diff -Nru snapd-2.45.1+20.04.2/arch/arch.go snapd-2.48.3+20.04/arch/arch.go
--- snapd-2.45.1+20.04.2/arch/arch.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/arch/arch.go	2021-02-02 08:21:12.000000000 +0000
@@ -61,11 +61,11 @@
 		"amd64":   "amd64",
 		"arm":     "armhf",
 		"arm64":   "arm64",
+		"ppc":     "powerpc",
+		"ppc64":   "ppc64", // available in debian and other distros
 		"ppc64le": "ppc64el",
+		"riscv64": "riscv64",
 		"s390x":   "s390x",
-		"ppc":     "powerpc",
-		// available in debian and other distros
-		"ppc64": "ppc64",
 	}
 
 	// If we are running on an ARM platform we need to have a
@@ -100,16 +100,16 @@
 func dpkgArchFromKernelArch(utsMachine string) string {
 	kernelArchMapping := map[string]string{
 		// kernel  dpkg
-		"i686":    "i386",
-		"x86_64":  "amd64",
+		"aarch64": "arm64",
 		"armv7l":  "armhf",
 		"armv8l":  "arm64",
-		"aarch64": "arm64",
+		"i686":    "i386",
+		"ppc":     "powerpc",
+		"ppc64":   "ppc64", // available in debian and other distros
 		"ppc64le": "ppc64el",
+		"riscv64": "riscv64",
 		"s390x":   "s390x",
-		"ppc":     "powerpc",
-		// available in debian and other distros
-		"ppc64": "ppc64",
+		"x86_64":  "amd64",
 	}
 
 	dpkgArch := kernelArchMapping[utsMachine]
diff -Nru snapd-2.45.1+20.04.2/arch/arch_test.go snapd-2.48.3+20.04/arch/arch_test.go
--- snapd-2.45.1+20.04.2/arch/arch_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/arch/arch_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -38,11 +38,11 @@
 	c.Check(dpkgArchFromGoArch("amd64"), Equals, "amd64")
 	c.Check(dpkgArchFromGoArch("arm"), Equals, "armhf")
 	c.Check(dpkgArchFromGoArch("arm64"), Equals, "arm64")
-	c.Check(dpkgArchFromGoArch("ppc64le"), Equals, "ppc64el")
-	c.Check(dpkgArchFromGoArch("ppc64"), Equals, "ppc64")
-	c.Check(dpkgArchFromGoArch("s390x"), Equals, "s390x")
 	c.Check(dpkgArchFromGoArch("ppc"), Equals, "powerpc")
 	c.Check(dpkgArchFromGoArch("ppc64"), Equals, "ppc64")
+	c.Check(dpkgArchFromGoArch("ppc64le"), Equals, "ppc64el")
+	c.Check(dpkgArchFromGoArch("riscv64"), Equals, "riscv64")
+	c.Check(dpkgArchFromGoArch("s390x"), Equals, "s390x")
 }
 
 func (ts *ArchTestSuite) TestArchSetArchitecture(c *C) {
diff -Nru snapd-2.45.1+20.04.2/asserts/asserts.go snapd-2.48.3+20.04/asserts/asserts.go
--- snapd-2.45.1+20.04.2/asserts/asserts.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/asserts.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2017 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -34,7 +34,8 @@
 type typeFlags int
 
 const (
-	noAuthority typeFlags = iota + 1
+	noAuthority typeFlags = 1 << iota
+	sequenceForming
 )
 
 // MetaHeaders is a list of headers in assertions which are about the assertion
@@ -65,11 +66,21 @@
 	return maxSupportedFormat[at.Name]
 }
 
+// SequencingForming returns true if the assertion type has a positive
+// integer >= 1 as the last component (preferably called "sequence")
+// of its primary key over which the assertions of the type form
+// sequences, usually without gaps, one sequence per sequence key (the
+// primary key prefix omitting the sequence number).
+// See SequenceMember.
+func (at *AssertionType) SequenceForming() bool {
+	return at.flags&sequenceForming != 0
+}
+
 // Understood assertion types.
 var (
 	AccountType         = &AssertionType{"account", []string{"account-id"}, assembleAccount, 0}
 	AccountKeyType      = &AssertionType{"account-key", []string{"public-key-sha3-384"}, assembleAccountKey, 0}
-	RepairType          = &AssertionType{"repair", []string{"brand-id", "repair-id"}, assembleRepair, 0}
+	RepairType          = &AssertionType{"repair", []string{"brand-id", "repair-id"}, assembleRepair, sequenceForming}
 	ModelType           = &AssertionType{"model", []string{"series", "brand-id", "model"}, assembleModel, 0}
 	SerialType          = &AssertionType{"serial", []string{"brand-id", "model", "serial"}, assembleSerial, 0}
 	BaseDeclarationType = &AssertionType{"base-declaration", []string{"series"}, assembleBaseDeclaration, 0}
@@ -79,6 +90,7 @@
 	SnapDeveloperType   = &AssertionType{"snap-developer", []string{"snap-id", "publisher-id"}, assembleSnapDeveloper, 0}
 	SystemUserType      = &AssertionType{"system-user", []string{"brand-id", "email"}, assembleSystemUser, 0}
 	ValidationType      = &AssertionType{"validation", []string{"series", "snap-id", "approved-snap-id", "approved-snap-revision"}, assembleValidation, 0}
+	ValidationSetType   = &AssertionType{"validation-set", []string{"series", "account-id", "name", "sequence"}, assembleValidationSet, sequenceForming}
 	StoreType           = &AssertionType{"store", []string{"store"}, assembleStore, 0}
 
 // ...
@@ -103,6 +115,7 @@
 	SnapDeveloperType.Name:   SnapDeveloperType,
 	SystemUserType.Name:      SystemUserType,
 	ValidationType.Name:      ValidationType,
+	ValidationSetType.Name:   ValidationSetType,
 	RepairType.Name:          RepairType,
 	StoreType.Name:           StoreType,
 	// no authority
@@ -138,6 +151,9 @@
 	// 3: support for on-store/on-brand/on-model device scope constraints
 	// 4: support for plug-names/slot-names constraints
 	maxSupportedFormat[SnapDeclarationType.Name] = 4
+
+	// 1: support to limit to device serials
+	maxSupportedFormat[SystemUserType.Name] = 1
 }
 
 func MockMaxSupportedFormat(assertType *AssertionType, maxFormat int) (restore func()) {
@@ -150,6 +166,25 @@
 
 var formatAnalyzer = map[*AssertionType]func(headers map[string]interface{}, body []byte) (formatnum int, err error){
 	SnapDeclarationType: snapDeclarationFormatAnalyze,
+	SystemUserType:      systemUserFormatAnalyze,
+}
+
+// MaxSupportedFormats returns a mapping between assertion type names
+// and corresponding max supported format if it is >= min. Typical
+// usage passes 1 or 0 for min.
+func MaxSupportedFormats(min int) (maxFormats map[string]int) {
+	if min == 0 {
+		maxFormats = make(map[string]int, len(typeRegistry))
+	} else {
+		maxFormats = make(map[string]int)
+	}
+	for name := range typeRegistry {
+		m := maxSupportedFormat[name]
+		if m >= min {
+			maxFormats[name] = m
+		}
+	}
+	return maxFormats
 }
 
 // SuggestFormat returns a minimum format that supports the features that would be used by an assertion with the given components.
@@ -188,15 +223,19 @@
 // corresponding to a primary key under the assertion type, it errors
 // if there are missing primary key headers.
 func PrimaryKeyFromHeaders(assertType *AssertionType, headers map[string]string) (primaryKey []string, err error) {
-	primaryKey = make([]string, len(assertType.PrimaryKey))
-	for i, k := range assertType.PrimaryKey {
+	return keysFromHeaders(assertType.PrimaryKey, headers)
+}
+
+func keysFromHeaders(keys []string, headers map[string]string) (keyValues []string, err error) {
+	keyValues = make([]string, len(keys))
+	for i, k := range keys {
 		keyVal := headers[k]
 		if keyVal == "" {
 			return nil, fmt.Errorf("must provide primary key: %v", k)
 		}
-		primaryKey[i] = keyVal
+		keyValues[i] = keyVal
 	}
-	return primaryKey, nil
+	return keyValues, nil
 }
 
 // Ref expresses a reference to an assertion.
@@ -237,6 +276,23 @@
 	return find(ref.Type, headers)
 }
 
+const RevisionNotKnown = -1
+
+// AtRevision represents an assertion at a given revision, possibly
+// not known (RevisionNotKnown).
+type AtRevision struct {
+	Ref
+	Revision int
+}
+
+func (at *AtRevision) String() string {
+	s := at.Ref.String()
+	if at.Revision == RevisionNotKnown {
+		return s
+	}
+	return fmt.Sprintf("%s at revision %d", s, at.Revision)
+}
+
 // Assertion represents an assertion through its general elements.
 type Assertion interface {
 	// Type returns the type of this assertion
@@ -275,6 +331,17 @@
 
 	// Ref returns a reference representing this assertion.
 	Ref() *Ref
+
+	// At returns an AtRevision referencing this assertion at its revision.
+	At() *AtRevision
+}
+
+// SequenceMember is implemented by assertions of sequence forming types.
+type SequenceMember interface {
+	Assertion
+
+	// Sequence returns the sequence number of this assertion.
+	Sequence() int
 }
 
 // customSigner represents an assertion with special arrangements for its signing key (e.g. self-signed), rather than the usual case where an assertion is signed by its authority.
@@ -380,6 +447,11 @@
 	}
 }
 
+// At returns an AtRevision referencing this assertion at its revision.
+func (ab *assertionBase) At() *AtRevision {
+	return &AtRevision{Ref: *ab.Ref(), Revision: ab.Revision()}
+}
+
 // sanity check
 var _ Assertion = (*assertionBase)(nil)
 
diff -Nru snapd-2.45.1+20.04.2/asserts/asserts_test.go snapd-2.48.3+20.04/asserts/asserts_test.go
--- snapd-2.45.1+20.04.2/asserts/asserts_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/asserts_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -65,12 +65,37 @@
 		"system-user",
 		"test-only",
 		"test-only-2",
+		"test-only-decl",
 		"test-only-no-authority",
 		"test-only-no-authority-pk",
+		"test-only-rev",
+		"test-only-seq",
 		"validation",
+		"validation-set",
 	})
 }
 
+func (as *assertsSuite) TestMaxSupportedFormats(c *C) {
+	snapDeclMaxFormat := asserts.SnapDeclarationType.MaxSupportedFormat()
+	systemUserMaxFormat := asserts.SystemUserType.MaxSupportedFormat()
+	// sanity
+	c.Check(snapDeclMaxFormat >= 4, Equals, true)
+	c.Check(systemUserMaxFormat >= 1, Equals, true)
+	c.Check(asserts.MaxSupportedFormats(1), DeepEquals, map[string]int{
+		"snap-declaration": snapDeclMaxFormat,
+		"system-user":      systemUserMaxFormat,
+		"test-only":        1,
+		"test-only-seq":    2,
+	})
+
+	// all
+	maxFormats := asserts.MaxSupportedFormats(0)
+	c.Assert(maxFormats, HasLen, len(asserts.TypeNames()))
+	c.Check(maxFormats["test-only"], Equals, 1)
+	c.Check(maxFormats["test-only-2"], Equals, 0)
+	c.Check(maxFormats["snap-declaration"], Equals, snapDeclMaxFormat)
+}
+
 func (as *assertsSuite) TestSuggestFormat(c *C) {
 	fmtnum, err := asserts.SuggestFormat(asserts.Type("test-only-2"), nil, nil)
 	c.Assert(err, IsNil)
@@ -163,6 +188,24 @@
 	c.Check(err, ErrorMatches, `"test-only-2" assertion reference primary key has the wrong length \(expected \[pk1 pk2\]\): \[abc\]`)
 }
 
+func (as *assertsSuite) TestAtRevisionString(c *C) {
+	ref := asserts.Ref{
+		Type:       asserts.AccountType,
+		PrimaryKey: []string{"canonical"},
+	}
+
+	at := &asserts.AtRevision{
+		Ref: ref,
+	}
+	c.Check(at.String(), Equals, "account (canonical) at revision 0")
+
+	at = &asserts.AtRevision{
+		Ref:      ref,
+		Revision: asserts.RevisionNotKnown,
+	}
+	c.Check(at.String(), Equals, "account (canonical)")
+}
+
 const exKeyID = "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij"
 
 const exampleEmptyBodyAllDefaults = "type: test-only\n" +
@@ -331,7 +374,9 @@
 		{"type: test-only\n", "type: unknown\n", `unknown assertion type: "unknown"`},
 		{"revision: 0\n", "revision: Z\n", `assertion: "revision" header is not an integer: Z`},
 		{"revision: 0\n", "revision:\n  - 1\n", `assertion: "revision" header is not an integer: \[1\]`},
+		{"revision: 0\n", "revision: 00\n", `assertion: "revision" header has invalid prefix zeros: 00`},
 		{"revision: 0\n", "revision: -10\n", "assertion: revision should be positive: -10"},
+		{"revision: 0\n", "revision: 99999999999999999999\n", `assertion: "revision" header is out of range: 99999999999999999999`},
 		{"format: 0\n", "format: Z\n", `assertion: "format" header is not an integer: Z`},
 		{"format: 0\n", "format: -10\n", "assertion: format should be positive: -10"},
 		{"primary-key: abc\n", "", `assertion test-only: "primary-key" header is mandatory`},
@@ -821,10 +866,19 @@
 		PrimaryKey: []string{"0"},
 	})
 
+	c.Check(a1.At(), DeepEquals, &asserts.AtRevision{
+		Ref: asserts.Ref{
+			Type:       asserts.TestOnlyType,
+			PrimaryKey: []string{"0"},
+		},
+		Revision: 0,
+	})
+
 	headers = map[string]interface{}{
 		"authority-id": "auth-id1",
 		"pk1":          "a",
 		"pk2":          "b",
+		"revision":     "1",
 	}
 	a2, err := asserts.AssembleAndSignInTest(asserts.TestOnly2Type, headers, nil, testPrivKey1)
 	c.Assert(err, IsNil)
@@ -833,6 +887,14 @@
 		Type:       asserts.TestOnly2Type,
 		PrimaryKey: []string{"a", "b"},
 	})
+
+	c.Check(a2.At(), DeepEquals, &asserts.AtRevision{
+		Ref: asserts.Ref{
+			Type:       asserts.TestOnly2Type,
+			PrimaryKey: []string{"a", "b"},
+		},
+		Revision: 1,
+	})
 }
 
 func (as *assertsSuite) TestAssembleHeadersCheck(c *C) {
@@ -888,6 +950,7 @@
 		"serial",
 		"system-user",
 		"validation",
+		"validation-set",
 		"repair",
 	}
 	c.Check(withAuthority, HasLen, asserts.NumAssertionType-3) // excluding device-session-request, serial-request, account-key-request
@@ -897,3 +960,16 @@
 		c.Check(err, ErrorMatches, `"authority-id" header is mandatory`)
 	}
 }
+
+func (as *assertsSuite) TestSequenceForming(c *C) {
+	sequenceForming := []string{
+		"repair",
+		"validation-set",
+	}
+	for _, name := range sequenceForming {
+		typ := asserts.Type(name)
+		c.Check(typ.SequenceForming(), Equals, true)
+	}
+
+	c.Check(asserts.SnapDeclarationType.SequenceForming(), Equals, false)
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/database.go snapd-2.48.3+20.04/asserts/database.go
--- snapd-2.45.1+20.04.2/asserts/database.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/database.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -65,6 +65,14 @@
 	// Search returns assertions matching the given headers.
 	// It invokes foundCb for each found assertion.
 	Search(assertType *AssertionType, headers map[string]string, foundCb func(Assertion), maxFormat int) error
+	// SequenceMemberAfter returns for a sequence-forming assertType the
+	// first assertion in the sequence under the given sequenceKey
+	// with sequence number larger than after. If after==-1 it
+	// returns the assertion with largest sequence number. If none
+	// exists it returns a NotFoundError, usually with omitted
+	// Headers. If assertType is not sequence-forming it can
+	// panic.
+	SequenceMemberAfter(assertType *AssertionType, sequenceKey []string, after, maxFormat int) (SequenceMember, error)
 }
 
 type nullBackstore struct{}
@@ -81,6 +89,10 @@
 	return nil
 }
 
+func (nbs nullBackstore) SequenceMemberAfter(t *AssertionType, kp []string, after, maxFormat int) (SequenceMember, error) {
+	return nil, &NotFoundError{Type: t}
+}
+
 // A KeypairManager is a manager and backstore for private/public key pairs.
 type KeypairManager interface {
 	// Put stores the given private/public key pair,
@@ -574,6 +586,80 @@
 	return db.findMany([]Backstore{db.trusted, db.predefined}, assertionType, headers)
 }
 
+// FindSequence finds an assertion for the given headers and after for
+// a sequence-forming type.
+// The provided headers must contain a sequence key, i.e. a prefix of
+// the primary key for the assertion type except for the sequence
+// number header.
+// The assertion is the first in the sequence under the sequence key
+// with sequence number > after.
+// If after is -1 it returns instead the assertion with the largest
+// sequence number.
+// It will constraint itself to assertions with format <= maxFormat
+// unless maxFormat is -1.
+// It returns a NotFoundError if the assertion cannot be found.
+func (db *Database) FindSequence(assertType *AssertionType, sequenceHeaders map[string]string, after, maxFormat int) (SequenceMember, error) {
+	err := checkAssertType(assertType)
+	if err != nil {
+		return nil, err
+	}
+	if !assertType.SequenceForming() {
+		return nil, fmt.Errorf("cannot use FindSequence with non sequence-forming assertion type %q", assertType.Name)
+	}
+	maxSupp := assertType.MaxSupportedFormat()
+	if maxFormat == -1 {
+		maxFormat = maxSupp
+	} else {
+		if maxFormat > maxSupp {
+			return nil, fmt.Errorf("cannot find %q assertions for format %d higher than supported format %d", assertType.Name, maxFormat, maxSupp)
+		}
+	}
+
+	// form the sequence key using all keys but the last one which
+	// is the sequence number
+	seqKey, err := keysFromHeaders(assertType.PrimaryKey[:len(assertType.PrimaryKey)-1], sequenceHeaders)
+	if err != nil {
+		return nil, err
+	}
+
+	// find the better result across backstores' results
+	better := func(cur, a SequenceMember) SequenceMember {
+		if cur == nil {
+			return a
+		}
+		curSeq := cur.Sequence()
+		aSeq := a.Sequence()
+		if after == -1 {
+			if aSeq > curSeq {
+				return a
+			}
+		} else {
+			if aSeq < curSeq {
+				return a
+			}
+		}
+		return cur
+	}
+
+	var assert SequenceMember
+	for _, bs := range db.backstores {
+		a, err := bs.SequenceMemberAfter(assertType, seqKey, after, maxFormat)
+		if err == nil {
+			assert = better(assert, a)
+			continue
+		}
+		if !IsNotFound(err) {
+			return nil, err
+		}
+	}
+
+	if assert != nil {
+		return assert, nil
+	}
+
+	return nil, &NotFoundError{Type: assertType, Headers: sequenceHeaders}
+}
+
 // assertion checkers
 
 // CheckSigningKeyIsNotExpired checks that the signing key is not expired.
diff -Nru snapd-2.45.1+20.04.2/asserts/database_test.go snapd-2.48.3+20.04/asserts/database_test.go
--- snapd-2.45.1+20.04.2/asserts/database_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/database_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -1238,6 +1238,117 @@
 	})
 }
 
+func (safs *signAddFindSuite) TestFindSequence(c *C) {
+	headers := map[string]interface{}{
+		"authority-id": "canonical",
+		"n":            "s1",
+		"sequence":     "1",
+	}
+	sq1f0, err := safs.signingDB.Sign(asserts.TestOnlySeqType, headers, nil, safs.signingKeyID)
+	c.Assert(err, IsNil)
+
+	headers = map[string]interface{}{
+		"authority-id": "canonical",
+		"n":            "s1",
+		"sequence":     "2",
+	}
+	sq2f0, err := safs.signingDB.Sign(asserts.TestOnlySeqType, headers, nil, safs.signingKeyID)
+	c.Assert(err, IsNil)
+
+	headers = map[string]interface{}{
+		"authority-id": "canonical",
+		"format":       "1",
+		"n":            "s1",
+		"sequence":     "2",
+		"revision":     "1",
+	}
+	sq2f1, err := safs.signingDB.Sign(asserts.TestOnlySeqType, headers, nil, safs.signingKeyID)
+	c.Assert(err, IsNil)
+
+	headers = map[string]interface{}{
+		"authority-id": "canonical",
+		"format":       "1",
+		"n":            "s1",
+		"sequence":     "3",
+	}
+	sq3f1, err := safs.signingDB.Sign(asserts.TestOnlySeqType, headers, nil, safs.signingKeyID)
+	c.Assert(err, IsNil)
+
+	headers = map[string]interface{}{
+		"authority-id": "canonical",
+		"format":       "2",
+		"n":            "s1",
+		"sequence":     "3",
+		"revision":     "1",
+	}
+	sq3f2, err := safs.signingDB.Sign(asserts.TestOnlySeqType, headers, nil, safs.signingKeyID)
+	c.Assert(err, IsNil)
+
+	for _, a := range []asserts.Assertion{sq1f0, sq2f0, sq2f1, sq3f1} {
+
+		err = safs.db.Add(a)
+		c.Assert(err, IsNil)
+	}
+
+	// stack a backstore, for test completeness, this is an unlikely
+	// scenario atm
+	bs := asserts.NewMemoryBackstore()
+	db := safs.db.WithStackedBackstore(bs)
+	err = db.Add(sq3f2)
+	c.Assert(err, IsNil)
+
+	seqHeaders := map[string]string{
+		"n": "s1",
+	}
+	tests := []struct {
+		after     int
+		maxFormat int
+		sequence  int
+		format    int
+		revision  int
+	}{
+		{after: 0, maxFormat: 0, sequence: 1, format: 0, revision: 0},
+		{after: 0, maxFormat: 2, sequence: 1, format: 0, revision: 0},
+		{after: 1, maxFormat: 0, sequence: 2, format: 0, revision: 0},
+		{after: 1, maxFormat: 1, sequence: 2, format: 1, revision: 1},
+		{after: 1, maxFormat: 2, sequence: 2, format: 1, revision: 1},
+		{after: 2, maxFormat: 0, sequence: -1},
+		{after: 2, maxFormat: 1, sequence: 3, format: 1, revision: 0},
+		{after: 2, maxFormat: 2, sequence: 3, format: 2, revision: 1},
+		{after: 3, maxFormat: 0, sequence: -1},
+		{after: 3, maxFormat: 2, sequence: -1},
+		{after: 4, maxFormat: 2, sequence: -1},
+		{after: -1, maxFormat: 0, sequence: 2, format: 0, revision: 0},
+		{after: -1, maxFormat: 1, sequence: 3, format: 1, revision: 0},
+		{after: -1, maxFormat: 2, sequence: 3, format: 2, revision: 1},
+	}
+
+	for _, t := range tests {
+		a, err := db.FindSequence(asserts.TestOnlySeqType, seqHeaders, t.after, t.maxFormat)
+		if t.sequence == -1 {
+			c.Check(err, DeepEquals, &asserts.NotFoundError{
+				Type:    asserts.TestOnlySeqType,
+				Headers: seqHeaders,
+			})
+		} else {
+			c.Assert(err, IsNil)
+			c.Assert(a.HeaderString("n"), Equals, "s1")
+			c.Check(a.Sequence(), Equals, t.sequence)
+			c.Check(a.Format(), Equals, t.format)
+			c.Check(a.Revision(), Equals, t.revision)
+		}
+	}
+
+	seqHeaders = map[string]string{
+		"n": "s2",
+	}
+	_, err = db.FindSequence(asserts.TestOnlySeqType, seqHeaders, -1, 2)
+	c.Check(err, DeepEquals, &asserts.NotFoundError{
+		Type: asserts.TestOnlySeqType, Headers: seqHeaders,
+	})
+
+}
+
 type revisionErrorSuite struct{}
 
 func (res *revisionErrorSuite) TestErrorText(c *C) {
diff -Nru snapd-2.45.1+20.04.2/asserts/export_test.go snapd-2.48.3+20.04/asserts/export_test.go
--- snapd-2.45.1+20.04.2/asserts/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -22,6 +22,8 @@
 import (
 	"io"
 	"time"
+
+	"github.com/snapcore/snapd/asserts/internal"
 )
 
 // expose test-only things here
@@ -112,6 +114,90 @@
 
 var TestOnly2Type = &AssertionType{"test-only-2", []string{"pk1", "pk2"}, assembleTestOnly2, 0}
 
+// TestOnlyDecl is a test-only assertion that mimics snap-declaration
+// relations with other assertions.
+type TestOnlyDecl struct {
+	assertionBase
+}
+
+func (dcl *TestOnlyDecl) ID() string {
+	return dcl.HeaderString("id")
+}
+
+func (dcl *TestOnlyDecl) DevID() string {
+	return dcl.HeaderString("dev-id")
+}
+
+func (dcl *TestOnlyDecl) Prerequisites() []*Ref {
+	return []*Ref{
+		{Type: AccountType, PrimaryKey: []string{dcl.DevID()}},
+	}
+}
+
+func assembleTestOnlyDecl(assert assertionBase) (Assertion, error) {
+	return &TestOnlyDecl{assert}, nil
+}
+
+var TestOnlyDeclType = &AssertionType{"test-only-decl", []string{"id"}, assembleTestOnlyDecl, 0}
+
+// TestOnlyRev is a test-only assertion that mimics snap-revision
+// relations with other assertions.
+type TestOnlyRev struct {
+	assertionBase
+}
+
+func (rev *TestOnlyRev) H() string {
+	return rev.HeaderString("h")
+}
+
+func (rev *TestOnlyRev) ID() string {
+	return rev.HeaderString("id")
+}
+
+func (rev *TestOnlyRev) DevID() string {
+	return rev.HeaderString("dev-id")
+}
+
+func (rev *TestOnlyRev) Prerequisites() []*Ref {
+	return []*Ref{
+		{Type: TestOnlyDeclType, PrimaryKey: []string{rev.ID()}},
+		{Type: AccountType, PrimaryKey: []string{rev.DevID()}},
+	}
+}
+
+func assembleTestOnlyRev(assert assertionBase) (Assertion, error) {
+	return &TestOnlyRev{assert}, nil
+}
+
+var TestOnlyRevType = &AssertionType{"test-only-rev", []string{"h"}, assembleTestOnlyRev, 0}
+
+// TestOnlySeq is a test-only assertion that is sequence-forming.
+type TestOnlySeq struct {
+	assertionBase
+	seq int
+}
+
+func (seq *TestOnlyRev) N() string {
+	return seq.HeaderString("n")
+}
+
+func (seq *TestOnlySeq) Sequence() int {
+	return seq.seq
+}
+
+func assembleTestOnlySeq(assert assertionBase) (Assertion, error) {
+	seq, err := checkSequence(assert.headers, "sequence")
+	if err != nil {
+		return nil, err
+	}
+	return &TestOnlySeq{
+		assertionBase: assert,
+		seq:           seq,
+	}, nil
+}
+
+var TestOnlySeqType = &AssertionType{"test-only-seq", []string{"n", "sequence"}, assembleTestOnlySeq, sequenceForming}
+
 type TestOnlyNoAuthority struct {
 	assertionBase
 }
@@ -147,6 +233,10 @@
 		}
 		return 0, nil
 	}
+	typeRegistry[TestOnlyDeclType.Name] = TestOnlyDeclType
+	typeRegistry[TestOnlyRevType.Name] = TestOnlyRevType
+	typeRegistry[TestOnlySeqType.Name] = TestOnlySeqType
+	maxSupportedFormat[TestOnlySeqType.Name] = 2
 }
 
 // AccountKeyIsKeyValidAt exposes isKeyValidAt on AccountKey for tests
@@ -196,3 +286,9 @@
 func (b *Batch) DoPrecheck(db *Database) error {
 	return b.precheck(db)
 }
+
+// pool tests
+
+func MakePoolGrouping(elems ...uint16) Grouping {
+	return Grouping(internal.Serialize(elems))
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/findwildcard.go snapd-2.48.3+20.04/asserts/findwildcard.go
--- snapd-2.45.1+20.04.2/asserts/findwildcard.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/findwildcard.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,8 +21,11 @@
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
+	"sort"
+	"strconv"
 	"strings"
 )
 
@@ -31,14 +34,21 @@
 
 <top>/<descendantWithWildcard[0]>/<descendantWithWildcard[1]>...
 
-where each descendantWithWildcard component can contain the * wildcard;
+where each descendantWithWildcard component can contain the * wildcard.
+
+One of the descendantWithWildcard components except the last
+can be "#>" or "#<", in which case that level is assumed to have names
+that can be parsed as positive integers, which will be enumerated in
+ascending (#>) or descending order respectively (#<); if seqnum != -1
+then only the values >seqnum or respectively <seqnum will be
+considered.
 
 foundCb is invoked with the paths of the found regular files relative to top (that means top/ is excluded).
 
 Unlike filepath.Glob any I/O operation error stops the walking and bottoms out, so does a foundCb invocation that returns an error.
 */
-func findWildcard(top string, descendantWithWildcard []string, foundCb func(relpath []string) error) error {
-	return findWildcardDescend(top, top, descendantWithWildcard, foundCb)
+func findWildcard(top string, descendantWithWildcard []string, seqnum int, foundCb func(relpath []string) error) error {
+	return findWildcardDescend(top, top, descendantWithWildcard, seqnum, foundCb)
 }
 
 func findWildcardBottom(top, current string, pat string, names []string, foundCb func(relpath []string) error) error {
@@ -74,13 +84,21 @@
 	return foundCb(hits)
 }
 
-func findWildcardDescend(top, current string, descendantWithWildcard []string, foundCb func(relpath []string) error) error {
+func findWildcardDescend(top, current string, descendantWithWildcard []string, seqnum int, foundCb func(relpath []string) error) error {
 	k := descendantWithWildcard[0]
+	if k == "#>" || k == "#<" {
+		if len(descendantWithWildcard) == 1 {
+			return fmt.Errorf("findWildcard: sequence wildcard (#>|<#) cannot be the last component")
+		}
+		return findWildcardSequence(top, current, k, descendantWithWildcard[1:], seqnum, foundCb)
+	}
 	if len(descendantWithWildcard) > 1 && strings.IndexByte(k, '*') == -1 {
-		return findWildcardDescend(top, filepath.Join(current, k), descendantWithWildcard[1:], foundCb)
+		return findWildcardDescend(top, filepath.Join(current, k), descendantWithWildcard[1:], seqnum, foundCb)
 	}
 
 	d, err := os.Open(current)
+	// ignore missing directory, higher level will produce
+	// NotFoundError as needed
 	if os.IsNotExist(err) {
 		return nil
 	}
@@ -101,11 +119,69 @@
 			return fmt.Errorf("findWildcard: invoked with malformed wildcard: %v", err)
 		}
 		if ok {
-			err = findWildcardDescend(top, filepath.Join(current, name), descendantWithWildcard[1:], foundCb)
+			err = findWildcardDescend(top, filepath.Join(current, name), descendantWithWildcard[1:], seqnum, foundCb)
 			if err != nil {
 				return err
 			}
 		}
 	}
 	return nil
+}
+
+func findWildcardSequence(top, current, seqWildcard string, descendantWithWildcard []string, seqnum int, foundCb func(relpath []string) error) error {
+	filter := func(i int) bool { return true }
+	if seqnum != -1 {
+		if seqWildcard == "#>" {
+			filter = func(i int) bool { return i > seqnum }
+		} else { // "#<", guaranteed by the caller
+			filter = func(i int) bool { return i < seqnum }
+		}
+	}
+
+	d, err := os.Open(current)
+	// ignore missing directory, higher level will produce
+	// NotFoundError as needed
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	defer d.Close()
+	var seq []int
+	for {
+		names, err := d.Readdirnames(100)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		for _, n := range names {
+			sqn, err := strconv.Atoi(n)
+			if err != nil || sqn < 0 || prefixZeros(n) {
+				return fmt.Errorf("cannot parse %q name as a valid sequence number", filepath.Join(current, n))
+			}
+			if filter(sqn) {
+				seq = append(seq, sqn)
+			}
+		}
+	}
+	sort.Ints(seq)
+
+	var start, direction int
+	if seqWildcard == "#>" {
+		start = 0
+		direction = 1
+	} else {
+		start = len(seq) - 1
+		direction = -1
+	}
+	for i := start; i >= 0 && i < len(seq); i += direction {
+		err = findWildcardDescend(top, filepath.Join(current, strconv.Itoa(seq[i])), descendantWithWildcard, -1, foundCb)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/asserts/findwildcard_test.go snapd-2.48.3+20.04/asserts/findwildcard_test.go
--- snapd-2.45.1+20.04.2/asserts/findwildcard_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/findwildcard_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -64,40 +64,40 @@
 		return nil
 	}
 
-	err = findWildcard(top, []string{"*", "*", "active"}, foundCb)
+	err = findWildcard(top, []string{"*", "*", "active"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	sort.Strings(res)
 	c.Check(res, check.DeepEquals, []string{"acc-id1/abcd/active", "acc-id1/e5cd/active", "acc-id2/f444/active"})
 
 	res = nil
-	err = findWildcard(top, []string{"*", "*", "active*"}, foundCb)
+	err = findWildcard(top, []string{"*", "*", "active*"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	sort.Strings(res)
 	c.Check(res, check.DeepEquals, []string{"acc-id1/abcd/active", "acc-id1/abcd/active.1", "acc-id1/e5cd/active", "acc-id2/f444/active"})
 
 	res = nil
-	err = findWildcard(top, []string{"zoo", "*", "active"}, foundCb)
+	err = findWildcard(top, []string{"zoo", "*", "active"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	c.Check(res, check.HasLen, 0)
 
 	res = nil
-	err = findWildcard(top, []string{"zoo", "*", "active*"}, foundCb)
+	err = findWildcard(top, []string{"zoo", "*", "active*"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	c.Check(res, check.HasLen, 0)
 
 	res = nil
-	err = findWildcard(top, []string{"a*", "zoo", "active"}, foundCb)
+	err = findWildcard(top, []string{"a*", "zoo", "active"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	c.Check(res, check.HasLen, 0)
 
 	res = nil
-	err = findWildcard(top, []string{"acc-id1", "*cd", "active"}, foundCb)
+	err = findWildcard(top, []string{"acc-id1", "*cd", "active"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	sort.Strings(res)
 	c.Check(res, check.DeepEquals, []string{"acc-id1/abcd/active", "acc-id1/e5cd/active"})
 
 	res = nil
-	err = findWildcard(top, []string{"acc-id1", "*cd", "active*"}, foundCb)
+	err = findWildcard(top, []string{"acc-id1", "*cd", "active*"}, 0, foundCb)
 	c.Assert(err, check.IsNil)
 	sort.Strings(res)
 	c.Check(res, check.DeepEquals, []string{"acc-id1/abcd/active", "acc-id1/abcd/active.1", "acc-id1/e5cd/active"})
@@ -129,11 +129,154 @@
 
 	myErr := errors.New("boom")
 	retErr = myErr
-	err = findWildcard(top, []string{"acc-id1", "*"}, foundCb)
+	err = findWildcard(top, []string{"acc-id1", "*"}, 0, foundCb)
 	c.Check(err, check.Equals, myErr)
 
 	retErr = nil
 	res = nil
-	err = findWildcard(top, []string{"acc-id2", "*"}, foundCb)
+	err = findWildcard(top, []string{"acc-id2", "*"}, 0, foundCb)
 	c.Check(err, check.ErrorMatches, "expected a regular file: .*")
 }
+
+func (fs *findWildcardSuite) TestFindWildcardSequence(c *check.C) {
+	top := filepath.Join(c.MkDir(), "top")
+
+	err := os.MkdirAll(top, os.ModePerm)
+	c.Assert(err, check.IsNil)
+
+	files := []string{
+		"s1/3/active.1",
+		"s1/3/active.2",
+		"s1/2/active",
+		"s1/2/active.1",
+		"s1/1/active",
+	}
+	for _, fn := range files {
+		err := os.MkdirAll(filepath.Dir(filepath.Join(top, fn)), os.ModePerm)
+		c.Assert(err, check.IsNil)
+		err = ioutil.WriteFile(filepath.Join(top, fn), nil, os.ModePerm)
+		c.Assert(err, check.IsNil)
+	}
+
+	var res [][]string
+	foundCb := func(relpath []string) error {
+		res = append(res, relpath)
+		return nil
+	}
+
+	sort := func() {
+		for _, r := range res {
+			sort.Strings(r)
+		}
+	}
+
+	// ascending
+
+	err = findWildcard(top, []string{"s1", "#>", "active*"}, 1, foundCb)
+	c.Assert(err, check.IsNil)
+	sort()
+	c.Check(res, check.DeepEquals, [][]string{
+		{"s1/2/active", "s1/2/active.1"},
+		{"s1/3/active.1", "s1/3/active.2"},
+	})
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#>", "active*"}, 2, foundCb)
+	c.Assert(err, check.IsNil)
+	sort()
+	c.Check(res, check.DeepEquals, [][]string{
+		{"s1/3/active.1", "s1/3/active.2"},
+	})
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#>", "active*"}, 3, foundCb)
+	c.Assert(err, check.IsNil)
+	c.Check(res, check.HasLen, 0)
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#>", "active*"}, -1, foundCb)
+	c.Assert(err, check.IsNil)
+	sort()
+	c.Check(res, check.DeepEquals, [][]string{
+		{"s1/1/active"},
+		{"s1/2/active", "s1/2/active.1"},
+		{"s1/3/active.1", "s1/3/active.2"},
+	})
+
+	// descending
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#<", "active*"}, -1, foundCb)
+	c.Assert(err, check.IsNil)
+	sort()
+	c.Check(res, check.DeepEquals, [][]string{
+		{"s1/3/active.1", "s1/3/active.2"},
+		{"s1/2/active", "s1/2/active.1"},
+		{"s1/1/active"},
+	})
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#<", "active*"}, 3, foundCb)
+	c.Assert(err, check.IsNil)
+	sort()
+	c.Check(res, check.DeepEquals, [][]string{
+		{"s1/2/active", "s1/2/active.1"},
+		{"s1/1/active"},
+	})
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#<", "active*"}, 2, foundCb)
+	c.Assert(err, check.IsNil)
+	sort()
+	c.Check(res, check.DeepEquals, [][]string{
+		{"s1/1/active"},
+	})
+
+	res = nil
+	err = findWildcard(top, []string{"s1", "#<", "active*"}, 1, foundCb)
+	c.Assert(err, check.IsNil)
+	c.Check(res, check.HasLen, 0)
+
+	// missing dir
+	res = nil
+	err = findWildcard(top, []string{"s2", "#<", "active*"}, 1, foundCb)
+	c.Assert(err, check.IsNil)
+	c.Check(res, check.HasLen, 0)
+}
+
+func (fs *findWildcardSuite) TestFindWildcardSequenceSomeErrors(c *check.C) {
+	top := filepath.Join(c.MkDir(), "top-errors")
+
+	err := os.MkdirAll(top, os.ModePerm)
+	c.Assert(err, check.IsNil)
+
+	files := []string{
+		"s1/1/active",
+		"s2/a/active.1",
+		"s3/-9/active.1",
+		"s4/01/active",
+	}
+	for _, fn := range files {
+		err := os.MkdirAll(filepath.Dir(filepath.Join(top, fn)), os.ModePerm)
+		c.Assert(err, check.IsNil)
+		err = ioutil.WriteFile(filepath.Join(top, fn), nil, os.ModePerm)
+		c.Assert(err, check.IsNil)
+	}
+
+	myErr := errors.New("boom")
+	foundCb := func(relpath []string) error {
+		return myErr
+	}
+
+	err = findWildcard(top, []string{"s1", "#>", "active*"}, -1, foundCb)
+	c.Assert(err, check.Equals, myErr)
+
+	err = findWildcard(top, []string{"s2", "#>", "active*"}, -1, foundCb)
+	c.Assert(err, check.ErrorMatches, `cannot parse ".*/top-errors/s2/a" name as a valid sequence number`)
+
+	err = findWildcard(top, []string{"s3", "#>", "active*"}, -1, foundCb)
+	c.Assert(err, check.ErrorMatches, `cannot parse ".*/top-errors/s3/-9" name as a valid sequence number`)
+
+	err = findWildcard(top, []string{"s4", "#>", "active*"}, -1, foundCb)
+	c.Assert(err, check.ErrorMatches, `cannot parse ".*/top-errors/s4/01" name as a valid sequence number`)
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/fsbackstore.go snapd-2.48.3+20.04/asserts/fsbackstore.go
--- snapd-2.45.1+20.04.2/asserts/fsbackstore.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/fsbackstore.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -20,6 +20,7 @@
 package asserts
 
 import (
+	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -123,7 +124,7 @@
 
 	comps := diskPrimaryPathComps(primaryPath, "active*")
 	assertTypeTop := filepath.Join(fsbs.top, assertType.Name)
-	err := findWildcard(assertTypeTop, comps, namesCb)
+	err := findWildcard(assertTypeTop, comps, 0, namesCb)
 	if err != nil {
 		return nil, fmt.Errorf("broken assertion storage, looking for %s: %v", assertType.Name, err)
 	}
@@ -189,7 +190,7 @@
 		foundCb(a)
 		return nil
 	}
-	err := findWildcard(assertTypeTop, diskPattern, candCb)
+	err := findWildcard(assertTypeTop, diskPattern, 0, candCb)
 	if err != nil {
 		return fmt.Errorf("broken assertion storage, searching for %s: %v", assertType.Name, err)
 	}
@@ -219,3 +220,56 @@
 	}
 	return fsbs.search(assertType, diskPattern, candCb, maxFormat)
 }
+
+// errFound marks the case an assertion was found
+var errFound = errors.New("found")
+
+func (fsbs *filesystemBackstore) SequenceMemberAfter(assertType *AssertionType, sequenceKey []string, after, maxFormat int) (SequenceMember, error) {
+	if !assertType.SequenceForming() {
+		panic(fmt.Sprintf("internal error: SequenceMemberAfter on non sequence-forming assertion type %s", assertType.Name))
+	}
+	if len(sequenceKey) != len(assertType.PrimaryKey)-1 {
+		return nil, fmt.Errorf("internal error: SequenceMemberAfter's sequence key argument length must be exactly 1 less than the assertion type primary key")
+	}
+
+	fsbs.mu.RLock()
+	defer fsbs.mu.RUnlock()
+
+	n := len(assertType.PrimaryKey)
+	diskPattern := make([]string, n+1)
+	for i, k := range sequenceKey {
+		diskPattern[i] = url.QueryEscape(k)
+	}
+	seqWildcard := "#>" // ascending sequence wildcard
+	if after == -1 {
+		// find the latest in sequence
+		// use descending sequence wildcard
+		seqWildcard = "#<"
+	}
+	diskPattern[n-1] = seqWildcard
+	diskPattern[n] = "active*"
+
+	var a Assertion
+	candCb := func(diskPrimaryPaths []string) error {
+		var err error
+		a, err = fsbs.pickLatestAssertion(assertType, diskPrimaryPaths, maxFormat)
+		if err == errNotFound {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		return errFound
+	}
+
+	assertTypeTop := filepath.Join(fsbs.top, assertType.Name)
+	err := findWildcard(assertTypeTop, diskPattern, after, candCb)
+	if err == errFound {
+		return a.(SequenceMember), nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("broken assertion storage, searching for %s: %v", assertType.Name, err)
+	}
+
+	return nil, &NotFoundError{Type: assertType}
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/fsbackstore_test.go snapd-2.48.3+20.04/asserts/fsbackstore_test.go
--- snapd-2.45.1+20.04.2/asserts/fsbackstore_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/fsbackstore_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -256,3 +256,117 @@
 	c.Check(as[0].Revision(), Equals, 1)
 
 }
+
+func (fsbss *fsBackstoreSuite) TestSequenceMemberAfter(c *C) {
+	topDir := filepath.Join(c.MkDir(), "asserts-db")
+	bs, err := asserts.OpenFSBackstore(topDir)
+	c.Assert(err, IsNil)
+
+	other1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: other\n" +
+		"sequence: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq1f0, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: s1\n" +
+		"sequence: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq2f0, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: s1\n" +
+		"sequence: 2\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq2f1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 1\n" +
+		"n: s1\n" +
+		"sequence: 2\n" +
+		"revision: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq3f1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 1\n" +
+		"n: s1\n" +
+		"sequence: 3\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq3f2, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 2\n" +
+		"n: s1\n" +
+		"sequence: 3\n" +
+		"revision: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	for _, a := range []asserts.Assertion{other1, sq1f0, sq2f0, sq2f1, sq3f1, sq3f2} {
+		err = bs.Put(asserts.TestOnlySeqType, a)
+		c.Assert(err, IsNil)
+	}
+
+	seqKey := []string{"s1"}
+	tests := []struct {
+		after     int
+		maxFormat int
+		sequence  int
+		format    int
+		revision  int
+	}{
+		{after: 0, maxFormat: 0, sequence: 1, format: 0, revision: 0},
+		{after: 0, maxFormat: 2, sequence: 1, format: 0, revision: 0},
+		{after: 1, maxFormat: 0, sequence: 2, format: 0, revision: 0},
+		{after: 1, maxFormat: 1, sequence: 2, format: 1, revision: 1},
+		{after: 1, maxFormat: 2, sequence: 2, format: 1, revision: 1},
+		{after: 2, maxFormat: 0, sequence: -1},
+		{after: 2, maxFormat: 1, sequence: 3, format: 1, revision: 0},
+		{after: 2, maxFormat: 2, sequence: 3, format: 2, revision: 1},
+		{after: 3, maxFormat: 0, sequence: -1},
+		{after: 3, maxFormat: 2, sequence: -1},
+		{after: 4, maxFormat: 2, sequence: -1},
+		{after: -1, maxFormat: 0, sequence: 2, format: 0, revision: 0},
+		{after: -1, maxFormat: 1, sequence: 3, format: 1, revision: 0},
+		{after: -1, maxFormat: 2, sequence: 3, format: 2, revision: 1},
+	}
+
+	for _, t := range tests {
+		a, err := bs.SequenceMemberAfter(asserts.TestOnlySeqType, seqKey, t.after, t.maxFormat)
+		if t.sequence == -1 {
+			c.Check(err, DeepEquals, &asserts.NotFoundError{
+				Type: asserts.TestOnlySeqType,
+			})
+		} else {
+			c.Assert(err, IsNil)
+			c.Assert(a.HeaderString("n"), Equals, "s1")
+			c.Check(a.Sequence(), Equals, t.sequence)
+			c.Check(a.Format(), Equals, t.format)
+			c.Check(a.Revision(), Equals, t.revision)
+		}
+	}
+
+	_, err = bs.SequenceMemberAfter(asserts.TestOnlySeqType, []string{"s2"}, -1, 2)
+	c.Check(err, DeepEquals, &asserts.NotFoundError{
+		Type: asserts.TestOnlySeqType,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/gpgkeypairmgr.go snapd-2.48.3+20.04/asserts/gpgkeypairmgr.go
--- snapd-2.45.1+20.04.2/asserts/gpgkeypairmgr.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/gpgkeypairmgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,7 +32,7 @@
 )
 
 func ensureGPGHomeDirectory() (string, error) {
-	real, err := osutil.RealUser()
+	real, err := osutil.UserMaybeSudoUser()
 	if err != nil {
 		return "", err
 	}
diff -Nru snapd-2.45.1+20.04.2/asserts/header_checks.go snapd-2.48.3+20.04/asserts/header_checks.go
--- snapd-2.45.1+20.04.2/asserts/header_checks.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/header_checks.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -116,25 +116,54 @@
 	if !ok {
 		return -1, fmt.Errorf("%q header is not an integer: %v", name, value)
 	}
-	m, err := strconv.Atoi(s)
+	m, err := atoi(s, "%q %s", name, "header")
 	if err != nil {
-		return -1, fmt.Errorf("%q header is not an integer: %v", name, s)
+		return -1, err
 	}
 	return m, nil
 }
 
 func checkInt(headers map[string]interface{}, name string) (int, error) {
-	valueStr, err := checkNotEmptyString(headers, name)
+	return checkIntWhat(headers, name, "header")
+}
+
+func checkIntWhat(headers map[string]interface{}, name, what string) (int, error) {
+	valueStr, err := checkNotEmptyStringWhat(headers, name, what)
 	if err != nil {
 		return -1, err
 	}
+	value, err := atoi(valueStr, "%q %s", name, what)
+	if err != nil {
+		return -1, err
+	}
+	return value, nil
+}
+
+type intSyntaxError string
+
+func (e intSyntaxError) Error() string {
+	return string(e)
+}
+
+func atoi(valueStr, whichFmt string, whichArgs ...interface{}) (int, error) {
 	value, err := strconv.Atoi(valueStr)
 	if err != nil {
-		return -1, fmt.Errorf("%q header is not an integer: %v", name, valueStr)
+		which := fmt.Sprintf(whichFmt, whichArgs...)
+		if ne, ok := err.(*strconv.NumError); ok && ne.Err == strconv.ErrRange {
+			return -1, fmt.Errorf("%s is out of range: %v", which, valueStr)
+		}
+		return -1, intSyntaxError(fmt.Sprintf("%s is not an integer: %v", which, valueStr))
+	}
+	if prefixZeros(valueStr) {
+		return -1, fmt.Errorf("%s has invalid prefix zeros: %s", fmt.Sprintf(whichFmt, whichArgs...), valueStr)
 	}
 	return value, nil
 }
 
+func prefixZeros(s string) bool {
+	return strings.HasPrefix(s, "0") && s != "0"
+}
+
 func checkRFC3339Date(headers map[string]interface{}, name string) (time.Time, error) {
 	return checkRFC3339DateWhat(headers, name, "header")
 }
@@ -176,11 +205,16 @@
 	if err != nil {
 		return 0, err
 	}
-
 	value, err := strconv.ParseUint(valueStr, 10, bitSize)
 	if err != nil {
+		if ne, ok := err.(*strconv.NumError); ok && ne.Err == strconv.ErrRange {
+			return 0, fmt.Errorf("%q header is out of range: %v", name, valueStr)
+		}
 		return 0, fmt.Errorf("%q header is not an unsigned integer: %v", name, valueStr)
 	}
+	if prefixZeros(valueStr) {
+		return 0, fmt.Errorf("%q header has invalid prefix zeros: %s", name, valueStr)
+	}
 	return value, nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/asserts/ifacedecls.go snapd-2.48.3+20.04/asserts/ifacedecls.go
--- snapd-2.45.1+20.04.2/asserts/ifacedecls.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/ifacedecls.go	2021-02-02 08:21:12.000000000 +0000
@@ -398,9 +398,14 @@
 	if x == "*" {
 		return SideArityConstraint{N: -1}, nil
 	}
-	n, err := strconv.Atoi(x)
-	if err != nil || n < 1 {
+	n, err := atoi(x, "%s in %s", which, context)
+	switch _, syntax := err.(intSyntaxError); {
+	case err == nil && n < 1:
+		fallthrough
+	case syntax:
 		return a, fmt.Errorf("%s in %s must be an integer >=1 or *", which, context)
+	case err != nil:
+		return a, err
 	}
 	return SideArityConstraint{N: n}, nil
 }
diff -Nru snapd-2.45.1+20.04.2/asserts/ifacedecls_test.go snapd-2.48.3+20.04/asserts/ifacedecls_test.go
--- snapd-2.45.1+20.04.2/asserts/ifacedecls_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/ifacedecls_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1334,6 +1334,12 @@
     plugs-per-slot: any`, `plugs-per-slot in allow-auto-connection in plug rule for interface "iface" must be an integer >=1 or \*`},
 		{`iface:
   allow-auto-connection:
+    slots-per-plug: 00`, `slots-per-plug in allow-auto-connection in plug rule for interface "iface" has invalid prefix zeros: 00`},
+		{`iface:
+  allow-auto-connection:
+    slots-per-plug: 99999999999999999999`, `slots-per-plug in allow-auto-connection in plug rule for interface "iface" is out of range: 99999999999999999999`},
+		{`iface:
+  allow-auto-connection:
     slots-per-plug: 0`, `slots-per-plug in allow-auto-connection in plug rule for interface "iface" must be an integer >=1 or \*`},
 		{`iface:
   allow-auto-connection:
@@ -2165,6 +2171,12 @@
     plugs-per-slot: any`, `plugs-per-slot in allow-auto-connection in slot rule for interface "iface" must be an integer >=1 or \*`},
 		{`iface:
   allow-auto-connection:
+    slots-per-plug: 00`, `slots-per-plug in allow-auto-connection in slot rule for interface "iface" has invalid prefix zeros: 00`},
+		{`iface:
+  allow-auto-connection:
+    slots-per-plug: 99999999999999999999`, `slots-per-plug in allow-auto-connection in slot rule for interface "iface" is out of range: 99999999999999999999`},
+		{`iface:
+  allow-auto-connection:
     slots-per-plug: 0`, `slots-per-plug in allow-auto-connection in slot rule for interface "iface" must be an integer >=1 or \*`},
 		{`iface:
   allow-auto-connection:
diff -Nru snapd-2.45.1+20.04.2/asserts/internal/grouping.go snapd-2.48.3+20.04/asserts/internal/grouping.go
--- snapd-2.45.1+20.04.2/asserts/internal/grouping.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/internal/grouping.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,286 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"sort"
+)
+
+// Groupings maintain labels to identify membership to one or more groups.
+// Labels are implemented as subsets of integers from 0
+// up to an excluded maximum, where the integers represent the groups.
+// Assumptions:
+//  - most labels are for one group or very few
+//  - a few labels are sparse with more groups in them
+//  - very few comprise the universe of all groups
+type Groupings struct {
+	n               uint
+	maxGroup        uint16
+	bitsetThreshold uint16
+}
+
+// NewGroupings creates a new Groupings supporting labels for membership
+// to up n groups. n must be a positive multiple of 16 and <=65536.
+func NewGroupings(n int) (*Groupings, error) {
+	if n <= 0 || n > 65536 {
+		return nil, fmt.Errorf("n=%d groups is outside of valid range (0, 65536]", n)
+	}
+	if n%16 != 0 {
+		return nil, fmt.Errorf("n=%d groups is not a multiple of 16", n)
+	}
+	return &Groupings{n: uint(n), bitsetThreshold: uint16(n / 16)}, nil
+}
+
+// N returns up to how many groups are supported.
+// That is the value that was passed to NewGroupings.
+func (gr *Groupings) N() int {
+	return int(gr.n)
+}
+
+// WithinRange checks whether group is within the admissible range for
+// labeling otherwise it returns an error.
+func (gr *Groupings) WithinRange(group uint16) error {
+	if uint(group) >= gr.n {
+		return fmt.Errorf("group exceeds admissible maximum: %d >= %d", group, gr.n)
+	}
+	return nil
+}
+
+type Grouping struct {
+	size  uint16
+	elems []uint16
+}
+
+func (g Grouping) Copy() Grouping {
+	elems2 := make([]uint16, len(g.elems), cap(g.elems))
+	copy(elems2[:], g.elems[:])
+	g.elems = elems2
+	return g
+}
+
+// search locates group among the sorted Grouping elements, it returns:
+//  * true if found
+//  * false if not found
+//  * the index at which group should be inserted to keep the
+//    elements sorted if not found and the bit-set representation is not in use
+func (gr *Groupings) search(g *Grouping, group uint16) (found bool, j uint16) {
+	if g.size > gr.bitsetThreshold {
+		return bitsetContains(g, group), 0
+	}
+	j = uint16(sort.Search(int(g.size), func(i int) bool { return g.elems[i] >= group }))
+	if j < g.size && g.elems[j] == group {
+		return true, 0
+	}
+	return false, j
+}
+
+func bitsetContains(g *Grouping, group uint16) bool {
+	return (g.elems[group/16] & (1 << (group % 16))) != 0
+}
+
+// AddTo adds the given group to the grouping.
+func (gr *Groupings) AddTo(g *Grouping, group uint16) error {
+	if err := gr.WithinRange(group); err != nil {
+		return err
+	}
+	if group > gr.maxGroup {
+		gr.maxGroup = group
+	}
+	if g.size == 0 {
+		g.size = 1
+		g.elems = []uint16{group}
+		return nil
+	}
+	found, j := gr.search(g, group)
+	if found {
+		return nil
+	}
+	newsize := g.size + 1
+	if newsize > gr.bitsetThreshold {
+		// switching to a bit-set representation after the size point
+		// where the space cost is the same, the representation uses
+		// bitsetThreshold-many 16-bits words stored in elems.
+		// We don't always use the bit-set representation because
+		// * we expect small groupings and iteration to be common,
+		//   iteration is more costly over the bit-set representation
+		// * serialization matches more or less what we do in memory,
+		//   so again is more efficient for small groupings in the
+		//   extensive representation.
+		if g.size == gr.bitsetThreshold {
+			prevelems := g.elems
+			g.elems = make([]uint16, gr.bitsetThreshold)
+			for _, e := range prevelems {
+				bitsetAdd(g, e)
+			}
+		}
+		g.size = newsize
+		bitsetAdd(g, group)
+		return nil
+	}
+	var newelems []uint16
+	if int(g.size) == cap(g.elems) {
+		newelems = make([]uint16, newsize, cap(g.elems)*2)
+		copy(newelems, g.elems[:j])
+	} else {
+		newelems = g.elems[:newsize]
+	}
+	if j < g.size {
+		copy(newelems[j+1:], g.elems[j:])
+	}
+	// inserting new group at j index keeping the elements sorted
+	newelems[j] = group
+	g.size = newsize
+	g.elems = newelems
+	return nil
+}
+
+func bitsetAdd(g *Grouping, group uint16) {
+	g.elems[group/16] |= 1 << (group % 16)
+}
+
+// Contains returns whether the given group is a member of the grouping.
+func (gr *Groupings) Contains(g *Grouping, group uint16) bool {
+	found, _ := gr.search(g, group)
+	return found
+}
+
+// Serialize produces a string encoding the given integers.
+func Serialize(elems []uint16) string {
+	b := bytes.NewBuffer(make([]byte, 0, len(elems)*2))
+	binary.Write(b, binary.LittleEndian, elems)
+	return base64.RawURLEncoding.EncodeToString(b.Bytes())
+}
+
+// Serialize produces a string representing the grouping label.
+func (gr *Groupings) Serialize(g *Grouping) string {
+	// groupings are serialized as:
+	//  * the actual element groups if there are up to
+	//    bitsetThreshold elements: elems[0], elems[1], ...
+	//  * otherwise the number of elements, followed by the bitset
+	//    representation comprised of bitsetThreshold-many 16-bits words
+	//    (stored using elems as well)
+	if g.size > gr.bitsetThreshold {
+		return gr.bitsetSerialize(g)
+	}
+	return Serialize(g.elems)
+}
+
+func (gr *Groupings) bitsetSerialize(g *Grouping) string {
+	b := bytes.NewBuffer(make([]byte, 0, (gr.bitsetThreshold+1)*2))
+	binary.Write(b, binary.LittleEndian, g.size)
+	binary.Write(b, binary.LittleEndian, g.elems)
+	return base64.RawURLEncoding.EncodeToString(b.Bytes())
+}
+
+const errSerializedLabelFmt = "invalid serialized grouping label: %v"
+
+// Deserialize reconstructs a grouping out of the serialized label.
+func (gr *Groupings) Deserialize(label string) (*Grouping, error) {
+	b, err := base64.RawURLEncoding.DecodeString(label)
+	if err != nil {
+		return nil, fmt.Errorf(errSerializedLabelFmt, err)
+	}
+	if len(b)%2 != 0 {
+		return nil, fmt.Errorf(errSerializedLabelFmt, "not divisible into 16-bits words")
+	}
+	m := len(b) / 2
+	var g Grouping
+	if m == int(gr.bitsetThreshold+1) {
+		// deserialize number of elements + bitset representation
+		// comprising bitsetThreshold-many 16-bits words
+		return gr.bitsetDeserialize(&g, b)
+	}
+	if m > int(gr.bitsetThreshold) {
+		return nil, fmt.Errorf(errSerializedLabelFmt, "too large")
+	}
+	g.size = uint16(m)
+	esz := uint16(1)
+	for esz < g.size {
+		esz *= 2
+	}
+	g.elems = make([]uint16, g.size, esz)
+	binary.Read(bytes.NewBuffer(b), binary.LittleEndian, g.elems)
+	for i, e := range g.elems {
+		if e > gr.maxGroup {
+			return nil, fmt.Errorf(errSerializedLabelFmt, "element larger than maximum group")
+		}
+		if i > 0 && g.elems[i-1] >= e {
+			return nil, fmt.Errorf(errSerializedLabelFmt, "not sorted")
+		}
+	}
+	return &g, nil
+}
+
+func (gr *Groupings) bitsetDeserialize(g *Grouping, b []byte) (*Grouping, error) {
+	buf := bytes.NewBuffer(b)
+	binary.Read(buf, binary.LittleEndian, &g.size)
+	if g.size > gr.maxGroup+1 {
+		return nil, fmt.Errorf(errSerializedLabelFmt, "bitset size cannot be possibly larger than maximum group plus 1")
+	}
+	if g.size <= gr.bitsetThreshold {
+		// should not have used a bitset repr for so few elements
+		return nil, fmt.Errorf(errSerializedLabelFmt, "bitset for too few elements")
+	}
+	g.elems = make([]uint16, gr.bitsetThreshold)
+	binary.Read(buf, binary.LittleEndian, g.elems)
+	return g, nil
+}
+
+// Iter iterates over the groups in the grouping and calls f with each of
+// them. If f returns an error Iter immediately returns with it.
+func (gr *Groupings) Iter(g *Grouping, f func(group uint16) error) error {
+	if g.size > gr.bitsetThreshold {
+		return gr.bitsetIter(g, f)
+	}
+	for _, e := range g.elems {
+		if err := f(e); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (gr *Groupings) bitsetIter(g *Grouping, f func(group uint16) error) error {
+	c := g.size
+	for i := uint16(0); i <= gr.maxGroup/16; i++ {
+		w := g.elems[i]
+		if w == 0 {
+			continue
+		}
+		for j := uint16(0); w != 0; j++ {
+			if w&1 != 0 {
+				if err := f(i*16 + j); err != nil {
+					return err
+				}
+				c--
+				if c == 0 {
+					// found all elements
+					return nil
+				}
+			}
+			w >>= 1
+		}
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/internal/grouping_test.go snapd-2.48.3+20.04/asserts/internal/grouping_test.go
--- snapd-2.45.1+20.04.2/asserts/internal/grouping_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/internal/grouping_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,713 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal_test
+
+import (
+	"encoding/base64"
+	"errors"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts/internal"
+)
+
+func TestInternal(t *testing.T) { TestingT(t) }
+
+type groupingsSuite struct{}
+
+var _ = Suite(&groupingsSuite{})
+
+func (s *groupingsSuite) TestNewGroupings(c *C) {
+	tests := []struct {
+		n   int
+		err string
+	}{
+		{-10, `n=-10 groups is outside of valid range \(0, 65536\]`},
+		{0, `n=0 groups is outside of valid range \(0, 65536\]`},
+		{9, "n=9 groups is not a multiple of 16"},
+		{16, ""},
+		{255, "n=255 groups is not a multiple of 16"},
+		{256, ""},
+		{1024, ""},
+		{65536, ""},
+		{65537, `n=65537 groups is outside of valid range \(0, 65536\]`},
+	}
+
+	for _, t := range tests {
+		comm := Commentf("%d", t.n)
+		gr, err := internal.NewGroupings(t.n)
+		if t.err == "" {
+			c.Check(err, IsNil, comm)
+			c.Check(gr, NotNil, comm)
+			c.Check(gr.N(), Equals, t.n)
+		} else {
+			c.Check(gr, IsNil, comm)
+			c.Check(err, ErrorMatches, t.err, comm)
+		}
+	}
+}
+
+func (s *groupingsSuite) TestAddToAndContains(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(16)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 3)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 4)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 2)
+	c.Assert(err, IsNil)
+
+	for i := uint16(0); i < 5; i++ {
+		c.Check(gr.Contains(&g, i), Equals, true)
+	}
+
+	c.Check(gr.Contains(&g, 5), Equals, false)
+}
+
+func (s *groupingsSuite) TestOutsideRange(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(16)
+	c.Assert(err, IsNil)
+
+	// sanity
+	err = gr.AddTo(&g, 15)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 16)
+	c.Check(err, ErrorMatches, "group exceeds admissible maximum: 16 >= 16")
+
+	err = gr.AddTo(&g, 99)
+	c.Check(err, ErrorMatches, "group exceeds admissible maximum: 99 >= 16")
+}
+
+func (s *groupingsSuite) TestSerializeLabel(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(128)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 3)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 4)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 2)
+	c.Assert(err, IsNil)
+
+	l := gr.Serialize(&g)
+
+	g1, err := gr.Deserialize(l)
+	c.Check(err, IsNil)
+
+	c.Check(g1, DeepEquals, &g)
+}
+
+func (s *groupingsSuite) TestDeserializeLabelErrors(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(64)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 2)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 3)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 4)
+	c.Assert(err, IsNil)
+
+	const errPrefix = "invalid serialized grouping label: "
+
+	invalidLabels := []struct {
+		invalid, errSuffix string
+	}{
+		// not base64
+		{"\x0a\x02\xf4", `illegal base64 data.*`},
+		// wrong length
+		{base64.RawURLEncoding.EncodeToString([]byte{1}), `not divisible into 16-bits words`},
+		// not a known group
+		{internal.Serialize([]uint16{5}), `element larger than maximum group`},
+		// not in order
+		{internal.Serialize([]uint16{0, 2, 1}), `not sorted`},
+		// bitset: too many words
+		{internal.Serialize([]uint16{0, 0, 0, 0, 0, 0}), `too large`},
+		// bitset: larger than maxgroup
+		{internal.Serialize([]uint16{6, 0, 0, 0, 0}), `bitset size cannot be possibly larger than maximum group plus 1`},
+		// bitset: grouping size is too small
+		{internal.Serialize([]uint16{0, 0, 0, 0, 0}), `bitset for too few elements`},
+		{internal.Serialize([]uint16{1, 0, 0, 0, 0}), `bitset for too few elements`},
+		{internal.Serialize([]uint16{4, 0, 0, 0, 0}), `bitset for too few elements`},
+	}
+
+	for _, il := range invalidLabels {
+		_, err := gr.Deserialize(il.invalid)
+		c.Check(err, ErrorMatches, errPrefix+il.errSuffix)
+	}
+}
+
+func (s *groupingsSuite) TestIter(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(128)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 3)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 4)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 2)
+	c.Assert(err, IsNil)
+
+	elems := []uint16{}
+	f := func(group uint16) error {
+		elems = append(elems, group)
+		return nil
+	}
+
+	err = gr.Iter(&g, f)
+	c.Assert(err, IsNil)
+	c.Check(elems, DeepEquals, []uint16{0, 1, 2, 3, 4})
+}
+
+func (s *groupingsSuite) TestIterError(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(32)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 3)
+	c.Assert(err, IsNil)
+
+	errBoom := errors.New("boom")
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return errBoom
+	}
+
+	err = gr.Iter(&g, f)
+	c.Check(err, Equals, errBoom)
+	c.Check(n, Equals, 1)
+}
+
+func (s *groupingsSuite) TestRepeated(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(64)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 2)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+
+	elems := []uint16{}
+	f := func(group uint16) error {
+		elems = append(elems, group)
+		return nil
+	}
+
+	err = gr.Iter(&g, f)
+	c.Assert(err, IsNil)
+	c.Check(elems, DeepEquals, []uint16{0, 1, 2})
+}
+
+func (s *groupingsSuite) TestCopy(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(16)
+	c.Assert(err, IsNil)
+
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 3)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 4)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 2)
+	c.Assert(err, IsNil)
+
+	g2 := g.Copy()
+	c.Check(g2, DeepEquals, g)
+
+	err = gr.AddTo(&g2, 7)
+	c.Assert(err, IsNil)
+
+	c.Check(gr.Contains(&g, 7), Equals, false)
+	c.Check(gr.Contains(&g2, 7), Equals, true)
+
+	c.Check(g2, Not(DeepEquals), g)
+}
+func (s *groupingsSuite) TestBitsetSerializeAndIterSimple(c *C) {
+	gr, err := internal.NewGroupings(32)
+	c.Assert(err, IsNil)
+
+	var elems []uint16
+	f := func(group uint16) error {
+		elems = append(elems, group)
+		return nil
+	}
+
+	var g internal.Grouping
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 5)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 17)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 24)
+	c.Assert(err, IsNil)
+
+	l := gr.Serialize(&g)
+	c.Check(l, DeepEquals,
+		internal.Serialize([]uint16{4,
+			uint16(1<<1 | 1<<5),
+			uint16(1<<(17-16) | 1<<(24-16)),
+		}))
+
+	err = gr.Iter(&g, f)
+	c.Assert(err, IsNil)
+	c.Check(elems, DeepEquals, []uint16{1, 5, 17, 24})
+}
+
+func (s *groupingsSuite) TestBitSet(c *C) {
+	var g internal.Grouping
+
+	gr, err := internal.NewGroupings(64)
+	c.Assert(err, IsNil)
+
+	for i := uint16(0); i < 64; i++ {
+		err := gr.AddTo(&g, i)
+		c.Assert(err, IsNil)
+		c.Check(gr.Contains(&g, i), Equals, true)
+
+		l := gr.Serialize(&g)
+
+		switch i {
+		case 4:
+			c.Check(l, Equals, internal.Serialize([]uint16{5, 0x1f, 0, 0, 0}))
+		case 15:
+			c.Check(l, Equals, internal.Serialize([]uint16{16, 0xffff, 0, 0, 0}))
+		case 16:
+			c.Check(l, Equals, internal.Serialize([]uint16{17, 0xffff, 0x1, 0, 0}))
+		case 63:
+			c.Check(l, Equals, internal.Serialize([]uint16{64, 0xffff, 0xffff, 0xffff, 0xffff}))
+		}
+
+		g1, err := gr.Deserialize(l)
+		c.Check(err, IsNil)
+
+		c.Check(g1, DeepEquals, &g)
+	}
+
+	for i := uint16(63); ; i-- {
+		err := gr.AddTo(&g, i)
+		c.Assert(err, IsNil)
+		c.Check(gr.Contains(&g, i), Equals, true)
+		if i == 0 {
+			break
+		}
+
+		l := gr.Serialize(&g)
+
+		g1, err := gr.Deserialize(l)
+		c.Check(err, IsNil)
+
+		c.Check(g1, DeepEquals, &g)
+	}
+}
+
+func (s *groupingsSuite) TestBitsetIter(c *C) {
+	gr, err := internal.NewGroupings(32)
+	c.Assert(err, IsNil)
+
+	var elems []uint16
+	f := func(group uint16) error {
+		elems = append(elems, group)
+		return nil
+	}
+
+	for i := uint16(2); i < 32; i++ {
+		var g internal.Grouping
+
+		err := gr.AddTo(&g, i-2)
+		c.Assert(err, IsNil)
+		err = gr.AddTo(&g, i-1)
+		c.Assert(err, IsNil)
+		err = gr.AddTo(&g, i)
+		c.Assert(err, IsNil)
+
+		err = gr.Iter(&g, f)
+		c.Assert(err, IsNil)
+		c.Check(elems, DeepEquals, []uint16{i - 2, i - 1, i})
+
+		elems = nil
+	}
+
+	var g internal.Grouping
+	for i := uint16(0); i < 32; i++ {
+		err = gr.AddTo(&g, i)
+		c.Assert(err, IsNil)
+	}
+
+	err = gr.Iter(&g, f)
+	c.Assert(err, IsNil)
+	c.Check(elems, HasLen, 32)
+}
+
+func (s *groupingsSuite) TestBitsetIterError(c *C) {
+	gr, err := internal.NewGroupings(16)
+	c.Assert(err, IsNil)
+
+	var g internal.Grouping
+
+	err = gr.AddTo(&g, 0)
+	c.Assert(err, IsNil)
+	err = gr.AddTo(&g, 1)
+	c.Assert(err, IsNil)
+
+	errBoom := errors.New("boom")
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return errBoom
+	}
+
+	err = gr.Iter(&g, f)
+	c.Check(err, Equals, errBoom)
+	c.Check(n, Equals, 1)
+}
+
+func BenchmarkIterBaseline(b *testing.B) {
+	b.StopTimer()
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		for j := uint16(0); j < 64; j++ {
+			f(j)
+		}
+		if n != 64 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIter4Elems(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	gr.AddTo(&g, 1)
+	gr.AddTo(&g, 5)
+	gr.AddTo(&g, 17)
+	gr.AddTo(&g, 24)
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 4 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitset5Elems(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	gr.AddTo(&g, 1)
+	gr.AddTo(&g, 5)
+	gr.AddTo(&g, 17)
+	gr.AddTo(&g, 24)
+	gr.AddTo(&g, 33)
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 5 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitsetEmptyStretches(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	gr.AddTo(&g, 0)
+	gr.AddTo(&g, 15)
+	gr.AddTo(&g, 16)
+	gr.AddTo(&g, 31)
+	gr.AddTo(&g, 32)
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 5 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitsetEven(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	for i := 0; i <= 63; i += 2 {
+		gr.AddTo(&g, uint16(i))
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 32 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitsetOdd(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	for i := 1; i <= 63; i += 2 {
+		gr.AddTo(&g, uint16(i))
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 32 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitset0Inc3(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	for i := 0; i <= 63; i += 3 {
+		gr.AddTo(&g, uint16(i))
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 22 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitset1Inc3(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	for i := 1; i <= 63; i += 3 {
+		gr.AddTo(&g, uint16(i))
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 21 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitset0Inc4(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	for i := 0; i <= 63; i += 4 {
+		gr.AddTo(&g, uint16(i))
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 16 {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkIterBitsetComplete(b *testing.B) {
+	b.StopTimer()
+
+	gr, err := internal.NewGroupings(64)
+	if err != nil {
+		b.FailNow()
+	}
+
+	n := 0
+	f := func(group uint16) error {
+		n++
+		return nil
+	}
+
+	var g internal.Grouping
+	for i := 0; i <= 63; i++ {
+		gr.AddTo(&g, uint16(i))
+	}
+
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		n = 0
+		gr.Iter(&g, f)
+		if n != 64 {
+			b.FailNow()
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/membackstore.go snapd-2.48.3+20.04/asserts/membackstore.go
--- snapd-2.45.1+20.04.2/asserts/membackstore.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/membackstore.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -21,6 +21,9 @@
 
 import (
 	"errors"
+	"fmt"
+	"sort"
+	"strconv"
 	"sync"
 )
 
@@ -33,12 +36,18 @@
 	put(assertType *AssertionType, key []string, assert Assertion) error
 	get(key []string, maxFormat int) (Assertion, error)
 	search(hint []string, found func(Assertion), maxFormat int)
+	sequenceMemberAfter(prefix []string, after, maxFormat int) (Assertion, error)
 }
 
 type memBSBranch map[string]memBSNode
 
 type memBSLeaf map[string]map[int]Assertion
 
+type memBSSeqLeaf struct {
+	memBSLeaf
+	sequence []int
+}
+
 func (br memBSBranch) put(assertType *AssertionType, key []string, assert Assertion) error {
 	key0 := key[0]
 	down := br[key0]
@@ -46,7 +55,12 @@
 		if len(key) > 2 {
 			down = make(memBSBranch)
 		} else {
-			down = make(memBSLeaf)
+			leaf := make(memBSLeaf)
+			if assertType.SequenceForming() {
+				down = &memBSSeqLeaf{memBSLeaf: leaf}
+			} else {
+				down = leaf
+			}
 		}
 		br[key0] = down
 	}
@@ -81,6 +95,23 @@
 	return nil
 }
 
+func (leaf *memBSSeqLeaf) put(assertType *AssertionType, key []string, assert Assertion) error {
+	if err := leaf.memBSLeaf.put(assertType, key, assert); err != nil {
+		return err
+	}
+	if len(leaf.memBSLeaf) != len(leaf.sequence) {
+		seqnum := assert.(SequenceMember).Sequence()
+		inspos := sort.SearchInts(leaf.sequence, seqnum)
+		n := len(leaf.sequence)
+		leaf.sequence = append(leaf.sequence, seqnum)
+		if inspos != n {
+			copy(leaf.sequence[inspos+1:n+1], leaf.sequence[inspos:n])
+			leaf.sequence[inspos] = seqnum
+		}
+	}
+	return nil
+}
+
 // errNotFound is used internally by backends, it is converted to the richer
 // NotFoundError only at their public interface boundary
 var errNotFound = errors.New("assertion not found")
@@ -136,6 +167,52 @@
 	}
 }
 
+func (br memBSBranch) sequenceMemberAfter(prefix []string, after, maxFormat int) (Assertion, error) {
+	prefix0 := prefix[0]
+	down := br[prefix0]
+	if down == nil {
+		return nil, errNotFound
+	}
+	return down.sequenceMemberAfter(prefix[1:], after, maxFormat)
+}
+
+func (left memBSLeaf) sequenceMemberAfter(prefix []string, after, maxFormat int) (Assertion, error) {
+	panic("internal error: unexpected sequenceMemberAfter on memBSLeaf")
+}
+
+func (leaf *memBSSeqLeaf) sequenceMemberAfter(prefix []string, after, maxFormat int) (Assertion, error) {
+	n := len(leaf.sequence)
+	dir := 1
+	var start int
+	if after == -1 {
+		// search for the latest in sequence compatible with
+		// maxFormat: consider all sequence numbers in
+		// sequence backward
+		dir = -1
+		start = n - 1
+	} else {
+		// search for the first in sequence with sequence number
+		// > after and compatible with maxFormat
+		start = sort.SearchInts(leaf.sequence, after)
+		if start == n {
+			// nothing
+			return nil, errNotFound
+		}
+		if leaf.sequence[start] == after {
+			// skip after itself
+			start += 1
+		}
+	}
+	for j := start; j >= 0 && j < n; j += dir {
+		seqkey := strconv.Itoa(leaf.sequence[j])
+		cur := leaf.cur(seqkey, maxFormat)
+		if cur != nil {
+			return cur, nil
+		}
+	}
+	return nil, errNotFound
+}
+
 // NewMemoryBackstore creates a memory backed assertions backstore.
 func NewMemoryBackstore() Backstore {
 	return &memoryBackstore{
@@ -189,3 +266,25 @@
 	mbs.top.search(hint, candCb, maxFormat)
 	return nil
 }
+
+func (mbs *memoryBackstore) SequenceMemberAfter(assertType *AssertionType, sequenceKey []string, after, maxFormat int) (SequenceMember, error) {
+	if !assertType.SequenceForming() {
+		panic(fmt.Sprintf("internal error: SequenceMemberAfter on non sequence-forming assertion type %q", assertType.Name))
+	}
+	if len(sequenceKey) != len(assertType.PrimaryKey)-1 {
+		return nil, fmt.Errorf("internal error: SequenceMemberAfter's sequence key argument length must be exactly 1 less than the assertion type primary key")
+	}
+
+	mbs.mu.RLock()
+	defer mbs.mu.RUnlock()
+
+	internalPrefix := make([]string, len(assertType.PrimaryKey))
+	internalPrefix[0] = assertType.Name
+	copy(internalPrefix[1:], sequenceKey)
+
+	a, err := mbs.top.sequenceMemberAfter(internalPrefix, after, maxFormat)
+	if err == errNotFound {
+		return nil, &NotFoundError{Type: assertType}
+	}
+	return a.(SequenceMember), err
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/membackstore_test.go snapd-2.48.3+20.04/asserts/membackstore_test.go
--- snapd-2.45.1+20.04.2/asserts/membackstore_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/membackstore_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -349,3 +349,191 @@
 	c.Check(as[0].Revision(), Equals, 1)
 
 }
+
+func (mbss *memBackstoreSuite) TestPutSequence(c *C) {
+	bs := asserts.NewMemoryBackstore()
+
+	sq1f0, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: s1\n" +
+		"sequence: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq2f0, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: s1\n" +
+		"sequence: 2\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq2f1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 1\n" +
+		"n: s1\n" +
+		"sequence: 2\n" +
+		"revision: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq3f1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 1\n" +
+		"n: s1\n" +
+		"sequence: 3\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	for _, a := range []asserts.Assertion{sq3f1, sq1f0, sq2f0, sq2f1} {
+		err = bs.Put(asserts.TestOnlySeqType, a)
+		c.Assert(err, IsNil)
+	}
+
+	a, err := bs.Get(asserts.TestOnlySeqType, []string{"s1", "1"}, 0)
+	c.Assert(err, IsNil)
+	c.Check(a.(asserts.SequenceMember).Sequence(), Equals, 1)
+	c.Check(a.Format(), Equals, 0)
+
+	a, err = bs.Get(asserts.TestOnlySeqType, []string{"s1", "2"}, 0)
+	c.Assert(err, IsNil)
+	c.Check(a.(asserts.SequenceMember).Sequence(), Equals, 2)
+	c.Check(a.Format(), Equals, 0)
+
+	a, err = bs.Get(asserts.TestOnlySeqType, []string{"s1", "2"}, 1)
+	c.Assert(err, IsNil)
+	c.Check(a.(asserts.SequenceMember).Sequence(), Equals, 2)
+	c.Check(a.Format(), Equals, 1)
+
+	a, err = bs.Get(asserts.TestOnlySeqType, []string{"s1", "3"}, 0)
+	c.Assert(err, DeepEquals, &asserts.NotFoundError{
+		Type: asserts.TestOnlySeqType,
+	})
+
+	a, err = bs.Get(asserts.TestOnlySeqType, []string{"s1", "3"}, 1)
+	c.Assert(err, IsNil)
+	c.Check(a.(asserts.SequenceMember).Sequence(), Equals, 3)
+	c.Check(a.Format(), Equals, 1)
+
+	err = bs.Put(asserts.TestOnlySeqType, sq2f0)
+	c.Check(err, DeepEquals, &asserts.RevisionError{Current: 1, Used: 0})
+}
+
+func (mbss *memBackstoreSuite) TestSequenceMemberAfter(c *C) {
+	bs := asserts.NewMemoryBackstore()
+
+	other1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: other\n" +
+		"sequence: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq1f0, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: s1\n" +
+		"sequence: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq2f0, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"n: s1\n" +
+		"sequence: 2\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq2f1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 1\n" +
+		"n: s1\n" +
+		"sequence: 2\n" +
+		"revision: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq3f1, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 1\n" +
+		"n: s1\n" +
+		"sequence: 3\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	sq3f2, err := asserts.Decode([]byte("type: test-only-seq\n" +
+		"authority-id: auth-id1\n" +
+		"format: 2\n" +
+		"n: s1\n" +
+		"sequence: 3\n" +
+		"revision: 1\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="))
+	c.Assert(err, IsNil)
+
+	for _, a := range []asserts.Assertion{other1, sq1f0, sq2f0, sq2f1, sq3f1, sq3f2} {
+		err = bs.Put(asserts.TestOnlySeqType, a)
+		c.Assert(err, IsNil)
+	}
+
+	seqKey := []string{"s1"}
+	tests := []struct {
+		after     int
+		maxFormat int
+		sequence  int
+		format    int
+		revision  int
+	}{
+		{after: 0, maxFormat: 0, sequence: 1, format: 0, revision: 0},
+		{after: 0, maxFormat: 2, sequence: 1, format: 0, revision: 0},
+		{after: 1, maxFormat: 0, sequence: 2, format: 0, revision: 0},
+		{after: 1, maxFormat: 1, sequence: 2, format: 1, revision: 1},
+		{after: 1, maxFormat: 2, sequence: 2, format: 1, revision: 1},
+		{after: 2, maxFormat: 0, sequence: -1},
+		{after: 2, maxFormat: 1, sequence: 3, format: 1, revision: 0},
+		{after: 2, maxFormat: 2, sequence: 3, format: 2, revision: 1},
+		{after: 3, maxFormat: 0, sequence: -1},
+		{after: 3, maxFormat: 2, sequence: -1},
+		{after: 4, maxFormat: 2, sequence: -1},
+		{after: -1, maxFormat: 0, sequence: 2, format: 0, revision: 0},
+		{after: -1, maxFormat: 1, sequence: 3, format: 1, revision: 0},
+		{after: -1, maxFormat: 2, sequence: 3, format: 2, revision: 1},
+	}
+
+	for _, t := range tests {
+		a, err := bs.SequenceMemberAfter(asserts.TestOnlySeqType, seqKey, t.after, t.maxFormat)
+		if t.sequence == -1 {
+			c.Check(err, DeepEquals, &asserts.NotFoundError{
+				Type: asserts.TestOnlySeqType,
+			})
+		} else {
+			c.Assert(err, IsNil)
+			c.Assert(a.HeaderString("n"), Equals, "s1")
+			c.Check(a.Sequence(), Equals, t.sequence)
+			c.Check(a.Format(), Equals, t.format)
+			c.Check(a.Revision(), Equals, t.revision)
+		}
+	}
+
+	_, err = bs.SequenceMemberAfter(asserts.TestOnlySeqType, []string{"s2"}, -1, 2)
+	c.Check(err, DeepEquals, &asserts.NotFoundError{
+		Type: asserts.TestOnlySeqType,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/model.go snapd-2.48.3+20.04/asserts/model.go
--- snapd-2.45.1+20.04.2/asserts/model.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/model.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016-2019 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -339,6 +339,25 @@
 	ModelDangerous ModelGrade = "dangerous"
 )
 
+// StorageSafety characterizes the requested storage safety of
+// the model which then controls what encryption is used
+type StorageSafety string
+
+const (
+	StorageSafetyUnset StorageSafety = "unset"
+	// StorageSafetyEncrypted implies mandatory full disk encryption.
+	StorageSafetyEncrypted StorageSafety = "encrypted"
+	// StorageSafetyPreferEncrypted implies full disk
+	// encryption when the system supports it.
+	StorageSafetyPreferEncrypted StorageSafety = "prefer-encrypted"
+	// StorageSafetyPreferUnencrypted implies no full disk
+	// encryption by default even if the system supports
+	// encryption.
+	StorageSafetyPreferUnencrypted StorageSafety = "prefer-unencrypted"
+)
+
+var validStorageSafeties = []string{string(StorageSafetyEncrypted), string(StorageSafetyPreferEncrypted), string(StorageSafetyPreferUnencrypted)}
+
 var validModelGrades = []string{string(ModelSecured), string(ModelSigned), string(ModelDangerous)}
 
 // gradeToCode encodes grades into 32 bits, trying to be slightly future-proof:
@@ -374,6 +393,8 @@
 
 	grade ModelGrade
 
+	storageSafety StorageSafety
+
 	allSnaps []*ModelSnap
 	// consumers of this info should care only about snap identity =>
 	// snapRef
@@ -415,17 +436,23 @@
 	return mod.classic
 }
 
-// Architecture returns the archicteture the model is based on.
+// Architecture returns the architecture the model is based on.
 func (mod *Model) Architecture() string {
 	return mod.HeaderString("architecture")
 }
 
-// Grade returns the stability grade of the model. Will be ModeGradeUnset
+// Grade returns the stability grade of the model. Will be ModelGradeUnset
 // for Core 16/18 models.
 func (mod *Model) Grade() ModelGrade {
 	return mod.grade
 }
 
+// StorageSafety returns the storage safety for the model. Will be
+// StorageSafetyUnset for Core 16/18 models.
+func (mod *Model) StorageSafety() StorageSafety {
+	return mod.storageSafety
+}
+
 // GadgetSnap returns the details of the gadget snap the model uses.
 func (mod *Model) GadgetSnap() *ModelSnap {
 	return mod.gadgetSnap
@@ -486,19 +513,29 @@
 	return mod.HeaderString("store")
 }
 
-// RequiredNoEssentialSnaps returns the snaps that must be installed at all times and cannot be removed for this model, excluding the essential snaps (gadget, kernel, boot base).
+// RequiredNoEssentialSnaps returns the snaps that must be installed at all times and cannot be removed for this model, excluding the essential snaps (gadget, kernel, boot base, snapd).
 func (mod *Model) RequiredNoEssentialSnaps() []naming.SnapRef {
 	return mod.requiredWithEssentialSnaps[mod.numEssentialSnaps:]
 }
 
-// RequiredWithEssentialSnaps returns the snaps that must be installed at all times and cannot be removed for this model, including the essential snaps (gadget, kernel, boot base).
+// RequiredWithEssentialSnaps returns the snaps that must be installed at all times and cannot be removed for this model, including any essential snaps (gadget, kernel, boot base, snapd).
 func (mod *Model) RequiredWithEssentialSnaps() []naming.SnapRef {
 	return mod.requiredWithEssentialSnaps
 }
 
-// AllSnaps returns all the snap listed by the model.
-func (mod *Model) AllSnaps() []*ModelSnap {
-	return mod.allSnaps
+// EssentialSnaps returns all essential snaps explicitly mentioned by
+// the model.
+// They are always returned according to this order with some skipped
+// if not mentioned: snapd, kernel, boot base, gadget.
+func (mod *Model) EssentialSnaps() []*ModelSnap {
+	return mod.allSnaps[:mod.numEssentialSnaps]
+}
+
+// SnapsWithoutEssential returns all the snaps listed by the model
+// without any of the essential snaps (as returned by EssentialSnaps).
+// They are returned in the order of mention by the model.
+func (mod *Model) SnapsWithoutEssential() []*ModelSnap {
+	return mod.allSnaps[mod.numEssentialSnaps:]
 }
 
 // SerialAuthority returns the authority ids that are accepted as
@@ -633,6 +670,9 @@
 		if _, ok := assert.headers["grade"]; ok {
 			return nil, fmt.Errorf("cannot specify a grade for model without the extended snaps header")
 		}
+		if _, ok := assert.headers["storage-safety"]; ok {
+			return nil, fmt.Errorf("cannot specify storage-safety for model without the extended snaps header")
+		}
 	}
 
 	if classic {
@@ -684,6 +724,7 @@
 
 	var modSnaps *modelSnaps
 	grade := ModelGradeUnset
+	storageSafety := StorageSafetyUnset
 	if extended {
 		gradeStr, err := checkOptionalString(assert.headers, "grade")
 		if err != nil {
@@ -697,6 +738,27 @@
 			grade = ModelGrade(gradeStr)
 		}
 
+		storageSafetyStr, err := checkOptionalString(assert.headers, "storage-safety")
+		if err != nil {
+			return nil, err
+		}
+		if storageSafetyStr != "" && !strutil.ListContains(validStorageSafeties, storageSafetyStr) {
+			return nil, fmt.Errorf("storage-safety for model must be %s, not %q", strings.Join(validStorageSafeties, "|"), storageSafetyStr)
+		}
+		if storageSafetyStr != "" {
+			storageSafety = StorageSafety(storageSafetyStr)
+		} else {
+			if grade == ModelSecured {
+				storageSafety = StorageSafetyEncrypted
+			} else {
+				storageSafety = StorageSafetyPreferEncrypted
+			}
+		}
+
+		if grade == ModelSecured && storageSafety != StorageSafetyEncrypted {
+			return nil, fmt.Errorf(`secured grade model must not have storage-safety overridden, only "encrypted" is valid`)
+		}
+
 		modSnaps, err = checkExtendedSnaps(extendedSnaps, base, grade)
 		if err != nil {
 			return nil, err
@@ -784,6 +846,7 @@
 		gadgetSnap:                 modSnaps.gadget,
 		kernelSnap:                 modSnaps.kernel,
 		grade:                      grade,
+		storageSafety:              storageSafety,
 		allSnaps:                   allSnaps,
 		requiredWithEssentialSnaps: requiredWithEssentialSnaps,
 		numEssentialSnaps:          numEssentialSnaps,
diff -Nru snapd-2.45.1+20.04.2/asserts/model_test.go snapd-2.48.3+20.04/asserts/model_test.go
--- snapd-2.45.1+20.04.2/asserts/model_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/model_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016-2019 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -133,6 +133,7 @@
     type: app
     presence: optional
 OTHERgrade: secured
+storage-safety: encrypted
 ` + "TSLINE" +
 		"body-length: 0\n" +
 		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
@@ -178,11 +179,15 @@
 	})
 	c.Check(model.Store(), Equals, "brand-store")
 	c.Check(model.Grade(), Equals, asserts.ModelGradeUnset)
-	allSnaps := model.AllSnaps()
-	c.Check(allSnaps, DeepEquals, []*asserts.ModelSnap{
+	c.Check(model.StorageSafety(), Equals, asserts.StorageSafetyUnset)
+	essentialSnaps := model.EssentialSnaps()
+	c.Check(essentialSnaps, DeepEquals, []*asserts.ModelSnap{
 		model.KernelSnap(),
 		model.BaseSnap(),
 		model.GadgetSnap(),
+	})
+	snaps := model.SnapsWithoutEssential()
+	c.Check(snaps, DeepEquals, []*asserts.ModelSnap{
 		{
 			Name:     "foo",
 			Modes:    []string{"run"},
@@ -195,14 +200,24 @@
 		},
 	})
 	// essential snaps included
-	reqSnaps := model.RequiredWithEssentialSnaps()
-	c.Check(reqSnaps, HasLen, len(allSnaps))
-	for i, r := range reqSnaps {
-		c.Check(r.SnapName(), Equals, allSnaps[i].Name)
-		c.Check(r.ID(), Equals, "")
+	reqSnaps := naming.NewSnapSet(model.RequiredWithEssentialSnaps())
+	for _, e := range essentialSnaps {
+		c.Check(reqSnaps.Contains(e), Equals, true)
+	}
+	for _, s := range snaps {
+		c.Check(reqSnaps.Contains(s), Equals, true)
 	}
+	c.Check(reqSnaps.Size(), Equals, len(essentialSnaps)+len(snaps))
 	// essential snaps excluded
-	c.Check(model.RequiredNoEssentialSnaps(), DeepEquals, reqSnaps[3:])
+	noEssential := naming.NewSnapSet(model.RequiredNoEssentialSnaps())
+	for _, e := range essentialSnaps {
+		c.Check(noEssential.Contains(e), Equals, false)
+	}
+	for _, s := range snaps {
+		c.Check(noEssential.Contains(s), Equals, true)
+	}
+	c.Check(noEssential.Size(), Equals, len(snaps))
+
 	c.Check(model.SystemUserAuthority(), HasLen, 0)
 	c.Check(model.SerialAuthority(), DeepEquals, []string{"brand-id1", "generic"})
 }
@@ -536,9 +551,12 @@
 	c.Check(model.Base(), Equals, "")
 	c.Check(model.BaseSnap(), IsNil)
 	c.Check(model.Store(), Equals, "brand-store")
-	allSnaps := model.AllSnaps()
-	c.Check(allSnaps, DeepEquals, []*asserts.ModelSnap{
+	essentialSnaps := model.EssentialSnaps()
+	c.Check(essentialSnaps, DeepEquals, []*asserts.ModelSnap{
 		model.GadgetSnap(),
+	})
+	snaps := model.SnapsWithoutEssential()
+	c.Check(snaps, DeepEquals, []*asserts.ModelSnap{
 		{
 			Name:     "foo",
 			Modes:    []string{"run"},
@@ -551,14 +569,23 @@
 		},
 	})
 	// gadget included
-	reqSnaps := model.RequiredWithEssentialSnaps()
-	c.Check(reqSnaps, HasLen, len(allSnaps))
-	for i, r := range reqSnaps {
-		c.Check(r.SnapName(), Equals, allSnaps[i].Name)
-		c.Check(r.ID(), Equals, "")
+	reqSnaps := naming.NewSnapSet(model.RequiredWithEssentialSnaps())
+	for _, e := range essentialSnaps {
+		c.Check(reqSnaps.Contains(e), Equals, true)
 	}
+	for _, s := range snaps {
+		c.Check(reqSnaps.Contains(s), Equals, true)
+	}
+	c.Check(reqSnaps.Size(), Equals, len(essentialSnaps)+len(snaps))
 	// gadget excluded
-	c.Check(model.RequiredNoEssentialSnaps(), DeepEquals, reqSnaps[1:])
+	noEssential := naming.NewSnapSet(model.RequiredNoEssentialSnaps())
+	for _, e := range essentialSnaps {
+		c.Check(noEssential.Contains(e), Equals, false)
+	}
+	for _, s := range snaps {
+		c.Check(noEssential.Contains(s), Equals, true)
+	}
+	c.Check(noEssential.Size(), Equals, len(snaps))
 }
 
 func (mods *modelSuite) TestClassicDecodeInvalid(c *C) {
@@ -640,11 +667,15 @@
 	})
 	c.Check(model.Store(), Equals, "brand-store")
 	c.Check(model.Grade(), Equals, asserts.ModelSecured)
-	allSnaps := model.AllSnaps()
-	c.Check(allSnaps, DeepEquals, []*asserts.ModelSnap{
+	c.Check(model.StorageSafety(), Equals, asserts.StorageSafetyEncrypted)
+	essentialSnaps := model.EssentialSnaps()
+	c.Check(essentialSnaps, DeepEquals, []*asserts.ModelSnap{
 		model.KernelSnap(),
 		model.BaseSnap(),
 		model.GadgetSnap(),
+	})
+	snaps := model.SnapsWithoutEssential()
+	c.Check(snaps, DeepEquals, []*asserts.ModelSnap{
 		{
 			Name:           "other-base",
 			SnapID:         "otherbasedididididididididididid",
@@ -679,14 +710,24 @@
 		},
 	})
 	// essential snaps included
-	reqSnaps := model.RequiredWithEssentialSnaps()
-	c.Check(reqSnaps, HasLen, len(allSnaps)-1)
-	for i, r := range reqSnaps {
-		c.Check(r.SnapName(), Equals, allSnaps[i].Name)
-		c.Check(r.ID(), Equals, allSnaps[i].SnapID)
+	reqSnaps := naming.NewSnapSet(model.RequiredWithEssentialSnaps())
+	for _, e := range essentialSnaps {
+		c.Check(reqSnaps.Contains(e), Equals, true)
+	}
+	for _, s := range snaps {
+		c.Check(reqSnaps.Contains(s), Equals, s.Presence == "required")
 	}
+	c.Check(reqSnaps.Size(), Equals, len(essentialSnaps)+len(snaps)-1)
 	// essential snaps excluded
-	c.Check(model.RequiredNoEssentialSnaps(), DeepEquals, reqSnaps[3:])
+	noEssential := naming.NewSnapSet(model.RequiredNoEssentialSnaps())
+	for _, e := range essentialSnaps {
+		c.Check(noEssential.Contains(e), Equals, false)
+	}
+	for _, s := range snaps {
+		c.Check(noEssential.Contains(s), Equals, s.Presence == "required")
+	}
+	c.Check(noEssential.Size(), Equals, len(snaps)-1)
+
 	c.Check(model.SystemUserAuthority(), HasLen, 0)
 	c.Check(model.SerialAuthority(), DeepEquals, []string{"brand-id1"})
 }
@@ -725,7 +766,7 @@
 	c.Assert(err, IsNil)
 	c.Check(a.Type(), Equals, asserts.ModelType)
 	model := a.(*asserts.Model)
-	snapdSnap := model.AllSnaps()[0]
+	snapdSnap := model.EssentialSnaps()[0]
 	c.Check(snapdSnap, DeepEquals, &asserts.ModelSnap{
 		Name:           "snapd",
 		SnapID:         "snapdidididididididididididididd",
@@ -792,8 +833,8 @@
 	c.Check(a.Type(), Equals, asserts.ModelType)
 	model := a.(*asserts.Model)
 	c.Check(model.Grade(), Equals, asserts.ModelDangerous)
-	allSnaps := model.AllSnaps()
-	c.Check(allSnaps[len(allSnaps)-2], DeepEquals, &asserts.ModelSnap{
+	snaps := model.SnapsWithoutEssential()
+	c.Check(snaps[len(snaps)-2], DeepEquals, &asserts.ModelSnap{
 		Name:           "myapp",
 		SnapType:       "app",
 		Modes:          []string{"run"},
@@ -802,6 +843,55 @@
 	})
 }
 
+func (mods *modelSuite) TestCore20ValidStorageSafety(c *C) {
+	encoded := strings.Replace(core20ModelExample, "TSLINE", mods.tsLine, 1)
+	encoded = strings.Replace(encoded, "OTHER", "", 1)
+	encoded = strings.Replace(encoded, "grade: secured\n", "grade: signed\n", 1)
+
+	for _, tc := range []struct {
+		ss  asserts.StorageSafety
+		sss string
+	}{
+		{asserts.StorageSafetyPreferEncrypted, "prefer-encrypted"},
+		{asserts.StorageSafetyPreferUnencrypted, "prefer-unencrypted"},
+		{asserts.StorageSafetyEncrypted, "encrypted"},
+	} {
+		ex := strings.Replace(encoded, "storage-safety: encrypted\n", fmt.Sprintf("storage-safety: %s\n", tc.sss), 1)
+		a, err := asserts.Decode([]byte(ex))
+		c.Assert(err, IsNil)
+		c.Check(a.Type(), Equals, asserts.ModelType)
+		model := a.(*asserts.Model)
+		c.Check(model.StorageSafety(), Equals, tc.ss)
+	}
+}
+
+func (mods *modelSuite) TestCore20DefaultStorageSafetySecured(c *C) {
+	encoded := strings.Replace(core20ModelExample, "TSLINE", mods.tsLine, 1)
+	encoded = strings.Replace(encoded, "OTHER", "", 1)
+	ex := strings.Replace(encoded, "storage-safety: encrypted\n", "", 1)
+
+	a, err := asserts.Decode([]byte(ex))
+	c.Assert(err, IsNil)
+	c.Check(a.Type(), Equals, asserts.ModelType)
+	model := a.(*asserts.Model)
+	c.Check(model.StorageSafety(), Equals, asserts.StorageSafetyEncrypted)
+}
+
+func (mods *modelSuite) TestCore20DefaultStorageSafetySignedDangerous(c *C) {
+	encoded := strings.Replace(core20ModelExample, "TSLINE", mods.tsLine, 1)
+	encoded = strings.Replace(encoded, "OTHER", "", 1)
+	encoded = strings.Replace(encoded, "storage-safety: encrypted\n", "", 1)
+
+	for _, grade := range []string{"dangerous", "signed"} {
+		ex := strings.Replace(encoded, "grade: secured\n", fmt.Sprintf("grade: %s\n", grade), 1)
+		a, err := asserts.Decode([]byte(ex))
+		c.Assert(err, IsNil)
+		c.Check(a.Type(), Equals, asserts.ModelType)
+		model := a.(*asserts.Model)
+		c.Check(model.StorageSafety(), Equals, asserts.StorageSafetyPreferEncrypted)
+	}
+}
+
 func (mods *modelSuite) TestCore20DecodeInvalid(c *C) {
 	encoded := strings.Replace(core20ModelExample, "TSLINE", mods.tsLine, 1)
 
@@ -840,6 +930,8 @@
 		{"OTHER", "gadget: foo\n", `cannot specify separate "gadget" header once using the extended snaps header`},
 		{"OTHER", "required-snaps:\n  - foo\n", `cannot specify separate "required-snaps" header once using the extended snaps header`},
 		{"grade: secured\n", "grade: foo\n", `grade for model must be secured|signed|dangerous`},
+		{"storage-safety: encrypted\n", "storage-safety: foo\n", `storage-safety for model must be encrypted\|prefer-encrypted\|prefer-unencrypted, not "foo"`},
+		{"storage-safety: encrypted\n", "storage-safety: prefer-unencrypted\n", `secured grade model must not have storage-safety overridden, only "encrypted" is valid`},
 	}
 	for _, test := range invalidTests {
 		invalid := strings.Replace(encoded, test.original, test.invalid, 1)
diff -Nru snapd-2.45.1+20.04.2/asserts/pool.go snapd-2.48.3+20.04/asserts/pool.go
--- snapd-2.45.1+20.04.2/asserts/pool.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/pool.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,775 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package asserts
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/snapcore/snapd/asserts/internal"
+)
+
+// A Grouping identifies opaquely a grouping of assertions.
+// Pool uses it to label the interesection between a set of groups.
+type Grouping string
+
+// A pool helps holding and tracking a set of assertions and their
+// prerequisites as they need to be updated or resolved.  The
+// assertions can be organized in groups. Failure can be tracked
+// isolated to groups, conversely any error related to a single group
+// alone will stop any work to resolve it. Independent assertions
+// should not be grouped. Assertions and prerequisites that are part
+// of more than one group are tracked properly only once.
+//
+// Typical usage involves specifying the initial assertions needing to
+// be resolved or updated using AddUnresolved and AddToUpdate. At this
+// point ToResolve can be called to get them organized in groupings
+// ready for fetching. Fetched assertions can then be provided with
+// Add or AddBatch. Because these can have prerequisites calling
+// ToResolve and fetching needs to be repeated until ToResolve's
+// result is empty.  Between any two ToResolve invocations but after
+// any Add or AddBatch AddUnresolved/AddToUpdate can also be used
+// again.
+//
+//                      V
+//                      |
+//        /-> AddUnresolved, AddToUpdate
+//        |             |
+//        |             V
+//        |------> ToResolve -> empty? done
+//        |             |
+//        |             V
+//        \ __________ Add
+//
+//
+// If errors prevent from fulfilling assertions from a ToResolve,
+// AddError and AddGroupingError can be used to report the errors so
+// that they can be associated with groups.
+//
+// All the resolved assertions in a Pool from groups not in error can
+// be committed to a destination database with CommitTo.
+type Pool struct {
+	groundDB RODatabase
+
+	numbering map[string]uint16
+	groupings *internal.Groupings
+
+	unresolved    map[string]*unresolvedRec
+	prerequisites map[string]*unresolvedRec
+
+	bs        Backstore
+	unchanged map[string]bool
+
+	groups map[uint16]*groupRec
+
+	curPhase poolPhase
+}
+
+// NewPool creates a new Pool, groundDB is used to resolve trusted and
+// predefined assertions and to provide the current revision for
+// assertions to update and their prerequisites. Up to n groups can be
+// used to organize the assertions.
+func NewPool(groundDB RODatabase, n int) *Pool {
+	groupings, err := internal.NewGroupings(n)
+	if err != nil {
+		panic(fmt.Sprintf("NewPool: %v", err))
+	}
+	return &Pool{
+		groundDB:      groundDB,
+		numbering:     make(map[string]uint16),
+		groupings:     groupings,
+		unresolved:    make(map[string]*unresolvedRec),
+		prerequisites: make(map[string]*unresolvedRec),
+		bs:            NewMemoryBackstore(),
+		unchanged:     make(map[string]bool),
+		groups:        make(map[uint16]*groupRec),
+	}
+}
+
+func (p *Pool) groupNum(group string) (gnum uint16, err error) {
+	if gnum, ok := p.numbering[group]; ok {
+		return gnum, nil
+	}
+	gnum = uint16(len(p.numbering))
+	if err = p.groupings.WithinRange(gnum); err != nil {
+		return 0, err
+	}
+	p.numbering[group] = gnum
+	return gnum, nil
+}
+
+func (p *Pool) ensureGroup(group string) (gnum uint16, err error) {
+	gnum, err = p.groupNum(group)
+	if err != nil {
+		return 0, err
+	}
+	if gRec := p.groups[gnum]; gRec == nil {
+		p.groups[gnum] = &groupRec{
+			name: group,
+		}
+	}
+	return gnum, nil
+}
+
+// Singleton returns a grouping containing only the given group.
+// It is useful mainly for tests and to drive Add are AddBatch when the
+// server is pushing assertions (instead of the usual pull scenario).
+func (p *Pool) Singleton(group string) (Grouping, error) {
+	gnum, err := p.ensureGroup(group)
+	if err != nil {
+		return Grouping(""), nil
+	}
+
+	var grouping internal.Grouping
+	p.groupings.AddTo(&grouping, gnum)
+	return Grouping(p.groupings.Serialize(&grouping)), nil
+}
+
+// An unresolvedRec tracks a single unresolved assertion until it is
+// resolved or there is an error doing so. The field 'grouping' will
+// grow to contain all the groups requiring this assertion while it
+// is unresolved.
+type unresolvedRec struct {
+	at       *AtRevision
+	grouping internal.Grouping
+
+	serializedLabel Grouping
+
+	err error
+}
+
+func (u *unresolvedRec) exportTo(r map[Grouping][]*AtRevision, gr *internal.Groupings) {
+	serLabel := Grouping(gr.Serialize(&u.grouping))
+	// remember serialized label
+	u.serializedLabel = serLabel
+	r[serLabel] = append(r[serLabel], u.at)
+}
+
+func (u *unresolvedRec) merge(at *AtRevision, gnum uint16, gr *internal.Groupings) {
+	gr.AddTo(&u.grouping, gnum)
+	// assume we want to resolve/update wrt the highest revision
+	if at.Revision > u.at.Revision {
+		u.at.Revision = at.Revision
+	}
+}
+
+// A groupRec keeps track of all the resolved assertions in a group
+// or whether the group should be considered in error (err != nil).
+type groupRec struct {
+	name     string
+	err      error
+	resolved []Ref
+}
+
+func (gRec *groupRec) hasErr() bool {
+	return gRec.err != nil
+}
+
+func (gRec *groupRec) setErr(e error) {
+	if gRec.err == nil {
+		gRec.err = e
+	}
+}
+
+func (gRec *groupRec) markResolved(ref *Ref) (marked bool) {
+	if gRec.hasErr() {
+		return false
+	}
+	gRec.resolved = append(gRec.resolved, *ref)
+	return true
+}
+
+// markResolved marks the assertion referenced by ref as resolved
+// in all the groups in grouping, except those already in error.
+func (p *Pool) markResolved(grouping *internal.Grouping, resolved *Ref) (marked bool) {
+	p.groupings.Iter(grouping, func(gnum uint16) error {
+		if p.groups[gnum].markResolved(resolved) {
+			marked = true
+		}
+		return nil
+	})
+	return marked
+}
+
+// setErr marks all the groups in grouping as in error with error err
+// except those already in error.
+func (p *Pool) setErr(grouping *internal.Grouping, err error) {
+	p.groupings.Iter(grouping, func(gnum uint16) error {
+		p.groups[gnum].setErr(err)
+		return nil
+	})
+}
+
+func (p *Pool) isPredefined(ref *Ref) (bool, error) {
+	_, err := ref.Resolve(p.groundDB.FindPredefined)
+	if err == nil {
+		return true, nil
+	}
+	if !IsNotFound(err) {
+		return false, err
+	}
+	return false, nil
+}
+
+func (p *Pool) isResolved(ref *Ref) (bool, error) {
+	if p.unchanged[ref.Unique()] {
+		return true, nil
+	}
+	_, err := p.bs.Get(ref.Type, ref.PrimaryKey, ref.Type.MaxSupportedFormat())
+	if err == nil {
+		return true, nil
+	}
+	if !IsNotFound(err) {
+		return false, err
+	}
+	return false, nil
+}
+
+func (p *Pool) curRevision(ref *Ref) (int, error) {
+	a, err := ref.Resolve(p.groundDB.Find)
+	if err != nil && !IsNotFound(err) {
+		return 0, err
+	}
+	if err == nil {
+		return a.Revision(), nil
+	}
+	return RevisionNotKnown, nil
+}
+
+type poolPhase int
+
+const (
+	poolPhaseAddUnresolved = iota
+	poolPhaseAdd
+)
+
+func (p *Pool) phase(ph poolPhase) error {
+	if ph == p.curPhase {
+		return nil
+	}
+	if ph == poolPhaseAdd {
+		return fmt.Errorf("internal error: cannot switch to Pool add phase without invoking ToResolve first")
+	}
+	// ph == poolPhaseAddUnresolved
+	p.unresolvedBookkeeping()
+	p.curPhase = poolPhaseAddUnresolved
+	return nil
+}
+
+// AddUnresolved adds the assertion referenced by unresolved
+// AtRevision to the Pool as unresolved and as required by the given group.
+// Usually unresolved.Revision will have been set to RevisionNotKnown.
+func (p *Pool) AddUnresolved(unresolved *AtRevision, group string) error {
+	if err := p.phase(poolPhaseAddUnresolved); err != nil {
+		return err
+	}
+	gnum, err := p.ensureGroup(group)
+	if err != nil {
+		return err
+	}
+	u := *unresolved
+	ok, err := p.isPredefined(&u.Ref)
+	if err != nil {
+		return err
+	}
+	if ok {
+		// predefined, nothing to do
+		return nil
+	}
+	return p.addUnresolved(&u, gnum)
+}
+
+func (p *Pool) addUnresolved(unresolved *AtRevision, gnum uint16) error {
+	ok, err := p.isResolved(&unresolved.Ref)
+	if err != nil {
+		return err
+	}
+	if ok {
+		// We assume that either the resolving of
+		// prerequisites for the already resolved assertion in
+		// progress has succeeded or will. If that's not the
+		// case we will fail at CommitTo time. We could
+		// instead recurse into its prerequisites again but the
+		// complexity isn't clearly worth it.
+		// See TestParallelPartialResolutionFailure
+		// Mark this as resolved in the group.
+		p.groups[gnum].markResolved(&unresolved.Ref)
+		return nil
+	}
+	uniq := unresolved.Ref.Unique()
+	var u *unresolvedRec
+	if u = p.unresolved[uniq]; u == nil {
+		u = &unresolvedRec{
+			at: unresolved,
+		}
+		p.unresolved[uniq] = u
+	}
+	u.merge(unresolved, gnum, p.groupings)
+	return nil
+}
+
+// ToResolve returns all the currently unresolved assertions in the
+// Pool, organized in opaque groupings based on which set of groups
+// requires each of them.
+// At the next ToResolve any unresolved assertion with not known
+// revision that was not added via Add or AddBatch will result in all
+// groups requiring it being in error with ErrUnresolved.
+// Conversely, the remaining unresolved assertions originally added
+// via AddToUpdate will be assumed to still be at their current
+// revisions.
+func (p *Pool) ToResolve() (map[Grouping][]*AtRevision, error) {
+	if p.curPhase == poolPhaseAdd {
+		p.unresolvedBookkeeping()
+	} else {
+		p.curPhase = poolPhaseAdd
+	}
+	r := make(map[Grouping][]*AtRevision)
+	for _, u := range p.unresolved {
+		if u.at.Revision == RevisionNotKnown {
+			rev, err := p.curRevision(&u.at.Ref)
+			if err != nil {
+				return nil, err
+			}
+			if rev != RevisionNotKnown {
+				u.at.Revision = rev
+			}
+		}
+		u.exportTo(r, p.groupings)
+	}
+	return r, nil
+}
+
+func (p *Pool) addPrerequisite(pref *Ref, g *internal.Grouping) error {
+	uniq := pref.Unique()
+	u := p.unresolved[uniq]
+	at := &AtRevision{
+		Ref:      *pref,
+		Revision: RevisionNotKnown,
+	}
+	if u == nil {
+		u = p.prerequisites[uniq]
+	}
+	if u != nil {
+		gr := p.groupings
+		gr.Iter(g, func(gnum uint16) error {
+			u.merge(at, gnum, gr)
+			return nil
+		})
+		return nil
+	}
+	ok, err := p.isPredefined(pref)
+	if err != nil {
+		return err
+	}
+	if ok {
+		// nothing to do
+		return nil
+	}
+	ok, err = p.isResolved(pref)
+	if err != nil {
+		return err
+	}
+	if ok {
+		// nothing to do, it is anyway implied
+		return nil
+	}
+	p.prerequisites[uniq] = &unresolvedRec{
+		at:       at,
+		grouping: g.Copy(),
+	}
+	return nil
+}
+
+func (p *Pool) add(a Assertion, g *internal.Grouping) error {
+	if err := p.bs.Put(a.Type(), a); err != nil {
+		if revErr, ok := err.(*RevisionError); ok {
+			if revErr.Current >= a.Revision() {
+				// we already got something more recent
+				return nil
+			}
+		}
+
+		return err
+	}
+	for _, pref := range a.Prerequisites() {
+		if err := p.addPrerequisite(pref, g); err != nil {
+			return err
+		}
+	}
+	keyRef := &Ref{
+		Type:       AccountKeyType,
+		PrimaryKey: []string{a.SignKeyID()},
+	}
+	if err := p.addPrerequisite(keyRef, g); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (p *Pool) resolveWith(unresolved map[string]*unresolvedRec, uniq string, u *unresolvedRec, a Assertion, extrag *internal.Grouping) (ok bool, err error) {
+	if a.Revision() > u.at.Revision {
+		if extrag == nil {
+			extrag = &u.grouping
+		} else {
+			p.groupings.Iter(&u.grouping, func(gnum uint16) error {
+				p.groupings.AddTo(extrag, gnum)
+				return nil
+			})
+		}
+		ref := a.Ref()
+		if p.markResolved(extrag, ref) {
+			// remove from tracking -
+			// remove u from unresolved only if the assertion
+			// is added to the resolved backstore;
+			// otherwise it might resurface as unresolved;
+			// it will be ultimately handled in
+			// unresolvedBookkeeping if it stays around
+			delete(unresolved, uniq)
+			if err := p.add(a, extrag); err != nil {
+				p.setErr(extrag, err)
+				return false, err
+			}
+		}
+	}
+	return true, nil
+}
+
+// Add adds the given assertion associated with the given grouping to the
+// Pool as resolved in all the groups requiring it.
+// Any not already resolved prerequisites of the assertion will
+// be implicitly added as unresolved and required by all of those groups.
+// The grouping will usually have been associated with the assertion
+// in a ToResolve's result. Otherwise the union of all groups
+// requiring the assertion plus the groups in grouping will be considered.
+// The latter is mostly relevant in scenarios where the server is pushing
+// assertions.
+// If an error is returned it refers to an immediate or local error.
+// Errors related to the assertions are associated with the relevant groups
+// and can be retrieved with Err, in which case ok is set to false.
+func (p *Pool) Add(a Assertion, grouping Grouping) (ok bool, err error) {
+	if err := p.phase(poolPhaseAdd); err != nil {
+		return false, err
+	}
+
+	if !a.SupportedFormat() {
+		e := &UnsupportedFormatError{Ref: a.Ref(), Format: a.Format()}
+		p.AddGroupingError(e, grouping)
+		return false, nil
+	}
+
+	return p.addToGrouping(a, grouping, p.groupings.Deserialize)
+}
+
+func (p *Pool) addToGrouping(a Assertion, grouping Grouping, deserializeGrouping func(string) (*internal.Grouping, error)) (ok bool, err error) {
+	uniq := a.Ref().Unique()
+	var u *unresolvedRec
+	var extrag *internal.Grouping
+	var unresolved map[string]*unresolvedRec
+	if u = p.unresolved[uniq]; u != nil {
+		unresolved = p.unresolved
+	} else if u = p.prerequisites[uniq]; u != nil {
+		unresolved = p.prerequisites
+	} else {
+		ok, err := p.isPredefined(a.Ref())
+		if err != nil {
+			return false, err
+		}
+		if ok {
+			// nothing to do
+			return true, nil
+		}
+		// a is not tracked as unresolved in any way so far,
+		// this is an atypical scenario where something gets
+		// pushed but we still want to add it to the resolved
+		// lists of the relevant groups; in case it is
+		// actually already resolved most of resolveWith below will
+		// be a nop
+		u = &unresolvedRec{
+			at: a.At(),
+		}
+		u.at.Revision = RevisionNotKnown
+	}
+
+	if u.serializedLabel != grouping {
+		var err error
+		extrag, err = deserializeGrouping(string(grouping))
+		if err != nil {
+			return false, err
+		}
+	}
+
+	return p.resolveWith(unresolved, uniq, u, a, extrag)
+}
+
+// AddBatch adds all the assertions in the Batch to the Pool,
+// associated with the given grouping and as resolved in all the
+// groups requiring them. It is equivalent to using Add on each of them.
+// If an error is returned it refers to an immediate or local error.
+// Errors related to the assertions are associated with the relevant groups
+// and can be retrieved with Err, in which case ok set to false.
+func (p *Pool) AddBatch(b *Batch, grouping Grouping) (ok bool, err error) {
+	if err := p.phase(poolPhaseAdd); err != nil {
+		return false, err
+	}
+
+	// b dealt with unsupported formats already
+
+	// deserialize grouping if needed only once
+	var cachedGrouping *internal.Grouping
+	deser := func(_ string) (*internal.Grouping, error) {
+		if cachedGrouping != nil {
+			// do a copy as addToGrouping and resolveWith
+			// might add to their input
+			g := cachedGrouping.Copy()
+			return &g, nil
+		}
+		var err error
+		cachedGrouping, err = p.groupings.Deserialize(string(grouping))
+		return cachedGrouping, err
+	}
+
+	inError := false
+	for _, a := range b.added {
+		ok, err := p.addToGrouping(a, grouping, deser)
+		if err != nil {
+			return false, err
+		}
+		if !ok {
+			inError = true
+		}
+	}
+
+	return !inError, nil
+}
+
+var (
+	ErrUnresolved       = errors.New("unresolved assertion")
+	ErrUnknownPoolGroup = errors.New("unknown pool group")
+)
+
+// unresolvedBookkeeping processes any left over unresolved assertions
+// since the last ToResolve invocation and intervening calls to Add/AddBatch,
+//  * they were either marked as in error which will be propagated
+//    to all groups requiring them
+//  * simply unresolved, which will be propagated to groups requiring them
+//    as ErrUnresolved
+//  * unchanged (update case)
+// unresolvedBookkeeping will also promote any recorded prerequisites
+// into actively unresolved, as long as not all the groups requiring them
+// are in error.
+func (p *Pool) unresolvedBookkeeping() {
+	// any left over unresolved are either:
+	//  * in error
+	//  * unchanged
+	//  * or unresolved
+	for uniq, u := range p.unresolved {
+		e := u.err
+		if e == nil {
+			if u.at.Revision == RevisionNotKnown {
+				e = ErrUnresolved
+			} else {
+				// unchanged
+				p.unchanged[uniq] = true
+			}
+		}
+		if e != nil {
+			p.setErr(&u.grouping, e)
+		}
+		delete(p.unresolved, uniq)
+	}
+
+	// prerequisites will become the new unresolved but drop them
+	// if all their groups are in error
+	for uniq, prereq := range p.prerequisites {
+		useful := false
+		p.groupings.Iter(&prereq.grouping, func(gnum uint16) error {
+			if !p.groups[gnum].hasErr() {
+				useful = true
+			}
+			return nil
+		})
+		if !useful {
+			delete(p.prerequisites, uniq)
+			continue
+		}
+	}
+
+	// prerequisites become the new unresolved, the emptied
+	// unresolved is used for prerequisites in the next round
+	p.unresolved, p.prerequisites = p.prerequisites, p.unresolved
+}
+
+// Err returns the error for group if group is in error, nil otherwise.
+func (p *Pool) Err(group string) error {
+	gnum, err := p.groupNum(group)
+	if err != nil {
+		return err
+	}
+	gRec := p.groups[gnum]
+	if gRec == nil {
+		return ErrUnknownPoolGroup
+	}
+	return gRec.err
+}
+
+// Errors returns a mapping of groups in error to their errors.
+func (p *Pool) Errors() map[string]error {
+	res := make(map[string]error)
+	for _, gRec := range p.groups {
+		if err := gRec.err; err != nil {
+			res[gRec.name] = err
+		}
+	}
+	if len(res) == 0 {
+		return nil
+	}
+	return res
+}
+
+// AddError associates error e with the unresolved assertion.
+// The error will be propagated to all the affected groups at
+// the next ToResolve.
+func (p *Pool) AddError(e error, ref *Ref) error {
+	if err := p.phase(poolPhaseAdd); err != nil {
+		return err
+	}
+	uniq := ref.Unique()
+	if u := p.unresolved[uniq]; u != nil && u.err == nil {
+		u.err = e
+	}
+	return nil
+}
+
+// AddGroupingError puts all the groups of grouping in error, with error e.
+func (p *Pool) AddGroupingError(e error, grouping Grouping) error {
+	if err := p.phase(poolPhaseAdd); err != nil {
+		return err
+	}
+
+	g, err := p.groupings.Deserialize(string(grouping))
+	if err != nil {
+		return err
+	}
+
+	p.setErr(g, e)
+	return nil
+}
+
+// AddToUpdate adds the assertion referenced by toUpdate and all its
+// prerequisites to the Pool as unresolved and as required by the
+// given group. It is assumed that the assertion is currently in the
+// ground database of the Pool, otherwise this will error.
+// The current revisions of the assertion and its prerequisites will
+// be recorded and only higher revisions will then resolve them,
+// otherwise if ultimately unresolved they will be assumed to still be
+// at their current ones.
+func (p *Pool) AddToUpdate(toUpdate *Ref, group string) error {
+	if err := p.phase(poolPhaseAddUnresolved); err != nil {
+		return err
+	}
+	gnum, err := p.ensureGroup(group)
+	if err != nil {
+		return err
+	}
+	retrieve := func(ref *Ref) (Assertion, error) {
+		return ref.Resolve(p.groundDB.Find)
+	}
+	add := func(a Assertion) error {
+		return p.addUnresolved(a.At(), gnum)
+	}
+	f := NewFetcher(p.groundDB, retrieve, add)
+	if err := f.Fetch(toUpdate); err != nil {
+		return err
+	}
+	return nil
+}
+
+// CommitTo adds the assertions from groups without errors to the
+// given assertion database. Commit errors can be retrieved via Err
+// per group. An error is returned directly only if CommitTo is called
+// with possible pending unresolved assertions.
+func (p *Pool) CommitTo(db *Database) error {
+	if p.curPhase == poolPhaseAddUnresolved {
+		return fmt.Errorf("internal error: cannot commit Pool during add unresolved phase")
+	}
+	p.unresolvedBookkeeping()
+
+	retrieve := func(ref *Ref) (Assertion, error) {
+		a, err := p.bs.Get(ref.Type, ref.PrimaryKey, ref.Type.MaxSupportedFormat())
+		if IsNotFound(err) {
+			// fallback to pre-existing assertions
+			a, err = ref.Resolve(db.Find)
+		}
+		if err != nil {
+			return nil, resolveError("cannot resolve prerequisite assertion: %s", ref, err)
+		}
+		return a, nil
+	}
+	save := func(a Assertion) error {
+		err := db.Add(a)
+		if IsUnaccceptedUpdate(err) {
+			// unsupported format case is handled before.
+			// be idempotent, db has already the same or
+			// newer.
+			return nil
+		}
+		return err
+	}
+
+NextGroup:
+	for _, gRec := range p.groups {
+		if gRec.hasErr() {
+			// already in error, ignore
+			continue
+		}
+		// TODO: try to reuse fetcher
+		f := NewFetcher(db, retrieve, save)
+		for i := range gRec.resolved {
+			if err := f.Fetch(&gRec.resolved[i]); err != nil {
+				gRec.setErr(err)
+				continue NextGroup
+			}
+		}
+	}
+
+	return nil
+}
+
+// ClearGroups clears the pool in terms of information associated with groups
+// while preserving information about already resolved or unchanged assertions.
+// It is useful for reusing a pool once the maximum of usable groups
+// that was set with NewPool has been exhausted. Group errors must be
+// queried before calling it otherwise they are lost. It is an error
+// to call it when there are still pending unresolved assertions in
+// the pool.
+func (p *Pool) ClearGroups() error {
+	if len(p.unresolved) != 0 || len(p.prerequisites) != 0 {
+		return fmt.Errorf("internal error: trying to clear groups of asserts.Pool with pending unresolved or prerequisites")
+	}
+
+	p.numbering = make(map[string]uint16)
+	// use a fresh Groupings as well so that max group tracking starts
+	// from scratch.
+	// NewGroupings cannot fail on a value accepted by it previously
+	p.groupings, _ = internal.NewGroupings(p.groupings.N())
+	p.groups = make(map[uint16]*groupRec)
+	p.curPhase = poolPhaseAdd
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/pool_test.go snapd-2.48.3+20.04/asserts/pool_test.go
--- snapd-2.45.1+20.04.2/asserts/pool_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/pool_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1019 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package asserts_test
+
+import (
+	"errors"
+	"sort"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/assertstest"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type poolSuite struct {
+	testutil.BaseTest
+
+	hub      *assertstest.StoreStack
+	dev1Acct *asserts.Account
+	dev2Acct *asserts.Account
+
+	decl1     *asserts.TestOnlyDecl
+	decl1_1   *asserts.TestOnlyDecl
+	rev1_1111 *asserts.TestOnlyRev
+	rev1_3333 *asserts.TestOnlyRev
+
+	decl2     *asserts.TestOnlyDecl
+	rev2_2222 *asserts.TestOnlyRev
+
+	db *asserts.Database
+}
+
+var _ = Suite(&poolSuite{})
+
+func (s *poolSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.hub = assertstest.NewStoreStack("hub", nil)
+	s.dev1Acct = assertstest.NewAccount(s.hub, "developer1", map[string]interface{}{
+		"account-id": "developer1",
+	}, "")
+	s.dev2Acct = assertstest.NewAccount(s.hub, "developer2", map[string]interface{}{
+		"account-id": "developer2",
+	}, "")
+
+	a, err := s.hub.Sign(asserts.TestOnlyDeclType, map[string]interface{}{
+		"id":     "one",
+		"dev-id": "developer1",
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.decl1 = a.(*asserts.TestOnlyDecl)
+
+	a, err = s.hub.Sign(asserts.TestOnlyDeclType, map[string]interface{}{
+		"id":       "one",
+		"dev-id":   "developer1",
+		"revision": "1",
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.decl1_1 = a.(*asserts.TestOnlyDecl)
+
+	a, err = s.hub.Sign(asserts.TestOnlyDeclType, map[string]interface{}{
+		"id":     "two",
+		"dev-id": "developer2",
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.decl2 = a.(*asserts.TestOnlyDecl)
+
+	a, err = s.hub.Sign(asserts.TestOnlyRevType, map[string]interface{}{
+		"h":      "1111",
+		"id":     "one",
+		"dev-id": "developer1",
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.rev1_1111 = a.(*asserts.TestOnlyRev)
+
+	a, err = s.hub.Sign(asserts.TestOnlyRevType, map[string]interface{}{
+		"h":      "3333",
+		"id":     "one",
+		"dev-id": "developer1",
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.rev1_3333 = a.(*asserts.TestOnlyRev)
+
+	a, err = s.hub.Sign(asserts.TestOnlyRevType, map[string]interface{}{
+		"h":      "2222",
+		"id":     "two",
+		"dev-id": "developer2",
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.rev2_2222 = a.(*asserts.TestOnlyRev)
+
+	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
+		Backstore: asserts.NewMemoryBackstore(),
+		Trusted:   s.hub.Trusted,
+	})
+	c.Assert(err, IsNil)
+	s.db = db
+}
+
+func (s *poolSuite) TestAddUnresolved(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	at1 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(at1, "for_one") // group num: 0
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {at1},
+	})
+}
+
+func (s *poolSuite) TestAddUnresolvedPredefined(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	at := s.hub.TrustedAccount.At()
+	at.Revision = asserts.RevisionNotKnown
+	err := pool.AddUnresolved(at, "for_one")
+	c.Assert(err, IsNil)
+
+	// nothing to resolve
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+}
+
+func (s *poolSuite) TestAddUnresolvedGrouping(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+
+	pool.AddUnresolved(storeKeyAt, "for_two") // group num: 0
+	pool.AddUnresolved(storeKeyAt, "for_one") // group num: 1
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0, 1): {storeKeyAt},
+	})
+}
+
+func (s *poolSuite) TestAddUnresolvedDup(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+
+	pool.AddUnresolved(storeKeyAt, "for_one") // group num: 0
+	pool.AddUnresolved(storeKeyAt, "for_one") // group num: 0
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt},
+	})
+}
+
+type byAtRevision []*asserts.AtRevision
+
+func (ats byAtRevision) Len() int {
+	return len(ats)
+}
+
+func (ats byAtRevision) Less(i, j int) bool {
+	return ats[i].Ref.Unique() < ats[j].Ref.Unique()
+}
+
+func (ats byAtRevision) Swap(i, j int) {
+	ats[i], ats[j] = ats[j], ats[i]
+}
+
+func sortToResolve(toResolve map[asserts.Grouping][]*asserts.AtRevision) {
+	for _, ats := range toResolve {
+		sort.Sort(byAtRevision(ats))
+	}
+}
+
+func (s *poolSuite) TestFetch(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {at1111},
+	})
+
+	ok, err := pool.Add(s.rev1_1111, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	decl1At := s.decl1.At()
+	decl1At.Revision = asserts.RevisionNotKnown
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+	storeKeyAt.Revision = asserts.RevisionNotKnown
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt, dev1AcctAt, decl1At},
+	})
+
+	c.Check(pool.Err("for_one"), IsNil)
+}
+
+func (s *poolSuite) TestCompleteFetch(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {at1111},
+	})
+
+	ok, err := pool.Add(s.rev1_1111, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	decl1At := s.decl1.At()
+	decl1At.Revision = asserts.RevisionNotKnown
+	storeKey := s.hub.StoreAccountKey("")
+	storeKeyAt := storeKey.At()
+	storeKeyAt.Revision = asserts.RevisionNotKnown
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt, dev1AcctAt, decl1At},
+	})
+
+	b := asserts.NewBatch(nil)
+	err = b.Add(s.decl1)
+	c.Assert(err, IsNil)
+	err = b.Add(storeKey)
+	c.Assert(err, IsNil)
+	err = b.Add(s.dev1Acct)
+	c.Assert(err, IsNil)
+
+	ok, err = pool.AddBatch(b, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	err = pool.CommitTo(s.db)
+	c.Check(err, IsNil)
+	c.Assert(pool.Err("for_one"), IsNil)
+
+	a, err := at1111.Ref.Resolve(s.db.Find)
+	c.Assert(err, IsNil)
+	c.Check(a.(*asserts.TestOnlyRev).H(), Equals, "1111")
+}
+
+func (s *poolSuite) TestPushSuggestionForPrerequisite(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {at1111},
+	})
+
+	ok, err := pool.Add(s.rev1_1111, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	// push prerequisite suggestion
+	ok, err = pool.Add(s.decl1, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	storeKey := s.hub.StoreAccountKey("")
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At(), dev1AcctAt},
+	})
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	ok, err = pool.Add(s.dev1Acct, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	err = pool.CommitTo(s.db)
+	c.Check(err, IsNil)
+	c.Assert(pool.Err("for_one"), IsNil)
+
+	a, err := at1111.Ref.Resolve(s.db.Find)
+	c.Assert(err, IsNil)
+	c.Check(a.(*asserts.TestOnlyRev).H(), Equals, "1111")
+}
+
+func (s *poolSuite) TestPushSuggestionForNew(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	atOne := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyDeclType, PrimaryKey: []string{"one"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(atOne, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {atOne},
+	})
+
+	ok, err := pool.Add(s.decl1, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	// new push suggestion
+	ok, err = pool.Add(s.rev1_1111, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt, dev1AcctAt},
+	})
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	ok, err = pool.Add(s.dev1Acct, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	err = pool.CommitTo(s.db)
+	c.Check(err, IsNil)
+	c.Assert(pool.Err("for_one"), IsNil)
+
+	a, err := s.rev1_1111.Ref().Resolve(s.db.Find)
+	c.Assert(err, IsNil)
+	c.Check(a.(*asserts.TestOnlyRev).H(), Equals, "1111")
+}
+
+func (s *poolSuite) TestPushSuggestionForNewViaBatch(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	atOne := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyDeclType, PrimaryKey: []string{"one"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(atOne, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {atOne},
+	})
+
+	b := asserts.NewBatch(nil)
+	err = b.Add(s.decl1)
+	c.Assert(err, IsNil)
+
+	// new push suggestions
+	err = b.Add(s.rev1_1111)
+	c.Assert(err, IsNil)
+	err = b.Add(s.rev1_3333)
+	c.Assert(err, IsNil)
+
+	ok, err := pool.AddBatch(b, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt, dev1AcctAt},
+	})
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	ok, err = pool.Add(s.dev1Acct, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	err = pool.CommitTo(s.db)
+	c.Check(err, IsNil)
+	c.Assert(pool.Err("for_one"), IsNil)
+
+	a, err := s.rev1_1111.Ref().Resolve(s.db.Find)
+	c.Assert(err, IsNil)
+	c.Check(a.(*asserts.TestOnlyRev).H(), Equals, "1111")
+
+	a, err = s.rev1_3333.Ref().Resolve(s.db.Find)
+	c.Assert(err, IsNil)
+	c.Check(a.(*asserts.TestOnlyRev).H(), Equals, "3333")
+}
+
+func (s *poolSuite) TestAddUnresolvedUnresolved(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	at1 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(at1, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {at1},
+	})
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("for_one"), Equals, asserts.ErrUnresolved)
+}
+
+func (s *poolSuite) TestAddFormatTooNew(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	_, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+
+	var a asserts.Assertion
+	(func() {
+		restore := asserts.MockMaxSupportedFormat(asserts.TestOnlyDeclType, 2)
+		defer restore()
+
+		a, err = s.hub.Sign(asserts.TestOnlyDeclType, map[string]interface{}{
+			"id":     "three",
+			"dev-id": "developer1",
+			"format": "2",
+		}, nil, "")
+		c.Assert(err, IsNil)
+	})()
+
+	gSuggestion, err := pool.Singleton("suggestion")
+	c.Assert(err, IsNil)
+
+	ok, err := pool.Add(a, gSuggestion)
+	c.Check(err, IsNil)
+	c.Check(ok, Equals, false)
+	c.Assert(pool.Err("suggestion"), ErrorMatches, `proposed "test-only-decl" assertion has format 2 but 0 is latest supported`)
+}
+
+func (s *poolSuite) TestAddOlderIgnored(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	_, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+
+	gSuggestion, err := pool.Singleton("suggestion")
+	c.Assert(err, IsNil)
+
+	ok, err := pool.Add(s.decl1_1, gSuggestion)
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	ok, err = pool.Add(s.decl1, gSuggestion)
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+	storeKeyAt.Revision = asserts.RevisionNotKnown
+
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		gSuggestion: {storeKeyAt, dev1AcctAt},
+	})
+}
+
+func (s *poolSuite) TestUnknownGroup(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	_, err := pool.Singleton("suggestion")
+	c.Assert(err, IsNil)
+	// sanity
+	c.Check(pool.Err("suggestion"), IsNil)
+
+	c.Check(pool.Err("foo"), Equals, asserts.ErrUnknownPoolGroup)
+}
+
+func (s *poolSuite) TestAddCurrentRevision(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""), s.dev1Acct, s.decl1)
+
+	pool := asserts.NewPool(s.db, 64)
+
+	atDev1Acct := s.dev1Acct.At()
+	atDev1Acct.Revision = asserts.RevisionNotKnown
+	err := pool.AddUnresolved(atDev1Acct, "one")
+	c.Assert(err, IsNil)
+
+	atDecl1 := s.decl1.At()
+	atDecl1.Revision = asserts.RevisionNotKnown
+	err = pool.AddUnresolved(atDecl1, "one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {s.dev1Acct.At(), s.decl1.At()},
+	})
+
+	// re-adding of current revisions, is not what we expect
+	// but needs not to produce unneeded roundtrips
+
+	ok, err := pool.Add(s.hub.StoreAccountKey(""), asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	// this will be kept marked as unresolved until the ToResolve
+	ok, err = pool.Add(s.dev1Acct, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	ok, err = pool.Add(s.decl1_1, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Assert(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("one"), IsNil)
+}
+
+func (s *poolSuite) TestUpdate(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+	assertstest.AddMany(s.db, s.dev1Acct, s.decl1, s.rev1_1111)
+	assertstest.AddMany(s.db, s.dev2Acct, s.decl2, s.rev2_2222)
+
+	pool := asserts.NewPool(s.db, 64)
+
+	err := pool.AddToUpdate(s.decl1.Ref(), "for_one") // group num: 0
+	c.Assert(err, IsNil)
+	err = pool.AddToUpdate(s.decl2.Ref(), "for_two") // group num: 1
+	c.Assert(err, IsNil)
+
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0, 1): {storeKeyAt},
+		asserts.MakePoolGrouping(0):    {s.dev1Acct.At(), s.decl1.At()},
+		asserts.MakePoolGrouping(1):    {s.dev2Acct.At(), s.decl2.At()},
+	})
+
+	ok, err := pool.Add(s.decl1_1, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	at2222 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"2222"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err = pool.AddUnresolved(at2222, "for_two")
+	c.Assert(err, IsNil)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(1): {&asserts.AtRevision{
+			Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"2222"}},
+			Revision: 0,
+		}},
+	})
+
+	c.Check(pool.Err("for_one"), IsNil)
+	c.Check(pool.Err("for_two"), IsNil)
+}
+
+var errBoom = errors.New("boom")
+
+func (s *poolSuite) TestAddErrorEarly(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKey := s.hub.StoreAccountKey("")
+	err := pool.AddToUpdate(storeKey.Ref(), "store_key")
+	c.Assert(err, IsNil)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err = pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At()},
+		asserts.MakePoolGrouping(1): {at1111},
+	})
+
+	err = pool.AddError(errBoom, storeKey.Ref())
+	c.Assert(err, IsNil)
+
+	ok, err := pool.Add(s.rev1_1111, asserts.MakePoolGrouping(1))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("store_key"), Equals, errBoom)
+	c.Check(pool.Err("for_one"), Equals, errBoom)
+}
+
+func (s *poolSuite) TestAddErrorLater(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKey := s.hub.StoreAccountKey("")
+	err := pool.AddToUpdate(storeKey.Ref(), "store_key")
+	c.Assert(err, IsNil)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err = pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At()},
+		asserts.MakePoolGrouping(1): {at1111},
+	})
+
+	ok, err := pool.Add(s.rev1_1111, asserts.MakePoolGrouping(1))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	err = pool.AddError(errBoom, storeKey.Ref())
+	c.Assert(err, IsNil)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("store_key"), Equals, errBoom)
+	c.Check(pool.Err("for_one"), Equals, errBoom)
+}
+
+func (s *poolSuite) TestNopUpdatePlusFetchOfPushed(c *C) {
+	storeKey := s.hub.StoreAccountKey("")
+	assertstest.AddMany(s.db, storeKey)
+	assertstest.AddMany(s.db, s.dev1Acct)
+	assertstest.AddMany(s.db, s.decl1)
+	assertstest.AddMany(s.db, s.rev1_1111)
+
+	pool := asserts.NewPool(s.db, 64)
+
+	atOne := s.decl1.At()
+	err := pool.AddToUpdate(&atOne.Ref, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At(), s.dev1Acct.At(), atOne},
+	})
+
+	// no updates but
+	// new push suggestion
+
+	gSuggestion, err := pool.Singleton("suggestion")
+	c.Assert(err, IsNil)
+
+	ok, err := pool.Add(s.rev1_3333, gSuggestion)
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Assert(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("for_one"), IsNil)
+
+	pool.AddGroupingError(errBoom, gSuggestion)
+
+	c.Assert(pool.Err("for_one"), IsNil)
+	c.Assert(pool.Err("suggestion"), Equals, errBoom)
+
+	at3333 := s.rev1_3333.At()
+	at3333.Revision = asserts.RevisionNotKnown
+	err = pool.AddUnresolved(at3333, at3333.Unique())
+	c.Assert(err, IsNil)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Assert(toResolve, HasLen, 0)
+
+	err = pool.CommitTo(s.db)
+	c.Check(err, IsNil)
+
+	c.Assert(pool.Err(at3333.Unique()), IsNil)
+
+	a, err := s.rev1_3333.Ref().Resolve(s.db.Find)
+	c.Assert(err, IsNil)
+	c.Check(a.(*asserts.TestOnlyRev).H(), Equals, "3333")
+}
+
+func (s *poolSuite) TestAddToUpdateThenUnresolved(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKey := s.hub.StoreAccountKey("")
+	storeKeyAt := storeKey.At()
+	storeKeyAt.Revision = asserts.RevisionNotKnown
+
+	err := pool.AddToUpdate(storeKey.Ref(), "for_one")
+	c.Assert(err, IsNil)
+	err = pool.AddUnresolved(storeKeyAt, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At()},
+	})
+}
+
+func (s *poolSuite) TestAddUnresolvedThenToUpdate(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKey := s.hub.StoreAccountKey("")
+	storeKeyAt := storeKey.At()
+	storeKeyAt.Revision = asserts.RevisionNotKnown
+
+	err := pool.AddUnresolved(storeKeyAt, "for_one")
+	c.Assert(err, IsNil)
+	err = pool.AddToUpdate(storeKey.Ref(), "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At()},
+	})
+}
+
+func (s *poolSuite) TestNopUpdatePlusFetch(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKey := s.hub.StoreAccountKey("")
+	err := pool.AddToUpdate(storeKey.Ref(), "store_key")
+	c.Assert(err, IsNil)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err = pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKey.At()},
+		asserts.MakePoolGrouping(1): {at1111},
+	})
+
+	ok, err := pool.Add(s.rev1_1111, asserts.MakePoolGrouping(1))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	decl1At := s.decl1.At()
+	decl1At.Revision = asserts.RevisionNotKnown
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(1): {dev1AcctAt, decl1At},
+	})
+
+	c.Check(pool.Err("store_key"), IsNil)
+	c.Check(pool.Err("for_one"), IsNil)
+}
+
+func (s *poolSuite) TestParallelPartialResolutionFailure(c *C) {
+	pool := asserts.NewPool(s.db, 64)
+
+	atOne := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyDeclType, PrimaryKey: []string{"one"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err := pool.AddUnresolved(atOne, "one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {atOne},
+	})
+
+	ok, err := pool.Add(s.decl1, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	dev1AcctAt := s.dev1Acct.At()
+	dev1AcctAt.Revision = asserts.RevisionNotKnown
+	decl1At := s.decl1.At()
+	decl1At.Revision = asserts.RevisionNotKnown
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+	storeKeyAt.Revision = asserts.RevisionNotKnown
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt, dev1AcctAt},
+	})
+
+	// failed to get prereqs
+	c.Check(pool.AddGroupingError(errBoom, asserts.MakePoolGrouping(0)), IsNil)
+
+	err = pool.AddUnresolved(atOne, "other")
+	c.Assert(err, IsNil)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Err("one"), Equals, errBoom)
+	c.Check(pool.Err("other"), IsNil)
+
+	// we fail at commit though
+	err = pool.CommitTo(s.db)
+	c.Check(err, IsNil)
+	c.Check(pool.Err("one"), Equals, errBoom)
+	c.Check(pool.Err("other"), ErrorMatches, "cannot resolve prerequisite assertion.*")
+}
+
+func (s *poolSuite) TestAddErrors(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+
+	pool := asserts.NewPool(s.db, 64)
+
+	storeKey := s.hub.StoreAccountKey("")
+	err := pool.AddToUpdate(storeKey.Ref(), "store_key")
+	c.Assert(err, IsNil)
+
+	at1111 := &asserts.AtRevision{
+		Ref:      asserts.Ref{Type: asserts.TestOnlyRevType, PrimaryKey: []string{"1111"}},
+		Revision: asserts.RevisionNotKnown,
+	}
+	err = pool.AddUnresolved(at1111, "for_one")
+	c.Assert(err, IsNil)
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 2)
+
+	err = pool.AddError(errBoom, storeKey.Ref())
+	c.Assert(err, IsNil)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	c.Check(pool.Errors(), DeepEquals, map[string]error{
+		"store_key": errBoom,
+		"for_one":   asserts.ErrUnresolved,
+	})
+}
+
+func (s *poolSuite) TestPoolReuseWithClearGroupsAndUnchanged(c *C) {
+	assertstest.AddMany(s.db, s.hub.StoreAccountKey(""))
+	assertstest.AddMany(s.db, s.dev1Acct, s.decl1)
+	assertstest.AddMany(s.db, s.dev2Acct, s.decl2)
+
+	pool := asserts.NewPool(s.db, 64)
+
+	err := pool.AddToUpdate(s.decl1.Ref(), "for_one") // group num: 0
+	c.Assert(err, IsNil)
+
+	storeKeyAt := s.hub.StoreAccountKey("").At()
+
+	toResolve, err := pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {storeKeyAt, s.dev1Acct.At(), s.decl1.At()},
+	})
+
+	ok, err := pool.Add(s.decl1_1, asserts.MakePoolGrouping(0))
+	c.Assert(err, IsNil)
+	c.Assert(ok, Equals, true)
+
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	c.Check(toResolve, HasLen, 0)
+
+	// clear the groups as we would do for real reuse when we have
+	// exhausted allowed groups
+	err = pool.ClearGroups()
+	c.Assert(err, IsNil)
+
+	err = pool.AddToUpdate(s.decl2.Ref(), "for_two") // group num: 0 again
+	c.Assert(err, IsNil)
+
+	// no reference to store key because it is remebered as unchanged
+	// across the clearing
+	toResolve, err = pool.ToResolve()
+	c.Assert(err, IsNil)
+	sortToResolve(toResolve)
+	c.Check(toResolve, DeepEquals, map[asserts.Grouping][]*asserts.AtRevision{
+		asserts.MakePoolGrouping(0): {s.dev2Acct.At(), s.decl2.At()},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/repair.go snapd-2.48.3+20.04/asserts/repair.go
--- snapd-2.45.1+20.04.2/asserts/repair.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/repair.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,8 +21,6 @@
 
 import (
 	"fmt"
-	"regexp"
-	"strconv"
 	"strings"
 	"time"
 )
@@ -55,6 +53,11 @@
 	return r.id
 }
 
+// Sequence implements SequenceMember, it returns the same as RepairID.
+func (r *Repair) Sequence() int {
+	return r.RepairID()
+}
+
 // Summary returns the mandatory summary description of the repair.
 func (r *Repair) Summary() string {
 	return r.HeaderString("summary")
@@ -97,24 +100,16 @@
 // sanity
 var _ consistencyChecker = (*Repair)(nil)
 
-// the repair-id can for now be a sequential number starting with 1
-var validRepairID = regexp.MustCompile("^[1-9][0-9]*$")
-
 func assembleRepair(assert assertionBase) (Assertion, error) {
 	err := checkAuthorityMatchesBrand(&assert)
 	if err != nil {
 		return nil, err
 	}
 
-	repairID, err := checkStringMatches(assert.headers, "repair-id", validRepairID)
+	repairID, err := checkSequence(assert.headers, "repair-id")
 	if err != nil {
 		return nil, err
 	}
-	id, err := strconv.Atoi(repairID)
-	if err != nil {
-		// given it matched it can likely only be too large
-		return nil, fmt.Errorf("repair-id too large: %s", repairID)
-	}
 
 	summary, err := checkNotEmptyString(assert.headers, "summary")
 	if err != nil {
@@ -152,7 +147,7 @@
 		series:        series,
 		architectures: architectures,
 		models:        models,
-		id:            id,
+		id:            repairID,
 		disabled:      disabled,
 		timestamp:     timestamp,
 	}, nil
diff -Nru snapd-2.45.1+20.04.2/asserts/repair_test.go snapd-2.48.3+20.04/asserts/repair_test.go
--- snapd-2.45.1+20.04.2/asserts/repair_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/repair_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -95,10 +95,13 @@
 	a, err := asserts.Decode([]byte(s.repairStr))
 	c.Assert(err, IsNil)
 	c.Check(a.Type(), Equals, asserts.RepairType)
+	_, ok := a.(asserts.SequenceMember)
+	c.Assert(ok, Equals, true)
 	repair := a.(*asserts.Repair)
 	c.Check(repair.Timestamp(), Equals, s.ts)
 	c.Check(repair.BrandID(), Equals, "acme")
 	c.Check(repair.RepairID(), Equals, 42)
+	c.Check(repair.Sequence(), Equals, 42)
 	c.Check(repair.Summary(), Equals, "example repair")
 	c.Check(repair.Series(), DeepEquals, []string{"16"})
 	c.Check(repair.Architectures(), DeepEquals, []string{"amd64", "arm64"})
@@ -142,10 +145,10 @@
 		{"architectures:\n  - amd64\n  - arm64\n", "architectures: foo\n", `"architectures" header must be a list of strings`},
 		{"models:\n  - acme/frobinator\n", "models: \n", `"models" header must be a list of strings`},
 		{"models:\n  - acme/frobinator\n", "models: something\n", `"models" header must be a list of strings`},
-		{"repair-id: 42\n", "repair-id: no-number\n", `"repair-id" header contains invalid characters: "no-number"`},
-		{"repair-id: 42\n", "repair-id: 0\n", `"repair-id" header contains invalid characters: "0"`},
-		{"repair-id: 42\n", "repair-id: 01\n", `"repair-id" header contains invalid characters: "01"`},
-		{"repair-id: 42\n", "repair-id: 99999999999999999999\n", `repair-id too large:.*`},
+		{"repair-id: 42\n", "repair-id: no-number\n", `"repair-id" header is not an integer: no-number`},
+		{"repair-id: 42\n", "repair-id: 0\n", `"repair-id" must be >=1: 0`},
+		{"repair-id: 42\n", "repair-id: 01\n", `"repair-id" header has invalid prefix zeros: 01`},
+		{"repair-id: 42\n", "repair-id: 99999999999999999999\n", `"repair-id" header is out of range: 99999999999999999999`},
 		{"brand-id: acme\n", "brand-id: brand-id-not-eq-authority-id\n", `authority-id and brand-id must match, repair assertions are expected to be signed by the brand: "acme" != "brand-id-not-eq-authority-id"`},
 		{"summary: example repair\n", "", `"summary" header is mandatory`},
 		{"summary: example repair\n", "summary: \n", `"summary" header should not be empty`},
diff -Nru snapd-2.45.1+20.04.2/asserts/snapasserts/snapasserts.go snapd-2.48.3+20.04/asserts/snapasserts/snapasserts.go
--- snapd-2.45.1+20.04.2/asserts/snapasserts/snapasserts.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/snapasserts/snapasserts.go	2021-02-02 08:21:12.000000000 +0000
@@ -17,7 +17,7 @@
  *
  */
 
-// Package snapasserts offers helpers to handle snap assertions and their checking for installation.
+// Package snapasserts offers helpers to handle snap related assertions and their checking for installation.
 package snapasserts
 
 import (
diff -Nru snapd-2.45.1+20.04.2/asserts/snapasserts/validation_sets.go snapd-2.48.3+20.04/asserts/snapasserts/validation_sets.go
--- snapd-2.45.1+20.04.2/asserts/snapasserts/validation_sets.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/snapasserts/validation_sets.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,283 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapasserts
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/snap"
+)
+
+// ValidationSetsConflictError describes an error where multiple
+// validation sets are in conflict about snaps.
+type ValidationSetsConflictError struct {
+	Sets  map[string]*asserts.ValidationSet
+	Snaps map[string]error
+}
+
+func (e *ValidationSetsConflictError) Error() string {
+	buf := bytes.NewBufferString("validation sets are in conflict:")
+	for _, err := range e.Snaps {
+		fmt.Fprintf(buf, "\n- %v", err)
+	}
+	return buf.String()
+}
+
+// ValidationSets can hold a combination of validation-set assertions
+// and can check for conflicts or help applying them.
+type ValidationSets struct {
+	// sets maps sequence keys to validation-set in the combination
+	sets map[string]*asserts.ValidationSet
+	// snaps maps snap-ids to snap constraints
+	snaps map[string]*snapContraints
+}
+
+const presConflict asserts.Presence = "conflict"
+
+var unspecifiedRevision = snap.R(0)
+var invalidPresRevision = snap.R(-1)
+
+type snapContraints struct {
+	name     string
+	presence asserts.Presence
+	// revisions maps revisions to pairing of ValidationSetSnap
+	// and the originating validation-set key
+	// * unspecifiedRevision is used for constraints without a
+	//   revision
+	// * invalidPresRevision is used for constraints that mark
+	//   presence as invalid
+	revisions map[snap.Revision][]*revConstraint
+}
+
+type revConstraint struct {
+	validationSetKey string
+	asserts.ValidationSetSnap
+}
+
+func (c *snapContraints) conflict() *snapConflictsError {
+	if c.presence != presConflict {
+		return nil
+	}
+
+	const dontCare asserts.Presence = ""
+	whichSets := func(rcs []*revConstraint, presence asserts.Presence) []string {
+		which := make([]string, 0, len(rcs))
+		for _, rc := range rcs {
+			if presence != dontCare && rc.Presence != presence {
+				continue
+			}
+			which = append(which, rc.validationSetKey)
+		}
+		if len(which) == 0 {
+			return nil
+		}
+		sort.Strings(which)
+		return which
+	}
+
+	byRev := make(map[snap.Revision][]string, len(c.revisions))
+	for r := range c.revisions {
+		pres := dontCare
+		switch r {
+		case invalidPresRevision:
+			pres = asserts.PresenceInvalid
+		case unspecifiedRevision:
+			pres = asserts.PresenceRequired
+		}
+		which := whichSets(c.revisions[r], pres)
+		if len(which) != 0 {
+			byRev[r] = which
+		}
+	}
+
+	return &snapConflictsError{
+		name:      c.name,
+		revisions: byRev,
+	}
+}
+
+type snapConflictsError struct {
+	name string
+	// revisions maps revisions to validation-set keys of the sets
+	// that are in conflict over the revision.
+	// * unspecifiedRevision is used for validation-sets conflicting
+	//   on the snap by requiring it but without a revision
+	// * invalidPresRevision is used for validation-sets that mark
+	//   presence as invalid
+	// see snapContraints.revisions as well
+	revisions map[snap.Revision][]string
+}
+
+func (e *snapConflictsError) Error() string {
+	whichSets := func(which []string) string {
+		return fmt.Sprintf("(%s)", strings.Join(which, ","))
+	}
+
+	msg := fmt.Sprintf("cannot constrain snap %q", e.name)
+	invalid := false
+	if invalidOnes, ok := e.revisions[invalidPresRevision]; ok {
+		msg += fmt.Sprintf(" as both invalid %s and required", whichSets(invalidOnes))
+		invalid = true
+	}
+
+	var revnos []int
+	for r := range e.revisions {
+		if r.N >= 1 {
+			revnos = append(revnos, r.N)
+		}
+	}
+	if len(revnos) == 1 {
+		msg += fmt.Sprintf(" at revision %d %s", revnos[0], whichSets(e.revisions[snap.R(revnos[0])]))
+	} else if len(revnos) > 1 {
+		sort.Ints(revnos)
+		l := make([]string, 0, len(revnos))
+		for _, rev := range revnos {
+			l = append(l, fmt.Sprintf("%d %s", rev, whichSets(e.revisions[snap.R(rev)])))
+		}
+		msg += fmt.Sprintf(" at different revisions %s", strings.Join(l, ", "))
+	}
+
+	if unspecifiedOnes, ok := e.revisions[unspecifiedRevision]; ok {
+		which := whichSets(unspecifiedOnes)
+		if which != "" {
+			if len(revnos) != 0 {
+				msg += " or"
+			}
+			if invalid {
+				msg += fmt.Sprintf(" at any revision %s", which)
+			} else {
+				msg += fmt.Sprintf(" required at any revision %s", which)
+			}
+		}
+	}
+	return msg
+}
+
+// NewValidationSets returns a new ValidationSets.
+func NewValidationSets() *ValidationSets {
+	return &ValidationSets{
+		sets:  map[string]*asserts.ValidationSet{},
+		snaps: map[string]*snapContraints{},
+	}
+}
+
+func valSetKey(valset *asserts.ValidationSet) string {
+	return fmt.Sprintf("%s/%s", valset.AccountID(), valset.Name())
+}
+
+// Add adds the given asserts.ValidationSet to the combination.
+// It errors if a validation-set with the same sequence key has been
+// added already.
+func (v *ValidationSets) Add(valset *asserts.ValidationSet) error {
+	k := valSetKey(valset)
+	if _, ok := v.sets[k]; ok {
+		return fmt.Errorf("cannot add a second validation-set under %q", k)
+	}
+	v.sets[k] = valset
+	for _, sn := range valset.Snaps() {
+		v.addSnap(sn, k)
+	}
+	return nil
+}
+
+func (v *ValidationSets) addSnap(sn *asserts.ValidationSetSnap, validationSetKey string) {
+	rev := snap.R(sn.Revision)
+	if sn.Presence == asserts.PresenceInvalid {
+		rev = invalidPresRevision
+	}
+
+	rc := &revConstraint{
+		validationSetKey:  validationSetKey,
+		ValidationSetSnap: *sn,
+	}
+
+	cs := v.snaps[sn.SnapID]
+	if cs == nil {
+		v.snaps[sn.SnapID] = &snapContraints{
+			name:     sn.Name,
+			presence: sn.Presence,
+			revisions: map[snap.Revision][]*revConstraint{
+				rev: {rc},
+			},
+		}
+		return
+	}
+
+	cs.revisions[rev] = append(cs.revisions[rev], rc)
+	if cs.presence == presConflict {
+		// nothing to check anymore
+		return
+	}
+	// this counts really different revisions or invalid
+	ndiff := len(cs.revisions)
+	if _, ok := cs.revisions[unspecifiedRevision]; ok {
+		ndiff -= 1
+	}
+	switch {
+	case cs.presence == asserts.PresenceOptional:
+		cs.presence = sn.Presence
+		fallthrough
+	case cs.presence == sn.Presence || sn.Presence == asserts.PresenceOptional:
+		if ndiff > 1 {
+			if cs.presence == asserts.PresenceRequired {
+				// different revisions required/invalid
+				cs.presence = presConflict
+				return
+			}
+			// multiple optional at different revisions => invalid
+			cs.presence = asserts.PresenceInvalid
+		}
+		return
+	}
+	// we are left with a combo of required and invalid => conflict
+	cs.presence = presConflict
+	return
+}
+
+// Conflict returns a non-nil error if the combination is in conflict,
+// nil otherwise.
+func (v *ValidationSets) Conflict() error {
+	sets := make(map[string]*asserts.ValidationSet)
+	snaps := make(map[string]error)
+
+	for snapID, snConstrs := range v.snaps {
+		snConflictsErr := snConstrs.conflict()
+		if snConflictsErr != nil {
+			snaps[snapID] = snConflictsErr
+			for _, valsetKeys := range snConflictsErr.revisions {
+				for _, valsetKey := range valsetKeys {
+					sets[valsetKey] = v.sets[valsetKey]
+				}
+			}
+		}
+	}
+
+	if len(snaps) != 0 {
+		return &ValidationSetsConflictError{
+			Sets:  sets,
+			Snaps: snaps,
+		}
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/snapasserts/validation_sets_test.go snapd-2.48.3+20.04/asserts/snapasserts/validation_sets_test.go
--- snapd-2.45.1+20.04.2/asserts/snapasserts/validation_sets_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/snapasserts/validation_sets_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,265 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapasserts_test
+
+import (
+	"fmt"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/assertstest"
+	"github.com/snapcore/snapd/asserts/snapasserts"
+)
+
+type validationSetsSuite struct{}
+
+var _ = Suite(&validationSetsSuite{})
+
+func (s *validationSetsSuite) TestAddFromSameSequence(c *C) {
+	mySnapAt7Valset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "required",
+				"revision": "7",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapAt8Valset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl",
+		"sequence":     "2",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "required",
+				"revision": "8",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	valsets := snapasserts.NewValidationSets()
+	err := valsets.Add(mySnapAt7Valset)
+	c.Assert(err, IsNil)
+	err = valsets.Add(mySnapAt8Valset)
+	c.Check(err, ErrorMatches, `cannot add a second validation-set under "account-id/my-snap-ctl"`)
+}
+
+func (s *validationSetsSuite) TestIntersections(c *C) {
+	mySnapAt7Valset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "required",
+				"revision": "7",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapAt7Valset2 := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl2",
+		"sequence":     "2",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "required",
+				"revision": "7",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapAt8Valset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl-other",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "required",
+				"revision": "8",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapAt8OptValset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl-opt",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "optional",
+				"revision": "8",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapInvalidValset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl-inv",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "invalid",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapAt7OptValset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl-opt2",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "optional",
+				"revision": "7",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapReqValset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl-req-only",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "required",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	mySnapOptValset := assertstest.FakeAssertion(map[string]interface{}{
+		"type":         "validation-set",
+		"authority-id": "account-id",
+		"series":       "16",
+		"account-id":   "account-id",
+		"name":         "my-snap-ctl-opt-only",
+		"sequence":     "1",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":     "my-snap",
+				"id":       "mysnapididididididididididididid",
+				"presence": "optional",
+			},
+		},
+	}).(*asserts.ValidationSet)
+
+	tests := []struct {
+		sets        []*asserts.ValidationSet
+		conflictErr string
+	}{
+		{[]*asserts.ValidationSet{mySnapAt7Valset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapAt7Valset2}, ""},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapAt8Valset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" at different revisions 7 \(account-id/my-snap-ctl\), 8 \(account-id/my-snap-ctl-other\)`},
+		{[]*asserts.ValidationSet{mySnapAt8Valset, mySnapAt8OptValset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapAt8OptValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" at different revisions 7 \(account-id/my-snap-ctl\), 8 \(account-id/my-snap-ctl-opt\)`},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapInvalidValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" as both invalid \(account-id/my-snap-ctl-inv\) and required at revision 7 \(account-id/my-snap-ctl\)`},
+		{[]*asserts.ValidationSet{mySnapInvalidValset, mySnapAt7Valset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" as both invalid \(account-id/my-snap-ctl-inv\) and required at revision 7 \(account-id/my-snap-ctl\)`},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapInvalidValset}, ""},
+		{[]*asserts.ValidationSet{mySnapInvalidValset, mySnapAt8OptValset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt7OptValset, mySnapAt8OptValset}, ""}, // no conflict but interpreted as invalid
+		{[]*asserts.ValidationSet{mySnapAt7OptValset, mySnapAt8OptValset, mySnapAt7Valset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" at different revisions 7 \(account-id/my-snap-ctl,account-id/my-snap-ctl-opt2\), 8 \(account-id/my-snap-ctl-opt\)`},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapInvalidValset, mySnapAt7Valset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" as both invalid \(account-id/my-snap-ctl-inv\) and required at different revisions 7 \(account-id/my-snap-ctl\), 8 \(account-id/my-snap-ctl-opt\)`},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapReqValset}, ""},
+		{[]*asserts.ValidationSet{mySnapReqValset, mySnapAt7Valset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapReqValset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapReqValset, mySnapAt7OptValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" at different revisions 7 \(account-id/my-snap-ctl-opt2\), 8 \(account-id/my-snap-ctl-opt\) or required at any revision \(account-id/my-snap-ctl-req-only\)`},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapAt7OptValset, mySnapReqValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" at different revisions 7 \(account-id/my-snap-ctl-opt2\), 8 \(account-id/my-snap-ctl-opt\) or required at any revision \(account-id/my-snap-ctl-req-only\)`},
+		{[]*asserts.ValidationSet{mySnapReqValset, mySnapInvalidValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" as both invalid \(account-id/my-snap-ctl-inv\) and required at any revision \(account-id/my-snap-ctl-req-only\)`},
+		{[]*asserts.ValidationSet{mySnapInvalidValset, mySnapReqValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" as both invalid \(account-id/my-snap-ctl-inv\) and required at any revision \(account-id/my-snap-ctl-req-only\)`},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapAt8Valset, mySnapOptValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" at different revisions 7 \(account-id/my-snap-ctl\), 8 \(account-id/my-snap-ctl-other\)`},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapOptValset}, ""},
+		{[]*asserts.ValidationSet{mySnapOptValset, mySnapAt7Valset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapOptValset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt8OptValset, mySnapOptValset, mySnapAt7OptValset}, ""}, // no conflict but interpreted as invalid
+		{[]*asserts.ValidationSet{mySnapInvalidValset, mySnapOptValset}, ""},
+		{[]*asserts.ValidationSet{mySnapOptValset, mySnapInvalidValset}, ""},
+		{[]*asserts.ValidationSet{mySnapAt7Valset, mySnapAt8Valset, mySnapReqValset, mySnapInvalidValset}, `(?ms)validation sets are in conflict:.*cannot constrain snap "my-snap" as both invalid \(account-id/my-snap-ctl-inv\) and required at different revisions 7 \(account-id/my-snap-ctl\), 8 \(account-id/my-snap-ctl-other\) or at any revision \(account-id/my-snap-ctl-req-only\)`},
+	}
+
+	for _, t := range tests {
+		valsets := snapasserts.NewValidationSets()
+		cSets := make(map[string]*asserts.ValidationSet)
+		for _, valset := range t.sets {
+			err := valsets.Add(valset)
+			c.Assert(err, IsNil)
+			// mySnapOptValset never influcens an outcome
+			if valset != mySnapOptValset {
+				cSets[fmt.Sprintf("%s/%s", valset.AccountID(), valset.Name())] = valset
+			}
+		}
+		err := valsets.Conflict()
+		if t.conflictErr == "" {
+			c.Check(err, IsNil)
+		} else {
+			c.Check(err, ErrorMatches, t.conflictErr)
+			ce := err.(*snapasserts.ValidationSetsConflictError)
+			c.Check(ce.Sets, DeepEquals, cSets)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/snap_asserts.go snapd-2.48.3+20.04/asserts/snap_asserts.go
--- snapd-2.45.1+20.04.2/asserts/snap_asserts.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/snap_asserts.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -481,6 +481,17 @@
 	}
 }
 
+func checkSnapRevisionWhat(headers map[string]interface{}, name, what string) (snapRevision int, err error) {
+	snapRevision, err = checkIntWhat(headers, name, what)
+	if err != nil {
+		return 0, err
+	}
+	if snapRevision < 1 {
+		return 0, fmt.Errorf(`%q %s must be >=1: %d`, name, what, snapRevision)
+	}
+	return snapRevision, nil
+}
+
 func assembleSnapRevision(assert assertionBase) (Assertion, error) {
 	_, err := checkDigest(assert.headers, "snap-sha3-384", crypto.SHA3_384)
 	if err != nil {
@@ -497,13 +508,10 @@
 		return nil, err
 	}
 
-	snapRevision, err := checkInt(assert.headers, "snap-revision")
+	snapRevision, err := checkSnapRevisionWhat(assert.headers, "snap-revision", "header")
 	if err != nil {
 		return nil, err
 	}
-	if snapRevision < 1 {
-		return nil, fmt.Errorf(`"snap-revision" header must be >=1: %d`, snapRevision)
-	}
 
 	_, err = checkNotEmptyString(assert.headers, "developer-id")
 	if err != nil {
@@ -607,13 +615,10 @@
 }
 
 func assembleValidation(assert assertionBase) (Assertion, error) {
-	approvedSnapRevision, err := checkInt(assert.headers, "approved-snap-revision")
+	approvedSnapRevision, err := checkSnapRevisionWhat(assert.headers, "approved-snap-revision", "header")
 	if err != nil {
 		return nil, err
 	}
-	if approvedSnapRevision < 1 {
-		return nil, fmt.Errorf(`"approved-snap-revision" header must be >=1: %d`, approvedSnapRevision)
-	}
 
 	revoked, err := checkOptionalBool(assert.headers, "revoked")
 	if err != nil {
diff -Nru snapd-2.45.1+20.04.2/asserts/snap_asserts_test.go snapd-2.48.3+20.04/asserts/snap_asserts_test.go
--- snapd-2.45.1+20.04.2/asserts/snap_asserts_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/snap_asserts_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -719,6 +719,8 @@
 		{"snap-size: 10000\n", "", `"snap-size" header is mandatory`},
 		{"snap-size: 10000\n", "snap-size: -1\n", `"snap-size" header is not an unsigned integer: -1`},
 		{"snap-size: 10000\n", "snap-size: zzz\n", `"snap-size" header is not an unsigned integer: zzz`},
+		{"snap-size: 10000\n", "snap-size: 010\n", `"snap-size" header has invalid prefix zeros: 010`},
+		{"snap-size: 10000\n", "snap-size: 99999999999999999999\n", `"snap-size" header is out of range: 99999999999999999999`},
 		{"grade: stable\n", "", `"grade" header is mandatory`},
 		{"grade: stable\n", "grade: \n", `"grade" header should not be empty`},
 		{sbs.tsLine, "", `"timestamp" header is mandatory`},
diff -Nru snapd-2.45.1+20.04.2/asserts/sysdb/sysdb.go snapd-2.48.3+20.04/asserts/sysdb/sysdb.go
--- snapd-2.45.1+20.04.2/asserts/sysdb/sysdb.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/sysdb/sysdb.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -39,11 +39,18 @@
 	return asserts.OpenDatabase(cfg)
 }
 
-// Open opens the system-wide assertion database with the trusted assertions set configured.
-func Open() (*asserts.Database, error) {
+// OpenAt opens a system assertion database at the given location with
+// the trusted assertions set configured.
+func OpenAt(path string) (*asserts.Database, error) {
 	cfg := &asserts.DatabaseConfig{
 		Trusted:         Trusted(),
 		OtherPredefined: Generic(),
 	}
-	return openDatabaseAt(dirs.SnapAssertsDBDir, cfg)
+	return openDatabaseAt(path, cfg)
+}
+
+// Open opens the system-wide assertion database with the trusted assertions
+// set configured.
+func Open() (*asserts.Database, error) {
+	return OpenAt(dirs.SnapAssertsDBDir)
 }
diff -Nru snapd-2.45.1+20.04.2/asserts/system_user.go snapd-2.48.3+20.04/asserts/system_user.go
--- snapd-2.45.1+20.04.2/asserts/system_user.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/system_user.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,6 +36,7 @@
 	assertionBase
 	series  []string
 	models  []string
+	serials []string
 	sshKeys []string
 	since   time.Time
 	until   time.Time
@@ -63,6 +64,11 @@
 	return su.models
 }
 
+// Serials returns the serials that this assertion is valid for.
+func (su *SystemUser) Serials() []string {
+	return su.serials
+}
+
 // Name returns the full name of the user (e.g. Random Guy).
 func (su *SystemUser) Name() string {
 	return su.HeaderString("name")
@@ -230,6 +236,17 @@
 	if err != nil {
 		return nil, err
 	}
+	serials, err := checkStringList(assert.headers, "serials")
+	if err != nil {
+		return nil, err
+	}
+	if len(serials) > 0 && assert.Format() < 1 {
+		return nil, fmt.Errorf(`the "serials" header is only supported for format 1 or greater`)
+	}
+	if len(serials) > 0 && len(models) != 1 {
+		return nil, fmt.Errorf(`in the presence of the "serials" header "models" must specify exactly one model`)
+	}
+
 	if _, err := checkOptionalString(assert.headers, "name"); err != nil {
 		return nil, err
 	}
@@ -273,9 +290,24 @@
 		assertionBase:       assert,
 		series:              series,
 		models:              models,
+		serials:             serials,
 		sshKeys:             sshKeys,
 		since:               since,
 		until:               until,
 		forcePasswordChange: forcePasswordChange,
 	}, nil
 }
+
+func systemUserFormatAnalyze(headers map[string]interface{}, body []byte) (formatnum int, err error) {
+	formatnum = 0
+
+	serials, err := checkStringList(headers, "serials")
+	if err != nil {
+		return 0, err
+	}
+	if len(serials) > 0 {
+		formatnum = 1
+	}
+
+	return formatnum, nil
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/system_user_test.go snapd-2.48.3+20.04/asserts/system_user_test.go
--- snapd-2.45.1+20.04.2/asserts/system_user_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/system_user_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -38,12 +38,14 @@
 	since     time.Time
 	sinceLine string
 
+	formatLine string
 	modelsLine string
 
 	systemUserStr string
 }
 
 const systemUserExample = "type: system-user\n" +
+	"FORMATLINE\n" +
 	"authority-id: canonical\n" +
 	"brand-id: canonical\n" +
 	"email: foo@example.com\n" +
@@ -68,9 +70,11 @@
 	s.until = time.Now().AddDate(0, 1, 0).Truncate(time.Second)
 	s.untilLine = fmt.Sprintf("until: %s\n", s.until.Format(time.RFC3339))
 	s.modelsLine = "models:\n  - frobinator\n"
+	s.formatLine = "format: 0\n"
 	s.systemUserStr = strings.Replace(systemUserExample, "UNTILLINE\n", s.untilLine, 1)
 	s.systemUserStr = strings.Replace(s.systemUserStr, "SINCELINE\n", s.sinceLine, 1)
 	s.systemUserStr = strings.Replace(s.systemUserStr, "MODELSLINE\n", s.modelsLine, 1)
+	s.systemUserStr = strings.Replace(s.systemUserStr, "FORMATLINE\n", s.formatLine, 1)
 }
 
 func (s *systemUserSuite) TestDecodeOK(c *C) {
@@ -183,6 +187,9 @@
 		{s.untilLine, "until: \n", `"until" header should not be empty`},
 		{s.untilLine, "until: 12:30\n", `"until" header is not a RFC3339 date: .*`},
 		{s.untilLine, "until: 1002-11-01T22:08:41+00:00\n", `'until' time cannot be before 'since' time`},
+		{s.modelsLine, s.modelsLine + "serials: \n", `"serials" header must be a list of strings`},
+		{s.modelsLine, s.modelsLine + "serials: something\n", `"serials" header must be a list of strings`},
+		{s.modelsLine, s.modelsLine + "serials:\n  - 7c7f435d-ed28-4281-bd77-e271e0846904\n", `the "serials" header is only supported for format 1 or greater`},
 	}
 
 	for _, test := range invalidTests {
@@ -212,3 +219,51 @@
 	_, err := asserts.Decode([]byte(su))
 	c.Check(err, IsNil)
 }
+
+// The following tests deal with "format: 1" which adds support for
+// tying system-user assertions to device serials.
+
+var serialsLine = "serials:\n  - 7c7f435d-ed28-4281-bd77-e271e0846904\n"
+
+func (s *systemUserSuite) TestDecodeInvalidFormat1Serials(c *C) {
+	s.systemUserStr = strings.Replace(s.systemUserStr, s.formatLine, "format: 1\n", 1)
+	serialWithMultipleModels := "models:\n  - m1\n  - m2\n" + serialsLine
+
+	invalidTests := []struct{ original, invalid, expectedErr string }{
+		{s.modelsLine, serialWithMultipleModels, `in the presence of the "serials" header "models" must specify exactly one model`},
+	}
+	for _, test := range invalidTests {
+		invalid := strings.Replace(s.systemUserStr, test.original, test.invalid, 1)
+		_, err := asserts.Decode([]byte(invalid))
+		c.Check(err, ErrorMatches, systemUserErrPrefix+test.expectedErr)
+	}
+}
+
+func (s *systemUserSuite) TestDecodeOKFormat1Serials(c *C) {
+	s.systemUserStr = strings.Replace(s.systemUserStr, s.formatLine, "format: 1\n", 1)
+
+	s.systemUserStr = strings.Replace(s.systemUserStr, s.modelsLine, s.modelsLine+serialsLine, 1)
+	a, err := asserts.Decode([]byte(s.systemUserStr))
+	c.Assert(err, IsNil)
+	c.Check(a.Type(), Equals, asserts.SystemUserType)
+	systemUser := a.(*asserts.SystemUser)
+	// just for sanity, already covered by "format: 0" tests
+	c.Check(systemUser.BrandID(), Equals, "canonical")
+	// new in "format: 1"
+	c.Check(systemUser.Serials(), DeepEquals, []string{"7c7f435d-ed28-4281-bd77-e271e0846904"})
+
+}
+
+func (s *systemUserSuite) TestSuggestedFormat(c *C) {
+	fmtnum, err := asserts.SuggestFormat(asserts.SystemUserType, nil, nil)
+	c.Assert(err, IsNil)
+	c.Check(fmtnum, Equals, 0)
+
+	headers := map[string]interface{}{
+		"serials": []interface{}{"serialserial"},
+	}
+	fmtnum, err = asserts.SuggestFormat(asserts.SystemUserType, headers, nil)
+	c.Assert(err, IsNil)
+	c.Check(fmtnum, Equals, 1)
+
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/systestkeys/trusted.go snapd-2.48.3+20.04/asserts/systestkeys/trusted.go
--- snapd-2.45.1+20.04.2/asserts/systestkeys/trusted.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/systestkeys/trusted.go	2021-02-02 08:21:12.000000000 +0000
@@ -238,7 +238,7 @@
 	TestRootAccountKey asserts.Assertion
 	// here for convenience, does not need to be in the trusted set
 	TestStoreAccountKey asserts.Assertion
-	// Testing-only trusted assertions for injecting in the the system trusted set.
+	// Testing-only trusted assertions for injecting in the system trusted set.
 	Trusted []asserts.Assertion
 )
 
diff -Nru snapd-2.45.1+20.04.2/asserts/validation_set.go snapd-2.48.3+20.04/asserts/validation_set.go
--- snapd-2.45.1+20.04.2/asserts/validation_set.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/validation_set.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,262 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package asserts
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/snapcore/snapd/snap/naming"
+	"github.com/snapcore/snapd/strutil"
+)
+
+// Presence represents a presence constraint.
+type Presence string
+
+const (
+	PresenceRequired Presence = "required"
+	PresenceOptional Presence = "optional"
+	PresenceInvalid  Presence = "invalid"
+)
+
+func presencesAsStrings(presences ...Presence) []string {
+	strs := make([]string, len(presences))
+	for i, pres := range presences {
+		strs[i] = string(pres)
+	}
+	return strs
+}
+
+var validValidationSetSnapPresences = presencesAsStrings(PresenceRequired, PresenceOptional, PresenceInvalid)
+
+func checkPresence(snap map[string]interface{}, which string, valid []string) (Presence, error) {
+	presence, err := checkOptionalStringWhat(snap, "presence", which)
+	if err != nil {
+		return Presence(""), err
+	}
+	if presence != "" && !strutil.ListContains(valid, presence) {
+		return Presence(""), fmt.Errorf("presence %s must be one of %s", which, strings.Join(valid, "|"))
+	}
+	return Presence(presence), nil
+}
+
+// ValidationSetSnap holds the details about a snap constrained by a validation-set assertion.
+type ValidationSetSnap struct {
+	Name   string
+	SnapID string
+
+	Presence Presence
+
+	Revision int
+}
+
+// SnapName implements naming.SnapRef.
+func (s *ValidationSetSnap) SnapName() string {
+	return s.Name
+}
+
+// ID implements naming.SnapRef.
+func (s *ValidationSetSnap) ID() string {
+	return s.SnapID
+}
+
+func checkValidationSetSnap(snap map[string]interface{}) (*ValidationSetSnap, error) {
+	name, err := checkNotEmptyStringWhat(snap, "name", "of snap")
+	if err != nil {
+		return nil, err
+	}
+	if err := naming.ValidateSnap(name); err != nil {
+		return nil, fmt.Errorf("invalid snap name %q", name)
+	}
+
+	what := fmt.Sprintf("of snap %q", name)
+
+	snapID, err := checkStringMatchesWhat(snap, "id", what, naming.ValidSnapID)
+	if err != nil {
+		return nil, err
+	}
+
+	presence, err := checkPresence(snap, what, validValidationSetSnapPresences)
+	if err != nil {
+		return nil, err
+	}
+
+	var snapRevision int
+	if _, ok := snap["revision"]; ok {
+		var err error
+		snapRevision, err = checkSnapRevisionWhat(snap, "revision", what)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if snapRevision != 0 && presence == PresenceInvalid {
+		return nil, fmt.Errorf(`cannot specify revision %s at the same time as stating its presence is invalid`, what)
+	}
+
+	return &ValidationSetSnap{
+		Name:     name,
+		SnapID:   snapID,
+		Presence: presence,
+		Revision: snapRevision,
+	}, nil
+}
+
+func checkValidationSetSnaps(snapList interface{}) ([]*ValidationSetSnap, error) {
+	const wrongHeaderType = `"snaps" header must be a list of maps`
+
+	entries, ok := snapList.([]interface{})
+	if !ok {
+		return nil, fmt.Errorf(wrongHeaderType)
+	}
+
+	seen := make(map[string]bool, len(entries))
+	seenIDs := make(map[string]string, len(entries))
+	snaps := make([]*ValidationSetSnap, 0, len(entries))
+	for _, entry := range entries {
+		snap, ok := entry.(map[string]interface{})
+		if !ok {
+			return nil, fmt.Errorf(wrongHeaderType)
+		}
+		valSetSnap, err := checkValidationSetSnap(snap)
+		if err != nil {
+			return nil, err
+		}
+
+		if seen[valSetSnap.Name] {
+			return nil, fmt.Errorf("cannot list the same snap %q multiple times", valSetSnap.Name)
+		}
+		seen[valSetSnap.Name] = true
+		snapID := valSetSnap.SnapID
+		if underName := seenIDs[snapID]; underName != "" {
+			return nil, fmt.Errorf("cannot specify the same snap id %q multiple times, specified for snaps %q and %q", snapID, underName, valSetSnap.Name)
+		}
+		seenIDs[snapID] = valSetSnap.Name
+
+		if valSetSnap.Presence == "" {
+			valSetSnap.Presence = PresenceRequired
+		}
+
+		snaps = append(snaps, valSetSnap)
+	}
+
+	return snaps, nil
+}
+
+// ValidationSet holds a validation-set assertion, which is a
+// statement by an account about a set snaps and possibly revisions
+// for which an extrinsic/implied property is valid (e.g. they work
+// well together). validation-sets are organized in sequences under a
+// name.
+type ValidationSet struct {
+	assertionBase
+
+	seq int
+
+	snaps []*ValidationSetSnap
+
+	timestamp time.Time
+}
+
+// Series returns the series for which the snap in the set are declared.
+func (vs *ValidationSet) Series() string {
+	return vs.HeaderString("series")
+}
+
+// AccountID returns the identifier of the account that signed this assertion.
+func (vs *ValidationSet) AccountID() string {
+	return vs.HeaderString("account-id")
+}
+
+// Name returns the name under which the validation-set is organized.
+func (vs *ValidationSet) Name() string {
+	return vs.HeaderString("name")
+}
+
+// Sequence returns the sequential number of the validation-set in its
+// named sequence.
+func (vs *ValidationSet) Sequence() int {
+	return vs.seq
+}
+
+// Snaps returns the constrained snaps by the validation-set.
+func (vs *ValidationSet) Snaps() []*ValidationSetSnap {
+	return vs.snaps
+}
+
+// Timestamp returns the time when the validation-set was issued.
+func (vs *ValidationSet) Timestamp() time.Time {
+	return vs.timestamp
+}
+
+func checkSequence(headers map[string]interface{}, name string) (int, error) {
+	seqnum, err := checkInt(headers, name)
+	if err != nil {
+		return -1, err
+	}
+	if seqnum < 1 {
+		return -1, fmt.Errorf("%q must be >=1: %v", name, seqnum)
+	}
+	return seqnum, nil
+}
+
+var (
+	validValidationSetName = regexp.MustCompile("^[a-z0-9](?:-?[a-z0-9])*$")
+)
+
+func assembleValidationSet(assert assertionBase) (Assertion, error) {
+	authorityID := assert.AuthorityID()
+	accountID := assert.HeaderString("account-id")
+	if accountID != authorityID {
+		return nil, fmt.Errorf("authority-id and account-id must match, validation-set assertions are expected to be signed by the issuer account: %q != %q", authorityID, accountID)
+	}
+
+	_, err := checkStringMatches(assert.headers, "name", validValidationSetName)
+	if err != nil {
+		return nil, err
+	}
+
+	seq, err := checkSequence(assert.headers, "sequence")
+	if err != nil {
+		return nil, err
+	}
+
+	snapList, ok := assert.headers["snaps"]
+	if !ok {
+		return nil, fmt.Errorf(`"snaps" header is mandatory`)
+	}
+	snaps, err := checkValidationSetSnaps(snapList)
+	if err != nil {
+		return nil, err
+	}
+
+	timestamp, err := checkRFC3339Date(assert.headers, "timestamp")
+	if err != nil {
+		return nil, err
+	}
+
+	return &ValidationSet{
+		assertionBase: assert,
+		seq:           seq,
+		snaps:         snaps,
+		timestamp:     timestamp,
+	}, nil
+}
diff -Nru snapd-2.45.1+20.04.2/asserts/validation_set_test.go snapd-2.48.3+20.04/asserts/validation_set_test.go
--- snapd-2.45.1+20.04.2/asserts/validation_set_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/asserts/validation_set_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,168 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package asserts_test
+
+import (
+	"strings"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts"
+)
+
+type validationSetSuite struct {
+	ts     time.Time
+	tsLine string
+}
+
+var _ = Suite(&validationSetSuite{})
+
+func (vss *validationSetSuite) SetUpSuite(c *C) {
+	vss.ts = time.Now().Truncate(time.Second).UTC()
+	vss.tsLine = "timestamp: " + vss.ts.Format(time.RFC3339) + "\n"
+}
+
+const (
+	validationSetExample = `type: validation-set
+authority-id: brand-id1
+series: 16
+account-id: brand-id1
+name: baz-3000-good
+sequence: 2
+snaps:
+  -
+    name: baz-linux
+    id: bazlinuxidididididididididididid
+    presence: optional
+    revision: 99
+OTHER` + "TSLINE" +
+		"body-length: 0\n" +
+		"sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij" +
+		"\n\n" +
+		"AXNpZw=="
+)
+
+func (vss *validationSetSuite) TestDecodeOK(c *C) {
+	encoded := strings.Replace(validationSetExample, "TSLINE", vss.tsLine, 1)
+	encoded = strings.Replace(encoded, "OTHER", "", 1)
+
+	a, err := asserts.Decode([]byte(encoded))
+	c.Assert(err, IsNil)
+	c.Check(a.Type(), Equals, asserts.ValidationSetType)
+	_, ok := a.(asserts.SequenceMember)
+	c.Assert(ok, Equals, true)
+	valset := a.(*asserts.ValidationSet)
+	c.Check(valset.AuthorityID(), Equals, "brand-id1")
+	c.Check(valset.Timestamp(), Equals, vss.ts)
+	c.Check(valset.Series(), Equals, "16")
+	c.Check(valset.AccountID(), Equals, "brand-id1")
+	c.Check(valset.Name(), Equals, "baz-3000-good")
+	c.Check(valset.Sequence(), Equals, 2)
+	snaps := valset.Snaps()
+	c.Assert(snaps, DeepEquals, []*asserts.ValidationSetSnap{
+		{
+			Name:     "baz-linux",
+			SnapID:   "bazlinuxidididididididididididid",
+			Presence: asserts.PresenceOptional,
+			Revision: 99,
+		},
+	})
+	c.Check(snaps[0].SnapName(), Equals, "baz-linux")
+	c.Check(snaps[0].ID(), Equals, "bazlinuxidididididididididididid")
+}
+
+func (vss *validationSetSuite) TestDecodeInvalid(c *C) {
+	const validationSetErrPrefix = "assertion validation-set: "
+
+	encoded := strings.Replace(validationSetExample, "TSLINE", vss.tsLine, 1)
+
+	snapsStanza := encoded[strings.Index(encoded, "snaps:"):strings.Index(encoded, "timestamp:")]
+
+	invalidTests := []struct{ original, invalid, expectedErr string }{
+		{"series: 16\n", "", `"series" header is mandatory`},
+		{"series: 16\n", "series: \n", `"series" header should not be empty`},
+		{"account-id: brand-id1\n", "", `"account-id" header is mandatory`},
+		{"account-id: brand-id1\n", "account-id: \n", `"account-id" header should not be empty`},
+		{"account-id: brand-id1\n", "account-id: random\n", `authority-id and account-id must match, validation-set assertions are expected to be signed by the issuer account: "brand-id1" != "random"`},
+		{"name: baz-3000-good\n", "", `"name" header is mandatory`},
+		{"name: baz-3000-good\n", "name: \n", `"name" header should not be empty`},
+		{"name: baz-3000-good\n", "name: baz/3000/good\n", `"name" primary key header cannot contain '/'`},
+		{"name: baz-3000-good\n", "name: baz+3000+good\n", `"name" header contains invalid characters: "baz\+3000\+good"`},
+		{vss.tsLine, "timestamp: 12:30\n", `"timestamp" header is not a RFC3339 date: .*`},
+		{"sequence: 2\n", "", `"sequence" header is mandatory`},
+		{"sequence: 2\n", "sequence: one\n", `"sequence" header is not an integer: one`},
+		{"sequence: 2\n", "sequence: 0\n", `"sequence" must be >=1: 0`},
+		{"sequence: 2\n", "sequence: -1\n", `"sequence" must be >=1: -1`},
+		{"sequence: 2\n", "sequence: 00\n", `"sequence" header has invalid prefix zeros: 00`},
+		{"sequence: 2\n", "sequence: 01\n", `"sequence" header has invalid prefix zeros: 01`},
+		{"sequence: 2\n", "sequence: 010\n", `"sequence" header has invalid prefix zeros: 010`},
+		{snapsStanza, "", `"snaps" header is mandatory`},
+		{snapsStanza, "snaps: snap\n", `"snaps" header must be a list of maps`},
+		{snapsStanza, "snaps:\n  - snap\n", `"snaps" header must be a list of maps`},
+		{"name: baz-linux\n", "other: 1\n", `"name" of snap is mandatory`},
+		{"name: baz-linux\n", "name: linux_2\n", `invalid snap name "linux_2"`},
+		{"id: bazlinuxidididididididididididid\n", "id: 2\n", `"id" of snap "baz-linux" contains invalid characters: "2"`},
+		{"    id: bazlinuxidididididididididididid\n", "", `"id" of snap "baz-linux" is mandatory`},
+		{"OTHER", "  -\n    name: baz-linux\n    id: bazlinuxidididididididididididid\n", `cannot list the same snap "baz-linux" multiple times`},
+		{"OTHER", "  -\n    name: baz-linux2\n    id: bazlinuxidididididididididididid\n", `cannot specify the same snap id "bazlinuxidididididididididididid" multiple times, specified for snaps "baz-linux" and "baz-linux2"`},
+		{"presence: optional\n", "presence:\n      - opt\n", `"presence" of snap "baz-linux" must be a string`},
+		{"presence: optional\n", "presence: no\n", `"presence" of snap "baz-linux" must be one of must be one of required|optional|invalid`},
+		{"revision: 99\n", "revision: 0\n", `"revision" of snap "baz-linux" must be >=1: 0`},
+		{"presence: optional\n", "presence: invalid\n", `cannot specify revision of snap "baz-linux" at the same time as stating its presence is invalid`},
+	}
+
+	for _, test := range invalidTests {
+		invalid := strings.Replace(encoded, test.original, test.invalid, 1)
+		invalid = strings.Replace(invalid, "OTHER", "", 1)
+		_, err := asserts.Decode([]byte(invalid))
+		c.Check(err, ErrorMatches, validationSetErrPrefix+test.expectedErr)
+	}
+
+}
+
+func (vss *validationSetSuite) TestSnapPresenceOptionalDefaultRequired(c *C) {
+	encoded := strings.Replace(validationSetExample, "TSLINE", vss.tsLine, 1)
+	encoded = strings.Replace(encoded, "OTHER", "", 1)
+	encoded = strings.Replace(encoded, "    presence: optional\n", "", 1)
+
+	a, err := asserts.Decode([]byte(encoded))
+	c.Assert(err, IsNil)
+	c.Check(a.Type(), Equals, asserts.ValidationSetType)
+	valset := a.(*asserts.ValidationSet)
+	snaps := valset.Snaps()
+	c.Assert(snaps, HasLen, 1)
+	c.Check(snaps[0].Presence, Equals, asserts.PresenceRequired)
+}
+
+func (vss *validationSetSuite) TestSnapRevisionOptional(c *C) {
+	encoded := strings.Replace(validationSetExample, "TSLINE", vss.tsLine, 1)
+	encoded = strings.Replace(encoded, "OTHER", "", 1)
+	encoded = strings.Replace(encoded, "    revision: 99\n", "", 1)
+
+	a, err := asserts.Decode([]byte(encoded))
+	c.Assert(err, IsNil)
+	c.Check(a.Type(), Equals, asserts.ValidationSetType)
+	valset := a.(*asserts.ValidationSet)
+	snaps := valset.Snaps()
+	c.Assert(snaps, HasLen, 1)
+	// 0 means unset
+	c.Check(snaps[0].Revision, Equals, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/boot/assets.go snapd-2.48.3+20.04/boot/assets.go
--- snapd-2.45.1+20.04.2/boot/assets.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/assets.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,859 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot
+
+import (
+	"crypto"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	_ "golang.org/x/crypto/sha3"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/strutil"
+)
+
+type trustedAssetsCache struct {
+	cacheDir string
+	hash     crypto.Hash
+}
+
+func newTrustedAssetsCache(cacheDir string) *trustedAssetsCache {
+	return &trustedAssetsCache{cacheDir: cacheDir, hash: crypto.SHA3_384}
+}
+
+func (c *trustedAssetsCache) tempAssetRelPath(blName, assetName string) string {
+	return filepath.Join(blName, assetName+".temp")
+}
+
+func (c *trustedAssetsCache) pathInCache(part string) string {
+	return filepath.Join(c.cacheDir, part)
+}
+
+func trustedAssetCacheRelPath(blName, assetName, assetHash string) string {
+	return filepath.Join(blName, fmt.Sprintf("%s-%s", assetName, assetHash))
+}
+
+// fileHash calculates the hash of an arbitrary file using the same hash method
+// as the cache.
+func (c *trustedAssetsCache) fileHash(name string) (string, error) {
+	digest, _, err := osutil.FileDigest(name, c.hash)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(digest), nil
+}
+
+// Add entry for a new named asset owned by a particular bootloader, with the
+// binary content of the located at a given path. The cache ensures that only
+// one entry for given tuple of (bootloader name, asset name, content-hash)
+// exists in the cache.
+func (c *trustedAssetsCache) Add(assetPath, blName, assetName string) (*trackedAsset, error) {
+	if err := os.MkdirAll(c.pathInCache(blName), 0755); err != nil {
+		return nil, fmt.Errorf("cannot create cache directory: %v", err)
+	}
+
+	// input
+	inf, err := os.Open(assetPath)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open asset file: %v", err)
+	}
+	defer inf.Close()
+	// temporary output
+	tempPath := c.pathInCache(c.tempAssetRelPath(blName, assetName))
+	outf, err := osutil.NewAtomicFile(tempPath, 0644, 0, osutil.NoChown, osutil.NoChown)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create temporary cache file: %v", err)
+	}
+	defer outf.Cancel()
+
+	// copy and hash at the same time
+	h := c.hash.New()
+	tr := io.TeeReader(inf, h)
+	if _, err := io.Copy(outf, tr); err != nil {
+		return nil, fmt.Errorf("cannot copy trusted asset to cache: %v", err)
+	}
+	hashStr := hex.EncodeToString(h.Sum(nil))
+	cacheKey := trustedAssetCacheRelPath(blName, assetName, hashStr)
+
+	ta := &trackedAsset{
+		blName: blName,
+		name:   assetName,
+		hash:   hashStr,
+	}
+
+	targetName := c.pathInCache(cacheKey)
+	if osutil.FileExists(targetName) {
+		// asset is already cached
+		return ta, nil
+	}
+	// commit under a new name
+	if err := outf.CommitAs(targetName); err != nil {
+		return nil, fmt.Errorf("cannot commit file to assets cache: %v", err)
+	}
+	return ta, nil
+}
+
+func (c *trustedAssetsCache) Remove(blName, assetName, hashStr string) error {
+	cacheKey := trustedAssetCacheRelPath(blName, assetName, hashStr)
+	if err := os.Remove(c.pathInCache(cacheKey)); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
+
+// CopyBootAssetsCacheToRoot copies the boot assets cache to a corresponding
+// location under a new root directory.
+func CopyBootAssetsCacheToRoot(dstRoot string) error {
+	if !osutil.IsDirectory(dirs.SnapBootAssetsDir) {
+		// nothing to copy
+		return nil
+	}
+
+	newCacheRoot := dirs.SnapBootAssetsDirUnder(dstRoot)
+	if err := os.MkdirAll(newCacheRoot, 0755); err != nil {
+		return fmt.Errorf("cannot create cache directory under new root: %v", err)
+	}
+	err := filepath.Walk(dirs.SnapBootAssetsDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		relPath, err := filepath.Rel(dirs.SnapBootAssetsDir, path)
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			if err := os.MkdirAll(filepath.Join(newCacheRoot, relPath), info.Mode()); err != nil {
+				return fmt.Errorf("cannot recreate cache directory %q: %v", relPath, err)
+			}
+			return nil
+		}
+		if !info.Mode().IsRegular() {
+			return fmt.Errorf("unsupported non-file entry %q mode %v", relPath, info.Mode())
+		}
+		if err := osutil.CopyFile(path, filepath.Join(newCacheRoot, relPath), osutil.CopyFlagPreserveAll); err != nil {
+			return fmt.Errorf("cannot copy boot asset cache file %q: %v", relPath, err)
+		}
+		return nil
+	})
+	return err
+}
+
+// ErrObserverNotApplicable indicates that observer is not applicable for use
+// with the model.
+var ErrObserverNotApplicable = errors.New("observer not applicable")
+
+// TrustedAssetsInstallObserverForModel returns a new trusted assets observer
+// for use during installation of the run mode system to track trusted and
+// control managed assets, provided the device model indicates this might be
+// needed. Otherwise, nil and ErrObserverNotApplicable is returned.
+func TrustedAssetsInstallObserverForModel(model *asserts.Model, gadgetDir string, useEncryption bool) (*TrustedAssetsInstallObserver, error) {
+	if model.Grade() == asserts.ModelGradeUnset {
+		// no need to observe updates when assets are not managed
+		return nil, ErrObserverNotApplicable
+	}
+	if gadgetDir == "" {
+		return nil, fmt.Errorf("internal error: gadget dir not provided")
+	}
+	// TODO:UC20: clarify use of empty rootdir when getting the lists of
+	// managed and trusted assets
+	runBl, runTrusted, runManaged, err := gadgetMaybeTrustedBootloaderAndAssets(gadgetDir, "",
+		&bootloader.Options{
+			Role:        bootloader.RoleRunMode,
+			NoSlashBoot: true,
+		})
+	if err != nil {
+		return nil, err
+	}
+	// and the recovery bootloader, seed is mounted during install
+	seedBl, seedTrusted, _, err := gadgetMaybeTrustedBootloaderAndAssets(gadgetDir, InitramfsUbuntuSeedDir,
+		&bootloader.Options{
+			Role: bootloader.RoleRecovery,
+		})
+	if err != nil {
+		return nil, err
+	}
+	if !useEncryption {
+		// we do not care about trusted assets when not encrypting data
+		// partition
+		runTrusted = nil
+		seedTrusted = nil
+	}
+	hasManaged := len(runManaged) > 0
+	hasTrusted := len(runTrusted) > 0 || len(seedTrusted) > 0
+	if !hasManaged && !hasTrusted && !useEncryption {
+		// no managed assets, and no trusted assets or we are not
+		// tracking them due to no encryption to data partition
+		return nil, ErrObserverNotApplicable
+	}
+
+	return &TrustedAssetsInstallObserver{
+		model:     model,
+		cache:     newTrustedAssetsCache(dirs.SnapBootAssetsDir),
+		gadgetDir: gadgetDir,
+
+		blName:        runBl.Name(),
+		managedAssets: runManaged,
+		trustedAssets: runTrusted,
+
+		recoveryBlName:        seedBl.Name(),
+		trustedRecoveryAssets: seedTrusted,
+	}, nil
+}
+
+type trackedAsset struct {
+	blName, name, hash string
+}
+
+func isAssetAlreadyTracked(bam bootAssetsMap, newAsset *trackedAsset) bool {
+	return isAssetHashTrackedInMap(bam, newAsset.name, newAsset.hash)
+}
+
+func isAssetHashTrackedInMap(bam bootAssetsMap, assetName, assetHash string) bool {
+	if bam == nil {
+		return false
+	}
+	hashes, ok := bam[assetName]
+	if !ok {
+		return false
+	}
+	return strutil.ListContains(hashes, assetHash)
+}
+
+// TrustedAssetsInstallObserver tracks the installation of trusted or managed
+// boot assets.
+type TrustedAssetsInstallObserver struct {
+	model     *asserts.Model
+	gadgetDir string
+	cache     *trustedAssetsCache
+
+	blName        string
+	managedAssets []string
+	trustedAssets []string
+	trackedAssets bootAssetsMap
+
+	recoveryBlName        string
+	trustedRecoveryAssets []string
+	trackedRecoveryAssets bootAssetsMap
+
+	dataEncryptionKey secboot.EncryptionKey
+	saveEncryptionKey secboot.EncryptionKey
+}
+
+// Observe observes the operation related to the content of a given gadget
+// structure. In particular, the TrustedAssetsInstallObserver tracks writing of
+// trusted or managed boot assets, such as the bootloader binary which is
+// measured as part of the secure boot or the bootloader configuration.
+//
+// Implements gadget.ContentObserver.
+func (o *TrustedAssetsInstallObserver) Observe(op gadget.ContentOperation, affectedStruct *gadget.LaidOutStructure, root, relativeTarget string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	if affectedStruct.Role != gadget.SystemBoot {
+		// only care about system-boot
+		return gadget.ChangeApply, nil
+	}
+
+	if len(o.managedAssets) != 0 && strutil.ListContains(o.managedAssets, relativeTarget) {
+		// this asset is managed by bootloader installation
+		return gadget.ChangeIgnore, nil
+	}
+	if len(o.trustedAssets) == 0 || !strutil.ListContains(o.trustedAssets, relativeTarget) {
+		// not one of the trusted assets
+		return gadget.ChangeApply, nil
+	}
+	ta, err := o.cache.Add(data.After, o.blName, filepath.Base(relativeTarget))
+	if err != nil {
+		return gadget.ChangeAbort, err
+	}
+	// during installation, modeenv is written out later, at this point we
+	// only care that the same file may appear multiple times in gadget
+	// structure content, so make sure we are not tracking it yet
+	if !isAssetAlreadyTracked(o.trackedAssets, ta) {
+		if o.trackedAssets == nil {
+			o.trackedAssets = bootAssetsMap{}
+		}
+		if len(o.trackedAssets[ta.name]) > 0 {
+			return gadget.ChangeAbort, fmt.Errorf("cannot reuse asset name %q", ta.name)
+		}
+		o.trackedAssets[ta.name] = append(o.trackedAssets[ta.name], ta.hash)
+	}
+	return gadget.ChangeApply, nil
+}
+
+// ObserveExistingTrustedRecoveryAssets observes existing trusted assets of a
+// recovery bootloader located inside a given root directory.
+func (o *TrustedAssetsInstallObserver) ObserveExistingTrustedRecoveryAssets(recoveryRootDir string) error {
+	if len(o.trustedRecoveryAssets) == 0 {
+		// not a trusted assets bootloader or has no trusted assets
+		return nil
+	}
+	for _, trustedAsset := range o.trustedRecoveryAssets {
+		ta, err := o.cache.Add(filepath.Join(recoveryRootDir, trustedAsset), o.recoveryBlName, filepath.Base(trustedAsset))
+		if err != nil {
+			return err
+		}
+		if !isAssetAlreadyTracked(o.trackedRecoveryAssets, ta) {
+			if o.trackedRecoveryAssets == nil {
+				o.trackedRecoveryAssets = bootAssetsMap{}
+			}
+			if len(o.trackedRecoveryAssets[ta.name]) > 0 {
+				return fmt.Errorf("cannot reuse recovery asset name %q", ta.name)
+			}
+			o.trackedRecoveryAssets[ta.name] = append(o.trackedRecoveryAssets[ta.name], ta.hash)
+		}
+	}
+	return nil
+}
+
+func (o *TrustedAssetsInstallObserver) currentTrustedBootAssetsMap() bootAssetsMap {
+	return o.trackedAssets
+}
+
+func (o *TrustedAssetsInstallObserver) currentTrustedRecoveryBootAssetsMap() bootAssetsMap {
+	return o.trackedRecoveryAssets
+}
+
+func (o *TrustedAssetsInstallObserver) ChosenEncryptionKeys(key, saveKey secboot.EncryptionKey) {
+	o.dataEncryptionKey = key
+	o.saveEncryptionKey = saveKey
+}
+
+// TrustedAssetsUpdateObserverForModel returns a new trusted assets observer for
+// tracking changes to the trusted boot assets and preserving managed assets,
+// provided the device model indicates this might be needed. Otherwise, nil and
+// ErrObserverNotApplicable is returned.
+func TrustedAssetsUpdateObserverForModel(model *asserts.Model, gadgetDir string) (*TrustedAssetsUpdateObserver, error) {
+	if model.Grade() == asserts.ModelGradeUnset {
+		// no need to observe updates when assets are not managed
+		return nil, ErrObserverNotApplicable
+	}
+	// trusted assets need tracking only when the system is using encryption
+	// for its data partitions
+	trackTrustedAssets := false
+	_, err := sealedKeysMethod(dirs.GlobalRootDir)
+	switch {
+	case err == nil:
+		trackTrustedAssets = true
+	case err == errNoSealedKeys:
+		// nothing to do
+	case err != nil:
+		// all other errors
+		return nil, err
+	}
+
+	// see what we need to observe for the run bootloader
+	runBl, runTrusted, runManaged, err := gadgetMaybeTrustedBootloaderAndAssets(gadgetDir, InitramfsUbuntuBootDir,
+		&bootloader.Options{
+			Role:        bootloader.RoleRunMode,
+			NoSlashBoot: true,
+		})
+	if err != nil {
+		return nil, err
+	}
+
+	// and the recovery bootloader
+	seedBl, seedTrusted, seedManaged, err := gadgetMaybeTrustedBootloaderAndAssets(gadgetDir, InitramfsUbuntuSeedDir,
+		&bootloader.Options{
+			Role: bootloader.RoleRecovery,
+		})
+	if err != nil {
+		return nil, err
+	}
+
+	hasManaged := len(runManaged) > 0 || len(seedManaged) > 0
+	hasTrusted := len(runTrusted) > 0 || len(seedTrusted) > 0
+	if !hasManaged {
+		// no managed assets
+		if !hasTrusted || !trackTrustedAssets {
+			// no trusted assets or we are not tracking them either
+			return nil, ErrObserverNotApplicable
+		}
+	}
+
+	obs := &TrustedAssetsUpdateObserver{
+		cache: newTrustedAssetsCache(dirs.SnapBootAssetsDir),
+		model: model,
+
+		bootBootloader:    runBl,
+		bootManagedAssets: runManaged,
+
+		seedBootloader:    seedBl,
+		seedManagedAssets: seedManaged,
+	}
+	if trackTrustedAssets {
+		obs.seedTrustedAssets = seedTrusted
+		obs.bootTrustedAssets = runTrusted
+	}
+	return obs, nil
+}
+
+// TrustedAssetsUpdateObserver tracks the updates of trusted boot assets and
+// attempts to reseal when needed or preserves managed boot assets.
+type TrustedAssetsUpdateObserver struct {
+	cache *trustedAssetsCache
+	model *asserts.Model
+
+	bootBootloader    bootloader.Bootloader
+	bootTrustedAssets []string
+	bootManagedAssets []string
+	changedAssets     []*trackedAsset
+
+	seedBootloader    bootloader.Bootloader
+	seedTrustedAssets []string
+	seedManagedAssets []string
+	seedChangedAssets []*trackedAsset
+
+	modeenv *Modeenv
+}
+
+func trustedAndManagedAssetsOfBootloader(bl bootloader.Bootloader) (trustedAssets, managedAssets []string, err error) {
+	tbl, ok := bl.(bootloader.TrustedAssetsBootloader)
+	if ok {
+		trustedAssets, err = tbl.TrustedAssets()
+		if err != nil {
+			return nil, nil, fmt.Errorf("cannot list %q bootloader trusted assets: %v", bl.Name(), err)
+		}
+		managedAssets = tbl.ManagedAssets()
+	}
+	return trustedAssets, managedAssets, nil
+}
+
+func findMaybeTrustedBootloaderAndAssets(rootDir string, opts *bootloader.Options) (foundBl bootloader.Bootloader, trustedAssets []string, err error) {
+	foundBl, err = bootloader.Find(rootDir, opts)
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot find bootloader: %v", err)
+	}
+	trustedAssets, _, err = trustedAndManagedAssetsOfBootloader(foundBl)
+	return foundBl, trustedAssets, err
+}
+
+func gadgetMaybeTrustedBootloaderAndAssets(gadgetDir, rootDir string, opts *bootloader.Options) (foundBl bootloader.Bootloader, trustedAssets, managedAssets []string, err error) {
+	foundBl, err = bootloader.ForGadget(gadgetDir, rootDir, opts)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("cannot find bootloader: %v", err)
+	}
+	trustedAssets, managedAssets, err = trustedAndManagedAssetsOfBootloader(foundBl)
+	return foundBl, trustedAssets, managedAssets, err
+}
+
+// Observe observes the operation related to the update or rollback of the
+// content of a given gadget structure. In particular, the
+// TrustedAssetsUpdateObserver tracks updates of trusted boot assets such as
+// bootloader binaries, or preserves managed assets such as boot configuration.
+//
+// Implements gadget.ContentUpdateObserver.
+func (o *TrustedAssetsUpdateObserver) Observe(op gadget.ContentOperation, affectedStruct *gadget.LaidOutStructure, root, relativeTarget string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	var whichBootloader bootloader.Bootloader
+	var whichTrustedAssets []string
+	var whichManagedAssets []string
+	var err error
+	var isRecovery bool
+
+	switch affectedStruct.Role {
+	case gadget.SystemBoot:
+		whichBootloader = o.bootBootloader
+		whichTrustedAssets = o.bootTrustedAssets
+		whichManagedAssets = o.bootManagedAssets
+	case gadget.SystemSeed:
+		whichBootloader = o.seedBootloader
+		whichTrustedAssets = o.seedTrustedAssets
+		whichManagedAssets = o.seedManagedAssets
+		isRecovery = true
+	default:
+		// only system-seed and system-boot are of interest
+		return gadget.ChangeApply, nil
+	}
+	// maybe an asset that we manage?
+	if len(whichManagedAssets) != 0 && strutil.ListContains(whichManagedAssets, relativeTarget) {
+		// this asset is managed directly by the bootloader, preserve it
+		if op != gadget.ContentUpdate {
+			return gadget.ChangeAbort, fmt.Errorf("internal error: managed bootloader asset change for non update operation %v", op)
+		}
+		return gadget.ChangeIgnore, nil
+	}
+
+	if len(whichTrustedAssets) == 0 {
+		// the system is not using encryption for data partitions, so
+		// we're done at this point
+		return gadget.ChangeApply, nil
+	}
+
+	// maybe an asset that is trusted in the boot process?
+	if !strutil.ListContains(whichTrustedAssets, relativeTarget) {
+		// not one of the trusted assets
+		return gadget.ChangeApply, nil
+	}
+	if o.modeenv == nil {
+		// we've hit a trusted asset, so a modeenv is needed now too
+		o.modeenv, err = ReadModeenv("")
+		if err != nil {
+			return gadget.ChangeAbort, fmt.Errorf("cannot load modeenv: %v", err)
+		}
+	}
+	switch op {
+	case gadget.ContentUpdate:
+		return o.observeUpdate(whichBootloader, isRecovery, root, relativeTarget, data)
+	case gadget.ContentRollback:
+		return o.observeRollback(whichBootloader, isRecovery, root, relativeTarget, data)
+	default:
+		// we only care about update and rollback actions
+		return gadget.ChangeApply, nil
+	}
+}
+
+func (o *TrustedAssetsUpdateObserver) observeUpdate(bl bootloader.Bootloader, recovery bool, root, relativeTarget string, change *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	modeenvBefore, err := o.modeenv.Copy()
+	if err != nil {
+		return gadget.ChangeAbort, fmt.Errorf("cannot copy modeenv: %v", err)
+	}
+
+	// we may be running after a mid-update reboot, where a successful boot
+	// would have trimmed the tracked assets hash lists to contain only the
+	// asset we booted with
+
+	var taBefore *trackedAsset
+	if change.Before != "" {
+		// make sure that the original copy is present in the cache if
+		// it existed
+		taBefore, err = o.cache.Add(change.Before, bl.Name(), filepath.Base(relativeTarget))
+		if err != nil {
+			return gadget.ChangeAbort, err
+		}
+	}
+
+	ta, err := o.cache.Add(change.After, bl.Name(), filepath.Base(relativeTarget))
+	if err != nil {
+		return gadget.ChangeAbort, err
+	}
+
+	trustedAssets := &o.modeenv.CurrentTrustedBootAssets
+	changedAssets := &o.changedAssets
+	if recovery {
+		trustedAssets = &o.modeenv.CurrentTrustedRecoveryBootAssets
+		changedAssets = &o.seedChangedAssets
+	}
+	// keep track of the change for cancellation purpose
+	*changedAssets = append(*changedAssets, ta)
+
+	if *trustedAssets == nil {
+		*trustedAssets = bootAssetsMap{}
+	}
+
+	if taBefore != nil && !isAssetAlreadyTracked(*trustedAssets, taBefore) {
+		// make sure that the boot asset that was was in the filesystem
+		// before the update, is properly tracked until either a
+		// successful boot or the update is canceled
+		// the original asset hash is listed first
+		(*trustedAssets)[taBefore.name] = append([]string{taBefore.hash}, (*trustedAssets)[taBefore.name]...)
+	}
+
+	if !isAssetAlreadyTracked(*trustedAssets, ta) {
+		if len((*trustedAssets)[ta.name]) > 1 {
+			// we expect at most 2 different blobs for a given asset
+			// name, the current one and one that will be installed
+			// during an update; more entries indicates that the
+			// same asset name is used multiple times with different
+			// content
+			return gadget.ChangeAbort, fmt.Errorf("cannot reuse asset name %q", ta.name)
+		}
+		(*trustedAssets)[ta.name] = append((*trustedAssets)[ta.name], ta.hash)
+	}
+
+	if o.modeenv.deepEqual(modeenvBefore) {
+		return gadget.ChangeApply, nil
+	}
+	if err := o.modeenv.Write(); err != nil {
+		return gadget.ChangeAbort, fmt.Errorf("cannot write modeeenv: %v", err)
+	}
+	return gadget.ChangeApply, nil
+}
+
+func (o *TrustedAssetsUpdateObserver) observeRollback(bl bootloader.Bootloader, recovery bool, root, relativeTarget string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	trustedAssets := &o.modeenv.CurrentTrustedBootAssets
+	otherTrustedAssets := o.modeenv.CurrentTrustedRecoveryBootAssets
+	if recovery {
+		trustedAssets = &o.modeenv.CurrentTrustedRecoveryBootAssets
+		otherTrustedAssets = o.modeenv.CurrentTrustedBootAssets
+	}
+
+	assetName := filepath.Base(relativeTarget)
+	hashList, ok := (*trustedAssets)[assetName]
+	if !ok || len(hashList) == 0 {
+		// asset not tracked in modeenv
+		return gadget.ChangeApply, nil
+	}
+
+	// new assets are appended to the list
+	expectedOldHash := hashList[0]
+	// sanity check, make sure that the current file is what we expect
+	newlyAdded := false
+	ondiskHash, err := o.cache.fileHash(filepath.Join(root, relativeTarget))
+	if err != nil {
+		// file may not exist if it was added by the update, that's ok
+		if !os.IsNotExist(err) {
+			return gadget.ChangeAbort, fmt.Errorf("cannot calculate the digest of current asset: %v", err)
+		}
+		newlyAdded = true
+		if len(hashList) > 1 {
+			// we have more than 1 hash of the asset, so we expected
+			// a previous revision to be restored, but got nothing
+			// instead
+			return gadget.ChangeAbort, fmt.Errorf("tracked asset %q is unexpectedly missing from disk",
+				assetName)
+		}
+	} else {
+		if ondiskHash != expectedOldHash {
+			// this is unexpected, a different file exists on disk?
+			return gadget.ChangeAbort, fmt.Errorf("unexpected content of existing asset %q", relativeTarget)
+		}
+	}
+
+	newHash := ""
+	if len(hashList) == 1 {
+		if newlyAdded {
+			newHash = hashList[0]
+		}
+	} else {
+		newHash = hashList[1]
+	}
+	if newHash != "" && !isAssetHashTrackedInMap(otherTrustedAssets, assetName, newHash) {
+		// asset revision is not used used elsewhere, we can remove it from the cache
+		if err := o.cache.Remove(bl.Name(), assetName, newHash); err != nil {
+			// XXX: should this be a log instead?
+			return gadget.ChangeAbort, fmt.Errorf("cannot remove unused boot asset %v:%v: %v", assetName, newHash, err)
+		}
+	}
+
+	// update modeenv content
+	if !newlyAdded {
+		(*trustedAssets)[assetName] = hashList[:1]
+	} else {
+		delete(*trustedAssets, assetName)
+	}
+
+	if err := o.modeenv.Write(); err != nil {
+		return gadget.ChangeAbort, fmt.Errorf("cannot write modeeenv: %v", err)
+	}
+
+	return gadget.ChangeApply, nil
+}
+
+// BeforeWrite is called when the update process has been staged for execution.
+func (o *TrustedAssetsUpdateObserver) BeforeWrite() error {
+	if o.modeenv == nil {
+		// modeenv wasn't even loaded yet, meaning none of the trusted
+		// boot assets was updated
+		return nil
+	}
+	const expectReseal = true
+	if err := resealKeyToModeenv(dirs.GlobalRootDir, o.model, o.modeenv, expectReseal); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (o *TrustedAssetsUpdateObserver) canceledUpdate(recovery bool) {
+	trustedAssets := &o.modeenv.CurrentTrustedBootAssets
+	otherTrustedAssets := o.modeenv.CurrentTrustedRecoveryBootAssets
+	changedAssets := o.changedAssets
+	if recovery {
+		trustedAssets = &o.modeenv.CurrentTrustedRecoveryBootAssets
+		otherTrustedAssets = o.modeenv.CurrentTrustedBootAssets
+		changedAssets = o.seedChangedAssets
+	}
+
+	if len(*trustedAssets) == 0 {
+		return
+	}
+
+	for _, changed := range changedAssets {
+		hashList, ok := (*trustedAssets)[changed.name]
+		if !ok || len(hashList) == 0 {
+			// not tracked already, nothing to do
+			continue
+		}
+		if len(hashList) == 1 {
+			currentAssetHash := hashList[0]
+			if currentAssetHash != changed.hash {
+				// assets list has already been trimmed, nothing
+				// to do
+				continue
+			} else {
+				// asset was newly added
+				delete(*trustedAssets, changed.name)
+			}
+		} else {
+			// asset updates were appended to the list
+			(*trustedAssets)[changed.name] = hashList[:1]
+		}
+		if !isAssetHashTrackedInMap(otherTrustedAssets, changed.name, changed.hash) {
+			// asset revision is not used used elsewhere, we can remove it from the cache
+			if err := o.cache.Remove(changed.blName, changed.name, changed.hash); err != nil {
+				logger.Noticef("cannot remove unused boot asset %v:%v: %v", changed.name, changed.hash, err)
+			}
+		}
+	}
+}
+
+// Canceled is called when the update has been canceled, or if changes
+// were written and the update has been reverted.
+func (o *TrustedAssetsUpdateObserver) Canceled() error {
+	if o.modeenv == nil {
+		// modeenv wasn't even loaded yet, meaning none of the boot
+		// assets was updated
+		return nil
+	}
+	for _, isRecovery := range []bool{false, true} {
+		o.canceledUpdate(isRecovery)
+	}
+
+	if err := o.modeenv.Write(); err != nil {
+		return fmt.Errorf("cannot write modeeenv: %v", err)
+	}
+
+	const expectReseal = true
+	if err := resealKeyToModeenv(dirs.GlobalRootDir, o.model, o.modeenv, expectReseal); err != nil {
+		return fmt.Errorf("while canceling gadget update: %v", err)
+	}
+	return nil
+}
+
+func observeSuccessfulBootAssetsForBootloader(m *Modeenv, root string, opts *bootloader.Options) (drop []*trackedAsset, err error) {
+	trustedAssetsMap := &m.CurrentTrustedBootAssets
+	otherTrustedAssetsMap := m.CurrentTrustedRecoveryBootAssets
+	whichBootloader := "run mode"
+	if opts != nil && opts.Role == bootloader.RoleRecovery {
+		trustedAssetsMap = &m.CurrentTrustedRecoveryBootAssets
+		otherTrustedAssetsMap = m.CurrentTrustedBootAssets
+		whichBootloader = "recovery"
+	}
+
+	if len(*trustedAssetsMap) == 0 {
+		// bootloader may have trusted assets, but we are not tracking
+		// any for the boot process
+		return nil, nil
+	}
+
+	// let's find the bootloader first
+	bl, trustedAssets, err := findMaybeTrustedBootloaderAndAssets(root, opts)
+	if err != nil {
+		return nil, err
+	}
+	if len(trustedAssets) == 0 {
+		// not a trusted assets bootloader, nothing to do
+		return nil, nil
+	}
+
+	cache := newTrustedAssetsCache(dirs.SnapBootAssetsDir)
+	for _, trustedAsset := range trustedAssets {
+		assetName := filepath.Base(trustedAsset)
+
+		// find the hash of the file on disk
+		assetHash, err := cache.fileHash(filepath.Join(root, trustedAsset))
+		if err != nil && !os.IsNotExist(err) {
+			return nil, fmt.Errorf("cannot calculate the digest of existing trusted asset: %v", err)
+		}
+		if assetHash == "" {
+			// no trusted asset on disk, but we booted nonetheless,
+			// at least log something
+			logger.Noticef("system booted without %v bootloader trusted asset %q", whichBootloader, trustedAsset)
+			// given that asset names cannot be reused, clear the
+			// boot assets map for the current bootloader
+			delete(*trustedAssetsMap, assetName)
+			continue
+		}
+
+		// this is what we booted with
+		bootedWith := []string{assetHash}
+		// one of these was expected during boot
+		hashList := (*trustedAssetsMap)[assetName]
+
+		assetFound := false
+		// find out if anything needs to be dropped
+		for _, hash := range hashList {
+			if hash == assetHash {
+				assetFound = true
+				continue
+			}
+			if !isAssetHashTrackedInMap(otherTrustedAssetsMap, assetName, hash) {
+				// asset can be dropped
+				drop = append(drop, &trackedAsset{
+					blName: bl.Name(),
+					name:   assetName,
+					hash:   hash,
+				})
+			}
+		}
+
+		if !assetFound {
+			// unexpected, we have booted with an asset whose hash
+			// is not listed among the ones we expect
+
+			// TODO:UC20: try to restore the asset from cache
+			return nil, fmt.Errorf("system booted with unexpected %v bootloader asset %q hash %v", whichBootloader, trustedAsset, assetHash)
+		}
+
+		// update the list of what we booted with
+		(*trustedAssetsMap)[assetName] = bootedWith
+
+	}
+	return drop, nil
+}
+
+// observeSuccessfulBootAssets observes the state of the trusted boot assets
+// after a successful boot. Returns a modified modeenv reflecting a new state,
+// and a list of assets that can be dropped from the cache.
+func observeSuccessfulBootAssets(m *Modeenv) (newM *Modeenv, drop []*trackedAsset, err error) {
+	newM, err = m.Copy()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for _, bl := range []struct {
+		root string
+		opts *bootloader.Options
+	}{
+		{
+			// ubuntu-boot bootloader
+			root: InitramfsUbuntuBootDir,
+			opts: &bootloader.Options{Role: bootloader.RoleRunMode, NoSlashBoot: true},
+		}, {
+			// ubuntu-seed bootloader
+			root: InitramfsUbuntuSeedDir,
+			opts: &bootloader.Options{Role: bootloader.RoleRecovery, NoSlashBoot: true},
+		},
+	} {
+		dropForBootloader, err := observeSuccessfulBootAssetsForBootloader(newM, bl.root, bl.opts)
+		if err != nil {
+			return nil, nil, err
+		}
+		drop = append(drop, dropForBootloader...)
+	}
+	return newM, drop, nil
+}
diff -Nru snapd-2.45.1+20.04.2/boot/assets_test.go snapd-2.48.3+20.04/boot/assets_test.go
--- snapd-2.45.1+20.04.2/boot/assets_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/assets_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2765 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"syscall"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/boot/boottest"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/bootloadertest"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/seed"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/timings"
+)
+
+type assetsSuite struct {
+	baseBootenvSuite
+}
+
+var _ = Suite(&assetsSuite{})
+
+func (s *assetsSuite) SetUpTest(c *C) {
+	s.baseBootenvSuite.SetUpTest(c)
+	c.Assert(os.MkdirAll(boot.InitramfsUbuntuBootDir, 0755), IsNil)
+	c.Assert(os.MkdirAll(boot.InitramfsUbuntuSeedDir, 0755), IsNil)
+
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error { return nil })
+	s.AddCleanup(restore)
+}
+
+func checkContentGlob(c *C, glob string, expected []string) {
+	l, err := filepath.Glob(glob)
+	c.Assert(err, IsNil)
+	c.Check(l, DeepEquals, expected)
+}
+
+func (s *assetsSuite) uc20UpdateObserverEncryptedSystemMockedBootloader(c *C) (*boot.TrustedAssetsUpdateObserver, *asserts.Model) {
+	// checked by TrustedAssetsUpdateObserverForModel and
+	// resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+	return s.uc20UpdateObserver(c, c.MkDir())
+}
+
+func (s *assetsSuite) uc20UpdateObserver(c *C, gadgetDir string) (*boot.TrustedAssetsUpdateObserver, *asserts.Model) {
+	uc20Model := boottest.MakeMockUC20Model()
+	obs, err := boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(obs, NotNil)
+	c.Assert(err, IsNil)
+	return obs, uc20Model
+}
+
+func (s *assetsSuite) bootloaderWithTrustedAssets(c *C, trustedAssets []string) *bootloadertest.MockTrustedAssetsBootloader {
+	tab := bootloadertest.Mock("trusted", "").WithTrustedAssets()
+	bootloader.Force(tab)
+	tab.TrustedAssetsList = trustedAssets
+	s.AddCleanup(func() { bootloader.Force(nil) })
+	return tab
+}
+
+func (s *assetsSuite) TestAssetsCacheAddRemove(c *C) {
+	cacheDir := c.MkDir()
+	d := c.MkDir()
+
+	cache := boot.NewTrustedAssetsCache(cacheDir)
+
+	data := []byte("foobar")
+	// SHA3-384
+	hash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err := ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+
+	// add a new file
+	ta, err := cache.Add(filepath.Join(d, "foobar"), "grub", "grubx64.efi")
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", hash)), testutil.FileEquals, string(data))
+	c.Check(ta, NotNil)
+
+	// try the same file again
+	taAgain, err := cache.Add(filepath.Join(d, "foobar"), "grub", "grubx64.efi")
+	c.Assert(err, IsNil)
+	// file already cached
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", hash)), testutil.FileEquals, string(data))
+	// and there's just one entry in the cache
+	checkContentGlob(c, filepath.Join(cacheDir, "grub", "*"), []string{
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", hash)),
+	})
+	// let go-check do the deep equals check
+	c.Check(taAgain, DeepEquals, ta)
+
+	// same data but different asset name
+	taDifferentAsset, err := cache.Add(filepath.Join(d, "foobar"), "grub", "bootx64.efi")
+	c.Assert(err, IsNil)
+	// new entry in cache
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", hash)), testutil.FileEquals, string(data))
+	// 2 files now
+	checkContentGlob(c, filepath.Join(cacheDir, "grub", "*"), []string{
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", hash)),
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", hash)),
+	})
+	c.Check(taDifferentAsset, NotNil)
+
+	// same source, data (new hash), existing asset name
+	newData := []byte("new foobar")
+	newHash := "5aa87615f6613a37d63c9a29746ef57457286c37148a4ae78493b0face5976c1fea940a19486e6bef65d43aec6b8f5a2"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), newData, 0644)
+	c.Assert(err, IsNil)
+
+	taExistingAssetName, err := cache.Add(filepath.Join(d, "foobar"), "grub", "bootx64.efi")
+	c.Assert(err, IsNil)
+	// new entry in cache
+	c.Check(taExistingAssetName, NotNil)
+	// we have both new and old asset
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", newHash)), testutil.FileEquals, string(newData))
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", hash)), testutil.FileEquals, string(data))
+	// 3 files in total
+	checkContentGlob(c, filepath.Join(cacheDir, "grub", "*"), []string{
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", hash)),
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", newHash)),
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", hash)),
+	})
+
+	// drop
+	err = cache.Remove("grub", "bootx64.efi", newHash)
+	c.Assert(err, IsNil)
+	// asset bootx64.efi with given hash was dropped
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", newHash)), testutil.FileAbsent)
+	// the other file still exists
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", hash)), testutil.FileEquals, string(data))
+	// remove it too
+	err = cache.Remove("grub", "bootx64.efi", hash)
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("bootx64.efi-%s", hash)), testutil.FileAbsent)
+
+	// what is left is the grub assets only
+	checkContentGlob(c, filepath.Join(cacheDir, "grub", "*"), []string{
+		filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", hash)),
+	})
+}
+
+func (s *assetsSuite) TestAssetsCacheAddErr(c *C) {
+	cacheDir := c.MkDir()
+	d := c.MkDir()
+	cache := boot.NewTrustedAssetsCache(cacheDir)
+
+	defer os.Chmod(cacheDir, 0755)
+	err := os.Chmod(cacheDir, 0000)
+	c.Assert(err, IsNil)
+
+	if os.Geteuid() != 0 {
+		err = ioutil.WriteFile(filepath.Join(d, "foobar"), []byte("foo"), 0644)
+		c.Assert(err, IsNil)
+		// cannot create bootloader subdirectory
+		ta, err := cache.Add(filepath.Join(d, "foobar"), "grub", "grubx64.efi")
+		c.Assert(err, ErrorMatches, "cannot create cache directory: mkdir .*/grub: permission denied")
+		c.Check(ta, IsNil)
+	}
+
+	// fix it now
+	err = os.Chmod(cacheDir, 0755)
+	c.Assert(err, IsNil)
+
+	_, err = cache.Add(filepath.Join(d, "no-file"), "grub", "grubx64.efi")
+	c.Assert(err, ErrorMatches, "cannot open asset file: open .*/no-file: no such file or directory")
+
+	if os.Geteuid() != 0 {
+		blDir := filepath.Join(cacheDir, "grub")
+		defer os.Chmod(blDir, 0755)
+		err = os.Chmod(blDir, 0000)
+		c.Assert(err, IsNil)
+
+		_, err = cache.Add(filepath.Join(d, "foobar"), "grub", "grubx64.efi")
+		c.Assert(err, ErrorMatches, `cannot create temporary cache file: open .*/grub/grubx64\.efi\.temp\.[a-zA-Z0-9]+~: permission denied`)
+	}
+}
+
+func (s *assetsSuite) TestAssetsCacheRemoveErr(c *C) {
+	cacheDir := c.MkDir()
+	d := c.MkDir()
+	cache := boot.NewTrustedAssetsCache(cacheDir)
+
+	data := []byte("foobar")
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err := ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	// cannot create bootloader subdirectory
+	_, err = cache.Add(filepath.Join(d, "foobar"), "grub", "grubx64.efi")
+	c.Assert(err, IsNil)
+	// sanity
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", dataHash)), testutil.FileEquals, string(data))
+
+	err = cache.Remove("grub", "no file", "some-hash")
+	c.Assert(err, IsNil)
+
+	// different asset name but known hash
+	err = cache.Remove("grub", "different-name", dataHash)
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(cacheDir, "grub", fmt.Sprintf("grubx64.efi-%s", dataHash)), testutil.FileEquals, string(data))
+}
+
+func (s *assetsSuite) TestInstallObserverNew(c *C) {
+	d := c.MkDir()
+	// bootloader in gadget cannot be identified
+	uc20Model := boottest.MakeMockUC20Model()
+	for _, encryption := range []bool{true, false} {
+		obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, encryption)
+		c.Assert(err, ErrorMatches, "cannot find bootloader: cannot determine bootloader")
+		c.Assert(obs, IsNil)
+	}
+
+	// pretend grub is used
+	c.Assert(ioutil.WriteFile(filepath.Join(d, "grub.conf"), nil, 0755), IsNil)
+
+	for _, encryption := range []bool{true, false} {
+		obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, encryption)
+		c.Assert(err, IsNil)
+		c.Assert(obs, NotNil)
+	}
+
+	// but nil for non UC20
+	nonUC20Model := boottest.MakeMockModel()
+	nonUC20obs, err := boot.TrustedAssetsInstallObserverForModel(nonUC20Model, d, false)
+	c.Assert(err, Equals, boot.ErrObserverNotApplicable)
+	c.Assert(nonUC20obs, IsNil)
+
+	// listing trusted assets fails
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+	})
+	tab.TrustedAssetsErr = fmt.Errorf("fail")
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, true)
+	c.Assert(err, ErrorMatches, `cannot list "trusted" bootloader trusted assets: fail`)
+	c.Assert(obs, IsNil)
+	// failed when listing run bootloader assets
+	c.Check(tab.TrustedAssetsCalls, Equals, 1)
+
+	// force an error
+	bootloader.ForceError(fmt.Errorf("fail bootloader"))
+	obs, err = boot.TrustedAssetsInstallObserverForModel(uc20Model, d, true)
+	c.Assert(err, ErrorMatches, `cannot find bootloader: fail bootloader`)
+	c.Assert(obs, IsNil)
+}
+
+var (
+	mockRunBootStruct = &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Role: gadget.SystemBoot,
+		},
+	}
+	mockSeedStruct = &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Role: gadget.SystemSeed,
+		},
+	}
+)
+
+func (s *assetsSuite) TestInstallObserverObserveSystemBootRealGrub(c *C) {
+	d := c.MkDir()
+
+	// mock a bootloader that uses trusted assets
+	err := ioutil.WriteFile(filepath.Join(d, "grub.conf"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+
+	otherData := []byte("other foobar")
+	err = ioutil.WriteFile(filepath.Join(d, "other-foobar"), otherData, 0644)
+	c.Assert(err, IsNil)
+
+	writeChange := &gadget.ContentChange{
+		// file that contains the data of the installed file
+		After: filepath.Join(d, "foobar"),
+		// there is no original file in place
+		Before: "",
+	}
+	// only grubx64.efi gets installed to system-boot
+	res, err := obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"EFI/boot/grubx64.efi", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// Observe is called when populating content, but one can freely specify
+	// overlapping content entries, so a same file may be observed more than
+	// once
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"EFI/boot/grubx64.efi", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// try with one more file, which is not a trusted asset of a run mode, so it is ignored
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"EFI/boot/bootx64.efi", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// a managed boot asset is to be held
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"EFI/ubuntu/grub.cfg", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+
+	// a single file in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "grub", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", fmt.Sprintf("grubx64.efi-%s", dataHash)),
+	})
+
+	// and one more, a non system-boot structure, so the file is ignored
+	systemSeedStruct := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Role: gadget.SystemSeed,
+		},
+	}
+	otherWriteChange := &gadget.ContentChange{
+		After: filepath.Join(d, "other-foobar"),
+	}
+	res, err = obs.Observe(gadget.ContentWrite, systemSeedStruct, boot.InitramfsUbuntuBootDir,
+		"EFI/boot/grubx64.efi", otherWriteChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// still, only one entry in the cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "grub", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", fmt.Sprintf("grubx64.efi-%s", dataHash)),
+	})
+
+	// let's see what the observer has tracked
+	tracked := obs.CurrentTrustedBootAssetsMap()
+	c.Check(tracked, DeepEquals, boot.BootAssetsMap{
+		"grubx64.efi": []string{dataHash},
+	})
+}
+
+func (s *assetsSuite) TestInstallObserverObserveSystemBootMocked(c *C) {
+	d := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"nested/other-asset",
+	})
+
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	// the list of trusted assets was asked for run and recovery bootloaders
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+
+	writeChange := &gadget.ContentChange{
+		// file that contains the data of the installed file
+		After: filepath.Join(d, "foobar"),
+		// there is no original file in place
+		Before: "",
+	}
+	res, err := obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"asset", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe same asset again
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"asset", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// different one
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"nested/other-asset", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// a non trusted asset
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"non-trusted", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// a single file in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("other-asset-%s", dataHash)),
+	})
+	// let's see what the observer has tracked
+	tracked := obs.CurrentTrustedBootAssetsMap()
+	c.Check(tracked, DeepEquals, boot.BootAssetsMap{
+		"asset":       []string{dataHash},
+		"other-asset": []string{dataHash},
+	})
+}
+
+func (s *assetsSuite) TestInstallObserverObserveSystemBootMockedNoEncryption(c *C) {
+	d := c.MkDir()
+	s.bootloaderWithTrustedAssets(c, []string{"asset"})
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := false
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, Equals, boot.ErrObserverNotApplicable)
+	c.Assert(obs, IsNil)
+}
+
+func (s *assetsSuite) TestInstallObserverObserveSystemBootMockedUnencryptedWithManaged(c *C) {
+	d := c.MkDir()
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+	tab.ManagedAssetsList = []string{"managed"}
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := false
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+
+	c.Assert(ioutil.WriteFile(filepath.Join(d, "foobar"), nil, 0755), IsNil)
+	writeChange := &gadget.ContentChange{
+		// file that contains the data of the installed file
+		After: filepath.Join(d, "foobar"),
+		// there is no original file in place
+		Before: "",
+	}
+	res, err := obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir,
+		"managed", writeChange)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+}
+
+func (s *assetsSuite) TestInstallObserverNonTrustedBootloader(c *C) {
+	// bootloader is not a trusted assets one, but we use encryption, one
+	// may try setting encryption key on the observer
+
+	d := c.MkDir()
+
+	// MockBootloader does not implement trusted assets
+	bootloader.Force(bootloadertest.Mock("mock", ""))
+	defer bootloader.Force(nil)
+
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	obs.ChosenEncryptionKeys(secboot.EncryptionKey{1, 2, 3, 4}, secboot.EncryptionKey{5, 6, 7, 8})
+	c.Check(obs.CurrentDataEncryptionKey(), DeepEquals, secboot.EncryptionKey{1, 2, 3, 4})
+	c.Check(obs.CurrentSaveEncryptionKey(), DeepEquals, secboot.EncryptionKey{5, 6, 7, 8})
+}
+
+func (s *assetsSuite) TestInstallObserverTrustedButNoAssets(c *C) {
+	// bootloader has no trusted assets, but encryption is enabled, and one
+	// may try setting a key on the observer
+
+	d := c.MkDir()
+
+	tab := bootloadertest.Mock("trusted-assets", "").WithTrustedAssets()
+	bootloader.Force(tab)
+	defer bootloader.Force(nil)
+
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	obs.ChosenEncryptionKeys(secboot.EncryptionKey{1, 2, 3, 4}, secboot.EncryptionKey{5, 6, 7, 8})
+	c.Check(obs.CurrentDataEncryptionKey(), DeepEquals, secboot.EncryptionKey{1, 2, 3, 4})
+	c.Check(obs.CurrentSaveEncryptionKey(), DeepEquals, secboot.EncryptionKey{5, 6, 7, 8})
+}
+
+func (s *assetsSuite) TestInstallObserverTrustedReuseNameErr(c *C) {
+	d := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"nested/asset",
+	})
+
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	// the list of trusted assets was asked for run and recovery bootloaders
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), []byte("foobar"), 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(d, "other"), []byte("other"), 0644)
+	c.Assert(err, IsNil)
+	res, err := obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// same asset name but different content
+	res, err = obs.Observe(gadget.ContentWrite, mockRunBootStruct, boot.InitramfsUbuntuBootDir, "nested/asset",
+		&gadget.ContentChange{After: filepath.Join(d, "other")})
+	c.Assert(err, ErrorMatches, `cannot reuse asset name "asset"`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+}
+
+func (s *assetsSuite) TestInstallObserverObserveExistingRecoveryMocked(c *C) {
+	d := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"nested/other-asset",
+		"shim",
+	})
+
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	// trusted assets for the run and recovery bootloaders were asked for
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "asset"), data, 0644)
+	c.Assert(err, IsNil)
+	err = os.Mkdir(filepath.Join(d, "nested"), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(d, "nested/other-asset"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	err = obs.ObserveExistingTrustedRecoveryAssets(d)
+	c.Assert(err, IsNil)
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("other-asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+	// the list of trusted assets for recovery was asked for
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+	// let's see what the observer has tracked
+	tracked := obs.CurrentTrustedRecoveryBootAssetsMap()
+	c.Check(tracked, DeepEquals, boot.BootAssetsMap{
+		"asset":       []string{dataHash},
+		"other-asset": []string{dataHash},
+		"shim":        []string{shimHash},
+	})
+}
+
+func (s *assetsSuite) TestInstallObserverObserveExistingRecoveryReuseNameErr(c *C) {
+	d := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"nested/asset",
+	})
+	// we get an observer for UC20
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	// got the list of trusted assets for run and recovery bootloaders
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	err = ioutil.WriteFile(filepath.Join(d, "asset"), []byte("foobar"), 0644)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Join(d, "nested"), 0755)
+	c.Assert(err, IsNil)
+	// same asset name but different content
+	err = ioutil.WriteFile(filepath.Join(d, "nested/asset"), []byte("other"), 0644)
+	c.Assert(err, IsNil)
+	err = obs.ObserveExistingTrustedRecoveryAssets(d)
+	// same asset name but different content
+	c.Assert(err, ErrorMatches, `cannot reuse recovery asset name "asset"`)
+	// got the list of trusted assets for recovery bootloader
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+}
+
+func (s *assetsSuite) TestInstallObserverObserveExistingRecoveryButMissingErr(c *C) {
+	d := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+	})
+
+	uc20Model := boottest.MakeMockUC20Model()
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(uc20Model, d, useEncryption)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	// trusted asset is missing
+	err = obs.ObserveExistingTrustedRecoveryAssets(d)
+	c.Assert(err, ErrorMatches, "cannot open asset file: .*/asset: no such file or directory")
+}
+
+func (s *assetsSuite) TestUpdateObserverNew(c *C) {
+	tab := s.bootloaderWithTrustedAssets(c, nil)
+
+	uc20Model := boottest.MakeMockUC20Model()
+
+	gadgetDir := c.MkDir()
+
+	// no trusted or managed assets
+	obs, err := boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(err, Equals, boot.ErrObserverNotApplicable)
+	c.Check(obs, IsNil)
+
+	// no managed, some trusted assets, but we are not tracking them
+	tab.TrustedAssetsList = []string{"asset"}
+	obs, err = boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(err, Equals, boot.ErrObserverNotApplicable)
+	c.Check(obs, IsNil)
+
+	// let's see some managed assets, but not trusted assets
+	tab.ManagedAssetsList = []string{"managed"}
+	tab.TrustedAssetsList = nil
+	obs, err = boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(err, IsNil)
+	c.Check(obs, NotNil)
+
+	// no managed, some trusted which we need to track
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+	tab.ManagedAssetsList = nil
+	tab.TrustedAssetsList = []string{"asset"}
+	obs, err = boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+
+	// but nil for non UC20
+	nonUC20Model := boottest.MakeMockModel()
+	nonUC20obs, err := boot.TrustedAssetsUpdateObserverForModel(nonUC20Model, gadgetDir)
+	c.Assert(err, Equals, boot.ErrObserverNotApplicable)
+	c.Assert(nonUC20obs, IsNil)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateMockedWithReseal(c *C) {
+	// observe an update where some of the assets exist and some are new,
+	// followed by reseal
+
+	d := c.MkDir()
+	backups := c.MkDir()
+	root := c.MkDir()
+
+	// try to arrange the backups like the updater would do it
+	before := []byte("before")
+	beforeHash := "2df0976fd45ba2392dc7985cdfb7c2d096c1ea4917929dd7a0e9bffae90a443271e702663fc6a4189c1f4ab3ce7daee3"
+	err := ioutil.WriteFile(filepath.Join(backups, "asset.backup"), before, 0644)
+	c.Assert(err, IsNil)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {beforeHash},
+			"shim":  {"shim-hash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {beforeHash},
+		},
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"nested/other-asset",
+		"shim",
+	})
+	tab.ManagedAssetsList = []string{
+		"managed-asset",
+	}
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+	// the list of trusted assets is obtained upfront
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "foobar"),
+			// original content would get backed up by the updater
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "foobar"),
+			// original content
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "nested/other-asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// all files are in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", beforeHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("other-asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {beforeHash, dataHash},
+		"shim":  {"shim-hash", shimHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset":       {beforeHash, dataHash},
+		"shim":        {shimHash},
+		"other-asset": {dataHash},
+	})
+
+	// verify that managed assets are to be preserved
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "managed-asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+
+	// everything is set up, trigger a reseal
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	err = obs.BeforeWrite()
+	c.Assert(err, IsNil)
+	c.Check(resealCalls, Equals, 1)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateExistingAssetMocked(c *C) {
+	d := c.MkDir()
+	root := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"shim",
+	})
+	tab.ManagedAssetsList = []string{
+		"managed-asset",
+		"nested/managed-asset",
+	}
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err := ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	// add one file to the cache, as if the system got rebooted before
+	// modeenv got updated
+	cache := boot.NewTrustedAssetsCache(dirs.SnapBootAssetsDir)
+	_, err = cache.Add(filepath.Join(d, "foobar"), "trusted", "asset")
+	c.Assert(err, IsNil)
+	// file is in the cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+	})
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"asset-hash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			// shim with same hash is listed as trusted, but missing
+			// from cache
+			"shim": {shimHash},
+		},
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	// observe the updates
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// trusted assets were asked for
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+	// file is in the cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		// shim was added to cache
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {"asset-hash", dataHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+		"shim":  {shimHash},
+	})
+
+	// verify that managed assets are to be preserved
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "managed-asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "nested/managed-asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+
+	// everything is set up, trigger reseal
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	// execute before-write action
+	err = obs.BeforeWrite()
+	c.Assert(err, IsNil)
+	c.Check(resealCalls, Equals, 1)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateNothingTrackedMocked(c *C) {
+	d := c.MkDir()
+	root := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+	})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err := ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+
+	m := boot.Modeenv{
+		Mode: "run",
+		// nothing is tracked in modeenv yet
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	// observe the updates
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// trusted assets were asked for
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+	// file is in the cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+
+	// reseal does nothing
+	err = obs.BeforeWrite()
+	c.Assert(err, IsNil)
+	c.Check(tab.RecoveryBootChainCalls, HasLen, 0)
+	c.Check(tab.BootChainKernelPath, HasLen, 0)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateOtherRoleStructMocked(c *C) {
+	d := c.MkDir()
+	root := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+	})
+
+	// modeenv is not set up, but the observer should not care
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+	// and once again for the recovery bootloader
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	// non system-boot or system-seed structure gets ignored
+	mockVolumeStruct := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Role: gadget.SystemData,
+		},
+	}
+
+	// observe the updates
+	res, err := obs.Observe(gadget.ContentUpdate, mockVolumeStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateTrivialErr(c *C) {
+	// test trivial error scenarios of the update observer
+
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	d := c.MkDir()
+	root := c.MkDir()
+	gadgetDir := c.MkDir()
+
+	uc20Model := boottest.MakeMockUC20Model()
+
+	// first no bootloader
+	bootloader.ForceError(fmt.Errorf("bootloader fail"))
+
+	obs, err := boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(obs, IsNil)
+	c.Assert(err, ErrorMatches, "cannot find bootloader: bootloader fail")
+
+	bootloader.ForceError(nil)
+	bl := bootloadertest.Mock("trusted", "").WithTrustedAssets()
+	bootloader.Force(bl)
+	defer bootloader.Force(nil)
+
+	bl.TrustedAssetsErr = fmt.Errorf("fail")
+	obs, err = boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(obs, IsNil)
+	c.Assert(err, ErrorMatches, `cannot list "trusted" bootloader trusted assets: fail`)
+	// failed listing trusted assets
+	c.Check(bl.TrustedAssetsCalls, Equals, 1)
+
+	// grab a new bootloader mock
+	bl = bootloadertest.Mock("trusted", "").WithTrustedAssets()
+	bootloader.Force(bl)
+	bl.TrustedAssetsList = []string{"asset"}
+
+	obs, err = boot.TrustedAssetsUpdateObserverForModel(uc20Model, gadgetDir)
+	c.Assert(err, IsNil)
+	c.Assert(obs, NotNil)
+	c.Check(bl.TrustedAssetsCalls, Equals, 2)
+
+	// no modeenv
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot load modeenv: .* no such file or directory`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot load modeenv: .* no such file or directory`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// no source file, hash will fail
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot open asset file: .*/foobar: no such file or directory`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{Before: filepath.Join(d, "before"), After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot open asset file: .*/before: no such file or directory`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot open asset file: .*/foobar: no such file or directory`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateRepeatedAssetErr(c *C) {
+	d := c.MkDir()
+	root := c.MkDir()
+
+	bl := bootloadertest.Mock("trusted", "").WithTrustedAssets()
+	bootloader.Force(bl)
+	defer bootloader.Force(nil)
+	bl.TrustedAssetsList = []string{"asset"}
+
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	// we are already tracking 2 assets, this is an unexpected state for observing content updates
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"one", "two"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"one", "two"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// and the source file
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot reuse asset name "asset"`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, ErrorMatches, `cannot reuse asset name "asset"`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateAfterSuccessfulBootMocked(c *C) {
+	//observe an update in a scenario when a mid-gadget-update reboot
+	//happened and we have successfully booted with new assets only, but the
+	//update is incomplete and gets started again
+
+	d := c.MkDir()
+	backups := c.MkDir()
+	root := c.MkDir()
+
+	// try to arrange the backups like the updater would do it
+	before := []byte("before")
+	beforeHash := "2df0976fd45ba2392dc7985cdfb7c2d096c1ea4917929dd7a0e9bffae90a443271e702663fc6a4189c1f4ab3ce7daee3"
+	err := ioutil.WriteFile(filepath.Join(backups, "asset.backup"), before, 0644)
+	c.Assert(err, IsNil)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+
+	// pretend we rebooted mid update and have successfully booted with the
+	// new assets already, the old asset may have been dropped from the cache already
+	cache := boot.NewTrustedAssetsCache(dirs.SnapBootAssetsDir)
+	_, err = cache.Add(filepath.Join(d, "foobar"), "trusted", "asset")
+	c.Assert(err, IsNil)
+	// file is in the cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+	})
+	// and similarly, only the new asset in modeenv
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+	})
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "foobar"),
+			// original content would get backed up by the updater
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "foobar"),
+			// original content
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+
+	// all files are in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", beforeHash)),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		// original asset is restored, listed first
+		"asset": {beforeHash, dataHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		// same here
+		"asset": {beforeHash, dataHash},
+	})
+}
+
+func (s *assetsSuite) TestUpdateObserverRollbackModeenvManipulationMocked(c *C) {
+	root := c.MkDir()
+	rootSeed := c.MkDir()
+	d := c.MkDir()
+	backups := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"nested/other-asset",
+		"shim",
+	})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	// file exists in both run and seed bootloader rootdirs
+	c.Assert(ioutil.WriteFile(filepath.Join(root, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(rootSeed, "asset"), data, 0644), IsNil)
+	// and in the gadget
+	c.Assert(ioutil.WriteFile(filepath.Join(d, "asset"), data, 0644), IsNil)
+	// would be listed as Before
+	c.Assert(ioutil.WriteFile(filepath.Join(backups, "asset.backup"), data, 0644), IsNil)
+
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	// only exists in seed bootloader rootdir
+	c.Assert(ioutil.WriteFile(filepath.Join(rootSeed, "shim"), shim, 0644), IsNil)
+	// and in the gadget
+	c.Assert(ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644), IsNil)
+	// would be listed as Before
+	c.Assert(ioutil.WriteFile(filepath.Join(backups, "shim.backup"), data, 0644), IsNil)
+
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	// mock some files in cache
+	for _, name := range []string{
+		fmt.Sprintf("asset-%s", dataHash),
+		fmt.Sprintf("shim-%s", shimHash),
+		"shim-newshimhash",
+		"asset-newhash",
+		"other-asset-newotherhash",
+	} {
+		err := ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+	// the list of trusted assets is obtained upfront
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			// new version added during update
+			"asset": {dataHash, "newhash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			// no new version added during update
+			"asset": {dataHash},
+			// new version added during update
+			"shim": {shimHash, "newshimhash"},
+			// completely new file
+			"other-asset": {"newotherhash"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	res, err := obs.Observe(gadget.ContentRollback, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{
+			After:  filepath.Join(d, "asset"),
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentRollback, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "shim"),
+			// no before content, new file
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, rootSeed, "shim",
+		&gadget.ContentChange{
+			After:  filepath.Join(d, "shim"),
+			Before: filepath.Join(backups, "shim.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, rootSeed, "asset",
+		&gadget.ContentChange{
+			After:  filepath.Join(d, "asset"),
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, rootSeed, "nested/other-asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "asset"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// all files are in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+		"shim":  {shimHash},
+	})
+}
+
+func (s *assetsSuite) TestUpdateObserverRollbackFileSanity(c *C) {
+	root := c.MkDir()
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+	// list of trusted assets is obtained upfront
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+
+	// sane state of modeenv before rollback
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			// only one hash is listed, indicating it's a new file
+			"asset": {"newhash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			// same thing
+			"asset": {"newhash"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+	// file does not exist on disk
+	res, err := obs.Observe(gadget.ContentRollback, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, HasLen, 0)
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, HasLen, 0)
+
+	// new observer
+	obs, _ = s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+	m = boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			// only one hash is listed, indicating it's a new file
+			"asset": {"newhash", "bogushash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			// same thing
+			"asset": {"newhash", "bogushash"},
+		},
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+	// again, file does not exist on disk, but we expected it to be there
+	res, err = obs.Observe(gadget.ContentRollback, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{})
+	c.Assert(err, ErrorMatches, `tracked asset "asset" is unexpectedly missing from disk`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{})
+	c.Assert(err, ErrorMatches, `tracked asset "asset" is unexpectedly missing from disk`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+
+	// create the file which will fail checksum check
+	err = ioutil.WriteFile(filepath.Join(root, "asset"), nil, 0644)
+	c.Assert(err, IsNil)
+	// once more, the file exists on disk, but has unexpected checksum
+	res, err = obs.Observe(gadget.ContentRollback, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{})
+	c.Assert(err, ErrorMatches, `unexpected content of existing asset "asset"`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{})
+	c.Assert(err, ErrorMatches, `unexpected content of existing asset "asset"`)
+	c.Check(res, Equals, gadget.ChangeAbort)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateRollbackGrub(c *C) {
+	// exercise a full update/rollback cycle with grub
+
+	gadgetDir := c.MkDir()
+	bootDir := c.MkDir()
+	seedDir := c.MkDir()
+
+	// prepare a marker for grub bootloader
+	c.Assert(ioutil.WriteFile(filepath.Join(gadgetDir, "grub.conf"), nil, 0644), IsNil)
+
+	// we get an observer for UC20
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+	obs, _ := s.uc20UpdateObserver(c, gadgetDir)
+
+	cache := boot.NewTrustedAssetsCache(dirs.SnapBootAssetsDir)
+
+	for _, dir := range []struct {
+		root              string
+		fileWithContent   [][]string
+		addContentToCache bool
+	}{
+		{
+			// data of boot bootloader
+			root: bootDir,
+			// SHA3-384: 0d0c6522fcc813770f2bb9ca68ad3b4f0ccc6b4bfbd2e8497030079e6146f92177ad8f6f83d96ab61d7d42f5228a4389
+			fileWithContent: [][]string{
+				{"EFI/boot/grubx64.efi", "grub efi"},
+			},
+			addContentToCache: true,
+		}, {
+			// data of seed bootloader
+			root: seedDir,
+			fileWithContent: [][]string{
+				// SHA3-384: 6c3e6fc78ade5aadc5f9f0603a127346cc174436eb5e0188e108a376c3ba4d8951c460a8f51674e797c06951f74cb10d
+				{"EFI/boot/grubx64.efi", "recovery grub efi"},
+				// SHA3-384: c0437507ac094a7e9c699725cc0a4726cd10799af9eb79bbeaa136c2773163c80432295c2a04d3aa2ddd535ce8f1a12b
+				{"EFI/boot/bootx64.efi", "recovery shim efi"},
+			},
+			addContentToCache: true,
+		}, {
+			// gadget content
+			root: gadgetDir,
+			fileWithContent: [][]string{
+				// SHA3-384: f9554844308e89b565c1cdbcbdb9b09b8210dd2f1a11cb3b361de0a59f780ae3d4bd6941729a60e0f8ce15b2edef605d
+				{"grubx64.efi", "new grub efi"},
+				// SHA3-384: cc0663cc7e6c7ada990261c3ff1d72da001dc02451558716422d3d2443b8789463363c9ff0cd1b853c6ced3e8e7dc39d
+				{"bootx64.efi", "new recovery shim efi"},
+				{"grub.conf", "grub from gadget"},
+			},
+		},
+		// just the markers
+		{
+			root: bootDir,
+			fileWithContent: [][]string{
+				{"EFI/ubuntu/grub.cfg", "grub marker"},
+			},
+		}, {
+			root: seedDir,
+			fileWithContent: [][]string{
+				{"EFI/ubuntu/grub.cfg", "grub marker"},
+			},
+		},
+	} {
+		for _, f := range dir.fileWithContent {
+			p := filepath.Join(dir.root, f[0])
+			err := os.MkdirAll(filepath.Dir(p), 0755)
+			c.Assert(err, IsNil)
+			err = ioutil.WriteFile(p, []byte(f[1]), 0644)
+			c.Assert(err, IsNil)
+			if dir.addContentToCache {
+				_, err = cache.Add(p, "grub", filepath.Base(p))
+				c.Assert(err, IsNil)
+			}
+		}
+	}
+	cacheContentBefore := []string{
+		// recovery shim
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "bootx64.efi-c0437507ac094a7e9c699725cc0a4726cd10799af9eb79bbeaa136c2773163c80432295c2a04d3aa2ddd535ce8f1a12b"),
+		// boot bootloader
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "grubx64.efi-0d0c6522fcc813770f2bb9ca68ad3b4f0ccc6b4bfbd2e8497030079e6146f92177ad8f6f83d96ab61d7d42f5228a4389"),
+		// recovery bootloader
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "grubx64.efi-6c3e6fc78ade5aadc5f9f0603a127346cc174436eb5e0188e108a376c3ba4d8951c460a8f51674e797c06951f74cb10d"),
+	}
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "grub", "*"), cacheContentBefore)
+	// current files are tracked
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"grubx64.efi": {"0d0c6522fcc813770f2bb9ca68ad3b4f0ccc6b4bfbd2e8497030079e6146f92177ad8f6f83d96ab61d7d42f5228a4389"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"grubx64.efi": {"6c3e6fc78ade5aadc5f9f0603a127346cc174436eb5e0188e108a376c3ba4d8951c460a8f51674e797c06951f74cb10d"},
+			"bootx64.efi": {"c0437507ac094a7e9c699725cc0a4726cd10799af9eb79bbeaa136c2773163c80432295c2a04d3aa2ddd535ce8f1a12b"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// updates first
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, bootDir, "EFI/boot/grubx64.efi",
+		&gadget.ContentChange{After: filepath.Join(gadgetDir, "grubx64.efi")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, seedDir, "EFI/boot/grubx64.efi",
+		&gadget.ContentChange{After: filepath.Join(gadgetDir, "grubx64.efi")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, seedDir, "EFI/boot/bootx64.efi",
+		&gadget.ContentChange{After: filepath.Join(gadgetDir, "bootx64.efi")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// grub.cfg on ubuntu-seed and ubuntu-boot is managed by snapd
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, seedDir, "EFI/ubuntu/grub.cfg",
+		&gadget.ContentChange{After: filepath.Join(gadgetDir, "grub.conf")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, seedDir, "EFI/ubuntu/grub.cfg",
+		&gadget.ContentChange{After: filepath.Join(gadgetDir, "grub.conf")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+
+	// verify cache contents
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "grub", "*"), []string{
+		// recovery shim
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "bootx64.efi-c0437507ac094a7e9c699725cc0a4726cd10799af9eb79bbeaa136c2773163c80432295c2a04d3aa2ddd535ce8f1a12b"),
+		// new recovery shim
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "bootx64.efi-cc0663cc7e6c7ada990261c3ff1d72da001dc02451558716422d3d2443b8789463363c9ff0cd1b853c6ced3e8e7dc39d"),
+		// boot bootloader
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "grubx64.efi-0d0c6522fcc813770f2bb9ca68ad3b4f0ccc6b4bfbd2e8497030079e6146f92177ad8f6f83d96ab61d7d42f5228a4389"),
+		// recovery bootloader
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "grubx64.efi-6c3e6fc78ade5aadc5f9f0603a127346cc174436eb5e0188e108a376c3ba4d8951c460a8f51674e797c06951f74cb10d"),
+		// new recovery and boot bootloader
+		filepath.Join(dirs.SnapBootAssetsDir, "grub", "grubx64.efi-f9554844308e89b565c1cdbcbdb9b09b8210dd2f1a11cb3b361de0a59f780ae3d4bd6941729a60e0f8ce15b2edef605d"),
+	})
+
+	// and modeenv contents
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"grubx64.efi": {
+			// old hash
+			"0d0c6522fcc813770f2bb9ca68ad3b4f0ccc6b4bfbd2e8497030079e6146f92177ad8f6f83d96ab61d7d42f5228a4389",
+			// update
+			"f9554844308e89b565c1cdbcbdb9b09b8210dd2f1a11cb3b361de0a59f780ae3d4bd6941729a60e0f8ce15b2edef605d",
+		},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"grubx64.efi": {
+			// old hash
+			"6c3e6fc78ade5aadc5f9f0603a127346cc174436eb5e0188e108a376c3ba4d8951c460a8f51674e797c06951f74cb10d",
+			// update
+			"f9554844308e89b565c1cdbcbdb9b09b8210dd2f1a11cb3b361de0a59f780ae3d4bd6941729a60e0f8ce15b2edef605d",
+		},
+		"bootx64.efi": {
+			// old hash
+			"c0437507ac094a7e9c699725cc0a4726cd10799af9eb79bbeaa136c2773163c80432295c2a04d3aa2ddd535ce8f1a12b",
+			// update
+			"cc0663cc7e6c7ada990261c3ff1d72da001dc02451558716422d3d2443b8789463363c9ff0cd1b853c6ced3e8e7dc39d",
+		},
+	})
+
+	// hiya, update failed, pretend we do a rollback, files on disk are as
+	// if they were restored
+
+	res, err = obs.Observe(gadget.ContentRollback, mockRunBootStruct, bootDir, "EFI/boot/grubx64.efi",
+		&gadget.ContentChange{})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, seedDir, "EFI/boot/grubx64.efi",
+		&gadget.ContentChange{})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentRollback, mockSeedStruct, seedDir, "EFI/boot/bootx64.efi",
+		&gadget.ContentChange{})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+
+	// modeenv is back to the initial state
+	afterRollbackM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterRollbackM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterRollbackM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// and cache is back to the same state as before
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "grub", "*"), cacheContentBefore)
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledSimpleAfterBackupMocked(c *C) {
+	d := c.MkDir()
+	root := c.MkDir()
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+			"shim":  {"shimhash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"recoveryhash"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// mock some files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-shimhash",
+		"asset-assethash",
+		"asset-recoveryhash",
+	} {
+		err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// files are in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {"assethash", dataHash},
+		"shim":  {"shimhash", shimHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {"recoveryhash", dataHash},
+		"shim":  {shimHash},
+	})
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	// update is canceled
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	// modeenv is back to initial state
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// unused assets were dropped
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+
+	c.Check(resealCalls, Equals, 1)
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledPartiallyUsedMocked(c *C) {
+	// cancel an update where one of the assets is already used and canceling does not remove it from the cache
+
+	d := c.MkDir()
+	root := c.MkDir()
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err := ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	// mock some files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-shimhash",
+		"asset-assethash",
+		fmt.Sprintf("shim-%s", shimHash),
+	} {
+		err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+			"shim":  {"shimhash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"shim": {shimHash},
+		},
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	// XXX: shim is not updated
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// files are in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {"assethash", dataHash},
+		"shim":  {"shimhash", shimHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+		"shim":  {shimHash},
+	})
+	// update is canceled
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	// modeenv is back to initial state
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// unused assets were dropped
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledNoActionsMocked(c *C) {
+	// make sure that when no ContentUpdate actions were registered, or some
+	// were registered for one bootloader, but not the other, is not
+	// triggering unwanted behavior on cancel
+
+	d := c.MkDir()
+	root := c.MkDir()
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+			"shim":  {"shimhash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"recoveryhash"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-shimhash",
+		"asset-assethash",
+		"asset-recoveryhash",
+	} {
+		err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	// cancel the update
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	// modeenv is unchanged
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// unused assets were dropped
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+
+	c.Check(resealCalls, Equals, 0)
+
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), []byte("shim"), 0644)
+	c.Assert(err, IsNil)
+	// observe only recovery bootloader update, no action for run bootloader
+	res, err := obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// cancel again
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	afterCancelM, err = boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledEmptyModeenvAssets(c *C) {
+	// cancel an update where the maps of trusted assets are nil/empty
+	d := c.MkDir()
+	root := c.MkDir()
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	// trigger loading modeenv and bootloader information
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), []byte("shim"), 0644)
+	c.Assert(err, IsNil)
+	// observe an update only for the recovery bootloader, the run bootloader trusted assets remain empty
+	res, err := obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+
+	// cancel the update
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, HasLen, 0)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, HasLen, 0)
+
+	// get a new observer, and observe an update for run bootloader asset only
+	obs, _ = s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// cancel once more
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	afterCancelM, err = boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, HasLen, 0)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, HasLen, 0)
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledAfterRollback(c *C) {
+	// pretend there are changed assets with hashes that are not listed in
+	// modeenv
+	d := c.MkDir()
+	root := c.MkDir()
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	// trigger loading modeenv and bootloader information
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), []byte("shim"), 0644)
+	c.Assert(err, IsNil)
+	res, err := obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+
+	// procure the desired state by:
+	// injecting a changed asset for run bootloader
+	recoveryAsset := true
+	obs.InjectChangedAsset("trusted", "asset", "changehash", !recoveryAsset)
+	// and a changed asset for recovery bootloader
+	obs.InjectChangedAsset("trusted", "asset", "changehash", recoveryAsset)
+	// completely unknown
+	obs.InjectChangedAsset("trusted", "unknown", "somehash", !recoveryAsset)
+
+	// cancel the update
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledUnhappyCacheStillProceeds(c *C) {
+	// make sure that trying to remove the file from cache will not break
+	// the cancellation
+
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be executed by the root user")
+	}
+
+	logBuf, restore := logger.MockLogger()
+	defer restore()
+
+	d := c.MkDir()
+	root := c.MkDir()
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"recoveryhash"},
+		},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"asset-assethash",
+		"asset-recoveryhash",
+	} {
+		err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+	// we get an observer for UC20
+	obs, _ := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+	res, err := obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// make sure that the cache directory state is as expected
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+	// and the file is added to the assets map
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {"assethash"},
+		"shim":  {shimHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {"recoveryhash"},
+		"shim":  {shimHash},
+	})
+
+	// make cache directory read only and thus cache.Remove() fail
+	c.Assert(os.Chmod(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0444), IsNil)
+	defer os.Chmod(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755)
+
+	// cancel should not fail, even though files cannot be removed from cache
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+	c.Check(logBuf.String(), Matches, fmt.Sprintf(`.* cannot remove unused boot asset shim:%s: .* permission denied\n`, shimHash))
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootNoTrusted(c *C) {
+	// call to observe successful boot without any trusted assets
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		// no trusted assets
+	}
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, IsNil)
+	c.Check(drop, IsNil)
+	c.Check(newM, DeepEquals, m)
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootNoAssetsOnDisk(c *C) {
+	// call to observe successful boot, but assets do not exist on disk
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+		},
+	}
+
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, IsNil)
+	c.Check(drop, IsNil)
+	// we booted without assets on disk nonetheless
+	c.Check(newM.CurrentTrustedBootAssets, HasLen, 0)
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, HasLen, 0)
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootAfterUpdate(c *C) {
+	// call to observe successful boot
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+
+	// only asset for ubuntu-boot
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	// shim and asset for ubuntu-seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "shim"), shim, 0644), IsNil)
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash", dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"recoveryassethash", dataHash},
+			"shim":  {"recoveryshimhash", shimHash},
+		},
+	}
+
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, IsNil)
+	c.Assert(newM, NotNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+		"shim":  {shimHash},
+	})
+	c.Check(drop, HasLen, 3)
+	for i, en := range []struct {
+		assetName, hash string
+	}{
+		{"asset", "assethash"},
+		{"asset", "recoveryassethash"},
+		{"shim", "recoveryshimhash"},
+	} {
+		c.Check(drop[i].Equals("trusted", en.assetName, en.hash), IsNil)
+	}
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootWithUnexpected(c *C) {
+	// call to observe successful boot, but the asset we booted with is unexpected
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	unexpected := []byte("unexpected")
+	unexpectedHash := "2c823b62c52e614e48faac7e8b1fbb8ff3aee4d06b6f7fe5bd7d64953162b6e9879ead4827fa19c8c9a514585ddac94c"
+
+	// asset for ubuntu-boot
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), unexpected, 0644), IsNil)
+	// and for ubuntu-seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), unexpected, 0644), IsNil)
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash", dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"recoveryassethash", dataHash},
+		},
+	}
+
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`system booted with unexpected run mode bootloader asset "asset" hash %v`, unexpectedHash))
+	c.Assert(newM, IsNil)
+	c.Check(drop, HasLen, 0)
+
+	// make the run bootloader asset an expected one, we should still fail
+	// on the recovery bootloader asset
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+
+	newM, drop, err = boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`system booted with unexpected recovery bootloader asset "asset" hash %v`, unexpectedHash))
+	c.Assert(newM, IsNil)
+	c.Check(drop, HasLen, 0)
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootSingleEntries(c *C) {
+	// call to observe successful boot
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+
+	// only asset for ubuntu-boot
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	// shim and asset for ubuntu-seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "shim"), shim, 0644), IsNil)
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+			"shim":  {shimHash},
+		},
+	}
+
+	// nothing is changed
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, IsNil)
+	c.Assert(newM, NotNil)
+	c.Check(newM, DeepEquals, m)
+	c.Check(drop, HasLen, 0)
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootDropCandidateUsedByOtherBootloader(c *C) {
+	// observe successful boot, an unused recovery asset of a recovery
+	// bootloader is used by the ubuntu-boot bootloader, so it cannot be
+	// dropped from cache
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	maybeDrop := []byte("maybe-drop")
+	maybeDropHash := "08a99ce3af529ebbfb9a82df690007ac650635b165c3d1b416d471907fa3843270dce9cc001ea26f4afb4e0c5af05209"
+	data := []byte("foobar")
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	// ubuntu-boot booted with maybe-drop asset
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), maybeDrop, 0644), IsNil)
+
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {maybeDropHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {maybeDropHash, dataHash},
+		},
+	}
+
+	// nothing is changed
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, IsNil)
+	c.Assert(newM, NotNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {maybeDropHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+	// nothing get dropped, maybe-drop asset is still used by the
+	// ubuntu-boot bootloader
+	c.Check(drop, HasLen, 0)
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootParallelUpdate(c *C) {
+	// call to observe successful boot
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+
+	// only asset for ubuntu-boot
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	// shim and asset for ubuntu-seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "shim"), shim, 0644), IsNil)
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"oldhash", dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"oldhash", dataHash},
+			"shim":  {shimHash},
+		},
+	}
+
+	newM, drop, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, IsNil)
+	c.Assert(newM, NotNil)
+	c.Check(newM.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+		"shim":  {shimHash},
+	})
+	// asset was updated in parallel on both partition from the same
+	// oldhash that should be dropped now
+	c.Check(drop, HasLen, 1)
+	c.Check(drop[0].Equals("trusted", "asset", "oldhash"), IsNil)
+}
+
+func (s *assetsSuite) TestObserveSuccessfulBootHashErr(c *C) {
+	// call to observe successful boot
+
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be executed by the root user")
+	}
+
+	s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0000), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0000), IsNil)
+
+	m := &boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+	}
+
+	// nothing is changed
+	_, _, err := boot.ObserveSuccessfulBootWithAssets(m)
+	c.Assert(err, ErrorMatches, "cannot calculate the digest of existing trusted asset: .*/asset: permission denied")
+}
+
+func (s *assetsSuite) TestCopyBootAssetsCacheHappy(c *C) {
+	newRoot := c.MkDir()
+	// does not fail when dir does not exist
+	err := boot.CopyBootAssetsCacheToRoot(newRoot)
+	c.Assert(err, IsNil)
+
+	// temporarily overide umask
+	oldUmask := syscall.Umask(0000)
+	defer syscall.Umask(oldUmask)
+
+	entries := []struct {
+		name, content string
+		mode          uint
+	}{
+		{"foo/bar", "1234", 0644},
+		{"grub/grubx64.efi-1234", "grub content", 0622},
+		{"top-level", "top level content", 0666},
+		{"deeply/nested/content", "deeply nested content", 0611},
+	}
+
+	for _, entry := range entries {
+		p := filepath.Join(dirs.SnapBootAssetsDir, entry.name)
+		err = os.MkdirAll(filepath.Dir(p), 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(p, []byte(entry.content), os.FileMode(entry.mode))
+		c.Assert(err, IsNil)
+	}
+
+	err = boot.CopyBootAssetsCacheToRoot(newRoot)
+	c.Assert(err, IsNil)
+	for _, entry := range entries {
+		p := filepath.Join(dirs.SnapBootAssetsDirUnder(newRoot), entry.name)
+		c.Check(p, testutil.FileEquals, entry.content)
+		fi, err := os.Stat(p)
+		c.Assert(err, IsNil)
+		c.Check(fi.Mode().Perm(), Equals, os.FileMode(entry.mode),
+			Commentf("unexpected mode of copied file %q: %v", entry.name, fi.Mode().Perm()))
+	}
+}
+
+func (s *assetsSuite) TestCopyBootAssetsCacheUnhappy(c *C) {
+	// non-file
+	newRoot := c.MkDir()
+	dirs.SnapBootAssetsDir = c.MkDir()
+	p := filepath.Join(dirs.SnapBootAssetsDir, "fifo")
+	syscall.Mkfifo(p, 0644)
+	err := boot.CopyBootAssetsCacheToRoot(newRoot)
+	c.Assert(err, ErrorMatches, `unsupported non-file entry "fifo" mode prw-.*`)
+
+	if os.Geteuid() == 0 {
+		// the rest of the test cannot be executed by root user
+		return
+	}
+
+	// non-writable root
+	newRoot = c.MkDir()
+	nonWritableRoot := filepath.Join(newRoot, "non-writable")
+	err = os.MkdirAll(nonWritableRoot, 0000)
+	c.Assert(err, IsNil)
+	dirs.SnapBootAssetsDir = c.MkDir()
+	err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "file"), nil, 0644)
+	c.Assert(err, IsNil)
+	err = boot.CopyBootAssetsCacheToRoot(nonWritableRoot)
+	c.Assert(err, ErrorMatches, `cannot create cache directory under new root: mkdir .*: permission denied`)
+
+	// file cannot be read
+	newRoot = c.MkDir()
+	dirs.SnapBootAssetsDir = c.MkDir()
+	err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "file"), nil, 0000)
+	c.Assert(err, IsNil)
+	err = boot.CopyBootAssetsCacheToRoot(newRoot)
+	c.Assert(err, ErrorMatches, `cannot copy boot asset cache file "file": failed to copy all: .*`)
+
+	// directory at destination cannot be recreated
+	newRoot = c.MkDir()
+	dirs.SnapBootAssetsDir = c.MkDir()
+	// make a directory at destination non writable
+	err = os.MkdirAll(dirs.SnapBootAssetsDirUnder(newRoot), 0755)
+	c.Assert(err, IsNil)
+	err = os.Chmod(dirs.SnapBootAssetsDirUnder(newRoot), 0000)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "dir"), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "dir", "file"), nil, 0000)
+	c.Assert(err, IsNil)
+	err = boot.CopyBootAssetsCacheToRoot(newRoot)
+	c.Assert(err, ErrorMatches, `cannot recreate cache directory "dir": .*: permission denied`)
+
+}
+
+func (s *assetsSuite) TestUpdateObserverReseal(c *C) {
+	// observe an update followed by reseal
+
+	d := c.MkDir()
+	backups := c.MkDir()
+	root := c.MkDir()
+
+	// try to arrange the backups like the updater would do it
+	before := []byte("before")
+	beforeHash := "2df0976fd45ba2392dc7985cdfb7c2d096c1ea4917929dd7a0e9bffae90a443271e702663fc6a4189c1f4ab3ce7daee3"
+	err := ioutil.WriteFile(filepath.Join(backups, "asset.backup"), before, 0644)
+	c.Assert(err, IsNil)
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {beforeHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {beforeHash},
+		},
+		CurrentRecoverySystems: []string{"recovery-system-label"},
+		CurrentKernels:         []string{"pc-kernel_500.snap"},
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+		"shim",
+	})
+
+	// we get an observer for UC20
+	obs, uc20model := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "foobar"),
+			// original content would get backed up by the updater
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{
+			After: filepath.Join(d, "foobar"),
+			// original content
+			Before: filepath.Join(backups, "asset.backup"),
+		})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", beforeHash)),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)),
+	})
+
+	restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-kernel_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 1},
+				RealName: "pc-kernel",
+			},
+		}
+		return uc20model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	// everything is set up, trigger a reseal
+
+	resealCalls := 0
+	shimBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)), bootloader.RoleRecovery)
+	assetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)), bootloader.RoleRecovery)
+	beforeAssetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", beforeHash)), bootloader.RoleRecovery)
+	recoveryKernelBf := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.rootdir, "var/lib/snapd/snaps/pc-kernel_500.snap"), "kernel.efi", bootloader.RoleRunMode)
+
+	tab.RecoveryBootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		recoveryKernelBf,
+	}
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		runKernelBf,
+	}
+
+	restore = boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+
+		c.Assert(params.ModelParams, HasLen, 1)
+		mp := params.ModelParams[0]
+		c.Check(mp.Model, DeepEquals, uc20model)
+		for _, ch := range mp.EFILoadChains {
+			printChain(c, ch, "-")
+		}
+		switch resealCalls {
+		case 1:
+			c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(recoveryKernelBf)),
+					secboot.NewLoadChain(beforeAssetBf,
+						secboot.NewLoadChain(recoveryKernelBf))),
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(runKernelBf)),
+					secboot.NewLoadChain(beforeAssetBf,
+						secboot.NewLoadChain(runKernelBf))),
+			})
+		case 2:
+			c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(recoveryKernelBf)),
+					secboot.NewLoadChain(beforeAssetBf,
+						secboot.NewLoadChain(recoveryKernelBf))),
+			})
+		default:
+			c.Errorf("unexpected additional call to secboot.ResealKey (call # %d)", resealCalls)
+		}
+		return nil
+	})
+	defer restore()
+
+	err = obs.BeforeWrite()
+	c.Assert(err, IsNil)
+	c.Check(resealCalls, Equals, 2)
+}
+
+func (s *assetsSuite) TestUpdateObserverCanceledReseal(c *C) {
+	// check that Canceled calls reseal when there were changes to the
+	// trusted boot assets
+	d := c.MkDir()
+	root := c.MkDir()
+
+	m := boot.Modeenv{
+		Mode: "run",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+			"shim":  {"shimhash"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash"},
+			"shim":  {"shimhash"},
+		},
+		CurrentRecoverySystems: []string{"system"},
+		CurrentKernels:         []string{"pc-kernel_1.snap"},
+	}
+	err := m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	// mock some files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-shimhash",
+		"asset-assethash",
+		"asset-recoveryhash",
+	} {
+		err = ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	// we get an observer for UC20
+	obs, uc20model := s.uc20UpdateObserverEncryptedSystemMockedBootloader(c)
+
+	data := []byte("foobar")
+	err = ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+	shim := []byte("shim")
+	err = ioutil.WriteFile(filepath.Join(d, "shim"), shim, 0644)
+	c.Assert(err, IsNil)
+
+	// trigger a bunch of updates, so that we have things to cancel
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// observe the recovery struct
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "shim",
+		&gadget.ContentChange{After: filepath.Join(d, "shim")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+
+	restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-kernel_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 1},
+				RealName: "pc-kernel",
+			},
+		}
+		return uc20model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	shimBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted/shim-shimhash"), bootloader.RoleRecovery)
+	assetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted/asset-assethash"), bootloader.RoleRecovery)
+	recoveryKernelBf := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.rootdir, "var/lib/snapd/snaps/pc-kernel_500.snap"), "kernel.efi", bootloader.RoleRunMode)
+	tab.RecoveryBootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		recoveryKernelBf,
+	}
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		runKernelBf,
+	}
+
+	resealCalls := 0
+	restore = boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		c.Assert(params.ModelParams, HasLen, 1)
+		mp := params.ModelParams[0]
+		c.Check(mp.Model, DeepEquals, uc20model)
+		for _, ch := range mp.EFILoadChains {
+			printChain(c, ch, "-")
+		}
+		switch resealCalls {
+		case 1:
+			c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(recoveryKernelBf))),
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(runKernelBf))),
+			})
+		case 2:
+			c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(recoveryKernelBf))),
+			})
+		default:
+			c.Errorf("unexpected additional call to secboot.ResealKey (call # %d)", resealCalls)
+		}
+		return nil
+	})
+	defer restore()
+
+	// update is canceled
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	// modeenv is back to initial state
+	afterCancelM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(afterCancelM.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(afterCancelM.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// unused assets were dropped
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-assethash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-recoveryhash"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-shimhash"),
+	})
+
+	c.Check(resealCalls, Equals, 2)
+}
+
+func (s *assetsSuite) TestUpdateObserverUpdateMockedNonEncryption(c *C) {
+	// observe an update on a system where encryption is not used
+
+	d := c.MkDir()
+	backups := c.MkDir()
+	root := c.MkDir()
+
+	// try to arrange the backups like the updater would do it
+	data := []byte("foobar")
+	err := ioutil.WriteFile(filepath.Join(d, "foobar"), data, 0644)
+	c.Assert(err, IsNil)
+
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err = m.WriteTo("")
+	c.Assert(err, IsNil)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{
+		"asset",
+	})
+	tab.ManagedAssetsList = []string{
+		"managed-asset",
+	}
+
+	// we get an observer for UC20, bootloader is mocked
+	obs, _ := s.uc20UpdateObserver(c, c.MkDir())
+
+	// asset is ignored, and the change is applied
+	change := &gadget.ContentChange{
+		After: filepath.Join(d, "foobar"),
+		// original content would get backed up by the updater
+		Before: filepath.Join(backups, "asset.backup"),
+	}
+	res, err := obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "asset", change)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "asset", change)
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeApply)
+	// trusted assets were asked for when setting up bootloader context
+	c.Check(tab.TrustedAssetsCalls, Equals, 2)
+	// but nothing is really tracked
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), nil)
+	// check modeenv
+	newM, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(newM.CurrentTrustedBootAssets, HasLen, 0)
+	c.Check(newM.CurrentTrustedRecoveryBootAssets, HasLen, 0)
+
+	// verify that managed assets are to be preserved
+	res, err = obs.Observe(gadget.ContentUpdate, mockRunBootStruct, root, "managed-asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+	res, err = obs.Observe(gadget.ContentUpdate, mockSeedStruct, root, "managed-asset",
+		&gadget.ContentChange{After: filepath.Join(d, "foobar")})
+	c.Assert(err, IsNil)
+	c.Check(res, Equals, gadget.ChangeIgnore)
+
+	// make sure that no reseal is triggered
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	err = obs.BeforeWrite()
+	c.Assert(err, IsNil)
+	c.Check(resealCalls, Equals, 0)
+
+	err = obs.Canceled()
+	c.Assert(err, IsNil)
+	c.Check(resealCalls, Equals, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/boot/bootchain.go snapd-2.48.3+20.04/boot/bootchain.go
--- snapd-2.45.1+20.04.2/boot/bootchain.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/bootchain.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,331 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/secboot"
+)
+
+// TODO:UC20 add a doc comment when this is stabilized
+type bootChain struct {
+	BrandID        string             `json:"brand-id"`
+	Model          string             `json:"model"`
+	Grade          asserts.ModelGrade `json:"grade"`
+	ModelSignKeyID string             `json:"model-sign-key-id"`
+	AssetChain     []bootAsset        `json:"asset-chain"`
+	Kernel         string             `json:"kernel"`
+	// KernelRevision is the revision of the kernel snap. It is empty if
+	// kernel is unasserted, in which case always reseal.
+	KernelRevision string   `json:"kernel-revision"`
+	KernelCmdlines []string `json:"kernel-cmdlines"`
+
+	model          *asserts.Model
+	kernelBootFile bootloader.BootFile
+}
+
+// TODO:UC20 add a doc comment when this is stabilized
+type bootAsset struct {
+	Role   bootloader.Role `json:"role"`
+	Name   string          `json:"name"`
+	Hashes []string        `json:"hashes"`
+}
+
+func bootAssetLess(b, other *bootAsset) bool {
+	byRole := b.Role < other.Role
+	byName := b.Name < other.Name
+	// sort order: role -> name -> hash list (len -> lexical)
+	if b.Role != other.Role {
+		return byRole
+	}
+	if b.Name != other.Name {
+		return byName
+	}
+	return stringListsLess(b.Hashes, other.Hashes)
+}
+
+func stringListsEqual(sl1, sl2 []string) bool {
+	if len(sl1) != len(sl2) {
+		return false
+	}
+	for i := range sl1 {
+		if sl1[i] != sl2[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func stringListsLess(sl1, sl2 []string) bool {
+	if len(sl1) != len(sl2) {
+		return len(sl1) < len(sl2)
+	}
+	for idx := range sl1 {
+		if sl1[idx] < sl2[idx] {
+			return true
+		}
+	}
+	return false
+}
+
+func toPredictableBootAsset(b *bootAsset) *bootAsset {
+	if b == nil {
+		return nil
+	}
+	newB := *b
+	if b.Hashes != nil {
+		newB.Hashes = make([]string, len(b.Hashes))
+		copy(newB.Hashes, b.Hashes)
+		sort.Strings(newB.Hashes)
+	}
+	return &newB
+}
+
+func toPredictableBootChain(b *bootChain) *bootChain {
+	if b == nil {
+		return nil
+	}
+	newB := *b
+	if b.AssetChain != nil {
+		newB.AssetChain = make([]bootAsset, len(b.AssetChain))
+		for i := range b.AssetChain {
+			newB.AssetChain[i] = *toPredictableBootAsset(&b.AssetChain[i])
+		}
+	}
+	if b.KernelCmdlines != nil {
+		newB.KernelCmdlines = make([]string, len(b.KernelCmdlines))
+		copy(newB.KernelCmdlines, b.KernelCmdlines)
+		sort.Strings(newB.KernelCmdlines)
+	}
+	return &newB
+}
+
+func predictableBootAssetsEqual(b1, b2 []bootAsset) bool {
+	b1JSON, err := json.Marshal(b1)
+	if err != nil {
+		return false
+	}
+	b2JSON, err := json.Marshal(b2)
+	if err != nil {
+		return false
+	}
+	return bytes.Equal(b1JSON, b2JSON)
+}
+
+func predictableBootAssetsLess(b1, b2 []bootAsset) bool {
+	if len(b1) != len(b2) {
+		return len(b1) < len(b2)
+	}
+	for i := range b1 {
+		if bootAssetLess(&b1[i], &b2[i]) {
+			return true
+		}
+	}
+	return false
+}
+
+type byBootChainOrder []bootChain
+
+func (b byBootChainOrder) Len() int      { return len(b) }
+func (b byBootChainOrder) Swap(i, j int) { b[i], b[j] = b[j], b[i] }
+func (b byBootChainOrder) Less(i, j int) bool {
+	// sort by model info
+	if b[i].BrandID != b[j].BrandID {
+		return b[i].BrandID < b[j].BrandID
+	}
+	if b[i].Model != b[j].Model {
+		return b[i].Model < b[j].Model
+	}
+	if b[i].Grade != b[j].Grade {
+		return b[i].Grade < b[j].Grade
+	}
+	if b[i].ModelSignKeyID != b[j].ModelSignKeyID {
+		return b[i].ModelSignKeyID < b[j].ModelSignKeyID
+	}
+	// then boot assets
+	if !predictableBootAssetsEqual(b[i].AssetChain, b[j].AssetChain) {
+		return predictableBootAssetsLess(b[i].AssetChain, b[j].AssetChain)
+	}
+	// then kernel
+	if b[i].Kernel != b[j].Kernel {
+		return b[i].Kernel < b[j].Kernel
+	}
+	if b[i].KernelRevision != b[j].KernelRevision {
+		return b[i].KernelRevision < b[j].KernelRevision
+	}
+	// and last kernel command lines
+	if !stringListsEqual(b[i].KernelCmdlines, b[j].KernelCmdlines) {
+		return stringListsLess(b[i].KernelCmdlines, b[j].KernelCmdlines)
+	}
+	return false
+}
+
+type predictableBootChains []bootChain
+
+// hasUnrevisionedKernels returns true if any of the chains have an
+// unrevisioned kernel. Revisions will not be set for unasserted
+// kernels.
+func (pbc predictableBootChains) hasUnrevisionedKernels() bool {
+	for i := range pbc {
+		if pbc[i].KernelRevision == "" {
+			return true
+		}
+	}
+	return false
+}
+
+func toPredictableBootChains(chains []bootChain) predictableBootChains {
+	if chains == nil {
+		return nil
+	}
+	predictableChains := make([]bootChain, len(chains))
+	for i := range chains {
+		predictableChains[i] = *toPredictableBootChain(&chains[i])
+	}
+	sort.Sort(byBootChainOrder(predictableChains))
+	return predictableChains
+}
+
+type bootChainEquivalence int
+
+const (
+	bootChainEquivalent   bootChainEquivalence = 0
+	bootChainDifferent    bootChainEquivalence = 1
+	bootChainUnrevisioned bootChainEquivalence = -1
+)
+
+// predictableBootChainsEqualForReseal returns bootChainEquivalent
+// when boot chains are equivalent for reseal. If the boot chains
+// are clearly different it returns bootChainDifferent.
+// If it would return bootChainEquivalent but the chains contain
+// unrevisioned kernels it will return bootChainUnrevisioned.
+func predictableBootChainsEqualForReseal(pb1, pb2 predictableBootChains) bootChainEquivalence {
+	pb1JSON, err := json.Marshal(pb1)
+	if err != nil {
+		return bootChainDifferent
+	}
+	pb2JSON, err := json.Marshal(pb2)
+	if err != nil {
+		return bootChainDifferent
+	}
+	if bytes.Equal(pb1JSON, pb2JSON) {
+		if pb1.hasUnrevisionedKernels() {
+			return bootChainUnrevisioned
+		}
+		return bootChainEquivalent
+	}
+	return bootChainDifferent
+}
+
+// bootAssetsToLoadChains generates a list of load chains covering given boot
+// assets sequence. At the end of each chain, adds an entry for the kernel boot
+// file.
+func bootAssetsToLoadChains(assets []bootAsset, kernelBootFile bootloader.BootFile, roleToBlName map[bootloader.Role]string) ([]*secboot.LoadChain, error) {
+	// kernel is added after all the assets
+	addKernelBootFile := len(assets) == 0
+	if addKernelBootFile {
+		return []*secboot.LoadChain{secboot.NewLoadChain(kernelBootFile)}, nil
+	}
+
+	thisAsset := assets[0]
+	blName := roleToBlName[thisAsset.Role]
+	if blName == "" {
+		return nil, fmt.Errorf("internal error: no bootloader name for boot asset role %q", thisAsset.Role)
+	}
+	var chains []*secboot.LoadChain
+	for _, hash := range thisAsset.Hashes {
+		var bf bootloader.BootFile
+		var next []*secboot.LoadChain
+		var err error
+
+		p := filepath.Join(
+			dirs.SnapBootAssetsDir,
+			trustedAssetCacheRelPath(blName, thisAsset.Name, hash))
+		if !osutil.FileExists(p) {
+			return nil, fmt.Errorf("file %s not found in boot assets cache", p)
+		}
+		bf = bootloader.NewBootFile(
+			"", // asset comes from the filesystem, not a snap
+			p,
+			thisAsset.Role,
+		)
+		next, err = bootAssetsToLoadChains(assets[1:], kernelBootFile, roleToBlName)
+		if err != nil {
+			return nil, err
+		}
+		chains = append(chains, secboot.NewLoadChain(bf, next...))
+	}
+	return chains, nil
+}
+
+// predictableBootChainsWrapperForStorage wraps the boot chains so
+// that we do not store the arrays directly as JSON and we can add
+// other information
+type predictableBootChainsWrapperForStorage struct {
+	ResealCount int                   `json:"reseal-count"`
+	BootChains  predictableBootChains `json:"boot-chains"`
+}
+
+func readBootChains(path string) (pbc predictableBootChains, resealCount int, err error) {
+	inf, err := os.Open(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, 0, nil
+		}
+		return nil, 0, fmt.Errorf("cannot open existing boot chains data file: %v", err)
+	}
+	defer inf.Close()
+	var wrapped predictableBootChainsWrapperForStorage
+	if err := json.NewDecoder(inf).Decode(&wrapped); err != nil {
+		return nil, 0, fmt.Errorf("cannot read boot chains data: %v", err)
+	}
+	return wrapped.BootChains, wrapped.ResealCount, nil
+}
+
+func writeBootChains(pbc predictableBootChains, path string, resealCount int) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return fmt.Errorf("cannot create device fde state directory: %v", err)
+	}
+	outf, err := osutil.NewAtomicFile(path, 0600, 0, osutil.NoChown, osutil.NoChown)
+	if err != nil {
+		return fmt.Errorf("cannot create a temporary boot chains file: %v", err)
+	}
+	// becomes noop when the file is committed
+	defer outf.Cancel()
+
+	wrapped := predictableBootChainsWrapperForStorage{
+		ResealCount: resealCount,
+		BootChains:  pbc,
+	}
+	if err := json.NewEncoder(outf).Encode(wrapped); err != nil {
+		return fmt.Errorf("cannot write boot chains data: %v", err)
+	}
+	return outf.Commit()
+}
diff -Nru snapd-2.45.1+20.04.2/boot/bootchain_test.go snapd-2.48.3+20.04/boot/bootchain_test.go
--- snapd-2.45.1+20.04.2/boot/bootchain_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/bootchain_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1236 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot_test
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/boot/boottest"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type bootchainSuite struct {
+	testutil.BaseTest
+
+	rootDir string
+}
+
+var _ = Suite(&bootchainSuite{})
+
+func (s *bootchainSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+	s.rootDir = c.MkDir()
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
+	dirs.SetRootDir(s.rootDir)
+
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir), 0755), IsNil)
+}
+
+func (s *bootchainSuite) TestBootAssetLess(c *C) {
+	for _, tc := range []struct {
+		l, r *boot.BootAsset
+		exp  bool
+	}{
+		{&boot.BootAsset{Role: "recovery"}, &boot.BootAsset{Role: "run"}, true},
+		{&boot.BootAsset{Role: "run"}, &boot.BootAsset{Role: "recovery"}, false},
+		{&boot.BootAsset{Name: "1"}, &boot.BootAsset{Name: "11"}, true},
+		{&boot.BootAsset{Name: "11"}, &boot.BootAsset{Name: "1"}, false},
+		{&boot.BootAsset{Hashes: []string{"11"}}, &boot.BootAsset{Hashes: []string{"11", "11"}}, true},
+		{&boot.BootAsset{Hashes: []string{"11"}}, &boot.BootAsset{Hashes: []string{"12"}}, true},
+	} {
+		less := boot.BootAssetLess(tc.l, tc.r)
+		c.Check(less, Equals, tc.exp, Commentf("expected %v got %v for:\nl:%v\nr:%v", tc.exp, less, tc.l, tc.r))
+	}
+}
+
+func (s *bootchainSuite) TestBootAssetsPredictable(c *C) {
+	// by role
+	ba := boot.BootAsset{
+		Role: bootloader.RoleRunMode, Name: "list", Hashes: []string{"b", "a"},
+	}
+	pred := boot.ToPredictableBootAsset(&ba)
+	c.Check(pred, DeepEquals, &boot.BootAsset{
+		Role: bootloader.RoleRunMode, Name: "list", Hashes: []string{"a", "b"},
+	})
+	// original structure is not changed
+	c.Check(ba, DeepEquals, boot.BootAsset{
+		Role: bootloader.RoleRunMode, Name: "list", Hashes: []string{"b", "a"},
+	})
+
+	// try to make a predictable struct predictable once more
+	predAgain := boot.ToPredictableBootAsset(pred)
+	c.Check(predAgain, DeepEquals, pred)
+
+	baNil := boot.ToPredictableBootAsset(nil)
+	c.Check(baNil, IsNil)
+}
+
+func (s *bootchainSuite) TestBootChainMarshalOnlyAssets(c *C) {
+	pbNil := boot.ToPredictableBootChain(nil)
+	c.Check(pbNil, IsNil)
+
+	bc := &boot.BootChain{
+		AssetChain: []boot.BootAsset{
+			{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"b"}},
+			{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"e", "d"}},
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"d", "c"}},
+			{Role: bootloader.RoleRunMode, Name: "1oader", Hashes: []string{"e", "d"}},
+			{Role: bootloader.RoleRunMode, Name: "0oader", Hashes: []string{"z", "x"}},
+		},
+	}
+
+	predictableBc := boot.ToPredictableBootChain(bc)
+
+	c.Check(predictableBc, DeepEquals, &boot.BootChain{
+		// assets not reordered
+		AssetChain: []boot.BootAsset{
+			// hash lists are sorted
+			{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"b"}},
+			{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d", "e"}},
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"c", "d"}},
+			{Role: bootloader.RoleRunMode, Name: "1oader", Hashes: []string{"d", "e"}},
+			{Role: bootloader.RoleRunMode, Name: "0oader", Hashes: []string{"x", "z"}},
+		},
+	})
+
+	// already predictable, but try again
+	alreadySortedBc := boot.ToPredictableBootChain(predictableBc)
+	c.Check(alreadySortedBc, DeepEquals, predictableBc)
+
+	// boot chain with 2 identical assets
+	bcIdenticalAssets := &boot.BootChain{
+		AssetChain: []boot.BootAsset{
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"z"}},
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"z"}},
+		},
+	}
+	sortedBcIdentical := boot.ToPredictableBootChain(bcIdenticalAssets)
+	c.Check(sortedBcIdentical, DeepEquals, bcIdenticalAssets)
+}
+
+func (s *bootchainSuite) TestBootChainMarshalFull(c *C) {
+	bc := &boot.BootChain{
+		BrandID:        "mybrand",
+		Model:          "foo",
+		Grade:          "dangerous",
+		ModelSignKeyID: "my-key-id",
+		// asset chain does not get sorted when marshaling
+		AssetChain: []boot.BootAsset{
+			// hash list will get sorted
+			{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"b", "a"}},
+			{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d"}},
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"c", "d"}},
+		},
+		Kernel:         "pc-kernel",
+		KernelRevision: "1234",
+		KernelCmdlines: []string{`foo=bar baz=0x123`, `a=1`},
+	}
+
+	uc20model := boottest.MakeMockUC20Model()
+	bc.SetModelAssertion(uc20model)
+	kernelBootFile := bootloader.NewBootFile("pc-kernel", "/foo", bootloader.RoleRecovery)
+	bc.SetKernelBootFile(kernelBootFile)
+
+	expectedPredictableBc := &boot.BootChain{
+		BrandID:        "mybrand",
+		Model:          "foo",
+		Grade:          "dangerous",
+		ModelSignKeyID: "my-key-id",
+		// assets are not reordered
+		AssetChain: []boot.BootAsset{
+			// hash lists are sorted
+			{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"a", "b"}},
+			{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d"}},
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"c", "d"}},
+		},
+		Kernel:         "pc-kernel",
+		KernelRevision: "1234",
+		KernelCmdlines: []string{`a=1`, `foo=bar baz=0x123`},
+	}
+	// those can't be set directly, but are copied as well
+	expectedPredictableBc.SetModelAssertion(uc20model)
+	expectedPredictableBc.SetKernelBootFile(kernelBootFile)
+
+	predictableBc := boot.ToPredictableBootChain(bc)
+	c.Check(predictableBc, DeepEquals, expectedPredictableBc)
+
+	d, err := json.Marshal(predictableBc)
+	c.Assert(err, IsNil)
+	c.Check(string(d), Equals, `{"brand-id":"mybrand","model":"foo","grade":"dangerous","model-sign-key-id":"my-key-id","asset-chain":[{"role":"recovery","name":"shim","hashes":["a","b"]},{"role":"recovery","name":"loader","hashes":["d"]},{"role":"run-mode","name":"loader","hashes":["c","d"]}],"kernel":"pc-kernel","kernel-revision":"1234","kernel-cmdlines":["a=1","foo=bar baz=0x123"]}`)
+	expectedOriginal := &boot.BootChain{
+		BrandID:        "mybrand",
+		Model:          "foo",
+		Grade:          "dangerous",
+		ModelSignKeyID: "my-key-id",
+		AssetChain: []boot.BootAsset{
+			{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"b", "a"}},
+			{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d"}},
+			{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"c", "d"}},
+		},
+		Kernel:         "pc-kernel",
+		KernelRevision: "1234",
+		KernelCmdlines: []string{`foo=bar baz=0x123`, `a=1`},
+	}
+	expectedOriginal.SetModelAssertion(uc20model)
+	expectedOriginal.SetKernelBootFile(kernelBootFile)
+	// original structure has not been modified
+	c.Check(bc, DeepEquals, expectedOriginal)
+}
+
+func (s *bootchainSuite) TestPredictableBootChainsEqualForReseal(c *C) {
+	var pbNil boot.PredictableBootChains
+
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbNil, pbNil), Equals, boot.BootChainEquivalent)
+
+	bcJustOne := []boot.BootChain{
+		{
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"b", "a"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d"}},
+				{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"c", "d"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "1234",
+			KernelCmdlines: []string{`foo`},
+		},
+	}
+	pbJustOne := boot.ToPredictableBootChains(bcJustOne)
+	// equal with self
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbJustOne, pbJustOne), Equals, boot.BootChainEquivalent)
+
+	// equal with nil?
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbJustOne, pbNil), Equals, boot.BootChainDifferent)
+
+	bcMoreAssets := []boot.BootChain{
+		{
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"a", "b"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d"}},
+			},
+			Kernel:         "pc-kernel-recovery",
+			KernelRevision: "1234",
+			KernelCmdlines: []string{`foo`},
+		}, {
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"a", "b"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"d"}},
+				{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"c", "d"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "1234",
+			KernelCmdlines: []string{`foo`},
+		},
+	}
+
+	pbMoreAssets := boot.ToPredictableBootChains(bcMoreAssets)
+
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbMoreAssets, pbJustOne), Equals, boot.BootChainDifferent)
+	// with self
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbMoreAssets, pbMoreAssets), Equals, boot.BootChainEquivalent)
+	// chains composed of respective elements are not equal
+	c.Check(boot.PredictableBootChainsEqualForReseal(
+		[]boot.BootChain{pbMoreAssets[0]},
+		[]boot.BootChain{pbMoreAssets[1]}),
+		Equals, boot.BootChainDifferent)
+
+	// unrevisioned/unasserted kernels
+	bcUnrevOne := []boot.BootChain{pbJustOne[0]}
+	bcUnrevOne[0].KernelRevision = ""
+	pbUnrevOne := boot.ToPredictableBootChains(bcUnrevOne)
+	// soundness
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbJustOne, pbJustOne), Equals, boot.BootChainEquivalent)
+	// never equal even with self because of unrevisioned
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbJustOne, pbUnrevOne), Equals, boot.BootChainDifferent)
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbUnrevOne, pbUnrevOne), Equals, boot.BootChainUnrevisioned)
+
+	bcUnrevMoreAssets := []boot.BootChain{pbMoreAssets[0], pbMoreAssets[1]}
+	bcUnrevMoreAssets[1].KernelRevision = ""
+	pbUnrevMoreAssets := boot.ToPredictableBootChains(bcUnrevMoreAssets)
+	// never equal even with self because of unrevisioned
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbUnrevMoreAssets, pbMoreAssets), Equals, boot.BootChainDifferent)
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbUnrevMoreAssets, pbUnrevMoreAssets), Equals, boot.BootChainUnrevisioned)
+}
+
+func (s *bootchainSuite) TestPredictableBootChainsFullMarshal(c *C) {
+	// chains will be sorted
+	chains := []boot.BootChain{
+		{
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "signed",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"x", "y"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+				{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"z", "x"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "2345",
+			KernelCmdlines: []string{`snapd_recovery_mode=run foo`},
+		}, {
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"y", "x"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+				{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"b", "a"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "1234",
+			KernelCmdlines: []string{`snapd_recovery_mode=run foo`},
+		}, {
+			// recovery system
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"y", "x"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "12",
+			KernelCmdlines: []string{
+				// will be sorted
+				`snapd_recovery_mode=recover snapd_recovery_system=23 foo`,
+				`snapd_recovery_mode=recover snapd_recovery_system=12 foo`,
+			},
+		},
+	}
+
+	predictableChains := boot.ToPredictableBootChains(chains)
+	d, err := json.Marshal(predictableChains)
+	c.Assert(err, IsNil)
+
+	var data []map[string]interface{}
+	err = json.Unmarshal(d, &data)
+	c.Assert(err, IsNil)
+	c.Check(data, DeepEquals, []map[string]interface{}{
+		{
+			"model":             "foo",
+			"brand-id":          "mybrand",
+			"grade":             "dangerous",
+			"model-sign-key-id": "my-key-id",
+			"kernel":            "pc-kernel-other",
+			"kernel-revision":   "12",
+			"kernel-cmdlines": []interface{}{
+				`snapd_recovery_mode=recover snapd_recovery_system=12 foo`,
+				`snapd_recovery_mode=recover snapd_recovery_system=23 foo`,
+			},
+			"asset-chain": []interface{}{
+				map[string]interface{}{"role": "recovery", "name": "shim", "hashes": []interface{}{"x", "y"}},
+				map[string]interface{}{"role": "recovery", "name": "loader", "hashes": []interface{}{"c", "d"}},
+			},
+		}, {
+			"model":             "foo",
+			"brand-id":          "mybrand",
+			"grade":             "dangerous",
+			"model-sign-key-id": "my-key-id",
+			"kernel":            "pc-kernel-other",
+			"kernel-revision":   "1234",
+			"kernel-cmdlines":   []interface{}{"snapd_recovery_mode=run foo"},
+			"asset-chain": []interface{}{
+				map[string]interface{}{"role": "recovery", "name": "shim", "hashes": []interface{}{"x", "y"}},
+				map[string]interface{}{"role": "recovery", "name": "loader", "hashes": []interface{}{"c", "d"}},
+				map[string]interface{}{"role": "run-mode", "name": "loader", "hashes": []interface{}{"a", "b"}},
+			},
+		}, {
+			"model":             "foo",
+			"brand-id":          "mybrand",
+			"grade":             "signed",
+			"model-sign-key-id": "my-key-id",
+			"kernel":            "pc-kernel-other",
+			"kernel-revision":   "2345",
+			"kernel-cmdlines":   []interface{}{"snapd_recovery_mode=run foo"},
+			"asset-chain": []interface{}{
+				map[string]interface{}{"role": "recovery", "name": "shim", "hashes": []interface{}{"x", "y"}},
+				map[string]interface{}{"role": "recovery", "name": "loader", "hashes": []interface{}{"c", "d"}},
+				map[string]interface{}{"role": "run-mode", "name": "loader", "hashes": []interface{}{"x", "z"}},
+			},
+		},
+	})
+}
+
+func (s *bootchainSuite) TestPredictableBootChainsFields(c *C) {
+	chainsNil := boot.ToPredictableBootChains(nil)
+	c.Check(chainsNil, IsNil)
+
+	justOne := []boot.BootChain{
+		{
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "signed",
+			ModelSignKeyID: "my-key-id",
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "2345",
+			KernelCmdlines: []string{`foo`},
+		},
+	}
+	predictableJustOne := boot.ToPredictableBootChains(justOne)
+	c.Check(predictableJustOne, DeepEquals, boot.PredictableBootChains(justOne))
+
+	chainsGrade := []boot.BootChain{
+		{
+			Grade: "signed",
+		}, {
+			Grade: "dangerous",
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsGrade), DeepEquals, boot.PredictableBootChains{
+		{
+			Grade: "dangerous",
+		}, {
+			Grade: "signed",
+		},
+	})
+
+	chainsKernel := []boot.BootChain{
+		{
+			Grade:  "dangerous",
+			Kernel: "foo",
+		}, {
+			Grade:  "dangerous",
+			Kernel: "bar",
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsKernel), DeepEquals, boot.PredictableBootChains{
+		{
+			Grade:  "dangerous",
+			Kernel: "bar",
+		}, {
+			Grade:  "dangerous",
+			Kernel: "foo",
+		},
+	})
+
+	chainsKernelRevision := []boot.BootChain{
+		{
+			Kernel:         "foo",
+			KernelRevision: "9",
+		}, {
+			Kernel:         "foo",
+			KernelRevision: "21",
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsKernelRevision), DeepEquals, boot.PredictableBootChains{
+		{
+			Kernel:         "foo",
+			KernelRevision: "21",
+		}, {
+			Kernel:         "foo",
+			KernelRevision: "9",
+		},
+	})
+
+	chainsCmdline := []boot.BootChain{
+		{
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`a`},
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsCmdline), DeepEquals, boot.PredictableBootChains{
+		{
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`a`},
+		}, {
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	})
+
+	chainsModel := []boot.BootChain{
+		{
+			Model:          "fridge",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsModel), DeepEquals, boot.PredictableBootChains{
+		{
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			Model:          "fridge",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	})
+
+	chainsBrand := []boot.BootChain{
+		{
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			BrandID:        "acme",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsBrand), DeepEquals, boot.PredictableBootChains{
+		{
+			BrandID:        "acme",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	})
+
+	chainsKeyID := []boot.BootChain{
+		{
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+			ModelSignKeyID: "key-2",
+		}, {
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+			ModelSignKeyID: "key-1",
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsKeyID), DeepEquals, boot.PredictableBootChains{
+		{
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+			ModelSignKeyID: "key-1",
+		}, {
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+			ModelSignKeyID: "key-2",
+		},
+	})
+
+	chainsAssets := []boot.BootChain{
+		{
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			ModelSignKeyID: "key-1",
+			AssetChain: []boot.BootAsset{
+				// will be sorted
+				{Hashes: []string{"b", "a"}},
+			},
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			ModelSignKeyID: "key-1",
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"b"}},
+			},
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsAssets), DeepEquals, boot.PredictableBootChains{
+		{
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			ModelSignKeyID: "key-1",
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"b"}},
+			},
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			ModelSignKeyID: "key-1",
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"a", "b"}},
+			},
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	})
+
+	chainsFewerAssets := []boot.BootChain{
+		{
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"b", "a"}},
+				{Hashes: []string{"c", "d"}},
+			},
+		}, {
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"b"}},
+			},
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsFewerAssets), DeepEquals, boot.PredictableBootChains{
+		{
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"b"}},
+			},
+		}, {
+			AssetChain: []boot.BootAsset{
+				{Hashes: []string{"a", "b"}},
+				{Hashes: []string{"c", "d"}},
+			},
+		},
+	})
+
+	// not confused if 2 chains are identical
+	chainsIdenticalAssets := []boot.BootChain{
+		{
+			BrandID:        "foo",
+			Model:          "box",
+			ModelSignKeyID: "key-1",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"a", "b"}},
+				{Name: "asset", Hashes: []string{"a", "b"}},
+			},
+			Grade:          "dangerous",
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		}, {
+			BrandID:        "foo",
+			Model:          "box",
+			Grade:          "dangerous",
+			ModelSignKeyID: "key-1",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"a", "b"}},
+				{Name: "asset", Hashes: []string{"a", "b"}},
+			},
+			Kernel:         "foo",
+			KernelCmdlines: []string{`panic=1`},
+		},
+	}
+	c.Check(boot.ToPredictableBootChains(chainsIdenticalAssets), DeepEquals, boot.PredictableBootChains(chainsIdenticalAssets))
+}
+
+func (s *bootchainSuite) TestPredictableBootChainsSortOrder(c *C) {
+	// check that sort order is model info, assets, kernel, kernel cmdline
+
+	chains := []boot.BootChain{
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1", "cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1", "cm=2"},
+		},
+	}
+	predictable := boot.ToPredictableBootChains(chains)
+	c.Check(predictable, DeepEquals, boot.PredictableBootChains{
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1", "cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "a",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1", "cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"x"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k1",
+			KernelCmdlines: []string{"cm=2"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=1"},
+		},
+		{
+			Model: "b",
+			AssetChain: []boot.BootAsset{
+				{Name: "asset", Hashes: []string{"y"}},
+			},
+			Kernel:         "k2",
+			KernelCmdlines: []string{"cm=2"},
+		},
+	})
+}
+
+func printChain(c *C, chain *secboot.LoadChain, prefix string) {
+	c.Logf("%v %v", prefix, chain.BootFile)
+	for _, n := range chain.Next {
+		printChain(c, n, prefix+"-")
+	}
+}
+
+// cPath returns a path under boot assets cache directory
+func cPath(p string) string {
+	return filepath.Join(dirs.SnapBootAssetsDir, p)
+}
+
+// nbf is bootloader.NewBootFile but shorter
+var nbf = bootloader.NewBootFile
+
+func (s *bootchainSuite) TestBootAssetsToLoadChainTrivialKernel(c *C) {
+	kbl := bootloader.NewBootFile("pc-kernel", "kernel.efi", bootloader.RoleRunMode)
+
+	chains, err := boot.BootAssetsToLoadChains(nil, kbl, nil)
+	c.Assert(err, IsNil)
+
+	c.Check(chains, DeepEquals, []*secboot.LoadChain{
+		secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode)),
+	})
+}
+
+func (s *bootchainSuite) TestBootAssetsToLoadChainErr(c *C) {
+	kbl := bootloader.NewBootFile("pc-kernel", "kernel.efi", bootloader.RoleRunMode)
+
+	assets := []boot.BootAsset{
+		{Name: "shim", Hashes: []string{"hash0"}, Role: bootloader.RoleRecovery},
+		{Name: "loader-recovery", Hashes: []string{"hash0"}, Role: bootloader.RoleRecovery},
+		{Name: "loader-run", Hashes: []string{"hash0"}, Role: bootloader.RoleRunMode},
+	}
+
+	blNames := map[bootloader.Role]string{
+		bootloader.RoleRecovery: "recovery-bl",
+		// missing bootloader name for role "run-mode"
+	}
+	// fails when probing the shim asset in the cache
+	chains, err := boot.BootAssetsToLoadChains(assets, kbl, blNames)
+	c.Assert(err, ErrorMatches, "file .*/recovery-bl/shim-hash0 not found in boot assets cache")
+	c.Check(chains, IsNil)
+	// make it work now
+	c.Assert(os.MkdirAll(filepath.Dir(cPath("recovery-bl/shim-hash0")), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(cPath("recovery-bl/shim-hash0"), nil, 0644), IsNil)
+
+	// nested error bubbled up
+	chains, err = boot.BootAssetsToLoadChains(assets, kbl, blNames)
+	c.Assert(err, ErrorMatches, "file .*/recovery-bl/loader-recovery-hash0 not found in boot assets cache")
+	c.Check(chains, IsNil)
+	// again, make it work
+	c.Assert(os.MkdirAll(filepath.Dir(cPath("recovery-bl/loader-recovery-hash0")), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(cPath("recovery-bl/loader-recovery-hash0"), nil, 0644), IsNil)
+
+	// fails on missing bootloader name for role "run-mode"
+	chains, err = boot.BootAssetsToLoadChains(assets, kbl, blNames)
+	c.Assert(err, ErrorMatches, `internal error: no bootloader name for boot asset role "run-mode"`)
+	c.Check(chains, IsNil)
+}
+
+func (s *bootchainSuite) TestBootAssetsToLoadChainSimpleChain(c *C) {
+	kbl := bootloader.NewBootFile("pc-kernel", "kernel.efi", bootloader.RoleRunMode)
+
+	assets := []boot.BootAsset{
+		{Name: "shim", Hashes: []string{"hash0"}, Role: bootloader.RoleRecovery},
+		{Name: "loader-recovery", Hashes: []string{"hash0"}, Role: bootloader.RoleRecovery},
+		{Name: "loader-run", Hashes: []string{"hash0"}, Role: bootloader.RoleRunMode},
+	}
+
+	// mock relevant files in cache
+	for _, name := range []string{
+		"recovery-bl/shim-hash0",
+		"recovery-bl/loader-recovery-hash0",
+		"run-bl/loader-run-hash0",
+	} {
+		p := filepath.Join(dirs.SnapBootAssetsDir, name)
+		c.Assert(os.MkdirAll(filepath.Dir(p), 0755), IsNil)
+		c.Assert(ioutil.WriteFile(p, nil, 0644), IsNil)
+	}
+
+	blNames := map[bootloader.Role]string{
+		bootloader.RoleRecovery: "recovery-bl",
+		bootloader.RoleRunMode:  "run-bl",
+	}
+
+	chains, err := boot.BootAssetsToLoadChains(assets, kbl, blNames)
+	c.Assert(err, IsNil)
+
+	c.Logf("got:")
+	for _, ch := range chains {
+		printChain(c, ch, "-")
+	}
+
+	expected := []*secboot.LoadChain{
+		secboot.NewLoadChain(nbf("", cPath("recovery-bl/shim-hash0"), bootloader.RoleRecovery),
+			secboot.NewLoadChain(nbf("", cPath("recovery-bl/loader-recovery-hash0"), bootloader.RoleRecovery),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash0"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))))),
+	}
+	c.Check(chains, DeepEquals, expected)
+}
+
+func (s *bootchainSuite) TestBootAssetsToLoadChainWithAlternativeChains(c *C) {
+	kbl := bootloader.NewBootFile("pc-kernel", "kernel.efi", bootloader.RoleRunMode)
+
+	assets := []boot.BootAsset{
+		{Name: "shim", Hashes: []string{"hash0", "hash1"}, Role: bootloader.RoleRecovery},
+		{Name: "loader-recovery", Hashes: []string{"hash0", "hash1"}, Role: bootloader.RoleRecovery},
+		{Name: "loader-run", Hashes: []string{"hash0", "hash1"}, Role: bootloader.RoleRunMode},
+	}
+
+	// mock relevant files in cache
+	for _, name := range []string{
+		"recovery-bl/shim-hash0", "recovery-bl/shim-hash1",
+		"recovery-bl/loader-recovery-hash0",
+		"recovery-bl/loader-recovery-hash1",
+		"run-bl/loader-run-hash0",
+		"run-bl/loader-run-hash1",
+	} {
+		p := filepath.Join(dirs.SnapBootAssetsDir, name)
+		c.Assert(os.MkdirAll(filepath.Dir(p), 0755), IsNil)
+		c.Assert(ioutil.WriteFile(p, nil, 0644), IsNil)
+	}
+
+	blNames := map[bootloader.Role]string{
+		bootloader.RoleRecovery: "recovery-bl",
+		bootloader.RoleRunMode:  "run-bl",
+	}
+	chains, err := boot.BootAssetsToLoadChains(assets, kbl, blNames)
+	c.Assert(err, IsNil)
+
+	c.Logf("got:")
+	for _, ch := range chains {
+		printChain(c, ch, "-")
+	}
+
+	expected := []*secboot.LoadChain{
+		secboot.NewLoadChain(nbf("", cPath("recovery-bl/shim-hash0"), bootloader.RoleRecovery),
+			secboot.NewLoadChain(nbf("", cPath("recovery-bl/loader-recovery-hash0"), bootloader.RoleRecovery),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash0"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash1"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode)))),
+			secboot.NewLoadChain(nbf("", cPath("recovery-bl/loader-recovery-hash1"), bootloader.RoleRecovery),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash0"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash1"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))))),
+		secboot.NewLoadChain(nbf("", cPath("recovery-bl/shim-hash1"), bootloader.RoleRecovery),
+			secboot.NewLoadChain(nbf("", cPath("recovery-bl/loader-recovery-hash0"), bootloader.RoleRecovery),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash0"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash1"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode)))),
+			secboot.NewLoadChain(nbf("", cPath("recovery-bl/loader-recovery-hash1"), bootloader.RoleRecovery),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash0"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))),
+				secboot.NewLoadChain(nbf("", cPath("run-bl/loader-run-hash1"), bootloader.RoleRunMode),
+					secboot.NewLoadChain(nbf("pc-kernel", "kernel.efi", bootloader.RoleRunMode))))),
+	}
+	c.Check(chains, DeepEquals, expected)
+}
+
+func (s *sealSuite) TestReadWriteBootChains(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
+	chains := []boot.BootChain{
+		{
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "signed",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"x", "y"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+				{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"z", "x"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "2345",
+			KernelCmdlines: []string{`snapd_recovery_mode=run foo`},
+		}, {
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"y", "x"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+			},
+			Kernel:         "pc-kernel-recovery",
+			KernelRevision: "1234",
+			KernelCmdlines: []string{`snapd_recovery_mode=recover foo`},
+		},
+	}
+
+	pbc := boot.ToPredictableBootChains(chains)
+
+	rootdir := c.MkDir()
+
+	expected := `{"reseal-count":0,"boot-chains":[{"brand-id":"mybrand","model":"foo","grade":"dangerous","model-sign-key-id":"my-key-id","asset-chain":[{"role":"recovery","name":"shim","hashes":["x","y"]},{"role":"recovery","name":"loader","hashes":["c","d"]}],"kernel":"pc-kernel-recovery","kernel-revision":"1234","kernel-cmdlines":["snapd_recovery_mode=recover foo"]},{"brand-id":"mybrand","model":"foo","grade":"signed","model-sign-key-id":"my-key-id","asset-chain":[{"role":"recovery","name":"shim","hashes":["x","y"]},{"role":"recovery","name":"loader","hashes":["c","d"]},{"role":"run-mode","name":"loader","hashes":["x","z"]}],"kernel":"pc-kernel-other","kernel-revision":"2345","kernel-cmdlines":["snapd_recovery_mode=run foo"]}]}
+`
+	// creates a complete tree and writes a file
+	err := boot.WriteBootChains(pbc, filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 0)
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), testutil.FileEquals, expected)
+
+	fi, err := os.Stat(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"))
+	c.Assert(err, IsNil)
+	c.Check(fi.Mode().Perm(), Equals, os.FileMode(0600))
+
+	loaded, cnt, err := boot.ReadBootChains(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"))
+	c.Assert(err, IsNil)
+	c.Check(loaded, DeepEquals, pbc)
+	c.Check(cnt, Equals, 0)
+	// boot chains should be same for reseal purpose
+	c.Check(boot.PredictableBootChainsEqualForReseal(pbc, loaded), Equals, boot.BootChainEquivalent)
+
+	// write them again with count > 0
+	err = boot.WriteBootChains(pbc, filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 99)
+	c.Assert(err, IsNil)
+
+	_, cnt, err = boot.ReadBootChains(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"))
+	c.Assert(err, IsNil)
+	c.Check(cnt, Equals, 99)
+
+	// make device/fde directory read only so that writing fails
+	otherRootdir := c.MkDir()
+	c.Assert(os.MkdirAll(dirs.SnapFDEDirUnder(otherRootdir), 0755), IsNil)
+	c.Assert(os.Chmod(dirs.SnapFDEDirUnder(otherRootdir), 0000), IsNil)
+	defer os.Chmod(dirs.SnapFDEDirUnder(otherRootdir), 0755)
+
+	err = boot.WriteBootChains(pbc, filepath.Join(dirs.SnapFDEDirUnder(otherRootdir), "boot-chains"), 0)
+	c.Assert(err, ErrorMatches, `cannot create a temporary boot chains file: open .*/boot-chains\.[a-zA-Z0-9]+~: permission denied`)
+
+	// make the original file non readable
+	c.Assert(os.Chmod(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 0000), IsNil)
+	defer os.Chmod(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 0755)
+	loaded, _, err = boot.ReadBootChains(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"))
+	c.Assert(err, ErrorMatches, "cannot open existing boot chains data file: open .*/boot-chains: permission denied")
+	c.Check(loaded, IsNil)
+
+	// loading from a file that does not exist yields a nil boot chain
+	// and 0 count
+	loaded, cnt, err = boot.ReadBootChains("does-not-exist")
+	c.Assert(err, IsNil)
+	c.Check(loaded, IsNil)
+	c.Check(cnt, Equals, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/boot/boot.go snapd-2.48.3+20.04/boot/boot.go
--- snapd-2.45.1+20.04.2/boot/boot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boot.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,7 @@
 	"errors"
 	"fmt"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/snap"
 )
@@ -89,6 +90,8 @@
 	Base() string
 
 	HasModeenv() bool
+
+	Model() *asserts.Model
 }
 
 // Participant figures out what the BootParticipant is for the given
@@ -113,9 +116,12 @@
 // bootloaderOptionsForDeviceKernel returns a set of bootloader options that
 // enable correct kernel extraction and removal for given device
 func bootloaderOptionsForDeviceKernel(dev Device) *bootloader.Options {
+	if !dev.HasModeenv() {
+		return nil
+	}
+	// find the run-mode bootloader with its kernel support for UC20
 	return &bootloader.Options{
-		// unified extractable kernel if in uc20 mode
-		ExtractedRunKernelImage: dev.HasModeenv(),
+		Role: bootloader.RoleRunMode,
 	}
 }
 
@@ -163,16 +169,21 @@
 	return true
 }
 
-// bootState exposes the boot state for a type of boot snap.
+// bootState exposes the boot state for a type of boot snap during
+// normal running state, i.e. after the pivot_root and after the initramfs.
 type bootState interface {
 	// revisions retrieves the revisions of the current snap and
 	// the try snap (only the latter might not be set), and
 	// the status of the trying snap.
+	// Note that the error could be only specific to the try snap, in which case
+	// curSnap may still be non-nil and valid. Callers concerned with robustness
+	// should always inspect a non-nil error with isTrySnapError, and use
+	// curSnap instead if the error is only for the trySnap or tryingStatus.
 	revisions() (curSnap, trySnap snap.PlaceInfo, tryingStatus string, err error)
 
 	// setNext lazily implements setting the next boot target for
 	// the type's boot snap. actually committing the update
-	// is done via the returned bootStateUpdate's commit.
+	// is done via the returned bootStateUpdate's commit method.
 	setNext(s snap.PlaceInfo) (rebootRequired bool, u bootStateUpdate, err error)
 
 	// markSuccessful lazily implements marking the boot
@@ -182,6 +193,14 @@
 	markSuccessful(bootStateUpdate) (bootStateUpdate, error)
 }
 
+// successfulBootState exposes the state of resources requiring bookkeeping on a
+// successful boot.
+type successfulBootState interface {
+	// markSuccessful lazily implements marking the boot
+	// successful for the given type of resource.
+	markSuccessful(bootStateUpdate) (bootStateUpdate, error)
+}
+
 // bootStateFor finds the right bootState implementation of the given
 // snap type and Device, if applicable.
 func bootStateFor(typ snap.Type, dev Device) (s bootState, err error) {
@@ -194,9 +213,9 @@
 	}
 	switch typ {
 	case snap.TypeOS, snap.TypeBase:
-		return newBootState(snap.TypeBase), nil
+		return newBootState(snap.TypeBase, dev), nil
 	case snap.TypeKernel:
-		return newBootState(snap.TypeKernel), nil
+		return newBootState(snap.TypeKernel, dev), nil
 	default:
 		return nil, fmt.Errorf("internal error: no boot state handling for snap type %q", typ)
 	}
@@ -320,6 +339,15 @@
 		}
 	}
 
+	if dev.HasModeenv() {
+		b := trustedAssetsBootState(dev)
+		var err error
+		u, err = b.markSuccessful(u)
+		if err != nil {
+			return fmt.Errorf(errPrefix, err)
+		}
+	}
+
 	if u != nil {
 		if err := u.commit(); err != nil {
 			return fmt.Errorf(errPrefix, err)
@@ -348,7 +376,7 @@
 
 	opts := &bootloader.Options{
 		// setup the recovery bootloader
-		Recovery: true,
+		Role: bootloader.RoleRecovery,
 	}
 	// TODO:UC20: should the recovery partition stay around as RW during run
 	// mode all the time?
diff -Nru snapd-2.45.1+20.04.2/boot/boot_robustness_test.go snapd-2.48.3+20.04/boot/boot_robustness_test.go
--- snapd-2.45.1+20.04.2/boot/boot_robustness_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boot_robustness_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -192,7 +192,7 @@
 }
 
 func (s *bootenv20Suite) TestHappyMarkBootSuccessful20KernelUpgradeUnexpectedReboots(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	tt := []struct {
@@ -256,7 +256,7 @@
 }
 
 func (s *bootenv20Suite) TestHappySetNextBoot20KernelUpgradeUnexpectedReboots(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	tt := []struct {
diff -Nru snapd-2.45.1+20.04.2/boot/bootstate16.go snapd-2.48.3+20.04/boot/bootstate16.go
--- snapd-2.45.1+20.04.2/boot/bootstate16.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/bootstate16.go	2021-02-02 08:21:12.000000000 +0000
@@ -31,7 +31,7 @@
 	errName   string
 }
 
-func newBootState16(typ snap.Type) bootState {
+func newBootState16(typ snap.Type, dev Device) bootState {
 	var varSuffix, errName string
 	switch typ {
 	case snap.TypeKernel:
@@ -74,6 +74,7 @@
 		if vName == "snap_mode" {
 			status = v
 		} else {
+			// TODO: use trySnapError here somehow?
 			if v == "" {
 				return nil, nil, "", fmt.Errorf("cannot get name and revision of %s (%s): boot variable unset", s16.errName, vName)
 			}
@@ -136,14 +137,18 @@
 	env := u16.env
 	toCommit := u16.toCommit
 
+	tryBootVar := fmt.Sprintf("snap_try_%s", s16.varSuffix)
+	bootVar := fmt.Sprintf("snap_%s", s16.varSuffix)
+
 	// snap_mode goes from "" -> "try" -> "trying" -> ""
 	// so if we are not in "trying" mode, nothing to do here
 	if env["snap_mode"] != TryingStatus {
+		// clean the try var anyways in case it was leftover from a rollback,
+		// etc.
+		toCommit[tryBootVar] = ""
 		return u16, nil
 	}
 
-	tryBootVar := fmt.Sprintf("snap_try_%s", s16.varSuffix)
-	bootVar := fmt.Sprintf("snap_%s", s16.varSuffix)
 	// update the boot vars
 	if env[tryBootVar] != "" {
 		toCommit[bootVar] = env[tryBootVar]
diff -Nru snapd-2.45.1+20.04.2/boot/bootstate20_bloader_kernel_state.go snapd-2.48.3+20.04/boot/bootstate20_bloader_kernel_state.go
--- snapd-2.45.1+20.04.2/boot/bootstate20_bloader_kernel_state.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/bootstate20_bloader_kernel_state.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,295 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/snap"
+)
+
+// extractedRunKernelImageBootloaderKernelState implements bootloaderKernelState20 for
+// bootloaders that implement ExtractedRunKernelImageBootloader
+type extractedRunKernelImageBootloaderKernelState struct {
+	// the bootloader
+	ebl bootloader.ExtractedRunKernelImageBootloader
+	// the current kernel status as read by the bootloader's bootenv
+	currentKernelStatus string
+	// the current kernel on the bootloader (not the try-kernel)
+	currentKernel snap.PlaceInfo
+}
+
+func (bks *extractedRunKernelImageBootloaderKernelState) load() error {
+	// get the kernel_status
+	m, err := bks.ebl.GetBootVars("kernel_status")
+	if err != nil {
+		return err
+	}
+
+	bks.currentKernelStatus = m["kernel_status"]
+
+	// get the current kernel for this bootloader to compare during commit() for
+	// markSuccessful() if we booted the current kernel or not
+	kernel, err := bks.ebl.Kernel()
+	if err != nil {
+		return fmt.Errorf("cannot identify kernel snap with bootloader %s: %v", bks.ebl.Name(), err)
+	}
+
+	bks.currentKernel = kernel
+
+	return nil
+}
+
+func (bks *extractedRunKernelImageBootloaderKernelState) kernel() snap.PlaceInfo {
+	return bks.currentKernel
+}
+
+func (bks *extractedRunKernelImageBootloaderKernelState) tryKernel() (snap.PlaceInfo, error) {
+	return bks.ebl.TryKernel()
+}
+
+func (bks *extractedRunKernelImageBootloaderKernelState) kernelStatus() string {
+	return bks.currentKernelStatus
+}
+
+func (bks *extractedRunKernelImageBootloaderKernelState) markSuccessfulKernel(sn snap.PlaceInfo) error {
+	// set the boot vars first, then enable the successful kernel, then disable
+	// the old try-kernel, see the comment in bootState20MarkSuccessful.commit()
+	// for details
+
+	// the ordering here is very important for boot reliability!
+
+	// If we have successfully just booted from a try-kernel and are
+	// marking it successful (this implies that snap_kernel=="trying" as set
+	// by the boot script), we need to do the following in order (since we
+	// have the added complexity of moving the kernel symlink):
+	// 1. Update kernel_status to ""
+	// 2. Move kernel symlink to point to the new try kernel
+	// 3. Remove try-kernel symlink
+	// 4. Remove old kernel from modeenv (this happens one level up from this
+	//    function)
+	//
+	// If we got rebooted after step 1, then the bootloader is booting the wrong
+	// kernel, but is at least booting a known good kernel and snapd in
+	// user-space would be able to figure out the inconsistency.
+	// If we got rebooted after step 2, the bootloader would boot from the new
+	// try-kernel which is okay because we were in the middle of committing
+	// that new kernel as good and all that's left is for snapd to cleanup
+	// the left-over try-kernel symlink.
+	//
+	// If instead we had moved the kernel symlink first to point to the new try
+	// kernel, and got rebooted before the kernel_status was updated, we would
+	// have kernel_status="trying" which would cause the bootloader to think
+	// the boot failed, and revert to booting using the kernel symlink, but that
+	// now points to the new kernel we were trying and we did not successfully
+	// boot from that kernel to know we should trust it.
+	//
+	// Removing the old kernel from the modeenv needs to happen after it is
+	// impossible for the bootloader to boot from that kernel, otherwise we
+	// could end up in a state where the bootloader doesn't want to boot the
+	// new kernel, but the initramfs doesn't trust the old kernel and we are
+	// stuck. As such, do this last, after the symlink no longer exists.
+	//
+	// The try-kernel symlink removal should happen last because it will not
+	// affect anything, except that if it was removed before updating
+	// kernel_status to "", the bootloader will think that the try kernel failed
+	// to boot and fall back to booting the old kernel which is safe.
+
+	// always set the boot vars first before mutating any of the kernel symlinks
+	// etc.
+	// for markSuccessful, we will always set the status to Default, even if
+	// technically this boot wasn't "successful" - it was successful in the
+	// sense that we booted some combination of boot snaps and made it all the
+	// way to snapd in user space
+	if bks.currentKernelStatus != DefaultStatus {
+		m := map[string]string{
+			"kernel_status": DefaultStatus,
+		}
+
+		// set the boot variables
+		err := bks.ebl.SetBootVars(m)
+		if err != nil {
+			return err
+		}
+	}
+
+	// if the kernel we booted is not the current one, we must have tried
+	// a new kernel, so enable that one as the current one now
+	if bks.currentKernel.Filename() != sn.Filename() {
+		err := bks.ebl.EnableKernel(sn)
+		if err != nil {
+			return err
+		}
+	}
+
+	// always disable the try kernel snap to cleanup in case we have upgrade
+	// failures which leave behind try-kernel.efi
+	err := bks.ebl.DisableTryKernel()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (bks *extractedRunKernelImageBootloaderKernelState) setNextKernel(sn snap.PlaceInfo, status string) error {
+	// always enable the try-kernel first, if we did the reverse and got
+	// rebooted after setting the boot vars but before enabling the try-kernel
+	// we could get stuck where the bootloader can't find the try-kernel and
+	// gets stuck waiting for a user to reboot, at which point we would fallback
+	// see i.e. https://github.com/snapcore/pc-amd64-gadget/issues/36
+	if sn.Filename() != bks.currentKernel.Filename() {
+		err := bks.ebl.EnableTryKernel(sn)
+		if err != nil {
+			return err
+		}
+	}
+
+	// only if the new kernel status is different from what we read should we
+	// run SetBootVars() to minimize wear/corruption possibility on the bootenv
+	if status != bks.currentKernelStatus {
+		m := map[string]string{
+			"kernel_status": status,
+		}
+
+		// set the boot variables
+		return bks.ebl.SetBootVars(m)
+	}
+
+	return nil
+}
+
+// envRefExtractedKernelBootloaderKernelState implements bootloaderKernelState20 for
+// bootloaders that only support using bootloader env and i.e. don't support
+// ExtractedRunKernelImageBootloader
+type envRefExtractedKernelBootloaderKernelState struct {
+	// the bootloader
+	bl bootloader.Bootloader
+
+	// the current state of env
+	env map[string]string
+
+	// the state of env to commit
+	toCommit map[string]string
+
+	// the current kernel
+	kern snap.PlaceInfo
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) load() error {
+	// for uc20, we only care about kernel_status, snap_kernel, and
+	// snap_try_kernel
+	m, err := envbks.bl.GetBootVars("kernel_status", "snap_kernel", "snap_try_kernel")
+	if err != nil {
+		return err
+	}
+
+	// the default commit env is the same state as the current env
+	envbks.env = m
+	envbks.toCommit = make(map[string]string, len(m))
+	for k, v := range m {
+		envbks.toCommit[k] = v
+	}
+
+	// snap_kernel is the current kernel snap
+	// parse the filename here because the kernel() method doesn't return an err
+	sn, err := snap.ParsePlaceInfoFromSnapFileName(envbks.env["snap_kernel"])
+	if err != nil {
+		return err
+	}
+
+	envbks.kern = sn
+
+	return nil
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) kernel() snap.PlaceInfo {
+	return envbks.kern
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) tryKernel() (snap.PlaceInfo, error) {
+	// empty snap_try_kernel is special case
+	if envbks.env["snap_try_kernel"] == "" {
+		return nil, bootloader.ErrNoTryKernelRef
+	}
+	sn, err := snap.ParsePlaceInfoFromSnapFileName(envbks.env["snap_try_kernel"])
+	if err != nil {
+		return nil, err
+	}
+
+	return sn, nil
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) kernelStatus() string {
+	return envbks.env["kernel_status"]
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) commonStateCommitUpdate(sn snap.PlaceInfo, bootvar string) bool {
+	envChanged := false
+
+	// check kernel_status
+	if envbks.env["kernel_status"] != envbks.toCommit["kernel_status"] {
+		envChanged = true
+	}
+
+	// if the specified snap is not the current snap, update the bootvar
+	if sn.Filename() != envbks.kern.Filename() {
+		envbks.toCommit[bootvar] = sn.Filename()
+		envChanged = true
+	}
+
+	return envChanged
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) markSuccessfulKernel(sn snap.PlaceInfo) error {
+	// the ordering here doesn't matter, as the only actual state we mutate is
+	// writing the bootloader env vars, so just do that once at the end after
+	// processing all the changes
+
+	// always set kernel_status to DefaultStatus
+	envbks.toCommit["kernel_status"] = DefaultStatus
+	envChanged := envbks.commonStateCommitUpdate(sn, "snap_kernel")
+
+	// if the snap_try_kernel is set, we should unset that to both cleanup after
+	// a successful trying -> "" transition, but also to cleanup if we got
+	// rebooted during the process and have it leftover
+	if envbks.env["snap_try_kernel"] != "" {
+		envChanged = true
+		envbks.toCommit["snap_try_kernel"] = ""
+	}
+
+	if envChanged {
+		return envbks.bl.SetBootVars(envbks.toCommit)
+	}
+
+	return nil
+}
+
+func (envbks *envRefExtractedKernelBootloaderKernelState) setNextKernel(sn snap.PlaceInfo, status string) error {
+	envbks.toCommit["kernel_status"] = status
+	bootenvChanged := envbks.commonStateCommitUpdate(sn, "snap_try_kernel")
+
+	if bootenvChanged {
+		return envbks.bl.SetBootVars(envbks.toCommit)
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/boot/bootstate20.go snapd-2.48.3+20.04/boot/bootstate20.go
--- snapd-2.45.1+20.04.2/boot/bootstate20.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/bootstate20.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -21,42 +21,36 @@
 
 import (
 	"fmt"
+	"path/filepath"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/strutil"
 )
 
-func newBootState20(typ snap.Type) bootState {
+func newBootState20(typ snap.Type, dev Device) bootState {
 	switch typ {
 	case snap.TypeBase:
 		return &bootState20Base{}
 	case snap.TypeKernel:
-		return &bootState20Kernel{}
+		return &bootState20Kernel{
+			dev: dev,
+		}
 	default:
 		panic(fmt.Sprintf("cannot make a bootState20 for snap type %q", typ))
 	}
 }
 
-//
-// modeenv methods
-//
-
-type bootState20Modeenv struct {
-	modeenv *Modeenv
-}
-
-func (bsm *bootState20Modeenv) loadModeenv() error {
-	// don't read modeenv multiple times
-	if bsm.modeenv != nil {
-		return nil
-	}
+func loadModeenv() (*Modeenv, error) {
 	modeenv, err := ReadModeenv("")
 	if err != nil {
-		return fmt.Errorf("cannot get snap revision: unable to read modeenv: %v", err)
+		return nil, fmt.Errorf("cannot get snap revision: unable to read modeenv: %v", err)
 	}
-	bsm.modeenv = modeenv
-
-	return nil
+	return modeenv, nil
 }
 
 //
@@ -82,269 +76,112 @@
 	markSuccessfulKernel(sn snap.PlaceInfo) error
 }
 
-// extractedRunKernelImageBootloaderKernelState implements bootloaderKernelState20 for
-// bootloaders that implement ExtractedRunKernelImageBootloader
-type extractedRunKernelImageBootloaderKernelState struct {
-	// the bootloader
-	ebl bootloader.ExtractedRunKernelImageBootloader
-	// the current kernel status as read by the bootloader's bootenv
-	currentKernelStatus string
-	// the current kernel on the bootloader (not the try-kernel)
-	currentKernel snap.PlaceInfo
-}
+//
+// bootStateUpdate for 20 methods
+//
 
-func (bks *extractedRunKernelImageBootloaderKernelState) load() error {
-	// get the kernel_status
-	m, err := bks.ebl.GetBootVars("kernel_status")
-	if err != nil {
-		return err
-	}
+type bootCommitTask func() error
 
-	bks.currentKernelStatus = m["kernel_status"]
+// bootStateUpdate20 implements the bootStateUpdate interface for both kernel
+// and base snaps on UC20.
+type bootStateUpdate20 struct {
+	// tasks to run before the modeenv has been written
+	preModeenvTasks []bootCommitTask
 
-	// get the current kernel for this bootloader to compare during commit() for
-	// markSuccessful() if we booted the current kernel or not
-	kernel, err := bks.ebl.Kernel()
-	if err != nil {
-		return fmt.Errorf("cannot identify kernel snap with bootloader %s: %v", bks.ebl.Name(), err)
-	}
+	// the modeenv that was read from disk
+	modeenv *Modeenv
 
-	bks.currentKernel = kernel
+	// the modeenv that will be written out in commit
+	writeModeenv *Modeenv
 
-	return nil
-}
+	// tasks to run after the modeenv has been written
+	postModeenvTasks []bootCommitTask
 
-func (bks *extractedRunKernelImageBootloaderKernelState) kernel() snap.PlaceInfo {
-	return bks.currentKernel
+	// model set if a reseal might be necessary
+	resealModel *asserts.Model
 }
 
-func (bks *extractedRunKernelImageBootloaderKernelState) tryKernel() (snap.PlaceInfo, error) {
-	return bks.ebl.TryKernel()
+func (u20 *bootStateUpdate20) preModeenv(task bootCommitTask) {
+	u20.preModeenvTasks = append(u20.preModeenvTasks, task)
 }
 
-func (bks *extractedRunKernelImageBootloaderKernelState) kernelStatus() string {
-	return bks.currentKernelStatus
-}
-
-func (bks *extractedRunKernelImageBootloaderKernelState) markSuccessfulKernel(sn snap.PlaceInfo) error {
-	// set the boot vars first, then enable the successful kernel, then disable
-	// the old try-kernel, see the comment in bootState20MarkSuccessful.commit()
-	// for details
-
-	// the ordering here is very important for boot reliability!
-
-	// If we have successfully just booted from a try-kernel and are
-	// marking it successful (this implies that snap_kernel=="trying" as set
-	// by the boot script), we need to do the following in order (since we
-	// have the added complexity of moving the kernel symlink):
-	// 1. Update kernel_status to ""
-	// 2. Move kernel symlink to point to the new try kernel
-	// 3. Remove try-kernel symlink
-	// 4. Remove old kernel from modeenv (this happens one level up from this
-	//    function)
-	//
-	// If we got rebooted after step 1, then the bootloader is booting the wrong
-	// kernel, but is at least booting a known good kernel and snapd in
-	// user-space would be able to figure out the inconsistency.
-	// If we got rebooted after step 2, the bootloader would boot from the new
-	// try-kernel which is okay because we were in the middle of committing
-	// that new kernel as good and all that's left is for snapd to cleanup
-	// the left-over try-kernel symlink.
-	//
-	// If instead we had moved the kernel symlink first to point to the new try
-	// kernel, and got rebooted before the kernel_status was updated, we would
-	// have kernel_status="trying" which would cause the bootloader to think
-	// the boot failed, and revert to booting using the kernel symlink, but that
-	// now points to the new kernel we were trying and we did not successfully
-	// boot from that kernel to know we should trust it.
-	//
-	// Removing the old kernel from the modeenv needs to happen after it is
-	// impossible for the bootloader to boot from that kernel, otherwise we
-	// could end up in a state where the bootloader doesn't want to boot the
-	// new kernel, but the initramfs doesn't trust the old kernel and we are
-	// stuck. As such, do this last, after the symlink no longer exists.
-	//
-	// The try-kernel symlink removal should happen last because it will not
-	// affect anything, except that if it was removed before updating
-	// kernel_status to "", the bootloader will think that the try kernel failed
-	// to boot and fall back to booting the old kernel which is safe.
-
-	// always set the boot vars first before mutating any of the kernel symlinks
-	// etc.
-	// for markSuccessful, we will always set the status to Default, even if
-	// technically this boot wasn't "successful" - it was successful in the
-	// sense that we booted some combination of boot snaps and made it all the
-	// way to snapd in user space
-	if bks.currentKernelStatus != DefaultStatus {
-		m := map[string]string{
-			"kernel_status": DefaultStatus,
-		}
+func (u20 *bootStateUpdate20) postModeenv(task bootCommitTask) {
+	u20.postModeenvTasks = append(u20.postModeenvTasks, task)
+}
 
-		// set the boot variables
-		err := bks.ebl.SetBootVars(m)
-		if err != nil {
-			return err
-		}
-	}
+func (u20 *bootStateUpdate20) resealForModel(model *asserts.Model) {
+	u20.resealModel = model
+}
 
-	// if the kernel we booted is not the current one, we must have tried
-	// a new kernel, so enable that one as the current one now
-	if bks.currentKernel.Filename() != sn.Filename() {
-		err := bks.ebl.EnableKernel(sn)
+func newBootStateUpdate20(m *Modeenv) (*bootStateUpdate20, error) {
+	u20 := &bootStateUpdate20{}
+	if m == nil {
+		var err error
+		m, err = loadModeenv()
 		if err != nil {
-			return err
+			return nil, err
 		}
 	}
-
-	// always disable the try kernel snap to cleanup in case we have upgrade
-	// failures which leave behind try-kernel.efi
-	err := bks.ebl.DisableTryKernel()
+	// copy the modeenv for the write object
+	u20.modeenv = m
+	var err error
+	u20.writeModeenv, err = m.Copy()
 	if err != nil {
-		return err
+		return nil, err
 	}
-
-	return nil
+	return u20, nil
 }
 
-func (bks *extractedRunKernelImageBootloaderKernelState) setNextKernel(sn snap.PlaceInfo, status string) error {
-	// always enable the try-kernel first, if we did the reverse and got
-	// rebooted after setting the boot vars but before enabling the try-kernel
-	// we could get stuck where the bootloader can't find the try-kernel and
-	// gets stuck waiting for a user to reboot, at which point we would fallback
-	// see i.e. https://github.com/snapcore/pc-amd64-gadget/issues/36
-	if sn.Filename() != bks.currentKernel.Filename() {
-		err := bks.ebl.EnableTryKernel(sn)
-		if err != nil {
+// commit will write out boot state persistently to disk.
+func (u20 *bootStateUpdate20) commit() error {
+	// The actual actions taken here will depend on what things were called
+	// before commit(), either setNextBoot for a single type of kernel snap, or
+	// markSuccessful for kernel and/or base snaps.
+	// It is expected that the caller code is carefully analyzed to avoid
+	// critical points where a hard system reset during that critical point
+	// would brick a device or otherwise severely fail an update.
+	// There are three things that callers can do before calling commit(),
+	// 1. modify writeModeenv to specify new values for things that will be
+	//    written to disk in the modeenv.
+	// 2. Add tasks to run before writing the modeenv.
+	// 3. Add tasks to run after writing the modeenv.
+
+	// first handle any pre-modeenv writing tasks
+	for _, t := range u20.preModeenvTasks {
+		if err := t(); err != nil {
 			return err
 		}
 	}
 
-	// only if the new kernel status is different from what we read should we
-	// run SetBootVars() to minimize wear/corruption possibility on the bootenv
-	if status != bks.currentKernelStatus {
-		m := map[string]string{
-			"kernel_status": status,
+	modeenvRewritten := false
+	// next write the modeenv if it changed
+	if !u20.writeModeenv.deepEqual(u20.modeenv) {
+		if err := u20.writeModeenv.Write(); err != nil {
+			return err
 		}
-
-		// set the boot variables
-		return bks.ebl.SetBootVars(m)
-	}
-
-	return nil
-}
-
-// envRefExtractedKernelBootloaderKernelState implements bootloaderKernelState20 for
-// bootloaders that only support using bootloader env and i.e. don't support
-// ExtractedRunKernelImageBootloader
-type envRefExtractedKernelBootloaderKernelState struct {
-	// the bootloader
-	bl bootloader.Bootloader
-
-	// the current state of env
-	env map[string]string
-
-	// the state of env to commit
-	toCommit map[string]string
-
-	// the current kernel
-	kern snap.PlaceInfo
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) load() error {
-	// for uc20, we only care about kernel_status, snap_kernel, and
-	// snap_try_kernel
-	m, err := envbks.bl.GetBootVars("kernel_status", "snap_kernel", "snap_try_kernel")
-	if err != nil {
-		return err
-	}
-
-	// the default commit env is the same state as the current env
-	envbks.env = m
-	envbks.toCommit = make(map[string]string, len(m))
-	for k, v := range m {
-		envbks.toCommit[k] = v
-	}
-
-	// snap_kernel is the current kernel snap
-	// parse the filename here because the kernel() method doesn't return an err
-	sn, err := snap.ParsePlaceInfoFromSnapFileName(envbks.env["snap_kernel"])
-	if err != nil {
-		return err
-	}
-
-	envbks.kern = sn
-
-	return nil
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) kernel() snap.PlaceInfo {
-	return envbks.kern
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) tryKernel() (snap.PlaceInfo, error) {
-	// empty snap_try_kernel is special case
-	if envbks.env["snap_try_kernel"] == "" {
-		return nil, bootloader.ErrNoTryKernelRef
-	}
-	sn, err := snap.ParsePlaceInfoFromSnapFileName(envbks.env["snap_try_kernel"])
-	if err != nil {
-		return nil, err
-	}
-
-	return sn, nil
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) kernelStatus() string {
-	return envbks.env["kernel_status"]
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) commonStateCommitUpdate(sn snap.PlaceInfo, bootvar string) bool {
-	envChanged := false
-
-	// check kernel_status
-	if envbks.env["kernel_status"] != envbks.toCommit["kernel_status"] {
-		envChanged = true
+		modeenvRewritten = true
 	}
 
-	// if the specified snap is not the current snap, update the bootvar
-	if sn.Filename() != envbks.kern.Filename() {
-		envbks.toCommit[bootvar] = sn.Filename()
-		envChanged = true
-	}
-
-	return envChanged
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) markSuccessfulKernel(sn snap.PlaceInfo) error {
-	// the ordering here doesn't matter, as the only actual state we mutate is
-	// writing the bootloader env vars, so just do that once at the end after
-	// processing all the changes
-
-	// always set kernel_status to DefaultStatus
-	envbks.toCommit["kernel_status"] = DefaultStatus
-	envChanged := envbks.commonStateCommitUpdate(sn, "snap_kernel")
-
-	// if the snap_try_kernel is set, we should unset that to both cleanup after
-	// a successful trying -> "" transition, but also to cleanup if we got
-	// rebooted during the process and have it leftover
-	if envbks.env["snap_try_kernel"] != "" {
-		envChanged = true
-		envbks.toCommit["snap_try_kernel"] = ""
-	}
-
-	if envChanged {
-		return envbks.bl.SetBootVars(envbks.toCommit)
+	// next reseal using the modeenv values, we do this before any
+	// post-modeenv tasks so if we are rebooted at any point after
+	// the reseal even before the post tasks are completed, we
+	// still boot properly
+	if u20.resealModel != nil {
+		// if there is ambiguity whether the boot chains have
+		// changed because of unasserted kernels, then pass a
+		// flag as hint whether to reseal based on whether we
+		// wrote the modeenv
+		expectReseal := modeenvRewritten
+		if err := resealKeyToModeenv(dirs.GlobalRootDir, u20.resealModel, u20.writeModeenv, expectReseal); err != nil {
+			return err
+		}
 	}
 
-	return nil
-}
-
-func (envbks *envRefExtractedKernelBootloaderKernelState) setNextKernel(sn snap.PlaceInfo, status string) error {
-	envbks.toCommit["kernel_status"] = status
-	bootenvChanged := envbks.commonStateCommitUpdate(sn, "snap_try_kernel")
-
-	if bootenvChanged {
-		return envbks.bl.SetBootVars(envbks.toCommit)
+	// finally handle any post-modeenv writing tasks
+	for _, t := range u20.postModeenvTasks {
+		if err := t(); err != nil {
+			return err
+		}
 	}
 
 	return nil
@@ -354,27 +191,17 @@
 // kernel snap methods
 //
 
-// bootState20Kernel implements the bootState and bootStateUpdate interfaces for
-// kernel snaps on UC20. It is used for setNext() and markSuccessful() - though
-// note that for markSuccessful() a different bootStateUpdate implementation is
-// returned, see bootState20MarkSuccessful
+// bootState20Kernel implements the bootState interface for kernel snaps on
+// UC20. It is used for both setNext() and markSuccessful(), with both of those
+// methods returning bootStateUpdate20 to be used with bootStateUpdate.
 type bootState20Kernel struct {
 	bks bootloaderKernelState20
 
-	// the kernel snap that was booted for markSuccessful()
-	bootedKernelSnap snap.PlaceInfo
-
-	// the kernel snap to try for setNext()
-	nextKernelSnap snap.PlaceInfo
-
-	// the kernel_status to commit during commit()
-	commitKernelStatus string
+	// used to find the bootloader to manipulate the enabled kernel, etc.
+	blOpts *bootloader.Options
+	blDir  string
 
-	// don't embed this struct - it will conflict with embedding
-	// bootState20Modeenv in bootState20Base when both bootState20Base and
-	// bootState20Kernel are embedded in bootState20MarkSuccessful
-	// also we only need to use it with setNext()
-	kModeenv bootState20Modeenv
+	dev Device
 }
 
 func (ks20 *bootState20Kernel) loadBootenv() error {
@@ -383,17 +210,16 @@
 		return nil
 	}
 
-	// find the bootloader and ensure it's an extracted run kernel image
-	// bootloader
-	opts := &bootloader.Options{
-		// we want extracted run kernel images for uc20
-		// TODO:UC20: the name of this flag is now confusing, as it is being
-		//            slightly abused to tell the uboot bootloader to just look
-		//            in a different directory, even when we don't have an
-		//            actual extracted kernel image for that impl
-		ExtractedRunKernelImage: true,
+	// find the run-mode bootloader
+	var opts *bootloader.Options
+	if ks20.blOpts != nil {
+		opts = ks20.blOpts
+	} else {
+		opts = &bootloader.Options{
+			Role: bootloader.RoleRunMode,
+		}
 	}
-	bl, err := bootloader.Find("", opts)
+	bl, err := bootloader.Find(ks20.blDir, opts)
 	if err != nil {
 		return err
 	}
@@ -425,8 +251,9 @@
 	kern := ks20.bks.kernel()
 
 	tryKernel, err := ks20.bks.tryKernel()
+	// if err is ErrNoTryKernelRef, then we will just return nil as the trySnap
 	if err != nil && err != bootloader.ErrNoTryKernelRef {
-		return nil, nil, "", err
+		return kern, nil, "", newTrySnapErrorf("cannot identify try kernel snap: %v", err)
 	}
 
 	if err == nil {
@@ -436,241 +263,275 @@
 	return kern, tryBootSn, status, nil
 }
 
+func (ks20 *bootState20Kernel) revisionsFromModeenv(*Modeenv) (curSnap, trySnap snap.PlaceInfo, tryingStatus string, err error) {
+	// the kernel snap doesn't use modeenv at all for getting their revisions
+	return ks20.revisions()
+}
+
 func (ks20 *bootState20Kernel) markSuccessful(update bootStateUpdate) (bootStateUpdate, error) {
 	// call the generic method with this object to do most of the legwork
-	u, sn, err := selectSuccessfulBootSnap(ks20, update)
+	u20, sn, err := selectSuccessfulBootSnap(ks20, update)
 	if err != nil {
 		return nil, err
 	}
 
-	// save this object inside the update to share bootenv / modeenv between
-	// multiple calls to markSuccessful for different snap types, but the same
-	// bootStateUpdate object
-	u.bootState20Kernel = *ks20
-
-	// u should always be non-nil if err is nil
-	u.bootedKernelSnap = sn
-	return u, nil
-}
+	// XXX: this if arises because some unit tests rely on not setting up kernel
+	// details and just operating on the base snap but this situation would
+	// never happen in reality
+	if sn != nil {
+		// On commit, mark the kernel successful before rewriting the modeenv
+		// because if we first rewrote the modeenv then got rebooted before
+		// marking the kernel successful, the bootloader would see that the boot
+		// failed to mark it successful and then fall back to the original
+		// kernel, but that kernel would no longer be in the modeenv, so we
+		// would die in the initramfs
+		u20.preModeenv(func() error { return ks20.bks.markSuccessfulKernel(sn) })
+
+		// On commit, set CurrentKernels as just this kernel because that is the
+		// successful kernel we booted
+		u20.writeModeenv.CurrentKernels = []string{sn.Filename()}
 
-func (ks20 *bootState20Kernel) setNext(next snap.PlaceInfo) (rebootRequired bool, u bootStateUpdate, err error) {
-	// commit() for setNext() also needs to add to the kernels in modeenv
-	err = ks20.kModeenv.loadModeenv()
-	if err != nil {
-		return false, nil, err
+		// keep track of the model for resealing
+		u20.resealForModel(ks20.dev.Model())
 	}
 
-	nextStatus, err := genericSetNext(ks20, next)
+	return u20, nil
+}
+
+func (ks20 *bootState20Kernel) setNext(next snap.PlaceInfo) (rebootRequired bool, u bootStateUpdate, err error) {
+	u20, nextStatus, err := genericSetNext(ks20, next)
 	if err != nil {
 		return false, nil, err
 	}
 
 	// if we are setting a snap as a try snap, then we need to reboot
 	rebootRequired = false
-	ks20.nextKernelSnap = next
 	if nextStatus == TryStatus {
 		rebootRequired = true
 	}
-	ks20.commitKernelStatus = nextStatus
-
-	// any state changes done so far are consumed in commit()
-
-	return rebootRequired, ks20, nil
-}
-
-// commit for bootState20Kernel is meant only to be used with setNext().
-// For markSuccessful(), use bootState20MarkSuccessful.
-func (ks20 *bootState20Kernel) commit() error {
-	// The ordering of this is very important for boot safety/reliability!!!
-
-	// If we are about to try an update, and need to add the try-kernel symlink,
-	// we need to do things in this order:
-	// 1. Add the kernel snap to the modeenv
-	// 2. Create try-kernel symlink
-	// 3. Update kernel_status to "try"
-	//
-	// This is because if we get rebooted in before 3, kernel_status is still
-	// unset and boot scripts proceeds to boot with the old kernel, effectively
-	// ignoring the try-kernel symlink.
-	// If we did it in the opposite order however, we would set kernel_status to
-	// "try" and then get rebooted before we could create the try-kernel
-	// symlink, so the bootloader would try to boot from the non-existent
-	// try-kernel symlink and become broken.
-	//
-	// Adding the kernel snap to the modeenv's list of trusted kernel snaps can
-	// effectively happen any time before we update the kernel_status to "try"
-	// for the same reasoning as for creating the try-kernel symlink. Putting it
-	// first is currently a purely aesthetic choice.
 
-	// add the kernel to the modeenv if it is not the current kernel (if it is
-	// the current kernel then it must already be in the modeenv)
 	currentKernel := ks20.bks.kernel()
-	if ks20.nextKernelSnap.Filename() != currentKernel.Filename() {
-		// add the kernel to the modeenv
-		ks20.kModeenv.modeenv.CurrentKernels = append(
-			ks20.kModeenv.modeenv.CurrentKernels,
-			ks20.nextKernelSnap.Filename(),
+	if next.Filename() != currentKernel.Filename() {
+		// on commit, add this kernel to the modeenv
+		u20.writeModeenv.CurrentKernels = append(
+			u20.writeModeenv.CurrentKernels,
+			next.Filename(),
 		)
-		err := ks20.kModeenv.modeenv.Write()
-		if err != nil {
-			return err
-		}
 	}
 
-	err := ks20.bks.setNextKernel(ks20.nextKernelSnap, ks20.commitKernelStatus)
-	if err != nil {
-		return err
+	// On commit, if we are about to try an update, and need to set the next
+	// kernel before rebooting, we need to do that after updating the modeenv,
+	// because if we did it before and got rebooted in between setting the next
+	// kernel and updating the modeenv, the initramfs would fail the boot
+	// because the modeenv doesn't "trust" or expect the new kernel that booted.
+	// As such, set the next kernel as a post modeenv task.
+	u20.postModeenv(func() error { return ks20.bks.setNextKernel(next, nextStatus) })
+
+	// keep track of the model for resealing
+	u20.resealForModel(ks20.dev.Model())
+
+	return rebootRequired, u20, nil
+}
+
+// selectAndCommitSnapInitramfsMount chooses which snap should be mounted
+// during the initramfs, and commits that choice if it needs state updated.
+// Choosing to boot/mount the base snap needs to be committed to the
+// modeenv, but no state needs to be committed when choosing to mount a
+// kernel snap.
+func (ks20 *bootState20Kernel) selectAndCommitSnapInitramfsMount(modeenv *Modeenv) (sn snap.PlaceInfo, err error) {
+	// first do the generic choice of which snap to use
+	first, second, err := genericInitramfsSelectSnap(ks20, modeenv, TryingStatus, "kernel")
+	if err != nil && err != errTrySnapFallback {
+		return nil, err
 	}
 
-	return nil
+	if err == errTrySnapFallback {
+		// this should not actually return, it should immediately reboot
+		return nil, initramfsReboot()
+	}
+
+	// now validate the chosen kernel snap against the modeenv CurrentKernel's
+	// setting
+	if strutil.ListContains(modeenv.CurrentKernels, first.Filename()) {
+		return first, nil
+	}
+
+	// if we didn't trust the first kernel in the modeenv, and second is set as
+	// a fallback, that means we booted a try kernel which is the first kernel,
+	// but we need to fallback to the second kernel, but we can't do that in the
+	// initramfs, we need to reboot so the bootloader boots the fallback kernel
+	// for us
+
+	if second != nil {
+		// this should not actually return, it should immediately reboot
+		return nil, initramfsReboot()
+	}
+
+	// no fallback expected, so first snap _is_ the only kernel and isn't
+	// trusted!
+	// since we have nothing to fallback to, we don't issue a reboot and will
+	// instead just fail the systemd unit in the initramfs for an operator to
+	// debug/fix
+	return nil, fmt.Errorf("fallback kernel snap %q is not trusted in the modeenv", first.Filename())
 }
 
 //
 // base snap methods
 //
 
-// bootState20Kernel implements the bootState and bootStateUpdate interfaces for
-// base snaps on UC20. It is used for setNext() and markSuccessful() - though
-// note that for markSuccessful() a different bootStateUpdate implementation is
-// returned, see bootState20MarkSuccessful
-type bootState20Base struct {
-	bootState20Modeenv
-
-	// the base_status to be written to the modeenv, stored separately to
-	// eliminate unnecessary writes to the modeenv when it's already in the
-	// state we want it in
-	commitBaseStatus string
-
-	// the base snap that was booted for markSuccessful()
-	bootedBaseSnap snap.PlaceInfo
-
-	// the base snap to try for setNext()
-	tryBaseSnap snap.PlaceInfo
-}
-
-func (bs20 *bootState20Base) loadModeenv() error {
-	// don't read modeenv multiple times
-	if bs20.modeenv != nil {
-		return nil
-	}
-	modeenv, err := ReadModeenv("")
-	if err != nil {
-		return fmt.Errorf("cannot get snap revision: unable to read modeenv: %v", err)
-	}
-	bs20.modeenv = modeenv
-
-	// default commit status is the current status
-	bs20.commitBaseStatus = bs20.modeenv.BaseStatus
-
-	return nil
-}
+// bootState20Base implements the bootState interface for base snaps on UC20.
+// It is used for both setNext() and markSuccessful(), with both of those
+// methods returning bootStateUpdate20 to be used with bootStateUpdate.
+type bootState20Base struct{}
 
 // revisions returns the current boot snap and optional try boot snap for the
 // type specified in bsgeneric.
 func (bs20 *bootState20Base) revisions() (curSnap, trySnap snap.PlaceInfo, tryingStatus string, err error) {
-	var bootSn, tryBootSn snap.PlaceInfo
-	err = bs20.loadModeenv()
+	modeenv, err := loadModeenv()
 	if err != nil {
 		return nil, nil, "", err
 	}
+	return bs20.revisionsFromModeenv(modeenv)
+}
 
-	if bs20.modeenv.Base == "" {
+func (bs20 *bootState20Base) revisionsFromModeenv(modeenv *Modeenv) (curSnap, trySnap snap.PlaceInfo, tryingStatus string, err error) {
+	var bootSn, tryBootSn snap.PlaceInfo
+
+	if modeenv.Base == "" {
 		return nil, nil, "", fmt.Errorf("cannot get snap revision: modeenv base boot variable is empty")
 	}
 
-	bootSn, err = snap.ParsePlaceInfoFromSnapFileName(bs20.modeenv.Base)
+	bootSn, err = snap.ParsePlaceInfoFromSnapFileName(modeenv.Base)
 	if err != nil {
 		return nil, nil, "", fmt.Errorf("cannot get snap revision: modeenv base boot variable is invalid: %v", err)
 	}
 
-	if bs20.modeenv.BaseStatus == TryingStatus && bs20.modeenv.TryBase != "" {
-		tryBootSn, err = snap.ParsePlaceInfoFromSnapFileName(bs20.modeenv.TryBase)
+	if modeenv.BaseStatus != DefaultStatus && modeenv.TryBase != "" {
+		tryBootSn, err = snap.ParsePlaceInfoFromSnapFileName(modeenv.TryBase)
 		if err != nil {
-			return nil, nil, "", fmt.Errorf("cannot get snap revision: modeenv try base boot variable is invalid: %v", err)
+			return bootSn, nil, "", newTrySnapErrorf("cannot get snap revision: modeenv try base boot variable is invalid: %v", err)
 		}
 	}
 
-	return bootSn, tryBootSn, bs20.modeenv.BaseStatus, nil
+	return bootSn, tryBootSn, modeenv.BaseStatus, nil
 }
 
 func (bs20 *bootState20Base) markSuccessful(update bootStateUpdate) (bootStateUpdate, error) {
 	// call the generic method with this object to do most of the legwork
-	u, sn, err := selectSuccessfulBootSnap(bs20, update)
+	u20, sn, err := selectSuccessfulBootSnap(bs20, update)
 	if err != nil {
 		return nil, err
 	}
 
-	// save this object inside the update to share bootenv / modeenv between
-	// multiple calls to markSuccessful for different snap types, but the same
-	// bootStateUpdate object
-	u.bootState20Base = *bs20
-
-	// u should always be non-nil if err is nil
-	u.bootedBaseSnap = sn
-	return u, nil
+	// on commit, always clear the base_status and try_base when marking
+	// successful, this has the useful side-effect of cleaning up if we have
+	// base_status=trying but no try_base set, or if we had an issue with
+	// try_base being invalid
+	u20.writeModeenv.BaseStatus = DefaultStatus
+	u20.writeModeenv.TryBase = ""
+
+	// set the base
+	u20.writeModeenv.Base = sn.Filename()
+
+	return u20, nil
 }
 
 func (bs20 *bootState20Base) setNext(next snap.PlaceInfo) (rebootRequired bool, u bootStateUpdate, err error) {
-	nextStatus, err := genericSetNext(bs20, next)
+	u20, nextStatus, err := genericSetNext(bs20, next)
 	if err != nil {
 		return false, nil, err
 	}
+
 	// if we are setting a snap as a try snap, then we need to reboot
 	rebootRequired = false
 	if nextStatus == TryStatus {
-		bs20.tryBaseSnap = next
+		// only update the try base if we are actually in try status
+		u20.writeModeenv.TryBase = next.Filename()
 		rebootRequired = true
 	}
-	bs20.commitBaseStatus = nextStatus
 
-	// any state changes done so far are consumed in to commit()
+	// always update the base status
+	u20.writeModeenv.BaseStatus = nextStatus
 
-	return rebootRequired, bs20, nil
+	return rebootRequired, u20, nil
 }
 
-// commit for bootState20Base is meant only to be used with setNext(), for
-// markSuccessful(), use bootState20MarkSuccessful.
-func (bs20 *bootState20Base) commit() error {
-	// the ordering here is less important than the kernel commit(), since the
-	// only operation that has side-effects is writing the modeenv at the end,
-	// and that uses an atomic file writing operation, so it's not a concern if
-	// we get rebooted during this snippet like it is with the kernel snap above
+// selectAndCommitSnapInitramfsMount chooses which snap should be mounted
+// during the early boot sequence, i.e. the initramfs, and commits that
+// choice if it needs state updated.
+// Choosing to boot/mount the base snap needs to be committed to the
+// modeenv, but no state needs to be committed when choosing to mount a
+// kernel snap.
+func (bs20 *bootState20Base) selectAndCommitSnapInitramfsMount(modeenv *Modeenv) (sn snap.PlaceInfo, err error) {
+	// first do the generic choice of which snap to use
+	// the logic in that function is sufficient to pick the base snap entirely,
+	// so we don't ever need to look at the fallback snap, we just need to know
+	// whether the chosen snap is a try snap or not, if it is then we process
+	// the modeenv in the "try" -> "trying" case
+	first, second, err := genericInitramfsSelectSnap(bs20, modeenv, TryStatus, "base")
+	// errTrySnapFallback is handled manually by inspecting second below
+	if err != nil && err != errTrySnapFallback {
+		return nil, err
+	}
+
+	modeenvChanged := false
 
-	// the TryBase is the snap we are trying - note this could be nil if we
-	// are calling setNext on the same snap that is current
-	changed := false
-	if bs20.tryBaseSnap != nil {
-		tryBase := bs20.tryBaseSnap.Filename()
-		if tryBase != bs20.modeenv.TryBase {
-			bs20.modeenv.TryBase = tryBase
-			changed = true
+	// apply the update logic to the choices modeenv
+	switch modeenv.BaseStatus {
+	case TryStatus:
+		// if we were in try status and we have a fallback, then we are in a
+		// normal try state and we change status to TryingStatus now
+		// all other cleanup of state is left to user space snapd
+		if second != nil {
+			modeenv.BaseStatus = TryingStatus
+			modeenvChanged = true
 		}
+	case TryingStatus:
+		// we tried to boot a try base snap and failed, so we need to reset
+		// BaseStatus
+		modeenv.BaseStatus = DefaultStatus
+		modeenvChanged = true
+	case DefaultStatus:
+		// nothing to do
+	default:
+		// log a message about invalid setting
+		logger.Noticef("invalid setting for \"base_status\" in modeenv : %q", modeenv.BaseStatus)
 	}
 
-	if bs20.commitBaseStatus != bs20.modeenv.BaseStatus {
-		bs20.modeenv.BaseStatus = bs20.commitBaseStatus
-		changed = true
+	if modeenvChanged {
+		err = modeenv.Write()
+		if err != nil {
+			return nil, err
+		}
 	}
 
-	// only write the modeenv if we actually changed it
-	if changed {
-		return bs20.modeenv.Write()
-	}
-	return nil
+	return first, nil
 }
 
 //
 // generic methods
 //
 
+type bootState20 interface {
+	bootState
+	// revisionsFromModeenv implements bootState.revisions but starting
+	// from an already loaded Modeenv.
+	revisionsFromModeenv(*Modeenv) (curSnap, trySnap snap.PlaceInfo, tryingStatus string, err error)
+}
+
 // genericSetNext implements the generic logic for setting up a snap to be tried
 // for boot and works for both kernel and base snaps (though not
 // simultaneously).
-func genericSetNext(b bootState, next snap.PlaceInfo) (setStatus string, err error) {
+func genericSetNext(b bootState20, next snap.PlaceInfo) (u20 *bootStateUpdate20, setStatus string, err error) {
+	u20, err = newBootStateUpdate20(nil)
+	if err != nil {
+		return nil, "", err
+	}
+
 	// get the current snap
-	current, _, _, err := b.revisions()
+	current, _, _, err := b.revisionsFromModeenv(u20.modeenv)
 	if err != nil {
-		return "", err
+		return nil, "", err
 	}
 
 	// check if the next snap is really the same as the current snap, in which
@@ -678,135 +539,184 @@
 	if current.SnapName() == next.SnapName() && next.SnapRevision() == current.SnapRevision() {
 		// if we are setting the next snap as the current snap, don't need to
 		// change any snaps, just reset the status to default
-		return DefaultStatus, nil
+		return u20, DefaultStatus, nil
 	}
 
 	// by default we will set the status as "try" to prepare for an update,
 	// which also by default will require a reboot
-	return TryStatus, nil
+	return u20, TryStatus, nil
 }
 
-// bootState20MarkSuccessful is like bootState20Base and
-// bootState20Kernel, but is the combination of both of those things so we can
-// mark both snaps successful in one go
-type bootState20MarkSuccessful struct {
-	// base snap
-	bootState20Base
-	// kernel snap
-	bootState20Kernel
+func toBootStateUpdate20(update bootStateUpdate) (u20 *bootStateUpdate20, err error) {
+	// try to extract bootStateUpdate20 out of update
+	if update != nil {
+		var ok bool
+		if u20, ok = update.(*bootStateUpdate20); !ok {
+			return nil, fmt.Errorf("internal error, cannot thread %T with update for UC20", update)
+		}
+	}
+	if u20 == nil {
+		// make a new one, also loading modeenv
+		u20, err = newBootStateUpdate20(nil)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return u20, nil
 }
 
 // selectSuccessfulBootSnap inspects the specified boot state to pick what
 // boot snap should be marked as successful and use as a valid rollback target.
 // If the first return value is non-nil, the second return value will be the
 // snap that was booted and should be marked as successful.
-// It also loads boot environment state into b.
-func selectSuccessfulBootSnap(b bootState, update bootStateUpdate) (
-	bsmark *bootState20MarkSuccessful,
+func selectSuccessfulBootSnap(b bootState20, update bootStateUpdate) (
+	u20 *bootStateUpdate20,
 	bootedSnap snap.PlaceInfo,
 	err error,
 ) {
-	// get the try snap and the current status
-	sn, trySnap, status, err := b.revisions()
+	u20, err = toBootStateUpdate20(update)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	// try to extract bsmark out of update
-	var ok bool
-	if update != nil {
-		if bsmark, ok = update.(*bootState20MarkSuccessful); !ok {
-			return nil, nil, fmt.Errorf("internal error, cannot thread %T with update for UC20", update)
-		}
-	}
-
-	if bsmark == nil {
-		bsmark = &bootState20MarkSuccessful{}
+	// get the try snap and the current status
+	sn, trySnap, status, err := b.revisionsFromModeenv(u20.modeenv)
+	if err != nil {
+		return nil, nil, err
 	}
 
 	// kernel_status and base_status go from "" -> "try" (set by snapd), to
 	// "try" -> "trying" (set by the boot script)
 	// so if we are in "trying" mode, then we should choose the try snap
 	if status == TryingStatus && trySnap != nil {
-		return bsmark, trySnap, nil
+		return u20, trySnap, nil
 	}
 
 	// if we are not in trying then choose the normal snap
-	return bsmark, sn, nil
+	return u20, sn, nil
 }
 
-// commit will persistently write out the boot variables, etc. needed to mark
-// the snaps saved in bsmark as successful boot targets/combinations.
-// note that this makes the assumption that markSuccessful() has been called for
-// both the base and kernel snaps here, if that assumption is not true anymore,
-// this could end up auto-cleaning status variables for something it shouldn't
-// be.
-func (bsmark *bootState20MarkSuccessful) commit() error {
-	// the base and kernel snap updates will modify the modeenv, so we only
-	// issue a single write at the end if something changed
-	modeenvChanged := false
+// genericInitramfsSelectSnap will run the logic to choose which snap should be
+// mounted during the initramfs using the given bootState and the expected try
+// status. The try status is needed because during the initramfs we will have
+// different statuses for kernel vs base snaps, where base snap is expected to
+// be in "try" mode, but kernel is expected to be in "trying" mode. It returns
+// the first and second choice for what snaps to mount. If there is a second
+// snap, then that snap is the fallback or non-trying snap and the first snap is
+// the try snap.
+func genericInitramfsSelectSnap(bs bootState20, modeenv *Modeenv, expectedTryStatus, typeString string) (
+	firstChoice, secondChoice snap.PlaceInfo,
+	err error,
+) {
+	curSnap, trySnap, snapTryStatus, err := bs.revisionsFromModeenv(modeenv)
 
-	// for full explanation of the robustness and ordering, see the comments
-	// on the implementations of bks.markSuccessfulKernel
+	if err != nil && !isTrySnapError(err) {
+		// we have no fallback snap!
+		return nil, nil, fmt.Errorf("fallback %s snap unusable: %v", typeString, err)
+	}
+
+	// check that the current snap actually exists
+	file := curSnap.Filename()
+	snapPath := filepath.Join(dirs.SnapBlobDirUnder(InitramfsWritableDir), file)
+	if !osutil.FileExists(snapPath) {
+		// somehow the boot snap doesn't exist in ubuntu-data
+		// for a kernel, this could happen if we have some bug where ubuntu-boot
+		// isn't properly updated and never changes, but snapd thinks it was
+		// updated and eventually snapd garbage collects old revisions of
+		// the kernel snap as it is "refreshed"
+		// for a base, this could happen if the modeenv is manipulated
+		// out-of-band from snapd
+		return nil, nil, fmt.Errorf("%s snap %q does not exist on ubuntu-data", typeString, file)
+	}
+
+	if err != nil && isTrySnapError(err) {
+		// just log that we had issues with the try snap and continue with
+		// using the normal snap
+		logger.Noticef("unable to process try %s snap: %v", typeString, err)
+		return curSnap, nil, errTrySnapFallback
+	}
+	if snapTryStatus != expectedTryStatus {
+		// the status is unexpected, log if its value is invalid and continue
+		// with the normal snap
+		fallbackErr := errTrySnapFallback
+		switch snapTryStatus {
+		case DefaultStatus:
+			fallbackErr = nil
+		case TryStatus, TryingStatus:
+		default:
+			logger.Noticef("\"%s_status\" has an invalid setting: %q", typeString, snapTryStatus)
+		}
+		return curSnap, nil, fallbackErr
+	}
+	// then we are trying a snap update and there should be a try snap
+	if trySnap == nil {
+		// it is unexpected when there isn't one
+		logger.Noticef("try-%[1]s snap is empty, but \"%[1]s_status\" is \"trying\"", typeString)
+		return curSnap, nil, errTrySnapFallback
+	}
+	trySnapPath := filepath.Join(dirs.SnapBlobDirUnder(InitramfsWritableDir), trySnap.Filename())
+	if !osutil.FileExists(trySnapPath) {
+		// or when the snap file does not exist
+		logger.Noticef("try-%s snap %q does not exist", typeString, trySnap.Filename())
+		return curSnap, nil, errTrySnapFallback
+	}
 
-	// kernel snap first, slightly higher priority
+	// we have a try snap and everything appears in order
+	return trySnap, curSnap, nil
+}
 
-	// bootedKernelSnap will only ever be non-nil if we aren't marking a kernel
-	// snap successful, i.e. we are only marking a base snap successful
-	// this shouldn't happen except in tests, but let's be robust against it
-	// just in case
-	if bsmark.bootedKernelSnap != nil {
-		// always mark the kernel snap successful _before_ any other state
-		// mutating that may happen in bks.markSuccessful, because what we don't
-		// want to happen is to remove the old kernel and only trust the new
-		// try kernel before we actually set it up to boot from the new try
-		// kernel - that would brick us because we wouldn't trust the new kernel
-		// but the bootloader still thinks it should boot from the old kernel
-		err := bsmark.bks.markSuccessfulKernel(bsmark.bootedKernelSnap)
-		if err != nil {
-			return err
-		}
+//
+// non snap boot resources
+//
 
-		// also always set current_kernels to be just the kernel we booted, for
-		// same reason we always disable the try-kernel
-		bsmark.modeenv.CurrentKernels = []string{bsmark.bootedKernelSnap.Filename()}
-		modeenvChanged = true
-	}
+// bootState20BootAssets implements the successfulBootState interface for trusted
+// boot assets UC20.
+type bootState20BootAssets struct {
+	dev Device
+}
 
-	// base snap next
-	// the ordering here is less important, since the only operation that
-	// has side-effects is writing the modeenv at the end, and that uses an
-	// atomic file writing operation, so it's not a concern if we get
-	// rebooted during this snippet like it is with the kernel snap above
-
-	// always clear the base_status and try_base when marking successful, this
-	// has the useful side-effect of cleaning up if we have base_status=trying
-	// but no try_base set, or if we had an issue with try_base being invalid
-	if bsmark.modeenv.BaseStatus != DefaultStatus {
-		modeenvChanged = true
-		bsmark.modeenv.TryBase = ""
-		bsmark.modeenv.BaseStatus = DefaultStatus
+func (ba20 *bootState20BootAssets) markSuccessful(update bootStateUpdate) (bootStateUpdate, error) {
+	u20, err := toBootStateUpdate20(update)
+	if err != nil {
+		return nil, err
 	}
 
-	if bsmark.bootedBaseSnap != nil {
-		// set the new base as the tried base snap
-		tryBase := bsmark.bootedBaseSnap.Filename()
-		if bsmark.modeenv.Base != tryBase {
-			bsmark.modeenv.Base = tryBase
-			modeenvChanged = true
-		}
-
-		// clear the TryBase
-		if bsmark.modeenv.TryBase != "" {
-			bsmark.modeenv.TryBase = ""
-			modeenvChanged = true
+	if len(u20.modeenv.CurrentTrustedBootAssets) == 0 && len(u20.modeenv.CurrentTrustedRecoveryBootAssets) == 0 {
+		// not using trusted boot assets, nothing more to do
+		return update, nil
+	}
+
+	newM, dropAssets, err := observeSuccessfulBootAssets(u20.writeModeenv)
+	if err != nil {
+		return nil, fmt.Errorf("cannot mark successful boot assets: %v", err)
+	}
+	// update modeenv
+	u20.writeModeenv = newM
+	// keep track of the model for resealing
+	u20.resealForModel(ba20.dev.Model())
+
+	if len(dropAssets) == 0 {
+		// nothing to drop, we're done
+		return u20, nil
+	}
+
+	u20.postModeenv(func() error {
+		cache := newTrustedAssetsCache(dirs.SnapBootAssetsDir)
+		// drop listed assets from cache
+		for _, ta := range dropAssets {
+			err := cache.Remove(ta.blName, ta.name, ta.hash)
+			if err != nil {
+				// XXX: should this be a log instead?
+				return fmt.Errorf("cannot remove unused boot asset %v:%v: %v", ta.name, ta.hash, err)
+			}
 		}
-	}
+		return nil
+	})
+	return u20, nil
+}
 
-	// write the modeenv
-	if modeenvChanged {
-		return bsmark.modeenv.Write()
+func trustedAssetsBootState(dev Device) *bootState20BootAssets {
+	return &bootState20BootAssets{
+		dev: dev,
 	}
-
-	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/boot/boottest/bootenv.go snapd-2.48.3+20.04/boot/boottest/bootenv.go
--- snapd-2.45.1+20.04.2/boot/boottest/bootenv.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boottest/bootenv.go	2021-02-02 08:21:12.000000000 +0000
@@ -109,14 +109,9 @@
 	if rollbackKernel && b16.BootVars["snap_kernel"] == "" {
 		return fmt.Errorf("kernel rollback can only be simulated if snap_kernel is set")
 	}
-	// clean try bootvars and statusVar
+	// clean only statusVar - the try vars will be cleaned by snapd NOT by the
+	// bootloader
 	b16.BootVars[b16.statusVar] = ""
-	if rollbackBase {
-		b16.BootVars["snap_try_core"] = ""
-	}
-	if rollbackKernel {
-		b16.BootVars["snap_try_kernel"] = ""
-	}
 	return nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/boot/boottest/device.go snapd-2.48.3+20.04/boot/boottest/device.go
--- snapd-2.45.1+20.04.2/boot/boottest/device.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boottest/device.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,7 @@
 import (
 	"strings"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
 )
 
@@ -29,37 +30,67 @@
 	bootSnap string
 	mode     string
 	uc20     bool
+
+	model *asserts.Model
 }
 
 // MockDevice implements boot.Device. It wraps a string like
-// <boot-snap-name>[@<mode>], no <boot-snap-name> means classic, no
-// <mode> defaults to "run". It returns <boot-snap-name> for both
-// Base and Kernel, for more control mock a DeviceContext.
+// <boot-snap-name>[@<mode>], no <boot-snap-name> means classic, empty
+// <mode> defaults to "run" for UC16/18. If mode is set HasModeenv
+// returns true for UC20 and an empty boot snap name panics.
+// It returns <boot-snap-name> for both Base and Kernel, for more
+// control mock a DeviceContext.
 func MockDevice(s string) boot.Device {
-	bootsnap, mode := snapAndMode(s)
+	bootsnap, mode, uc20 := snapAndMode(s)
+	if uc20 && bootsnap == "" {
+		panic("MockDevice with no snap name and @mode is unsupported")
+	}
 	return &mockDevice{
 		bootSnap: bootsnap,
 		mode:     mode,
+		uc20:     uc20,
 	}
 }
 
 // MockUC20Device implements boot.Device and returns true for HasModeenv.
-func MockUC20Device(s string) boot.Device {
-	m := MockDevice(s).(*mockDevice)
-	m.uc20 = true
-	return m
+// Arguments are mode (empty means "run"), and model.
+// If model is nil a default model is used (same as MakeMockUC20Model).
+func MockUC20Device(mode string, model *asserts.Model) boot.Device {
+	if mode == "" {
+		mode = "run"
+	}
+	if model == nil {
+		model = MakeMockUC20Model()
+	}
+	return &mockDevice{
+		bootSnap: model.Kernel(),
+		mode:     mode,
+		uc20:     true,
+		model:    model,
+	}
 }
 
-func snapAndMode(str string) (snap, mode string) {
+func snapAndMode(str string) (snap, mode string, uc20 bool) {
 	parts := strings.SplitN(string(str), "@", 2)
 	if len(parts) == 1 || parts[1] == "" {
-		return parts[0], "run"
+		return parts[0], "run", false
 	}
-	return parts[0], parts[1]
+	return parts[0], parts[1], true
 }
 
 func (d *mockDevice) Kernel() string   { return d.bootSnap }
-func (d *mockDevice) Base() string     { return d.bootSnap }
 func (d *mockDevice) Classic() bool    { return d.bootSnap == "" }
 func (d *mockDevice) RunMode() bool    { return d.mode == "run" }
 func (d *mockDevice) HasModeenv() bool { return d.uc20 }
+func (d *mockDevice) Base() string {
+	if d.model != nil {
+		return d.model.Base()
+	}
+	return d.bootSnap
+}
+func (d *mockDevice) Model() *asserts.Model {
+	if d.model == nil {
+		panic("Device.Model called but MockUC20Device not used")
+	}
+	return d.model
+}
diff -Nru snapd-2.45.1+20.04.2/boot/boottest/device_test.go snapd-2.48.3+20.04/boot/boottest/device_test.go
--- snapd-2.45.1+20.04.2/boot/boottest/device_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boottest/device_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -41,19 +41,9 @@
 	c.Check(dev.RunMode(), Equals, true)
 	c.Check(dev.HasModeenv(), Equals, false)
 
-	dev = boottest.MockDevice("@run")
-	c.Check(dev.Classic(), Equals, true)
-	c.Check(dev.Kernel(), Equals, "")
-	c.Check(dev.Base(), Equals, "")
-	c.Check(dev.RunMode(), Equals, true)
-	c.Check(dev.HasModeenv(), Equals, false)
+	c.Check(func() { dev.Model() }, PanicMatches, "Device.Model called.*")
 
-	dev = boottest.MockDevice("@recover")
-	c.Check(dev.Classic(), Equals, true)
-	c.Check(dev.Kernel(), Equals, "")
-	c.Check(dev.Base(), Equals, "")
-	c.Check(dev.RunMode(), Equals, false)
-	c.Check(dev.HasModeenv(), Equals, false)
+	c.Check(func() { boottest.MockDevice("@run") }, Panics, "MockDevice with no snap name and @mode is unsupported")
 }
 
 func (s *boottestSuite) TestMockDeviceBaseOrKernel(c *C) {
@@ -63,38 +53,59 @@
 	c.Check(dev.Base(), Equals, "boot-snap")
 	c.Check(dev.RunMode(), Equals, true)
 	c.Check(dev.HasModeenv(), Equals, false)
+	c.Check(func() { dev.Model() }, Panics, "Device.Model called but MockUC20Device not used")
 
 	dev = boottest.MockDevice("boot-snap@run")
 	c.Check(dev.Classic(), Equals, false)
 	c.Check(dev.Kernel(), Equals, "boot-snap")
 	c.Check(dev.Base(), Equals, "boot-snap")
 	c.Check(dev.RunMode(), Equals, true)
-	c.Check(dev.HasModeenv(), Equals, false)
+	c.Check(dev.HasModeenv(), Equals, true)
+	c.Check(func() { dev.Model() }, PanicMatches, "Device.Model called.*")
 
 	dev = boottest.MockDevice("boot-snap@recover")
 	c.Check(dev.Classic(), Equals, false)
 	c.Check(dev.Kernel(), Equals, "boot-snap")
 	c.Check(dev.Base(), Equals, "boot-snap")
 	c.Check(dev.RunMode(), Equals, false)
-	c.Check(dev.HasModeenv(), Equals, false)
+	c.Check(dev.HasModeenv(), Equals, true)
+	c.Check(func() { dev.Model() }, PanicMatches, "Device.Model called.*")
 }
 
 func (s *boottestSuite) TestMockUC20Device(c *C) {
-	dev := boottest.MockUC20Device("boot-snap")
-	c.Check(dev.HasModeenv(), Equals, true)
-
-	dev = boottest.MockUC20Device("boot-snap@run")
+	dev := boottest.MockUC20Device("", nil)
 	c.Check(dev.HasModeenv(), Equals, true)
+	c.Check(dev.Classic(), Equals, false)
+	c.Check(dev.RunMode(), Equals, true)
+	c.Check(dev.Kernel(), Equals, "pc-kernel")
+	c.Check(dev.Base(), Equals, "core20")
 
-	dev = boottest.MockUC20Device("boot-snap@recover")
-	c.Check(dev.HasModeenv(), Equals, true)
+	c.Check(dev.Model().Model(), Equals, "my-model-uc20")
 
-	dev = boottest.MockUC20Device("")
-	c.Check(dev.HasModeenv(), Equals, true)
+	dev = boottest.MockUC20Device("run", nil)
+	c.Check(dev.RunMode(), Equals, true)
 
-	dev = boottest.MockUC20Device("@run")
-	c.Check(dev.HasModeenv(), Equals, true)
+	dev = boottest.MockUC20Device("recover", nil)
+	c.Check(dev.RunMode(), Equals, false)
 
-	dev = boottest.MockUC20Device("@recover")
-	c.Check(dev.HasModeenv(), Equals, true)
+	model := boottest.MakeMockUC20Model(map[string]interface{}{
+		"model": "other-model-uc20",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name": "pc-linux",
+				"id":   "pclinuxdidididididididididididid",
+				"type": "kernel",
+			},
+			map[string]interface{}{
+				"name": "pc",
+				"id":   "pcididididididididididididididid",
+				"type": "gadget",
+			},
+		},
+	})
+	dev = boottest.MockUC20Device("recover", model)
+	c.Check(dev.RunMode(), Equals, false)
+	c.Check(dev.Kernel(), Equals, "pc-linux")
+	c.Check(dev.Model().Model(), Equals, "other-model-uc20")
+	c.Check(dev.Model(), Equals, model)
 }
diff -Nru snapd-2.45.1+20.04.2/boot/boottest/model.go snapd-2.48.3+20.04/boot/boottest/model.go
--- snapd-2.45.1+20.04.2/boot/boottest/model.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boottest/model.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,70 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boottest
+
+import (
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/assertstest"
+)
+
+func MakeMockModel(overrides ...map[string]interface{}) *asserts.Model {
+	headers := map[string]interface{}{
+		"type":         "model",
+		"authority-id": "my-brand",
+		"series":       "16",
+		"brand-id":     "my-brand",
+		"model":        "my-model",
+		"display-name": "My Model",
+		"architecture": "amd64",
+		"base":         "core18",
+		"gadget":       "pc=18",
+		"kernel":       "pc-kernel=18",
+		"timestamp":    "2018-01-01T08:00:00+00:00",
+	}
+	return assertstest.FakeAssertion(append([]map[string]interface{}{headers}, overrides...)...).(*asserts.Model)
+}
+
+func MakeMockUC20Model(overrides ...map[string]interface{}) *asserts.Model {
+	headers := map[string]interface{}{
+		"type":         "model",
+		"authority-id": "my-brand",
+		"series":       "16",
+		"brand-id":     "my-brand",
+		"model":        "my-model-uc20",
+		"display-name": "My Model",
+		"architecture": "amd64",
+		"base":         "core20",
+		"grade":        "dangerous",
+		"timestamp":    "2019-11-01T08:00:00+00:00",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name": "pc-kernel",
+				"id":   "pckernelidididididididididididid",
+				"type": "kernel",
+			},
+			map[string]interface{}{
+				"name": "pc",
+				"id":   "pcididididididididididididididid",
+				"type": "gadget",
+			},
+		},
+	}
+	return assertstest.FakeAssertion(append([]map[string]interface{}{headers}, overrides...)...).(*asserts.Model)
+}
diff -Nru snapd-2.45.1+20.04.2/boot/boot_test.go snapd-2.48.3+20.04/boot/boot_test.go
--- snapd-2.45.1+20.04.2/boot/boot_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/boot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2019 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -21,6 +21,7 @@
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -28,14 +29,18 @@
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/boot/boottest"
 	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/seed"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
 	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/timings"
 )
 
 func TestBoot(t *testing.T) { TestingT(t) }
@@ -43,18 +48,20 @@
 type baseBootenvSuite struct {
 	testutil.BaseTest
 
+	rootdir string
 	bootdir string
 }
 
 func (s *baseBootenvSuite) SetUpTest(c *C) {
 	s.BaseTest.SetUpTest(c)
 
-	dirs.SetRootDir(c.MkDir())
+	s.rootdir = c.MkDir()
+	dirs.SetRootDir(s.rootdir)
 	s.AddCleanup(func() { dirs.SetRootDir("") })
 	restore := snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {})
 	s.AddCleanup(restore)
 
-	s.bootdir = filepath.Join(dirs.GlobalRootDir, "boot")
+	s.bootdir = filepath.Join(s.rootdir, "boot")
 }
 
 func (s *baseBootenvSuite) forceBootloader(bloader bootloader.Bootloader) {
@@ -62,6 +69,13 @@
 	s.AddCleanup(func() { bootloader.Force(nil) })
 }
 
+func (s *baseBootenvSuite) stampSealedKeys(c *C, rootdir string) {
+	stamp := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "sealed-keys")
+	c.Assert(os.MkdirAll(filepath.Dir(stamp), 0755), IsNil)
+	err := ioutil.WriteFile(stamp, nil, 0644)
+	c.Assert(err, IsNil)
+}
+
 type bootenvSuite struct {
 	baseBootenvSuite
 
@@ -80,10 +94,12 @@
 type baseBootenv20Suite struct {
 	baseBootenvSuite
 
-	kern1 snap.PlaceInfo
-	kern2 snap.PlaceInfo
-	base1 snap.PlaceInfo
-	base2 snap.PlaceInfo
+	kern1  snap.PlaceInfo
+	kern2  snap.PlaceInfo
+	ukern1 snap.PlaceInfo
+	ukern2 snap.PlaceInfo
+	base1  snap.PlaceInfo
+	base2  snap.PlaceInfo
 
 	normalDefaultState      *bootenv20Setup
 	normalTryingKernelState *bootenv20Setup
@@ -98,6 +114,11 @@
 	s.kern2, err = snap.ParsePlaceInfoFromSnapFileName("pc-kernel_2.snap")
 	c.Assert(err, IsNil)
 
+	s.ukern1, err = snap.ParsePlaceInfoFromSnapFileName("pc-kernel_x1.snap")
+	c.Assert(err, IsNil)
+	s.ukern2, err = snap.ParsePlaceInfoFromSnapFileName("pc-kernel_x2.snap")
+	c.Assert(err, IsNil)
+
 	s.base1, err = snap.ParsePlaceInfoFromSnapFileName("core20_1.snap")
 	c.Assert(err, IsNil)
 	s.base2, err = snap.ParsePlaceInfoFromSnapFileName("core20_2.snap")
@@ -130,6 +151,8 @@
 	// state for after trying a new kernel for robustness tests, etc.
 	s.normalTryingKernelState = &bootenv20Setup{
 		modeenv: &boot.Modeenv{
+			// operating mode is run
+			Mode: "run",
 			// base is base1
 			Base: s.base1.Filename(),
 			// no try base
@@ -197,8 +220,8 @@
 		// multiple modeenvs from a single test and just call the restore
 		// function in between the parts of the test that use different modeenvs
 		r := func() {
-			emptyModeenv := &boot.Modeenv{}
-			c.Assert(emptyModeenv.WriteTo(""), IsNil)
+			defaultModeenv := &boot.Modeenv{Mode: "run"}
+			c.Assert(defaultModeenv.WriteTo(""), IsNil)
 		}
 		cleanups = append(cleanups, r)
 	}
@@ -220,12 +243,12 @@
 	case *bootloadertest.MockExtractedRunKernelImageBootloader:
 		// then we can use the advanced methods on it
 		if opts.kern != nil {
-			r := vbl.SetRunKernelImageEnabledKernel(opts.kern)
+			r := vbl.SetEnabledKernel(opts.kern)
 			cleanups = append(cleanups, r)
 		}
 
 		if opts.tryKern != nil {
-			r := vbl.SetRunKernelImageEnabledTryKernel(opts.tryKern)
+			r := vbl.SetEnabledTryKernel(opts.tryKern)
 			cleanups = append(cleanups, r)
 		}
 
@@ -259,6 +282,8 @@
 			err := bl.SetBootVars(origEnv)
 			c.Assert(err, IsNil)
 		})
+	default:
+		c.Fatalf("unsupported bootloader %T", bl)
 	}
 
 	return func() {
@@ -371,7 +396,7 @@
 }
 
 func (s *bootenv20Suite) TestCurrentBoot20NameAndRevision(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -399,7 +424,7 @@
 // only difference between this test and TestCurrentBoot20NameAndRevision is the
 // base bootloader which doesn't support ExtractedRunKernelImageBootloader.
 func (s *bootenv20EnvRefKernelSuite) TestCurrentBoot20NameAndRevision(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -527,10 +552,10 @@
 
 	for i, t := range table {
 		dev := boottest.MockDevice(t.model)
-		bp := boot.Participant(t.with, t.with.GetType(), dev)
+		bp := boot.Participant(t.with, t.with.Type(), dev)
 		c.Check(bp.IsTrivial(), Equals, t.nop, Commentf("%d", i))
 		if !t.nop {
-			c.Check(bp, DeepEquals, boot.NewCoreBootParticipant(t.with, t.with.GetType(), dev))
+			c.Check(bp, DeepEquals, boot.NewCoreBootParticipant(t.with, t.with.Type(), dev))
 		}
 	}
 }
@@ -573,8 +598,75 @@
 	}
 }
 
+func (s *bootenvSuite) TestMarkBootSuccessfulKernelStatusTryingNoTryKernelSnapCleansUp(c *C) {
+	coreDev := boottest.MockDevice("some-snap")
+
+	// set all the same vars as if we were doing trying, except don't set a try
+	// kernel
+
+	err := s.bootloader.SetBootVars(map[string]string{
+		"snap_kernel": "kernel_41.snap",
+		"snap_mode":   boot.TryingStatus,
+	})
+	c.Assert(err, IsNil)
+
+	// mark successful
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// check that the bootloader variables were cleaned
+	expected := map[string]string{
+		"snap_mode":       boot.DefaultStatus,
+		"snap_kernel":     "kernel_41.snap",
+		"snap_try_kernel": "",
+	}
+	m, err := s.bootloader.GetBootVars("snap_mode", "snap_try_kernel", "snap_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, expected)
+
+	// do it again, verify it's still okay
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+	m2, err := s.bootloader.GetBootVars("snap_mode", "snap_try_kernel", "snap_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(m2, DeepEquals, expected)
+}
+
+func (s *bootenvSuite) TestMarkBootSuccessfulTryKernelKernelStatusDefaultCleansUp(c *C) {
+	coreDev := boottest.MockDevice("some-snap")
+
+	// set an errant snap_try_kernel
+	err := s.bootloader.SetBootVars(map[string]string{
+		"snap_kernel":     "kernel_41.snap",
+		"snap_try_kernel": "kernel_42.snap",
+		"snap_mode":       boot.DefaultStatus,
+	})
+	c.Assert(err, IsNil)
+
+	// mark successful
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// check that the bootloader variables were cleaned
+	expected := map[string]string{
+		"snap_mode":       boot.DefaultStatus,
+		"snap_kernel":     "kernel_41.snap",
+		"snap_try_kernel": "",
+	}
+	m, err := s.bootloader.GetBootVars("snap_mode", "snap_try_kernel", "snap_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, expected)
+
+	// do it again, verify it's still okay
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+	m2, err := s.bootloader.GetBootVars("snap_mode", "snap_try_kernel", "snap_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(m2, DeepEquals, expected)
+}
+
 func (s *bootenv20Suite) TestCoreKernel20(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -609,7 +701,7 @@
 }
 
 func (s *bootenv20Suite) TestCoreParticipant20SetNextSameKernelSnap(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -652,7 +744,7 @@
 }
 
 func (s *bootenv20EnvRefKernelSuite) TestCoreParticipant20SetNextSameKernelSnap(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -693,7 +785,7 @@
 }
 
 func (s *bootenv20Suite) TestCoreParticipant20SetNextNewKernelSnap(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -730,17 +822,90 @@
 	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename(), s.kern2.Filename()})
 }
 
-func (s *bootenv20EnvRefKernelSuite) TestCoreParticipant20SetNextNewKernelSnap(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+func (s *bootenv20Suite) TestCoreParticipant20SetNextNewKernelSnapWithReseal(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	assetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)), bootloader.RoleRunMode)
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.kern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "asset", bootloader.RoleRunMode),
+		// TODO:UC20: fix mocked trusted assets bootloader to actually
+		// geenerate kernel boot files
+		runKernelBf,
+	}
+
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.kern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+	}
+
 	r := setupUC20Bootenv(
 		c,
-		s.bootloader,
-		s.normalDefaultState,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv:    m,
+			kern:       s.kern1,
+			kernStatus: boot.DefaultStatus,
+		},
 	)
 	defer r()
 
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+
+		c.Assert(params.ModelParams, HasLen, 1)
+		mp := params.ModelParams[0]
+		c.Check(mp.Model, DeepEquals, coreDev.Model())
+		for _, ch := range mp.EFILoadChains {
+			printChain(c, ch, "-")
+		}
+		c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+			secboot.NewLoadChain(assetBf,
+				secboot.NewLoadChain(runKernelBf)),
+			secboot.NewLoadChain(assetBf,
+				// TODO:UC20: once mock trusted assets
+				// bootloader can generated boot files for the
+				// kernel this will use candidate kernel
+				secboot.NewLoadChain(runKernelBf)),
+		})
+		// actual paths are seen only here
+		c.Check(tab.BootChainKernelPath, DeepEquals, []string{
+			s.kern1.MountFile(),
+			s.kern2.MountFile(),
+		})
+		return nil
+	})
+	defer restore()
+
 	// get the boot kernel participant from our new kernel snap
 	bootKern := boot.Participant(s.kern2, snap.TypeKernel, coreDev)
 	// make sure it's not a trivial boot participant
@@ -752,8 +917,9 @@
 	c.Assert(rebootRequired, Equals, true)
 
 	// make sure the env was updated
-	m := s.bootloader.BootVars
-	c.Assert(m, DeepEquals, map[string]string{
+	bvars, err := tab.GetBootVars("kernel_status", "snap_kernel", "snap_try_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(bvars, DeepEquals, map[string]string{
 		"kernel_status":   boot.TryStatus,
 		"snap_kernel":     s.kern1.Filename(),
 		"snap_try_kernel": s.kern2.Filename(),
@@ -763,137 +929,515 @@
 	m2, err := boot.ReadModeenv("")
 	c.Assert(err, IsNil)
 	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename(), s.kern2.Filename()})
+
+	c.Check(resealCalls, Equals, 1)
 }
 
-func (s *bootenv20Suite) TestMarkBootSuccessful20KernelStatusTryingNoKernelSnapCleansUp(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+func (s *bootenv20Suite) TestCoreParticipant20SetNextNewUnassertedKernelSnapWithReseal(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	assetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)), bootloader.RoleRunMode)
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.ukern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "asset", bootloader.RoleRunMode),
+		// TODO:UC20: fix mocked trusted assets bootloader to actually
+		// geenerate kernel boot files
+		runKernelBf,
+	}
+
+	uc20Model := boottest.MakeMockUC20Model()
+	coreDev := boottest.MockUC20Device("", uc20Model)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
-	// set all the same vars as if we were doing trying, except don't set a try
-	// kernel
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.ukern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+	}
+
 	r := setupUC20Bootenv(
 		c,
-		s.bootloader,
+		tab.MockBootloader,
 		&bootenv20Setup{
-			modeenv: &boot.Modeenv{
-				Mode:           "run",
-				Base:           s.base1.Filename(),
-				CurrentKernels: []string{s.kern1.Filename(), s.kern2.Filename()},
-			},
-			kern: s.kern1,
-			// no try-kernel
-			kernStatus: boot.TryingStatus,
+			modeenv:    m,
+			kern:       s.ukern1,
+			kernStatus: boot.DefaultStatus,
 		},
 	)
 	defer r()
 
-	// mark successful
-	err := boot.MarkBootSuccessful(coreDev)
-	c.Assert(err, IsNil)
-
-	// check that the bootloader variable was cleaned
-	expected := map[string]string{"kernel_status": boot.DefaultStatus}
-	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
-
-	// check that MarkBootSuccessful didn't enable a kernel (since there was no
-	// try kernel)
-	_, nEnableCalls := s.bootloader.GetRunKernelImageFunctionSnapCalls("EnableKernel")
-	c.Assert(nEnableCalls, Equals, 0)
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+
+		c.Assert(params.ModelParams, HasLen, 1)
+		mp := params.ModelParams[0]
+		c.Check(mp.Model, DeepEquals, uc20Model)
+		for _, ch := range mp.EFILoadChains {
+			printChain(c, ch, "-")
+		}
+		c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+			secboot.NewLoadChain(assetBf,
+				secboot.NewLoadChain(runKernelBf)),
+			secboot.NewLoadChain(assetBf,
+				// TODO:UC20: once mock trusted assets
+				// bootloader can generated boot files for the
+				// kernel this will use candidate kernel
+				secboot.NewLoadChain(runKernelBf)),
+		})
+		// actual paths are seen only here
+		c.Check(tab.BootChainKernelPath, DeepEquals, []string{
+			s.ukern1.MountFile(),
+			s.ukern2.MountFile(),
+		})
+		return nil
+	})
+	defer restore()
 
-	// we will always end up disabling a try-kernel though as cleanup
-	_, nDisableTryCalls := s.bootloader.GetRunKernelImageFunctionSnapCalls("DisableTryKernel")
-	c.Assert(nDisableTryCalls, Equals, 1)
+	// get the boot kernel participant from our new kernel snap
+	bootKern := boot.Participant(s.ukern2, snap.TypeKernel, coreDev)
+	// make sure it's not a trivial boot participant
+	c.Assert(bootKern.IsTrivial(), Equals, false)
 
-	// do it again, verify it's still okay
-	err = boot.MarkBootSuccessful(coreDev)
+	// make the kernel used on next boot
+	rebootRequired, err := bootKern.SetNextBoot()
 	c.Assert(err, IsNil)
-	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
-
-	// no new enabled kernels
-	_, nEnableCalls = s.bootloader.GetRunKernelImageFunctionSnapCalls("EnableKernel")
-	c.Assert(nEnableCalls, Equals, 0)
+	c.Assert(rebootRequired, Equals, true)
 
-	// again we will try to cleanup any leftover try-kernels
-	_, nDisableTryCalls = s.bootloader.GetRunKernelImageFunctionSnapCalls("DisableTryKernel")
-	c.Assert(nDisableTryCalls, Equals, 2)
+	bvars, err := tab.GetBootVars("kernel_status", "snap_kernel", "snap_try_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(bvars, DeepEquals, map[string]string{
+		"kernel_status":   boot.TryStatus,
+		"snap_kernel":     s.ukern1.Filename(),
+		"snap_try_kernel": s.ukern2.Filename(),
+	})
 
-	// check that the modeenv re-wrote the CurrentKernels
+	// and that the modeenv now has this kernel listed
 	m2, err := boot.ReadModeenv("")
 	c.Assert(err, IsNil)
-	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename()})
+	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.ukern1.Filename(), s.ukern2.Filename()})
+
+	c.Check(resealCalls, Equals, 1)
 }
 
-func (s *bootenv20EnvRefKernelSuite) TestMarkBootSuccessful20KernelStatusTryingNoKernelSnapCleansUp(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+func (s *bootenv20Suite) TestCoreParticipant20SetNextSameKernelSnapNoReseal(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.kern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "asset", bootloader.RoleRunMode),
+		runKernelBf,
+	}
+
+	uc20Model := boottest.MakeMockUC20Model()
+	coreDev := boottest.MockUC20Device("", uc20Model)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
-	// set all the same vars as if we were doing trying, except don't set a try
-	// kernel
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.kern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+	}
+
 	r := setupUC20Bootenv(
 		c,
-		s.bootloader,
+		tab.MockBootloader,
 		&bootenv20Setup{
-			modeenv: &boot.Modeenv{
-				Mode:           "run",
-				Base:           s.base1.Filename(),
-				CurrentKernels: []string{s.kern1.Filename(), s.kern2.Filename()},
-			},
-			kern: s.kern1,
-			// no try-kernel
-			kernStatus: boot.TryingStatus,
+			modeenv:    m,
+			kern:       s.kern1,
+			kernStatus: boot.DefaultStatus,
 		},
 	)
 	defer r()
 
-	// mark successful
-	err := boot.MarkBootSuccessful(coreDev)
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	// get the boot kernel participant from our kernel snap
+	bootKern := boot.Participant(s.kern1, snap.TypeKernel, coreDev)
+	// make sure it's not a trivial boot participant
+	c.Assert(bootKern.IsTrivial(), Equals, false)
+
+	// write boot-chains for current state that will stay unchanged
+	bootChains := []boot.BootChain{{
+		BrandID:        "my-brand",
+		Model:          "my-model-uc20",
+		Grade:          "dangerous",
+		ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+		AssetChain: []boot.BootAsset{
+			{
+				Role: bootloader.RoleRunMode,
+				Name: "asset",
+				Hashes: []string{
+					"0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8",
+				},
+			},
+		},
+		Kernel:         "pc-kernel",
+		KernelRevision: "1",
+		KernelCmdlines: []string{"snapd_recovery_mode=run"},
+	}}
+	err := boot.WriteBootChains(bootChains, filepath.Join(dirs.SnapFDEDir, "boot-chains"), 0)
 	c.Assert(err, IsNil)
 
-	// make sure the env was updated
-	expected := map[string]string{
+	// make the kernel used on next boot
+	rebootRequired, err := bootKern.SetNextBoot()
+	c.Assert(err, IsNil)
+	c.Assert(rebootRequired, Equals, false)
+
+	// make sure the env is as expected
+	bvars, err := tab.GetBootVars("kernel_status", "snap_kernel", "snap_try_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(bvars, DeepEquals, map[string]string{
 		"kernel_status":   boot.DefaultStatus,
 		"snap_kernel":     s.kern1.Filename(),
 		"snap_try_kernel": "",
-	}
-	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
-
-	// do it again, verify it's still okay
-	err = boot.MarkBootSuccessful(coreDev)
-	c.Assert(err, IsNil)
-
-	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
+	})
 
-	// check that the modeenv re-wrote the CurrentKernels
+	// and that the modeenv now has the one kernel listed
 	m2, err := boot.ReadModeenv("")
 	c.Assert(err, IsNil)
 	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename()})
+
+	// boot chains were built
+	c.Check(tab.BootChainKernelPath, DeepEquals, []string{
+		s.kern1.MountFile(),
+	})
+	// no actual reseal
+	c.Check(resealCalls, Equals, 0)
 }
 
-func (s *bootenv20Suite) TestMarkBootSuccessful20BaseStatusTryingNoTryBaseSnapCleansUp(c *C) {
+func (s *bootenv20Suite) TestCoreParticipant20SetNextSameUnassertedKernelSnapNoReseal(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.ukern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "asset", bootloader.RoleRunMode),
+		runKernelBf,
+	}
+
+	uc20Model := boottest.MakeMockUC20Model()
+	coreDev := boottest.MockUC20Device("", uc20Model)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
 	m := &boot.Modeenv{
-		Mode: "run",
-		Base: s.base1.Filename(),
-		// no TryBase set
-		BaseStatus: boot.TryingStatus,
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.ukern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
 	}
+
 	r := setupUC20Bootenv(
 		c,
-		s.bootloader,
+		tab.MockBootloader,
 		&bootenv20Setup{
-			modeenv: m,
-			// no kernel setup necessary
+			modeenv:    m,
+			kern:       s.ukern1,
+			kernStatus: boot.DefaultStatus,
 		},
 	)
 	defer r()
 
-	coreDev := boottest.MockUC20Device("core20")
-	c.Assert(coreDev.HasModeenv(), Equals, true)
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return fmt.Errorf("unexpected call")
+	})
+	defer restore()
 
-	// mark successful
-	err := boot.MarkBootSuccessful(coreDev)
+	// get the boot kernel participant from our kernel snap
+	bootKern := boot.Participant(s.ukern1, snap.TypeKernel, coreDev)
+	// make sure it's not a trivial boot participant
+	c.Assert(bootKern.IsTrivial(), Equals, false)
+
+	// write boot-chains for current state that will stay unchanged
+	bootChains := []boot.BootChain{{
+		BrandID:        "my-brand",
+		Model:          "my-model-uc20",
+		Grade:          "dangerous",
+		ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+		AssetChain: []boot.BootAsset{
+			{
+				Role: bootloader.RoleRunMode,
+				Name: "asset",
+				Hashes: []string{
+					"0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8",
+				},
+			},
+		},
+		Kernel:         "pc-kernel",
+		KernelRevision: "",
+		KernelCmdlines: []string{"snapd_recovery_mode=run"},
+	}}
+	err := boot.WriteBootChains(bootChains, filepath.Join(dirs.SnapFDEDir, "boot-chains"), 0)
 	c.Assert(err, IsNil)
 
-	// check that the modeenv base_status was re-written to default
+	// make the kernel used on next boot
+	rebootRequired, err := bootKern.SetNextBoot()
+	c.Assert(err, IsNil)
+	c.Assert(rebootRequired, Equals, false)
+
+	// make sure the env is as expected
+	bvars, err := tab.GetBootVars("kernel_status", "snap_kernel", "snap_try_kernel")
+	c.Assert(err, IsNil)
+	c.Assert(bvars, DeepEquals, map[string]string{
+		"kernel_status":   boot.DefaultStatus,
+		"snap_kernel":     s.ukern1.Filename(),
+		"snap_try_kernel": "",
+	})
+
+	// and that the modeenv now has the one kernel listed
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.ukern1.Filename()})
+
+	// boot chains were built
+	c.Check(tab.BootChainKernelPath, DeepEquals, []string{
+		s.ukern1.MountFile(),
+	})
+	// no actual reseal
+	c.Check(resealCalls, Equals, 0)
+}
+
+func (s *bootenv20EnvRefKernelSuite) TestCoreParticipant20SetNextNewKernelSnap(c *C) {
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	r := setupUC20Bootenv(
+		c,
+		s.bootloader,
+		s.normalDefaultState,
+	)
+	defer r()
+
+	// get the boot kernel participant from our new kernel snap
+	bootKern := boot.Participant(s.kern2, snap.TypeKernel, coreDev)
+	// make sure it's not a trivial boot participant
+	c.Assert(bootKern.IsTrivial(), Equals, false)
+
+	// make the kernel used on next boot
+	rebootRequired, err := bootKern.SetNextBoot()
+	c.Assert(err, IsNil)
+	c.Assert(rebootRequired, Equals, true)
+
+	// make sure the env was updated
+	m := s.bootloader.BootVars
+	c.Assert(m, DeepEquals, map[string]string{
+		"kernel_status":   boot.TryStatus,
+		"snap_kernel":     s.kern1.Filename(),
+		"snap_try_kernel": s.kern2.Filename(),
+	})
+
+	// and that the modeenv now has this kernel listed
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename(), s.kern2.Filename()})
+}
+
+func (s *bootenv20Suite) TestMarkBootSuccessful20KernelStatusTryingNoKernelSnapCleansUp(c *C) {
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	// set all the same vars as if we were doing trying, except don't set a try
+	// kernel
+	r := setupUC20Bootenv(
+		c,
+		s.bootloader,
+		&bootenv20Setup{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.base1.Filename(),
+				CurrentKernels: []string{s.kern1.Filename(), s.kern2.Filename()},
+			},
+			kern: s.kern1,
+			// no try-kernel
+			kernStatus: boot.TryingStatus,
+		},
+	)
+	defer r()
+
+	// mark successful
+	err := boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// check that the bootloader variable was cleaned
+	expected := map[string]string{"kernel_status": boot.DefaultStatus}
+	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
+
+	// check that MarkBootSuccessful didn't enable a kernel (since there was no
+	// try kernel)
+	_, nEnableCalls := s.bootloader.GetRunKernelImageFunctionSnapCalls("EnableKernel")
+	c.Assert(nEnableCalls, Equals, 0)
+
+	// we will always end up disabling a try-kernel though as cleanup
+	_, nDisableTryCalls := s.bootloader.GetRunKernelImageFunctionSnapCalls("DisableTryKernel")
+	c.Assert(nDisableTryCalls, Equals, 1)
+
+	// do it again, verify it's still okay
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
+
+	// no new enabled kernels
+	_, nEnableCalls = s.bootloader.GetRunKernelImageFunctionSnapCalls("EnableKernel")
+	c.Assert(nEnableCalls, Equals, 0)
+
+	// again we will try to cleanup any leftover try-kernels
+	_, nDisableTryCalls = s.bootloader.GetRunKernelImageFunctionSnapCalls("DisableTryKernel")
+	c.Assert(nDisableTryCalls, Equals, 2)
+
+	// check that the modeenv re-wrote the CurrentKernels
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename()})
+}
+
+func (s *bootenv20EnvRefKernelSuite) TestMarkBootSuccessful20KernelStatusTryingNoKernelSnapCleansUp(c *C) {
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	// set all the same vars as if we were doing trying, except don't set a try
+	// kernel
+	r := setupUC20Bootenv(
+		c,
+		s.bootloader,
+		&bootenv20Setup{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.base1.Filename(),
+				CurrentKernels: []string{s.kern1.Filename(), s.kern2.Filename()},
+			},
+			kern: s.kern1,
+			// no try-kernel
+			kernStatus: boot.TryingStatus,
+		},
+	)
+	defer r()
+
+	// mark successful
+	err := boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// make sure the env was updated
+	expected := map[string]string{
+		"kernel_status":   boot.DefaultStatus,
+		"snap_kernel":     s.kern1.Filename(),
+		"snap_try_kernel": "",
+	}
+	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
+
+	// do it again, verify it's still okay
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	c.Assert(s.bootloader.BootVars, DeepEquals, expected)
+
+	// check that the modeenv re-wrote the CurrentKernels
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern1.Filename()})
+}
+
+func (s *bootenv20Suite) TestMarkBootSuccessful20BaseStatusTryingNoTryBaseSnapCleansUp(c *C) {
+	m := &boot.Modeenv{
+		Mode: "run",
+		Base: s.base1.Filename(),
+		// no TryBase set
+		BaseStatus: boot.TryingStatus,
+	}
+	r := setupUC20Bootenv(
+		c,
+		s.bootloader,
+		&bootenv20Setup{
+			modeenv: m,
+			// no kernel setup necessary
+		},
+	)
+	defer r()
+
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	// mark successful
+	err := boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// check that the modeenv base_status was re-written to default
 	m2, err := boot.ReadModeenv("")
 	c.Assert(err, IsNil)
 	c.Assert(m2.BaseStatus, Equals, boot.DefaultStatus)
@@ -912,7 +1456,7 @@
 }
 
 func (s *bootenv20Suite) TestCoreParticipant20SetNextSameBaseSnap(c *C) {
-	coreDev := boottest.MockUC20Device("core20")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	m := &boot.Modeenv{
@@ -950,7 +1494,7 @@
 }
 
 func (s *bootenv20Suite) TestCoreParticipant20SetNextNewBaseSnap(c *C) {
-	coreDev := boottest.MockUC20Device("core20")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// default state
@@ -986,6 +1530,61 @@
 	c.Assert(m2.TryBase, Equals, s.base2.Filename())
 }
 
+func (s *bootenv20Suite) TestCoreParticipant20SetNextNewBaseSnapNoReseal(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	// we should not even need to build boot chains
+	tab.BootChainErr = errors.New("boom")
+
+	// default state
+	m := &boot.Modeenv{
+		Mode: "run",
+		Base: s.base1.Filename(),
+	}
+	r := setupUC20Bootenv(
+		c,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv: m,
+			// no kernel setup necessary
+		},
+	)
+	defer r()
+
+	// get the boot base participant from our new base snap
+	bootBase := boot.Participant(s.base2, snap.TypeBase, coreDev)
+	// make sure it's not a trivial boot participant
+	c.Assert(bootBase.IsTrivial(), Equals, false)
+
+	// make the base used on next boot
+	rebootRequired, err := bootBase.SetNextBoot()
+	c.Assert(err, IsNil)
+	c.Assert(rebootRequired, Equals, true)
+
+	// make sure the modeenv was updated
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Assert(m2.Base, Equals, m.Base)
+	c.Assert(m2.BaseStatus, Equals, boot.TryStatus)
+	c.Assert(m2.TryBase, Equals, s.base2.Filename())
+
+	// no reseal
+	c.Check(resealCalls, Equals, 0)
+}
+
 func (s *bootenvSuite) TestMarkBootSuccessfulAllSnap(c *C) {
 	coreDev := boottest.MockDevice("some-snap")
 
@@ -1013,7 +1612,7 @@
 }
 
 func (s *bootenv20Suite) TestMarkBootSuccessful20AllSnap(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// bonus points: we were trying both a base snap and a kernel snap
@@ -1077,7 +1676,7 @@
 }
 
 func (s *bootenv20EnvRefKernelSuite) TestMarkBootSuccessful20AllSnap(c *C) {
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// bonus points: we were trying both a base snap and a kernel snap
@@ -1190,7 +1789,7 @@
 	)
 	defer r()
 
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// mark successful
@@ -1229,6 +1828,99 @@
 	c.Assert(nDisableTryCalls, Equals, 2)
 }
 
+func (s *bootenv20Suite) TestMarkBootSuccessful20KernelUpdateWithReseal(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	assetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)), bootloader.RoleRunMode)
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.kern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "asset", bootloader.RoleRunMode),
+		runKernelBf,
+	}
+
+	// trying a kernel snap
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.kern1.Filename(), s.kern2.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+	}
+	r := setupUC20Bootenv(
+		c,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv:    m,
+			kern:       s.kern1,
+			tryKern:    s.kern2,
+			kernStatus: boot.TryingStatus,
+		},
+	)
+	defer r()
+
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	resealCalls := 0
+	restore := boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+
+		c.Assert(params.ModelParams, HasLen, 1)
+		mp := params.ModelParams[0]
+		c.Check(mp.Model, DeepEquals, coreDev.Model())
+		for _, ch := range mp.EFILoadChains {
+			printChain(c, ch, "-")
+		}
+		c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+			secboot.NewLoadChain(assetBf,
+				secboot.NewLoadChain(runKernelBf)),
+		})
+		return nil
+	})
+	defer restore()
+
+	// mark successful
+	err := boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// check the bootloader variables
+	expected := map[string]string{
+		"kernel_status":   boot.DefaultStatus,
+		"snap_kernel":     s.kern2.Filename(),
+		"snap_try_kernel": boot.DefaultStatus,
+	}
+	c.Assert(tab.BootVars, DeepEquals, expected)
+
+	// check that the new kernel is the only one in modeenv
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Assert(m2.CurrentKernels, DeepEquals, []string{s.kern2.Filename()})
+
+	c.Check(resealCalls, Equals, 1)
+}
+
 func (s *bootenv20EnvRefKernelSuite) TestMarkBootSuccessful20KernelUpdate(c *C) {
 	// trying a kernel snap
 	m := &boot.Modeenv{
@@ -1248,7 +1940,7 @@
 	)
 	defer r()
 
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// mark successful
@@ -1295,7 +1987,7 @@
 	)
 	defer r()
 
-	coreDev := boottest.MockUC20Device("some-snap")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// mark successful
@@ -1321,6 +2013,549 @@
 	c.Assert(m3.BaseStatus, Equals, "")
 }
 
+func (s *bootenv20Suite) bootloaderWithTrustedAssets(c *C, trustedAssets []string) *bootloadertest.MockTrustedAssetsBootloader {
+	// TODO:UC20: this should be an ExtractedRecoveryKernelImageBootloader
+	// because that would reflect our main currently supported
+	// trusted assets bootloader (grub)
+	tab := bootloadertest.Mock("trusted", "").WithTrustedAssets()
+	bootloader.Force(tab)
+	tab.TrustedAssetsList = trustedAssets
+	s.AddCleanup(func() { bootloader.Force(nil) })
+	return tab
+}
+
+func (s *bootenv20Suite) TestMarkBootSuccessful20BootAssetsUpdateHappy(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+
+	c.Assert(os.MkdirAll(boot.InitramfsUbuntuBootDir, 0755), IsNil)
+	c.Assert(os.MkdirAll(boot.InitramfsUbuntuSeedDir, 0755), IsNil)
+	// only asset for ubuntu
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "asset"), data, 0644), IsNil)
+	// shim and asset for seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "shim"), shim, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-recoveryshimhash",
+		"shim-" + shimHash,
+		"asset-assethash",
+		"asset-recoveryassethash",
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	shimBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("shim-%s", shimHash)), bootloader.RoleRecovery)
+	assetBf := bootloader.NewBootFile("", filepath.Join(dirs.SnapBootAssetsDir, "trusted", fmt.Sprintf("asset-%s", dataHash)), bootloader.RoleRecovery)
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.kern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+	recoveryKernelBf := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		runKernelBf,
+	}
+	tab.RecoveryBootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		recoveryKernelBf,
+	}
+
+	uc20Model := boottest.MakeMockUC20Model()
+
+	restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-linux_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 1},
+				RealName: "pc-linux",
+			},
+		}
+		return uc20Model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	// we were trying an update of boot assets
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.kern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {"assethash", dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"recoveryassethash", dataHash},
+			"shim":  {"recoveryshimhash", shimHash},
+		},
+		CurrentRecoverySystems: []string{"system"},
+	}
+	r := setupUC20Bootenv(
+		c,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv:    m,
+			kern:       s.kern1,
+			kernStatus: boot.DefaultStatus,
+		},
+	)
+	defer r()
+
+	coreDev := boottest.MockUC20Device("", uc20Model)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	resealCalls := 0
+	restore = boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+
+		c.Assert(params.ModelParams, HasLen, 1)
+		mp := params.ModelParams[0]
+		c.Check(mp.Model, DeepEquals, uc20Model)
+		for _, ch := range mp.EFILoadChains {
+			printChain(c, ch, "-")
+		}
+		switch resealCalls {
+		case 1:
+			c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(runKernelBf))),
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(recoveryKernelBf))),
+			})
+		case 2:
+			c.Check(mp.EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shimBf,
+					secboot.NewLoadChain(assetBf,
+						secboot.NewLoadChain(recoveryKernelBf))),
+			})
+		default:
+			c.Errorf("unexpected additional call to secboot.ResealKey (call # %d)", resealCalls)
+		}
+		return nil
+	})
+	defer restore()
+
+	// mark successful
+	err := boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// check the modeenv
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	// update assets are in the list
+	c.Check(m2.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+	})
+	c.Check(m2.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"asset": {dataHash},
+		"shim":  {shimHash},
+	})
+	// unused files were dropped from cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-"+dataHash),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-"+shimHash),
+	})
+	c.Check(resealCalls, Equals, 2)
+}
+
+func (s *bootenv20Suite) TestMarkBootSuccessful20BootAssetsStableStateHappy(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"nested/asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir, "nested"), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir, "nested"), 0755), IsNil)
+	// only asset for ubuntu-boot
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "nested/asset"), data, 0644), IsNil)
+	// shim and asset for ubuntu-seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "nested/asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "shim"), shim, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-" + shimHash,
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.kern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+	recoveryKernelBf := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		runKernelBf,
+	}
+	tab.RecoveryBootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		recoveryKernelBf,
+	}
+
+	uc20Model := boottest.MakeMockUC20Model()
+
+	restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-kernel-recovery_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 1},
+				RealName: "pc-kernel-recovery",
+			},
+		}
+		return uc20Model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	// we were trying an update of boot assets
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.kern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+			"shim":  {shimHash},
+		},
+		CurrentRecoverySystems: []string{"system"},
+	}
+	r := setupUC20Bootenv(
+		c,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv:    m,
+			kern:       s.kern1,
+			kernStatus: boot.DefaultStatus,
+		},
+	)
+	defer r()
+
+	coreDev := boottest.MockUC20Device("", uc20Model)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	resealCalls := 0
+	restore = boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	// write boot-chains for current state that will stay unchanged
+	bootChains := []boot.BootChain{{
+		BrandID:        "my-brand",
+		Model:          "my-model-uc20",
+		Grade:          "dangerous",
+		ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+		AssetChain: []boot.BootAsset{{
+			Role: bootloader.RoleRecovery, Name: "shim",
+			Hashes: []string{
+				"dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b",
+			},
+		}, {
+			Role: bootloader.RoleRecovery, Name: "asset", Hashes: []string{
+				"0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8",
+			},
+		}},
+		Kernel:         "pc-kernel",
+		KernelRevision: "1",
+		KernelCmdlines: []string{"snapd_recovery_mode=run"},
+	}, {
+		BrandID:        "my-brand",
+		Model:          "my-model-uc20",
+		Grade:          "dangerous",
+		ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+		AssetChain: []boot.BootAsset{{
+			Role: bootloader.RoleRecovery, Name: "shim",
+			Hashes: []string{
+				"dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b",
+			},
+		}, {
+			Role: bootloader.RoleRecovery, Name: "asset", Hashes: []string{
+				"0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8",
+			},
+		}},
+		Kernel:         "pc-kernel-recovery",
+		KernelRevision: "1",
+		KernelCmdlines: []string{"snapd_recovery_mode=recover snapd_recovery_system=system"},
+	}}
+
+	recoveryBootChains := []boot.BootChain{bootChains[1]}
+
+	err := boot.WriteBootChains(boot.ToPredictableBootChains(bootChains), filepath.Join(dirs.SnapFDEDir, "boot-chains"), 0)
+	c.Assert(err, IsNil)
+
+	err = boot.WriteBootChains(boot.ToPredictableBootChains(recoveryBootChains), filepath.Join(dirs.SnapFDEDir, "recovery-boot-chains"), 0)
+	c.Assert(err, IsNil)
+
+	// mark successful
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// modeenv is unchanged
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(m2.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(m2.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// files are still in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-"+dataHash),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-"+shimHash),
+	})
+
+	// boot chains were built
+	c.Check(tab.BootChainKernelPath, DeepEquals, []string{
+		s.kern1.MountFile(),
+	})
+	// no actual reseal
+	c.Check(resealCalls, Equals, 0)
+}
+
+func (s *bootenv20Suite) TestMarkBootSuccessful20BootUnassertedKernelAssetsStableStateHappy(c *C) {
+	// checked by resealKeyToModeenv
+	s.stampSealedKeys(c, dirs.GlobalRootDir)
+
+	tab := s.bootloaderWithTrustedAssets(c, []string{"nested/asset", "shim"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+	shim := []byte("shim")
+	shimHash := "dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir, "nested"), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir, "nested"), 0755), IsNil)
+	// only asset for ubuntu-boot
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "nested/asset"), data, 0644), IsNil)
+	// shim and asset for ubuntu-seed
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "nested/asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "shim"), shim, 0644), IsNil)
+
+	// mock the files in cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{
+		"shim-" + shimHash,
+		"asset-" + dataHash,
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	runKernelBf := bootloader.NewBootFile(filepath.Join(s.ukern1.Filename()), "kernel.efi", bootloader.RoleRunMode)
+	recoveryKernelBf := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+
+	tab.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		runKernelBf,
+	}
+	tab.RecoveryBootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "shim", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "asset", bootloader.RoleRecovery),
+		recoveryKernelBf,
+	}
+
+	uc20Model := boottest.MakeMockUC20Model()
+
+	restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-kernel-recovery_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 1},
+				RealName: "pc-kernel-recovery",
+			},
+		}
+		return uc20Model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	// we were trying an update of boot assets
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.ukern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {dataHash},
+			"shim":  {shimHash},
+		},
+		CurrentRecoverySystems: []string{"system"},
+	}
+	r := setupUC20Bootenv(
+		c,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv:    m,
+			kern:       s.ukern1,
+			kernStatus: boot.DefaultStatus,
+		},
+	)
+	defer r()
+
+	coreDev := boottest.MockUC20Device("", uc20Model)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	resealCalls := 0
+	restore = boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+		resealCalls++
+		return nil
+	})
+	defer restore()
+
+	// write boot-chains for current state that will stay unchanged
+	bootChains := []boot.BootChain{{
+		BrandID:        "my-brand",
+		Model:          "my-model-uc20",
+		Grade:          "dangerous",
+		ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+		AssetChain: []boot.BootAsset{{
+			Role: bootloader.RoleRecovery, Name: "shim",
+			Hashes: []string{
+				"dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b",
+			},
+		}, {
+			Role: bootloader.RoleRecovery, Name: "asset", Hashes: []string{
+				"0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8",
+			},
+		}},
+		Kernel: "pc-kernel",
+		// unasserted kernel snap
+		KernelRevision: "",
+		KernelCmdlines: []string{"snapd_recovery_mode=run"},
+	}, {
+		BrandID:        "my-brand",
+		Model:          "my-model-uc20",
+		Grade:          "dangerous",
+		ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+		AssetChain: []boot.BootAsset{{
+			Role: bootloader.RoleRecovery, Name: "shim",
+			Hashes: []string{
+				"dac0063e831d4b2e7a330426720512fc50fa315042f0bb30f9d1db73e4898dcb89119cac41fdfa62137c8931a50f9d7b",
+			},
+		}, {
+			Role: bootloader.RoleRecovery, Name: "asset", Hashes: []string{
+				"0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8",
+			},
+		}},
+		Kernel:         "pc-kernel-recovery",
+		KernelRevision: "1",
+		KernelCmdlines: []string{"snapd_recovery_mode=recover snapd_recovery_system=system"},
+	}}
+
+	recoveryBootChains := []boot.BootChain{bootChains[1]}
+
+	err := boot.WriteBootChains(boot.ToPredictableBootChains(bootChains), filepath.Join(dirs.SnapFDEDir, "boot-chains"), 0)
+	c.Assert(err, IsNil)
+
+	err = boot.WriteBootChains(boot.ToPredictableBootChains(recoveryBootChains), filepath.Join(dirs.SnapFDEDir, "recovery-boot-chains"), 0)
+	c.Assert(err, IsNil)
+
+	// mark successful
+	err = boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, IsNil)
+
+	// modeenv is unchanged
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	c.Check(m2.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(m2.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// files are still in cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-"+dataHash),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "shim-"+shimHash),
+	})
+
+	// boot chains were built
+	c.Check(tab.BootChainKernelPath, DeepEquals, []string{
+		s.ukern1.MountFile(),
+	})
+	// no actual reseal
+	c.Check(resealCalls, Equals, 0)
+}
+
+func (s *bootenv20Suite) TestMarkBootSuccessful20BootAssetsUpdateUnexpectedAsset(c *C) {
+	tab := s.bootloaderWithTrustedAssets(c, []string{"EFI/asset"})
+
+	data := []byte("foobar")
+	// SHA3-384
+	dataHash := "0fa8abfbdaf924ad307b74dd2ed183b9a4a398891a2f6bac8fd2db7041b77f068580f9c6c66f699b496c2da1cbcc7ed8"
+
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir, "EFI"), 0755), IsNil)
+	c.Assert(os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI"), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuBootDir, "EFI/asset"), data, 0644), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/asset"), data, 0644), IsNil)
+	// mock some state in the cache
+	c.Assert(os.MkdirAll(filepath.Join(dirs.SnapBootAssetsDir, "trusted"), 0755), IsNil)
+	for _, name := range []string{"asset-one", "asset-two"} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapBootAssetsDir, "trusted", name), nil, 0644), IsNil)
+	}
+
+	// we were trying an update of boot assets
+	m := &boot.Modeenv{
+		Mode:           "run",
+		Base:           s.base1.Filename(),
+		CurrentKernels: []string{s.kern1.Filename()},
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			// hash will not match
+			"asset": {"one", "two"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"asset": {"one", "two"},
+		},
+	}
+	r := setupUC20Bootenv(
+		c,
+		tab.MockBootloader,
+		&bootenv20Setup{
+			modeenv:    m,
+			kern:       s.kern1,
+			kernStatus: boot.DefaultStatus,
+		},
+	)
+	defer r()
+
+	coreDev := boottest.MockUC20Device("", nil)
+	c.Assert(coreDev.HasModeenv(), Equals, true)
+
+	// mark successful
+	err := boot.MarkBootSuccessful(coreDev)
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`cannot mark boot successful: cannot mark successful boot assets: system booted with unexpected run mode bootloader asset "EFI/asset" hash %s`, dataHash))
+
+	// check the modeenv
+	m2, err := boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+	// modeenv is unchaged
+	c.Check(m2.CurrentTrustedBootAssets, DeepEquals, m.CurrentTrustedBootAssets)
+	c.Check(m2.CurrentTrustedRecoveryBootAssets, DeepEquals, m.CurrentTrustedRecoveryBootAssets)
+	// nothing was removed from cache
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDir, "trusted", "*"), []string{
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-one"),
+		filepath.Join(dirs.SnapBootAssetsDir, "trusted", "asset-two"),
+	})
+}
+
 type recoveryBootenv20Suite struct {
 	baseBootenvSuite
 
@@ -1337,7 +2572,7 @@
 	s.bootloader = bootloadertest.Mock("mock", c.MkDir())
 	s.forceBootloader(s.bootloader)
 
-	s.dev = boottest.MockUC20Device("some-snap")
+	s.dev = boottest.MockUC20Device("", nil)
 }
 
 func (s *recoveryBootenv20Suite) TestSetRecoveryBootSystemAndModeHappy(c *C) {
@@ -1380,7 +2615,7 @@
 	err = boot.SetRecoveryBootSystemAndMode(s.dev, "1234", "install")
 	c.Assert(err, IsNil)
 
-	bl, err := bootloader.Find(boot.InitramfsUbuntuSeedDir, &bootloader.Options{Recovery: true})
+	bl, err := bootloader.Find(boot.InitramfsUbuntuSeedDir, &bootloader.Options{Role: bootloader.RoleRecovery})
 	c.Assert(err, IsNil)
 
 	blvars, err := bl.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
diff -Nru snapd-2.45.1+20.04.2/boot/cmdline.go snapd-2.48.3+20.04/boot/cmdline.go
--- snapd-2.45.1+20.04.2/boot/cmdline.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/cmdline.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,13 +20,13 @@
 package boot
 
 import (
-	"bufio"
-	"bytes"
+	"errors"
 	"fmt"
-	"io/ioutil"
-	"strings"
 
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/strutil"
 )
 
@@ -42,43 +42,36 @@
 )
 
 var (
-	// the kernel commandline - can be overridden in tests
-	procCmdline = "/proc/cmdline"
-
 	validModes = []string{ModeInstall, ModeRecover, ModeRun}
 )
 
-func whichModeAndRecoverySystem(cmdline []byte) (mode string, sysLabel string, err error) {
-	scanner := bufio.NewScanner(bytes.NewBuffer(cmdline))
-	scanner.Split(bufio.ScanWords)
-
-	for scanner.Scan() {
-		w := scanner.Text()
-		if strings.HasPrefix(w, "snapd_recovery_mode=") {
-			if mode != "" {
-				return "", "", fmt.Errorf("cannot specify mode more than once")
-			}
-			mode = strings.SplitN(w, "=", 2)[1]
-			if mode == "" {
-				mode = ModeInstall
-			}
-			if !strutil.ListContains(validModes, mode) {
-				return "", "", fmt.Errorf("cannot use unknown mode %q", mode)
-			}
-		}
-		if strings.HasPrefix(w, "snapd_recovery_system=") {
-			if sysLabel != "" {
-				return "", "", fmt.Errorf("cannot specify recovery system label more than once")
-			}
-			sysLabel = strings.SplitN(w, "=", 2)[1]
-		}
-	}
-	if err := scanner.Err(); err != nil {
+// ModeAndRecoverySystemFromKernelCommandLine returns the current system mode
+// and the recovery system label as passed in the kernel command line by the
+// bootloader.
+func ModeAndRecoverySystemFromKernelCommandLine() (mode, sysLabel string, err error) {
+	m, err := osutil.KernelCommandLineKeyValues("snapd_recovery_mode", "snapd_recovery_system")
+	if err != nil {
 		return "", "", err
 	}
+	var modeOk bool
+	mode, modeOk = m["snapd_recovery_mode"]
+
+	// no mode specified gets interpreted as install
+	if modeOk {
+		if mode == "" {
+			mode = ModeInstall
+		} else if !strutil.ListContains(validModes, mode) {
+			return "", "", fmt.Errorf("cannot use unknown mode %q", mode)
+		}
+	}
+
+	sysLabel = m["snapd_recovery_system"]
+
 	switch {
 	case mode == "" && sysLabel == "":
 		return "", "", fmt.Errorf("cannot detect mode nor recovery system to use")
+	case mode == "" && sysLabel != "":
+		return "", "", fmt.Errorf("cannot specify system label without a mode")
 	case mode == ModeInstall && sysLabel == "":
 		return "", "", fmt.Errorf("cannot specify install mode without system label")
 	case mode == ModeRun && sysLabel != "":
@@ -89,22 +82,82 @@
 	return mode, sysLabel, nil
 }
 
-// ModeAndRecoverySystemFromKernelCommandLine returns the current system mode
-// and the recovery system label as passed in the kernel command line by the
-// bootloader.
-func ModeAndRecoverySystemFromKernelCommandLine() (mode, sysLabel string, err error) {
-	cmdline, err := ioutil.ReadFile(procCmdline)
+var errBootConfigNotManaged = errors.New("boot config is not managed")
+
+func getBootloaderManagingItsAssets(where string, opts *bootloader.Options) (bootloader.TrustedAssetsBootloader, error) {
+	bl, err := bootloader.Find(where, opts)
 	if err != nil {
-		return "", "", err
+		return nil, fmt.Errorf("internal error: cannot find trusted assets bootloader under %q: %v", where, err)
+	}
+	mbl, ok := bl.(bootloader.TrustedAssetsBootloader)
+	if !ok {
+		// the bootloader cannot manage its scripts
+		return nil, errBootConfigNotManaged
 	}
-	return whichModeAndRecoverySystem(cmdline)
+	return mbl, nil
 }
 
-// MockProcCmdline overrides the path to /proc/cmdline. For use in tests.
-func MockProcCmdline(newPath string) (restore func()) {
-	oldProcCmdline := procCmdline
-	procCmdline = newPath
-	return func() {
-		procCmdline = oldProcCmdline
+const (
+	currentEdition = iota
+	candidateEdition
+)
+
+func composeCommandLine(model *asserts.Model, currentOrCandidate int, mode, system string) (string, error) {
+	if model.Grade() == asserts.ModelGradeUnset {
+		return "", nil
 	}
+	if mode != ModeRun && mode != ModeRecover {
+		return "", fmt.Errorf("internal error: unsupported command line mode %q", mode)
+	}
+	// get the run mode bootloader under the native run partition layout
+	opts := &bootloader.Options{
+		Role:        bootloader.RoleRunMode,
+		NoSlashBoot: true,
+	}
+	bootloaderRootDir := InitramfsUbuntuBootDir
+	modeArg := "snapd_recovery_mode=run"
+	systemArg := ""
+	if mode == ModeRecover {
+		// dealing with recovery system bootloader
+		opts.Role = bootloader.RoleRecovery
+		bootloaderRootDir = InitramfsUbuntuSeedDir
+		// recovery mode & system command line arguments
+		modeArg = "snapd_recovery_mode=recover"
+		systemArg = fmt.Sprintf("snapd_recovery_system=%v", system)
+	}
+	mbl, err := getBootloaderManagingItsAssets(bootloaderRootDir, opts)
+	if err != nil {
+		if err == errBootConfigNotManaged {
+			return "", nil
+		}
+		return "", err
+	}
+	// TODO:UC20: fetch extra args from gadget
+	extraArgs := ""
+	if currentOrCandidate == currentEdition {
+		return mbl.CommandLine(modeArg, systemArg, extraArgs)
+	} else {
+		return mbl.CandidateCommandLine(modeArg, systemArg, extraArgs)
+	}
+}
+
+// ComposeRecoveryCommandLine composes the kernel command line used when booting
+// a given system in recover mode.
+func ComposeRecoveryCommandLine(model *asserts.Model, system string) (string, error) {
+	return composeCommandLine(model, currentEdition, ModeRecover, system)
+}
+
+// ComposeCommandLine composes the kernel command line used when booting the
+// system in run mode.
+func ComposeCommandLine(model *asserts.Model) (string, error) {
+	return composeCommandLine(model, currentEdition, ModeRun, "")
+}
+
+// TODO:UC20: add helper to compose candidate command line for a recovery system
+
+// ComposeCandidateCommandLine composes the kernel command line used when
+// booting the system in run mode with the current built-in edition of managed
+// boot assets.
+func ComposeCandidateCommandLine(model *asserts.Model) (string, error) {
+	return composeCommandLine(model, candidateEdition, ModeRun, "")
 }
diff -Nru snapd-2.45.1+20.04.2/boot/cmdline_test.go snapd-2.48.3+20.04/boot/cmdline_test.go
--- snapd-2.45.1+20.04.2/boot/cmdline_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/cmdline_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,6 +27,10 @@
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/boot/boottest"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/bootloadertest"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -44,7 +48,7 @@
 
 	err := os.MkdirAll(filepath.Join(s.rootDir, "proc"), 0755)
 	c.Assert(err, IsNil)
-	restore := boot.MockProcCmdline(filepath.Join(s.rootDir, "proc/cmdline"))
+	restore := osutil.MockProcCmdline(filepath.Join(s.rootDir, "proc/cmdline"))
 	s.AddCleanup(restore)
 }
 
@@ -82,13 +86,19 @@
 		cmd: "snapd_recovery_mode=install foo=bar",
 		err: `cannot specify install mode without system label`,
 	}, {
-		// boot scripts couldn't decide on mode
-		cmd: "snapd_recovery_mode=install snapd_recovery_system=1234 snapd_recovery_mode=run",
-		err: "cannot specify mode more than once",
-	}, {
-		// boot scripts couldn't decide which system to use
-		cmd: "snapd_recovery_system=not-this-one snapd_recovery_mode=install snapd_recovery_system=1234",
-		err: "cannot specify recovery system label more than once",
+		cmd: "snapd_recovery_system=1234",
+		err: `cannot specify system label without a mode`,
+	}, {
+		// multiple kernel command line params end up using the last one - this
+		// effectively matches the kernel handling too
+		cmd:  "snapd_recovery_mode=install snapd_recovery_system=1234 snapd_recovery_mode=run",
+		mode: "run",
+		// label gets unset because it's not used for run mode
+		label: "",
+	}, {
+		cmd:   "snapd_recovery_system=not-this-one snapd_recovery_mode=install snapd_recovery_system=1234",
+		mode:  "install",
+		label: "1234",
 	}} {
 		c.Logf("tc: %q", tc)
 		s.mockProcCmdlineContent(c, tc.cmd)
@@ -103,3 +113,89 @@
 		}
 	}
 }
+
+func (s *kernelCommandLineSuite) TestComposeCommandLineNotManagedHappy(c *C) {
+	model := boottest.MakeMockUC20Model()
+
+	bl := bootloadertest.Mock("btloader", c.MkDir())
+	bootloader.Force(bl)
+	defer bootloader.Force(nil)
+
+	cmdline, err := boot.ComposeRecoveryCommandLine(model, "20200314")
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "")
+
+	cmdline, err = boot.ComposeCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "")
+
+	tbl := bl.WithTrustedAssets()
+	bootloader.Force(tbl)
+
+	cmdline, err = boot.ComposeRecoveryCommandLine(model, "20200314")
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=recover snapd_recovery_system=20200314")
+
+	cmdline, err = boot.ComposeCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=run")
+}
+
+func (s *kernelCommandLineSuite) TestComposeCommandLineNotUC20(c *C) {
+	model := boottest.MakeMockModel()
+
+	bl := bootloadertest.Mock("btloader", c.MkDir())
+	bootloader.Force(bl)
+	defer bootloader.Force(nil)
+	cmdline, err := boot.ComposeRecoveryCommandLine(model, "20200314")
+	c.Assert(err, IsNil)
+	c.Check(cmdline, Equals, "")
+
+	cmdline, err = boot.ComposeCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Check(cmdline, Equals, "")
+}
+
+func (s *kernelCommandLineSuite) TestComposeCommandLineManagedHappy(c *C) {
+	model := boottest.MakeMockUC20Model()
+
+	tbl := bootloadertest.Mock("btloader", c.MkDir()).WithTrustedAssets()
+	bootloader.Force(tbl)
+	defer bootloader.Force(nil)
+
+	tbl.StaticCommandLine = "panic=-1"
+
+	cmdline, err := boot.ComposeRecoveryCommandLine(model, "20200314")
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=recover snapd_recovery_system=20200314 panic=-1")
+	cmdline, err = boot.ComposeCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=run panic=-1")
+
+	cmdline, err = boot.ComposeRecoveryCommandLine(model, "20200314")
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=recover snapd_recovery_system=20200314 panic=-1")
+	cmdline, err = boot.ComposeCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=run panic=-1")
+}
+
+func (s *kernelCommandLineSuite) TestComposeCandidateCommandLineManagedHappy(c *C) {
+	model := boottest.MakeMockUC20Model()
+
+	tbl := bootloadertest.Mock("btloader", c.MkDir()).WithTrustedAssets()
+	bootloader.Force(tbl)
+	defer bootloader.Force(nil)
+
+	tbl.StaticCommandLine = "panic=-1"
+	tbl.CandidateStaticCommandLine = "candidate panic=-1"
+
+	cmdline, err := boot.ComposeCandidateCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=run candidate panic=-1")
+
+	// managed status is effectively ignored
+	cmdline, err = boot.ComposeCandidateCommandLine(model)
+	c.Assert(err, IsNil)
+	c.Assert(cmdline, Equals, "snapd_recovery_mode=run candidate panic=-1")
+}
diff -Nru snapd-2.45.1+20.04.2/boot/debug.go snapd-2.48.3+20.04/boot/debug.go
--- snapd-2.45.1+20.04.2/boot/debug.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/debug.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,28 +24,55 @@
 	"io"
 
 	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
 )
 
 // DumpBootVars writes a dump of the snapd bootvars to the given writer
 func DumpBootVars(w io.Writer, dir string, uc20 bool) error {
-	bloader, err := bootloader.Find(dir, nil)
-	if err != nil {
-		return err
+	opts := &bootloader.Options{
+		NoSlashBoot: dir != "" && dir != "/",
+	}
+	switch dir {
+	// is it any of the well-known UC20 boot partition mount locations?
+	case InitramfsUbuntuBootDir:
+		opts.Role = bootloader.RoleRunMode
+		uc20 = true
+	case InitramfsUbuntuSeedDir:
+		opts.Role = bootloader.RoleRecovery
+		uc20 = true
+	}
+	if !opts.NoSlashBoot && !uc20 {
+		// this may still be a UC20 system
+		if osutil.FileExists(dirs.SnapModeenvFile) {
+			uc20 = true
+		}
+	}
+	allKeys := []string{
+		"snap_mode",
+		"snap_core",
+		"snap_try_core",
+		"snap_kernel",
+		"snap_try_kernel",
 	}
-	var allKeys []string
 	if uc20 {
-		// TODO:UC20: what about snapd_recovery_kernel, snapd_recovery_mode, and
-		//            snapd_recovery_system?
-		allKeys = []string{"kernel_status"}
-	} else {
+		if !opts.NoSlashBoot {
+			// no root directory set, default ot run mode
+			opts.Role = bootloader.RoleRunMode
+		}
+		// keys relevant to all uc20 bootloader implementations
 		allKeys = []string{
-			"snap_mode",
-			"snap_core",
-			"snap_try_core",
+			"snapd_recovery_mode",
+			"snapd_recovery_system",
+			"snapd_recovery_kernel",
 			"snap_kernel",
-			"snap_try_kernel",
+			"kernel_status",
 		}
 	}
+	bloader, err := bootloader.Find(dir, opts)
+	if err != nil {
+		return err
+	}
 
 	bootVars, err := bloader.GetBootVars(allKeys...)
 	if err != nil {
diff -Nru snapd-2.45.1+20.04.2/boot/errors.go snapd-2.48.3+20.04/boot/errors.go
--- snapd-2.45.1+20.04.2/boot/errors.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/errors.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,49 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot
+
+import (
+	"errors"
+	"fmt"
+)
+
+// trySnapError is an error that only applies to the try snaps where multiple
+// snaps are returned, this is mainly and primarily used in revisions().
+type trySnapError string
+
+func (sre trySnapError) Error() string {
+	return string(sre)
+}
+
+func newTrySnapErrorf(format string, args ...interface{}) error {
+	return trySnapError(fmt.Sprintf(format, args...))
+}
+
+// isTrySnapError returns true if the given error is an error resulting from
+// accessing information about the try snap or the trying status.
+func isTrySnapError(err error) bool {
+	switch err.(type) {
+	case trySnapError:
+		return true
+	}
+	return false
+}
+
+var errTrySnapFallback = errors.New("fallback to original snap")
diff -Nru snapd-2.45.1+20.04.2/boot/export_test.go snapd-2.48.3+20.04/boot/export_test.go
--- snapd-2.45.1+20.04.2/boot/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,7 +20,14 @@
 package boot
 
 import (
+	"fmt"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/seed"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/timings"
 )
 
 func NewCoreBootParticipant(s snap.PlaceInfo, t snap.Type, dev Device) *coreBootParticipant {
@@ -40,3 +47,144 @@
 func (m *Modeenv) WasRead() bool {
 	return m.read
 }
+
+func (m *Modeenv) DeepEqual(m2 *Modeenv) bool {
+	return m.deepEqual(m2)
+}
+
+var (
+	ModeenvKnownKeys = modeenvKnownKeys
+
+	MarshalModeenvEntryTo        = marshalModeenvEntryTo
+	UnmarshalModeenvValueFromCfg = unmarshalModeenvValueFromCfg
+
+	NewTrustedAssetsCache = newTrustedAssetsCache
+
+	ObserveSuccessfulBootWithAssets = observeSuccessfulBootAssets
+	SealKeyToModeenv                = sealKeyToModeenv
+	ResealKeyToModeenv              = resealKeyToModeenv
+	RecoveryBootChainsForSystems    = recoveryBootChainsForSystems
+	SealKeyModelParams              = sealKeyModelParams
+)
+
+type BootAssetsMap = bootAssetsMap
+type TrackedAsset = trackedAsset
+
+func (t *TrackedAsset) Equals(blName, name, hash string) error {
+	equal := t.hash == hash &&
+		t.name == name &&
+		t.blName == blName
+	if !equal {
+		return fmt.Errorf("not equal to bootloader %q tracked asset %v:%v", t.blName, t.name, t.hash)
+	}
+	return nil
+}
+
+func (o *TrustedAssetsInstallObserver) CurrentTrustedBootAssetsMap() BootAssetsMap {
+	return o.currentTrustedBootAssetsMap()
+}
+
+func (o *TrustedAssetsInstallObserver) CurrentTrustedRecoveryBootAssetsMap() BootAssetsMap {
+	return o.currentTrustedRecoveryBootAssetsMap()
+}
+
+func (o *TrustedAssetsInstallObserver) CurrentDataEncryptionKey() secboot.EncryptionKey {
+	return o.dataEncryptionKey
+}
+
+func (o *TrustedAssetsInstallObserver) CurrentSaveEncryptionKey() secboot.EncryptionKey {
+	return o.saveEncryptionKey
+}
+
+func MockSecbootSealKeys(f func(keys []secboot.SealKeyRequest, params *secboot.SealKeysParams) error) (restore func()) {
+	old := secbootSealKeys
+	secbootSealKeys = f
+	return func() {
+		secbootSealKeys = old
+	}
+}
+
+func MockSecbootResealKeys(f func(params *secboot.ResealKeysParams) error) (restore func()) {
+	old := secbootResealKeys
+	secbootResealKeys = f
+	return func() {
+		secbootResealKeys = old
+	}
+}
+
+func MockSeedReadSystemEssential(f func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error)) (restore func()) {
+	old := seedReadSystemEssential
+	seedReadSystemEssential = f
+	return func() {
+		seedReadSystemEssential = old
+	}
+}
+
+func (o *TrustedAssetsUpdateObserver) InjectChangedAsset(blName, assetName, hash string, recovery bool) {
+	ta := &trackedAsset{
+		blName: blName,
+		name:   assetName,
+		hash:   hash,
+	}
+	if !recovery {
+		o.changedAssets = append(o.changedAssets, ta)
+	} else {
+		o.seedChangedAssets = append(o.seedChangedAssets, ta)
+	}
+}
+
+type BootAsset = bootAsset
+type BootChain = bootChain
+type PredictableBootChains = predictableBootChains
+
+const (
+	BootChainEquivalent   = bootChainEquivalent
+	BootChainDifferent    = bootChainDifferent
+	BootChainUnrevisioned = bootChainUnrevisioned
+)
+
+var (
+	ToPredictableBootAsset              = toPredictableBootAsset
+	ToPredictableBootChain              = toPredictableBootChain
+	ToPredictableBootChains             = toPredictableBootChains
+	PredictableBootChainsEqualForReseal = predictableBootChainsEqualForReseal
+	BootAssetsToLoadChains              = bootAssetsToLoadChains
+	BootAssetLess                       = bootAssetLess
+	WriteBootChains                     = writeBootChains
+	ReadBootChains                      = readBootChains
+	IsResealNeeded                      = isResealNeeded
+)
+
+func (b *bootChain) SetModelAssertion(model *asserts.Model) {
+	b.model = model
+}
+
+func (b *bootChain) SetKernelBootFile(kbf bootloader.BootFile) {
+	b.kernelBootFile = kbf
+}
+
+func (b *bootChain) KernelBootFile() bootloader.BootFile {
+	return b.kernelBootFile
+}
+
+func MockHasFDESetupHook(f func() (bool, error)) (restore func()) {
+	oldHasFDESetupHook := HasFDESetupHook
+	HasFDESetupHook = f
+	return func() {
+		HasFDESetupHook = oldHasFDESetupHook
+	}
+}
+
+func MockRunFDESetupHook(f func(string, *FDESetupHookParams) ([]byte, error)) (restore func()) {
+	oldRunFDESetupHook := RunFDESetupHook
+	RunFDESetupHook = f
+	return func() { RunFDESetupHook = oldRunFDESetupHook }
+}
+
+func MockResealKeyToModeenvUsingFDESetupHook(f func(string, *asserts.Model, *Modeenv, bool) error) (restore func()) {
+	old := resealKeyToModeenvUsingFDESetupHook
+	resealKeyToModeenvUsingFDESetupHook = f
+	return func() {
+		resealKeyToModeenvUsingFDESetupHook = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/boot/initramfs20dirs.go snapd-2.48.3+20.04/boot/initramfs20dirs.go
--- snapd-2.45.1+20.04.2/boot/initramfs20dirs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/initramfs20dirs.go	2021-02-02 08:21:12.000000000 +0000
@@ -38,6 +38,10 @@
 	// during the initramfs, typically used in recover mode.
 	InitramfsHostUbuntuDataDir string
 
+	// InitramfsHostWritableDir is the location of the host writable
+	// partition during the initramfs, typically used in recover mode.
+	InitramfsHostWritableDir string
+
 	// InitramfsUbuntuBootDir is the location of ubuntu-boot during the
 	// initramfs.
 	InitramfsUbuntuBootDir string
@@ -46,6 +50,10 @@
 	// initramfs.
 	InitramfsUbuntuSeedDir string
 
+	// InitramfsUbuntuSaveDir is the location of ubuntu-save during the
+	// initramfs.
+	InitramfsUbuntuSaveDir string
+
 	// InitramfsWritableDir is the location of the writable partition during the
 	// initramfs. Note that this may refer to a temporary filesystem or a
 	// physical partition depending on what system mode the system is in.
@@ -56,20 +64,37 @@
 	// partition.
 	InstallHostWritableDir string
 
-	// InitramfsEncryptionKeyDir is the location of the encrypted partition keys
-	// during the initramfs.
-	InitramfsEncryptionKeyDir string
+	// InstallHostFDEDataDir is the location of the FDE data during install mode.
+	InstallHostFDEDataDir string
+
+	// InstallHostFDESaveDir is the directory of the FDE data on the
+	// ubuntu-save partition during install mode. For other modes,
+	// use dirs.SnapSaveFDEDirUnder().
+	InstallHostFDESaveDir string
+
+	// InitramfsSeedEncryptionKeyDir is the location of the encrypted partition
+	// keys during the initramfs on ubuntu-seed.
+	InitramfsSeedEncryptionKeyDir string
+
+	// InitramfsBootEncryptionKeyDir is the location of the encrypted partition
+	// keys during the initramfs on ubuntu-boot.
+	InitramfsBootEncryptionKeyDir string
 )
 
 func setInitramfsDirVars(rootdir string) {
 	InitramfsRunMntDir = filepath.Join(rootdir, "run/mnt")
 	InitramfsDataDir = filepath.Join(InitramfsRunMntDir, "data")
 	InitramfsHostUbuntuDataDir = filepath.Join(InitramfsRunMntDir, "host", "ubuntu-data")
+	InitramfsHostWritableDir = filepath.Join(InitramfsHostUbuntuDataDir, "system-data")
 	InitramfsUbuntuBootDir = filepath.Join(InitramfsRunMntDir, "ubuntu-boot")
 	InitramfsUbuntuSeedDir = filepath.Join(InitramfsRunMntDir, "ubuntu-seed")
+	InitramfsUbuntuSaveDir = filepath.Join(InitramfsRunMntDir, "ubuntu-save")
 	InstallHostWritableDir = filepath.Join(InitramfsRunMntDir, "ubuntu-data", "system-data")
+	InstallHostFDEDataDir = dirs.SnapFDEDirUnder(InstallHostWritableDir)
+	InstallHostFDESaveDir = filepath.Join(InitramfsUbuntuSaveDir, "device/fde")
 	InitramfsWritableDir = filepath.Join(InitramfsDataDir, "system-data")
-	InitramfsEncryptionKeyDir = filepath.Join(InitramfsUbuntuSeedDir, "device/fde")
+	InitramfsSeedEncryptionKeyDir = filepath.Join(InitramfsUbuntuSeedDir, "device/fde")
+	InitramfsBootEncryptionKeyDir = filepath.Join(InitramfsUbuntuBootDir, "device/fde")
 }
 
 func init() {
diff -Nru snapd-2.45.1+20.04.2/boot/initramfs.go snapd-2.48.3+20.04/boot/initramfs.go
--- snapd-2.45.1+20.04.2/boot/initramfs.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/initramfs.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,121 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot
+
+import (
+	"os/exec"
+	"time"
+
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snap"
+)
+
+// InitramfsRunModeSelectSnapsToMount returns a map of the snap paths to mount
+// for the specified snap types.
+func InitramfsRunModeSelectSnapsToMount(
+	typs []snap.Type,
+	modeenv *Modeenv,
+) (map[snap.Type]snap.PlaceInfo, error) {
+	var sn snap.PlaceInfo
+	var err error
+	m := make(map[snap.Type]snap.PlaceInfo)
+	for _, typ := range typs {
+		// TODO: consider passing a bootStateUpdate20 instead?
+		var selectSnapFn func(*Modeenv) (snap.PlaceInfo, error)
+		switch typ {
+		case snap.TypeBase:
+			bs := &bootState20Base{}
+			selectSnapFn = bs.selectAndCommitSnapInitramfsMount
+		case snap.TypeKernel:
+			blOpts := &bootloader.Options{
+				Role:        bootloader.RoleRunMode,
+				NoSlashBoot: true,
+			}
+			blDir := InitramfsUbuntuBootDir
+			bs := &bootState20Kernel{
+				blDir:  blDir,
+				blOpts: blOpts,
+			}
+			selectSnapFn = bs.selectAndCommitSnapInitramfsMount
+		}
+		sn, err = selectSnapFn(modeenv)
+		if err != nil {
+			return nil, err
+		}
+
+		m[typ] = sn
+	}
+
+	return m, nil
+}
+
+// EnsureNextBootToRunMode will mark the bootenv of the recovery bootloader such
+// that recover mode is now ready to switch back to run mode upon any reboot.
+func EnsureNextBootToRunMode(systemLabel string) error {
+	// at the end of the initramfs we need to set the bootenv such that a reboot
+	// now at any point will rollback to run mode without additional config or
+	// actions
+
+	opts := &bootloader.Options{
+		// setup the recovery bootloader
+		Role: bootloader.RoleRecovery,
+	}
+
+	bl, err := bootloader.Find(InitramfsUbuntuSeedDir, opts)
+	if err != nil {
+		return err
+	}
+
+	m := map[string]string{
+		"snapd_recovery_system": systemLabel,
+		"snapd_recovery_mode":   "run",
+	}
+	return bl.SetBootVars(m)
+}
+
+// initramfsReboot triggers a reboot from the initramfs immediately
+var initramfsReboot = func() error {
+	if osutil.IsTestBinary() {
+		panic("initramfsReboot must be mocked in tests")
+	}
+
+	out, err := exec.Command("/sbin/reboot").CombinedOutput()
+	if err != nil {
+		return osutil.OutputErr(out, err)
+	}
+
+	// reboot command in practice seems to not return, but apparently it is
+	// theoretically possible it could return, so to account for this we will
+	// loop for a "long" time waiting for the system to be rebooted, and panic
+	// after a timeout so that if something goes wrong with the reboot we do
+	// exit with some info about the expected reboot
+	time.Sleep(10 * time.Minute)
+	panic("expected reboot to happen within 10 minutes after calling /sbin/reboot")
+}
+
+func MockInitramfsReboot(f func() error) (restore func()) {
+	osutil.MustBeTestBinary("initramfsReboot only can be mocked in tests")
+	old := initramfsReboot
+	initramfsReboot = f
+	return func() {
+		initramfsReboot = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/boot/initramfs_test.go snapd-2.48.3+20.04/boot/initramfs_test.go
--- snapd-2.45.1+20.04.2/boot/initramfs_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/initramfs_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,632 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/boot/boottest"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/bootloadertest"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/snap"
+)
+
+type initramfsSuite struct {
+	baseBootenvSuite
+}
+
+var _ = Suite(&initramfsSuite{})
+
+func (s *initramfsSuite) SetUpTest(c *C) {
+	s.baseBootenvSuite.SetUpTest(c)
+}
+
+func (s *initramfsSuite) TestEnsureNextBootToRunMode(c *C) {
+	// with no bootloader available we can't mark successful
+	err := boot.EnsureNextBootToRunMode("label")
+	c.Assert(err, ErrorMatches, "cannot determine bootloader")
+
+	// forcing a bootloader works
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	err = boot.EnsureNextBootToRunMode("label")
+	c.Assert(err, IsNil)
+
+	// the bloader vars have been updated
+	m, err := bloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_mode":   "run",
+		"snapd_recovery_system": "label",
+	})
+}
+
+func (s *initramfsSuite) TestEnsureNextBootToRunModeRealBootloader(c *C) {
+	// create a real grub.cfg on ubuntu-seed
+	err := os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/ubuntu"), 0755)
+	c.Assert(err, IsNil)
+
+	err = ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/ubuntu", "grub.cfg"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	err = boot.EnsureNextBootToRunMode("somelabel")
+	c.Assert(err, IsNil)
+
+	opts := &bootloader.Options{
+		// setup the recovery bootloader
+		Role: bootloader.RoleRecovery,
+	}
+	bloader, err := bootloader.Find(boot.InitramfsUbuntuSeedDir, opts)
+	c.Assert(err, IsNil)
+	c.Assert(bloader.Name(), Equals, "grub")
+
+	// the bloader vars have been updated
+	m, err := bloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_mode":   "run",
+		"snapd_recovery_system": "somelabel",
+	})
+}
+
+func makeSnapFilesOnInitramfsUbuntuData(c *C, comment CommentInterface, snaps ...snap.PlaceInfo) (restore func()) {
+	// also make sure the snaps also exist on ubuntu-data
+	snapDir := dirs.SnapBlobDirUnder(boot.InitramfsWritableDir)
+	err := os.MkdirAll(snapDir, 0755)
+	c.Assert(err, IsNil, comment)
+	paths := make([]string, 0, len(snaps))
+	for _, sn := range snaps {
+		snPath := filepath.Join(snapDir, sn.Filename())
+		paths = append(paths, snPath)
+		err = ioutil.WriteFile(snPath, nil, 0644)
+		c.Assert(err, IsNil, comment)
+	}
+	return func() {
+		for _, path := range paths {
+			err := os.Remove(path)
+			c.Assert(err, IsNil, comment)
+		}
+	}
+}
+
+func (s *initramfsSuite) TestInitramfsRunModeSelectSnapsToMount(c *C) {
+	// make some snap infos we will use in the tests
+	kernel1, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
+	c.Assert(err, IsNil)
+
+	kernel2, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_2.snap")
+	c.Assert(err, IsNil)
+
+	base1, err := snap.ParsePlaceInfoFromSnapFileName("core20_1.snap")
+	c.Assert(err, IsNil)
+
+	base2, err := snap.ParsePlaceInfoFromSnapFileName("core20_2.snap")
+	c.Assert(err, IsNil)
+
+	baseT := snap.TypeBase
+	kernelT := snap.TypeKernel
+
+	tt := []struct {
+		m              *boot.Modeenv
+		expectedM      *boot.Modeenv
+		typs           []snap.Type
+		kernel         snap.PlaceInfo
+		trykernel      snap.PlaceInfo
+		blvars         map[string]string
+		snapsToMake    []snap.PlaceInfo
+		expected       map[snap.Type]snap.PlaceInfo
+		errPattern     string
+		comment        string
+		expRebootPanic string
+	}{
+		//
+		// default paths
+		//
+
+		// default base path
+		{
+			m:           &boot.Modeenv{Mode: "run", Base: base1.Filename()},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1},
+			expected:    map[snap.Type]snap.PlaceInfo{baseT: base1},
+			comment:     "default base path",
+		},
+		// default kernel path
+		{
+			m:           &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename()}},
+			kernel:      kernel1,
+			typs:        []snap.Type{kernelT},
+			snapsToMake: []snap.PlaceInfo{kernel1},
+			expected:    map[snap.Type]snap.PlaceInfo{kernelT: kernel1},
+			comment:     "default kernel path",
+		},
+
+		//
+		// happy kernel upgrade paths
+		//
+
+		// kernel upgrade path
+		{
+			m:           &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()}},
+			kernel:      kernel1,
+			trykernel:   kernel2,
+			typs:        []snap.Type{kernelT},
+			blvars:      map[string]string{"kernel_status": boot.TryingStatus},
+			snapsToMake: []snap.PlaceInfo{kernel1, kernel2},
+			expected:    map[snap.Type]snap.PlaceInfo{kernelT: kernel2},
+			comment:     "successful kernel upgrade path",
+		},
+		// extraneous kernel extracted/set, but kernel_status is default,
+		// so the bootloader will ignore that and boot the default kernel
+		// note that this test case is a bit ambiguous as we don't actually know
+		// in the initramfs that the bootloader actually booted the default
+		// kernel, we are just assuming that the bootloader implementation in
+		// the real world is robust enough to only boot the try kernel if and
+		// only if kernel_status is not DefaultStatus
+		{
+			m:           &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()}},
+			kernel:      kernel1,
+			trykernel:   kernel2,
+			typs:        []snap.Type{kernelT},
+			blvars:      map[string]string{"kernel_status": boot.DefaultStatus},
+			snapsToMake: []snap.PlaceInfo{kernel1, kernel2},
+			expected:    map[snap.Type]snap.PlaceInfo{kernelT: kernel1},
+			comment:     "fallback kernel upgrade path, due to kernel_status empty (default)",
+		},
+
+		//
+		// unhappy reboot fallback kernel paths
+		//
+
+		// kernel upgrade path, but reboots to fallback due to untrusted kernel from modeenv
+		{
+			m:              &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename()}},
+			kernel:         kernel1,
+			trykernel:      kernel2,
+			typs:           []snap.Type{kernelT},
+			blvars:         map[string]string{"kernel_status": boot.TryingStatus},
+			snapsToMake:    []snap.PlaceInfo{kernel1, kernel2},
+			expRebootPanic: "reboot due to modeenv untrusted try kernel",
+			comment:        "fallback kernel upgrade path, due to modeenv untrusted try kernel",
+		},
+		// kernel upgrade path, but reboots to fallback due to try kernel file not existing
+		{
+			m:              &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()}},
+			kernel:         kernel1,
+			trykernel:      kernel2,
+			typs:           []snap.Type{kernelT},
+			blvars:         map[string]string{"kernel_status": boot.TryingStatus},
+			snapsToMake:    []snap.PlaceInfo{kernel1},
+			expRebootPanic: "reboot due to try kernel file not existing",
+			comment:        "fallback kernel upgrade path, due to try kernel file not existing",
+		},
+		// kernel upgrade path, but reboots to fallback due to invalid kernel_status
+		{
+			m:              &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()}},
+			kernel:         kernel1,
+			trykernel:      kernel2,
+			typs:           []snap.Type{kernelT},
+			blvars:         map[string]string{"kernel_status": boot.TryStatus},
+			snapsToMake:    []snap.PlaceInfo{kernel1, kernel2},
+			expRebootPanic: "reboot due to kernel_status wrong",
+			comment:        "fallback kernel upgrade path, due to kernel_status wrong",
+		},
+
+		//
+		// unhappy initramfs fail kernel paths
+		//
+
+		// fallback kernel not trusted in modeenv
+		{
+			m:           &boot.Modeenv{Mode: "run"},
+			kernel:      kernel1,
+			typs:        []snap.Type{kernelT},
+			snapsToMake: []snap.PlaceInfo{kernel1},
+			errPattern:  fmt.Sprintf("fallback kernel snap %q is not trusted in the modeenv", kernel1.Filename()),
+			comment:     "fallback kernel not trusted in modeenv",
+		},
+		// fallback kernel file doesn't exist
+		{
+			m:          &boot.Modeenv{Mode: "run", CurrentKernels: []string{kernel1.Filename()}},
+			kernel:     kernel1,
+			typs:       []snap.Type{kernelT},
+			errPattern: fmt.Sprintf("kernel snap %q does not exist on ubuntu-data", kernel1.Filename()),
+			comment:    "fallback kernel file doesn't exist",
+		},
+
+		//
+		// happy base upgrade paths
+		//
+
+		// successful base upgrade path
+		{
+			m: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.TryStatus,
+			},
+			expectedM: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.TryingStatus,
+			},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1, base2},
+			expected:    map[snap.Type]snap.PlaceInfo{baseT: base2},
+			comment:     "successful base upgrade path",
+		},
+		// base upgrade path, but uses fallback due to try base file not existing
+		{
+			m: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.TryStatus,
+			},
+			expectedM: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.TryStatus,
+			},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1},
+			expected:    map[snap.Type]snap.PlaceInfo{baseT: base1},
+			comment:     "fallback base upgrade path, due to missing try base file",
+		},
+		// base upgrade path, but uses fallback due to base_status trying
+		{
+			m: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.TryingStatus,
+			},
+			expectedM: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.DefaultStatus,
+			},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1, base2},
+			expected:    map[snap.Type]snap.PlaceInfo{baseT: base1},
+			comment:     "fallback base upgrade path, due to base_status trying",
+		},
+		// base upgrade path, but uses fallback due to base_status default
+		{
+			m: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.DefaultStatus,
+			},
+			expectedM: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    base2.Filename(),
+				BaseStatus: boot.DefaultStatus,
+			},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1, base2},
+			expected:    map[snap.Type]snap.PlaceInfo{baseT: base1},
+			comment:     "fallback base upgrade path, due to missing base_status",
+		},
+
+		//
+		// unhappy base paths
+		//
+
+		// base snap unset
+		{
+			m:           &boot.Modeenv{Mode: "run"},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1},
+			errPattern:  "fallback base snap unusable: cannot get snap revision: modeenv base boot variable is empty",
+			comment:     "base snap unset in modeenv",
+		},
+		// base snap file doesn't exist
+		{
+			m:          &boot.Modeenv{Mode: "run", Base: base1.Filename()},
+			typs:       []snap.Type{baseT},
+			errPattern: fmt.Sprintf("base snap %q does not exist on ubuntu-data", base1.Filename()),
+			comment:    "base snap unset in modeenv",
+		},
+		// unhappy, but silent path with fallback, due to invalid try base snap name
+		{
+			m: &boot.Modeenv{
+				Mode:       "run",
+				Base:       base1.Filename(),
+				TryBase:    "bogusname",
+				BaseStatus: boot.TryStatus,
+			},
+			typs:        []snap.Type{baseT},
+			snapsToMake: []snap.PlaceInfo{base1},
+			expected:    map[snap.Type]snap.PlaceInfo{baseT: base1},
+			comment:     "corrupted base snap name",
+		},
+
+		//
+		// combined cases
+		//
+
+		// default
+		{
+			m: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				CurrentKernels: []string{kernel1.Filename()},
+			},
+			expectedM: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				CurrentKernels: []string{kernel1.Filename()},
+			},
+			kernel:      kernel1,
+			typs:        []snap.Type{baseT, kernelT},
+			snapsToMake: []snap.PlaceInfo{base1, kernel1},
+			expected: map[snap.Type]snap.PlaceInfo{
+				baseT:   base1,
+				kernelT: kernel1,
+			},
+			comment: "default combined kernel + base",
+		},
+		// combined, upgrade only the kernel
+		{
+			m: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()},
+			},
+			expectedM: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()},
+			},
+			kernel:      kernel1,
+			trykernel:   kernel2,
+			typs:        []snap.Type{baseT, kernelT},
+			blvars:      map[string]string{"kernel_status": boot.TryingStatus},
+			snapsToMake: []snap.PlaceInfo{base1, kernel1, kernel2},
+			expected: map[snap.Type]snap.PlaceInfo{
+				baseT:   base1,
+				kernelT: kernel2,
+			},
+			comment: "combined kernel + base, successful kernel upgrade",
+		},
+		// combined, upgrade only the base
+		{
+			m: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				TryBase:        base2.Filename(),
+				BaseStatus:     boot.TryStatus,
+				CurrentKernels: []string{kernel1.Filename()},
+			},
+			expectedM: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				TryBase:        base2.Filename(),
+				BaseStatus:     boot.TryingStatus,
+				CurrentKernels: []string{kernel1.Filename()},
+			},
+			kernel:      kernel1,
+			typs:        []snap.Type{baseT, kernelT},
+			snapsToMake: []snap.PlaceInfo{base1, base2, kernel1},
+			expected: map[snap.Type]snap.PlaceInfo{
+				baseT:   base2,
+				kernelT: kernel1,
+			},
+			comment: "combined kernel + base, successful base upgrade",
+		},
+		// bonus points: combined upgrade kernel and base
+		{
+			m: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				TryBase:        base2.Filename(),
+				BaseStatus:     boot.TryStatus,
+				CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()},
+			},
+			expectedM: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				TryBase:        base2.Filename(),
+				BaseStatus:     boot.TryingStatus,
+				CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()},
+			},
+			kernel:      kernel1,
+			trykernel:   kernel2,
+			typs:        []snap.Type{baseT, kernelT},
+			blvars:      map[string]string{"kernel_status": boot.TryingStatus},
+			snapsToMake: []snap.PlaceInfo{base1, base2, kernel1, kernel2},
+			expected: map[snap.Type]snap.PlaceInfo{
+				baseT:   base2,
+				kernelT: kernel2,
+			},
+			comment: "combined kernel + base, successful base + kernel upgrade",
+		},
+		// combined, fallback upgrade on kernel
+		{
+			m: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()},
+			},
+			expectedM: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				CurrentKernels: []string{kernel1.Filename(), kernel2.Filename()},
+			},
+			kernel:      kernel1,
+			trykernel:   kernel2,
+			typs:        []snap.Type{baseT, kernelT},
+			blvars:      map[string]string{"kernel_status": boot.DefaultStatus},
+			snapsToMake: []snap.PlaceInfo{base1, kernel1, kernel2},
+			expected: map[snap.Type]snap.PlaceInfo{
+				baseT:   base1,
+				kernelT: kernel1,
+			},
+			comment: "combined kernel + base, fallback kernel upgrade, due to missing boot var",
+		},
+		// combined, fallback upgrade on base
+		{
+			m: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				TryBase:        base2.Filename(),
+				BaseStatus:     boot.TryingStatus,
+				CurrentKernels: []string{kernel1.Filename()},
+			},
+			expectedM: &boot.Modeenv{
+				Mode:           "run",
+				Base:           base1.Filename(),
+				TryBase:        base2.Filename(),
+				BaseStatus:     boot.DefaultStatus,
+				CurrentKernels: []string{kernel1.Filename()},
+			},
+			kernel:      kernel1,
+			typs:        []snap.Type{baseT, kernelT},
+			snapsToMake: []snap.PlaceInfo{base1, base2, kernel1},
+			expected: map[snap.Type]snap.PlaceInfo{
+				baseT:   base1,
+				kernelT: kernel1,
+			},
+			comment: "combined kernel + base, fallback base upgrade, due to base_status trying",
+		},
+	}
+
+	// do both the normal uc20 bootloader and the env ref bootloader
+	bloaderTable := []struct {
+		bl interface {
+			bootloader.Bootloader
+			SetEnabledKernel(s snap.PlaceInfo) (restore func())
+			SetEnabledTryKernel(s snap.PlaceInfo) (restore func())
+		}
+		name string
+	}{
+		{
+			boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir())),
+			"env ref extracted kernel",
+		},
+		{
+			boottest.MockUC20EnvRefExtractedKernelRunBootenv(bootloadertest.Mock("mock", c.MkDir())),
+			"extracted run kernel image",
+		},
+	}
+
+	for _, tbl := range bloaderTable {
+		bl := tbl.bl
+		for _, t := range tt {
+			var cleanups []func()
+
+			comment := Commentf("[%s] %s", tbl.name, t.comment)
+
+			// we use a panic to simulate a reboot
+			if t.expRebootPanic != "" {
+				r := boot.MockInitramfsReboot(func() error {
+					panic(t.expRebootPanic)
+				})
+				cleanups = append(cleanups, r)
+			}
+
+			bootloader.Force(bl)
+			cleanups = append(cleanups, func() { bootloader.Force(nil) })
+
+			// set the bl kernel / try kernel
+			if t.kernel != nil {
+				cleanups = append(cleanups, bl.SetEnabledKernel(t.kernel))
+			}
+
+			if t.trykernel != nil {
+				cleanups = append(cleanups, bl.SetEnabledTryKernel(t.trykernel))
+			}
+
+			if t.blvars != nil {
+				c.Assert(bl.SetBootVars(t.blvars), IsNil, comment)
+				cleanBootVars := make(map[string]string, len(t.blvars))
+				for k := range t.blvars {
+					cleanBootVars[k] = ""
+				}
+				cleanups = append(cleanups, func() {
+					c.Assert(bl.SetBootVars(cleanBootVars), IsNil, comment)
+				})
+			}
+
+			if len(t.snapsToMake) != 0 {
+				r := makeSnapFilesOnInitramfsUbuntuData(c, comment, t.snapsToMake...)
+				cleanups = append(cleanups, r)
+			}
+
+			// write the modeenv to somewhere so we can read it and pass that to
+			// InitramfsRunModeChooseSnapsToMount
+			err := t.m.WriteTo(boot.InitramfsWritableDir)
+			// remove it because we are writing many modeenvs in this single test
+			cleanups = append(cleanups, func() {
+				c.Assert(os.Remove(dirs.SnapModeenvFileUnder(boot.InitramfsWritableDir)), IsNil, Commentf(t.comment))
+			})
+			c.Assert(err, IsNil, comment)
+
+			m, err := boot.ReadModeenv(boot.InitramfsWritableDir)
+			c.Assert(err, IsNil, comment)
+
+			if t.expRebootPanic != "" {
+				f := func() { boot.InitramfsRunModeSelectSnapsToMount(t.typs, m) }
+				c.Assert(f, PanicMatches, t.expRebootPanic, comment)
+			} else {
+				mountSnaps, err := boot.InitramfsRunModeSelectSnapsToMount(t.typs, m)
+				if t.errPattern != "" {
+					c.Assert(err, ErrorMatches, t.errPattern, comment)
+				} else {
+					c.Assert(err, IsNil, comment)
+					c.Assert(mountSnaps, DeepEquals, t.expected, comment)
+				}
+			}
+
+			// check that the modeenv changed as expected
+			if t.expectedM != nil {
+				newM, err := boot.ReadModeenv(boot.InitramfsWritableDir)
+				c.Assert(err, IsNil, comment)
+				c.Assert(newM.Base, Equals, t.expectedM.Base, comment)
+				c.Assert(newM.BaseStatus, Equals, t.expectedM.BaseStatus, comment)
+				c.Assert(newM.TryBase, Equals, t.expectedM.TryBase, comment)
+
+				// shouldn't be changing in the initramfs, but be safe
+				c.Assert(newM.CurrentKernels, DeepEquals, t.expectedM.CurrentKernels, comment)
+			}
+
+			// clean up
+			for _, r := range cleanups {
+				r()
+			}
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/boot/kernel_os_test.go snapd-2.48.3+20.04/boot/kernel_os_test.go
--- snapd-2.45.1+20.04.2/boot/kernel_os_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/kernel_os_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -77,7 +77,7 @@
 	info.RealName = "core"
 	info.Revision = snap.R(100)
 
-	bs := boot.NewCoreBootParticipant(info, info.GetType(), coreDev)
+	bs := boot.NewCoreBootParticipant(info, info.Type(), coreDev)
 	reboot, err := bs.SetNextBoot()
 	c.Assert(err, IsNil)
 
@@ -99,7 +99,7 @@
 	info.RealName = "core18"
 	info.Revision = snap.R(1818)
 
-	bs := boot.NewCoreBootParticipant(info, info.GetType(), coreDev)
+	bs := boot.NewCoreBootParticipant(info, info.Type(), coreDev)
 	reboot, err := bs.SetNextBoot()
 	c.Assert(err, IsNil)
 
@@ -148,7 +148,7 @@
 }
 
 func (s *bootenv20Suite) TestSetNextBoot20ForKernel(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -191,7 +191,7 @@
 }
 
 func (s *bootenv20EnvRefKernelSuite) TestSetNextBoot20ForKernel(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -245,7 +245,7 @@
 }
 
 func (s *bootenv20Suite) TestSetNextBoot20ForKernelForTheSameKernel(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -288,7 +288,7 @@
 }
 
 func (s *bootenv20EnvRefKernelSuite) TestSetNextBoot20ForKernelForTheSameKernel(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	r := setupUC20Bootenv(
@@ -348,7 +348,7 @@
 }
 
 func (s *bootenv20Suite) TestSetNextBoot20ForKernelForTheSameKernelTryMode(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// set all the same vars as if we were doing trying, except don't set a try
@@ -402,7 +402,7 @@
 }
 
 func (s *bootenv20EnvRefKernelSuite) TestSetNextBoot20ForKernelForTheSameKernelTryMode(c *C) {
-	coreDev := boottest.MockUC20Device("pc-kernel")
+	coreDev := boottest.MockUC20Device("", nil)
 	c.Assert(coreDev.HasModeenv(), Equals, true)
 
 	// set all the same vars as if we were doing trying, except don't set a try
@@ -477,9 +477,11 @@
 func (s *ubootSuite) forceUC20UbootBootloader(c *C) {
 	bootloader.Force(nil)
 
-	// to find the uboot bootloader we need to pass in NoSlashBoot because
-	// that's where the gadget assets get installed to
+	// for the uboot bootloader InstallBootConfig we pass in
+	// NoSlashBoot because that's where the gadget assets get
+	// installed to
 	installOpts := &bootloader.Options{
+		Role:        bootloader.RoleRunMode,
 		NoSlashBoot: true,
 	}
 
@@ -505,10 +507,9 @@
 	err = os.Rename(fn, targetFile)
 	c.Assert(err, IsNil)
 
-	// however when finding the bootloader, since we want it to show up as the
-	// "runtime" bootloader, just use ExtractedRunKernelImage
+	// find the run mode bootloader under /boot
 	runtimeOpts := &bootloader.Options{
-		ExtractedRunKernelImage: true,
+		Role: bootloader.RoleRunMode,
 	}
 
 	bloader, err := bootloader.Find("", runtimeOpts)
diff -Nru snapd-2.45.1+20.04.2/boot/makebootable.go snapd-2.48.3+20.04/boot/makebootable.go
--- snapd-2.45.1+20.04.2/boot/makebootable.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/makebootable.go	2021-02-02 08:21:12.000000000 +0000
@@ -54,13 +54,13 @@
 // rootdir points to an image filesystem (UC 16/18), image recovery
 // filesystem (UC20 at prepare-image time) or ephemeral system (UC20
 // install mode).
-func MakeBootable(model *asserts.Model, rootdir string, bootWith *BootableSet) error {
+func MakeBootable(model *asserts.Model, rootdir string, bootWith *BootableSet, sealer *TrustedAssetsInstallObserver) error {
 	if model.Grade() == asserts.ModelGradeUnset {
 		return makeBootable16(model, rootdir, bootWith)
 	}
 
 	if !bootWith.Recovery {
-		return makeBootable20RunMode(model, rootdir, bootWith)
+		return makeBootable20RunMode(model, rootdir, bootWith, sealer)
 	}
 	return makeBootable20(model, rootdir, bootWith)
 }
@@ -159,7 +159,7 @@
 	opts := &bootloader.Options{
 		PrepareImageTime: true,
 		// setup the recovery bootloader
-		Recovery: true,
+		Role: bootloader.RoleRecovery,
 	}
 
 	// install the bootloader configuration from the gadget
@@ -181,6 +181,8 @@
 	// ubuntu-seed
 	blVars := map[string]string{
 		"snapd_recovery_system": bootWith.RecoverySystemLabel,
+		// always set the mode as install
+		"snapd_recovery_mode": ModeInstall,
 	}
 	if err := bl.SetBootVars(blVars); err != nil {
 		return fmt.Errorf("cannot set recovery environment: %v", err)
@@ -225,9 +227,8 @@
 	return nil
 }
 
-func makeBootable20RunMode(model *asserts.Model, rootdir string, bootWith *BootableSet) error {
+func makeBootable20RunMode(model *asserts.Model, rootdir string, bootWith *BootableSet, sealer *TrustedAssetsInstallObserver) error {
 	// TODO:UC20:
-	// - create grub.cfg instead of using the gadget one
 	// - figure out what to do for uboot gadgets, currently we require them to
 	//   install the boot.sel onto ubuntu-boot directly, but the file should be
 	//   managed by snapd instead
@@ -256,10 +257,27 @@
 		}
 	}
 
+	// replicate the boot assets cache in host's writable
+	if err := CopyBootAssetsCacheToRoot(InstallHostWritableDir); err != nil {
+		return fmt.Errorf("cannot replicate boot assets cache: %v", err)
+	}
+
+	var currentTrustedBootAssets bootAssetsMap
+	var currentTrustedRecoveryBootAssets bootAssetsMap
+	if sealer != nil {
+		currentTrustedBootAssets = sealer.currentTrustedBootAssetsMap()
+		currentTrustedRecoveryBootAssets = sealer.currentTrustedRecoveryBootAssetsMap()
+	}
+	recoverySystemLabel := filepath.Base(bootWith.RecoverySystemDir)
 	// write modeenv on the ubuntu-data partition
 	modeenv := &Modeenv{
 		Mode:           "run",
-		RecoverySystem: filepath.Base(bootWith.RecoverySystemDir),
+		RecoverySystem: recoverySystemLabel,
+		// default to the system we were installed from
+		CurrentRecoverySystems:           []string{recoverySystemLabel},
+		CurrentTrustedBootAssets:         currentTrustedBootAssets,
+		CurrentTrustedRecoveryBootAssets: currentTrustedRecoveryBootAssets,
+		// keep this comment to make gofmt 1.9 happy
 		Base:           filepath.Base(bootWith.BasePath),
 		CurrentKernels: []string{bootWith.Kernel.Filename()},
 		BrandID:        model.BrandID(),
@@ -272,15 +290,19 @@
 
 	// get the ubuntu-boot bootloader and extract the kernel there
 	opts := &bootloader.Options{
+		// Bootloader for run mode
+		Role: bootloader.RoleRunMode,
 		// At this point the run mode bootloader is under the native
-		// layout, no /boot mount.
+		// run partition layout, no /boot mount.
 		NoSlashBoot: true,
-		// Bootloader that supports kernel asset extraction
-		ExtractedRunKernelImage: true,
 	}
-	bl, err := bootloader.Find(InitramfsUbuntuBootDir, opts)
+	// the bootloader config may have been installed when the ubuntu-boot
+	// partition was created, but for a trusted assets the bootloader config
+	// will be installed further down; for now identify the run mode
+	// bootloader by looking at the gadget
+	bl, err := bootloader.ForGadget(bootWith.UnpackedGadgetDir, InitramfsUbuntuBootDir, opts)
 	if err != nil {
-		return fmt.Errorf("internal error: cannot find run system bootloader: %v", err)
+		return fmt.Errorf("internal error: cannot identify run system bootloader: %v", err)
 	}
 
 	// extract the kernel first and mark kernel_status ready
@@ -330,12 +352,30 @@
 		return fmt.Errorf("cannot set run system environment: %v", err)
 	}
 
+	_, ok = bl.(bootloader.TrustedAssetsBootloader)
+	if ok {
+		// the bootloader can manage its boot config
+
+		// installing boot config must be performed after the boot
+		// partition has been populated with gadget data
+		if err := bl.InstallBootConfig(bootWith.UnpackedGadgetDir, opts); err != nil {
+			return fmt.Errorf("cannot install managed bootloader assets: %v", err)
+		}
+	}
+
+	if sealer != nil {
+		// seal the encryption key to the parameters specified in modeenv
+		if err := sealKeyToModeenv(sealer.dataEncryptionKey, sealer.saveEncryptionKey, model, modeenv); err != nil {
+			return err
+		}
+	}
+
 	// LAST step: update recovery bootloader environment to indicate that we
 	// transition to run mode now
 	opts = &bootloader.Options{
 		// let the bootloader know we will be touching the recovery
 		// partition
-		Recovery: true,
+		Role: bootloader.RoleRecovery,
 	}
 	bl, err = bootloader.Find(InitramfsUbuntuSeedDir, opts)
 	if err != nil {
diff -Nru snapd-2.45.1+20.04.2/boot/makebootable_test.go snapd-2.48.3+20.04/boot/makebootable_test.go
--- snapd-2.45.1+20.04.2/boot/makebootable_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/makebootable_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2019 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -28,17 +28,23 @@
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/boot/boottest"
 	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/assets"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
+	"github.com/snapcore/snapd/bootloader/grubenv"
 	"github.com/snapcore/snapd/bootloader/ubootenv"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/seed"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snapfile"
 	"github.com/snapcore/snapd/snap/snaptest"
 	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/timings"
 )
 
 type makeBootableSuite struct {
@@ -74,31 +80,15 @@
 }
 
 func (s *makeBootableSuite) TestMakeBootable(c *C) {
-	dirs.SetRootDir("")
-
-	headers := map[string]interface{}{
-		"type":         "model",
-		"authority-id": "my-brand",
-		"series":       "16",
-		"brand-id":     "my-brand",
-		"model":        "my-model",
-		"display-name": "My Model",
-		"architecture": "amd64",
-		"base":         "core18",
-		"gadget":       "pc=18",
-		"kernel":       "pc-kernel=18",
-		"timestamp":    "2018-01-01T08:00:00+00:00",
-	}
-	model := assertstest.FakeAssertion(headers).(*asserts.Model)
+	bootloader.Force(nil)
+	model := boottest.MakeMockModel()
 
 	grubCfg := []byte("#grub cfg")
 	unpackedGadgetDir := c.MkDir()
 	err := ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub.conf"), grubCfg, 0644)
 	c.Assert(err, IsNil)
 
-	rootdir := c.MkDir()
-
-	seedSnapsDirs := filepath.Join(rootdir, "/var/lib/snapd/seed", "snaps")
+	seedSnapsDirs := filepath.Join(s.rootdir, "/var/lib/snapd/seed", "snaps")
 	err = os.MkdirAll(seedSnapsDirs, 0755)
 	c.Assert(err, IsNil)
 
@@ -125,34 +115,31 @@
 		UnpackedGadgetDir: unpackedGadgetDir,
 	}
 
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
 	c.Assert(err, IsNil)
 
 	// check the bootloader config
-	m, err := s.bootloader.GetBootVars("snap_kernel", "snap_core", "snap_menuentry")
-	c.Assert(err, IsNil)
-	c.Check(m["snap_kernel"], Equals, "pc-kernel_5.snap")
-	c.Check(m["snap_core"], Equals, "core18_3.snap")
-	c.Check(m["snap_menuentry"], Equals, "My Model")
-
-	// kernel was extracted as needed
-	c.Check(s.bootloader.ExtractKernelAssetsCalls, DeepEquals, []snap.PlaceInfo{kernelInfo})
+	seedGenv := grubenv.NewEnv(filepath.Join(s.rootdir, "boot/grub/grubenv"))
+	c.Assert(seedGenv.Load(), IsNil)
+	c.Check(seedGenv.Get("snap_kernel"), Equals, "pc-kernel_5.snap")
+	c.Check(seedGenv.Get("snap_core"), Equals, "core18_3.snap")
+	c.Check(seedGenv.Get("snap_menuentry"), Equals, "My Model")
 
 	// check symlinks from snap blob dir
-	kernelBlob := filepath.Join(dirs.SnapBlobDirUnder(rootdir), kernelInfo.Filename())
-	dst, err := os.Readlink(filepath.Join(dirs.SnapBlobDirUnder(rootdir), kernelInfo.Filename()))
+	kernelBlob := filepath.Join(dirs.SnapBlobDirUnder(s.rootdir), kernelInfo.Filename())
+	dst, err := os.Readlink(filepath.Join(dirs.SnapBlobDirUnder(s.rootdir), kernelInfo.Filename()))
 	c.Assert(err, IsNil)
 	c.Check(dst, Equals, "../seed/snaps/pc-kernel_5.snap")
 	c.Check(kernelBlob, testutil.FilePresent)
 
-	baseBlob := filepath.Join(dirs.SnapBlobDirUnder(rootdir), baseInfo.Filename())
-	dst, err = os.Readlink(filepath.Join(dirs.SnapBlobDirUnder(rootdir), baseInfo.Filename()))
+	baseBlob := filepath.Join(dirs.SnapBlobDirUnder(s.rootdir), baseInfo.Filename())
+	dst, err = os.Readlink(filepath.Join(dirs.SnapBlobDirUnder(s.rootdir), baseInfo.Filename()))
 	c.Assert(err, IsNil)
 	c.Check(dst, Equals, "../seed/snaps/core18_3.snap")
 	c.Check(baseBlob, testutil.FilePresent)
 
 	// check that the bootloader (grub here) configuration was copied
-	c.Check(filepath.Join(rootdir, "boot", "grub/grub.cfg"), testutil.FileEquals, grubCfg)
+	c.Check(filepath.Join(s.rootdir, "boot", "grub/grub.cfg"), testutil.FileEquals, grubCfg)
 }
 
 type makeBootable20Suite struct {
@@ -184,50 +171,24 @@
 	s.forceBootloader(s.bootloader)
 }
 
-func makeMockUC20Model() *asserts.Model {
-	headers := map[string]interface{}{
-		"type":         "model",
-		"authority-id": "my-brand",
-		"series":       "16",
-		"brand-id":     "my-brand",
-		"model":        "my-model-uc20",
-		"display-name": "My Model",
-		"architecture": "amd64",
-		"base":         "core20",
-		"grade":        "dangerous",
-		"timestamp":    "2019-11-01T08:00:00+00:00",
-		"snaps": []interface{}{
-			map[string]interface{}{
-				"name": "pc-linux",
-				"id":   "pclinuxdidididididididididididid",
-				"type": "kernel",
-			},
-			map[string]interface{}{
-				"name": "pc",
-				"id":   "pcididididididididididididididid",
-				"type": "gadget",
-			},
-		},
-	}
-	return assertstest.FakeAssertion(headers).(*asserts.Model)
-}
-
 func (s *makeBootable20Suite) TestMakeBootable20(c *C) {
-	dirs.SetRootDir("")
-
-	model := makeMockUC20Model()
+	bootloader.Force(nil)
+	model := boottest.MakeMockUC20Model()
 
 	unpackedGadgetDir := c.MkDir()
 	grubRecoveryCfg := []byte("#grub-recovery cfg")
+	grubRecoveryCfgAsset := []byte("#grub-recovery cfg from assets")
 	err := ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub-recovery.conf"), grubRecoveryCfg, 0644)
+	restore := assets.MockInternal("grub-recovery.cfg", grubRecoveryCfgAsset)
+	defer restore()
+
 	c.Assert(err, IsNil)
 	grubCfg := []byte("#grub cfg")
 	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub.conf"), grubCfg, 0644)
 	c.Assert(err, IsNil)
 
-	rootdir := c.MkDir()
 	// on uc20 the seed layout if different
-	seedSnapsDirs := filepath.Join(rootdir, "/snaps")
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
 	err = os.MkdirAll(seedSnapsDirs, 0755)
 	c.Assert(err, IsNil)
 
@@ -261,34 +222,33 @@
 		Recovery:            true,
 	}
 
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
 	c.Assert(err, IsNil)
 
 	// ensure only a single file got copied (the grub.cfg)
-	files, err := filepath.Glob(filepath.Join(rootdir, "EFI/ubuntu/*"))
+	files, err := filepath.Glob(filepath.Join(s.rootdir, "EFI/ubuntu/*"))
 	c.Assert(err, IsNil)
-	c.Check(files, HasLen, 1)
-	// check that the recovery bootloader configuration was copied with
+	// grub.cfg and grubenv
+	c.Check(files, HasLen, 2)
+	// check that the recovery bootloader configuration was installed with
 	// the correct content
-	c.Check(filepath.Join(rootdir, "EFI/ubuntu/grub.cfg"), testutil.FileEquals, grubRecoveryCfg)
+	c.Check(filepath.Join(s.rootdir, "EFI/ubuntu/grub.cfg"), testutil.FileEquals, grubRecoveryCfgAsset)
 
 	// ensure no /boot was setup
-	c.Check(filepath.Join(rootdir, "boot"), testutil.FileAbsent)
+	c.Check(filepath.Join(s.rootdir, "boot"), testutil.FileAbsent)
 
 	// ensure the correct recovery system configuration was set
-	c.Check(s.bootloader.RecoverySystemDir, Equals, recoverySystemDir)
-	c.Check(s.bootloader.RecoverySystemBootVars, DeepEquals, map[string]string{
-		"snapd_recovery_kernel": "/snaps/pc-kernel_5.snap",
-	})
-	c.Check(s.bootloader.BootVars, DeepEquals, map[string]string{
-		"snapd_recovery_system": label,
-	})
+	seedGenv := grubenv.NewEnv(filepath.Join(s.rootdir, "EFI/ubuntu/grubenv"))
+	c.Assert(seedGenv.Load(), IsNil)
+	c.Check(seedGenv.Get("snapd_recovery_system"), Equals, label)
+
+	systemGenv := grubenv.NewEnv(filepath.Join(s.rootdir, recoverySystemDir, "grubenv"))
+	c.Assert(systemGenv.Load(), IsNil)
+	c.Check(systemGenv.Get("snapd_recovery_kernel"), Equals, "/snaps/pc-kernel_5.snap")
 }
 
 func (s *makeBootable20Suite) TestMakeBootable20UnsetRecoverySystemLabelError(c *C) {
-	dirs.SetRootDir("")
-
-	model := makeMockUC20Model()
+	model := boottest.MakeMockUC20Model()
 
 	unpackedGadgetDir := c.MkDir()
 	grubRecoveryCfg := []byte("#grub-recovery cfg")
@@ -298,8 +258,6 @@
 	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub.conf"), grubCfg, 0644)
 	c.Assert(err, IsNil)
 
-	rootdir := c.MkDir()
-
 	label := "20191209"
 	recoverySystemDir := filepath.Join("/systems", label)
 	bootWith := &boot.BootableSet{
@@ -308,34 +266,28 @@
 		Recovery:          true,
 	}
 
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
 	c.Assert(err, ErrorMatches, "internal error: recovery system label unset")
 }
 
 func (s *makeBootable20Suite) TestMakeBootable20MultipleRecoverySystemsError(c *C) {
-	dirs.SetRootDir("")
-
-	model := makeMockUC20Model()
+	model := boottest.MakeMockUC20Model()
 
 	bootWith := &boot.BootableSet{Recovery: true}
-	rootdir := c.MkDir()
-	err := os.MkdirAll(filepath.Join(rootdir, "systems/20191204"), 0755)
+	err := os.MkdirAll(filepath.Join(s.rootdir, "systems/20191204"), 0755)
 	c.Assert(err, IsNil)
-	err = os.MkdirAll(filepath.Join(rootdir, "systems/20191205"), 0755)
+	err = os.MkdirAll(filepath.Join(s.rootdir, "systems/20191205"), 0755)
 	c.Assert(err, IsNil)
 
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
 	c.Assert(err, ErrorMatches, "cannot make multiple recovery systems bootable yet")
 }
 
 func (s *makeBootable20Suite) TestMakeBootable20RunMode(c *C) {
-	dirs.SetRootDir("")
 	bootloader.Force(nil)
 
-	model := makeMockUC20Model()
-	rootdir := c.MkDir()
-	dirs.SetRootDir(rootdir)
-	seedSnapsDirs := filepath.Join(rootdir, "/snaps")
+	model := boottest.MakeMockUC20Model()
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
 	err := os.MkdirAll(seedSnapsDirs, 0755)
 	c.Assert(err, IsNil)
 
@@ -344,7 +296,19 @@
 	mockSeedGrubCfg := filepath.Join(mockSeedGrubDir, "grub.cfg")
 	err = os.MkdirAll(filepath.Dir(mockSeedGrubCfg), 0755)
 	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(mockSeedGrubCfg, nil, 0644)
+	err = ioutil.WriteFile(mockSeedGrubCfg, []byte("# Snapd-Boot-Config-Edition: 1\n"), 0644)
+	c.Assert(err, IsNil)
+
+	// setup recovery boot assets
+	err = os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/boot"), 0755)
+	c.Assert(err, IsNil)
+	// SHA3-384: 39efae6545f16e39633fbfbef0d5e9fdd45a25d7df8764978ce4d81f255b038046a38d9855e42e5c7c4024e153fd2e37
+	err = ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/boot/bootx64.efi"),
+		[]byte("recovery shim content"), 0644)
+	c.Assert(err, IsNil)
+	// SHA3-384: aa3c1a83e74bf6dd40dd64e5c5bd1971d75cdf55515b23b9eb379f66bf43d4661d22c4b8cf7d7a982d2013ab65c1c4c5
+	err = ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/boot/grubx64.efi"),
+		[]byte("recovery grub content"), 0644)
 	c.Assert(err, IsNil)
 
 	// grub on ubuntu-boot
@@ -355,6 +319,25 @@
 	err = ioutil.WriteFile(mockBootGrubCfg, nil, 0644)
 	c.Assert(err, IsNil)
 
+	unpackedGadgetDir := c.MkDir()
+	grubRecoveryCfg := []byte("#grub-recovery cfg")
+	grubRecoveryCfgAsset := []byte("#grub-recovery cfg from assets")
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub-recovery.conf"), grubRecoveryCfg, 0644)
+	c.Assert(err, IsNil)
+	restore := assets.MockInternal("grub-recovery.cfg", grubRecoveryCfgAsset)
+	defer restore()
+	grubCfg := []byte("#grub cfg")
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub.conf"), grubCfg, 0644)
+	c.Assert(err, IsNil)
+	grubCfgAsset := []byte("# Snapd-Boot-Config-Edition: 1\n#grub cfg from assets")
+	restore = assets.MockInternal("grub.cfg", grubCfgAsset)
+	defer restore()
+
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "bootx64.efi"), []byte("shim content"), 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grubx64.efi"), []byte("grub content"), 0644)
+	c.Assert(err, IsNil)
+
 	// make the snaps symlinks so that we can ensure that makebootable follows
 	// the symlinks and copies the files and not the symlinks
 	baseFn, baseInfo := makeSnap(c, "core20", `name: core20
@@ -383,11 +366,115 @@
 		KernelPath:        kernelInSeed,
 		Kernel:            kernelInfo,
 		Recovery:          false,
+		UnpackedGadgetDir: unpackedGadgetDir,
 	}
 
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	// set up observer state
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(model, unpackedGadgetDir, useEncryption)
+	c.Assert(obs, NotNil)
+	c.Assert(err, IsNil)
+	runBootStruct := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Role: gadget.SystemBoot,
+		},
+	}
+
+	// only grubx64.efi gets installed to system-boot
+	_, err = obs.Observe(gadget.ContentWrite, runBootStruct, boot.InitramfsUbuntuBootDir, "EFI/boot/grubx64.efi",
+		&gadget.ContentChange{After: filepath.Join(unpackedGadgetDir, "grubx64.efi")})
+	c.Assert(err, IsNil)
+
+	// observe recovery assets
+	err = obs.ObserveExistingTrustedRecoveryAssets(boot.InitramfsUbuntuSeedDir)
+	c.Assert(err, IsNil)
+
+	// set encryption key
+	myKey := secboot.EncryptionKey{}
+	myKey2 := secboot.EncryptionKey{}
+	for i := range myKey {
+		myKey[i] = byte(i)
+		myKey2[i] = byte(128 + i)
+	}
+	obs.ChosenEncryptionKeys(myKey, myKey2)
+
+	// set a mock recovery kernel
+	readSystemEssentialCalls := 0
+	restore = boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		readSystemEssentialCalls++
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-kernel_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 1},
+				RealName: "pc-kernel",
+			},
+		}
+		return model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	// set mock key sealing
+	sealKeysCalls := 0
+	restore = boot.MockSecbootSealKeys(func(keys []secboot.SealKeyRequest, params *secboot.SealKeysParams) error {
+		sealKeysCalls++
+		switch sealKeysCalls {
+		case 1:
+			c.Check(keys, HasLen, 1)
+			c.Check(keys[0].Key, DeepEquals, myKey)
+		case 2:
+			c.Check(keys, HasLen, 2)
+			c.Check(keys[0].Key, DeepEquals, myKey)
+			c.Check(keys[1].Key, DeepEquals, myKey2)
+		default:
+			c.Errorf("unexpected additional call to secboot.SealKeys (call # %d)", sealKeysCalls)
+		}
+		c.Assert(params.ModelParams, HasLen, 1)
+
+		shim := bootloader.NewBootFile("", filepath.Join(s.rootdir,
+			"var/lib/snapd/boot-assets/grub/bootx64.efi-39efae6545f16e39633fbfbef0d5e9fdd45a25d7df8764978ce4d81f255b038046a38d9855e42e5c7c4024e153fd2e37"),
+			bootloader.RoleRecovery)
+		grub := bootloader.NewBootFile("", filepath.Join(s.rootdir,
+			"var/lib/snapd/boot-assets/grub/grubx64.efi-aa3c1a83e74bf6dd40dd64e5c5bd1971d75cdf55515b23b9eb379f66bf43d4661d22c4b8cf7d7a982d2013ab65c1c4c5"),
+			bootloader.RoleRecovery)
+		runGrub := bootloader.NewBootFile("", filepath.Join(s.rootdir,
+			"var/lib/snapd/boot-assets/grub/grubx64.efi-5ee042c15e104b825d6bc15c41cdb026589f1ec57ed966dd3f29f961d4d6924efc54b187743fa3a583b62722882d405d"),
+			bootloader.RoleRunMode)
+		kernel := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+		runKernel := bootloader.NewBootFile(filepath.Join(s.rootdir, "var/lib/snapd/snaps/pc-kernel_5.snap"), "kernel.efi", bootloader.RoleRunMode)
+
+		switch sealKeysCalls {
+		case 1:
+			c.Assert(params.ModelParams[0].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shim, secboot.NewLoadChain(grub, secboot.NewLoadChain(kernel))),
+				secboot.NewLoadChain(shim, secboot.NewLoadChain(grub, secboot.NewLoadChain(runGrub, secboot.NewLoadChain(runKernel)))),
+			})
+			c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+				"snapd_recovery_mode=recover snapd_recovery_system=20191216 console=ttyS0 console=tty1 panic=-1",
+				"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+			})
+		case 2:
+			c.Assert(params.ModelParams[0].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shim, secboot.NewLoadChain(grub, secboot.NewLoadChain(kernel))),
+			})
+			c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+				"snapd_recovery_mode=recover snapd_recovery_system=20191216 console=ttyS0 console=tty1 panic=-1",
+			})
+		default:
+			c.Errorf("unexpected additional call to secboot.SealKeys (call # %d)", sealKeysCalls)
+		}
+
+		c.Assert(params.ModelParams[0].Model.DisplayName(), Equals, "My Model")
+
+		return nil
+	})
+	defer restore()
+
+	err = boot.MakeBootable(model, s.rootdir, bootWith, obs)
 	c.Assert(err, IsNil)
 
+	// ensure grub.cfg in boot was installed from internal assets
+	c.Check(mockBootGrubCfg, testutil.FileEquals, string(grubCfgAsset))
+
 	// ensure base/kernel got copied to /var/lib/snapd/snaps
 	core20Snap := filepath.Join(dirs.SnapBlobDirUnder(boot.InstallHostWritableDir), "core20_3.snap")
 	pcKernelSnap := filepath.Join(dirs.SnapBlobDirUnder(boot.InstallHostWritableDir), "pc-kernel_5.snap")
@@ -419,29 +506,313 @@
 	c.Check(extractedKernelSymlink, testutil.FilePresent)
 
 	// ensure modeenv looks correct
-	ubuntuDataModeEnvPath := filepath.Join(rootdir, "/run/mnt/ubuntu-data/system-data/var/lib/snapd/modeenv")
+	ubuntuDataModeEnvPath := filepath.Join(s.rootdir, "/run/mnt/ubuntu-data/system-data/var/lib/snapd/modeenv")
 	c.Check(ubuntuDataModeEnvPath, testutil.FileEquals, `mode=run
 recovery_system=20191216
+current_recovery_systems=20191216
 base=core20_3.snap
 current_kernels=pc-kernel_5.snap
 model=my-brand/my-model-uc20
 grade=dangerous
+current_trusted_boot_assets={"grubx64.efi":["5ee042c15e104b825d6bc15c41cdb026589f1ec57ed966dd3f29f961d4d6924efc54b187743fa3a583b62722882d405d"]}
+current_trusted_recovery_boot_assets={"bootx64.efi":["39efae6545f16e39633fbfbef0d5e9fdd45a25d7df8764978ce4d81f255b038046a38d9855e42e5c7c4024e153fd2e37"],"grubx64.efi":["aa3c1a83e74bf6dd40dd64e5c5bd1971d75cdf55515b23b9eb379f66bf43d4661d22c4b8cf7d7a982d2013ab65c1c4c5"]}
 `)
+	copiedGrubBin := filepath.Join(
+		dirs.SnapBootAssetsDirUnder(boot.InstallHostWritableDir),
+		"grub",
+		"grubx64.efi-5ee042c15e104b825d6bc15c41cdb026589f1ec57ed966dd3f29f961d4d6924efc54b187743fa3a583b62722882d405d",
+	)
+	copiedRecoveryGrubBin := filepath.Join(
+		dirs.SnapBootAssetsDirUnder(boot.InstallHostWritableDir),
+		"grub",
+		"grubx64.efi-aa3c1a83e74bf6dd40dd64e5c5bd1971d75cdf55515b23b9eb379f66bf43d4661d22c4b8cf7d7a982d2013ab65c1c4c5",
+	)
+	copiedRecoveryShimBin := filepath.Join(
+		dirs.SnapBootAssetsDirUnder(boot.InstallHostWritableDir),
+		"grub",
+		"bootx64.efi-39efae6545f16e39633fbfbef0d5e9fdd45a25d7df8764978ce4d81f255b038046a38d9855e42e5c7c4024e153fd2e37",
+	)
+
+	// only one file in the cache under new root
+	checkContentGlob(c, filepath.Join(dirs.SnapBootAssetsDirUnder(boot.InstallHostWritableDir), "grub", "*"), []string{
+		copiedRecoveryShimBin,
+		copiedGrubBin,
+		copiedRecoveryGrubBin,
+	})
+	// with the right content
+	c.Check(copiedGrubBin, testutil.FileEquals, "grub content")
+	c.Check(copiedRecoveryGrubBin, testutil.FileEquals, "recovery grub content")
+	c.Check(copiedRecoveryShimBin, testutil.FileEquals, "recovery shim content")
+
+	// make sure SealKey was called for the run object and the fallback object
+	c.Check(sealKeysCalls, Equals, 2)
+
+	// make sure the marker file for sealed key was created
+	c.Check(filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "sealed-keys"), testutil.FilePresent)
+
+	// make sure we wrote the boot chains data file
+	c.Check(filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "boot-chains"), testutil.FilePresent)
 }
 
-func (s *makeBootable20UbootSuite) TestUbootMakeBootable20TraditionalUbootenvFails(c *C) {
-	dirs.SetRootDir("")
+func (s *makeBootable20Suite) TestMakeBootable20RunModeInstallBootConfigErr(c *C) {
+	bootloader.Force(nil)
+
+	model := boottest.MakeMockUC20Model()
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
+	err := os.MkdirAll(seedSnapsDirs, 0755)
+	c.Assert(err, IsNil)
+
+	// grub on ubuntu-seed
+	mockSeedGrubDir := filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI", "ubuntu")
+	err = os.MkdirAll(mockSeedGrubDir, 0755)
+	c.Assert(err, IsNil)
+	// no recovery grub.cfg so that test fails if it ever reaches that point
+
+	// grub on ubuntu-boot
+	mockBootGrubDir := filepath.Join(boot.InitramfsUbuntuBootDir, "EFI", "ubuntu")
+	mockBootGrubCfg := filepath.Join(mockBootGrubDir, "grub.cfg")
+	err = os.MkdirAll(filepath.Dir(mockBootGrubCfg), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(mockBootGrubCfg, nil, 0644)
+	c.Assert(err, IsNil)
+
+	unpackedGadgetDir := c.MkDir()
+
+	// make the snaps symlinks so that we can ensure that makebootable follows
+	// the symlinks and copies the files and not the symlinks
+	baseFn, baseInfo := makeSnap(c, "core20", `name: core20
+type: base
+version: 5.0
+`, snap.R(3))
+	baseInSeed := filepath.Join(seedSnapsDirs, baseInfo.Filename())
+	err = os.Symlink(baseFn, baseInSeed)
+	c.Assert(err, IsNil)
+	kernelFn, kernelInfo := makeSnapWithFiles(c, "pc-kernel", `name: pc-kernel
+type: kernel
+version: 5.0
+`, snap.R(5),
+		[][]string{
+			{"kernel.efi", "I'm a kernel.efi"},
+		},
+	)
+	kernelInSeed := filepath.Join(seedSnapsDirs, kernelInfo.Filename())
+	err = os.Symlink(kernelFn, kernelInSeed)
+	c.Assert(err, IsNil)
+
+	bootWith := &boot.BootableSet{
+		RecoverySystemDir: "20191216",
+		BasePath:          baseInSeed,
+		Base:              baseInfo,
+		KernelPath:        kernelInSeed,
+		Kernel:            kernelInfo,
+		Recovery:          false,
+		UnpackedGadgetDir: unpackedGadgetDir,
+	}
+
+	// no grub marker in gadget directory raises an error
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
+	c.Assert(err, ErrorMatches, "internal error: cannot identify run system bootloader: cannot determine bootloader")
+
+	// set up grub.cfg in gadget
+	grubCfg := []byte("#grub cfg")
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub.conf"), grubCfg, 0644)
+	c.Assert(err, IsNil)
+
+	// no write access to destination directory
+	restore := assets.MockInternal("grub.cfg", nil)
+	defer restore()
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
+	c.Assert(err, ErrorMatches, `cannot install managed bootloader assets: internal error: no boot asset for "grub.cfg"`)
+}
+
+func (s *makeBootable20Suite) TestMakeBootable20RunModeSealKeyErr(c *C) {
+	bootloader.Force(nil)
+
+	model := boottest.MakeMockUC20Model()
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
+	err := os.MkdirAll(seedSnapsDirs, 0755)
+	c.Assert(err, IsNil)
+
+	// grub on ubuntu-seed
+	mockSeedGrubDir := filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI", "ubuntu")
+	mockSeedGrubCfg := filepath.Join(mockSeedGrubDir, "grub.cfg")
+	err = os.MkdirAll(filepath.Dir(mockSeedGrubCfg), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(mockSeedGrubCfg, []byte("# Snapd-Boot-Config-Edition: 1\n"), 0644)
+	c.Assert(err, IsNil)
+
+	// setup recovery boot assets
+	err = os.MkdirAll(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/boot"), 0755)
+	c.Assert(err, IsNil)
+	// SHA3-384: 39efae6545f16e39633fbfbef0d5e9fdd45a25d7df8764978ce4d81f255b038046a38d9855e42e5c7c4024e153fd2e37
+	err = ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/boot/bootx64.efi"),
+		[]byte("recovery shim content"), 0644)
+	c.Assert(err, IsNil)
+	// SHA3-384: aa3c1a83e74bf6dd40dd64e5c5bd1971d75cdf55515b23b9eb379f66bf43d4661d22c4b8cf7d7a982d2013ab65c1c4c5
+	err = ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "EFI/boot/grubx64.efi"),
+		[]byte("recovery grub content"), 0644)
+	c.Assert(err, IsNil)
+
+	// grub on ubuntu-boot
+	mockBootGrubDir := filepath.Join(boot.InitramfsUbuntuBootDir, "EFI", "ubuntu")
+	mockBootGrubCfg := filepath.Join(mockBootGrubDir, "grub.cfg")
+	err = os.MkdirAll(filepath.Dir(mockBootGrubCfg), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(mockBootGrubCfg, nil, 0644)
+	c.Assert(err, IsNil)
+
+	unpackedGadgetDir := c.MkDir()
+	grubRecoveryCfg := []byte("#grub-recovery cfg")
+	grubRecoveryCfgAsset := []byte("#grub-recovery cfg from assets")
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub-recovery.conf"), grubRecoveryCfg, 0644)
+	c.Assert(err, IsNil)
+	restore := assets.MockInternal("grub-recovery.cfg", grubRecoveryCfgAsset)
+	defer restore()
+	grubCfg := []byte("#grub cfg")
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grub.conf"), grubCfg, 0644)
+	c.Assert(err, IsNil)
+	grubCfgAsset := []byte("# Snapd-Boot-Config-Edition: 1\n#grub cfg from assets")
+	restore = assets.MockInternal("grub.cfg", grubCfgAsset)
+	defer restore()
+
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "bootx64.efi"), []byte("shim content"), 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "grubx64.efi"), []byte("grub content"), 0644)
+	c.Assert(err, IsNil)
 
-	model := makeMockUC20Model()
+	// make the snaps symlinks so that we can ensure that makebootable follows
+	// the symlinks and copies the files and not the symlinks
+	baseFn, baseInfo := makeSnap(c, "core20", `name: core20
+type: base
+version: 5.0
+`, snap.R(3))
+	baseInSeed := filepath.Join(seedSnapsDirs, baseInfo.Filename())
+	err = os.Symlink(baseFn, baseInSeed)
+	c.Assert(err, IsNil)
+	kernelFn, kernelInfo := makeSnapWithFiles(c, "pc-kernel", `name: pc-kernel
+type: kernel
+version: 5.0
+`, snap.R(5),
+		[][]string{
+			{"kernel.efi", "I'm a kernel.efi"},
+		},
+	)
+	kernelInSeed := filepath.Join(seedSnapsDirs, kernelInfo.Filename())
+	err = os.Symlink(kernelFn, kernelInSeed)
+	c.Assert(err, IsNil)
+
+	bootWith := &boot.BootableSet{
+		RecoverySystemDir: "20191216",
+		BasePath:          baseInSeed,
+		Base:              baseInfo,
+		KernelPath:        kernelInSeed,
+		Kernel:            kernelInfo,
+		Recovery:          false,
+		UnpackedGadgetDir: unpackedGadgetDir,
+	}
+
+	// set up observer state
+	useEncryption := true
+	obs, err := boot.TrustedAssetsInstallObserverForModel(model, unpackedGadgetDir, useEncryption)
+	c.Assert(obs, NotNil)
+	c.Assert(err, IsNil)
+	runBootStruct := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Role: gadget.SystemBoot,
+		},
+	}
+
+	// only grubx64.efi gets installed to system-boot
+	_, err = obs.Observe(gadget.ContentWrite, runBootStruct, boot.InitramfsUbuntuBootDir, "EFI/boot/grubx64.efi",
+		&gadget.ContentChange{After: filepath.Join(unpackedGadgetDir, "grubx64.efi")})
+	c.Assert(err, IsNil)
+
+	// observe recovery assets
+	err = obs.ObserveExistingTrustedRecoveryAssets(boot.InitramfsUbuntuSeedDir)
+	c.Assert(err, IsNil)
+
+	// set encryption key
+	myKey := secboot.EncryptionKey{}
+	myKey2 := secboot.EncryptionKey{}
+	for i := range myKey {
+		myKey[i] = byte(i)
+		myKey2[i] = byte(128 + i)
+	}
+	obs.ChosenEncryptionKeys(myKey, myKey2)
+
+	// set a mock recovery kernel
+	readSystemEssentialCalls := 0
+	restore = boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+		readSystemEssentialCalls++
+		kernelSnap := &seed.Snap{
+			Path: "/var/lib/snapd/seed/snaps/pc-kernel_1.snap",
+			SideInfo: &snap.SideInfo{
+				Revision: snap.Revision{N: 0},
+				RealName: "pc-kernel",
+			},
+		}
+		return model, []*seed.Snap{kernelSnap}, nil
+	})
+	defer restore()
+
+	// set mock key sealing
+	sealKeysCalls := 0
+	restore = boot.MockSecbootSealKeys(func(keys []secboot.SealKeyRequest, params *secboot.SealKeysParams) error {
+		sealKeysCalls++
+		switch sealKeysCalls {
+		case 1:
+			c.Check(keys, HasLen, 1)
+			c.Check(keys[0].Key, DeepEquals, myKey)
+		case 2:
+			c.Check(keys, HasLen, 2)
+			c.Check(keys[0].Key, DeepEquals, myKey)
+			c.Check(keys[1].Key, DeepEquals, myKey2)
+		default:
+			c.Errorf("unexpected additional call to secboot.SealKeys (call # %d)", sealKeysCalls)
+		}
+		c.Assert(params.ModelParams, HasLen, 1)
+
+		shim := bootloader.NewBootFile("", filepath.Join(s.rootdir,
+			"var/lib/snapd/boot-assets/grub/bootx64.efi-39efae6545f16e39633fbfbef0d5e9fdd45a25d7df8764978ce4d81f255b038046a38d9855e42e5c7c4024e153fd2e37"),
+			bootloader.RoleRecovery)
+		grub := bootloader.NewBootFile("", filepath.Join(s.rootdir,
+			"var/lib/snapd/boot-assets/grub/grubx64.efi-aa3c1a83e74bf6dd40dd64e5c5bd1971d75cdf55515b23b9eb379f66bf43d4661d22c4b8cf7d7a982d2013ab65c1c4c5"),
+			bootloader.RoleRecovery)
+		runGrub := bootloader.NewBootFile("", filepath.Join(s.rootdir,
+			"var/lib/snapd/boot-assets/grub/grubx64.efi-5ee042c15e104b825d6bc15c41cdb026589f1ec57ed966dd3f29f961d4d6924efc54b187743fa3a583b62722882d405d"),
+			bootloader.RoleRunMode)
+		kernel := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+		runKernel := bootloader.NewBootFile(filepath.Join(s.rootdir, "var/lib/snapd/snaps/pc-kernel_5.snap"), "kernel.efi", bootloader.RoleRunMode)
+
+		c.Assert(params.ModelParams[0].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+			secboot.NewLoadChain(shim, secboot.NewLoadChain(grub, secboot.NewLoadChain(kernel))),
+			secboot.NewLoadChain(shim, secboot.NewLoadChain(grub, secboot.NewLoadChain(runGrub, secboot.NewLoadChain(runKernel)))),
+		})
+		c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+			"snapd_recovery_mode=recover snapd_recovery_system=20191216 console=ttyS0 console=tty1 panic=-1",
+			"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+		})
+		c.Assert(params.ModelParams[0].Model.DisplayName(), Equals, "My Model")
+
+		return fmt.Errorf("seal error")
+	})
+	defer restore()
+
+	err = boot.MakeBootable(model, s.rootdir, bootWith, obs)
+	c.Assert(err, ErrorMatches, "cannot seal the encryption keys: seal error")
+}
+
+func (s *makeBootable20UbootSuite) TestUbootMakeBootable20TraditionalUbootenvFails(c *C) {
+	bootloader.Force(nil)
+	model := boottest.MakeMockUC20Model()
 
 	unpackedGadgetDir := c.MkDir()
 	ubootEnv := []byte("#uboot env")
 	err := ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "uboot.conf"), ubootEnv, 0644)
 	c.Assert(err, IsNil)
 
-	rootdir := c.MkDir()
 	// on uc20 the seed layout if different
-	seedSnapsDirs := filepath.Join(rootdir, "/snaps")
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
 	err = os.MkdirAll(seedSnapsDirs, 0755)
 	c.Assert(err, IsNil)
 
@@ -479,23 +850,20 @@
 	}
 
 	// TODO:UC20: enable this use case
-	err = boot.MakeBootable(model, rootdir, bootWith)
-	c.Assert(err, ErrorMatches, fmt.Sprintf("cannot find boot config in %q", unpackedGadgetDir))
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
+	c.Assert(err, ErrorMatches, "non-empty uboot.env not supported on UC20 yet")
 }
 
 func (s *makeBootable20UbootSuite) TestUbootMakeBootable20BootScr(c *C) {
-	dirs.SetRootDir("")
-
-	model := makeMockUC20Model()
+	model := boottest.MakeMockUC20Model()
 
 	unpackedGadgetDir := c.MkDir()
 	// the uboot.conf must be empty for this to work/do the right thing
 	err := ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "uboot.conf"), nil, 0644)
 	c.Assert(err, IsNil)
 
-	rootdir := c.MkDir()
 	// on uc20 the seed layout if different
-	seedSnapsDirs := filepath.Join(rootdir, "/snaps")
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
 	err = os.MkdirAll(seedSnapsDirs, 0755)
 	c.Assert(err, IsNil)
 
@@ -532,16 +900,17 @@
 		Recovery:            true,
 	}
 
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
 	c.Assert(err, IsNil)
 
 	// since uboot.conf was absent, we won't have installed the uboot.env, as
 	// it is expected that the gadget assets would have installed boot.scr
 	// instead
-	c.Check(filepath.Join(rootdir, "uboot.env"), testutil.FileAbsent)
+	c.Check(filepath.Join(s.rootdir, "uboot.env"), testutil.FileAbsent)
 
 	c.Check(s.bootloader.BootVars, DeepEquals, map[string]string{
 		"snapd_recovery_system": label,
+		"snapd_recovery_mode":   "install",
 	})
 
 	// ensure the correct recovery system configuration was set
@@ -555,14 +924,11 @@
 	)
 }
 
-func (s *makeBootable20UbootSuite) TestUbootMakeBootable20RunModeBootScr(c *C) {
-	dirs.SetRootDir("")
+func (s *makeBootable20UbootSuite) TestUbootMakeBootable20RunModeBootSel(c *C) {
 	bootloader.Force(nil)
 
-	model := makeMockUC20Model()
-	rootdir := c.MkDir()
-	dirs.SetRootDir(rootdir)
-	seedSnapsDirs := filepath.Join(rootdir, "/snaps")
+	model := boottest.MakeMockUC20Model()
+	seedSnapsDirs := filepath.Join(s.rootdir, "/snaps")
 	err := os.MkdirAll(seedSnapsDirs, 0755)
 	c.Assert(err, IsNil)
 
@@ -574,7 +940,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(env.Save(), IsNil)
 
-	// uboot on ubuntu-boot
+	// uboot on ubuntu-boot (as if it was installed when creating the partition)
 	mockBootUbootBootSel := filepath.Join(boot.InitramfsUbuntuBootDir, "uboot/ubuntu/boot.sel")
 	err = os.MkdirAll(filepath.Dir(mockBootUbootBootSel), 0755)
 	c.Assert(err, IsNil)
@@ -582,6 +948,9 @@
 	c.Assert(err, IsNil)
 	c.Assert(env.Save(), IsNil)
 
+	unpackedGadgetDir := c.MkDir()
+	c.Assert(ioutil.WriteFile(filepath.Join(unpackedGadgetDir, "uboot.conf"), nil, 0644), IsNil)
+
 	baseFn, baseInfo := makeSnap(c, "core20", `name: core20
 type: base
 version: 5.0
@@ -610,9 +979,9 @@
 		KernelPath:        kernelInSeed,
 		Kernel:            kernelInfo,
 		Recovery:          false,
+		UnpackedGadgetDir: unpackedGadgetDir,
 	}
-
-	err = boot.MakeBootable(model, rootdir, bootWith)
+	err = boot.MakeBootable(model, s.rootdir, bootWith, nil)
 	c.Assert(err, IsNil)
 
 	// ensure base/kernel got copied to /var/lib/snapd/snaps
@@ -641,9 +1010,10 @@
 	}
 
 	// ensure modeenv looks correct
-	ubuntuDataModeEnvPath := filepath.Join(rootdir, "/run/mnt/ubuntu-data/system-data/var/lib/snapd/modeenv")
+	ubuntuDataModeEnvPath := filepath.Join(s.rootdir, "/run/mnt/ubuntu-data/system-data/var/lib/snapd/modeenv")
 	c.Check(ubuntuDataModeEnvPath, testutil.FileEquals, `mode=run
 recovery_system=20191216
+current_recovery_systems=20191216
 base=core20_3.snap
 current_kernels=arm-kernel_5.snap
 model=my-brand/my-model-uc20
diff -Nru snapd-2.45.1+20.04.2/boot/modeenv.go snapd-2.48.3+20.04/boot/modeenv.go
--- snapd-2.45.1+20.04.2/boot/modeenv.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/modeenv.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -21,9 +21,13 @@
 
 import (
 	"bytes"
+	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
+	"reflect"
+	"sort"
 	"strings"
 
 	"github.com/mvo5/goconfigparser"
@@ -32,18 +36,32 @@
 	"github.com/snapcore/snapd/osutil"
 )
 
+type bootAssetsMap map[string][]string
+
 // Modeenv is a file on UC20 that provides additional information
 // about the current mode (run,recover,install)
 type Modeenv struct {
-	Mode           string
-	RecoverySystem string
-	Base           string
-	TryBase        string
-	BaseStatus     string
-	CurrentKernels []string
-	Model          string
-	BrandID        string
-	Grade          string
+	Mode                   string   `key:"mode"`
+	RecoverySystem         string   `key:"recovery_system"`
+	CurrentRecoverySystems []string `key:"current_recovery_systems"`
+	Base                   string   `key:"base"`
+	TryBase                string   `key:"try_base"`
+	BaseStatus             string   `key:"base_status"`
+	CurrentKernels         []string `key:"current_kernels"`
+	Model                  string   `key:"model"`
+	BrandID                string   `key:"model,secondary"`
+	Grade                  string   `key:"grade"`
+	// CurrentTrustedBootAssets is a map of a run bootloader's asset names to
+	// a list of hashes of the asset contents. Typically the first entry in
+	// the list is a hash of an asset the system currently boots with (or is
+	// expected to have booted with). The second entry, if present, is the
+	// hash of an entry added when an update of the asset was being applied
+	// and will become the sole entry after a successful boot.
+	CurrentTrustedBootAssets bootAssetsMap `key:"current_trusted_boot_assets"`
+	// CurrentTrustedRecoveryBootAssetsMap is a map of a recovery bootloader's
+	// asset names to a list of hashes of the asset contents. Used similarly
+	// to CurrentTrustedBootAssets.
+	CurrentTrustedRecoveryBootAssets bootAssetsMap `key:"current_trusted_recovery_boot_assets"`
 
 	// read is set to true when a modenv was read successfully
 	read bool
@@ -51,6 +69,43 @@
 	// originRootdir is set to the root whence the modeenv was
 	// read from, and where it will be written back to
 	originRootdir string
+
+	// extrakeys is all the keys in the modeenv we read from the file but don't
+	// understand, we keep track of this so that if we read a new modeenv with
+	// extra keys and need to rewrite it, we will write those new keys as well
+	extrakeys map[string]string
+}
+
+var modeenvKnownKeys = make(map[string]bool)
+
+func init() {
+	st := reflect.TypeOf(Modeenv{})
+	num := st.NumField()
+	for i := 0; i < num; i++ {
+		f := st.Field(i)
+		if f.PkgPath != "" {
+			// unexported
+			continue
+		}
+		key := f.Tag.Get("key")
+		if key == "" {
+			panic(fmt.Sprintf("modeenv %s field has no key tag", f.Name))
+		}
+		const secondaryModifier = ",secondary"
+		if strings.HasSuffix(key, secondaryModifier) {
+			// secondary field in a group fields
+			// corresponding to one file key
+			key := key[:len(key)-len(secondaryModifier)]
+			if !modeenvKnownKeys[key] {
+				panic(fmt.Sprintf("modeenv %s field marked as secondary for not yet defined key %q", f.Name, key))
+			}
+			continue
+		}
+		if modeenvKnownKeys[key] {
+			panic(fmt.Sprintf("modeenv key %q repeated on %s", key, f.Name))
+		}
+		modeenvKnownKeys[key] = true
+	}
 }
 
 func modeenvFile(rootdir string) string {
@@ -69,52 +124,87 @@
 	if err := cfg.ReadFile(modeenvPath); err != nil {
 		return nil, err
 	}
+
 	// TODO:UC20: should we check these errors and try to do something?
-	recoverySystem, _ := cfg.Get("", "recovery_system")
-	mode, _ := cfg.Get("", "mode")
-	base, _ := cfg.Get("", "base")
-	baseStatus, _ := cfg.Get("", "base_status")
-	tryBase, _ := cfg.Get("", "try_base")
+	m := Modeenv{
+		read:          true,
+		originRootdir: rootdir,
+		extrakeys:     make(map[string]string),
+	}
+	unmarshalModeenvValueFromCfg(cfg, "recovery_system", &m.RecoverySystem)
+	unmarshalModeenvValueFromCfg(cfg, "current_recovery_systems", &m.CurrentRecoverySystems)
+	unmarshalModeenvValueFromCfg(cfg, "mode", &m.Mode)
+	if m.Mode == "" {
+		return nil, fmt.Errorf("internal error: mode is unset")
+	}
+	unmarshalModeenvValueFromCfg(cfg, "base", &m.Base)
+	unmarshalModeenvValueFromCfg(cfg, "base_status", &m.BaseStatus)
+	unmarshalModeenvValueFromCfg(cfg, "try_base", &m.TryBase)
 
 	// current_kernels is a comma-delimited list in a string
-	kernelsString, _ := cfg.Get("", "current_kernels")
-	var kernels []string
-	if kernelsString != "" {
-		kernels = strings.Split(kernelsString, ",")
-		// drop empty strings
-		nonEmptyKernels := make([]string, 0, len(kernels))
-		for _, kernel := range kernels {
-			if kernel != "" {
-				nonEmptyKernels = append(nonEmptyKernels, kernel)
-			}
-		}
-		kernels = nonEmptyKernels
-	}
-	brand := ""
-	model := ""
-	brandSlashModel, _ := cfg.Get("", "model")
-	if bsmSplit := strings.SplitN(brandSlashModel, "/", 2); len(bsmSplit) == 2 {
-		if bsmSplit[0] != "" && bsmSplit[1] != "" {
-			brand = bsmSplit[0]
-			model = bsmSplit[1]
+	unmarshalModeenvValueFromCfg(cfg, "current_kernels", &m.CurrentKernels)
+	var bm modeenvModel
+	unmarshalModeenvValueFromCfg(cfg, "model", &bm)
+	m.BrandID = bm.brandID
+	m.Model = bm.model
+	// expect the caller to validate the grade
+	unmarshalModeenvValueFromCfg(cfg, "grade", &m.Grade)
+	unmarshalModeenvValueFromCfg(cfg, "current_trusted_boot_assets", &m.CurrentTrustedBootAssets)
+	unmarshalModeenvValueFromCfg(cfg, "current_trusted_recovery_boot_assets", &m.CurrentTrustedRecoveryBootAssets)
+
+	// save all the rest of the keys we don't understand
+	keys, err := cfg.Options("")
+	if err != nil {
+		return nil, err
+	}
+	for _, k := range keys {
+		if !modeenvKnownKeys[k] {
+			val, err := cfg.Get("", k)
+			if err != nil {
+				return nil, err
+			}
+			m.extrakeys[k] = val
 		}
 	}
-	// expect the caller to validate the grade
-	grade, _ := cfg.Get("", "grade")
 
-	return &Modeenv{
-		Mode:           mode,
-		RecoverySystem: recoverySystem,
-		Base:           base,
-		TryBase:        tryBase,
-		BaseStatus:     baseStatus,
-		CurrentKernels: kernels,
-		BrandID:        brand,
-		Grade:          grade,
-		Model:          model,
-		read:           true,
-		originRootdir:  rootdir,
-	}, nil
+	return &m, nil
+}
+
+// deepEqual compares two modeenvs to ensure they are textually the same. It
+// does not consider whether the modeenvs were read from disk or created purely
+// in memory. It also does not sort or otherwise mutate any sub-objects,
+// performing simple strict verification of sub-objects.
+func (m *Modeenv) deepEqual(m2 *Modeenv) bool {
+	b, err := json.Marshal(m)
+	if err != nil {
+		return false
+	}
+	b2, err := json.Marshal(m2)
+	if err != nil {
+		return false
+	}
+	return bytes.Equal(b, b2)
+}
+
+// Copy will make a deep copy of a Modeenv.
+func (m *Modeenv) Copy() (*Modeenv, error) {
+	// to avoid hard-coding all fields here and manually copying everything, we
+	// take the easy way out and serialize to json then re-import into a
+	// empty Modeenv
+	b, err := json.Marshal(m)
+	if err != nil {
+		return nil, err
+	}
+	m2 := &Modeenv{}
+	err = json.Unmarshal(b, m2)
+	if err != nil {
+		return nil, err
+	}
+
+	// manually copy the unexported fields as they won't be in the JSON
+	m2.read = m.read
+	m2.originRootdir = m.originRootdir
+	return m2, nil
 }
 
 // Write outputs the modeenv to the file where it was read, only valid on
@@ -134,24 +224,16 @@
 		return err
 	}
 	buf := bytes.NewBuffer(nil)
-	if m.Mode != "" {
-		fmt.Fprintf(buf, "mode=%s\n", m.Mode)
-	}
-	if m.RecoverySystem != "" {
-		fmt.Fprintf(buf, "recovery_system=%s\n", m.RecoverySystem)
-	}
-	if m.Base != "" {
-		fmt.Fprintf(buf, "base=%s\n", m.Base)
-	}
-	if m.TryBase != "" {
-		fmt.Fprintf(buf, "try_base=%s\n", m.TryBase)
-	}
-	if m.BaseStatus != "" {
-		fmt.Fprintf(buf, "base_status=%s\n", m.BaseStatus)
-	}
-	if len(m.CurrentKernels) != 0 {
-		fmt.Fprintf(buf, "current_kernels=%s\n", strings.Join(m.CurrentKernels, ","))
+	if m.Mode == "" {
+		return fmt.Errorf("internal error: mode is unset")
 	}
+	marshalModeenvEntryTo(buf, "mode", m.Mode)
+	marshalModeenvEntryTo(buf, "recovery_system", m.RecoverySystem)
+	marshalModeenvEntryTo(buf, "current_recovery_systems", m.CurrentRecoverySystems)
+	marshalModeenvEntryTo(buf, "base", m.Base)
+	marshalModeenvEntryTo(buf, "try_base", m.TryBase)
+	marshalModeenvEntryTo(buf, "base_status", m.BaseStatus)
+	marshalModeenvEntryTo(buf, "current_kernels", strings.Join(m.CurrentKernels, ","))
 	if m.Model != "" || m.Grade != "" {
 		if m.Model == "" {
 			return fmt.Errorf("internal error: model is unset")
@@ -159,10 +241,21 @@
 		if m.BrandID == "" {
 			return fmt.Errorf("internal error: brand is unset")
 		}
-		fmt.Fprintf(buf, "model=%s/%s\n", m.BrandID, m.Model)
+		marshalModeenvEntryTo(buf, "model", &modeenvModel{brandID: m.BrandID, model: m.Model})
 	}
-	if m.Grade != "" {
-		fmt.Fprintf(buf, "grade=%s\n", m.Grade)
+	marshalModeenvEntryTo(buf, "grade", m.Grade)
+	marshalModeenvEntryTo(buf, "current_trusted_boot_assets", m.CurrentTrustedBootAssets)
+	marshalModeenvEntryTo(buf, "current_trusted_recovery_boot_assets", m.CurrentTrustedRecoveryBootAssets)
+
+	// write all the extra keys at the end
+	// sort them for test convenience
+	extraKeys := make([]string, 0, len(m.extrakeys))
+	for k := range m.extrakeys {
+		extraKeys = append(extraKeys, k)
+	}
+	sort.Strings(extraKeys)
+	for _, k := range extraKeys {
+		marshalModeenvEntryTo(buf, k, m.extrakeys[k])
 	}
 
 	if err := osutil.AtomicWriteFile(modeenvPath, buf.Bytes(), 0644, 0); err != nil {
@@ -170,3 +263,140 @@
 	}
 	return nil
 }
+
+type modeenvValueMarshaller interface {
+	MarshalModeenvValue() (string, error)
+}
+
+type modeenvValueUnmarshaller interface {
+	UnmarshalModeenvValue(value string) error
+}
+
+// marshalModeenvEntryTo marshals to out what as value for an entry
+// with the given key. If what is empty this is a no-op.
+func marshalModeenvEntryTo(out io.Writer, key string, what interface{}) error {
+	var asString string
+	switch v := what.(type) {
+	case string:
+		if v == "" {
+			return nil
+		}
+		asString = v
+	case []string:
+		if len(v) == 0 {
+			return nil
+		}
+		asString = asModeenvStringList(v)
+	default:
+		if vm, ok := what.(modeenvValueMarshaller); ok {
+			marshalled, err := vm.MarshalModeenvValue()
+			if err != nil {
+				return fmt.Errorf("cannot marshal value for key %q: %v", key, err)
+			}
+			asString = marshalled
+		} else if jm, ok := what.(json.Marshaler); ok {
+			marshalled, err := jm.MarshalJSON()
+			if err != nil {
+				return fmt.Errorf("cannot marshal value for key %q as JSON: %v", key, err)
+			}
+			asString = string(marshalled)
+			if asString == "null" {
+				//  no need to keep nulls in the modeenv
+				return nil
+			}
+		} else {
+			return fmt.Errorf("internal error: cannot marshal unsupported type %T value %v for key %q", what, what, key)
+		}
+	}
+	_, err := fmt.Fprintf(out, "%s=%s\n", key, asString)
+	return err
+}
+
+// unmarshalModeenvValueFromCfg unmarshals the value of the entry with
+// th given key to dest. If there's no such entry dest might be left
+// empty.
+func unmarshalModeenvValueFromCfg(cfg *goconfigparser.ConfigParser, key string, dest interface{}) error {
+	if dest == nil {
+		return fmt.Errorf("internal error: cannot unmarshal to nil")
+	}
+	kv, _ := cfg.Get("", key)
+
+	switch v := dest.(type) {
+	case *string:
+		*v = kv
+	case *[]string:
+		*v = splitModeenvStringList(kv)
+	default:
+		if vm, ok := v.(modeenvValueUnmarshaller); ok {
+			if err := vm.UnmarshalModeenvValue(kv); err != nil {
+				return fmt.Errorf("cannot unmarshal modeenv value %q to %T: %v", kv, dest, err)
+			}
+			return nil
+		} else if jm, ok := v.(json.Unmarshaler); ok {
+			if len(kv) == 0 {
+				// leave jm empty
+				return nil
+			}
+			if err := jm.UnmarshalJSON([]byte(kv)); err != nil {
+				return fmt.Errorf("cannot unmarshal modeenv value %q as JSON to %T: %v", kv, dest, err)
+			}
+			return nil
+		}
+		return fmt.Errorf("internal error: cannot unmarshal value %q for unsupported type %T", kv, dest)
+	}
+	return nil
+}
+
+func splitModeenvStringList(v string) []string {
+	if v == "" {
+		return nil
+	}
+	split := strings.Split(v, ",")
+	// drop empty strings
+	nonEmpty := make([]string, 0, len(split))
+	for _, one := range split {
+		if one != "" {
+			nonEmpty = append(nonEmpty, one)
+		}
+	}
+	if len(nonEmpty) == 0 {
+		return nil
+	}
+	return nonEmpty
+}
+
+func asModeenvStringList(v []string) string {
+	return strings.Join(v, ",")
+}
+
+type modeenvModel struct {
+	brandID, model string
+}
+
+func (m *modeenvModel) MarshalModeenvValue() (string, error) {
+	return fmt.Sprintf("%s/%s", m.brandID, m.model), nil
+}
+
+func (m *modeenvModel) UnmarshalModeenvValue(brandSlashModel string) error {
+	if bsmSplit := strings.SplitN(brandSlashModel, "/", 2); len(bsmSplit) == 2 {
+		if bsmSplit[0] != "" && bsmSplit[1] != "" {
+			m.brandID = bsmSplit[0]
+			m.model = bsmSplit[1]
+		}
+	}
+	return nil
+}
+
+func (b bootAssetsMap) MarshalJSON() ([]byte, error) {
+	asMap := map[string][]string(b)
+	return json.Marshal(asMap)
+}
+
+func (b *bootAssetsMap) UnmarshalJSON(data []byte) error {
+	var asMap map[string][]string
+	if err := json.Unmarshal(data, &asMap); err != nil {
+		return err
+	}
+	*b = bootAssetsMap(asMap)
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/boot/modeenv_test.go snapd-2.48.3+20.04/boot/modeenv_test.go
--- snapd-2.45.1+20.04.2/boot/modeenv_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/boot/modeenv_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -20,10 +20,15 @@
 package boot_test
 
 import (
+	"bytes"
+	"encoding/json"
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 
+	"github.com/mvo5/goconfigparser"
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/boot"
@@ -46,6 +51,23 @@
 	s.mockModeenvPath = filepath.Join(s.tmpdir, dirs.SnapModeenvFile)
 }
 
+func (s *modeenvSuite) TestKnownKnown(c *C) {
+	// double check keys as found with reflect
+	c.Check(boot.ModeenvKnownKeys, DeepEquals, map[string]bool{
+		"mode":                     true,
+		"recovery_system":          true,
+		"current_recovery_systems": true,
+		"base":            true,
+		"try_base":        true,
+		"base_status":     true,
+		"current_kernels": true,
+		"model":           true,
+		"grade":           true,
+		"current_trusted_boot_assets":          true,
+		"current_trusted_recovery_boot_assets": true,
+	})
+}
+
 func (s *modeenvSuite) TestReadEmptyErrors(c *C) {
 	modeenv, err := boot.ReadModeenv("/no/such/file")
 	c.Assert(os.IsNotExist(err), Equals, true)
@@ -68,11 +90,8 @@
 	s.makeMockModeenvFile(c, "")
 
 	modeenv, err := boot.ReadModeenv(s.tmpdir)
-	c.Assert(err, IsNil)
-	c.Check(modeenv.Mode, Equals, "")
-	c.Check(modeenv.RecoverySystem, Equals, "")
-	// an empty modeenv still means the modeenv was set
-	c.Check(modeenv.WasRead(), Equals, true)
+	c.Assert(err, ErrorMatches, "internal error: mode is unset")
+	c.Assert(modeenv, IsNil)
 }
 
 func (s *modeenvSuite) TestReadMode(c *C) {
@@ -85,6 +104,178 @@
 	c.Check(modeenv.Base, Equals, "")
 }
 
+func (s *modeenvSuite) TestDeepEqualDiskVsMemoryInvariant(c *C) {
+	s.makeMockModeenvFile(c, `mode=recovery
+recovery_system=20191126
+base=core20_123.snap
+try_base=core20_124.snap
+base_status=try
+`)
+
+	diskModeenv, err := boot.ReadModeenv(s.tmpdir)
+	c.Assert(err, IsNil)
+	inMemoryModeenv := &boot.Modeenv{
+		Mode:           "recovery",
+		RecoverySystem: "20191126",
+		Base:           "core20_123.snap",
+		TryBase:        "core20_124.snap",
+		BaseStatus:     "try",
+	}
+	c.Assert(inMemoryModeenv.DeepEqual(diskModeenv), Equals, true)
+	c.Assert(diskModeenv.DeepEqual(inMemoryModeenv), Equals, true)
+}
+
+func (s *modeenvSuite) TestCopyDeepEquals(c *C) {
+	s.makeMockModeenvFile(c, `mode=recovery
+recovery_system=20191126
+base=core20_123.snap
+try_base=core20_124.snap
+base_status=try
+current_trusted_boot_assets={"thing1":["hash1","hash2"],"thing2":["hash3"]}
+`)
+
+	diskModeenv, err := boot.ReadModeenv(s.tmpdir)
+	c.Assert(err, IsNil)
+	inMemoryModeenv := &boot.Modeenv{
+		Mode:           "recovery",
+		RecoverySystem: "20191126",
+		Base:           "core20_123.snap",
+		TryBase:        "core20_124.snap",
+		BaseStatus:     "try",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"thing1": {"hash1", "hash2"},
+			"thing2": {"hash3"},
+		},
+	}
+
+	c.Assert(inMemoryModeenv.DeepEqual(diskModeenv), Equals, true)
+	c.Assert(diskModeenv.DeepEqual(inMemoryModeenv), Equals, true)
+
+	diskModeenv2, err := diskModeenv.Copy()
+	c.Assert(err, IsNil)
+	c.Assert(diskModeenv.DeepEqual(diskModeenv2), Equals, true)
+	c.Assert(diskModeenv2.DeepEqual(diskModeenv), Equals, true)
+	c.Assert(inMemoryModeenv.DeepEqual(diskModeenv2), Equals, true)
+	c.Assert(diskModeenv2.DeepEqual(inMemoryModeenv), Equals, true)
+
+	inMemoryModeenv2, err := inMemoryModeenv.Copy()
+	c.Assert(err, IsNil)
+	c.Assert(inMemoryModeenv.DeepEqual(inMemoryModeenv2), Equals, true)
+	c.Assert(inMemoryModeenv2.DeepEqual(inMemoryModeenv), Equals, true)
+	c.Assert(inMemoryModeenv2.DeepEqual(diskModeenv), Equals, true)
+	c.Assert(diskModeenv.DeepEqual(inMemoryModeenv2), Equals, true)
+}
+
+func (s *modeenvSuite) TestCopyDiskWriteWorks(c *C) {
+	s.makeMockModeenvFile(c, `mode=recovery
+recovery_system=20191126
+base=core20_123.snap
+try_base=core20_124.snap
+base_status=try
+`)
+
+	diskModeenv, err := boot.ReadModeenv(s.tmpdir)
+	c.Assert(err, IsNil)
+	dupDiskModeenv, err := diskModeenv.Copy()
+	c.Assert(err, IsNil)
+
+	// move the original file out of the way
+	err = os.Rename(dirs.SnapModeenvFileUnder(s.tmpdir), dirs.SnapModeenvFileUnder(s.tmpdir)+".orig")
+	c.Assert(err, IsNil)
+	c.Assert(dirs.SnapModeenvFileUnder(s.tmpdir), testutil.FileAbsent)
+
+	// write the duplicate, it should write to the same original location and it
+	// should be the same content
+	err = dupDiskModeenv.Write()
+	c.Assert(err, IsNil)
+	c.Assert(dirs.SnapModeenvFileUnder(s.tmpdir), testutil.FilePresent)
+	origBytes, err := ioutil.ReadFile(dirs.SnapModeenvFileUnder(s.tmpdir) + ".orig")
+	c.Assert(err, IsNil)
+	// the files should be the same
+	c.Assert(dirs.SnapModeenvFileUnder(s.tmpdir), testutil.FileEquals, string(origBytes))
+}
+
+func (s *modeenvSuite) TestCopyMemoryWriteFails(c *C) {
+	inMemoryModeenv := &boot.Modeenv{
+		Mode:           "recovery",
+		RecoverySystem: "20191126",
+		Base:           "core20_123.snap",
+		TryBase:        "core20_124.snap",
+		BaseStatus:     "try",
+	}
+	dupInMemoryModeenv, err := inMemoryModeenv.Copy()
+	c.Assert(err, IsNil)
+
+	// write the duplicate, it should fail
+	err = dupInMemoryModeenv.Write()
+	c.Assert(err, ErrorMatches, "internal error: must use WriteTo with modeenv not read from disk")
+}
+
+func (s *modeenvSuite) TestDeepEquals(c *C) {
+	// start with two identical modeenvs
+	modeenv1 := &boot.Modeenv{
+		Mode:                   "recovery",
+		RecoverySystem:         "20191126",
+		CurrentRecoverySystems: []string{"1", "2"},
+
+		Base:           "core20_123.snap",
+		TryBase:        "core20_124.snap",
+		BaseStatus:     "try",
+		CurrentKernels: []string{"k1", "k2"},
+
+		Model:   "model",
+		BrandID: "brand",
+		Grade:   "secured",
+
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"thing1": {"hash1", "hash2"},
+			"thing2": {"hash3"},
+		},
+	}
+
+	modeenv2 := &boot.Modeenv{
+		Mode:                   "recovery",
+		RecoverySystem:         "20191126",
+		CurrentRecoverySystems: []string{"1", "2"},
+
+		Base:           "core20_123.snap",
+		TryBase:        "core20_124.snap",
+		BaseStatus:     "try",
+		CurrentKernels: []string{"k1", "k2"},
+
+		Model:   "model",
+		BrandID: "brand",
+		Grade:   "secured",
+
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"thing1": {"hash1", "hash2"},
+			"thing2": {"hash3"},
+		},
+	}
+
+	// same object should be the same
+	c.Assert(modeenv1.DeepEqual(modeenv1), Equals, true)
+
+	// no difference should be the same at the start
+	c.Assert(modeenv1.DeepEqual(modeenv2), Equals, true)
+	c.Assert(modeenv2.DeepEqual(modeenv1), Equals, true)
+
+	// invert CurrentKernels
+	modeenv2.CurrentKernels = []string{"k2", "k1"}
+	c.Assert(modeenv1.DeepEqual(modeenv2), Equals, false)
+	c.Assert(modeenv2.DeepEqual(modeenv1), Equals, false)
+
+	// make CurrentKernels capitalized
+	modeenv2.CurrentKernels = []string{"K1", "k2"}
+	c.Assert(modeenv1.DeepEqual(modeenv2), Equals, false)
+	c.Assert(modeenv2.DeepEqual(modeenv1), Equals, false)
+
+	// make CurrentKernels disappear
+	modeenv2.CurrentKernels = nil
+	c.Assert(modeenv1.DeepEqual(modeenv2), Equals, false)
+	c.Assert(modeenv2.DeepEqual(modeenv1), Equals, false)
+}
+
 func (s *modeenvSuite) TestReadModeWithRecoverySystem(c *C) {
 	s.makeMockModeenvFile(c, `mode=recovery
 recovery_system=20191126
@@ -96,6 +287,62 @@
 	c.Check(modeenv.RecoverySystem, Equals, "20191126")
 }
 
+func (s *modeenvSuite) TestReadModeenvWithUnknownKeysKeepsWrites(c *C) {
+	s.makeMockModeenvFile(c, `first_unknown=thing
+mode=recovery
+recovery_system=20191126
+unknown_key=some unknown value
+a_key=other
+`)
+
+	modeenv, err := boot.ReadModeenv(s.tmpdir)
+	c.Assert(err, IsNil)
+	c.Check(modeenv.Mode, Equals, "recovery")
+	c.Check(modeenv.RecoverySystem, Equals, "20191126")
+
+	c.Assert(modeenv.Write(), IsNil)
+
+	c.Assert(s.mockModeenvPath, testutil.FileEquals, `mode=recovery
+recovery_system=20191126
+a_key=other
+first_unknown=thing
+unknown_key=some unknown value
+`)
+}
+
+func (s *modeenvSuite) TestReadModeenvWithUnknownKeysDeepEqualsSameWithoutUnknownKeys(c *C) {
+	s.makeMockModeenvFile(c, `first_unknown=thing
+mode=recovery
+recovery_system=20191126
+try_base=core20_124.snap
+base_status=try
+unknown_key=some unknown value
+current_trusted_boot_assets={"grubx64.efi":["hash1","hash2"]}
+current_trusted_recovery_boot_assets={"bootx64.efi":["shimhash1","shimhash2"],"grubx64.efi":["recovery-hash1"]}
+a_key=other
+`)
+
+	modeenvWithExtraKeys, err := boot.ReadModeenv(s.tmpdir)
+	c.Assert(err, IsNil)
+	c.Check(modeenvWithExtraKeys.Mode, Equals, "recovery")
+	c.Check(modeenvWithExtraKeys.RecoverySystem, Equals, "20191126")
+
+	// should be the same as one that with just those keys in memory
+	c.Assert(modeenvWithExtraKeys.DeepEqual(&boot.Modeenv{
+		Mode:           "recovery",
+		RecoverySystem: "20191126",
+		TryBase:        "core20_124.snap",
+		BaseStatus:     boot.TryStatus,
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"grubx64.efi": []string{"hash1", "hash2"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"bootx64.efi": []string{"shimhash1", "shimhash2"},
+			"grubx64.efi": []string{"recovery-hash1"},
+		},
+	}), Equals, true)
+}
+
 func (s *modeenvSuite) TestReadModeWithBase(c *C) {
 	s.makeMockModeenvFile(c, `mode=recovery
 recovery_system=20191126
@@ -254,8 +501,10 @@
 	c.Assert(s.mockModeenvPath, testutil.FileAbsent)
 
 	modeenv := &boot.Modeenv{
-		Mode:           "run",
-		RecoverySystem: "20191128",
+		Mode:                   "run",
+		RecoverySystem:         "20191128",
+		CurrentRecoverySystems: []string{"20191128", "2020-02-03", "20240101-FOO"},
+		// keep this comment to make gofmt 1.9 happy
 		Base:           "core20_321.snap",
 		TryBase:        "core20_322.snap",
 		BaseStatus:     boot.TryStatus,
@@ -266,9 +515,153 @@
 
 	c.Assert(s.mockModeenvPath, testutil.FileEquals, `mode=run
 recovery_system=20191128
+current_recovery_systems=20191128,2020-02-03,20240101-FOO
 base=core20_321.snap
 try_base=core20_322.snap
 base_status=try
 current_kernels=pc-kernel_1.snap,pc-kernel_2.snap
 `)
 }
+
+func (s *modeenvSuite) TestReadRecoverySystems(c *C) {
+	tt := []struct {
+		systemsString   string
+		expectedSystems []string
+	}{
+		{
+			"20191126",
+			[]string{"20191126"},
+		}, {
+			"20191128,2020-02-03,20240101-FOO",
+			[]string{"20191128", "2020-02-03", "20240101-FOO"},
+		},
+		{",,,", nil},
+		{"", nil},
+	}
+
+	for _, t := range tt {
+		c.Logf("tc: %q", t.systemsString)
+		s.makeMockModeenvFile(c, `mode=recovery
+recovery_system=20191126
+current_recovery_systems=`+t.systemsString+"\n")
+
+		modeenv, err := boot.ReadModeenv(s.tmpdir)
+		c.Assert(err, IsNil)
+		c.Check(modeenv.Mode, Equals, "recovery")
+		c.Check(modeenv.RecoverySystem, Equals, "20191126")
+		c.Check(modeenv.CurrentRecoverySystems, DeepEquals, t.expectedSystems)
+	}
+}
+
+type fancyDataBothMarshallers struct {
+	Foo []string
+}
+
+func (f *fancyDataBothMarshallers) MarshalModeenvValue() (string, error) {
+	return strings.Join(f.Foo, "#"), nil
+}
+
+func (f *fancyDataBothMarshallers) UnmarshalModeenvValue(v string) error {
+	f.Foo = strings.Split(v, "#")
+	return nil
+}
+
+func (f *fancyDataBothMarshallers) MarshalJSON() ([]byte, error) {
+	return nil, fmt.Errorf("unexpected call to JSON marshaller")
+}
+
+func (f *fancyDataBothMarshallers) UnmarshalJSON(data []byte) error {
+	return fmt.Errorf("unexpected call to JSON unmarshaller")
+}
+
+type fancyDataJSONOnly struct {
+	Foo []string
+}
+
+func (f *fancyDataJSONOnly) MarshalJSON() ([]byte, error) {
+	return json.Marshal(f.Foo)
+}
+
+func (f *fancyDataJSONOnly) UnmarshalJSON(data []byte) error {
+	return json.Unmarshal(data, &f.Foo)
+}
+
+func (s *modeenvSuite) TestFancyMarshalUnmarshal(c *C) {
+	var buf bytes.Buffer
+
+	dboth := fancyDataBothMarshallers{Foo: []string{"1", "two"}}
+	err := boot.MarshalModeenvEntryTo(&buf, "fancy", &dboth)
+	c.Assert(err, IsNil)
+	c.Check(buf.String(), Equals, `fancy=1#two
+`)
+
+	djson := fancyDataJSONOnly{Foo: []string{"1", "two", "with\nnewline"}}
+	err = boot.MarshalModeenvEntryTo(&buf, "fancy_json", &djson)
+	c.Assert(err, IsNil)
+	c.Check(buf.String(), Equals, `fancy=1#two
+fancy_json=["1","two","with\nnewline"]
+`)
+
+	cfg := goconfigparser.New()
+	cfg.AllowNoSectionHeader = true
+	err = cfg.Read(&buf)
+	c.Assert(err, IsNil)
+
+	var dbothRev fancyDataBothMarshallers
+	err = boot.UnmarshalModeenvValueFromCfg(cfg, "fancy", &dbothRev)
+	c.Assert(err, IsNil)
+	c.Check(dbothRev, DeepEquals, dboth)
+
+	var djsonRev fancyDataJSONOnly
+	err = boot.UnmarshalModeenvValueFromCfg(cfg, "fancy_json", &djsonRev)
+	c.Assert(err, IsNil)
+	c.Check(djsonRev, DeepEquals, djson)
+}
+
+func (s *modeenvSuite) TestFancyUnmarshalJSONEmpty(c *C) {
+	var buf bytes.Buffer
+
+	cfg := goconfigparser.New()
+	cfg.AllowNoSectionHeader = true
+	err := cfg.Read(&buf)
+	c.Assert(err, IsNil)
+
+	var djsonRev fancyDataJSONOnly
+	err = boot.UnmarshalModeenvValueFromCfg(cfg, "fancy_json", &djsonRev)
+	c.Assert(err, IsNil)
+	c.Check(djsonRev.Foo, IsNil)
+}
+
+func (s *modeenvSuite) TestMarshalCurrentTrustedBootAssets(c *C) {
+	c.Assert(s.mockModeenvPath, testutil.FileAbsent)
+
+	modeenv := &boot.Modeenv{
+		Mode:           "run",
+		RecoverySystem: "20191128",
+		CurrentTrustedBootAssets: boot.BootAssetsMap{
+			"grubx64.efi": []string{"hash1", "hash2"},
+		},
+		CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+			"grubx64.efi": []string{"recovery-hash1"},
+			"bootx64.efi": []string{"shimhash1", "shimhash2"},
+		},
+	}
+	err := modeenv.WriteTo(s.tmpdir)
+	c.Assert(err, IsNil)
+
+	c.Assert(s.mockModeenvPath, testutil.FileEquals, `mode=run
+recovery_system=20191128
+current_trusted_boot_assets={"grubx64.efi":["hash1","hash2"]}
+current_trusted_recovery_boot_assets={"bootx64.efi":["shimhash1","shimhash2"],"grubx64.efi":["recovery-hash1"]}
+`)
+
+	modeenvRead, err := boot.ReadModeenv(s.tmpdir)
+	c.Assert(err, IsNil)
+	c.Assert(modeenvRead.CurrentTrustedBootAssets, DeepEquals, boot.BootAssetsMap{
+		"grubx64.efi": []string{"hash1", "hash2"},
+	})
+	c.Assert(modeenvRead.CurrentTrustedRecoveryBootAssets, DeepEquals, boot.BootAssetsMap{
+		"grubx64.efi": []string{"recovery-hash1"},
+		"bootx64.efi": []string{"shimhash1", "shimhash2"},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/boot/seal.go snapd-2.48.3+20.04/boot/seal.go
--- snapd-2.45.1+20.04.2/boot/seal.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/seal.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,671 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/seed"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/strutil"
+	"github.com/snapcore/snapd/timings"
+)
+
+var (
+	secbootSealKeys   = secboot.SealKeys
+	secbootResealKeys = secboot.ResealKeys
+
+	seedReadSystemEssential = seed.ReadSystemEssential
+)
+
+// Hook functions setup by devicestate to support device-specific full
+// disk encryption implementations. The state must be locked when these
+// functions are called.
+var (
+	HasFDESetupHook = func() (bool, error) {
+		return false, nil
+	}
+	RunFDESetupHook = func(op string, params *FDESetupHookParams) ([]byte, error) {
+		return nil, fmt.Errorf("internal error: RunFDESetupHook not set yet")
+	}
+)
+
+type sealingMethod string
+
+const (
+	sealingMethodLegacyTPM    = sealingMethod("")
+	sealingMethodTPM          = sealingMethod("tpm")
+	sealingMethodFDESetupHook = sealingMethod("fde-setup-hook")
+)
+
+// FDESetupHookParams contains the inputs for the fde-setup hook
+type FDESetupHookParams struct {
+	Key     secboot.EncryptionKey
+	KeyName string
+
+	Models []*asserts.Model
+
+	//TODO:UC20: provide bootchains and a way to track measured
+	//boot-assets
+}
+
+func bootChainsFileUnder(rootdir string) string {
+	return filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains")
+}
+
+func recoveryBootChainsFileUnder(rootdir string) string {
+	return filepath.Join(dirs.SnapFDEDirUnder(rootdir), "recovery-boot-chains")
+}
+
+// sealKeyToModeenv seals the supplied keys to the parameters specified
+// in modeenv.
+// It assumes to be invoked in install mode.
+func sealKeyToModeenv(key, saveKey secboot.EncryptionKey, model *asserts.Model, modeenv *Modeenv) error {
+	// make sure relevant locations exist
+	for _, p := range []string{
+		InitramfsSeedEncryptionKeyDir,
+		InitramfsBootEncryptionKeyDir,
+		InstallHostFDEDataDir,
+		InstallHostFDESaveDir,
+	} {
+		// XXX: should that be 0700 ?
+		if err := os.MkdirAll(p, 0755); err != nil {
+			return err
+		}
+	}
+
+	hasHook, err := HasFDESetupHook()
+	if err != nil {
+		return fmt.Errorf("cannot check for fde-setup hook %v", err)
+	}
+	if hasHook {
+		return sealKeyToModeenvUsingFDESetupHook(key, saveKey, model, modeenv)
+	}
+
+	return sealKeyToModeenvUsingSecboot(key, saveKey, model, modeenv)
+}
+
+func runKeySealRequests(key secboot.EncryptionKey) []secboot.SealKeyRequest {
+	return []secboot.SealKeyRequest{
+		{
+			Key:     key,
+			KeyFile: filepath.Join(InitramfsBootEncryptionKeyDir, "ubuntu-data.sealed-key"),
+		},
+	}
+}
+
+func fallbackKeySealRequests(key, saveKey secboot.EncryptionKey) []secboot.SealKeyRequest {
+	return []secboot.SealKeyRequest{
+		{
+			Key:     key,
+			KeyFile: filepath.Join(InitramfsSeedEncryptionKeyDir, "ubuntu-data.recovery.sealed-key"),
+		},
+		{
+			Key:     saveKey,
+			KeyFile: filepath.Join(InitramfsSeedEncryptionKeyDir, "ubuntu-save.recovery.sealed-key"),
+		},
+	}
+}
+
+func sealKeyToModeenvUsingFDESetupHook(key, saveKey secboot.EncryptionKey, model *asserts.Model, modeenv *Modeenv) error {
+	// TODO: support full boot chains
+
+	for _, skr := range append(runKeySealRequests(key), fallbackKeySealRequests(key, saveKey)...) {
+		params := &FDESetupHookParams{
+			Key: skr.Key,
+			// TODO: decide what the right KeyName is
+			// KeyName: filepath.Base(skr.KeyFile),
+			Models: []*asserts.Model{model},
+		}
+		sealedKey, err := RunFDESetupHook("initial-setup", params)
+		if err != nil {
+			return err
+		}
+		if err := osutil.AtomicWriteFile(filepath.Join(skr.KeyFile), sealedKey, 0600, 0); err != nil {
+			return fmt.Errorf("cannot store key: %v", err)
+		}
+	}
+
+	if err := stampSealedKeys(InstallHostWritableDir, "fde-setup-hook"); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func sealKeyToModeenvUsingSecboot(key, saveKey secboot.EncryptionKey, model *asserts.Model, modeenv *Modeenv) error {
+	// build the recovery mode boot chain
+	rbl, err := bootloader.Find(InitramfsUbuntuSeedDir, &bootloader.Options{
+		Role: bootloader.RoleRecovery,
+	})
+	if err != nil {
+		return fmt.Errorf("cannot find the recovery bootloader: %v", err)
+	}
+	tbl, ok := rbl.(bootloader.TrustedAssetsBootloader)
+	if !ok {
+		// TODO:UC20: later the exact kind of bootloaders we expect here might change
+		return fmt.Errorf("internal error: cannot seal keys without a trusted assets bootloader")
+	}
+
+	recoveryBootChains, err := recoveryBootChainsForSystems([]string{modeenv.RecoverySystem}, tbl, model, modeenv)
+	if err != nil {
+		return fmt.Errorf("cannot compose recovery boot chains: %v", err)
+	}
+
+	// build the run mode boot chains
+	bl, err := bootloader.Find(InitramfsUbuntuBootDir, &bootloader.Options{
+		Role:        bootloader.RoleRunMode,
+		NoSlashBoot: true,
+	})
+	if err != nil {
+		return fmt.Errorf("cannot find the bootloader: %v", err)
+	}
+	cmdline, err := ComposeCandidateCommandLine(model)
+	if err != nil {
+		return fmt.Errorf("cannot compose the candidate command line: %v", err)
+	}
+
+	runModeBootChains, err := runModeBootChains(rbl, bl, model, modeenv, cmdline)
+	if err != nil {
+		return fmt.Errorf("cannot compose run mode boot chains: %v", err)
+	}
+
+	pbc := toPredictableBootChains(append(runModeBootChains, recoveryBootChains...))
+
+	roleToBlName := map[bootloader.Role]string{
+		bootloader.RoleRecovery: rbl.Name(),
+		bootloader.RoleRunMode:  bl.Name(),
+	}
+
+	// the boot chains we seal the fallback object to
+	rpbc := toPredictableBootChains(recoveryBootChains)
+
+	// gets written to a file by sealRunObjectKeys()
+	authKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return fmt.Errorf("cannot generate key for signing dynamic authorization policies: %v", err)
+	}
+
+	if err := sealRunObjectKeys(key, pbc, authKey, roleToBlName); err != nil {
+		return err
+	}
+
+	if err := sealFallbackObjectKeys(key, saveKey, rpbc, authKey, roleToBlName); err != nil {
+		return err
+	}
+
+	if err := stampSealedKeys(InstallHostWritableDir, sealingMethodTPM); err != nil {
+		return err
+	}
+
+	installBootChainsPath := bootChainsFileUnder(InstallHostWritableDir)
+	if err := writeBootChains(pbc, installBootChainsPath, 0); err != nil {
+		return err
+	}
+
+	installRecoveryBootChainsPath := recoveryBootChainsFileUnder(InstallHostWritableDir)
+	if err := writeBootChains(rpbc, installRecoveryBootChainsPath, 0); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func sealRunObjectKeys(key secboot.EncryptionKey, pbc predictableBootChains, authKey *ecdsa.PrivateKey, roleToBlName map[bootloader.Role]string) error {
+	modelParams, err := sealKeyModelParams(pbc, roleToBlName)
+	if err != nil {
+		return fmt.Errorf("cannot prepare for key sealing: %v", err)
+	}
+
+	sealKeyParams := &secboot.SealKeysParams{
+		ModelParams:            modelParams,
+		TPMPolicyAuthKey:       authKey,
+		TPMPolicyAuthKeyFile:   filepath.Join(InstallHostFDESaveDir, "tpm-policy-auth-key"),
+		TPMLockoutAuthFile:     filepath.Join(InstallHostFDESaveDir, "tpm-lockout-auth"),
+		TPMProvision:           true,
+		PCRPolicyCounterHandle: secboot.RunObjectPCRPolicyCounterHandle,
+	}
+	// The run object contains only the ubuntu-data key; the ubuntu-save key
+	// is then stored inside the encrypted data partition, so that the normal run
+	// path only unseals one object because unsealing is expensive.
+	// Furthermore, the run object key is stored on ubuntu-boot so that we do not
+	// need to continually write/read keys from ubuntu-seed.
+	if err := secbootSealKeys(runKeySealRequests(key), sealKeyParams); err != nil {
+		return fmt.Errorf("cannot seal the encryption keys: %v", err)
+	}
+
+	return nil
+}
+
+func sealFallbackObjectKeys(key, saveKey secboot.EncryptionKey, pbc predictableBootChains, authKey *ecdsa.PrivateKey, roleToBlName map[bootloader.Role]string) error {
+	// also seal the keys to the recovery bootchains as a fallback
+	modelParams, err := sealKeyModelParams(pbc, roleToBlName)
+	if err != nil {
+		return fmt.Errorf("cannot prepare for fallback key sealing: %v", err)
+	}
+	sealKeyParams := &secboot.SealKeysParams{
+		ModelParams:            modelParams,
+		TPMPolicyAuthKey:       authKey,
+		PCRPolicyCounterHandle: secboot.FallbackObjectPCRPolicyCounterHandle,
+	}
+	// The fallback object contains the ubuntu-data and ubuntu-save keys. The
+	// key files are stored on ubuntu-seed, separate from ubuntu-data so they
+	// can be used if ubuntu-data and ubuntu-boot are corrupted or unavailable.
+	if err := secbootSealKeys(fallbackKeySealRequests(key, saveKey), sealKeyParams); err != nil {
+		return fmt.Errorf("cannot seal the fallback encryption keys: %v", err)
+	}
+
+	return nil
+}
+
+func stampSealedKeys(rootdir string, content sealingMethod) error {
+	stamp := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "sealed-keys")
+	if err := os.MkdirAll(filepath.Dir(stamp), 0755); err != nil {
+		return fmt.Errorf("cannot create device fde state directory: %v", err)
+	}
+
+	if err := osutil.AtomicWriteFile(stamp, []byte(content), 0644, 0); err != nil {
+		return fmt.Errorf("cannot create fde sealed keys stamp file: %v", err)
+	}
+	return nil
+}
+
+var errNoSealedKeys = errors.New("no sealed keys")
+
+// sealedKeysMethod return whether any keys were sealed at all
+func sealedKeysMethod(rootdir string) (sm sealingMethod, err error) {
+	// TODO:UC20: consider more than the marker for cases where we reseal
+	// outside of run mode
+	stamp := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "sealed-keys")
+	content, err := ioutil.ReadFile(stamp)
+	if os.IsNotExist(err) {
+		return sm, errNoSealedKeys
+	}
+	return sealingMethod(content), err
+}
+
+// resealKeyToModeenv reseals the existing encryption key to the
+// parameters specified in modeenv.
+func resealKeyToModeenv(rootdir string, model *asserts.Model, modeenv *Modeenv, expectReseal bool) error {
+	method, err := sealedKeysMethod(rootdir)
+	if err == errNoSealedKeys {
+		// nothing to do
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	switch method {
+	case sealingMethodFDESetupHook:
+		return resealKeyToModeenvUsingFDESetupHook(rootdir, model, modeenv, expectReseal)
+	case sealingMethodTPM, sealingMethodLegacyTPM:
+		return resealKeyToModeenvSecboot(rootdir, model, modeenv, expectReseal)
+	default:
+		return fmt.Errorf("unknown key sealing method: %q", method)
+	}
+}
+
+var resealKeyToModeenvUsingFDESetupHook = resealKeyToModeenvUsingFDESetupHookImpl
+
+func resealKeyToModeenvUsingFDESetupHookImpl(rootdir string, model *asserts.Model, modeenv *Modeenv, expectReseal bool) error {
+	// TODO: Implement reseal using the fde-setup hook. This will
+	//       require a helper like "FDEShouldResealUsingSetupHook"
+	//       that will be set by devicestate and returns (bool,
+	//       error).  It needs to return "false" during seeding
+	//       because then there is no kernel available yet.  It
+	//       can though return true as soon as there's an active
+	//       kernel if seeded is false
+	//
+	//       It will also need to run HasFDESetupHook internally
+	//       and return an error if the hook goes missing
+	//       (e.g. because a kernel refresh losses the hook by
+	//       accident). It could also run features directly and
+	//       check for "reseal" in features.
+	return nil
+}
+
+func resealKeyToModeenvSecboot(rootdir string, model *asserts.Model, modeenv *Modeenv, expectReseal bool) error {
+	// build the recovery mode boot chain
+	rbl, err := bootloader.Find(InitramfsUbuntuSeedDir, &bootloader.Options{
+		Role: bootloader.RoleRecovery,
+	})
+	if err != nil {
+		return fmt.Errorf("cannot find the recovery bootloader: %v", err)
+	}
+	tbl, ok := rbl.(bootloader.TrustedAssetsBootloader)
+	if !ok {
+		// TODO:UC20: later the exact kind of bootloaders we expect here might change
+		return fmt.Errorf("internal error: sealed keys but not a trusted assets bootloader")
+	}
+	recoveryBootChains, err := recoveryBootChainsForSystems(modeenv.CurrentRecoverySystems, tbl, model, modeenv)
+	if err != nil {
+		return fmt.Errorf("cannot compose recovery boot chains: %v", err)
+	}
+
+	// build the run mode boot chains
+	bl, err := bootloader.Find(InitramfsUbuntuBootDir, &bootloader.Options{
+		Role:        bootloader.RoleRunMode,
+		NoSlashBoot: true,
+	})
+	if err != nil {
+		return fmt.Errorf("cannot find the bootloader: %v", err)
+	}
+	cmdline, err := ComposeCommandLine(model)
+	if err != nil {
+		return fmt.Errorf("cannot compose the run mode command line: %v", err)
+	}
+
+	runModeBootChains, err := runModeBootChains(rbl, bl, model, modeenv, cmdline)
+	if err != nil {
+		return fmt.Errorf("cannot compose run mode boot chains: %v", err)
+	}
+
+	// reseal the run object
+	pbc := toPredictableBootChains(append(runModeBootChains, recoveryBootChains...))
+
+	needed, nextCount, err := isResealNeeded(pbc, bootChainsFileUnder(rootdir), expectReseal)
+	if err != nil {
+		return err
+	}
+	if !needed {
+		logger.Debugf("reseal not necessary")
+		return nil
+	}
+	pbcJSON, _ := json.Marshal(pbc)
+	logger.Debugf("resealing (%d) to boot chains: %s", nextCount, pbcJSON)
+
+	roleToBlName := map[bootloader.Role]string{
+		bootloader.RoleRecovery: rbl.Name(),
+		bootloader.RoleRunMode:  bl.Name(),
+	}
+
+	saveFDEDir := dirs.SnapFDEDirUnderSave(dirs.SnapSaveDirUnder(rootdir))
+	authKeyFile := filepath.Join(saveFDEDir, "tpm-policy-auth-key")
+	if err := resealRunObjectKeys(pbc, authKeyFile, roleToBlName); err != nil {
+		return err
+	}
+	logger.Debugf("resealing (%d) succeeded", nextCount)
+
+	bootChainsPath := bootChainsFileUnder(rootdir)
+	if err := writeBootChains(pbc, bootChainsPath, nextCount); err != nil {
+		return err
+	}
+
+	// reseal the fallback object
+	rpbc := toPredictableBootChains(recoveryBootChains)
+
+	var nextFallbackCount int
+	needed, nextFallbackCount, err = isResealNeeded(rpbc, recoveryBootChainsFileUnder(rootdir), expectReseal)
+	if err != nil {
+		return err
+	}
+	if !needed {
+		logger.Debugf("fallback reseal not necessary")
+		return nil
+	}
+
+	rpbcJSON, _ := json.Marshal(rpbc)
+	logger.Debugf("resealing (%d) to recovery boot chains: %s", nextCount, rpbcJSON)
+
+	if err := resealFallbackObjectKeys(rpbc, authKeyFile, roleToBlName); err != nil {
+		return err
+	}
+	logger.Debugf("fallback resealing (%d) succeeded", nextFallbackCount)
+
+	recoveryBootChainsPath := recoveryBootChainsFileUnder(rootdir)
+	return writeBootChains(rpbc, recoveryBootChainsPath, nextFallbackCount)
+}
+
+func resealRunObjectKeys(pbc predictableBootChains, authKeyFile string, roleToBlName map[bootloader.Role]string) error {
+	// get model parameters from bootchains
+	modelParams, err := sealKeyModelParams(pbc, roleToBlName)
+	if err != nil {
+		return fmt.Errorf("cannot prepare for key resealing: %v", err)
+	}
+
+	// list all the key files to reseal
+	keyFiles := []string{
+		filepath.Join(InitramfsBootEncryptionKeyDir, "ubuntu-data.sealed-key"),
+	}
+
+	resealKeyParams := &secboot.ResealKeysParams{
+		ModelParams:          modelParams,
+		KeyFiles:             keyFiles,
+		TPMPolicyAuthKeyFile: authKeyFile,
+	}
+	if err := secbootResealKeys(resealKeyParams); err != nil {
+		return fmt.Errorf("cannot reseal the encryption key: %v", err)
+	}
+
+	return nil
+}
+
+func resealFallbackObjectKeys(pbc predictableBootChains, authKeyFile string, roleToBlName map[bootloader.Role]string) error {
+	// get model parameters from bootchains
+	modelParams, err := sealKeyModelParams(pbc, roleToBlName)
+	if err != nil {
+		return fmt.Errorf("cannot prepare for fallback key resealing: %v", err)
+	}
+
+	// list all the key files to reseal
+	keyFiles := []string{
+		filepath.Join(InitramfsSeedEncryptionKeyDir, "ubuntu-data.recovery.sealed-key"),
+		filepath.Join(InitramfsSeedEncryptionKeyDir, "ubuntu-save.recovery.sealed-key"),
+	}
+
+	resealKeyParams := &secboot.ResealKeysParams{
+		ModelParams:          modelParams,
+		KeyFiles:             keyFiles,
+		TPMPolicyAuthKeyFile: authKeyFile,
+	}
+	if err := secbootResealKeys(resealKeyParams); err != nil {
+		return fmt.Errorf("cannot reseal the fallback encryption keys: %v", err)
+	}
+
+	return nil
+}
+
+func recoveryBootChainsForSystems(systems []string, trbl bootloader.TrustedAssetsBootloader, model *asserts.Model, modeenv *Modeenv) (chains []bootChain, err error) {
+	for _, system := range systems {
+		// get the command line
+		cmdline, err := ComposeRecoveryCommandLine(model, system)
+		if err != nil {
+			return nil, fmt.Errorf("cannot obtain recovery kernel command line: %v", err)
+		}
+
+		// get kernel information from seed
+		perf := timings.New(nil)
+		_, snaps, err := seedReadSystemEssential(dirs.SnapSeedDir, system, []snap.Type{snap.TypeKernel}, perf)
+		if err != nil {
+			return nil, err
+		}
+		if len(snaps) != 1 {
+			return nil, fmt.Errorf("cannot obtain recovery kernel snap")
+		}
+		seedKernel := snaps[0]
+
+		var kernelRev string
+		if seedKernel.SideInfo.Revision.Store() {
+			kernelRev = seedKernel.SideInfo.Revision.String()
+		}
+
+		recoveryBootChain, err := trbl.RecoveryBootChain(seedKernel.Path)
+		if err != nil {
+			return nil, err
+		}
+
+		// get asset chains
+		assetChain, kbf, err := buildBootAssets(recoveryBootChain, modeenv)
+		if err != nil {
+			return nil, err
+		}
+
+		chains = append(chains, bootChain{
+			BrandID:        model.BrandID(),
+			Model:          model.Model(),
+			Grade:          model.Grade(),
+			ModelSignKeyID: model.SignKeyID(),
+			AssetChain:     assetChain,
+			Kernel:         seedKernel.SnapName(),
+			KernelRevision: kernelRev,
+			KernelCmdlines: []string{cmdline},
+			model:          model,
+			kernelBootFile: kbf,
+		})
+	}
+	return chains, nil
+}
+
+func runModeBootChains(rbl, bl bootloader.Bootloader, model *asserts.Model, modeenv *Modeenv, cmdline string) ([]bootChain, error) {
+	tbl, ok := rbl.(bootloader.TrustedAssetsBootloader)
+	if !ok {
+		return nil, fmt.Errorf("recovery bootloader doesn't support trusted assets")
+	}
+
+	chains := make([]bootChain, 0, len(modeenv.CurrentKernels))
+	for _, k := range modeenv.CurrentKernels {
+		info, err := snap.ParsePlaceInfoFromSnapFileName(k)
+		if err != nil {
+			return nil, err
+		}
+		runModeBootChain, err := tbl.BootChain(bl, info.MountFile())
+		if err != nil {
+			return nil, err
+		}
+
+		// get asset chains
+		assetChain, kbf, err := buildBootAssets(runModeBootChain, modeenv)
+		if err != nil {
+			return nil, err
+		}
+		var kernelRev string
+		if info.SnapRevision().Store() {
+			kernelRev = info.SnapRevision().String()
+		}
+		chains = append(chains, bootChain{
+			BrandID:        model.BrandID(),
+			Model:          model.Model(),
+			Grade:          model.Grade(),
+			ModelSignKeyID: model.SignKeyID(),
+			AssetChain:     assetChain,
+			Kernel:         info.SnapName(),
+			KernelRevision: kernelRev,
+			KernelCmdlines: []string{cmdline},
+			model:          model,
+			kernelBootFile: kbf,
+		})
+	}
+	return chains, nil
+}
+
+// buildBootAssets takes the BootFiles of a bootloader boot chain and
+// produces corresponding bootAssets with the matching current asset
+// hashes from modeenv plus it returns separately the last BootFile
+// which is for the kernel.
+func buildBootAssets(bootFiles []bootloader.BootFile, modeenv *Modeenv) (assets []bootAsset, kernel bootloader.BootFile, err error) {
+	assets = make([]bootAsset, len(bootFiles)-1)
+
+	// the last element is the kernel which is not a boot asset
+	for i, bf := range bootFiles[:len(bootFiles)-1] {
+		name := filepath.Base(bf.Path)
+		var hashes []string
+		var ok bool
+		if bf.Role == bootloader.RoleRecovery {
+			hashes, ok = modeenv.CurrentTrustedRecoveryBootAssets[name]
+		} else {
+			hashes, ok = modeenv.CurrentTrustedBootAssets[name]
+		}
+		if !ok {
+			return nil, kernel, fmt.Errorf("cannot find expected boot asset %s in modeenv", name)
+		}
+		assets[i] = bootAsset{
+			Role:   bf.Role,
+			Name:   name,
+			Hashes: hashes,
+		}
+	}
+
+	return assets, bootFiles[len(bootFiles)-1], nil
+}
+
+func sealKeyModelParams(pbc predictableBootChains, roleToBlName map[bootloader.Role]string) ([]*secboot.SealKeyModelParams, error) {
+	modelToParams := map[*asserts.Model]*secboot.SealKeyModelParams{}
+	modelParams := make([]*secboot.SealKeyModelParams, 0, len(pbc))
+
+	for _, bc := range pbc {
+		loadChains, err := bootAssetsToLoadChains(bc.AssetChain, bc.kernelBootFile, roleToBlName)
+		if err != nil {
+			return nil, fmt.Errorf("cannot build load chains with current boot assets: %s", err)
+		}
+
+		// group parameters by model, reuse an existing SealKeyModelParams
+		// if the model is the same.
+		if params, ok := modelToParams[bc.model]; ok {
+			params.KernelCmdlines = strutil.SortedListsUniqueMerge(params.KernelCmdlines, bc.KernelCmdlines)
+			params.EFILoadChains = append(params.EFILoadChains, loadChains...)
+		} else {
+			param := &secboot.SealKeyModelParams{
+				Model:          bc.model,
+				KernelCmdlines: bc.KernelCmdlines,
+				EFILoadChains:  loadChains,
+			}
+			modelParams = append(modelParams, param)
+			modelToParams[bc.model] = param
+		}
+	}
+
+	return modelParams, nil
+}
+
+// isResealNeeded returns true when the predictable boot chains provided as
+// input do not match the cached boot chains on disk under rootdir.
+// It also returns the next value for the reasel count that is saved
+// together with the boot chains.
+// A hint expectReseal can be provided, it is used when the matching
+// is ambigous because the boot chains contain unrevisioned kernels.
+func isResealNeeded(pbc predictableBootChains, bootChainsFile string, expectReseal bool) (ok bool, nextCount int, err error) {
+	previousPbc, c, err := readBootChains(bootChainsFile)
+	if err != nil {
+		return false, 0, err
+	}
+
+	switch predictableBootChainsEqualForReseal(pbc, previousPbc) {
+	case bootChainEquivalent:
+		return false, c + 1, nil
+	case bootChainUnrevisioned:
+		return expectReseal, c + 1, nil
+	case bootChainDifferent:
+	}
+	return true, c + 1, nil
+}
diff -Nru snapd-2.45.1+20.04.2/boot/seal_test.go snapd-2.48.3+20.04/boot/seal_test.go
--- snapd-2.45.1+20.04.2/boot/seal_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/boot/seal_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1044 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package boot_test
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/boot/boottest"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/seed"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/timings"
+)
+
+type sealSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&sealSuite{})
+
+func (s *sealSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	rootdir := c.MkDir()
+	dirs.SetRootDir(rootdir)
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
+}
+
+func (s *sealSuite) TestSealKeyToModeenv(c *C) {
+	for _, tc := range []struct {
+		sealErr error
+		err     string
+	}{
+		{sealErr: nil, err: ""},
+		{sealErr: errors.New("seal error"), err: "cannot seal the encryption keys: seal error"},
+	} {
+		rootdir := c.MkDir()
+		dirs.SetRootDir(rootdir)
+		defer dirs.SetRootDir("")
+
+		err := createMockGrubCfg(filepath.Join(rootdir, "run/mnt/ubuntu-seed"))
+		c.Assert(err, IsNil)
+
+		err = createMockGrubCfg(filepath.Join(rootdir, "run/mnt/ubuntu-boot"))
+		c.Assert(err, IsNil)
+
+		modeenv := &boot.Modeenv{
+			RecoverySystem: "20200825",
+			CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+				"grubx64.efi": []string{"grub-hash-1"},
+				"bootx64.efi": []string{"shim-hash-1"},
+			},
+
+			CurrentTrustedBootAssets: boot.BootAssetsMap{
+				"grubx64.efi": []string{"run-grub-hash-1"},
+			},
+
+			CurrentKernels: []string{"pc-kernel_500.snap"},
+		}
+
+		// mock asset cache
+		p := filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/bootx64.efi-shim-hash-1")
+		err = os.MkdirAll(filepath.Dir(p), 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(p, nil, 0644)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-grub-hash-1"), nil, 0644)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-run-grub-hash-1"), nil, 0644)
+		c.Assert(err, IsNil)
+
+		// set encryption key
+		myKey := secboot.EncryptionKey{}
+		myKey2 := secboot.EncryptionKey{}
+		for i := range myKey {
+			myKey[i] = byte(i)
+			myKey2[i] = byte(128 + i)
+		}
+
+		model := boottest.MakeMockUC20Model()
+
+		// set a mock recovery kernel
+		readSystemEssentialCalls := 0
+		restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+			readSystemEssentialCalls++
+			kernelSnap := &seed.Snap{
+				Path: "/var/lib/snapd/seed/snaps/pc-kernel_1.snap",
+				SideInfo: &snap.SideInfo{
+					RealName: "pc-kernel",
+					Revision: snap.Revision{N: 1},
+				},
+			}
+			return model, []*seed.Snap{kernelSnap}, nil
+		})
+		defer restore()
+
+		// set mock key sealing
+		sealKeysCalls := 0
+		restore = boot.MockSecbootSealKeys(func(keys []secboot.SealKeyRequest, params *secboot.SealKeysParams) error {
+			sealKeysCalls++
+			switch sealKeysCalls {
+			case 1:
+				// the run object seals only the ubuntu-data key
+				c.Check(params.TPMPolicyAuthKeyFile, Equals, filepath.Join(boot.InstallHostFDESaveDir, "tpm-policy-auth-key"))
+				c.Check(params.TPMLockoutAuthFile, Equals, filepath.Join(boot.InstallHostFDESaveDir, "tpm-lockout-auth"))
+
+				dataKeyFile := filepath.Join(rootdir, "/run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key")
+				c.Check(keys, DeepEquals, []secboot.SealKeyRequest{{Key: myKey, KeyFile: dataKeyFile}})
+			case 2:
+				// the fallback object seals the ubuntu-data and the ubuntu-save keys
+				c.Check(params.TPMPolicyAuthKeyFile, Equals, "")
+				c.Check(params.TPMLockoutAuthFile, Equals, "")
+
+				dataKeyFile := filepath.Join(rootdir, "/run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key")
+				saveKeyFile := filepath.Join(rootdir, "/run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key")
+				c.Check(keys, DeepEquals, []secboot.SealKeyRequest{{Key: myKey, KeyFile: dataKeyFile}, {Key: myKey2, KeyFile: saveKeyFile}})
+			default:
+				c.Errorf("unexpected additional call to secboot.SealKeys (call # %d)", sealKeysCalls)
+			}
+			c.Assert(params.ModelParams, HasLen, 1)
+			for _, d := range []string{boot.InitramfsSeedEncryptionKeyDir, boot.InstallHostFDEDataDir} {
+				ex, isdir, _ := osutil.DirExists(d)
+				c.Check(ex && isdir, Equals, true, Commentf("location %q does not exist or is not a directory", d))
+			}
+
+			shim := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/bootx64.efi-shim-hash-1"), bootloader.RoleRecovery)
+			grub := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-grub-hash-1"), bootloader.RoleRecovery)
+			runGrub := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-run-grub-hash-1"), bootloader.RoleRunMode)
+			kernel := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+			runKernel := bootloader.NewBootFile(filepath.Join(rootdir, "var/lib/snapd/snaps/pc-kernel_500.snap"), "kernel.efi", bootloader.RoleRunMode)
+
+			switch sealKeysCalls {
+			case 1:
+				c.Assert(params.ModelParams[0].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+					secboot.NewLoadChain(shim,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(kernel))),
+					secboot.NewLoadChain(shim,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(runGrub,
+								secboot.NewLoadChain(runKernel)))),
+				})
+				c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+					"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+				})
+			case 2:
+				c.Assert(params.ModelParams[0].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+					secboot.NewLoadChain(shim,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(kernel))),
+				})
+				c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+				})
+			default:
+				c.Errorf("unexpected additional call to secboot.SealKeys (call # %d)", sealKeysCalls)
+			}
+			c.Assert(params.ModelParams[0].Model.DisplayName(), Equals, "My Model")
+
+			return tc.sealErr
+		})
+		defer restore()
+
+		err = boot.SealKeyToModeenv(myKey, myKey2, model, modeenv)
+		if tc.sealErr != nil {
+			c.Assert(sealKeysCalls, Equals, 1)
+		} else {
+			c.Assert(sealKeysCalls, Equals, 2)
+		}
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+			continue
+		}
+
+		// verify the boot chains data file
+		pbc, cnt, err := boot.ReadBootChains(filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "boot-chains"))
+		c.Assert(err, IsNil)
+		c.Check(cnt, Equals, 0)
+		c.Check(pbc, DeepEquals, boot.PredictableBootChains{
+			boot.BootChain{
+				BrandID:        "my-brand",
+				Model:          "my-model-uc20",
+				Grade:          "dangerous",
+				ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+				AssetChain: []boot.BootAsset{
+					{
+						Role:   "recovery",
+						Name:   "bootx64.efi",
+						Hashes: []string{"shim-hash-1"},
+					},
+					{
+						Role:   "recovery",
+						Name:   "grubx64.efi",
+						Hashes: []string{"grub-hash-1"},
+					},
+				},
+				Kernel:         "pc-kernel",
+				KernelRevision: "1",
+				KernelCmdlines: []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+				},
+			},
+			boot.BootChain{
+				BrandID:        "my-brand",
+				Model:          "my-model-uc20",
+				Grade:          "dangerous",
+				ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+				AssetChain: []boot.BootAsset{
+					{
+						Role:   "recovery",
+						Name:   "bootx64.efi",
+						Hashes: []string{"shim-hash-1"},
+					},
+					{
+						Role:   "recovery",
+						Name:   "grubx64.efi",
+						Hashes: []string{"grub-hash-1"},
+					},
+					{
+						Role:   "run-mode",
+						Name:   "grubx64.efi",
+						Hashes: []string{"run-grub-hash-1"},
+					},
+				},
+				Kernel:         "pc-kernel",
+				KernelRevision: "500",
+				KernelCmdlines: []string{
+					"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+				},
+			},
+		})
+
+		// verify the recovery boot chains
+		pbc, cnt, err = boot.ReadBootChains(filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "recovery-boot-chains"))
+		c.Assert(err, IsNil)
+		c.Check(cnt, Equals, 0)
+		c.Check(pbc, DeepEquals, boot.PredictableBootChains{
+			boot.BootChain{
+				BrandID:        "my-brand",
+				Model:          "my-model-uc20",
+				Grade:          "dangerous",
+				ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+				AssetChain: []boot.BootAsset{
+					{
+						Role:   "recovery",
+						Name:   "bootx64.efi",
+						Hashes: []string{"shim-hash-1"},
+					},
+					{
+						Role:   "recovery",
+						Name:   "grubx64.efi",
+						Hashes: []string{"grub-hash-1"},
+					},
+				},
+				Kernel:         "pc-kernel",
+				KernelRevision: "1",
+				KernelCmdlines: []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+				},
+			},
+		})
+
+		// marker
+		marker := filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "sealed-keys")
+		c.Check(marker, testutil.FileEquals, "tpm")
+	}
+}
+
+// TODO:UC20: also test fallback reseal
+func (s *sealSuite) TestResealKeyToModeenv(c *C) {
+	var prevPbc boot.PredictableBootChains
+
+	for _, tc := range []struct {
+		sealedKeys bool
+		prevPbc    bool
+		resealErr  error
+		err        string
+	}{
+		{sealedKeys: false, resealErr: nil, err: ""},
+		{sealedKeys: true, resealErr: nil, err: ""},
+		{sealedKeys: true, resealErr: errors.New("reseal error"), err: "cannot reseal the encryption key: reseal error"},
+		{prevPbc: true, sealedKeys: true, resealErr: nil, err: ""},
+	} {
+		rootdir := c.MkDir()
+		dirs.SetRootDir(rootdir)
+		defer dirs.SetRootDir("")
+
+		if tc.sealedKeys {
+			c.Assert(os.MkdirAll(dirs.SnapFDEDir, 0755), IsNil)
+			err := ioutil.WriteFile(filepath.Join(dirs.SnapFDEDir, "sealed-keys"), nil, 0644)
+			c.Assert(err, IsNil)
+
+		}
+
+		err := createMockGrubCfg(filepath.Join(rootdir, "run/mnt/ubuntu-seed"))
+		c.Assert(err, IsNil)
+
+		err = createMockGrubCfg(filepath.Join(rootdir, "run/mnt/ubuntu-boot"))
+		c.Assert(err, IsNil)
+
+		modeenv := &boot.Modeenv{
+			CurrentRecoverySystems: []string{"20200825"},
+			CurrentTrustedRecoveryBootAssets: boot.BootAssetsMap{
+				"grubx64.efi": []string{"grub-hash-1"},
+				"bootx64.efi": []string{"shim-hash-1", "shim-hash-2"},
+			},
+
+			CurrentTrustedBootAssets: boot.BootAssetsMap{
+				"grubx64.efi": []string{"run-grub-hash-1", "run-grub-hash-2"},
+			},
+
+			CurrentKernels: []string{"pc-kernel_500.snap", "pc-kernel_600.snap"},
+		}
+
+		if tc.prevPbc {
+			err := boot.WriteBootChains(prevPbc, filepath.Join(dirs.SnapFDEDir, "boot-chains"), 9)
+			c.Assert(err, IsNil)
+		}
+
+		// mock asset cache
+		p := filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/bootx64.efi-shim-hash-1")
+		err = os.MkdirAll(filepath.Dir(p), 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(p, nil, 0644)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/bootx64.efi-shim-hash-2"), nil, 0644)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-grub-hash-1"), nil, 0644)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-run-grub-hash-1"), nil, 0644)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-run-grub-hash-2"), nil, 0644)
+		c.Assert(err, IsNil)
+
+		model := boottest.MakeMockUC20Model()
+
+		// set a mock recovery kernel
+		readSystemEssentialCalls := 0
+		restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+			readSystemEssentialCalls++
+			kernelSnap := &seed.Snap{
+				Path: "/var/lib/snapd/seed/snaps/pc-kernel_1.snap",
+				SideInfo: &snap.SideInfo{
+					RealName: "pc-kernel",
+					Revision: snap.Revision{N: 1},
+				},
+			}
+			return model, []*seed.Snap{kernelSnap}, nil
+		})
+		defer restore()
+
+		// set mock key resealing
+		resealKeysCalls := 0
+		restore = boot.MockSecbootResealKeys(func(params *secboot.ResealKeysParams) error {
+			c.Check(params.TPMPolicyAuthKeyFile, Equals, filepath.Join(dirs.SnapSaveDir, "device/fde", "tpm-policy-auth-key"))
+
+			resealKeysCalls++
+			c.Assert(params.ModelParams, HasLen, 1)
+
+			// shared parameters
+			c.Assert(params.ModelParams[0].Model.DisplayName(), Equals, "My Model")
+			switch resealKeysCalls {
+			case 1:
+				c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+					"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+				})
+				// load chains
+				c.Assert(params.ModelParams[0].EFILoadChains, HasLen, 6)
+			case 2:
+				c.Assert(params.ModelParams[0].KernelCmdlines, DeepEquals, []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+				})
+				// load chains
+				c.Assert(params.ModelParams[0].EFILoadChains, HasLen, 2)
+			default:
+				c.Errorf("unexpected additional call to secboot.ResealKeys (call # %d)", resealKeysCalls)
+			}
+
+			// recovery parameters
+			shim := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/bootx64.efi-shim-hash-1"), bootloader.RoleRecovery)
+			shim2 := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/bootx64.efi-shim-hash-2"), bootloader.RoleRecovery)
+			grub := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-grub-hash-1"), bootloader.RoleRecovery)
+			kernel := bootloader.NewBootFile("/var/lib/snapd/seed/snaps/pc-kernel_1.snap", "kernel.efi", bootloader.RoleRecovery)
+
+			c.Assert(params.ModelParams[0].EFILoadChains[:2], DeepEquals, []*secboot.LoadChain{
+				secboot.NewLoadChain(shim,
+					secboot.NewLoadChain(grub,
+						secboot.NewLoadChain(kernel))),
+				secboot.NewLoadChain(shim2,
+					secboot.NewLoadChain(grub,
+						secboot.NewLoadChain(kernel))),
+			})
+
+			// run mode parameters
+			runGrub := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-run-grub-hash-1"), bootloader.RoleRunMode)
+			runGrub2 := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/grubx64.efi-run-grub-hash-2"), bootloader.RoleRunMode)
+			runKernel := bootloader.NewBootFile(filepath.Join(rootdir, "var/lib/snapd/snaps/pc-kernel_500.snap"), "kernel.efi", bootloader.RoleRunMode)
+			runKernel2 := bootloader.NewBootFile(filepath.Join(rootdir, "var/lib/snapd/snaps/pc-kernel_600.snap"), "kernel.efi", bootloader.RoleRunMode)
+
+			switch resealKeysCalls {
+			case 1:
+				c.Assert(params.ModelParams[0].EFILoadChains[2:4], DeepEquals, []*secboot.LoadChain{
+					secboot.NewLoadChain(shim,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(runGrub,
+								secboot.NewLoadChain(runKernel)),
+							secboot.NewLoadChain(runGrub2,
+								secboot.NewLoadChain(runKernel)),
+						)),
+					secboot.NewLoadChain(shim2,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(runGrub,
+								secboot.NewLoadChain(runKernel)),
+							secboot.NewLoadChain(runGrub2,
+								secboot.NewLoadChain(runKernel)),
+						)),
+				})
+
+				c.Assert(params.ModelParams[0].EFILoadChains[4:], DeepEquals, []*secboot.LoadChain{
+					secboot.NewLoadChain(shim,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(runGrub,
+								secboot.NewLoadChain(runKernel2)),
+							secboot.NewLoadChain(runGrub2,
+								secboot.NewLoadChain(runKernel2)),
+						)),
+					secboot.NewLoadChain(shim2,
+						secboot.NewLoadChain(grub,
+							secboot.NewLoadChain(runGrub,
+								secboot.NewLoadChain(runKernel2)),
+							secboot.NewLoadChain(runGrub2,
+								secboot.NewLoadChain(runKernel2)),
+						)),
+				})
+			}
+
+			return tc.resealErr
+		})
+		defer restore()
+
+		// here we don't have unasserted kernels so just set
+		// expectReseal to false as it doesn't matter;
+		// the behavior with unasserted kernel is tested in
+		// boot_test.go specific tests
+		const expectReseal = false
+		err = boot.ResealKeyToModeenv(rootdir, model, modeenv, expectReseal)
+		if !tc.sealedKeys || tc.prevPbc {
+			// did nothing
+			c.Assert(err, IsNil)
+			c.Assert(resealKeysCalls, Equals, 0)
+			continue
+		}
+		if tc.resealErr != nil {
+			c.Assert(resealKeysCalls, Equals, 1)
+		} else {
+			c.Assert(resealKeysCalls, Equals, 2)
+		}
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+			continue
+		}
+
+		// verify the boot chains data file
+		pbc, cnt, err := boot.ReadBootChains(filepath.Join(dirs.SnapFDEDir, "boot-chains"))
+		c.Assert(err, IsNil)
+		if tc.prevPbc {
+			c.Assert(cnt, Equals, 10)
+		} else {
+			c.Assert(cnt, Equals, 1)
+		}
+		c.Check(pbc, DeepEquals, boot.PredictableBootChains{
+			boot.BootChain{
+				BrandID:        "my-brand",
+				Model:          "my-model-uc20",
+				Grade:          "dangerous",
+				ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+				AssetChain: []boot.BootAsset{
+					{
+						Role:   "recovery",
+						Name:   "bootx64.efi",
+						Hashes: []string{"shim-hash-1", "shim-hash-2"},
+					},
+					{
+						Role:   "recovery",
+						Name:   "grubx64.efi",
+						Hashes: []string{"grub-hash-1"},
+					},
+				},
+				Kernel:         "pc-kernel",
+				KernelRevision: "1",
+				KernelCmdlines: []string{
+					"snapd_recovery_mode=recover snapd_recovery_system=20200825 console=ttyS0 console=tty1 panic=-1",
+				},
+			},
+			boot.BootChain{
+				BrandID:        "my-brand",
+				Model:          "my-model-uc20",
+				Grade:          "dangerous",
+				ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+				AssetChain: []boot.BootAsset{
+					{
+						Role:   "recovery",
+						Name:   "bootx64.efi",
+						Hashes: []string{"shim-hash-1", "shim-hash-2"},
+					},
+					{
+						Role:   "recovery",
+						Name:   "grubx64.efi",
+						Hashes: []string{"grub-hash-1"},
+					},
+					{
+						Role:   "run-mode",
+						Name:   "grubx64.efi",
+						Hashes: []string{"run-grub-hash-1", "run-grub-hash-2"},
+					},
+				},
+				Kernel:         "pc-kernel",
+				KernelRevision: "500",
+				KernelCmdlines: []string{
+					"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+				},
+			},
+			boot.BootChain{
+				BrandID:        "my-brand",
+				Model:          "my-model-uc20",
+				Grade:          "dangerous",
+				ModelSignKeyID: "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij",
+				AssetChain: []boot.BootAsset{
+					{
+						Role:   "recovery",
+						Name:   "bootx64.efi",
+						Hashes: []string{"shim-hash-1", "shim-hash-2"},
+					},
+					{
+						Role:   "recovery",
+						Name:   "grubx64.efi",
+						Hashes: []string{"grub-hash-1"},
+					},
+					{
+						Role:   "run-mode",
+						Name:   "grubx64.efi",
+						Hashes: []string{"run-grub-hash-1", "run-grub-hash-2"},
+					},
+				},
+				Kernel:         "pc-kernel",
+				KernelRevision: "600",
+				KernelCmdlines: []string{
+					"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
+				},
+			},
+		})
+		prevPbc = pbc
+	}
+}
+
+func (s *sealSuite) TestRecoveryBootChainsForSystems(c *C) {
+	for _, tc := range []struct {
+		assetsMap          boot.BootAssetsMap
+		recoverySystems    []string
+		undefinedKernel    bool
+		expectedAssets     []boot.BootAsset
+		expectedKernelRevs []int
+		err                string
+	}{
+		{
+			// transition sequences
+			recoverySystems: []string{"20200825"},
+			assetsMap: boot.BootAssetsMap{
+				"grubx64.efi": []string{"grub-hash-1", "grub-hash-2"},
+				"bootx64.efi": []string{"shim-hash-1"},
+			},
+			expectedAssets: []boot.BootAsset{
+				{Role: bootloader.RoleRecovery, Name: "bootx64.efi", Hashes: []string{"shim-hash-1"}},
+				{Role: bootloader.RoleRecovery, Name: "grubx64.efi", Hashes: []string{"grub-hash-1", "grub-hash-2"}},
+			},
+			expectedKernelRevs: []int{1},
+		},
+		{
+			// two systems
+			recoverySystems: []string{"20200825", "20200831"},
+			assetsMap: boot.BootAssetsMap{
+				"grubx64.efi": []string{"grub-hash-1", "grub-hash-2"},
+				"bootx64.efi": []string{"shim-hash-1"},
+			},
+			expectedAssets: []boot.BootAsset{
+				{Role: bootloader.RoleRecovery, Name: "bootx64.efi", Hashes: []string{"shim-hash-1"}},
+				{Role: bootloader.RoleRecovery, Name: "grubx64.efi", Hashes: []string{"grub-hash-1", "grub-hash-2"}},
+			},
+			expectedKernelRevs: []int{1, 3},
+		},
+		{
+			// non-transition sequence
+			recoverySystems: []string{"20200825"},
+			assetsMap: boot.BootAssetsMap{
+				"grubx64.efi": []string{"grub-hash-1"},
+				"bootx64.efi": []string{"shim-hash-1"},
+			},
+			expectedAssets: []boot.BootAsset{
+				{Role: bootloader.RoleRecovery, Name: "bootx64.efi", Hashes: []string{"shim-hash-1"}},
+				{Role: bootloader.RoleRecovery, Name: "grubx64.efi", Hashes: []string{"grub-hash-1"}},
+			},
+			expectedKernelRevs: []int{1},
+		},
+		{
+			// invalid recovery system label
+			recoverySystems: []string{"0"},
+			err:             `invalid system seed label: "0"`,
+		},
+	} {
+		rootdir := c.MkDir()
+		dirs.SetRootDir(rootdir)
+		defer dirs.SetRootDir("")
+
+		// set recovery kernel
+		restore := boot.MockSeedReadSystemEssential(func(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*seed.Snap, error) {
+			if label != "20200825" && label != "20200831" {
+				return nil, nil, fmt.Errorf("invalid system seed label: %q", label)
+			}
+			kernelRev := 1
+			if label == "20200831" {
+				kernelRev = 3
+			}
+			kernelSnap := &seed.Snap{
+				Path: fmt.Sprintf("/var/lib/snapd/seed/snaps/pc-kernel_%d.snap", kernelRev),
+				SideInfo: &snap.SideInfo{
+					RealName: "pc-kernel",
+					Revision: snap.R(kernelRev),
+				},
+			}
+			return nil, []*seed.Snap{kernelSnap}, nil
+		})
+		defer restore()
+
+		grubDir := filepath.Join(rootdir, "run/mnt/ubuntu-seed")
+		err := createMockGrubCfg(grubDir)
+		c.Assert(err, IsNil)
+
+		bl, err := bootloader.Find(grubDir, &bootloader.Options{Role: bootloader.RoleRecovery})
+		c.Assert(err, IsNil)
+		tbl, ok := bl.(bootloader.TrustedAssetsBootloader)
+		c.Assert(ok, Equals, true)
+
+		model := boottest.MakeMockUC20Model()
+
+		modeenv := &boot.Modeenv{
+			CurrentTrustedRecoveryBootAssets: tc.assetsMap,
+		}
+
+		bc, err := boot.RecoveryBootChainsForSystems(tc.recoverySystems, tbl, model, modeenv)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+			c.Assert(bc, HasLen, len(tc.recoverySystems))
+			for i, chain := range bc {
+				c.Assert(chain.AssetChain, DeepEquals, tc.expectedAssets)
+				c.Check(chain.Kernel, Equals, "pc-kernel")
+				expectedKernelRev := tc.expectedKernelRevs[i]
+				c.Check(chain.KernelRevision, Equals, fmt.Sprintf("%d", expectedKernelRev))
+				c.Check(chain.KernelBootFile(), DeepEquals, bootloader.BootFile{Snap: fmt.Sprintf("/var/lib/snapd/seed/snaps/pc-kernel_%d.snap", expectedKernelRev), Path: "kernel.efi", Role: bootloader.RoleRecovery})
+			}
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+
+	}
+
+}
+
+func createMockGrubCfg(baseDir string) error {
+	cfg := filepath.Join(baseDir, "EFI/ubuntu/grub.cfg")
+	if err := os.MkdirAll(filepath.Dir(cfg), 0755); err != nil {
+		return err
+	}
+	return ioutil.WriteFile(cfg, []byte("# Snapd-Boot-Config-Edition: 1\n"), 0644)
+}
+
+func (s *sealSuite) TestSealKeyModelParams(c *C) {
+	rootdir := c.MkDir()
+	dirs.SetRootDir(rootdir)
+	defer dirs.SetRootDir("")
+
+	model := boottest.MakeMockUC20Model()
+
+	roleToBlName := map[bootloader.Role]string{
+		bootloader.RoleRecovery: "grub",
+		bootloader.RoleRunMode:  "grub",
+	}
+	// mock asset cache
+	p := filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/shim-shim-hash")
+	err := os.MkdirAll(filepath.Dir(p), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(p, nil, 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/loader-loader-hash1"), nil, 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/loader-loader-hash2"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	oldmodel := boottest.MakeMockUC20Model(map[string]interface{}{
+		"model":     "old-model-uc20",
+		"timestamp": "2019-10-01T08:00:00+00:00",
+	})
+
+	// old recovery
+	oldrc := boot.BootChain{
+		BrandID: oldmodel.BrandID(),
+		Model:   oldmodel.Model(),
+		AssetChain: []boot.BootAsset{
+			{Name: "shim", Role: bootloader.RoleRecovery, Hashes: []string{"shim-hash"}},
+			{Name: "loader", Role: bootloader.RoleRecovery, Hashes: []string{"loader-hash1"}},
+		},
+		KernelCmdlines: []string{"panic=1", "oldrc"},
+	}
+	oldrc.SetModelAssertion(oldmodel)
+	oldkbf := bootloader.BootFile{Snap: "pc-kernel_1.snap"}
+	oldrc.SetKernelBootFile(oldkbf)
+
+	// recovery
+	rc1 := boot.BootChain{
+		BrandID: model.BrandID(),
+		Model:   model.Model(),
+		AssetChain: []boot.BootAsset{
+			{Name: "shim", Role: bootloader.RoleRecovery, Hashes: []string{"shim-hash"}},
+			{Name: "loader", Role: bootloader.RoleRecovery, Hashes: []string{"loader-hash1"}},
+		},
+		KernelCmdlines: []string{"panic=1", "rc1"},
+	}
+	rc1.SetModelAssertion(model)
+	rc1kbf := bootloader.BootFile{Snap: "pc-kernel_10.snap"}
+	rc1.SetKernelBootFile(rc1kbf)
+
+	// run system
+	runc1 := boot.BootChain{
+		BrandID: model.BrandID(),
+		Model:   model.Model(),
+		AssetChain: []boot.BootAsset{
+			{Name: "shim", Role: bootloader.RoleRecovery, Hashes: []string{"shim-hash"}},
+			{Name: "loader", Role: bootloader.RoleRecovery, Hashes: []string{"loader-hash1"}},
+			{Name: "loader", Role: bootloader.RoleRunMode, Hashes: []string{"loader-hash2"}},
+		},
+		KernelCmdlines: []string{"panic=1", "runc1"},
+	}
+	runc1.SetModelAssertion(model)
+	runc1kbf := bootloader.BootFile{Snap: "pc-kernel_50.snap"}
+	runc1.SetKernelBootFile(runc1kbf)
+
+	pbc := boot.ToPredictableBootChains([]boot.BootChain{rc1, runc1, oldrc})
+
+	shim := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/shim-shim-hash"), bootloader.RoleRecovery)
+	loader1 := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/loader-loader-hash1"), bootloader.RoleRecovery)
+	loader2 := bootloader.NewBootFile("", filepath.Join(rootdir, "var/lib/snapd/boot-assets/grub/loader-loader-hash2"), bootloader.RoleRunMode)
+
+	params, err := boot.SealKeyModelParams(pbc, roleToBlName)
+	c.Assert(err, IsNil)
+	c.Check(params, HasLen, 2)
+	c.Check(params[0].Model, Equals, model)
+	// NB: merging of lists makes panic=1 appear once
+	c.Check(params[0].KernelCmdlines, DeepEquals, []string{"panic=1", "rc1", "runc1"})
+
+	c.Check(params[0].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+		secboot.NewLoadChain(shim,
+			secboot.NewLoadChain(loader1,
+				secboot.NewLoadChain(rc1kbf))),
+		secboot.NewLoadChain(shim,
+			secboot.NewLoadChain(loader1,
+				secboot.NewLoadChain(loader2,
+					secboot.NewLoadChain(runc1kbf)))),
+	})
+
+	c.Check(params[1].Model, Equals, oldmodel)
+	c.Check(params[1].KernelCmdlines, DeepEquals, []string{"oldrc", "panic=1"})
+	c.Check(params[1].EFILoadChains, DeepEquals, []*secboot.LoadChain{
+		secboot.NewLoadChain(shim,
+			secboot.NewLoadChain(loader1,
+				secboot.NewLoadChain(oldkbf))),
+	})
+}
+
+func (s *sealSuite) TestIsResealNeeded(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
+	chains := []boot.BootChain{
+		{
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "signed",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"x", "y"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+				{Role: bootloader.RoleRunMode, Name: "loader", Hashes: []string{"z", "x"}},
+			},
+			Kernel:         "pc-kernel-other",
+			KernelRevision: "2345",
+			KernelCmdlines: []string{`snapd_recovery_mode=run foo`},
+		}, {
+			BrandID:        "mybrand",
+			Model:          "foo",
+			Grade:          "dangerous",
+			ModelSignKeyID: "my-key-id",
+			AssetChain: []boot.BootAsset{
+				// hashes will be sorted
+				{Role: bootloader.RoleRecovery, Name: "shim", Hashes: []string{"y", "x"}},
+				{Role: bootloader.RoleRecovery, Name: "loader", Hashes: []string{"c", "d"}},
+			},
+			Kernel:         "pc-kernel-recovery",
+			KernelRevision: "1234",
+			KernelCmdlines: []string{`snapd_recovery_mode=recover foo`},
+		},
+	}
+
+	pbc := boot.ToPredictableBootChains(chains)
+
+	rootdir := c.MkDir()
+	err := boot.WriteBootChains(pbc, filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 2)
+	c.Assert(err, IsNil)
+
+	needed, _, err := boot.IsResealNeeded(pbc, filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), false)
+	c.Assert(err, IsNil)
+	c.Check(needed, Equals, false)
+
+	otherchain := []boot.BootChain{pbc[0]}
+	needed, cnt, err := boot.IsResealNeeded(otherchain, filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), false)
+	c.Assert(err, IsNil)
+	// chains are different
+	c.Check(needed, Equals, true)
+	c.Check(cnt, Equals, 3)
+
+	// boot-chains does not exist, we cannot compare so advise to reseal
+	otherRootdir := c.MkDir()
+	needed, cnt, err = boot.IsResealNeeded(otherchain, filepath.Join(dirs.SnapFDEDirUnder(otherRootdir), "boot-chains"), false)
+	c.Assert(err, IsNil)
+	c.Check(needed, Equals, true)
+	c.Check(cnt, Equals, 1)
+
+	// exists but cannot be read
+	c.Assert(os.Chmod(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 0000), IsNil)
+	defer os.Chmod(filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), 0755)
+	needed, _, err = boot.IsResealNeeded(otherchain, filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains"), false)
+	c.Assert(err, ErrorMatches, "cannot open existing boot chains data file: open .*/boot-chains: permission denied")
+	c.Check(needed, Equals, false)
+
+	// unrevisioned kernel chain
+	unrevchain := []boot.BootChain{pbc[0], pbc[1]}
+	unrevchain[1].KernelRevision = ""
+	// write on disk
+	bootChainsFile := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "boot-chains")
+	err = boot.WriteBootChains(unrevchain, bootChainsFile, 2)
+	c.Assert(err, IsNil)
+
+	needed, cnt, err = boot.IsResealNeeded(pbc, bootChainsFile, false)
+	c.Assert(err, IsNil)
+	c.Check(needed, Equals, true)
+	c.Check(cnt, Equals, 3)
+
+	// cases falling back to expectReseal
+	needed, _, err = boot.IsResealNeeded(unrevchain, bootChainsFile, false)
+	c.Assert(err, IsNil)
+	c.Check(needed, Equals, false)
+
+	needed, cnt, err = boot.IsResealNeeded(unrevchain, bootChainsFile, true)
+	c.Assert(err, IsNil)
+	c.Check(needed, Equals, true)
+	c.Check(cnt, Equals, 3)
+}
+
+func (s *sealSuite) TestSealToModeenvWithFdeHookHappy(c *C) {
+	rootdir := c.MkDir()
+	dirs.SetRootDir(rootdir)
+	defer dirs.SetRootDir("")
+
+	restore := boot.MockHasFDESetupHook(func() (bool, error) {
+		return true, nil
+	})
+	defer restore()
+
+	n := 0
+	var runFDESetupHookParams []*boot.FDESetupHookParams
+	restore = boot.MockRunFDESetupHook(func(op string, params *boot.FDESetupHookParams) ([]byte, error) {
+		n++
+		c.Assert(op, Equals, "initial-setup")
+		runFDESetupHookParams = append(runFDESetupHookParams, params)
+		return []byte("sealed-key: " + strconv.Itoa(n)), nil
+	})
+	defer restore()
+
+	modeenv := &boot.Modeenv{
+		RecoverySystem: "20200825",
+	}
+	key := secboot.EncryptionKey{1, 2, 3, 4}
+	saveKey := secboot.EncryptionKey{5, 6, 7, 8}
+
+	model := boottest.MakeMockUC20Model()
+	err := boot.SealKeyToModeenv(key, saveKey, model, modeenv)
+	c.Assert(err, IsNil)
+	// check that runFDESetupHook was called the expected way
+	c.Check(runFDESetupHookParams, DeepEquals, []*boot.FDESetupHookParams{
+		{Key: secboot.EncryptionKey{1, 2, 3, 4}, Models: []*asserts.Model{model}},
+		{Key: secboot.EncryptionKey{1, 2, 3, 4}, Models: []*asserts.Model{model}},
+		{Key: secboot.EncryptionKey{5, 6, 7, 8}, Models: []*asserts.Model{model}},
+	})
+	// check that the sealed keys got written to the expected places
+	for i, p := range []string{
+		filepath.Join(boot.InitramfsBootEncryptionKeyDir, "ubuntu-data.sealed-key"),
+		filepath.Join(boot.InitramfsSeedEncryptionKeyDir, "ubuntu-data.recovery.sealed-key"),
+		filepath.Join(boot.InitramfsSeedEncryptionKeyDir, "ubuntu-save.recovery.sealed-key"),
+	} {
+		c.Check(p, testutil.FileEquals, "sealed-key: "+strconv.Itoa(i+1))
+	}
+	marker := filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "sealed-keys")
+	c.Check(marker, testutil.FileEquals, "fde-setup-hook")
+}
+
+func (s *sealSuite) TestSealToModeenvWithFdeHookSad(c *C) {
+	rootdir := c.MkDir()
+	dirs.SetRootDir(rootdir)
+	defer dirs.SetRootDir("")
+
+	restore := boot.MockHasFDESetupHook(func() (bool, error) {
+		return true, nil
+	})
+	defer restore()
+
+	restore = boot.MockRunFDESetupHook(func(op string, params *boot.FDESetupHookParams) ([]byte, error) {
+		return nil, fmt.Errorf("hook failed")
+	})
+	defer restore()
+
+	modeenv := &boot.Modeenv{
+		RecoverySystem: "20200825",
+	}
+	key := secboot.EncryptionKey{1, 2, 3, 4}
+	saveKey := secboot.EncryptionKey{5, 6, 7, 8}
+
+	model := boottest.MakeMockUC20Model()
+	err := boot.SealKeyToModeenv(key, saveKey, model, modeenv)
+	c.Assert(err, ErrorMatches, "hook failed")
+	marker := filepath.Join(dirs.SnapFDEDirUnder(boot.InstallHostWritableDir), "sealed-keys")
+	c.Check(marker, testutil.FileAbsent)
+}
+
+func (s *sealSuite) TestResealKeyToModeenvWithFdeHookCalled(c *C) {
+	rootdir := c.MkDir()
+	dirs.SetRootDir(rootdir)
+	defer dirs.SetRootDir("")
+
+	resealKeyToModeenvUsingFDESetupHookCalled := 0
+	restore := boot.MockResealKeyToModeenvUsingFDESetupHook(func(string, *asserts.Model, *boot.Modeenv, bool) error {
+		resealKeyToModeenvUsingFDESetupHookCalled++
+		return nil
+	})
+	defer restore()
+
+	// TODO: this simulates that the hook is not available yet
+	//       because of e.g. seeding. Longer term there will be
+	//       more, see TODO in resealKeyToModeenvUsingFDESetupHookImpl
+	restore = boot.MockHasFDESetupHook(func() (bool, error) {
+		return false, fmt.Errorf("hook not available yet because e.g. seeding")
+	})
+	defer restore()
+
+	marker := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "sealed-keys")
+	err := os.MkdirAll(filepath.Dir(marker), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(marker, []byte("fde-setup-hook"), 0644)
+	c.Assert(err, IsNil)
+
+	modeenv := &boot.Modeenv{
+		RecoverySystem: "20200825",
+	}
+
+	model := boottest.MakeMockUC20Model()
+	expectReseal := false
+	err = boot.ResealKeyToModeenv(rootdir, model, modeenv, expectReseal)
+	c.Assert(err, IsNil)
+	c.Check(resealKeyToModeenvUsingFDESetupHookCalled, Equals, 1)
+}
+
+func (s *sealSuite) TestResealKeyToModeenvWithFdeHookVerySad(c *C) {
+	rootdir := c.MkDir()
+	dirs.SetRootDir(rootdir)
+	defer dirs.SetRootDir("")
+
+	resealKeyToModeenvUsingFDESetupHookCalled := 0
+	restore := boot.MockResealKeyToModeenvUsingFDESetupHook(func(string, *asserts.Model, *boot.Modeenv, bool) error {
+		resealKeyToModeenvUsingFDESetupHookCalled++
+		return fmt.Errorf("fde setup hook failed")
+	})
+	defer restore()
+
+	marker := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "sealed-keys")
+	err := os.MkdirAll(filepath.Dir(marker), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(marker, []byte("fde-setup-hook"), 0644)
+	c.Assert(err, IsNil)
+
+	modeenv := &boot.Modeenv{
+		RecoverySystem: "20200825",
+	}
+
+	model := boottest.MakeMockUC20Model()
+	expectReseal := false
+	err = boot.ResealKeyToModeenv(rootdir, model, modeenv, expectReseal)
+	c.Assert(err, ErrorMatches, "fde setup hook failed")
+	c.Check(resealKeyToModeenvUsingFDESetupHookCalled, Equals, 1)
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/androidboot.go snapd-2.48.3+20.04/bootloader/androidboot.go
--- snapd-2.45.1+20.04.2/bootloader/androidboot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/androidboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,7 +24,6 @@
 	"path/filepath"
 
 	"github.com/snapcore/snapd/bootloader/androidbootenv"
-	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 )
 
@@ -33,11 +32,8 @@
 }
 
 // newAndroidboot creates a new Androidboot bootloader object
-func newAndroidBoot(rootdir string) Bootloader {
+func newAndroidBoot(rootdir string, _ *Options) Bootloader {
 	a := &androidboot{rootdir: rootdir}
-	if !osutil.FileExists(a.ConfigFile()) {
-		return nil
-	}
 	return a
 }
 
@@ -56,7 +52,7 @@
 	return filepath.Join(a.rootdir, "/boot/androidboot")
 }
 
-func (a *androidboot) InstallBootConfig(gadgetDir string, opts *Options) (bool, error) {
+func (a *androidboot) InstallBootConfig(gadgetDir string, opts *Options) error {
 	gadgetFile := filepath.Join(gadgetDir, a.Name()+".conf")
 	systemFile := a.ConfigFile()
 	return genericInstallBootConfig(gadgetFile, systemFile)
diff -Nru snapd-2.45.1+20.04.2/bootloader/androidboot_test.go snapd-2.48.3+20.04/bootloader/androidboot_test.go
--- snapd-2.45.1+20.04.2/bootloader/androidboot_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/androidboot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -45,11 +45,6 @@
 	bootloader.MockAndroidBootFile(c, s.rootdir, 0644)
 }
 
-func (s *androidBootTestSuite) TestNewAndroidbootNoAndroidbootReturnsNil(c *C) {
-	a := bootloader.NewAndroidBoot("/something/not/there")
-	c.Assert(a, IsNil)
-}
-
 func (s *androidBootTestSuite) TestNewAndroidboot(c *C) {
 	a := bootloader.NewAndroidBoot(s.rootdir)
 	c.Assert(a, NotNil)
diff -Nru snapd-2.45.1+20.04.2/bootloader/asset.go snapd-2.48.3+20.04/bootloader/asset.go
--- snapd-2.45.1+20.04.2/bootloader/asset.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/asset.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,113 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package bootloader
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/snapcore/snapd/bootloader/assets"
+)
+
+var errNoEdition = errors.New("no edition")
+
+// editionFromDiskConfigAsset extracts the edition information from a boot
+// config asset on disk.
+func editionFromDiskConfigAsset(p string) (uint, error) {
+	f, err := os.Open(p)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return 0, errNoEdition
+		}
+		return 0, fmt.Errorf("cannot load existing config asset: %v", err)
+	}
+	defer f.Close()
+	return editionFromConfigAsset(f)
+}
+
+const editionHeader = "# Snapd-Boot-Config-Edition: "
+
+// editionFromConfigAsset extracts edition information from boot config asset.
+func editionFromConfigAsset(asset io.Reader) (uint, error) {
+	scanner := bufio.NewScanner(asset)
+	if !scanner.Scan() {
+		err := fmt.Errorf("cannot read config asset: unexpected EOF")
+		if sErr := scanner.Err(); sErr != nil {
+			err = fmt.Errorf("cannot read config asset: %v", err)
+		}
+		return 0, err
+	}
+
+	line := scanner.Text()
+	if !strings.HasPrefix(line, editionHeader) {
+		return 0, errNoEdition
+	}
+
+	editionStr := line[len(editionHeader):]
+	editionStr = strings.TrimSpace(editionStr)
+	edition, err := strconv.ParseUint(editionStr, 10, 32)
+	if err != nil {
+		return 0, fmt.Errorf("cannot parse asset edition: %v", err)
+	}
+	return uint(edition), nil
+}
+
+// editionFromInternalConfigAsset extracts edition information from a named
+// internal boot config asset.
+func editionFromInternalConfigAsset(assetName string) (uint, error) {
+	data := assets.Internal(assetName)
+	if data == nil {
+		return 0, fmt.Errorf("internal error: no boot asset for %q", assetName)
+	}
+	return editionFromConfigAsset(bytes.NewReader(data))
+}
+
+// configAsset is a boot config asset, such as text script, used by grub or
+// u-boot.
+type configAsset struct {
+	body          []byte
+	parsedEdition uint
+}
+
+func (g *configAsset) Edition() uint {
+	return g.parsedEdition
+}
+
+func (g *configAsset) Raw() []byte {
+	return g.body
+}
+
+func configAssetFrom(data []byte) (*configAsset, error) {
+	edition, err := editionFromConfigAsset(bytes.NewReader(data))
+	if err != nil && err != errNoEdition {
+		return nil, err
+	}
+	gbs := &configAsset{
+		body:          data,
+		parsedEdition: edition,
+	}
+	return gbs, nil
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/assets.go snapd-2.48.3+20.04/bootloader/assets/assets.go
--- snapd-2.45.1+20.04.2/bootloader/assets/assets.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/assets.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,137 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+var registeredAssets = map[string][]byte{}
+
+// ForEditions wraps a snippet that is used in editions starting with
+// FirstEdition.
+type ForEditions struct {
+	// First edition this snippet is used in
+	FirstEdition uint
+	// Snippet data
+	Snippet []byte
+}
+
+var registeredEditionSnippets = map[string][]ForEditions{}
+
+// registerInternal registers an internal asset under the given name.
+func registerInternal(name string, data []byte) {
+	if _, ok := registeredAssets[name]; ok {
+		panic(fmt.Sprintf("asset %q is already registered", name))
+	}
+	registeredAssets[name] = data
+}
+
+// Internal returns the content of an internal asset registered under the given
+// name, or nil when none was found.
+func Internal(name string) []byte {
+	return registeredAssets[name]
+}
+
+type byFirstEdition []ForEditions
+
+func (b byFirstEdition) Len() int           { return len(b) }
+func (b byFirstEdition) Swap(i, j int)      { b[i], b[j] = b[j], b[i] }
+func (b byFirstEdition) Less(i, j int) bool { return b[i].FirstEdition < b[j].FirstEdition }
+
+// registerSnippetForEditions register a set of snippets, each carrying the
+// first edition number it applies to, under a given key.
+func registerSnippetForEditions(name string, snippets []ForEditions) {
+	if _, ok := registeredEditionSnippets[name]; ok {
+		panic(fmt.Sprintf("edition snippets %q are already registered", name))
+	}
+
+	if !sort.IsSorted(byFirstEdition(snippets)) {
+		panic(fmt.Sprintf("edition snippets %q must be sorted in ascending edition number order", name))
+	}
+	for i := range snippets {
+		if i == 0 {
+			continue
+		}
+		if snippets[i-1].FirstEdition == snippets[i].FirstEdition {
+			panic(fmt.Sprintf(`first edition %v repeated in edition snippets %q`,
+				snippets[i].FirstEdition, name))
+		}
+	}
+	registeredEditionSnippets[name] = snippets
+}
+
+// SnippetForEdition returns a snippet registered under given name,
+// applicable for the provided edition number.
+func SnippetForEdition(name string, edition uint) []byte {
+	snippets := registeredEditionSnippets[name]
+	if snippets == nil {
+		return nil
+	}
+	var current []byte
+	// snippets are sorted by ascending edition number when adding
+	for _, snip := range snippets {
+		if edition >= snip.FirstEdition {
+			current = snip.Snippet
+		} else {
+			break
+		}
+	}
+	return current
+}
+
+// MockInternal mocks the contents of an internal asset for use in testing.
+func MockInternal(name string, data []byte) (restore func()) {
+	osutil.MustBeTestBinary("mocking can be done only in tests")
+
+	old, ok := registeredAssets[name]
+	registeredAssets[name] = data
+	return func() {
+		if ok {
+			registeredAssets[name] = old
+		} else {
+			delete(registeredAssets, name)
+		}
+	}
+}
+
+// MockSnippetsForEdition mocks the contents of per-edition snippets.
+func MockSnippetsForEdition(name string, snippets []ForEditions) (restore func()) {
+	osutil.MustBeTestBinary("mocking can be done only in tests")
+
+	old, ok := registeredEditionSnippets[name]
+	snippetsCopy := make([]ForEditions, len(snippets))
+	copy(snippetsCopy, snippets)
+	if ok {
+		delete(registeredEditionSnippets, name)
+	}
+	registerSnippetForEditions(name, snippetsCopy)
+
+	return func() {
+		if ok {
+			registeredEditionSnippets[name] = old
+		} else {
+			delete(registeredAssets, name)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/assets_test.go snapd-2.48.3+20.04/bootloader/assets/assets_test.go
--- snapd-2.45.1+20.04.2/bootloader/assets/assets_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/assets_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,156 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/bootloader/assets"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type assetsTestSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&assetsTestSuite{})
+
+func (s *assetsTestSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+	s.AddCleanup(assets.MockCleanState())
+}
+
+func (s *assetsTestSuite) TestRegisterInternalSimple(c *C) {
+	assets.RegisterInternal("foo", []byte("bar"))
+	data := assets.Internal("foo")
+	c.Check(data, DeepEquals, []byte("bar"))
+
+	complexData := `this is "some
+complex binary " data
+`
+	assets.RegisterInternal("complex-data", []byte(complexData))
+	complex := assets.Internal("complex-data")
+	c.Check(complex, DeepEquals, []byte(complexData))
+
+	nodata := assets.Internal("no data")
+	c.Check(nodata, IsNil)
+}
+
+func (s *assetsTestSuite) TestRegisterDoublePanics(c *C) {
+	assets.RegisterInternal("foo", []byte("foo"))
+	// panics with the same key, no matter the data used
+	c.Assert(func() { assets.RegisterInternal("foo", []byte("bar")) },
+		PanicMatches, `asset "foo" is already registered`)
+	c.Assert(func() { assets.RegisterInternal("foo", []byte("foo")) },
+		PanicMatches, `asset "foo" is already registered`)
+}
+
+func (s *assetsTestSuite) TestRegisterSnippetPanics(c *C) {
+	assets.RegisterSnippetForEditions("foo", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte("foo")},
+	})
+	// panics with the same key
+	c.Assert(func() {
+		assets.RegisterSnippetForEditions("foo", []assets.ForEditions{
+			{FirstEdition: 2, Snippet: []byte("bar")},
+		})
+	}, PanicMatches, `edition snippets "foo" are already registered`)
+	// panics when snippets aren't sorted
+	c.Assert(func() {
+		assets.RegisterSnippetForEditions("unsorted", []assets.ForEditions{
+			{FirstEdition: 2, Snippet: []byte("two")},
+			{FirstEdition: 1, Snippet: []byte("one")},
+		})
+	}, PanicMatches, `edition snippets "unsorted" must be sorted in ascending edition number order`)
+	// panics when edition is repeated
+	c.Assert(func() {
+		assets.RegisterSnippetForEditions("doubled edition", []assets.ForEditions{
+			{FirstEdition: 1, Snippet: []byte("one")},
+			{FirstEdition: 2, Snippet: []byte("two")},
+			{FirstEdition: 3, Snippet: []byte("three")},
+			{FirstEdition: 3, Snippet: []byte("more tree")},
+			{FirstEdition: 4, Snippet: []byte("four")},
+		})
+	}, PanicMatches, `first edition 3 repeated in edition snippets "doubled edition"`)
+	// mix unsorted with duplicate edition
+	c.Assert(func() {
+		assets.RegisterSnippetForEditions("unsorted and doubled edition", []assets.ForEditions{
+			{FirstEdition: 1, Snippet: []byte("one")},
+			{FirstEdition: 2, Snippet: []byte("two")},
+			{FirstEdition: 1, Snippet: []byte("one again")},
+			{FirstEdition: 3, Snippet: []byte("more tree")},
+			{FirstEdition: 4, Snippet: []byte("four")},
+		})
+	}, PanicMatches, `edition snippets "unsorted and doubled edition" must be sorted in ascending edition number order`)
+}
+
+func (s *assetsTestSuite) TestEditionSnippets(c *C) {
+	assets.RegisterSnippetForEditions("foo", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte("one")},
+		{FirstEdition: 2, Snippet: []byte("two")},
+		{FirstEdition: 3, Snippet: []byte("three")},
+		{FirstEdition: 4, Snippet: []byte("four")},
+		{FirstEdition: 10, Snippet: []byte("ten")},
+		{FirstEdition: 20, Snippet: []byte("twenty")},
+	})
+	assets.RegisterSnippetForEditions("bar", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte("bar one")},
+		{FirstEdition: 3, Snippet: []byte("bar three")},
+		// same as 3
+		{FirstEdition: 5, Snippet: []byte("bar three")},
+	})
+	assets.RegisterSnippetForEditions("just-one", []assets.ForEditions{
+		{FirstEdition: 2, Snippet: []byte("just one")},
+	})
+
+	for _, tc := range []struct {
+		asset   string
+		edition uint
+		exp     []byte
+	}{
+		{"foo", 1, []byte("one")},
+		{"foo", 4, []byte("four")},
+		{"foo", 10, []byte("ten")},
+		// still using snipped from edition 4
+		{"foo", 9, []byte("four")},
+		// still using snipped from edition 10
+		{"foo", 11, []byte("ten")},
+		{"foo", 30, []byte("twenty")},
+		// different asset
+		{"bar", 1, []byte("bar one")},
+		{"bar", 2, []byte("bar one")},
+		{"bar", 3, []byte("bar three")},
+		{"bar", 4, []byte("bar three")},
+		{"bar", 5, []byte("bar three")},
+		{"bar", 6, []byte("bar three")},
+		// nothing registered for edition 0
+		{"bar", 0, nil},
+		// a single snippet under this key
+		{"just-one", 2, []byte("just one")},
+		{"just-one", 1, nil},
+		// asset not registered
+		{"no asset", 1, nil},
+		{"no asset", 100, nil},
+	} {
+		c.Logf("%q edition %v", tc.asset, tc.edition)
+		snippet := assets.SnippetForEdition(tc.asset, tc.edition)
+		c.Check(snippet, DeepEquals, tc.exp)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/data/grub.cfg snapd-2.48.3+20.04/bootloader/assets/data/grub.cfg
--- snapd-2.45.1+20.04.2/bootloader/assets/data/grub.cfg	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/data/grub.cfg	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,44 @@
+# Snapd-Boot-Config-Edition: 1
+
+set default=0
+set timeout=3
+set timeout_style=hidden
+
+# load only kernel_status from the bootenv
+load_env --file /EFI/ubuntu/grubenv kernel_status snapd_extra_cmdline_args
+
+set snapd_static_cmdline_args='console=ttyS0 console=tty1 panic=-1'
+
+set kernel=kernel.efi
+
+if [ "$kernel_status" = "try" ]; then
+    # a new kernel got installed
+    set kernel_status="trying"
+    save_env kernel_status
+
+    # use try-kernel.efi
+    set kernel=try-kernel.efi
+elif [ "$kernel_status" = "trying" ]; then
+    # nothing cleared the "trying snap" so the boot failed
+    # we clear the mode and boot normally
+    set kernel_status=""
+    save_env kernel_status
+elif [ -n "$kernel_status" ]; then
+    # ERROR invalid kernel_status state, reset to empty
+    echo "invalid kernel_status!!!"
+    echo "resetting to empty"
+    set kernel_status=""
+    save_env kernel_status
+fi
+
+if [ -e $prefix/$kernel ]; then
+menuentry "Run Ubuntu Core 20" {
+    # use $prefix because the symlink manipulation at runtime for kernel snap
+    # upgrades, etc. should only need the /boot/grub/ directory, not the
+    # /EFI/ubuntu/ directory
+    chainloader $prefix/$kernel snapd_recovery_mode=run $snapd_static_cmdline_args $snapd_extra_cmdline_args
+}
+else
+    # nothing to boot :-/
+    echo "missing kernel at $prefix/$kernel!"
+fi
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/data/grub-recovery.cfg snapd-2.48.3+20.04/bootloader/assets/data/grub-recovery.cfg
--- snapd-2.45.1+20.04.2/bootloader/assets/data/grub-recovery.cfg	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/data/grub-recovery.cfg	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,63 @@
+# Snapd-Boot-Config-Edition: 1
+
+set default=0
+set timeout=3
+set timeout_style=hidden
+
+if [ -e /EFI/ubuntu/grubenv ]; then
+   load_env --file /EFI/ubuntu/grubenv snapd_recovery_mode snapd_recovery_system
+fi
+
+# standard cmdline params
+set snapd_static_cmdline_args='console=ttyS0 console=tty1 panic=-1'
+
+# if no default boot mode set, pick one
+if [ -z "$snapd_recovery_mode" ]; then
+    set snapd_recovery_mode=install
+fi
+
+if [ "$snapd_recovery_mode" = "run" ]; then
+    default="run"
+elif [ -n "$snapd_recovery_system" ]; then
+    default=$snapd_recovery_mode-$snapd_recovery_system
+fi
+
+search --no-floppy --set=boot_fs --label ubuntu-boot
+
+if [ -n "$boot_fs" ]; then
+    menuentry "Continue to run mode" --hotkey=n --id=run {
+        chainloader ($boot_fs)/EFI/boot/grubx64.efi
+    }
+fi
+
+# globbing in grub does not sort
+for label in /systems/*; do
+    regexp --set 1:label "/([0-9]*)\$" "$label"
+    if [ -z "$label" ]; then
+        continue
+    fi
+    # yes, you need to backslash that less-than
+    if [ -z "$best" -o "$label" \< "$best" ]; then
+        set best="$label"
+    fi
+    # if grubenv did not pick mode-system, use best one
+    if [ -z "$snapd_recovery_system" ]; then
+        default=$snapd_recovery_mode-$best
+    fi
+    set snapd_recovery_kernel=
+    load_env --file /systems/$label/grubenv snapd_recovery_kernel snapd_extra_cmdline_args
+
+    # We could "source /systems/$snapd_recovery_system/grub.cfg" here as well
+    menuentry "Recover using $label" --hotkey=r --id=recover-$label $snapd_recovery_kernel recover $label {
+        loopback loop $2
+        chainloader (loop)/kernel.efi snapd_recovery_mode=$3 snapd_recovery_system=$4 $snapd_static_cmdline_args $snapd_extra_cmdline_args
+    }
+    menuentry "Install using $label" --hotkey=i --id=install-$label $snapd_recovery_kernel install $label {
+        loopback loop $2
+        chainloader (loop)/kernel.efi snapd_recovery_mode=$3 snapd_recovery_system=$4 $snapd_static_cmdline_args $snapd_extra_cmdline_args
+    }
+done
+
+menuentry 'UEFI Firmware Settings' --hotkey=f 'uefi-firmware' {
+    fwsetup
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/data/README.grub snapd-2.48.3+20.04/bootloader/assets/data/README.grub
--- snapd-2.45.1+20.04.2/bootloader/assets/data/README.grub	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/data/README.grub	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+Edition 1 of grub.cfg and grub-recovery.cfg imported from https://github.com/snapcore/pc-amd64-gadget, commit:
+
+commit e4d63119322691f14a3f9dfa36a3a075e941ec9d (HEAD -> 20, origin/HEAD, origin/20)
+Merge: b70d2ae d113aca
+Author: Dimitri John Ledkov <xnox@ubuntu.com>
+Date:   Thu May 7 19:30:00 2020 +0100
+
+    Merge pull request #47 from xnox/production-keys
+
+    gadget: bump edition to 2, using production signing keys for everything.
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/export_test.go snapd-2.48.3+20.04/bootloader/assets/export_test.go
--- snapd-2.45.1+20.04.2/bootloader/assets/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,36 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+var (
+	RegisterInternal           = registerInternal
+	RegisterSnippetForEditions = registerSnippetForEditions
+)
+
+func MockCleanState() (restore func()) {
+	oldRegisteredAssets := registeredAssets
+	oldRegisteredEditionAssets := registeredEditionSnippets
+	registeredAssets = map[string][]byte{}
+	registeredEditionSnippets = map[string][]ForEditions{}
+	return func() {
+		registeredAssets = oldRegisteredAssets
+		registeredEditionSnippets = oldRegisteredEditionAssets
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/genasset/export_test.go snapd-2.48.3+20.04/bootloader/assets/genasset/export_test.go
--- snapd-2.45.1+20.04.2/bootloader/assets/genasset/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/genasset/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,32 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+var (
+	ParseArgs   = parseArgs
+	Run         = run
+	FormatLines = formatLines
+)
+
+func ResetArgs() {
+	*inFile = ""
+	*outFile = ""
+	*assetName = ""
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/genasset/main.go snapd-2.48.3+20.04/bootloader/assets/genasset/main.go
--- snapd-2.45.1+20.04.2/bootloader/assets/genasset/main.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/genasset/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,157 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"text/template"
+	"time"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+var assetTemplateText = `// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) {{ .Year }} Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+// Code generated from {{ .InputFileName }} DO NOT EDIT
+
+func init() {
+	registerInternal("{{ .AssetName }}", []byte{
+{{ range .AssetDataLines }}		{{ . }}
+{{ end }}	})
+}
+`
+
+var inFile = flag.String("in", "", "asset input file")
+var outFile = flag.String("out", "", "asset output file")
+var assetName = flag.String("name", "", "asset name")
+var assetTemplate = template.Must(template.New("asset").Parse(assetTemplateText))
+
+// formatLines generates a list of strings, each carrying a line containing hex
+// encoded data
+func formatLines(data []byte) []string {
+	const lineBreak = 16
+
+	l := len(data)
+	lines := make([]string, 0, l/lineBreak+1)
+	for i := 0; i < l; i = i + lineBreak {
+		end := i + lineBreak
+		start := i
+		if end > l {
+			end = l
+		}
+		var line bytes.Buffer
+		forLine := data[start:end]
+		for idx, val := range forLine {
+			line.WriteString(fmt.Sprintf("0x%02x,", val))
+			if idx != len(forLine)-1 {
+				line.WriteRune(' ')
+			}
+		}
+		lines = append(lines, line.String())
+	}
+	return lines
+}
+
+func run(assetName, inputFile, outputFile string) error {
+	inf, err := os.Open(inputFile)
+	if err != nil {
+		return fmt.Errorf("cannot open input file: %v", err)
+	}
+	defer inf.Close()
+
+	var inData bytes.Buffer
+	if _, err := io.Copy(&inData, inf); err != nil {
+		return fmt.Errorf("cannot copy input data: %v", err)
+	}
+
+	outf, err := osutil.NewAtomicFile(outputFile, 0644, 0, osutil.NoChown, osutil.NoChown)
+	if err != nil {
+		return fmt.Errorf("cannot open output file: %v", err)
+	}
+	defer outf.Cancel()
+
+	templateData := struct {
+		Comment        string
+		InputFileName  string
+		AssetName      string
+		AssetDataLines []string
+		Year           string
+	}{
+		InputFileName: inputFile,
+		// dealing with precise formatting in template is annoying thus
+		// we use a preformatted lines carrying asset data
+		AssetDataLines: formatLines(inData.Bytes()),
+		AssetName:      assetName,
+		Year:           strconv.Itoa(time.Now().Year()),
+	}
+	if err := assetTemplate.Execute(outf, &templateData); err != nil {
+		return fmt.Errorf("cannot generate content: %v", err)
+	}
+	return outf.Commit()
+}
+
+func parseArgs() error {
+	flag.Parse()
+	if *inFile == "" {
+		return fmt.Errorf("input file not provided")
+	}
+	if *outFile == "" {
+		return fmt.Errorf("output file not provided")
+	}
+	if *assetName == "" {
+		return fmt.Errorf("asset name not provided")
+	}
+	return nil
+}
+
+func main() {
+	if err := parseArgs(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	if err := run(*assetName, *inFile, *outFile); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/genasset/main_test.go snapd-2.48.3+20.04/bootloader/assets/genasset/main_test.go
--- snapd-2.45.1+20.04.2/bootloader/assets/genasset/main_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/genasset/main_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,176 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	generate "github.com/snapcore/snapd/bootloader/assets/genasset"
+	"github.com/snapcore/snapd/testutil"
+)
+
+// Hook up check.v1 into the "go test" runner
+func Test(t *testing.T) { TestingT(t) }
+
+type generateAssetsTestSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&generateAssetsTestSuite{})
+
+func (s *generateAssetsTestSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+}
+
+func mockArgs(args []string) (restore func()) {
+	old := os.Args
+	os.Args = args
+	return func() {
+		os.Args = old
+	}
+}
+
+func (s *generateAssetsTestSuite) TestArgs(c *C) {
+	generate.ResetArgs()
+	restore := mockArgs([]string{"self", "-in", "ok", "-out", "ok", "-name", "assetname"})
+	defer restore()
+	c.Assert(generate.ParseArgs(), IsNil)
+	// no input file
+	generate.ResetArgs()
+	restore = mockArgs([]string{"self", "-out", "ok", "-name", "assetname"})
+	defer restore()
+	c.Assert(generate.ParseArgs(), ErrorMatches, "input file not provided")
+	// no output file
+	restore = mockArgs([]string{"self", "-in", "in", "-name", "assetname"})
+	defer restore()
+	generate.ResetArgs()
+	c.Assert(generate.ParseArgs(), ErrorMatches, "output file not provided")
+	// no name
+	generate.ResetArgs()
+	restore = mockArgs([]string{"self", "-in", "in", "-out", "out"})
+	defer restore()
+	c.Assert(generate.ParseArgs(), ErrorMatches, "asset name not provided")
+}
+
+func (s *generateAssetsTestSuite) TestSimpleAsset(c *C) {
+	d := c.MkDir()
+	err := ioutil.WriteFile(filepath.Join(d, "in"), []byte("this is a\n"+
+		"multiline asset \"'``\nwith chars\n"), 0644)
+	c.Assert(err, IsNil)
+	err = generate.Run("asset-name", filepath.Join(d, "in"), filepath.Join(d, "out"))
+	c.Assert(err, IsNil)
+	data, err := ioutil.ReadFile(filepath.Join(d, "out"))
+	c.Assert(err, IsNil)
+
+	const exp = `// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) %d Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+// Code generated from %s DO NOT EDIT
+
+func init() {
+	registerInternal("asset-name", []byte{
+		0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x61, 0x0a, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x6c,
+		0x69, 0x6e, 0x65, 0x20, 0x61, 0x73, 0x73, 0x65, 0x74, 0x20, 0x22, 0x27, 0x60, 0x60, 0x0a, 0x77,
+		0x69, 0x74, 0x68, 0x20, 0x63, 0x68, 0x61, 0x72, 0x73, 0x0a,
+	})
+}
+`
+	c.Check(string(data), Equals, fmt.Sprintf(exp, time.Now().Year(), filepath.Join(d, "in")))
+}
+
+func (s *generateAssetsTestSuite) TestGoFmtClean(c *C) {
+	_, err := exec.LookPath("gofmt")
+	if err != nil {
+		c.Skip("gofmt is missing")
+	}
+
+	d := c.MkDir()
+	err = ioutil.WriteFile(filepath.Join(d, "in"), []byte("this is a\n"+
+		"multiline asset \"'``\nuneven chars\n"), 0644)
+	c.Assert(err, IsNil)
+	err = generate.Run("asset-name", filepath.Join(d, "in"), filepath.Join(d, "out"))
+	c.Assert(err, IsNil)
+
+	cmd := exec.Command("gofmt", "-l", "-d", filepath.Join(d, "out"))
+	out, err := cmd.CombinedOutput()
+	c.Assert(err, IsNil)
+	c.Assert(out, HasLen, 0, Commentf("output file is not gofmt clean: %s", string(out)))
+}
+
+func (s *generateAssetsTestSuite) TestRunErrors(c *C) {
+	d := c.MkDir()
+	err := generate.Run("asset-name", filepath.Join(d, "missing"), filepath.Join(d, "out"))
+	c.Assert(err, ErrorMatches, "cannot open input file: open .*/missing: no such file or directory")
+
+	err = ioutil.WriteFile(filepath.Join(d, "in"), []byte("this is a\n"+
+		"multiline asset \"'``\nuneven chars\n"), 0644)
+	c.Assert(err, IsNil)
+
+	err = generate.Run("asset-name", filepath.Join(d, "in"), filepath.Join(d, "does-not-exist", "out"))
+	c.Assert(err, ErrorMatches, `cannot open output file: open .*/does-not-exist/out\..*: no such file or directory`)
+
+}
+
+func (s *generateAssetsTestSuite) TestFormatLines(c *C) {
+	out := generate.FormatLines(bytes.Repeat([]byte{1}, 12))
+	c.Check(out, DeepEquals, []string{
+		"0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,",
+	})
+	out = generate.FormatLines(bytes.Repeat([]byte{1}, 16))
+	c.Check(out, DeepEquals, []string{
+		"0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,",
+	})
+	out = generate.FormatLines(bytes.Repeat([]byte{1}, 17))
+	c.Check(out, DeepEquals, []string{
+		"0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,",
+		"0x01,",
+	})
+	out = generate.FormatLines(bytes.Repeat([]byte{1}, 1))
+	c.Check(out, DeepEquals, []string{
+		"0x01,",
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/generate.go snapd-2.48.3+20.04/bootloader/assets/generate.go
--- snapd-2.45.1+20.04.2/bootloader/assets/generate.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/generate.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,23 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+//go:generate go run ./genasset/main.go -name grub.cfg -in ./data/grub.cfg -out ./grub_cfg_asset.go
+//go:generate go run ./genasset/main.go -name grub-recovery.cfg -in ./data/grub-recovery.cfg -out ./grub_recovery_cfg_asset.go
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/grub_cfg_asset.go snapd-2.48.3+20.04/bootloader/assets/grub_cfg_asset.go
--- snapd-2.45.1+20.04.2/bootloader/assets/grub_cfg_asset.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/grub_cfg_asset.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,110 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+// Code generated from ./data/grub.cfg DO NOT EDIT
+
+func init() {
+	registerInternal("grub.cfg", []byte{
+		0x23, 0x20, 0x53, 0x6e, 0x61, 0x70, 0x64, 0x2d, 0x42, 0x6f, 0x6f, 0x74, 0x2d, 0x43, 0x6f, 0x6e,
+		0x66, 0x69, 0x67, 0x2d, 0x45, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x0a, 0x0a,
+		0x73, 0x65, 0x74, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3d, 0x30, 0x0a, 0x73, 0x65,
+		0x74, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x3d, 0x33, 0x0a, 0x73, 0x65, 0x74, 0x20,
+		0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x3d, 0x68, 0x69,
+		0x64, 0x64, 0x65, 0x6e, 0x0a, 0x0a, 0x23, 0x20, 0x6c, 0x6f, 0x61, 0x64, 0x20, 0x6f, 0x6e, 0x6c,
+		0x79, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x20,
+		0x66, 0x72, 0x6f, 0x6d, 0x20, 0x74, 0x68, 0x65, 0x20, 0x62, 0x6f, 0x6f, 0x74, 0x65, 0x6e, 0x76,
+		0x0a, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x65, 0x6e, 0x76, 0x20, 0x2d, 0x2d, 0x66, 0x69, 0x6c, 0x65,
+		0x20, 0x2f, 0x45, 0x46, 0x49, 0x2f, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75, 0x2f, 0x67, 0x72, 0x75,
+		0x62, 0x65, 0x6e, 0x76, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74,
+		0x75, 0x73, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f, 0x63,
+		0x6d, 0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x0a, 0x0a, 0x73, 0x65, 0x74,
+		0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x63, 0x6d,
+		0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x3d, 0x27, 0x63, 0x6f, 0x6e, 0x73,
+		0x6f, 0x6c, 0x65, 0x3d, 0x74, 0x74, 0x79, 0x53, 0x30, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x6f, 0x6c,
+		0x65, 0x3d, 0x74, 0x74, 0x79, 0x31, 0x20, 0x70, 0x61, 0x6e, 0x69, 0x63, 0x3d, 0x2d, 0x31, 0x27,
+		0x0a, 0x0a, 0x73, 0x65, 0x74, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x3d, 0x6b, 0x65, 0x72,
+		0x6e, 0x65, 0x6c, 0x2e, 0x65, 0x66, 0x69, 0x0a, 0x0a, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x22, 0x24,
+		0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x20, 0x3d,
+		0x20, 0x22, 0x74, 0x72, 0x79, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20,
+		0x20, 0x20, 0x20, 0x23, 0x20, 0x61, 0x20, 0x6e, 0x65, 0x77, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65,
+		0x6c, 0x20, 0x67, 0x6f, 0x74, 0x20, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x65, 0x64, 0x0a,
+		0x20, 0x20, 0x20, 0x20, 0x73, 0x65, 0x74, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73,
+		0x74, 0x61, 0x74, 0x75, 0x73, 0x3d, 0x22, 0x74, 0x72, 0x79, 0x69, 0x6e, 0x67, 0x22, 0x0a, 0x20,
+		0x20, 0x20, 0x20, 0x73, 0x61, 0x76, 0x65, 0x5f, 0x65, 0x6e, 0x76, 0x20, 0x6b, 0x65, 0x72, 0x6e,
+		0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x0a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23,
+		0x20, 0x75, 0x73, 0x65, 0x20, 0x74, 0x72, 0x79, 0x2d, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x2e,
+		0x65, 0x66, 0x69, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x73, 0x65, 0x74, 0x20, 0x6b, 0x65, 0x72, 0x6e,
+		0x65, 0x6c, 0x3d, 0x74, 0x72, 0x79, 0x2d, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x2e, 0x65, 0x66,
+		0x69, 0x0a, 0x65, 0x6c, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x22, 0x24, 0x6b, 0x65, 0x72, 0x6e, 0x65,
+		0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x20, 0x3d, 0x20, 0x22, 0x74, 0x72, 0x79,
+		0x69, 0x6e, 0x67, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20, 0x20,
+		0x20, 0x23, 0x20, 0x6e, 0x6f, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x20, 0x63, 0x6c, 0x65, 0x61, 0x72,
+		0x65, 0x64, 0x20, 0x74, 0x68, 0x65, 0x20, 0x22, 0x74, 0x72, 0x79, 0x69, 0x6e, 0x67, 0x20, 0x73,
+		0x6e, 0x61, 0x70, 0x22, 0x20, 0x73, 0x6f, 0x20, 0x74, 0x68, 0x65, 0x20, 0x62, 0x6f, 0x6f, 0x74,
+		0x20, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20, 0x77, 0x65,
+		0x20, 0x63, 0x6c, 0x65, 0x61, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6d, 0x6f, 0x64, 0x65, 0x20,
+		0x61, 0x6e, 0x64, 0x20, 0x62, 0x6f, 0x6f, 0x74, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x6c,
+		0x79, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x73, 0x65, 0x74, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c,
+		0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x3d, 0x22, 0x22, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x73,
+		0x61, 0x76, 0x65, 0x5f, 0x65, 0x6e, 0x76, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73,
+		0x74, 0x61, 0x74, 0x75, 0x73, 0x0a, 0x65, 0x6c, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x6e, 0x20,
+		0x22, 0x24, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22,
+		0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20, 0x45,
+		0x52, 0x52, 0x4f, 0x52, 0x20, 0x69, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x6b, 0x65, 0x72,
+		0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x20, 0x73, 0x74, 0x61, 0x74, 0x65,
+		0x2c, 0x20, 0x72, 0x65, 0x73, 0x65, 0x74, 0x20, 0x74, 0x6f, 0x20, 0x65, 0x6d, 0x70, 0x74, 0x79,
+		0x0a, 0x20, 0x20, 0x20, 0x20, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x22, 0x69, 0x6e, 0x76, 0x61, 0x6c,
+		0x69, 0x64, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+		0x21, 0x21, 0x21, 0x22, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x22, 0x72,
+		0x65, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x20, 0x74, 0x6f, 0x20, 0x65, 0x6d, 0x70, 0x74,
+		0x79, 0x22, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x73, 0x65, 0x74, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65,
+		0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x3d, 0x22, 0x22, 0x0a, 0x20, 0x20, 0x20, 0x20,
+		0x73, 0x61, 0x76, 0x65, 0x5f, 0x65, 0x6e, 0x76, 0x20, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f,
+		0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x0a, 0x66, 0x69, 0x0a, 0x0a, 0x69, 0x66, 0x20, 0x5b, 0x20,
+		0x2d, 0x65, 0x20, 0x24, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x2f, 0x24, 0x6b, 0x65, 0x72, 0x6e,
+		0x65, 0x6c, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x6d, 0x65, 0x6e, 0x75, 0x65,
+		0x6e, 0x74, 0x72, 0x79, 0x20, 0x22, 0x52, 0x75, 0x6e, 0x20, 0x55, 0x62, 0x75, 0x6e, 0x74, 0x75,
+		0x20, 0x43, 0x6f, 0x72, 0x65, 0x20, 0x32, 0x30, 0x22, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+		0x23, 0x20, 0x75, 0x73, 0x65, 0x20, 0x24, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x20, 0x62, 0x65,
+		0x63, 0x61, 0x75, 0x73, 0x65, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x79, 0x6d, 0x6c, 0x69, 0x6e,
+		0x6b, 0x20, 0x6d, 0x61, 0x6e, 0x69, 0x70, 0x75, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61,
+		0x74, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x6b, 0x65,
+		0x72, 0x6e, 0x65, 0x6c, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20,
+		0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x73, 0x2c, 0x20, 0x65, 0x74, 0x63, 0x2e, 0x20, 0x73,
+		0x68, 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x6f, 0x6e, 0x6c, 0x79, 0x20, 0x6e, 0x65, 0x65, 0x64, 0x20,
+		0x74, 0x68, 0x65, 0x20, 0x2f, 0x62, 0x6f, 0x6f, 0x74, 0x2f, 0x67, 0x72, 0x75, 0x62, 0x2f, 0x20,
+		0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x2c, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x74,
+		0x68, 0x65, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20, 0x2f, 0x45, 0x46, 0x49, 0x2f, 0x75, 0x62,
+		0x75, 0x6e, 0x74, 0x75, 0x2f, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x0a,
+		0x20, 0x20, 0x20, 0x20, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x65, 0x72, 0x20,
+		0x24, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x2f, 0x24, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x20,
+		0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6d,
+		0x6f, 0x64, 0x65, 0x3d, 0x72, 0x75, 0x6e, 0x20, 0x24, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x73,
+		0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72,
+		0x67, 0x73, 0x20, 0x24, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f,
+		0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x0a, 0x7d, 0x0a, 0x65,
+		0x6c, 0x73, 0x65, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20, 0x6e, 0x6f, 0x74, 0x68, 0x69, 0x6e,
+		0x67, 0x20, 0x74, 0x6f, 0x20, 0x62, 0x6f, 0x6f, 0x74, 0x20, 0x3a, 0x2d, 0x2f, 0x0a, 0x20, 0x20,
+		0x20, 0x20, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x22, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x20,
+		0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x20, 0x61, 0x74, 0x20, 0x24, 0x70, 0x72, 0x65, 0x66, 0x69,
+		0x78, 0x2f, 0x24, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x21, 0x22, 0x0a, 0x66, 0x69, 0x0a,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/grub.go snapd-2.48.3+20.04/bootloader/assets/grub.go
--- snapd-2.45.1+20.04.2/bootloader/assets/grub.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/grub.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,29 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+func init() {
+	registerSnippetForEditions("grub.cfg:static-cmdline", []ForEditions{
+		{FirstEdition: 1, Snippet: []byte("console=ttyS0 console=tty1 panic=-1")},
+	})
+	registerSnippetForEditions("grub-recovery.cfg:static-cmdline", []ForEditions{
+		{FirstEdition: 1, Snippet: []byte("console=ttyS0 console=tty1 panic=-1")},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/grub_recovery_cfg_asset.go snapd-2.48.3+20.04/bootloader/assets/grub_recovery_cfg_asset.go
--- snapd-2.45.1+20.04.2/bootloader/assets/grub_recovery_cfg_asset.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/grub_recovery_cfg_asset.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,157 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets
+
+// Code generated from ./data/grub-recovery.cfg DO NOT EDIT
+
+func init() {
+	registerInternal("grub-recovery.cfg", []byte{
+		0x23, 0x20, 0x53, 0x6e, 0x61, 0x70, 0x64, 0x2d, 0x42, 0x6f, 0x6f, 0x74, 0x2d, 0x43, 0x6f, 0x6e,
+		0x66, 0x69, 0x67, 0x2d, 0x45, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x0a, 0x0a,
+		0x73, 0x65, 0x74, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3d, 0x30, 0x0a, 0x73, 0x65,
+		0x74, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x3d, 0x33, 0x0a, 0x73, 0x65, 0x74, 0x20,
+		0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x3d, 0x68, 0x69,
+		0x64, 0x64, 0x65, 0x6e, 0x0a, 0x0a, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x65, 0x20, 0x2f, 0x45,
+		0x46, 0x49, 0x2f, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75, 0x2f, 0x67, 0x72, 0x75, 0x62, 0x65, 0x6e,
+		0x76, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20, 0x20, 0x6c, 0x6f, 0x61,
+		0x64, 0x5f, 0x65, 0x6e, 0x76, 0x20, 0x2d, 0x2d, 0x66, 0x69, 0x6c, 0x65, 0x20, 0x2f, 0x45, 0x46,
+		0x49, 0x2f, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75, 0x2f, 0x67, 0x72, 0x75, 0x62, 0x65, 0x6e, 0x76,
+		0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f,
+		0x6d, 0x6f, 0x64, 0x65, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76,
+		0x65, 0x72, 0x79, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x0a, 0x66, 0x69, 0x0a, 0x0a, 0x23,
+		0x20, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x20, 0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e,
+		0x65, 0x20, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x0a, 0x73, 0x65, 0x74, 0x20, 0x73, 0x6e, 0x61,
+		0x70, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e,
+		0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x3d, 0x27, 0x63, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0x3d,
+		0x74, 0x74, 0x79, 0x53, 0x30, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0x3d, 0x74, 0x74,
+		0x79, 0x31, 0x20, 0x70, 0x61, 0x6e, 0x69, 0x63, 0x3d, 0x2d, 0x31, 0x27, 0x0a, 0x0a, 0x23, 0x20,
+		0x69, 0x66, 0x20, 0x6e, 0x6f, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x20, 0x62, 0x6f,
+		0x6f, 0x74, 0x20, 0x6d, 0x6f, 0x64, 0x65, 0x20, 0x73, 0x65, 0x74, 0x2c, 0x20, 0x70, 0x69, 0x63,
+		0x6b, 0x20, 0x6f, 0x6e, 0x65, 0x0a, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x7a, 0x20, 0x22, 0x24,
+		0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6d,
+		0x6f, 0x64, 0x65, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20, 0x20,
+		0x20, 0x73, 0x65, 0x74, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76,
+		0x65, 0x72, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x3d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c,
+		0x0a, 0x66, 0x69, 0x0a, 0x0a, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x22, 0x24, 0x73, 0x6e, 0x61, 0x70,
+		0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x22,
+		0x20, 0x3d, 0x20, 0x22, 0x72, 0x75, 0x6e, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e,
+		0x0a, 0x20, 0x20, 0x20, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3d, 0x22, 0x72, 0x75,
+		0x6e, 0x22, 0x0a, 0x65, 0x6c, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x6e, 0x20, 0x22, 0x24, 0x73,
+		0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x73, 0x79,
+		0x73, 0x74, 0x65, 0x6d, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20,
+		0x20, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3d, 0x24, 0x73, 0x6e, 0x61, 0x70, 0x64,
+		0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x2d, 0x24,
+		0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x73,
+		0x79, 0x73, 0x74, 0x65, 0x6d, 0x0a, 0x66, 0x69, 0x0a, 0x0a, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
+		0x20, 0x2d, 0x2d, 0x6e, 0x6f, 0x2d, 0x66, 0x6c, 0x6f, 0x70, 0x70, 0x79, 0x20, 0x2d, 0x2d, 0x73,
+		0x65, 0x74, 0x3d, 0x62, 0x6f, 0x6f, 0x74, 0x5f, 0x66, 0x73, 0x20, 0x2d, 0x2d, 0x6c, 0x61, 0x62,
+		0x65, 0x6c, 0x20, 0x75, 0x62, 0x75, 0x6e, 0x74, 0x75, 0x2d, 0x62, 0x6f, 0x6f, 0x74, 0x0a, 0x0a,
+		0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x6e, 0x20, 0x22, 0x24, 0x62, 0x6f, 0x6f, 0x74, 0x5f, 0x66,
+		0x73, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x6d,
+		0x65, 0x6e, 0x75, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x20, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e,
+		0x75, 0x65, 0x20, 0x74, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x20, 0x6d, 0x6f, 0x64, 0x65, 0x22, 0x20,
+		0x2d, 0x2d, 0x68, 0x6f, 0x74, 0x6b, 0x65, 0x79, 0x3d, 0x6e, 0x20, 0x2d, 0x2d, 0x69, 0x64, 0x3d,
+		0x72, 0x75, 0x6e, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x68,
+		0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x65, 0x72, 0x20, 0x28, 0x24, 0x62, 0x6f, 0x6f, 0x74,
+		0x5f, 0x66, 0x73, 0x29, 0x2f, 0x45, 0x46, 0x49, 0x2f, 0x62, 0x6f, 0x6f, 0x74, 0x2f, 0x67, 0x72,
+		0x75, 0x62, 0x78, 0x36, 0x34, 0x2e, 0x65, 0x66, 0x69, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a,
+		0x66, 0x69, 0x0a, 0x0a, 0x23, 0x20, 0x67, 0x6c, 0x6f, 0x62, 0x62, 0x69, 0x6e, 0x67, 0x20, 0x69,
+		0x6e, 0x20, 0x67, 0x72, 0x75, 0x62, 0x20, 0x64, 0x6f, 0x65, 0x73, 0x20, 0x6e, 0x6f, 0x74, 0x20,
+		0x73, 0x6f, 0x72, 0x74, 0x0a, 0x66, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x20, 0x69,
+		0x6e, 0x20, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x2f, 0x2a, 0x3b, 0x20, 0x64, 0x6f,
+		0x0a, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x67, 0x65, 0x78, 0x70, 0x20, 0x2d, 0x2d, 0x73, 0x65,
+		0x74, 0x20, 0x31, 0x3a, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x20, 0x22, 0x2f, 0x28, 0x5b, 0x30, 0x2d,
+		0x39, 0x5d, 0x2a, 0x29, 0x5c, 0x24, 0x22, 0x20, 0x22, 0x24, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x22,
+		0x0a, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x7a, 0x20, 0x22, 0x24, 0x6c,
+		0x61, 0x62, 0x65, 0x6c, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20,
+		0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x0a, 0x20,
+		0x20, 0x20, 0x20, 0x66, 0x69, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20, 0x79, 0x65, 0x73, 0x2c,
+		0x20, 0x79, 0x6f, 0x75, 0x20, 0x6e, 0x65, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x62, 0x61, 0x63,
+		0x6b, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x20, 0x74, 0x68, 0x61, 0x74, 0x20, 0x6c, 0x65, 0x73, 0x73,
+		0x2d, 0x74, 0x68, 0x61, 0x6e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d,
+		0x7a, 0x20, 0x22, 0x24, 0x62, 0x65, 0x73, 0x74, 0x22, 0x20, 0x2d, 0x6f, 0x20, 0x22, 0x24, 0x6c,
+		0x61, 0x62, 0x65, 0x6c, 0x22, 0x20, 0x5c, 0x3c, 0x20, 0x22, 0x24, 0x62, 0x65, 0x73, 0x74, 0x22,
+		0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+		0x20, 0x73, 0x65, 0x74, 0x20, 0x62, 0x65, 0x73, 0x74, 0x3d, 0x22, 0x24, 0x6c, 0x61, 0x62, 0x65,
+		0x6c, 0x22, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x66, 0x69, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x23, 0x20,
+		0x69, 0x66, 0x20, 0x67, 0x72, 0x75, 0x62, 0x65, 0x6e, 0x76, 0x20, 0x64, 0x69, 0x64, 0x20, 0x6e,
+		0x6f, 0x74, 0x20, 0x70, 0x69, 0x63, 0x6b, 0x20, 0x6d, 0x6f, 0x64, 0x65, 0x2d, 0x73, 0x79, 0x73,
+		0x74, 0x65, 0x6d, 0x2c, 0x20, 0x75, 0x73, 0x65, 0x20, 0x62, 0x65, 0x73, 0x74, 0x20, 0x6f, 0x6e,
+		0x65, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x5b, 0x20, 0x2d, 0x7a, 0x20, 0x22, 0x24,
+		0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x73,
+		0x79, 0x73, 0x74, 0x65, 0x6d, 0x22, 0x20, 0x5d, 0x3b, 0x20, 0x74, 0x68, 0x65, 0x6e, 0x0a, 0x20,
+		0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3d, 0x24,
+		0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6d,
+		0x6f, 0x64, 0x65, 0x2d, 0x24, 0x62, 0x65, 0x73, 0x74, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x66, 0x69,
+		0x0a, 0x20, 0x20, 0x20, 0x20, 0x73, 0x65, 0x74, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72,
+		0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x3d, 0x0a,
+		0x20, 0x20, 0x20, 0x20, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x65, 0x6e, 0x76, 0x20, 0x2d, 0x2d, 0x66,
+		0x69, 0x6c, 0x65, 0x20, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x2f, 0x24, 0x6c, 0x61,
+		0x62, 0x65, 0x6c, 0x2f, 0x67, 0x72, 0x75, 0x62, 0x65, 0x6e, 0x76, 0x20, 0x73, 0x6e, 0x61, 0x70,
+		0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6b, 0x65, 0x72, 0x6e, 0x65,
+		0x6c, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f, 0x63, 0x6d,
+		0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x0a, 0x0a, 0x20, 0x20, 0x20, 0x20,
+		0x23, 0x20, 0x57, 0x65, 0x20, 0x63, 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x22, 0x73, 0x6f, 0x75, 0x72,
+		0x63, 0x65, 0x20, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x2f, 0x24, 0x73, 0x6e, 0x61,
+		0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x73, 0x79, 0x73, 0x74,
+		0x65, 0x6d, 0x2f, 0x67, 0x72, 0x75, 0x62, 0x2e, 0x63, 0x66, 0x67, 0x22, 0x20, 0x68, 0x65, 0x72,
+		0x65, 0x20, 0x61, 0x73, 0x20, 0x77, 0x65, 0x6c, 0x6c, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x6d, 0x65,
+		0x6e, 0x75, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x20, 0x22, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72,
+		0x20, 0x75, 0x73, 0x69, 0x6e, 0x67, 0x20, 0x24, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x22, 0x20, 0x2d,
+		0x2d, 0x68, 0x6f, 0x74, 0x6b, 0x65, 0x79, 0x3d, 0x72, 0x20, 0x2d, 0x2d, 0x69, 0x64, 0x3d, 0x72,
+		0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x2d, 0x24, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x20, 0x24, 0x73,
+		0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6b, 0x65,
+		0x72, 0x6e, 0x65, 0x6c, 0x20, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x24, 0x6c, 0x61,
+		0x62, 0x65, 0x6c, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6c, 0x6f,
+		0x6f, 0x70, 0x62, 0x61, 0x63, 0x6b, 0x20, 0x6c, 0x6f, 0x6f, 0x70, 0x20, 0x24, 0x32, 0x0a, 0x20,
+		0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x61, 0x64,
+		0x65, 0x72, 0x20, 0x28, 0x6c, 0x6f, 0x6f, 0x70, 0x29, 0x2f, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c,
+		0x2e, 0x65, 0x66, 0x69, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76,
+		0x65, 0x72, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x3d, 0x24, 0x33, 0x20, 0x73, 0x6e, 0x61, 0x70,
+		0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65,
+		0x6d, 0x3d, 0x24, 0x34, 0x20, 0x24, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74,
+		0x69, 0x63, 0x5f, 0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x20,
+		0x24, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f, 0x63, 0x6d, 0x64,
+		0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a,
+		0x20, 0x20, 0x20, 0x20, 0x6d, 0x65, 0x6e, 0x75, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x20, 0x22, 0x49,
+		0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x20, 0x75, 0x73, 0x69, 0x6e, 0x67, 0x20, 0x24, 0x6c, 0x61,
+		0x62, 0x65, 0x6c, 0x22, 0x20, 0x2d, 0x2d, 0x68, 0x6f, 0x74, 0x6b, 0x65, 0x79, 0x3d, 0x69, 0x20,
+		0x2d, 0x2d, 0x69, 0x64, 0x3d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x2d, 0x24, 0x6c, 0x61,
+		0x62, 0x65, 0x6c, 0x20, 0x24, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76,
+		0x65, 0x72, 0x79, 0x5f, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x20, 0x69, 0x6e, 0x73, 0x74, 0x61,
+		0x6c, 0x6c, 0x20, 0x24, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+		0x20, 0x20, 0x20, 0x20, 0x6c, 0x6f, 0x6f, 0x70, 0x62, 0x61, 0x63, 0x6b, 0x20, 0x6c, 0x6f, 0x6f,
+		0x70, 0x20, 0x24, 0x32, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x68, 0x61,
+		0x69, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x65, 0x72, 0x20, 0x28, 0x6c, 0x6f, 0x6f, 0x70, 0x29, 0x2f,
+		0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x2e, 0x65, 0x66, 0x69, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64,
+		0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x3d, 0x24,
+		0x33, 0x20, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79,
+		0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x3d, 0x24, 0x34, 0x20, 0x24, 0x73, 0x6e, 0x61, 0x70,
+		0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e, 0x65,
+		0x5f, 0x61, 0x72, 0x67, 0x73, 0x20, 0x24, 0x73, 0x6e, 0x61, 0x70, 0x64, 0x5f, 0x65, 0x78, 0x74,
+		0x72, 0x61, 0x5f, 0x63, 0x6d, 0x64, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x0a,
+		0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x64, 0x6f, 0x6e, 0x65, 0x0a, 0x0a, 0x6d, 0x65, 0x6e, 0x75,
+		0x65, 0x6e, 0x74, 0x72, 0x79, 0x20, 0x27, 0x55, 0x45, 0x46, 0x49, 0x20, 0x46, 0x69, 0x72, 0x6d,
+		0x77, 0x61, 0x72, 0x65, 0x20, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x27, 0x20, 0x2d,
+		0x2d, 0x68, 0x6f, 0x74, 0x6b, 0x65, 0x79, 0x3d, 0x66, 0x20, 0x27, 0x75, 0x65, 0x66, 0x69, 0x2d,
+		0x66, 0x69, 0x72, 0x6d, 0x77, 0x61, 0x72, 0x65, 0x27, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+		0x66, 0x77, 0x73, 0x65, 0x74, 0x75, 0x70, 0x0a, 0x7d, 0x0a,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/assets/grub_test.go snapd-2.48.3+20.04/bootloader/assets/grub_test.go
--- snapd-2.45.1+20.04.2/bootloader/assets/grub_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/assets/grub_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,128 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assets_test
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/bootloader/assets"
+	"github.com/snapcore/snapd/testutil"
+)
+
+// Hook up check.v1 into the "go test" runner
+func Test(t *testing.T) { TestingT(t) }
+
+type grubAssetsTestSuite struct{}
+
+var _ = Suite(&grubAssetsTestSuite{})
+
+func (s *grubAssetsTestSuite) testGrubConfigContains(c *C, name string, keys ...string) {
+	a := assets.Internal(name)
+	c.Assert(a, NotNil)
+	as := string(a)
+	for _, canary := range keys {
+		c.Assert(as, testutil.Contains, canary)
+	}
+	idx := bytes.IndexRune(a, '\n')
+	c.Assert(idx, Not(Equals), -1)
+	c.Assert(string(a[:idx]), Equals, "# Snapd-Boot-Config-Edition: 1")
+}
+
+func (s *grubAssetsTestSuite) TestGrubConf(c *C) {
+	s.testGrubConfigContains(c, "grub.cfg",
+		"snapd_recovery_mode",
+		"set snapd_static_cmdline_args='console=ttyS0 console=tty1 panic=-1'",
+	)
+}
+
+func (s *grubAssetsTestSuite) TestGrubRecoveryConf(c *C) {
+	s.testGrubConfigContains(c, "grub-recovery.cfg",
+		"snapd_recovery_mode",
+		"snapd_recovery_system",
+		"set snapd_static_cmdline_args='console=ttyS0 console=tty1 panic=-1'",
+	)
+}
+
+func (s *grubAssetsTestSuite) TestGrubCmdlineSnippetEditions(c *C) {
+	for _, tc := range []struct {
+		asset   string
+		edition uint
+		snip    []byte
+	}{
+		{"grub.cfg:static-cmdline", 1, []byte("console=ttyS0 console=tty1 panic=-1")},
+		{"grub-recovery.cfg:static-cmdline", 1, []byte("console=ttyS0 console=tty1 panic=-1")},
+	} {
+		snip := assets.SnippetForEdition(tc.asset, tc.edition)
+		c.Assert(snip, NotNil)
+		c.Check(snip, DeepEquals, tc.snip)
+	}
+}
+
+func (s *grubAssetsTestSuite) TestGrubCmdlineSnippetCrossCheck(c *C) {
+	for _, tc := range []struct {
+		asset   string
+		snippet string
+		edition uint
+		content []byte
+		pattern string
+	}{
+		{
+			asset: "grub.cfg", snippet: "grub.cfg:static-cmdline", edition: 1,
+			content: []byte("console=ttyS0 console=tty1 panic=-1"),
+			pattern: "set snapd_static_cmdline_args='%s'\n",
+		},
+		{
+			asset: "grub-recovery.cfg", snippet: "grub-recovery.cfg:static-cmdline", edition: 1,
+			content: []byte("console=ttyS0 console=tty1 panic=-1"),
+			pattern: "set snapd_static_cmdline_args='%s'\n",
+		},
+	} {
+		grubCfg := assets.Internal(tc.asset)
+		c.Assert(grubCfg, NotNil)
+		prefix := fmt.Sprintf("# Snapd-Boot-Config-Edition: %d", tc.edition)
+		c.Assert(bytes.HasPrefix(grubCfg, []byte(prefix)), Equals, true)
+		// get a matching snippet
+		snip := assets.SnippetForEdition(tc.snippet, tc.edition)
+		c.Assert(snip, NotNil)
+		c.Assert(snip, DeepEquals, tc.content)
+		c.Assert(string(grubCfg), testutil.Contains, fmt.Sprintf(tc.pattern, string(snip)))
+	}
+}
+
+func (s *grubAssetsTestSuite) TestGrubAssetsWereRegenerated(c *C) {
+	for _, tc := range []struct {
+		asset string
+		file  string
+	}{
+		{"grub.cfg", "data/grub.cfg"},
+		{"grub-recovery.cfg", "data/grub-recovery.cfg"},
+	} {
+		assetData := assets.Internal(tc.asset)
+		c.Assert(assetData, NotNil)
+		data, err := ioutil.ReadFile(tc.file)
+		c.Assert(err, IsNil)
+		c.Check(assetData, DeepEquals, data, Commentf("asset %q has not been updated", tc.asset))
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/asset_test.go snapd-2.48.3+20.04/bootloader/asset_test.go
--- snapd-2.45.1+20.04.2/bootloader/asset_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/asset_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,129 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2015 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package bootloader_test
+
+import (
+	"bytes"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/assets"
+)
+
+type configAssetTestSuite struct {
+	baseBootenvTestSuite
+}
+
+var _ = Suite(&configAssetTestSuite{})
+
+func (s *configAssetTestSuite) TestTrivialFromConfigAssert(c *C) {
+	e, err := bootloader.EditionFromConfigAsset(bytes.NewBufferString(`# Snapd-Boot-Config-Edition: 321
+next line
+one after that`))
+	c.Assert(err, IsNil)
+	c.Assert(e, Equals, uint(321))
+
+	e, err = bootloader.EditionFromConfigAsset(bytes.NewBufferString(`# Snapd-Boot-Config-Edition: 932
+# Snapd-Boot-Config-Edition: 321
+one after that`))
+	c.Assert(err, IsNil)
+	c.Assert(e, Equals, uint(932))
+
+	e, err = bootloader.EditionFromConfigAsset(bytes.NewBufferString(`# Snapd-Boot-Config-Edition: 1234
+one after that
+# Snapd-Boot-Config-Edition: 321
+`))
+	c.Assert(err, IsNil)
+	c.Assert(e, Equals, uint(1234))
+}
+
+func (s *configAssetTestSuite) TestTrivialFromFile(c *C) {
+	d := c.MkDir()
+	p := filepath.Join(d, "foo")
+	ioutil.WriteFile(p, []byte(`# Snapd-Boot-Config-Edition: 123
+this is some
+this too`), 0644)
+	e, err := bootloader.EditionFromDiskConfigAsset(p)
+	c.Assert(err, IsNil)
+	c.Assert(e, Equals, uint(123))
+}
+
+func (s *configAssetTestSuite) TestRealConfig(c *C) {
+	grubConfig := assets.Internal("grub.cfg")
+	c.Assert(grubConfig, NotNil)
+	e, err := bootloader.EditionFromConfigAsset(bytes.NewReader(grubConfig))
+	c.Assert(err, IsNil)
+	c.Assert(e, Equals, uint(1))
+}
+
+func (s *configAssetTestSuite) TestNoConfig(c *C) {
+	_, err := bootloader.EditionFromConfigAsset(bytes.NewReader(nil))
+	c.Assert(err, ErrorMatches, "cannot read config asset: unexpected EOF")
+}
+
+func (s *configAssetTestSuite) TestNoFile(c *C) {
+	d := c.MkDir()
+	p := filepath.Join(d, "foo")
+	// file does not exist
+	_, err := bootloader.EditionFromDiskConfigAsset(p)
+	c.Assert(err, ErrorMatches, "no edition")
+}
+
+func (s *configAssetTestSuite) TestUnreadableFile(c *C) {
+	// root has DAC override
+	if os.Geteuid() == 0 {
+		c.Skip("test case cannot be correctly executed by root")
+	}
+	d := c.MkDir()
+	p := filepath.Join(d, "foo")
+	err := ioutil.WriteFile(p, []byte("foo"), 0000)
+	c.Assert(err, IsNil)
+	_, err = bootloader.EditionFromDiskConfigAsset(p)
+	c.Assert(err, ErrorMatches, "cannot load existing config asset: .*/foo: permission denied")
+}
+
+func (s *configAssetTestSuite) TestNoEdition(c *C) {
+	_, err := bootloader.EditionFromConfigAsset(bytes.NewReader([]byte(`this is some script
+without edition header
+`)))
+	c.Assert(err, ErrorMatches, "no edition")
+}
+
+func (s *configAssetTestSuite) TestBadEdition(c *C) {
+	_, err := bootloader.EditionFromConfigAsset(bytes.NewReader([]byte(`# Snapd-Boot-Config-Edition: random
+data follows
+`)))
+	c.Assert(err, ErrorMatches, `cannot parse asset edition: .* parsing "random": invalid syntax`)
+}
+
+func (s *configAssetTestSuite) TestConfigAssetFrom(c *C) {
+	script := []byte(`# Snapd-Boot-Config-Edition: 123
+data follows
+`)
+	bs, err := bootloader.ConfigAssetFrom(script)
+	c.Assert(err, IsNil)
+	c.Assert(bs, NotNil)
+	c.Assert(bs.Edition(), Equals, uint(123))
+	c.Assert(bs.Raw(), DeepEquals, script)
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/bootloader.go snapd-2.48.3+20.04/bootloader/bootloader.go
--- snapd-2.45.1+20.04.2/bootloader/bootloader.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/bootloader.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2015 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -25,6 +25,7 @@
 	"os"
 	"path/filepath"
 
+	"github.com/snapcore/snapd/bootloader/assets"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
@@ -39,6 +40,18 @@
 	ErrNoTryKernelRef = errors.New("no try-kernel referenced")
 )
 
+// Role indicates whether the bootloader is used for recovery or run mode.
+type Role string
+
+const (
+	// RoleSole applies to the sole bootloader used by UC16/18.
+	RoleSole Role = ""
+	// RoleRunMode applies to the run mode booloader.
+	RoleRunMode Role = "run-mode"
+	// RoleRecovery apllies to the recovery bootloader.
+	RoleRecovery Role = "recovery"
+)
+
 // Options carries bootloader options.
 type Options struct {
 	// PrepareImageTime indicates whether the booloader is being
@@ -46,16 +59,25 @@
 	// system.
 	PrepareImageTime bool
 
-	// Recovery indicates to use the recovery bootloader. Note that
-	// UC16/18 do not have a recovery partition.
-	Recovery bool
+	// Role specifies to use the bootloader for the given role.
+	Role Role
 
-	// NoSlashBoot indicates to use the run mode bootloader but
-	// under the native layout and not the /boot mount.
+	// NoSlashBoot indicates to use the native layout of the
+	// bootloader partition and not the /boot mount.
+	// It applies only for RoleRunMode.
+	// It is implied and ignored for RoleRecovery.
+	// It is an error to set it for RoleSole.
 	NoSlashBoot bool
+}
 
-	// ExtractedRunKernelImage is whether to force kernel asset extraction.
-	ExtractedRunKernelImage bool
+func (o *Options) validate() error {
+	if o == nil {
+		return nil
+	}
+	if o.NoSlashBoot && o.Role == RoleSole {
+		return fmt.Errorf("internal error: bootloader.RoleSole doesn't expect NoSlashBoot set")
+	}
+	return nil
 }
 
 // Bootloader provides an interface to interact with the system
@@ -74,9 +96,8 @@
 	ConfigFile() string
 
 	// InstallBootConfig will try to install the boot config in the
-	// given gadgetDir to rootdir. If no boot config for this bootloader
-	// is found ok is false.
-	InstallBootConfig(gadgetDir string, opts *Options) (ok bool, err error)
+	// given gadgetDir to rootdir.
+	InstallBootConfig(gadgetDir string, opts *Options) error
 
 	// ExtractKernelAssets extracts kernel assets from the given kernel snap.
 	ExtractKernelAssets(s snap.PlaceInfo, snapf snap.Container) error
@@ -93,6 +114,7 @@
 type RecoveryAwareBootloader interface {
 	Bootloader
 	SetRecoverySystemEnv(recoverySystemDir string, values map[string]string) error
+	GetRecoverySystemEnv(recoverySystemDir string, key string) (string, error)
 }
 
 type ExtractedRecoveryKernelImageBootloader interface {
@@ -139,30 +161,110 @@
 	DisableTryKernel() error
 }
 
-func genericInstallBootConfig(gadgetFile, systemFile string) (bool, error) {
-	if !osutil.FileExists(gadgetFile) {
-		return false, nil
+// TrustedAssetsBootloader has boot assets that take part in the secure boot
+// process and need to be tracked, while other boot assets (typically boot
+// config) are managed by snapd.
+type TrustedAssetsBootloader interface {
+	Bootloader
+
+	// ManagedAssets returns a list of boot assets managed by the bootloader
+	// in the boot filesystem. Does not require rootdir to be set.
+	ManagedAssets() []string
+	// UpdateBootConfig updates the boot config assets used by the bootloader.
+	UpdateBootConfig(*Options) error
+	// CommandLine returns the kernel command line composed of mode and
+	// system arguments, built-in bootloader specific static arguments
+	// corresponding to the on-disk boot asset edition, followed by any
+	// extra arguments. The command line may be different when using a
+	// recovery bootloader.
+	CommandLine(modeArg, systemArg, extraArgs string) (string, error)
+	// CandidateCommandLine is similar to CommandLine, but uses the current
+	// edition of managed built-in boot assets as reference.
+	CandidateCommandLine(modeArg, systemArg, extraArgs string) (string, error)
+
+	// TrustedAssets returns the list of relative paths to assets inside the
+	// bootloader's rootdir that are measured in the boot process in the
+	// order of loading during the boot. Does not require rootdir to be set.
+	TrustedAssets() ([]string, error)
+
+	// RecoveryBootChain returns the load chain for recovery modes.
+	// It should be called on a RoleRecovery bootloader.
+	RecoveryBootChain(kernelPath string) ([]BootFile, error)
+
+	// BootChain returns the load chain for run mode.
+	// It should be called on a RoleRecovery bootloader passing the
+	// RoleRunMode bootloader.
+	BootChain(runBl Bootloader, kernelPath string) ([]BootFile, error)
+}
+
+func genericInstallBootConfig(gadgetFile, systemFile string) error {
+	if err := os.MkdirAll(filepath.Dir(systemFile), 0755); err != nil {
+		return err
+	}
+	return osutil.CopyFile(gadgetFile, systemFile, osutil.CopyFlagOverwrite)
+}
+
+func genericSetBootConfigFromAsset(systemFile, assetName string) error {
+	bootConfig := assets.Internal(assetName)
+	if bootConfig == nil {
+		return fmt.Errorf("internal error: no boot asset for %q", assetName)
 	}
 	if err := os.MkdirAll(filepath.Dir(systemFile), 0755); err != nil {
-		return true, err
+		return err
 	}
-	return true, osutil.CopyFile(gadgetFile, systemFile, osutil.CopyFlagOverwrite)
+	return osutil.AtomicWriteFile(systemFile, bootConfig, 0644, 0)
+}
+
+func genericUpdateBootConfigFromAssets(systemFile string, assetName string) error {
+	currentBootConfigEdition, err := editionFromDiskConfigAsset(systemFile)
+	if err != nil && err != errNoEdition {
+		return err
+	}
+	if err == errNoEdition {
+		return nil
+	}
+	newBootConfig := assets.Internal(assetName)
+	if len(newBootConfig) == 0 {
+		return fmt.Errorf("no boot config asset with name %q", assetName)
+	}
+	bc, err := configAssetFrom(newBootConfig)
+	if err != nil {
+		return err
+	}
+	if bc.Edition() <= currentBootConfigEdition {
+		// edition of the candidate boot config is lower than or equal
+		// to one currently installed
+		return nil
+	}
+	return osutil.AtomicWriteFile(systemFile, bc.Raw(), 0644, 0)
 }
 
 // InstallBootConfig installs the bootloader config from the gadget
 // snap dir into the right place.
 func InstallBootConfig(gadgetDir, rootDir string, opts *Options) error {
-	for _, bl := range []installableBootloader{&grub{}, &uboot{}, &androidboot{}, &lk{}} {
-		bl.setRootDir(rootDir)
-		ok, err := bl.InstallBootConfig(gadgetDir, opts)
-		if ok {
-			return err
-		}
+	if err := opts.validate(); err != nil {
+		return err
 	}
-
-	return fmt.Errorf("cannot find boot config in %q", gadgetDir)
+	bl, err := ForGadget(gadgetDir, rootDir, opts)
+	if err != nil {
+		return fmt.Errorf("cannot find boot config in %q", gadgetDir)
+	}
+	return bl.InstallBootConfig(gadgetDir, opts)
 }
 
+type bootloaderNewFunc func(rootdir string, opts *Options) Bootloader
+
+var (
+	//  bootloaders list all possible bootloaders by their constructor
+	//  function.
+	bootloaders = []bootloaderNewFunc{
+		newUboot,
+		newGrub,
+		newAndroidBoot,
+		newLk,
+	}
+)
+
 var (
 	forcedBootloader Bootloader
 	forcedError      error
@@ -175,6 +277,9 @@
 // can also be used to find the recovery bootloader, e.g. on uc20:
 //   bootloader.Find("/run/mnt/ubuntu-seed")
 func Find(rootdir string, opts *Options) (Bootloader, error) {
+	if err := opts.validate(); err != nil {
+		return nil, err
+	}
 	if forcedBootloader != nil || forcedError != nil {
 		return forcedBootloader, forcedError
 	}
@@ -186,26 +291,12 @@
 		opts = &Options{}
 	}
 
-	// try uboot
-	if uboot := newUboot(rootdir, opts); uboot != nil {
-		return uboot, nil
-	}
-
-	// no, try grub
-	if grub := newGrub(rootdir, opts); grub != nil {
-		return grub, nil
-	}
-
-	// no, try androidboot
-	if androidboot := newAndroidBoot(rootdir); androidboot != nil {
-		return androidboot, nil
-	}
-
-	// no, try lk
-	if lk := newLk(rootdir, opts); lk != nil {
-		return lk, nil
+	for _, blNew := range bootloaders {
+		bl := blNew(rootdir, opts)
+		if osutil.FileExists(bl.ConfigFile()) {
+			return bl, nil
+		}
 	}
-
 	// no, weeeee
 	return nil, ErrBootloader
 }
@@ -256,3 +347,52 @@
 
 	return nil
 }
+
+// ForGadget returns a bootloader matching a given gadget by inspecting the
+// contents of gadget directory or an error if no matching bootloader is found.
+func ForGadget(gadgetDir, rootDir string, opts *Options) (Bootloader, error) {
+	if err := opts.validate(); err != nil {
+		return nil, err
+	}
+	if forcedBootloader != nil || forcedError != nil {
+		return forcedBootloader, forcedError
+	}
+	for _, blNew := range bootloaders {
+		bl := blNew(rootDir, opts)
+		markerConf := filepath.Join(gadgetDir, bl.Name()+".conf")
+		// do we have a marker file?
+		if osutil.FileExists(markerConf) {
+			return bl, nil
+		}
+	}
+	return nil, ErrBootloader
+}
+
+// BootFile represents each file in the chains of trusted assets and
+// kernels used in the boot process. For example a boot file can be an
+// EFI binary or a snap file containing an EFI binary.
+type BootFile struct {
+	// Path is the path to the file in the filesystem or, if Snap
+	// is set, the relative path inside the snap file.
+	Path string
+	// Snap contains the path to the snap file if a snap file is used.
+	Snap string
+	// Role is set to the role of the bootloader this boot file
+	// originates from.
+	Role Role
+}
+
+func NewBootFile(snap, path string, role Role) BootFile {
+	return BootFile{
+		Snap: snap,
+		Path: path,
+		Role: role,
+	}
+}
+
+// WithPath returns a copy of the BootFile with path updated to the
+// specified value.
+func (b BootFile) WithPath(path string) BootFile {
+	b.Path = path
+	return b
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/bootloadertest/bootloadertest.go snapd-2.48.3+20.04/bootloader/bootloadertest/bootloadertest.go
--- snapd-2.45.1+20.04.2/bootloader/bootloadertest/bootloadertest.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/bootloadertest/bootloadertest.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,7 @@
 import (
 	"fmt"
 	"path/filepath"
+	"strings"
 
 	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/snap"
@@ -42,15 +43,18 @@
 	RemoveKernelAssetsCalls  []snap.PlaceInfo
 
 	InstallBootConfigCalled []string
-	InstallBootConfigResult bool
 	InstallBootConfigErr    error
 
+	enabledKernel    snap.PlaceInfo
+	enabledTryKernel snap.PlaceInfo
+
 	panicMethods map[string]bool
 }
 
-// ensure MockBootloader(s) implement the Bootloader interfaceces
+// ensure MockBootloader(s) implement the Bootloader interface
 var _ bootloader.Bootloader = (*MockBootloader)(nil)
 var _ bootloader.RecoveryAwareBootloader = (*MockRecoveryAwareBootloader)(nil)
+var _ bootloader.TrustedAssetsBootloader = (*MockTrustedAssetsBootloader)(nil)
 var _ bootloader.ExtractedRunKernelImageBootloader = (*MockExtractedRunKernelImageBootloader)(nil)
 var _ bootloader.ExtractedRecoveryKernelImageBootloader = (*MockExtractedRecoveryKernelImageBootloader)(nil)
 
@@ -109,11 +113,33 @@
 	return nil
 }
 
+func (b *MockBootloader) SetEnabledKernel(s snap.PlaceInfo) (restore func()) {
+	oldSn := b.enabledTryKernel
+	oldVar := b.BootVars["snap_kernel"]
+	b.enabledKernel = s
+	b.BootVars["snap_kernel"] = s.Filename()
+	return func() {
+		b.BootVars["snap_kernel"] = oldVar
+		b.enabledKernel = oldSn
+	}
+}
+
+func (b *MockBootloader) SetEnabledTryKernel(s snap.PlaceInfo) (restore func()) {
+	oldSn := b.enabledTryKernel
+	oldVar := b.BootVars["snap_try_kernel"]
+	b.enabledTryKernel = s
+	b.BootVars["snap_try_kernel"] = s.Filename()
+	return func() {
+		b.BootVars["snap_try_kernel"] = oldVar
+		b.enabledTryKernel = oldSn
+	}
+}
+
 // InstallBootConfig installs the boot config in the gadget directory to the
 // mock bootloader's root directory.
-func (b *MockBootloader) InstallBootConfig(gadgetDir string, opts *bootloader.Options) (bool, error) {
+func (b *MockBootloader) InstallBootConfig(gadgetDir string, opts *bootloader.Options) error {
 	b.InstallBootConfigCalled = append(b.InstallBootConfigCalled, gadgetDir)
-	return b.InstallBootConfigResult, b.InstallBootConfigErr
+	return b.InstallBootConfigErr
 }
 
 // MockRecoveryAwareBootloader mocks a bootloader implementing the
@@ -178,6 +204,16 @@
 	return nil
 }
 
+// GetRecoverySystemEnv gets the recovery system environment bootloader
+// variables; part of RecoveryAwareBootloader.
+func (b *MockRecoveryAwareBootloader) GetRecoverySystemEnv(recoverySystemDir, key string) (string, error) {
+	if recoverySystemDir == "" {
+		panic("MockBootloader.GetRecoverySystemEnv called without recoverySystemDir")
+	}
+	b.RecoverySystemDir = recoverySystemDir
+	return b.RecoverySystemBootVars[key], nil
+}
+
 // MockExtractedRunKernelImageBootloader mocks a bootloader
 // implementing the ExtractedRunKernelImageBootloader interface.
 type MockExtractedRunKernelImageBootloader struct {
@@ -204,10 +240,10 @@
 	}
 }
 
-// SetRunKernelImageEnabledKernel sets the current kernel "symlink" as returned
+// SetEnabledKernel sets the current kernel "symlink" as returned
 // by Kernel(); returns' a restore function to set it back to what it was
 // before.
-func (b *MockExtractedRunKernelImageBootloader) SetRunKernelImageEnabledKernel(kernel snap.PlaceInfo) (restore func()) {
+func (b *MockExtractedRunKernelImageBootloader) SetEnabledKernel(kernel snap.PlaceInfo) (restore func()) {
 	old := b.runKernelImageEnabledKernel
 	b.runKernelImageEnabledKernel = kernel
 	return func() {
@@ -215,11 +251,11 @@
 	}
 }
 
-// SetRunKernelImageEnabledTryKernel sets the current try-kernel "symlink" as
+// SetEnabledTryKernel sets the current try-kernel "symlink" as
 // returned by TryKernel(). If set to nil, TryKernel()'s second return value
 // will be false; returns' a restore function to set it back to what it was
 // before.
-func (b *MockExtractedRunKernelImageBootloader) SetRunKernelImageEnabledTryKernel(kernel snap.PlaceInfo) (restore func()) {
+func (b *MockExtractedRunKernelImageBootloader) SetEnabledTryKernel(kernel snap.PlaceInfo) (restore func()) {
 	old := b.runKernelImageEnabledTryKernel
 	b.runKernelImageEnabledTryKernel = kernel
 	return func() {
@@ -335,3 +371,85 @@
 	b.runKernelImageEnabledTryKernel = nil
 	return b.runKernelImageMockedErrs["DisableTryKernel"]
 }
+
+// MockTrustedAssetsBootloader mocks a bootloader implementing the
+// bootloader.TrustedAssetsBootloader interface.
+type MockTrustedAssetsBootloader struct {
+	*MockBootloader
+
+	TrustedAssetsList  []string
+	TrustedAssetsErr   error
+	TrustedAssetsCalls int
+
+	RecoveryBootChainList []bootloader.BootFile
+	RecoveryBootChainErr  error
+	BootChainList         []bootloader.BootFile
+	BootChainErr          error
+
+	RecoveryBootChainCalls []string
+	BootChainRunBl         []bootloader.Bootloader
+	BootChainKernelPath    []string
+
+	UpdateErr                  error
+	UpdateCalls                int
+	ManagedAssetsList          []string
+	StaticCommandLine          string
+	CandidateStaticCommandLine string
+	CommandLineErr             error
+}
+
+func (b *MockBootloader) WithTrustedAssets() *MockTrustedAssetsBootloader {
+	return &MockTrustedAssetsBootloader{
+		MockBootloader: b,
+	}
+}
+
+func (b *MockTrustedAssetsBootloader) ManagedAssets() []string {
+	return b.ManagedAssetsList
+}
+
+func (b *MockTrustedAssetsBootloader) UpdateBootConfig(opts *bootloader.Options) error {
+	b.UpdateCalls++
+	return b.UpdateErr
+}
+
+func glueCommandLine(modeArg, systemArg, staticArgs, extraArgs string) string {
+	args := []string(nil)
+	for _, argSet := range []string{modeArg, systemArg, staticArgs, extraArgs} {
+		if argSet != "" {
+			args = append(args, argSet)
+		}
+	}
+	line := strings.Join(args, " ")
+	return strings.TrimSpace(line)
+}
+
+func (b *MockTrustedAssetsBootloader) CommandLine(modeArg, systemArg, extraArgs string) (string, error) {
+	if b.CommandLineErr != nil {
+		return "", b.CommandLineErr
+	}
+	return glueCommandLine(modeArg, systemArg, b.StaticCommandLine, extraArgs), nil
+}
+
+func (b *MockTrustedAssetsBootloader) CandidateCommandLine(modeArg, systemArg, extraArgs string) (string, error) {
+	if b.CommandLineErr != nil {
+		return "", b.CommandLineErr
+	}
+	return glueCommandLine(modeArg, systemArg, b.CandidateStaticCommandLine, extraArgs), nil
+}
+
+func (b *MockTrustedAssetsBootloader) TrustedAssets() ([]string, error) {
+	b.TrustedAssetsCalls++
+	return b.TrustedAssetsList, b.TrustedAssetsErr
+}
+
+func (b *MockTrustedAssetsBootloader) RecoveryBootChain(kernelPath string) ([]bootloader.BootFile, error) {
+	b.RecoveryBootChainCalls = append(b.RecoveryBootChainCalls, kernelPath)
+	return b.RecoveryBootChainList, b.RecoveryBootChainErr
+}
+
+func (b *MockTrustedAssetsBootloader) BootChain(runBl bootloader.Bootloader, kernelPath string) ([]bootloader.BootFile, error) {
+	b.BootChainRunBl = append(b.BootChainRunBl, runBl)
+	b.BootChainKernelPath = append(b.BootChainKernelPath, kernelPath)
+	return b.BootChainList, b.BootChainErr
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/bootloader_test.go snapd-2.48.3+20.04/bootloader/bootloader_test.go
--- snapd-2.45.1+20.04.2/bootloader/bootloader_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/bootloader_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,12 +22,14 @@
 import (
 	"errors"
 	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/assets"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/testutil"
@@ -93,7 +95,7 @@
 	c.Assert(err, ErrorMatches, `cannot find boot config in.*`)
 }
 
-func (s *bootenvTestSuite) TestInstallBootloaderConfig(c *C) {
+func (s *bootenvTestSuite) TestInstallBootloaderConfigFromGadget(c *C) {
 	for _, t := range []struct {
 		name                string
 		gadgetFile, sysFile string
@@ -108,18 +110,209 @@
 			name:       "uboot boot.scr",
 			gadgetFile: "uboot.conf",
 			sysFile:    "/uboot/ubuntu/boot.sel",
-			opts:       &bootloader.Options{NoSlashBoot: true},
+			opts:       &bootloader.Options{Role: bootloader.RoleRecovery},
 		},
 		{name: "androidboot", gadgetFile: "androidboot.conf", sysFile: "/boot/androidboot/androidboot.env"},
 		{name: "lk", gadgetFile: "lk.conf", sysFile: "/boot/lk/snapbootsel.bin"},
-		{name: "grub recovery", gadgetFile: "grub-recovery.conf", sysFile: "/EFI/ubuntu/grub.cfg", opts: &bootloader.Options{Recovery: true}},
 	} {
 		mockGadgetDir := c.MkDir()
+		rootDir := c.MkDir()
 		err := ioutil.WriteFile(filepath.Join(mockGadgetDir, t.gadgetFile), t.gadgetFileContent, 0644)
 		c.Assert(err, IsNil)
-		err = bootloader.InstallBootConfig(mockGadgetDir, s.rootdir, t.opts)
+		err = bootloader.InstallBootConfig(mockGadgetDir, rootDir, t.opts)
 		c.Assert(err, IsNil, Commentf("installing boot config for %s", t.name))
-		fn := filepath.Join(s.rootdir, t.sysFile)
+		fn := filepath.Join(rootDir, t.sysFile)
 		c.Assert(fn, testutil.FilePresent, Commentf("boot config missing for %s at %s", t.name, t.sysFile))
 	}
 }
+
+func (s *bootenvTestSuite) TestInstallBootloaderConfigFromAssets(c *C) {
+	recoveryOpts := &bootloader.Options{
+		Role: bootloader.RoleRecovery,
+	}
+	systemBootOpts := &bootloader.Options{
+		Role: bootloader.RoleRunMode,
+	}
+	defaultRecoveryGrubAsset := assets.Internal("grub-recovery.cfg")
+	c.Assert(defaultRecoveryGrubAsset, NotNil)
+	defaultGrubAsset := assets.Internal("grub.cfg")
+	c.Assert(defaultGrubAsset, NotNil)
+
+	for _, t := range []struct {
+		name                string
+		gadgetFile, sysFile string
+		gadgetFileContent   []byte
+		sysFileContent      []byte
+		assetContent        []byte
+		assetName           string
+		err                 string
+		opts                *bootloader.Options
+	}{
+		{
+			name:       "recovery grub",
+			opts:       recoveryOpts,
+			gadgetFile: "grub.conf",
+			// empty file in the gadget
+			gadgetFileContent: nil,
+			sysFile:           "/EFI/ubuntu/grub.cfg",
+			assetName:         "grub-recovery.cfg",
+			assetContent:      []byte("hello assets"),
+			// boot config from assets
+			sysFileContent: []byte("hello assets"),
+		}, {
+			name:              "recovery grub with non empty gadget file",
+			opts:              recoveryOpts,
+			gadgetFile:        "grub.conf",
+			gadgetFileContent: []byte("not so empty"),
+			sysFile:           "/EFI/ubuntu/grub.cfg",
+			assetName:         "grub-recovery.cfg",
+			assetContent:      []byte("hello assets"),
+			// boot config from assets
+			sysFileContent: []byte("hello assets"),
+		}, {
+			name:       "recovery grub with default asset",
+			opts:       recoveryOpts,
+			gadgetFile: "grub.conf",
+			// empty file in the gadget
+			gadgetFileContent: nil,
+			sysFile:           "/EFI/ubuntu/grub.cfg",
+			sysFileContent:    defaultRecoveryGrubAsset,
+		}, {
+			name:       "recovery grub missing asset",
+			opts:       recoveryOpts,
+			gadgetFile: "grub.conf",
+			// empty file in the gadget
+			gadgetFileContent: nil,
+			sysFile:           "/EFI/ubuntu/grub.cfg",
+			assetName:         "grub-recovery.cfg",
+			// no asset content
+			err: `internal error: no boot asset for "grub-recovery.cfg"`,
+		}, {
+			name:       "system-boot grub",
+			opts:       systemBootOpts,
+			gadgetFile: "grub.conf",
+			// empty file in the gadget
+			gadgetFileContent: nil,
+			sysFile:           "/EFI/ubuntu/grub.cfg",
+			assetName:         "grub.cfg",
+			assetContent:      []byte("hello assets"),
+			sysFileContent:    []byte("hello assets"),
+		}, {
+			name:       "system-boot grub with default asset",
+			opts:       systemBootOpts,
+			gadgetFile: "grub.conf",
+			// empty file in the gadget
+			gadgetFileContent: nil,
+			sysFile:           "/EFI/ubuntu/grub.cfg",
+			sysFileContent:    defaultGrubAsset,
+		},
+	} {
+		mockGadgetDir := c.MkDir()
+		rootDir := c.MkDir()
+		fn := filepath.Join(rootDir, t.sysFile)
+		err := ioutil.WriteFile(filepath.Join(mockGadgetDir, t.gadgetFile), t.gadgetFileContent, 0644)
+		c.Assert(err, IsNil)
+		var restoreAsset func()
+		if t.assetName != "" {
+			restoreAsset = assets.MockInternal(t.assetName, t.assetContent)
+		}
+		err = bootloader.InstallBootConfig(mockGadgetDir, rootDir, t.opts)
+		if t.err == "" {
+			c.Assert(err, IsNil, Commentf("installing boot config for %s", t.name))
+			// mocked asset content
+			c.Assert(fn, testutil.FileEquals, string(t.sysFileContent))
+		} else {
+			c.Assert(err, ErrorMatches, t.err)
+			c.Assert(fn, testutil.FileAbsent)
+		}
+		if restoreAsset != nil {
+			restoreAsset()
+		}
+	}
+}
+
+func (s *bootenvTestSuite) TestBootloaderFind(c *C) {
+	for _, tc := range []struct {
+		name    string
+		sysFile string
+		opts    *bootloader.Options
+		expName string
+	}{
+		{name: "grub", sysFile: "/boot/grub/grub.cfg", expName: "grub"},
+		{
+			// native run partition layout
+			name: "grub", sysFile: "/EFI/ubuntu/grub.cfg",
+			opts:    &bootloader.Options{Role: bootloader.RoleRunMode, NoSlashBoot: true},
+			expName: "grub",
+		},
+		{
+			// recovery layout
+			name: "grub", sysFile: "/EFI/ubuntu/grub.cfg",
+			opts:    &bootloader.Options{Role: bootloader.RoleRecovery},
+			expName: "grub",
+		},
+
+		// traditional uboot.env - the uboot.env file needs to be non-empty
+		{name: "uboot.env", sysFile: "/boot/uboot/uboot.env", expName: "uboot"},
+		// boot.sel variant
+		{
+			name:    "uboot boot.scr",
+			sysFile: "/uboot/ubuntu/boot.sel",
+			opts:    &bootloader.Options{Role: bootloader.RoleRunMode, NoSlashBoot: true},
+			expName: "uboot",
+		},
+		{name: "androidboot", sysFile: "/boot/androidboot/androidboot.env", expName: "androidboot"},
+		// lk is detected differently based on runtime/prepare-image
+		{name: "lk", sysFile: "/dev/disk/by-partlabel/snapbootsel", expName: "lk"},
+		{
+			name: "lk", sysFile: "/boot/lk/snapbootsel.bin",
+			expName: "lk", opts: &bootloader.Options{PrepareImageTime: true},
+		},
+	} {
+		c.Logf("tc: %v", tc.name)
+		rootDir := c.MkDir()
+		err := os.MkdirAll(filepath.Join(rootDir, filepath.Dir(tc.sysFile)), 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(rootDir, tc.sysFile), nil, 0644)
+		c.Assert(err, IsNil)
+		bl, err := bootloader.Find(rootDir, tc.opts)
+		c.Assert(err, IsNil)
+		c.Assert(bl, NotNil)
+		c.Check(bl.Name(), Equals, tc.expName)
+	}
+}
+
+func (s *bootenvTestSuite) TestBootloaderForGadget(c *C) {
+	for _, tc := range []struct {
+		name       string
+		gadgetFile string
+		opts       *bootloader.Options
+		expName    string
+	}{
+		{name: "grub", gadgetFile: "grub.conf", expName: "grub"},
+		{name: "grub", gadgetFile: "grub.conf", opts: &bootloader.Options{Role: bootloader.RoleRunMode, NoSlashBoot: true}, expName: "grub"},
+		{name: "grub", gadgetFile: "grub.conf", opts: &bootloader.Options{Role: bootloader.RoleRecovery}, expName: "grub"},
+		{name: "uboot", gadgetFile: "uboot.conf", expName: "uboot"},
+		{name: "androidboot", gadgetFile: "androidboot.conf", expName: "androidboot"},
+		{name: "lk", gadgetFile: "lk.conf", expName: "lk"},
+	} {
+		c.Logf("tc: %v", tc.name)
+		gadgetDir := c.MkDir()
+		rootDir := c.MkDir()
+		err := os.MkdirAll(filepath.Join(rootDir, filepath.Dir(tc.gadgetFile)), 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(gadgetDir, tc.gadgetFile), nil, 0644)
+		c.Assert(err, IsNil)
+		bl, err := bootloader.ForGadget(gadgetDir, rootDir, tc.opts)
+		c.Assert(err, IsNil)
+		c.Assert(bl, NotNil)
+		c.Check(bl.Name(), Equals, tc.expName)
+	}
+}
+
+func (s *bootenvTestSuite) TestBootFileWithPath(c *C) {
+	a := bootloader.NewBootFile("", "some/path", bootloader.RoleRunMode)
+	b := a.WithPath("other/path")
+	c.Assert(a.Path, Equals, "some/path")
+	c.Assert(b.Path, Equals, "other/path")
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/efi/efi.go snapd-2.48.3+20.04/bootloader/efi/efi.go
--- snapd-2.45.1+20.04.2/bootloader/efi/efi.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/efi/efi.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,7 +29,6 @@
 	"io/ioutil"
 	"os"
 	"path/filepath"
-	"strings"
 	"unicode/utf16"
 
 	"github.com/snapcore/snapd/dirs"
@@ -48,8 +47,7 @@
 )
 
 var (
-	isSnapdTest = len(os.Args) > 0 && strings.HasSuffix(os.Args[0], ".test")
-	openEFIVar  = openEFIVarImpl
+	openEFIVar = openEFIVarImpl
 )
 
 const expectedEFIvarfsDir = "/sys/firmware/efi/efivars"
@@ -164,9 +162,7 @@
 // MockVars mocks EFI variables as read by ReadVar*, only to be used
 // from tests. Set vars to nil to mock a non-EFI system.
 func MockVars(vars map[string][]byte, attrs map[string]VariableAttr) (restore func()) {
-	if !isSnapdTest {
-		panic("MockVars only to be used from tests")
-	}
+	osutil.MustBeTestBinary("MockVars only to be used from tests")
 	old := openEFIVar
 	openEFIVar = func(name string) (io.ReadCloser, VariableAttr, int64, error) {
 		if vars == nil {
diff -Nru snapd-2.45.1+20.04.2/bootloader/export_test.go snapd-2.48.3+20.04/bootloader/export_test.go
--- snapd-2.45.1+20.04.2/bootloader/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,7 +32,7 @@
 
 // creates a new Androidboot bootloader object
 func NewAndroidBoot(rootdir string) Bootloader {
-	return newAndroidBoot(rootdir)
+	return newAndroidBoot(rootdir, nil)
 }
 
 func MockAndroidBootFile(c *C, rootdir string, mode os.FileMode) {
@@ -44,7 +44,7 @@
 }
 
 func NewUboot(rootdir string, blOpts *Options) ExtractedRecoveryKernelImageBootloader {
-	return newUboot(rootdir, blOpts)
+	return newUboot(rootdir, blOpts).(ExtractedRecoveryKernelImageBootloader)
 }
 
 func MockUbootFiles(c *C, rootdir string, blOpts *Options) {
@@ -62,7 +62,7 @@
 }
 
 func NewGrub(rootdir string, opts *Options) RecoveryAwareBootloader {
-	return newGrub(rootdir, opts)
+	return newGrub(rootdir, opts).(RecoveryAwareBootloader)
 }
 
 func MockGrubFiles(c *C, rootdir string) {
@@ -102,3 +102,10 @@
 	lk := b.(*lk)
 	return lk.inRuntimeMode
 }
+
+var (
+	EditionFromDiskConfigAsset           = editionFromDiskConfigAsset
+	EditionFromConfigAsset               = editionFromConfigAsset
+	ConfigAssetFrom                      = configAssetFrom
+	StaticCommandLineForGrubAssetEdition = staticCommandLineForGrubAssetEdition
+)
diff -Nru snapd-2.45.1+20.04.2/bootloader/grub.go snapd-2.48.3+20.04/bootloader/grub.go
--- snapd-2.45.1+20.04.2/bootloader/grub.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/grub.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2015 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -23,7 +23,9 @@
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
+	"github.com/snapcore/snapd/bootloader/assets"
 	"github.com/snapcore/snapd/bootloader/grubenv"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
@@ -35,6 +37,7 @@
 	_ installableBootloader             = (*grub)(nil)
 	_ RecoveryAwareBootloader           = (*grub)(nil)
 	_ ExtractedRunKernelImageBootloader = (*grub)(nil)
+	_ TrustedAssetsBootloader           = (*grub)(nil)
 )
 
 type grub struct {
@@ -43,22 +46,27 @@
 	basedir string
 
 	uefiRunKernelExtraction bool
+	recovery                bool
+	nativePartitionLayout   bool
 }
 
 // newGrub create a new Grub bootloader object
-func newGrub(rootdir string, opts *Options) RecoveryAwareBootloader {
+func newGrub(rootdir string, opts *Options) Bootloader {
 	g := &grub{rootdir: rootdir}
-	if opts != nil && (opts.Recovery || opts.NoSlashBoot) {
+	if opts != nil {
+		// Set the flag to extract the run kernel, only
+		// for UC20 run mode.
+		// Both UC16/18 and the recovery mode of UC20 load
+		// the kernel directly from snaps.
+		g.uefiRunKernelExtraction = opts.Role == RoleRunMode
+		g.recovery = opts.Role == RoleRecovery
+		g.nativePartitionLayout = opts.NoSlashBoot || g.recovery
+	}
+	if g.nativePartitionLayout {
 		g.basedir = "EFI/ubuntu"
 	} else {
 		g.basedir = "boot/grub"
 	}
-	if !osutil.FileExists(g.ConfigFile()) {
-		return nil
-	}
-	if opts != nil {
-		g.uefiRunKernelExtraction = opts.ExtractedRunKernelImage
-	}
 
 	return g
 }
@@ -78,12 +86,28 @@
 	return filepath.Join(g.rootdir, g.basedir)
 }
 
-func (g *grub) InstallBootConfig(gadgetDir string, opts *Options) (bool, error) {
-	if opts != nil && opts.Recovery {
-		recoveryGrubCfg := filepath.Join(gadgetDir, g.Name()+"-recovery.conf")
-		systemFile := filepath.Join(g.rootdir, "/EFI/ubuntu/grub.cfg")
-		return genericInstallBootConfig(recoveryGrubCfg, systemFile)
+func (g *grub) installManagedRecoveryBootConfig(gadgetDir string) error {
+	assetName := g.Name() + "-recovery.cfg"
+	systemFile := filepath.Join(g.rootdir, "/EFI/ubuntu/grub.cfg")
+	return genericSetBootConfigFromAsset(systemFile, assetName)
+}
+
+func (g *grub) installManagedBootConfig(gadgetDir string) error {
+	assetName := g.Name() + ".cfg"
+	systemFile := filepath.Join(g.rootdir, "/EFI/ubuntu/grub.cfg")
+	return genericSetBootConfigFromAsset(systemFile, assetName)
+}
+
+func (g *grub) InstallBootConfig(gadgetDir string, opts *Options) error {
+	if opts != nil && opts.Role == RoleRecovery {
+		// install managed config for the recovery partition
+		return g.installManagedRecoveryBootConfig(gadgetDir)
+	}
+	if opts != nil && opts.Role == RoleRunMode {
+		// install managed boot config that can handle kernel.efi
+		return g.installManagedBootConfig(gadgetDir)
 	}
+
 	gadgetFile := filepath.Join(gadgetDir, g.Name()+".conf")
 	systemFile := filepath.Join(g.rootdir, "/boot/grub/grub.cfg")
 	return genericInstallBootConfig(gadgetFile, systemFile)
@@ -104,6 +128,21 @@
 	return genv.Save()
 }
 
+func (g *grub) GetRecoverySystemEnv(recoverySystemDir string, key string) (string, error) {
+	if recoverySystemDir == "" {
+		return "", fmt.Errorf("internal error: recoverySystemDir unset")
+	}
+	recoverySystemGrubEnv := filepath.Join(g.rootdir, recoverySystemDir, "grubenv")
+	genv := grubenv.NewEnv(recoverySystemGrubEnv)
+	if err := genv.Load(); err != nil {
+		if os.IsNotExist(err) {
+			return "", nil
+		}
+		return "", err
+	}
+	return genv.Get(key), nil
+}
+
 func (g *grub) ConfigFile() string {
 	return filepath.Join(g.dir(), "grub.cfg")
 }
@@ -300,3 +339,172 @@
 	}
 	return nil, ErrNoTryKernelRef
 }
+
+// UpdateBootConfig updates the grub boot config only if it is already managed
+// and has a lower edition.
+//
+// Implements ManagedAssetsBootloader for the grub bootloader.
+func (g *grub) UpdateBootConfig(opts *Options) error {
+	// XXX: do we need to take opts here?
+	bootScriptName := "grub.cfg"
+	currentBootConfig := filepath.Join(g.dir(), "grub.cfg")
+	if opts != nil && opts.Role == RoleRecovery {
+		// use the recovery asset when asked to do so
+		bootScriptName = "grub-recovery.cfg"
+	}
+	return genericUpdateBootConfigFromAssets(currentBootConfig, bootScriptName)
+}
+
+// ManagedAssets returns a list relative paths to boot assets inside the root
+// directory of the filesystem.
+//
+// Implements ManagedAssetsBootloader for the grub bootloader.
+func (g *grub) ManagedAssets() []string {
+	return []string{
+		filepath.Join(g.basedir, "grub.cfg"),
+	}
+}
+
+func (g *grub) commandLineForEdition(edition uint, modeArg, systemArg, extraArgs string) (string, error) {
+	assetName := "grub.cfg"
+	if g.recovery {
+		assetName = "grub-recovery.cfg"
+	}
+	staticCmdline := staticCommandLineForGrubAssetEdition(assetName, edition)
+	args, err := osutil.KernelCommandLineSplit(staticCmdline + " " + extraArgs)
+	if err != nil {
+		return "", fmt.Errorf("cannot use badly formatted kernel command line: %v", err)
+	}
+	// join all argument with a single space, see
+	// grub-core/lib/cmdline.c:grub_create_loader_cmdline() for reference,
+	// arguments are separated by a single space, the space after last is
+	// replaced with terminating NULL
+	snapdArgs := make([]string, 0, 2)
+	if modeArg != "" {
+		snapdArgs = append(snapdArgs, modeArg)
+	}
+	if systemArg != "" {
+		snapdArgs = append(snapdArgs, systemArg)
+	}
+	return strings.Join(append(snapdArgs, args...), " "), nil
+}
+
+// CommandLine returns the kernel command line composed of mode and
+// system arguments, built-in bootloader specific static arguments
+// corresponding to the on-disk boot asset edition, followed by any
+// extra arguments. The command line may be different when using a
+// recovery bootloader.
+//
+// Implements ManagedAssetsBootloader for the grub bootloader.
+func (g *grub) CommandLine(modeArg, systemArg, extraArgs string) (string, error) {
+	currentBootConfig := filepath.Join(g.dir(), "grub.cfg")
+	edition, err := editionFromDiskConfigAsset(currentBootConfig)
+	if err != nil {
+		if err != errNoEdition {
+			return "", fmt.Errorf("cannot obtain edition number of current boot config: %v", err)
+		}
+		// we were called using the ManagedAssetsBootloader interface
+		// meaning the caller expects to us to use the managed assets,
+		// since one on disk is not managed, use the initial edition of
+		// the internal boot asset which is compatible with grub.cfg
+		// used before we started writing out the files ourselves
+		edition = 1
+	}
+	return g.commandLineForEdition(edition, modeArg, systemArg, extraArgs)
+}
+
+// CandidateCommandLine is similar to CommandLine, but uses the current
+// edition of managed built-in boot assets as reference.
+//
+// Implements ManagedAssetsBootloader for the grub bootloader.
+func (g *grub) CandidateCommandLine(modeArg, systemArg, extraArgs string) (string, error) {
+	assetName := "grub.cfg"
+	if g.recovery {
+		assetName = "grub-recovery.cfg"
+	}
+	edition, err := editionFromInternalConfigAsset(assetName)
+	if err != nil {
+		return "", err
+	}
+	return g.commandLineForEdition(edition, modeArg, systemArg, extraArgs)
+}
+
+// staticCommandLineForGrubAssetEdition fetches a static command line for given
+// grub asset edition
+func staticCommandLineForGrubAssetEdition(asset string, edition uint) string {
+	cmdline := assets.SnippetForEdition(fmt.Sprintf("%s:static-cmdline", asset), edition)
+	if cmdline == nil {
+		return ""
+	}
+	return string(cmdline)
+}
+
+var (
+	grubRecoveryModeTrustedAssets = []string{
+		// recovery mode shim EFI binary
+		"EFI/boot/bootx64.efi",
+		// recovery mode grub EFI binary
+		"EFI/boot/grubx64.efi",
+	}
+
+	grubRunModeTrustedAssets = []string{
+		// run mode grub EFI binary
+		"EFI/boot/grubx64.efi",
+	}
+)
+
+// TrustedAssets returns the list of relative paths to assets inside
+// the bootloader's rootdir that are measured in the boot process in the
+// order of loading during the boot.
+func (g *grub) TrustedAssets() ([]string, error) {
+	if !g.nativePartitionLayout {
+		return nil, fmt.Errorf("internal error: trusted assets called without native host-partition layout")
+	}
+	if g.recovery {
+		return grubRecoveryModeTrustedAssets, nil
+	}
+	return grubRunModeTrustedAssets, nil
+}
+
+// RecoveryBootChain returns the load chain for recovery modes.
+// It should be called on a RoleRecovery bootloader.
+func (g *grub) RecoveryBootChain(kernelPath string) ([]BootFile, error) {
+	if !g.recovery {
+		return nil, fmt.Errorf("not a recovery bootloader")
+	}
+
+	// add trusted assets to the recovery chain
+	chain := make([]BootFile, 0, len(grubRecoveryModeTrustedAssets)+1)
+	for _, ta := range grubRecoveryModeTrustedAssets {
+		chain = append(chain, NewBootFile("", ta, RoleRecovery))
+	}
+	// add recovery kernel to the recovery chain
+	chain = append(chain, NewBootFile(kernelPath, "kernel.efi", RoleRecovery))
+
+	return chain, nil
+}
+
+// BootChain returns the load chain for run mode.
+// It should be called on a RoleRecovery bootloader passing the
+// RoleRunMode bootloader.
+func (g *grub) BootChain(runBl Bootloader, kernelPath string) ([]BootFile, error) {
+	if !g.recovery {
+		return nil, fmt.Errorf("not a recovery bootloader")
+	}
+	if runBl.Name() != "grub" {
+		return nil, fmt.Errorf("run mode bootloader must be grub")
+	}
+
+	// add trusted assets to the recovery chain
+	chain := make([]BootFile, 0, len(grubRecoveryModeTrustedAssets)+len(grubRunModeTrustedAssets)+1)
+	for _, ta := range grubRecoveryModeTrustedAssets {
+		chain = append(chain, NewBootFile("", ta, RoleRecovery))
+	}
+	for _, ta := range grubRunModeTrustedAssets {
+		chain = append(chain, NewBootFile("", ta, RoleRunMode))
+	}
+	// add kernel to the boot chain
+	chain = append(chain, NewBootFile(kernelPath, "kernel.efi", RoleRunMode))
+
+	return chain, nil
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/grub_test.go snapd-2.48.3+20.04/bootloader/grub_test.go
--- snapd-2.45.1+20.04.2/bootloader/grub_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/grub_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,6 +30,7 @@
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/assets"
 	"github.com/snapcore/snapd/bootloader/grubenv"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
@@ -98,11 +99,6 @@
 	s.grubEditenvSet(c, "k", "v")
 }
 
-func (s *grubTestSuite) TestNewGrubNoGrubReturnsNil(c *C) {
-	g := bootloader.NewGrub("/something/not/there", nil)
-	c.Assert(g, IsNil)
-}
-
 func (s *grubTestSuite) TestNewGrub(c *C) {
 	s.makeFakeGrubEnv(c)
 
@@ -229,37 +225,37 @@
 	return filepath.Join(s.bootdir, "grub")
 }
 
-func (s *grubTestSuite) grubRecoveryDir() string {
+func (s *grubTestSuite) grubEFINativeDir() string {
 	return filepath.Join(s.rootdir, "EFI/ubuntu")
 }
 
-func (s *grubTestSuite) makeFakeGrubRecoveryEnv(c *C) {
-	err := os.MkdirAll(s.grubRecoveryDir(), 0755)
+func (s *grubTestSuite) makeFakeGrubEFINativeEnv(c *C, content []byte) {
+	err := os.MkdirAll(s.grubEFINativeDir(), 0755)
 	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(s.grubRecoveryDir(), "grub.cfg"), nil, 0644)
+	err = ioutil.WriteFile(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), content, 0644)
 	c.Assert(err, IsNil)
 }
 
 func (s *grubTestSuite) TestNewGrubWithOptionRecovery(c *C) {
-	s.makeFakeGrubRecoveryEnv(c)
+	s.makeFakeGrubEFINativeEnv(c, nil)
 
-	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Recovery: true})
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
 	c.Assert(g, NotNil)
 	c.Assert(g.Name(), Equals, "grub")
 }
 
 func (s *grubTestSuite) TestNewGrubWithOptionRecoveryBootEnv(c *C) {
-	s.makeFakeGrubRecoveryEnv(c)
-	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Recovery: true})
+	s.makeFakeGrubEFINativeEnv(c, nil)
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
 
 	// check that setting vars goes to the right place
-	c.Check(filepath.Join(s.grubRecoveryDir(), "grubenv"), testutil.FileAbsent)
+	c.Check(filepath.Join(s.grubEFINativeDir(), "grubenv"), testutil.FileAbsent)
 	err := g.SetBootVars(map[string]string{
 		"k1": "v1",
 		"k2": "v2",
 	})
 	c.Assert(err, IsNil)
-	c.Check(filepath.Join(s.grubRecoveryDir(), "grubenv"), testutil.FilePresent)
+	c.Check(filepath.Join(s.grubEFINativeDir(), "grubenv"), testutil.FilePresent)
 
 	env, err := g.GetBootVars("k1", "k2")
 	c.Assert(err, IsNil)
@@ -274,13 +270,14 @@
 	s.makeFakeGrubEnv(c)
 
 	// we can't create a recovery grub with that
-	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Recovery: true})
+	g, err := bootloader.Find(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
 	c.Assert(g, IsNil)
+	c.Assert(err, Equals, bootloader.ErrBootloader)
 }
 
 func (s *grubTestSuite) TestGrubSetRecoverySystemEnv(c *C) {
-	s.makeFakeGrubRecoveryEnv(c)
-	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Recovery: true})
+	s.makeFakeGrubEFINativeEnv(c, nil)
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
 
 	// check that we can set a recovery system specific bootenv
 	bvars := map[string]string{
@@ -300,6 +297,36 @@
 	c.Check(genv.Get("other_options"), Equals, "are-supported")
 }
 
+func (s *grubTestSuite) TestGetRecoverySystemEnv(c *C) {
+	s.makeFakeGrubEFINativeEnv(c, nil)
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
+
+	err := os.MkdirAll(filepath.Join(s.rootdir, "/systems/20191209"), 0755)
+	c.Assert(err, IsNil)
+	recoverySystemGrubenv := filepath.Join(s.rootdir, "/systems/20191209/grubenv")
+
+	// does not fail when there is no recovery env
+	value, err := g.GetRecoverySystemEnv("/systems/20191209", "no_file")
+	c.Assert(err, IsNil)
+	c.Check(value, Equals, "")
+
+	genv := grubenv.NewEnv(recoverySystemGrubenv)
+	genv.Set("snapd_extra_cmdline_args", "foo bar baz")
+	genv.Set("random_option", `has "some spaces"`)
+	err = genv.Save()
+	c.Assert(err, IsNil)
+
+	value, err = g.GetRecoverySystemEnv("/systems/20191209", "snapd_extra_cmdline_args")
+	c.Assert(err, IsNil)
+	c.Check(value, Equals, "foo bar baz")
+	value, err = g.GetRecoverySystemEnv("/systems/20191209", "random_option")
+	c.Assert(err, IsNil)
+	c.Check(value, Equals, `has "some spaces"`)
+	value, err = g.GetRecoverySystemEnv("/systems/20191209", "not_set")
+	c.Assert(err, IsNil)
+	c.Check(value, Equals, ``)
+}
+
 func (s *grubTestSuite) makeKernelAssetSnap(c *C, snapFileName string) snap.PlaceInfo {
 	kernelSnap, err := snap.ParsePlaceInfoFromSnapFileName(snapFileName)
 	c.Assert(err, IsNil)
@@ -444,6 +471,10 @@
 }
 
 func (s *grubTestSuite) TestGrubExtractedRunKernelImageDisableTryKernel(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	s.makeFakeGrubEnv(c)
 	g := bootloader.NewGrub(s.rootdir, nil)
 	eg, ok := g.(bootloader.ExtractedRunKernelImageBootloader)
@@ -479,7 +510,7 @@
 func (s *grubTestSuite) TestKernelExtractionRunImageKernel(c *C) {
 	s.makeFakeGrubEnv(c)
 
-	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{ExtractedRunKernelImage: true})
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRunMode})
 	c.Assert(g, NotNil)
 
 	files := [][]string{
@@ -519,9 +550,9 @@
 func (s *grubTestSuite) TestKernelExtractionRunImageKernelNoSlashBoot(c *C) {
 	// this is ubuntu-boot but during install we use the native EFI/ubuntu
 	// layout, same as Recovery, without the /boot mount
-	s.makeFakeGrubRecoveryEnv(c)
+	s.makeFakeGrubEFINativeEnv(c, nil)
 
-	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{ExtractedRunKernelImage: true, NoSlashBoot: true})
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRunMode, NoSlashBoot: true})
 	c.Assert(g, NotNil)
 
 	files := [][]string{
@@ -569,3 +600,482 @@
 	c.Assert(err, IsNil)
 	c.Check(exists, Equals, false)
 }
+
+func (s *grubTestSuite) TestListManagedAssets(c *C) {
+	s.makeFakeGrubEFINativeEnv(c, []byte(`this is
+some random boot config`))
+
+	opts := &bootloader.Options{NoSlashBoot: true}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	c.Check(tg.ManagedAssets(), DeepEquals, []string{
+		"EFI/ubuntu/grub.cfg",
+	})
+
+	opts = &bootloader.Options{Role: bootloader.RoleRecovery}
+	tg = bootloader.NewGrub(s.rootdir, opts).(bootloader.TrustedAssetsBootloader)
+	c.Check(tg.ManagedAssets(), DeepEquals, []string{
+		"EFI/ubuntu/grub.cfg",
+	})
+
+	// as it called for the root fs rather than a mount point of a partition
+	// with boot assets
+	tg = bootloader.NewGrub(s.rootdir, nil).(bootloader.TrustedAssetsBootloader)
+	c.Check(tg.ManagedAssets(), DeepEquals, []string{
+		"boot/grub/grub.cfg",
+	})
+}
+
+func (s *grubTestSuite) TestRecoveryUpdateBootConfigNoEdition(c *C) {
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte("recovery boot script"))
+
+	opts := &bootloader.Options{Role: bootloader.RoleRecovery}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+
+	restore := assets.MockInternal("grub-recovery.cfg", []byte(`# Snapd-Boot-Config-Edition: 5
+this is mocked grub-recovery.conf
+`))
+	defer restore()
+
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+	// install the recovery boot script
+	err := tg.UpdateBootConfig(opts)
+	c.Assert(err, IsNil)
+
+	c.Assert(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), testutil.FileEquals, `recovery boot script`)
+}
+
+func (s *grubTestSuite) TestRecoveryUpdateBootConfigUpdates(c *C) {
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte(`# Snapd-Boot-Config-Edition: 1
+recovery boot script`))
+
+	opts := &bootloader.Options{Role: bootloader.RoleRecovery}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+
+	restore := assets.MockInternal("grub-recovery.cfg", []byte(`# Snapd-Boot-Config-Edition: 3
+this is mocked grub-recovery.conf
+`))
+	defer restore()
+	restore = assets.MockInternal("grub.cfg", []byte(`# Snapd-Boot-Config-Edition: 4
+this is mocked grub.conf
+`))
+	defer restore()
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+	// install the recovery boot script
+	err := tg.UpdateBootConfig(opts)
+	c.Assert(err, IsNil)
+	// the recovery boot asset was picked
+	c.Assert(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), testutil.FileEquals, `# Snapd-Boot-Config-Edition: 3
+this is mocked grub-recovery.conf
+`)
+}
+
+func (s *grubTestSuite) testBootUpdateBootConfigUpdates(c *C, oldConfig, newConfig string, update bool) {
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte(oldConfig))
+
+	opts := &bootloader.Options{NoSlashBoot: true}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+
+	restore := assets.MockInternal("grub.cfg", []byte(newConfig))
+	defer restore()
+
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+	err := tg.UpdateBootConfig(opts)
+	c.Assert(err, IsNil)
+	if update {
+		c.Assert(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), testutil.FileEquals, newConfig)
+	} else {
+		c.Assert(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), testutil.FileEquals, oldConfig)
+	}
+}
+
+func (s *grubTestSuite) TestNoSlashBootUpdateBootConfigNoUpdateWhenNotManaged(c *C) {
+	oldConfig := `not managed`
+	newConfig := `# Snapd-Boot-Config-Edition: 3
+this update is not applied
+`
+	// the current boot config is not managed, no update applied
+	const updateApplied = false
+	s.testBootUpdateBootConfigUpdates(c, oldConfig, newConfig, updateApplied)
+}
+
+func (s *grubTestSuite) TestNoSlashBootUpdateBootConfigUpdates(c *C) {
+	oldConfig := `# Snapd-Boot-Config-Edition: 2
+boot script
+`
+	// edition is higher, update is applied
+	newConfig := `# Snapd-Boot-Config-Edition: 3
+this is updated grub.cfg
+`
+	const updateApplied = true
+	s.testBootUpdateBootConfigUpdates(c, oldConfig, newConfig, updateApplied)
+}
+
+func (s *grubTestSuite) TestNoSlashBootUpdateBootConfigNoUpdate(c *C) {
+	oldConfig := `# Snapd-Boot-Config-Edition: 2
+boot script
+`
+	// edition is lower, no update is applied
+	newConfig := `# Snapd-Boot-Config-Edition: 1
+this is updated grub.cfg
+`
+	const updateApplied = false
+	s.testBootUpdateBootConfigUpdates(c, oldConfig, newConfig, updateApplied)
+}
+
+func (s *grubTestSuite) TestNoSlashBootUpdateBootConfigSameEdition(c *C) {
+	oldConfig := `# Snapd-Boot-Config-Edition: 1
+boot script
+`
+	// edition is equal, no update is applied
+	newConfig := `# Snapd-Boot-Config-Edition: 1
+this is updated grub.cfg
+`
+	const updateApplied = false
+	s.testBootUpdateBootConfigUpdates(c, oldConfig, newConfig, updateApplied)
+}
+
+func (s *grubTestSuite) TestBootUpdateBootConfigTrivialErr(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
+	oldConfig := `# Snapd-Boot-Config-Edition: 2
+boot script
+`
+	// edition is higher, update is applied
+	newConfig := `# Snapd-Boot-Config-Edition: 3
+this is updated grub.cfg
+`
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte(oldConfig))
+	restore := assets.MockInternal("grub.cfg", []byte(newConfig))
+	defer restore()
+
+	opts := &bootloader.Options{NoSlashBoot: true}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	err := os.Chmod(s.grubEFINativeDir(), 0000)
+	c.Assert(err, IsNil)
+	defer os.Chmod(s.grubEFINativeDir(), 0755)
+
+	err = tg.UpdateBootConfig(opts)
+	c.Assert(err, ErrorMatches, "cannot load existing config asset: .*/EFI/ubuntu/grub.cfg: permission denied")
+	err = os.Chmod(s.grubEFINativeDir(), 0555)
+	c.Assert(err, IsNil)
+
+	c.Assert(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), testutil.FileEquals, oldConfig)
+
+	// writing out new config fails
+	err = os.Chmod(s.grubEFINativeDir(), 0111)
+	c.Assert(err, IsNil)
+	err = tg.UpdateBootConfig(opts)
+	c.Assert(err, ErrorMatches, `open .*/EFI/ubuntu/grub.cfg\..+: permission denied`)
+	c.Assert(filepath.Join(s.grubEFINativeDir(), "grub.cfg"), testutil.FileEquals, oldConfig)
+}
+
+func (s *grubTestSuite) TestStaticCmdlineForGrubAsset(c *C) {
+	restore := assets.MockSnippetsForEdition("grub-asset:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 2, Snippet: []byte(`static cmdline "with spaces"`)},
+	})
+	defer restore()
+	cmdline := bootloader.StaticCommandLineForGrubAssetEdition("grub-asset", 1)
+	c.Check(cmdline, Equals, ``)
+	cmdline = bootloader.StaticCommandLineForGrubAssetEdition("grub-asset", 2)
+	c.Check(cmdline, Equals, `static cmdline "with spaces"`)
+	cmdline = bootloader.StaticCommandLineForGrubAssetEdition("grub-asset", 4)
+	c.Check(cmdline, Equals, `static cmdline "with spaces"`)
+}
+
+func (s *grubTestSuite) TestCommandLineNotManaged(c *C) {
+	grubCfg := "boot script\n"
+
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte(grubCfg))
+
+	restore := assets.MockSnippetsForEdition("grub.cfg:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte(`static=1`)},
+		{FirstEdition: 2, Snippet: []byte(`static=2`)},
+	})
+	defer restore()
+	restore = assets.MockSnippetsForEdition("grub-recovery.cfg:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte(`static=1 recovery`)},
+		{FirstEdition: 2, Snippet: []byte(`static=2 recovery`)},
+	})
+	defer restore()
+
+	opts := &bootloader.Options{NoSlashBoot: true}
+	mg := bootloader.NewGrub(s.rootdir, opts).(bootloader.TrustedAssetsBootloader)
+
+	args, err := mg.CommandLine("snapd_recovery_mode=run", "", "extra")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, "snapd_recovery_mode=run static=1 extra")
+
+	optsRecovery := &bootloader.Options{NoSlashBoot: true, Role: bootloader.RoleRecovery}
+	mgr := bootloader.NewGrub(s.rootdir, optsRecovery).(bootloader.TrustedAssetsBootloader)
+
+	args, err = mgr.CommandLine("snapd_recovery_mode=recover", "snapd_recovery_system=1234", "extra")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, "snapd_recovery_mode=recover snapd_recovery_system=1234 static=1 recovery extra")
+}
+
+func (s *grubTestSuite) TestCommandLineMocked(c *C) {
+	grubCfg := `# Snapd-Boot-Config-Edition: 2
+boot script
+`
+	staticCmdline := `arg1   foo=123 panic=-1 arg2="with spaces "`
+	staticCmdlineEdition3 := `edition=3 static args`
+	restore := assets.MockSnippetsForEdition("grub.cfg:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte(staticCmdline)},
+		{FirstEdition: 3, Snippet: []byte(staticCmdlineEdition3)},
+	})
+	defer restore()
+	staticCmdlineRecovery := `recovery config panic=-1`
+	restore = assets.MockSnippetsForEdition("grub-recovery.cfg:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte(staticCmdlineRecovery)},
+	})
+	defer restore()
+
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte(grubCfg))
+
+	optsNoSlashBoot := &bootloader.Options{NoSlashBoot: true}
+	g := bootloader.NewGrub(s.rootdir, optsNoSlashBoot)
+	c.Assert(g, NotNil)
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	extraArgs := `extra_arg=1  extra_foo=-1   panic=3 baz="more  spaces"`
+	args, err := tg.CommandLine("snapd_recovery_mode=run", "", extraArgs)
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=run arg1 foo=123 panic=-1 arg2="with spaces " extra_arg=1 extra_foo=-1 panic=3 baz="more  spaces"`)
+
+	// empty mode/system do not produce confusing results
+	args, err = tg.CommandLine("", "", extraArgs)
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `arg1 foo=123 panic=-1 arg2="with spaces " extra_arg=1 extra_foo=-1 panic=3 baz="more  spaces"`)
+
+	// now check the recovery bootloader
+	optsRecovery := &bootloader.Options{NoSlashBoot: true, Role: bootloader.RoleRecovery}
+	mrg := bootloader.NewGrub(s.rootdir, optsRecovery).(bootloader.TrustedAssetsBootloader)
+	args, err = mrg.CommandLine("snapd_recovery_mode=recover", "snapd_recovery_system=20200202", extraArgs)
+	c.Assert(err, IsNil)
+	// static command line from recovery asset
+	c.Check(args, Equals, `snapd_recovery_mode=recover snapd_recovery_system=20200202 recovery config panic=-1 extra_arg=1 extra_foo=-1 panic=3 baz="more  spaces"`)
+
+	// try with a different edition
+	grubCfg3 := `# Snapd-Boot-Config-Edition: 3
+boot script
+`
+	s.makeFakeGrubEFINativeEnv(c, []byte(grubCfg3))
+	tg = bootloader.NewGrub(s.rootdir, optsNoSlashBoot).(bootloader.TrustedAssetsBootloader)
+	c.Assert(g, NotNil)
+	extraArgs = `extra_arg=1`
+	args, err = tg.CommandLine("snapd_recovery_mode=run", "", extraArgs)
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=run edition=3 static args extra_arg=1`)
+}
+
+func (s *grubTestSuite) TestCandidateCommandLineMocked(c *C) {
+	grubCfg := `# Snapd-Boot-Config-Edition: 1
+boot script
+`
+	// edition on disk
+	s.makeFakeGrubEFINativeEnv(c, []byte(grubCfg))
+
+	edition2 := []byte(`# Snapd-Boot-Config-Edition: 2`)
+	edition3 := []byte(`# Snapd-Boot-Config-Edition: 3`)
+	edition4 := []byte(`# Snapd-Boot-Config-Edition: 4`)
+
+	restore := assets.MockInternal("grub.cfg", edition2)
+	defer restore()
+	restore = assets.MockInternal("grub-recovery.cfg", edition2)
+	defer restore()
+
+	restore = assets.MockSnippetsForEdition("grub.cfg:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte(`edition=1`)},
+		{FirstEdition: 3, Snippet: []byte(`edition=3`)},
+	})
+	defer restore()
+	restore = assets.MockSnippetsForEdition("grub-recovery.cfg:static-cmdline", []assets.ForEditions{
+		{FirstEdition: 1, Snippet: []byte(`recovery edition=1`)},
+		{FirstEdition: 3, Snippet: []byte(`recovery edition=3`)},
+		{FirstEdition: 4, Snippet: []byte(`recovery edition=4up`)},
+	})
+	defer restore()
+
+	optsNoSlashBoot := &bootloader.Options{NoSlashBoot: true}
+	mg := bootloader.NewGrub(s.rootdir, optsNoSlashBoot).(bootloader.TrustedAssetsBootloader)
+	optsRecovery := &bootloader.Options{NoSlashBoot: true, Role: bootloader.RoleRecovery}
+	recoverymg := bootloader.NewGrub(s.rootdir, optsRecovery).(bootloader.TrustedAssetsBootloader)
+
+	args, err := mg.CandidateCommandLine("snapd_recovery_mode=run", "", "extra=1")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=run edition=1 extra=1`)
+	args, err = recoverymg.CandidateCommandLine("snapd_recovery_mode=recover", "snapd_recovery_system=20200202", "extra=1")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=recover snapd_recovery_system=20200202 recovery edition=1 extra=1`)
+
+	restore = assets.MockInternal("grub.cfg", edition3)
+	defer restore()
+	restore = assets.MockInternal("grub-recovery.cfg", edition3)
+	defer restore()
+
+	args, err = mg.CandidateCommandLine("snapd_recovery_mode=run", "", "extra=1")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=run edition=3 extra=1`)
+	args, err = recoverymg.CandidateCommandLine("snapd_recovery_mode=recover", "snapd_recovery_system=20200202", "extra=1")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=recover snapd_recovery_system=20200202 recovery edition=3 extra=1`)
+
+	// bump edition only for recovery
+	restore = assets.MockInternal("grub-recovery.cfg", edition4)
+	defer restore()
+	// boot bootloader unchanged
+	args, err = mg.CandidateCommandLine("snapd_recovery_mode=run", "", "extra=1")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=run edition=3 extra=1`)
+	// recovery uses a new edition
+	args, err = recoverymg.CandidateCommandLine("snapd_recovery_mode=recover", "snapd_recovery_system=20200202", "extra=1")
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=recover snapd_recovery_system=20200202 recovery edition=4up extra=1`)
+}
+
+func (s *grubTestSuite) TestCommandLineReal(c *C) {
+	grubCfg := `# Snapd-Boot-Config-Edition: 1
+boot script
+`
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte(grubCfg))
+
+	opts := &bootloader.Options{NoSlashBoot: true}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+	tg, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	extraArgs := "foo bar baz=1"
+	args, err := tg.CommandLine("snapd_recovery_mode=run", "", extraArgs)
+	c.Assert(err, IsNil)
+	c.Check(args, Equals, `snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1 foo bar baz=1`)
+
+	// now check the recovery bootloader
+	opts = &bootloader.Options{NoSlashBoot: true, Role: bootloader.RoleRecovery}
+	mrg := bootloader.NewGrub(s.rootdir, opts).(bootloader.TrustedAssetsBootloader)
+	args, err = mrg.CommandLine("snapd_recovery_mode=recover", "snapd_recovery_system=20200202", extraArgs)
+	c.Assert(err, IsNil)
+	// static command line from recovery asset
+	c.Check(args, Equals, `snapd_recovery_mode=recover snapd_recovery_system=20200202 console=ttyS0 console=tty1 panic=-1 foo bar baz=1`)
+}
+
+func (s *grubTestSuite) TestTrustedAssetsNativePartitionLayout(c *C) {
+	// native EFI/ubuntu setup
+	s.makeFakeGrubEFINativeEnv(c, []byte("grub.cfg"))
+	opts := &bootloader.Options{NoSlashBoot: true}
+	g := bootloader.NewGrub(s.rootdir, opts)
+	c.Assert(g, NotNil)
+
+	tab, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	ta, err := tab.TrustedAssets()
+	c.Assert(err, IsNil)
+	c.Check(ta, DeepEquals, []string{
+		"EFI/boot/grubx64.efi",
+	})
+
+	// recovery bootloader
+	recoveryOpts := &bootloader.Options{NoSlashBoot: true, Role: bootloader.RoleRecovery}
+	tarb := bootloader.NewGrub(s.rootdir, recoveryOpts).(bootloader.TrustedAssetsBootloader)
+	c.Assert(tarb, NotNil)
+
+	ta, err = tarb.TrustedAssets()
+	c.Assert(err, IsNil)
+	c.Check(ta, DeepEquals, []string{
+		"EFI/boot/bootx64.efi",
+		"EFI/boot/grubx64.efi",
+	})
+
+}
+
+func (s *grubTestSuite) TestTrustedAssetsRoot(c *C) {
+	s.makeFakeGrubEnv(c)
+	g := bootloader.NewGrub(s.rootdir, nil)
+	tab, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	ta, err := tab.TrustedAssets()
+	c.Assert(err, ErrorMatches, "internal error: trusted assets called without native host-partition layout")
+	c.Check(ta, IsNil)
+}
+
+func (s *grubTestSuite) TestRecoveryBootChains(c *C) {
+	s.makeFakeGrubEFINativeEnv(c, nil)
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
+	tab, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	chain, err := tab.RecoveryBootChain("kernel.snap")
+	c.Assert(err, IsNil)
+	c.Assert(chain, DeepEquals, []bootloader.BootFile{
+		{Path: "EFI/boot/bootx64.efi", Role: bootloader.RoleRecovery},
+		{Path: "EFI/boot/grubx64.efi", Role: bootloader.RoleRecovery},
+		{Snap: "kernel.snap", Path: "kernel.efi", Role: bootloader.RoleRecovery},
+	})
+}
+
+func (s *grubTestSuite) TestRecoveryBootChainsNotRecoveryBootloader(c *C) {
+	s.makeFakeGrubEnv(c)
+	g := bootloader.NewGrub(s.rootdir, nil)
+	tab, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	_, err := tab.RecoveryBootChain("kernel.snap")
+	c.Assert(err, ErrorMatches, "not a recovery bootloader")
+}
+
+func (s *grubTestSuite) TestBootChains(c *C) {
+	s.makeFakeGrubEFINativeEnv(c, nil)
+	g := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRecovery})
+	tab, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	g2 := bootloader.NewGrub(s.rootdir, &bootloader.Options{Role: bootloader.RoleRunMode})
+
+	chain, err := tab.BootChain(g2, "kernel.snap")
+	c.Assert(err, IsNil)
+	c.Assert(chain, DeepEquals, []bootloader.BootFile{
+		{Path: "EFI/boot/bootx64.efi", Role: bootloader.RoleRecovery},
+		{Path: "EFI/boot/grubx64.efi", Role: bootloader.RoleRecovery},
+		{Path: "EFI/boot/grubx64.efi", Role: bootloader.RoleRunMode},
+		{Snap: "kernel.snap", Path: "kernel.efi", Role: bootloader.RoleRunMode},
+	})
+}
+
+func (s *grubTestSuite) TestBootChainsNotRecoveryBootloader(c *C) {
+	s.makeFakeGrubEnv(c)
+	g := bootloader.NewGrub(s.rootdir, nil)
+	tab, ok := g.(bootloader.TrustedAssetsBootloader)
+	c.Assert(ok, Equals, true)
+
+	g2 := bootloader.NewGrub(s.rootdir, &bootloader.Options{NoSlashBoot: true, Role: bootloader.RoleRunMode})
+
+	_, err := tab.BootChain(g2, "kernel.snap")
+	c.Assert(err, ErrorMatches, "not a recovery bootloader")
+}
diff -Nru snapd-2.45.1+20.04.2/bootloader/lkenv/lkenv.go snapd-2.48.3+20.04/bootloader/lkenv/lkenv.go
--- snapd-2.45.1+20.04.2/bootloader/lkenv/lkenv.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/lkenv/lkenv.go	2021-02-02 08:21:12.000000000 +0000
@@ -51,7 +51,7 @@
 /**
  * Following structure has to be kept in sync with c structure defined by
  * include/lk/snappy-boot_v1.h
- * c headerfile is used by bootloader, this ensures sync of  the environment
+ * c headerfile is used by bootloader, this ensures sync of the environment
  * between snapd and bootloader
 
  * when this structure needs to be updated,
@@ -93,7 +93,7 @@
 	Reboot_reason [SNAP_NAME_MAX_LEN]byte
 
 	/**
-	 * Matrix for mapping of boot img partion to installed kernel snap revision
+	 * Matrix for mapping of boot img partition to installed kernel snap revision
 	 *
 	 * First column represents boot image partition label (e.g. boot_a,boot_b )
 	 *   value are static and should be populated at gadget built time
@@ -134,7 +134,7 @@
 	Bootimg_file_name [SNAP_NAME_MAX_LEN]byte
 
 	/**
-	 * gadget assets: Matrix for mapping of gadget asset partions
+	 * gadget assets: Matrix for mapping of gadget asset partitions
 	 * Optional boot asset tracking, based on bootloader support
 	 * Some boot chains support A/B boot assets for increased robustness
 	 * example being A/B TrustExecutionEnvironment
@@ -170,7 +170,7 @@
 	Unused_key_20 [SNAP_NAME_MAX_LEN]byte
 
 	/* unused array of 10 key value pairs */
-	Kye_value_pairs [10][2][SNAP_NAME_MAX_LEN]byte
+	Key_value_pairs [10][2][SNAP_NAME_MAX_LEN]byte
 
 	/* crc32 value for structure */
 	Crc32 uint32
@@ -337,20 +337,20 @@
 	w.Truncate(ss - 4)
 	binary.Write(w, binary.LittleEndian, &l.env.Crc32)
 
-	err := l.SaveEnv(l.path, w)
+	err := l.saveEnv(l.path, w)
 	if err != nil {
 		logger.Debugf("Save: failed to save main environment")
 	}
 	// if there is backup environment file save to it as well
 	if osutil.FileExists(l.pathbak) {
-		if err := l.SaveEnv(l.pathbak, w); err != nil {
+		if err := l.saveEnv(l.pathbak, w); err != nil {
 			logger.Debugf("Save: failed to save backup environment %v", err)
 		}
 	}
 	return err
 }
 
-func (l *Env) SaveEnv(path string, buf *bytes.Buffer) error {
+func (l *Env) saveEnv(path string, buf *bytes.Buffer) error {
 	f, err := os.OpenFile(path, os.O_WRONLY, 0660)
 	if err != nil {
 		return fmt.Errorf("cannot open LK env file for env storing: %v", err)
@@ -384,7 +384,9 @@
 	return "", fmt.Errorf("cannot find free partition for boot image")
 }
 
-// SetBootPartition set kernel revision name to passed boot partition
+// SetBootPartition sets the kernel revision reference in the provided boot
+// partition reference to the provided kernel revision. It returns a non-nil err
+// if the provided boot partition reference was not found.
 func (l *Env) SetBootPartition(bootpart, kernel string) error {
 	for x := range l.env.Bootimg_matrix {
 		if bootpart == cToGoString(l.env.Bootimg_matrix[x][MATRIX_ROW_PARTITION][:]) {
@@ -395,6 +397,9 @@
 	return fmt.Errorf("cannot find defined [%s] boot image partition", bootpart)
 }
 
+// GetBootPartition returns the first found boot partition that contains a
+// reference to the given kernel revision. If the revision was not found, a
+// non-nil error is returned.
 func (l *Env) GetBootPartition(kernel string) (string, error) {
 	for x := range l.env.Bootimg_matrix {
 		if kernel == cToGoString(l.env.Bootimg_matrix[x][MATRIX_ROW_KERNEL][:]) {
@@ -404,18 +409,21 @@
 	return "", fmt.Errorf("cannot find kernel %q in boot image partitions", kernel)
 }
 
-// FreeBootPartition free passed kernel revision from any boot partition
-// ignore if there is no boot partition with given kernel revision
-func (l *Env) FreeBootPartition(kernel string) (bool, error) {
+// RemoveKernelRevisionFromBootPartition removes from the boot image matrix the
+// first found boot partition that contains a reference to the given kernel
+// revision. If the referenced kernel revision was not found, a non-nil err is
+// returned, otherwise the reference is removed and nil is returned.
+// Note that to persist this change the env must be saved afterwards with Save.
+func (l *Env) RemoveKernelRevisionFromBootPartition(kernel string) error {
 	for x := range l.env.Bootimg_matrix {
 		if "" != cToGoString(l.env.Bootimg_matrix[x][MATRIX_ROW_PARTITION][:]) {
 			if kernel == cToGoString(l.env.Bootimg_matrix[x][MATRIX_ROW_KERNEL][:]) {
 				l.env.Bootimg_matrix[x][1][MATRIX_ROW_PARTITION] = 0
-				return true, nil
+				return nil
 			}
 		}
 	}
-	return false, fmt.Errorf("cannot find defined [%s] boot image partition", kernel)
+	return fmt.Errorf("cannot find defined [%s] boot image partition", kernel)
 }
 
 // GetBootImageName return expected boot image file name in kernel snap
diff -Nru snapd-2.45.1+20.04.2/bootloader/lkenv/lkenv_test.go snapd-2.48.3+20.04/bootloader/lkenv/lkenv_test.go
--- snapd-2.45.1+20.04.2/bootloader/lkenv/lkenv_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/lkenv/lkenv_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -276,13 +276,11 @@
 	err = env.SetBootPartition("boot_a", "kernel-3")
 	c.Assert(err, IsNil)
 	// remove kernel
-	used, err := env.FreeBootPartition("kernel-3")
+	err = env.RemoveKernelRevisionFromBootPartition("kernel-3")
 	c.Assert(err, IsNil)
-	c.Check(used, Equals, true)
 	// repeated use should return false and error
-	used, err = env.FreeBootPartition("kernel-3")
+	err = env.RemoveKernelRevisionFromBootPartition("kernel-3")
 	c.Assert(err, NotNil)
-	c.Check(used, Equals, false)
 }
 
 func (l *lkenvTestSuite) TestZippedDataSample(c *C) {
diff -Nru snapd-2.45.1+20.04.2/bootloader/lk.go snapd-2.48.3+20.04/bootloader/lk.go
--- snapd-2.45.1+20.04.2/bootloader/lk.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/lk.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,7 +28,6 @@
 
 	"github.com/snapcore/snapd/bootloader/lkenv"
 	"github.com/snapcore/snapd/logger"
-	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 )
 
@@ -41,17 +40,15 @@
 func newLk(rootdir string, opts *Options) Bootloader {
 	l := &lk{rootdir: rootdir}
 
-	// XXX: in the long run we want this to go away, we probably add
-	//      something like "boot.PrepareImage()" and add an (optional)
-	//      method "PrepareImage" to the bootloader interface that is
-	//      used to setup a bootloader from prepare-image if things
-	//      are very different from runtime vs image-building mode.
-	//
-	// determine mode we are in, runtime or image build
-	l.inRuntimeMode = !opts.PrepareImageTime
-
-	if !osutil.FileExists(l.envFile()) {
-		return nil
+	if opts != nil {
+		// XXX: in the long run we want this to go away, we probably add
+		//      something like "boot.PrepareImage()" and add an (optional)
+		//      method "PrepareImage" to the bootloader interface that is
+		//      used to setup a bootloader from prepare-image if things
+		//      are very different from runtime vs image-building mode.
+		//
+		// determine mode we are in, runtime or image build
+		l.inRuntimeMode = !opts.PrepareImageTime
 	}
 
 	return l
@@ -75,7 +72,7 @@
 	return filepath.Join(l.rootdir, "/boot/lk/")
 }
 
-func (l *lk) InstallBootConfig(gadgetDir string, opts *Options) (bool, error) {
+func (l *lk) InstallBootConfig(gadgetDir string, opts *Options) error {
 	gadgetFile := filepath.Join(gadgetDir, l.Name()+".conf")
 	systemFile := l.ConfigFile()
 	return genericInstallBootConfig(gadgetFile, systemFile)
@@ -208,8 +205,10 @@
 	if err := env.Load(); err != nil && !os.IsNotExist(err) {
 		return err
 	}
-	dirty, _ := env.FreeBootPartition(blobName)
-	if dirty {
+	err := env.RemoveKernelRevisionFromBootPartition(blobName)
+	if err == nil {
+		// found and removed the revision from the bootimg matrix, need to
+		// update the env to persist the change
 		return env.Save()
 	}
 	return nil
diff -Nru snapd-2.45.1+20.04.2/bootloader/lk_test.go snapd-2.48.3+20.04/bootloader/lk_test.go
--- snapd-2.45.1+20.04.2/bootloader/lk_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/lk_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,11 +42,6 @@
 
 var _ = Suite(&lkTestSuite{})
 
-func (s *lkTestSuite) TestNewLkNolkReturnsNil(c *C) {
-	l := bootloader.NewLk("/does/not/exist", nil)
-	c.Assert(l, IsNil)
-}
-
 func (s *lkTestSuite) TestNewLk(c *C) {
 	bootloader.MockLkFiles(c, s.rootdir, nil)
 	l := bootloader.NewLk(s.rootdir, nil)
@@ -227,7 +222,7 @@
 	// now remove the kernel
 	err = lk.RemoveKernelAssets(info)
 	c.Assert(err, IsNil)
-	// and ensure its no longer available in the boot partions
+	// and ensure its no longer available in the boot partitions
 	err = lkenv.Load()
 	c.Assert(err, IsNil)
 	bootPart, err = lkenv.GetBootPartition("ubuntu-kernel_42.snap")
diff -Nru snapd-2.45.1+20.04.2/bootloader/ubootenv/env.go snapd-2.48.3+20.04/bootloader/ubootenv/env.go
--- snapd-2.45.1+20.04.2/bootloader/ubootenv/env.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/ubootenv/env.go	2021-02-02 08:21:12.000000000 +0000
@@ -100,6 +100,11 @@
 	if err != nil {
 		return nil, err
 	}
+
+	if len(contentWithHeader) < headerSize {
+		return nil, fmt.Errorf("cannot open %q: smaller than expected header", fname)
+	}
+
 	crc := readUint32(contentWithHeader)
 
 	payload := contentWithHeader[headerSize:]
diff -Nru snapd-2.45.1+20.04.2/bootloader/ubootenv/env_test.go snapd-2.48.3+20.04/bootloader/ubootenv/env_test.go
--- snapd-2.45.1+20.04.2/bootloader/ubootenv/env_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/ubootenv/env_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -67,6 +67,16 @@
 	c.Assert(env2.String(), Equals, "foo=bar\n")
 }
 
+func (u *uenvTestSuite) TestOpenEnvBadEmpty(c *C) {
+	empty := filepath.Join(c.MkDir(), "empty.env")
+
+	err := ioutil.WriteFile(empty, nil, 0644)
+	c.Assert(err, IsNil)
+
+	_, err = ubootenv.Open(empty)
+	c.Assert(err, ErrorMatches, `cannot open ".*": smaller than expected header`)
+}
+
 func (u *uenvTestSuite) TestOpenEnvBadCRC(c *C) {
 	corrupted := filepath.Join(c.MkDir(), "corrupted.env")
 
diff -Nru snapd-2.45.1+20.04.2/bootloader/uboot.go snapd-2.48.3+20.04/bootloader/uboot.go
--- snapd-2.45.1+20.04.2/bootloader/uboot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/uboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,7 +25,6 @@
 	"path/filepath"
 
 	"github.com/snapcore/snapd/bootloader/ubootenv"
-	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 )
 
@@ -44,32 +43,29 @@
 func (u *uboot) processBlOpts(blOpts *Options) {
 	if blOpts != nil {
 		switch {
-		case blOpts.NoSlashBoot, blOpts.Recovery:
-			// Recovery or NoSlashBoot imply we use the "boot.sel" simple text
-			// format file in /uboot/ubuntu as it exists on the partition
+		case blOpts.Role == RoleRecovery || blOpts.NoSlashBoot:
+			// RoleRecovery or NoSlashBoot imply we use
+			// the "boot.sel" simple text format file in
+			// /uboot/ubuntu as it exists on the partition
 			// directly
 			u.basedir = "/uboot/ubuntu/"
 			fallthrough
-		case blOpts.ExtractedRunKernelImage:
-			// if just ExtractedRunKernelImage is defined, we expect to find
-			// /boot/uboot/boot.sel
+		case blOpts.Role == RoleRunMode:
+			// if RoleRunMode (and no NoSlashBoot), we
+			// expect to find /boot/uboot/boot.sel
 			u.ubootEnvFileName = "boot.sel"
 		}
 	}
 }
 
 // newUboot create a new Uboot bootloader object
-func newUboot(rootdir string, blOpts *Options) ExtractedRecoveryKernelImageBootloader {
+func newUboot(rootdir string, blOpts *Options) Bootloader {
 	u := &uboot{
 		rootdir: rootdir,
 	}
 	u.setDefaults()
 	u.processBlOpts(blOpts)
 
-	if !osutil.FileExists(u.envFile()) {
-		return nil
-	}
-
 	return u
 }
 
@@ -88,7 +84,7 @@
 	return filepath.Join(u.rootdir, u.basedir)
 }
 
-func (u *uboot) InstallBootConfig(gadgetDir string, blOpts *Options) (bool, error) {
+func (u *uboot) InstallBootConfig(gadgetDir string, blOpts *Options) error {
 	gadgetFile := filepath.Join(gadgetDir, u.Name()+".conf")
 	// if the gadget file is empty, then we don't install anything
 	// this is because there are some gadgets, namely the 20 pi gadget right
@@ -99,7 +95,7 @@
 	//            actual format?
 	st, err := os.Stat(gadgetFile)
 	if err != nil {
-		return false, err
+		return err
 	}
 	if st.Size() == 0 {
 		// we have an empty uboot.conf, and hence a uboot bootloader in the
@@ -109,30 +105,30 @@
 
 		err := os.MkdirAll(filepath.Dir(u.envFile()), 0755)
 		if err != nil {
-			return false, err
+			return err
 		}
 
 		// TODO:UC20: what's a reasonable size for this file?
 		env, err := ubootenv.Create(u.envFile(), 4096)
 		if err != nil {
-			return false, err
+			return err
 		}
 
 		if err := env.Save(); err != nil {
-			return false, nil
+			return nil
 		}
 
-		return true, nil
+		return nil
 	}
 
 	// InstallBootConfig gets called on a uboot that does not come from newUboot
 	// so we need to apply the defaults here
 	u.setDefaults()
 
-	if blOpts != nil && blOpts.Recovery {
+	if blOpts != nil && blOpts.Role == RoleRecovery {
 		// not supported yet, this is traditional uboot.env from gadget
 		// TODO:UC20: support this use-case
-		return false, fmt.Errorf("non-empty uboot.env not supported on UC20 yet")
+		return fmt.Errorf("non-empty uboot.env not supported on UC20 yet")
 	}
 
 	systemFile := u.ConfigFile()
diff -Nru snapd-2.45.1+20.04.2/bootloader/uboot_test.go snapd-2.48.3+20.04/bootloader/uboot_test.go
--- snapd-2.45.1+20.04.2/bootloader/uboot_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/bootloader/uboot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -41,11 +41,6 @@
 
 var _ = Suite(&ubootTestSuite{})
 
-func (s *ubootTestSuite) TestNewUbootNoUbootReturnsNil(c *C) {
-	u := bootloader.NewUboot(s.rootdir, nil)
-	c.Assert(u, IsNil)
-}
-
 func (s *ubootTestSuite) TestNewUboot(c *C) {
 	bootloader.MockUbootFiles(c, s.rootdir, nil)
 	u := bootloader.NewUboot(s.rootdir, nil)
@@ -234,17 +229,17 @@
 			"traditional uboot.env",
 		},
 		{
-			&bootloader.Options{NoSlashBoot: true},
+			&bootloader.Options{Role: bootloader.RoleRunMode, NoSlashBoot: true},
 			"/uboot/ubuntu/boot.sel",
 			"uc20 install mode boot.sel",
 		},
 		{
-			&bootloader.Options{ExtractedRunKernelImage: true},
+			&bootloader.Options{Role: bootloader.RoleRunMode},
 			"/boot/uboot/boot.sel",
 			"uc20 run mode boot.sel",
 		},
 		{
-			&bootloader.Options{Recovery: true},
+			&bootloader.Options{Role: bootloader.RoleRecovery},
 			"/uboot/ubuntu/boot.sel",
 			"uc20 recovery boot.sel",
 		},
diff -Nru snapd-2.45.1+20.04.2/check-pr-has-label.py snapd-2.48.3+20.04/check-pr-has-label.py
--- snapd-2.45.1+20.04.2/check-pr-has-label.py	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/check-pr-has-label.py	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,114 @@
+#!/usr/bin/python3
+
+import argparse
+import urllib.request
+import logging
+
+from html.parser import HTMLParser
+
+LABELS = {
+    # PR label indicating that spread job should be skipped
+    'LABEL_SKIP_SPREAD_JOB': "Skip spread",
+    # PR label indicating that nested tests need to be executed
+    'LABEL_RUN_SPREAD_NESTED': "Run nested"
+    }
+
+
+class GithubLabelsParser(HTMLParser):
+    def __init__(self):
+        super().__init__()
+        self.in_labels = False
+        self.deep = 0
+        self.labels = []
+
+    def handle_starttag(self, tag, attributes):
+        logging.debug(attributes)
+
+        if not self.in_labels:
+            attr_class = [attr[1] for attr in attributes if attr[0] == "class"]
+            if len(attr_class) == 0:
+                return
+            # labels are in separate div defined like:
+            # <div class=".. labels .." .. >
+            elems = attr_class[0].split(" ")
+            if "labels" in elems:
+                self.in_labels = True
+                self.deep = 1
+                logging.debug("labels start")
+        else:
+            # nesting counter
+            self.deep += 1
+
+            # inside labels
+            # label entry has
+            # <a class=".." data-name="<label name>" />
+            attr_data_name = [attr[1] for attr in attributes if attr[0] == "data-name"]
+            if len(attr_data_name) == 0:
+                return
+            data_name = attr_data_name[0]
+            logging.debug("found label: %s", data_name)
+            self.labels.append(data_name)
+
+    def handle_endtag(self, tag):
+        if self.in_labels:
+            self.deep -= 1
+            if self.deep < 1:
+                logging.debug("labels end")
+                self.in_labels = False
+
+    def handle_data(self, data):
+        if self.in_labels:
+            logging.debug("data: %s", data)
+
+
+def grab_pr_labels(pr_number: int):
+    # ideally we would use the github API - however we can't because:
+    # a) its rate limiting and travis IPs hit the API a lot so we regularly
+    #    get errors
+    # b) using a API token is tricky because travis will not allow the secure
+    #    vars for forks
+    # so instead we just scrape the html title which is unlikely to change
+    # radically
+    parser = GithubLabelsParser()
+    with urllib.request.urlopen(
+        "https://github.com/snapcore/snapd/pull/{}".format(pr_number)
+    ) as f:
+        parser.feed(f.read().decode("utf-8"))
+    return parser.labels
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "pr_number", 
+        metavar="PR number", 
+        help="the github PR number to check"
+    )
+    parser.add_argument(
+        "label", 
+        metavar="Label name", 
+        choices=LABELS.keys(), 
+        help="the github PR label to check"
+    )
+    parser.add_argument(
+        "-d", "--debug", help="enable debug logging", action="store_true"
+    )
+    args = parser.parse_args()
+
+    lvl = logging.INFO
+    if args.debug:
+        lvl = logging.DEBUG
+    logging.basicConfig(level=lvl)
+
+    pr_labels = grab_pr_labels(args.pr_number)
+    print("pr labels:", pr_labels)
+
+    if LABELS.get(args.label) not in pr_labels:
+        raise SystemExit(1)
+
+    print("Label: '{}' found in PR: '{}'".format(
+        LABELS.get(args.label), args.pr_number))
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/check-pr-skip-spread.py snapd-2.48.3+20.04/check-pr-skip-spread.py
--- snapd-2.45.1+20.04.2/check-pr-skip-spread.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/check-pr-skip-spread.py	1970-01-01 00:00:00.000000000 +0000
@@ -1,101 +0,0 @@
-#!/usr/bin/python3
-
-import argparse
-import urllib.request
-import logging
-
-from html.parser import HTMLParser
-
-# PR label indicating that spread job should be skipped
-LABEL_SKIP_SPREAD_JOB = "Skip spread"
-
-
-class GithubLabelsParser(HTMLParser):
-    def __init__(self):
-        super().__init__()
-        self.in_labels = False
-        self.deep = 0
-        self.labels = []
-
-    def handle_starttag(self, tag, attributes):
-        logging.debug(attributes)
-
-        if not self.in_labels:
-            attr_class = [attr[1] for attr in attributes if attr[0] == "class"]
-            if len(attr_class) == 0:
-                return
-            # labels are in separate div defined like:
-            # <div class=".. labels .." .. >
-            elems = attr_class[0].split(" ")
-            if "labels" in elems:
-                self.in_labels = True
-                self.deep = 1
-                logging.debug("labels start")
-        else:
-            # nesting counter
-            self.deep += 1
-
-            # inside labels
-            # label entry has
-            # <a class=".." data-name="<label name>" />
-            attr_data_name = [attr[1] for attr in attributes if attr[0] == "data-name"]
-            if len(attr_data_name) == 0:
-                return
-            data_name = attr_data_name[0]
-            logging.debug("found label: %s", data_name)
-            self.labels.append(data_name)
-
-    def handle_endtag(self, tag):
-        if self.in_labels:
-            self.deep -= 1
-            if self.deep < 1:
-                logging.debug("labels end")
-                self.in_labels = False
-
-    def handle_data(self, data):
-        if self.in_labels:
-            logging.debug("data: %s", data)
-
-
-def grab_pr_labels(pr_number: int):
-    # ideally we would use the github API - however we can't because:
-    # a) its rate limiting and travis IPs hit the API a lot so we regularly
-    #    get errors
-    # b) using a API token is tricky because travis will not allow the secure
-    #    vars for forks
-    # so instead we just scrape the html title which is unlikely to change
-    # radically
-    parser = GithubLabelsParser()
-    with urllib.request.urlopen(
-        "https://github.com/snapcore/snapd/pull/{}".format(pr_number)
-    ) as f:
-        parser.feed(f.read().decode("utf-8"))
-    return parser.labels
-
-
-def main():
-    parser = argparse.ArgumentParser()
-    parser.add_argument(
-        "pr_number", metavar="PR number", help="the github PR number to check"
-    )
-    parser.add_argument(
-        "-d", "--debug", help="enable debug logging", action="store_true"
-    )
-    args = parser.parse_args()
-
-    lvl = logging.INFO
-    if args.debug:
-        lvl = logging.DEBUG
-    logging.basicConfig(level=lvl)
-
-    labels = grab_pr_labels(args.pr_number)
-    print("labels:", labels)
-
-    if LABEL_SKIP_SPREAD_JOB not in labels:
-        raise SystemExit(1)
-
-    print("requested to skip the spread job")
-
-
-if __name__ == "__main__":
-    main()
diff -Nru snapd-2.45.1+20.04.2/check-pr-title.py snapd-2.48.3+20.04/check-pr-title.py
--- snapd-2.45.1+20.04.2/check-pr-title.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/check-pr-title.py	2021-02-02 08:21:12.000000000 +0000
@@ -53,7 +53,7 @@
     # package, otherpackage/subpackage: this is a title
     # tests/regression/lp-12341234: foo
     # [RFC] foo: bar
-    if not re.match(r"[a-zA-Z0-9_\-/,. \[\]{}]+: .*", title):
+    if not re.match(r"[a-zA-Z0-9_\-\*/,. \[\]{}]+: .*", title):
         raise InvalidPRTitle(title)
 
 
diff -Nru snapd-2.45.1+20.04.2/client/asserts.go snapd-2.48.3+20.04/client/asserts.go
--- snapd-2.45.1+20.04.2/client/asserts.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/asserts.go	2021-02-02 08:21:12.000000000 +0000
@@ -84,14 +84,12 @@
 		q.Set("remote", "true")
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), doTimeout)
-	defer cancel()
-	response, err := client.raw(ctx, "GET", path, q, nil, nil)
+	response, cancel, err := client.rawWithTimeout(context.Background(), "GET", path, q, nil, nil, nil)
 	if err != nil {
 		fmt := "failed to query assertions: %w"
 		return nil, xerrors.Errorf(fmt, err)
 	}
-
+	defer cancel()
 	defer response.Body.Close()
 	if response.StatusCode != 200 {
 		return nil, parseError(response)
diff -Nru snapd-2.45.1+20.04.2/client/client.go snapd-2.48.3+20.04/client/client.go
--- snapd-2.45.1+20.04.2/client/client.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/client.go	2021-02-02 08:21:12.000000000 +0000
@@ -31,6 +31,7 @@
 	"net/url"
 	"os"
 	"path"
+	"strconv"
 	"time"
 
 	"github.com/snapcore/snapd/dirs"
@@ -204,7 +205,7 @@
 const AllowInteractionHeader = "X-Allow-Interaction"
 
 // raw performs a request and returns the resulting http.Response and
-// error you usually only need to call this directly if you expect the
+// error. You usually only need to call this directly if you expect the
 // response to not be JSON, otherwise you'd call Do(...) instead.
 func (client *Client) raw(ctx context.Context, method, urlpath string, query url.Values, headers map[string]string, body io.Reader) (*http.Response, error) {
 	// fake a url to keep http.Client happy
@@ -222,6 +223,16 @@
 	for key, value := range headers {
 		req.Header.Set(key, value)
 	}
+	// Content-length headers are special and need to be set
+	// directly to the request. Just setting it to the header
+	// will be ignored by go http.
+	if clStr := req.Header.Get("Content-Length"); clStr != "" {
+		cl, err := strconv.ParseInt(clStr, 10, 64)
+		if err != nil {
+			return nil, err
+		}
+		req.ContentLength = cl
+	}
 
 	if !client.disableAuth {
 		// set Authorization header if there are user's credentials
@@ -247,16 +258,19 @@
 	return rsp, nil
 }
 
-// rawWithTimeout is like raw(), but sets a timeout for the whole of request and
-// response (including rsp.Body() read) round trip. The caller is responsible
-// for canceling the internal context to release the resources associated with
-// the request by calling the returned cancel function.
-func (client *Client) rawWithTimeout(ctx context.Context, method, urlpath string, query url.Values, headers map[string]string, body io.Reader, timeout time.Duration) (*http.Response, context.CancelFunc, error) {
-	if timeout == 0 {
-		return nil, nil, fmt.Errorf("internal error: timeout not set for rawWithTimeout")
+// rawWithTimeout is like raw(), but sets a timeout based on opts for
+// the whole of request and response (including rsp.Body() read) round
+// trip. If opts is nil the default doTimeout is used.
+// The caller is responsible for canceling the internal context
+// to release the resources associated with the request by calling the
+// returned cancel function.
+func (client *Client) rawWithTimeout(ctx context.Context, method, urlpath string, query url.Values, headers map[string]string, body io.Reader, opts *doOptions) (*http.Response, context.CancelFunc, error) {
+	opts = ensureDoOpts(opts)
+	if opts.Timeout <= 0 {
+		return nil, nil, fmt.Errorf("internal error: timeout not set in options for rawWithTimeout")
 	}
 
-	ctx, cancel := context.WithTimeout(ctx, timeout)
+	ctx, cancel := context.WithTimeout(ctx, opts.Timeout)
 	rsp, err := client.raw(ctx, method, urlpath, query, headers, body)
 	if err != nil && ctx.Err() != nil {
 		cancel()
@@ -272,7 +286,7 @@
 	// timeout for the whole of a single request to complete, requests are
 	// retried for up to 38s in total, make sure that the client timeout is
 	// not shorter than that
-	doTimeout = 50 * time.Second
+	doTimeout = 120 * time.Second
 )
 
 // MockDoTimings mocks the delay used by the do retry loop and request timeout.
@@ -300,43 +314,73 @@
 	client.doer = hijacked{f}
 }
 
-type doFlags struct {
-	NoTimeout bool
+type doOptions struct {
+	// Timeout is the overall request timeout
+	Timeout time.Duration
+	// Retry interval.
+	// Note for a request with a Timeout but without a retry, Retry should just
+	// be set to something larger than the Timeout.
+	Retry time.Duration
+}
+
+func ensureDoOpts(opts *doOptions) *doOptions {
+	if opts == nil {
+		// defaults
+		opts = &doOptions{
+			Timeout: doTimeout,
+			Retry:   doRetry,
+		}
+	}
+	return opts
+}
+
+// doNoTimeoutAndRetry can be passed to the do family to not have timeout
+// nor retries.
+var doNoTimeoutAndRetry = &doOptions{
+	Timeout: time.Duration(-1),
 }
 
 // do performs a request and decodes the resulting json into the given
 // value. It's low-level, for testing/experimenting only; you should
 // usually use a higher level interface that builds on this.
-func (client *Client) do(method, path string, query url.Values, headers map[string]string, body io.Reader, v interface{}, flags doFlags) (statusCode int, err error) {
-	retry := time.NewTicker(doRetry)
-	defer retry.Stop()
-	timeout := time.NewTimer(doTimeout)
-	defer timeout.Stop()
+func (client *Client) do(method, path string, query url.Values, headers map[string]string, body io.Reader, v interface{}, opts *doOptions) (statusCode int, err error) {
+	opts = ensureDoOpts(opts)
+
+	client.checkMaintenanceJSON()
 
 	var rsp *http.Response
 	var ctx context.Context = context.Background()
-	for {
-		if flags.NoTimeout {
-			rsp, err = client.raw(ctx, method, path, query, headers, body)
-		} else {
+	if opts.Timeout <= 0 {
+		// no timeout and retries
+		rsp, err = client.raw(ctx, method, path, query, headers, body)
+	} else {
+		if opts.Retry <= 0 {
+			return 0, fmt.Errorf("internal error: retry setting %s invalid", opts.Retry)
+		}
+		retry := time.NewTicker(opts.Retry)
+		defer retry.Stop()
+		timeout := time.NewTimer(opts.Timeout)
+		defer timeout.Stop()
+
+		for {
 			var cancel context.CancelFunc
 			// use the same timeout as for the whole of the retry
 			// loop to error out the whole do() call when a single
 			// request exceeds the deadline
-			rsp, cancel, err = client.rawWithTimeout(ctx, method, path, query, headers, body, doTimeout)
+			rsp, cancel, err = client.rawWithTimeout(ctx, method, path, query, headers, body, opts)
 			if err == nil {
 				defer cancel()
 			}
-		}
-		if err == nil || method != "GET" {
+			if err == nil || method != "GET" {
+				break
+			}
+			select {
+			case <-retry.C:
+				continue
+			case <-timeout.C:
+			}
 			break
 		}
-		select {
-		case <-retry.C:
-			continue
-		case <-timeout.C:
-		}
-		break
 	}
 	if err != nil {
 		return 0, err
@@ -370,8 +414,60 @@
 // response payload into the given value using the "UseNumber" json decoding
 // which produces json.Numbers instead of float64 types for numbers.
 func (client *Client) doSync(method, path string, query url.Values, headers map[string]string, body io.Reader, v interface{}) (*ResultInfo, error) {
+	return client.doSyncWithOpts(method, path, query, headers, body, v, nil)
+}
+
+// checkMaintenanceJSON checks if there is a maintenance.json file written by
+// snapd the daemon that positively identifies snapd as being unavailable due to
+// maintenance, either for snapd restarting itself to update, or rebooting the
+// system to update the kernel or base snap, etc. If there is ongoing
+// maintenance, then the maintenance object on the client is set appropriately.
+// note that currently checkMaintenanceJSON does not return errors, such that
+// if the file is missing or corrupt or empty, nothing will happen and it will
+// be silently ignored
+func (client *Client) checkMaintenanceJSON() {
+	f, err := os.Open(dirs.SnapdMaintenanceFile)
+	// just continue if we can't read the maintenance file
+	if err != nil {
+		return
+	}
+	defer f.Close()
+
+	// we have a maintenance file, try to read it
+	maintenance := &Error{}
+
+	if err := json.NewDecoder(f).Decode(&maintenance); err != nil {
+		// if the json is malformed, just ignore it for now, we only use it for
+		// positive identification of snapd down for maintenance
+		return
+	}
+
+	if maintenance != nil {
+		switch maintenance.Kind {
+		case ErrorKindDaemonRestart:
+			client.maintenance = maintenance
+		case ErrorKindSystemRestart:
+			client.maintenance = maintenance
+		}
+		// don't set maintenance for other kinds, as we don't know what it
+		// is yet
+
+		// this also means an empty json object in maintenance.json doesn't get
+		// treated as a real maintenance downtime for example
+	}
+}
+
+func (client *Client) doSyncWithOpts(method, path string, query url.Values, headers map[string]string, body io.Reader, v interface{}, opts *doOptions) (*ResultInfo, error) {
+	// first check maintenance.json to see if snapd is down for a restart, and
+	// set cli.maintenance as appropriate, then perform the request
+	// TODO: it would be a nice thing to skip the request if we know that snapd
+	// won't respond and return a specific error, but that's a big behavior
+	// change we probably shouldn't make right now, not to mention it probably
+	// requires adjustments in other areas too
+	client.checkMaintenanceJSON()
+
 	var rsp response
-	statusCode, err := client.do(method, path, query, headers, body, &rsp, doFlags{})
+	statusCode, err := client.do(method, path, query, headers, body, &rsp, opts)
 	if err != nil {
 		return nil, err
 	}
@@ -395,18 +491,13 @@
 }
 
 func (client *Client) doAsync(method, path string, query url.Values, headers map[string]string, body io.Reader) (changeID string, err error) {
-	_, changeID, err = client.doAsyncFull(method, path, query, headers, body, doFlags{})
+	_, changeID, err = client.doAsyncFull(method, path, query, headers, body, nil)
 	return
 }
 
-func (client *Client) doAsyncNoTimeout(method, path string, query url.Values, headers map[string]string, body io.Reader) (changeID string, err error) {
-	_, changeID, err = client.doAsyncFull(method, path, query, headers, body, doFlags{NoTimeout: true})
-	return changeID, err
-}
-
-func (client *Client) doAsyncFull(method, path string, query url.Values, headers map[string]string, body io.Reader, flags doFlags) (result json.RawMessage, changeID string, err error) {
+func (client *Client) doAsyncFull(method, path string, query url.Values, headers map[string]string, body io.Reader, opts *doOptions) (result json.RawMessage, changeID string, err error) {
 	var rsp response
-	statusCode, err := client.do(method, path, query, headers, body, &rsp, flags)
+	statusCode, err := client.do(method, path, query, headers, body, &rsp, opts)
 	if err != nil {
 		return nil, "", err
 	}
@@ -474,7 +565,7 @@
 
 // Error is the real value of response.Result when an error occurs.
 type Error struct {
-	Kind    string      `json:"kind"`
+	Kind    ErrorKind   `json:"kind"`
 	Value   interface{} `json:"value"`
 	Message string      `json:"message"`
 
@@ -485,57 +576,12 @@
 	return e.Message
 }
 
-const (
-	ErrorKindTwoFactorRequired = "two-factor-required"
-	ErrorKindTwoFactorFailed   = "two-factor-failed"
-	ErrorKindLoginRequired     = "login-required"
-	ErrorKindInvalidAuthData   = "invalid-auth-data"
-	ErrorKindTermsNotAccepted  = "terms-not-accepted"
-	ErrorKindNoPaymentMethods  = "no-payment-methods"
-	ErrorKindPaymentDeclined   = "payment-declined"
-	ErrorKindPasswordPolicy    = "password-policy"
-
-	ErrorKindSnapAlreadyInstalled   = "snap-already-installed"
-	ErrorKindSnapNotInstalled       = "snap-not-installed"
-	ErrorKindSnapNotFound           = "snap-not-found"
-	ErrorKindAppNotFound            = "app-not-found"
-	ErrorKindSnapLocal              = "snap-local"
-	ErrorKindSnapNeedsDevMode       = "snap-needs-devmode"
-	ErrorKindSnapNeedsClassic       = "snap-needs-classic"
-	ErrorKindSnapNeedsClassicSystem = "snap-needs-classic-system"
-	ErrorKindSnapNotClassic         = "snap-not-classic"
-	ErrorKindNoUpdateAvailable      = "snap-no-update-available"
-
-	ErrorKindRevisionNotAvailable     = "snap-revision-not-available"
-	ErrorKindChannelNotAvailable      = "snap-channel-not-available"
-	ErrorKindArchitectureNotAvailable = "snap-architecture-not-available"
-
-	ErrorKindChangeConflict = "snap-change-conflict"
-
-	ErrorKindNotSnap = "snap-not-a-snap"
-
-	ErrorKindNetworkTimeout = "network-timeout"
-	ErrorKindDNSFailure     = "dns-failure"
-
-	ErrorKindInterfacesUnchanged = "interfaces-unchanged"
-
-	ErrorKindBadQuery           = "bad-query"
-	ErrorKindConfigNoSuchOption = "option-not-found"
-
-	ErrorKindSystemRestart = "system-restart"
-	ErrorKindDaemonRestart = "daemon-restart"
-
-	ErrorKindAssertionNotFound = "assertion-not-found"
-
-	ErrorKindUnsuccessful = "unsuccessful"
-)
-
 // IsRetryable returns true if the given error is an error
 // that can be retried later.
 func IsRetryable(err error) bool {
 	switch e := err.(type) {
 	case *Error:
-		return e.Kind == ErrorKindChangeConflict
+		return e.Kind == ErrorKindSnapChangeConflict
 	}
 	return false
 }
@@ -687,3 +733,13 @@
 	_, err := client.doSync("GET", "/v2/debug", urlParams, nil, nil, &result)
 	return err
 }
+
+type SystemRecoveryKeysResponse struct {
+	RecoveryKey  string `json:"recovery-key"`
+	ReinstallKey string `json:"reinstall-key"`
+}
+
+func (client *Client) SystemRecoveryKeys(result interface{}) error {
+	_, err := client.doSync("GET", "/v2/system-recovery-keys", nil, nil, nil, &result)
+	return err
+}
diff -Nru snapd-2.45.1+20.04.2/client/client_test.go snapd-2.48.3+20.04/client/client_test.go
--- snapd-2.45.1+20.04.2/client/client_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/client_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,8 +20,10 @@
 package client_test
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net"
 	"net/http"
@@ -37,12 +39,15 @@
 
 	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/testutil"
 )
 
 // Hook up check.v1 into the "go test" runner
 func Test(t *testing.T) { TestingT(t) }
 
 type clientSuite struct {
+	testutil.BaseTest
+
 	cli           *client.Client
 	req           *http.Request
 	reqs          []*http.Request
@@ -53,13 +58,16 @@
 	header        http.Header
 	status        int
 	contentLength int64
-	restore       func()
+
+	countingCloser *countingCloser
 }
 
 var _ = Suite(&clientSuite{})
 
 func (cs *clientSuite) SetUpTest(c *C) {
 	os.Setenv(client.TestAuthFileEnvKey, filepath.Join(c.MkDir(), "auth.json"))
+	cs.AddCleanup(func() { os.Unsetenv(client.TestAuthFileEnvKey) })
+
 	cs.cli = client.New(nil)
 	cs.cli.SetDoer(cs)
 	cs.err = nil
@@ -72,15 +80,22 @@
 	cs.status = 200
 	cs.doCalls = 0
 	cs.contentLength = 0
+	cs.countingCloser = nil
 
 	dirs.SetRootDir(c.MkDir())
+	cs.AddCleanup(func() { dirs.SetRootDir("") })
 
-	cs.restore = client.MockDoTimings(time.Millisecond, 100*time.Millisecond)
+	cs.AddCleanup(client.MockDoTimings(time.Millisecond, 100*time.Millisecond))
 }
 
-func (cs *clientSuite) TearDownTest(c *C) {
-	os.Unsetenv(client.TestAuthFileEnvKey)
-	cs.restore()
+type countingCloser struct {
+	io.Reader
+	closeCalled int
+}
+
+func (n *countingCloser) Close() error {
+	n.closeCalled++
+	return nil
 }
 
 func (cs *clientSuite) Do(req *http.Request) (*http.Response, error) {
@@ -90,8 +105,9 @@
 	if cs.doCalls < len(cs.rsps) {
 		body = cs.rsps[cs.doCalls]
 	}
+	cs.countingCloser = &countingCloser{Reader: strings.NewReader(body)}
 	rsp := &http.Response{
-		Body:          ioutil.NopCloser(strings.NewReader(body)),
+		Body:          cs.countingCloser,
 		Header:        cs.header,
 		StatusCode:    cs.status,
 		ContentLength: cs.contentLength,
@@ -108,7 +124,7 @@
 
 func (cs *clientSuite) TestClientDoReportsErrors(c *C) {
 	cs.err = errors.New("ouchie")
-	_, err := cs.cli.Do("GET", "/", nil, nil, nil, client.DoFlags{})
+	_, err := cs.cli.Do("GET", "/", nil, nil, nil, nil)
 	c.Check(err, ErrorMatches, "cannot communicate with server: ouchie")
 	if cs.doCalls < 2 {
 		c.Fatalf("do did not retry")
@@ -119,7 +135,7 @@
 	var v []int
 	cs.rsp = `[1,2]`
 	reqBody := ioutil.NopCloser(strings.NewReader(""))
-	statusCode, err := cs.cli.Do("GET", "/this", nil, reqBody, &v, client.DoFlags{})
+	statusCode, err := cs.cli.Do("GET", "/this", nil, reqBody, &v, nil)
 	c.Check(err, IsNil)
 	c.Check(statusCode, Equals, 200)
 	c.Check(v, DeepEquals, []int{1, 2})
@@ -130,12 +146,91 @@
 	c.Check(cs.req.URL.Path, Equals, "/this")
 }
 
+func makeMaintenanceFile(c *C, b []byte) {
+	c.Assert(os.MkdirAll(filepath.Dir(dirs.SnapdMaintenanceFile), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(dirs.SnapdMaintenanceFile, b, 0644), IsNil)
+}
+
+func (cs *clientSuite) TestClientSetMaintenanceForMaintenanceJSON(c *C) {
+	// write a maintenance.json that says snapd is down for a restart
+	maintErr := &client.Error{
+		Kind:    client.ErrorKindSystemRestart,
+		Message: "system is restarting",
+	}
+	b, err := json.Marshal(maintErr)
+	c.Assert(err, IsNil)
+	makeMaintenanceFile(c, b)
+
+	// now after a Do(), we will have maintenance set to what we wrote
+	// originally
+	_, err = cs.cli.Do("GET", "/this", nil, nil, nil, nil)
+	c.Check(err, IsNil)
+
+	returnedErr := cs.cli.Maintenance()
+	c.Assert(returnedErr, DeepEquals, maintErr)
+}
+
+func (cs *clientSuite) TestClientIgnoresGarbageMaintenanceJSON(c *C) {
+	// write a garbage maintenance.json that can't be unmarshalled
+	makeMaintenanceFile(c, []byte("blah blah blah not json"))
+
+	// after a Do(), no maintenance set and also no error returned from Do()
+	_, err := cs.cli.Do("GET", "/this", nil, nil, nil, nil)
+	c.Check(err, IsNil)
+
+	returnedErr := cs.cli.Maintenance()
+	c.Assert(returnedErr, IsNil)
+}
+
+func (cs *clientSuite) TestClientDoNoTimeoutIgnoresRetry(c *C) {
+	var v []int
+	cs.rsp = `[1,2]`
+	cs.err = fmt.Errorf("borken")
+	reqBody := ioutil.NopCloser(strings.NewReader(""))
+	doOpts := &client.DoOptions{
+		// Timeout is unset, thus 0, and thus we ignore the retry and only run
+		// once even though there is an error
+		Retry: time.Duration(time.Second),
+	}
+	_, err := cs.cli.Do("GET", "/this", nil, reqBody, &v, doOpts)
+	c.Check(err, ErrorMatches, "cannot communicate with server: borken")
+	c.Assert(cs.doCalls, Equals, 1)
+}
+
+func (cs *clientSuite) TestClientDoRetryValidation(c *C) {
+	var v []int
+	cs.rsp = `[1,2]`
+	reqBody := ioutil.NopCloser(strings.NewReader(""))
+	doOpts := &client.DoOptions{
+		Retry:   time.Duration(-1),
+		Timeout: time.Duration(time.Minute),
+	}
+	_, err := cs.cli.Do("GET", "/this", nil, reqBody, &v, doOpts)
+	c.Check(err, ErrorMatches, "internal error: retry setting.*invalid")
+	c.Assert(cs.req, IsNil)
+}
+
+func (cs *clientSuite) TestClientDoRetryWorks(c *C) {
+	reqBody := ioutil.NopCloser(strings.NewReader(""))
+	cs.err = fmt.Errorf("borken")
+	doOpts := &client.DoOptions{
+		Retry:   time.Duration(time.Millisecond),
+		Timeout: time.Duration(time.Second),
+	}
+	_, err := cs.cli.Do("GET", "/this", nil, reqBody, nil, doOpts)
+	c.Check(err, ErrorMatches, "cannot communicate with server: borken")
+	// best effort checking given that execution could be slow
+	// on some machines
+	c.Assert(cs.doCalls > 500, Equals, true)
+	c.Assert(cs.doCalls < 1100, Equals, true)
+}
+
 func (cs *clientSuite) TestClientUnderstandsStatusCode(c *C) {
 	var v []int
 	cs.status = 202
 	cs.rsp = `[1,2]`
 	reqBody := ioutil.NopCloser(strings.NewReader(""))
-	statusCode, err := cs.cli.Do("GET", "/this", nil, reqBody, &v, client.DoFlags{})
+	statusCode, err := cs.cli.Do("GET", "/this", nil, reqBody, &v, nil)
 	c.Check(err, IsNil)
 	c.Check(statusCode, Equals, 202)
 	c.Check(v, DeepEquals, []int{1, 2})
@@ -151,7 +246,7 @@
 	defer os.Unsetenv(client.TestAuthFileEnvKey)
 
 	var v string
-	_, _ = cs.cli.Do("GET", "/this", nil, nil, &v, client.DoFlags{})
+	_, _ = cs.cli.Do("GET", "/this", nil, nil, &v, nil)
 	c.Assert(cs.req, NotNil)
 	authorization := cs.req.Header.Get("Authorization")
 	c.Check(authorization, Equals, "")
@@ -169,7 +264,7 @@
 	c.Assert(err, IsNil)
 
 	var v string
-	_, _ = cs.cli.Do("GET", "/this", nil, nil, &v, client.DoFlags{})
+	_, _ = cs.cli.Do("GET", "/this", nil, nil, &v, nil)
 	authorization := cs.req.Header.Get("Authorization")
 	c.Check(authorization, Equals, `Macaroon root="macaroon", discharge="discharge"`)
 }
@@ -188,7 +283,7 @@
 	var v string
 	cli := client.New(&client.Config{DisableAuth: true})
 	cli.SetDoer(cs)
-	_, _ = cli.Do("GET", "/this", nil, nil, &v, client.DoFlags{})
+	_, _ = cli.Do("GET", "/this", nil, nil, &v, nil)
 	authorization := cs.req.Header.Get("Authorization")
 	c.Check(authorization, Equals, "")
 }
@@ -197,13 +292,13 @@
 	var v string
 	cli := client.New(&client.Config{Interactive: false})
 	cli.SetDoer(cs)
-	_, _ = cli.Do("GET", "/this", nil, nil, &v, client.DoFlags{})
+	_, _ = cli.Do("GET", "/this", nil, nil, &v, nil)
 	interactive := cs.req.Header.Get(client.AllowInteractionHeader)
 	c.Check(interactive, Equals, "")
 
 	cli = client.New(&client.Config{Interactive: true})
 	cli.SetDoer(cs)
-	_, _ = cli.Do("GET", "/this", nil, nil, &v, client.DoFlags{})
+	_, _ = cli.Do("GET", "/this", nil, nil, &v, nil)
 	interactive = cs.req.Header.Get(client.AllowInteractionHeader)
 	c.Check(interactive, Equals, "true")
 }
@@ -340,7 +435,7 @@
 		Args:      []string{"bar", "--baz"},
 	}
 
-	stdout, stderr, err := cli.RunSnapctl(options)
+	stdout, stderr, err := cli.RunSnapctl(options, nil)
 	c.Check(err, IsNil)
 	c.Check(string(stdout), Equals, "test stdout")
 	c.Check(string(stderr), Equals, "test stderr")
@@ -461,7 +556,7 @@
 	c.Check(client.IsRetryable(errors.New("some-error")), Equals, false)
 	c.Check(client.IsRetryable(&client.Error{Kind: "something-else"}), Equals, false)
 	// happy
-	c.Check(client.IsRetryable(&client.Error{Kind: client.ErrorKindChangeConflict}), Equals, true)
+	c.Check(client.IsRetryable(&client.Error{Kind: client.ErrorKindSnapChangeConflict}), Equals, true)
 }
 
 func (cs *clientSuite) TestUserAgent(c *C) {
@@ -469,7 +564,7 @@
 	cli.SetDoer(cs)
 
 	var v string
-	_, _ = cli.Do("GET", "/", nil, nil, &v, client.DoFlags{})
+	_, _ = cli.Do("GET", "/", nil, nil, &v, nil)
 	c.Assert(cs.req, NotNil)
 	c.Check(cs.req.Header.Get("User-Agent"), Equals, "some-agent/9.87")
 }
@@ -528,9 +623,21 @@
 	defer func() { testServer.Close() }()
 
 	cli := client.New(&client.Config{BaseURL: testServer.URL})
-	_, err := cli.Do("GET", "/", nil, nil, nil, client.DoFlags{})
+	_, err := cli.Do("GET", "/", nil, nil, nil, nil)
 	c.Assert(err, ErrorMatches, `.* timeout exceeded while waiting for response`)
 
-	_, err = cli.Do("POST", "/", nil, nil, nil, client.DoFlags{})
+	_, err = cli.Do("POST", "/", nil, nil, nil, nil)
 	c.Assert(err, ErrorMatches, `.* timeout exceeded while waiting for response`)
 }
+
+func (cs *clientSuite) TestClientSystemRecoveryKeys(c *C) {
+	cs.rsp = `{"type":"sync", "result":{"recovery-key":"42"}}`
+
+	var key client.SystemRecoveryKeysResponse
+	err := cs.cli.SystemRecoveryKeys(&key)
+	c.Assert(err, IsNil)
+	c.Check(cs.reqs, HasLen, 1)
+	c.Check(cs.reqs[0].Method, Equals, "GET")
+	c.Check(cs.reqs[0].URL.Path, Equals, "/v2/system-recovery-keys")
+	c.Check(key.RecoveryKey, Equals, "42")
+}
diff -Nru snapd-2.45.1+20.04.2/client/clientutil/snapinfo.go snapd-2.48.3+20.04/client/clientutil/snapinfo.go
--- snapd-2.45.1+20.04.2/client/clientutil/snapinfo.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/client/clientutil/snapinfo.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,149 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Package clientutil offers utilities to turn snap.Info and related
+// structs into client structs and to work with the latter.
+package clientutil
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snap"
+)
+
+// A StatusDecorator is able to decorate client.AppInfos with service status.
+type StatusDecorator interface {
+	DecorateWithStatus(appInfo *client.AppInfo, snapApp *snap.AppInfo) error
+}
+
+// ClientSnapFromSnapInfo returns a client.Snap derived from snap.Info.
+// If an optional StatusDecorator is provided it will be used to
+// add service status information.
+func ClientSnapFromSnapInfo(snapInfo *snap.Info, decorator StatusDecorator) (*client.Snap, error) {
+	var publisher *snap.StoreAccount
+	if snapInfo.Publisher.Username != "" {
+		publisher = &snapInfo.Publisher
+	}
+
+	confinement := snapInfo.Confinement
+	if confinement == "" {
+		confinement = snap.StrictConfinement
+	}
+
+	snapapps := make([]*snap.AppInfo, 0, len(snapInfo.Apps))
+	for _, app := range snapInfo.Apps {
+		snapapps = append(snapapps, app)
+	}
+	sort.Sort(snap.AppInfoBySnapApp(snapapps))
+
+	apps, err := ClientAppInfosFromSnapAppInfos(snapapps, decorator)
+	result := &client.Snap{
+		Description: snapInfo.Description(),
+		Developer:   snapInfo.Publisher.Username,
+		Publisher:   publisher,
+		Icon:        snapInfo.Media.IconURL(),
+		ID:          snapInfo.ID(),
+		InstallDate: snapInfo.InstallDate(),
+		Name:        snapInfo.InstanceName(),
+		Revision:    snapInfo.Revision,
+		Summary:     snapInfo.Summary(),
+		Type:        string(snapInfo.Type()),
+		Base:        snapInfo.Base,
+		Version:     snapInfo.Version,
+		Channel:     snapInfo.Channel,
+		Private:     snapInfo.Private,
+		Confinement: string(confinement),
+		Apps:        apps,
+		Broken:      snapInfo.Broken,
+		Contact:     snapInfo.Contact,
+		Title:       snapInfo.Title(),
+		License:     snapInfo.License,
+		Media:       snapInfo.Media,
+		Prices:      snapInfo.Prices,
+		Channels:    snapInfo.Channels,
+		Tracks:      snapInfo.Tracks,
+		CommonIDs:   snapInfo.CommonIDs,
+		Website:     snapInfo.Website,
+		StoreURL:    snapInfo.StoreURL,
+	}
+
+	return result, err
+}
+
+func ClientAppInfoNotes(app *client.AppInfo) string {
+	if !app.IsService() {
+		return "-"
+	}
+
+	var notes = make([]string, 0, 2)
+	var seenTimer, seenSocket bool
+	for _, act := range app.Activators {
+		switch act.Type {
+		case "timer":
+			seenTimer = true
+		case "socket":
+			seenSocket = true
+		}
+	}
+	if seenTimer {
+		notes = append(notes, "timer-activated")
+	}
+	if seenSocket {
+		notes = append(notes, "socket-activated")
+	}
+	if len(notes) == 0 {
+		return "-"
+	}
+	return strings.Join(notes, ",")
+}
+
+// ClientAppInfosFromSnapAppInfos returns client.AppInfos derived from
+// the given snap.AppInfos.
+// If an optional StatusDecorator is provided it will be used to add
+// service status information as well, this will be done only if the
+// snap is active and when the app is a service.
+func ClientAppInfosFromSnapAppInfos(apps []*snap.AppInfo, decorator StatusDecorator) ([]client.AppInfo, error) {
+	out := make([]client.AppInfo, 0, len(apps))
+	for _, app := range apps {
+		appInfo := client.AppInfo{
+			Snap:     app.Snap.InstanceName(),
+			Name:     app.Name,
+			CommonID: app.CommonID,
+		}
+		if fn := app.DesktopFile(); osutil.FileExists(fn) {
+			appInfo.DesktopFile = fn
+		}
+
+		appInfo.Daemon = app.Daemon
+		if !app.IsService() || decorator == nil || !app.Snap.IsActive() {
+			out = append(out, appInfo)
+			continue
+		}
+
+		if err := decorator.DecorateWithStatus(&appInfo, app); err != nil {
+			return nil, err
+		}
+		out = append(out, appInfo)
+	}
+
+	return out, nil
+}
diff -Nru snapd-2.45.1+20.04.2/client/clientutil/snapinfo_test.go snapd-2.48.3+20.04/client/clientutil/snapinfo_test.go
--- snapd-2.45.1+20.04.2/client/clientutil/snapinfo_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/client/clientutil/snapinfo_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,286 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package clientutil_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/client/clientutil"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type cmdSuite struct {
+	testutil.BaseTest
+}
+
+func (s *cmdSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
+}
+
+var _ = Suite(&cmdSuite{})
+
+func (*cmdSuite) TestClientSnapFromSnapInfo(c *C) {
+	si := &snap.Info{
+		SnapType:      snap.TypeApp,
+		SuggestedName: "",
+		InstanceKey:   "insta",
+		Version:       "v1",
+		Confinement:   snap.StrictConfinement,
+		License:       "Proprietary",
+		Publisher: snap.StoreAccount{
+			ID:          "ZvtzsxbsHivZLdvzrt0iqW529riGLfXJ",
+			Username:    "thingyinc",
+			DisplayName: "Thingy Inc.",
+			Validation:  "unproven",
+		},
+		Base: "core18",
+		SideInfo: snap.SideInfo{
+			RealName:          "the-snap",
+			SnapID:            "snapidid",
+			Revision:          snap.R(99),
+			EditedTitle:       "the-title",
+			EditedSummary:     "the-summary",
+			EditedDescription: "the-description",
+			Channel:           "latest/stable",
+			Contact:           "https://thingy.com",
+			Private:           true,
+		},
+		Channels: map[string]*snap.ChannelSnapInfo{},
+		Tracks:   []string{},
+		Prices:   map[string]float64{},
+		Media: []snap.MediaInfo{
+			{Type: "icon", URL: "https://dashboard.snapcraft.io/site_media/appmedia/2017/12/Thingy.png"},
+			{Type: "screenshot", URL: "https://dashboard.snapcraft.io/site_media/appmedia/2018/01/Thingy_01.png"},
+			{Type: "screenshot", URL: "https://dashboard.snapcraft.io/site_media/appmedia/2018/01/Thingy_02.png", Width: 600, Height: 200},
+		},
+		CommonIDs: []string{"org.thingy"},
+		Website:   "http://example.com/thingy",
+		StoreURL:  "https://snapcraft.io/thingy",
+		Broken:    "broken",
+	}
+	// valid InstallDate
+	err := os.MkdirAll(si.MountDir(), 0755)
+	c.Assert(err, IsNil)
+	err = os.Symlink(si.Revision.String(), filepath.Join(filepath.Dir(si.MountDir()), "current"))
+	c.Assert(err, IsNil)
+
+	ci, err := clientutil.ClientSnapFromSnapInfo(si, nil)
+	c.Check(err, IsNil)
+
+	// check that fields are filled
+	// see daemon/snap.go for fields filled after this
+	expectedZeroFields := []string{
+		"Screenshots", // unused nowadays
+		"DownloadSize",
+		"InstalledSize",
+		"Health",
+		"Status",
+		"TrackingChannel",
+		"IgnoreValidation",
+		"CohortKey",
+		"DevMode",
+		"TryMode",
+		"JailMode",
+		"MountedFrom",
+	}
+	var checker func(string, reflect.Value)
+	checker = func(pfx string, x reflect.Value) {
+		t := x.Type()
+		for i := 0; i < x.NumField(); i++ {
+			f := t.Field(i)
+			if f.PkgPath != "" {
+				// not exported, ignore
+				continue
+			}
+			v := x.Field(i)
+			if f.Anonymous {
+				checker(pfx+f.Name+".", v)
+				continue
+			}
+			if reflect.DeepEqual(v.Interface(), reflect.Zero(f.Type).Interface()) {
+				name := pfx + f.Name
+				c.Check(expectedZeroFields, testutil.Contains, name, Commentf("%s not set", name))
+			}
+		}
+	}
+	x := reflect.ValueOf(ci).Elem()
+	checker("", x)
+
+	// check some values
+	c.Check(ci.Name, Equals, "the-snap_insta")
+	c.Check(ci.Type, Equals, "app")
+	c.Check(ci.ID, Equals, si.ID())
+	c.Check(ci.Revision, Equals, snap.R(99))
+	c.Check(ci.Version, Equals, "v1")
+	c.Check(ci.Title, Equals, "the-title")
+	c.Check(ci.Summary, Equals, "the-summary")
+	c.Check(ci.Description, Equals, "the-description")
+	c.Check(ci.Icon, Equals, si.Media.IconURL())
+	c.Check(ci.Website, Equals, si.Website)
+	c.Check(ci.StoreURL, Equals, si.StoreURL)
+	c.Check(ci.Developer, Equals, "thingyinc")
+	c.Check(ci.Publisher, DeepEquals, &si.Publisher)
+}
+
+type testStatusDecorator struct {
+	calls int
+}
+
+func (sd *testStatusDecorator) DecorateWithStatus(appInfo *client.AppInfo, app *snap.AppInfo) error {
+	sd.calls++
+	if appInfo.Snap != app.Snap.InstanceName() || appInfo.Name != app.Name {
+		panic("mismatched")
+	}
+	appInfo.Enabled = true
+	appInfo.Active = true
+	return nil
+}
+
+func (*cmdSuite) TestClientSnapFromSnapInfoAppsInactive(c *C) {
+	si := &snap.Info{
+		SnapType:      snap.TypeApp,
+		SuggestedName: "",
+		InstanceKey:   "insta",
+		SideInfo: snap.SideInfo{
+			RealName: "the-snap",
+			SnapID:   "snapidid",
+			Revision: snap.R(99),
+		},
+	}
+	si.Apps = map[string]*snap.AppInfo{
+		"svc": {Snap: si, Name: "svc", Daemon: "simple"},
+		"app": {Snap: si, Name: "app", CommonID: "common.id"},
+	}
+	// sanity
+	c.Check(si.IsActive(), Equals, false)
+	// desktop file
+	df := si.Apps["app"].DesktopFile()
+	err := os.MkdirAll(filepath.Dir(df), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(df, nil, 0644)
+	c.Assert(err, IsNil)
+
+	sd := &testStatusDecorator{}
+	ci, err := clientutil.ClientSnapFromSnapInfo(si, sd)
+	c.Check(err, IsNil)
+
+	c.Check(ci.Name, Equals, "the-snap_insta")
+	c.Check(ci.Apps, DeepEquals, []client.AppInfo{
+		{
+			Snap:        "the-snap_insta",
+			Name:        "app",
+			CommonID:    "common.id",
+			DesktopFile: df,
+		},
+		{Snap: "the-snap_insta", Name: "svc", Daemon: "simple"},
+	})
+	// not called on inactive snaps
+	c.Check(sd.calls, Equals, 0)
+}
+
+func (*cmdSuite) TestClientSnapFromSnapInfoAppsActive(c *C) {
+	si := &snap.Info{
+		SnapType:      snap.TypeApp,
+		SuggestedName: "",
+		InstanceKey:   "insta",
+		SideInfo: snap.SideInfo{
+			RealName: "the-snap",
+			SnapID:   "snapidid",
+			Revision: snap.R(99),
+		},
+	}
+	si.Apps = map[string]*snap.AppInfo{
+		"svc": {Snap: si, Name: "svc", Daemon: "simple"},
+	}
+	// make it active
+	err := os.MkdirAll(si.MountDir(), 0755)
+	c.Assert(err, IsNil)
+	err = os.Symlink(si.Revision.String(), filepath.Join(filepath.Dir(si.MountDir()), "current"))
+	c.Assert(err, IsNil)
+	c.Check(si.IsActive(), Equals, true)
+
+	sd := &testStatusDecorator{}
+	ci, err := clientutil.ClientSnapFromSnapInfo(si, sd)
+	c.Check(err, IsNil)
+	// ... service status
+	c.Check(ci.Name, Equals, "the-snap_insta")
+	c.Check(ci.Apps, DeepEquals, []client.AppInfo{
+		{Snap: "the-snap_insta", Name: "svc", Daemon: "simple", Enabled: true, Active: true},
+	})
+
+	c.Check(sd.calls, Equals, 1)
+}
+
+func (*cmdSuite) TestAppStatusNotes(c *C) {
+	ai := client.AppInfo{}
+	c.Check(clientutil.ClientAppInfoNotes(&ai), Equals, "-")
+
+	ai = client.AppInfo{
+		Daemon: "oneshot",
+	}
+	c.Check(clientutil.ClientAppInfoNotes(&ai), Equals, "-")
+
+	ai = client.AppInfo{
+		Daemon: "oneshot",
+		Activators: []client.AppActivator{
+			{Type: "timer"},
+		},
+	}
+	c.Check(clientutil.ClientAppInfoNotes(&ai), Equals, "timer-activated")
+
+	ai = client.AppInfo{
+		Daemon: "oneshot",
+		Activators: []client.AppActivator{
+			{Type: "socket"},
+		},
+	}
+	c.Check(clientutil.ClientAppInfoNotes(&ai), Equals, "socket-activated")
+
+	// check that the output is stable regardless of the order of activators
+	ai = client.AppInfo{
+		Daemon: "oneshot",
+		Activators: []client.AppActivator{
+			{Type: "timer"},
+			{Type: "socket"},
+		},
+	}
+	c.Check(clientutil.ClientAppInfoNotes(&ai), Equals, "timer-activated,socket-activated")
+	ai = client.AppInfo{
+		Daemon: "oneshot",
+		Activators: []client.AppActivator{
+			{Type: "socket"},
+			{Type: "timer"},
+		},
+	}
+	c.Check(clientutil.ClientAppInfoNotes(&ai), Equals, "timer-activated,socket-activated")
+}
diff -Nru snapd-2.45.1+20.04.2/client/console_conf.go snapd-2.48.3+20.04/client/console_conf.go
--- snapd-2.45.1+20.04.2/client/console_conf.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/client/console_conf.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,44 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package client
+
+import "time"
+
+// InternalConsoleConfStartResponse is the response from console-conf start
+// support
+type InternalConsoleConfStartResponse struct {
+	ActiveAutoRefreshChanges []string `json:"active-auto-refreshes,omitempty"`
+	ActiveAutoRefreshSnaps   []string `json:"active-auto-refresh-snaps,omitempty"`
+}
+
+// InternalConsoleConfStart invokes the dedicated console-conf start support
+// to handle intervening auto-refreshes.
+// Not for general use.
+func (client *Client) InternalConsoleConfStart() ([]string, []string, error) {
+	resp := &InternalConsoleConfStartResponse{}
+	// do the post with a short timeout so that if snapd is not available due to
+	// maintenance we will return very quickly so the caller can handle that
+	opts := &doOptions{
+		Timeout: 2 * time.Second,
+		Retry:   1 * time.Hour,
+	}
+	_, err := client.doSyncWithOpts("POST", "/v2/internal/console-conf-start", nil, nil, nil, resp, opts)
+	return resp.ActiveAutoRefreshChanges, resp.ActiveAutoRefreshSnaps, err
+}
diff -Nru snapd-2.45.1+20.04.2/client/console_conf_test.go snapd-2.48.3+20.04/client/console_conf_test.go
--- snapd-2.45.1+20.04.2/client/console_conf_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/client/console_conf_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,63 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package client_test
+
+import (
+	. "gopkg.in/check.v1"
+)
+
+func (cs *clientSuite) TestClientInternalConsoleConfEndpointEmpty(c *C) {
+	// no changes and no snaps
+	cs.status = 200
+	cs.rsp = `{
+		"type": "sync",
+		"status-code": 200,
+        "result": {}
+	}`
+
+	chgs, snaps, err := cs.cli.InternalConsoleConfStart()
+	c.Assert(chgs, HasLen, 0)
+	c.Assert(snaps, HasLen, 0)
+	c.Assert(err, IsNil)
+	c.Check(cs.req.Method, Equals, "POST")
+	c.Check(cs.req.URL.Path, Equals, "/v2/internal/console-conf-start")
+	c.Check(cs.doCalls, Equals, 1)
+}
+
+func (cs *clientSuite) TestClientInternalConsoleConfEndpoint(c *C) {
+	// some changes and snaps
+	cs.status = 200
+	cs.rsp = `{
+		"type": "sync",
+		"status-code": 200,
+        "result": {
+			"active-auto-refreshes": ["1"],
+			"active-auto-refresh-snaps": ["pc-kernel"]
+		}
+	}`
+
+	chgs, snaps, err := cs.cli.InternalConsoleConfStart()
+	c.Assert(err, IsNil)
+	c.Assert(chgs, DeepEquals, []string{"1"})
+	c.Assert(snaps, DeepEquals, []string{"pc-kernel"})
+	c.Check(cs.req.Method, Equals, "POST")
+	c.Check(cs.req.URL.Path, Equals, "/v2/internal/console-conf-start")
+	c.Check(cs.doCalls, Equals, 1)
+}
diff -Nru snapd-2.45.1+20.04.2/client/errors.go snapd-2.48.3+20.04/client/errors.go
--- snapd-2.45.1+20.04.2/client/errors.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/client/errors.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,145 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package client
+
+// ErrorKind distinguishes kind of errors.
+type ErrorKind string
+
+// error kind const value doc comments here have a non-default,
+// specialized style (to help docs/error-kind.go):
+//
+// // ErrorKind...: DESCRIPTION .
+//
+// Note the mandatory dot at the end.
+// `code-like` quoting should be used when meaningful.
+
+// Error kinds. Keep https://forum.snapcraft.io/t/using-the-rest-api/18603#heading--errors in sync using doc/error-kinds.go.
+const (
+	// ErrorKindTwoFactorRequired: the client needs to retry the
+	// `login` command including an OTP.
+	ErrorKindTwoFactorRequired ErrorKind = "two-factor-required"
+	// ErrorKindTwoFactorFailed: the OTP provided wasn't recognised.
+	ErrorKindTwoFactorFailed ErrorKind = "two-factor-failed"
+	// ErrorKindLoginRequired: the requested operation cannot be
+	// performed without an authenticated user. This is the kind
+	// of any other 401 Unauthorized response.
+	ErrorKindLoginRequired ErrorKind = "login-required"
+	// ErrorKindInvalidAuthData: the authentication data provided
+	// failed to validate (e.g. a malformed email address). The
+	// `value` of the error is an object with a key per failed field
+	// and a list of the failures on each field.
+	ErrorKindInvalidAuthData ErrorKind = "invalid-auth-data"
+	// ErrorKindPasswordPolicy: provided password doesn't meet
+	// system policy.
+	ErrorKindPasswordPolicy ErrorKind = "password-policy"
+	// ErrorKindAuthCancelled: authentication was cancelled by the user.
+	ErrorKindAuthCancelled ErrorKind = "auth-cancelled"
+
+	// ErrorKindTermsNotAccepted: deprecated, do not document.
+	ErrorKindTermsNotAccepted ErrorKind = "terms-not-accepted"
+	// ErrorKindNoPaymentMethods: deprecated, do not document.
+	ErrorKindNoPaymentMethods ErrorKind = "no-payment-methods"
+	// ErrorKindPaymentDeclined: deprecated, do not document.
+	ErrorKindPaymentDeclined ErrorKind = "payment-declined"
+
+	// ErrorKindSnapAlreadyInstalled: the requested snap is
+	// already installed.
+	ErrorKindSnapAlreadyInstalled ErrorKind = "snap-already-installed"
+	// ErrorKindSnapNotInstalled: the requested snap is not installed.
+	ErrorKindSnapNotInstalled ErrorKind = "snap-not-installed"
+	// ErrorKindSnapNotFound: the requested snap couldn't be found.
+	ErrorKindSnapNotFound ErrorKind = "snap-not-found"
+	// ErrorKindAppNotFound: the requested app couldn't be found.
+	ErrorKindAppNotFound ErrorKind = "app-not-found"
+	// ErrorKindSnapLocal: cannot perform operation on local snap.
+	ErrorKindSnapLocal ErrorKind = "snap-local"
+	// ErrorKindSnapNeedsDevMode: the requested snap needs devmode
+	// to be installed.
+	ErrorKindSnapNeedsDevMode ErrorKind = "snap-needs-devmode"
+	// ErrorKindSnapNeedsClassic: the requested snap needs classic
+	// confinement to be installed.
+	ErrorKindSnapNeedsClassic ErrorKind = "snap-needs-classic"
+	// ErrorKindSnapNeedsClassicSystem: the requested snap can't
+	// be installed on the current non-classic system.
+	ErrorKindSnapNeedsClassicSystem ErrorKind = "snap-needs-classic-system"
+	// ErrorKindSnapNotClassic: snap not compatible with classic mode.
+	ErrorKindSnapNotClassic ErrorKind = "snap-not-classic"
+	// ErrorKindSnapNoUpdateAvailable: the requested snap does not
+	// have an update available.
+	ErrorKindSnapNoUpdateAvailable ErrorKind = "snap-no-update-available"
+	// ErrorKindSnapRevisionNotAvailable: no snap revision available
+	// as specified.
+	ErrorKindSnapRevisionNotAvailable ErrorKind = "snap-revision-not-available"
+	// ErrorKindSnapChannelNotAvailable: no snap revision on specified
+	// channel. The `value` of the error is a rich object with
+	// requested `snap-name`, `action`, `channel`, `architecture`, and
+	// actually available `releases` as list of
+	// `{"architecture":... , "channel": ...}` objects.
+	ErrorKindSnapChannelNotAvailable ErrorKind = "snap-channel-not-available"
+	// ErrorKindSnapArchitectureNotAvailable: no snap revision on
+	// specified architecture. Value has the same format as for
+	// `snap-channel-not-available`.
+	ErrorKindSnapArchitectureNotAvailable ErrorKind = "snap-architecture-not-available"
+
+	// ErrorKindSnapChangeConflict: the requested operation would
+	// conflict with currently ongoing change. This is a temporary
+	// error. The error `value` is an object with optional fields
+	// `snap-name`, `change-kind` of the ongoing change.
+	ErrorKindSnapChangeConflict ErrorKind = "snap-change-conflict"
+
+	// ErrorKindNotSnap: the given snap or directory does not
+	// look like a snap.
+	ErrorKindNotSnap ErrorKind = "snap-not-a-snap"
+
+	// ErrorKindInterfacesUnchanged: the requested interfaces'
+	// operation would have no effect.
+	ErrorKindInterfacesUnchanged ErrorKind = "interfaces-unchanged"
+
+	// ErrorKindBadQuery: a bad query was provided.
+	ErrorKindBadQuery ErrorKind = "bad-query"
+	// ErrorKindConfigNoSuchOption: the given configuration option
+	// does not exist.
+	ErrorKindConfigNoSuchOption ErrorKind = "option-not-found"
+
+	// ErrorKindAssertionNotFound: assertion can not be found.
+	ErrorKindAssertionNotFound ErrorKind = "assertion-not-found"
+
+	// ErrorKindUnsuccessful: snapctl command was unsuccessful.
+	ErrorKindUnsuccessful ErrorKind = "unsuccessful"
+
+	// ErrorKindNetworkTimeout: a timeout occurred during the request.
+	ErrorKindNetworkTimeout ErrorKind = "network-timeout"
+
+	// ErrorKindDNSFailure: DNS not responding.
+	ErrorKindDNSFailure ErrorKind = "dns-failure"
+
+	// ErrorKindInsufficientDiskSpace: not enough disk space to perform the request.
+	ErrorKindInsufficientDiskSpace ErrorKind = "insufficient-disk-space"
+)
+
+// Maintenance error kinds.
+// These are used only inside the maintenance field of responses.
+// Keep https://forum.snapcraft.io/t/using-the-rest-api/18603#heading--maint-errors in sync using doc/error-kinds.go.
+const (
+	// ErrorKindDaemonRestart: daemon is restarting.
+	ErrorKindDaemonRestart ErrorKind = "daemon-restart"
+	// ErrorKindSystemRestart: system is restarting.
+	ErrorKindSystemRestart ErrorKind = "system-restart"
+)
diff -Nru snapd-2.45.1+20.04.2/client/export_test.go snapd-2.48.3+20.04/client/export_test.go
--- snapd-2.45.1+20.04.2/client/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,11 +30,11 @@
 	client.doer = d
 }
 
-type DoFlags = doFlags
+type DoOptions = doOptions
 
 // Do does do.
-func (client *Client) Do(method, path string, query url.Values, body io.Reader, v interface{}, flags DoFlags) (statusCode int, err error) {
-	return client.do(method, path, query, nil, body, v, flags)
+func (client *Client) Do(method, path string, query url.Values, body io.Reader, v interface{}, opts *DoOptions) (statusCode int, err error) {
+	return client.do(method, path, query, nil, body, v, opts)
 }
 
 // expose parseError for testing
diff -Nru snapd-2.45.1+20.04.2/client/icons.go snapd-2.48.3+20.04/client/icons.go
--- snapd-2.45.1+20.04.2/client/icons.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/icons.go	2021-02-02 08:21:12.000000000 +0000
@@ -40,13 +40,12 @@
 func (c *Client) Icon(pkgID string) (*Icon, error) {
 	const errPrefix = "cannot retrieve icon"
 
-	ctx, cancel := context.WithTimeout(context.Background(), doTimeout)
-	defer cancel()
-	response, err := c.raw(ctx, "GET", fmt.Sprintf("/v2/icons/%s/icon", pkgID), nil, nil, nil)
+	response, cancel, err := c.rawWithTimeout(context.Background(), "GET", fmt.Sprintf("/v2/icons/%s/icon", pkgID), nil, nil, nil, nil)
 	if err != nil {
 		fmt := "%s: failed to communicate with server: %w"
 		return nil, xerrors.Errorf(fmt, errPrefix, err)
 	}
+	defer cancel()
 	defer response.Body.Close()
 
 	if response.StatusCode != 200 {
diff -Nru snapd-2.45.1+20.04.2/client/login.go snapd-2.48.3+20.04/client/login.go
--- snapd-2.45.1+20.04.2/client/login.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/login.go	2021-02-02 08:21:12.000000000 +0000
@@ -94,7 +94,7 @@
 	}
 
 	if homeDir == "" {
-		real, err := osutil.RealUser()
+		real, err := osutil.UserMaybeSudoUser()
 		if err != nil {
 			panic(err)
 		}
@@ -106,7 +106,7 @@
 
 // writeAuthData saves authentication details for later reuse through ReadAuthData
 func writeAuthData(user User) error {
-	real, err := osutil.RealUser()
+	real, err := osutil.UserMaybeSudoUser()
 	if err != nil {
 		return err
 	}
diff -Nru snapd-2.45.1+20.04.2/client/model.go snapd-2.48.3+20.04/client/model.go
--- snapd-2.45.1+20.04.2/client/model.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/model.go	2021-02-02 08:21:12.000000000 +0000
@@ -80,13 +80,12 @@
 func currentAssertion(client *Client, path string) (asserts.Assertion, error) {
 	q := url.Values{}
 
-	ctx, cancel := context.WithTimeout(context.Background(), doTimeout)
-	defer cancel()
-	response, err := client.raw(ctx, "GET", path, q, nil, nil)
+	response, cancel, err := client.rawWithTimeout(context.Background(), "GET", path, q, nil, nil, nil)
 	if err != nil {
 		fmt := "failed to query current assertion: %w"
 		return nil, xerrors.Errorf(fmt, err)
 	}
+	defer cancel()
 	defer response.Body.Close()
 	if response.StatusCode != 200 {
 		return nil, parseError(response)
diff -Nru snapd-2.45.1+20.04.2/client/snapctl.go snapd-2.48.3+20.04/client/snapctl.go
--- snapd-2.45.1+20.04.2/client/snapctl.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/snapctl.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,8 +23,21 @@
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"io"
+	"io/ioutil"
 )
 
+// InternalSsnapctlCmdNeedsStdin returns true if the given snapctl command
+// needs data from stdin
+func InternalSnapctlCmdNeedsStdin(name string) bool {
+	switch name {
+	case "fde-setup-result":
+		return true
+	default:
+		return false
+	}
+}
+
 // SnapCtlOptions holds the various options with which snapctl is invoked.
 type SnapCtlOptions struct {
 	// ContextID is a string used to determine the context of this call (e.g.
@@ -35,14 +48,36 @@
 	Args []string `json:"args"`
 }
 
+// SnapCtlPostData is the data posted to the daemon /v2/snapctl endpoint
+// TODO: this can be removed again once we no longer need to pass stdin data
+//       but instead use a real stdin stream
+type SnapCtlPostData struct {
+	SnapCtlOptions
+
+	Stdin []byte `json:"stdin,omitempty"`
+}
+
 type snapctlOutput struct {
 	Stdout string `json:"stdout"`
 	Stderr string `json:"stderr"`
 }
 
 // RunSnapctl requests a snapctl run for the given options.
-func (client *Client) RunSnapctl(options *SnapCtlOptions) (stdout, stderr []byte, err error) {
-	b, err := json.Marshal(options)
+func (client *Client) RunSnapctl(options *SnapCtlOptions, stdin io.Reader) (stdout, stderr []byte, err error) {
+	// TODO: instead of reading all of stdin here we need to forward it to
+	//       the daemon eventually
+	var stdinData []byte
+	if stdin != nil {
+		stdinData, err = ioutil.ReadAll(stdin)
+		if err != nil {
+			return nil, nil, fmt.Errorf("cannot read stdin: %v", err)
+		}
+	}
+
+	b, err := json.Marshal(SnapCtlPostData{
+		SnapCtlOptions: *options,
+		Stdin:          stdinData,
+	})
 	if err != nil {
 		return nil, nil, fmt.Errorf("cannot marshal options: %s", err)
 	}
diff -Nru snapd-2.45.1+20.04.2/client/snapctl_test.go snapd-2.48.3+20.04/client/snapctl_test.go
--- snapd-2.45.1+20.04.2/client/snapctl_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/snapctl_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,8 @@
 package client_test
 
 import (
+	"bytes"
+	"encoding/base64"
 	"encoding/json"
 
 	"github.com/snapcore/snapd/client"
@@ -32,7 +34,7 @@
 		ContextID: "1234ABCD",
 		Args:      []string{"foo", "bar"},
 	}
-	cs.cli.RunSnapctl(options)
+	cs.cli.RunSnapctl(options, nil)
 	c.Check(cs.req.Method, check.Equals, "POST")
 	c.Check(cs.req.URL.Path, check.Equals, "/v2/snapctl")
 }
@@ -47,12 +49,13 @@
 		}
 	}`
 
+	mockStdin := bytes.NewBufferString("some-input")
 	options := &client.SnapCtlOptions{
 		ContextID: "1234ABCD",
 		Args:      []string{"foo", "bar"},
 	}
 
-	stdout, stderr, err := cs.cli.RunSnapctl(options)
+	stdout, stderr, err := cs.cli.RunSnapctl(options, mockStdin)
 	c.Assert(err, check.IsNil)
 	c.Check(string(stdout), check.Equals, "test stdout")
 	c.Check(string(stderr), check.Equals, "test stderr")
@@ -64,5 +67,18 @@
 	c.Check(body, check.DeepEquals, map[string]interface{}{
 		"context-id": "1234ABCD",
 		"args":       []interface{}{"foo", "bar"},
+
+		// json byte-stream is b64 encoded
+		"stdin": base64.StdEncoding.EncodeToString([]byte("some-input")),
 	})
 }
+
+func (cs *clientSuite) TestInternalSnapctlCmdNeedsStdin(c *check.C) {
+	res := client.InternalSnapctlCmdNeedsStdin("fde-setup-result")
+	c.Check(res, check.Equals, true)
+
+	for _, s := range []string{"help", "other"} {
+		res := client.InternalSnapctlCmdNeedsStdin(s)
+		c.Check(res, check.Equals, false)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/client/snap_op.go snapd-2.48.3+20.04/client/snap_op.go
--- snapd-2.45.1+20.04.2/client/snap_op.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/snap_op.go	2021-02-02 08:21:12.000000000 +0000
@@ -40,6 +40,7 @@
 	Classic          bool   `json:"classic,omitempty"`
 	Dangerous        bool   `json:"dangerous,omitempty"`
 	IgnoreValidation bool   `json:"ignore-validation,omitempty"`
+	IgnoreRunning    bool   `json:"ignore-running,omitempty"`
 	Unaliased        bool   `json:"unaliased,omitempty"`
 	Purge            bool   `json:"purge,omitempty"`
 	Amend            bool   `json:"amend,omitempty"`
@@ -74,6 +75,9 @@
 }
 
 func (opts *SnapOptions) writeOptionFields(mw *multipart.Writer) error {
+	if err := writeFieldBool(mw, "ignore-running", opts.IgnoreRunning); err != nil {
+		return err
+	}
 	return writeFieldBool(mw, "unaliased", opts.Unaliased)
 }
 
@@ -204,7 +208,7 @@
 		"Content-Type": "application/json",
 	}
 
-	return client.doAsyncFull("POST", "/v2/snaps", nil, headers, bytes.NewBuffer(data), doFlags{})
+	return client.doAsyncFull("POST", "/v2/snaps", nil, headers, bytes.NewBuffer(data), nil)
 }
 
 // InstallPath sideloads the snap with the given path under optional provided name,
@@ -230,7 +234,8 @@
 		"Content-Type": mw.FormDataContentType(),
 	}
 
-	return client.doAsyncNoTimeout("POST", "/v2/snaps", nil, headers, pr)
+	_, changeID, err = client.doAsyncFull("POST", "/v2/snaps", nil, headers, pr, doNoTimeoutAndRetry)
+	return changeID, err
 }
 
 // Try
diff -Nru snapd-2.45.1+20.04.2/client/snap_op_test.go snapd-2.48.3+20.04/client/snap_op_test.go
--- snapd-2.45.1+20.04.2/client/snap_op_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/snap_op_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -242,6 +242,37 @@
 	c.Check(id, check.Equals, "66b3")
 }
 
+func (cs *clientSuite) TestClientOpInstallPathIgnoreRunning(c *check.C) {
+	cs.status = 202
+	cs.rsp = `{
+		"change": "66b3",
+		"status-code": 202,
+		"type": "async"
+	}`
+	bodyData := []byte("snap-data")
+
+	snap := filepath.Join(c.MkDir(), "foo.snap")
+	err := ioutil.WriteFile(snap, bodyData, 0644)
+	c.Assert(err, check.IsNil)
+
+	id, err := cs.cli.InstallPath(snap, "", &client.SnapOptions{IgnoreRunning: true})
+	c.Assert(err, check.IsNil)
+
+	body, err := ioutil.ReadAll(cs.req.Body)
+	c.Assert(err, check.IsNil)
+
+	c.Assert(string(body), check.Matches, "(?s).*\r\nsnap-data\r\n.*")
+	c.Assert(string(body), check.Matches, "(?s).*Content-Disposition: form-data; name=\"action\"\r\n\r\ninstall\r\n.*")
+	c.Assert(string(body), check.Matches, "(?s).*Content-Disposition: form-data; name=\"ignore-running\"\r\n\r\ntrue\r\n.*")
+
+	c.Check(cs.req.Method, check.Equals, "POST")
+	c.Check(cs.req.URL.Path, check.Equals, fmt.Sprintf("/v2/snaps"))
+	c.Assert(cs.req.Header.Get("Content-Type"), check.Matches, "multipart/form-data; boundary=.*")
+	_, ok := cs.req.Context().Deadline()
+	c.Assert(ok, check.Equals, false)
+	c.Check(id, check.Equals, "66b3")
+}
+
 func (cs *clientSuite) TestClientOpInstallPathInstance(c *check.C) {
 	cs.status = 202
 	cs.rsp = `{
diff -Nru snapd-2.45.1+20.04.2/client/snapshot.go snapd-2.48.3+20.04/client/snapshot.go
--- snapd-2.45.1+20.04.2/client/snapshot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/snapshot.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,9 +21,11 @@
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"net/url"
 	"strconv"
 	"strings"
@@ -32,6 +34,9 @@
 	"github.com/snapcore/snapd/snap"
 )
 
+// SnapshotExportMediaType is the media type used to identify snapshot exports in the API.
+const SnapshotExportMediaType = "application/x.snapd.snapshot"
+
 var (
 	ErrSnapshotSetNotFound   = errors.New("no snapshot set with the given ID")
 	ErrSnapshotSnapsNotFound = errors.New("no snapshot for the requested snaps found in the set with the given ID")
@@ -176,3 +181,50 @@
 
 	return client.doAsync("POST", "/v2/snapshots", nil, headers, bytes.NewBuffer(data))
 }
+
+// SnapshotExport streams the requested snapshot set.
+//
+// The return value includes the length of the returned stream.
+func (client *Client) SnapshotExport(setID uint64) (stream io.ReadCloser, contentLength int64, err error) {
+	rsp, err := client.raw(context.Background(), "GET", fmt.Sprintf("/v2/snapshots/%v/export", setID), nil, nil, nil)
+	if err != nil {
+		return nil, 0, err
+	}
+	if rsp.StatusCode != 200 {
+		defer rsp.Body.Close()
+
+		var r response
+		specificErr := r.err(client, rsp.StatusCode)
+		if err != nil {
+			return nil, 0, specificErr
+		}
+		return nil, 0, fmt.Errorf("unexpected status code: %v", rsp.Status)
+	}
+	contentType := rsp.Header.Get("Content-Type")
+	if contentType != SnapshotExportMediaType {
+		return nil, 0, fmt.Errorf("unexpected snapshot export content type %q", contentType)
+	}
+
+	return rsp.Body, rsp.ContentLength, nil
+}
+
+// SnapshotImportSet is a snapshot import created by a "snap import-snapshot".
+type SnapshotImportSet struct {
+	ID    uint64   `json:"set-id"`
+	Snaps []string `json:"snaps"`
+}
+
+// SnapshotImport imports an exported snapshot set.
+func (client *Client) SnapshotImport(exportStream io.Reader, size int64) (SnapshotImportSet, error) {
+	headers := map[string]string{
+		"Content-Type":   SnapshotExportMediaType,
+		"Content-Length": strconv.FormatInt(size, 10),
+	}
+
+	var importSet SnapshotImportSet
+	if _, err := client.doSync("POST", "/v2/snapshots", nil, headers, exportStream, &importSet); err != nil {
+		return importSet, err
+	}
+
+	return importSet, nil
+}
diff -Nru snapd-2.45.1+20.04.2/client/snapshot_test.go snapd-2.48.3+20.04/client/snapshot_test.go
--- snapd-2.45.1+20.04.2/client/snapshot_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/snapshot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,7 +20,11 @@
 package client_test
 
 import (
+	"io/ioutil"
+	"net/http"
 	"net/url"
+	"strconv"
+	"strings"
 	"time"
 
 	"gopkg.in/check.v1"
@@ -137,3 +141,79 @@
 func (cs *clientSuite) TestClientRestoreSnapshots(c *check.C) {
 	cs.testClientSnapshotAction(c, "restore", cs.cli.RestoreSnapshots)
 }
+
+func (cs *clientSuite) TestClientExportSnapshot(c *check.C) {
+	type tableT struct {
+		content     string
+		contentType string
+		status      int
+	}
+
+	table := []tableT{
+		{"dummy-export", client.SnapshotExportMediaType, 200},
+		{"dummy-export", "application/x-tar", 400},
+		{"", "", 400},
+	}
+
+	for i, t := range table {
+		comm := check.Commentf("%d: %q", i, t.content)
+
+		cs.contentLength = int64(len(t.content))
+		cs.header = http.Header{"Content-Type": []string{t.contentType}}
+		cs.rsp = t.content
+		cs.status = t.status
+
+		r, size, err := cs.cli.SnapshotExport(42)
+		if t.status == 200 {
+			c.Assert(err, check.IsNil, comm)
+			c.Assert(cs.countingCloser.closeCalled, check.Equals, 0)
+			c.Assert(size, check.Equals, int64(len(t.content)), comm)
+		} else {
+			c.Assert(err.Error(), check.Equals, "unexpected status code: ")
+			c.Assert(cs.countingCloser.closeCalled, check.Equals, 1)
+		}
+
+		if t.status == 200 {
+			buf, err := ioutil.ReadAll(r)
+			c.Assert(err, check.IsNil)
+			c.Assert(string(buf), check.Equals, t.content)
+		}
+	}
+}
+
+func (cs *clientSuite) TestClientSnapshotImport(c *check.C) {
+	type tableT struct {
+		rsp    string
+		status int
+		setID  uint64
+		error  string
+	}
+	table := []tableT{
+		{`{"type": "sync", "result": {"set-id": 42, "snaps": ["baz", "bar", "foo"]}}`, 200, 42, ""},
+		{`{"type": "error"}`, 400, 0, "server error: \"Bad Request\""},
+	}
+
+	for i, t := range table {
+		comm := check.Commentf("%d: %s", i, t.rsp)
+
+		cs.rsp = t.rsp
+		cs.status = t.status
+
+		fakeSnapshotData := "fake"
+		r := strings.NewReader(fakeSnapshotData)
+		importSet, err := cs.cli.SnapshotImport(r, int64(len(fakeSnapshotData)))
+		if t.error != "" {
+			c.Assert(err, check.NotNil, comm)
+			c.Check(err.Error(), check.Equals, t.error, comm)
+			continue
+		}
+		c.Assert(err, check.IsNil, comm)
+		c.Assert(cs.req.Header.Get("Content-Type"), check.Equals, client.SnapshotExportMediaType)
+		c.Assert(cs.req.Header.Get("Content-Length"), check.Equals, strconv.Itoa(len(fakeSnapshotData)))
+		c.Check(importSet.ID, check.Equals, t.setID, comm)
+		c.Check(importSet.Snaps, check.DeepEquals, []string{"baz", "bar", "foo"}, comm)
+		d, err := ioutil.ReadAll(cs.req.Body)
+		c.Assert(err, check.IsNil)
+		c.Check(string(d), check.Equals, fakeSnapshotData)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/client/systems.go snapd-2.48.3+20.04/client/systems.go
--- snapd-2.45.1+20.04.2/client/systems.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/systems.go	2021-02-02 08:21:12.000000000 +0000
@@ -103,3 +103,38 @@
 	}
 	return nil
 }
+
+// RebootToSystem issues a request to reboot into system with the
+// given label and the given mode.
+//
+// When called without a systemLabel and without a mode it will just
+// trigger a regular reboot.
+//
+// When called without a systemLabel but with a mode it will use
+// the current system to enter the given mode.
+//
+// Note that "recover" and "run" modes are only available for the
+// current system.
+func (client *Client) RebootToSystem(systemLabel, mode string) error {
+	// verification is done by the backend
+
+	req := struct {
+		Action string `json:"action"`
+		Mode   string `json:"mode"`
+	}{
+		Action: "reboot",
+		Mode:   mode,
+	}
+
+	var body bytes.Buffer
+	if err := json.NewEncoder(&body).Encode(&req); err != nil {
+		return err
+	}
+	if _, err := client.doSync("POST", "/v2/systems/"+systemLabel, nil, nil, &body, nil); err != nil {
+		if systemLabel != "" {
+			return xerrors.Errorf("cannot request system reboot into %q: %v", systemLabel, err)
+		}
+		return xerrors.Errorf("cannot request system reboot: %v", err)
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/client/systems_test.go snapd-2.48.3+20.04/client/systems_test.go
--- snapd-2.45.1+20.04.2/client/systems_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/systems_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -169,3 +169,49 @@
 	err = cs.cli.DoSystemAction("1234", nil)
 	c.Assert(err, check.ErrorMatches, "cannot request an action without one")
 }
+
+func (cs *clientSuite) TestRequestSystemRebootHappy(c *check.C) {
+	cs.rsp = `{
+	    "type": "sync",
+	    "status-code": 200,
+	    "result": {}
+	}`
+	err := cs.cli.RebootToSystem("20201212", "install")
+	c.Assert(err, check.IsNil)
+	c.Check(cs.req.Method, check.Equals, "POST")
+	c.Check(cs.req.URL.Path, check.Equals, "/v2/systems/20201212")
+
+	body, err := ioutil.ReadAll(cs.req.Body)
+	c.Assert(err, check.IsNil)
+	var req map[string]interface{}
+	err = json.Unmarshal(body, &req)
+	c.Assert(err, check.IsNil)
+	c.Assert(req, check.DeepEquals, map[string]interface{}{
+		"action": "reboot",
+		"mode":   "install",
+	})
+}
+
+func (cs *clientSuite) TestRequestSystemRebootErrorNoSystem(c *check.C) {
+	cs.rsp = `{
+	    "type": "error",
+	    "status-code": 500,
+	    "result": {"message": "failed"}
+	}`
+	err := cs.cli.RebootToSystem("", "install")
+	c.Assert(err, check.ErrorMatches, `cannot request system reboot: failed`)
+	c.Check(cs.req.Method, check.Equals, "POST")
+	c.Check(cs.req.URL.Path, check.Equals, "/v2/systems")
+}
+
+func (cs *clientSuite) TestRequestSystemRebootErrorWithSystem(c *check.C) {
+	cs.rsp = `{
+	    "type": "error",
+	    "status-code": 500,
+	    "result": {"message": "failed"}
+	}`
+	err := cs.cli.RebootToSystem("1234", "install")
+	c.Assert(err, check.ErrorMatches, `cannot request system reboot into "1234": failed`)
+	c.Check(cs.req.Method, check.Equals, "POST")
+	c.Check(cs.req.URL.Path, check.Equals, "/v2/systems/1234")
+}
diff -Nru snapd-2.45.1+20.04.2/client/users.go snapd-2.48.3+20.04/client/users.go
--- snapd-2.45.1+20.04.2/client/users.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/users.go	2021-02-02 08:21:12.000000000 +0000
@@ -45,6 +45,8 @@
 	Sudoer       bool   `json:"sudoer,omitempty"`
 	Known        bool   `json:"known,omitempty"`
 	ForceManaged bool   `json:"force-managed,omitempty"`
+	// Automatic is for internal snapd use, behavior might evolve
+	Automatic bool `json:"automatic,omitempty"`
 }
 
 // RemoveUserOptions holds options for removing a local system user.
@@ -88,7 +90,7 @@
 // Results may be provided even if there are errors.
 func (client *Client) CreateUsers(options []*CreateUserOptions) ([]*CreateUserResult, error) {
 	for _, opts := range options {
-		if opts == nil || (opts.Email == "" && !opts.Known) {
+		if opts == nil || (opts.Email == "" && !(opts.Known || opts.Automatic)) {
 			return nil, fmt.Errorf("cannot create user from store details without an email to query for")
 		}
 	}
diff -Nru snapd-2.45.1+20.04.2/client/users_test.go snapd-2.48.3+20.04/client/users_test.go
--- snapd-2.45.1+20.04.2/client/users_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/client/users_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -139,11 +139,25 @@
 		Username: "two",
 	}, {
 		Username: "three",
+	},
+	},
+}, {
+	options: []*client.CreateUserOptions{{
+		Automatic: true,
 	}},
-}}
+	bodies: []string{
+		`{"action":"create","automatic":true}`,
+	},
+	responses: []string{
+		// for automatic result can be empty
+		`{"type": "sync", "result": []}`,
+	},
+},
+}
 
 func (cs *clientSuite) TestClientCreateUsers(c *C) {
 	for _, test := range createUsersTests {
+		cs.reqs = nil
 		cs.rsps = test.responses
 
 		results, err := cs.cli.CreateUsers(test.options)
diff -Nru snapd-2.45.1+20.04.2/cmd/autogen.sh snapd-2.48.3+20.04/cmd/autogen.sh
--- snapd-2.45.1+20.04.2/cmd/autogen.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/autogen.sh	2021-02-02 08:21:12.000000000 +0000
@@ -32,6 +32,9 @@
 	debian)
 		extra_opts="--libexecdir=/usr/lib/snapd"
 		;;
+	gentoo)
+		extra_opts="--libexecdir=/usr/lib/snapd --with-snap-mount-dir=/var/lib/snapd/snap --enable-apparmor --enable-nvidia-biarch --enable-merged-usr"
+		;;
 	ubuntu)
 		extra_opts="--libexecdir=/usr/lib/snapd --enable-nvidia-multiarch --enable-static-libcap --enable-static-libapparmor --with-host-arch-triplet=$(dpkg-architecture -qDEB_HOST_MULTIARCH)"
 		if [ "$(dpkg-architecture -qDEB_HOST_ARCH)" = "amd64" ]; then
diff -Nru snapd-2.45.1+20.04.2/cmd/cmd_linux.go snapd-2.48.3+20.04/cmd/cmd_linux.go
--- snapd-2.45.1+20.04.2/cmd/cmd_linux.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmd_linux.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,218 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2016 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd
-
-import (
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-
-	"github.com/snapcore/snapd/cmd/cmdutil"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/logger"
-	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/release"
-	"github.com/snapcore/snapd/strutil"
-)
-
-// The SNAP_REEXEC environment variable controls whether the command
-// will attempt to re-exec itself from inside an ubuntu-core snap
-// present on the system. If not present in the environ it's assumed
-// to be set to 1 (do re-exec); that is: set it to 0 to disable.
-const reExecKey = "SNAP_REEXEC"
-
-var (
-	// snapdSnap is the place to look for the snapd snap; we will re-exec
-	// here
-	snapdSnap = "/snap/snapd/current"
-
-	// coreSnap is the place to look for the core snap; we will re-exec
-	// here if there is no snapd snap
-	coreSnap = "/snap/core/current"
-
-	// selfExe is the path to a symlink pointing to the current executable
-	selfExe = "/proc/self/exe"
-
-	syscallExec = syscall.Exec
-	osReadlink  = os.Readlink
-)
-
-// distroSupportsReExec returns true if the distribution we are running on can use re-exec.
-//
-// This is true by default except for a "core/all" snap system where it makes
-// no sense and in certain distributions that we don't want to enable re-exec
-// yet because of missing validation or other issues.
-func distroSupportsReExec() bool {
-	if !release.OnClassic {
-		return false
-	}
-	if !release.DistroLike("debian", "ubuntu") {
-		logger.Debugf("re-exec not supported on distro %q yet", release.ReleaseInfo.ID)
-		return false
-	}
-	return true
-}
-
-// coreSupportsReExec returns true if the given core/snapd snap should be used as re-exec target.
-//
-// Ensure we do not use older version of snapd, look for info file and ignore
-// version of core that do not yet have it.
-func coreSupportsReExec(coreOrSnapdPath string) bool {
-	infoPath := filepath.Join(coreOrSnapdPath, filepath.Join(dirs.CoreLibExecDir, "info"))
-	ver, err := cmdutil.SnapdVersionFromInfoFile(infoPath)
-	if err != nil {
-		logger.Noticef("%v", err)
-		return false
-	}
-
-	// > 0 means our Version is bigger than the version of snapd in core
-	res, err := strutil.VersionCompare(Version, ver)
-	if err != nil {
-		logger.Debugf("cannot version compare %q and %q: %v", Version, ver, err)
-		return false
-	}
-	if res > 0 {
-		logger.Debugf("snap (at %q) is older (%q) than distribution package (%q)", coreOrSnapdPath, ver, Version)
-		return false
-	}
-	return true
-}
-
-// TODO: move to cmd/cmdutil/
-//
-// InternalToolPath returns the path of an internal snapd tool. The tool
-// *must* be located inside the same tree as the current binary.
-//
-// The return value is either the path of the tool in the current distribution
-// or in the core/snapd snap (or the ubuntu-core snap) if the current binary is
-// ran from that location.
-func InternalToolPath(tool string) (string, error) {
-	distroTool := filepath.Join(dirs.DistroLibExecDir, tool)
-
-	// find the internal path relative to the running snapd, this
-	// ensure we don't rely on the state of the system (like
-	// having a valid "current" symlink).
-	exe, err := osReadlink("/proc/self/exe")
-	if err != nil {
-		return "", err
-	}
-
-	if !strings.HasPrefix(exe, dirs.DistroLibExecDir) {
-		// either running from mounted location or /usr/bin/snap*
-
-		// find the local prefix to the snap:
-		// /snap/snapd/123/usr/bin/snap       -> /snap/snapd/123
-		// /snap/core/234/usr/lib/snapd/snapd -> /snap/core/234
-		idx := strings.LastIndex(exe, "/usr/")
-		if idx > 0 {
-			// only assume mounted location when path contains
-			// /usr/, but does not start with one
-			prefix := exe[:idx]
-			return filepath.Join(prefix, "/usr/lib/snapd", tool), nil
-		}
-		if idx == -1 {
-			// or perhaps some other random location, make sure the tool
-			// exists there and is an executable
-			maybeTool := filepath.Join(filepath.Dir(exe), tool)
-			if osutil.IsExecutable(maybeTool) {
-				return maybeTool, nil
-			}
-		}
-	}
-
-	// fallback to distro tool
-	return distroTool, nil
-}
-
-// mustUnsetenv will unset the given environment key or panic if it
-// cannot do that
-func mustUnsetenv(key string) {
-	if err := os.Unsetenv(key); err != nil {
-		log.Panicf("cannot unset %s: %s", key, err)
-	}
-}
-
-// ExecInSnapdOrCoreSnap makes sure you're executing the binary that ships in
-// the snapd/core snap.
-func ExecInSnapdOrCoreSnap() {
-	// Which executable are we?
-	exe, err := os.Readlink(selfExe)
-	if err != nil {
-		logger.Noticef("cannot read /proc/self/exe: %v", err)
-		return
-	}
-
-	// Special case for snapd re-execing from 2.21. In this
-	// version of snap/snapd we did set SNAP_REEXEC=0 when we
-	// re-execed. In this case we need to unset the reExecKey to
-	// ensure that subsequent run of snap/snapd (e.g. when using
-	// classic confinement) will *not* prevented from re-execing.
-	if strings.HasPrefix(exe, dirs.SnapMountDir) && !osutil.GetenvBool(reExecKey, true) {
-		mustUnsetenv(reExecKey)
-		return
-	}
-
-	// If we are asked not to re-execute use distribution packages. This is
-	// "spiritual" re-exec so use the same environment variable to decide.
-	if !osutil.GetenvBool(reExecKey, true) {
-		logger.Debugf("re-exec disabled by user")
-		return
-	}
-
-	// Did we already re-exec?
-	if strings.HasPrefix(exe, dirs.SnapMountDir) {
-		return
-	}
-
-	// If the distribution doesn't support re-exec or run-from-core then don't do it.
-	if !distroSupportsReExec() {
-		return
-	}
-
-	// Is this executable in the core snap too?
-	coreOrSnapdPath := snapdSnap
-	full := filepath.Join(snapdSnap, exe)
-	if !osutil.FileExists(full) {
-		coreOrSnapdPath = coreSnap
-		full = filepath.Join(coreSnap, exe)
-		if !osutil.FileExists(full) {
-			return
-		}
-	}
-
-	// If the core snap doesn't support re-exec or run-from-core then don't do it.
-	if !coreSupportsReExec(coreOrSnapdPath) {
-		return
-	}
-
-	logger.Debugf("restarting into %q", full)
-	panic(syscallExec(full, os.Args, os.Environ()))
-}
-
-// MockOsReadlink is for use in tests
-func MockOsReadlink(f func(string) (string, error)) func() {
-	realOsReadlink := osReadlink
-	osReadlink = f
-	return func() {
-		osReadlink = realOsReadlink
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmd_linux_test.go snapd-2.48.3+20.04/cmd/cmd_linux_test.go
--- snapd-2.45.1+20.04.2/cmd/cmd_linux_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmd_linux_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,117 +0,0 @@
-package cmd
-
-import (
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/snapcore/snapd/dirs"
-)
-
-const dataOK = `one line
-another line
-yadda yadda
-VERSION=42
-potatoes
-`
-
-const dataNOK = `a line
-another
-this is a very long line
-that wasn't long what are you talking about long lines are like, so long you need to add things like commas to them for them to even make sense
-a short one
-and another
-what is this
-why
-no
-stop
-`
-
-const dataHuge = `Lorem ipsum dolor sit amet, consectetur adipiscing elit.
-Quisque euismod ac elit ac auctor.
-Proin malesuada diam ac tellus maximus aliquam.
-Aenean tincidunt mi et tortor bibendum fringilla.
-Phasellus finibus, urna id convallis vestibulum, metus metus venenatis massa, et efficitur nisi elit in massa.
-Mauris at nisl leo.
-Nulla ullamcorper risus venenatis massa venenatis, ac finibus lacus aliquam.
-Nunc tempor convallis cursus.
-Maecenas id rhoncus orci, eget pretium eros.
-
-Donec et consectetur lacus.
-Nam nec mattis elit, id sollicitudin magna.
-Aenean sit amet diam vitae tellus finibus tristique.
-Duis et pharetra tortor, id pharetra erat.
-Suspendisse commodo venenatis blandit.
-Morbi tellus est, iaculis et tincidunt nec, semper ut ipsum.
-Mauris quis condimentum risus.
-Lorem ipsum dolor sit amet, consectetur adipiscing elit.
-Mauris gravida turpis ut urna laoreet, sit amet tempor odio porttitor.
-
-Aliquam nibh libero, venenatis ac vehicula at, blandit id odio.
-Etiam malesuada consectetur porta.
-Fusce consectetur ligula et metus interdum sollicitudin.
-Pellentesque odio neque, pharetra et gravida non, vestibulum nec lorem.
-Sed condimentum velit ex, sit amet viverra lectus aliquet quis.
-Aliquam tincidunt eu elit at condimentum.
-Donec feugiat urna tortor, pellentesque tincidunt quam congue eu.
-
-Phasellus vel libero molestie, semper erat at, suscipit nisi.
-Nullam euismod neque ut turpis molestie, eu fringilla elit volutpat.
-Phasellus maximus, urna eget porta congue, diam enim volutpat diam, nec ultrices lorem risus ac metus.
-Vivamus convallis eros non nunc pretium bibendum.
-Maecenas consectetur metus metus.
-Morbi scelerisque urna at arcu tristique feugiat.
-Vestibulum condimentum odio sed tortor vulputate, eget hendrerit mi consequat.
-Integer egestas finibus augue, ac scelerisque ex pretium aliquam.
-Aliquam erat volutpat.
-Suspendisse a nulla ultrices, porttitor tellus ut, bibendum diam.
-In nibh dui, tempus eget vestibulum in, euismod in ex.
-In tempus felis lectus.
-
-Maecenas suscipit turpis eget velit molestie, quis luctus nibh placerat.
-Nulla semper eleifend nisi ut dignissim.
-Donec eu massa maximus, blandit massa ac, lobortis risus.
-Donec id condimentum libero, vel fringilla diam.
-Praesent ultrices, ante congue sollicitudin sagittis, orci ex maximus ipsum, at convallis nunc nisl nec lorem.
-Duis iaculis finibus fermentum.
-Curabitur quis pharetra metus.
-Donec nisl ipsum, faucibus vitae odio sed, mattis feugiat nisl.
-Pellentesque nec justo in magna volutpat accumsan.
-Pellentesque porttitor justo non velit porta rhoncus.
-Nulla ut lectus quis lectus rutrum dignissim.
-Pellentesque posuere sagittis felis, quis varius purus pharetra eu.
-Nam blandit diam ullamcorper, auctor massa at, aliquet dui.
-Aliquam erat volutpat.
-Nullam sit amet augue nec diam sollicitudin ullamcorper a vitae neque.
-VERSION=42
-`
-
-func benchmarkCSRE(b *testing.B, data string) {
-	tempdir, err := ioutil.TempDir("", "")
-	if err != nil {
-		b.Fatalf("tempdir: %v", err)
-	}
-	defer os.RemoveAll(tempdir)
-	if err = os.MkdirAll(filepath.Join(tempdir, dirs.CoreLibExecDir), 0755); err != nil {
-		b.Fatalf("mkdirall: %v", err)
-	}
-
-	if err = ioutil.WriteFile(filepath.Join(tempdir, dirs.CoreLibExecDir, "info"), []byte(data), 0600); err != nil {
-		b.Fatalf("%v", err)
-	}
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		coreSupportsReExec(tempdir)
-	}
-}
-
-func BenchmarkCSRE_fakeOK(b *testing.B)   { benchmarkCSRE(b, dataOK) }
-func BenchmarkCSRE_fakeNOK(b *testing.B)  { benchmarkCSRE(b, dataNOK) }
-func BenchmarkCSRE_fakeHuge(b *testing.B) { benchmarkCSRE(b, dataHuge) }
-
-func BenchmarkCSRE_real(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		coreSupportsReExec("/snap/core/current")
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmd_other.go snapd-2.48.3+20.04/cmd/cmd_other.go
--- snapd-2.45.1+20.04.2/cmd/cmd_other.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmd_other.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,40 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build !linux
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd
-
-import (
-	"errors"
-)
-
-// ExecInSnapdOrCoreSnap makes sure you're executing the binary that ships in
-// the snapd/core snap.
-// On this OS this is a stub.
-func ExecInSnapdOrCoreSnap() {
-	return
-}
-
-// InternalToolPath returns the path of an internal snapd tool. The tool
-// *must* be located inside the same tree as the current binary.
-//
-// On this OS this is a stub and always returns an error.
-func InternalToolPath(tool string) (string, error) {
-	return "", errors.New("unsupported on non-Linux systems")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmd_test.go snapd-2.48.3+20.04/cmd/cmd_test.go
--- snapd-2.45.1+20.04.2/cmd/cmd_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmd_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,419 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2017 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/logger"
-	"github.com/snapcore/snapd/release"
-)
-
-func Test(t *testing.T) { TestingT(t) }
-
-type cmdSuite struct {
-	restoreExec   func()
-	restoreLogger func()
-	execCalled    int
-	lastExecArgv0 string
-	lastExecArgv  []string
-	lastExecEnvv  []string
-	fakeroot      string
-	snapdPath     string
-	corePath      string
-}
-
-var _ = Suite(&cmdSuite{})
-
-func (s *cmdSuite) SetUpTest(c *C) {
-	s.restoreExec = cmd.MockSyscallExec(s.syscallExec)
-	_, s.restoreLogger = logger.MockLogger()
-	s.execCalled = 0
-	s.lastExecArgv0 = ""
-	s.lastExecArgv = nil
-	s.lastExecEnvv = nil
-	s.fakeroot = c.MkDir()
-	dirs.SetRootDir(s.fakeroot)
-	s.snapdPath = filepath.Join(dirs.SnapMountDir, "/snapd/42")
-	s.corePath = filepath.Join(dirs.SnapMountDir, "/core/21")
-	c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, "proc/self"), 0755), IsNil)
-}
-
-func (s *cmdSuite) TearDownTest(c *C) {
-	s.restoreExec()
-	s.restoreLogger()
-}
-
-func (s *cmdSuite) syscallExec(argv0 string, argv []string, envv []string) (err error) {
-	s.execCalled++
-	s.lastExecArgv0 = argv0
-	s.lastExecArgv = argv
-	s.lastExecEnvv = envv
-	return fmt.Errorf(">exec of %q in tests<", argv0)
-}
-
-func (s *cmdSuite) fakeCoreVersion(c *C, coreDir, version string) {
-	p := filepath.Join(coreDir, "/usr/lib/snapd")
-	c.Assert(os.MkdirAll(p, 0755), IsNil)
-	c.Assert(ioutil.WriteFile(filepath.Join(p, "info"), []byte("VERSION="+version), 0644), IsNil)
-}
-
-func (s *cmdSuite) fakeInternalTool(c *C, coreDir, toolName string) string {
-	s.fakeCoreVersion(c, coreDir, "42")
-	p := filepath.Join(coreDir, "/usr/lib/snapd", toolName)
-	c.Assert(ioutil.WriteFile(p, nil, 0755), IsNil)
-
-	return p
-}
-
-func (s *cmdSuite) mockReExecingEnv() func() {
-	restore := []func(){
-		release.MockOnClassic(true),
-		release.MockReleaseInfo(&release.OS{ID: "ubuntu"}),
-		cmd.MockCoreSnapdPaths(s.corePath, s.snapdPath),
-		cmd.MockVersion("2"),
-	}
-
-	return func() {
-		for i := len(restore) - 1; i >= 0; i-- {
-			restore[i]()
-		}
-	}
-}
-
-func (s *cmdSuite) mockReExecFor(c *C, coreDir, toolName string) func() {
-	selfExe := filepath.Join(s.fakeroot, "proc/self/exe")
-	restore := []func(){
-		s.mockReExecingEnv(),
-		cmd.MockSelfExe(selfExe),
-	}
-	s.fakeInternalTool(c, coreDir, toolName)
-	c.Assert(os.Symlink(filepath.Join("/usr/lib/snapd", toolName), selfExe), IsNil)
-
-	return func() {
-		for i := len(restore) - 1; i >= 0; i-- {
-			restore[i]()
-		}
-	}
-}
-
-func (s *cmdSuite) TestDistroSupportsReExec(c *C) {
-	restore := release.MockOnClassic(true)
-	defer restore()
-
-	// Some distributions don't support re-execution yet.
-	for _, id := range []string{"fedora", "centos", "rhel", "opensuse", "suse", "poky"} {
-		restore = release.MockReleaseInfo(&release.OS{ID: id})
-		defer restore()
-		c.Check(cmd.DistroSupportsReExec(), Equals, false, Commentf("ID: %q", id))
-	}
-
-	// While others do.
-	for _, id := range []string{"debian", "ubuntu"} {
-		restore = release.MockReleaseInfo(&release.OS{ID: id})
-		defer restore()
-		c.Check(cmd.DistroSupportsReExec(), Equals, true, Commentf("ID: %q", id))
-	}
-}
-
-func (s *cmdSuite) TestNonClassicDistroNoSupportsReExec(c *C) {
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	// no distro supports re-exec when not on classic :-)
-	for _, id := range []string{
-		"fedora", "centos", "rhel", "opensuse", "suse", "poky",
-		"debian", "ubuntu", "arch", "archlinux",
-	} {
-		restore = release.MockReleaseInfo(&release.OS{ID: id})
-		defer restore()
-		c.Check(cmd.DistroSupportsReExec(), Equals, false, Commentf("ID: %q", id))
-	}
-}
-
-func (s *cmdSuite) TestCoreSupportsReExecNoInfo(c *C) {
-	// there's no snapd/info in a just-created tmpdir :-p
-	c.Check(cmd.CoreSupportsReExec(c.MkDir()), Equals, false)
-}
-
-func (s *cmdSuite) TestCoreSupportsReExecBadInfo(c *C) {
-	// can't read snapd/info if it's a directory
-	p := s.snapdPath + "/usr/lib/snapd/info"
-	c.Assert(os.MkdirAll(p, 0755), IsNil)
-
-	c.Check(cmd.CoreSupportsReExec(s.snapdPath), Equals, false)
-}
-
-func (s *cmdSuite) TestCoreSupportsReExecBadInfoContent(c *C) {
-	// can't understand snapd/info if all it holds are potatoes
-	p := s.snapdPath + "/usr/lib/snapd"
-	c.Assert(os.MkdirAll(p, 0755), IsNil)
-	c.Assert(ioutil.WriteFile(p+"/info", []byte("potatoes"), 0644), IsNil)
-
-	c.Check(cmd.CoreSupportsReExec(s.snapdPath), Equals, false)
-}
-
-func (s *cmdSuite) TestCoreSupportsReExecBadVersion(c *C) {
-	// can't understand snapd/info if all its version is gibberish
-	s.fakeCoreVersion(c, s.snapdPath, "0:")
-
-	c.Check(cmd.CoreSupportsReExec(s.snapdPath), Equals, false)
-}
-
-func (s *cmdSuite) TestCoreSupportsReExecOldVersion(c *C) {
-	// can't re-exec if core version is too old
-	defer cmd.MockVersion("2")()
-	s.fakeCoreVersion(c, s.snapdPath, "0")
-
-	c.Check(cmd.CoreSupportsReExec(s.snapdPath), Equals, false)
-}
-
-func (s *cmdSuite) TestCoreSupportsReExec(c *C) {
-	defer cmd.MockVersion("2")()
-	s.fakeCoreVersion(c, s.snapdPath, "9999")
-
-	c.Check(cmd.CoreSupportsReExec(s.snapdPath), Equals, true)
-}
-
-func (s *cmdSuite) TestInternalToolPathNoReexec(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join(dirs.DistroLibExecDir, "snapd"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, filepath.Join(dirs.DistroLibExecDir, "potato"))
-}
-
-func (s *cmdSuite) TestInternalToolPathWithReexec(c *C) {
-	s.fakeInternalTool(c, s.snapdPath, "potato")
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join(s.snapdPath, "/usr/lib/snapd/snapd"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, filepath.Join(dirs.SnapMountDir, "snapd/42/usr/lib/snapd/potato"))
-}
-
-func (s *cmdSuite) TestInternalToolPathWithOtherLocation(c *C) {
-	s.fakeInternalTool(c, s.snapdPath, "potato")
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join("/tmp/tmp.foo_1234/usr/lib/snapd/snapd"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, "/tmp/tmp.foo_1234/usr/lib/snapd/potato")
-}
-
-func (s *cmdSuite) TestInternalToolSnapPathWithOtherLocation(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join("/tmp/tmp.foo_1234/usr/bin/snap"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, "/tmp/tmp.foo_1234/usr/lib/snapd/potato")
-}
-
-func (s *cmdSuite) TestInternalToolPathWithOtherCrazyLocation(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join("/usr/foo/usr/tmp/tmp.foo_1234/usr/bin/snap"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, "/usr/foo/usr/tmp/tmp.foo_1234/usr/lib/snapd/potato")
-}
-
-func (s *cmdSuite) TestInternalToolPathWithDevLocationFallback(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join("/home/dev/snapd/snapd"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, filepath.Join(dirs.DistroLibExecDir, "potato"))
-}
-
-func (s *cmdSuite) TestInternalToolPathWithOtherDevLocationWhenExecutable(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join(dirs.GlobalRootDir, "/tmp/snapd"), nil
-	})
-	defer restore()
-
-	devTool := filepath.Join(dirs.GlobalRootDir, "/tmp/potato")
-	err := os.MkdirAll(filepath.Dir(devTool), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(devTool, []byte(""), 0755)
-	c.Assert(err, IsNil)
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, filepath.Join(dirs.GlobalRootDir, "/tmp/potato"))
-}
-
-func (s *cmdSuite) TestInternalToolPathWithOtherDevLocationNonExecutable(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join(dirs.GlobalRootDir, "/tmp/snapd"), nil
-	})
-	defer restore()
-
-	devTool := filepath.Join(dirs.GlobalRootDir, "/tmp/non-executable-potato")
-	err := os.MkdirAll(filepath.Dir(devTool), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(devTool, []byte(""), 0644)
-	c.Assert(err, IsNil)
-
-	path, err := cmd.InternalToolPath("non-executable-potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, filepath.Join(dirs.DistroLibExecDir, "non-executable-potato"))
-}
-
-func (s *cmdSuite) TestInternalToolPathSnapdPathReexec(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join(dirs.SnapMountDir, "core/111/usr/bin/snap"), nil
-	})
-	defer restore()
-
-	p, err := cmd.InternalToolPath("snapd")
-	c.Assert(err, IsNil)
-	c.Check(p, Equals, filepath.Join(dirs.SnapMountDir, "/core/111/usr/lib/snapd/snapd"))
-}
-
-func (s *cmdSuite) TestInternalToolPathSnapdSnap(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join(dirs.SnapMountDir, "snapd/22/usr/bin/snap"), nil
-	})
-	defer restore()
-	p, err := cmd.InternalToolPath("snapd")
-	c.Assert(err, IsNil)
-	c.Check(p, Equals, filepath.Join(dirs.SnapMountDir, "/snapd/22/usr/lib/snapd/snapd"))
-}
-
-func (s *cmdSuite) TestInternalToolPathWithLibexecdirLocation(c *C) {
-	defer dirs.SetRootDir(s.fakeroot)
-	restore := release.MockReleaseInfo(&release.OS{ID: "fedora"})
-	defer restore()
-	// reload directory paths
-	dirs.SetRootDir("/")
-
-	restore = cmd.MockOsReadlink(func(string) (string, error) {
-		return filepath.Join("/usr/bin/snap"), nil
-	})
-	defer restore()
-
-	path, err := cmd.InternalToolPath("potato")
-	c.Check(err, IsNil)
-	c.Check(path, Equals, filepath.Join("/usr/libexec/snapd/potato"))
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnap(c *C) {
-	defer s.mockReExecFor(c, s.snapdPath, "potato")()
-
-	c.Check(cmd.ExecInSnapdOrCoreSnap, PanicMatches, `>exec of "[^"]+/potato" in tests<`)
-	c.Check(s.execCalled, Equals, 1)
-	c.Check(s.lastExecArgv0, Equals, filepath.Join(s.snapdPath, "/usr/lib/snapd/potato"))
-	c.Check(s.lastExecArgv, DeepEquals, os.Args)
-}
-
-func (s *cmdSuite) TestExecInOldCoreSnap(c *C) {
-	defer s.mockReExecFor(c, s.corePath, "potato")()
-
-	c.Check(cmd.ExecInSnapdOrCoreSnap, PanicMatches, `>exec of "[^"]+/potato" in tests<`)
-	c.Check(s.execCalled, Equals, 1)
-	c.Check(s.lastExecArgv0, Equals, filepath.Join(s.corePath, "/usr/lib/snapd/potato"))
-	c.Check(s.lastExecArgv, DeepEquals, os.Args)
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnapBailsNoCoreSupport(c *C) {
-	defer s.mockReExecFor(c, s.snapdPath, "potato")()
-
-	// no "info" -> no core support:
-	c.Assert(os.Remove(filepath.Join(s.snapdPath, "/usr/lib/snapd/info")), IsNil)
-
-	cmd.ExecInSnapdOrCoreSnap()
-	c.Check(s.execCalled, Equals, 0)
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnapMissingExe(c *C) {
-	defer s.mockReExecFor(c, s.snapdPath, "potato")()
-
-	// missing exe:
-	c.Assert(os.Remove(filepath.Join(s.snapdPath, "/usr/lib/snapd/potato")), IsNil)
-
-	cmd.ExecInSnapdOrCoreSnap()
-	c.Check(s.execCalled, Equals, 0)
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnapBadSelfExe(c *C) {
-	defer s.mockReExecFor(c, s.snapdPath, "potato")()
-
-	// missing self/exe:
-	c.Assert(os.Remove(filepath.Join(s.fakeroot, "proc/self/exe")), IsNil)
-
-	cmd.ExecInSnapdOrCoreSnap()
-	c.Check(s.execCalled, Equals, 0)
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnapBailsNoDistroSupport(c *C) {
-	defer s.mockReExecFor(c, s.snapdPath, "potato")()
-
-	// no distro support:
-	defer release.MockOnClassic(false)()
-
-	cmd.ExecInSnapdOrCoreSnap()
-	c.Check(s.execCalled, Equals, 0)
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnapNoDouble(c *C) {
-	selfExe := filepath.Join(s.fakeroot, "proc/self/exe")
-	err := os.Symlink(filepath.Join(s.fakeroot, "/snap/core/42/usr/lib/snapd"), selfExe)
-	c.Assert(err, IsNil)
-	cmd.MockSelfExe(selfExe)
-
-	cmd.ExecInSnapdOrCoreSnap()
-	c.Check(s.execCalled, Equals, 0)
-}
-
-func (s *cmdSuite) TestExecInSnapdOrCoreSnapDisabled(c *C) {
-	defer s.mockReExecFor(c, s.snapdPath, "potato")()
-
-	os.Setenv("SNAP_REEXEC", "0")
-	defer os.Unsetenv("SNAP_REEXEC")
-
-	cmd.ExecInSnapdOrCoreSnap()
-	c.Check(s.execCalled, Equals, 0)
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmdutil/cmdutil.go snapd-2.48.3+20.04/cmd/cmdutil/cmdutil.go
--- snapd-2.45.1+20.04.2/cmd/cmdutil/cmdutil.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmdutil/cmdutil.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,140 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmdutil
-
-import (
-	"bufio"
-	"bytes"
-	"debug/elf"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/osutil"
-)
-
-func elfInterp(cmd string) (string, error) {
-	el, err := elf.Open(cmd)
-	if err != nil {
-		return "", err
-	}
-	defer el.Close()
-
-	for _, prog := range el.Progs {
-		if prog.Type == elf.PT_INTERP {
-			r := prog.Open()
-			interp, err := ioutil.ReadAll(r)
-			if err != nil {
-				return "", nil
-			}
-
-			return string(bytes.Trim(interp, "\x00")), nil
-		}
-	}
-
-	return "", fmt.Errorf("cannot find PT_INTERP header")
-}
-
-func parseLdSoConf(root string, confPath string) []string {
-	f, err := os.Open(filepath.Join(root, confPath))
-	if err != nil {
-		return nil
-	}
-	defer f.Close()
-
-	var out []string
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		line := scanner.Text()
-		switch {
-		case strings.HasPrefix(line, "#"):
-			// nothing
-		case strings.TrimSpace(line) == "":
-			// nothing
-		case strings.HasPrefix(line, "include "):
-			l := strings.SplitN(line, "include ", 2)
-			files, err := filepath.Glob(filepath.Join(root, l[1]))
-			if err != nil {
-				return nil
-			}
-			for _, f := range files {
-				out = append(out, parseLdSoConf(root, f[len(root):])...)
-			}
-		default:
-			out = append(out, filepath.Join(root, line))
-		}
-
-	}
-	if err := scanner.Err(); err != nil {
-		return nil
-	}
-
-	return out
-}
-
-// CommandFromSystemSnap runs a command from the snapd/core snap
-// using the proper interpreter and library paths.
-//
-// At the moment it can only run ELF files, expects a standard ld.so
-// interpreter, and can't handle RPATH.
-func CommandFromSystemSnap(name string, cmdArgs ...string) (*exec.Cmd, error) {
-	from := "snapd"
-	root := filepath.Join(dirs.SnapMountDir, "/snapd/current")
-	if !osutil.FileExists(root) {
-		from = "core"
-		root = filepath.Join(dirs.SnapMountDir, "/core/current")
-	}
-
-	cmdPath := filepath.Join(root, name)
-	interp, err := elfInterp(cmdPath)
-	if err != nil {
-		return nil, err
-	}
-	coreLdSo := filepath.Join(root, interp)
-	// we cannot use EvalSymlink here because we need to resolve
-	// relative and an absolute symlinks differently. A absolute
-	// symlink is relative to root of the snapd/core snap.
-	seen := map[string]bool{}
-	for osutil.IsSymlink(coreLdSo) {
-		link, err := os.Readlink(coreLdSo)
-		if err != nil {
-			return nil, err
-		}
-		if filepath.IsAbs(link) {
-			coreLdSo = filepath.Join(root, link)
-		} else {
-			coreLdSo = filepath.Join(filepath.Dir(coreLdSo), link)
-		}
-		if seen[coreLdSo] {
-			return nil, fmt.Errorf("cannot run command from %s: symlink cycle found", from)
-		}
-		seen[coreLdSo] = true
-	}
-
-	ldLibraryPathForCore := parseLdSoConf(root, "/etc/ld.so.conf")
-
-	ldSoArgs := []string{"--library-path", strings.Join(ldLibraryPathForCore, ":"), cmdPath}
-	allArgs := append(ldSoArgs, cmdArgs...)
-	return exec.Command(coreLdSo, allArgs...), nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmdutil/cmdutil_test.go snapd-2.48.3+20.04/cmd/cmdutil/cmdutil_test.go
--- snapd-2.45.1+20.04.2/cmd/cmdutil/cmdutil_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmdutil/cmdutil_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,118 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2016 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmdutil_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/cmdutil"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/osutil"
-)
-
-// Hook up check.v1 into the "go test" runner
-func Test(t *testing.T) { TestingT(t) }
-
-var truePath = osutil.LookPathDefault("true", "/bin/true")
-
-type cmdutilSuite struct{}
-
-var _ = Suite(&cmdutilSuite{})
-
-func (s *cmdutilSuite) SetUpTest(c *C) {
-	dirs.SetRootDir(c.MkDir())
-}
-
-func (s *cmdutilSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("")
-}
-
-func (s *cmdutilSuite) makeMockLdSoConf(c *C, root string) {
-	ldSoConf := filepath.Join(root, "/etc/ld.so.conf")
-	ldSoConfD := ldSoConf + ".d"
-
-	err := os.MkdirAll(filepath.Dir(ldSoConf), 0755)
-	c.Assert(err, IsNil)
-	err = os.MkdirAll(ldSoConfD, 0755)
-	c.Assert(err, IsNil)
-
-	err = ioutil.WriteFile(ldSoConf, []byte("include /etc/ld.so.conf.d/*.conf"), 0644)
-	c.Assert(err, IsNil)
-
-	ldSoConf1 := filepath.Join(ldSoConfD, "x86_64-linux-gnu.conf")
-
-	err = ioutil.WriteFile(ldSoConf1, []byte(`
-# Multiarch support
-/lib/x86_64-linux-gnu
-/usr/lib/x86_64-linux-gnu`), 0644)
-	c.Assert(err, IsNil)
-}
-
-func (s *cmdutilSuite) TestCommandFromSystemSnap(c *C) {
-	for _, snap := range []string{"core", "snapd"} {
-
-		root := filepath.Join(dirs.SnapMountDir, snap, "current")
-		s.makeMockLdSoConf(c, root)
-
-		os.MkdirAll(filepath.Join(root, "/usr/bin"), 0755)
-		osutil.CopyFile(truePath, filepath.Join(root, "/usr/bin/xdelta3"), 0)
-		cmd, err := cmdutil.CommandFromSystemSnap("/usr/bin/xdelta3", "--some-xdelta-arg")
-		c.Assert(err, IsNil)
-
-		out, err := exec.Command("/bin/sh", "-c", fmt.Sprintf("readelf -l %s |grep interpreter:|cut -f2 -d:|cut -f1 -d]", truePath)).Output()
-		c.Assert(err, IsNil)
-		interp := strings.TrimSpace(string(out))
-
-		c.Check(cmd.Args, DeepEquals, []string{
-			filepath.Join(root, interp),
-			"--library-path",
-			fmt.Sprintf("%s/lib/x86_64-linux-gnu:%s/usr/lib/x86_64-linux-gnu", root, root),
-			filepath.Join(root, "/usr/bin/xdelta3"),
-			"--some-xdelta-arg",
-		})
-	}
-}
-
-func (s *cmdutilSuite) TestCommandFromCoreSymlinkCycle(c *C) {
-	root := filepath.Join(dirs.SnapMountDir, "/core/current")
-	s.makeMockLdSoConf(c, root)
-
-	os.MkdirAll(filepath.Join(root, "/usr/bin"), 0755)
-	osutil.CopyFile(truePath, filepath.Join(root, "/usr/bin/xdelta3"), 0)
-
-	out, err := exec.Command("/bin/sh", "-c", "readelf -l /bin/true |grep interpreter:|cut -f2 -d:|cut -f1 -d]").Output()
-	c.Assert(err, IsNil)
-	interp := strings.TrimSpace(string(out))
-
-	coreInterp := filepath.Join(root, interp)
-	c.Assert(os.MkdirAll(filepath.Dir(coreInterp), 0755), IsNil)
-	c.Assert(os.Symlink(filepath.Base(coreInterp), coreInterp), IsNil)
-
-	_, err = cmdutil.CommandFromSystemSnap("/usr/bin/xdelta3", "--some-xdelta-arg")
-	c.Assert(err, ErrorMatches, "cannot run command from core: symlink cycle found")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmdutil/version.go snapd-2.48.3+20.04/cmd/cmdutil/version.go
--- snapd-2.45.1+20.04.2/cmd/cmdutil/version.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmdutil/version.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,53 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmdutil
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-)
-
-// SnapdVersionFromInfoFile returns snapd version read for the
-// given info" file, pointed by infoPath.
-// The format of the "info" file is a single line with "VERSION=..."
-// in it. The file is produced by mkversion.sh and normally installed
-// along snapd binary in /usr/lib/snapd.
-func SnapdVersionFromInfoFile(infoPath string) (string, error) {
-	content, err := ioutil.ReadFile(infoPath)
-	if err != nil {
-		return "", fmt.Errorf("cannot open snapd info file %q: %s", infoPath, err)
-	}
-
-	if !bytes.HasPrefix(content, []byte("VERSION=")) {
-		idx := bytes.Index(content, []byte("\nVERSION="))
-		if idx < 0 {
-			return "", fmt.Errorf("cannot find snapd version information in %q", content)
-		}
-		content = content[idx+1:]
-	}
-	content = content[8:]
-	idx := bytes.IndexByte(content, '\n')
-	if idx > -1 {
-		content = content[:idx]
-	}
-
-	return string(content), nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/cmdutil/version_test.go snapd-2.48.3+20.04/cmd/cmdutil/version_test.go
--- snapd-2.45.1+20.04.2/cmd/cmdutil/version_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/cmdutil/version_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,57 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmdutil_test
-
-import (
-	"io/ioutil"
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/cmdutil"
-)
-
-type versionSuite struct{}
-
-var _ = Suite(&versionSuite{})
-
-func (s *versionSuite) TestNoVersionFile(c *C) {
-	_, err := cmdutil.SnapdVersionFromInfoFile("/non-existing-file")
-	c.Assert(err, ErrorMatches, `cannot open snapd info file "/non-existing-file":.*`)
-}
-
-func (s *versionSuite) TestNoVersionData(c *C) {
-	top := c.MkDir()
-	infoFile := filepath.Join(top, "info")
-	c.Assert(ioutil.WriteFile(infoFile, []byte("foo"), 0644), IsNil)
-
-	_, err := cmdutil.SnapdVersionFromInfoFile(infoFile)
-	c.Assert(err, ErrorMatches, `cannot find snapd version information in "foo"`)
-}
-
-func (s *versionSuite) TestVersionHappy(c *C) {
-	top := c.MkDir()
-	infoFile := filepath.Join(top, "info")
-	c.Assert(ioutil.WriteFile(infoFile, []byte("VERSION=1.2.3"), 0644), IsNil)
-
-	ver, err := cmdutil.SnapdVersionFromInfoFile(infoFile)
-	c.Assert(err, IsNil)
-	c.Check(ver, Equals, "1.2.3")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/export_test.go snapd-2.48.3+20.04/cmd/export_test.go
--- snapd-2.45.1+20.04.2/cmd/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/export_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,52 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2017 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd
-
-var (
-	DistroSupportsReExec = distroSupportsReExec
-	CoreSupportsReExec   = coreSupportsReExec
-)
-
-func MockCoreSnapdPaths(newCoreSnap, newSnapdSnap string) func() {
-	oldOldCore := coreSnap
-	oldNewCore := snapdSnap
-	snapdSnap = newSnapdSnap
-	coreSnap = newCoreSnap
-	return func() {
-		snapdSnap = oldNewCore
-		coreSnap = oldOldCore
-	}
-}
-
-func MockSelfExe(newSelfExe string) func() {
-	oldSelfExe := selfExe
-	selfExe = newSelfExe
-	return func() {
-		selfExe = oldSelfExe
-	}
-}
-
-func MockSyscallExec(f func(argv0 string, argv []string, envv []string) (err error)) func() {
-	oldSyscallExec := syscallExec
-	syscallExec = f
-	return func() {
-		syscallExec = oldSyscallExec
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/cgroup-pids-support.c snapd-2.48.3+20.04/cmd/libsnap-confine-private/cgroup-pids-support.c
--- snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/cgroup-pids-support.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/libsnap-confine-private/cgroup-pids-support.c	1970-01-01 00:00:00.000000000 +0000
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "cgroup-pids-support.h"
-
-#include "cgroup-support.h"
-
-static const char *pids_cgroup_dir = "/sys/fs/cgroup/pids";
-
-void sc_cgroup_pids_join(const char *snap_security_tag, pid_t pid) {
-    sc_cgroup_create_and_join(pids_cgroup_dir, snap_security_tag, pid);
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/cgroup-pids-support.h snapd-2.48.3+20.04/cmd/libsnap-confine-private/cgroup-pids-support.h
--- snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/cgroup-pids-support.h	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/libsnap-confine-private/cgroup-pids-support.h	1970-01-01 00:00:00.000000000 +0000
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#ifndef SC_CGROUP_PIDS_SUPPORT_H
-#define SC_CGROUP_PIDS_SUPPORT_H
-
-#include <sys/types.h>
-
-/**
- * Join the pid cgroup for the given snap application.
- *
- * This function adds the specified task to the pid cgroup specific to the
- * given snap. The name of the cgroup is "snap.$snap_name.$app_name" for apps
- * or "snap.$snap_name.hook.$hook_name" for hooks.
- *
- * The "tasks" file belonging to the cgroup contains the set of all the
- * threads that originate from the given snap app or hook. Examining that
- * file one can reliably determine if the set is empty or not.
- *
- * Similarly the "cgroup.procs" file belonging to the same directory contains
- * the set of all the processes that originate from the given snap app or
- * hook.
- *
- * For more details please review:
- * https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt
- **/
-void sc_cgroup_pids_join(const char *snap_security_tag, pid_t pid);
-
-#endif
diff -Nru snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/feature.c snapd-2.48.3+20.04/cmd/libsnap-confine-private/feature.c
--- snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/feature.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/libsnap-confine-private/feature.c	2021-02-02 08:21:12.000000000 +0000
@@ -43,6 +43,9 @@
 	case SC_FEATURE_PARALLEL_INSTANCES:
 		file_name = "parallel-instances";
 		break;
+	case SC_FEATURE_HIDDEN_SNAP_FOLDER:
+		file_name = "hidden-snap-folder";
+		break;
 	default:
 		die("unknown feature flag code %d", flag);
 	}
diff -Nru snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/feature.h snapd-2.48.3+20.04/cmd/libsnap-confine-private/feature.h
--- snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/feature.h	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/libsnap-confine-private/feature.h	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 	SC_FEATURE_PER_USER_MOUNT_NAMESPACE = 1 << 0,
 	SC_FEATURE_REFRESH_APP_AWARENESS = 1 << 1,
 	SC_FEATURE_PARALLEL_INSTANCES = 1 << 2,
+	SC_FEATURE_HIDDEN_SNAP_FOLDER = 1 << 3,
 } sc_feature_flag;
 
 /**
diff -Nru snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/feature-test.c snapd-2.48.3+20.04/cmd/libsnap-confine-private/feature-test.c
--- snapd-2.45.1+20.04.2/cmd/libsnap-confine-private/feature-test.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/libsnap-confine-private/feature-test.c	2021-02-02 08:21:12.000000000 +0000
@@ -89,6 +89,20 @@
 	g_assert(sc_feature_enabled(SC_FEATURE_PARALLEL_INSTANCES));
 }
 
+static void test_feature_hidden_snap_folder(void)
+{
+	const char *d = sc_testdir();
+	sc_mock_feature_flag_dir(d);
+
+	g_assert(!sc_feature_enabled(SC_FEATURE_HIDDEN_SNAP_FOLDER));
+
+	char pname[PATH_MAX];
+	sc_must_snprintf(pname, sizeof pname, "%s/hidden-snap-folder", d);
+	g_file_set_contents(pname, "", -1, NULL);
+
+	g_assert(sc_feature_enabled(SC_FEATURE_HIDDEN_SNAP_FOLDER));
+}
+
 static void __attribute__((constructor)) init(void)
 {
 	g_test_add_func("/feature/missing_dir",
@@ -99,4 +113,6 @@
 			test_feature_enabled__present_file);
 	g_test_add_func("/feature/parallel_instances",
 			test_feature_parallel_instances);
+	g_test_add_func("/feature/hidden_snap_folder",
+			test_feature_hidden_snap_folder);
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/Makefile.am snapd-2.48.3+20.04/cmd/Makefile.am
--- snapd-2.45.1+20.04.2/cmd/Makefile.am	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/Makefile.am	2021-02-02 08:21:12.000000000 +0000
@@ -55,8 +55,6 @@
 endif
 
 new_format = \
-	 libsnap-confine-private/cgroup-pids-support.c \
-	 libsnap-confine-private/cgroup-pids-support.h \
 	 libsnap-confine-private/cgroup-support.c \
 	 libsnap-confine-private/cgroup-support.h \
 	 libsnap-confine-private/infofile-test.c \
@@ -72,7 +70,9 @@
 	 snap-confine/snap-confine-invocation-test.c \
 	 snap-confine/snap-confine-invocation.c \
 	 snap-confine/snap-confine-invocation.h \
-	 snap-discard-ns/snap-discard-ns.c
+	 snap-discard-ns/snap-discard-ns.c \
+	 snap-gdb-shim/snap-gdb-shim.c \
+	 snap-gdb-shim/snap-gdbserver-shim.c
 
 # NOTE: clang-format is using project-wide .clang-format file.
 .PHONY: fmt
@@ -112,8 +112,6 @@
 	libsnap-confine-private/apparmor-support.h \
 	libsnap-confine-private/cgroup-freezer-support.c \
 	libsnap-confine-private/cgroup-freezer-support.h \
-	libsnap-confine-private/cgroup-pids-support.c \
-	libsnap-confine-private/cgroup-pids-support.h \
 	libsnap-confine-private/cgroup-support.c \
 	libsnap-confine-private/cgroup-support.h \
 	libsnap-confine-private/classic.c \
@@ -491,6 +489,17 @@
 snap_gdb_shim_snap_gdb_shim_LDADD = libsnap-confine-private.a
 
 ##
+## snap-gdbserver-shim
+##
+
+libexec_PROGRAMS += snap-gdb-shim/snap-gdbserver-shim
+
+snap_gdb_shim_snap_gdbserver_shim_SOURCES = \
+	snap-gdb-shim/snap-gdbserver-shim.c
+
+snap_gdb_shim_snap_gdbserver_shim_LDADD = libsnap-confine-private.a
+
+##
 ## snapd-generator
 ##
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_auto_import.go snapd-2.48.3+20.04/cmd/snap/cmd_auto_import.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_auto_import.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_auto_import.go	2021-02-02 08:21:12.000000000 +0000
@@ -61,6 +61,9 @@
 
 	isTesting := snapdenv.Testing()
 
+	// TODO: re-write this to use osutil.LoadMountInfo instead of doing the
+	//       parsing ourselves
+
 	scanner := bufio.NewScanner(f)
 	for scanner.Scan() {
 		l := strings.Fields(scanner.Text())
@@ -94,7 +97,24 @@
 			continue
 		}
 
+		// TODO: should the following 2 checks try to be more smart like
+		//       `snap-bootstrap initramfs-mounts` and try to find the boot disk
+		//       and determine what partitions to skip using the disks package?
+
+		// skip all initramfs mounted disks on uc20
 		mountPoint := l[4]
+		if strings.HasPrefix(mountPoint, boot.InitramfsRunMntDir) {
+			continue
+		}
+
+		// skip all seed dir mount points too, as these are bind mounts to the
+		// initramfs dirs on uc20, this can show up as
+		// /writable/system-data/var/lib/snapd/seed as well as
+		// /var/lib/snapd/seed
+		if strings.HasSuffix(mountPoint, dirs.SnapSeedDir) {
+			continue
+		}
+
 		cand := filepath.Join(mountPoint, autoImportsName)
 		if osutil.FileExists(cand) {
 			cands = append(cands, cand)
@@ -102,7 +122,6 @@
 	}
 
 	return cands, scanner.Err()
-
 }
 
 func queueFile(src string) error {
@@ -260,12 +279,15 @@
 }
 
 func (x *cmdAutoImport) autoAddUsers() error {
-	cmd := cmdCreateUser{
-		clientMixin: x.clientMixin,
-		Known:       true,
-		Sudoer:      true,
+	options := client.CreateUserOptions{
+		Automatic: true,
 	}
-	return cmd.Execute(nil)
+	results, err := x.client.CreateUsers([]*client.CreateUserOptions{&options})
+	for _, result := range results {
+		fmt.Fprintf(Stdout, i18n.G("created user %q\n"), result.Username)
+	}
+
+	return err
 }
 
 func removableBlockDevices() (removableDevices []string) {
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_auto_import_test.go snapd-2.48.3+20.04/cmd/snap/cmd_auto_import_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_auto_import_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_auto_import_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,7 +28,6 @@
 
 	. "gopkg.in/check.v1"
 
-	"github.com/snapcore/snapd/boot"
 	snap "github.com/snapcore/snapd/cmd/snap"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
@@ -68,7 +67,7 @@
 			c.Check(r.URL.Path, Equals, "/v2/users")
 			postData, err := ioutil.ReadAll(r.Body)
 			c.Assert(err, IsNil)
-			c.Check(string(postData), Equals, `{"action":"create","sudoer":true,"known":true}`)
+			c.Check(string(postData), Equals, `{"action":"create","automatic":true}`)
 
 			fmt.Fprintln(w, `{"type": "sync", "result": [{"username": "foo"}]}`)
 			n++
@@ -245,7 +244,7 @@
 			c.Check(r.URL.Path, Equals, "/v2/users")
 			postData, err := ioutil.ReadAll(r.Body)
 			c.Assert(err, IsNil)
-			c.Check(string(postData), Equals, `{"action":"create","sudoer":true,"known":true}`)
+			c.Check(string(postData), Equals, `{"action":"create","automatic":true}`)
 
 			fmt.Fprintln(w, `{"type": "sync", "result": [{"username": "foo"}]}`)
 			n++
@@ -315,7 +314,7 @@
 	err := ioutil.WriteFile(mockProcCmdlinePath, []byte("foo=bar snapd_recovery_mode=install snapd_recovery_system=20191118"), 0644)
 	c.Assert(err, IsNil)
 
-	restore = boot.MockProcCmdline(mockProcCmdlinePath)
+	restore = osutil.MockProcCmdline(mockProcCmdlinePath)
 	defer restore()
 
 	_, err = snap.Parser(snap.Client()).ParseArgs([]string{"auto-import"})
@@ -463,3 +462,98 @@
 		filepath.Join(rootdir, "/tmp/snapd-auto-import-mount-1"),
 	})
 }
+
+func (s *SnapSuite) TestAutoImportUC20CandidatesIgnoresSystemPartitions(c *C) {
+
+	mountDirs := []string{
+		"/writable/system-data/var/lib/snapd/seed",
+		"/var/lib/snapd/seed",
+		"/run/mnt/ubuntu-boot",
+		"/run/mnt/ubuntu-seed",
+		"/run/mnt/ubuntu-data",
+		"/mnt/real-device",
+	}
+
+	rootDir := c.MkDir()
+	dirs.SetRootDir(rootDir)
+	defer func() { dirs.SetRootDir("") }()
+
+	args := make([]interface{}, 0, len(mountDirs)+1)
+	args = append(args, dirs.GlobalRootDir)
+	// pretend there are auto-import.asserts on all of them
+	for _, dir := range mountDirs {
+		args = append(args, dir)
+		file := filepath.Join(rootDir, dir, "auto-import.assert")
+		c.Assert(os.MkdirAll(filepath.Dir(file), 0755), IsNil)
+		c.Assert(ioutil.WriteFile(file, nil, 0644), IsNil)
+	}
+
+	mockMountInfoFmtWithLoop := `
+24 0 8:18 / %[1]s%[2]s rw,relatime foo ext3 /dev/meep2 no,separator
+24 0 8:18 / %[1]s%[3]s rw,relatime - ext3 /dev/meep2 rw,errors=remount-ro,data=ordered
+24 0 8:18 / %[1]s%[4]s rw,relatime opt:1 - ext4 /dev/meep3 rw,errors=remount-ro,data=ordered
+24 0 8:18 / %[1]s%[5]s rw,relatime opt:1 opt:2 - ext2 /dev/meep4 rw,errors=remount-ro,data=ordered
+24 0 8:18 / %[1]s%[6]s rw,relatime opt:1 opt:2 - ext2 /dev/meep5 rw,errors=remount-ro,data=ordered
+24 0 8:18 / %[1]s%[7]s rw,relatime opt:1 opt:2 - ext2 /dev/meep78 rw,errors=remount-ro,data=ordered
+`
+
+	content := fmt.Sprintf(mockMountInfoFmtWithLoop, args...)
+	restore := snap.MockMountInfoPath(makeMockMountInfo(c, content))
+	defer restore()
+
+	l, err := snap.AutoImportCandidates()
+	c.Check(err, IsNil)
+
+	// only device should be the /mnt/real-device one
+	c.Check(l, DeepEquals, []string{filepath.Join(rootDir, "/mnt/real-device", "auto-import.assert")})
+}
+
+func (s *SnapSuite) TestAutoImportAssertsManagedEmptyReply(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	fakeAssertData := []byte("my-assertion")
+
+	n := 0
+	total := 2
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch n {
+		case 0:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/assertions")
+			postData, err := ioutil.ReadAll(r.Body)
+			c.Assert(err, IsNil)
+			c.Check(postData, DeepEquals, fakeAssertData)
+			fmt.Fprintln(w, `{"type": "sync", "result": {"ready": true, "status": "Done"}}`)
+			n++
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/users")
+			postData, err := ioutil.ReadAll(r.Body)
+			c.Assert(err, IsNil)
+			c.Check(string(postData), Equals, `{"action":"create","automatic":true}`)
+
+			fmt.Fprintln(w, `{"type": "sync", "result": []}`)
+			n++
+		default:
+			c.Fatalf("unexpected request: %v (expected %d got %d)", r, total, n)
+		}
+
+	})
+
+	fakeAssertsFn := filepath.Join(c.MkDir(), "auto-import.assert")
+	err := ioutil.WriteFile(fakeAssertsFn, fakeAssertData, 0644)
+	c.Assert(err, IsNil)
+
+	mockMountInfoFmt := `
+24 0 8:18 / %s rw,relatime shared:1 - ext4 /dev/sdb2 rw,errors=remount-ro,data=ordered`
+	content := fmt.Sprintf(mockMountInfoFmt, filepath.Dir(fakeAssertsFn))
+	restore = snap.MockMountInfoPath(makeMockMountInfo(c, content))
+	defer restore()
+
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"auto-import"})
+	c.Assert(err, IsNil)
+	c.Assert(rest, DeepEquals, []string{})
+	c.Check(s.Stdout(), Equals, ``)
+	c.Check(n, Equals, total)
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_create_cohort.go snapd-2.48.3+20.04/cmd/snap/cmd_create_cohort.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_create_cohort.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_create_cohort.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,7 +26,7 @@
 	"github.com/snapcore/snapd/i18n"
 )
 
-var shortCreateCohortHelp = i18n.G("Create cohort keys for a series of snaps")
+var shortCreateCohortHelp = i18n.G("Create cohort keys for a set of snaps")
 var longCreateCohortHelp = i18n.G(`
 The create-cohort command creates a set of cohort keys for a given set of snaps.
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_debug_seeding.go snapd-2.48.3+20.04/cmd/snap/cmd_debug_seeding.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_debug_seeding.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_debug_seeding.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,163 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/jessevdk/go-flags"
+
+	"github.com/snapcore/snapd/interfaces"
+)
+
+type cmdSeeding struct {
+	clientMixin
+	unicodeMixin
+}
+
+func init() {
+	cmd := addDebugCommand("seeding",
+		"(internal) obtain seeding and preseeding details",
+		"(internal) obtain seeding and preseeding details",
+		func() flags.Commander {
+			return &cmdSeeding{}
+		}, nil, nil)
+	cmd.hidden = true
+}
+
+func (x *cmdSeeding) Execute(args []string) error {
+	esc := x.getEscapes()
+
+	if len(args) > 0 {
+		return ErrExtraArgs
+	}
+	var resp struct {
+		Seeded           bool       `json:"seeded,omitempty"`
+		Preseeded        bool       `json:"preseeded,omitempty"`
+		PreseedStartTime *time.Time `json:"preseed-start-time,omitempty"`
+		PreseedTime      *time.Time `json:"preseed-time,omitempty"`
+		SeedStartTime    *time.Time `json:"seed-start-time,omitempty"`
+		SeedRestartTime  *time.Time `json:"seed-restart-time,omitempty"`
+		SeedTime         *time.Time `json:"seed-time,omitempty"`
+		// use json.RawMessage to delay unmarshal'ing to the interfaces pkg
+		PreseedSystemKey     *json.RawMessage `json:"preseed-system-key,omitempty"`
+		SeedRestartSystemKey *json.RawMessage `json:"seed-restart-system-key,omitempty"`
+
+		SeedError string `json:"seed-error,omitempty"`
+	}
+	if err := x.client.DebugGet("seeding", &resp, nil); err != nil {
+		return err
+	}
+
+	w := tabWriter()
+
+	// show seeded and preseeded keys
+	fmt.Fprintf(w, "seeded:\t%v\n", resp.Seeded)
+	if resp.SeedError != "" {
+		// print seed-error
+		termWidth, _ := termSize()
+		termWidth -= 3
+		if termWidth > 100 {
+			// any wider than this and it gets hard to read
+			termWidth = 100
+		}
+		fmt.Fprintln(w, "seed-error: |")
+		// XXX: reuse/abuse
+		printDescr(w, resp.SeedError, termWidth)
+	}
+
+	fmt.Fprintf(w, "preseeded:\t%v\n", resp.Preseeded)
+
+	// calculate the time spent preseeding (if preseeded) and seeding
+	// for the preseeded case, we use the seed-restart-time as the start time
+	// to show how long we spent only after booting the preseeded image
+
+	// if we are missing time values, we will default to showing "-" for the
+	// duration
+	seedDuration := esc.dash
+	if resp.Preseeded {
+		if resp.PreseedTime != nil && resp.PreseedStartTime != nil {
+			preseedDuration := resp.PreseedTime.Sub(*resp.PreseedStartTime).Round(time.Millisecond)
+			fmt.Fprintf(w, "image-preseeding:\t%v\n", preseedDuration)
+		} else {
+			fmt.Fprintf(w, "image-preseeding:\t%s\n", esc.dash)
+		}
+
+		if resp.SeedTime != nil && resp.SeedRestartTime != nil {
+			seedDuration = fmt.Sprintf("%v", resp.SeedTime.Sub(*resp.SeedRestartTime).Round(time.Millisecond))
+		}
+	} else if resp.SeedTime != nil && resp.SeedStartTime != nil {
+		seedDuration = fmt.Sprintf("%v", resp.SeedTime.Sub(*resp.SeedStartTime).Round(time.Millisecond))
+	}
+	fmt.Fprintf(w, "seed-completion:\t%s\n", seedDuration)
+
+	// we flush the tabwriter now because if we have more output, it will be
+	// the system keys, which are JSON and thus will never display cleanly in
+	// line with the other keys we did above
+	w.Flush()
+
+	// only compare system-keys if preseeded and the system-keys exist
+	// they might not exist if this command is used on a system that was
+	// preseeded with an older version of snapd, i.e. while this feature is
+	// being rolled out, we may be preseeding images via old snapd deb, but with
+	// new snapd snap
+	if resp.Preseeded && resp.SeedRestartSystemKey != nil && resp.PreseedSystemKey != nil {
+		// only show them if they don't match, so first unmarshal them so we can
+		// properly compare them
+
+		// we use raw json messages here so that the interfaces pkg can do the
+		// real unmarshalling to a real systemKey interface{} that can be
+		// compared with SystemKeysMatch, if we had instead unmarshalled here,
+		// we would have to remarshal the map[string]interface{} we got above
+		// and then pass those bytes back to the interfaces pkg which is awkward
+		seedSk, err := interfaces.UnmarshalJSONSystemKey(bytes.NewReader(*resp.SeedRestartSystemKey))
+		if err != nil {
+			return err
+		}
+
+		preseedSk, err := interfaces.UnmarshalJSONSystemKey(bytes.NewReader(*resp.PreseedSystemKey))
+		if err != nil {
+			return err
+		}
+
+		match, err := interfaces.SystemKeysMatch(preseedSk, seedSk)
+		if err != nil {
+			return err
+		}
+		if !match {
+			// mismatch, display the different keys
+			var preseedSkJSON, seedRestartSkJSON bytes.Buffer
+			json.Indent(&preseedSkJSON, *resp.PreseedSystemKey, "", "  ")
+			fmt.Fprintf(Stdout, "preseed-system-key: ")
+			preseedSkJSON.WriteTo(Stdout)
+			fmt.Fprintln(Stdout, "")
+
+			json.Indent(&seedRestartSkJSON, *resp.SeedRestartSystemKey, "", "  ")
+			fmt.Fprintf(Stdout, "seed-restart-system-key: ")
+			seedRestartSkJSON.WriteTo(Stdout)
+			fmt.Fprintln(Stdout, "")
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_debug_seeding_test.go snapd-2.48.3+20.04/cmd/snap/cmd_debug_seeding_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_debug_seeding_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_debug_seeding_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,493 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+
+	. "gopkg.in/check.v1"
+
+	snap "github.com/snapcore/snapd/cmd/snap"
+)
+
+var newPreseedNewSnapdSameSysKey = `
+{
+    "result": {
+        "preseed-start-time": "2020-07-24T21:41:33.838194712Z",
+        "preseed-system-key": {
+            "apparmor-features": [
+                "caps",
+                "dbus",
+                "domain",
+                "file",
+                "mount",
+                "namespaces",
+                "network",
+                "network_v8",
+                "policy",
+                "ptrace",
+                "query",
+                "rlimit",
+                "signal"
+            ],
+            "apparmor-parser-features": [
+                "unsafe"
+            ],
+            "apparmor-parser-mtime": 1589907589,
+            "build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+            "cgroup-version": "1",
+            "nfs-home": false,
+            "overlay-root": "",
+            "seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+            "seccomp-features": [
+                "allow",
+                "errno",
+                "kill_process",
+                "kill_thread",
+                "log",
+                "trace",
+                "trap",
+                "user_notif"
+            ],
+            "version": 10
+        },
+        "preseed-time": "2020-07-24T21:41:43.156401424Z",
+        "preseeded": true,
+        "seed-restart-system-key": {
+            "apparmor-features": [
+                "caps",
+                "dbus",
+                "domain",
+                "file",
+                "mount",
+                "namespaces",
+                "network",
+                "network_v8",
+                "policy",
+                "ptrace",
+                "query",
+                "rlimit",
+                "signal"
+            ],
+            "apparmor-parser-features": [
+                "unsafe"
+            ],
+            "apparmor-parser-mtime": 1589907589,
+            "build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+            "cgroup-version": "1",
+            "nfs-home": false,
+            "overlay-root": "",
+            "seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+            "seccomp-features": [
+                "allow",
+                "errno",
+                "kill_process",
+                "kill_thread",
+                "log",
+                "trace",
+                "trap",
+                "user_notif"
+            ],
+            "version": 10
+        },
+        "seed-restart-time": "2020-07-24T21:42:16.646098923Z",
+        "seed-start-time": "0001-01-01T00:00:00Z",
+        "seed-time": "2020-07-24T21:42:20.518607Z",
+        "seeded": true
+    },
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+var newPreseedNewSnapdDiffSysKey = `
+{
+    "result": {
+        "preseed-start-time": "2020-07-24T21:41:33.838194712Z",
+        "preseed-system-key": {
+            "apparmor-features": [
+                "caps",
+                "dbus",
+                "domain",
+                "file",
+                "mount",
+                "namespaces",
+                "network",
+                "network_v8",
+                "policy",
+                "ptrace",
+                "query",
+                "rlimit",
+                "signal"
+            ],
+            "apparmor-parser-features": [
+                "unsafe"
+            ],
+            "apparmor-parser-mtime": 1589907589,
+            "build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+            "cgroup-version": "1",
+            "nfs-home": false,
+            "overlay-root": "",
+            "seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+            "seccomp-features": [
+                "allow",
+                "errno",
+                "kill_process",
+                "kill_thread",
+                "log",
+                "trace",
+                "trap",
+                "user_notif"
+            ],
+            "version": 10
+        },
+        "preseed-time": "2020-07-24T21:41:43.156401424Z",
+        "preseeded": true,
+        "seed-restart-system-key": {
+            "apparmor-features": [
+                "caps",
+                "dbus",
+                "domain",
+                "file",
+                "mount",
+                "namespaces",
+                "network",
+                "policy",
+                "ptrace",
+                "query",
+                "rlimit",
+                "signal"
+            ],
+            "apparmor-parser-features": [
+                "unsafe"
+            ],
+            "apparmor-parser-mtime": 1589907589,
+            "build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+            "cgroup-version": "1",
+            "nfs-home": false,
+            "overlay-root": "",
+            "seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+            "seccomp-features": [
+                "allow",
+                "errno",
+                "kill",
+                "log",
+                "trace",
+                "trap",
+                "user_notif"
+            ],
+            "version": 10
+        },
+        "seed-restart-time": "2020-07-24T21:42:16.646098923Z",
+        "seed-start-time": "0001-01-01T00:00:00Z",
+        "seed-time": "2020-07-24T21:42:20.518607Z",
+        "seeded": true
+    },
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+// a system that was not preseeded at all
+var noPreseedingJSON = `
+{
+    "result": {
+        "seed-time": "2019-07-04T19:16:10.548793375-05:00",
+        "seeded": true
+    },
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+var seedingError = `{
+    "result": {
+        "preseed-start-time": "2020-07-24T21:41:33.838194712Z",
+        "preseed-time": "2020-07-24T21:41:43.156401424Z",
+        "preseeded": true,
+        "seed-error": "cannot perform the following tasks:\n- xxx"
+    },
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+// a system that was preseeded, but didn't record the new keys
+// this is the case for a system that was preseeded and then seeded with an old
+// snapd, but then is refreshed to a version of snapd that supports snap debug
+// seeding, where we want to still have sensible output
+var oldPreseedingJSON = `{
+    "result": {
+        "preseed-start-time": "0001-01-01T00:00:00Z",
+        "preseed-time": "0001-01-01T00:00:00Z",
+        "seed-restart-time": "2019-07-04T19:14:10.548793375-05:00",
+        "seed-start-time": "0001-01-01T00:00:00Z",
+        "seed-time": "2019-07-04T19:16:10.548793375-05:00",
+        "seeded": true,
+        "preseeded": true
+    },
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+var stillSeeding = `{
+    "result": {
+        "preseed-start-time": "2020-07-24T21:41:33.838194712Z",
+        "preseed-time": "2020-07-24T21:41:43.156401424Z",
+        "preseeded": true
+    },
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+var stillSeedingNoPreseed = `{
+    "result": {},
+    "status": "OK",
+    "status-code": 200,
+    "type": "sync"
+}`
+
+func (s *SnapSuite) TestDebugSeeding(c *C) {
+	tt := []struct {
+		jsonResp   string
+		expStdout  string
+		expStderr  string
+		expErr     string
+		comment    string
+		hasUnicode bool
+	}{
+		{
+			jsonResp: newPreseedNewSnapdSameSysKey,
+			expStdout: `
+seeded:            true
+preseeded:         true
+image-preseeding:  9.318s
+seed-completion:   3.873s
+`[1:],
+			comment: "new preseed keys, same system-key",
+		},
+		{
+			jsonResp: newPreseedNewSnapdDiffSysKey,
+			expStdout: `
+seeded:            true
+preseeded:         true
+image-preseeding:  9.318s
+seed-completion:   3.873s
+preseed-system-key: {
+  "apparmor-features": [
+    "caps",
+    "dbus",
+    "domain",
+    "file",
+    "mount",
+    "namespaces",
+    "network",
+    "network_v8",
+    "policy",
+    "ptrace",
+    "query",
+    "rlimit",
+    "signal"
+  ],
+  "apparmor-parser-features": [
+    "unsafe"
+  ],
+  "apparmor-parser-mtime": 1589907589,
+  "build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+  "cgroup-version": "1",
+  "nfs-home": false,
+  "overlay-root": "",
+  "seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+  "seccomp-features": [
+    "allow",
+    "errno",
+    "kill_process",
+    "kill_thread",
+    "log",
+    "trace",
+    "trap",
+    "user_notif"
+  ],
+  "version": 10
+}
+seed-restart-system-key: {
+  "apparmor-features": [
+    "caps",
+    "dbus",
+    "domain",
+    "file",
+    "mount",
+    "namespaces",
+    "network",
+    "policy",
+    "ptrace",
+    "query",
+    "rlimit",
+    "signal"
+  ],
+  "apparmor-parser-features": [
+    "unsafe"
+  ],
+  "apparmor-parser-mtime": 1589907589,
+  "build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+  "cgroup-version": "1",
+  "nfs-home": false,
+  "overlay-root": "",
+  "seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+  "seccomp-features": [
+    "allow",
+    "errno",
+    "kill",
+    "log",
+    "trace",
+    "trap",
+    "user_notif"
+  ],
+  "version": 10
+}
+`[1:],
+			comment: "new preseed keys, different system-key",
+		},
+		{
+			jsonResp: noPreseedingJSON,
+			expStdout: `
+seeded:           true
+preseeded:        false
+seed-completion:  --
+`[1:],
+			comment: "not preseeded no unicode",
+		},
+		{
+			jsonResp: noPreseedingJSON,
+			expStdout: `
+seeded:           true
+preseeded:        false
+seed-completion:  –
+`[1:],
+			comment:    "not preseeded",
+			hasUnicode: true,
+		},
+		{
+			jsonResp: oldPreseedingJSON,
+			expStdout: `
+seeded:            true
+preseeded:         true
+image-preseeding:  0s
+seed-completion:   2m0s
+`[1:],
+			comment: "old preseeded json",
+		},
+		{
+			jsonResp: stillSeeding,
+			expStdout: `
+seeded:            false
+preseeded:         true
+image-preseeding:  9.318s
+seed-completion:   --
+`[1:],
+			comment: "preseeded, still seeding no unicode",
+		},
+		{
+			jsonResp: stillSeeding,
+			expStdout: `
+seeded:            false
+preseeded:         true
+image-preseeding:  9.318s
+seed-completion:   –
+`[1:],
+			hasUnicode: true,
+			comment:    "preseeded, still seeding",
+		},
+		{
+			jsonResp: stillSeedingNoPreseed,
+			expStdout: `
+seeded:           false
+preseeded:        false
+seed-completion:  --
+`[1:],
+			comment: "not preseeded, still seeding no unicode",
+		},
+		{
+			jsonResp: stillSeedingNoPreseed,
+			expStdout: `
+seeded:           false
+preseeded:        false
+seed-completion:  –
+`[1:],
+			hasUnicode: true,
+			comment:    "not preseeded, still seeding",
+		},
+		{
+			jsonResp: seedingError,
+			expStdout: `
+seeded:  false
+seed-error: |
+  cannot perform the following tasks:
+  - xxx
+preseeded:         true
+image-preseeding:  9.318s
+seed-completion:   --
+`[1:],
+			comment: "preseeded, error during seeding",
+		},
+	}
+
+	for _, t := range tt {
+		comment := Commentf(t.comment)
+		n := 0
+		s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+			n++
+			switch n {
+			case 1:
+				c.Assert(r.Method, Equals, "GET", comment)
+				c.Assert(r.URL.Path, Equals, "/v2/debug", comment)
+				c.Assert(r.URL.RawQuery, Equals, "aspect=seeding", comment)
+				data, err := ioutil.ReadAll(r.Body)
+				c.Assert(err, IsNil, comment)
+				c.Assert(string(data), Equals, "", comment)
+				fmt.Fprintln(w, t.jsonResp)
+			default:
+				c.Fatalf("expected to get 1 request, now on %d", n)
+			}
+		})
+		args := []string{"debug", "seeding"}
+		if t.hasUnicode {
+			args = append(args, "--unicode=always")
+		}
+		rest, err := snap.Parser(snap.Client()).ParseArgs(args)
+		if t.expErr != "" {
+			c.Assert(err, ErrorMatches, t.expErr, comment)
+			c.Assert(s.Stdout(), Equals, "", comment)
+			c.Assert(s.Stderr(), Equals, t.expStderr, comment)
+			continue
+		}
+		c.Assert(err, IsNil, comment)
+		c.Assert(rest, DeepEquals, []string{}, comment)
+		c.Assert(s.Stdout(), Equals, t.expStdout, comment)
+		c.Assert(s.Stderr(), Equals, "", comment)
+		c.Assert(n, Equals, 1, comment)
+
+		s.ResetStdStreams()
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_download.go snapd-2.48.3+20.04/cmd/snap/cmd_download.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_download.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_download.go	2021-02-02 08:21:12.000000000 +0000
@@ -71,7 +71,7 @@
 	}})
 }
 
-func fetchSnapAssertions(tsto *image.ToolingStore, snapPath string, snapInfo *snap.Info) (string, error) {
+func fetchSnapAssertionsDirect(tsto *image.ToolingStore, snapPath string, snapInfo *snap.Info) (string, error) {
 	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
 		Backstore: asserts.NewMemoryBackstore(),
 		Trusted:   sysdb.Trusted(),
@@ -113,6 +113,43 @@
 `), assertPath, snapPath)
 }
 
+// for testing
+var downloadDirect = downloadDirectImpl
+
+func downloadDirectImpl(snapName string, revision snap.Revision, dlOpts image.DownloadOptions) error {
+	tsto, err := image.NewToolingStore()
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(Stdout, i18n.G("Fetching snap %q\n"), snapName)
+	snapPath, snapInfo, _, err := tsto.DownloadSnap(snapName, dlOpts)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(Stdout, i18n.G("Fetching assertions for %q\n"), snapName)
+	assertPath, err := fetchSnapAssertionsDirect(tsto, snapPath, snapInfo)
+	if err != nil {
+		return err
+	}
+	printInstallHint(assertPath, snapPath)
+	return nil
+}
+
+func (x *cmdDownload) downloadFromStore(snapName string, revision snap.Revision) error {
+	dlOpts := image.DownloadOptions{
+		TargetDir: x.TargetDir,
+		Basename:  x.Basename,
+		Channel:   x.Channel,
+		CohortKey: x.CohortKey,
+		Revision:  revision,
+		// if something goes wrong, don't force it to start over again
+		LeavePartialOnError: true,
+	}
+	return downloadDirect(snapName, revision, dlOpts)
+}
+
 func (x *cmdDownload) Execute(args []string) error {
 	if strings.ContainsRune(x.Basename, filepath.Separator) {
 		return fmt.Errorf(i18n.G("cannot specify a path in basename (use --target-dir for that)"))
@@ -143,33 +180,5 @@
 	}
 
 	snapName := string(x.Positional.Snap)
-
-	tsto, err := image.NewToolingStore()
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintf(Stdout, i18n.G("Fetching snap %q\n"), snapName)
-	dlOpts := image.DownloadOptions{
-		TargetDir: x.TargetDir,
-		Basename:  x.Basename,
-		Channel:   x.Channel,
-		CohortKey: x.CohortKey,
-		Revision:  revision,
-		// if something goes wrong, don't force it to start over again
-		LeavePartialOnError: true,
-	}
-	snapPath, snapInfo, _, err := tsto.DownloadSnap(snapName, dlOpts)
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintf(Stdout, i18n.G("Fetching assertions for %q\n"), snapName)
-	assertPath, err := fetchSnapAssertions(tsto, snapPath, snapInfo)
-	if err != nil {
-		return err
-	}
-	printInstallHint(assertPath, snapPath)
-
-	return nil
+	return x.downloadFromStore(snapName, revision)
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_download_test.go snapd-2.48.3+20.04/cmd/snap/cmd_download_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_download_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_download_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,19 +20,22 @@
 package main_test
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 
 	"gopkg.in/check.v1"
 
-	snap "github.com/snapcore/snapd/cmd/snap"
+	snapCmd "github.com/snapcore/snapd/cmd/snap"
+	"github.com/snapcore/snapd/image"
+	"github.com/snapcore/snapd/snap"
 )
 
 // these only cover errors that happen before hitting the network,
 // because we're not (yet!) mocking the tooling store
 
 func (s *SnapSuite) TestDownloadBadBasename(c *check.C) {
-	_, err := snap.Parser(snap.Client()).ParseArgs([]string{
+	_, err := snapCmd.Parser(snapCmd.Client()).ParseArgs([]string{
 		"download", "--basename=/foo", "a-snap",
 	})
 
@@ -40,7 +43,7 @@
 }
 
 func (s *SnapSuite) TestDownloadBadChannelCombo(c *check.C) {
-	_, err := snap.Parser(snap.Client()).ParseArgs([]string{
+	_, err := snapCmd.Parser(snapCmd.Client()).ParseArgs([]string{
 		"download", "--beta", "--channel=foo", "a-snap",
 	})
 
@@ -48,7 +51,7 @@
 }
 
 func (s *SnapSuite) TestDownloadCohortAndRevision(c *check.C) {
-	_, err := snap.Parser(snap.Client()).ParseArgs([]string{
+	_, err := snapCmd.Parser(snapCmd.Client()).ParseArgs([]string{
 		"download", "--cohort=what", "--revision=1234", "a-snap",
 	})
 
@@ -56,7 +59,7 @@
 }
 
 func (s *SnapSuite) TestDownloadChannelAndRevision(c *check.C) {
-	_, err := snap.Parser(snap.Client()).ParseArgs([]string{
+	_, err := snapCmd.Parser(snapCmd.Client()).ParseArgs([]string{
 		"download", "--beta", "--revision=1234", "a-snap",
 	})
 
@@ -64,7 +67,7 @@
 }
 
 func (s *SnapSuite) TestPrintInstalHint(c *check.C) {
-	snap.PrintInstallHint("foo_1.assert", "foo_1.snap")
+	snapCmd.PrintInstallHint("foo_1.assert", "foo_1.snap")
 	c.Check(s.Stdout(), check.Equals, `Install the snap with:
    snap ack foo_1.assert
    snap install foo_1.snap
@@ -75,10 +78,53 @@
 	c.Assert(err, check.IsNil)
 	as := filepath.Join(cwd, "some-dir/foo_1.assert")
 	sn := filepath.Join(cwd, "some-dir/foo_1.snap")
-	snap.PrintInstallHint(as, sn)
+	snapCmd.PrintInstallHint(as, sn)
 	c.Check(s.Stdout(), check.Equals, `Install the snap with:
    snap ack some-dir/foo_1.assert
    snap install some-dir/foo_1.snap
 `)
+}
+
+func (s *SnapSuite) TestDownloadDirect(c *check.C) {
+	var n int
+	restore := snapCmd.MockDownloadDirect(func(snapName string, revision snap.Revision, dlOpts image.DownloadOptions) error {
+		c.Check(snapName, check.Equals, "a-snap")
+		c.Check(revision, check.Equals, snap.R(0))
+		c.Check(dlOpts.Basename, check.Equals, "some-base-name")
+		c.Check(dlOpts.TargetDir, check.Equals, "some-target-dir")
+		c.Check(dlOpts.Channel, check.Equals, "some-channel")
+		c.Check(dlOpts.CohortKey, check.Equals, "some-cohort")
+		n++
+		return nil
+	})
+	defer restore()
+
+	// check that a direct download got issued
+	_, err := snapCmd.Parser(snapCmd.Client()).ParseArgs([]string{
+		"download",
+		"--target-directory=some-target-dir",
+		"--basename=some-base-name",
+		"--channel=some-channel",
+		"--cohort=some-cohort",
+		"a-snap"},
+	)
+	c.Assert(err, check.IsNil)
+	c.Check(n, check.Equals, 1)
+}
+
+func (s *SnapSuite) TestDownloadDirectErrors(c *check.C) {
+	var n int
+	restore := snapCmd.MockDownloadDirect(func(snapName string, revision snap.Revision, dlOpts image.DownloadOptions) error {
+		n++
+		return fmt.Errorf("some-error")
+	})
+	defer restore()
 
+	// check that a direct download got issued
+	_, err := snapCmd.Parser(snapCmd.Client()).ParseArgs([]string{
+		"download",
+		"a-snap"},
+	)
+	c.Assert(err, check.ErrorMatches, "some-error")
+	c.Check(n, check.Equals, 1)
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_help.go snapd-2.48.3+20.04/cmd/snap/cmd_help.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_help.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_help.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -170,9 +170,17 @@
 }
 
 type helpCategory struct {
-	Label       string
+	Label string
+	// Other is set if the category Commands should be listed
+	// together under "... Other" in the `snap help` list.
+	Other       bool
 	Description string
-	Commands    []string
+	// Commands list commands belonging to the category that should
+	// be listed under both `snap help` and "snap help --all`.
+	Commands []string
+	// AllOnlyCommands list commands belonging to the category that should
+	// be listed only under "snap help --all`.
+	AllOnlyCommands []string
 }
 
 // helpCategories helps us by grouping commands
@@ -180,11 +188,11 @@
 	{
 		Label:       i18n.G("Basics"),
 		Description: i18n.G("basic snap management"),
-		Commands:    []string{"find", "info", "install", "list", "remove"},
+		Commands:    []string{"find", "info", "install", "remove", "list"},
 	}, {
 		Label:       i18n.G("...more"),
 		Description: i18n.G("slightly more advanced snap management"),
-		Commands:    []string{"refresh", "revert", "switch", "disable", "enable"},
+		Commands:    []string{"refresh", "revert", "switch", "disable", "enable", "create-cohort"},
 	}, {
 		Label:       i18n.G("History"),
 		Description: i18n.G("manage system change transactions"),
@@ -194,33 +202,52 @@
 		Description: i18n.G("manage services"),
 		Commands:    []string{"services", "start", "stop", "restart", "logs"},
 	}, {
-		Label:       i18n.G("Commands"),
-		Description: i18n.G("manage aliases"),
-		Commands:    []string{"alias", "aliases", "unalias", "prefer"},
+		Label:       i18n.G("Permissions"),
+		Description: i18n.G("manage permissions"),
+		Commands:    []string{"connections", "interface", "connect", "disconnect"},
 	}, {
 		Label:       i18n.G("Configuration"),
 		Description: i18n.G("system administration and configuration"),
 		Commands:    []string{"get", "set", "unset", "wait"},
 	}, {
+		Label:       i18n.G("App Aliases"),
+		Description: i18n.G("manage aliases"),
+		Commands:    []string{"alias", "aliases", "unalias", "prefer"},
+	}, {
 		Label:       i18n.G("Account"),
 		Description: i18n.G("authentication to snapd and the snap store"),
 		Commands:    []string{"login", "logout", "whoami"},
 	}, {
-		Label:       i18n.G("Permissions"),
-		Description: i18n.G("manage permissions"),
-		Commands:    []string{"connections", "interface", "connect", "disconnect"},
+		Label:           i18n.G("Snapshots"),
+		Description:     i18n.G("archives of snap data"),
+		Commands:        []string{"saved", "save", "check-snapshot", "restore", "forget"},
+		AllOnlyCommands: []string{"export-snapshot", "import-snapshot"},
+	}, {
+		Label:       i18n.G("Device"),
+		Description: i18n.G("manage device"),
+		Commands:    []string{"model", "reboot", "recovery"},
+	}, {
+		Label:       i18n.G("Warnings"),
+		Other:       true,
+		Description: i18n.G("manage warnings"),
+		Commands:    []string{"warnings", "okay"},
+	}, {
+		Label:       i18n.G("Assertions"),
+		Other:       true,
+		Description: i18n.G("manage assertions"),
+		Commands:    []string{"known", "ack"},
 	}, {
-		Label:       i18n.G("Snapshots"),
-		Description: i18n.G("archives of snap data"),
-		Commands:    []string{"saved", "save", "check-snapshot", "restore", "forget"},
-	}, {
-		Label:       i18n.G("Other"),
-		Description: i18n.G("miscellanea"),
-		Commands:    []string{"version", "warnings", "okay", "ack", "known", "model", "create-cohort"},
-	}, {
-		Label:       i18n.G("Development"),
-		Description: i18n.G("developer-oriented features"),
-		Commands:    []string{"run", "pack", "try", "download", "prepare-image"},
+		Label:           i18n.G("Introspection"),
+		Other:           true,
+		Description:     i18n.G("introspection and debugging of snapd"),
+		Commands:        []string{"version"},
+		AllOnlyCommands: []string{"debug"},
+	},
+	{
+		Label:           i18n.G("Development"),
+		Description:     i18n.G("developer-oriented features"),
+		Commands:        []string{"download", "pack", "run", "try"},
+		AllOnlyCommands: []string{"prepare-image"},
 	},
 }
 
@@ -231,18 +258,18 @@
 enabling secure delivery and operation of the latest apps and utilities.
 `))
 	snapUsage               = i18n.G("Usage: snap <command> [<options>...]")
-	snapHelpCategoriesIntro = i18n.G("Commands can be classified as follows:")
+	snapHelpCategoriesIntro = i18n.G("Commonly used commands can be classified as follows:")
+	snapHelpAllIntro        = i18n.G("Commands can be classified as follows:")
 	snapHelpAllFooter       = i18n.G("For more information about a command, run 'snap help <command>'.")
 	snapHelpFooter          = i18n.G("For a short summary of all commands, run 'snap help --all'.")
 )
 
-func printHelpHeader() {
+func printHelpHeader(cmdsIntro string) {
 	fmt.Fprintln(Stdout, longSnapDescription)
 	fmt.Fprintln(Stdout)
 	fmt.Fprintln(Stdout, snapUsage)
 	fmt.Fprintln(Stdout)
-	fmt.Fprintln(Stdout, snapHelpCategoriesIntro)
-	fmt.Fprintln(Stdout)
+	fmt.Fprintln(Stdout, cmdsIntro)
 }
 
 func printHelpAllFooter() {
@@ -257,22 +284,45 @@
 
 // this is called when the Execute returns a flags.Error with ErrCommandRequired
 func printShortHelp() {
-	printHelpHeader()
-	maxLen := 0
+	printHelpHeader(snapHelpCategoriesIntro)
+	maxLen := utf8.RuneCountInString("... Other")
+	var otherCommands []string
+	var develCateg *helpCategory
 	for _, categ := range helpCategories {
+		if categ.Other {
+			otherCommands = append(otherCommands, categ.Commands...)
+			continue
+		}
+		if categ.Label == "Development" {
+			develCateg = &categ
+		}
 		if l := utf8.RuneCountInString(categ.Label); l > maxLen {
 			maxLen = l
 		}
 	}
+
+	fmt.Fprintln(Stdout)
 	for _, categ := range helpCategories {
+		// Other and Development will come last
+		if categ.Other || categ.Label == "Development" || len(categ.Commands) == 0 {
+			continue
+		}
 		fmt.Fprintf(Stdout, "%*s: %s\n", maxLen+2, categ.Label, strings.Join(categ.Commands, ", "))
 	}
+	// ... Other
+	if len(otherCommands) > 0 {
+		fmt.Fprintf(Stdout, "%*s: %s\n", maxLen+2, "... Other", strings.Join(otherCommands, ", "))
+	}
+	// Development last
+	if develCateg != nil && len(develCateg.Commands) > 0 {
+		fmt.Fprintf(Stdout, "%*s: %s\n", maxLen+2, "Development", strings.Join(develCateg.Commands, ", "))
+	}
 	printHelpFooter()
 }
 
 // this is "snap help --all"
 func printLongHelp(parser *flags.Parser) {
-	printHelpHeader()
+	printHelpHeader(snapHelpAllIntro)
 	maxLen := 0
 	for _, categ := range helpCategories {
 		for _, command := range categ.Commands {
@@ -280,6 +330,11 @@
 				maxLen = l
 			}
 		}
+		for _, command := range categ.AllOnlyCommands {
+			if l := len(command); l > maxLen {
+				maxLen = l
+			}
+		}
 	}
 
 	// flags doesn't have a LookupCommand?
@@ -289,10 +344,8 @@
 		cmdLookup[cmd.Name] = cmd
 	}
 
-	for _, categ := range helpCategories {
-		fmt.Fprintln(Stdout)
-		fmt.Fprintf(Stdout, "  %s (%s):\n", categ.Label, categ.Description)
-		for _, name := range categ.Commands {
+	listCmds := func(cmds []string) {
+		for _, name := range cmds {
 			cmd := cmdLookup[name]
 			if cmd == nil {
 				fmt.Fprintf(Stderr, "??? Cannot find command %q mentioned in help categories, please report!\n", name)
@@ -301,5 +354,12 @@
 			}
 		}
 	}
+
+	for _, categ := range helpCategories {
+		fmt.Fprintln(Stdout)
+		fmt.Fprintf(Stdout, "  %s (%s):\n", categ.Label, categ.Description)
+		listCmds(categ.Commands)
+		listCmds(categ.AllOnlyCommands)
+	}
 	printHelpAllFooter()
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_help_test.go snapd-2.48.3+20.04/cmd/snap/cmd_help_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_help_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_help_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -54,7 +54,9 @@
 			snap.LongSnapDescription,
 			"",
 			regexp.QuoteMeta(snap.SnapUsage),
-			"", ".*", "",
+			"",
+			snap.SnapHelpCategoriesIntro,
+			".*", "",
 			snap.SnapHelpAllFooter,
 			snap.SnapHelpFooter,
 		}, "\n")+`\s*`, comment)
@@ -75,7 +77,7 @@
 		"",
 		regexp.QuoteMeta(snap.SnapUsage),
 		"",
-		snap.SnapHelpCategoriesIntro,
+		snap.SnapHelpAllIntro,
 		"", ".*", "",
 		snap.SnapHelpAllFooter,
 	}, "\n")+`\s*`)
@@ -135,15 +137,19 @@
 		categorised[cmd] = true
 	}
 	seen := make(map[string]string, len(all))
-	for _, categ := range snap.HelpCategories {
-		for _, cmd := range categ.Commands {
+	seenCmds := func(cmds []string, label string) {
+		for _, cmd := range cmds {
 			categorised[cmd] = true
 			if seen[cmd] != "" {
-				c.Errorf("duplicated: %q in %q and %q", cmd, seen[cmd], categ.Label)
+				c.Errorf("duplicated: %q in %q and %q", cmd, seen[cmd], label)
 			}
-			seen[cmd] = categ.Label
+			seen[cmd] = label
 		}
 	}
+	for _, categ := range snap.HelpCategories {
+		seenCmds(categ.Commands, categ.Label)
+		seenCmds(categ.AllOnlyCommands, categ.Label)
+	}
 	for cmd := range all {
 		if !categorised[cmd] {
 			c.Errorf("uncategorised: %q", cmd)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_info.go snapd-2.48.3+20.04/cmd/snap/cmd_info.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_info.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_info.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,7 @@
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
+	"github.com/snapcore/snapd/client/clientutil"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
@@ -122,7 +122,7 @@
 		return nil, err
 	}
 
-	direct, err := cmd.ClientSnapFromSnapInfo(info)
+	direct, err := clientutil.ClientSnapFromSnapInfo(info, nil)
 	if err != nil {
 		return nil, err
 	}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_interfaces_test.go snapd-2.48.3+20.04/cmd/snap/cmd_interfaces_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_interfaces_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_interfaces_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -142,15 +142,14 @@
 	c.Assert(s.Stdout(), Equals, expectedStdout)
 	c.Assert(s.Stderr(), testutil.EqualsWrapped, InterfacesDeprecationNotice)
 
-	s.SetUpTest(c)
+	s.ResetStdStreams()
 	// should be the same
 	rest, err = Parser(Client()).ParseArgs([]string{"interfaces", "canonical-pi2"})
 	c.Assert(err, IsNil)
 	c.Assert(rest, DeepEquals, []string{})
 	c.Assert(s.Stdout(), Equals, expectedStdout)
 	c.Assert(s.Stderr(), testutil.EqualsWrapped, InterfacesDeprecationNotice)
-
-	s.SetUpTest(c)
+	s.ResetStdStreams()
 	// and the same again
 	rest, err = Parser(Client()).ParseArgs([]string{"interfaces", "keyboard-lights"})
 	c.Assert(err, IsNil)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_model.go snapd-2.48.3+20.04/cmd/snap/cmd_model.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_model.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_model.go	2021-02-02 08:21:12.000000000 +0000
@@ -54,8 +54,8 @@
 	errNoVerboseAssertion = errors.New(i18n.G("cannot use --verbose with --assertion"))
 
 	// this list is a "nice" "human" "readable" "ordering" of headers to print
-	// off, sorted in lexographical order with meta headers and primary key
-	// headers removed, and big nasty keys such as device-key-sha3-384 and
+	// off, sorted in lexical order with meta headers and primary key headers
+	// removed, and big nasty keys such as device-key-sha3-384 and
 	// device-key at the bottom
 	// it also contains both serial and model assertion headers, but we
 	// follow the same code path for both assertion types and some of the
@@ -68,6 +68,8 @@
 		"gadget",
 		"kernel",
 		"revision",
+		"store",
+		"system-user-authority",
 		"timestamp",
 		"required-snaps",
 		"device-key-sha3-384",
@@ -222,6 +224,14 @@
 		fmt.Fprintf(w, "model%s\t%s\n", separator, modelHeader)
 	}
 
+	// only output the grade if it is non-empty, either it is not in the model
+	// assertion for all non-uc20 model assertions, or it is non-empty and
+	// required for uc20 model assertions
+	grade := modelAssertion.HeaderString("grade")
+	if grade != "" {
+		fmt.Fprintf(w, "grade%s\t%s\n", separator, grade)
+	}
+
 	// serial is same for all variants
 	fmt.Fprintf(w, "serial%s\t%s\n", separator, serial)
 
@@ -241,7 +251,7 @@
 			// switch on which header it is to handle some special cases
 			switch headerName {
 			// list of scalars
-			case "required-snaps":
+			case "required-snaps", "system-user-authority":
 				headerIfaceList, ok := headerValue.([]interface{})
 				if !ok {
 					return invalidTypeErr
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_model_test.go snapd-2.48.3+20.04/cmd/snap/cmd_model_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_model_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_model_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,6 +37,10 @@
 base: core18
 gadget: pc=18
 kernel: pc-kernel=18
+store: mememestore
+system-user-authority:
+  - youyouyou
+  - mememe
 required-snaps:
   - core
   - hello-world
@@ -55,6 +59,50 @@
 85yK2e/NQ/fxSwQJMhBF74jM1z9arq6RMiE/KOleFAOraKn2hcROKnEeinABW+sOn6vNuMVv
 `
 
+const happyUC20ModelAssertionResponse = `type: model
+authority-id: testrootorg
+series: 16
+brand-id: testrootorg
+model: test-snapd-core-20-amd64
+architecture: amd64
+base: core20
+grade: secured
+snaps:
+  -
+    default-channel: 20/edge
+    id: UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH
+    name: pc
+    type: gadget
+  -
+    default-channel: 20/edge
+    id: pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza
+    name: pc-kernel
+    type: kernel
+  -
+    default-channel: latest/stable
+    id: DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q
+    name: core20
+    type: base
+  -
+    default-channel: latest/stable
+    id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
+    name: snapd
+    type: snapd
+timestamp: 2018-09-11T22:00:00+00:00
+sign-key-sha3-384: hIedp1AvrWlcDI4uS_qjoFLzjKl5enu4G2FYJpgB3Pj-tUzGlTQBxMBsBmi-tnJR
+
+AcLBUgQAAQoABgUCX06qogAAv10QAFaqQ0NDDvIB7LqM0xNIz+5Y6PB5wJaRk0HqVsg2LlNgS0PQ
+uJf0uFMV4GjQMraL7ZYv9BGyUoA+cz8Nbiz85m1g2ADt0ugqR/x2bAojii9lbFLmWpDMJcZhrtB1
+3k32lEUwqTMvzYTGiZ6TVug0KYbdmf2+5IGxsayAS3EwdrfbuGRHZOv6XGV7bmm1GEwCRAFvgHCk
+BHKoLZ+rfbNclF4l6G+biWJTdyc5jCMpMQ6X/INnx2hXaMRf9Jfrpl6s2bGCfsxW6HVf7AWZ8qHK
+jtWPQqJ6NFu2Kw1lYIA202ReK8DC3gfAlOeNzUG5dTPor3KwAoDJJI8ZaQypOazEhO9SHERIutbP
+eqPxPmEoB2+E0/o0+g0o5jK4qww3Yd7b8FTDkqm2xfuuldWAiAA4x6ZOQb2So9OLT6ovqHnD3D2r
+pLW/lhqwfKp3xzIVUrLi0sjGOVXu5xFDDRyFICZ6kwC7JynRGfHoa5E2y7rv8ehnOZQJ+esz9sgY
+lCJcyJ8vhabDlVHg0msSeNKMVBwhQnOSakEwlcfVyaSnapArkF+OCAMl8cuGpMTKO7vJLIJo2c2P
+jcVE0ftsTGs9eBi2HmdDhu3e3fmxHt9VcC4uRSOnYNVcJnMh0yVmG8RGS/Dqcz04II7llww6JJYG
+KKjQ3RU/TduXa8VJsoWiRRUYAv3H
+`
+
 const happyModelWithDisplayNameAssertionResponse = `type: model
 authority-id: mememe
 series: 16
@@ -65,6 +113,10 @@
 base: core18
 gadget: pc=18
 kernel: pc-kernel=18
+store: mememestore
+system-user-authority:
+  - youyouyou
+  - mememe
 required-snaps:
   - core
   - hello-world
@@ -131,6 +183,38 @@
 eg==
 `
 
+const happySerialUC20AssertionResponse = `type: serial
+authority-id: testrootorg
+brand-id: testrootorg
+model: test-snapd-core-20-amd64
+serial: 7777
+device-key:
+    AcbBTQRWhcGAARAAuKf9n7WvZDI7u3NzMkD8WN+dxCYrb0UE9XIaHcbrj0i2zJpxCtUtpzoEo7Uk
+    Cvxuhr2uBpzAa8fScwzOd77MGHIZQDpS7sFSkhYsSSN0m4sy8vRevsj0roN31fugCjRnhtLTkgxo
+    KSoAsK87vYnC+m5V5AHaRER7q1KgpUoVD7eLOJZyrd/tWecsLL9OK87yAQHdF/cVlQupOP6OU3fK
+    DllER6V2TD4jADK2Gyj2lDhy3F0+rE0a+zsGpmQQBorvzbozUHgBE3z/XjTTMrHYP4m+4V5HeWdn
+    rHt/x1LZ8wMTCMT1eeruclC82UPRgF0zWI+P7WgBqogJpCbfadhAj1zvKW+5vJ385n0BU7PoAZtA
+    KddBbsmEnfK/gWIxgFemIrYcYGhIBxYY6iNcygTYRFo4R9xm3bELHLG+viHggih4Lrjnb4sLHOdC
+    h3C4/45bY+6hSno8GQGlp4kYQQM8mrF9st51jIM6oyB84NtoySLYYE1wMeGNzDHSuI+1IiRmaTgy
+    Q2ImXTuqOhclhNA1sOi3R4H+oOBxe6GmoM5ATBPBqJeqUEvK8GpSRCig0QH4qMNF/abNKwvKhGMZ
+    LqtpFp5LNx7xYuAwoVkcq0nxQTsXctl3gJqY+lRx7mIeoXLZPKZyJees+5v96oa9lMdNX3f5UUpX
+    zq0cNhdgHrXZfcsAEQEAAQ==
+device-key-sha3-384: CZeO_5nJm_Rg0izosNfcQRoQj9nFtAmK2Y_tz4YjlKlvS93b_9gTDHuby5HHwi7d
+timestamp: 2020-09-03T14:42:47-05:00
+sign-key-sha3-384: hIedp1AvrWlcDI4uS_qjoFLzjKl5enu4G2FYJpgB3Pj-tUzGlTQBxMBsBmi-tnJR
+
+AcLBUgQAAQoABgUCX1FHNwAAqFoQABFiyzipoTYAuYN0Wd7cXuPPD7z+z+E+LoZZ+j4vUKqvnGX8
+tksb2nEEOQhjSvVof5pPOswWgq8Nj52dtYA20R5Zgfy0MZHHcCCfgxaRj6EiFyrG5h9l5wWMnzdb
+pXo9SJ3hxw6lKdj3n9RAAY0mACvw6f/trcyLeSxQ7EBm6X9c4ohJSjlHkKj0TlKkNTrFflko5aQH
+uJUk/YgsvMTZUHbgj6QKHlODUH8iRvOHxzn/Y9BlnzBsb/SyzvNTPeQyzFtd9QkESI2sWghviys2
+fGeEZPeXU6xts6Ht+xhr3mj5npZwkkL/6YxSzm9owQ0zGrfaFTswN+xoDKZ5498qRtSY3mCK/5xx
+kvWpOTHHhfvuS3GGyvRZOih7IAffDEwQsUNh8V9IjQNNTIkCYTPZz4WBM42mI8UgeDsnDImmcoc0
+GlqBeCxUigszJlEdUAHQklwW7Sgp13mceR3zB7BHgp4Sk7n0RyPuTQUA94ys6SeesK5YphwmhVed
+V02lkdeqRbGt3yZ/T5Zg8CIUIM0RKDSqoHgvoCMZh98dRGv6LPRj/P0RSWmjYWotjdK+lXK1fySM
+RXMNJIInZoC0x8qEwGLXVl5V3z8motLG71ie7PQ677W0dE9XM5LRnZHEKXP41jfaOO9vu12TtBsh
+pe/pnYDfIzU6OyOsdmkGWaWD+nbD
+`
+
 const noModelAssertionYetResponse = `
 {
 	"type": "error",
@@ -266,6 +350,17 @@
 `[1:],
 		},
 		{
+			comment: "normal uc20 serial and model asserts",
+			modelF:  simpleHappyResponder(happyUC20ModelAssertionResponse),
+			serialF: simpleHappyResponder(happySerialUC20AssertionResponse),
+			outText: `
+brand   MeMeMe (meuser*)
+model   test-snapd-core-20-amd64
+grade   secured
+serial  7777
+`[1:],
+		},
+		{
 			comment: "model assert has display-name",
 			modelF:  simpleHappyResponder(happyModelWithDisplayNameAssertionResponse),
 			serialF: simpleHappyResponder(happySerialAssertionResponse),
@@ -314,13 +409,17 @@
 	c.Assert(err, check.IsNil)
 	c.Assert(rest, check.DeepEquals, []string{})
 	c.Check(s.Stdout(), check.Equals, `
-brand-id:        mememe
-model:           test-model
-serial:          serialserial
-architecture:    amd64
-base:            core18
-gadget:          pc=18
-kernel:          pc-kernel=18
+brand-id:               mememe
+model:                  test-model
+serial:                 serialserial
+architecture:           amd64
+base:                   core18
+gadget:                 pc=18
+kernel:                 pc-kernel=18
+store:                  mememestore
+system-user-authority:  
+  - youyouyou
+  - mememe
 timestamp:       2017-07-27T00:00:00Z
 required-snaps:  
   - core
@@ -341,14 +440,18 @@
 	c.Assert(err, check.IsNil)
 	c.Assert(rest, check.DeepEquals, []string{})
 	c.Check(s.Stdout(), check.Equals, `
-brand-id:        mememe
-model:           test-model
-serial:          serialserial
-architecture:    amd64
-base:            core18
-display-name:    Model Name
-gadget:          pc=18
-kernel:          pc-kernel=18
+brand-id:               mememe
+model:                  test-model
+serial:                 serialserial
+architecture:           amd64
+base:                   core18
+display-name:           Model Name
+gadget:                 pc=18
+kernel:                 pc-kernel=18
+store:                  mememestore
+system-user-authority:  
+  - youyouyou
+  - mememe
 timestamp:       2017-07-27T00:00:00Z
 required-snaps:  
   - core
@@ -369,13 +472,17 @@
 	c.Assert(err, check.IsNil)
 	c.Assert(rest, check.DeepEquals, []string{})
 	c.Check(s.Stdout(), check.Equals, `
-brand-id:        mememe
-model:           test-model
-serial:          -- (device not registered yet)
-architecture:    amd64
-base:            core18
-gadget:          pc=18
-kernel:          pc-kernel=18
+brand-id:               mememe
+model:                  test-model
+serial:                 -- (device not registered yet)
+architecture:           amd64
+base:                   core18
+gadget:                 pc=18
+kernel:                 pc-kernel=18
+store:                  mememestore
+system-user-authority:  
+  - youyouyou
+  - mememe
 timestamp:       2017-07-27T00:00:00Z
 required-snaps:  
   - core
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_pack.go snapd-2.48.3+20.04/cmd/snap/cmd_pack.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_pack.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_pack.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,8 @@
 	"fmt"
 	"path/filepath"
 
+	"golang.org/x/xerrors"
+
 	"github.com/jessevdk/go-flags"
 
 	"github.com/snapcore/snapd/i18n"
@@ -114,7 +116,7 @@
 	if err != nil {
 		// TRANSLATORS: the %q is the snap-dir (the first positional
 		// argument to the command); the %v is an error
-		return fmt.Errorf(i18n.G("cannot pack %q: %v"), x.Positional.SnapDir, err)
+		return xerrors.Errorf(i18n.G("cannot pack %q: %w"), x.Positional.SnapDir, err)
 
 	}
 	// TRANSLATORS: %s is the path to the built snap file
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_prepare_image.go snapd-2.48.3+20.04/cmd/snap/cmd_prepare_image.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_prepare_image.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_prepare_image.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package main
 
 import (
+	"os"
 	"strings"
 
 	"github.com/jessevdk/go-flags"
@@ -110,6 +111,9 @@
 		opts.SnapChannels = snapChannels
 	}
 
+	// store-wide cohort key via env, see image/options.go
+	opts.WideCohortKey = os.Getenv("UBUNTU_STORE_COHORT_KEY")
+
 	opts.PrepareDir = x.Positional.TargetDir
 	opts.Classic = x.Classic
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_prepare_image_test.go snapd-2.48.3+20.04/cmd/snap/cmd_prepare_image_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_prepare_image_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_prepare_image_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,7 @@
 
 import (
 	. "gopkg.in/check.v1"
+	"os"
 
 	snap "github.com/snapcore/snapd/cmd/snap"
 	"github.com/snapcore/snapd/image"
@@ -92,6 +93,31 @@
 	})
 }
 
+func (s *SnapPrepareImageSuite) TestPrepareImageClassicWideCohort(c *C) {
+	var opts *image.Options
+	prep := func(o *image.Options) error {
+		opts = o
+		return nil
+	}
+	r := snap.MockImagePrepare(prep)
+	defer r()
+
+	os.Setenv("UBUNTU_STORE_COHORT_KEY", "is-six-centuries")
+
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"prepare-image", "--classic", "model", "prepare-dir"})
+	c.Assert(err, IsNil)
+	c.Assert(rest, DeepEquals, []string{})
+
+	c.Check(opts, DeepEquals, &image.Options{
+		Classic:       true,
+		WideCohortKey: "is-six-centuries",
+		ModelFile:     "model",
+		PrepareDir:    "prepare-dir",
+	})
+
+	os.Unsetenv("UBUNTU_STORE_COHORT_KEY")
+}
+
 func (s *SnapPrepareImageSuite) TestPrepareImageExtraSnaps(c *C) {
 	var opts *image.Options
 	prep := func(o *image.Options) error {
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_reboot.go snapd-2.48.3+20.04/cmd/snap/cmd_reboot.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_reboot.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_reboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,125 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"fmt"
+
+	"github.com/jessevdk/go-flags"
+
+	"github.com/snapcore/snapd/i18n"
+)
+
+type cmdReboot struct {
+	clientMixin
+	Positional struct {
+		Label string
+	} `positional-args:"true"`
+
+	RunMode     bool `long:"run"`
+	InstallMode bool `long:"install"`
+	RecoverMode bool `long:"recover"`
+}
+
+var shortRebootHelp = i18n.G("Reboot into selected system and mode")
+var longRebootHelp = i18n.G(`
+The reboot command reboots the system into a particular mode of the selected
+recovery system.
+
+When called without a system label and without a mode it will just
+trigger a regular reboot.
+
+When called without a system label but with a mode it will use the
+current system to enter the given mode.
+
+Note that "recover" and "run" modes are only available for the
+current system.
+`)
+
+func init() {
+	addCommand("reboot", shortRebootHelp, longRebootHelp, func() flags.Commander {
+		return &cmdReboot{}
+	}, map[string]string{
+		// TRANSLATORS: This should not start with a lowercase letter.
+		"run": i18n.G("Boot into run mode"),
+		// TRANSLATORS: This should not start with a lowercase letter.
+		"install": i18n.G("Boot into install mode"),
+		// TRANSLATORS: This should not start with a lowercase letter.
+		"recover": i18n.G("Boot into recover mode"),
+	}, []argDesc{
+		{
+			// TRANSLATORS: This needs to begin with < and end with >
+			name: i18n.G("<label>"),
+			// TRANSLATORS: This should not start with a lowercase letter.
+			desc: i18n.G("The recovery system label"),
+		},
+	})
+}
+
+func (x *cmdReboot) modeFromCommandline() (string, error) {
+	var mode string
+
+	for _, arg := range []struct {
+		enabled bool
+		mode    string
+	}{
+		{x.RunMode, "run"},
+		{x.RecoverMode, "recover"},
+		{x.InstallMode, "install"},
+	} {
+		if !arg.enabled {
+			continue
+		}
+		if mode != "" {
+			return "", fmt.Errorf(i18n.G("Please specify a single mode"))
+		}
+		mode = arg.mode
+	}
+
+	return mode, nil
+}
+
+func (x *cmdReboot) Execute(args []string) error {
+	if len(args) > 0 {
+		return ErrExtraArgs
+	}
+
+	mode, err := x.modeFromCommandline()
+	if err != nil {
+		return err
+	}
+
+	if err := x.client.RebootToSystem(x.Positional.Label, mode); err != nil {
+		return err
+	}
+
+	switch {
+	case x.Positional.Label != "" && mode != "":
+		fmt.Fprintf(Stdout, i18n.G("Reboot into %q %q mode.\n"), x.Positional.Label, mode)
+	case x.Positional.Label != "":
+		fmt.Fprintf(Stdout, i18n.G("Reboot into %q.\n"), x.Positional.Label)
+	case mode != "":
+		fmt.Fprintf(Stdout, i18n.G("Reboot into %q mode.\n"), mode)
+	default:
+		fmt.Fprintf(Stdout, i18n.G("Reboot\n"))
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_reboot_test.go snapd-2.48.3+20.04/cmd/snap/cmd_reboot_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_reboot_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_reboot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,168 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+
+	. "gopkg.in/check.v1"
+
+	snap "github.com/snapcore/snapd/cmd/snap"
+)
+
+func (s *SnapSuite) TestRebootHelp(c *C) {
+	msg := `Usage:
+  snap.test reboot [reboot-OPTIONS] [<label>]
+
+The reboot command reboots the system into a particular mode of the selected
+recovery system.
+
+When called without a system label and without a mode it will just
+trigger a regular reboot.
+
+When called without a system label but with a mode it will use the
+current system to enter the given mode.
+
+Note that "recover" and "run" modes are only available for the
+current system.
+
+[reboot command options]
+      --run        Boot into run mode
+      --install    Boot into install mode
+      --recover    Boot into recover mode
+
+[reboot command arguments]
+  <label>:         The recovery system label
+`
+	s.testSubCommandHelp(c, "reboot", msg)
+}
+
+func (s *SnapSuite) TestRebootHappy(c *C) {
+
+	for _, tc := range []struct {
+		cmdline          []string
+		expectedEndpoint string
+		expectedJSON     string
+		expectedMsg      string
+	}{
+		{
+			cmdline:          []string{"reboot"},
+			expectedEndpoint: "/v2/systems",
+			expectedJSON:     `{"action":"reboot","mode":""}`,
+			expectedMsg:      `Reboot`,
+		},
+		{
+			cmdline:          []string{"reboot", "--recover"},
+			expectedEndpoint: "/v2/systems",
+			expectedJSON:     `{"action":"reboot","mode":"recover"}`,
+			expectedMsg:      `Reboot into "recover" mode.`,
+		},
+		{
+			cmdline:          []string{"reboot", "20200101"},
+			expectedEndpoint: "/v2/systems/20200101",
+			expectedJSON:     `{"action":"reboot","mode":""}`,
+			expectedMsg:      `Reboot into "20200101".`,
+		},
+		{
+			cmdline:          []string{"reboot", "--recover", "20200101"},
+			expectedEndpoint: "/v2/systems/20200101",
+			expectedJSON:     `{"action":"reboot","mode":"recover"}`,
+			expectedMsg:      `Reboot into "20200101" "recover" mode.`,
+		},
+	} {
+
+		n := 0
+		s.ResetStdStreams()
+
+		s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+			switch n {
+			case 0:
+				c.Check(r.Method, Equals, "POST")
+				c.Check(r.URL.Path, Equals, tc.expectedEndpoint, Commentf("%v", tc.cmdline))
+				c.Check(r.URL.RawQuery, Equals, "")
+				body, err := ioutil.ReadAll(r.Body)
+				c.Check(err, IsNil)
+				c.Check(string(body), Equals, tc.expectedJSON+"\n")
+				fmt.Fprintln(w, `{"type": "sync", "result": {}}`)
+			default:
+				c.Fatalf("expected to get 1 requests, now on %d", n+1)
+			}
+
+			n++
+		})
+
+		// The server side will work out if the request is valid
+		rest, err := snap.Parser(snap.Client()).ParseArgs(tc.cmdline)
+		c.Assert(err, IsNil)
+		c.Assert(rest, DeepEquals, []string{})
+		c.Check(s.Stdout(), Equals, tc.expectedMsg+"\n", Commentf("%v", tc.cmdline))
+		c.Check(s.Stderr(), Equals, "")
+	}
+}
+
+func (s *SnapSuite) TestRebootUnhappy(c *C) {
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		c.Fatalf("server should not be hit in this test")
+	})
+
+	var tc = []struct {
+		args   []string
+		errStr string
+	}{
+		{
+			args:   []string{"reboot", "--run", "--recover", "20200101"},
+			errStr: "Please specify a single mode",
+		},
+		{
+			args:   []string{"reboot", "--unknown-mode", "20200101"},
+			errStr: "unknown flag `unknown-mode'",
+		},
+	}
+
+	for _, t := range tc {
+		_, err := snap.Parser(snap.Client()).ParseArgs(t.args)
+		c.Check(err, ErrorMatches, t.errStr, Commentf(strings.Join(t.args, " ")))
+	}
+}
+
+func (s *SnapSuite) TestRebootAPIFail(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch n {
+		case 0:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/systems/20200101")
+			c.Check(r.URL.RawQuery, Equals, "")
+			w.WriteHeader(404)
+			fmt.Fprintln(w, `{"type": "error", "status-code":404, "result": {"message":"requested system does not exist"}}`)
+		default:
+			c.Fatalf("expected to get 1 requests, now on %d", n+1)
+		}
+
+		n++
+	})
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"reboot", "--recover", "20200101"})
+	c.Assert(err, ErrorMatches, `cannot request system reboot into "20200101": requested system does not exist`)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "")
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_recovery.go snapd-2.48.3+20.04/cmd/snap/cmd_recovery.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_recovery.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_recovery.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,116 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/jessevdk/go-flags"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/i18n"
+	"github.com/snapcore/snapd/release"
+)
+
+type cmdRecovery struct {
+	clientMixin
+	colorMixin
+
+	ShowKeys bool `long:"show-keys"`
+}
+
+var shortRecoveryHelp = i18n.G("List available recovery systems")
+var longRecoveryHelp = i18n.G(`
+The recovery command lists the available recovery systems.
+
+With --show-keys it displays recovery keys that can be used to unlock the encrypted partitions if the device-specific automatic unlocking does not work.
+`)
+
+func init() {
+	addCommand("recovery", shortRecoveryHelp, longRecoveryHelp, func() flags.Commander {
+		// XXX: if we want more/nicer details we can add `snap recovery <system>` later
+		return &cmdRecovery{}
+	}, colorDescs.also(
+		map[string]string{
+			// TRANSLATORS: This should not start with a lowercase letter.
+			"show-keys": i18n.G("Show recovery keys (if available) to unlock encrypted partitions."),
+		}), nil)
+}
+
+func notesForSystem(sys *client.System) string {
+	if sys.Current {
+		return "current"
+	}
+	return "-"
+}
+
+func (x *cmdRecovery) showKeys(w io.Writer) error {
+	if release.OnClassic {
+		return errors.New(`command "show-keys" is not available on classic systems`)
+	}
+	var srk *client.SystemRecoveryKeysResponse
+	err := x.client.SystemRecoveryKeys(&srk)
+	if err != nil {
+		return err
+	}
+	fmt.Fprintf(w, "recovery:\t%s\n", srk.RecoveryKey)
+	fmt.Fprintf(w, "reinstall:\t%s\n", srk.ReinstallKey)
+	return nil
+}
+
+func (x *cmdRecovery) Execute(args []string) error {
+	if len(args) > 0 {
+		return ErrExtraArgs
+	}
+
+	esc := x.getEscapes()
+	w := tabWriter()
+	defer w.Flush()
+
+	if x.ShowKeys {
+		return x.showKeys(w)
+	}
+
+	systems, err := x.client.ListSystems()
+	if err != nil {
+		return err
+	}
+	if len(systems) == 0 {
+		fmt.Fprintf(Stderr, i18n.G("No recovery systems available.\n"))
+		return nil
+	}
+
+	fmt.Fprintf(w, i18n.G("Label\tBrand\tModel\tNotes\n"))
+	for _, sys := range systems {
+		// doing it this way because otherwise it's a sea of %s\t%s\t%s
+		line := []string{
+			sys.Label,
+			shortPublisher(esc, &sys.Brand),
+			sys.Model.Model,
+			notesForSystem(&sys),
+		}
+		fmt.Fprintln(w, strings.Join(line, "\t"))
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_recovery_test.go snapd-2.48.3+20.04/cmd/snap/cmd_recovery_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_recovery_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_recovery_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,194 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	"fmt"
+	"net/http"
+
+	. "gopkg.in/check.v1"
+
+	snap "github.com/snapcore/snapd/cmd/snap"
+	"github.com/snapcore/snapd/release"
+)
+
+func (s *SnapSuite) TestRecoveryHelp(c *C) {
+	msg := `Usage:
+  snap.test recovery [recovery-OPTIONS]
+
+The recovery command lists the available recovery systems.
+
+With --show-keys it displays recovery keys that can be used to unlock the
+encrypted partitions if the device-specific automatic unlocking does not work.
+
+[recovery command options]
+      --color=[auto|never|always]     Use a little bit of color to highlight
+                                      some things. (default: auto)
+      --unicode=[auto|never|always]   Use a little bit of Unicode to improve
+                                      legibility. (default: auto)
+      --show-keys                     Show recovery keys (if available) to
+                                      unlock encrypted partitions.
+`
+	s.testSubCommandHelp(c, "recovery", msg)
+}
+
+func (s *SnapSuite) TestRecovery(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch n {
+		case 0:
+			c.Check(r.Method, Equals, "GET")
+			c.Check(r.URL.Path, Equals, "/v2/systems")
+			c.Check(r.URL.RawQuery, Equals, "")
+			fmt.Fprintln(w, `{"type": "sync", "result": {
+        "systems": [
+           {
+                "current": true,
+                "label": "20200101",
+                "model": {
+                    "model": "model-id-1",
+                    "brand-id": "brand-id-1",
+                    "display-name": "Wonky Model"
+                },
+                "brand": {
+                    "id": "brand-id-1",
+                    "username": "brand-1",
+                    "display-name": "Wonky Publishing"
+                },
+                "actions": [
+                    {"title": "recover", "mode": "recover"},
+                    {"title": "reinstall", "mode": "install"}
+                ]
+           },
+           {
+                "label": "20200802",
+                "model": {
+                    "model": "model-id-2",
+                    "brand-id": "brand-id-1",
+                    "display-name": "Other Model"
+                },
+                "brand": {
+                    "id": "brand-id-2",
+                    "username": "brand-2",
+                    "display-name": "Other Publishing"
+                },
+                "actions": [
+                    {"title": "recover", "mode": "recover"},
+                    {"title": "reinstall", "mode": "install"}
+                ]
+           }
+        ]
+}}`)
+		default:
+			c.Fatalf("expected to get 1 requests, now on %d", n+1)
+		}
+
+		n++
+	})
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"recovery"})
+	c.Assert(err, IsNil)
+	c.Assert(rest, DeepEquals, []string{})
+	c.Check(s.Stdout(), Equals, `
+Label     Brand    Model       Notes
+20200101  brand-1  model-id-1  current
+20200802  brand-2  model-id-2  -
+`[1:])
+	c.Check(s.Stderr(), Equals, "")
+}
+
+func (s *SnapSuite) TestNoRecoverySystems(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch n {
+		case 0:
+			c.Check(r.Method, Equals, "GET")
+			c.Check(r.URL.Path, Equals, "/v2/systems")
+			c.Check(r.URL.RawQuery, Equals, "")
+			fmt.Fprintln(w, `{"type": "sync", "result": {}}`)
+		default:
+			c.Fatalf("expected to get 1 requests, now on %d", n+1)
+		}
+
+		n++
+	})
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"recovery"})
+	c.Assert(err, IsNil)
+	c.Assert(rest, DeepEquals, []string{})
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "No recovery systems available.\n")
+}
+
+func (s *SnapSuite) TestNoRecoverySystemsError(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch n {
+		case 0:
+			c.Check(r.Method, Equals, "GET")
+			c.Check(r.URL.Path, Equals, "/v2/systems")
+			c.Check(r.URL.RawQuery, Equals, "")
+			fmt.Fprintln(w, `{"type": "error", "result": {"message": "permission denied"}, "status-code": 403}`)
+		default:
+			c.Fatalf("expected to get 1 requests, now on %d", n+1)
+		}
+
+		n++
+	})
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"recovery"})
+	c.Check(err, ErrorMatches, `cannot list recovery systems: permission denied`)
+}
+
+func (s *SnapSuite) TestRecoveryShowRecoveryKeyOnClassicErrors(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		c.Fatalf("unexpected server call")
+	})
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"recovery", "--show-keys"})
+	c.Assert(err, ErrorMatches, `command "show-keys" is not available on classic systems`)
+}
+
+func (s *SnapSuite) TestRecoveryShowRecoveryKeyHappy(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch n {
+		case 0:
+			c.Check(r.Method, Equals, "GET")
+			c.Check(r.URL.Path, Equals, "/v2/system-recovery-keys")
+			c.Check(r.URL.RawQuery, Equals, "")
+			fmt.Fprintln(w, `{"type": "sync", "result": {"recovery-key": "61665-00531-54469-09783-47273-19035-40077-28287", "reinstall-key":"1234"}}`)
+		default:
+			c.Fatalf("expected to get 1 requests, now on %d", n+1)
+		}
+
+		n++
+	})
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"recovery", "--show-keys"})
+	c.Assert(err, IsNil)
+	c.Assert(rest, DeepEquals, []string{})
+	c.Check(s.Stdout(), Equals, `recovery:   61665-00531-54469-09783-47273-19035-40077-28287
+reinstall:  1234
+`)
+	c.Check(s.Stderr(), Equals, "")
+	c.Check(n, Equals, 1)
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_routine_console_conf.go snapd-2.48.3+20.04/cmd/snap/cmd_routine_console_conf.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_routine_console_conf.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_routine_console_conf.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,140 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/snapcore/snapd/client"
+
+	"github.com/jessevdk/go-flags"
+	"github.com/snapcore/snapd/i18n"
+)
+
+type cmdRoutineConsoleConfStart struct {
+	clientMixin
+}
+
+var shortRoutineConsoleConfStartHelp = i18n.G("Start console-conf snapd routine")
+var longRoutineConsoleConfStartHelp = i18n.G(`
+The console-conf-start command starts synchronization with console-conf
+
+This command is used by console-conf when it starts up. It delays refreshes if
+there are none currently ongoing, and exits with a specific error code if there
+are ongoing refreshes which console-conf should wait for before prompting the 
+user to begin configuring the device.
+`)
+
+// TODO: move these to their own package for unified time constants for how
+// often or long we do things like waiting for a reboot, etc. ?
+var snapdAPIInterval = 2 * time.Second
+var snapdWaitForFullSystemReboot = 10 * time.Minute
+
+func init() {
+	c := addRoutineCommand("console-conf-start", shortRoutineConsoleConfStartHelp, longRoutineConsoleConfStartHelp, func() flags.Commander {
+		return &cmdRoutineConsoleConfStart{}
+	}, nil, nil)
+	c.hidden = true
+}
+
+func printfFunc(msg string, format ...interface{}) func() {
+	return func() {
+		fmt.Fprintf(Stderr, msg, format...)
+	}
+}
+
+func (x *cmdRoutineConsoleConfStart) Execute(args []string) error {
+	var snapdReloadMsgOnce, systemReloadMsgOnce, snapRefreshMsgOnce sync.Once
+
+	for {
+		chgs, snaps, err := x.client.InternalConsoleConfStart()
+		if err != nil {
+			// snapd may be under maintenance right now, either for base/kernel
+			// snap refreshes which result in a reboot, or for snapd itself
+			// which just results in a restart of the daemon
+			maybeMaintErr := x.client.Maintenance()
+			if maybeMaintErr == nil {
+				// not a maintenance error, give up
+				return err
+			}
+
+			maintErr, ok := maybeMaintErr.(*client.Error)
+			if !ok {
+				// if cli.Maintenance() didn't return a client.Error we have very weird
+				// problems
+				return fmt.Errorf("internal error: client.Maintenance() didn't return a client.Error")
+			}
+
+			if maintErr.Kind == client.ErrorKindDaemonRestart {
+				// then we need to wait for snapd to restart, so keep trying
+				// the console-conf-start endpoint until it works
+				snapdReloadMsgOnce.Do(printfFunc("Snapd is reloading, please wait...\n"))
+
+				// we know that snapd isn't available because it is in
+				// maintenance so we don't gain anything by hitting it
+				// more frequently except for perhaps a quicker latency
+				// for the user when it comes back, but it will be busy
+				// doing things when it starts up anyways so it won't be
+				// able to respond immediately
+				time.Sleep(snapdAPIInterval)
+				continue
+			} else if maintErr.Kind == client.ErrorKindSystemRestart {
+				// system is rebooting, just wait for the reboot
+				systemReloadMsgOnce.Do(printfFunc("System is rebooting, please wait for reboot...\n"))
+				time.Sleep(snapdWaitForFullSystemReboot)
+				// if we didn't reboot after 10 minutes something's probably broken
+				return fmt.Errorf("system didn't reboot after 10 minutes even though snapd daemon is in maintenance")
+			}
+		}
+
+		if len(chgs) == 0 {
+			return nil
+		}
+
+		if len(snaps) == 0 {
+			// internal error if we have chg id's, but no snaps
+			return fmt.Errorf("internal error: returned changes (%v) but no snap names", chgs)
+		}
+
+		snapRefreshMsgOnce.Do(func() {
+			sort.Strings(snaps)
+
+			var snapNameList string
+			switch len(snaps) {
+			case 1:
+				snapNameList = snaps[0]
+			case 2:
+				snapNameList = fmt.Sprintf("%s and %s", snaps[0], snaps[1])
+			default:
+				// don't forget the oxford comma!
+				snapNameList = fmt.Sprintf("%s, and %s", strings.Join(snaps[:len(snaps)-1], ", "), snaps[len(snaps)-1])
+			}
+
+			fmt.Fprintf(Stderr, "Snaps (%s) are refreshing, please wait...\n", snapNameList)
+		})
+
+		// don't DDOS snapd by hitting it's API too often
+		time.Sleep(snapdAPIInterval)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_routine_console_conf_test.go snapd-2.48.3+20.04/cmd/snap/cmd_routine_console_conf_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_routine_console_conf_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_routine_console_conf_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,496 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/client"
+	snap "github.com/snapcore/snapd/cmd/snap"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func (s *SnapSuite) TestRoutineConsoleConfStartTrivialCase(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{"type":"sync", "status-code": 200, "result": {}}`)
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "")
+	c.Assert(n, Equals, 1)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartInconsistentAPIResponseError(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			// return just refresh changes but no snap ids
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"]
+				}
+			}`)
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, ErrorMatches, `internal error: returned changes .* but no snap names`)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "")
+	c.Assert(n, Equals, 1)
+
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartNonMaintenanceErrorReturned(c *C) {
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			// return internal server error
+			fmt.Fprintf(w, `{
+			"type":"error",
+			"status-code": 500,
+			"result": {
+				"message": "broken server"
+			}
+		}`)
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, ErrorMatches, "broken server")
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "")
+	c.Assert(n, Equals, 1)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartSingleSnap(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		// first 4 times we hit the API there is a snap refresh ongoing
+		case 1, 2, 3, 4:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			// return just refresh changes but no snap ids
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["pc-kernel"]
+				}
+			}`)
+		// 5th time we return nothing as we are done
+		case 5:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{"type":"sync", "status-code": 200, "result": {}}`)
+
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "Snaps (pc-kernel) are refreshing, please wait...\n")
+	c.Assert(n, Equals, 5)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartTwoSnaps(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		// first 4 times we hit the API there is a snap refresh ongoing
+		case 1, 2, 3, 4:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			// return just refresh changes but no snap ids
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["pc-kernel","core20"]
+				}
+			}`)
+		// 5th time we return nothing as we are done
+		case 5:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{"type":"sync", "status-code": 200, "result": {}}`)
+
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "Snaps (core20 and pc-kernel) are refreshing, please wait...\n")
+	c.Assert(n, Equals, 5)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartMultipleSnaps(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		// first 4 times we hit the API there are snap refreshes ongoing
+		case 1, 2, 3, 4:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["pc-kernel","snapd","core20","pc"]
+				}
+			}`)
+		// 5th time we return nothing as we are done
+		case 5:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{"type":"sync", "status-code": 200, "result": {}}`)
+
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), Equals, "Snaps (core20, pc, pc-kernel, and snapd) are refreshing, please wait...\n")
+	c.Assert(n, Equals, 5)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartSnapdRefreshMaintenanceJSON(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+
+	// write a maintenance.json before any requests and then the first request
+	// should fail and see the maintenance.json and then subsequent operations
+	// succeed
+	maintErr := client.Error{
+		Kind:    client.ErrorKindDaemonRestart,
+		Message: "daemon is restarting",
+	}
+	b, err := json.Marshal(&maintErr)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Dir(dirs.SnapdMaintenanceFile), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(dirs.SnapdMaintenanceFile, b, 0644)
+	c.Assert(err, IsNil)
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		// 1st time we don't respond at all to simulate what happens if the user
+		// triggers console-conf to start after snapd has shut down for a
+		// refresh
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+		// 2nd time we hit the API, return an in-progress refresh
+		case 2:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["snapd"]
+				}
+			}`)
+		// 3rd time we are actually done
+		case 3:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{"type":"sync", "status-code": 200, "result": {}}`)
+
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err = snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), testutil.Contains, "Snapd is reloading, please wait...\n")
+	c.Check(s.Stderr(), testutil.Contains, "Snaps (snapd) are refreshing, please wait...\n")
+	c.Assert(n, Equals, 3)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartSystemRebootMaintenanceJSON(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+
+	r = snap.MockSnapdWaitForFullSystemReboot(0)
+	defer r()
+
+	// write a maintenance.json before any requests and then the first request
+	// should fail and see the maintenance.json and then subsequent operations
+	// succeed
+	maintErr := client.Error{
+		Kind:    client.ErrorKindSystemRestart,
+		Message: "system is restarting",
+	}
+	b, err := json.Marshal(&maintErr)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Dir(dirs.SnapdMaintenanceFile), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(dirs.SnapdMaintenanceFile, b, 0644)
+	c.Assert(err, IsNil)
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+		// 1st time we don't respond at all to simulate what happens if the user
+		// triggers console-conf to start after snapd has shut down for a
+		// refresh
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err = snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, ErrorMatches, "system didn't reboot after 10 minutes even though snapd daemon is in maintenance")
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), testutil.Contains, "System is rebooting, please wait for reboot...\n")
+	c.Assert(n, Equals, 1)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartSnapdRefreshRestart(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+
+		// 1st time we hit the API there is a snapd snap refresh ongoing
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["snapd"]
+				}
+			}`)
+
+		// 2nd time we hit the API, set maintenance in the response
+		case 2:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["snapd"]
+				},
+				"maintenance": {
+					"kind": "daemon-restart",
+					"message": "daemon is restarting"
+				}
+			}`)
+
+		// 3rd time we return nothing as if we are down for maintenance
+		case 3:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+		// 4th time we resume responding, but still in progress
+		case 4:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["snapd"]
+				}
+			}`)
+
+		// 5th time we are actually done
+		case 5:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{"type":"sync", "status-code": 200, "result": {}}`)
+
+		default:
+			c.Errorf("unexpected request %v", n)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), testutil.Contains, "Snapd is reloading, please wait...\n")
+	c.Check(s.Stderr(), testutil.Contains, "Snaps (snapd) are refreshing, please wait...\n")
+	c.Assert(n, Equals, 5)
+}
+
+func (s *SnapSuite) TestRoutineConsoleConfStartKernelRefreshReboot(c *C) {
+	// make the command hit the API as fast as possible for testing
+	r := snap.MockSnapdAPIInterval(0)
+	defer r()
+	r = snap.MockSnapdWaitForFullSystemReboot(0)
+	defer r()
+
+	n := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		switch n {
+
+		// 1st time we hit the API there is a snapd snap refresh ongoing
+		case 1:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["pc-kernel"]
+				}
+			}`)
+
+		// 2nd time we hit the API, set maintenance in the response, but still
+		// give a valid response (so that it reads the maintenance)
+		case 2:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+
+			fmt.Fprintf(w, `{
+				"type":"sync",
+				"status-code": 200,
+				"result": {
+					"active-auto-refreshes": ["1"],
+					"active-auto-refresh-snaps": ["pc-kernel"]
+				},
+				"maintenance": {
+					"kind": "system-restart",
+					"message": "system is restarting"
+				}
+			}`)
+
+		// 3rd time we hit the API, we need to not return anything so that the
+		// client will inspect the error and see there is a maintenance error
+		case 3:
+			c.Check(r.Method, Equals, "POST")
+			c.Check(r.URL.Path, Equals, "/v2/internal/console-conf-start")
+		default:
+			c.Errorf("unexpected %s request (number %d) to %s", r.Method, n, r.URL.Path)
+		}
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"routine", "console-conf-start"})
+	// this is the internal error, which we will hit immediately for testing,
+	// in a real scenario a reboot would happen OOTB from the snap client
+	c.Assert(err, ErrorMatches, "system didn't reboot after 10 minutes even though snapd daemon is in maintenance")
+	c.Check(s.Stdout(), Equals, "")
+	c.Check(s.Stderr(), testutil.Contains, "System is rebooting, please wait for reboot...\n")
+	c.Check(s.Stderr(), testutil.Contains, "Snaps (pc-kernel) are refreshing, please wait...\n")
+	c.Assert(n, Equals, 3)
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_run.go snapd-2.48.3+20.04/cmd/snap/cmd_run.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_run.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_run.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 	"fmt"
 	"io"
 	"io/ioutil"
+	"net"
 	"os"
 	"os/exec"
 	"os/user"
@@ -38,12 +39,14 @@
 	"github.com/jessevdk/go-flags"
 
 	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/dbusutil"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/strace"
+	"github.com/snapcore/snapd/sandbox/cgroup"
 	"github.com/snapcore/snapd/sandbox/selinux"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snapenv"
@@ -74,6 +77,7 @@
 	// "default" and "optional-value" to distinguish this.
 	Strace    string `long:"strace" optional:"true" optional-value:"with-strace" default:"no-strace" default-mask:"-"`
 	Gdb       bool   `long:"gdb"`
+	Gdbserver string `long:"experimental-gdbserver" default:"no-gdbserver" optional-value:":0" optional:"true"`
 	TraceExec bool   `long:"trace-exec"`
 
 	// not a real option, used to check if cmdRun is initialized by
@@ -105,6 +109,8 @@
 			// TRANSLATORS: This should not start with a lowercase letter.
 			"gdb": i18n.G("Run the command with gdb"),
 			// TRANSLATORS: This should not start with a lowercase letter.
+			"experimental-gdbserver": i18n.G("Run the command with gdbserver (experimental)"),
+			// TRANSLATORS: This should not start with a lowercase letter.
 			"timer": i18n.G("Run as a timer service with given schedule"),
 			// TRANSLATORS: This should not start with a lowercase letter.
 			"trace-exec": i18n.G("Display exec calls timing data"),
@@ -180,6 +186,9 @@
 	logger.Debugf("system key mismatch detected, waiting for snapd to start responding...")
 
 	for i := 0; i < timeout; i++ {
+		// TODO: we could also check cli.Maintenance() here too in case snapd is
+		// down semi-permanently for a refresh, but what message do we show to
+		// the user or what do we do if we know snapd is down for maintenance?
 		if _, err := cli.SysInfo(); err == nil {
 			return nil
 		}
@@ -415,6 +424,7 @@
 }
 
 func (x *cmdRun) useStrace() bool {
+	// make sure the go-flag parser ran and assigned default values
 	return x.ParserRan == 1 && x.Strace != "no-strace"
 }
 
@@ -714,7 +724,7 @@
 		return nil
 	}
 
-	conn, err := dbus.SessionBus()
+	conn, err := dbusutil.SessionBus()
 	if err != nil {
 		return err
 	}
@@ -748,7 +758,73 @@
 
 type envForExecFunc func(extra map[string]string) []string
 
+var gdbServerWelcomeFmt = `
+Welcome to "snap run --gdbserver".
+You are right before your application is run.
+Please open a different terminal and run:
+
+gdb -ex="target remote %[1]s" -ex=continue -ex="signal SIGCONT"
+(gdb) continue
+
+or use your favorite gdb frontend and connect to %[1]s
+`
+
+func racyFindFreePort() (int, error) {
+	l, err := net.Listen("tcp", ":0")
+	if err != nil {
+		return 0, err
+	}
+	defer l.Close()
+	return l.Addr().(*net.TCPAddr).Port, nil
+}
+
+func (x *cmdRun) useGdbserver() bool {
+	// make sure the go-flag parser ran and assigned default values
+	return x.ParserRan == 1 && x.Gdbserver != "no-gdbserver"
+}
+
+func (x *cmdRun) runCmdUnderGdbserver(origCmd []string, envForExec envForExecFunc) error {
+	gcmd := exec.Command(origCmd[0], origCmd[1:]...)
+	gcmd.Stdin = os.Stdin
+	gcmd.Stdout = os.Stdout
+	gcmd.Stderr = os.Stderr
+	gcmd.Env = envForExec(map[string]string{"SNAP_CONFINE_RUN_UNDER_GDBSERVER": "1"})
+	if err := gcmd.Start(); err != nil {
+		return err
+	}
+	// wait for the child process executing gdb helper to raise SIGSTOP
+	// signalling readiness to attach a gdbserver process
+	var status syscall.WaitStatus
+	_, err := syscall.Wait4(gcmd.Process.Pid, &status, syscall.WSTOPPED, nil)
+	if err != nil {
+		return err
+	}
+
+	addr := x.Gdbserver
+	if addr == ":0" {
+		// XXX: run "gdbserver :0" instead and parse "Listening on port 45971"
+		//      on stderr instead?
+		port, err := racyFindFreePort()
+		if err != nil {
+			return fmt.Errorf("cannot find free port: %v", err)
+		}
+		addr = fmt.Sprintf(":%v", port)
+	}
+	// XXX: should we provide a helper here instead? something like
+	//      `snap run --attach-debugger` or similar? The downside
+	//      is that attaching a gdb frontend is harder?
+	fmt.Fprintf(Stdout, fmt.Sprintf(gdbServerWelcomeFmt, addr))
+	// note that only gdbserver needs to run as root, the application
+	// keeps running as the user
+	gdbSrvCmd := exec.Command("sudo", "-E", "gdbserver", "--attach", addr, strconv.Itoa(gcmd.Process.Pid))
+	if output, err := gdbSrvCmd.CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
+
 func (x *cmdRun) runCmdUnderGdb(origCmd []string, envForExec envForExecFunc) error {
+	// the resulting application process runs as root
 	cmd := []string{"sudo", "-E", "gdb", "-ex=run", "-ex=catch exec", "-ex=continue", "--args"}
 	cmd = append(cmd, origCmd...)
 
@@ -938,6 +1014,22 @@
 	}
 	if info.Base != "" {
 		cmd = append(cmd, "--base", info.Base)
+	} else {
+		if info.Type() == snap.TypeKernel {
+			// kernels have no explicit base, we use the boot base
+			modelAssertion, err := x.client.CurrentModelAssertion()
+			if err != nil {
+				if hook != "" {
+					return fmt.Errorf("cannot get model assertion to setup kernel hook run: %v", err)
+				} else {
+					return fmt.Errorf("cannot get model assertion to setup kernel app run: %v", err)
+				}
+			}
+			modelBase := modelAssertion.Base()
+			if modelBase != "" {
+				cmd = append(cmd, "--base", modelBase)
+			}
+		}
 	}
 	cmd = append(cmd, securityTag)
 
@@ -960,6 +1052,9 @@
 	if x.Gdb {
 		cmd = append(cmd, "--command=gdb")
 	}
+	if x.useGdbserver() {
+		cmd = append(cmd, "--command=gdbserver")
+	}
 	if x.Command != "" {
 		cmd = append(cmd, "--command="+x.Command)
 	}
@@ -1003,13 +1098,82 @@
 		return env.ForExecEscapeUnsafe(snapenv.PreservedUnsafePrefix)
 	}
 
+	// Systemd automatically places services under a unique cgroup encoding the
+	// security tag, but for apps and hooks we need to create a transient scope
+	// with similar purpose ourselves.
+	//
+	// The way this happens is as follows:
+	//
+	// 1) Services are implemented using systemd service units. Starting a
+	// unit automatically places it in a cgroup named after the service unit
+	// name. Snapd controls the name of the service units thus indirectly
+	// controls the cgroup name.
+	//
+	// 2) Non-services, including hooks, are started inside systemd
+	// transient scopes. Scopes are a systemd unit type that are defined
+	// programmatically and are meant for groups of processes started and
+	// stopped by an _arbitrary process_ (ie, not systemd). Systemd
+	// requires that each scope is given a unique name. We employ a scheme
+	// where random UUID is combined with the name of the security tag
+	// derived from snap application or hook name. Multiple concurrent
+	// invocations of "snap run" will use distinct UUIDs.
+	//
+	// Transient scopes allow launched snaps to integrate into
+	// the systemd design. See:
+	// https://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/
+	//
+	// Programs running as root, like system-wide services and programs invoked
+	// using tools like sudo are placed under system.slice. Programs running as
+	// a non-root user are placed under user.slice, specifically in a scope
+	// specific to a logind session.
+	//
+	// This arrangement allows for proper accounting and control of resources
+	// used by snap application processes of each type.
+	//
+	// For more information about systemd cgroups, including unit types, see:
+	// https://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/
+	_, appName := snap.SplitSnapApp(snapApp)
+	needsTracking := true
+	if app := info.Apps[appName]; hook == "" && app != nil && app.IsService() {
+		// If we are running a service app then we do not need to use
+		// application tracking. Services, both in the system and user scope,
+		// do not need tracking because systemd already places them in a
+		// tracking cgroup, named after the systemd unit name, and those are
+		// sufficient to identify both the snap name and the app name.
+		needsTracking = false
+	}
+	// Allow using the session bus for all apps but not for hooks.
+	allowSessionBus := hook == ""
+	// Track, or confirm existing tracking from systemd.
+	var trackingErr error
+	if needsTracking {
+		opts := &cgroup.TrackingOptions{AllowSessionBus: allowSessionBus}
+		trackingErr = cgroupCreateTransientScopeForTracking(securityTag, opts)
+	} else {
+		trackingErr = cgroupConfirmSystemdServiceTracking(securityTag)
+	}
+	if trackingErr != nil {
+		if trackingErr != cgroup.ErrCannotTrackProcess {
+			return trackingErr
+		}
+		// If we cannot track the process then log a debug message.
+		// TODO: if we could, create a warning. Currently this is not possible
+		// because only snapd can create warnings, internally.
+		logger.Debugf("snapd cannot track the started application")
+		logger.Debugf("snap refreshes will not be postponed by this process")
+	}
 	if x.TraceExec {
 		return x.runCmdWithTraceExec(cmd, envForExec)
 	} else if x.Gdb {
 		return x.runCmdUnderGdb(cmd, envForExec)
+	} else if x.useGdbserver() {
+		return x.runCmdUnderGdbserver(cmd, envForExec)
 	} else if x.useStrace() {
 		return x.runCmdUnderStrace(cmd, envForExec)
 	} else {
 		return syscallExec(cmd[0], cmd, envForExec(nil))
 	}
 }
+
+var cgroupCreateTransientScopeForTracking = cgroup.CreateTransientScopeForTracking
+var cgroupConfirmSystemdServiceTracking = cgroup.ConfirmSystemdServiceTracking
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_run_test.go snapd-2.48.3+20.04/cmd/snap/cmd_run_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_run_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_run_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,7 @@
 import (
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"os/user"
 	"path/filepath"
@@ -34,6 +35,7 @@
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/sandbox/cgroup"
 	"github.com/snapcore/snapd/sandbox/selinux"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
@@ -46,6 +48,9 @@
 apps:
  app:
   command: run-app
+ svc:
+  command: run-svc
+  daemon: simple
 hooks:
  configure:
 `)
@@ -81,6 +86,9 @@
 	s.AddCleanup(snaprun.MockUserCurrent(func() (*user.User, error) {
 		return &user.User{Uid: u.Uid, HomeDir: s.fakeHome}, nil
 	}))
+	s.AddCleanup(snaprun.MockCreateTransientScopeForTracking(func(string, *cgroup.TrackingOptions) error {
+		return nil
+	}))
 }
 
 func (s *RunSuite) TestInvalidParameters(c *check.C) {
@@ -559,6 +567,9 @@
 }
 
 func (s *RunSuite) TestSnapRunSnapdHelperPath(c *check.C) {
+	_, r := logger.MockLogger()
+	defer r()
+
 	var osReadlinkResult string
 	restore := snaprun.MockOsReadlink(func(name string) (string, error) {
 		return osReadlinkResult, nil
@@ -582,6 +593,15 @@
 			filepath.Join("/usr/bin/snap"),
 			filepath.Join(dirs.DistroLibExecDir, tool),
 		},
+		{
+			filepath.Join("/home/foo/ws/snapd/snap"),
+			filepath.Join(dirs.DistroLibExecDir, tool),
+		},
+		// unexpected case
+		{
+			filepath.Join(dirs.SnapMountDir, "snapd2/current/bin/snap"),
+			filepath.Join(dirs.DistroLibExecDir, tool),
+		},
 	} {
 		osReadlinkResult = t.readlink
 		toolPath, err := snaprun.SnapdHelperPath(tool)
@@ -1011,6 +1031,9 @@
 }
 
 func (s *RunSuite) TestRunCmdWithTraceExecUnhappy(c *check.C) {
+	_, r := logger.MockLogger()
+	defer r()
+
 	defer mockSnapConfine(dirs.DistroLibExecDir)()
 
 	// mock installed snap
@@ -1257,3 +1280,292 @@
 		{"systemctl", "is-system-running"},
 	})
 }
+
+func (s *RunSuite) TestSnapRunTrackingApps(c *check.C) {
+	restore := mockSnapConfine(filepath.Join(dirs.SnapMountDir, "core", "111", dirs.CoreLibExecDir))
+	defer restore()
+
+	// mock installed snap
+	snaptest.MockSnapCurrent(c, string(mockYaml), &snap.SideInfo{
+		Revision: snap.R("x2"),
+	})
+
+	// pretend to be running from core
+	restore = snaprun.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.SnapMountDir, "core/111/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	created := false
+	restore = snaprun.MockCreateTransientScopeForTracking(func(securityTag string, opts *cgroup.TrackingOptions) error {
+		c.Assert(securityTag, check.Equals, "snap.snapname.app")
+		c.Assert(opts, check.NotNil)
+		c.Assert(opts.AllowSessionBus, check.Equals, true)
+		created = true
+		return nil
+	})
+	defer restore()
+
+	restore = snaprun.MockConfirmSystemdServiceTracking(func(securityTag string) error {
+		panic("apps need to create a scope and do not use systemd service tracking")
+	})
+	defer restore()
+
+	// redirect exec
+	execArg0 := ""
+	execArgs := []string{}
+	execEnv := []string{}
+	restore = snaprun.MockSyscallExec(func(arg0 string, args []string, envv []string) error {
+		execArg0 = arg0
+		execArgs = args
+		execEnv = envv
+		return nil
+	})
+	defer restore()
+
+	// and run it!
+	rest, err := snaprun.Parser(snaprun.Client()).ParseArgs([]string{"run", "--", "snapname.app", "--arg1", "arg2"})
+	c.Assert(err, check.IsNil)
+	c.Assert(rest, check.DeepEquals, []string{"snapname.app", "--arg1", "arg2"})
+	c.Check(execArg0, check.Equals, filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"))
+	c.Check(execArgs, check.DeepEquals, []string{
+		filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"),
+		"snap.snapname.app",
+		filepath.Join(dirs.CoreLibExecDir, "snap-exec"),
+		"snapname.app", "--arg1", "arg2"})
+	c.Check(execEnv, testutil.Contains, "SNAP_REVISION=x2")
+	c.Assert(created, check.Equals, true)
+}
+
+func (s *RunSuite) TestSnapRunTrackingHooks(c *check.C) {
+	restore := mockSnapConfine(filepath.Join(dirs.SnapMountDir, "core", "111", dirs.CoreLibExecDir))
+	defer restore()
+
+	// mock installed snap
+	snaptest.MockSnapCurrent(c, string(mockYaml), &snap.SideInfo{
+		Revision: snap.R("x2"),
+	})
+
+	// pretend to be running from core
+	restore = snaprun.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.SnapMountDir, "core/111/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	created := false
+	restore = snaprun.MockCreateTransientScopeForTracking(func(securityTag string, opts *cgroup.TrackingOptions) error {
+		c.Assert(securityTag, check.Equals, "snap.snapname.hook.configure")
+		c.Assert(opts, check.NotNil)
+		c.Assert(opts.AllowSessionBus, check.Equals, false)
+		created = true
+		return nil
+	})
+	defer restore()
+
+	restore = snaprun.MockConfirmSystemdServiceTracking(func(securityTag string) error {
+		panic("hooks need to create a scope and do not use systemd service tracking")
+	})
+	defer restore()
+
+	// redirect exec
+	execArg0 := ""
+	execArgs := []string{}
+	execEnv := []string{}
+	restore = snaprun.MockSyscallExec(func(arg0 string, args []string, envv []string) error {
+		execArg0 = arg0
+		execArgs = args
+		execEnv = envv
+		return nil
+	})
+	defer restore()
+
+	// and run it!
+	rest, err := snaprun.Parser(snaprun.Client()).ParseArgs([]string{"run", "--hook", "configure", "-r", "x2", "snapname"})
+	c.Assert(err, check.IsNil)
+	c.Assert(rest, check.DeepEquals, []string{"snapname"})
+	c.Check(execArg0, check.Equals, filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"))
+	c.Check(execArgs, check.DeepEquals, []string{
+		filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"),
+		"snap.snapname.hook.configure",
+		filepath.Join(dirs.CoreLibExecDir, "snap-exec"),
+		"--hook=configure", "snapname"})
+	c.Check(execEnv, testutil.Contains, "SNAP_REVISION=x2")
+	c.Assert(created, check.Equals, true)
+}
+
+func (s *RunSuite) TestSnapRunTrackingServices(c *check.C) {
+	restore := mockSnapConfine(filepath.Join(dirs.SnapMountDir, "core", "111", dirs.CoreLibExecDir))
+	defer restore()
+
+	// mock installed snap
+	snaptest.MockSnapCurrent(c, string(mockYaml), &snap.SideInfo{
+		Revision: snap.R("x2"),
+	})
+
+	// pretend to be running from core
+	restore = snaprun.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.SnapMountDir, "core/111/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	restore = snaprun.MockCreateTransientScopeForTracking(func(securityTag string, opts *cgroup.TrackingOptions) error {
+		panic("services rely on systemd tracking, should not have created a transient scope")
+	})
+	defer restore()
+
+	confirmed := false
+	restore = snaprun.MockConfirmSystemdServiceTracking(func(securityTag string) error {
+		confirmed = true
+		c.Assert(securityTag, check.Equals, "snap.snapname.svc")
+		return nil
+	})
+	defer restore()
+
+	// redirect exec
+	execArg0 := ""
+	execArgs := []string{}
+	execEnv := []string{}
+	restore = snaprun.MockSyscallExec(func(arg0 string, args []string, envv []string) error {
+		execArg0 = arg0
+		execArgs = args
+		execEnv = envv
+		return nil
+	})
+	defer restore()
+
+	// and run it!
+	rest, err := snaprun.Parser(snaprun.Client()).ParseArgs([]string{"run", "--", "snapname.svc", "--arg1", "arg2"})
+	c.Assert(err, check.IsNil)
+	c.Assert(rest, check.DeepEquals, []string{"snapname.svc", "--arg1", "arg2"})
+	c.Check(execArg0, check.Equals, filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"))
+	c.Check(execArgs, check.DeepEquals, []string{
+		filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"),
+		"snap.snapname.svc",
+		filepath.Join(dirs.CoreLibExecDir, "snap-exec"),
+		"snapname.svc", "--arg1", "arg2"})
+	c.Check(execEnv, testutil.Contains, "SNAP_REVISION=x2")
+	c.Assert(confirmed, check.Equals, true)
+}
+
+func (s *RunSuite) TestSnapRunTrackingFailure(c *check.C) {
+	restore := mockSnapConfine(filepath.Join(dirs.SnapMountDir, "core", "111", dirs.CoreLibExecDir))
+	defer restore()
+
+	// mock installed snap
+	snaptest.MockSnapCurrent(c, string(mockYaml), &snap.SideInfo{
+		Revision: snap.R("x2"),
+	})
+
+	// pretend to be running from core
+	restore = snaprun.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.SnapMountDir, "core/111/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	created := false
+	restore = snaprun.MockCreateTransientScopeForTracking(func(securityTag string, opts *cgroup.TrackingOptions) error {
+		c.Assert(securityTag, check.Equals, "snap.snapname.app")
+		c.Assert(opts, check.NotNil)
+		c.Assert(opts.AllowSessionBus, check.Equals, true)
+		created = true
+		// Pretend that the tracking system was unable to track this application.
+		return cgroup.ErrCannotTrackProcess
+	})
+	defer restore()
+
+	restore = snaprun.MockConfirmSystemdServiceTracking(func(securityTag string) error {
+		panic("apps need to create a scope and do not use systemd service tracking")
+	})
+	defer restore()
+
+	// redirect exec
+	execArg0 := ""
+	execArgs := []string{}
+	execEnv := []string{}
+	restore = snaprun.MockSyscallExec(func(arg0 string, args []string, envv []string) error {
+		execArg0 = arg0
+		execArgs = args
+		execEnv = envv
+		return nil
+	})
+	defer restore()
+
+	// Capture the debug log that is printed by this test.
+	os.Setenv("SNAPD_DEBUG", "1")
+	defer os.Unsetenv("SNAPD_DEBUG")
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	// and run it!
+	rest, err := snaprun.Parser(snaprun.Client()).ParseArgs([]string{"run", "--", "snapname.app", "--arg1", "arg2"})
+	c.Assert(err, check.IsNil)
+	c.Assert(rest, check.DeepEquals, []string{"snapname.app", "--arg1", "arg2"})
+	c.Check(execArg0, check.Equals, filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"))
+	c.Check(execArgs, check.DeepEquals, []string{
+		filepath.Join(dirs.SnapMountDir, "/core/111", dirs.CoreLibExecDir, "snap-confine"),
+		"snap.snapname.app",
+		filepath.Join(dirs.CoreLibExecDir, "snap-exec"),
+		"snapname.app", "--arg1", "arg2"})
+	c.Check(execEnv, testutil.Contains, "SNAP_REVISION=x2")
+	c.Assert(created, check.Equals, true)
+
+	// Ensure that the debug message is printed.
+	c.Assert(logbuf.String(), testutil.Contains, "snapd cannot track the started application\n")
+}
+
+var mockKernelYaml = []byte(`name: pc-kernel
+type: kernel
+version: 1.0
+hooks:
+ fde-setup:
+`)
+
+func (s *RunSuite) TestSnapRunHookKernelImplicitBase(c *check.C) {
+	defer mockSnapConfine(dirs.DistroLibExecDir)()
+
+	nModel := 0
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v2/model":
+			switch nModel {
+			case 0:
+				c.Check(r.Method, check.Equals, "GET")
+				c.Check(r.URL.RawQuery, check.Equals, "")
+				fmt.Fprintln(w, happyUC20ModelAssertionResponse)
+			default:
+				c.Fatalf("expected to get 1 request for /v2/model, now on %d", nModel+1)
+			}
+			nModel++
+		}
+	})
+
+	// mock installed kernel
+	snaptest.MockSnapCurrent(c, string(mockKernelYaml), &snap.SideInfo{
+		Revision: snap.R(42),
+	})
+
+	// redirect exec
+	execArg0 := ""
+	execArgs := []string{}
+	execEnv := []string{}
+	restorer := snaprun.MockSyscallExec(func(arg0 string, args []string, envv []string) error {
+		execArg0 = arg0
+		execArgs = args
+		execEnv = envv
+		return nil
+	})
+	defer restorer()
+
+	// Run a hook from the active revision
+	_, err := snaprun.Parser(snaprun.Client()).ParseArgs([]string{"run", "--hook=fde-setup", "--", "pc-kernel"})
+	c.Assert(err, check.IsNil)
+	c.Check(execArg0, check.Equals, filepath.Join(dirs.DistroLibExecDir, "snap-confine"))
+	c.Check(execArgs, check.DeepEquals, []string{
+		filepath.Join(dirs.DistroLibExecDir, "snap-confine"),
+		"--base", "core20",
+		"snap.pc-kernel.hook.fde-setup",
+		filepath.Join(dirs.CoreLibExecDir, "snap-exec"),
+		"--hook=fde-setup", "pc-kernel"})
+	c.Check(execEnv, testutil.Contains, "SNAP_REVISION=42")
+	c.Check(nModel, check.Equals, 1)
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_services.go snapd-2.48.3+20.04/cmd/snap/cmd_services.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_services.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_services.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,7 +26,7 @@
 	"github.com/jessevdk/go-flags"
 
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
+	"github.com/snapcore/snapd/client/clientutil"
 	"github.com/snapcore/snapd/i18n"
 )
 
@@ -144,7 +144,7 @@
 		if svc.Active {
 			current = i18n.G("active")
 		}
-		fmt.Fprintf(w, "%s.%s\t%s\t%s\t%s\n", svc.Snap, svc.Name, startup, current, cmd.ClientAppInfoNotes(svc))
+		fmt.Fprintf(w, "%s.%s\t%s\t%s\t%s\n", svc.Snap, svc.Name, startup, current, clientutil.ClientAppInfoNotes(svc))
 	}
 
 	return nil
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_snap_op.go snapd-2.48.3+20.04/cmd/snap/cmd_snap_op.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_snap_op.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_snap_op.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,6 +35,7 @@
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap/channel"
 	"github.com/snapcore/snapd/strutil"
 )
@@ -57,11 +58,11 @@
 With no further options, the snaps are installed tracking the stable channel,
 with strict security confinement.
 
-Revision choice via the --revision override requires the the user to
+Revision choice via the --revision override requires the user to
 have developer access to the snap, either directly or through the
 store's collaboration feature, and to be logged in (see 'snap help login').
 
-Note a later refresh will typically undo a revision override, taking the snap
+Note that a later refresh will typically undo a revision override, taking the snap
 back to the current revision of the channel it's tracking.
 
 Use --name to set the instance name when installing from snap file.
@@ -73,6 +74,10 @@
 By default all the snap revisions are removed, including their data and the
 common data directory. When a --revision option is passed only the specified
 revision is removed.
+
+Unless automatic snapshots are disabled, a snapshot of all data for the snap is 
+saved upon removal, which is then available for future restoration with snap
+restore. The --purge option disables automatically creating snapshots.
 `)
 
 var longRefreshHelp = i18n.G(`
@@ -82,7 +87,7 @@
 With no further options, the snaps are refreshed to the current revision of the
 channel they're tracking, preserving their confinement options.
 
-Revision choice via the --revision override requires the the user to
+Revision choice via the --revision override requires the user to
 have developer access to the snap, either directly or through the
 store's collaboration feature, and to be logged in (see 'snap help login').
 
@@ -191,8 +196,8 @@
 		return x.removeOne(opts)
 	}
 
-	if x.Revision != "" {
-		return errors.New(i18n.G("a single snap name is needed to specify the revision"))
+	if x.Purge || x.Revision != "" {
+		return errors.New(i18n.G("a single snap name is needed to specify options"))
 	}
 	return x.removeMany(nil)
 }
@@ -308,6 +313,18 @@
 	return trackingRisk == currentRisk, nil
 }
 
+func maybeWithSudoSecurePath() bool {
+	// Some distributions set secure_path to a known list of paths in
+	// /etc/sudoers. The snapd package currently has no means of overwriting
+	// or extending that setting.
+	if _, isSet := os.LookupEnv("SUDO_UID"); !isSet {
+		return false
+	}
+	// Known distros setting secure_path that does not include
+	// $SNAP_MOUNT_DIR/bin:
+	return release.DistroLike("fedora", "opensuse", "debian")
+}
+
 // show what has been done
 func showDone(cli *client.Client, names []string, op string, opts *client.SnapOptions, esc *escapes) error {
 	snaps, err := cli.List(names, nil)
@@ -315,7 +332,7 @@
 		return err
 	}
 
-	needsPathWarning := !isSnapInPath()
+	needsPathWarning := !isSnapInPath() && !maybeWithSudoSecurePath()
 	for _, snap := range snaps {
 		channelStr := ""
 		if snap.Channel != "" {
@@ -457,8 +474,9 @@
 
 	Name string `long:"name"`
 
-	Cohort     string `long:"cohort"`
-	Positional struct {
+	Cohort        string `long:"cohort"`
+	IgnoreRunning bool   `long:"ignore-running" hidden:"yes"`
+	Positional    struct {
 		Snaps []remoteSnapName `positional-arg-name:"<snap>"`
 	} `positional-args:"yes" required:"yes"`
 }
@@ -574,11 +592,12 @@
 
 	dangerous := x.Dangerous || x.ForceDangerous
 	opts := &client.SnapOptions{
-		Channel:   x.Channel,
-		Revision:  x.Revision,
-		Dangerous: dangerous,
-		Unaliased: x.Unaliased,
-		CohortKey: x.Cohort,
+		Channel:       x.Channel,
+		Revision:      x.Revision,
+		Dangerous:     dangerous,
+		Unaliased:     x.Unaliased,
+		CohortKey:     x.Cohort,
+		IgnoreRunning: x.IgnoreRunning,
 	}
 	x.setModes(opts)
 
@@ -620,6 +639,7 @@
 	List             bool   `long:"list"`
 	Time             bool   `long:"time"`
 	IgnoreValidation bool   `long:"ignore-validation"`
+	IgnoreRunning    bool   `long:"ignore-running" hidden:"yes"`
 	Positional       struct {
 		Snaps []installedSnapName `positional-arg-name:"<snap>"`
 	} `positional-args:"yes"`
@@ -785,6 +805,7 @@
 			Amend:            x.Amend,
 			Channel:          x.Channel,
 			IgnoreValidation: x.IgnoreValidation,
+			IgnoreRunning:    x.IgnoreRunning,
 			Revision:         x.Revision,
 			CohortKey:        x.Cohort,
 			LeaveCohort:      x.LeaveCohort,
@@ -800,6 +821,9 @@
 	if x.IgnoreValidation {
 		return errors.New(i18n.G("a single snap name must be specified when ignoring validation"))
 	}
+	if x.IgnoreRunning {
+		return errors.New(i18n.G("a single snap name must be specified when ignoring running apps and hooks"))
+	}
 
 	return x.refreshMany(names, nil)
 }
@@ -953,8 +977,9 @@
 	waitMixin
 
 	modeMixin
-	Revision   string `long:"revision"`
-	Positional struct {
+	Revision      string `long:"revision"`
+	IgnoreRunning bool   `long:"ignore-running" hidden:"yes"`
+	Positional    struct {
 		Snap installedSnapName `positional-arg-name:"<snap>"`
 	} `positional-args:"yes" required:"yes"`
 }
@@ -979,7 +1004,10 @@
 	}
 
 	name := string(x.Positional.Snap)
-	opts := &client.SnapOptions{Revision: x.Revision}
+	opts := &client.SnapOptions{
+		Revision:      x.Revision,
+		IgnoreRunning: x.IgnoreRunning,
+	}
 	x.setModes(opts)
 	changeID, err := x.client.Revert(name, opts)
 	if err != nil {
@@ -1078,6 +1106,8 @@
 			"name": i18n.G("Install the snap file under the given instance name"),
 			// TRANSLATORS: This should not start with a lowercase letter.
 			"cohort": i18n.G("Install the snap in the given cohort"),
+			// TRANSLATORS: This should not start with a lowercase letter.
+			"ignore-running": i18n.G("Ignore running hooks or applications blocking the installation"),
 		}), nil)
 	addCommand("refresh", shortRefreshHelp, longRefreshHelp, func() flags.Commander { return &cmdRefresh{} },
 		colorDescs.also(waitDescs).also(channelDescs).also(modeDescs).also(timeDescs).also(map[string]string{
@@ -1092,6 +1122,8 @@
 			// TRANSLATORS: This should not start with a lowercase letter.
 			"ignore-validation": i18n.G("Ignore validation by other snaps blocking the refresh"),
 			// TRANSLATORS: This should not start with a lowercase letter.
+			"ignore-running": i18n.G("Ignore running hooks or applications blocking the refresh"),
+			// TRANSLATORS: This should not start with a lowercase letter.
 			"cohort": i18n.G("Refresh the snap into the given cohort"),
 			// TRANSLATORS: This should not start with a lowercase letter.
 			"leave-cohort": i18n.G("Refresh the snap out of its cohort"),
@@ -1102,6 +1134,8 @@
 	addCommand("revert", shortRevertHelp, longRevertHelp, func() flags.Commander { return &cmdRevert{} }, waitDescs.also(modeDescs).also(map[string]string{
 		// TRANSLATORS: This should not start with a lowercase letter.
 		"revision": i18n.G("Revert to the given revision"),
+		// TRANSLATORS: This should not start with a lowercase letter.
+		"ignore-running": i18n.G("Ignore running hooks or applications blocking the revert"),
 	}), nil)
 	addCommand("switch", shortSwitchHelp, longSwitchHelp, func() flags.Commander { return &cmdSwitch{} }, waitDescs.also(channelDescs).also(map[string]string{
 		// TRANSLATORS: This should not start with a lowercase letter.
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_snap_op_test.go snapd-2.48.3+20.04/cmd/snap/cmd_snap_op_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_snap_op_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_snap_op_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,7 @@
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -37,8 +38,8 @@
 	snap "github.com/snapcore/snapd/cmd/snap"
 	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/progress/progresstest"
+	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/testutil"
-	"os"
 )
 
 type snapOpTestServer struct {
@@ -206,6 +207,25 @@
 	c.Check(s.srv.n, check.Equals, s.srv.total)
 }
 
+func (s *SnapOpSuite) TestInstallIgnoreRunning(c *check.C) {
+	s.srv.checker = func(r *http.Request) {
+		c.Check(r.URL.Path, check.Equals, "/v2/snaps/foo")
+		c.Check(DecodedRequestBody(c, r), check.DeepEquals, map[string]interface{}{
+			"action":         "install",
+			"ignore-running": true,
+		})
+	}
+
+	s.RedirectClientToTestServer(s.srv.handle)
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"install", "--ignore-running", "foo"})
+	c.Assert(err, check.IsNil)
+	c.Assert(rest, check.DeepEquals, []string{})
+	c.Check(s.Stdout(), check.Matches, `(?sm).*foo 1.0 from Bar installed`)
+	c.Check(s.Stderr(), check.Equals, "")
+	// ensure that the fake server api was actually hit
+	c.Check(s.srv.n, check.Equals, s.srv.total)
+}
+
 func (s *SnapOpSuite) TestInstallNoPATH(c *check.C) {
 	// PATH restored by test tear down
 	os.Setenv("PATH", "/bin:/usr/bin:/sbin:/usr/sbin")
@@ -228,6 +248,34 @@
 	c.Check(s.srv.n, check.Equals, s.srv.total)
 }
 
+func (s *SnapOpSuite) TestInstallNoPATHMaybeResetBySudo(c *check.C) {
+	// PATH restored by test tear down
+	os.Setenv("PATH", "/bin:/usr/bin:/sbin:/usr/sbin")
+	if old, isset := os.LookupEnv("SUDO_UID"); isset {
+		defer os.Setenv("SUDO_UID", old)
+	}
+	os.Setenv("SUDO_UID", "1234")
+	restore := release.MockReleaseInfo(&release.OS{ID: "fedora"})
+	defer restore()
+	s.srv.checker = func(r *http.Request) {
+		c.Check(r.URL.Path, check.Equals, "/v2/snaps/foo")
+		c.Check(DecodedRequestBody(c, r), check.DeepEquals, map[string]interface{}{
+			"action":  "install",
+			"channel": "candidate",
+		})
+		s.srv.channel = "candidate"
+	}
+
+	s.RedirectClientToTestServer(s.srv.handle)
+	rest, err := snap.Parser(snap.Client()).ParseArgs([]string{"install", "--channel", "candidate", "foo"})
+	c.Assert(err, check.IsNil)
+	c.Assert(rest, check.DeepEquals, []string{})
+	c.Check(s.Stdout(), check.Matches, `(?sm).*foo \(candidate\) 1.0 from Bar installed`)
+	c.Check(s.Stderr(), check.HasLen, 0)
+	// ensure that the fake server api was actually hit
+	c.Check(s.srv.n, check.Equals, s.srv.total)
+}
+
 func (s *SnapOpSuite) TestInstallFromTrack(c *check.C) {
 	s.srv.checker = func(r *http.Request) {
 		c.Check(r.URL.Path, check.Equals, "/v2/snaps/foo")
@@ -1613,6 +1661,69 @@
 	c.Check(s.srv.n, check.Equals, s.srv.total)
 }
 
+func (s *SnapOpSuite) TestRemoveInsufficientDiskSpace(c *check.C) {
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, `{
+			"type": "error",
+			"result": {
+				"message": "disk space error",
+				"kind": "insufficient-disk-space",
+				"value": {
+					"snap-names": ["foo", "bar"],
+					"change-kind": "remove"
+				},
+				"status-code": 507
+				}}`)
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"remove", "foo"})
+	c.Check(err, check.ErrorMatches, `(?sm)cannot remove "foo", "bar" due to low disk space for automatic snapshot,.*use --purge to avoid creating a snapshot`)
+	c.Check(s.Stdout(), check.Equals, "")
+	c.Check(s.Stderr(), check.Equals, "")
+}
+
+func (s *SnapOpSuite) TestInstallInsufficientDiskSpace(c *check.C) {
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, `{
+			"type": "error",
+			"result": {
+				"message": "disk space error",
+				"kind": "insufficient-disk-space",
+				"value": {
+					"snap-names": ["foo"],
+					"change-kind": "install"
+				},
+				"status-code": 507
+				}}`)
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"install", "foo"})
+	c.Check(err, check.ErrorMatches, `cannot install "foo" due to low disk space`)
+	c.Check(s.Stdout(), check.Equals, "")
+	c.Check(s.Stderr(), check.Equals, "")
+}
+
+func (s *SnapOpSuite) TestRefreshInsufficientDiskSpace(c *check.C) {
+	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, `{
+			"type": "error",
+			"result": {
+				"message": "disk space error",
+				"kind": "insufficient-disk-space",
+				"value": {
+					"snap-names": ["foo"],
+					"change-kind": "refresh"
+				},
+				"status-code": 507
+				}}`)
+	})
+
+	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"refresh", "foo"})
+	c.Check(err, check.ErrorMatches, `cannot refresh "foo" due to low disk space`)
+	c.Check(s.Stdout(), check.Equals, "")
+	c.Check(s.Stderr(), check.Equals, "")
+}
+
 func (s *SnapOpSuite) TestRemoveRevision(c *check.C) {
 	s.srv.total = 3
 	s.srv.checker = func(r *http.Request) {
@@ -1633,10 +1744,12 @@
 	c.Check(s.srv.n, check.Equals, s.srv.total)
 }
 
-func (s *SnapOpSuite) TestRemoveManyRevision(c *check.C) {
+func (s *SnapOpSuite) TestRemoveManyOptions(c *check.C) {
 	s.RedirectClientToTestServer(nil)
 	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"remove", "--revision=17", "one", "two"})
-	c.Assert(err, check.ErrorMatches, `a single snap name is needed to specify the revision`)
+	c.Assert(err, check.ErrorMatches, `a single snap name is needed to specify options`)
+	_, err = snap.Parser(snap.Client()).ParseArgs([]string{"remove", "--purge", "one", "two"})
+	c.Assert(err, check.ErrorMatches, `a single snap name is needed to specify options`)
 }
 
 func (s *SnapOpSuite) TestRemoveMany(c *check.C) {
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_snapshot.go snapd-2.48.3+20.04/cmd/snap/cmd_snapshot.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_snapshot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_snapshot.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,8 @@
 
 import (
 	"fmt"
+	"io"
+	"os"
 	"strconv"
 	"strings"
 
@@ -36,11 +38,13 @@
 }
 
 var (
-	shortSavedHelp   = i18n.G("List currently stored snapshots")
-	shortSaveHelp    = i18n.G("Save a snapshot of the current data")
-	shortForgetHelp  = i18n.G("Delete a snapshot")
-	shortCheckHelp   = i18n.G("Check a snapshot")
-	shortRestoreHelp = i18n.G("Restore a snapshot")
+	shortSavedHelp          = i18n.G("List currently stored snapshots")
+	shortSaveHelp           = i18n.G("Save a snapshot of the current data")
+	shortForgetHelp         = i18n.G("Delete a snapshot")
+	shortCheckHelp          = i18n.G("Check a snapshot")
+	shortRestoreHelp        = i18n.G("Restore a snapshot")
+	shortExportSnapshotHelp = i18n.G("Export a snapshot")
+	shortImportSnapshotHelp = i18n.G("Import a snapshot")
 )
 
 var longSavedHelp = i18n.G(`
@@ -98,6 +102,15 @@
 restriction may be lifted in the future.
 `)
 
+var longExportSnapshotHelp = i18n.G(`
+Export a snapshot to the given filename.
+`)
+
+var longImportSnapshotHelp = i18n.G(`
+Import an exported snapshot set to the system. The snapshot is imported
+with a new snapshot ID and can be restored using the restore command.
+`)
+
 type savedCmd struct {
 	clientMixin
 	durationMixin
@@ -125,6 +138,7 @@
 		fmt.Fprintln(Stdout, i18n.G("No snapshots found."))
 		return nil
 	}
+
 	w := tabWriter()
 	defer w.Flush()
 
@@ -384,4 +398,126 @@
 				desc: i18n.G("The snap for which data will be verified"),
 			},
 		})
+
+	addCommand("export-snapshot",
+		shortExportSnapshotHelp,
+		longExportSnapshotHelp,
+		func() flags.Commander {
+			return &exportSnapshotCmd{}
+		}, nil, []argDesc{
+			{
+				name: "<id>",
+				// TRANSLATORS: This should not start with a lowercase letter.
+				desc: i18n.G("Set id of snapshot to export"),
+			},
+			{
+				// TRANSLATORS: This should retain < ... >. The file name is the name of an exported snapshot.
+				name: i18n.G("<filename>"),
+				// TRANSLATORS: This should not start with a lowercase letter.
+				desc: i18n.G("The filename of the export"),
+			},
+		})
+
+	addCommand("import-snapshot",
+		shortImportSnapshotHelp,
+		longImportSnapshotHelp,
+		func() flags.Commander {
+			return &importSnapshotCmd{}
+		}, nil, []argDesc{
+			{
+				name: "<filename>",
+				// TRANSLATORS: This should not start with a lowercase letter.
+				desc: i18n.G("Name of the snapshot export file to use"),
+			},
+		})
+}
+
+type exportSnapshotCmd struct {
+	clientMixin
+	Positional struct {
+		ID       snapshotID `positional-arg-name:"<id>"`
+		Filename string     `long:"filename"`
+	} `positional-args:"yes" required:"yes"`
+}
+
+func (x *exportSnapshotCmd) Execute([]string) (err error) {
+	setID, err := x.Positional.ID.ToUint()
+	if err != nil {
+		return err
+	}
+
+	r, expectedSize, err := x.client.SnapshotExport(setID)
+	if err != nil {
+		return err
+	}
+
+	filename := x.Positional.Filename
+	f, err := os.Create(filename + ".part")
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	defer func() {
+		if err != nil {
+			os.Remove(filename + ".part")
+		}
+	}()
+
+	// Pre-allocate the disk space for the snapshot, if the file system supports this.
+	if err := maybeReserveDiskSpace(f, expectedSize); err != nil {
+		return fmt.Errorf(i18n.G("cannot reserve disk space for snapshot: %v"), err)
+	}
+
+	n, err := io.Copy(f, r)
+	if err != nil {
+		return err
+	}
+	if n != expectedSize {
+		return fmt.Errorf(i18n.G("unexpected size, got: %v but wanted %v"), n, expectedSize)
+	}
+
+	if err := os.Rename(filename+".part", filename); err != nil {
+		return err
+	}
+
+	// TRANSLATORS: the first argument is the identifier of the snapshot, the second one is the file name.
+	fmt.Fprintf(Stdout, i18n.G("Exported snapshot #%s into %q\n"), x.Positional.ID, x.Positional.Filename)
+	return nil
+}
+
+type importSnapshotCmd struct {
+	clientMixin
+	durationMixin
+	Positional struct {
+		Filename string `long:"filename"`
+	} `positional-args:"yes" required:"yes"`
+}
+
+func (x *importSnapshotCmd) Execute([]string) error {
+	filename := x.Positional.Filename
+	f, err := os.Open(filename)
+	if err != nil {
+		return fmt.Errorf("error accessing file: %v", err)
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return fmt.Errorf("cannot stat file: %v", err)
+	}
+
+	importSet, err := x.client.SnapshotImport(f, st.Size())
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(Stdout, i18n.G("Imported snapshot as #%d\n"), importSet.ID)
+	// Now display the details about this snapshot, re-use the
+	// "snap saved" command for this which displays details about
+	// the snapshot.
+	y := &savedCmd{
+		clientMixin:   x.clientMixin,
+		durationMixin: x.durationMixin,
+		ID:            snapshotID(strconv.FormatUint(importSet.ID, 10)),
+	}
+	return y.Execute(nil)
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_snapshot_test.go snapd-2.48.3+20.04/cmd/snap/cmd_snapshot_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_snapshot_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_snapshot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,13 +21,17 @@
 
 import (
 	"fmt"
+	"io/ioutil"
 	"net/http"
+	"path/filepath"
 	"strings"
 	"time"
 
 	. "gopkg.in/check.v1"
 
-	"github.com/snapcore/snapd/cmd/snap"
+	"github.com/snapcore/snapd/client"
+	main "github.com/snapcore/snapd/cmd/snap"
+	"github.com/snapcore/snapd/strutil/quantity"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -64,6 +68,12 @@
 }, {
 	args:   "check-snapshot 4 snap1 snap2",
 	stdout: "Snapshot #4 of snaps \"snap1\", \"snap2\" verified successfully.\n",
+}, {
+	args:  "export-snapshot x snapshot-export.snapshot",
+	error: `invalid argument for snapshot set id: expected a non-negative integer argument \(see 'snap help saved'\)`,
+}, {
+	args:  "export-snapshot 1",
+	error: "the required argument `<filename>` was not provided",
 }}
 
 func (s *SnapSuite) TestSnapSnaphotsTest(c *C) {
@@ -86,9 +96,23 @@
 			c.Check(s.Stderr(), testutil.EqualsWrapped, test.stderr)
 			c.Check(s.Stdout(), testutil.MatchesWrapped, test.stdout)
 		}
+		c.Check("snapshot-export.snapshot", testutil.FileAbsent)
+		c.Check("snapshot-export.snapshot.part", testutil.FileAbsent)
 	}
 }
 
+func (s *SnapSuite) TestSnapshotExportHappy(c *C) {
+	s.mockSnapshotsServer(c)
+
+	exportedSnapshotPath := filepath.Join(c.MkDir(), "export-snapshot.snapshot")
+	_, err := main.Parser(main.Client()).ParseArgs([]string{"export-snapshot", "1", exportedSnapshotPath})
+	c.Check(err, IsNil)
+	c.Check(s.Stderr(), testutil.EqualsWrapped, "")
+	c.Check(s.Stdout(), testutil.MatchesWrapped, `Exported snapshot #1 into ".*/export-snapshot.snapshot"`)
+	c.Check(exportedSnapshotPath, testutil.FileEquals, "Hello World!")
+	c.Check(exportedSnapshotPath+".part", testutil.FileAbsent)
+}
+
 func (s *SnapSuite) mockSnapshotsServer(c *C) {
 	s.RedirectClientToTestServer(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
@@ -101,14 +125,45 @@
 					return
 				}
 				fmt.Fprintf(w, `{"type":"sync","status-code":200,"status":"OK","result":[{"id":1,"snapshots":[{"set":1,"time":%q,"snap":"htop","revision":"1168","snap-id":"Z","epoch":{"read":[0],"write":[0]},"summary":"","version":"2","sha3-384":{"archive.tgz":""},"size":1}]}]}`, snapshotTime)
-			} else {
-				w.WriteHeader(202)
-				fmt.Fprintln(w, `{"type":"async", "status-code": 202, "change": "9"}`)
+			}
+			if r.Method == "POST" {
+				if r.Header.Get("Content-Type") == client.SnapshotExportMediaType {
+					fmt.Fprintln(w, `{"type": "sync", "result": {"set-id": 42, "snaps": ["htop"]}}`)
+				} else {
+
+					w.WriteHeader(202)
+					fmt.Fprintln(w, `{"type":"async", "status-code": 202, "change": "9"}`)
+				}
 			}
 		case "/v2/changes/9":
 			fmt.Fprintln(w, `{"type": "sync", "result": {"ready": true, "status": "Done", "data": {}}}`)
+		case "/v2/snapshots/1/export":
+			w.Header().Set("Content-Type", client.SnapshotExportMediaType)
+			fmt.Fprint(w, "Hello World!")
 		default:
 			c.Errorf("unexpected path %q", r.URL.Path)
 		}
 	})
 }
+
+func (s *SnapSuite) TestSnapshotImportHappy(c *C) {
+	// mockSnapshotServer will return set-id 42 and three snaps for all
+	// import calls
+	s.mockSnapshotsServer(c)
+
+	// time may be crossing DST change, so the age value should not be
+	// hardcoded, otherwise we'll see failures for 2 montsh during the year
+	expectedAge := time.Since(time.Now().AddDate(0, -1, 0))
+	ageStr := quantity.FormatDuration(expectedAge.Seconds())
+
+	exportedSnapshotPath := filepath.Join(c.MkDir(), "mocked-snapshot.snapshot")
+	ioutil.WriteFile(exportedSnapshotPath, []byte("this is really snapshot zip file data"), 0644)
+
+	_, err := main.Parser(main.Client()).ParseArgs([]string{"import-snapshot", exportedSnapshotPath})
+	c.Check(err, IsNil)
+	c.Check(s.Stderr(), testutil.EqualsWrapped, "")
+	c.Check(s.Stdout(), testutil.MatchesWrapped, fmt.Sprintf(`Imported snapshot as #42
+Set  Snap  Age    Version  Rev   Size    Notes
+1    htop  %-6s 2        1168      1B  -
+`, ageStr))
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_userd.go snapd-2.48.3+20.04/cmd/snap/cmd_userd.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_userd.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_userd.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,8 +28,8 @@
 
 	"github.com/jessevdk/go-flags"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/i18n"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/usersession/agent"
 	"github.com/snapcore/snapd/usersession/autostart"
 	"github.com/snapcore/snapd/usersession/userd"
@@ -103,7 +103,7 @@
 	if err != nil {
 		return err
 	}
-	agent.Version = cmd.Version
+	agent.Version = snapdtool.Version
 	agent.Start()
 
 	ch, stop := signalNotify(syscall.SIGINT, syscall.SIGTERM)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_version.go snapd-2.48.3+20.04/cmd/snap/cmd_version.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_version.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_version.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,8 +25,8 @@
 	"github.com/jessevdk/go-flags"
 
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/i18n"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 var shortVersionHelp = i18n.G("Show version details")
@@ -48,15 +48,14 @@
 		return ErrExtraArgs
 	}
 
-	printVersions(cmd.client)
-	return nil
+	return printVersions(cmd.client)
 }
 
 func printVersions(cli *client.Client) error {
 	sv := serverVersion(cli)
 	w := tabWriter()
 
-	fmt.Fprintf(w, "snap\t%s\n", cmd.Version)
+	fmt.Fprintf(w, "snap\t%s\n", snapdtool.Version)
 	fmt.Fprintf(w, "snapd\t%s\n", sv.Version)
 	fmt.Fprintf(w, "series\t%s\n", sv.Series)
 	if sv.OnClassic {
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_version_test.go snapd-2.48.3+20.04/cmd/snap/cmd_version_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_version_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_version_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,7 @@
 	. "gopkg.in/check.v1"
 
 	snap "github.com/snapcore/snapd/cmd/snap"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 func (s *SnapSuite) TestVersionCommandOnClassic(c *C) {
@@ -34,7 +35,7 @@
 	})
 	restore := mockArgs("snap", "version")
 	defer restore()
-	restore = mockVersion("4.56")
+	restore = snapdtool.MockVersion("4.56")
 	defer restore()
 
 	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"version"})
@@ -49,7 +50,7 @@
 	})
 	restore := mockArgs("snap", "--version")
 	defer restore()
-	restore = mockVersion("4.56")
+	restore = snapdtool.MockVersion("4.56")
 	defer restore()
 
 	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"version"})
@@ -64,7 +65,7 @@
 	})
 	restore := mockArgs("snap", "version")
 	defer restore()
-	restore = mockVersion("4.56")
+	restore = snapdtool.MockVersion("4.56")
 	defer restore()
 
 	_, err := snap.Parser(snap.Client()).ParseArgs([]string{"version"})
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/cmd_warnings.go snapd-2.48.3+20.04/cmd/snap/cmd_warnings.go
--- snapd-2.45.1+20.04.2/cmd/snap/cmd_warnings.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/cmd_warnings.go	2021-02-02 08:21:12.000000000 +0000
@@ -159,7 +159,7 @@
 }
 
 func writeWarningTimestamp(t time.Time) error {
-	user, err := osutil.RealUser()
+	user, err := osutil.UserMaybeSudoUser()
 	if err != nil {
 		return err
 	}
@@ -189,7 +189,7 @@
 }
 
 func lastWarningTimestamp() (time.Time, error) {
-	user, err := osutil.RealUser()
+	user, err := osutil.UserMaybeSudoUser()
 	if err != nil {
 		return time.Time{}, fmt.Errorf("cannot determine real user: %v", err)
 	}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/error.go snapd-2.48.3+20.04/cmd/snap/error.go
--- snapd-2.45.1+20.04.2/cmd/snap/error.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/error.go	2021-02-02 08:21:12.000000000 +0000
@@ -125,8 +125,8 @@
 				snapName = errValStr
 			}
 		}
-	case client.ErrorKindChannelNotAvailable,
-		client.ErrorKindArchitectureNotAvailable:
+	case client.ErrorKindSnapChannelNotAvailable,
+		client.ErrorKindSnapArchitectureNotAvailable:
 		values, ok := err.Value.(map[string]interface{})
 		if ok {
 			candName, _ := values["snap-name"].(string)
@@ -144,7 +144,7 @@
 			}
 		}
 		fallthrough
-	case client.ErrorKindRevisionNotAvailable:
+	case client.ErrorKindSnapRevisionNotAvailable:
 		if snapName == "" {
 			errValStr, ok := err.Value.(string)
 			if ok && errValStr != "" {
@@ -207,7 +207,7 @@
 		}
 	case client.ErrorKindSnapLocal:
 		msg = i18n.G("local snap %q is unknown to the store, use --amend to proceed anyway")
-	case client.ErrorKindNoUpdateAvailable:
+	case client.ErrorKindSnapNoUpdateAvailable:
 		isError = false
 		msg = i18n.G("snap %q has no updates available")
 	case client.ErrorKindSnapNotInstalled:
@@ -222,6 +222,31 @@
 		isError = false
 		usesSnapName = false
 		msg = i18n.G("snapd is about to reboot the system")
+	case client.ErrorKindInsufficientDiskSpace:
+		// this error carries multiple snap names
+		usesSnapName = false
+		values, ok := err.Value.(map[string]interface{})
+		if ok {
+			changeKind, _ := values["change-kind"].(string)
+			snaps, _ := values["snap-names"].([]interface{})
+			snapNames := make([]string, len(snaps))
+			for i, v := range snaps {
+				snapNames[i] = fmt.Sprint(v)
+			}
+			names := strutil.Quoted(snapNames)
+			switch changeKind {
+			case "remove":
+				msg = fmt.Sprintf(i18n.G("cannot remove %s due to low disk space for automatic snapshot, use --purge to avoid creating a snapshot"), names)
+			case "install":
+				msg = fmt.Sprintf(i18n.G("cannot install %s due to low disk space"), names)
+			case "refresh":
+				msg = fmt.Sprintf(i18n.G("cannot refresh %s due to low disk space"), names)
+			default:
+				msg = err.Error()
+			}
+			break
+		}
+		fallthrough
 	default:
 		usesSnapName = false
 		msg = err.Message
@@ -239,7 +264,7 @@
 	return msg, nil
 }
 
-func snapRevisionNotAvailableMessage(kind, snapName, action, arch, snapChannel string, releases []interface{}) string {
+func snapRevisionNotAvailableMessage(kind client.ErrorKind, snapName, action, arch, snapChannel string, releases []interface{}) string {
 	// releases contains all available (arch x channel)
 	// as reported by the store through the daemon
 	req, err := channel.Parse(snapChannel, arch)
@@ -276,7 +301,7 @@
 	}
 
 	// no release is for this architecture
-	if kind == client.ErrorKindArchitectureNotAvailable {
+	if kind == client.ErrorKindSnapArchitectureNotAvailable {
 		// TODO: add "Get more information..." hints once snap info
 		// support showing multiple/all archs
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/export_test.go snapd-2.48.3+20.04/cmd/snap/export_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,7 +28,9 @@
 
 	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/image"
+	"github.com/snapcore/snapd/sandbox/cgroup"
 	"github.com/snapcore/snapd/sandbox/selinux"
+	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/store"
 )
 
@@ -70,6 +72,7 @@
 	LongSnapDescription     = longSnapDescription
 	SnapUsage               = snapUsage
 	SnapHelpCategoriesIntro = snapHelpCategoriesIntro
+	SnapHelpAllIntro        = snapHelpAllIntro
 	SnapHelpAllFooter       = snapHelpAllFooter
 	SnapHelpFooter          = snapHelpFooter
 	HelpCategories          = helpCategories
@@ -326,6 +329,22 @@
 
 type ServiceName = serviceName
 
+func MockCreateTransientScopeForTracking(fn func(securityTag string, opts *cgroup.TrackingOptions) error) (restore func()) {
+	old := cgroupCreateTransientScopeForTracking
+	cgroupCreateTransientScopeForTracking = fn
+	return func() {
+		cgroupCreateTransientScopeForTracking = old
+	}
+}
+
+func MockConfirmSystemdServiceTracking(fn func(securityTag string) error) (restore func()) {
+	old := cgroupConfirmSystemdServiceTracking
+	cgroupConfirmSystemdServiceTracking = fn
+	return func() {
+		cgroupConfirmSystemdServiceTracking = old
+	}
+}
+
 func MockApparmorSnapAppFromPid(f func(pid int) (string, string, string, error)) (restore func()) {
 	old := apparmorSnapAppFromPid
 	apparmorSnapAppFromPid = f
@@ -357,3 +376,27 @@
 		ioutilTempDir = old
 	}
 }
+
+func MockDownloadDirect(f func(snapName string, revision snap.Revision, dlOpts image.DownloadOptions) error) (restore func()) {
+	old := downloadDirect
+	downloadDirect = f
+	return func() {
+		downloadDirect = old
+	}
+}
+
+func MockSnapdAPIInterval(t time.Duration) (restore func()) {
+	old := snapdAPIInterval
+	snapdAPIInterval = t
+	return func() {
+		snapdAPIInterval = old
+	}
+}
+
+func MockSnapdWaitForFullSystemReboot(t time.Duration) (restore func()) {
+	old := snapdWaitForFullSystemReboot
+	snapdWaitForFullSystemReboot = t
+	return func() {
+		snapdWaitForFullSystemReboot = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/fallocate_darwin.go snapd-2.48.3+20.04/cmd/snap/fallocate_darwin.go
--- snapd-2.45.1+20.04.2/cmd/snap/fallocate_darwin.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/fallocate_darwin.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,28 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"os"
+)
+
+func maybeReserveDiskSpace(f *os.File, size int64) error {
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/fallocate_linux.go snapd-2.48.3+20.04/cmd/snap/fallocate_linux.go
--- snapd-2.45.1+20.04.2/cmd/snap/fallocate_linux.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/fallocate_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,35 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"os"
+	"syscall"
+)
+
+func maybeReserveDiskSpace(f *os.File, size int64) error {
+	const fallocKeepSize = 1 // This is FALLOC_FL_KEEP_SIZE
+	if err := syscall.Fallocate(int(f.Fd()), fallocKeepSize, 0, size); err != nil {
+		if err != syscall.EOPNOTSUPP && err != syscall.ENOSYS {
+			return err
+		}
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/main.go snapd-2.48.3+20.04/cmd/snap/main.go
--- snapd-2.45.1+20.04.2/cmd/snap/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,24 +30,27 @@
 	"unicode"
 	"unicode/utf8"
 
+	"golang.org/x/xerrors"
+
 	"github.com/jessevdk/go-flags"
 
 	"golang.org/x/crypto/ssh/terminal"
 
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/squashfs"
 	"github.com/snapcore/snapd/snapdenv"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 func init() {
 	// set User-Agent for when 'snap' talks to the store directly (snap download etc...)
-	snapdenv.SetUserAgentFromVersion(cmd.Version, nil, "snap")
+	snapdenv.SetUserAgentFromVersion(snapdtool.Version, nil, "snap")
 
 	if osutil.GetenvBool("SNAPD_DEBUG") || snapdenv.Testing() {
 		// in tests or when debugging, enforce the "tidy" lint checks
@@ -350,7 +353,6 @@
 	})
 	// Add the debug command
 	debugCommand, err := parser.AddCommand("debug", shortDebugHelp, longDebugHelp, &cmdDebug{})
-	debugCommand.Hidden = true
 	if err != nil {
 		logger.Panicf("cannot add command %q: %v", "debug", err)
 	}
@@ -424,8 +426,30 @@
 	return snapApp, nil
 }
 
+// exitCodeFromError takes an error and returns specific exit codes
+// for some errors. Otherwise the generic exit code 1 is returned.
+func exitCodeFromError(err error) int {
+	var mksquashfsError squashfs.MksquashfsError
+	var cmdlineFlagsError *flags.Error
+	var unknownCmdError unknownCommandError
+
+	switch {
+	case err == nil:
+		return 0
+	case client.IsRetryable(err):
+		return 10
+	case xerrors.As(err, &mksquashfsError):
+		return 20
+	case xerrors.As(err, &cmdlineFlagsError) || xerrors.As(err, &unknownCmdError):
+		// EX_USAGE, see sysexit.h
+		return 64
+	default:
+		return 1
+	}
+}
+
 func main() {
-	cmd.ExecInSnapdOrCoreSnap()
+	snapdtool.ExecInSnapdOrCoreSnap()
 
 	// check for magic symlink to /usr/bin/snap:
 	// 1. symlink from command-not-found to /usr/bin/snap: run c-n-f
@@ -481,10 +505,7 @@
 	// no magic /o\
 	if err := run(); err != nil {
 		fmt.Fprintf(Stderr, errorPrefix, err)
-		if client.IsRetryable(err) {
-			os.Exit(10)
-		}
-		os.Exit(1)
+		os.Exit(exitCodeFromError(err))
 	}
 }
 
@@ -509,6 +530,14 @@
 	0x2e3b, // three-em dash
 })
 
+type unknownCommandError struct {
+	msg string
+}
+
+func (e unknownCommandError) Error() string {
+	return e.msg
+}
+
 func run() error {
 	cli := mkClient()
 	parser := Parser(cli)
@@ -532,7 +561,7 @@
 					}
 				}
 				// TRANSLATORS: %q is the command the user entered; %s is 'snap help' or 'snap help <cmd>'
-				return fmt.Errorf(i18n.G("unknown command %q, see '%s'."), sub, sug)
+				return unknownCommandError{fmt.Sprintf(i18n.G("unknown command %q, see '%s'."), sub, sug)}
 			}
 		}
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap/main_test.go snapd-2.48.3+20.04/cmd/snap/main_test.go
--- snapd-2.45.1+20.04.2/cmd/snap/main_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap/main_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,11 +35,11 @@
 	"golang.org/x/crypto/ssh/terminal"
 	. "gopkg.in/check.v1"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/testutil"
 
 	snap "github.com/snapcore/snapd/cmd/snap"
@@ -98,6 +98,10 @@
 	s.AddCleanup(snap.MockIsStdinTTY(false))
 
 	s.AddCleanup(snap.MockSELinuxIsEnabled(func() (bool, error) { return false, nil }))
+
+	// mock an empty cmdline since we check the cmdline to check whether we are
+	// in install mode or not and we don't want to use the host's proc/cmdline
+	s.AddCleanup(osutil.MockProcCmdline(filepath.Join(c.MkDir(), "proc/cmdline")))
 }
 
 func (s *BaseSnapSuite) TearDownTest(c *C) {
@@ -174,12 +178,6 @@
 	return func() { os.Args = old }
 }
 
-func mockVersion(v string) (restore func()) {
-	old := cmd.Version
-	cmd.Version = v
-	return func() { cmd.Version = old }
-}
-
 func mockSnapConfine(libExecDir string) func() {
 	snapConfine := filepath.Join(libExecDir, "snap-confine")
 	if err := os.MkdirAll(libExecDir, 0755); err != nil {
@@ -237,7 +235,7 @@
 	})
 	restore := mockArgs("snap", "--version")
 	defer restore()
-	restore = mockVersion("4.56")
+	restore = snapdtool.MockVersion("4.56")
 	defer restore()
 
 	c.Assert(func() { snap.RunMain() }, PanicMatches, `internal error: exitStatus\{0\} .*`)
@@ -251,7 +249,7 @@
 	})
 	restore := mockArgs("snap", "--version")
 	defer restore()
-	restore = mockVersion("4.56")
+	restore = snapdtool.MockVersion("4.56")
 	defer restore()
 
 	c.Assert(func() { snap.RunMain() }, PanicMatches, `internal error: exitStatus\{0\} .*`)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/bootstrap_dummy.go snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/bootstrap_dummy.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/bootstrap_dummy.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/bootstrap_dummy.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,29 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build nosecboot
-
-/*
- * Copyright (C) 2019-2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package bootstrap
-
-import (
-	"fmt"
-)
-
-func Run(gadgetRoot, device string, options Options) error {
-	return fmt.Errorf("build without secboot support")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/bootstrap.go snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/bootstrap.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/bootstrap.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/bootstrap.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,319 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build !nosecboot
-
-/*
- * Copyright (C) 2019-2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package bootstrap
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/boot"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/secboot"
-)
-
-const (
-	ubuntuDataLabel = "ubuntu-data"
-)
-
-func deviceFromRole(lv *gadget.LaidOutVolume, role string) (device string, err error) {
-	for _, vs := range lv.LaidOutStructure {
-		// XXX: this part of the finding maybe should be a
-		// method on gadget.*Volume
-		if vs.Role == role {
-			device, err = gadget.FindDeviceForStructure(&vs)
-			if err != nil {
-				return "", fmt.Errorf("cannot find device for role %q: %v", role, err)
-			}
-			return gadget.ParentDiskFromPartition(device)
-		}
-	}
-	return "", fmt.Errorf("cannot find role %s in gadget", role)
-}
-
-// Run bootstraps the partitions of a device, by either creating
-// missing ones or recreating installed ones.
-func Run(gadgetRoot, device string, options Options) error {
-	if options.Encrypt && (options.KeyFile == "" || options.RecoveryKeyFile == "") {
-		return fmt.Errorf("key file and recovery key file must be specified when encrypting")
-	}
-
-	if gadgetRoot == "" {
-		return fmt.Errorf("cannot use empty gadget root directory")
-	}
-
-	lv, err := gadget.PositionedVolumeFromGadget(gadgetRoot)
-	if err != nil {
-		return fmt.Errorf("cannot layout the volume: %v", err)
-	}
-
-	// XXX: the only situation where auto-detect is not desired is
-	//      in (spread) testing - consider to remove forcing a device
-	//
-	// auto-detect device if no device is forced
-	if device == "" {
-		device, err = deviceFromRole(lv, gadget.SystemSeed)
-		if err != nil {
-			return fmt.Errorf("cannot find device to create partitions on: %v", err)
-		}
-	}
-
-	diskLayout, err := partition.DeviceLayoutFromDisk(device)
-	if err != nil {
-		return fmt.Errorf("cannot read %v partitions: %v", device, err)
-	}
-
-	// check if the current partition table is compatible with the gadget,
-	// ignoring partitions added by the installer (will be removed later)
-	if err := ensureLayoutCompatibility(lv, diskLayout); err != nil {
-		return fmt.Errorf("gadget and %v partition table not compatible: %v", device, err)
-	}
-
-	// remove partitions added during a previous (failed) install attempt
-	if err := diskLayout.RemoveCreated(); err != nil {
-		return fmt.Errorf("cannot remove partitions from previous install: %v", err)
-	}
-	// at this point we removed any existing partition, nuke any
-	// of the existing sealed key files placed outside of the
-	// encrypted partitions (LP: #1879338)
-	if options.KeyFile != "" {
-		if err := os.Remove(options.KeyFile); err != nil && !os.IsNotExist(err) {
-			return fmt.Errorf("cannot cleanup obsolete key file: %v", options.KeyFile)
-		}
-
-	}
-
-	created, err := diskLayout.CreateMissing(lv)
-	if err != nil {
-		return fmt.Errorf("cannot create the partitions: %v", err)
-	}
-
-	// generate keys externally so multiple encrypted partitions can use the same key
-	var key partition.EncryptionKey
-	var rkey partition.RecoveryKey
-
-	if options.Encrypt {
-		key, err = partition.NewEncryptionKey()
-		if err != nil {
-			return fmt.Errorf("cannot create encryption key: %v", err)
-		}
-
-		rkey, err = partition.NewRecoveryKey()
-		if err != nil {
-			return fmt.Errorf("cannot create recovery key: %v", err)
-		}
-	}
-
-	for _, part := range created {
-		if options.Encrypt && part.Role == gadget.SystemData {
-			dataPart, err := partition.NewEncryptedDevice(&part, key, ubuntuDataLabel)
-			if err != nil {
-				return err
-			}
-
-			if err := dataPart.AddRecoveryKey(key, rkey); err != nil {
-				return err
-			}
-
-			// update the encrypted device node
-			part.Node = dataPart.Node
-		}
-
-		if err := partition.MakeFilesystem(part); err != nil {
-			return err
-		}
-
-		if err := partition.DeployContent(part, gadgetRoot); err != nil {
-			return err
-		}
-
-		if options.Mount && part.Label != "" && part.HasFilesystem() {
-			if err := partition.MountFilesystem(part, boot.InitramfsRunMntDir); err != nil {
-				return err
-			}
-		}
-	}
-
-	// store the encryption key as the last part of the process to reduce the
-	// possibility of exiting with an error after the TPM provisioning
-	if options.Encrypt {
-		if err := tpmSealKey(key, rkey, options); err != nil {
-			return fmt.Errorf("cannot seal the encryption key: %v", err)
-		}
-	}
-
-	return nil
-}
-
-func tpmSealKey(key partition.EncryptionKey, rkey partition.RecoveryKey, options Options) error {
-	if err := rkey.Store(options.RecoveryKeyFile); err != nil {
-		return fmt.Errorf("cannot store recovery key: %v", err)
-	}
-
-	tpm, err := secboot.NewTPMSupport()
-	if err != nil {
-		return fmt.Errorf("cannot initialize TPM: %v", err)
-	}
-
-	if options.TPMLockoutAuthFile != "" {
-		if err := tpm.StoreLockoutAuth(options.TPMLockoutAuthFile); err != nil {
-			return fmt.Errorf("cannot store TPM lockout authorization: %v", err)
-		}
-	}
-
-	shim := filepath.Join(boot.InitramfsUbuntuBootDir, "EFI/boot/bootx64.efi")
-	grub := filepath.Join(boot.InitramfsUbuntuBootDir, "EFI/boot/grubx64.efi")
-
-	// TODO:UC20: Fix EFI image loading events
-	//
-	// The idea of EFIImageLoadEvent is to build a set of load paths for the current
-	// device configuration. So you could have something like this:
-	//
-	// shim -> recovery grub -> recovery kernel 1
-	//                      |-> recovery kernel 2
-	//                      |-> recovery kernel ...
-	//                      |-> normal grub -> run kernel good
-	//                                     |-> run kernel try
-	//
-	// Or it could look like this, which is the same thing:
-	//
-	// shim -> recovery grub -> recovery kernel 1
-	// shim -> recovery grub -> recovery kernel 2
-	// shim -> recovery grub -> recovery kernel ...
-	// shim -> recovery grub -> normal grub -> run kernel good
-	// shim -> recovery grub -> normal grub -> run kernel try
-	//
-	// This implementation in #8476, seems to just build a tree of shim -> grub -> kernel
-	// sequences for every combination of supplied input file, although the code here just
-	// specifies a single shim, grub and kernel binary, so you get one load path that looks
-	// like this:
-	//
-	// shim -> grub -> kernel
-	//
-	// This is ok for now because every boot path uses the same chain of trust, regardless
-	// of which kernel you're booting or whether you're booting through both the recovery
-	// and normal grubs. But when we add the ability to seal against specific binaries in
-	// order to secure the system with the Microsoft chain of trust, then the actual trees
-	// of EFIImageLoadEvents will need to match the exact supported boot sequences.
-
-	if err := tpm.SetShimFiles(shim); err != nil {
-		return err
-	}
-	if err := tpm.SetBootloaderFiles(grub); err != nil {
-		return err
-	}
-	if options.KernelPath != "" {
-		if err := tpm.SetKernelFiles(options.KernelPath); err != nil {
-			return err
-		}
-	}
-
-	// TODO:UC20: get cmdline definition from bootloaders
-	kernelCmdlines := []string{
-		// run mode
-		"snapd_recovery_mode=run console=ttyS0 console=tty1 panic=-1",
-		// recover mode
-		fmt.Sprintf("snapd_recovery_mode=recover snapd_recovery_system=%s console=ttyS0 console=tty1 panic=-1", options.SystemLabel),
-	}
-
-	tpm.SetKernelCmdlines(kernelCmdlines)
-
-	if options.Model != nil {
-		tpm.SetModels([]*asserts.Model{options.Model})
-	}
-
-	// Provision the TPM as late as possible
-	// TODO:UC20: ideally we should ask the firmware to clear the TPM and then reboot
-	//            if the device has previously been provisioned, see
-	//            https://godoc.org/github.com/snapcore/secboot#RequestTPMClearUsingPPI
-	if err := tpm.Provision(); err != nil {
-		return fmt.Errorf("cannot provision the TPM: %v", err)
-	}
-
-	if err := tpm.Seal(key[:], options.KeyFile, options.PolicyUpdateDataFile); err != nil {
-		return fmt.Errorf("cannot seal and store encryption key: %v", err)
-	}
-
-	return nil
-}
-
-func ensureLayoutCompatibility(gadgetLayout *gadget.LaidOutVolume, diskLayout *partition.DeviceLayout) error {
-	eq := func(ds partition.DeviceStructure, gs gadget.LaidOutStructure) bool {
-		dv := ds.VolumeStructure
-		gv := gs.VolumeStructure
-		nameMatch := gv.Name == dv.Name
-		if gadgetLayout.Schema == "mbr" {
-			// partitions have no names in MBR
-			nameMatch = true
-		}
-		// Previous installation may have failed before filesystem creation or partition may be encrypted
-		check := nameMatch && ds.StartOffset == gs.StartOffset && (ds.CreatedDuringInstall || dv.Filesystem == gv.Filesystem)
-		if gv.Role == gadget.SystemData {
-			// system-data may have been expanded
-			return check && dv.Size >= gv.Size
-		}
-		return check && dv.Size == gv.Size
-	}
-	contains := func(haystack []gadget.LaidOutStructure, needle partition.DeviceStructure) bool {
-		for _, h := range haystack {
-			if eq(needle, h) {
-				return true
-			}
-		}
-		return false
-	}
-
-	if gadgetLayout.Size > diskLayout.Size {
-		return fmt.Errorf("device %v (%s) is too small to fit the requested layout (%s)", diskLayout.Device,
-			diskLayout.Size.IECString(), gadgetLayout.Size.IECString())
-	}
-
-	// Check if top level properties match
-	if !isCompatibleSchema(gadgetLayout.Volume.Schema, diskLayout.Schema) {
-		return fmt.Errorf("disk partitioning schema %q doesn't match gadget schema %q", diskLayout.Schema, gadgetLayout.Volume.Schema)
-	}
-	if gadgetLayout.Volume.ID != "" && gadgetLayout.Volume.ID != diskLayout.ID {
-		return fmt.Errorf("disk ID %q doesn't match gadget volume ID %q", diskLayout.ID, gadgetLayout.Volume.ID)
-	}
-
-	// Check if all existing device partitions are also in gadget
-	for _, ds := range diskLayout.Structure {
-		if !contains(gadgetLayout.LaidOutStructure, ds) {
-			return fmt.Errorf("cannot find disk partition %s (starting at %d) in gadget", ds.Node, ds.StartOffset)
-		}
-	}
-
-	return nil
-}
-
-func isCompatibleSchema(gadgetSchema, diskSchema string) bool {
-	switch gadgetSchema {
-	// XXX: "mbr,gpt" is currently unsupported
-	case "", "gpt":
-		return diskSchema == "gpt"
-	case "mbr":
-		return diskSchema == "dos"
-	default:
-		return false
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/bootstrap_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/bootstrap_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/bootstrap_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/bootstrap_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,421 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build !nosecboot
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package bootstrap_test
-
-import (
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-func TestBootstrap(t *testing.T) { TestingT(t) }
-
-type bootstrapSuite struct {
-	testutil.BaseTest
-
-	dir string
-}
-
-var _ = Suite(&bootstrapSuite{})
-
-// XXX: write a very high level integration like test here that
-// mocks the world (sfdisk,lsblk,mkfs,...)? probably silly as
-// each part inside bootstrap is tested and we have a spread test
-
-func (s *bootstrapSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
-
-	s.dir = c.MkDir()
-	dirs.SetRootDir(s.dir)
-	s.AddCleanup(func() { dirs.SetRootDir("/") })
-}
-
-func (s *bootstrapSuite) TestBootstrapRunError(c *C) {
-	err := bootstrap.Run("", "", bootstrap.Options{})
-	c.Assert(err, ErrorMatches, "cannot use empty gadget root directory")
-}
-
-const mockGadgetYaml = `volumes:
-  pc:
-    bootloader: grub
-    structure:
-      - name: mbr
-        type: mbr
-        size: 440
-      - name: BIOS Boot
-        type: DA,21686148-6449-6E6F-744E-656564454649
-        size: 1M
-        offset: 1M
-        offset-write: mbr+92
-`
-
-const mockExtraStructure = `
-      - name: Writable
-        role: system-data
-        filesystem-label: writable
-        filesystem: ext4
-        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
-        size: 1200M
-`
-
-var mockDeviceLayout = partition.DeviceLayout{
-	Structure: []partition.DeviceStructure{
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name: "mbr",
-					Size: 440,
-				},
-				StartOffset: 0,
-			},
-			Node: "/dev/node1",
-		},
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name: "BIOS Boot",
-					Size: 1 * gadget.SizeMiB,
-				},
-				StartOffset: 1 * gadget.SizeMiB,
-			},
-			Node: "/dev/node2",
-		},
-	},
-	ID:         "anything",
-	Device:     "/dev/node",
-	Schema:     "gpt",
-	Size:       2 * gadget.SizeGiB,
-	SectorSize: 512,
-}
-
-func (s *bootstrapSuite) TestLayoutCompatibility(c *C) {
-	// same contents (the locally created structure should be ignored)
-	gadgetLayout := layoutFromYaml(c, mockGadgetYaml)
-	err := bootstrap.EnsureLayoutCompatibility(gadgetLayout, &mockDeviceLayout)
-	c.Assert(err, IsNil)
-
-	// missing structure (that's ok)
-	gadgetLayoutWithExtras := layoutFromYaml(c, mockGadgetYaml+mockExtraStructure)
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &mockDeviceLayout)
-	c.Assert(err, IsNil)
-
-	deviceLayoutWithExtras := mockDeviceLayout
-	deviceLayoutWithExtras.Structure = append(deviceLayoutWithExtras.Structure,
-		partition.DeviceStructure{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:  "Extra partition",
-					Size:  10 * gadget.SizeMiB,
-					Label: "extra",
-				},
-				StartOffset: 2 * gadget.SizeMiB,
-			},
-			Node: "/dev/node3",
-		},
-	)
-	// extra structure (should fail)
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayout, &deviceLayoutWithExtras)
-	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node3.* in gadget`)
-
-	// layout is not compatible if the device is too small
-	smallDeviceLayout := mockDeviceLayout
-	smallDeviceLayout.Size = 100 * gadget.SizeMiB
-	// sanity check
-	c.Check(gadgetLayoutWithExtras.Size > smallDeviceLayout.Size, Equals, true)
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &smallDeviceLayout)
-	c.Assert(err, ErrorMatches, `device /dev/node \(100 MiB\) is too small to fit the requested layout \(1\.17 GiB\)`)
-}
-
-func (s *bootstrapSuite) TestMBRLayoutCompatibility(c *C) {
-	const mockMBRGadgetYaml = `volumes:
-  pc:
-    schema: mbr
-    bootloader: grub
-    structure:
-      - name: mbr
-        type: mbr
-        size: 440
-      - name: BIOS Boot
-        type: DA,21686148-6449-6E6F-744E-656564454649
-        size: 1M
-        offset: 1M
-        offset-write: mbr+92
-`
-	var mockMBRDeviceLayout = partition.DeviceLayout{
-		Structure: []partition.DeviceStructure{
-			{
-				LaidOutStructure: gadget.LaidOutStructure{
-					VolumeStructure: &gadget.VolumeStructure{
-						// partition names have no
-						// meaning in MBR schema
-						Name: "other",
-						Size: 440,
-					},
-					StartOffset: 0,
-				},
-				Node: "/dev/node1",
-			},
-			{
-				LaidOutStructure: gadget.LaidOutStructure{
-					VolumeStructure: &gadget.VolumeStructure{
-						// partition names have no
-						// meaning in MBR schema
-						Name: "different BIOS Boot",
-						Size: 1 * gadget.SizeMiB,
-					},
-					StartOffset: 1 * gadget.SizeMiB,
-				},
-				Node: "/dev/node2",
-			},
-		},
-		ID:         "anything",
-		Device:     "/dev/node",
-		Schema:     "dos",
-		Size:       2 * gadget.SizeGiB,
-		SectorSize: 512,
-	}
-	gadgetLayout := layoutFromYaml(c, mockMBRGadgetYaml)
-	err := bootstrap.EnsureLayoutCompatibility(gadgetLayout, &mockMBRDeviceLayout)
-	c.Assert(err, IsNil)
-	// structure is missing from disk
-	gadgetLayoutWithExtras := layoutFromYaml(c, mockMBRGadgetYaml+mockExtraStructure)
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &mockMBRDeviceLayout)
-	c.Assert(err, IsNil)
-	// add it now
-	deviceLayoutWithExtras := mockMBRDeviceLayout
-	deviceLayoutWithExtras.Structure = append(deviceLayoutWithExtras.Structure,
-		partition.DeviceStructure{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					// name is ignored with MBR schema
-					Name:       "Extra partition",
-					Size:       1200 * gadget.SizeMiB,
-					Label:      "extra",
-					Filesystem: "ext4",
-					Type:       "83",
-				},
-				StartOffset: 2 * gadget.SizeMiB,
-			},
-			Node: "/dev/node3",
-		},
-	)
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayoutWithExtras)
-	c.Assert(err, IsNil)
-	// add another structure that's not part of the gadget
-	deviceLayoutWithExtras.Structure = append(deviceLayoutWithExtras.Structure,
-		partition.DeviceStructure{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					// name is ignored with MBR schema
-					Name: "Extra extra partition",
-					Size: 1 * gadget.SizeMiB,
-				},
-				StartOffset: 1202 * gadget.SizeMiB,
-			},
-			Node: "/dev/node4",
-		},
-	)
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayoutWithExtras)
-	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node4 .* in gadget`)
-}
-
-func (s *bootstrapSuite) TestLayoutCompatibilityWithCreatedPartitions(c *C) {
-	gadgetLayoutWithExtras := layoutFromYaml(c, mockGadgetYaml+mockExtraStructure)
-	deviceLayout := mockDeviceLayout
-	// device matches gadget except for the filesystem type
-	deviceLayout.Structure = append(deviceLayout.Structure,
-		partition.DeviceStructure{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:       "Writable",
-					Size:       1200 * gadget.SizeMiB,
-					Label:      "writable",
-					Filesystem: "something_else",
-				},
-				StartOffset: 2 * gadget.SizeMiB,
-			},
-			Node:                 "/dev/node3",
-			CreatedDuringInstall: true,
-		},
-	)
-	err := bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
-	c.Assert(err, IsNil)
-
-	// compare layouts without partitions created at install time (should fail)
-	deviceLayout.Structure[len(deviceLayout.Structure)-1].CreatedDuringInstall = false
-	err = bootstrap.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
-	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node3.* in gadget`)
-
-}
-
-func (s *bootstrapSuite) TestSchemaCompatibility(c *C) {
-	gadgetLayout := layoutFromYaml(c, mockGadgetYaml)
-	deviceLayout := mockDeviceLayout
-
-	error_msg := "disk partitioning.* doesn't match gadget.*"
-
-	for i, tc := range []struct {
-		gs string
-		ds string
-		e  string
-	}{
-		{"", "dos", error_msg},
-		{"", "gpt", ""},
-		{"", "xxx", error_msg},
-		{"mbr", "dos", ""},
-		{"mbr", "gpt", error_msg},
-		{"mbr", "xxx", error_msg},
-		{"gpt", "dos", error_msg},
-		{"gpt", "gpt", ""},
-		{"gpt", "xxx", error_msg},
-		// XXX: "mbr,gpt" is currently unsupported
-		{"mbr,gpt", "dos", error_msg},
-		{"mbr,gpt", "gpt", error_msg},
-		{"mbr,gpt", "xxx", error_msg},
-	} {
-		c.Logf("%d: %q %q\n", i, tc.gs, tc.ds)
-		gadgetLayout.Volume.Schema = tc.gs
-		deviceLayout.Schema = tc.ds
-		err := bootstrap.EnsureLayoutCompatibility(gadgetLayout, &deviceLayout)
-		if tc.e == "" {
-			c.Assert(err, IsNil)
-		} else {
-			c.Assert(err, ErrorMatches, tc.e)
-		}
-	}
-	c.Logf("-----")
-}
-
-func (s *bootstrapSuite) TestIDCompatibility(c *C) {
-	gadgetLayout := layoutFromYaml(c, mockGadgetYaml)
-	deviceLayout := mockDeviceLayout
-
-	error_msg := "disk ID.* doesn't match gadget volume ID.*"
-
-	for i, tc := range []struct {
-		gid string
-		did string
-		e   string
-	}{
-		{"", "", ""},
-		{"", "123", ""},
-		{"123", "345", error_msg},
-		{"123", "123", ""},
-	} {
-		c.Logf("%d: %q %q\n", i, tc.gid, tc.did)
-		gadgetLayout.Volume.ID = tc.gid
-		deviceLayout.ID = tc.did
-		err := bootstrap.EnsureLayoutCompatibility(gadgetLayout, &deviceLayout)
-		if tc.e == "" {
-			c.Assert(err, IsNil)
-		} else {
-			c.Assert(err, ErrorMatches, tc.e)
-		}
-	}
-	c.Logf("-----")
-}
-
-func layoutFromYaml(c *C, gadgetYaml string) *gadget.LaidOutVolume {
-	gadgetRoot := filepath.Join(c.MkDir(), "gadget")
-	err := os.MkdirAll(filepath.Join(gadgetRoot, "meta"), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(gadgetRoot, "meta", "gadget.yaml"), []byte(gadgetYaml), 0644)
-	c.Assert(err, IsNil)
-	pv, err := gadget.PositionedVolumeFromGadget(gadgetRoot)
-	c.Assert(err, IsNil)
-	return pv
-}
-
-const mockUC20GadgetYaml = `volumes:
-  pc:
-    bootloader: grub
-    structure:
-      - name: mbr
-        type: mbr
-        size: 440
-      - name: BIOS Boot
-        type: DA,21686148-6449-6E6F-744E-656564454649
-        size: 1M
-        offset: 1M
-        offset-write: mbr+92
-      - name: ubuntu-seed
-        role: system-seed
-        filesystem: vfat
-        # UEFI will boot the ESP partition by default first
-        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
-        size: 1200M
-      - name: ubuntu-data
-        role: system-data
-        filesystem: ext4
-        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
-        size: 750M
-`
-
-func (s *bootstrapSuite) setupMockSysfs(c *C) {
-	err := os.MkdirAll(filepath.Join(s.dir, "/dev/disk/by-partlabel"), 0755)
-	c.Assert(err, IsNil)
-
-	err = ioutil.WriteFile(filepath.Join(s.dir, "/dev/fakedevice0p1"), nil, 0644)
-	c.Assert(err, IsNil)
-	err = os.Symlink("../../fakedevice0p1", filepath.Join(s.dir, "/dev/disk/by-partlabel/ubuntu-seed"))
-	c.Assert(err, IsNil)
-
-	// make parent device
-	err = ioutil.WriteFile(filepath.Join(s.dir, "/dev/fakedevice0"), nil, 0644)
-	c.Assert(err, IsNil)
-	// and fake /sys/block structure
-	err = os.MkdirAll(filepath.Join(s.dir, "/sys/block/fakedevice0/fakedevice0p1"), 0755)
-	c.Assert(err, IsNil)
-}
-
-func (s *bootstrapSuite) TestDeviceFromRoleHappy(c *C) {
-	s.setupMockSysfs(c)
-	lv := layoutFromYaml(c, mockUC20GadgetYaml)
-
-	device, err := bootstrap.DeviceFromRole(lv, gadget.SystemSeed)
-	c.Assert(err, IsNil)
-	c.Check(device, Matches, ".*/dev/fakedevice0")
-}
-
-func (s *bootstrapSuite) TestDeviceFromRoleErrorNoMatchingSysfs(c *C) {
-	// note no sysfs mocking
-	lv := layoutFromYaml(c, mockUC20GadgetYaml)
-
-	_, err := bootstrap.DeviceFromRole(lv, gadget.SystemSeed)
-	c.Assert(err, ErrorMatches, `cannot find device for role "system-seed": device not found`)
-}
-
-func (s *bootstrapSuite) TestDeviceFromRoleErrorNoRole(c *C) {
-	s.setupMockSysfs(c)
-	lv := layoutFromYaml(c, mockGadgetYaml)
-
-	_, err := bootstrap.DeviceFromRole(lv, gadget.SystemSeed)
-	c.Assert(err, ErrorMatches, "cannot find role system-seed in gadget")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/export_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/export_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/export_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,26 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build !nosecboot
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package bootstrap
-
-var (
-	EnsureLayoutCompatibility = ensureLayoutCompatibility
-	DeviceFromRole            = deviceFromRole
-)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/options.go snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/options.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/bootstrap/options.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/bootstrap/options.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,45 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019-2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package bootstrap
-
-import (
-	"github.com/snapcore/snapd/asserts"
-)
-
-type Options struct {
-	// Also mount the filesystems after creation
-	Mount bool
-	// Encrypt the data partition
-	Encrypt bool
-	// KeyFile is the location where the encryption key is written to
-	KeyFile string
-	// RecoveryKeyFile is the location where the recovery key is written to
-	RecoveryKeyFile string
-	// TPMLockoutAuthFile is the location where the TPM lockout authorization is written to
-	TPMLockoutAuthFile string
-	// PolicyUpdateDataFile is the location where the authorization policy update data is written to
-	PolicyUpdateDataFile string
-	// KernelPath is the path to the kernel to seal the keyfile to
-	KernelPath string
-	// Model is the device model to seal the keyfile to
-	Model *asserts.Model
-	// SystemLabel is the recover system label to seal the keyfile to
-	SystemLabel string
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_create_partitions.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_create_partitions.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_create_partitions.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_create_partitions.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,102 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019-2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/jessevdk/go-flags"
-
-	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
-)
-
-var bootstrapRun = bootstrap.Run
-
-func init() {
-	const (
-		short = "Create missing partitions for the device"
-		long  = ""
-	)
-
-	addCommandBuilder(func(parser *flags.Parser) {
-		if _, err := parser.AddCommand("create-partitions", short, long, &cmdCreatePartitions{}); err != nil {
-			panic(err)
-		}
-	})
-}
-
-type cmdCreatePartitions struct {
-	Mount                bool   `short:"m" long:"mount" description:"Also mount filesystems after creation"`
-	Encrypt              bool   `long:"encrypt" description:"Encrypt the data partition"`
-	KeyFile              string `long:"key-file" value-name:"filename" description:"Where the key file will be stored"`
-	RecoveryKeyFile      string `long:"recovery-key-file" value-name:"filename" description:"Where the recovery key file will be stored"`
-	TPMLockoutAuthFile   string `long:"tpm-lockout-auth" value-name:"filename" descrition:"Where the TPM lockout authorization data file will be stored"`
-	PolicyUpdateDataFile string `long:"policy-update-data-file" value-name:"filename" description:"Where the authorization policy update data file will be stored"`
-	KernelPath           string `long:"kernel" value-name:"path" description:"Path to the kernel to be installed"`
-	ModelPath            string `long:"model" value-name:"filename" description:"The model to seal the key file to"`
-
-	Positional struct {
-		GadgetRoot string `positional-arg-name:"<gadget-root>"`
-		Device     string `positional-arg-name:"<device>"`
-	} `positional-args:"yes"`
-}
-
-func (c *cmdCreatePartitions) Execute(args []string) error {
-	var model *asserts.Model
-	if c.ModelPath != "" {
-		var err error
-		model, err = readModel(c.ModelPath)
-		if err != nil {
-			return fmt.Errorf("cannot load model: %v", err)
-		}
-	}
-
-	options := bootstrap.Options{
-		Mount:                c.Mount,
-		Encrypt:              c.Encrypt,
-		KeyFile:              c.KeyFile,
-		RecoveryKeyFile:      c.RecoveryKeyFile,
-		TPMLockoutAuthFile:   c.TPMLockoutAuthFile,
-		PolicyUpdateDataFile: c.PolicyUpdateDataFile,
-		KernelPath:           c.KernelPath,
-		Model:                model,
-	}
-
-	return bootstrapRun(c.Positional.GadgetRoot, c.Positional.Device, options)
-}
-
-func readModel(modelPath string) (*asserts.Model, error) {
-	f, err := os.Open(modelPath)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	a, err := asserts.NewDecoder(f).Decode()
-	if err != nil {
-		return nil, fmt.Errorf("cannot decode assertion: %v", err)
-	}
-	if a.Type() != asserts.ModelType {
-		return nil, fmt.Errorf("not a model assertion")
-	}
-	return a.(*asserts.Model), nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_create_partitions_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_create_partitions_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_create_partitions_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_create_partitions_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,132 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019-2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package main_test
-
-import (
-	"io/ioutil"
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	main "github.com/snapcore/snapd/cmd/snap-bootstrap"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
-)
-
-func (s *cmdSuite) TestCreatePartitionsHappy(c *C) {
-	n := 0
-	restore := main.MockBootstrapRun(func(gadgetRoot, device string, opts bootstrap.Options) error {
-		c.Check(gadgetRoot, Equals, "gadget-dir")
-		c.Check(device, Equals, "device")
-		n++
-		return nil
-	})
-	defer restore()
-
-	rest, err := main.Parser().ParseArgs([]string{"create-partitions", "gadget-dir", "device"})
-	c.Assert(err, IsNil)
-	c.Assert(rest, HasLen, 0)
-	c.Assert(n, Equals, 1)
-}
-
-func (s *cmdSuite) TestCreatePartitionsMount(c *C) {
-	n := 0
-	restore := main.MockBootstrapRun(func(gadgetRoot, device string, opts bootstrap.Options) error {
-		c.Check(gadgetRoot, Equals, "gadget-dir")
-		c.Check(device, Equals, "device")
-		c.Check(opts.Mount, Equals, true)
-		n++
-		return nil
-	})
-	defer restore()
-
-	rest, err := main.Parser().ParseArgs([]string{"create-partitions", "--mount", "gadget-dir", "device"})
-	c.Assert(err, IsNil)
-	c.Assert(rest, HasLen, 0)
-	c.Assert(n, Equals, 1)
-}
-
-var testModel = `type: model
-authority-id: brand-id1
-series: 16
-brand-id: brand-id1
-model: baz-3000
-display-name: Baz 3000
-architecture: amd64
-system-user-authority: *
-base: core20
-store: brand-store
-snaps:
-  -
-    name: baz-linux
-    id: bazlinuxidididididididididididid
-    type: kernel
-    default-channel: 20
-  -
-    name: brand-gadget
-    id: brandgadgetdidididididididididid
-    type: gadget
-  -
-    name: other-base
-    id: otherbasedididididididididididid
-    type: base
-grade: secured
-body-length: 0
-timestamp: 2002-10-02T10:00:00-05:00
-sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij
-
-AXNpZw==`
-
-func (s *cmdSuite) TestCreatePartitionsWithEncryption(c *C) {
-	n := 0
-	restore := main.MockBootstrapRun(func(gadgetRoot, device string, opts bootstrap.Options) error {
-		c.Check(gadgetRoot, Equals, "gadget-dir")
-		c.Check(device, Equals, "device")
-		c.Check(opts.Encrypt, Equals, true)
-		c.Check(opts.KeyFile, Equals, "keyfile")
-		c.Check(opts.RecoveryKeyFile, Equals, "recovery")
-		c.Check(opts.TPMLockoutAuthFile, Equals, "lockout")
-		c.Check(opts.PolicyUpdateDataFile, Equals, "update")
-		c.Check(opts.KernelPath, Equals, "kernel")
-		c.Check(opts.Model.Model(), Equals, "baz-3000")
-		n++
-		return nil
-	})
-	defer restore()
-
-	mockModelPath := filepath.Join(c.MkDir(), "model")
-	err := ioutil.WriteFile(mockModelPath, []byte(testModel), 0644)
-	c.Assert(err, IsNil)
-
-	rest, err := main.Parser().ParseArgs([]string{
-		"create-partitions",
-		"--encrypt",
-		"--key-file", "keyfile",
-		"--recovery-key-file", "recovery",
-		"--tpm-lockout-auth", "lockout",
-		"--policy-update-data-file", "update",
-		"--kernel", "kernel",
-		"--model", mockModelPath,
-		"gadget-dir",
-		"device",
-	})
-	c.Assert(err, IsNil)
-	c.Assert(rest, HasLen, 0)
-	c.Assert(n, Equals, 1)
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -20,8 +20,9 @@
 package main
 
 import (
+	"crypto/subtle"
+	"encoding/json"
 	"fmt"
-	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -29,25 +30,27 @@
 	"syscall"
 
 	"github.com/jessevdk/go-flags"
-	// XXX: import as "to" sb to be consistent with snapcore/snapd/secboot
-	"github.com/snapcore/secboot"
-	"golang.org/x/xerrors"
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
-	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/disks"
 	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/secboot"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/squashfs"
 	"github.com/snapcore/snapd/sysconfig"
+
+	// to set sysconfig.ApplyFilesystemOnlyDefaultsImpl
+	_ "github.com/snapcore/snapd/overlord/configstate/configcore"
 )
 
 func init() {
 	const (
-		short = "Generate initramfs mount tuples"
-		long  = "Generate mount tuples for the initramfs until nothing more can be done"
+		short = "Generate mounts for the initramfs"
+		long  = "Generate and perform all mounts for the initramfs before transitioning to userspace"
 	)
 
 	addCommandBuilder(func(parser *flags.Parser) {
@@ -65,52 +68,156 @@
 	return generateInitramfsMounts()
 }
 
-// XXX: move all var () to the top, it's very spread out right now
-var (
-	// Stdout - can be overridden in tests
-	stdout io.Writer = os.Stdout
-)
-
 var (
 	osutilIsMounted = osutil.IsMounted
-)
 
-var (
-	// for mocking by tests
-	devDiskByLabelDir = "/dev/disk/by-label"
+	snapTypeToMountDir = map[snap.Type]string{
+		snap.TypeBase:   "base",
+		snap.TypeKernel: "kernel",
+		snap.TypeSnapd:  "snapd",
+	}
+
+	secbootMeasureSnapSystemEpochWhenPossible    func() error
+	secbootMeasureSnapModelWhenPossible          func(findModel func() (*asserts.Model, error)) error
+	secbootUnlockVolumeUsingSealedKeyIfEncrypted func(disk disks.Disk, name string, encryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error)
+	secbootUnlockEncryptedVolumeUsingKey         func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error)
+
+	secbootLockSealedKeys func() error
+
+	bootFindPartitionUUIDForBootedKernelDisk = boot.FindPartitionUUIDForBootedKernelDisk
 )
 
-// generateMountsMode* is called multiple times from initramfs until it
-// no longer generates more mount points and just returns an empty output.
-func generateMountsModeInstall(mst initramfsMountsState, recoverySystem string) error {
-	allMounted, err := generateMountsCommonInstallRecover(mst, recoverySystem)
+func stampedAction(stamp string, action func() error) error {
+	stampFile := filepath.Join(dirs.SnapBootstrapRunDir, stamp)
+	if osutil.FileExists(stampFile) {
+		return nil
+	}
+	if err := os.MkdirAll(filepath.Dir(stampFile), 0755); err != nil {
+		return err
+	}
+	if err := action(); err != nil {
+		return err
+	}
+	return ioutil.WriteFile(stampFile, nil, 0644)
+}
+
+func generateInitramfsMounts() (err error) {
+	// ensure that the last thing we do is to lock access to sealed keys,
+	// regardless of mode or early failures.
+	defer func() {
+		if e := secbootLockSealedKeys(); e != nil {
+			e = fmt.Errorf("error locking access to sealed keys: %v", e)
+			if err == nil {
+				err = e
+			} else {
+				// preserve err but log
+				logger.Noticef("%v", e)
+			}
+		}
+	}()
+
+	// Ensure there is a very early initial measurement
+	err = stampedAction("secboot-epoch-measured", func() error {
+		return secbootMeasureSnapSystemEpochWhenPossible()
+	})
 	if err != nil {
 		return err
 	}
-	if !allMounted {
-		return nil
+
+	mode, recoverySystem, err := boot.ModeAndRecoverySystemFromKernelCommandLine()
+	if err != nil {
+		return err
+	}
+
+	mst := &initramfsMountsState{
+		mode:           mode,
+		recoverySystem: recoverySystem,
+	}
+
+	switch mode {
+	case "recover":
+		return generateMountsModeRecover(mst)
+	case "install":
+		return generateMountsModeInstall(mst)
+	case "run":
+		return generateMountsModeRun(mst)
+	}
+	// this should never be reached
+	return fmt.Errorf("internal error: mode in generateInitramfsMounts not handled")
+}
+
+// generateMountsMode* is called multiple times from initramfs until it
+// no longer generates more mount points and just returns an empty output.
+func generateMountsModeInstall(mst *initramfsMountsState) error {
+	// steps 1 and 2 are shared with recover mode
+	if _, err := generateMountsCommonInstallRecover(mst); err != nil {
+		return err
 	}
 
-	// n+1: final step: write $(tmpfs-data)/var/lib/snapd/modeenv - this
-	//      is the tmpfs we just created above
+	// 3. final step: write modeenv to tmpfs data dir and disable cloud-init in
+	//   install mode
 	modeEnv := &boot.Modeenv{
 		Mode:           "install",
-		RecoverySystem: recoverySystem,
+		RecoverySystem: mst.recoverySystem,
 	}
 	if err := modeEnv.WriteTo(boot.InitramfsWritableDir); err != nil {
 		return err
 	}
-	// and disable cloud-init in install mode
-	if err := sysconfig.DisableCloudInit(boot.InitramfsWritableDir); err != nil {
-		return err
+
+	// done, no output, no error indicates to initramfs we are done with
+	// mounting stuff
+	return nil
+}
+
+// copyNetworkConfig copies the network configuration to the target
+// directory. This is used to copy the network configuration
+// data from a real uc20 ubuntu-data partition into a ephemeral one.
+func copyNetworkConfig(src, dst string) error {
+	for _, globEx := range []string{
+		// for network configuration setup by console-conf, etc.
+		// TODO:UC20: we want some way to "try" or "verify" the network
+		//            configuration or to only use known-to-be-good network
+		//            configuration i.e. from ubuntu-save before installing it
+		//            onto recover mode, because the network configuration could
+		//            have been what was broken so we don't want to break
+		//            network configuration for recover mode as well, but for
+		//            now this is fine
+		"system-data/etc/netplan/*",
+		// etc/machine-id is part of what systemd-networkd uses to generate a
+		// DHCP clientid (the other part being the interface name), so to have
+		// the same IP addresses across run mode and recover mode, we need to
+		// also copy the machine-id across
+		"system-data/etc/machine-id",
+	} {
+		if err := copyFromGlobHelper(src, dst, globEx); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// copyUbuntuDataMisc copies miscellaneous other files from the run mode system
+// to the recover system such as:
+//  - timesync clock to keep the same time setting in recover as in run mode
+func copyUbuntuDataMisc(src, dst string) error {
+	for _, globEx := range []string{
+		// systemd's timesync clock file so that the time in recover mode moves
+		// forward to what it was in run mode
+		// NOTE: we don't sync back the time movement from recover mode to run
+		// mode currently, unclear how/when we could do this, but recover mode
+		// isn't meant to be long lasting and as such it's probably not a big
+		// problem to "lose" the time spent in recover mode
+		"system-data/var/lib/systemd/timesync/clock",
+	} {
+		if err := copyFromGlobHelper(src, dst, globEx); err != nil {
+			return err
+		}
 	}
 
-	// n+3: done, no output, no error indicates to initramfs we are done
-	//      with mounting stuff
 	return nil
 }
 
-// copyUbuntuDataAuth copies the authenication files like
+// copyUbuntuDataAuth copies the authentication files like
 //  - extrausers passwd,shadow etc
 //  - sshd host configuration
 //  - user .ssh dir
@@ -121,48 +228,24 @@
 		"system-data/var/lib/extrausers/*",
 		"system-data/etc/ssh/*",
 		"user-data/*/.ssh/*",
+		// this ensures we get proper authentication to snapd from "snap"
+		// commands in recover mode
+		"user-data/*/.snap/auth.json",
 		// this ensures we also get non-ssh enabled accounts copied
 		"user-data/*/.profile",
 		// so that users have proper perms, i.e. console-conf added users are
 		// sudoers
 		"system-data/etc/sudoers.d/*",
 	} {
-		matches, err := filepath.Glob(filepath.Join(src, globEx))
-		if err != nil {
+		if err := copyFromGlobHelper(src, dst, globEx); err != nil {
 			return err
 		}
-		for _, p := range matches {
-			comps := strings.Split(strings.TrimPrefix(p, src), "/")
-			for i := range comps {
-				part := filepath.Join(comps[0 : i+1]...)
-				fi, err := os.Stat(filepath.Join(src, part))
-				if err != nil {
-					return err
-				}
-				if fi.IsDir() {
-					if err := os.Mkdir(filepath.Join(dst, part), fi.Mode()); err != nil && !os.IsExist(err) {
-						return err
-					}
-					st, ok := fi.Sys().(*syscall.Stat_t)
-					if !ok {
-						return fmt.Errorf("cannot get stat data: %v", err)
-					}
-					if err := os.Chown(filepath.Join(dst, part), int(st.Uid), int(st.Gid)); err != nil {
-						return err
-					}
-				} else {
-					if err := osutil.CopyFile(p, filepath.Join(dst, part), osutil.CopyFlagPreserveAll); err != nil {
-						return err
-					}
-				}
-			}
-		}
 	}
 
 	// ensure the user state is transferred as well
 	srcState := filepath.Join(src, "system-data/var/lib/snapd/state.json")
 	dstState := filepath.Join(dst, "system-data/var/lib/snapd/state.json")
-	err := state.CopyState(srcState, dstState, []string{"auth.users"})
+	err := state.CopyState(srcState, dstState, []string{"auth.users", "auth.macaroon-key", "auth.last-id"})
 	if err != nil && err != state.ErrNoState {
 		return fmt.Errorf("cannot copy user state: %v", err)
 	}
@@ -170,569 +253,1191 @@
 	return nil
 }
 
-func generateMountsModeRecover(mst initramfsMountsState, recoverySystem string) error {
-	allMounted, err := generateMountsCommonInstallRecover(mst, recoverySystem)
-	if err != nil {
+// copySafeDefaultData will copy to the destination a "safe" set of data for
+// a blank recover mode, i.e. one where we cannot copy authentication, etc. from
+// the actual host ubuntu-data. Currently this is just a file to disable
+// console-conf from running.
+func copySafeDefaultData(dst string) error {
+	consoleConfCompleteFile := filepath.Join(dst, "system-data/var/lib/console-conf/complete")
+	if err := os.MkdirAll(filepath.Dir(consoleConfCompleteFile), 0755); err != nil {
 		return err
 	}
-	if !allMounted {
-		return nil
-	}
+	return ioutil.WriteFile(consoleConfCompleteFile, nil, 0644)
+}
 
-	// n+1: mount ubuntu-data for recovery
-	isRecoverDataMounted, err := osutilIsMounted(boot.InitramfsHostUbuntuDataDir)
+func copyFromGlobHelper(src, dst, globEx string) error {
+	matches, err := filepath.Glob(filepath.Join(src, globEx))
 	if err != nil {
 		return err
 	}
-	if !isRecoverDataMounted {
-		const lockKeysForLast = true
-		device, err := unlockIfEncrypted("ubuntu-data", lockKeysForLast)
-		if err != nil {
-			return err
+	for _, p := range matches {
+		comps := strings.Split(strings.TrimPrefix(p, src), "/")
+		for i := range comps {
+			part := filepath.Join(comps[0 : i+1]...)
+			fi, err := os.Stat(filepath.Join(src, part))
+			if err != nil {
+				return err
+			}
+			if fi.IsDir() {
+				if err := os.Mkdir(filepath.Join(dst, part), fi.Mode()); err != nil && !os.IsExist(err) {
+					return err
+				}
+				st, ok := fi.Sys().(*syscall.Stat_t)
+				if !ok {
+					return fmt.Errorf("cannot get stat data: %v", err)
+				}
+				if err := os.Chown(filepath.Join(dst, part), int(st.Uid), int(st.Gid)); err != nil {
+					return err
+				}
+			} else {
+				if err := osutil.CopyFile(p, filepath.Join(dst, part), osutil.CopyFlagPreserveAll); err != nil {
+					return err
+				}
+			}
 		}
+	}
 
-		fmt.Fprintf(stdout, "%s %s\n", device, boot.InitramfsHostUbuntuDataDir)
-		return nil
+	return nil
+}
+
+// states for partition state
+const (
+	// states for LocateState
+	partitionFound      = "found"
+	partitionNotFound   = "not-found"
+	partitionErrFinding = "error-finding"
+	// states for MountState
+	partitionMounted          = "mounted"
+	partitionErrMounting      = "error-mounting"
+	partitionAbsentOptional   = "absent-but-optional"
+	partitionMountedUntrusted = "mounted-untrusted"
+	// states for UnlockState
+	partitionUnlocked     = "unlocked"
+	partitionErrUnlocking = "error-unlocking"
+	// keys used to unlock for UnlockKey
+	keyRun      = "run"
+	keyFallback = "fallback"
+	keyRecovery = "recovery"
+)
+
+// partitionState is the state of a partition after recover mode has completed
+// for degraded mode.
+type partitionState struct {
+	// MountState is whether the partition was mounted successfully or not.
+	MountState string `json:"mount-state,omitempty"`
+	// MountLocation is where the partition was mounted.
+	MountLocation string `json:"mount-location,omitempty"`
+	// Device is what device the partition corresponds to. It can be the
+	// physical block device if the partition is unencrypted or if it was not
+	// successfully unlocked, or it can be a decrypted mapper device if the
+	// partition was encrypted and successfully decrypted, or it can be the
+	// empty string (or missing) if the partition was not found at all.
+	Device string `json:"device,omitempty"`
+	// FindState indicates whether the partition was found on the disk or not.
+	FindState string `json:"find-state,omitempty"`
+	// UnlockState was whether the partition was unlocked successfully or not.
+	UnlockState string `json:"unlock-state,omitempty"`
+	// UnlockKey was what key the partition was unlocked with, either "run",
+	// "fallback" or "recovery".
+	UnlockKey string `json:"unlock-key,omitempty"`
+
+	// unexported internal fields for tracking the device, these are used during
+	// state machine execution, and then combined into Device during finalize()
+	// for simple representation to the consumer of degraded.json
+
+	// fsDevice is what decrypted mapper device corresponds to the
+	// partition, it can have the following states
+	// - successfully decrypted => the decrypted mapper device
+	// - unencrypted => the block device of the partition
+	// - identified as decrypted, but failed to decrypt => empty string
+	fsDevice string
+	// partDevice is always the physical block device of the partition, in the
+	// encrypted case this is the physical encrypted partition.
+	partDevice string
+}
+
+type recoverDegradedState struct {
+	// UbuntuData is the state of the ubuntu-data (or ubuntu-data-enc)
+	// partition.
+	UbuntuData partitionState `json:"ubuntu-data,omitempty"`
+	// UbuntuBoot is the state of the ubuntu-boot partition.
+	UbuntuBoot partitionState `json:"ubuntu-boot,omitempty"`
+	// UbuntuSave is the state of the ubuntu-save (or ubuntu-save-enc)
+	// partition.
+	UbuntuSave partitionState `json:"ubuntu-save,omitempty"`
+	// ErrorLog is the log of error messages encountered during recover mode
+	// setting up degraded mode.
+	ErrorLog []string `json:"error-log"`
+}
+
+func (r *recoverDegradedState) partition(part string) *partitionState {
+	switch part {
+	case "ubuntu-data":
+		return &r.UbuntuData
+	case "ubuntu-boot":
+		return &r.UbuntuBoot
+	case "ubuntu-save":
+		return &r.UbuntuSave
 	}
+	panic(fmt.Sprintf("unknown partition %s", part))
+}
 
-	// now copy the auth data from the real ubuntu-data dir to the ephemeral
-	// ubuntu-data dir
-	if err := copyUbuntuDataAuth(boot.InitramfsHostUbuntuDataDir, boot.InitramfsDataDir); err != nil {
-		return err
+func (r *recoverDegradedState) LogErrorf(format string, v ...interface{}) {
+	msg := fmt.Sprintf(format, v...)
+	r.ErrorLog = append(r.ErrorLog, msg)
+	logger.Noticef(msg)
+}
+
+// stateFunc is a function which executes a state action, returns the next
+// function (for the next) state or nil if it is the final state.
+type stateFunc func() (stateFunc, error)
+
+// recoverModeStateMachine is a state machine implementing the logic for degraded recover
+// mode. the following state diagram shows the logic for the various states and
+// transitions:
+/**
+
+
+TODO: the state diagram is out-of-date, locate save unencrypted is being
+taken care via unlock save w/ fallback key which also works for
+unencrypted save
+
+
+                         +---------+                    +----------+
+                         | start   |                    | mount    |       fail
+                         |         +------------------->+ boot     +------------------------+
+                         |         |                    |          |                        |
+                         +---------+                    +----+-----+                        |
+                                                             |                              |
+                                                     success |                              |
+                                                             |                              |
+                                                             v                              v
+        fail or        +-------------------+  fail,     +----+------+  fail,       +--------+-------+
+        not needed     |    locate save    |  unencrypt |unlock data|  encrypted   | unlock data w/ |
+        +--------------+    unencrypted    +<-----------+w/ run key +--------------+ fallback key   +-------+
+        |              |                   |            |           |              |                |       |
+        |              +--------+----------+            +-----+-----+              +--------+-------+       |
+        |                       |                             |                             |               |
+        |                       |success                      |success                      |               |
+        |                       |                             |                    success  |        fail   |
+        v                       v                             v                             |               |
++---+---+           +-------+----+                +-------+----+                            |               |
+|       |           | mount      |       success  | mount data |                            |               |
+| done  +<----------+ save       |      +---------+            +<---------------------------+               |
+|       |           |            |      |         |            |                                            |
++--+----+           +----+-------+      |         +----------+-+                                            |
+   ^                     ^              |                    |                                              |
+   |                     | success      v                    |                                              |
+   |                     |     +--------+----+   fail        |fail                                          |
+   |                     |     | unlock save +--------+      |                                              |
+   |                     +-----+ w/ run key  |        v      v                                              |
+   |                     ^     +-------------+   +----+------+-----+                                        |
+   |                     |                       | unlock save     |                                        |
+   |                     |                       | w/ fallback key +----------------------------------------+
+   |                     +-----------------------+                 |
+   |                             success         +-------+---------+
+   |                                                     |
+   |                                                     |
+   |                                                     |
+   +-----------------------------------------------------+
+                                                fail
+
+*/
+
+type recoverModeStateMachine struct {
+	// the current state is the one that is about to be executed
+	current stateFunc
+
+	// device model
+	model *asserts.Model
+
+	// the disk we have all our partitions on
+	disk disks.Disk
+
+	// TODO:UC20: for clarity turn this into into tristate:
+	// unknown|encrypted|unencrypted
+	isEncryptedDev bool
+
+	// state for tracking what happens as we progress through degraded mode of
+	// recovery
+	degradedState *recoverDegradedState
+}
+
+// degraded returns whether a degraded recover mode state has fallen back from
+// the typical operation to some sort of degraded mode.
+func (m *recoverModeStateMachine) degraded() bool {
+	r := m.degradedState
+
+	if m.isEncryptedDev {
+		// for encrypted devices, we need to have ubuntu-save mounted
+		if r.UbuntuSave.MountState != partitionMounted {
+			return true
+		}
+
+		// we also should have all the unlock keys as run keys
+		if r.UbuntuData.UnlockKey != keyRun {
+			return true
+		}
+
+		if r.UbuntuSave.UnlockKey != keyRun {
+			return true
+		}
+	} else {
+		// for unencrypted devices, ubuntu-save must either be mounted or
+		// absent-but-optional
+		if r.UbuntuSave.MountState != partitionMounted {
+			if r.UbuntuSave.MountState != partitionAbsentOptional {
+				return true
+			}
+		}
 	}
 
-	// n+2: final step: write $(tmpfs-data)/var/lib/snapd/modeenv - this
-	//      is the tmpfs we just created above
-	modeEnv := &boot.Modeenv{
-		Mode:           "recover",
-		RecoverySystem: recoverySystem,
+	// ubuntu-boot and ubuntu-data should both be mounted
+	if r.UbuntuBoot.MountState != partitionMounted {
+		return true
 	}
-	if err := modeEnv.WriteTo(boot.InitramfsWritableDir); err != nil {
-		return err
+	if r.UbuntuData.MountState != partitionMounted {
+		return true
 	}
-	// and disable cloud-init in recover mode
-	if err := sysconfig.DisableCloudInit(boot.InitramfsWritableDir); err != nil {
-		return err
+
+	// TODO: should we also check MountLocation too?
+
+	// we should have nothing in the error log
+	if len(r.ErrorLog) != 0 {
+		return true
 	}
 
-	// n+3: done, no output, no error indicates to initramfs we are done
-	//      with mounting stuff
+	return false
+}
+
+func (m *recoverModeStateMachine) diskOpts() *disks.Options {
+	if m.isEncryptedDev {
+		return &disks.Options{
+			IsDecryptedDevice: true,
+		}
+	}
 	return nil
 }
 
-func generateMountsCommonInstallRecover(mst initramfsMountsState, recoverySystem string) (allMounted bool, err error) {
-	// 1. always ensure seed partition is mounted
-	isMounted, err := osutilIsMounted(boot.InitramfsUbuntuSeedDir)
+func (m *recoverModeStateMachine) verifyMountPoint(dir, name string) error {
+	matches, err := m.disk.MountPointIsFromDisk(dir, m.diskOpts())
 	if err != nil {
-		return false, err
+		return err
 	}
-	if !isMounted {
-		fmt.Fprintf(stdout, "/dev/disk/by-label/ubuntu-seed %s\n", boot.InitramfsUbuntuSeedDir)
-		return false, nil
+	if !matches {
+		return fmt.Errorf("cannot validate mount: %s mountpoint target %s is expected to be from disk %s but is not", name, dir, m.disk.Dev())
 	}
+	return nil
+}
 
-	// 1a. measure model
-	err = stampedAction(fmt.Sprintf("%s-model-measured", recoverySystem), func() error {
-		return measureWhenPossible(func(tpm *secboot.TPMConnection) error {
-			model, err := mst.Model()
-			if err != nil {
-				return err
-			}
-			return secMeasureModel(tpm, model)
-		})
-	})
+func (m *recoverModeStateMachine) setFindState(partName, partUUID string, err error) error {
+	part := m.degradedState.partition(partName)
 	if err != nil {
-		return false, err
+		if _, ok := err.(disks.FilesystemLabelNotFoundError); ok {
+			// explicit error that the device was not found
+			part.FindState = partitionNotFound
+			m.degradedState.LogErrorf("cannot find %v partition on disk %s", partName, m.disk.Dev())
+			return nil
+		}
+		// the error is not "not-found", so we have a real error
+		part.FindState = partitionErrFinding
+		m.degradedState.LogErrorf("error finding %v partition on disk %s: %v", partName, m.disk.Dev(), err)
+		return nil
 	}
 
-	// 2. (auto) select recovery system for now
-	isBaseMounted, err := osutilIsMounted(filepath.Join(boot.InitramfsRunMntDir, "base"))
-	if err != nil {
-		return false, err
-	}
-	isKernelMounted, err := osutilIsMounted(filepath.Join(boot.InitramfsRunMntDir, "kernel"))
+	// device was found
+	part.FindState = partitionFound
+	dev := fmt.Sprintf("/dev/disk/by-partuuid/%s", partUUID)
+	part.partDevice = dev
+	part.fsDevice = dev
+	return nil
+}
+
+func (m *recoverModeStateMachine) setMountState(part, where string, err error) error {
 	if err != nil {
-		return false, err
+		m.degradedState.LogErrorf("cannot mount %v: %v", part, err)
+		m.degradedState.partition(part).MountState = partitionErrMounting
+		return nil
 	}
-	isSnapdMounted, err := osutilIsMounted(filepath.Join(boot.InitramfsRunMntDir, "snapd"))
-	if err != nil {
-		return false, err
+
+	m.degradedState.partition(part).MountState = partitionMounted
+	m.degradedState.partition(part).MountLocation = where
+
+	if err := m.verifyMountPoint(where, part); err != nil {
+		m.degradedState.LogErrorf("cannot verify %s mount point at %v: %v", part, where, err)
+		return err
 	}
-	if !isBaseMounted || !isKernelMounted || !isSnapdMounted {
-		// load the recovery system and generate mounts for kernel/base
-		// and snapd
-		var whichTypes []snap.Type
-		if !isBaseMounted {
-			whichTypes = append(whichTypes, snap.TypeBase)
-		}
-		if !isKernelMounted {
-			whichTypes = append(whichTypes, snap.TypeKernel)
-		}
-		if !isSnapdMounted {
-			whichTypes = append(whichTypes, snap.TypeSnapd)
-		}
-		essSnaps, err := mst.RecoverySystemEssentialSnaps("", whichTypes)
-		if err != nil {
-			return false, fmt.Errorf("cannot load metadata and verify essential bootstrap snaps %v: %v", whichTypes, err)
-		}
+	return nil
+}
 
-		// TODO:UC20: do we need more cross checks here?
-		for _, essentialSnap := range essSnaps {
-			switch essentialSnap.EssentialType {
-			case snap.TypeBase:
-				fmt.Fprintf(stdout, "%s %s\n", essentialSnap.Path, filepath.Join(boot.InitramfsRunMntDir, "base"))
-			case snap.TypeKernel:
-				// TODO:UC20: we need to cross-check the kernel path with snapd_recovery_kernel used by grub
-				fmt.Fprintf(stdout, "%s %s\n", essentialSnap.Path, filepath.Join(boot.InitramfsRunMntDir, "kernel"))
-			case snap.TypeSnapd:
-				fmt.Fprintf(stdout, "%s %s\n", essentialSnap.Path, filepath.Join(boot.InitramfsRunMntDir, "snapd"))
-			}
-		}
+func (m *recoverModeStateMachine) setUnlockStateWithRunKey(partName string, unlockRes secboot.UnlockResult, err error) error {
+	part := m.degradedState.partition(partName)
+	// save the device if we found it from secboot
+	if unlockRes.PartDevice != "" {
+		part.FindState = partitionFound
+		part.partDevice = unlockRes.PartDevice
+		part.fsDevice = unlockRes.FsDevice
+	} else {
+		part.FindState = partitionNotFound
+	}
+	if unlockRes.IsEncrypted {
+		m.isEncryptedDev = true
 	}
 
-	// 3. the ephemeral data partition
-	isMounted, err = osutilIsMounted(boot.InitramfsDataDir)
 	if err != nil {
-		return false, err
+		// create different error message for encrypted vs unencrypted
+		if unlockRes.IsEncrypted {
+			// if we know the device is decrypted we must also always know at
+			// least the partDevice (which is the encrypted block device)
+			m.degradedState.LogErrorf("cannot unlock encrypted %s (device %s) with sealed run key: %v", partName, part.partDevice, err)
+			part.UnlockState = partitionErrUnlocking
+		} else {
+			// TODO: we don't know if this is a plain not found or  a different error
+			m.degradedState.LogErrorf("cannot locate %s partition for mounting host data: %v", partName, err)
+		}
+
+		return nil
 	}
-	if !isMounted {
-		fmt.Fprintf(stdout, "--type=tmpfs tmpfs %s\n", boot.InitramfsDataDir)
-		return false, nil
+
+	if unlockRes.IsEncrypted {
+		// unlocked successfully
+		part.UnlockState = partitionUnlocked
+		part.UnlockKey = keyRun
 	}
 
-	return true, nil
+	return nil
 }
 
-// TODO:UC20 move some of these helpers somehow to our secboot
+func (m *recoverModeStateMachine) setUnlockStateWithFallbackKey(partName string, unlockRes secboot.UnlockResult, err error, partitionOptional bool) error {
+	// first check the result and error for consistency; since we are using udev
+	// there could be inconsistent results at different points in time
+
+	// TODO: consider refactoring UnlockVolumeUsingSealedKeyIfEncrypted to not
+	//       also find the partition on the disk, that should eliminate this
+	//       consistency checking as we can code it such that we don't get these
+	//       possible inconsistencies
+
+	// do basic consistency checking on unlockRes to make sure the
+	// result makes sense.
+	if unlockRes.FsDevice != "" && err != nil {
+		// This case should be impossible to enter, we can't
+		// have a filesystem device but an error set
+		return fmt.Errorf("internal error: inconsistent return values from UnlockVolumeUsingSealedKeyIfEncrypted for partition %s: %v", partName, err)
+	}
+
+	part := m.degradedState.partition(partName)
+	// Also make sure that if we previously saw a partition device that we see
+	// the same device again.
+	if unlockRes.PartDevice != "" && part.partDevice != "" && unlockRes.PartDevice != part.partDevice {
+		return fmt.Errorf("inconsistent partitions found for %s: previously found %s but now found %s", partName, part.partDevice, unlockRes.PartDevice)
+	}
+
+	// ensure consistency between encrypted state of the device/disk and what we
+	// may have seen previously
+	if m.isEncryptedDev && !unlockRes.IsEncrypted {
+		// then we previously were able to positively identify an
+		// ubuntu-data-enc but can't anymore, so we have inconsistent results
+		// from inspecting the disk which is suspicious and we should fail
+		return fmt.Errorf("inconsistent disk encryption status: previous access resulted in encrypted, but now is unencrypted from partition %s", partName)
+	}
+
+	// now actually process the result into the state
+	if unlockRes.PartDevice != "" {
+		part.FindState = partitionFound
+		// Note that in some case this may be redundantly assigning the same
+		// value to partDevice again.
+		part.partDevice = unlockRes.PartDevice
+		part.fsDevice = unlockRes.FsDevice
+	}
+
+	// There are a few cases where this could be the first time that we found a
+	// decrypted device in the UnlockResult, but m.isEncryptedDev is still
+	// false.
+	// - The first case is if we couldn't find ubuntu-boot at all, in which case
+	// we can't use the run object keys from there and instead need to directly
+	// fallback to trying the fallback object keys from ubuntu-seed
+	// - The second case is if we couldn't identify an ubuntu-data-enc or an
+	// ubuntu-data partition at all, we still could have an ubuntu-save-enc
+	// partition in which case we maybe could still have an encrypted disk that
+	// needs unlocking with the fallback object keys from ubuntu-seed
+	//
+	// As such, if m.isEncryptedDev is false, but unlockRes.IsEncrypted is
+	// true, then it is safe to assign m.isEncryptedDev to true.
+	if !m.isEncryptedDev && unlockRes.IsEncrypted {
+		m.isEncryptedDev = true
+	}
+
+	if err != nil {
+		// create different error message for encrypted vs unencrypted
+		if m.isEncryptedDev {
+			m.degradedState.LogErrorf("cannot unlock encrypted %s partition with sealed fallback key: %v", partName, err)
+			part.UnlockState = partitionErrUnlocking
+		} else {
+			// if we don't have an encrypted device and err != nil, then the
+			// device must be not-found, see above checks
 
-const tpmPCR = 12
+			// if the partition is optional (like ubuntu-save is) then don't
+			// report an error for ubuntu-save not being found and also set it
+			// as absent-but-optional
+			if unlockRes.PartDevice == "" && partitionOptional {
+				part.MountState = partitionAbsentOptional
+			} else {
+				// log the error the partition is mandatory
+				m.degradedState.LogErrorf("cannot locate %s partition: %v", partName, err)
+			}
+		}
 
-func secMeasureEpoch(tpm *secboot.TPMConnection) error {
-	if err := secbootMeasureSnapSystemEpochToTPM(tpm, tpmPCR); err != nil {
-		return fmt.Errorf("cannot measure snap system epoch: %v", err)
+		return nil
 	}
-	return nil
-}
 
-func secMeasureModel(tpm *secboot.TPMConnection, model *asserts.Model) error {
-	if err := secbootMeasureSnapModelToTPM(tpm, tpmPCR, model); err != nil {
-		return fmt.Errorf("cannot measure snap system model: %v", err)
+	if m.isEncryptedDev {
+		// unlocked successfully
+		part.UnlockState = partitionUnlocked
+
+		// figure out which key/method we used to unlock the partition
+		switch unlockRes.UnlockMethod {
+		case secboot.UnlockedWithSealedKey:
+			part.UnlockKey = keyFallback
+		case secboot.UnlockedWithRecoveryKey:
+			part.UnlockKey = keyRecovery
+
+			// TODO: should we fail with internal error for default case here?
+		}
 	}
+
 	return nil
 }
 
-func measureWhenPossible(whatHow func(tpm *secboot.TPMConnection) error) error {
-	// the model is ready, we're good to try measuring it now
-	tpm, err := insecureConnectToTPM()
-	if err != nil {
-		var perr *os.PathError
-		// XXX: xerrors.Is() does not work with PathErrors?
-		if xerrors.As(err, &perr) {
-			// no TPM
-			return nil
+func newRecoverModeStateMachine(model *asserts.Model, disk disks.Disk) *recoverModeStateMachine {
+	m := &recoverModeStateMachine{
+		model: model,
+		disk:  disk,
+		degradedState: &recoverDegradedState{
+			ErrorLog: []string{},
+		},
+	}
+	// first step is to mount ubuntu-boot to check for run mode keys to unlock
+	// ubuntu-data
+	m.current = m.mountBoot
+	return m
+}
+
+func (m *recoverModeStateMachine) execute() (finished bool, err error) {
+	next, err := m.current()
+	m.current = next
+	finished = next == nil
+	if finished && err == nil {
+		if err := m.finalize(); err != nil {
+			return true, err
 		}
-		return fmt.Errorf("cannot open TPM connection: %v", err)
 	}
-	defer tpm.Close()
-
-	return whatHow(tpm)
+	return finished, err
 }
 
-func generateMountsModeRun(mst initramfsMountsState) error {
-	// 1.1 always ensure basic partitions are mounted
-	for _, d := range []string{boot.InitramfsUbuntuBootDir, boot.InitramfsUbuntuSeedDir} {
-		isMounted, err := osutilIsMounted(d)
-		if err != nil {
-			return err
+func (m *recoverModeStateMachine) finalize() error {
+	// check soundness
+	// the grade check makes sure that if data was mounted unencrypted
+	// but the model is secured it will end up marked as untrusted
+	isEncrypted := m.isEncryptedDev || m.model.StorageSafety() == asserts.StorageSafetyEncrypted
+	part := m.degradedState.partition("ubuntu-data")
+	if part.MountState == partitionMounted && isEncrypted {
+		// check that save and data match
+		// We want to avoid a chosen ubuntu-data
+		// (e.g. activated with a recovery key) to get access
+		// via its logins to the secrets in ubuntu-save (in
+		// particular the policy update auth key)
+		// TODO:UC20: we should try to be a bit more specific here in checking that
+		//       data and save match, and not mark data as untrusted if we
+		//       know that the real save is locked/protected (or doesn't exist
+		//       in the case of bad corruption) because currently this code will
+		//       mark data as untrusted, even if it was unlocked with the run
+		//       object key and we failed to unlock ubuntu-save at all, which is
+		//       undesirable. This effectively means that you need to have both
+		//       ubuntu-data and ubuntu-save unlockable and have matching marker
+		//       files in order to use the files from ubuntu-data to log-in,
+		//       etc.
+		trustData, _ := checkDataAndSavaPairing(boot.InitramfsHostWritableDir)
+		if !trustData {
+			part.MountState = partitionMountedUntrusted
+			m.degradedState.LogErrorf("cannot trust ubuntu-data, ubuntu-save and ubuntu-data are not marked as from the same install")
 		}
-		if !isMounted {
-			// we need ubuntu-seed to be mounted before we can continue to
-			// check ubuntu-data, so return if we need something mounted
-			fmt.Fprintf(stdout, "/dev/disk/by-label/%s %s\n", filepath.Base(d), d)
-			return nil
+	}
+
+	// finally, combine the states of partDevice and fsDevice into the
+	// exported Device field for marshalling
+	// ubuntu-boot is easy - it will always be unencrypted so we just set
+	// Device to partDevice
+	m.degradedState.partition("ubuntu-boot").Device = m.degradedState.partition("ubuntu-boot").partDevice
+
+	// for ubuntu-data and save, we need to actually look at the states
+	for _, partName := range []string{"ubuntu-data", "ubuntu-save"} {
+		part := m.degradedState.partition(partName)
+		if part.fsDevice == "" {
+			// then the device is encrypted, but we failed to decrypt it, so
+			// set Device to the encrypted block device
+			part.Device = part.partDevice
+		} else {
+			// all other cases, fsDevice is set to what we want to
+			// export, either it is set to the decrypted mapper device in the
+			// case it was successfully decrypted, or it is set to the encrypted
+			// block device if we failed to decrypt it, or it was set to the
+			// unencrypted block device if it was unencrypted
+			part.Device = part.fsDevice
 		}
 	}
 
-	// 1.1a measure model
-	err := stampedAction("run-model-measured", func() error {
-		return measureWhenPossible(func(tpm *secboot.TPMConnection) error {
-			model, err := mst.UnverifiedBootModel()
-			if err != nil {
-				return err
-			}
-			return secMeasureModel(tpm, model)
-		})
-	})
-	if err != nil {
-		return err
+	return nil
+}
+
+func (m *recoverModeStateMachine) trustData() bool {
+	return m.degradedState.partition("ubuntu-data").MountState == partitionMounted
+}
+
+// mountBoot is the first state to execute in the state machine, it can
+// transition to the following states:
+// - if ubuntu-boot is mounted successfully, execute unlockDataRunKey
+// - if ubuntu-boot can't be mounted, execute unlockDataFallbackKey
+// - if we mounted the wrong ubuntu-boot (or otherwise can't verify which one we
+//   mounted), return fatal error
+func (m *recoverModeStateMachine) mountBoot() (stateFunc, error) {
+	part := m.degradedState.partition("ubuntu-boot")
+	// use the disk we mounted ubuntu-seed from as a reference to find
+	// ubuntu-seed and mount it
+	partUUID, findErr := m.disk.FindMatchingPartitionUUID("ubuntu-boot")
+	if err := m.setFindState("ubuntu-boot", partUUID, findErr); err != nil {
+		return nil, err
+	}
+	if part.FindState != partitionFound {
+		// if we didn't find ubuntu-boot, we can't try to unlock data with the
+		// run key, and should instead just jump straight to attempting to
+		// unlock with the fallback key
+		return m.unlockDataFallbackKey, nil
+	}
+
+	// should we fsck ubuntu-boot? probably yes because on some platforms
+	// (u-boot for example) ubuntu-boot is vfat and it could have been unmounted
+	// dirtily, and we need to fsck it to ensure it is mounted safely before
+	// reading keys from it
+	fsckSystemdOpts := &systemdMountOptions{
+		NeedsFsck: true,
+	}
+	mountErr := doSystemdMount(part.fsDevice, boot.InitramfsUbuntuBootDir, fsckSystemdOpts)
+	if err := m.setMountState("ubuntu-boot", boot.InitramfsUbuntuBootDir, mountErr); err != nil {
+		return nil, err
+	}
+	if part.MountState == partitionErrMounting {
+		// if we didn't mount data, then try to unlock data with the
+		// fallback key
+		return m.unlockDataFallbackKey, nil
+	}
+
+	// next step try to unlock data with run object
+	return m.unlockDataRunKey, nil
+}
+
+// stateUnlockDataRunKey will try to unlock ubuntu-data with the normal run-mode
+// key, and if it fails, progresses to the next state, which is either:
+// - failed to unlock data, but we know it's an encrypted device -> try to unlock with fallback key
+// - failed to find data at all -> try to unlock save
+// - unlocked data with run key -> mount data
+func (m *recoverModeStateMachine) unlockDataRunKey() (stateFunc, error) {
+	runModeKey := filepath.Join(boot.InitramfsBootEncryptionKeyDir, "ubuntu-data.sealed-key")
+	unlockOpts := &secboot.UnlockVolumeUsingSealedKeyOptions{
+		// don't allow using the recovery key to unlock, we only try using the
+		// recovery key after we first try the fallback object
+		AllowRecoveryKey: false,
+	}
+	unlockRes, unlockErr := secbootUnlockVolumeUsingSealedKeyIfEncrypted(m.disk, "ubuntu-data", runModeKey, unlockOpts)
+	if err := m.setUnlockStateWithRunKey("ubuntu-data", unlockRes, unlockErr); err != nil {
+		return nil, err
+	}
+	if unlockErr != nil {
+		// we couldn't unlock ubuntu-data with the primary key, or we didn't
+		// find it in the unencrypted case
+		if unlockRes.IsEncrypted {
+			// we know the device is encrypted, so the next state is to try
+			// unlocking with the fallback key
+			return m.unlockDataFallbackKey, nil
+		}
+
+		// if we didn't even find the device to the point where it would have
+		// been identified as decrypted or unencrypted device, we could have
+		// just entirely lost ubuntu-data-enc, and we could still have an
+		// encrypted device, so instead try to unlock ubuntu-save with the
+		// fallback key, the logic there can also handle an unencrypted ubuntu-save
+		return m.unlockSaveFallbackKey, nil
+	}
+
+	// otherwise successfully unlocked it (or just found it if it was unencrypted)
+	// so just mount it
+	return m.mountData, nil
+}
+
+func (m *recoverModeStateMachine) unlockDataFallbackKey() (stateFunc, error) {
+	// try to unlock data with the fallback key on ubuntu-seed, which must have
+	// been mounted at this point
+	unlockOpts := &secboot.UnlockVolumeUsingSealedKeyOptions{
+		// we want to allow using the recovery key if the fallback key fails as
+		// using the fallback object is the last chance before we give up trying
+		// to unlock data
+		AllowRecoveryKey: true,
+	}
+	// TODO: this prompts for a recovery key
+	// TODO: we should somehow customize the prompt to mention what key we need
+	// the user to enter, and what we are unlocking (as currently the prompt
+	// says "recovery key" and the partition UUID for what is being unlocked)
+	dataFallbackKey := filepath.Join(boot.InitramfsSeedEncryptionKeyDir, "ubuntu-data.recovery.sealed-key")
+	unlockRes, unlockErr := secbootUnlockVolumeUsingSealedKeyIfEncrypted(m.disk, "ubuntu-data", dataFallbackKey, unlockOpts)
+	const partitionMandatory = false
+	if err := m.setUnlockStateWithFallbackKey("ubuntu-data", unlockRes, unlockErr, partitionMandatory); err != nil {
+		return nil, err
+	}
+	if unlockErr != nil {
+		// skip trying to mount data, since we did not unlock data we cannot
+		// open save with with the run key, so try the fallback one
+		return m.unlockSaveFallbackKey, nil
 	}
-	// TODO:UC20: cross check the model we read from ubuntu-boot/model with
-	// one recorded in ubuntu-data modeenv during install
 
-	// 1.2 mount Data, and exit, as it needs to be mounted for us to do step 2
-	isDataMounted, err := osutilIsMounted(boot.InitramfsDataDir)
+	// unlocked it, now go mount it
+	return m.mountData, nil
+}
+
+func (m *recoverModeStateMachine) mountData() (stateFunc, error) {
+	data := m.degradedState.partition("ubuntu-data")
+	// don't do fsck on the data partition, it could be corrupted
+	mountErr := doSystemdMount(data.fsDevice, boot.InitramfsHostUbuntuDataDir, nil)
+	if err := m.setMountState("ubuntu-data", boot.InitramfsHostUbuntuDataDir, mountErr); err != nil {
+		return nil, err
+	}
+	if mountErr == nil && m.isEncryptedDev {
+		// if we succeeded in mounting data and we are encrypted, the next step
+		// is to unlock save with the run key from ubuntu-data
+		return m.unlockSaveRunKey, nil
+	}
+
+	// otherwise we always fall back to unlocking save with the fallback key,
+	// this could be two cases:
+	// 1. we are unencrypted in which case the secboot function used in
+	//    unlockSaveRunKey will fail and then proceed to trying the fallback key
+	//    function anyways which uses a secboot function that is suitable for
+	//    unencrypted data
+	// 2. we are encrypted and we failed to mount data successfully, meaning we
+	//    don't have the bare key from ubuntu-data to use, and need to fall back
+	//    to the sealed key from ubuntu-seed
+	return m.unlockSaveFallbackKey, nil
+}
+
+func (m *recoverModeStateMachine) unlockSaveRunKey() (stateFunc, error) {
+	// to get to this state, we needed to have mounted ubuntu-data on host, so
+	// if encrypted, we can try to read the run key from host ubuntu-data
+	saveKey := filepath.Join(dirs.SnapFDEDirUnder(boot.InitramfsHostWritableDir), "ubuntu-save.key")
+	key, err := ioutil.ReadFile(saveKey)
 	if err != nil {
-		return err
+		// log the error and skip to trying the fallback key
+		m.degradedState.LogErrorf("cannot access run ubuntu-save key: %v", err)
+		return m.unlockSaveFallbackKey, nil
 	}
-	if !isDataMounted {
-		const lockKeysForLast = true
-		device, err := unlockIfEncrypted("ubuntu-data", lockKeysForLast)
-		if err != nil {
-			return err
-		}
 
-		fmt.Fprintf(stdout, "%s %s\n", device, boot.InitramfsDataDir)
-		return nil
+	unlockRes, unlockErr := secbootUnlockEncryptedVolumeUsingKey(m.disk, "ubuntu-save", key)
+	if err := m.setUnlockStateWithRunKey("ubuntu-save", unlockRes, unlockErr); err != nil {
+		return nil, err
+	}
+	if unlockErr != nil {
+		// failed to unlock with run key, try fallback key
+		return m.unlockSaveFallbackKey, nil
 	}
 
-	// 2.1 read modeenv
-	modeEnv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
+	// unlocked it properly, go mount it
+	return m.mountSave, nil
+}
+
+func (m *recoverModeStateMachine) unlockSaveFallbackKey() (stateFunc, error) {
+	// remember what we assumed about encryption before looking at
+	// save
+	assumeEncrypted := m.isEncryptedDev
+
+	// try to unlock save with the fallback key on ubuntu-seed, which must have
+	// been mounted at this point
+	unlockOpts := &secboot.UnlockVolumeUsingSealedKeyOptions{
+		// we want to allow using the recovery key if the fallback key fails as
+		// using the fallback object is the last chance before we give up trying
+		// to unlock save
+		AllowRecoveryKey: true,
+	}
+	saveFallbackKey := filepath.Join(boot.InitramfsSeedEncryptionKeyDir, "ubuntu-save.recovery.sealed-key")
+	// TODO: this prompts again for a recover key, but really this is the
+	// reinstall key we will prompt for
+	// TODO: we should somehow customize the prompt to mention what key we need
+	// the user to enter, and what we are unlocking (as currently the prompt
+	// says "recovery key" and the partition UUID for what is being unlocked)
+	unlockRes, unlockErr := secbootUnlockVolumeUsingSealedKeyIfEncrypted(m.disk, "ubuntu-save", saveFallbackKey, unlockOpts)
+	const partitionOptionalIfUnencrypted = true
+	if err := m.setUnlockStateWithFallbackKey("ubuntu-save", unlockRes, unlockErr, partitionOptionalIfUnencrypted); err != nil {
+		return nil, err
+	}
+	if unlockErr != nil {
+		// all done, nothing left to try and mount, mounting ubuntu-save is the
+		// last step but we couldn't find or unlock it
+		return nil, nil
+	}
+
+	// do a consistency check to make sure that if we found ubuntu-data
+	// unencrypted that we don't also mount ubuntu-save as encrypted
+	data := m.degradedState.partition("ubuntu-data")
+	if unlockRes.IsEncrypted && data.FindState == partitionFound && !assumeEncrypted {
+		return nil, fmt.Errorf("inconsistent encryption status for disk %s: ubuntu-data (device %s) was found unencrypted but ubuntu-save (device %s) was found to be encrypted", m.disk.Dev(), data.fsDevice, unlockRes.FsDevice)
+	}
+
+	// otherwise we unlocked it, so go mount it
+	return m.mountSave, nil
+}
+
+func (m *recoverModeStateMachine) mountSave() (stateFunc, error) {
+	save := m.degradedState.partition("ubuntu-save")
+	// TODO: should we fsck ubuntu-save ?
+	mountErr := doSystemdMount(save.fsDevice, boot.InitramfsUbuntuSaveDir, nil)
+	if err := m.setMountState("ubuntu-save", boot.InitramfsUbuntuSaveDir, mountErr); err != nil {
+		return nil, err
+	}
+	// all done, nothing left to try and mount
+	return nil, nil
+}
+
+func generateMountsModeRecover(mst *initramfsMountsState) error {
+	// steps 1 and 2 are shared with install mode
+	model, err := generateMountsCommonInstallRecover(mst)
 	if err != nil {
 		return err
 	}
 
-	// 2.2.1 check if base is mounted
-	isBaseMounted, err := osutilIsMounted(filepath.Join(boot.InitramfsRunMntDir, "base"))
+	// get the disk that we mounted the ubuntu-seed partition from as a
+	// reference point for future mounts
+	disk, err := disks.DiskFromMountPoint(boot.InitramfsUbuntuSeedDir, nil)
 	if err != nil {
 		return err
 	}
-	if !isBaseMounted {
-		// 2.2.2 use modeenv base_status and try_base to see  if we are trying
-		// an update to the base snap
-		base := modeEnv.Base
-		if base == "" {
-			// we have no fallback base!
-			return fmt.Errorf("modeenv corrupt: missing base setting")
-		}
-		if modeEnv.BaseStatus == boot.TryStatus {
-			// then we are trying a base snap update and there should be a
-			// try_base set in the modeenv too
-			if modeEnv.TryBase != "" {
-				// check that the TryBase exists in ubuntu-data
-				tryBaseSnapPath := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), modeEnv.TryBase)
-				if osutil.FileExists(tryBaseSnapPath) {
-					// set the TryBase and have the initramfs mount this base
-					// snap
-					modeEnv.BaseStatus = boot.TryingStatus
-					base = modeEnv.TryBase
-				} else {
-					logger.Noticef("try-base snap %q does not exist", modeEnv.TryBase)
-				}
-			} else {
-				logger.Noticef("try-base snap is empty, but \"base_status\" is \"trying\"")
+
+	// 3. run the state machine logic for mounting partitions, this involves
+	//    trying to unlock then mount ubuntu-data, and then unlocking and
+	//    mounting ubuntu-save
+	//    see the state* functions for details of what each step does and
+	//    possible transition points
+
+	machine, err := func() (machine *recoverModeStateMachine, err error) {
+		// first state to execute is to unlock ubuntu-data with the run key
+		machine = newRecoverModeStateMachine(model, disk)
+		for {
+			finished, err := machine.execute()
+			// TODO: consider whether certain errors are fatal or not
+			if err != nil {
+				return nil, err
+			}
+			if finished {
+				break
 			}
-			// TODO:UC20: log a message if try_base is unset here?
-		} else if modeEnv.BaseStatus == boot.TryingStatus {
-			// snapd failed to start with the base snap update, so we need to
-			// fallback to the old base snap and clear base_status
-			modeEnv.BaseStatus = boot.DefaultStatus
-		} else if modeEnv.BaseStatus != boot.DefaultStatus {
-			logger.Noticef("\"base_status\" has an invalid setting: %q", modeEnv.BaseStatus)
 		}
 
-		baseSnapPath := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), base)
-		fmt.Fprintf(stdout, "%s %s\n", baseSnapPath, filepath.Join(boot.InitramfsRunMntDir, "base"))
-	}
-
-	// 2.3.1 check if the kernel is mounted
-	isKernelMounted, err := osutilIsMounted(filepath.Join(boot.InitramfsRunMntDir, "kernel"))
+		return machine, nil
+	}()
 	if err != nil {
 		return err
 	}
-	if !isKernelMounted {
-		// make a map to easily check if a kernel snap is valid or not
-		validKernels := make(map[string]bool, len(modeEnv.CurrentKernels))
-		for _, validKernel := range modeEnv.CurrentKernels {
-			validKernels[validKernel] = true
+
+	// 3.1 write out degraded.json if we ended up falling back somewhere
+	if machine.degraded() {
+		b, err := json.Marshal(machine.degradedState)
+		if err != nil {
+			return err
 		}
 
-		// find ubuntu-boot bootloader to get the kernel_status and kernel.efi
-		// status so we can determine the right kernel snap to have mounted
+		if err := os.MkdirAll(dirs.SnapBootstrapRunDir, 0755); err != nil {
+			return err
+		}
 
-		// TODO:UC20: should all this logic move to boot package? feels awfully
-		// similar to the logic in revisions() for bootState20
+		// leave the information about degraded state at an ephemeral location
+		if err := ioutil.WriteFile(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), b, 0644); err != nil {
+			return err
+		}
+	}
 
-		// At this point the run mode bootloader is under the native
-		// layout, no /boot mount.
-		opts := &bootloader.Options{NoSlashBoot: true}
-		bl, err := bootloader.Find(boot.InitramfsUbuntuBootDir, opts)
-		if err != nil {
-			return fmt.Errorf("internal error: cannot find run system bootloader: %v", err)
+	// 4. final step: copy the auth data and network config from
+	//    the real ubuntu-data dir to the ephemeral ubuntu-data
+	//    dir, write the modeenv to the tmpfs data, and disable
+	//    cloud-init in recover mode
+
+	// if we have the host location, then we were able to successfully mount
+	// ubuntu-data, and as such we can proceed with copying files from there
+	// onto the tmpfs
+	// Proceed only if we trust ubuntu-data to be paired with ubuntu-save
+	if machine.trustData() {
+		// TODO: erroring here should fallback to copySafeDefaultData and
+		// proceed on with degraded mode anyways
+		if err := copyUbuntuDataAuth(boot.InitramfsHostUbuntuDataDir, boot.InitramfsDataDir); err != nil {
+			return err
 		}
+		if err := copyNetworkConfig(boot.InitramfsHostUbuntuDataDir, boot.InitramfsDataDir); err != nil {
+			return err
+		}
+		if err := copyUbuntuDataMisc(boot.InitramfsHostUbuntuDataDir, boot.InitramfsDataDir); err != nil {
+			return err
+		}
+	} else {
+		// we don't have ubuntu-data host mountpoint, so we should setup safe
+		// defaults for i.e. console-conf in the running image to block
+		// attackers from accessing the system - just because we can't access
+		// ubuntu-data doesn't mean that attackers wouldn't be able to if they
+		// could login
 
-		var kern, tryKern snap.PlaceInfo
-		var kernStatus string
+		if err := copySafeDefaultData(boot.InitramfsDataDir); err != nil {
+			return err
+		}
+	}
 
-		ebl, ok := bl.(bootloader.ExtractedRunKernelImageBootloader)
-		if ok {
-			// use ebl methods
-			kern, err = ebl.Kernel()
-			if err != nil {
-				return fmt.Errorf("no fallback kernel snap: %v", err)
-			}
+	modeEnv := &boot.Modeenv{
+		Mode:           "recover",
+		RecoverySystem: mst.recoverySystem,
+	}
+	if err := modeEnv.WriteTo(boot.InitramfsWritableDir); err != nil {
+		return err
+	}
 
-			tryKern, err = ebl.TryKernel()
-			if err != nil && err != bootloader.ErrNoTryKernelRef {
-				return err
-			}
+	// finally we need to modify the bootenv to mark the system as successful,
+	// this ensures that when you reboot from recover mode without doing
+	// anything else, you are auto-transitioned back to run mode
+	// TODO:UC20: as discussed unclear we need to pass the recovery system here
+	if err := boot.EnsureNextBootToRunMode(mst.recoverySystem); err != nil {
+		return err
+	}
 
-			m, err := ebl.GetBootVars("kernel_status")
-			if err != nil {
-				return fmt.Errorf("cannot get kernel_status from bootloader %s", ebl.Name())
-			}
+	// done, no output, no error indicates to initramfs we are done with
+	// mounting stuff
+	return nil
+}
 
-			kernStatus = m["kernel_status"]
-		} else {
-			// use the bootenv
-			m, err := bl.GetBootVars("snap_kernel", "snap_try_kernel", "kernel_status")
-			if err != nil {
-				return err
-			}
-			kern, err = snap.ParsePlaceInfoFromSnapFileName(m["snap_kernel"])
-			if err != nil {
-				return fmt.Errorf("no fallback kernel snap: %v", err)
-			}
+// checkDataAndSavaPairing make sure that ubuntu-data and ubuntu-save
+// come from the same install by comparing secret markers in them
+func checkDataAndSavaPairing(rootdir string) (bool, error) {
+	// read the secret marker file from ubuntu-data
+	markerFile1 := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "marker")
+	marker1, err := ioutil.ReadFile(markerFile1)
+	if err != nil {
+		return false, err
+	}
+	// read the secret marker file from ubuntu-save
+	markerFile2 := filepath.Join(dirs.SnapFDEDirUnderSave(boot.InitramfsUbuntuSaveDir), "marker")
+	marker2, err := ioutil.ReadFile(markerFile2)
+	if err != nil {
+		return false, err
+	}
+	return subtle.ConstantTimeCompare(marker1, marker2) == 1, nil
+}
 
-			// only try to parse snap_try_kernel if it is set
-			if m["snap_try_kernel"] != "" {
-				tryKern, err = snap.ParsePlaceInfoFromSnapFileName(m["snap_try_kernel"])
-				if err != nil {
-					logger.Noticef("try-kernel setting is invalid: %v", err)
-				}
-			}
+// mountPartitionMatchingKernelDisk will select the partition to mount at dir,
+// using the boot package function FindPartitionUUIDForBootedKernelDisk to
+// determine what partition the booted kernel came from. If which disk the
+// kernel came from cannot be determined, then it will fallback to mounting via
+// the specified disk label.
+func mountPartitionMatchingKernelDisk(dir, fallbacklabel string) error {
+	partuuid, err := bootFindPartitionUUIDForBootedKernelDisk()
+	// TODO: the by-partuuid is only available on gpt disks, on mbr we need
+	//       to use by-uuid or by-id
+	partSrc := filepath.Join("/dev/disk/by-partuuid", partuuid)
+	if err != nil {
+		// no luck, try mounting by label instead
+		partSrc = filepath.Join("/dev/disk/by-label", fallbacklabel)
+	}
+
+	opts := &systemdMountOptions{
+		// always fsck the partition when we are mounting it, as this is the
+		// first partition we will be mounting, we can't know if anything is
+		// corrupted yet
+		NeedsFsck: true,
+	}
+	return doSystemdMount(partSrc, dir, opts)
+}
+
+func generateMountsCommonInstallRecover(mst *initramfsMountsState) (*asserts.Model, error) {
+	// 1. always ensure seed partition is mounted first before the others,
+	//      since the seed partition is needed to mount the snap files there
+	if err := mountPartitionMatchingKernelDisk(boot.InitramfsUbuntuSeedDir, "ubuntu-seed"); err != nil {
+		return nil, err
+	}
+
+	// load model and verified essential snaps metadata
+	typs := []snap.Type{snap.TypeBase, snap.TypeKernel, snap.TypeSnapd, snap.TypeGadget}
+	model, essSnaps, err := mst.ReadEssential("", typs)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load metadata and verify essential bootstrap snaps %v: %v", typs, err)
+	}
 
-			kernStatus = m["kernel_status"]
+	// 2.1. measure model
+	err = stampedAction(fmt.Sprintf("%s-model-measured", mst.recoverySystem), func() error {
+		return secbootMeasureSnapModelWhenPossible(func() (*asserts.Model, error) {
+			return model, nil
+		})
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// 2.2. (auto) select recovery system and mount seed snaps
+	// TODO:UC20: do we need more cross checks here?
+	for _, essentialSnap := range essSnaps {
+		if essentialSnap.EssentialType == snap.TypeGadget {
+			// don't need to mount the gadget anywhere, but we use the snap
+			// later hence it is loaded
+			continue
+		}
+		dir := snapTypeToMountDir[essentialSnap.EssentialType]
+		// TODO:UC20: we need to cross-check the kernel path with snapd_recovery_kernel used by grub
+		if err := doSystemdMount(essentialSnap.Path, filepath.Join(boot.InitramfsRunMntDir, dir), nil); err != nil {
+			return nil, err
 		}
+	}
 
-		kernelFile := kern.Filename()
-		if !validKernels[kernelFile] {
-			// we don't trust the fallback kernel!
-			return fmt.Errorf("fallback kernel snap %q is not trusted in the modeenv", kernelFile)
-		}
-
-		if kernStatus == boot.TryingStatus {
-			// check for the try kernel
-			if tryKern != nil {
-				tryKernelFile := tryKern.Filename()
-				if validKernels[tryKernelFile] {
-					kernelFile = tryKernelFile
-				} else {
-					logger.Noticef("try-kernel %q is not trusted in the modeenv", tryKernelFile)
-				}
-			} else {
-				logger.Noticef("missing try-kernel, even though \"kernel_status\" is \"trying\"")
-			}
+	// TODO:UC20: after we have the kernel and base snaps mounted, we should do
+	//            the bind mounts from the kernel modules on top of the base
+	//            mount and delete the corresponding systemd units from the
+	//            initramfs layout
 
-			// TODO:UC20: actually we really shouldn't be falling back here at
-			//            all - if the kernel we booted isn't mountable in the
-			//            initramfs, we should trigger a reboot so that we boot
-			//            the fallback kernel and then mount that one
+	// TODO:UC20: after the kernel and base snaps are mounted, we should setup
+	//            writable here as well to take over from "the-modeenv" script
+	//            in the initrd too
+
+	// TODO:UC20: after the kernel and base snaps are mounted and writable is
+	//            mounted, we should also implement writable-paths here too as
+	//            writing it in Go instead of shellscript is desirable
+
+	// 2.3. mount "ubuntu-data" on a tmpfs
+	mntOpts := &systemdMountOptions{
+		Tmpfs: true,
+	}
+	err = doSystemdMount("tmpfs", boot.InitramfsDataDir, mntOpts)
+	if err != nil {
+		return nil, err
+	}
+
+	// finally get the gadget snap from the essential snaps and use it to
+	// configure the ephemeral system
+	// should only be one seed snap
+	gadgetPath := ""
+	for _, essentialSnap := range essSnaps {
+		if essentialSnap.EssentialType == snap.TypeGadget {
+			gadgetPath = essentialSnap.Path
 		}
+	}
+	gadgetSnap := squashfs.New(gadgetPath)
 
-		kernelPath := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), kernelFile)
-		fmt.Fprintf(stdout, "%s %s\n", kernelPath, filepath.Join(boot.InitramfsRunMntDir, "kernel"))
+	// we need to configure the ephemeral system with defaults and such using
+	// from the seed gadget
+	configOpts := &sysconfig.Options{
+		// never allow cloud-init to run inside the ephemeral system, in the
+		// install case we don't want it to ever run, and in the recover case
+		// cloud-init will already have run in run mode, so things like network
+		// config and users should already be setup and we will copy those
+		// further down in the setup for recover mode
+		AllowCloudInit: false,
+		TargetRootDir:  boot.InitramfsWritableDir,
+		GadgetSnap:     gadgetSnap,
+	}
+	if err := sysconfig.ConfigureTargetSystem(configOpts); err != nil {
+		return nil, err
 	}
 
-	// 3.1 Maybe mount the snapd snap on first boot of run-mode
-	// TODO:UC20: Make RecoverySystem empty after successful first boot
-	// somewhere in devicestate
-	if modeEnv.RecoverySystem != "" {
-		isSnapdMounted, err := osutilIsMounted(filepath.Join(boot.InitramfsRunMntDir, "snapd"))
+	return model, err
+}
+
+func maybeMountSave(disk disks.Disk, rootdir string, encrypted bool, mountOpts *systemdMountOptions) (haveSave bool, err error) {
+	var saveDevice string
+	if encrypted {
+		saveKey := filepath.Join(dirs.SnapFDEDirUnder(rootdir), "ubuntu-save.key")
+		// if ubuntu-save exists and is encrypted, the key has been created during install
+		if !osutil.FileExists(saveKey) {
+			// ubuntu-data is encrypted, but we appear to be missing
+			// a key to open ubuntu-save
+			return false, fmt.Errorf("cannot find ubuntu-save encryption key at %v", saveKey)
+		}
+		// we have save.key, volume exists and is encrypted
+		key, err := ioutil.ReadFile(saveKey)
 		if err != nil {
-			return err
+			return true, err
 		}
-
-		if !isSnapdMounted {
-			// load the recovery system and generate mount for snapd
-			essSnaps, err := mst.RecoverySystemEssentialSnaps(modeEnv.RecoverySystem, []snap.Type{snap.TypeSnapd})
-			if err != nil {
-				return fmt.Errorf("cannot load metadata and verify snapd snap: %v", err)
+		unlockRes, err := secbootUnlockEncryptedVolumeUsingKey(disk, "ubuntu-save", key)
+		if err != nil {
+			return true, fmt.Errorf("cannot unlock ubuntu-save volume: %v", err)
+		}
+		saveDevice = unlockRes.FsDevice
+	} else {
+		partUUID, err := disk.FindMatchingPartitionUUID("ubuntu-save")
+		if err != nil {
+			if _, ok := err.(disks.FilesystemLabelNotFoundError); ok {
+				// this is ok, ubuntu-save may not exist for
+				// non-encrypted device
+				return false, nil
 			}
-			fmt.Fprintf(stdout, "%s %s\n", essSnaps[0].Path, filepath.Join(boot.InitramfsRunMntDir, "snapd"))
+			return false, err
 		}
+		saveDevice = filepath.Join("/dev/disk/by-partuuid", partUUID)
 	}
-
-	// 4.1 Write the modeenv out again
-	return modeEnv.Write()
+	if err := doSystemdMount(saveDevice, boot.InitramfsUbuntuSaveDir, mountOpts); err != nil {
+		return true, err
+	}
+	return true, nil
 }
 
-func stampedAction(stamp string, action func() error) error {
-	stampFile := filepath.Join(dirs.SnapBootstrapRunDir, stamp)
-	if osutil.FileExists(stampFile) {
-		return nil
+func generateMountsModeRun(mst *initramfsMountsState) error {
+	// 1. mount ubuntu-boot
+	if err := mountPartitionMatchingKernelDisk(boot.InitramfsUbuntuBootDir, "ubuntu-boot"); err != nil {
+		return err
 	}
-	if err := os.MkdirAll(filepath.Dir(stampFile), 0755); err != nil {
+
+	// get the disk that we mounted the ubuntu-boot partition from as a
+	// reference point for future mounts
+	disk, err := disks.DiskFromMountPoint(boot.InitramfsUbuntuBootDir, nil)
+	if err != nil {
 		return err
 	}
-	if err := action(); err != nil {
+
+	// 2. mount ubuntu-seed
+	// use the disk we mounted ubuntu-boot from as a reference to find
+	// ubuntu-seed and mount it
+	partUUID, err := disk.FindMatchingPartitionUUID("ubuntu-seed")
+	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(stampFile, nil, 0644)
-}
 
-func generateInitramfsMounts() error {
-	// Ensure there is a very early initial measurement
-	err := stampedAction("secboot-epoch-measured", func() error {
-		return measureWhenPossible(secMeasureEpoch)
+	// fsck is safe to run on ubuntu-seed as per the manpage, it should not
+	// meaningfully contribute to corruption if we fsck it every time we boot,
+	// and it is important to fsck it because it is vfat and mounted writable
+	// TODO:UC20: mount it as read-only here and remount as writable when we
+	//            need it to be writable for i.e. transitioning to recover mode
+	fsckSystemdOpts := &systemdMountOptions{
+		NeedsFsck: true,
+	}
+	if err := doSystemdMount(fmt.Sprintf("/dev/disk/by-partuuid/%s", partUUID), boot.InitramfsUbuntuSeedDir, fsckSystemdOpts); err != nil {
+		return err
+	}
+
+	// 3.1. measure model
+	err = stampedAction("run-model-measured", func() error {
+		return secbootMeasureSnapModelWhenPossible(mst.UnverifiedBootModel)
 	})
 	if err != nil {
 		return err
 	}
+	// TODO:UC20: cross check the model we read from ubuntu-boot/model with
+	// one recorded in ubuntu-data modeenv during install
 
-	mode, recoverySystem, err := boot.ModeAndRecoverySystemFromKernelCommandLine()
+	// 3.2. mount Data
+	runModeKey := filepath.Join(boot.InitramfsBootEncryptionKeyDir, "ubuntu-data.sealed-key")
+	opts := &secboot.UnlockVolumeUsingSealedKeyOptions{
+		AllowRecoveryKey: true,
+	}
+	unlockRes, err := secbootUnlockVolumeUsingSealedKeyIfEncrypted(disk, "ubuntu-data", runModeKey, opts)
 	if err != nil {
 		return err
 	}
 
-	mst := newInitramfsMountsState(mode, recoverySystem)
-
-	switch mode {
-	case "recover":
-		// XXX: don't pass both args
-		return generateMountsModeRecover(mst, recoverySystem)
-	case "install":
-		// XXX: don't pass both args
-		return generateMountsModeInstall(mst, recoverySystem)
-	case "run":
-		return generateMountsModeRun(mst)
+	// TODO: do we actually need fsck if we are mounting a mapper device?
+	// probably not?
+	if err := doSystemdMount(unlockRes.FsDevice, boot.InitramfsDataDir, fsckSystemdOpts); err != nil {
+		return err
 	}
-	// this should never be reached
-	return fmt.Errorf("internal error: mode in generateInitramfsMounts not handled")
-}
+	isEncryptedDev := unlockRes.IsEncrypted
 
-var (
-	secbootLockAccessToSealedKeys = secboot.LockAccessToSealedKeys
-)
-
-func isDeviceEncrypted(name string) (ok bool, encdev string) {
-	encdev = filepath.Join(devDiskByLabelDir, name+"-enc")
-	if osutil.FileExists(encdev) {
-		return true, encdev
-	}
-	return false, ""
-}
-
-// TODO:UC20: move this somewhere appropriate
-var readKernelUUID = func() string {
-	b, err := ioutil.ReadFile("/proc/sys/kernel/random/uuid")
-	if err != nil {
-		panic("can't read kernel uuid")
-	}
-	return strings.TrimSpace(string(b))
-}
-
-// unlockIfEncrypted verifies whether an encrypted volume with the specified
-// name exists and unlocks it. With lockKeysOnFinish set, access to the sealed
-// keys will be locked when this function completes. The path to the unencrypted
-// device node is returned.
-func unlockIfEncrypted(name string, lockKeysOnFinish bool) (string, error) {
-	// TODO:UC20: use secureConnectToTPM if we decide there's benefit in doing that or we
-	//            have a hard requirement for a valid EK cert chain for every boot (ie, panic
-	//            if there isn't one). But we can't do that as long as we need to download
-	//            intermediate certs from the manufacturer.
-	tpm, tpmErr := insecureConnectToTPM()
-	if tpmErr != nil {
-		logger.Noticef("cannot open TPM connection: %v", tpmErr)
-	} else {
-		defer tpm.Close()
+	// 3.3. mount ubuntu-save (if present)
+	haveSave, err := maybeMountSave(disk, boot.InitramfsWritableDir, isEncryptedDev, fsckSystemdOpts)
+	if err != nil {
+		return err
 	}
 
-	var lockErr error
-	var mapperName string
-	err := func() error {
-		defer func() {
-			// TODO:UC20: we might want some better error handling here - eg, if tpmErr is a
-			//            *os.PathError returned from go-tpm2 then this is an indicator that there
-			//            is no TPM device. But other errors probably shouldn't be ignored.
-			if lockKeysOnFinish && tpmErr == nil {
-				// Lock access to the sealed keys. This should be called whenever there
-				// is a TPM device detected, regardless of whether secure boot is enabled
-				// or there is an encrypted volume to unlock. Note that snap-bootstrap can
-				// be called several times during initialization, and if there are multiple
-				// volumes to unlock we should lock access to the sealed keys only after
-				// the last encrypted volume is unlocked, in which case lockKeysOnFinish
-				// should be set to true.
-				lockErr = secbootLockAccessToSealedKeys(tpm)
-			}
-		}()
+	// 4.1 verify that ubuntu-data comes from where we expect it to
+	diskOpts := &disks.Options{}
+	if unlockRes.IsEncrypted {
+		// then we need to specify that the data mountpoint is expected to be a
+		// decrypted device, applies to both ubuntu-data and ubuntu-save
+		diskOpts.IsDecryptedDevice = true
+	}
 
-		ok, encdev := isDeviceEncrypted(name)
-		if !ok {
-			return nil
+	matches, err := disk.MountPointIsFromDisk(boot.InitramfsDataDir, diskOpts)
+	if err != nil {
+		return err
+	}
+	if !matches {
+		// failed to verify that ubuntu-data mountpoint comes from the same disk
+		// as ubuntu-boot
+		return fmt.Errorf("cannot validate boot: ubuntu-data mountpoint is expected to be from disk %s but is not", disk.Dev())
+	}
+	if haveSave {
+		// 4.1a we have ubuntu-save, verify it as well
+		matches, err = disk.MountPointIsFromDisk(boot.InitramfsUbuntuSaveDir, diskOpts)
+		if err != nil {
+			return err
+		}
+		if !matches {
+			return fmt.Errorf("cannot validate boot: ubuntu-save mountpoint is expected to be from disk %s but is not", disk.Dev())
 		}
 
-		if tpmErr != nil {
-			return fmt.Errorf("cannot unlock encrypted device %q: %v", name, tpmErr)
+		if isEncryptedDev {
+			// in run mode the path to open an encrypted save is for
+			// data to be encrypted and the save key in it
+			// to be successfully used. This already should stop
+			// allowing to chose ubuntu-data to try to access
+			// save. as safety boot also stops if the keys cannot
+			// be locked.
+			// for symmetry with recover code and extra paranoia
+			// though also check that the markers match.
+			paired, err := checkDataAndSavaPairing(boot.InitramfsWritableDir)
+			if err != nil {
+				return err
+			}
+			if !paired {
+				return fmt.Errorf("cannot validate boot: ubuntu-save and ubuntu-data are not marked as from the same install")
+			}
 		}
-		// TODO:UC20: snap-bootstrap should validate that <name>-enc is what
-		//            we expect (and not e.g. an external disk), and also that
-		//            <name> is from <name>-enc and not an unencrypted partition
-		//            with the same name (LP #1863886)
-		sealedKeyPath := filepath.Join(boot.InitramfsEncryptionKeyDir, name+".sealed-key")
-		mapperName = name + "-" + readKernelUUID()
-		return unlockEncryptedPartition(tpm, mapperName, encdev, sealedKeyPath, "", lockKeysOnFinish)
-	}()
-	if err != nil {
-		return "", err
-	}
-	if lockErr != nil {
-		return "", fmt.Errorf("cannot lock access to sealed keys: %v", lockErr)
 	}
 
-	// return the encrypted device if the device we are maybe unlocked is an
-	// encrypted device
-	if mapperName != "" {
-		return filepath.Join("/dev/mapper", mapperName), nil
+	// 4.2. read modeenv
+	modeEnv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
+	if err != nil {
+		return err
 	}
 
-	// otherwise use the device from /dev/disk/by-label
-	// TODO:UC20: we want to always determine the ubuntu-data partition by
-	//            referencing the ubuntu-boot or ubuntu-seed partitions and not
-	//            by using labels
-	return filepath.Join(devDiskByLabelDir, name), nil
-}
+	typs := []snap.Type{snap.TypeBase, snap.TypeKernel}
 
-var (
-	secbootConnectToDefaultTPM            = secboot.ConnectToDefaultTPM
-	secbootSecureConnectToDefaultTPM      = secboot.SecureConnectToDefaultTPM
-	secbootActivateVolumeWithTPMSealedKey = secboot.ActivateVolumeWithTPMSealedKey
-	secbootMeasureSnapModelToTPM          = secboot.MeasureSnapModelToTPM
-	secbootMeasureSnapSystemEpochToTPM    = secboot.MeasureSnapSystemEpochToTPM
-)
-
-// TODO:UC20 move the connect methods somehow to our secboot
-
-func secureConnectToTPM(ekcfile string) (*secboot.TPMConnection, error) {
-	ekCertReader, err := os.Open(ekcfile)
+	// 4.2 choose base and kernel snaps (this includes updating modeenv if
+	//     needed to try the base snap)
+	mounts, err := boot.InitramfsRunModeSelectSnapsToMount(typs, modeEnv)
 	if err != nil {
-		return nil, fmt.Errorf("cannot open endorsement key certificate file: %v", err)
+		return err
 	}
-	defer ekCertReader.Close()
-
-	return secbootSecureConnectToDefaultTPM(ekCertReader, nil)
-}
 
-func insecureConnectToTPM() (*secboot.TPMConnection, error) {
-	return secbootConnectToDefaultTPM()
-}
-
-// unlockEncryptedPartition unseals the keyfile and opens an encrypted device.
-func unlockEncryptedPartition(tpm *secboot.TPMConnection, name, device, keyfile, pinfile string, lock bool) error {
-	options := secboot.ActivateWithTPMSealedKeyOptions{
-		PINTries:            1,
-		RecoveryKeyTries:    3,
-		LockSealedKeyAccess: lock,
+	// TODO:UC20: with grade > dangerous, verify the kernel snap hash against
+	//            what we booted using the tpm log, this may need to be passed
+	//            to the function above to make decisions there, or perhaps this
+	//            code actually belongs in the bootloader implementation itself
+
+	// 4.3 mount base and kernel snaps
+	// make sure this is a deterministic order
+	for _, typ := range []snap.Type{snap.TypeBase, snap.TypeKernel} {
+		if sn, ok := mounts[typ]; ok {
+			dir := snapTypeToMountDir[typ]
+			snapPath := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), sn.Filename())
+			if err := doSystemdMount(snapPath, filepath.Join(boot.InitramfsRunMntDir, dir), nil); err != nil {
+				return err
+			}
+		}
 	}
 
-	activated, err := secbootActivateVolumeWithTPMSealedKey(tpm, name, device, keyfile, nil, &options)
-	if !activated {
-		// ActivateVolumeWithTPMSealedKey should always return an error if activated == false
-		return fmt.Errorf("cannot activate encrypted device %q: %v", device, err)
-	}
-	if err != nil {
-		logger.Noticef("successfully activated encrypted device %q using a fallback activation method", device)
-	} else {
-		logger.Noticef("successfully activated encrypted device %q with TPM", device)
+	// 4.4 mount snapd snap only on first boot
+	if modeEnv.RecoverySystem != "" {
+		// load the recovery system and generate mount for snapd
+		_, essSnaps, err := mst.ReadEssential(modeEnv.RecoverySystem, []snap.Type{snap.TypeSnapd})
+		if err != nil {
+			return fmt.Errorf("cannot load metadata and verify snapd snap: %v", err)
+		}
+
+		return doSystemdMount(essSnaps[0].Path, filepath.Join(boot.InitramfsRunMntDir, "snapd"), nil)
 	}
 
 	return nil
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_nosecboot.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_nosecboot.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_nosecboot.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_nosecboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,52 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build nosecboot
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"errors"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/osutil/disks"
+	"github.com/snapcore/snapd/secboot"
+)
+
+var (
+	errNotImplemented = errors.New("not implemented")
+)
+
+func init() {
+	secbootMeasureSnapSystemEpochWhenPossible = func() error {
+		return errNotImplemented
+	}
+	secbootMeasureSnapModelWhenPossible = func(_ func() (*asserts.Model, error)) error {
+		return errNotImplemented
+	}
+	secbootUnlockVolumeUsingSealedKeyIfEncrypted = func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		return secboot.UnlockResult{}, errNotImplemented
+	}
+	secbootUnlockEncryptedVolumeUsingKey = func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		return secboot.UnlockResult{}, errNotImplemented
+	}
+
+	secbootLockSealedKeys = func() error {
+		return errNotImplemented
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_recover_degraded_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_recover_degraded_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_recover_degraded_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_recover_degraded_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,292 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	main "github.com/snapcore/snapd/cmd/snap-bootstrap"
+)
+
+func (s *initramfsMountsSuite) TestInitramfsDegradedState(c *C) {
+	tt := []struct {
+		r         main.RecoverDegradedState
+		encrypted bool
+		degraded  bool
+		comment   string
+	}{
+		// unencrypted happy
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState: "absent-but-optional",
+				},
+			},
+			degraded: false,
+			comment:  "happy unencrypted no save",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState: "mounted",
+				},
+			},
+			degraded: false,
+			comment:  "happy unencrypted save",
+		},
+		// unencrypted unhappy
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "error-mounting",
+				},
+				UbuntuData: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState: "absent-but-optional",
+				},
+				ErrorLog: []string{
+					"cannot find ubuntu-boot partition on disk 259:0",
+				},
+			},
+			degraded: true,
+			comment:  "unencrypted, error mounting boot",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState: "error-mounting",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState: "absent-but-optional",
+				},
+				ErrorLog: []string{
+					"cannot find ubuntu-data partition on disk 259:0",
+				},
+			},
+			degraded: true,
+			comment:  "unencrypted, error mounting data",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState: "error-mounting",
+				},
+				ErrorLog: []string{
+					"cannot find ubuntu-save partition on disk 259:0",
+				},
+			},
+			degraded: true,
+			comment:  "unencrypted, error mounting save",
+		},
+
+		// encrypted happy
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "run",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "run",
+				},
+			},
+			encrypted: true,
+			degraded:  false,
+			comment:   "happy encrypted",
+		},
+		// encrypted unhappy
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "error-mounting",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "fallback",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "run",
+				},
+				ErrorLog: []string{
+					"cannot find ubuntu-boot partition on disk 259:0",
+				},
+			},
+			encrypted: true,
+			degraded:  true,
+			comment:   "encrypted, no boot, fallback data",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "fallback",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "run",
+				},
+				ErrorLog: []string{
+					"cannot unlock encrypted ubuntu-data with sealed run key: failed to unlock ubuntu-data",
+				},
+			},
+			encrypted: true,
+			degraded:  true,
+			comment:   "encrypted, fallback data",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "run",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "fallback",
+				},
+				ErrorLog: []string{
+					"cannot unlock encrypted ubuntu-save with sealed run key: failed to unlock ubuntu-save",
+				},
+			},
+			encrypted: true,
+			degraded:  true,
+			comment:   "encrypted, fallback save",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "run",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "recovery",
+				},
+				ErrorLog: []string{
+					"cannot unlock encrypted ubuntu-save with sealed run key: failed to unlock ubuntu-save",
+				},
+			},
+			encrypted: true,
+			degraded:  true,
+			comment:   "encrypted, recovery save",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "fallback",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "fallback",
+				},
+				ErrorLog: []string{
+					"cannot unlock encrypted ubuntu-data with sealed run key: failed to unlock ubuntu-data",
+				},
+			},
+			encrypted: true,
+			degraded:  true,
+			comment:   "encrypted, fallback data, fallback save",
+		},
+		{
+			r: main.RecoverDegradedState{
+				UbuntuBoot: main.PartitionState{
+					MountState: "mounted",
+				},
+				UbuntuData: main.PartitionState{
+					MountState:  "mounted",
+					UnlockState: "unlocked",
+					UnlockKey:   "fallback",
+				},
+				UbuntuSave: main.PartitionState{
+					MountState:  "not-mounted",
+					UnlockState: "not-unlocked",
+				},
+				ErrorLog: []string{
+					"cannot unlock encrypted ubuntu-save with sealed run key: failed to unlock ubuntu-save",
+					"cannot unlock encrypted ubuntu-save with sealed fallback key: failed to unlock ubuntu-save",
+				},
+			},
+			encrypted: true,
+			degraded:  true,
+			comment:   "encrypted, fallback data, no save",
+		},
+	}
+
+	for _, t := range tt {
+		var comment CommentInterface
+		if t.comment != "" {
+			comment = Commentf(t.comment)
+		}
+
+		c.Assert(t.r.Degraded(t.encrypted), Equals, t.degraded, comment)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_secboot.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_secboot.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_secboot.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_secboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,33 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"github.com/snapcore/snapd/secboot"
+)
+
+func init() {
+	secbootMeasureSnapSystemEpochWhenPossible = secboot.MeasureSnapSystemEpochWhenPossible
+	secbootMeasureSnapModelWhenPossible = secboot.MeasureSnapModelWhenPossible
+	secbootUnlockVolumeUsingSealedKeyIfEncrypted = secboot.UnlockVolumeUsingSealedKeyIfEncrypted
+	secbootUnlockEncryptedVolumeUsingKey = secboot.UnlockEncryptedVolumeUsingKey
+	secbootLockSealedKeys = secboot.LockSealedKeys
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_initramfs_mounts_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_initramfs_mounts_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,16 +21,14 @@
 
 import (
 	"bytes"
-	"errors"
+	"encoding/json"
 	"fmt"
-	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
-	"syscall"
+	"strings"
+	"time"
 
-	"github.com/canonical/go-tpm2"
-	"github.com/snapcore/secboot"
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/asserts"
@@ -42,9 +40,13 @@
 	main "github.com/snapcore/snapd/cmd/snap-bootstrap"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/disks"
+	"github.com/snapcore/snapd/secboot"
 	"github.com/snapcore/snapd/seed"
 	"github.com/snapcore/snapd/seed/seedtest"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/systemd"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -61,12 +63,61 @@
 	seedDir  string
 	sysLabel string
 	model    *asserts.Model
+	tmpDir   string
 
-	mockTPM *secboot.TPMConnection
+	kernel   snap.PlaceInfo
+	kernelr2 snap.PlaceInfo
+	core20   snap.PlaceInfo
+	core20r2 snap.PlaceInfo
+	snapd    snap.PlaceInfo
 }
 
 var _ = Suite(&initramfsMountsSuite{})
 
+var (
+	tmpfsMountOpts = &main.SystemdMountOptions{
+		Tmpfs: true,
+	}
+	needsFsckDiskMountOpts = &main.SystemdMountOptions{
+		NeedsFsck: true,
+	}
+
+	// a boot disk without ubuntu-save
+	defaultBootDisk = &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot": "ubuntu-boot-partuuid",
+			"ubuntu-seed": "ubuntu-seed-partuuid",
+			"ubuntu-data": "ubuntu-data-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "default",
+	}
+
+	defaultBootWithSaveDisk = &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot": "ubuntu-boot-partuuid",
+			"ubuntu-seed": "ubuntu-seed-partuuid",
+			"ubuntu-data": "ubuntu-data-partuuid",
+			"ubuntu-save": "ubuntu-save-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "default-with-save",
+	}
+
+	defaultEncBootDisk = &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot":     "ubuntu-boot-partuuid",
+			"ubuntu-seed":     "ubuntu-seed-partuuid",
+			"ubuntu-data-enc": "ubuntu-data-enc-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "defaultEncDev",
+	}
+
+	mockStateContent = `{"data":{"auth":{"users":[{"id":1,"name":"mvo"}],"macaroon-key":"not-a-cookie","last-id":1}},"some":{"other":"stuff"}}`
+)
+
 // because 1.9 vet does not like xerrors.Errorf(".. %w")
 type mockedWrappedError struct {
 	err error
@@ -77,28 +128,14 @@
 
 func (m *mockedWrappedError) Error() string { return fmt.Sprintf(m.fmt, m.err) }
 
-func (s *initramfsMountsSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
-
-	s.Stdout = bytes.NewBuffer(nil)
-	restore := main.MockStdout(s.Stdout)
-	s.AddCleanup(restore)
-
-	_, restore = logger.MockLogger()
-	s.AddCleanup(restore)
-
-	// mock /run/mnt
-	dirs.SetRootDir(c.MkDir())
-	restore = func() { dirs.SetRootDir("") }
-	s.AddCleanup(restore)
-
+func (s *initramfsMountsSuite) setupSeed(c *C, gadgetSnapFiles [][]string) {
 	// pretend /run/mnt/ubuntu-seed has a valid seed
 	s.seedDir = boot.InitramfsUbuntuSeedDir
 
 	// now create a minimal uc20 seed dir with snaps/assertions
 	seed20 := &seedtest.TestingSeed20{SeedDir: s.seedDir}
 	seed20.SetupAssertSigning("canonical")
-	restore = seed.MockTrusted(seed20.StoreSigning.Trusted)
+	restore := seed.MockTrusted(seed20.StoreSigning.Trusted)
 	s.AddCleanup(restore)
 
 	// XXX: we don't really use this but seedtest always expects my-brand
@@ -108,7 +145,7 @@
 
 	// add a bunch of snaps
 	seed20.MakeAssertedSnap(c, "name: snapd\nversion: 1\ntype: snapd", nil, snap.R(1), "canonical", seed20.StoreSigning.Database)
-	seed20.MakeAssertedSnap(c, "name: pc\nversion: 1\ntype: gadget\nbase: core20", nil, snap.R(1), "canonical", seed20.StoreSigning.Database)
+	seed20.MakeAssertedSnap(c, "name: pc\nversion: 1\ntype: gadget\nbase: core20", gadgetSnapFiles, snap.R(1), "canonical", seed20.StoreSigning.Database)
 	seed20.MakeAssertedSnap(c, "name: pc-kernel\nversion: 1\ntype: kernel", nil, snap.R(1), "canonical", seed20.StoreSigning.Database)
 	seed20.MakeAssertedSnap(c, "name: core20\nversion: 1\ntype: base", nil, snap.R(1), "canonical", seed20.StoreSigning.Database)
 
@@ -132,31 +169,131 @@
 			}},
 	}, nil)
 
-	mockTPM, restoreTPM := mockSecbootTPM(c)
-	s.AddCleanup(restoreTPM)
-	s.mockTPM = mockTPM
+}
 
-	restoreConnect := main.MockSecbootConnectToDefaultTPM(func() (*secboot.TPMConnection, error) {
-		// XXX: we should use xerrors.Errorf("no tpm: %w", &os.PathError{})
-		// but 1.9 vet complains about unknown verb %w
-		return nil, &mockedWrappedError{
-			fmt: "no tpm: %v",
-			err: &os.PathError{
-				Op: "open", Path: "/dev/mock/tpm0", Err: syscall.ENOENT,
-			},
-		}
-	})
-	s.AddCleanup(restoreConnect)
+func (s *initramfsMountsSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.Stdout = bytes.NewBuffer(nil)
+
+	_, restore := logger.MockLogger()
+	s.AddCleanup(restore)
+
+	s.tmpDir = c.MkDir()
+
+	// mock /run/mnt
+	dirs.SetRootDir(s.tmpDir)
+	restore = func() { dirs.SetRootDir("") }
+	s.AddCleanup(restore)
+
+	// setup the seed
+	s.setupSeed(c, nil)
+
+	// make test snap PlaceInfo's for various boot functionality
+	var err error
+	s.kernel, err = snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
+	c.Assert(err, IsNil)
+
+	s.core20, err = snap.ParsePlaceInfoFromSnapFileName("core20_1.snap")
+	c.Assert(err, IsNil)
+
+	s.kernelr2, err = snap.ParsePlaceInfoFromSnapFileName("pc-kernel_2.snap")
+	c.Assert(err, IsNil)
+
+	s.core20r2, err = snap.ParsePlaceInfoFromSnapFileName("core20_2.snap")
+	c.Assert(err, IsNil)
+
+	s.snapd, err = snap.ParsePlaceInfoFromSnapFileName("snapd_1.snap")
+	c.Assert(err, IsNil)
+
+	// by default mock that we don't have UEFI vars, etc. to get the booted
+	// kernel partition partition uuid
+	s.AddCleanup(main.MockPartitionUUIDForBootedKernelDisk(""))
+	s.AddCleanup(main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		return nil
+	}))
+	s.AddCleanup(main.MockSecbootMeasureSnapModelWhenPossible(func(f func() (*asserts.Model, error)) error {
+		c.Check(f, NotNil)
+		return nil
+	}))
+	s.AddCleanup(main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		return foundUnencrypted(name), nil
+	}))
+	s.AddCleanup(main.MockSecbootLockSealedKeys(func() error {
+		return nil
+	}))
+}
+
+// helpers to create consistent UnlockResult values
+
+func foundUnencrypted(name string) secboot.UnlockResult {
+	dev := filepath.Join("/dev/disk/by-partuuid", name+"-partuuid")
+	return secboot.UnlockResult{
+		PartDevice: dev,
+		FsDevice:   dev,
+	}
+}
+
+func happyUnlocked(name string, method secboot.UnlockMethod) secboot.UnlockResult {
+	return secboot.UnlockResult{
+		PartDevice:   filepath.Join("/dev/disk/by-partuuid", name+"-enc-partuuid"),
+		FsDevice:     filepath.Join("/dev/mapper", name+"-random"),
+		IsEncrypted:  true,
+		UnlockMethod: method,
+	}
+}
+
+func foundEncrypted(name string) secboot.UnlockResult {
+	return secboot.UnlockResult{
+		PartDevice: filepath.Join("/dev/disk/by-partuuid", name+"-enc-partuuid"),
+		// FsDevice is empty if we didn't unlock anything
+		FsDevice:    "",
+		IsEncrypted: true,
+	}
+}
+
+func notFoundPart() secboot.UnlockResult {
+	return secboot.UnlockResult{}
+}
+
+// makeSnapFilesOnEarlyBootUbuntuData creates the snap files on ubuntu-data as
+// we
+func makeSnapFilesOnEarlyBootUbuntuData(c *C, snaps ...snap.PlaceInfo) {
+	snapDir := dirs.SnapBlobDirUnder(boot.InitramfsWritableDir)
+	err := os.MkdirAll(snapDir, 0755)
+	c.Assert(err, IsNil)
+	for _, sn := range snaps {
+		snFilename := sn.Filename()
+		err = ioutil.WriteFile(filepath.Join(snapDir, snFilename), nil, 0644)
+		c.Assert(err, IsNil)
+	}
 }
 
 func (s *initramfsMountsSuite) mockProcCmdlineContent(c *C, newContent string) {
 	mockProcCmdline := filepath.Join(c.MkDir(), "proc-cmdline")
 	err := ioutil.WriteFile(mockProcCmdline, []byte(newContent), 0644)
 	c.Assert(err, IsNil)
-	restore := boot.MockProcCmdline(mockProcCmdline)
+	restore := osutil.MockProcCmdline(mockProcCmdline)
 	s.AddCleanup(restore)
 }
 
+func (s *initramfsMountsSuite) mockUbuntuSaveKeyAndMarker(c *C, rootDir, key, marker string) {
+	keyPath := filepath.Join(dirs.SnapFDEDirUnder(rootDir), "ubuntu-save.key")
+	c.Assert(os.MkdirAll(filepath.Dir(keyPath), 0700), IsNil)
+	c.Assert(ioutil.WriteFile(keyPath, []byte(key), 0600), IsNil)
+
+	if marker != "" {
+		markerPath := filepath.Join(dirs.SnapFDEDirUnder(rootDir), "marker")
+		c.Assert(ioutil.WriteFile(markerPath, []byte(marker), 0600), IsNil)
+	}
+}
+
+func (s *initramfsMountsSuite) mockUbuntuSaveMarker(c *C, rootDir, marker string) {
+	markerPath := filepath.Join(rootDir, "device/fde", "marker")
+	c.Assert(os.MkdirAll(filepath.Dir(markerPath), 0700), IsNil)
+	c.Assert(ioutil.WriteFile(markerPath, []byte(marker), 0600), IsNil)
+}
+
 func (s *initramfsMountsSuite) TestInitramfsMountsNoModeError(c *C) {
 	s.mockProcCmdlineContent(c, "nothing-to-see")
 
@@ -171,347 +308,622 @@
 	c.Assert(err, ErrorMatches, `cannot use unknown mode "install-foo"`)
 }
 
-// these types represent lists of expected mount directories to be
-// checked with IsMounted with an associated mounted state to simulate
-type (
-	expectedMountDirs interface {
-		size() int
-		// dirAndIsMounted returns the dir expected for the
-		// IsMounted call with relative call number callNum
-		// plus the simulated mounted state
-		dirAndIsMounted(callNum int) (dir string, mounted bool)
+type systemdMount struct {
+	what  string
+	where string
+	opts  *main.SystemdMountOptions
+}
+
+// this is a function so we evaluate InitramfsUbuntuBootDir, etc at the time of
+// the test to pick up test-specific dirs.GlobalRootDir
+func ubuntuLabelMount(label string, mode string) systemdMount {
+	mnt := systemdMount{
+		opts: needsFsckDiskMountOpts,
+	}
+	switch label {
+	case "ubuntu-boot":
+		mnt.what = "/dev/disk/by-label/ubuntu-boot"
+		mnt.where = boot.InitramfsUbuntuBootDir
+	case "ubuntu-seed":
+		mnt.what = "/dev/disk/by-label/ubuntu-seed"
+		mnt.where = boot.InitramfsUbuntuSeedDir
+		// don't fsck in run mode
+		if mode == "run" {
+			mnt.opts = nil
+		}
+	case "ubuntu-data":
+		mnt.what = "/dev/disk/by-label/ubuntu-data"
+		mnt.where = boot.InitramfsDataDir
+	}
+
+	return mnt
+}
+
+// ubuntuPartUUIDMount returns a systemdMount for the partuuid disk, expecting
+// that the partuuid contains in it the expected label for easier coding
+func ubuntuPartUUIDMount(partuuid string, mode string) systemdMount {
+	// all partitions are expected to be mounted with fsck on
+	mnt := systemdMount{
+		opts: needsFsckDiskMountOpts,
+	}
+	mnt.what = filepath.Join("/dev/disk/by-partuuid", partuuid)
+	switch {
+	case strings.Contains(partuuid, "ubuntu-boot"):
+		mnt.where = boot.InitramfsUbuntuBootDir
+	case strings.Contains(partuuid, "ubuntu-seed"):
+		mnt.where = boot.InitramfsUbuntuSeedDir
+	case strings.Contains(partuuid, "ubuntu-data"):
+		mnt.where = boot.InitramfsDataDir
+	case strings.Contains(partuuid, "ubuntu-save"):
+		mnt.where = boot.InitramfsUbuntuSaveDir
+	}
+
+	return mnt
+}
+
+func (s *initramfsMountsSuite) makeSeedSnapSystemdMount(typ snap.Type) systemdMount {
+	mnt := systemdMount{}
+	var name, dir string
+	switch typ {
+	case snap.TypeSnapd:
+		name = "snapd"
+		dir = "snapd"
+	case snap.TypeBase:
+		name = "core20"
+		dir = "base"
+	case snap.TypeKernel:
+		name = "pc-kernel"
+		dir = "kernel"
+	}
+	mnt.what = filepath.Join(s.seedDir, "snaps", name+"_1.snap")
+	mnt.where = filepath.Join(boot.InitramfsRunMntDir, dir)
+
+	return mnt
+}
+
+func (s *initramfsMountsSuite) makeRunSnapSystemdMount(typ snap.Type, sn snap.PlaceInfo) systemdMount {
+	mnt := systemdMount{}
+	var dir string
+	switch typ {
+	case snap.TypeSnapd:
+		dir = "snapd"
+	case snap.TypeBase:
+		dir = "base"
+	case snap.TypeKernel:
+		dir = "kernel"
 	}
-	mounted       []string
-	notYetMounted []string
-)
 
-func (m mounted) size() int                                            { return len(m) }
-func (m mounted) dirAndIsMounted(callNum int) (dir string, state bool) { return m[callNum], true }
+	mnt.what = filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), sn.Filename())
+	mnt.where = filepath.Join(boot.InitramfsRunMntDir, dir)
 
-func (n notYetMounted) size() int { return len(n) }
-func (n notYetMounted) dirAndIsMounted(callNum int) (dir string, state bool) {
-	return n[callNum], false
+	return mnt
 }
 
-func (s *initramfsMountsSuite) mockExpectedMountChecks(c *C, expectedDirs ...expectedMountDirs) *int {
-	var n int // call counter
-	r := main.MockOsutilIsMounted(func(path string) (bool, error) {
-		callNum := n
+func (s *initramfsMountsSuite) mockSystemdMountSequence(c *C, mounts []systemdMount, comment CommentInterface) (restore func()) {
+	n := 0
+	if comment == nil {
+		comment = Commentf("")
+	}
+	s.AddCleanup(func() {
+		// make sure that after the test is done, we had as many mount calls as
+		// mocked mounts
+		c.Check(n, Equals, len(mounts), comment)
+	})
+	return main.MockSystemdMount(func(what, where string, opts *main.SystemdMountOptions) error {
 		n++
-		// find expected covering callNum
-		for _, expected := range expectedDirs {
-			// is callNum within expected?
-			if callNum < expected.size() {
-				dir, mounted := expected.dirAndIsMounted(callNum)
-				c.Check(path, Equals, dir)
-				return mounted, nil
-			}
-			// adjust callNum for indexing within the next expected
-			callNum -= expected.size()
+		c.Assert(n <= len(mounts), Equals, true)
+		if n > len(mounts) {
+			return fmt.Errorf("unexpected systemd-mount call: %s, %s, %+v", what, where, opts)
 		}
-		return false, fmt.Errorf("unexpected number of calls: %v", n)
+		mnt := mounts[n-1]
+		c.Assert(what, Equals, mnt.what, comment)
+		c.Assert(where, Equals, mnt.where, comment)
+		c.Assert(opts, DeepEquals, mnt.opts, comment)
+		return nil
 	})
-	s.AddCleanup(r)
-	return &n
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeStep1(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeHappy(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=install snapd_recovery_system="+s.sysLabel)
 
-	n := s.mockExpectedMountChecks(c,
-		notYetMounted{boot.InitramfsUbuntuSeedDir},
-	)
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	defer main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})()
+
+	restore := s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "install"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+	}, nil)
+	defer restore()
 
 	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 1)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf("/dev/disk/by-label/ubuntu-seed %s/ubuntu-seed\n", boot.InitramfsRunMntDir))
+
+	modeEnv := dirs.SnapModeenvFileUnder(boot.InitramfsWritableDir)
+	c.Check(modeEnv, testutil.FileEquals, `mode=install
+recovery_system=20191118
+`)
+	cloudInitDisable := filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
+	c.Check(cloudInitDisable, testutil.FilePresent)
+
+	c.Check(sealedKeysLocked, Equals, true)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeStep2(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeGadgetDefaultsHappy(c *C) {
+	// setup a seed with default gadget yaml
+	const gadgetYamlDefaults = `
+defaults:
+  system:
+    service:
+      rsyslog.disable: true
+      ssh.disable: true
+      console-conf.disable: true
+    journal.persistent: true
+`
+	c.Assert(os.RemoveAll(s.seedDir), IsNil)
+
+	s.setupSeed(c, [][]string{
+		{"meta/gadget.yaml", gadgetYamlDefaults},
+	})
+
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=install snapd_recovery_system="+s.sysLabel)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{boot.InitramfsUbuntuSeedDir},
-		notYetMounted{
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
+	restore := s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "install"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
 			boot.InitramfsDataDir,
+			tmpfsMountOpts,
 		},
-	)
+	}, nil)
+	defer restore()
+
+	// we will call out to systemctl in the initramfs, but only using --root
+	// which doesn't talk to systemd, just manipulates files around
+	var sysctlArgs [][]string
+	systemctlRestorer := systemd.MockSystemctl(func(args ...string) (buf []byte, err error) {
+		sysctlArgs = append(sysctlArgs, args)
+		return nil, nil
+	})
+	defer systemctlRestorer()
 
 	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/snaps/snapd_1.snap %[2]s/snapd
-%[1]s/snaps/pc-kernel_1.snap %[2]s/kernel
-%[1]s/snaps/core20_1.snap %[2]s/base
---type=tmpfs tmpfs %[2]s/data
-`, s.seedDir, boot.InitramfsRunMntDir))
+
+	modeEnv := dirs.SnapModeenvFileUnder(boot.InitramfsWritableDir)
+	c.Check(modeEnv, testutil.FileEquals, `mode=install
+recovery_system=20191118
+`)
+
+	cloudInitDisable := filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
+	c.Check(cloudInitDisable, testutil.FilePresent)
+
+	// check that everything from the gadget defaults was setup
+	c.Assert(osutil.FileExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/ssh/sshd_not_to_be_run")), Equals, true)
+	c.Assert(osutil.FileExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/var/lib/console-conf/complete")), Equals, true)
+	exists, _, _ := osutil.DirExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/var/log/journal"))
+	c.Assert(exists, Equals, true)
+
+	// systemctl was called the way we expect
+	c.Assert(sysctlArgs, DeepEquals, [][]string{{"--root", filepath.Join(boot.InitramfsWritableDir, "_writable_defaults"), "mask", "rsyslog.service"}})
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeStep4(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeBootedKernelPartitionUUIDHappy(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=install snapd_recovery_system="+s.sysLabel)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{boot.InitramfsUbuntuSeedDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
+	restore := main.MockPartitionUUIDForBootedKernelDisk("specific-ubuntu-seed-partuuid")
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		{
+			"/dev/disk/by-partuuid/specific-ubuntu-seed-partuuid",
+			boot.InitramfsUbuntuSeedDir,
+			needsFsckDiskMountOpts,
+		},
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
 			boot.InitramfsDataDir,
+			tmpfsMountOpts,
 		},
-	)
+	}, nil)
+	defer restore()
 
 	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, "")
+
 	modeEnv := dirs.SnapModeenvFileUnder(boot.InitramfsWritableDir)
 	c.Check(modeEnv, testutil.FileEquals, `mode=install
 recovery_system=20191118
 `)
-	cloudInitDisable := filepath.Join(boot.InitramfsWritableDir, "etc/cloud/cloud-init.disabled")
+	cloudInitDisable := filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
 	c.Check(cloudInitDisable, testutil.FilePresent)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep1Boot(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeUnencryptedWithSaveHappy(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	n := s.mockExpectedMountChecks(c,
-		notYetMounted{boot.InitramfsUbuntuBootDir},
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsDataDir}:       defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}: defaultBootWithSaveDisk,
+		},
 	)
+	defer restore()
 
-	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 1)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`/dev/disk/by-label/ubuntu-boot %[1]s/ubuntu-boot
-`, boot.InitramfsRunMntDir))
-}
-
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep1Seed(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-boot", "run"),
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		ubuntuPartUUIDMount("ubuntu-data-partuuid", "run"),
+		ubuntuPartUUIDMount("ubuntu-save-partuuid", "run"),
+		s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+		s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+	}, nil)
+	defer restore()
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{boot.InitramfsUbuntuBootDir},
-		notYetMounted{boot.InitramfsUbuntuSeedDir},
-	)
+	// mock a bootloader
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
 
-	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 2)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`/dev/disk/by-label/ubuntu-seed %[1]s/ubuntu-seed
-`, boot.InitramfsRunMntDir))
-}
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep1Data(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-		},
-		notYetMounted{boot.InitramfsDataDir},
-	)
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
+	}
+	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
+	c.Assert(err, IsNil)
 
-	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 3)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`/dev/disk/by-label/ubuntu-data %[1]s/data
-`, boot.InitramfsRunMntDir))
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep1EncryptedData(c *C) {
+func (s *initramfsMountsSuite) testInitramfsMountsRunModeNoSaveUnencrypted(c *C) error {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	// write the installed model like makebootable does it
-	err := os.MkdirAll(boot.InitramfsUbuntuBootDir, 0755)
-	c.Assert(err, IsNil)
-	mf, err := os.Create(filepath.Join(boot.InitramfsUbuntuBootDir, "model"))
-	c.Assert(err, IsNil)
-	defer mf.Close()
-	err = asserts.NewEncoder(mf).Encode(s.model)
-	c.Assert(err, IsNil)
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootDisk,
+			{Mountpoint: boot.InitramfsDataDir}:       defaultBootDisk,
+		},
+	)
+	defer restore()
 
-	// setup ubuntu-data-enc
-	devDiskByLabel, restore := mockDevDiskByLabel(c)
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-boot", "run"),
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		ubuntuPartUUIDMount("ubuntu-data-partuuid", "run"),
+		s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+		s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+	}, nil)
 	defer restore()
 
-	ubuntuDataEnc := filepath.Join(devDiskByLabel, "ubuntu-data-enc")
-	err = ioutil.WriteFile(ubuntuDataEnc, nil, 0644)
-	c.Assert(err, IsNil)
+	// mock a bootloader
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
 
-	restore = main.MockRandomKernelUUID(func() string {
-		return "some-kernel-uuid"
-	})
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
 	defer restore()
 
-	// setup a fake tpm
-	mockTPM, restore := mockSecbootTPM(c)
-	defer restore()
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
-	activated := false
-	// setup activating the fake tpm
-	restore = main.MockSecbootActivateVolumeWithTPMSealedKey(func(tpm *secboot.TPMConnection, volumeName, sourceDevicePath,
-		keyPath string, pinReader io.Reader, options *secboot.ActivateWithTPMSealedKeyOptions) (bool, error) {
-		c.Assert(tpm, Equals, mockTPM)
-		c.Assert(volumeName, Equals, "ubuntu-data-some-kernel-uuid")
-		c.Assert(sourceDevicePath, Equals, ubuntuDataEnc)
-		// the keyfile will be on ubuntu-seed as ubuntu-data.sealed-key
-		c.Assert(keyPath, Equals, filepath.Join(boot.InitramfsUbuntuSeedDir, "device/fde", "ubuntu-data.sealed-key"))
-		c.Assert(*options, DeepEquals, secboot.ActivateWithTPMSealedKeyOptions{
-			PINTries:            1,
-			RecoveryKeyTries:    3,
-			LockSealedKeyAccess: true,
-		})
-		activated = true
-		return true, nil
-	})
-	defer restore()
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
+	}
+	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
+	c.Assert(err, IsNil)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-		},
-		notYetMounted{boot.InitramfsDataDir},
-	)
+	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	return err
+}
 
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeNoSaveUnencryptedHappy(c *C) {
+	// ensure that we check that access to sealed keys were locked
 	sealedKeysLocked := false
-	restore = main.MockSecbootLockAccessToSealedKeys(func(tpm *secboot.TPMConnection) error {
+	defer main.MockSecbootLockSealedKeys(func() error {
 		sealedKeysLocked = true
 		return nil
-	})
-	defer restore()
-
-	epochPCR := -1
-	modelPCR := -1
-	restore = main.MockSecbootMeasureSnapSystemEpochToTPM(func(tpm *secboot.TPMConnection, pcrIndex int) error {
-		epochPCR = pcrIndex
-		return nil
-	})
-	defer restore()
-
-	var measuredModel *asserts.Model
-	restore = main.MockSecbootMeasureSnapModelToTPM(func(tpm *secboot.TPMConnection, pcrIndex int, model *asserts.Model) error {
-		modelPCR = pcrIndex
-		measuredModel = model
-		return nil
-	})
-	defer restore()
+	})()
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	err := s.testInitramfsMountsRunModeNoSaveUnencrypted(c)
 	c.Assert(err, IsNil)
-	c.Check(*n, Equals, 3)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`/dev/mapper/ubuntu-data-some-kernel-uuid %[1]s/data
-`, boot.InitramfsRunMntDir))
-	c.Check(activated, Equals, true)
-	c.Check(sealedKeysLocked, Equals, true)
-	c.Check(epochPCR, Equals, 12)
-	c.Check(modelPCR, Equals, 12)
-	c.Check(measuredModel, NotNil)
-	c.Check(measuredModel, DeepEquals, s.model)
-
-	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
-	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "run-model-measured"), testutil.FilePresent)
-}
 
-func (s *initramfsMountsSuite) TestInitramfsMountsStep1EncryptedNoModelRun(c *C) {
-	s.testInitramfsMountsStep1EncryptedNoModel(c, "run", "")
+	c.Check(sealedKeysLocked, Equals, true)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsStep1EncryptedNoModelInstall(c *C) {
-	s.testInitramfsMountsStep1EncryptedNoModel(c, "install", s.sysLabel)
-}
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeNoSaveUnencryptedKeyLockingUnhappy(c *C) {
+	// have blocking sealed keys fail
+	defer main.MockSecbootLockSealedKeys(func() error {
+		return fmt.Errorf("blocking keys failed")
+	})()
 
-func (s *initramfsMountsSuite) TestInitramfsMountsStep1EncryptedNoModelRecovery(c *C) {
-	s.testInitramfsMountsStep1EncryptedNoModel(c, "recover", s.sysLabel)
+	err := s.testInitramfsMountsRunModeNoSaveUnencrypted(c)
+	c.Assert(err, ErrorMatches, "error locking access to sealed keys: blocking keys failed")
 }
 
-func (s *initramfsMountsSuite) testInitramfsMountsStep1EncryptedNoModel(c *C, mode, label string) {
-	s.mockProcCmdlineContent(c, fmt.Sprintf("snapd_recovery_mode=%s", mode))
-	if label != "" {
-		s.mockProcCmdlineContent(c,
-			fmt.Sprintf("snapd_recovery_mode=%s snapd_recovery_system=%s", mode, label))
-		// break the seed
-		err := os.Remove(filepath.Join(s.seedDir, "systems", label, "model"))
-		c.Assert(err, IsNil)
-	}
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeRealSystemdMountTimesOutNoMount(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=install snapd_recovery_system="+s.sysLabel)
 
-	// setup ubuntu-data-enc
-	devDiskByLabel, restore := mockDevDiskByLabel(c)
+	testStart := time.Now()
+	timeCalls := 0
+	restore := main.MockTimeNow(func() time.Time {
+		timeCalls++
+		switch timeCalls {
+		case 1, 2:
+			return testStart
+		case 3:
+			// 1:31 later, we should time out
+			return testStart.Add(1*time.Minute + 31*time.Second)
+		default:
+			c.Errorf("unexpected time.Now() call (%d)", timeCalls)
+			// we want the test to fail at some point and not run forever, so
+			// move time way forward to make it for sure time out
+			return testStart.Add(10000 * time.Hour)
+		}
+	})
 	defer restore()
 
-	ubuntuDataEnc := filepath.Join(devDiskByLabel, "ubuntu-data-enc")
-	err := ioutil.WriteFile(ubuntuDataEnc, nil, 0644)
-	c.Assert(err, IsNil)
+	cmd := testutil.MockCommand(c, "systemd-mount", ``)
+	defer cmd.Restore()
 
-	restore = main.MockOsutilIsMounted(func(path string) (bool, error) {
-		return true, nil
-	})
-	defer restore()
-	restore = main.MockSecbootConnectToDefaultTPM(func() (*secboot.TPMConnection, error) {
-		return s.mockTPM, nil
+	isMountedCalls := 0
+	restore = main.MockOsutilIsMounted(func(where string) (bool, error) {
+		isMountedCalls++
+		switch isMountedCalls {
+		// always return false for the mount
+		case 1, 2:
+			c.Assert(where, Equals, boot.InitramfsUbuntuSeedDir)
+			return false, nil
+		default:
+			// shouldn't be called more than twice due to the time.Now() mocking
+			c.Errorf("test broken, IsMounted called too many (%d) times", isMountedCalls)
+			return false, fmt.Errorf("test broken, IsMounted called too many (%d) times", isMountedCalls)
+		}
 	})
 	defer restore()
 
-	restore = main.MockSecbootLockAccessToSealedKeys(func(tpm *secboot.TPMConnection) error {
-		return fmt.Errorf("unexpected call")
-	})
-	defer restore()
-	measureEpochCalls := 0
-	restore = main.MockSecbootMeasureSnapSystemEpochToTPM(func(tpm *secboot.TPMConnection, pcrIndex int) error {
-		measureEpochCalls++
-		return nil
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, ErrorMatches, fmt.Sprintf("timed out after 1m30s waiting for mount %s on %s", "/dev/disk/by-label/ubuntu-seed", boot.InitramfsUbuntuSeedDir))
+	c.Check(s.Stdout.String(), Equals, "")
+
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeHappyRealSystemdMount(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=install snapd_recovery_system="+s.sysLabel)
+
+	baseMnt := filepath.Join(boot.InitramfsRunMntDir, "base")
+	kernelMnt := filepath.Join(boot.InitramfsRunMntDir, "kernel")
+	snapdMnt := filepath.Join(boot.InitramfsRunMntDir, "snapd")
+
+	// don't do anything from systemd-mount, we verify the arguments passed at
+	// the end with cmd.Calls
+	cmd := testutil.MockCommand(c, "systemd-mount", ``)
+	defer cmd.Restore()
+
+	// mock that in turn, /run/mnt/ubuntu-boot, /run/mnt/ubuntu-seed, etc. are
+	// mounted
+	n := 0
+	restore := main.MockOsutilIsMounted(func(where string) (bool, error) {
+		n++
+		switch n {
+		// first call for each mount returns false, then returns true, this
+		// tests in the case where systemd is racy / inconsistent and things
+		// aren't mounted by the time systemd-mount returns
+		case 1, 2:
+			c.Assert(where, Equals, boot.InitramfsUbuntuSeedDir)
+			return n%2 == 0, nil
+		case 3, 4:
+			c.Assert(where, Equals, snapdMnt)
+			return n%2 == 0, nil
+		case 5, 6:
+			c.Assert(where, Equals, kernelMnt)
+			return n%2 == 0, nil
+		case 7, 8:
+			c.Assert(where, Equals, baseMnt)
+			return n%2 == 0, nil
+		case 9, 10:
+			c.Assert(where, Equals, boot.InitramfsDataDir)
+			return n%2 == 0, nil
+		default:
+			c.Errorf("unexpected IsMounted check on %s", where)
+			return false, fmt.Errorf("unexpected IsMounted check on %s", where)
+		}
 	})
 	defer restore()
-	measureModelCalls := 0
-	restore = main.MockSecbootMeasureSnapModelToTPM(func(tpm *secboot.TPMConnection, pcrIndex int, model *asserts.Model) error {
-		measureModelCalls++
-		return fmt.Errorf("unexpected call")
-	})
+
+	// mock a bootloader
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
 	defer restore()
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	where := "/run/mnt/ubuntu-boot/model"
-	if mode != "run" {
-		where = fmt.Sprintf("/run/mnt/ubuntu-seed/systems/%s/model", label)
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
+
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
-	c.Assert(err, ErrorMatches,
-		fmt.Sprintf("cannot read model assertion: open .*%s: no such file or directory", where))
-	c.Assert(measureEpochCalls, Equals, 1)
-	c.Assert(measureModelCalls, Equals, 0)
-	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
-	gl, err := filepath.Glob(filepath.Join(dirs.SnapBootstrapRunDir, "*-model-measured"))
+	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
-	c.Assert(gl, HasLen, 0)
-}
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, IsNil)
+	c.Check(s.Stdout.String(), Equals, "")
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
+	// check that all of the override files are present
+	for _, initrdUnit := range []string{
+		"initrd.target",
+		"initrd-fs.target",
+		"initrd-switch-root.target",
+		"local-fs.target",
+	} {
+		for _, mountUnit := range []string{
+			systemd.EscapeUnitNamePath(boot.InitramfsUbuntuSeedDir),
+			systemd.EscapeUnitNamePath(snapdMnt),
+			systemd.EscapeUnitNamePath(kernelMnt),
+			systemd.EscapeUnitNamePath(baseMnt),
+			systemd.EscapeUnitNamePath(boot.InitramfsDataDir),
+		} {
+			fname := fmt.Sprintf("snap_bootstrap_%s.conf", mountUnit)
+			unitFile := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d", fname)
+			c.Assert(unitFile, testutil.FileEquals, fmt.Sprintf(`[Unit]
+Requires=%[1]s
+After=%[1]s
+`, mountUnit+".mount"))
+		}
+	}
+
+	// 2 IsMounted calls per mount point, so 10 total IsMounted calls
+	c.Assert(n, Equals, 10)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"systemd-mount",
+			"/dev/disk/by-label/ubuntu-seed",
 			boot.InitramfsUbuntuSeedDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.snapd.Filename()),
+			snapdMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.kernel.Filename()),
+			kernelMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.core20.Filename()),
+			baseMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			"tmpfs",
 			boot.InitramfsDataDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--type=tmpfs",
+			"--fsck=no",
 		},
-		notYetMounted{
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
+	})
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeNoSaveHappyRealSystemdMount(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	baseMnt := filepath.Join(boot.InitramfsRunMntDir, "base")
+	kernelMnt := filepath.Join(boot.InitramfsRunMntDir, "kernel")
+	snapdMnt := filepath.Join(boot.InitramfsRunMntDir, "snapd")
+
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}:     defaultBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:     defaultBootDisk,
+			{Mountpoint: boot.InitramfsHostUbuntuDataDir}: defaultBootDisk,
 		},
 	)
+	defer restore()
 
-	// write modeenv
-	modeEnv := boot.Modeenv{
-		RecoverySystem: "20191118",
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	// don't do anything from systemd-mount, we verify the arguments passed at
+	// the end with cmd.Calls
+	cmd := testutil.MockCommand(c, "systemd-mount", ``)
+	defer cmd.Restore()
+
+	// mock that in turn, /run/mnt/ubuntu-boot, /run/mnt/ubuntu-seed, etc. are
+	// mounted
+	n := 0
+	restore = main.MockOsutilIsMounted(func(where string) (bool, error) {
+		n++
+		switch n {
+		// first call for each mount returns false, then returns true, this
+		// tests in the case where systemd is racy / inconsistent and things
+		// aren't mounted by the time systemd-mount returns
+		case 1, 2:
+			c.Assert(where, Equals, boot.InitramfsUbuntuSeedDir)
+			return n%2 == 0, nil
+		case 3, 4:
+			c.Assert(where, Equals, snapdMnt)
+			return n%2 == 0, nil
+		case 5, 6:
+			c.Assert(where, Equals, kernelMnt)
+			return n%2 == 0, nil
+		case 7, 8:
+			c.Assert(where, Equals, baseMnt)
+			return n%2 == 0, nil
+		case 9, 10:
+			c.Assert(where, Equals, boot.InitramfsDataDir)
+			return n%2 == 0, nil
+		case 11, 12:
+			c.Assert(where, Equals, boot.InitramfsUbuntuBootDir)
+			return n%2 == 0, nil
+		case 13, 14:
+			c.Assert(where, Equals, boot.InitramfsHostUbuntuDataDir)
+			return n%2 == 0, nil
+		default:
+			c.Errorf("unexpected IsMounted check on %s", where)
+			return false, fmt.Errorf("unexpected IsMounted check on %s", where)
+		}
+	})
+	defer restore()
+
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		// this test doesn't use ubuntu-save, so we need to return an
+		// unencrypted ubuntu-data the first time, but not found the second time
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+		case 1:
+			return foundUnencrypted(name), nil
+		case 2:
+			return notFoundPart(), fmt.Errorf("error enumerating to find ubuntu-save")
+		default:
+			c.Errorf("unexpected call (number %d) to UnlockVolumeUsingSealedKeyIfEncrypted", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("unexpected call (%d) to UnlockVolumeUsingSealedKeyIfEncrypted", unlockVolumeWithSealedKeyCalls)
+		}
+	})
+	defer restore()
 
 	// mock a bootloader
 	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
@@ -519,921 +931,1329 @@
 	defer bootloader.Force(nil)
 
 	// set the current kernel
-	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
-	c.Assert(err, IsNil)
-	r := bloader.SetRunKernelImageEnabledKernel(kernel)
-	defer r()
-
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 6)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/core20_123.snap %[1]s/base
-%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_1.snap %[1]s/kernel
-%[1]s/ubuntu-seed/snaps/snapd_1.snap %[1]s/snapd
-`, boot.InitramfsRunMntDir))
-}
-
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2BaseSnapUpgradeFailsHappy(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "base")},
-		mounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
-	)
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
-	// write modeenv as if we failed to boot and were rebooted because the
-	// base snap was broken
-	modeEnv := &boot.Modeenv{
-		Base:       "core20_123.snap",
-		TryBase:    "core20_124.snap",
-		BaseStatus: boot.TryingStatus,
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
 	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
 
-	tryBaseSnap := filepath.Join(boot.InitramfsWritableDir, dirs.SnapBlobDir, "core20_124.snap")
-	err = os.MkdirAll(filepath.Dir(tryBaseSnap), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(tryBaseSnap, []byte{0}, 0644)
-	c.Assert(err, IsNil)
-	defer os.Remove(tryBaseSnap)
+	s.testRecoverModeHappy(c)
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/core20_123.snap %[1]s/base
-`, boot.InitramfsRunMntDir))
+	c.Check(s.Stdout.String(), Equals, "")
 
-	// check that the modeenv was re-written
-	newModeenv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
-	// BaseStatus was re-set to default
-	c.Assert(newModeenv.BaseStatus, DeepEquals, boot.DefaultStatus)
-	c.Assert(newModeenv.TryBase, DeepEquals, modeEnv.TryBase)
-	c.Assert(newModeenv.Base, DeepEquals, modeEnv.Base)
-}
+	// check that all of the override files are present
+	for _, initrdUnit := range []string{
+		"initrd.target",
+		"initrd-fs.target",
+		"initrd-switch-root.target",
+		"local-fs.target",
+	} {
+		for _, mountUnit := range []string{
+			systemd.EscapeUnitNamePath(boot.InitramfsUbuntuSeedDir),
+			systemd.EscapeUnitNamePath(snapdMnt),
+			systemd.EscapeUnitNamePath(kernelMnt),
+			systemd.EscapeUnitNamePath(baseMnt),
+			systemd.EscapeUnitNamePath(boot.InitramfsDataDir),
+			systemd.EscapeUnitNamePath(boot.InitramfsHostUbuntuDataDir),
+		} {
+			fname := fmt.Sprintf("snap_bootstrap_%s.conf", mountUnit)
+			unitFile := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d", fname)
+			c.Assert(unitFile, testutil.FileEquals, fmt.Sprintf(`[Unit]
+Requires=%[1]s
+After=%[1]s
+`, mountUnit+".mount"))
+		}
+	}
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2ModeenvTryBaseEmptyHappy(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	// 2 IsMounted calls per mount point, so 14 total IsMounted calls
+	c.Assert(n, Equals, 14)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"systemd-mount",
+			"/dev/disk/by-label/ubuntu-seed",
 			boot.InitramfsUbuntuSeedDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.snapd.Filename()),
+			snapdMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.kernel.Filename()),
+			kernelMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.core20.Filename()),
+			baseMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			"tmpfs",
 			boot.InitramfsDataDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--type=tmpfs",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+			boot.InitramfsHostUbuntuDataDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "base")},
-		mounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
-	)
-
-	// write a modeenv with no try_base so we fall back to using base
-	modeEnv := &boot.Modeenv{
-		Base:       "core20_123.snap",
-		BaseStatus: boot.TryStatus,
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	})
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/core20_123.snap %[1]s/base
-`, boot.InitramfsRunMntDir))
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
 
-	// check that the modeenv is the same
-	newModeenv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
-	c.Assert(newModeenv.BaseStatus, DeepEquals, modeEnv.BaseStatus)
-	c.Assert(newModeenv.TryBase, DeepEquals, modeEnv.TryBase)
-	c.Assert(newModeenv.Base, DeepEquals, modeEnv.Base)
+	// we should have only tried to unseal things twice, first for ubuntu-data
+	// unencrypted, then for ubuntu-save unencrypted
+	c.Assert(unlockVolumeWithSealedKeyCalls, Equals, 2)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2BaseSnapUpgradeHappy(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeWithSaveHappyRealSystemdMount(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsHostUbuntuDataDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}:     defaultBootWithSaveDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "base")},
-		mounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
+
+	baseMnt := filepath.Join(boot.InitramfsRunMntDir, "base")
+	kernelMnt := filepath.Join(boot.InitramfsRunMntDir, "kernel")
+	snapdMnt := filepath.Join(boot.InitramfsRunMntDir, "snapd")
+
+	// don't do anything from systemd-mount, we verify the arguments passed at
+	// the end with cmd.Calls
+	cmd := testutil.MockCommand(c, "systemd-mount", ``)
+	defer cmd.Restore()
+
+	isMountedChecks := []string{}
+	restore = main.MockOsutilIsMounted(func(where string) (bool, error) {
+		isMountedChecks = append(isMountedChecks, where)
+		return true, nil
+	})
+	defer restore()
+
+	// mock a bootloader
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
+
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
 	// write modeenv
-	modeEnv := &boot.Modeenv{
-		Base:       "core20_123.snap",
-		TryBase:    "core20_124.snap",
-		BaseStatus: boot.TryStatus,
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
 	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
 
-	tryBaseSnap := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), "core20_124.snap")
-	err = os.MkdirAll(filepath.Dir(tryBaseSnap), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(tryBaseSnap, []byte{0}, 0644)
-	c.Assert(err, IsNil)
-	defer os.Remove(tryBaseSnap)
+	s.testRecoverModeHappy(c)
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/core20_124.snap %[1]s/base
-`, boot.InitramfsRunMntDir))
+	c.Check(s.Stdout.String(), Equals, "")
 
-	// check that the modeenv was re-written
-	newModeenv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
-	c.Assert(newModeenv.BaseStatus, DeepEquals, boot.TryingStatus)
-	c.Assert(newModeenv.TryBase, DeepEquals, modeEnv.TryBase)
-	c.Assert(newModeenv.Base, DeepEquals, modeEnv.Base)
-}
+	// check that all of the override files are present
+	for _, initrdUnit := range []string{
+		"initrd.target",
+		"initrd-fs.target",
+		"initrd-switch-root.target",
+		"local-fs.target",
+	} {
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2ModeenvBaseEmptyUnhappy(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+		mountUnit := systemd.EscapeUnitNamePath(boot.InitramfsUbuntuSaveDir)
+		fname := fmt.Sprintf("snap_bootstrap_%s.conf", mountUnit)
+		unitFile := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d", fname)
+		c.Assert(unitFile, testutil.FileEquals, fmt.Sprintf(`[Unit]
+Requires=%[1]s
+After=%[1]s
+`, mountUnit+".mount"))
+	}
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
+	c.Check(isMountedChecks, DeepEquals, []string{
+		boot.InitramfsUbuntuSeedDir,
+		snapdMnt,
+		kernelMnt,
+		baseMnt,
+		boot.InitramfsDataDir,
+		boot.InitramfsUbuntuBootDir,
+		boot.InitramfsHostUbuntuDataDir,
+		boot.InitramfsUbuntuSaveDir,
+	})
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"systemd-mount",
+			"/dev/disk/by-label/ubuntu-seed",
 			boot.InitramfsUbuntuSeedDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.snapd.Filename()),
+			snapdMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.kernel.Filename()),
+			kernelMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(s.seedDir, "snaps", s.core20.Filename()),
+			baseMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			"tmpfs",
 			boot.InitramfsDataDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--type=tmpfs",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+			boot.InitramfsHostUbuntuDataDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			boot.InitramfsUbuntuSaveDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "base")},
-		mounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
-	)
-
-	// write an empty modeenv
-	modeEnv := &boot.Modeenv{}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	})
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, ErrorMatches, "modeenv corrupt: missing base setting")
-	c.Assert(*n, Equals, 4)
-	c.Check(s.Stdout.String(), Equals, "")
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2ModeenvTryBaseNotExistsHappy(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeHappyNoSaveRealSystemdMount(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootDisk,
+			{Mountpoint: boot.InitramfsDataDir}:       defaultBootDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "base")},
-		mounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
+
+	baseMnt := filepath.Join(boot.InitramfsRunMntDir, "base")
+	kernelMnt := filepath.Join(boot.InitramfsRunMntDir, "kernel")
+
+	// don't do anything from systemd-mount, we verify the arguments passed at
+	// the end with cmd.Calls
+	cmd := testutil.MockCommand(c, "systemd-mount", ``)
+	defer cmd.Restore()
+
+	// mock that in turn, /run/mnt/ubuntu-boot, /run/mnt/ubuntu-seed, etc. are
+	// mounted
+	n := 0
+	restore = main.MockOsutilIsMounted(func(where string) (bool, error) {
+		n++
+		switch n {
+		// first call for each mount returns false, then returns true, this
+		// tests in the case where systemd is racy / inconsistent and things
+		// aren't mounted by the time systemd-mount returns
+		case 1, 2:
+			c.Assert(where, Equals, boot.InitramfsUbuntuBootDir)
+			return n%2 == 0, nil
+		case 3, 4:
+			c.Assert(where, Equals, boot.InitramfsUbuntuSeedDir)
+			return n%2 == 0, nil
+		case 5, 6:
+			c.Assert(where, Equals, boot.InitramfsDataDir)
+			return n%2 == 0, nil
+		case 7, 8:
+			c.Assert(where, Equals, baseMnt)
+			return n%2 == 0, nil
+		case 9, 10:
+			c.Assert(where, Equals, kernelMnt)
+			return n%2 == 0, nil
+		default:
+			c.Errorf("unexpected IsMounted check on %s", where)
+			return false, fmt.Errorf("unexpected IsMounted check on %s", where)
+		}
+	})
+	defer restore()
+
+	// mock a bootloader
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
+
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
-	// write a modeenv with try_base not existing on disk so we fall back to
-	// using the normal base
-	modeEnv := &boot.Modeenv{
-		Base:       "core20_123.snap",
-		TryBase:    "core20_124.snap",
-		BaseStatus: boot.TryStatus,
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
 	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
 
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/core20_123.snap %[1]s/base
-`, boot.InitramfsRunMntDir))
+	c.Check(s.Stdout.String(), Equals, "")
 
-	// check that the modeenv is the same
-	newModeenv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
-	c.Assert(newModeenv.BaseStatus, DeepEquals, modeEnv.BaseStatus)
-	c.Assert(newModeenv.TryBase, DeepEquals, modeEnv.TryBase)
-	c.Assert(newModeenv.Base, DeepEquals, modeEnv.Base)
-}
+	// check that all of the override files are present
+	for _, initrdUnit := range []string{
+		"initrd.target",
+		"initrd-fs.target",
+		"initrd-switch-root.target",
+		"local-fs.target",
+	} {
+		for _, mountUnit := range []string{
+			systemd.EscapeUnitNamePath(boot.InitramfsUbuntuBootDir),
+			systemd.EscapeUnitNamePath(boot.InitramfsUbuntuSeedDir),
+			systemd.EscapeUnitNamePath(boot.InitramfsDataDir),
+			systemd.EscapeUnitNamePath(baseMnt),
+			systemd.EscapeUnitNamePath(kernelMnt),
+		} {
+			fname := fmt.Sprintf("snap_bootstrap_%s.conf", mountUnit)
+			unitFile := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d", fname)
+			c.Assert(unitFile, testutil.FileEquals, fmt.Sprintf(`[Unit]
+Requires=%[1]s
+After=%[1]s
+`, mountUnit+".mount"))
+		}
+	}
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2KernelSnapUpgradeHappy(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	// 2 IsMounted calls per mount point, so 10 total IsMounted calls
+	c.Assert(n, Equals, 10)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"systemd-mount",
+			"/dev/disk/by-label/ubuntu-boot",
 			boot.InitramfsUbuntuBootDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-seed-partuuid",
 			boot.InitramfsUbuntuSeedDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
 			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), s.core20.Filename()),
+			baseMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), s.kernel.Filename()),
+			kernelMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		},
+	})
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeWithSaveHappyRealSystemdMount(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsDataDir}:       defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}: defaultBootWithSaveDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
 
-	// write modeenv
-	modeEnv := &boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap", "pc-kernel_2.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	baseMnt := filepath.Join(boot.InitramfsRunMntDir, "base")
+	kernelMnt := filepath.Join(boot.InitramfsRunMntDir, "kernel")
 
-	tryBaseSnap := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), "core20_124.snap")
-	err = os.MkdirAll(filepath.Dir(tryBaseSnap), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(tryBaseSnap, []byte{0}, 0644)
-	c.Assert(err, IsNil)
-	defer os.Remove(tryBaseSnap)
+	// don't do anything from systemd-mount, we verify the arguments passed at
+	// the end with cmd.Calls
+	cmd := testutil.MockCommand(c, "systemd-mount", ``)
+	defer cmd.Restore()
+
+	isMountedChecks := []string{}
+	restore = main.MockOsutilIsMounted(func(where string) (bool, error) {
+		isMountedChecks = append(isMountedChecks, where)
+		return true, nil
+	})
+	defer restore()
 
 	// mock a bootloader
 	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
 	bootloader.Force(bloader)
 	defer bootloader.Force(nil)
 
-	bloader.BootVars["kernel_status"] = boot.TryingStatus
-
 	// set the current kernel
-	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
-	c.Assert(err, IsNil)
-	r := bloader.SetRunKernelImageEnabledKernel(kernel)
-	defer r()
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
+
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
-	// set the try kernel
-	tryKernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_2.snap")
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
+	}
+	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
-	r = bloader.SetRunKernelImageEnabledTryKernel(tryKernel)
-	defer r()
 
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_2.snap %[1]s/kernel
-`, boot.InitramfsRunMntDir))
-}
+	c.Check(s.Stdout.String(), Equals, "")
 
-// TODO:UC20: in this case snap-bootstrap should request a reboot, since we
-//            already booted the try snap, so mounting the fallback kernel will
-//            not match in some cases
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2UntrustedKernelSnap(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	// check that all of the override files are present
+	for _, initrdUnit := range []string{
+		"initrd.target",
+		"initrd-fs.target",
+		"initrd-switch-root.target",
+		"local-fs.target",
+	} {
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
+		mountUnit := systemd.EscapeUnitNamePath(boot.InitramfsUbuntuSaveDir)
+		fname := fmt.Sprintf("snap_bootstrap_%s.conf", mountUnit)
+		unitFile := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d", fname)
+		c.Assert(unitFile, testutil.FileEquals, fmt.Sprintf(`[Unit]
+Requires=%[1]s
+After=%[1]s
+`, mountUnit+".mount"))
+	}
+
+	c.Check(isMountedChecks, DeepEquals, []string{
+		boot.InitramfsUbuntuBootDir,
+		boot.InitramfsUbuntuSeedDir,
+		boot.InitramfsDataDir,
+		boot.InitramfsUbuntuSaveDir,
+		baseMnt,
+		kernelMnt,
+	})
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"systemd-mount",
+			"/dev/disk/by-label/ubuntu-boot",
 			boot.InitramfsUbuntuBootDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-seed-partuuid",
 			boot.InitramfsUbuntuSeedDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
 			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			boot.InitramfsUbuntuSaveDir,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=yes",
+		}, {
+			"systemd-mount",
+			filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), s.core20.Filename()),
+			baseMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		}, {
+			"systemd-mount",
+			filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), s.kernel.Filename()),
+			kernelMnt,
+			"--no-pager",
+			"--no-ask-password",
+			"--fsck=no",
+		},
+	})
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeFirstBootRecoverySystemSetHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsDataDir}:       defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}: defaultBootWithSaveDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
 
-	// write modeenv
-	modeEnv := boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-boot", "run"),
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		ubuntuPartUUIDMount("ubuntu-data-partuuid", "run"),
+		ubuntuPartUUIDMount("ubuntu-save-partuuid", "run"),
+		s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+		s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+		// RecoverySystem set makes us mount the snapd snap here
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+	}, nil)
+	defer restore()
 
 	// mock a bootloader
 	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
 	bootloader.Force(bloader)
 	defer bootloader.Force(nil)
 
-	// set the current kernel as a kernel not in CurrentKernels
-	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_2.snap")
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
+
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
+
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		RecoverySystem: "20191118",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
+	}
+	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
-	r := bloader.SetRunKernelImageEnabledKernel(kernel)
-	defer r()
 
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, ErrorMatches, fmt.Sprintf("fallback kernel snap %q is not trusted in the modeenv", "pc-kernel_2.snap"))
-	c.Assert(*n, Equals, 5)
+	c.Assert(err, IsNil)
+
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
 }
 
-// TODO:UC20: in this case snap-bootstrap should request a reboot, since we
-//            already booted the try snap, so mounting the fallback kernel will
-//            not match in some cases
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2UntrustedTryKernelSnapFallsBack(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeWithBootedKernelPartUUIDHappy(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
+	restore := main.MockPartitionUUIDForBootedKernelDisk("ubuntu-boot-partuuid")
+	defer restore()
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootDisk,
+			{Mountpoint: boot.InitramfsDataDir}:       defaultBootDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
 
-	// write modeenv
-	modeEnv := boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		ubuntuPartUUIDMount("ubuntu-data-partuuid", "run"),
+		s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+		s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+	}, nil)
+	defer restore()
 
 	// mock a bootloader
 	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
 	bootloader.Force(bloader)
 	defer bootloader.Force(nil)
 
-	// set the try kernel as a kernel not in CurrentKernels
-	kernel2, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_2.snap")
-	c.Assert(err, IsNil)
-	r := bloader.SetRunKernelImageEnabledTryKernel(kernel2)
-	defer r()
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
+
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
-	// set the normal kernel as a valid kernel
-	kernel1, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
+	// write modeenv
+	modeEnv := boot.Modeenv{
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
+	}
+	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
-	r = bloader.SetRunKernelImageEnabledKernel(kernel1)
-	defer r()
 
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-
-	// TODO:UC20: if we have somewhere to log errors from snap-bootstrap during
-	// the initramfs, check that log here
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_1.snap %[1]s/kernel
-`, boot.InitramfsRunMntDir))
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2KernelStatusTryingNoTryKernel(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeEncryptedDataHappy(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	defer main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})()
+
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:                          defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsDataDir, IsDecryptedDevice: true}:       defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir, IsDecryptedDevice: true}: defaultEncBootDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
 
-	// write modeenv
-	modeEnv := boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
-
-	// mock a bootloader
-	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
-	bootloader.Force(bloader)
-	defer bootloader.Force(nil)
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-boot", "run"),
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsDataDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			needsFsckDiskMountOpts,
+		},
+		s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+		s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+	}, nil)
+	defer restore()
 
-	// we are in trying mode, but don't set a try-kernel so we fallback to the
-	// fallback kernel
-	err = bloader.SetBootVars(map[string]string{"kernel_status": boot.TryingStatus})
+	// write the installed model like makebootable does it
+	err := os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir, "device"), 0755)
 	c.Assert(err, IsNil)
-
-	// set the normal kernel as a valid kernel
-	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
+	mf, err := os.Create(filepath.Join(boot.InitramfsUbuntuBootDir, "device/model"))
 	c.Assert(err, IsNil)
-	r := bloader.SetRunKernelImageEnabledKernel(kernel)
-	defer r()
-
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-
-	// TODO:UC20: if we have somewhere to log errors from snap-bootstrap during
-	// the initramfs, check that log here
+	defer mf.Close()
+	err = asserts.NewEncoder(mf).Encode(s.model)
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_1.snap %[1]s/kernel
-`, boot.InitramfsRunMntDir))
-}
-
-func (s *initramfsMountsSuite) TestUnlockIfEncrypted(c *C) {
-	for idx, tc := range []struct {
-		hasTPM    bool
-		tpmErr    error
-		hasEncdev bool
-		last      bool
-		lockOk    bool
-		activated bool
-		device    string
-		err       string
-	}{
-		// TODO: verify which cases are possible
-		{
-			hasTPM: true, hasEncdev: true, last: true, lockOk: true,
-			activated: true, device: "name",
-		}, {
-			hasTPM: true, hasEncdev: true, last: true, lockOk: true,
-			err: "cannot activate encrypted device .*: activation error",
-		}, {
-			hasTPM: true, hasEncdev: true, last: true, activated: true,
-			err: "cannot lock access to sealed keys: lock failed",
-		}, {
-			hasTPM: true, hasEncdev: true, lockOk: true, activated: true,
-			device: "name",
-		}, {
-			hasTPM: true, hasEncdev: true, lockOk: true,
-			err: "cannot activate encrypted device .*: activation error",
-		}, {
-			hasTPM: true, hasEncdev: true, activated: true, device: "name",
-		}, {
-			hasTPM: true, hasEncdev: true,
-			err: "cannot activate encrypted device .*: activation error",
-		}, {
-			hasTPM: true, last: true, lockOk: true, activated: true,
-			device: "name",
-		}, {
-			hasTPM: true, last: true, activated: true,
-			err: "cannot lock access to sealed keys: lock failed",
-		}, {
-			hasTPM: true, lockOk: true, activated: true, device: "name",
-		}, {
-			hasTPM: true, activated: true, device: "name",
-		}, {
-			hasTPM: true, hasEncdev: true, last: true,
-			tpmErr: errors.New("tpm error"),
-			err:    `cannot unlock encrypted device "name": tpm error`,
-		}, {
-			hasTPM: true, hasEncdev: true,
-			tpmErr: errors.New("tpm error"),
-			err:    `cannot unlock encrypted device "name": tpm error`,
-		}, {
-			hasTPM: true, last: true, device: "name",
-			tpmErr: errors.New("tpm error"),
-		}, {
-			hasTPM: true, device: "name",
-			tpmErr: errors.New("tpm error"),
-		}, {
-			hasEncdev: true, last: true,
-			tpmErr: errors.New("no tpm"),
-			err:    `cannot unlock encrypted device "name": no tpm`,
-		}, {
-			hasEncdev: true,
-			tpmErr:    errors.New("no tpm"),
-			err:       `cannot unlock encrypted device "name": no tpm`,
-		}, {
-			last: true, device: "name", tpmErr: errors.New("no tpm"),
-		}, {
-			tpmErr: errors.New("no tpm"), device: "name",
-		},
-	} {
-		randomUUID := fmt.Sprintf("random-uuid-for-test-%d", idx)
-		restore := main.MockRandomKernelUUID(func() string {
-			return randomUUID
-		})
-		defer restore()
 
-		c.Logf("tc %v: %+v", idx, tc)
-		mockTPM, restoreTPM := mockSecbootTPM(c)
-		defer restoreTPM()
-
-		restoreConnect := main.MockSecbootConnectToDefaultTPM(func() (*secboot.TPMConnection, error) {
-			return mockTPM, tc.tpmErr
+	dataActivated := false
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		c.Assert(name, Equals, "ubuntu-data")
+		c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+		c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+			AllowRecoveryKey: true,
 		})
-		defer restoreConnect()
 
-		n := 0
-		restoreLock := main.MockSecbootLockAccessToSealedKeys(func(tpm *secboot.TPMConnection) error {
-			n++
-			c.Assert(tpm, Equals, mockTPM)
-			if tc.lockOk {
-				return nil
-			}
-			return errors.New("lock failed")
-		})
-		defer restoreLock()
+		dataActivated = true
+		// return true because we are using an encrypted device
+		return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+	})
+	defer restore()
 
-		devDiskByLabel, restoreDev := mockDevDiskByLabel(c)
-		defer restoreDev()
-		if tc.hasEncdev {
-			err := ioutil.WriteFile(filepath.Join(devDiskByLabel, "name-enc"), nil, 0644)
-			c.Assert(err, IsNil)
-		}
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
 
-		restoreActivate := main.MockSecbootActivateVolumeWithTPMSealedKey(func(tpm *secboot.TPMConnection, volumeName, sourceDevicePath,
-			keyPath string, pinReader io.Reader, options *secboot.ActivateWithTPMSealedKeyOptions) (bool, error) {
-			c.Assert(tpm, Equals, mockTPM)
-			c.Assert(volumeName, Equals, "name-"+randomUUID)
-			c.Assert(sourceDevicePath, Equals, filepath.Join(devDiskByLabel, "name-enc"))
-			c.Assert(keyPath, Equals, filepath.Join(boot.InitramfsEncryptionKeyDir, "name.sealed-key"))
-			c.Assert(*options, DeepEquals, secboot.ActivateWithTPMSealedKeyOptions{
-				PINTries:            1,
-				RecoveryKeyTries:    3,
-				LockSealedKeyAccess: tc.last,
-			})
-			if !tc.activated {
-				return false, errors.New("activation error")
-			}
-			return true, nil
-		})
-		defer restoreActivate()
+	saveActivated := false
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		saveActivated = true
+		c.Assert(name, Equals, "ubuntu-save")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
+	defer restore()
 
-		device, err := main.UnlockIfEncrypted("name", tc.last)
-		if tc.device == "" {
-			c.Check(device, Equals, tc.device)
-		} else {
-			if tc.hasEncdev {
-				c.Assert(device, Equals, filepath.Join("/dev/mapper", tc.device+"-"+randomUUID))
-			} else {
-				c.Assert(device, Equals, filepath.Join(devDiskByLabel, tc.device))
-			}
-		}
-		if tc.err == "" {
-			c.Assert(err, IsNil)
-		} else {
-			c.Assert(err, ErrorMatches, tc.err)
-		}
-		// LockAccessToSealedKeys should be called whenever there is a TPM device
-		// detected, regardless of whether secure boot is enabled or there is an
-		// encrypted volume to unlock. If we have multiple encrypted volumes, we
-		// should call it after the last one is unlocked.
-		if tc.hasTPM && tc.tpmErr == nil && tc.last {
-			c.Assert(n, Equals, 1)
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
 		}
-	}
-}
+		return nil
+	})
+	defer restore()
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2EnvRefKernelBootstate(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	// mock a bootloader
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-		},
-		notYetMounted{
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
-		},
-	)
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
+
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
 	// write modeenv
 	modeEnv := boot.Modeenv{
-		RecoverySystem: "20191118",
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
+	err = modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
 
-	// mock a bootloader
-	bloader := boottest.MockUC20EnvRefExtractedKernelRunBootenv(bootloadertest.Mock("mock", c.MkDir()))
-	bootloader.Force(bloader)
-	defer bootloader.Force(nil)
-
-	// set the current kernel
-	bloader.SetBootKernel("pc-kernel_1.snap")
-
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 6)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/core20_123.snap %[1]s/base
-%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_1.snap %[1]s/kernel
-%[1]s/ubuntu-seed/snaps/snapd_1.snap %[1]s/snapd
-`, boot.InitramfsRunMntDir))
+	c.Check(dataActivated, Equals, true)
+	c.Check(saveActivated, Equals, true)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+	c.Check(sealedKeysLocked, Equals, true)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "run-model-measured"), testutil.FilePresent)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2EnvRefKernelBootstateKernelSnapUpgradeHappy(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeEncryptedDataUnhappyNoSave(c *C) {
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
+	defaultEncNoSaveBootDisk := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot":     "ubuntu-boot-partuuid",
+			"ubuntu-seed":     "ubuntu-seed-partuuid",
+			"ubuntu-data-enc": "ubuntu-data-enc-partuuid",
+			// missing ubuntu-save
+		},
+		DiskHasPartitions: true,
+		DevNum:            "defaultEncDev",
+	}
+
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:                    defaultEncNoSaveBootDisk,
+			{Mountpoint: boot.InitramfsDataDir, IsDecryptedDevice: true}: defaultEncNoSaveBootDisk,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
 	)
+	defer restore()
 
-	// write modeenv
-	modeEnv := &boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap", "pc-kernel_2.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-boot", "run"),
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsDataDir,
+			needsFsckDiskMountOpts,
+		},
+	}, nil)
+	defer restore()
 
-	tryBaseSnap := filepath.Join(dirs.SnapBlobDirUnder(boot.InitramfsWritableDir), "core20_124.snap")
-	err = os.MkdirAll(filepath.Dir(tryBaseSnap), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(tryBaseSnap, []byte{0}, 0644)
-	c.Assert(err, IsNil)
-	defer os.Remove(tryBaseSnap)
+	dataActivated := false
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		c.Assert(name, Equals, "ubuntu-data")
+		dataActivated = true
+		// return true because we are using an encrypted device
+		return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+	})
+	defer restore()
+
+	// the test does not mock ubuntu-save.key, the secboot helper for
+	// opening a volume using the key should not be called
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Fatal("unexpected call")
+		return secboot.UnlockResult{}, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error { return nil })
+	defer restore()
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		return nil
+	})
+	defer restore()
 
 	// mock a bootloader
-	bloader := boottest.MockUC20EnvRefExtractedKernelRunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
 	bootloader.Force(bloader)
 	defer bootloader.Force(nil)
 
-	bloader.BootVars["kernel_status"] = boot.TryingStatus
-
-	// set the current kernel and try kernel
-	bloader.SetBootKernel("pc-kernel_1.snap")
-	bloader.SetBootTryKernel("pc-kernel_2.snap")
-
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_2.snap %[1]s/kernel
-`, boot.InitramfsRunMntDir))
-}
-
-// TODO:UC20: in this case snap-bootstrap should request a reboot, since we
-//            already booted the try snap, so mounting the fallback kernel will
-//            not match in some cases
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2EnvRefKernelBootstateUntrustedKernelSnap(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
-	)
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
 	// write modeenv
 	modeEnv := boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
 	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
 
-	// mock a bootloader
-	bloader := boottest.MockUC20EnvRefExtractedKernelRunBootenv(bootloadertest.Mock("mock", c.MkDir()))
-	bootloader.Force(bloader)
-	defer bootloader.Force(nil)
-
-	// set the current kernel as a kernel not in CurrentKernels
-	bloader.SetBootKernel("pc-kernel_2.snap")
-
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, ErrorMatches, fmt.Sprintf("fallback kernel snap %q is not trusted in the modeenv", "pc-kernel_2.snap"))
-	c.Assert(*n, Equals, 5)
+	c.Assert(err, ErrorMatches, "cannot find ubuntu-save encryption key at .*/run/mnt/data/system-data/var/lib/snapd/device/fde/ubuntu-save.key")
+	c.Check(dataActivated, Equals, true)
 }
 
-// TODO:UC20: in this case snap-bootstrap should request a reboot, since we
-//            already booted the try snap, so mounting the fallback kernel will
-//            not match in some cases
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2EnvRefKernelBootstateUntrustedTryKernelSnapFallsBack(c *C) {
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeEncryptedDataUnhappyUnlockSaveFail(c *C) {
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	defer main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return fmt.Errorf("blocking keys failed")
+	})()
+
 	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	restore := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:                          defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsDataDir, IsDecryptedDevice: true}:       defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir, IsDecryptedDevice: true}: defaultEncBootDisk,
+		},
+	)
+	defer restore()
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-boot", "run"),
+		ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+		{
+			"/dev/mapper/ubuntu-data-random",
 			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
+			needsFsckDiskMountOpts,
 		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
-	)
+	}, nil)
+	defer restore()
 
-	// write modeenv
-	modeEnv := boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
-	}
-	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
-	c.Assert(err, IsNil)
+	dataActivated := false
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		c.Assert(name, Equals, "ubuntu-data")
+		dataActivated = true
+		// return true because we are using an encrypted device
+		return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsWritableDir, "foo", "")
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not yet activated"))
+		return foundEncrypted("ubuntu-save"), fmt.Errorf("ubuntu-save unlock fail")
+	})
+	defer restore()
+
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error { return nil })
+	defer restore()
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		return nil
+	})
+	defer restore()
 
 	// mock a bootloader
-	bloader := boottest.MockUC20EnvRefExtractedKernelRunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+	bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
 	bootloader.Force(bloader)
 	defer bootloader.Force(nil)
 
-	// set the try kernel as a kernel not in CurrentKernels
-	bloader.SetBootTryKernel("pc-kernel_2.snap")
-
-	// set the normal kernel as a valid kernel
-	bloader.SetBootKernel("pc-kernel_1.snap")
-
-	bloader.BootVars["kernel_status"] = boot.TryingStatus
-
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-
-	// TODO:UC20: if we have somewhere to log errors from snap-bootstrap during
-	// the initramfs, check that log here
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_1.snap %[1]s/kernel
-`, boot.InitramfsRunMntDir))
-}
-
-func (s *initramfsMountsSuite) TestInitramfsMountsRunModeStep2EnvRefKernelBootstateKernelStatusTryingNoTryKernel(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
+	// set the current kernel
+	restore = bloader.SetEnabledKernel(s.kernel)
+	defer restore()
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuBootDir,
-			boot.InitramfsUbuntuSeedDir,
-			boot.InitramfsDataDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "kernel")},
-	)
+	makeSnapFilesOnEarlyBootUbuntuData(c, s.kernel, s.core20)
 
 	// write modeenv
 	modeEnv := boot.Modeenv{
-		Base:           "core20_123.snap",
-		CurrentKernels: []string{"pc-kernel_1.snap"},
+		Mode:           "run",
+		Base:           s.core20.Filename(),
+		CurrentKernels: []string{s.kernel.Filename()},
 	}
 	err := modeEnv.WriteTo(boot.InitramfsWritableDir)
 	c.Assert(err, IsNil)
 
-	// mock a bootloader
-	bloader := boottest.MockUC20EnvRefExtractedKernelRunBootenv(bootloadertest.Mock("mock", c.MkDir()))
-	bootloader.Force(bloader)
-	defer bootloader.Force(nil)
-
-	// we are in trying mode, but don't set a try-kernel so we fallback to the
-	// fallback kernel
-	err = bloader.SetBootVars(map[string]string{"kernel_status": boot.TryingStatus})
-	c.Assert(err, IsNil)
-
-	// set the normal kernel as a valid kernel
-	bloader.SetBootKernel("pc-kernel_1.snap")
-
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-
-	// TODO:UC20: if we have somewhere to log errors from snap-bootstrap during
-	// the initramfs, check that log here
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/data/system-data/var/lib/snapd/snaps/pc-kernel_1.snap %[1]s/kernel
-`, boot.InitramfsRunMntDir))
+	c.Assert(err, ErrorMatches, "cannot unlock ubuntu-save volume: ubuntu-save unlock fail")
+	c.Check(dataActivated, Equals, true)
+	// locking sealing keys was attempted, error was only logged
+	c.Check(sealedKeysLocked, Equals, true)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeStep1(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeEncryptedNoModel(c *C) {
+	s.testInitramfsMountsEncryptedNoModel(c, "run", "", 1)
+}
 
-	n := s.mockExpectedMountChecks(c,
-		notYetMounted{boot.InitramfsUbuntuSeedDir},
-	)
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeEncryptedNoModel(c *C) {
+	s.testInitramfsMountsEncryptedNoModel(c, "install", s.sysLabel, 0)
+}
 
-	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 1)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf("/dev/disk/by-label/ubuntu-seed %s/ubuntu-seed\n", boot.InitramfsRunMntDir))
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedNoModel(c *C) {
+	s.testInitramfsMountsEncryptedNoModel(c, "recover", s.sysLabel, 0)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeStep2(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+func (s *initramfsMountsSuite) testInitramfsMountsEncryptedNoModel(c *C, mode, label string, expectedMeasureModelCalls int) {
+	s.mockProcCmdlineContent(c, fmt.Sprintf("snapd_recovery_mode=%s", mode))
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{boot.InitramfsUbuntuSeedDir},
-		notYetMounted{
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
-			filepath.Join(boot.InitramfsRunMntDir, "data"),
-		},
-	)
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	defer main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return fmt.Errorf("blocking keys failed")
+	})()
 
-	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 5)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/snaps/snapd_1.snap %[2]s/snapd
-%[1]s/snaps/pc-kernel_1.snap %[2]s/kernel
-%[1]s/snaps/core20_1.snap %[2]s/base
---type=tmpfs tmpfs %[2]s/data
-`, s.seedDir, boot.InitramfsRunMntDir))
-}
+	// install and recover mounts are just ubuntu-seed before we fail
+	var restore func()
+	if mode == "run" {
+		// run mode will mount ubuntu-boot and ubuntu-seed
+		restore = s.mockSystemdMountSequence(c, []systemdMount{
+			ubuntuLabelMount("ubuntu-boot", mode),
+			ubuntuPartUUIDMount("ubuntu-seed-partuuid", mode),
+		}, nil)
+		restore2 := disks.MockMountPointDisksToPartitionMapping(
+			map[disks.Mountpoint]*disks.MockDiskMapping{
+				{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			},
+		)
+		defer restore2()
+	} else {
+		restore = s.mockSystemdMountSequence(c, []systemdMount{
+			ubuntuLabelMount("ubuntu-seed", mode),
+		}, nil)
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeStep3(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+		// in install / recover mode the code doesn't make it far enough to do
+		// any disk cross checking
+	}
+	defer restore()
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuSeedDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
-			filepath.Join(boot.InitramfsRunMntDir, "data"),
-		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "host/ubuntu-data")},
-	)
+	if label != "" {
+		s.mockProcCmdlineContent(c,
+			fmt.Sprintf("snapd_recovery_mode=%s snapd_recovery_system=%s", mode, label))
+		// break the seed
+		err := os.Remove(filepath.Join(s.seedDir, "systems", label, "model"))
+		c.Assert(err, IsNil)
+	}
+
+	measureEpochCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		_, err := findModel()
+		if err != nil {
+			return err
+		}
+		return fmt.Errorf("unexpected call")
+	})
+	defer restore()
 
 	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	where := "/run/mnt/ubuntu-boot/device/model"
+	if mode != "run" {
+		where = fmt.Sprintf("/run/mnt/ubuntu-seed/systems/%s/model", label)
+	}
+	c.Assert(err, ErrorMatches, fmt.Sprintf(".*cannot read model assertion: open .*%s: no such file or directory", where))
+	c.Assert(measureEpochCalls, Equals, 1)
+	c.Assert(measureModelCalls, Equals, expectedMeasureModelCalls)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	gl, err := filepath.Glob(filepath.Join(dirs.SnapBootstrapRunDir, "*-model-measured"))
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 6)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`/dev/disk/by-label/ubuntu-data %s/host/ubuntu-data
-`, boot.InitramfsRunMntDir))
+	c.Assert(gl, HasLen, 0)
+	c.Check(sealedKeysLocked, Equals, true)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeStep3Encrypted(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+func (s *initramfsMountsSuite) TestInitramfsMountsRunModeUpgradeScenarios(c *C) {
+	tt := []struct {
+		modeenv *boot.Modeenv
+		// this is a function so we can have delayed execution, typical values
+		// depend on the root dir which changes for each test case
+		additionalMountsFunc func() []systemdMount
+		enableKernel         snap.PlaceInfo
+		enableTryKernel      snap.PlaceInfo
+		snapFiles            []snap.PlaceInfo
+		kernelStatus         string
+
+		expRebootPanic string
+		expLog         string
+		expError       string
+		expModeenv     *boot.Modeenv
+		comment        string
+	}{
+		// default case no upgrades
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+				}
+			},
+			enableKernel: s.kernel,
+			snapFiles:    []snap.PlaceInfo{s.core20, s.kernel},
+			comment:      "happy default no upgrades",
+		},
 
-	// setup ubuntu-data-enc
-	devDiskByLabel, restore := mockDevDiskByLabel(c)
-	defer restore()
+		// happy upgrade cases
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				CurrentKernels: []string{s.kernel.Filename(), s.kernelr2.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernelr2),
+				}
+			},
+			kernelStatus:    boot.TryingStatus,
+			enableKernel:    s.kernel,
+			enableTryKernel: s.kernelr2,
+			snapFiles:       []snap.PlaceInfo{s.core20, s.kernel, s.kernelr2},
+			comment:         "happy kernel snap upgrade",
+		},
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.TryStatus,
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20r2),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+				}
+			},
+			enableKernel: s.kernel,
+			snapFiles:    []snap.PlaceInfo{s.kernel, s.core20, s.core20r2},
+			expModeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.TryingStatus,
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			comment: "happy base snap upgrade",
+		},
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.TryStatus,
+				CurrentKernels: []string{s.kernel.Filename(), s.kernelr2.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20r2),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernelr2),
+				}
+			},
+			enableKernel:    s.kernel,
+			enableTryKernel: s.kernelr2,
+			snapFiles:       []snap.PlaceInfo{s.kernel, s.kernelr2, s.core20, s.core20r2},
+			kernelStatus:    boot.TryingStatus,
+			expModeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.TryingStatus,
+				CurrentKernels: []string{s.kernel.Filename(), s.kernelr2.Filename()},
+			},
+			comment: "happy simultaneous base snap and kernel snap upgrade",
+		},
 
-	ubuntuDataEnc := filepath.Join(devDiskByLabel, "ubuntu-data-enc")
-	err := ioutil.WriteFile(ubuntuDataEnc, nil, 0644)
-	c.Assert(err, IsNil)
+		// fallback cases
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.TryStatus,
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+				}
+			},
+			enableKernel: s.kernel,
+			snapFiles:    []snap.PlaceInfo{s.kernel, s.core20},
+			comment:      "happy fallback try base not existing",
+		},
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				BaseStatus:     boot.TryStatus,
+				TryBase:        "",
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+				}
+			},
+			enableKernel: s.kernel,
+			snapFiles:    []snap.PlaceInfo{s.kernel, s.core20},
+			comment:      "happy fallback base_status try, empty try_base",
+		},
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.TryingStatus,
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			additionalMountsFunc: func() []systemdMount {
+				return []systemdMount{
+					s.makeRunSnapSystemdMount(snap.TypeBase, s.core20),
+					s.makeRunSnapSystemdMount(snap.TypeKernel, s.kernel),
+				}
+			},
+			enableKernel: s.kernel,
+			snapFiles:    []snap.PlaceInfo{s.kernel, s.core20, s.core20r2},
+			expModeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				TryBase:        s.core20r2.Filename(),
+				BaseStatus:     boot.DefaultStatus,
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			comment: "happy fallback failed boot with try snap",
+		},
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			enableKernel:    s.kernel,
+			enableTryKernel: s.kernelr2,
+			snapFiles:       []snap.PlaceInfo{s.core20, s.kernel, s.kernelr2},
+			kernelStatus:    boot.TryingStatus,
+			expRebootPanic:  "reboot due to untrusted try kernel snap",
+			comment:         "happy fallback untrusted try kernel snap",
+		},
+		// TODO:UC20: if we ever have a way to compare what kernel was booted,
+		//            and we compute that the booted kernel was the try kernel,
+		//            but the try kernel is not enabled on the bootloader
+		//            (somehow??), then this should become a reboot case rather
+		//            than mount the old kernel snap
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			kernelStatus:   boot.TryingStatus,
+			enableKernel:   s.kernel,
+			snapFiles:      []snap.PlaceInfo{s.core20, s.kernel},
+			expRebootPanic: "reboot due to no try kernel snap",
+			comment:        "happy fallback kernel_status trying no try kernel",
+		},
 
-	// setup a fake tpm
-	mockTPM, restore := mockSecbootTPM(c)
-	defer restore()
+		// unhappy cases
+		{
+			modeenv: &boot.Modeenv{
+				Mode: "run",
+			},
+			expError: "fallback base snap unusable: cannot get snap revision: modeenv base boot variable is empty",
+			comment:  "unhappy empty modeenv",
+		},
+		// TODO:UC20: in this case snap-bootstrap should request a reboot, since we
+		//            already booted the try snap, so mounting the fallback kernel will
+		//            not match in some cases
+		{
+			modeenv: &boot.Modeenv{
+				Mode:           "run",
+				Base:           s.core20.Filename(),
+				CurrentKernels: []string{s.kernel.Filename()},
+			},
+			enableKernel: s.kernelr2,
+			snapFiles:    []snap.PlaceInfo{s.core20, s.kernelr2},
+			expError:     fmt.Sprintf("fallback kernel snap %q is not trusted in the modeenv", s.kernelr2.Filename()),
+			comment:      "unhappy untrusted main kernel snap",
+		},
+	}
 
-	restore = main.MockRandomKernelUUID(func() string {
-		return "some-kernel-uuid"
-	})
-	defer restore()
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=run")
 
-	activated := false
-	// setup activating the fake tpm
-	restore = main.MockSecbootActivateVolumeWithTPMSealedKey(func(tpm *secboot.TPMConnection, volumeName, sourceDevicePath,
-		keyPath string, pinReader io.Reader, options *secboot.ActivateWithTPMSealedKeyOptions) (bool, error) {
-		c.Assert(tpm, Equals, mockTPM)
-		c.Assert(volumeName, Equals, "ubuntu-data-some-kernel-uuid")
-		c.Assert(sourceDevicePath, Equals, ubuntuDataEnc)
-		// the keyfile will be on ubuntu-seed as ubuntu-data.sealed-key
-		c.Assert(keyPath, Equals, filepath.Join(boot.InitramfsUbuntuSeedDir, "device/fde", "ubuntu-data.sealed-key"))
-		c.Assert(*options, DeepEquals, secboot.ActivateWithTPMSealedKeyOptions{
-			PINTries:            1,
-			RecoveryKeyTries:    3,
-			LockSealedKeyAccess: true,
-		})
-		activated = true
-		return true, nil
-	})
-	defer restore()
+	for _, t := range tt {
+		comment := Commentf(t.comment)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuSeedDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
-			filepath.Join(boot.InitramfsRunMntDir, "data"),
-		},
-		notYetMounted{filepath.Join(boot.InitramfsRunMntDir, "host/ubuntu-data")},
-	)
+		var cleanups []func()
 
-	sealedKeysLocked := false
-	restore = main.MockSecbootLockAccessToSealedKeys(func(tpm *secboot.TPMConnection) error {
-		sealedKeysLocked = true
-		return nil
-	})
-	defer restore()
+		if t.expRebootPanic != "" {
+			r := boot.MockInitramfsReboot(func() error {
+				panic(t.expRebootPanic)
+			})
+			cleanups = append(cleanups, r)
+		}
 
-	epochPCR := -1
-	modelPCR := -1
-	restore = main.MockSecbootMeasureSnapSystemEpochToTPM(func(tpm *secboot.TPMConnection, pcrIndex int) error {
-		epochPCR = pcrIndex
-		return nil
-	})
-	defer restore()
+		// setup unique root dir per test
+		rootDir := c.MkDir()
+		cleanups = append(cleanups, func() { dirs.SetRootDir(dirs.GlobalRootDir) })
+		dirs.SetRootDir(rootDir)
+
+		restore := disks.MockMountPointDisksToPartitionMapping(
+			map[disks.Mountpoint]*disks.MockDiskMapping{
+				{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultBootDisk,
+				{Mountpoint: boot.InitramfsDataDir}:       defaultBootDisk,
+			},
+		)
+		cleanups = append(cleanups, restore)
 
-	var measuredModel *asserts.Model
-	restore = main.MockSecbootMeasureSnapModelToTPM(func(tpm *secboot.TPMConnection, pcrIndex int, model *asserts.Model) error {
-		modelPCR = pcrIndex
-		measuredModel = model
-		return nil
-	})
-	defer restore()
+		// setup expected systemd-mount calls - every test case has ubuntu-boot,
+		// ubuntu-seed and ubuntu-data mounts because all those mounts happen
+		// before any boot logic
+		mnts := []systemdMount{
+			ubuntuLabelMount("ubuntu-boot", "run"),
+			ubuntuPartUUIDMount("ubuntu-seed-partuuid", "run"),
+			ubuntuPartUUIDMount("ubuntu-data-partuuid", "run"),
+		}
+		if t.additionalMountsFunc != nil {
+			mnts = append(mnts, t.additionalMountsFunc()...)
+		}
+		cleanups = append(cleanups, s.mockSystemdMountSequence(c, mnts, comment))
 
-	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 6)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`/dev/mapper/ubuntu-data-some-kernel-uuid %[1]s/host/ubuntu-data
-`, boot.InitramfsRunMntDir))
+		// mock a bootloader
+		bloader := boottest.MockUC20RunBootenv(bootloadertest.Mock("mock", c.MkDir()))
+		bootloader.Force(bloader)
+		cleanups = append(cleanups, func() { bootloader.Force(nil) })
+
+		if t.enableKernel != nil {
+			// don't need to restore since each test case has a unique bloader
+			bloader.SetEnabledKernel(t.enableKernel)
+		}
 
-	c.Check(activated, Equals, true)
-	c.Check(sealedKeysLocked, Equals, true)
-	c.Check(epochPCR, Equals, 12)
-	c.Check(modelPCR, Equals, 12)
-	c.Check(measuredModel, NotNil)
-	c.Check(measuredModel, DeepEquals, s.model)
+		if t.enableTryKernel != nil {
+			bloader.SetEnabledTryKernel(t.enableTryKernel)
+		}
 
-	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
-	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
-}
+		// set the kernel_status boot var
+		err := bloader.SetBootVars(map[string]string{"kernel_status": t.kernelStatus})
+		c.Assert(err, IsNil, comment)
+
+		// write the initial modeenv
+		err = t.modeenv.WriteTo(boot.InitramfsWritableDir)
+		c.Assert(err, IsNil, comment)
+
+		// make the snap files - no restore needed because we use a unique root
+		// dir for each test case
+		makeSnapFilesOnEarlyBootUbuntuData(c, t.snapFiles...)
+
+		if t.expRebootPanic != "" {
+			f := func() { main.Parser().ParseArgs([]string{"initramfs-mounts"}) }
+			c.Assert(f, PanicMatches, t.expRebootPanic, comment)
+		} else {
+			_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
+			if t.expError != "" {
+				c.Assert(err, ErrorMatches, t.expError, comment)
+			} else {
+				c.Assert(err, IsNil, comment)
 
-var mockStateContent = `{"data":{"auth":{"users":[{"name":"mvo"}]}},"some":{"other":"stuff"}}`
+				// check the resultant modeenv
+				// if the expModeenv is nil, we just compare to the start
+				newModeenv, err := boot.ReadModeenv(boot.InitramfsWritableDir)
+				c.Assert(err, IsNil, comment)
+				m := t.modeenv
+				if t.expModeenv != nil {
+					m = t.expModeenv
+				}
+				c.Assert(newModeenv.BaseStatus, DeepEquals, m.BaseStatus, comment)
+				c.Assert(newModeenv.TryBase, DeepEquals, m.TryBase, comment)
+				c.Assert(newModeenv.Base, DeepEquals, m.Base, comment)
+			}
+		}
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeStep4(c *C) {
-	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+		for _, r := range cleanups {
+			r()
+		}
+	}
+}
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{
-			boot.InitramfsUbuntuSeedDir,
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
-			filepath.Join(boot.InitramfsRunMntDir, "data"),
-			filepath.Join(boot.InitramfsRunMntDir, "host/ubuntu-data"),
-		},
-	)
+func (s *initramfsMountsSuite) testRecoverModeHappy(c *C) {
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore := main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
 
+	// mock various files that are copied around during recover mode (and files
+	// that shouldn't be copied around)
 	ephemeralUbuntuData := filepath.Join(boot.InitramfsRunMntDir, "data/")
 	err := os.MkdirAll(ephemeralUbuntuData, 0755)
 	c.Assert(err, IsNil)
@@ -1441,7 +2261,7 @@
 	hostUbuntuData := filepath.Join(boot.InitramfsRunMntDir, "host/ubuntu-data/")
 	err = os.MkdirAll(hostUbuntuData, 0755)
 	c.Assert(err, IsNil)
-	mockAuthFiles := []string{
+	mockCopiedFiles := []string{
 		// extrausers
 		"system-data/var/lib/extrausers/passwd",
 		"system-data/var/lib/extrausers/shadow",
@@ -1453,20 +2273,32 @@
 		// user ssh
 		"user-data/user1/.ssh/authorized_keys",
 		"user-data/user2/.ssh/authorized_keys",
+		// user snap authentication
+		"user-data/user1/.snap/auth.json",
 		// sudoers
 		"system-data/etc/sudoers.d/create-user-test",
+		// netplan networking
+		"system-data/etc/netplan/00-snapd-config.yaml", // example console-conf filename
+		"system-data/etc/netplan/50-cloud-init.yaml",   // example cloud-init filename
+		// systemd clock file
+		"system-data/var/lib/systemd/timesync/clock",
+		"system-data/etc/machine-id", // machine-id for systemd-networkd
 	}
 	mockUnrelatedFiles := []string{
 		"system-data/var/lib/foo",
 		"system-data/etc/passwd",
 		"user-data/user1/some-random-data",
 		"user-data/user2/other-random-data",
+		"user-data/user2/.snap/sneaky-not-auth.json",
+		"system-data/etc/not-networking/netplan",
+		"system-data/var/lib/systemd/timesync/clock-not-the-clock",
+		"system-data/etc/machine-id-except-not",
 	}
-	for _, mockAuthFile := range append(mockAuthFiles, mockUnrelatedFiles...) {
-		p := filepath.Join(hostUbuntuData, mockAuthFile)
+	for _, mockFile := range append(mockCopiedFiles, mockUnrelatedFiles...) {
+		p := filepath.Join(hostUbuntuData, mockFile)
 		err = os.MkdirAll(filepath.Dir(p), 0750)
 		c.Assert(err, IsNil)
-		mockContent := fmt.Sprintf("content of %s", filepath.Base(mockAuthFile))
+		mockContent := fmt.Sprintf("content of %s", filepath.Base(mockFile))
 		err = ioutil.WriteFile(p, []byte(mockContent), 0640)
 		c.Assert(err, IsNil)
 	}
@@ -1479,8 +2311,9 @@
 
 	_, err = main.Parser().ParseArgs([]string{"initramfs-mounts"})
 	c.Assert(err, IsNil)
-	c.Assert(*n, Equals, 6)
-	c.Check(s.Stdout.String(), Equals, "")
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
 
 	modeEnv := filepath.Join(ephemeralUbuntuData, "/system-data/var/lib/snapd/modeenv")
 	c.Check(modeEnv, testutil.FileEquals, `mode=recover
@@ -1489,7 +2322,7 @@
 	for _, p := range mockUnrelatedFiles {
 		c.Check(filepath.Join(ephemeralUbuntuData, p), testutil.FileAbsent)
 	}
-	for _, p := range mockAuthFiles {
+	for _, p := range mockCopiedFiles {
 		c.Check(filepath.Join(ephemeralUbuntuData, p), testutil.FilePresent)
 		fi, err := os.Stat(filepath.Join(ephemeralUbuntuData, p))
 		// check file mode is set
@@ -1501,83 +2334,2368 @@
 		c.Check(fiParent.Mode(), Equals, os.FileMode(os.ModeDir|0750))
 	}
 
-	c.Check(filepath.Join(ephemeralUbuntuData, "system-data/var/lib/snapd/state.json"), testutil.FileEquals, `{"data":{"auth":{"users":[{"name":"mvo"}]}},"changes":{},"tasks":{},"last-change-id":0,"last-task-id":0,"last-lane-id":0}`)
-}
+	c.Check(filepath.Join(ephemeralUbuntuData, "system-data/var/lib/snapd/state.json"), testutil.FileEquals, `{"data":{"auth":{"last-id":1,"macaroon-key":"not-a-cookie","users":[{"id":1,"name":"mvo"}]}},"changes":{},"tasks":{},"last-change-id":0,"last-task-id":0,"last-lane-id":0}`)
 
-func mockSecbootTPM(c *C) (tpm *secboot.TPMConnection, restore func()) {
-	tcti, err := os.Open("/dev/null")
+	// finally check that the recovery system bootenv was updated to be in run
+	// mode
+	bloader, err := bootloader.Find("", nil)
 	c.Assert(err, IsNil)
-	tpmctx, err := tpm2.NewTPMContext(tcti)
+	m, err := bloader.GetBootVars("snapd_recovery_system", "snapd_recovery_mode")
 	c.Assert(err, IsNil)
-	mockTPM := &secboot.TPMConnection{TPMContext: tpmctx}
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191118",
+		"snapd_recovery_mode":   "run",
+	})
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// mock that we don't know which partition uuid the kernel was booted from
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsHostUbuntuDataDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}:     defaultBootWithSaveDisk,
+		},
+	)
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeGadgetDefaultsHappy(c *C) {
+	// setup a seed with default gadget yaml
+	const gadgetYamlDefaults = `
+defaults:
+  system:
+    service:
+      rsyslog.disable: true
+      ssh.disable: true
+      console-conf.disable: true
+    journal.persistent: true
+`
+	c.Assert(os.RemoveAll(s.seedDir), IsNil)
+
+	s.setupSeed(c, [][]string{
+		{"meta/gadget.yaml", gadgetYamlDefaults},
+	})
+
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// mock that we don't know which partition uuid the kernel was booted from
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsHostUbuntuDataDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}:     defaultBootWithSaveDisk,
+		},
+	)
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
 
-	restoreConnect := main.MockSecbootConnectToDefaultTPM(func() (*secboot.TPMConnection, error) {
-		return mockTPM, nil
+	// we will call out to systemctl in the initramfs, but only using --root
+	// which doesn't talk to systemd, just manipulates files around
+	var sysctlArgs [][]string
+	systemctlRestorer := systemd.MockSystemctl(func(args ...string) (buf []byte, err error) {
+		sysctlArgs = append(sysctlArgs, args)
+		return nil, nil
 	})
-	return mockTPM, restoreConnect
+	defer systemctlRestorer()
+
+	s.testRecoverModeHappy(c)
+
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
+
+	c.Assert(osutil.FileExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")), Equals, true)
+
+	// check that everything from the gadget defaults was setup
+	c.Assert(osutil.FileExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/ssh/sshd_not_to_be_run")), Equals, true)
+	c.Assert(osutil.FileExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/var/lib/console-conf/complete")), Equals, true)
+	exists, _, _ := osutil.DirExists(filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/var/log/journal"))
+	c.Assert(exists, Equals, true)
+
+	// systemctl was called the way we expect
+	c.Assert(sysctlArgs, DeepEquals, [][]string{{"--root", filepath.Join(boot.InitramfsWritableDir, "_writable_defaults"), "mask", "rsyslog.service"}})
 }
 
-func mockDevDiskByLabel(c *C) (string, func()) {
-	devDir := filepath.Join(c.MkDir(), "dev/disk/by-label")
-	err := os.MkdirAll(devDir, 0755)
-	c.Assert(err, IsNil)
-	restore := main.MockDevDiskByLabelDir(devDir)
-	return devDir, restore
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeHappyBootedKernelPartitionUUID(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("specific-ubuntu-seed-partuuid")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:     defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsHostUbuntuDataDir}: defaultBootWithSaveDisk,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}:     defaultBootWithSaveDisk,
+		},
+	)
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		{
+			"/dev/disk/by-partuuid/specific-ubuntu-seed-partuuid",
+			boot.InitramfsUbuntuSeedDir,
+			needsFsckDiskMountOpts,
+		},
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
 }
 
-func (s *initramfsMountsSuite) testInitramfsMountsInstallRecoverModeStep1Measure(c *C, mode string) {
-	s.mockProcCmdlineContent(c, fmt.Sprintf("snapd_recovery_mode=%s snapd_recovery_system=%s", mode, s.sysLabel))
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeHappyEncrypted(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
 
-	n := s.mockExpectedMountChecks(c,
-		mounted{boot.InitramfsUbuntuSeedDir},
-		notYetMounted{
-			filepath.Join(boot.InitramfsRunMntDir, "base"),
-			filepath.Join(boot.InitramfsRunMntDir, "kernel"),
-			filepath.Join(boot.InitramfsRunMntDir, "snapd"),
-			filepath.Join(boot.InitramfsRunMntDir, "data"),
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
 		},
 	)
+	defer restore()
+
+	dataActivated := false
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		c.Assert(name, Equals, "ubuntu-data")
+		c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+		c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+		dataActivated = true
+		return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+	})
+	defer restore()
 
-	// setup a fake tpm
-	_, restore := mockSecbootTPM(c)
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	saveActivated := false
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		saveActivated = true
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
 	defer restore()
 
-	epochPCR := -1
-	modelPCR := -1
-	restore = main.MockSecbootMeasureSnapSystemEpochToTPM(func(tpm *secboot.TPMConnection, pcrIndex int) error {
-		epochPCR = pcrIndex
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
 		return nil
 	})
 	defer restore()
 
 	var measuredModel *asserts.Model
-	restore = main.MockSecbootMeasureSnapModelToTPM(func(tpm *secboot.TPMConnection, pcrIndex int, model *asserts.Model) error {
-		modelPCR = pcrIndex
-		measuredModel = model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
 		return nil
 	})
 	defer restore()
 
-	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
-	c.Assert(err, IsNil)
-	c.Check(s.Stdout.String(), Equals, fmt.Sprintf(`%[1]s/snaps/snapd_1.snap %[2]s/snapd
-%[1]s/snaps/pc-kernel_1.snap %[2]s/kernel
-%[1]s/snaps/core20_1.snap %[2]s/base
---type=tmpfs tmpfs %[2]s/data
-`, s.seedDir, boot.InitramfsRunMntDir))
-	c.Check(epochPCR, Equals, 12)
-	c.Check(modelPCR, Equals, 12)
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	// we should not have written a degraded.json
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"), testutil.FileAbsent)
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(saveActivated, Equals, true)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func checkDegradedJSON(c *C, exp map[string]interface{}) {
+	b, err := ioutil.ReadFile(filepath.Join(dirs.SnapBootstrapRunDir, "degraded.json"))
+	c.Assert(err, IsNil)
+	degradedJSONObj := make(map[string]interface{}, 0)
+	err = json.Unmarshal(b, &degradedJSONObj)
+	c.Assert(err, IsNil)
+
+	c.Assert(degradedJSONObj, DeepEquals, exp)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedDataUnlockFallbackHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	saveActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// pretend we can't unlock ubuntu-data with the main run key
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			return foundEncrypted("ubuntu-data"), fmt.Errorf("failed to unlock ubuntu-data")
+
+		case 2:
+			// now we can unlock ubuntu-data with the fallback key
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			dataActivated = true
+			return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		saveActivated = true
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"find-state":     "found",
+			"mount-state":    "mounted",
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-data-random",
+			"unlock-state":   "unlocked",
+			"find-state":     "found",
+			"mount-state":    "mounted",
+			"unlock-key":     "fallback",
+			"mount-location": boot.InitramfsHostUbuntuDataDir,
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "run",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot unlock encrypted ubuntu-data (device /dev/disk/by-partuuid/ubuntu-data-enc-partuuid) with sealed run key: failed to unlock ubuntu-data",
+		},
+	})
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 2)
+	c.Check(saveActivated, Equals, true)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedSaveUnlockFallbackHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	saveActivationAttempted := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// ubuntu data can be unlocked fine
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			dataActivated = true
+			return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+
+		case 2:
+			// then after ubuntu-save is attempted to be unlocked with the
+			// unsealed run object on the encrypted data partition, we fall back
+			// to using the sealed object on ubuntu-seed for save
+			c.Assert(saveActivationAttempted, Equals, true)
+			c.Assert(name, Equals, "ubuntu-save")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			dataActivated = true
+			return happyUnlocked("ubuntu-save", secboot.UnlockedWithSealedKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		saveActivationAttempted = true
+		return foundEncrypted("ubuntu-save"), fmt.Errorf("failed to unlock ubuntu-save with run object")
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"find-state":     "found",
+			"mount-state":    "mounted",
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-data-random",
+			"unlock-state":   "unlocked",
+			"find-state":     "found",
+			"mount-state":    "mounted",
+			"unlock-key":     "run",
+			"mount-location": boot.InitramfsHostUbuntuDataDir,
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "fallback",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot unlock encrypted ubuntu-save (device /dev/disk/by-partuuid/ubuntu-save-enc-partuuid) with sealed run key: failed to unlock ubuntu-save with run object",
+		},
+	})
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 2)
+	c.Check(saveActivationAttempted, Equals, true)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedAbsentBootDataUnlockFallbackHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	defaultEncDiskNoBoot := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-seed":     "ubuntu-seed-partuuid",
+			"ubuntu-data-enc": "ubuntu-data-enc-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "defaultEncDevNoBoot",
+	}
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncDiskNoBoot,
+			// no ubuntu-boot so we fall back to unlocking data with fallback
+			// key right away
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: defaultEncDiskNoBoot,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncDiskNoBoot,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+		case 1:
+			// we skip trying to unlock with run key on ubuntu-boot and go
+			// directly to using the fallback key on ubuntu-seed
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			dataActivated = true
+			return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		// no ubuntu-boot
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"find-state": "not-found",
+		},
+		"ubuntu-data": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-data-random",
+			"unlock-state":   "unlocked",
+			"find-state":     "found",
+			"mount-state":    "mounted",
+			"unlock-key":     "fallback",
+			"mount-location": boot.InitramfsHostUbuntuDataDir,
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "run",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot find ubuntu-boot partition on disk defaultEncDevNoBoot",
+		},
+	})
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 1)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedAbsentBootDataUnlockRecoveryKeyHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	defaultEncDiskNoBoot := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-seed":     "ubuntu-seed-partuuid",
+			"ubuntu-data-enc": "ubuntu-data-enc-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "defaultEncDevNoBoot",
+	}
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncDiskNoBoot,
+			// no ubuntu-boot so we fall back to unlocking data with fallback
+			// key right away
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: defaultEncDiskNoBoot,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncDiskNoBoot,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+		case 1:
+			// we skip trying to unlock with run key on ubuntu-boot and go
+			// directly to using the fallback key on ubuntu-seed
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			dataActivated = true
+			// it was unlocked with a recovery key
+
+			return happyUnlocked("ubuntu-data", secboot.UnlockedWithRecoveryKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		// no ubuntu-boot
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"find-state": "not-found",
+		},
+		"ubuntu-data": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-data-random",
+			"unlock-state":   "unlocked",
+			"find-state":     "found",
+			"mount-state":    "mounted",
+			"unlock-key":     "recovery",
+			"mount-location": boot.InitramfsHostUbuntuDataDir,
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "run",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot find ubuntu-boot partition on disk defaultEncDevNoBoot",
+		},
+	})
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 1)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedDataUnlockFailSaveUnlockFallbackHappy(c *C) {
+	// test a scenario when unsealing of data fails with both the run key
+	// and fallback key, but save can be unlocked using the fallback key
+
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+		},
+	)
+	defer restore()
+
+	dataActivationAttempts := 0
+	saveActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// ubuntu data can't be unlocked with run key
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			dataActivationAttempts++
+			return foundEncrypted("ubuntu-data"), fmt.Errorf("failed to unlock ubuntu-data with run object")
+
+		case 2:
+			// nor can it be unlocked with fallback key
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			dataActivationAttempts++
+			return foundEncrypted("ubuntu-data"), fmt.Errorf("failed to unlock ubuntu-data with fallback object")
+
+		case 3:
+			// we can however still unlock ubuntu-save (somehow?)
+			c.Assert(name, Equals, "ubuntu-save")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			saveActivated = true
+			return happyUnlocked("ubuntu-save", secboot.UnlockedWithSealedKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		// nothing can call this function in the tested scenario
+		c.Fatalf("unexpected call")
+		return secboot.UnlockResult{}, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore = main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
+
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, IsNil)
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
+
+	modeEnv := filepath.Join(boot.InitramfsWritableDir, "var/lib/snapd/modeenv")
+	c.Check(modeEnv, testutil.FileEquals, `mode=recover
+recovery_system=20191118
+`)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"find-state":   "found",
+			"device":       "/dev/disk/by-partuuid/ubuntu-data-enc-partuuid",
+			"unlock-state": "error-unlocking",
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "fallback",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot unlock encrypted ubuntu-data (device /dev/disk/by-partuuid/ubuntu-data-enc-partuuid) with sealed run key: failed to unlock ubuntu-data with run object",
+			"cannot unlock encrypted ubuntu-data partition with sealed fallback key: failed to unlock ubuntu-data with fallback object",
+		},
+	})
+
+	bloader2, err := bootloader.Find("", nil)
+	c.Assert(err, IsNil)
+	m, err := bloader2.GetBootVars("snapd_recovery_system", "snapd_recovery_mode")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191118",
+		"snapd_recovery_mode":   "run",
+	})
+
+	// since we didn't mount data at all, we won't have copied in files from
+	// there and instead will copy safe defaults to the ephemeral data
+	c.Assert(filepath.Join(boot.InitramfsRunMntDir, "/data/system-data/var/lib/console-conf/complete"), testutil.FilePresent)
+
+	c.Check(dataActivationAttempts, Equals, 2)
+	c.Check(saveActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 3)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeDegradedAbsentDataSaveFallbackHappy(c *C) {
+	// test a scenario when data cannot be found but unencrypted save can be
+	// mounted
+
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// no ubuntu-data on the disk at all
+	mockDiskNoData := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot": "ubuntu-boot-partuuid",
+			"ubuntu-seed": "ubuntu-seed-partuuid",
+			"ubuntu-save": "ubuntu-save-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "noDataUnenc",
+	}
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: mockDiskNoData,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: mockDiskNoData,
+			{Mountpoint: boot.InitramfsUbuntuSaveDir}: mockDiskNoData,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	saveActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// ubuntu data can't be found at all
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			_, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			// sanity check that we can't find a normal ubuntu-data either
+			_, err = disk.FindMatchingPartitionUUID(name)
+			c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+			dataActivated = true
+			// data not found at all
+			return notFoundPart(), fmt.Errorf("error enumerating to find ubuntu-data")
+
+		case 2:
+			// we can however still mount unecrypted ubuntu-save
+			c.Assert(name, Equals, "ubuntu-save")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"))
+			_, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+			unencDevPartUUID, err := disk.FindMatchingPartitionUUID(name)
+			c.Assert(err, IsNil)
+			c.Assert(unencDevPartUUID, Equals, "ubuntu-save-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			saveActivated = true
+			return foundUnencrypted("ubuntu-save"), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		// nothing can call this function in the tested scenario
+		c.Fatalf("unexpected call")
+		return secboot.UnlockResult{}, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore = main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
+
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, IsNil)
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
+
+	modeEnv := filepath.Join(boot.InitramfsWritableDir, "var/lib/snapd/modeenv")
+	c.Check(modeEnv, testutil.FileEquals, `mode=recover
+recovery_system=20191118
+`)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"find-state": "not-found",
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/disk/by-partuuid/ubuntu-save-partuuid",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot locate ubuntu-data partition for mounting host data: error enumerating to find ubuntu-data",
+		},
+	})
+
+	bloader2, err := bootloader.Find("", nil)
+	c.Assert(err, IsNil)
+	m, err := bloader2.GetBootVars("snapd_recovery_system", "snapd_recovery_mode")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191118",
+		"snapd_recovery_mode":   "run",
+	})
+
+	// since we didn't mount data at all, we won't have copied in files from
+	// there and instead will copy safe defaults to the ephemeral data
+	c.Assert(filepath.Join(boot.InitramfsRunMntDir, "/data/system-data/var/lib/console-conf/complete"), testutil.FilePresent)
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(saveActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 2)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeDegradedUnencryptedDataSaveEncryptedUnhappy(c *C) {
+	// test a scenario when data is unencrypted but save is encrypted
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// no ubuntu-data on the disk at all
+	mockDiskDataUnencSaveEnc := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot": "ubuntu-boot-partuuid",
+			"ubuntu-seed": "ubuntu-seed-partuuid",
+			// ubuntu-data is unencrypted but ubuntu-save is encrypted
+			"ubuntu-data":     "ubuntu-data-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "dataUnencSaveEnc",
+	}
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}:     mockDiskDataUnencSaveEnc,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}:     mockDiskDataUnencSaveEnc,
+			{Mountpoint: boot.InitramfsHostUbuntuDataDir}: mockDiskDataUnencSaveEnc,
+			// we don't include the mountpoint for ubuntu-save, since it should
+			// never be mounted - we fail as soon as we find the encrypted save
+			// and unlock it, but before we mount it
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	saveActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// ubuntu data is a plain old unencrypted partition
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			_, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			// sanity check that we can't find a normal ubuntu-data either
+			partUUID, err := disk.FindMatchingPartitionUUID(name)
+			c.Assert(err, IsNil)
+			c.Assert(partUUID, Equals, "ubuntu-data-partuuid")
+			dataActivated = true
+
+			return foundUnencrypted("ubuntu-data"), nil
+
+		case 2:
+			// we can however still find/unlock ubuntu-save with the recovery key
+			c.Assert(name, Equals, "ubuntu-save")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"))
+			_, err := disk.FindMatchingPartitionUUID(name)
+			c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			saveActivated = true
+			return happyUnlocked("ubuntu-save", secboot.UnlockedWithRecoveryKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		// nothing can call this function in the tested scenario
+		c.Fatalf("unexpected call")
+		return secboot.UnlockResult{}, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore = main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
+
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, ErrorMatches, `inconsistent encryption status for disk dataUnencSaveEnc: ubuntu-data \(device /dev/disk/by-partuuid/ubuntu-data-partuuid\) was found unencrypted but ubuntu-save \(device /dev/mapper/ubuntu-save-random\) was found to be encrypted`)
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(saveActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 2)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedAbsentDataSaveUnlockFallbackHappy(c *C) {
+	// test a scenario when data cannot be found but save can be
+	// unlocked using the fallback key
+
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	// no ubuntu-data on the disk at all
+	mockDiskNoData := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-boot":     "ubuntu-boot-partuuid",
+			"ubuntu-seed":     "ubuntu-seed-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "defaultEncDev",
+	}
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: mockDiskNoData,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: mockDiskNoData,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: mockDiskNoData,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	saveActivated := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// ubuntu data can't be found at all
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			_, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			dataActivated = true
+			// data not found at all
+			return notFoundPart(), fmt.Errorf("error enumerating to find ubuntu-data")
+
+		case 2:
+			// we can however still unlock ubuntu-save with the fallback key
+			c.Assert(name, Equals, "ubuntu-save")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			saveActivated = true
+			return happyUnlocked("ubuntu-save", secboot.UnlockedWithSealedKey), nil
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		// nothing can call this function in the tested scenario
+		c.Fatalf("unexpected call")
+		return secboot.UnlockResult{}, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore = main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
+
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, IsNil)
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
+
+	modeEnv := filepath.Join(boot.InitramfsWritableDir, "var/lib/snapd/modeenv")
+	c.Check(modeEnv, testutil.FileEquals, `mode=recover
+recovery_system=20191118
+`)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"find-state": "not-found",
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "fallback",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{
+			"cannot locate ubuntu-data partition for mounting host data: error enumerating to find ubuntu-data",
+		},
+	})
+
+	bloader2, err := bootloader.Find("", nil)
+	c.Assert(err, IsNil)
+	m, err := bloader2.GetBootVars("snapd_recovery_system", "snapd_recovery_mode")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191118",
+		"snapd_recovery_mode":   "run",
+	})
+
+	// since we didn't mount data at all, we won't have copied in files from
+	// there and instead will copy safe defaults to the ephemeral data
+	c.Assert(filepath.Join(boot.InitramfsRunMntDir, "/data/system-data/var/lib/console-conf/complete"), testutil.FilePresent)
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(saveActivated, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 2)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedDegradedDataUnlockFailSaveUnlockFailHappy(c *C) {
+	// test a scenario when unlocking data with both run and fallback keys
+	// fails, followed by a failure to unlock save with the fallback key
+
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		// no ubuntu-data mountpoint is mocked, but there is an
+		// ubuntu-data-enc partition in the disk we find
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+		},
+	)
+	defer restore()
+
+	dataActivationAttempts := 0
+	saveUnsealActivationAttempted := false
+	unlockVolumeWithSealedKeyCalls := 0
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		unlockVolumeWithSealedKeyCalls++
+		switch unlockVolumeWithSealedKeyCalls {
+
+		case 1:
+			// ubuntu data can't be unlocked with run key
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+			dataActivationAttempts++
+			return foundEncrypted("ubuntu-data"), fmt.Errorf("failed to unlock ubuntu-data with run object")
+
+		case 2:
+			// nor can it be unlocked with fallback key
+			c.Assert(name, Equals, "ubuntu-data")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			dataActivationAttempts++
+			return foundEncrypted("ubuntu-data"), fmt.Errorf("failed to unlock ubuntu-data with fallback object")
+
+		case 3:
+			// we also fail to unlock save
+
+			// no attempts to activate ubuntu-save yet
+			c.Assert(name, Equals, "ubuntu-save")
+			c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"))
+			encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+			c.Assert(err, IsNil)
+			c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+			c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{
+				AllowRecoveryKey: true,
+			})
+			saveUnsealActivationAttempted = true
+			return foundEncrypted("ubuntu-save"), fmt.Errorf("failed to unlock ubuntu-save with fallback object")
+
+		default:
+			c.Errorf("unexpected call to UnlockVolumeUsingSealedKeyIfEncrypted (num %d)", unlockVolumeWithSealedKeyCalls)
+			return secboot.UnlockResult{}, fmt.Errorf("broken test")
+		}
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		// nothing can call this function in the tested scenario
+		c.Fatalf("unexpected call")
+		return secboot.UnlockResult{}, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+	}, nil)
+	defer restore()
+
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore = main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
+
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, IsNil)
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
+
+	modeEnv := filepath.Join(boot.InitramfsRunMntDir, "data/system-data/var/lib/snapd/modeenv")
+	c.Check(modeEnv, testutil.FileEquals, `mode=recover
+recovery_system=20191118
+`)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"find-state":   "found",
+			"device":       "/dev/disk/by-partuuid/ubuntu-data-enc-partuuid",
+			"unlock-state": "error-unlocking",
+		},
+		"ubuntu-save": map[string]interface{}{
+			"find-state":   "found",
+			"device":       "/dev/disk/by-partuuid/ubuntu-save-enc-partuuid",
+			"unlock-state": "error-unlocking",
+		},
+		"error-log": []interface{}{
+			"cannot unlock encrypted ubuntu-data (device /dev/disk/by-partuuid/ubuntu-data-enc-partuuid) with sealed run key: failed to unlock ubuntu-data with run object",
+			"cannot unlock encrypted ubuntu-data partition with sealed fallback key: failed to unlock ubuntu-data with fallback object",
+			"cannot unlock encrypted ubuntu-save partition with sealed fallback key: failed to unlock ubuntu-save with fallback object",
+		},
+	})
+
+	bloader2, err := bootloader.Find("", nil)
+	c.Assert(err, IsNil)
+	m, err := bloader2.GetBootVars("snapd_recovery_system", "snapd_recovery_mode")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191118",
+		"snapd_recovery_mode":   "run",
+	})
+
+	// since we didn't mount data at all, we won't have copied in files from
+	// there and instead will copy safe defaults to the ephemeral data
+	c.Assert(filepath.Join(boot.InitramfsRunMntDir, "/data/system-data/var/lib/console-conf/complete"), testutil.FilePresent)
+
+	c.Check(dataActivationAttempts, Equals, 2)
+	c.Check(saveUnsealActivationAttempted, Equals, true)
+	c.Check(unlockVolumeWithSealedKeyCalls, Equals, 3)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedMismatchedMarker(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv after we are done
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: defaultEncBootDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: defaultEncBootDisk,
+		},
+	)
+	defer restore()
+
+	dataActivated := false
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		c.Assert(name, Equals, "ubuntu-data")
+		c.Assert(sealedEncryptionKeyFile, Equals, filepath.Join(s.tmpDir, "run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"))
+
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+		c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+		dataActivated = true
+		return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "other-marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	saveActivated := false
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		c.Check(dataActivated, Equals, true, Commentf("ubuntu-data not activated yet"))
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		saveActivated = true
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	// ensure that we check that access to sealed keys were locked
+	sealedKeysLocked := false
+	restore = main.MockSecbootLockSealedKeys(func() error {
+		sealedKeysLocked = true
+		return nil
+	})
+	defer restore()
+
+	_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+	c.Assert(err, IsNil)
+
+	// we always need to lock access to sealed keys
+	c.Check(sealedKeysLocked, Equals, true)
+
+	modeEnv := filepath.Join(boot.InitramfsWritableDir, "var/lib/snapd/modeenv")
+	c.Check(modeEnv, testutil.FileEquals, `mode=recover
+recovery_system=20191118
+`)
+
+	checkDegradedJSON(c, map[string]interface{}{
+		"ubuntu-boot": map[string]interface{}{
+			"device":         "/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuBootDir,
+		},
+		"ubuntu-data": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-data-random",
+			"unlock-state":   "unlocked",
+			"find-state":     "found",
+			"mount-state":    "mounted-untrusted",
+			"unlock-key":     "run",
+			"mount-location": boot.InitramfsHostUbuntuDataDir,
+		},
+		"ubuntu-save": map[string]interface{}{
+			"device":         "/dev/mapper/ubuntu-save-random",
+			"unlock-key":     "run",
+			"unlock-state":   "unlocked",
+			"mount-state":    "mounted",
+			"find-state":     "found",
+			"mount-location": boot.InitramfsUbuntuSaveDir,
+		},
+		"error-log": []interface{}{"cannot trust ubuntu-data, ubuntu-save and ubuntu-data are not marked as from the same install"},
+	})
+
+	bloader2, err := bootloader.Find("", nil)
+	c.Assert(err, IsNil)
+	m, err := bloader2.GetBootVars("snapd_recovery_system", "snapd_recovery_mode")
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191118",
+		"snapd_recovery_mode":   "run",
+	})
+
+	// since we didn't mount data at all, we won't have copied in files from
+	// there and instead will copy safe defaults to the ephemeral data
+	c.Assert(filepath.Join(boot.InitramfsRunMntDir, "/data/system-data/var/lib/console-conf/complete"), testutil.FilePresent)
+
+	c.Check(dataActivated, Equals, true)
+	c.Check(saveActivated, Equals, true)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeEncryptedAttackerFSAttachedHappy(c *C) {
+	s.mockProcCmdlineContent(c, "snapd_recovery_mode=recover snapd_recovery_system="+s.sysLabel)
+
+	restore := main.MockPartitionUUIDForBootedKernelDisk("")
+	defer restore()
+
+	// setup a bootloader for setting the bootenv
+	bloader := bootloadertest.Mock("mock", c.MkDir())
+	bootloader.Force(bloader)
+	defer bootloader.Force(nil)
+
+	mockDisk := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-seed":     "ubuntu-seed-partuuid",
+			"ubuntu-boot":     "ubuntu-boot-partuuid",
+			"ubuntu-data-enc": "ubuntu-data-enc-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "bootDev",
+	}
+	attackerDisk := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-seed":     "ubuntu-seed-attacker-partuuid",
+			"ubuntu-boot":     "ubuntu-boot-attacker-partuuid",
+			"ubuntu-data-enc": "ubuntu-data-enc-attacker-partuuid",
+			"ubuntu-save-enc": "ubuntu-save-enc-attacker-partuuid",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "attackerDev",
+	}
+
+	restore = disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: boot.InitramfsUbuntuSeedDir}: mockDisk,
+			{Mountpoint: boot.InitramfsUbuntuBootDir}: mockDisk,
+			{
+				Mountpoint:        boot.InitramfsHostUbuntuDataDir,
+				IsDecryptedDevice: true,
+			}: mockDisk,
+			{
+				Mountpoint:        boot.InitramfsUbuntuSaveDir,
+				IsDecryptedDevice: true,
+			}: mockDisk,
+			// this is the attacker fs on a different disk
+			{Mountpoint: "somewhere-else"}: attackerDisk,
+		},
+	)
+	defer restore()
+
+	activated := false
+	restore = main.MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error) {
+		c.Assert(name, Equals, "ubuntu-data")
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-data-enc-partuuid")
+		c.Assert(opts, DeepEquals, &secboot.UnlockVolumeUsingSealedKeyOptions{})
+
+		activated = true
+		return happyUnlocked("ubuntu-data", secboot.UnlockedWithSealedKey), nil
+	})
+	defer restore()
+
+	s.mockUbuntuSaveKeyAndMarker(c, boot.InitramfsHostWritableDir, "foo", "marker")
+	s.mockUbuntuSaveMarker(c, boot.InitramfsUbuntuSaveDir, "marker")
+
+	restore = main.MockSecbootUnlockEncryptedVolumeUsingKey(func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error) {
+		encDevPartUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+		c.Assert(err, IsNil)
+		c.Assert(encDevPartUUID, Equals, "ubuntu-save-enc-partuuid")
+		c.Assert(key, DeepEquals, []byte("foo"))
+		return happyUnlocked("ubuntu-save", secboot.UnlockedWithKey), nil
+	})
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", "recover"),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+		{
+			"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+			boot.InitramfsUbuntuBootDir,
+			needsFsckDiskMountOpts,
+		},
+		{
+			"/dev/mapper/ubuntu-data-random",
+			boot.InitramfsHostUbuntuDataDir,
+			nil,
+		},
+		{
+			"/dev/mapper/ubuntu-save-random",
+			boot.InitramfsUbuntuSaveDir,
+			nil,
+		},
+	}, nil)
+	defer restore()
+
+	s.testRecoverModeHappy(c)
+
+	c.Check(activated, Equals, true)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
+	c.Check(measuredModel, DeepEquals, s.model)
+
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
+	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, fmt.Sprintf("%s-model-measured", s.sysLabel)), testutil.FilePresent)
+}
+
+func (s *initramfsMountsSuite) testInitramfsMountsInstallRecoverModeMeasure(c *C, mode string) {
+	s.mockProcCmdlineContent(c, fmt.Sprintf("snapd_recovery_mode=%s snapd_recovery_system=%s", mode, s.sysLabel))
+
+	modeMnts := []systemdMount{
+		ubuntuLabelMount("ubuntu-seed", mode),
+		s.makeSeedSnapSystemdMount(snap.TypeSnapd),
+		s.makeSeedSnapSystemdMount(snap.TypeKernel),
+		s.makeSeedSnapSystemdMount(snap.TypeBase),
+		{
+			"tmpfs",
+			boot.InitramfsDataDir,
+			tmpfsMountOpts,
+		},
+	}
+
+	mockDiskMapping := map[disks.Mountpoint]*disks.MockDiskMapping{
+		{Mountpoint: boot.InitramfsUbuntuSeedDir}: {
+			FilesystemLabelToPartUUID: map[string]string{
+				"ubuntu-seed": "ubuntu-seed-partuuid",
+			},
+			DiskHasPartitions: true,
+		},
+	}
+
+	if mode == "recover" {
+		// setup a bootloader for setting the bootenv after we are done
+		bloader := bootloadertest.Mock("mock", c.MkDir())
+		bootloader.Force(bloader)
+		defer bootloader.Force(nil)
+
+		// add the expected mount of ubuntu-data onto the host data dir
+		modeMnts = append(modeMnts,
+			systemdMount{
+				"/dev/disk/by-partuuid/ubuntu-boot-partuuid",
+				boot.InitramfsUbuntuBootDir,
+				needsFsckDiskMountOpts,
+			},
+			systemdMount{
+				"/dev/disk/by-partuuid/ubuntu-data-partuuid",
+				boot.InitramfsHostUbuntuDataDir,
+				nil,
+			},
+			systemdMount{
+				"/dev/disk/by-partuuid/ubuntu-save-partuuid",
+				boot.InitramfsUbuntuSaveDir,
+				nil,
+			})
+
+		// also add the ubuntu-data and ubuntu-save fs labels to the
+		// disk referenced by the ubuntu-seed partition
+		disk := mockDiskMapping[disks.Mountpoint{Mountpoint: boot.InitramfsUbuntuSeedDir}]
+		disk.FilesystemLabelToPartUUID["ubuntu-boot"] = "ubuntu-boot-partuuid"
+		disk.FilesystemLabelToPartUUID["ubuntu-data"] = "ubuntu-data-partuuid"
+		disk.FilesystemLabelToPartUUID["ubuntu-save"] = "ubuntu-save-partuuid"
+
+		// and also add the /run/mnt/host/ubuntu-{boot,data,save} mountpoints
+		// for cross-checking after mounting
+		mockDiskMapping[disks.Mountpoint{Mountpoint: boot.InitramfsUbuntuBootDir}] = disk
+		mockDiskMapping[disks.Mountpoint{Mountpoint: boot.InitramfsHostUbuntuDataDir}] = disk
+		mockDiskMapping[disks.Mountpoint{Mountpoint: boot.InitramfsUbuntuSaveDir}] = disk
+	}
+
+	restore := disks.MockMountPointDisksToPartitionMapping(mockDiskMapping)
+	defer restore()
+
+	measureEpochCalls := 0
+	measureModelCalls := 0
+	restore = main.MockSecbootMeasureSnapSystemEpochWhenPossible(func() error {
+		measureEpochCalls++
+		return nil
+	})
+	defer restore()
+
+	var measuredModel *asserts.Model
+	restore = main.MockSecbootMeasureSnapModelWhenPossible(func(findModel func() (*asserts.Model, error)) error {
+		measureModelCalls++
+		var err error
+		measuredModel, err = findModel()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	defer restore()
+
+	restore = s.mockSystemdMountSequence(c, modeMnts, nil)
+	defer restore()
+
+	if mode == "recover" {
+		// use the helper
+		s.testRecoverModeHappy(c)
+	} else {
+		_, err := main.Parser().ParseArgs([]string{"initramfs-mounts"})
+		c.Assert(err, IsNil)
+
+		modeEnv := filepath.Join(boot.InitramfsDataDir, "/system-data/var/lib/snapd/modeenv")
+		c.Check(modeEnv, testutil.FileEquals, `mode=install
+recovery_system=20191118
+`)
+	}
+
 	c.Check(measuredModel, NotNil)
 	c.Check(measuredModel, DeepEquals, s.model)
+	c.Check(measureEpochCalls, Equals, 1)
+	c.Check(measureModelCalls, Equals, 1)
 	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, "secboot-epoch-measured"), testutil.FilePresent)
 	c.Assert(filepath.Join(dirs.SnapBootstrapRunDir, s.sysLabel+"-model-measured"), testutil.FilePresent)
-	c.Check(*n, Equals, 5)
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeStep1Measure(c *C) {
-	s.testInitramfsMountsInstallRecoverModeStep1Measure(c, "")
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeMeasure(c *C) {
+	s.testInitramfsMountsInstallRecoverModeMeasure(c, "install")
+}
+
+func (s *initramfsMountsSuite) TestInitramfsMountsInstallModeUnsetMeasure(c *C) {
+	// TODO:UC20: eventually we should require snapd_recovery_mode to be set to
+	// explicitly "install" for install mode, but we originally allowed
+	// snapd_recovery_mode="" and interpreted it as install mode, so test that
+	// case too
+	s.testInitramfsMountsInstallRecoverModeMeasure(c, "")
 }
 
-func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeStep1Measure(c *C) {
-	s.testInitramfsMountsInstallRecoverModeStep1Measure(c, "recover")
+func (s *initramfsMountsSuite) TestInitramfsMountsRecoverModeMeasure(c *C) {
+	s.testInitramfsMountsInstallRecoverModeMeasure(c, "recover")
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_recovery_chooser_trigger.go snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_recovery_chooser_trigger.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/cmd_recovery_chooser_trigger.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/cmd_recovery_chooser_trigger.go	2021-02-02 08:21:12.000000000 +0000
@@ -77,7 +77,7 @@
 	if c.MarkerFile != "" {
 		markerFile = c.MarkerFile
 	}
-	logger.Noticef("trigger timeout %v", timeout)
+	logger.Noticef("trigger wait timeout %v", timeout)
 	logger.Noticef("marker file %v", markerFile)
 
 	_, err := os.Stat(markerFile)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/export_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/export_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016-2019 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -20,40 +20,55 @@
 package main
 
 import (
-	"io"
+	"fmt"
 	"time"
 
-	"github.com/snapcore/secboot"
 	"github.com/snapcore/snapd/asserts"
-
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
+	"github.com/snapcore/snapd/osutil/disks"
+	"github.com/snapcore/snapd/secboot"
 )
 
 var (
 	Parser = parser
+
+	DoSystemdMount = doSystemdMountImpl
 )
 
-func MockBootstrapRun(f func(string, string, bootstrap.Options) error) (restore func()) {
-	oldBootstrapRun := bootstrapRun
-	bootstrapRun = f
-	return func() {
-		bootstrapRun = oldBootstrapRun
+type SystemdMountOptions = systemdMountOptions
+
+type RecoverDegradedState = recoverDegradedState
+
+type PartitionState = partitionState
+
+func (r *RecoverDegradedState) Degraded(isEncrypted bool) bool {
+	m := recoverModeStateMachine{
+		isEncryptedDev: isEncrypted,
+		degradedState:  r,
 	}
+	return m.degraded()
 }
 
-func MockStdout(newStdout io.Writer) (restore func()) {
-	oldStdout := stdout
-	stdout = newStdout
+func MockTimeNow(f func() time.Time) (restore func()) {
+	old := timeNow
+	timeNow = f
 	return func() {
-		stdout = oldStdout
+		timeNow = old
 	}
 }
 
-func MockOsutilIsMounted(f func(path string) (bool, error)) (restore func()) {
-	oldOsutilIsMounted := osutilIsMounted
+func MockOsutilIsMounted(f func(string) (bool, error)) (restore func()) {
+	old := osutilIsMounted
 	osutilIsMounted = f
 	return func() {
-		osutilIsMounted = oldOsutilIsMounted
+		osutilIsMounted = old
+	}
+}
+
+func MockSystemdMount(f func(_, _ string, opts *SystemdMountOptions) error) (restore func()) {
+	old := doSystemdMount
+	doSystemdMount = f
+	return func() {
+		doSystemdMount = old
 	}
 }
 
@@ -75,71 +90,57 @@
 	}
 }
 
-var (
-	UnlockIfEncrypted = unlockIfEncrypted
-)
-
-func MockSecbootConnectToDefaultTPM(f func() (*secboot.TPMConnection, error)) (restore func()) {
-	old := secbootConnectToDefaultTPM
-	secbootConnectToDefaultTPM = f
+func MockSecbootUnlockVolumeUsingSealedKeyIfEncrypted(f func(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *secboot.UnlockVolumeUsingSealedKeyOptions) (secboot.UnlockResult, error)) (restore func()) {
+	old := secbootUnlockVolumeUsingSealedKeyIfEncrypted
+	secbootUnlockVolumeUsingSealedKeyIfEncrypted = f
 	return func() {
-		secbootConnectToDefaultTPM = old
+		secbootUnlockVolumeUsingSealedKeyIfEncrypted = old
 	}
 }
 
-func MockSecbootLockAccessToSealedKeys(f func(tpm *secboot.TPMConnection) error) (restore func()) {
-	old := secbootLockAccessToSealedKeys
-	secbootLockAccessToSealedKeys = f
+func MockSecbootUnlockEncryptedVolumeUsingKey(f func(disk disks.Disk, name string, key []byte) (secboot.UnlockResult, error)) (restore func()) {
+	old := secbootUnlockEncryptedVolumeUsingKey
+	secbootUnlockEncryptedVolumeUsingKey = f
 	return func() {
-		secbootLockAccessToSealedKeys = old
+		secbootUnlockEncryptedVolumeUsingKey = old
 	}
 }
 
-func MockSecbootSecureConnectToDefaultTPM(f func(ekCertDataReader io.Reader,
-	endorsementAuth []byte) (*secboot.TPMConnection, error)) (restore func()) {
-	old := secbootSecureConnectToDefaultTPM
-	secbootSecureConnectToDefaultTPM = f
+func MockSecbootMeasureSnapSystemEpochWhenPossible(f func() error) (restore func()) {
+	old := secbootMeasureSnapSystemEpochWhenPossible
+	secbootMeasureSnapSystemEpochWhenPossible = f
 	return func() {
-		secbootSecureConnectToDefaultTPM = old
+		secbootMeasureSnapSystemEpochWhenPossible = old
 	}
 }
 
-func MockSecbootActivateVolumeWithTPMSealedKey(f func(tpm *secboot.TPMConnection, volumeName, sourceDevicePath, keyPath string, pinReader io.Reader, options *secboot.ActivateWithTPMSealedKeyOptions) (bool, error)) (restore func()) {
-	old := secbootActivateVolumeWithTPMSealedKey
-	secbootActivateVolumeWithTPMSealedKey = f
+func MockSecbootMeasureSnapModelWhenPossible(f func(findModel func() (*asserts.Model, error)) error) (restore func()) {
+	old := secbootMeasureSnapModelWhenPossible
+	secbootMeasureSnapModelWhenPossible = f
 	return func() {
-		secbootActivateVolumeWithTPMSealedKey = old
+		secbootMeasureSnapModelWhenPossible = old
 	}
 }
 
-func MockDevDiskByLabelDir(new string) (restore func()) {
-	old := devDiskByLabelDir
-	devDiskByLabelDir = new
+func MockSecbootLockSealedKeys(f func() error) (restore func()) {
+	old := secbootLockSealedKeys
+	secbootLockSealedKeys = f
 	return func() {
-		devDiskByLabelDir = old
+		secbootLockSealedKeys = old
 	}
 }
 
-func MockRandomKernelUUID(new func() string) (restore func()) {
-	old := readKernelUUID
-	readKernelUUID = new
-	return func() {
-		readKernelUUID = old
+func MockPartitionUUIDForBootedKernelDisk(uuid string) (restore func()) {
+	old := bootFindPartitionUUIDForBootedKernelDisk
+	bootFindPartitionUUIDForBootedKernelDisk = func() (string, error) {
+		if uuid == "" {
+			// mock error
+			return "", fmt.Errorf("mocked error")
+		}
+		return uuid, nil
 	}
-}
-
-func MockSecbootMeasureSnapSystemEpochToTPM(f func(tpm *secboot.TPMConnection, pcrIndex int) error) (restore func()) {
-	old := secbootMeasureSnapSystemEpochToTPM
-	secbootMeasureSnapSystemEpochToTPM = f
-	return func() {
-		secbootMeasureSnapSystemEpochToTPM = old
-	}
-}
 
-func MockSecbootMeasureSnapModelToTPM(f func(tpm *secboot.TPMConnection, pcrIndex int, model *asserts.Model) error) (restore func()) {
-	old := secbootMeasureSnapModelToTPM
-	secbootMeasureSnapModelToTPM = f
 	return func() {
-		secbootMeasureSnapModelToTPM = old
+		bootFindPartitionUUIDForBootedKernelDisk = old
 	}
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/initramfs_mounts_state.go snapd-2.48.3+20.04/cmd/snap-bootstrap/initramfs_mounts_state.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/initramfs_mounts_state.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/initramfs_mounts_state.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,105 +34,39 @@
 
 // initramfsMountsState helps tracking the state and progress
 // of the mounting driving process.
-type initramfsMountsState interface {
-	// Model returns the verified model from the seed (only for
-	// modes other than run).
-	Model() (*asserts.Model, error)
-
-	// RecoverySystemEssentialSnaps returns the verified essential
-	// snaps from the recoverySystem. If recoverySystem is "" the
-	// implied one will be used (only for modes other than run).
-	RecoverySystemEssentialSnaps(recoverySystem string, essentialTypes []snap.Type) ([]*seed.Snap, error)
-
-	// UnverifiedBootModel returns the unverified model from the
-	// boot partition for run mode. The current and only use case
-	// is measuring the model for run mode. Otherwise no decisions
-	// should be based on an unverified model. Note that the model
-	// is verified at the time the key auth policy is computed.
-	UnverifiedBootModel() (*asserts.Model, error)
-}
-
-var newInitramfsMountsState = func(mode, recoverySystem string) initramfsMountsState {
-	return &initramfsMountsStateImpl{
-		mode:           mode,
-		recoverySystem: recoverySystem,
-	}
-}
-
-type initramfsMountsStateImpl struct {
+type initramfsMountsState struct {
 	mode           string
 	recoverySystem string
-
-	seed seed.EssentialMetaLoaderSeed
 }
 
 var errRunModeNoImpliedRecoverySystem = errors.New("internal error: no implied recovery system in run mode")
 
-// loadSeed opens the seed and reads its assertions; it does not
-// re-open or re-read the seed when called multiple times.
-// The opened seed is available is mst.seed
-func (mst *initramfsMountsStateImpl) loadSeed(recoverySystem string) error {
-	if mst.seed != nil {
-		return nil
-	}
-
+// ReadEssential returns the model and verified essential
+// snaps from the recoverySystem. If recoverySystem is "" the
+// implied one will be used (only for modes other than run).
+func (mst *initramfsMountsState) ReadEssential(recoverySystem string, essentialTypes []snap.Type) (*asserts.Model, []*seed.Snap, error) {
 	if recoverySystem == "" {
 		if mst.mode == "run" {
-			return errRunModeNoImpliedRecoverySystem
+			return nil, nil, errRunModeNoImpliedRecoverySystem
 		}
 		recoverySystem = mst.recoverySystem
 	}
 
-	systemSeed, err := seed.Open(boot.InitramfsUbuntuSeedDir, recoverySystem)
-	if err != nil {
-		return err
-	}
-
-	seed20, ok := systemSeed.(seed.EssentialMetaLoaderSeed)
-	if !ok {
-		return fmt.Errorf("internal error: UC20 seed must implement EssentialMetaLoaderSeed")
-	}
-
-	// load assertions into a temporary database
-	if err := seed20.LoadAssertions(nil, nil); err != nil {
-		return err
-	}
-
-	mst.seed = seed20
-	return nil
-}
-
-func (mst *initramfsMountsStateImpl) Model() (*asserts.Model, error) {
-	if mst.mode == "run" {
-		return nil, errRunModeNoImpliedRecoverySystem
-	}
-	if err := mst.loadSeed(""); err != nil {
-		return nil, err
-	}
-	mod, _ := mst.seed.Model()
-	return mod, nil
-}
-
-func (mst *initramfsMountsStateImpl) RecoverySystemEssentialSnaps(recoverySystem string, essentialTypes []snap.Type) ([]*seed.Snap, error) {
-	if err := mst.loadSeed(recoverySystem); err != nil {
-		return nil, err
-	}
-
-	// load and verify metadata only for the relevant essential snaps
 	perf := timings.New(nil)
-	if err := mst.seed.LoadEssentialMeta(essentialTypes, perf); err != nil {
-		return nil, err
-	}
-
-	return mst.seed.EssentialSnaps(), nil
+	return seed.ReadSystemEssential(boot.InitramfsUbuntuSeedDir, recoverySystem, essentialTypes, perf)
 }
 
-func (mst *initramfsMountsStateImpl) UnverifiedBootModel() (*asserts.Model, error) {
+// UnverifiedBootModel returns the unverified model from the
+// boot partition for run mode. The current and only use case
+// is measuring the model for run mode. Otherwise no decisions
+// should be based on an unverified model. Note that the model
+// is verified at the time the key auth policy is computed.
+func (mst *initramfsMountsState) UnverifiedBootModel() (*asserts.Model, error) {
 	if mst.mode != "run" {
 		return nil, fmt.Errorf("internal error: unverified boot model access is for limited run mode use")
 	}
 
-	mf, err := os.Open(filepath.Join(boot.InitramfsUbuntuBootDir, "model"))
+	mf, err := os.Open(filepath.Join(boot.InitramfsUbuntuBootDir, "device/model"))
 	if err != nil {
 		return nil, fmt.Errorf("cannot read model assertion: %v", err)
 	}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/initramfs_systemd_mount.go snapd-2.48.3+20.04/cmd/snap-bootstrap/initramfs_systemd_mount.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/initramfs_systemd_mount.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/initramfs_systemd_mount.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,194 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/systemd"
+)
+
+var (
+	timeNow = time.Now
+
+	// default 1:30, as that is how long systemd will wait for services by
+	// default so seems a sensible default
+	defaultMountUnitWaitTimeout = time.Minute + 30*time.Second
+
+	unitFileDependOverride = `[Unit]
+Requires=%[1]s
+After=%[1]s
+`
+
+	doSystemdMount = doSystemdMountImpl
+)
+
+// systemdMountOptions reflects the set of options for mounting something using
+// systemd-mount(1)
+type systemdMountOptions struct {
+	// Tmpfs indicates that "what" should be ignored and a new tmpfs should be
+	// mounted at the location.
+	Tmpfs bool
+	// Ephemeral indicates that the mount should not persist from the initramfs
+	// to after the pivot_root to normal userspace. The default value, false,
+	// means that the mount will persist across the transition, this is done by
+	// creating systemd unit overrides for various initrd targets in /run that
+	// systemd understands when it isolates to the initrd-cleanup.target when
+	// the pivot_root is performed.
+	Ephemeral bool
+	// NeedsFsck indicates that before returning to the caller, an fsck check
+	// should be performed on the thing being mounted.
+	NeedsFsck bool
+	// NoWait will not wait until the systemd unit is active and running, which
+	// is the default behavior.
+	NoWait bool
+}
+
+// doSystemdMount will mount "what" at "where" using systemd-mount(1) with
+// various options. Note that in some error cases, the mount unit may have
+// already been created and it will not be deleted here, if that is the case
+// callers should check manually if the unit needs to be removed on error
+// conditions.
+func doSystemdMountImpl(what, where string, opts *systemdMountOptions) error {
+	if opts == nil {
+		opts = &systemdMountOptions{}
+	}
+
+	// doesn't make sense to fsck a tmpfs
+	if opts.NeedsFsck && opts.Tmpfs {
+		return fmt.Errorf("cannot mount %q at %q: impossible to fsck a tmpfs", what, where)
+	}
+
+	whereEscaped := systemd.EscapeUnitNamePath(where)
+	unitName := whereEscaped + ".mount"
+
+	args := []string{what, where, "--no-pager", "--no-ask-password"}
+	if opts.Tmpfs {
+		args = append(args, "--type=tmpfs")
+	}
+
+	if opts.NeedsFsck {
+		// note that with the --fsck=yes argument, systemd will block starting
+		// the mount unit on a new systemd-fsck@<what> unit that will run the
+		// fsck, so we don't need to worry about waiting for that to finish in
+		// the case where we are supposed to wait (which is the default for this
+		// function)
+		args = append(args, "--fsck=yes")
+	} else {
+		// the default is to use fsck=yes, so if it doesn't need fsck we need to
+		// explicitly turn it off
+		args = append(args, "--fsck=no")
+	}
+
+	// Under all circumstances that we use systemd-mount here from
+	// snap-bootstrap, it is expected to be okay to block waiting for the unit
+	// to be started and become active, because snap-bootstrap is, by design,
+	// expected to run as late as possible in the initramfs, and so any
+	// dependencies there might be in systemd creating and starting these mount
+	// units should already be ready and so we will not block forever. If
+	// however there was something going on in systemd at the same time that the
+	// mount unit depended on, we could hit a deadlock blocking as systemd will
+	// not enqueue this job until it's dependencies are ready, and so if those
+	// things depend on this mount unit we are stuck. The solution to this
+	// situation is to make snap-bootstrap run as late as possible before
+	// mounting things.
+	// However, we leave in the option to not block if there is ever a reason
+	// we need to do so.
+	if opts.NoWait {
+		args = append(args, "--no-block")
+	}
+
+	// note that we do not currently parse any output from systemd-mount, but if
+	// we ever do, take special care surrounding the debug output that systemd
+	// outputs with the "debug" kernel command line present (or equivalently the
+	// SYSTEMD_LOG_LEVEL=debug env var) which will add lots of additional output
+	// to stderr from systemd commands
+	out, err := exec.Command("systemd-mount", args...).CombinedOutput()
+	if err != nil {
+		return osutil.OutputErr(out, err)
+	}
+
+	// if it should survive pivot_root() then we need to add overrides for this
+	// unit to /run/systemd units
+	if !opts.Ephemeral {
+		// to survive the pivot_root, we need to make the mount units depend on
+		// all of the various initrd special targets by adding runtime conf
+		// files there
+		// note we could do this statically in the initramfs main filesystem
+		// layout, but that means that changes to snap-bootstrap would block on
+		// waiting for those files to be added before things works here, this is
+		// a more flexible strategy that puts snap-bootstrap in control
+		overrideContent := []byte(fmt.Sprintf(unitFileDependOverride, unitName))
+		for _, initrdUnit := range []string{
+			"initrd.target",
+			"initrd-fs.target",
+			"initrd-switch-root.target",
+			"local-fs.target",
+		} {
+			targetDir := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d")
+			err := os.MkdirAll(targetDir, 0755)
+			if err != nil {
+				return err
+			}
+
+			// add an override file for the initrd unit to depend on this mount
+			// unit so that when we isolate to the initrd unit, it does not get
+			// unmounted
+			fname := fmt.Sprintf("snap_bootstrap_%s.conf", whereEscaped)
+			err = ioutil.WriteFile(filepath.Join(targetDir, fname), overrideContent, 0644)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if !opts.NoWait {
+		// TODO: is this necessary, systemd-mount seems to only return when the
+		// unit is active and the mount is there, but perhaps we should be a bit
+		// paranoid here and wait anyways?
+		// see systemd-mount(1)
+
+		// wait for the mount to exist
+		start := timeNow()
+		var now time.Time
+		for now = timeNow(); now.Sub(start) < defaultMountUnitWaitTimeout; now = timeNow() {
+			mounted, err := osutilIsMounted(where)
+			if mounted {
+				break
+			}
+			if err != nil {
+				return err
+			}
+		}
+
+		if now.Sub(start) > defaultMountUnitWaitTimeout {
+			return fmt.Errorf("timed out after %s waiting for mount %s on %s", defaultMountUnitWaitTimeout, what, where)
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/initramfs_systemd_mount_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/initramfs_systemd_mount_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/initramfs_systemd_mount_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/initramfs_systemd_mount_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,235 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main_test
+
+import (
+	"fmt"
+	"path/filepath"
+	"time"
+
+	main "github.com/snapcore/snapd/cmd/snap-bootstrap"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/systemd"
+	"github.com/snapcore/snapd/testutil"
+
+	. "gopkg.in/check.v1"
+)
+
+type doSystemdMountSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&doSystemdMountSuite{})
+
+func (s *doSystemdMountSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("") })
+}
+
+func (s *doSystemdMountSuite) TestDoSystemdMountUnhappy(c *C) {
+	cmd := testutil.MockCommand(c, "systemd-mount", `
+echo "mocked error"
+exit 1
+`)
+	defer cmd.Restore()
+
+	err := main.DoSystemdMount("something", "somewhere only we know", nil)
+	c.Assert(err, ErrorMatches, "mocked error")
+}
+
+func (s *doSystemdMountSuite) TestDoSystemdMount(c *C) {
+
+	testStart := time.Now()
+
+	tt := []struct {
+		what             string
+		where            string
+		opts             *main.SystemdMountOptions
+		timeNowTimes     []time.Time
+		isMountedReturns []bool
+		expErr           string
+		comment          string
+	}{
+		{
+			what:             "/dev/sda3",
+			where:            "/run/mnt/data",
+			timeNowTimes:     []time.Time{testStart, testStart},
+			isMountedReturns: []bool{true},
+			comment:          "happy default",
+		},
+		{
+			what:  "tmpfs",
+			where: "/run/mnt/data",
+			opts: &main.SystemdMountOptions{
+				Tmpfs: true,
+			},
+			timeNowTimes:     []time.Time{testStart, testStart},
+			isMountedReturns: []bool{true},
+			comment:          "happy tmpfs",
+		},
+		{
+			what:  "tmpfs",
+			where: "/run/mnt/data",
+			opts: &main.SystemdMountOptions{
+				NeedsFsck: true,
+			},
+			timeNowTimes:     []time.Time{testStart, testStart},
+			isMountedReturns: []bool{true},
+			comment:          "happy fsck",
+		},
+		{
+			what:  "tmpfs",
+			where: "/run/mnt/data",
+			opts: &main.SystemdMountOptions{
+				Ephemeral: true,
+			},
+			timeNowTimes:     []time.Time{testStart, testStart},
+			isMountedReturns: []bool{true},
+			comment:          "happy initramfs ephemeral",
+		},
+		{
+			what:  "tmpfs",
+			where: "/run/mnt/data",
+			opts: &main.SystemdMountOptions{
+				NoWait: true,
+			},
+			comment: "happy no wait",
+		},
+		{
+			what:             "what",
+			where:            "where",
+			timeNowTimes:     []time.Time{testStart, testStart, testStart, testStart.Add(2 * time.Minute)},
+			isMountedReturns: []bool{false, false},
+			expErr:           "timed out after 1m30s waiting for mount what on where",
+			comment:          "times out waiting for mount to appear",
+		},
+		{
+			what:  "what",
+			where: "where",
+			opts: &main.SystemdMountOptions{
+				Tmpfs:     true,
+				NeedsFsck: true,
+			},
+			expErr:  "cannot mount \"what\" at \"where\": impossible to fsck a tmpfs",
+			comment: "invalid tmpfs + fsck",
+		},
+	}
+
+	for _, t := range tt {
+		comment := Commentf(t.comment)
+
+		var cleanups []func()
+
+		opts := t.opts
+		if opts == nil {
+			opts = &main.SystemdMountOptions{}
+		}
+		dirs.SetRootDir(c.MkDir())
+		cleanups = append(cleanups, func() { dirs.SetRootDir("") })
+
+		cmd := testutil.MockCommand(c, "systemd-mount", ``)
+		cleanups = append(cleanups, cmd.Restore)
+
+		timeCalls := 0
+		restore := main.MockTimeNow(func() time.Time {
+			timeCalls++
+			c.Assert(timeCalls <= len(t.timeNowTimes), Equals, true, comment)
+			if timeCalls > len(t.timeNowTimes) {
+				c.Errorf("too many time.Now calls (%d)", timeCalls)
+				// we want the test to fail at some point and not run forever, so
+				// move time way forward to make it for sure time out
+				return testStart.Add(10000 * time.Hour)
+			}
+			return t.timeNowTimes[timeCalls-1]
+		})
+		cleanups = append(cleanups, restore)
+
+		cleanups = append(cleanups, func() {
+			c.Assert(timeCalls, Equals, len(t.timeNowTimes), comment)
+		})
+
+		isMountedCalls := 0
+		restore = main.MockOsutilIsMounted(func(where string) (bool, error) {
+			isMountedCalls++
+			c.Assert(isMountedCalls <= len(t.isMountedReturns), Equals, true, comment)
+			if isMountedCalls > len(t.isMountedReturns) {
+				e := fmt.Sprintf("too many osutil.IsMounted calls (%d)", isMountedCalls)
+				c.Errorf(e)
+				// we want the test to fail at some point and not run forever, so
+				// move time way forward to make it for sure time out
+				return false, fmt.Errorf(e)
+			}
+			return t.isMountedReturns[isMountedCalls-1], nil
+		})
+		cleanups = append(cleanups, restore)
+
+		cleanups = append(cleanups, func() {
+			c.Assert(isMountedCalls, Equals, len(t.isMountedReturns), comment)
+		})
+
+		err := main.DoSystemdMount(t.what, t.where, t.opts)
+		if t.expErr != "" {
+			c.Assert(err, ErrorMatches, t.expErr)
+		} else {
+			c.Assert(err, IsNil)
+
+			args := []string{
+				"systemd-mount", t.what, t.where, "--no-pager", "--no-ask-password",
+			}
+			if opts.Tmpfs {
+				args = append(args, "--type=tmpfs")
+			}
+			if opts.NeedsFsck {
+				args = append(args, "--fsck=yes")
+			} else {
+				args = append(args, "--fsck=no")
+			}
+			if opts.NoWait {
+				args = append(args, "--no-block")
+			}
+			c.Assert(cmd.Calls(), DeepEquals, [][]string{args})
+
+			// check that the overrides are present if opts.Ephemeral is false,
+			// or check the overrides are not present if opts.Ephemeral is true
+			for _, initrdUnit := range []string{
+				"initrd.target",
+				"initrd-fs.target",
+				"initrd-switch-root.target",
+				"local-fs.target",
+			} {
+				mountUnit := systemd.EscapeUnitNamePath(t.where)
+				fname := fmt.Sprintf("snap_bootstrap_%s.conf", mountUnit)
+				unitFile := filepath.Join(dirs.GlobalRootDir, "/run/systemd/system", initrdUnit+".d", fname)
+				if opts.Ephemeral {
+					c.Assert(unitFile, testutil.FileAbsent)
+				} else {
+					c.Assert(unitFile, testutil.FileEquals, fmt.Sprintf(`[Unit]
+Requires=%[1]s
+After=%[1]s
+`, mountUnit+".mount"))
+				}
+			}
+		}
+
+		for _, r := range cleanups {
+			r()
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/main.go snapd-2.48.3+20.04/cmd/snap-bootstrap/main.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,9 @@
 	"github.com/jessevdk/go-flags"
 
 	"github.com/snapcore/snapd/logger"
+
+	// this import will init "secboot.FDEHasRevealKey" correctly
+	_ "github.com/snapcore/snapd/overlord/devicestate/fde"
 )
 
 var (
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/deploy.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/deploy.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/deploy.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/deploy.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,121 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"syscall"
-
-	"github.com/snapcore/snapd/gadget"
-)
-
-var (
-	deployMountpoint = "/run/snap-recover"
-
-	sysMount   = syscall.Mount
-	sysUnmount = syscall.Unmount
-)
-
-func deployFilesystemContent(part DeviceStructure, gadgetRoot string) (err error) {
-	mountpoint := filepath.Join(deployMountpoint, strconv.Itoa(part.Index))
-	if err := os.MkdirAll(mountpoint, 0755); err != nil {
-		return err
-	}
-
-	// temporarily mount the filesystem
-	if err := sysMount(part.Node, mountpoint, part.Filesystem, 0, ""); err != nil {
-		return fmt.Errorf("cannot mount filesystem %q at %q: %v", part.Node, mountpoint, err)
-	}
-	defer func() {
-		errUnmount := sysUnmount(mountpoint, 0)
-		if err == nil {
-			err = errUnmount
-		}
-	}()
-
-	fs, err := gadget.NewMountedFilesystemWriter(gadgetRoot, &part.LaidOutStructure)
-	if err != nil {
-		return fmt.Errorf("cannot create filesystem image writer: %v", err)
-	}
-
-	var preserveFiles []string
-	if err := fs.Write(mountpoint, preserveFiles); err != nil {
-		return fmt.Errorf("cannot create filesystem image: %v", err)
-	}
-
-	return nil
-}
-
-func deployNonFSContent(part DeviceStructure, gadgetRoot string) error {
-	f, err := os.OpenFile(part.Node, os.O_RDWR, 0644)
-	if err != nil {
-		return fmt.Errorf("cannot deploy bare content for %q: %v", part.Node, err)
-	}
-	defer f.Close()
-
-	// Laid out structures start relative to the beginning of the
-	// volume, shift the structure offsets to 0, so that it starts
-	// at the beginning of the partition
-	l := gadget.ShiftStructureTo(part.LaidOutStructure, 0)
-	raw, err := gadget.NewRawStructureWriter(gadgetRoot, &l)
-	if err != nil {
-		return err
-	}
-	return raw.Write(f)
-}
-
-func DeployContent(part DeviceStructure, gadgetRoot string) error {
-	switch {
-	case !part.IsPartition():
-		return fmt.Errorf("cannot deploy non-partitions yet")
-	case !part.HasFilesystem():
-		if err := deployNonFSContent(part, gadgetRoot); err != nil {
-			return err
-		}
-	case part.HasFilesystem():
-		if err := deployFilesystemContent(part, gadgetRoot); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func MountFilesystem(part DeviceStructure, baseMntPoint string) error {
-	if !part.HasFilesystem() {
-		return fmt.Errorf("cannot mount a partition with no filesystem")
-	}
-	if part.Label == "" {
-		return fmt.Errorf("cannot mount a filesystem with no label")
-	}
-
-	mountpoint := filepath.Join(baseMntPoint, part.Label)
-	if err := os.MkdirAll(mountpoint, 0755); err != nil {
-		return fmt.Errorf("cannot create mountpoint: %v", err)
-	}
-	if err := sysMount(part.Node, mountpoint, part.Filesystem, 0, ""); err != nil {
-		return fmt.Errorf("cannot mount filesystem %q at %q: %v", part.Node, mountpoint, err)
-	}
-
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/deploy_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/deploy_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/deploy_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/deploy_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,153 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/boot"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type deploySuite struct {
-	testutil.BaseTest
-
-	gadgetRoot string
-
-	mockMountPoint   string
-	mockMountCalls   []struct{ source, target, fstype string }
-	mockUnmountCalls []string
-
-	mockMountErr error
-}
-
-var _ = Suite(&deploySuite{})
-
-func (s *deploySuite) SetUpTest(c *C) {
-	s.mockMountErr = nil
-	s.mockMountCalls = nil
-	s.mockUnmountCalls = nil
-
-	s.gadgetRoot = c.MkDir()
-	err := makeMockGadget(s.gadgetRoot, gadgetContent)
-	c.Assert(err, IsNil)
-
-	s.mockMountPoint = c.MkDir()
-	restore := partition.MockDeployMountpoint(s.mockMountPoint)
-	s.AddCleanup(restore)
-
-	restore = partition.MockSysMount(func(source, target, fstype string, flags uintptr, data string) error {
-		s.mockMountCalls = append(s.mockMountCalls, struct{ source, target, fstype string }{source, target, fstype})
-		return s.mockMountErr
-	})
-	s.AddCleanup(restore)
-
-	restore = partition.MockSysUnmount(func(target string, flags int) error {
-		s.mockUnmountCalls = append(s.mockUnmountCalls, target)
-		return nil
-	})
-	s.AddCleanup(restore)
-}
-
-func (s *deploySuite) TestDeployMountedContentErr(c *C) {
-	s.mockMountErr = fmt.Errorf("boom")
-
-	node2MountPoint := filepath.Join(s.mockMountPoint, "2")
-	err := partition.DeployContent(mockDeviceStructureSystemSeed, s.gadgetRoot)
-	c.Assert(err, ErrorMatches, fmt.Sprintf(`cannot mount filesystem "/dev/node2" at %q: boom`, node2MountPoint))
-}
-
-func (s *deploySuite) TestDeployMountedContent(c *C) {
-	err := partition.DeployContent(mockDeviceStructureSystemSeed, s.gadgetRoot)
-	c.Assert(err, IsNil)
-
-	node2MountPoint := filepath.Join(s.mockMountPoint, "2")
-	c.Check(s.mockMountCalls, DeepEquals, []struct{ source, target, fstype string }{
-		{"/dev/node2", node2MountPoint, "vfat"},
-	})
-	c.Check(s.mockUnmountCalls, DeepEquals, []string{node2MountPoint})
-
-	c.Check(filepath.Join(node2MountPoint, "EFI/boot/grubx64.efi"), testutil.FilePresent)
-	c.Assert(err, IsNil)
-}
-
-func (s *deploySuite) TestDeployRawContent(c *C) {
-	mockNode := filepath.Join(c.MkDir(), "mock-node")
-	err := ioutil.WriteFile(mockNode, nil, 0644)
-	c.Assert(err, IsNil)
-
-	// copy existing mock
-	m := mockDeviceStructureBiosBoot
-	m.Node = mockNode
-	m.LaidOutContent = []gadget.LaidOutContent{
-		{
-			VolumeContent: &gadget.VolumeContent{
-				Image: "pc-core.img",
-			},
-			StartOffset: 2,
-			Size:        gadget.Size(len("pc-core.img content")),
-		},
-	}
-
-	err = partition.DeployContent(m, s.gadgetRoot)
-	c.Assert(err, IsNil)
-
-	content, err := ioutil.ReadFile(m.Node)
-	c.Assert(err, IsNil)
-	// note the 2 zero byte start offset
-	c.Check(string(content), Equals, "\x00\x00pc-core.img content")
-}
-
-func (s *deploySuite) TestMountFilesystem(c *C) {
-	dirs.SetRootDir(c.MkDir())
-	defer dirs.SetRootDir("")
-
-	// mounting will only happen for devices with a label
-	mockDeviceStructureBiosBoot.Label = "bios-boot"
-	defer func() { mockDeviceStructureBiosBoot.Label = "" }()
-
-	err := partition.MountFilesystem(mockDeviceStructureBiosBoot, boot.InitramfsRunMntDir)
-	c.Assert(err, ErrorMatches, "cannot mount a partition with no filesystem")
-
-	// mount a filesystem...
-	err = partition.MountFilesystem(mockDeviceStructureSystemSeed, boot.InitramfsRunMntDir)
-	c.Assert(err, IsNil)
-
-	// ...and check if it was mounted at the right mount point
-	c.Check(s.mockMountCalls, HasLen, 1)
-	c.Check(s.mockMountCalls, DeepEquals, []struct{ source, target, fstype string }{
-		{"/dev/node2", boot.InitramfsUbuntuSeedDir, "vfat"},
-	})
-
-	// now try to mount a filesystem with no label
-	mockDeviceStructureSystemSeed.Label = ""
-	defer func() { mockDeviceStructureSystemSeed.Label = "ubuntu-seed" }()
-
-	err = partition.MountFilesystem(mockDeviceStructureSystemSeed, boot.InitramfsRunMntDir)
-	c.Assert(err, ErrorMatches, "cannot mount a filesystem with no label")
-
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/encrypt.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/encrypt.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/encrypt.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/encrypt.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,224 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition
-
-import (
-	"bytes"
-	"crypto/rand"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"syscall"
-
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/osutil"
-)
-
-var (
-	tempFile = ioutil.TempFile
-)
-
-const (
-	// The encryption key size is set so it has the same entropy as the derived
-	// key. The recovery key is shorter and goes through KDF iterations.
-	encryptionKeySize = 64
-	recoveryKeySize   = 16
-)
-
-type EncryptionKey [encryptionKeySize]byte
-
-func NewEncryptionKey() (EncryptionKey, error) {
-	var key EncryptionKey
-	// rand.Read() is protected against short reads
-	_, err := rand.Read(key[:])
-	// On return, n == len(b) if and only if err == nil
-	return key, err
-}
-
-type RecoveryKey [recoveryKeySize]byte
-
-func NewRecoveryKey() (RecoveryKey, error) {
-	var key RecoveryKey
-	// rand.Read() is protected against short reads
-	_, err := rand.Read(key[:])
-	// On return, n == len(b) if and only if err == nil
-	return key, err
-}
-
-// Store writes the recovery key in the location specified by filename.
-func (key RecoveryKey) Store(filename string) error {
-	if err := os.MkdirAll(filepath.Dir(filename), 0755); err != nil {
-		return err
-	}
-	return osutil.AtomicWriteFile(filename, key[:], 0600, 0)
-}
-
-// EncryptedDevice represents a LUKS-backed encrypted block device.
-type EncryptedDevice struct {
-	parent *DeviceStructure
-	name   string
-	Node   string
-}
-
-// NewEncryptedDevice creates an encrypted device in the existing partition using the
-// specified key.
-func NewEncryptedDevice(part *DeviceStructure, key EncryptionKey, name string) (*EncryptedDevice, error) {
-	dev := &EncryptedDevice{
-		parent: part,
-		name:   name,
-		// A new block device is used to access the encrypted data. Note that
-		// you can't open an encrypted device under different names and a name
-		// can't be used in more than one device at the same time.
-		Node: fmt.Sprintf("/dev/mapper/%s", name),
-	}
-
-	if err := cryptsetupFormat(key, name+"-enc", part.Node); err != nil {
-		return nil, fmt.Errorf("cannot format encrypted device: %v", err)
-	}
-
-	if err := cryptsetupOpen(key, part.Node, name); err != nil {
-		return nil, fmt.Errorf("cannot open encrypted device on %s: %s", part.Node, err)
-	}
-
-	return dev, nil
-}
-
-func (dev *EncryptedDevice) AddRecoveryKey(key EncryptionKey, rkey RecoveryKey) error {
-	return cryptsetupAddKey(key, rkey, dev.parent.Node)
-}
-
-func (dev *EncryptedDevice) Close() error {
-	return cryptsetupClose(dev.name)
-}
-
-func cryptsetupFormat(key EncryptionKey, label, node string) error {
-	// We use a keyfile with the same entropy as the derived key so we can
-	// keep the KDF iteration count to a minimum. Longer processing will not
-	// increase security in this case.
-	args := []string{
-		// batch processing, no password verification
-		"-q",
-		// formatting a new device
-		"luksFormat",
-		// use LUKS2
-		"--type", "luks2",
-		// read key from stdin
-		"--key-file", "-",
-		// use AES-256 with XTS block cipher mode (XTS requires 2 keys)
-		"--cipher", "aes-xts-plain64", "--key-size", "512",
-		// use --iter-time 1 with the default KDF argon2i so
-		// to do virtually no derivation, here key is a random
-		// key with good entropy, not a passphrase, so
-		// spending time deriving from it is not necessary or
-		// makes sense
-		"--pbkdf", "argon2i", "--iter-time", "1",
-		// set LUKS2 label
-		"--label", label,
-		// device to format
-		node,
-	}
-	cmd := exec.Command("cryptsetup", args...)
-	cmd.Stdin = bytes.NewReader(key[:])
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return osutil.OutputErr(output, err)
-	}
-	return nil
-}
-
-func cryptsetupOpen(key EncryptionKey, node, name string) error {
-	cmd := exec.Command("cryptsetup", "open", "--key-file", "-", node, name)
-	cmd.Stdin = bytes.NewReader(key[:])
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return osutil.OutputErr(output, err)
-	}
-	return nil
-}
-
-func cryptsetupClose(name string) error {
-	if output, err := exec.Command("cryptsetup", "close", name).CombinedOutput(); err != nil {
-		return osutil.OutputErr(output, err)
-	}
-	return nil
-}
-
-func cryptsetupAddKey(key EncryptionKey, rkey RecoveryKey, node string) error {
-	// create a named pipe to pass the recovery key
-	fpath := filepath.Join(dirs.SnapRunDir, "tmp-rkey")
-	if err := os.MkdirAll(dirs.SnapRunDir, 0755); err != nil {
-		return err
-	}
-	if err := syscall.Mkfifo(fpath, 0600); err != nil {
-		return fmt.Errorf("cannot create named pipe: %v", err)
-	}
-	defer os.RemoveAll(fpath)
-
-	// add a new key to slot 1 reading the passphrase from the named pipe
-	// (explicitly choose keyslot 1 to ensure we have a predictable slot
-	// number in case we decide to kill all other slots later)
-	args := []string{
-		// add a new key
-		"luksAddKey",
-		// the encrypted device
-		node,
-		// batch processing, no password verification
-		"-q",
-		// read existing key from stdin
-		"--key-file", "-",
-		// store it in keyslot 1
-		"--key-slot", "1",
-		// the named pipe
-		fpath,
-	}
-
-	cmd := exec.Command("cryptsetup", args...)
-	cmd.Stdin = bytes.NewReader(key[:])
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-
-	// open the named pipe and write the recovery key
-	file, err := os.OpenFile(fpath, os.O_WRONLY, 0600)
-	if err != nil {
-		return fmt.Errorf("cannot open recovery key pipe: %v", err)
-	}
-	n, err := file.Write(rkey[:])
-	if n != recoveryKeySize {
-		file.Close()
-		return fmt.Errorf("cannot write recovery key: short write (%d bytes written)", n)
-	}
-	if err != nil {
-		cmd.Process.Kill()
-		file.Close()
-		return fmt.Errorf("cannot write recovery key: %v", err)
-	}
-	if err := file.Close(); err != nil {
-		cmd.Process.Kill()
-		return fmt.Errorf("cannot close recovery key pipe: %v", err)
-	}
-	if err := cmd.Wait(); err != nil {
-		return fmt.Errorf("cannot add recovery key: %v", err)
-	}
-
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/encrypt_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/encrypt_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/encrypt_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/encrypt_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,148 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type encryptSuite struct {
-	testutil.BaseTest
-
-	mockCryptsetup *testutil.MockCmd
-}
-
-var _ = Suite(&encryptSuite{})
-
-var mockDeviceStructure = partition.DeviceStructure{
-	LaidOutStructure: gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Name: "Test structure",
-			Size: 0x100000,
-		},
-		StartOffset: 0,
-		Index:       1,
-	},
-	Node: "/dev/node1",
-}
-
-func (s *encryptSuite) SetUpTest(c *C) {
-	dirs.SetRootDir(c.MkDir())
-	c.Assert(os.MkdirAll(dirs.SnapRunDir, 0755), IsNil)
-}
-
-func (s *encryptSuite) TestEncryptHappy(c *C) {
-	s.mockCryptsetup = testutil.MockCommand(c, "cryptsetup", "")
-	s.AddCleanup(s.mockCryptsetup.Restore)
-
-	// create empty key to prevent blocking on lack of system entropy
-	key := partition.EncryptionKey{}
-	dev, err := partition.NewEncryptedDevice(&mockDeviceStructure, key, "some-label")
-	c.Assert(err, IsNil)
-	c.Assert(dev.Node, Equals, "/dev/mapper/some-label")
-
-	c.Assert(s.mockCryptsetup.Calls(), DeepEquals, [][]string{
-		{
-			"cryptsetup", "-q", "luksFormat", "--type", "luks2", "--key-file", "-",
-			"--cipher", "aes-xts-plain64", "--key-size", "512", "--pbkdf", "argon2i",
-			"--iter-time", "1", "--label", "some-label-enc", "/dev/node1",
-		},
-		{
-			"cryptsetup", "open", "--key-file", "-", "/dev/node1", "some-label",
-		},
-	})
-
-	err = dev.Close()
-	c.Assert(err, IsNil)
-}
-
-func (s *encryptSuite) TestEncryptFormatError(c *C) {
-	s.mockCryptsetup = testutil.MockCommand(c, "cryptsetup", `[ "$2" == "luksFormat" ] && exit 127 || exit 0`)
-	s.AddCleanup(s.mockCryptsetup.Restore)
-
-	key := partition.EncryptionKey{}
-	_, err := partition.NewEncryptedDevice(&mockDeviceStructure, key, "some-label")
-	c.Assert(err, ErrorMatches, "cannot format encrypted device:.*")
-}
-
-func (s *encryptSuite) TestEncryptOpenError(c *C) {
-	s.mockCryptsetup = testutil.MockCommand(c, "cryptsetup", `[ "$1" == "open" ] && exit 127 || exit 0`)
-	s.AddCleanup(s.mockCryptsetup.Restore)
-
-	key := partition.EncryptionKey{}
-	_, err := partition.NewEncryptedDevice(&mockDeviceStructure, key, "some-label")
-	c.Assert(err, ErrorMatches, "cannot open encrypted device on /dev/node1:.*")
-}
-
-func (s *encryptSuite) TestEncryptAddKey(c *C) {
-	capturedFifo := filepath.Join(c.MkDir(), "captured-stdin")
-	s.mockCryptsetup = testutil.MockCommand(c, "cryptsetup", fmt.Sprintf(`[ "$1" == "luksAddKey" ] && cat %s/tmp-rkey > %s || exit 0`, dirs.SnapRunDir, capturedFifo))
-	s.AddCleanup(s.mockCryptsetup.Restore)
-
-	key := partition.EncryptionKey{}
-	dev, err := partition.NewEncryptedDevice(&mockDeviceStructure, key, "some-label")
-	c.Assert(err, IsNil)
-
-	rkey := partition.RecoveryKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}
-	err = dev.AddRecoveryKey(key, rkey)
-	c.Assert(err, IsNil)
-
-	c.Assert(s.mockCryptsetup.Calls(), DeepEquals, [][]string{
-		{
-			"cryptsetup", "-q", "luksFormat", "--type", "luks2", "--key-file", "-",
-			"--cipher", "aes-xts-plain64", "--key-size", "512", "--pbkdf", "argon2i",
-			"--iter-time", "1", "--label", "some-label-enc", "/dev/node1",
-		},
-		{
-			"cryptsetup", "open", "--key-file", "-", "/dev/node1", "some-label",
-		},
-		{
-			"cryptsetup", "luksAddKey", "/dev/node1", "-q", "--key-file", "-",
-			"--key-slot", "1", filepath.Join(dirs.SnapRunDir, "tmp-rkey"),
-		},
-	})
-	c.Assert(capturedFifo, testutil.FileEquals, rkey[:])
-
-	err = dev.Close()
-	c.Assert(err, IsNil)
-}
-
-func (s *encryptSuite) TestRecoveryKeyStore(c *C) {
-	rkey := partition.RecoveryKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 255}
-	err := rkey.Store("test-key")
-	c.Assert(err, IsNil)
-	fileInfo, err := os.Stat("test-key")
-	c.Assert(err, IsNil)
-	c.Assert(fileInfo.Mode(), Equals, os.FileMode(0600))
-	data, err := ioutil.ReadFile("test-key")
-	c.Assert(err, IsNil)
-	c.Assert(data, DeepEquals, rkey[:])
-	os.Remove("test-key")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/export_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/export_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/export_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,70 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition
-
-import (
-	"time"
-)
-
-type LsblkFilesystemInfo = lsblkFilesystemInfo
-type LsblkBlockDevice = lsblkBlockDevice
-type SFDiskPartitionTable = sfdiskPartitionTable
-type SFDiskPartition = sfdiskPartition
-
-var (
-	FilesystemInfo                 = filesystemInfo
-	BuildPartitionList             = buildPartitionList
-	Mkfs                           = mkfs
-	EnsureNodesExist               = ensureNodesExist
-	DeviceLayoutFromPartitionTable = deviceLayoutFromPartitionTable
-	ListCreatedPartitions          = listCreatedPartitions
-)
-
-func MockDeployMountpoint(new string) (restore func()) {
-	old := deployMountpoint
-	deployMountpoint = new
-	return func() {
-		deployMountpoint = old
-	}
-}
-
-func MockSysMount(f func(source, target, fstype string, flags uintptr, data string) error) (restore func()) {
-	old := sysMount
-	sysMount = f
-	return func() {
-		sysMount = old
-	}
-}
-
-func MockSysUnmount(f func(target string, flags int) error) (restore func()) {
-	old := sysUnmount
-	sysUnmount = f
-	return func() {
-		sysUnmount = old
-	}
-}
-
-func MockEnsureNodesExist(f func(ds []DeviceStructure, timeout time.Duration) error) (restore func()) {
-	old := ensureNodesExist
-	ensureNodesExist = f
-	return func() {
-		ensureNodesExist = old
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/mkfs.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/mkfs.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/mkfs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/mkfs.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,55 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition
-
-import (
-	"fmt"
-
-	"github.com/snapcore/snapd/gadget"
-)
-
-func MakeFilesystem(part DeviceStructure) error {
-	if part.VolumeStructure == nil {
-		return fmt.Errorf("cannot use incomplete device %v", part.Node)
-	}
-
-	if part.VolumeStructure.Filesystem != "" {
-		if err := mkfs(part.Node, part.VolumeStructure.Label, part.VolumeStructure.Filesystem); err != nil {
-			return err
-		}
-		if err := udevTrigger(part.Node); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// mkfs will create a single filesystem on the given node with
-// the given label and filesystem type.
-func mkfs(node, label, filesystem string) error {
-	switch filesystem {
-	case "vfat":
-		return gadget.MkfsVfat(node, label, "")
-	case "ext4":
-		return gadget.MkfsExt4(node, label, "")
-	default:
-		return fmt.Errorf("cannot create unsupported filesystem %q", filesystem)
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/mkfs_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/mkfs_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/mkfs_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/mkfs_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,148 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition_test
-
-import (
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type mkfsSuite struct {
-	testutil.BaseTest
-
-	mockMkfsVfat *testutil.MockCmd
-	mockMkfsExt4 *testutil.MockCmd
-	mockUdevadm  *testutil.MockCmd
-}
-
-var _ = Suite(&mkfsSuite{})
-
-func (s *mkfsSuite) SetUpTest(c *C) {
-	// some commads use fakeroot, mock one that just calls the other script
-	cmdFakeroot := testutil.MockCommand(c, "fakeroot", `exec "$@"`)
-	s.AddCleanup(cmdFakeroot.Restore)
-	s.mockMkfsVfat = testutil.MockCommand(c, "mkfs.vfat", "")
-	s.AddCleanup(s.mockMkfsVfat.Restore)
-	s.mockMkfsExt4 = testutil.MockCommand(c, "mkfs.ext4", "")
-	s.AddCleanup(s.mockMkfsExt4.Restore)
-	s.mockUdevadm = testutil.MockCommand(c, "udevadm", "")
-	s.AddCleanup(s.mockUdevadm.Restore)
-}
-
-func (s *mkfsSuite) TestMkfsUnhappy(c *C) {
-	err := partition.Mkfs("/dev/node", "some-label", "unsupported-filesystem-type")
-	c.Assert(err, ErrorMatches, `cannot create unsupported filesystem "unsupported-filesystem-type"`)
-}
-
-func (s *mkfsSuite) TestMkfsVfat(c *C) {
-	err := partition.Mkfs("/dev/node", "some-label", "vfat")
-	c.Assert(err, IsNil)
-	// details are already tested in the gadget package
-	c.Assert(s.mockMkfsVfat.Calls(), HasLen, 1)
-}
-
-func (s *mkfsSuite) TestMkfsExt4(c *C) {
-	err := partition.Mkfs("/dev/node", "some-label", "ext4")
-	c.Assert(err, IsNil)
-	// details are already tested in the gadget package
-	c.Assert(s.mockMkfsExt4.Calls(), HasLen, 1)
-}
-
-func (s *mkfsSuite) TestMakefilesystemNothing(c *C) {
-	part := partition.DeviceStructure{}
-	err := partition.MakeFilesystem(part)
-	c.Assert(err, ErrorMatches, "cannot use incomplete device ")
-	c.Assert(s.mockMkfsExt4.Calls(), HasLen, 0)
-	c.Assert(s.mockMkfsVfat.Calls(), HasLen, 0)
-	c.Assert(s.mockUdevadm.Calls(), HasLen, 0)
-}
-
-func (s *mkfsSuite) TestMakefilesystem(c *C) {
-	created := []partition.DeviceStructure{
-		{
-			Node: "/dev/node2",
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:       "Recovery",
-					Size:       1258291200,
-					Type:       "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
-					Role:       "system-seed",
-					Filesystem: "vfat",
-					Content: []gadget.VolumeContent{
-						{
-							Source: "grubx64.efi",
-							Target: "EFI/boot/grubx64.efi",
-						},
-					},
-				},
-				StartOffset: 2097152,
-				Index:       2,
-			},
-		}, {
-			Node: "/dev/node3",
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:       "Writable",
-					Size:       1258291200,
-					Type:       "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
-					Role:       "system-data",
-					Filesystem: "ext4",
-				},
-				StartOffset: 1260388352,
-				Index:       3,
-			}}, {
-			Node: "/dev/node4",
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:       "Writable",
-					Size:       12345,
-					Type:       "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
-					Role:       "system-save",
-					Filesystem: "ext4",
-				},
-				StartOffset: 1260388352 + 1258291200,
-				Index:       4,
-			},
-		},
-	}
-
-	// single fat partition is created first, then 2 ext4 partitions
-	for n, part := range created {
-		err := partition.MakeFilesystem(part)
-		c.Assert(err, IsNil)
-		c.Assert(s.mockMkfsVfat.Calls(), HasLen, 1)
-		c.Assert(s.mockMkfsExt4.Calls(), HasLen, n)
-	}
-
-	// ensure ordering is correct
-	calls := s.mockMkfsExt4.Calls()[0]
-	c.Assert(calls[len(calls)-1:], DeepEquals, []string{"/dev/node3"})
-	calls = s.mockMkfsExt4.Calls()[1]
-	c.Assert(calls[len(calls)-1:], DeepEquals, []string{"/dev/node4"})
-	c.Assert(s.mockMkfsVfat.Calls(), HasLen, 1)
-	c.Assert(s.mockUdevadm.Calls(), DeepEquals, [][]string{
-		{"udevadm", "trigger", "--settle", "/dev/node2"},
-		{"udevadm", "trigger", "--settle", "/dev/node3"},
-		{"udevadm", "trigger", "--settle", "/dev/node4"},
-	})
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/partition_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/partition_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/partition_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/partition_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,126 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition_test
-
-import (
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-func TestPartition(t *testing.T) { TestingT(t) }
-
-type partitionTestSuite struct {
-	testutil.BaseTest
-
-	dir string
-}
-
-var _ = Suite(&partitionTestSuite{})
-
-func (s *partitionTestSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
-
-	s.dir = c.MkDir()
-}
-
-var mockDeviceStructureBiosBoot = partition.DeviceStructure{
-	Node: "/dev/node1",
-	LaidOutStructure: gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Name: "BIOS Boot",
-			Size: 1 * 1024 * 1024,
-			Type: "DA,21686148-6449-6E6F-744E-656564454649",
-			Content: []gadget.VolumeContent{
-				{
-					Image: "pc-core.img",
-				},
-			},
-		},
-		StartOffset: 0,
-		Index:       1,
-	},
-}
-
-var mockDeviceStructureSystemSeed = partition.DeviceStructure{
-	Node: "/dev/node2",
-	LaidOutStructure: gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Name:       "Recovery",
-			Size:       1258291200,
-			Type:       "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
-			Role:       "system-seed",
-			Label:      "ubuntu-seed",
-			Filesystem: "vfat",
-			Content: []gadget.VolumeContent{
-				{
-					Source: "grubx64.efi",
-					Target: "EFI/boot/grubx64.efi",
-				},
-			},
-		},
-		StartOffset: 2097152,
-		Index:       2,
-	},
-}
-
-var mockDeviceStructureWritable = partition.DeviceStructure{
-	Node:                 "/dev/node3",
-	CreatedDuringInstall: true,
-	LaidOutStructure: gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Name:       "Writable",
-			Size:       1258291200,
-			Type:       "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
-			Role:       "system-data",
-			Label:      "ubuntu-data",
-			Filesystem: "ext4",
-		},
-		StartOffset: 1260388352,
-		Index:       3,
-	},
-}
-
-func makeMockGadget(gadgetRoot, gadgetContent string) error {
-	if err := os.MkdirAll(filepath.Join(gadgetRoot, "meta"), 0755); err != nil {
-		return err
-	}
-	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "meta", "gadget.yaml"), []byte(gadgetContent), 0644); err != nil {
-		return err
-	}
-	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "pc-boot.img"), []byte("pc-boot.img content"), 0644); err != nil {
-		return err
-	}
-	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "pc-core.img"), []byte("pc-core.img content"), 0644); err != nil {
-		return err
-	}
-	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "grubx64.efi"), []byte("grubx64.efi content"), 0644); err != nil {
-		return err
-	}
-
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/sfdisk.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/sfdisk.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/sfdisk.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/sfdisk.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,538 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"os/exec"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/logger"
-	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/strutil"
-)
-
-const (
-	ubuntuBootLabel = "ubuntu-boot"
-	ubuntuSeedLabel = "ubuntu-seed"
-	ubuntuDataLabel = "ubuntu-data"
-
-	sectorSize gadget.Size = 512
-
-	createdPartitionAttr = "59"
-)
-
-var createdPartitionGUID = []string{
-	"0FC63DAF-8483-4772-8E79-3D69D8477DE4", // Linux filesystem data
-	"0657FD6D-A4AB-43C4-84E5-0933C84B4F4F", // Linux swap partition
-}
-
-// creationSupported returns whether we support and expect to create partitions
-// of the given type, it also means we are ready to remove them for re-installation
-// or retried installation if they are appropriately marked with createdPartitionAttr.
-func creationSupported(ptype string) bool {
-	return strutil.ListContains(createdPartitionGUID, strings.ToUpper(ptype))
-}
-
-// sfdiskDeviceDump represents the sfdisk --dump JSON output format.
-type sfdiskDeviceDump struct {
-	PartitionTable sfdiskPartitionTable `json:"partitiontable"`
-}
-
-type sfdiskPartitionTable struct {
-	Label      string            `json:"label"`
-	ID         string            `json:"id"`
-	Device     string            `json:"device"`
-	Unit       string            `json:"unit"`
-	FirstLBA   uint64            `json:"firstlba"`
-	LastLBA    uint64            `json:"lastlba"`
-	Partitions []sfdiskPartition `json:"partitions"`
-}
-
-type sfdiskPartition struct {
-	Node  string `json:"node"`
-	Start uint64 `json:"start"`
-	Size  uint64 `json:"size"`
-	// List of GPT partition attributes in <attr>[ <attr>] format, numeric attributes
-	// are listed as GUID:<bit>[,<bit>]. Note that the even though the sfdisk(8) manpage
-	// says --part-attrs takes a space or comma separated list, the output from
-	// --json/--dump uses a different format.
-	Attrs string `json:"attrs"`
-	Type  string `json:"type"`
-	UUID  string `json:"uuid"`
-	Name  string `json:"name"`
-}
-
-func isCreatedDuringInstall(p *sfdiskPartition, fs *lsblkBlockDevice, sfdiskLabel string) bool {
-	switch sfdiskLabel {
-	case "gpt":
-		// the created partitions use specific GPT GUID types and set a
-		// specific bit in partition attributes
-		if !creationSupported(p.Type) {
-			return false
-		}
-		for _, a := range strings.Fields(p.Attrs) {
-			if !strings.HasPrefix(a, "GUID:") {
-				continue
-			}
-			attrs := strings.Split(a[5:], ",")
-			if strutil.ListContains(attrs, createdPartitionAttr) {
-				return true
-			}
-		}
-	case "dos":
-		// we have no similar type/bit attribute setting for MBR, on top
-		// of that MBR does not support partition names, fall back to
-		// reasonable assumption that only partitions carrying
-		// ubuntu-boot and ubuntu-data labels are created during
-		// install, everything else was part of factory image
-
-		// TODO:UC20 consider using gadget layout information to build a
-		// mapping of partition start offset to label/name
-		createdDuringInstall := []string{ubuntuBootLabel, ubuntuDataLabel}
-		return strutil.ListContains(createdDuringInstall, fs.Label)
-	}
-	return false
-}
-
-type DeviceLayout struct {
-	Structure []DeviceStructure
-	ID        string
-	Device    string
-	Schema    string
-	// size in bytes
-	Size gadget.Size
-	// sector size in bytes
-	SectorSize     gadget.Size
-	partitionTable *sfdiskPartitionTable
-}
-
-type DeviceStructure struct {
-	gadget.LaidOutStructure
-
-	Node                 string
-	CreatedDuringInstall bool
-}
-
-// DeviceLayoutFromDisk obtains the partitioning and filesystem information from
-// the block device.
-func DeviceLayoutFromDisk(device string) (*DeviceLayout, error) {
-	output, err := exec.Command("sfdisk", "--json", "-d", device).Output()
-	if err != nil {
-		return nil, osutil.OutputErr(output, err)
-	}
-
-	var dump sfdiskDeviceDump
-	if err := json.Unmarshal(output, &dump); err != nil {
-		return nil, fmt.Errorf("cannot parse sfdisk output: %v", err)
-	}
-
-	dl, err := deviceLayoutFromPartitionTable(dump.PartitionTable)
-	if err != nil {
-		return nil, err
-	}
-	dl.Device = device
-
-	return dl, nil
-}
-
-var (
-	ensureNodesExist = ensureNodesExistImpl
-)
-
-// CreateMissing creates the partitions listed in the positioned volume pv
-// that are missing from the existing device layout.
-func (dl *DeviceLayout) CreateMissing(pv *gadget.LaidOutVolume) ([]DeviceStructure, error) {
-	buf, created := buildPartitionList(dl, pv)
-	if len(created) == 0 {
-		return created, nil
-	}
-
-	// Write the partition table. By default sfdisk will try to re-read the
-	// partition table with the BLKRRPART ioctl but will fail because the
-	// kernel side rescan removes and adds partitions and we have partitions
-	// mounted (so it fails on removal). Use --no-reread to skip this attempt.
-	cmd := exec.Command("sfdisk", "--append", "--no-reread", dl.Device)
-	cmd.Stdin = buf
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return created, osutil.OutputErr(output, err)
-	}
-
-	// Re-read the partition table
-	if err := reloadPartitionTable(dl.Device); err != nil {
-		return nil, err
-	}
-
-	// Make sure the devices for the partitions we created are available
-	if err := ensureNodesExist(created, 5*time.Second); err != nil {
-		return nil, fmt.Errorf("partition not available: %v", err)
-	}
-
-	return created, nil
-}
-
-// RemoveCreated removes partitions added during a previous failed install
-// attempt.
-func (dl *DeviceLayout) RemoveCreated() error {
-	indexes := make([]string, 0, len(dl.partitionTable.Partitions))
-	for i, s := range dl.Structure {
-		if s.CreatedDuringInstall {
-			logger.Noticef("partition %s was created during previous install", s.Node)
-			indexes = append(indexes, strconv.Itoa(i+1))
-		}
-	}
-	if len(indexes) == 0 {
-		return nil
-	}
-
-	// Delete disk partitions
-	cmd := exec.Command("sfdisk", append([]string{"--no-reread", "--delete", dl.Device}, indexes...)...)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return osutil.OutputErr(output, err)
-	}
-
-	// Reload the partition table
-	if err := reloadPartitionTable(dl.Device); err != nil {
-		return err
-	}
-
-	// Re-read the partition table from the device to update our partition list
-	layout, err := DeviceLayoutFromDisk(dl.Device)
-	if err != nil {
-		return fmt.Errorf("cannot read disk layout: %v", err)
-	}
-	if dl.ID != layout.ID {
-		return fmt.Errorf("partition table IDs don't match")
-	}
-	dl.Structure = layout.Structure
-	dl.partitionTable = layout.partitionTable
-
-	// Ensure all created partitions were removed
-	if remaining := listCreatedPartitions(layout); len(remaining) > 0 {
-		return fmt.Errorf("cannot remove partitions: %s", strings.Join(remaining, ", "))
-	}
-
-	return nil
-}
-
-// ensureNodeExists makes sure the device nodes for all device structures are
-// available and notified to udev, within a specified amount of time.
-func ensureNodesExistImpl(ds []DeviceStructure, timeout time.Duration) error {
-	t0 := time.Now()
-	for _, part := range ds {
-		found := false
-		for time.Since(t0) < timeout {
-			if osutil.FileExists(part.Node) {
-				found = true
-				break
-			}
-			time.Sleep(100 * time.Millisecond)
-		}
-		if found {
-			if err := udevTrigger(part.Node); err != nil {
-				return err
-			}
-		} else {
-			return fmt.Errorf("device %s not available", part.Node)
-		}
-	}
-	return nil
-}
-
-func fromSfdiskPartitionType(st string, sfdiskLabel string) (string, error) {
-	switch sfdiskLabel {
-	case "dos":
-		// sometimes sfdisk reports what is "0C" in gadget.yaml as "c",
-		// normalize the values
-		v, err := strconv.ParseUint(st, 16, 8)
-		if err != nil {
-			return "", fmt.Errorf("cannot convert MBR partition type %q", st)
-		}
-		return fmt.Sprintf("%02X", v), nil
-	case "gpt":
-		return st, nil
-	default:
-		return "", fmt.Errorf("unsupported partitioning schema %q", sfdiskLabel)
-	}
-}
-
-func blockDeviceSizeInSectors(devpath string) (gadget.Size, error) {
-	// the size is reported in 512-byte sectors
-	// XXX: consider using /sys/block/<dev>/size directly
-	out, err := exec.Command("blockdev", "--getsz", devpath).CombinedOutput()
-	if err != nil {
-		return 0, osutil.OutputErr(out, err)
-	}
-	nospace := strings.TrimSpace(string(out))
-	sz, err := strconv.Atoi(nospace)
-	if err != nil {
-		return 0, fmt.Errorf("cannot parse device size %q: %v", nospace, err)
-	}
-	return gadget.Size(sz), nil
-}
-
-// deviceLayoutFromPartitionTable takes an sfdisk dump partition table and returns
-// the partitioning information as a device layout.
-func deviceLayoutFromPartitionTable(ptable sfdiskPartitionTable) (*DeviceLayout, error) {
-	if ptable.Unit != "sectors" {
-		return nil, fmt.Errorf("cannot position partitions: unknown unit %q", ptable.Unit)
-	}
-
-	structure := make([]gadget.VolumeStructure, len(ptable.Partitions))
-	ds := make([]DeviceStructure, len(ptable.Partitions))
-
-	for i, p := range ptable.Partitions {
-		info, err := filesystemInfo(p.Node)
-		if err != nil {
-			return nil, fmt.Errorf("cannot obtain filesystem information: %v", err)
-		}
-		switch {
-		case len(info.BlockDevices) == 0:
-			continue
-		case len(info.BlockDevices) > 1:
-			return nil, fmt.Errorf("unexpected number of blockdevices for node %q: %v", p.Node, info.BlockDevices)
-		}
-		bd := info.BlockDevices[0]
-
-		vsType, err := fromSfdiskPartitionType(p.Type, ptable.Label)
-		if err != nil {
-			return nil, fmt.Errorf("cannot convert sfdisk partition type %q: %v", p.Type, err)
-		}
-
-		structure[i] = gadget.VolumeStructure{
-			Name:       p.Name,
-			Size:       gadget.Size(p.Size) * sectorSize,
-			Label:      bd.Label,
-			Type:       vsType,
-			Filesystem: bd.FSType,
-		}
-
-		ds[i] = DeviceStructure{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &structure[i],
-				StartOffset:     gadget.Size(p.Start) * sectorSize,
-				Index:           i + 1,
-			},
-			Node:                 p.Node,
-			CreatedDuringInstall: isCreatedDuringInstall(&p, &bd, ptable.Label),
-		}
-	}
-
-	var numSectors gadget.Size
-	if ptable.LastLBA != 0 {
-		// sfdisk reports the last usable LBA for GPT disks only
-		numSectors = gadget.Size(ptable.LastLBA + 1)
-	} else {
-		// sfdisk does not report any information about the size of a
-		// MBR partitioned disk, find out the size of the device by
-		// other means
-		sz, err := blockDeviceSizeInSectors(ptable.Device)
-		if err != nil {
-			return nil, fmt.Errorf("cannot obtain the size of device %q: %v", ptable.Device, err)
-		}
-		numSectors = sz
-	}
-
-	dl := &DeviceLayout{
-		Structure:      ds,
-		ID:             ptable.ID,
-		Device:         ptable.Device,
-		Schema:         ptable.Label,
-		Size:           numSectors * sectorSize,
-		SectorSize:     sectorSize,
-		partitionTable: &ptable,
-	}
-
-	return dl, nil
-}
-
-func deviceName(name string, index int) string {
-	if len(name) > 0 {
-		last := name[len(name)-1]
-		if last >= '0' && last <= '9' {
-			return fmt.Sprintf("%sp%d", name, index)
-		}
-	}
-	return fmt.Sprintf("%s%d", name, index)
-}
-
-// buildPartitionList builds a list of partitions based on the current
-// device contents and gadget structure list, in sfdisk dump format, and
-// returns a partitioning description suitable for sfdisk input and a
-// list of the partitions to be created.
-func buildPartitionList(dl *DeviceLayout, pv *gadget.LaidOutVolume) (sfdiskInput *bytes.Buffer, toBeCreated []DeviceStructure) {
-	ptable := dl.partitionTable
-
-	// Keep track what partitions we already have on disk
-	seen := map[uint64]bool{}
-	for _, p := range ptable.Partitions {
-		seen[p.Start] = true
-	}
-
-	// Check if the last partition has a system-data role
-	canExpandData := false
-	if n := len(pv.LaidOutStructure); n > 0 {
-		last := pv.LaidOutStructure[n-1]
-		if last.VolumeStructure.Role == gadget.SystemData {
-			canExpandData = true
-		}
-	}
-
-	// The partition index
-	pIndex := 0
-
-	// Write new partition data in named-fields format
-	buf := &bytes.Buffer{}
-	for _, p := range pv.LaidOutStructure {
-		if !p.IsPartition() {
-			continue
-		}
-
-		pIndex++
-		s := p.VolumeStructure
-
-		// Skip partitions that are already in the volume
-		start := p.StartOffset / sectorSize
-		if seen[uint64(start)] {
-			continue
-		}
-
-		// Only allow the creation of partitions with known GUIDs
-		// TODO:UC20: also provide a mechanism for MBR (RPi)
-		ptype := partitionType(ptable.Label, p.Type)
-		if ptable.Label == "gpt" && !creationSupported(ptype) {
-			logger.Noticef("cannot create partition with unsupported type %s", ptype)
-			continue
-		}
-
-		// Check if the data partition should be expanded
-		size := s.Size
-		if s.Role == gadget.SystemData && canExpandData && p.StartOffset+s.Size < dl.Size {
-			size = dl.Size - p.StartOffset
-		}
-
-		// Can we use the index here? Get the largest existing partition number and
-		// build from there could be safer if the disk partitions are not consecutive
-		// (can this actually happen in our images?)
-		node := deviceName(ptable.Device, pIndex)
-		fmt.Fprintf(buf, "%s : start=%12d, size=%12d, type=%s, name=%q, attrs=\"GUID:%s\"\n", node,
-			p.StartOffset/sectorSize, size/sectorSize, ptype, s.Name, createdPartitionAttr)
-
-		// Set expected labels based on role
-		switch s.Role {
-		case gadget.SystemBoot:
-			s.Label = ubuntuBootLabel
-		case gadget.SystemSeed:
-			s.Label = ubuntuSeedLabel
-		case gadget.SystemData:
-			s.Label = ubuntuDataLabel
-		}
-
-		toBeCreated = append(toBeCreated, DeviceStructure{
-			LaidOutStructure:     p,
-			Node:                 node,
-			CreatedDuringInstall: true,
-		})
-	}
-
-	return buf, toBeCreated
-}
-
-// listCreatedPartitions returns a list of partitions created during the
-// install process.
-func listCreatedPartitions(layout *DeviceLayout) []string {
-	created := make([]string, 0, len(layout.Structure))
-	for _, s := range layout.Structure {
-		if s.CreatedDuringInstall {
-			created = append(created, s.Node)
-		}
-	}
-	return created
-}
-
-// udevTrigger triggers udev for the specified device and waits until
-// all events in the udev queue are handled.
-func udevTrigger(device string) error {
-	if output, err := exec.Command("udevadm", "trigger", "--settle", device).CombinedOutput(); err != nil {
-		return osutil.OutputErr(output, err)
-	}
-	return nil
-}
-
-// reloadPartitionTable instructs the kernel to re-read the partition
-// table of a given block device.
-func reloadPartitionTable(device string) error {
-	// Re-read the partition table using the BLKPG ioctl, which doesn't
-	// remove existing partitions, only appends new partitions with the right
-	// size and offset. As long as we provide consistent partitioning from
-	// userspace we're safe. At this point we also trigger udev to create
-	// the new partition device nodes.
-	output, err := exec.Command("partx", "-u", device).CombinedOutput()
-	if err != nil {
-		return osutil.OutputErr(output, err)
-	}
-	return nil
-}
-
-func partitionType(label, ptype string) string {
-	t := strings.Split(ptype, ",")
-	if len(t) < 1 {
-		return ""
-	}
-	if len(t) == 1 {
-		return t[0]
-	}
-	if label == "gpt" {
-		return t[1]
-	}
-	return t[0]
-}
-
-// lsblkFilesystemInfo represents the lsblk --fs JSON output format.
-type lsblkFilesystemInfo struct {
-	BlockDevices []lsblkBlockDevice `json:"blockdevices"`
-}
-
-type lsblkBlockDevice struct {
-	Name       string `json:"name"`
-	FSType     string `json:"fstype"`
-	Label      string `json:"label"`
-	UUID       string `json:"uuid"`
-	Mountpoint string `json:"mountpoint"`
-}
-
-func filesystemInfo(node string) (*lsblkFilesystemInfo, error) {
-	output, err := exec.Command("lsblk", "--fs", "--json", node).CombinedOutput()
-	if err != nil {
-		return nil, osutil.OutputErr(output, err)
-	}
-
-	var info lsblkFilesystemInfo
-	if err := json.Unmarshal(output, &info); err != nil {
-		return nil, fmt.Errorf("cannot parse lsblk output: %v", err)
-	}
-
-	return &info, nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/sfdisk_test.go snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/sfdisk_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/partition/sfdisk_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/partition/sfdisk_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,750 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package partition_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"path/filepath"
-	"time"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/partition"
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-const mockSfdiskScriptBiosAndRecovery = `
->&2 echo "Some warning from sfdisk"
-echo '{
-   "partitiontable": {
-      "label": "gpt",
-      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-      "device": "/dev/node",
-      "unit": "sectors",
-      "firstlba": 34,
-      "lastlba": 8388574,
-      "partitions": [
-         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"},
-         {"node": "/dev/node2", "start": 4096, "size": 2457600, "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B", "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F", "name": "Recovery", "attrs": "GUID:59"}
-      ]
-   }
-}'`
-
-const mockSfdiskScriptBiosRecoveryWritable = `
->&2 echo "Some warning from sfdisk"
-echo '{
-   "partitiontable": {
-      "label": "gpt",
-      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-      "device": "/dev/node",
-      "unit": "sectors",
-      "firstlba": 34,
-      "lastlba": 8388574,
-      "partitions": [
-         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"},
-         {"node": "/dev/node2", "start": 4096, "size": 2457600, "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B", "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F", "name": "Recovery"},
-         {"node": "/dev/node3", "start": 2461696, "size": 2457600, "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4", "uuid": "f940029d-bfbb-4887-9d44-321e85c63866", "name": "Writable", "attrs": "GUID:59"}
-      ]
-   }
-}'`
-
-const mockSfdiskScriptBiosAndRemovableRecovery = `
-if [ -f %[1]s/2 ]; then
-   rm %[1]s/[0-9]
-elif [ -f %[1]s/1 ]; then
-   touch %[1]s/2
-   exit 0
-else
-   PART=',{"node": "/dev/node2", "start": 4096, "size": 2457600, "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4", "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F", "name": "Recovery", "attrs": "GUID:59"}'
-   touch %[1]s/1
-fi
-echo '{
-   "partitiontable": {
-      "label": "gpt",
-      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-      "device": "/dev/node",
-      "unit": "sectors",
-      "firstlba": 34,
-      "lastlba": 8388574,
-      "partitions": [
-         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"}
-         '"$PART
-      ]
-   }
-}"`
-
-const mockSfdiskScriptBios = `echo '{
-    "partitiontable": {
-        "label": "gpt",
-        "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-        "device": "/dev/node",
-        "unit": "sectors",
-        "firstlba": 34,
-        "lastlba": 8388574,
-        "partitions": [
-            {
-                "node": "/dev/node1",
-                "start": 2048,
-                "size": 2048,
-                "type": "21686148-6449-6E6F-744E-656564454649",
-                "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F",
-                "name": "BIOS Boot"
-            }
-        ]
-    }
-}'`
-
-// XXX: improve mocking later
-const mockLsblkScript = `echo '{
-    "blockdevices": [
-        {"name": "nodeX", "fstype": null, "label": null, "uuid": null, "mountpoint": null}
-    ]
-}'`
-
-const mockLsblkScriptBiosAndRecovery = `
-[ "$3" == "/dev/node1" ] && echo '{
-    "blockdevices": [ {"name": "node1", "fstype": null, "label": null, "uuid": null, "mountpoint": null} ]
-}'
-[ "$3" == "/dev/node2" ] && echo '{
-    "blockdevices": [ {"name": "node2", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "A644-B807", "mountpoint": null} ]
-}'
-exit 0`
-
-const mockLsblkScriptBiosRecoveryWritable = `
-[ "$3" == "/dev/node1" ] && echo '{
-    "blockdevices": [ {"name": "node1", "fstype": null, "label": null, "uuid": null, "mountpoint": null} ]
-}'
-[ "$3" == "/dev/node2" ] && echo '{
-    "blockdevices": [ {"name": "node2", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "A644-B807", "mountpoint": null} ]
-}'
-[ "$3" == "/dev/node3" ] && echo '{
-    "blockdevices": [ {"name": "node3", "fstype": "ext4", "label": "ubuntu-data", "uuid": "8781-433a", "mountpoint": null} ]
-}'
-exit 0`
-
-const gadgetContent = `volumes:
-  pc:
-    bootloader: grub
-    structure:
-      - name: mbr
-        type: mbr
-        size: 440
-        content:
-          - image: pc-boot.img
-      - name: BIOS Boot
-        type: DA,21686148-6449-6E6F-744E-656564454649
-        size: 1M
-        offset: 1M
-        offset-write: mbr+92
-        content:
-          - image: pc-core.img
-      - name: Recovery
-        role: system-seed
-        filesystem: vfat
-        # UEFI will boot the ESP partition by default first
-        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
-        size: 1200M
-        content:
-          - source: grubx64.efi
-            target: EFI/boot/grubx64.efi
-      - name: Writable
-        role: system-data
-        filesystem: ext4
-        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
-        size: 1200M
-`
-
-func (s *partitionTestSuite) TestDeviceInfoGPT(c *C) {
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosAndRecovery)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosAndRecovery)
-	defer cmdLsblk.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, IsNil)
-	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "--json", "-d", "/dev/node"},
-	})
-	c.Assert(cmdLsblk.Calls(), DeepEquals, [][]string{
-		{"lsblk", "--fs", "--json", "/dev/node1"},
-		{"lsblk", "--fs", "--json", "/dev/node2"},
-	})
-	c.Assert(err, IsNil)
-	c.Assert(dl.Schema, Equals, "gpt")
-	c.Assert(dl.ID, Equals, "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA")
-	c.Assert(dl.Device, Equals, "/dev/node")
-	c.Assert(dl.SectorSize, Equals, gadget.Size(512))
-	c.Assert(dl.Size, Equals, gadget.Size(8388575*512))
-	c.Assert(len(dl.Structure), Equals, 2)
-
-	c.Assert(dl.Structure, DeepEquals, []partition.DeviceStructure{
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:       "BIOS Boot",
-					Size:       0x100000,
-					Label:      "",
-					Type:       "21686148-6449-6E6F-744E-656564454649",
-					Filesystem: "",
-				},
-				StartOffset: 0x100000,
-				Index:       1,
-			},
-			Node: "/dev/node1",
-		},
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Name:       "Recovery",
-					Size:       0x4b000000,
-					Label:      "ubuntu-seed",
-					Type:       "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
-					Filesystem: "vfat",
-				},
-				StartOffset: 0x200000,
-				Index:       2,
-			},
-			Node: "/dev/node2",
-		},
-	})
-}
-
-func (s *partitionTestSuite) TestDeviceInfoMBR(c *C) {
-	const mockSfdiskWithMBR = `
->&2 echo "Some warning from sfdisk"
-echo '{
-   "partitiontable": {
-      "label": "dos",
-      "device": "/dev/node",
-      "unit": "sectors",
-      "partitions": [
-         {"node": "/dev/node1", "start": 4096, "size": 2457600, "type": "c"},
-         {"node": "/dev/node2", "start": 2461696, "size": 1048576, "type": "d"},
-         {"node": "/dev/node3", "start": 3510272, "size": 1048576, "type": "d"}
-      ]
-   }
-}'`
-	const mockLsblkForMBR = `
-[ "$3" == "/dev/node1" ] && echo '{
-    "blockdevices": [ {"name": "node1", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "A644-B807", "mountpoint": null} ]
-}'
-[ "$3" == "/dev/node2" ] && echo '{
-    "blockdevices": [ {"name": "node2", "fstype": "vfat", "label": "ubuntu-boot", "uuid": "A644-B808", "mountpoint": null} ]
-}'
-[ "$3" == "/dev/node3" ] && echo '{
-    "blockdevices": [ {"name": "node3", "fstype": "ext4", "label": "ubuntu-data", "mountpoint": null} ]
-}'
-exit 0`
-
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskWithMBR)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkForMBR)
-	defer cmdLsblk.Restore()
-
-	cmdBlockdev := testutil.MockCommand(c, "blockdev", "echo 12345670")
-	defer cmdBlockdev.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, IsNil)
-	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "--json", "-d", "/dev/node"},
-	})
-	c.Assert(cmdLsblk.Calls(), DeepEquals, [][]string{
-		{"lsblk", "--fs", "--json", "/dev/node1"},
-		{"lsblk", "--fs", "--json", "/dev/node2"},
-		{"lsblk", "--fs", "--json", "/dev/node3"},
-	})
-	c.Assert(cmdBlockdev.Calls(), DeepEquals, [][]string{
-		{"blockdev", "--getsz", "/dev/node"},
-	})
-	c.Assert(err, IsNil)
-	c.Assert(dl.ID, Equals, "")
-	c.Assert(dl.Schema, Equals, "dos")
-	c.Assert(dl.Device, Equals, "/dev/node")
-	c.Assert(dl.SectorSize, Equals, gadget.Size(512))
-	c.Assert(dl.Size, Equals, gadget.Size(12345670*512))
-	c.Assert(len(dl.Structure), Equals, 3)
-
-	c.Assert(dl.Structure, DeepEquals, []partition.DeviceStructure{
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Size:       0x4b000000,
-					Label:      "ubuntu-seed",
-					Type:       "0C",
-					Filesystem: "vfat",
-				},
-				StartOffset: 0x200000,
-				Index:       1,
-			},
-			Node:                 "/dev/node1",
-			CreatedDuringInstall: false,
-		},
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Size:       0x20000000,
-					Label:      "ubuntu-boot",
-					Type:       "0D",
-					Filesystem: "vfat",
-				},
-				StartOffset: 0x4b200000,
-				Index:       2,
-			},
-			Node:                 "/dev/node2",
-			CreatedDuringInstall: true,
-		},
-		{
-			LaidOutStructure: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{
-					Size:       0x20000000,
-					Label:      "ubuntu-data",
-					Type:       "0D",
-					Filesystem: "ext4",
-				},
-				StartOffset: 0x6b200000,
-				Index:       3,
-			},
-			Node:                 "/dev/node3",
-			CreatedDuringInstall: true,
-		},
-	})
-}
-
-func (s *partitionTestSuite) TestDeviceInfoNotSectors(c *C) {
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `echo '{
-   "partitiontable": {
-      "label": "gpt",
-      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-      "device": "/dev/node",
-      "unit": "not_sectors",
-      "firstlba": 34,
-      "lastlba": 8388574,
-      "partitions": [
-         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"}
-      ]
-   }
-}'`)
-	defer cmdSfdisk.Restore()
-
-	_, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, ErrorMatches, "cannot position partitions: unknown unit .*")
-}
-
-func (s *partitionTestSuite) TestDeviceInfoFilesystemInfoError(c *C) {
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `echo '{
-   "partitiontable": {
-      "label": "gpt",
-      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-      "device": "/dev/node",
-      "unit": "sectors",
-      "firstlba": 34,
-      "lastlba": 8388574,
-      "partitions": [
-         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"}
-      ]
-   }
-}'`)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", "echo lsblk error; exit 1")
-	defer cmdLsblk.Restore()
-
-	_, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, ErrorMatches, "cannot obtain filesystem information: lsblk error")
-}
-
-func (s *partitionTestSuite) TestDeviceInfoJsonError(c *C) {
-	cmd := testutil.MockCommand(c, "sfdisk", `echo 'This is not a json'`)
-	defer cmd.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, ErrorMatches, "cannot parse sfdisk output: invalid .*")
-	c.Assert(dl, IsNil)
-}
-
-func (s *partitionTestSuite) TestDeviceInfoError(c *C) {
-	cmd := testutil.MockCommand(c, "sfdisk", "echo 'sfdisk: not found'; exit 127")
-	defer cmd.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, ErrorMatches, "sfdisk: not found")
-	c.Assert(dl, IsNil)
-}
-
-func (s *partitionTestSuite) TestBuildPartitionList(c *C) {
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosAndRecovery)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScript)
-	defer cmdLsblk.Restore()
-
-	ptable := partition.SFDiskPartitionTable{
-		Label:    "gpt",
-		ID:       "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-		Device:   "/dev/node",
-		Unit:     "sectors",
-		FirstLBA: 34,
-		LastLBA:  8388574,
-		Partitions: []partition.SFDiskPartition{
-			{
-				Node:  "/dev/node1",
-				Start: 2048,
-				Size:  2048,
-				Type:  "21686148-6449-6E6F-744E-656564454649",
-				UUID:  "2E59D969-52AB-430B-88AC-F83873519F6F",
-				Name:  "BIOS Boot",
-			},
-			{
-				Node:  "/dev/node2",
-				Start: 4096,
-				Size:  2457600,
-				Type:  "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
-				UUID:  "216c34ff-9be6-4787-9ab3-a4c1429c3e73",
-				Name:  "Recovery",
-			},
-		},
-	}
-
-	gadgetRoot := filepath.Join(c.MkDir(), "gadget")
-	err := makeMockGadget(gadgetRoot, gadgetContent)
-	c.Assert(err, IsNil)
-	pv, err := gadget.PositionedVolumeFromGadget(gadgetRoot)
-	c.Assert(err, IsNil)
-
-	dl, err := partition.DeviceLayoutFromPartitionTable(ptable)
-	c.Assert(err, IsNil)
-
-	// the expected expanded writable partition size is:
-	// start offset = (2M + 1200M), expanded size in sectors = (8388575*512 - start offset)/512
-	sfdiskInput, create := partition.BuildPartitionList(dl, pv)
-	c.Assert(sfdiskInput.String(), Equals, `/dev/node3 : start=     2461696, size=     5926879, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, name="Writable", attrs="GUID:59"
-`)
-	c.Assert(create, DeepEquals, []partition.DeviceStructure{mockDeviceStructureWritable})
-}
-
-func (s *partitionTestSuite) TestCreatePartitions(c *C) {
-	restore := partition.MockEnsureNodesExist(func(ds []partition.DeviceStructure, timeout time.Duration) error {
-		return nil
-	})
-	defer restore()
-
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosAndRecovery)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScript)
-	defer cmdLsblk.Restore()
-
-	cmdPartx := testutil.MockCommand(c, "partx", "")
-	defer cmdPartx.Restore()
-
-	gadgetRoot := filepath.Join(c.MkDir(), "gadget")
-	err := makeMockGadget(gadgetRoot, gadgetContent)
-	c.Assert(err, IsNil)
-	pv, err := gadget.PositionedVolumeFromGadget(gadgetRoot)
-	c.Assert(err, IsNil)
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, IsNil)
-	created, err := dl.CreateMissing(pv)
-	c.Assert(err, IsNil)
-	c.Assert(created, DeepEquals, []partition.DeviceStructure{mockDeviceStructureWritable})
-
-	// Check partition table read and write
-	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "--json", "-d", "/dev/node"},
-		{"sfdisk", "--append", "--no-reread", "/dev/node"},
-	})
-
-	// Check partition table update
-	c.Assert(cmdPartx.Calls(), DeepEquals, [][]string{
-		{"partx", "-u", "/dev/node"},
-	})
-}
-
-func (s *partitionTestSuite) TestRemovePartitionsTrivial(c *C) {
-	// no locally created partitions
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBios)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosAndRecovery)
-	defer cmdLsblk.Restore()
-
-	cmdPartx := testutil.MockCommand(c, "partx", "")
-	defer cmdPartx.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, IsNil)
-
-	err = dl.RemoveCreated()
-	c.Assert(err, IsNil)
-
-	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "--json", "-d", "/dev/node"},
-	})
-}
-
-func (s *partitionTestSuite) TestRemovePartitions(c *C) {
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", fmt.Sprintf(mockSfdiskScriptBiosAndRemovableRecovery, s.dir))
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosAndRecovery)
-	defer cmdLsblk.Restore()
-
-	cmdPartx := testutil.MockCommand(c, "partx", "")
-	defer cmdPartx.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, IsNil)
-
-	err = dl.RemoveCreated()
-	c.Assert(err, IsNil)
-
-	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "--json", "-d", "/dev/node"},
-		{"sfdisk", "--no-reread", "--delete", "/dev/node", "2"},
-		{"sfdisk", "--json", "-d", "/dev/node"},
-	})
-}
-
-func (s *partitionTestSuite) TestRemovePartitionsError(c *C) {
-	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosRecoveryWritable)
-	defer cmdSfdisk.Restore()
-
-	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosRecoveryWritable)
-	defer cmdLsblk.Restore()
-
-	cmdPartx := testutil.MockCommand(c, "partx", "")
-	defer cmdPartx.Restore()
-
-	dl, err := partition.DeviceLayoutFromDisk("/dev/node")
-	c.Assert(err, IsNil)
-
-	err = dl.RemoveCreated()
-	c.Assert(err, ErrorMatches, "cannot remove partitions: /dev/node3")
-}
-
-func (s *partitionTestSuite) TestListCreatedPartitionsGPT(c *C) {
-	cmdLsblk := testutil.MockCommand(c, "lsblk", `echo '{ "blockdevices": [ {"fstype":"ext4", "label":null} ] }'`)
-	defer cmdLsblk.Restore()
-
-	ptable := partition.SFDiskPartitionTable{
-		Label:    "gpt",
-		ID:       "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
-		Device:   "/dev/node",
-		Unit:     "sectors",
-		FirstLBA: 34,
-		LastLBA:  8388574,
-		Partitions: []partition.SFDiskPartition{
-			{
-				Node:  "/dev/node1",
-				Start: 1024,
-				Size:  1024,
-				Type:  "0fc63daf-8483-4772-8e79-3d69d8477de4",
-				UUID:  "641764aa-a680-4d36-a7ad-f7bd01fd8d12",
-				Name:  "Linux filesystem",
-			},
-			{
-				Node:  "/dev/node2",
-				Start: 2048,
-				Size:  2048,
-				Type:  "0657FD6D-A4AB-43C4-84E5-0933C84B4F4F",
-				UUID:  "7ea3a75a-3f6d-4647-8134-89ae61fe88d5",
-				Name:  "Linux swap",
-			},
-			{
-				Node:  "/dev/node3",
-				Start: 8192,
-				Size:  8192,
-				Type:  "21686148-6449-6E6F-744E-656564454649",
-				UUID:  "30a26851-4b08-4b8d-8aea-f686e723ed8c",
-				Name:  "BIOS boot partition",
-			},
-			{
-				Node:  "/dev/node4",
-				Start: 16384,
-				Size:  16384,
-				Type:  "0fc63daf-8483-4772-8e79-3d69d8477de4",
-				UUID:  "8ab3e8fd-d53d-4d72-9c5e-56146915fd07",
-				Name:  "Another Linux filesystem",
-			},
-		},
-	}
-	dl, err := partition.DeviceLayoutFromPartitionTable(ptable)
-	c.Assert(err, IsNil)
-	list := partition.ListCreatedPartitions(dl)
-	c.Assert(list, HasLen, 0)
-
-	// Set attribute bit for all partitions except the last one
-	for i := 0; i < len(ptable.Partitions)-1; i++ {
-		ptable.Partitions[i].Attrs = "RequiredPartition LegacyBIOSBootable GUID:58,59"
-	}
-
-	dl, err = partition.DeviceLayoutFromPartitionTable(ptable)
-	c.Assert(err, IsNil)
-	list = partition.ListCreatedPartitions(dl)
-	c.Assert(list, DeepEquals, []string{"/dev/node1", "/dev/node2"})
-}
-
-func (s *partitionTestSuite) TestListCreatedPartitionsMBR(c *C) {
-	cmdLsblk := testutil.MockCommand(c, "lsblk", `
-what=
-shift 2
-case "$1" in
-   /dev/node1)
-      what='{"name": "node1", "fstype":"ext4", "label":"ubuntu-seed"}'
-      ;;
-   /dev/node2)
-      what='{"name": "node2", "fstype":"vfat", "label":"ubuntu-boot"}'
-      ;;
-   /dev/node3)
-      what='{"name": "node3", "fstype":null, "label":null}'
-      ;;
-   /dev/node4)
-      what='{"name": "node4", "fstype":"ext4", "label":"ubuntu-data"}'
-      ;;
-  *)
-    echo "unexpected call"
-    exit 1
-esac
-
-cat <<EOF
-{
-"blockdevices": [
-   $what
-  ]
-}
-EOF`)
-	defer cmdLsblk.Restore()
-	cmdBlockdev := testutil.MockCommand(c, "blockdev", `echo '1234567'`)
-	defer cmdBlockdev.Restore()
-
-	ptable := partition.SFDiskPartitionTable{
-		Label:  "dos",
-		Device: "/dev/node",
-		Unit:   "sectors",
-		Partitions: []partition.SFDiskPartition{
-			{
-				// ubuntu-seed
-				Node:  "/dev/node1",
-				Start: 1024,
-				Size:  1024,
-				Type:  "0a",
-			},
-			{
-				// ubuntu-boot
-				Node:  "/dev/node2",
-				Start: 2048,
-				Size:  2048,
-				Type:  "b",
-			},
-			{
-				// unlabeled
-				Node:  "/dev/node3",
-				Start: 8192,
-				Size:  8192,
-				Type:  "c",
-			},
-			{
-				// ubuntu-data
-				Node:  "/dev/node4",
-				Start: 16384,
-				Size:  16384,
-				Type:  "0d",
-			},
-		},
-	}
-	dl, err := partition.DeviceLayoutFromPartitionTable(ptable)
-	c.Assert(err, IsNil)
-	list := partition.ListCreatedPartitions(dl)
-	c.Assert(list, DeepEquals, []string{"/dev/node2", "/dev/node4"})
-}
-
-func (s *partitionTestSuite) TestFilesystemInfo(c *C) {
-	cmd := testutil.MockCommand(c, "lsblk", `echo '{
-   "blockdevices": [
-      {"name": "loop8p2", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "C1F4-CE43", "mountpoint": null}
-   ]
-}'`)
-	defer cmd.Restore()
-
-	info, err := partition.FilesystemInfo("/dev/node")
-	c.Assert(cmd.Calls(), DeepEquals, [][]string{
-		{"lsblk", "--fs", "--json", "/dev/node"},
-	})
-	c.Assert(err, IsNil)
-	c.Assert(len(info.BlockDevices), Equals, 1)
-	bd := info.BlockDevices[0]
-	c.Assert(bd.Name, Equals, "loop8p2")
-	c.Assert(bd.FSType, Equals, "vfat")
-	c.Assert(bd.Label, Equals, "ubuntu-seed")
-	c.Assert(bd.UUID, Equals, "C1F4-CE43")
-}
-
-func (s *partitionTestSuite) TestFilesystemInfoJsonError(c *C) {
-	cmd := testutil.MockCommand(c, "lsblk", `echo 'This is not a json'`)
-	defer cmd.Restore()
-
-	info, err := partition.FilesystemInfo("/dev/node")
-	c.Assert(err, ErrorMatches, "cannot parse lsblk output: invalid .*")
-	c.Assert(info, IsNil)
-}
-
-func (s *partitionTestSuite) TestFilesystemInfoError(c *C) {
-	cmd := testutil.MockCommand(c, "lsblk", "echo 'lsblk: not found'; exit 127")
-	defer cmd.Restore()
-
-	info, err := partition.FilesystemInfo("/dev/node")
-	c.Assert(err, ErrorMatches, "lsblk: not found")
-	c.Assert(info, IsNil)
-}
-
-func (s *partitionTestSuite) TestEnsureNodesExist(c *C) {
-	cmdUdevadm := testutil.MockCommand(c, "udevadm", "")
-	defer cmdUdevadm.Restore()
-
-	node := filepath.Join(c.MkDir(), "node")
-	err := ioutil.WriteFile(node, nil, 0644)
-	c.Assert(err, IsNil)
-	ds := []partition.DeviceStructure{{Node: node}}
-	err = partition.EnsureNodesExist(ds, 10*time.Millisecond)
-	c.Assert(err, IsNil)
-	c.Assert(cmdUdevadm.Calls(), DeepEquals, [][]string{
-		{"udevadm", "trigger", "--settle", node},
-	})
-}
-
-func (s *partitionTestSuite) TestEnsureNodesExistTimeout(c *C) {
-	cmdUdevadm := testutil.MockCommand(c, "udevadm", "")
-	defer cmdUdevadm.Restore()
-
-	node := filepath.Join(c.MkDir(), "node")
-	ds := []partition.DeviceStructure{{Node: node}}
-	t := time.Now()
-	timeout := 1 * time.Second
-	err := partition.EnsureNodesExist(ds, timeout)
-	c.Assert(err, ErrorMatches, fmt.Sprintf("device %s not available", node))
-	c.Assert(time.Since(t) >= timeout, Equals, true)
-	c.Assert(cmdUdevadm.Calls(), HasLen, 0)
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-bootstrap/triggerwatch/evdev.go snapd-2.48.3+20.04/cmd/snap-bootstrap/triggerwatch/evdev.go
--- snapd-2.45.1+20.04.2/cmd/snap-bootstrap/triggerwatch/evdev.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-bootstrap/triggerwatch/evdev.go	2021-02-02 08:21:12.000000000 +0000
@@ -88,7 +88,7 @@
 }
 
 func (e *evdevKeyboardInputDevice) WaitForTrigger(ch chan keyEvent) {
-	logger.Noticef("%s: starting wait", e)
+	logger.Noticef("%s: starting wait, hold %s to trigger", e, holdToTrigger)
 
 	// XXX: do not mess with setting the key repeat rate, as it's cumbersome
 	// and golang-evdev SetRepeatRate() parameter order is actually reversed
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-confine/mount-support.c snapd-2.48.3+20.04/cmd/snap-confine/mount-support.c
--- snapd-2.45.1+20.04.2/cmd/snap-confine/mount-support.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-confine/mount-support.c	2021-02-02 08:21:12.000000000 +0000
@@ -33,7 +33,6 @@
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
-#include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
@@ -322,8 +321,13 @@
 		// Fixes the following bugs:
 		//  - https://bugs.launchpad.net/snap-confine/+bug/1580018
 		//  - https://bugzilla.opensuse.org/show_bug.cgi?id=1028568
-		const char *dirs_from_core[] =
-		    { "/etc/alternatives", "/etc/ssl", "/etc/nsswitch.conf",
+		const char *dirs_from_core[] = {
+			"/etc/alternatives", "/etc/ssl", "/etc/nsswitch.conf",
+			// Some specifc and privileged interfaces (e.g docker-support) give
+			// access to apparmor_parser from the base snap which at a minimum
+			// needs to use matching configuration from the base snap instead
+			// of from the users host system.
+			"/etc/apparmor", "/etc/apparmor.d",
 			NULL
 		};
 		for (const char **dirs = dirs_from_core; *dirs != NULL; dirs++) {
@@ -648,7 +652,6 @@
 			{"/sys"},	// fundamental filesystem
 			{"/tmp"},	// to get writable tmp
 			{"/var/snap"},	// to get access to global snap data
-			{"/var/lib/dhcp",.is_optional = true}, // to support network-control interface
 			{"/var/lib/snapd"},	// to get access to snapd state and seccomp profiles
 			{"/var/tmp"},	// to get access to the other temporary directory
 			{"/run"},	// to get /run with sockets and what not
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-confine/ns-support.c snapd-2.48.3+20.04/cmd/snap-confine/ns-support.c
--- snapd-2.45.1+20.04.2/cmd/snap-confine/ns-support.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-confine/ns-support.c	2021-02-02 08:21:12.000000000 +0000
@@ -93,7 +93,7 @@
 	if (readlinkat(init_mnt_fd, "", init_buf, sizeof init_buf) < 0) {
 		if (errno == ENOENT) {
 			// According to namespaces(7) on a pre 3.8 kernel the namespace
-			// files are hardlinks, not sylinks. If that happens readlinkat
+			// files are hardlinks, not symlinks. If that happens readlinkat
 			// fails with ENOENT. As a quick workaround for this special-case
 			// functionality, just bail out and do nothing without raising an
 			// error.
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-confine/snap-confine.apparmor.in snapd-2.48.3+20.04/cmd/snap-confine/snap-confine.apparmor.in
--- snapd-2.45.1+20.04.2/cmd/snap-confine/snap-confine.apparmor.in	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-confine/snap-confine.apparmor.in	2021-02-02 08:21:12.000000000 +0000
@@ -68,17 +68,10 @@
     /sys/fs/cgroup/freezer/snap.*/ w,
     /sys/fs/cgroup/freezer/snap.*/cgroup.procs rw,
 
-    # cgroup: pids
-    # allow creating per snap-security-tag hierarchy and adding snap command (task)
-    # invocations to the controller.
-    /sys/fs/cgroup/pids/ r,
-    /sys/fs/cgroup/pids/snap.*/ w,
-    /sys/fs/cgroup/pids/snap.*/cgroup.procs w,
-
     # querying udev
     /etc/udev/udev.conf r,
     /sys/**/uevent r,
-    /usr/lib/snapd/snap-device-helper ixr, # drop
+    @LIBEXECDIR@/snap-device-helper ixr, # drop
     /{,usr/}lib/udev/snappy-app-dev ixr, # drop
     /run/udev/** rw,
     /{,usr/}bin/tr ixr,
@@ -91,9 +84,9 @@
     capability setgid,
 
     # changing profile
-    @{PROC}/[0-9]*/attr/exec w,
+    @{PROC}/[0-9]*/attr/{,apparmor/}exec w,
     # Reading current profile
-    @{PROC}/[0-9]*/attr/current r,
+    @{PROC}/[0-9]*/attr/{,apparmor/}current r,
     # Reading available filesystems
     @{PROC}/filesystems r,
 
@@ -106,8 +99,11 @@
     # '/'. Use 'unsafe' to support snap-exec on armhf and its reliance on
     # the environment for determining the capabilities of the architecture.
     # 'unsafe' is ok here because the kernel will have already cleared the
-    # environment as part of launching snap-confine with
-    # CAP_SYS_ADMIN.
+    # environment as part of launching snap-confine with CAP_SYS_ADMIN. This
+    # does leave directories as configured by ld.so.preload as well as
+    # LD_PRELOAD to be set to a library which is in a directory configured by
+    # ld.so.conf, but access to those locations is mediated by this profile
+    # (which requires rules for specific locations).
     change_profile unsafe /** -> [^u/]**,
     change_profile unsafe /** -> u[^n]**,
     change_profile unsafe /** -> un[^c]**,
@@ -221,15 +217,23 @@
     mount options=(rw bind) /usr/bin/snapctl -> /tmp/snap.rootfs_*/usr/bin/snapctl,
     mount options=(rw slave) -> /tmp/snap.rootfs_*/usr/bin/snapctl,
 
-    # /etc/alternatives (classic)
+    # /etc/alternatives (classic and normal mode)
     mount options=(rw bind) @SNAP_MOUNT_DIR@/*/*/etc/alternatives/ -> /tmp/snap.rootfs_*/etc/alternatives/,
     mount options=(rw bind) @SNAP_MOUNT_DIR@/*/*/etc/ssl/ -> /tmp/snap.rootfs_*/etc/ssl/,
     mount options=(rw bind) @SNAP_MOUNT_DIR@/*/*/etc/nsswitch.conf -> /tmp/snap.rootfs_*/etc/nsswitch.conf,
-    # /etc/alternatives (core)
+    mount options=(rw bind) @SNAP_MOUNT_DIR@/*/*/etc/apparmor/ -> /tmp/snap.rootfs_*/etc/apparmor/,
+    mount options=(rw bind) @SNAP_MOUNT_DIR@/*/*/etc/apparmor.d/ -> /tmp/snap.rootfs_*/etc/apparmor.d/,
+
+    # /etc/alternatives (core/legacy mode)
     mount options=(rw bind) /etc/alternatives/ -> /tmp/snap.rootfs_*/etc/alternatives/,
+
+    # making all those directories slave shared.
     mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/alternatives/,
     mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/ssl/,
     mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/nsswitch.conf,
+    mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/apparmor/,
+    mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/apparmor.d/,
+
     # the /snap directory
     mount options=(rw rbind) @SNAP_MOUNT_DIR@/ -> /tmp/snap.rootfs_*/snap/,
     mount options=(rw rslave) -> /tmp/snap.rootfs_*/snap/,
@@ -430,7 +434,7 @@
     /var/lib/snapd/cookie/snap.* r,
 
     # For aa_change_hat() to go into ^mount-namespace-capture-helper
-    @{PROC}/[0-9]*/attr/current w,
+    @{PROC}/[0-9]*/attr/{,apparmor/}current w,
 
     # As a special exception allow snap-confine to write to anything in /var/lib.
     # This code should be changed to allow delegation so that snap-confine can
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-confine/snap-confine.c snapd-2.48.3+20.04/cmd/snap-confine/snap-confine.c
--- snapd-2.45.1+20.04.2/cmd/snap-confine/snap-confine.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-confine/snap-confine.c	2021-02-02 08:21:12.000000000 +0000
@@ -34,7 +34,6 @@
 
 #include "../libsnap-confine-private/apparmor-support.h"
 #include "../libsnap-confine-private/cgroup-freezer-support.h"
-#include "../libsnap-confine-private/cgroup-pids-support.h"
 #include "../libsnap-confine-private/cgroup-support.h"
 #include "../libsnap-confine-private/classic.h"
 #include "../libsnap-confine-private/cleanup-funcs.h"
@@ -125,7 +124,7 @@
 /**
  * sc_preserve_and_sanitize_process_state sanitizes process state.
  *
- * The following process state is sanitised:
+ * The following process state is sanitized:
  *  - the umask is set to 0
  *  - the current working directory is set to /
  *
@@ -305,9 +304,6 @@
 						    gid_t real_gid,
 						    gid_t saved_gid);
 
-static void maybe_join_tracking_cgroup(const sc_invocation * inv,
-				       gid_t real_gid, gid_t saved_gid);
-
 int main(int argc, char **argv)
 {
 	// Use our super-defensive parser to figure out what we've been asked to do.
@@ -563,11 +559,6 @@
 	 */
 	debug("preparing classic execution environment");
 
-	/* Join a tracking cgroup if appropriate feature is enabled. */
-	int snap_lock_fd = sc_lock_snap(inv->snap_instance);
-	maybe_join_tracking_cgroup(inv, real_gid, saved_gid);
-	sc_unlock(snap_lock_fd);
-
 	if (!sc_feature_enabled(SC_FEATURE_PARALLEL_INSTANCES)) {
 		return;
 	}
@@ -740,8 +731,6 @@
 		sc_cgroup_freezer_join(inv->snap_instance, getpid());
 	}
 
-	maybe_join_tracking_cgroup(inv, real_gid, saved_gid);
-
 	sc_unlock(snap_lock_fd);
 
 	sc_close_mount_ns(group);
@@ -770,13 +759,3 @@
 		}
 	}
 }
-
-static void maybe_join_tracking_cgroup(const sc_invocation * inv,
-				       gid_t real_gid, gid_t saved_gid)
-{
-	if (!sc_cgroup_is_v2()) {
-		if (sc_feature_enabled(SC_FEATURE_REFRESH_APP_AWARENESS)) {
-			sc_cgroup_pids_join(inv->security_tag, getpid());
-		}
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-confine/snap-device-helper snapd-2.48.3+20.04/cmd/snap-confine/snap-device-helper
--- snapd-2.45.1+20.04.2/cmd/snap-confine/snap-device-helper	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-confine/snap-device-helper	2021-02-02 08:21:12.000000000 +0000
@@ -19,7 +19,7 @@
 [ "$NOSNAP" != "$APPNAME" ] || { echo "malformed appname $APPNAME" >&2; exit 1; }
 
 # FIXME: this will break for instances that are called "hook" :(
-# Handle hooks first, the the nosnap part looks like this:
+# Handle hooks first, the nosnap part looks like this:
 # - "$snap_hook_$hookname"
 # - "$snap_$instance_hook_$hookname
 # we need to make sure we change this to:
@@ -53,8 +53,16 @@
 fi
 
 # check if it's a block or char dev
+# TODO: re-write this to be more robust, the bash variable substitution done 
+# here is quite awkard :-/
 if [ "${DEVPATH#*/block/}" != "$DEVPATH" ]; then
     type="b"
+elif [ "${DEVPATH#*/nvme/nvme*/nvme*n*}" != "$DEVPATH" ]; then
+    # char devices are .../nvme/nvme* but block devices are
+    # .../nvme/nvme*/nvme*n* and .../nvme/nvme*/nvme*n*p*
+    # so if have a device that has nvme/nvme*/nvme*n* in it,
+    # treat it as a block device
+    type="b"
 else
     type="c"
 fi
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-confine/udev-support.c snapd-2.48.3+20.04/cmd/snap-confine/udev-support.c
--- snapd-2.45.1+20.04.2/cmd/snap-confine/udev-support.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-confine/udev-support.c	2021-02-02 08:21:12.000000000 +0000
@@ -107,13 +107,24 @@
 
 	struct udev_device *d =
 	    udev_device_new_from_syspath(udev_s->udev, path);
-	if (d == NULL)
-		die("cannot find device from syspath %s", path);
+	// udev may be late with registering the device, e.g. under high load, and
+	// udev lookup will fail.
+	if (d == NULL) {
+		debug("cannot find device from syspath %s", path);
+		return;
+	}
 	dev_t devnum = udev_device_get_devnum(d);
 	udev_device_unref(d);
 
-	_run_snappy_app_dev_add_majmin(udev_s, path, major(devnum),
-				       minor(devnum));
+	unsigned int devmaj = major(devnum);
+	unsigned int devmin = minor(devnum);
+	// per udev_device_get_devnum man page, on failure a device type with minor
+	// and major number set to 0 is returned.
+	if (devmaj == 0 && devmin == 0) {
+		debug("cannot get major/minor numbers for %s", path);
+	} else {
+		_run_snappy_app_dev_add_majmin(udev_s, path, devmaj, devmin);
+	}
 }
 
 /*
@@ -169,17 +180,21 @@
 void setup_devices_cgroup(const char *security_tag, struct snappy_udev *udev_s)
 {
 	debug("%s", __func__);
-	// Devices that must always be present
-	const char *static_devices[] = {
-		"/sys/class/mem/null",
-		"/sys/class/mem/full",
-		"/sys/class/mem/zero",
-		"/sys/class/mem/random",
-		"/sys/class/mem/urandom",
-		"/sys/class/tty/tty",
-		"/sys/class/tty/console",
-		"/sys/class/tty/ptmx",
-		NULL,
+	// Hardcode major/minor for common sysfs devices to avoid udev lookup
+	struct {
+		char *name;
+		unsigned int maj;
+		unsigned int min;
+	} static_devices[] = {
+		{.name="/sys/class/mem/null", .maj=1, .min=3},
+		{.name="/sys/class/mem/full", .maj=1, .min=7},
+		{.name="/sys/class/mem/zero", .maj=1, .min=5},
+		{.name="/sys/class/mem/random", .maj=1, .min=8},
+		{.name="/sys/class/mem/urandom", .maj=1, .min=9},
+		{.name="/sys/class/tty/tty", .maj=5, .min=0},
+		{.name="/sys/class/tty/console", .maj=5, .min=1},
+		{.name="/sys/class/tty/ptmx", .maj=5, .min=2},
+		{.name=NULL, .maj=0, .min=0}
 	};
 
 	if (udev_s == NULL)
@@ -224,8 +239,9 @@
 	write_string_to_file(cgroup_file, "a");
 
 	// add the common devices
-	for (int i = 0; static_devices[i] != NULL; i++)
-		run_snappy_app_dev_add(udev_s, static_devices[i]);
+	for (int i = 0; static_devices[i].name != NULL; i++)
+		_run_snappy_app_dev_add_majmin(udev_s, static_devices[i].name,
+				static_devices[i].maj, static_devices[i].min);
 
 	// add glob for current and future PTY slaves. We unconditionally add
 	// them since we use a devpts newinstance. Unix98 PTY slaves major
diff -Nru snapd-2.45.1+20.04.2/cmd/snapctl/main.go snapd-2.48.3+20.04/cmd/snapctl/main.go
--- snapd-2.45.1+20.04.2/cmd/snapctl/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snapctl/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,11 +21,12 @@
 
 import (
 	"fmt"
+	"io"
 	"os"
 
 	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/xdgopenproxy"
+	"github.com/snapcore/snapd/usersession/xdgopenproxy"
 )
 
 var clientConfig = client.Config{
@@ -55,8 +56,13 @@
 		os.Exit(0)
 	}
 
+	var stdin io.Reader
+	if len(os.Args) > 1 && client.InternalSnapctlCmdNeedsStdin(os.Args[1]) {
+		stdin = os.Stdin
+	}
+
 	// no internal command, route via snapd
-	stdout, stderr, err := run()
+	stdout, stderr, err := run(stdin)
 	if err != nil {
 		if e, ok := err.(*client.Error); ok {
 			switch e.Kind {
@@ -87,7 +93,7 @@
 	}
 }
 
-func run() (stdout, stderr []byte, err error) {
+func run(stdin io.Reader) (stdout, stderr []byte, err error) {
 	cli := client.New(&clientConfig)
 
 	cookie := os.Getenv("SNAP_COOKIE")
@@ -98,5 +104,5 @@
 	return cli.RunSnapctl(&client.SnapCtlOptions{
 		ContextID: cookie,
 		Args:      os.Args[1:],
-	})
+	}, stdin)
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snapctl/main_test.go snapd-2.48.3+20.04/cmd/snapctl/main_test.go
--- snapd-2.45.1+20.04.2/cmd/snapctl/main_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snapctl/main_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -41,6 +42,7 @@
 	oldArgs           []string
 	expectedContextID string
 	expectedArgs      []string
+	expectedStdin     []byte
 }
 
 var _ = Suite(&snapctlSuite{})
@@ -57,11 +59,12 @@
 			c.Assert(r.URL.Path, Equals, "/v2/snapctl")
 			c.Assert(r.Header.Get("Authorization"), Equals, "")
 
-			var snapctlOptions client.SnapCtlOptions
+			var snapctlPostData client.SnapCtlPostData
 			decoder := json.NewDecoder(r.Body)
-			c.Assert(decoder.Decode(&snapctlOptions), IsNil)
-			c.Assert(snapctlOptions.ContextID, Equals, s.expectedContextID)
-			c.Assert(snapctlOptions.Args, DeepEquals, s.expectedArgs)
+			c.Assert(decoder.Decode(&snapctlPostData), IsNil)
+			c.Assert(snapctlPostData.ContextID, Equals, s.expectedContextID)
+			c.Assert(snapctlPostData.Args, DeepEquals, s.expectedArgs)
+			c.Assert(snapctlPostData.Stdin, DeepEquals, s.expectedStdin)
 
 			fmt.Fprintln(w, `{"type": "sync", "result": {"stdout": "test stdout", "stderr": "test stderr"}}`)
 		default:
@@ -91,7 +94,7 @@
 }
 
 func (s *snapctlSuite) TestSnapctl(c *C) {
-	stdout, stderr, err := run()
+	stdout, stderr, err := run(nil)
 	c.Check(err, IsNil)
 	c.Check(string(stdout), Equals, "test stdout")
 	c.Check(string(stderr), Equals, "test stderr")
@@ -101,7 +104,7 @@
 	os.Args = []string{"snapctl", "foo", "--bar"}
 
 	s.expectedArgs = []string{"foo", "--bar"}
-	stdout, stderr, err := run()
+	stdout, stderr, err := run(nil)
 	c.Check(err, IsNil)
 	c.Check(string(stdout), Equals, "test stdout")
 	c.Check(string(stderr), Equals, "test stderr")
@@ -114,6 +117,14 @@
 	os.Args = []string{"snapctl", "-h"}
 	s.expectedArgs = []string{"-h"}
 
-	_, _, err := run()
+	_, _, err := run(nil)
+	c.Check(err, IsNil)
+}
+
+func (s *snapctlSuite) TestSnapctlWithStdin(c *C) {
+	s.expectedStdin = []byte("hello")
+	mockStdin := bytes.NewBuffer(s.expectedStdin)
+
+	_, _, err := run(mockStdin)
 	c.Check(err, IsNil)
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snapd/main.go snapd-2.48.3+20.04/cmd/snapd/main.go
--- snapd-2.45.1+20.04.2/cmd/snapd/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snapd/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,7 +26,6 @@
 	"syscall"
 	"time"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/daemon"
 	"github.com/snapcore/snapd/errtracker"
 	"github.com/snapcore/snapd/logger"
@@ -34,6 +33,7 @@
 	"github.com/snapcore/snapd/sandbox"
 	"github.com/snapcore/snapd/sanity"
 	"github.com/snapcore/snapd/snapdenv"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/systemd"
 )
 
@@ -48,7 +48,7 @@
 	}
 	// set here to avoid accidental submits in e.g. unit tests
 	errtracker.CrashDbURLBase = "https://daisy.ubuntu.com/"
-	errtracker.SnapdVersion = cmd.Version
+	errtracker.SnapdVersion = snapdtool.Version
 }
 
 func main() {
@@ -56,7 +56,7 @@
 	if snapdenv.Preseeding() {
 		logger.Noticef("running for preseeding")
 	} else {
-		cmd.ExecInSnapdOrCoreSnap()
+		snapdtool.ExecInSnapdOrCoreSnap()
 	}
 
 	ch := make(chan os.Signal, 2)
@@ -109,7 +109,7 @@
 
 func run(ch chan os.Signal) error {
 	t0 := time.Now().Truncate(time.Millisecond)
-	snapdenv.SetUserAgentFromVersion(cmd.Version, sandbox.ForceDevMode)
+	snapdenv.SetUserAgentFromVersion(snapdtool.Version, sandbox.ForceDevMode)
 
 	d, err := daemon.New()
 	if err != nil {
@@ -132,7 +132,7 @@
 		checkTicker = tic.C
 	}
 
-	d.Version = cmd.Version
+	d.Version = snapdtool.Version
 
 	if err := d.Start(); err != nil {
 		return err
diff -Nru snapd-2.45.1+20.04.2/cmd/snapd-generator/main.c snapd-2.48.3+20.04/cmd/snapd-generator/main.c
--- snapd-2.45.1+20.04.2/cmd/snapd-generator/main.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snapd-generator/main.c	2021-02-02 08:21:12.000000000 +0000
@@ -18,6 +18,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
+#include <dirent.h>
+#include <errno.h>
+#include <unistd.h>
 
 #include "config.h"
 
@@ -38,18 +42,8 @@
 	return root;
 }
 
-int main(int argc, char **argv)
+int ensure_root_fs_shared(const char *normal_dir)
 {
-	if (argc != 4) {
-		printf("usage: snapd-workaround-generator "
-		       "normal-dir early-dir late-dir\n");
-		return 1;
-	}
-	const char *normal_dir = argv[1];
-	// For reference, but we don't use those variables here.
-	// const char *early_dir = argv[2];
-	// const char *late_dir = argv[3];
-
 	// Load /proc/self/mountinfo so that we can inspect the root filesystem.
 	sc_mountinfo *mounts SC_CLEANUP(sc_cleanup_mountinfo) = NULL;
 	mounts = sc_parse_mountinfo(NULL);
@@ -97,3 +91,120 @@
 	fprintf(f, "WantedBy=local-fs.target\n");
 	return 0;
 }
+
+static bool file_exists(const char *path) {
+	struct stat buf;
+	// Not using lstat to automatically resolve symbolic links,
+	// including handling, as an error, dangling symbolic links.
+	return stat(path, &buf) == 0 && (buf.st_mode & S_IFMT) == S_IFREG;
+}
+
+// PATH may not be set (the case on 16.04), in which case this is the fallback
+// for looking up squashfuse / snapfuse executable.
+// Based on what systemd uses when compiled for systems with "unmerged /usr"
+// (see man systemd.exec).
+static const char * const path_fallback = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+
+static bool executable_exists(const char *name) {
+	char *path = getenv("PATH");
+	char *path_copy SC_CLEANUP(sc_cleanup_string) = NULL;
+	if (path == NULL) {
+		path_copy = sc_strdup(path_fallback);
+	} else {
+		path_copy = sc_strdup(path);
+	}
+
+	char *ptr = NULL;
+	char *token = strtok_r(path_copy, ":", &ptr);
+	char fname[PATH_MAX + 1] = { 0 };
+	while (token) {
+		sc_must_snprintf(fname, sizeof fname, "%s/%s", token, name);
+		if (access(fname, X_OK) == 0) {
+			return true;
+		}
+		token = strtok_r(NULL, ":", &ptr);
+	}
+	return false;
+}
+
+int ensure_fusesquashfs_inside_container(const char *normal_dir)
+{
+	// check if we are running inside a container, systemd
+	// provides this file all the way back to trusty if run in a
+	// container
+	if (!file_exists("/run/systemd/container")) {
+		return 0;
+	}
+
+	const char *fstype;
+	if (executable_exists("squashfuse")) {
+		fstype = "fuse.squashfuse";
+	} else if (executable_exists("snapfuse")) {
+		fstype = "fuse.snapfuse";
+	} else {
+		fprintf(stderr,
+			"cannot find squashfuse or snapfuse executable\n");
+		return 2;
+	}
+
+	DIR *units_dir SC_CLEANUP(sc_cleanup_closedir) = NULL;
+	units_dir = opendir("/etc/systemd/system");
+	if (units_dir == NULL) {
+		// nothing to do
+		return 0;
+	}
+
+	char fname[PATH_MAX + 1] = { 0 };
+
+	struct dirent *ent;
+	while (ent = readdir(units_dir)) {
+		// find snap mount units, i.e:
+		// snap-somename.mount or var-lib-snapd-snap-somename.mount
+		if (!sc_endswith(ent->d_name, ".mount")) {
+			continue;
+		}
+		if (!(sc_startswith(ent->d_name, "snap-") || sc_startswith(ent->d_name, "var-lib-snapd-snap-"))) {
+			continue;
+		}
+		sc_must_snprintf(fname, sizeof fname,
+			"%s/%s.d", normal_dir, ent->d_name);
+		if (mkdir(fname, 0755) != 0) {
+			if (errno != EEXIST) {
+				fprintf(stderr,
+					"cannot create %s directory: %m\n", fname);
+				return 2;
+			}
+		}
+
+		sc_must_snprintf(fname, sizeof fname,
+			"%s/%s.d/container.conf", normal_dir, ent->d_name);
+
+		FILE *f SC_CLEANUP(sc_cleanup_file) = NULL;
+		f = fopen(fname, "w");
+		if (!f) {
+			fprintf(stderr, "cannot open %s: %m\n", fname);
+			return 2;
+		}
+		fprintf(f, "[Mount]\nType=%s\nOptions=nodev,ro,x-gdu.hide,allow_other\nLazyUnmount=yes\n", fstype);
+	}
+	
+	return 0;
+}
+
+int main(int argc, char **argv)
+{
+	if (argc != 4) {
+		printf("usage: snapd-generator normal-dir early-dir late-dir\n");
+		return 1;
+	}
+	const char *normal_dir = argv[1];
+	// For reference, but we don't use those variables here.
+	// const char *early_dir = argv[2];
+	// const char *late_dir = argv[3];
+
+	int status = 0;
+	status = ensure_root_fs_shared(normal_dir);
+	status |= ensure_fusesquashfs_inside_container(normal_dir);
+
+	return status;
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-exec/main.go snapd-2.48.3+20.04/cmd/snap-exec/main.go
--- snapd-2.45.1+20.04.2/cmd/snap-exec/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-exec/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -113,7 +113,7 @@
 		cmd = app.ReloadCommand
 	case "post-stop":
 		cmd = app.PostStopCommand
-	case "", "gdb":
+	case "", "gdb", "gdbserver":
 		cmd = app.Command
 	default:
 		return "", fmt.Errorf("cannot use %q command", command)
@@ -220,6 +220,9 @@
 	case "gdb":
 		fullCmd = append(fullCmd, fullCmd[0])
 		fullCmd[0] = filepath.Join(dirs.CoreLibExecDir, "snap-gdb-shim")
+	case "gdbserver":
+		fullCmd = append(fullCmd, fullCmd[0])
+		fullCmd[0] = filepath.Join(dirs.CoreLibExecDir, "snap-gdbserver-shim")
 	}
 	fullCmd = append(fullCmd, cmdArgs...)
 	fullCmd = append(fullCmd, args...)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-gdb-shim/snap-gdbserver-shim.c snapd-2.48.3+20.04/cmd/snap-gdb-shim/snap-gdbserver-shim.c
--- snapd-2.45.1+20.04.2/cmd/snap-gdb-shim/snap-gdbserver-shim.c	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-gdb-shim/snap-gdbserver-shim.c	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "../libsnap-confine-private/utils.h"
+
+int main(int argc, char **argv) {
+    if (sc_is_debug_enabled()) {
+        for (int i = 0; i < argc; i++) {
+            fprintf(stderr, "-%s-\n", argv[i]);
+        }
+    }
+    if (argc < 2) {
+        fprintf(stderr, "missing a command to execute");
+        abort();
+    }
+    // Signal to "snap run" that we are ready to get a debugger attached. When a
+    // debugger gets attached it will stop the binary at whatever point the
+    // binary is executing. So we cannot have clever code here that e.g. waits
+    // for a debugger to get attached because that code would also get
+    // stoppped/debugged by that debugger and that would be confusing for the
+    // user.
+    //
+    // once a debugger is attached we expect it to send:
+    //  "continue; signal SIGCONT"
+    raise(SIGSTOP);
+
+    // signal gdb to stop here
+    printf("\n\n");
+    printf("THIS OPTION IS EXPERIMENTAL\n\n");
+    printf("Welcome to `snap run --gdb`.\n");
+    printf("You are right before your application is execed():\n");
+    printf("- set any options you may need\n");
+    printf("- (optionally) set a breakpoint in 'main'\n");
+    printf("- use 'cont' to start\n");
+    printf("\n\n");
+    raise(SIGTRAP);
+
+    const char *executable = argv[1];
+    execv(executable, (char *const *)&argv[1]);
+    perror("execv failed");
+    // very different exit code to make an execve failure easy to distinguish
+    return 101;
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-gdb-shim/snap-gdb-shim.c snapd-2.48.3+20.04/cmd/snap-gdb-shim/snap-gdb-shim.c
--- snapd-2.45.1+20.04.2/cmd/snap-gdb-shim/snap-gdb-shim.c	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-gdb-shim/snap-gdb-shim.c	2021-02-02 08:21:12.000000000 +0000
@@ -22,25 +22,28 @@
 
 #include "../libsnap-confine-private/utils.h"
 
-int main(int argc, char **argv)
-{
-	if (sc_is_debug_enabled()) {
-		for (int i = 0; i < argc; i++) {
-			printf("-%s-\n", argv[i]);
-		}
-	}
-	// signal gdb to stop here
-	printf("\n\n");
-	printf("Welcome to `snap run --gdb`.\n");
-	printf("You are right before your application is execed():\n");
-	printf("- set any options you may need\n");
-	printf("- use 'cont' to start\n");
-	printf("\n\n");
-	raise(SIGTRAP);
+int main(int argc, char **argv) {
+    if (sc_is_debug_enabled()) {
+        for (int i = 0; i < argc; i++) {
+            fprintf(stderr, "-%s-\n", argv[i]);
+        }
+    }
+    if (argc < 2) {
+        fprintf(stderr, "missing a command to execute");
+        abort();
+    }
+    // signal gdb to stop here
+    printf("\n\n");
+    printf("Welcome to `snap run --gdb`.\n");
+    printf("You are right before your application is execed():\n");
+    printf("- set any options you may need\n");
+    printf("- use 'cont' to start\n");
+    printf("\n\n");
+    raise(SIGTRAP);
 
-	const char *executable = argv[1];
-	execv(executable, (char *const *)&argv[1]);
-	perror("execv failed");
-	// very different exit code to make an execve failure easy to distinguish
-	return 101;
+    const char *executable = argv[1];
+    execv(executable, (char *const *)&argv[1]);
+    perror("execv failed");
+    // very different exit code to make an execve failure easy to distinguish
+    return 101;
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snapinfo.go snapd-2.48.3+20.04/cmd/snapinfo.go
--- snapd-2.45.1+20.04.2/cmd/snapinfo.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snapinfo.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,199 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd
-
-import (
-	"fmt"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/progress"
-	"github.com/snapcore/snapd/snap"
-	"github.com/snapcore/snapd/systemd"
-)
-
-func ClientSnapFromSnapInfo(snapInfo *snap.Info) (*client.Snap, error) {
-	var publisher *snap.StoreAccount
-	if snapInfo.Publisher.Username != "" {
-		publisher = &snapInfo.Publisher
-	}
-
-	confinement := snapInfo.Confinement
-	if confinement == "" {
-		confinement = snap.StrictConfinement
-	}
-
-	snapapps := make([]*snap.AppInfo, 0, len(snapInfo.Apps))
-	for _, app := range snapInfo.Apps {
-		snapapps = append(snapapps, app)
-	}
-	sort.Sort(BySnapApp(snapapps))
-
-	apps, err := ClientAppInfosFromSnapAppInfos(snapapps)
-	result := &client.Snap{
-		Description: snapInfo.Description(),
-		Developer:   snapInfo.Publisher.Username,
-		Publisher:   publisher,
-		Icon:        snapInfo.Media.IconURL(),
-		ID:          snapInfo.SnapID,
-		InstallDate: snapInfo.InstallDate(),
-		Name:        snapInfo.InstanceName(),
-		Revision:    snapInfo.Revision,
-		Summary:     snapInfo.Summary(),
-		Type:        string(snapInfo.GetType()),
-		Base:        snapInfo.Base,
-		Version:     snapInfo.Version,
-		Channel:     snapInfo.Channel,
-		Private:     snapInfo.Private,
-		Confinement: string(confinement),
-		Apps:        apps,
-		Broken:      snapInfo.Broken,
-		Contact:     snapInfo.Contact,
-		Title:       snapInfo.Title(),
-		License:     snapInfo.License,
-		Media:       snapInfo.Media,
-		Prices:      snapInfo.Prices,
-		Channels:    snapInfo.Channels,
-		Tracks:      snapInfo.Tracks,
-		CommonIDs:   snapInfo.CommonIDs,
-		Website:     snapInfo.Website,
-		StoreURL:    snapInfo.StoreURL,
-	}
-
-	return result, err
-}
-
-func ClientAppInfoNotes(app *client.AppInfo) string {
-	if !app.IsService() {
-		return "-"
-	}
-
-	var notes = make([]string, 0, 2)
-	var seenTimer, seenSocket bool
-	for _, act := range app.Activators {
-		switch act.Type {
-		case "timer":
-			seenTimer = true
-		case "socket":
-			seenSocket = true
-		}
-	}
-	if seenTimer {
-		notes = append(notes, "timer-activated")
-	}
-	if seenSocket {
-		notes = append(notes, "socket-activated")
-	}
-	if len(notes) == 0 {
-		return "-"
-	}
-	return strings.Join(notes, ",")
-}
-
-// BySnapApp sorts apps by (snap name, app name)
-type BySnapApp []*snap.AppInfo
-
-func (a BySnapApp) Len() int      { return len(a) }
-func (a BySnapApp) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
-func (a BySnapApp) Less(i, j int) bool {
-	iName := a[i].Snap.InstanceName()
-	jName := a[j].Snap.InstanceName()
-	if iName == jName {
-		return a[i].Name < a[j].Name
-	}
-	return iName < jName
-}
-
-func ClientAppInfosFromSnapAppInfos(apps []*snap.AppInfo) ([]client.AppInfo, error) {
-	// TODO: pass in an actual notifier here instead of null
-	//       (Status doesn't _need_ it, but benefits from it)
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, progress.Null)
-
-	out := make([]client.AppInfo, 0, len(apps))
-	for _, app := range apps {
-		appInfo := client.AppInfo{
-			Snap:     app.Snap.InstanceName(),
-			Name:     app.Name,
-			CommonID: app.CommonID,
-		}
-		if fn := app.DesktopFile(); osutil.FileExists(fn) {
-			appInfo.DesktopFile = fn
-		}
-
-		appInfo.Daemon = app.Daemon
-		if !app.IsService() || !app.Snap.IsActive() {
-			out = append(out, appInfo)
-			continue
-		}
-
-		// collect all services for a single call to systemctl
-		serviceNames := make([]string, 0, 1+len(app.Sockets)+1)
-		serviceNames = append(serviceNames, app.ServiceName())
-
-		sockSvcFileToName := make(map[string]string, len(app.Sockets))
-		for _, sock := range app.Sockets {
-			sockUnit := filepath.Base(sock.File())
-			sockSvcFileToName[sockUnit] = sock.Name
-			serviceNames = append(serviceNames, sockUnit)
-		}
-		if app.Timer != nil {
-			timerUnit := filepath.Base(app.Timer.File())
-			serviceNames = append(serviceNames, timerUnit)
-		}
-
-		// sysd.Status() makes sure that we get only the units we asked
-		// for and raises an error otherwise
-		sts, err := sysd.Status(serviceNames...)
-		if err != nil {
-			return nil, fmt.Errorf("cannot get status of services of app %q: %v", app.Name, err)
-		}
-		if len(sts) != len(serviceNames) {
-			return nil, fmt.Errorf("cannot get status of services of app %q: expected %v results, got %v", app.Name, len(serviceNames), len(sts))
-		}
-		for _, st := range sts {
-			switch filepath.Ext(st.UnitName) {
-			case ".service":
-				appInfo.Enabled = st.Enabled
-				appInfo.Active = st.Active
-			case ".timer":
-				appInfo.Activators = append(appInfo.Activators, client.AppActivator{
-					Name:    app.Name,
-					Enabled: st.Enabled,
-					Active:  st.Active,
-					Type:    "timer",
-				})
-			case ".socket":
-				appInfo.Activators = append(appInfo.Activators, client.AppActivator{
-					Name:    sockSvcFileToName[st.UnitName],
-					Enabled: st.Enabled,
-					Active:  st.Active,
-					Type:    "socket",
-				})
-			}
-		}
-		out = append(out, appInfo)
-	}
-
-	return out, nil
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snapinfo_test.go snapd-2.48.3+20.04/cmd/snapinfo_test.go
--- snapd-2.45.1+20.04.2/cmd/snapinfo_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snapinfo_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,82 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd_test
-
-import (
-	"gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
-	"github.com/snapcore/snapd/snap"
-)
-
-func (*cmdSuite) TestC2S(c *check.C) {
-	// TODO: add moar fields!
-	si := &snap.Info{
-		Website: "http://example.com/xyzzy",
-	}
-	ci, err := cmd.ClientSnapFromSnapInfo(si)
-	c.Check(err, check.IsNil)
-	c.Check(ci.Website, check.Equals, si.Website)
-}
-
-func (*cmdSuite) TestAppStatusNotes(c *check.C) {
-	ai := client.AppInfo{}
-	c.Check(cmd.ClientAppInfoNotes(&ai), check.Equals, "-")
-
-	ai = client.AppInfo{
-		Daemon: "oneshot",
-	}
-	c.Check(cmd.ClientAppInfoNotes(&ai), check.Equals, "-")
-
-	ai = client.AppInfo{
-		Daemon: "oneshot",
-		Activators: []client.AppActivator{
-			{Type: "timer"},
-		},
-	}
-	c.Check(cmd.ClientAppInfoNotes(&ai), check.Equals, "timer-activated")
-
-	ai = client.AppInfo{
-		Daemon: "oneshot",
-		Activators: []client.AppActivator{
-			{Type: "socket"},
-		},
-	}
-	c.Check(cmd.ClientAppInfoNotes(&ai), check.Equals, "socket-activated")
-
-	// check that the output is stable regardless of the order of activators
-	ai = client.AppInfo{
-		Daemon: "oneshot",
-		Activators: []client.AppActivator{
-			{Type: "timer"},
-			{Type: "socket"},
-		},
-	}
-	c.Check(cmd.ClientAppInfoNotes(&ai), check.Equals, "timer-activated,socket-activated")
-	ai = client.AppInfo{
-		Daemon: "oneshot",
-		Activators: []client.AppActivator{
-			{Type: "socket"},
-			{Type: "timer"},
-		},
-	}
-	c.Check(cmd.ClientAppInfoNotes(&ai), check.Equals, "timer-activated,socket-activated")
-}
diff -Nru snapd-2.45.1+20.04.2/cmd/snaplock/runinhibit/inhibit.go snapd-2.48.3+20.04/cmd/snaplock/runinhibit/inhibit.go
--- snapd-2.45.1+20.04.2/cmd/snaplock/runinhibit/inhibit.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snaplock/runinhibit/inhibit.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,154 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Package runinhibit contains operations for establishing, removing and
+// querying snap run inhibition lock.
+package runinhibit
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+)
+
+// defaultInhibitDir is the directory where inhibition files are stored.
+const defaultInhibitDir = "/var/lib/snapd/inhibit"
+
+// InhibitDir is the directory where inhibition files are stored.
+// This value can be changed by calling dirs.SetRootDir.
+var InhibitDir = defaultInhibitDir
+
+func init() {
+	dirs.AddRootDirCallback(func(root string) {
+		InhibitDir = filepath.Join(root, defaultInhibitDir)
+	})
+}
+
+// Hint is a string representing reason for the inhibition of "snap run".
+type Hint string
+
+const (
+	// HintNotInhibited is used when "snap run" is not inhibited.
+	HintNotInhibited Hint = ""
+	// HintInhibitedForRefresh represents inhibition of a "snap run" while a refresh change is being performed.
+	HintInhibitedForRefresh Hint = "refresh"
+)
+
+func hintFile(snapName string) string {
+	return filepath.Join(InhibitDir, snapName+".lock")
+}
+
+func openHintFileLock(snapName string) (*osutil.FileLock, error) {
+	return osutil.NewFileLockWithMode(hintFile(snapName), 0644)
+}
+
+// LockWithHint sets a persistent "snap run" inhibition lock, for the given snap, with a given hint.
+//
+// The hint cannot be empty. It should be one of the Hint constants defined in
+// this package. With the hint in place "snap run" will not allow the snap to
+// start and will block, presenting a user interface if possible.
+func LockWithHint(snapName string, hint Hint) error {
+	if len(hint) == 0 {
+		return fmt.Errorf("lock hint cannot be empty")
+	}
+	if err := os.MkdirAll(InhibitDir, 0755); err != nil {
+		return err
+	}
+	flock, err := openHintFileLock(snapName)
+	if err != nil {
+		return err
+	}
+	defer flock.Close()
+
+	if err := flock.Lock(); err != nil {
+		return err
+	}
+	f := flock.File()
+	if err := f.Truncate(0); err != nil {
+		return err
+	}
+	_, err = f.WriteString(string(hint))
+	return err
+}
+
+// Unlock truncates the run inhibition lock, for the given snap.
+//
+// An empty inhibition lock means uninhibited "snap run".
+func Unlock(snapName string) error {
+	flock, err := openHintFileLock(snapName)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	defer flock.Close()
+
+	if err := flock.Lock(); err != nil {
+		return err
+	}
+	f := flock.File()
+	return f.Truncate(0)
+}
+
+// IsLocked returns the state of the run inhibition lock for the given snap.
+//
+// It returns the current, non-empty hit if inhibition is in place. Otherwise
+// it returns an empty hint.
+func IsLocked(snapName string) (Hint, error) {
+	fname := filepath.Join(InhibitDir, snapName+".lock")
+	flock, err := osutil.OpenExistingLockForReading(fname)
+	if os.IsNotExist(err) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	defer flock.Close()
+
+	if err := flock.ReadLock(); err != nil {
+		return "", err
+	}
+
+	buf, err := ioutil.ReadAll(flock.File())
+	if err != nil {
+		return "", err
+	}
+	return Hint(string(buf)), nil
+}
+
+// RemoveLockFile removes the run inhibition lock for the given snap.
+//
+// This function should not be used as a substitute of Unlock, as race-free
+// ability to inspect the inhibition state relies on flock(2) which requires the
+// file to exist in the first place and non-privileged processes cannot create
+// it.
+//
+// The function does not fail if the inhibition lock does not exist.
+func RemoveLockFile(snapName string) error {
+	err := os.Remove(hintFile(snapName))
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snaplock/runinhibit/inhibit_test.go snapd-2.48.3+20.04/cmd/snaplock/runinhibit/inhibit_test.go
--- snapd-2.45.1+20.04.2/cmd/snaplock/runinhibit/inhibit_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snaplock/runinhibit/inhibit_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,156 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package runinhibit_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/testutil"
+)
+
+// Hook up check.v1 into the "go test" runner
+func Test(t *testing.T) { TestingT(t) }
+
+type runInhibitSuite struct{}
+
+var _ = Suite(&runInhibitSuite{})
+
+func (s *runInhibitSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+}
+
+func (s *runInhibitSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("")
+}
+
+// Locking cannot be done with an empty hint as that is equivalent to unlocking.
+func (s *runInhibitSuite) TestLockWithEmptyHint(c *C) {
+	_, err := os.Stat(runinhibit.InhibitDir)
+	c.Assert(os.IsNotExist(err), Equals, true)
+
+	err = runinhibit.LockWithHint("pkg", runinhibit.HintNotInhibited)
+	c.Assert(err, ErrorMatches, "lock hint cannot be empty")
+
+	_, err = os.Stat(runinhibit.InhibitDir)
+	c.Assert(os.IsNotExist(err), Equals, true)
+}
+
+// Locking a file creates required directories and writes the hint file.
+func (s *runInhibitSuite) TestLockWithHint(c *C) {
+	_, err := os.Stat(runinhibit.InhibitDir)
+	c.Assert(os.IsNotExist(err), Equals, true)
+
+	err = runinhibit.LockWithHint("pkg", runinhibit.HintInhibitedForRefresh)
+	c.Assert(err, IsNil)
+
+	fi, err := os.Stat(runinhibit.InhibitDir)
+	c.Assert(err, IsNil)
+	c.Check(fi.IsDir(), Equals, true)
+
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileEquals, "refresh")
+}
+
+// The lock can be re-acquired to present a different hint.
+func (s *runInhibitSuite) TestLockLocked(c *C) {
+	err := runinhibit.LockWithHint("pkg", runinhibit.HintInhibitedForRefresh)
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileEquals, "refresh")
+
+	err = runinhibit.LockWithHint("pkg", runinhibit.Hint("just-testing"))
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileEquals, "just-testing")
+
+	err = runinhibit.LockWithHint("pkg", runinhibit.Hint("short"))
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileEquals, "short")
+}
+
+// Unlocking an unlocked lock doesn't break anything.
+func (s *runInhibitSuite) TestUnlockUnlocked(c *C) {
+	err := runinhibit.Unlock("pkg")
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileAbsent)
+}
+
+// Unlocking an locked lock truncates the hint.
+func (s *runInhibitSuite) TestUnlockLocked(c *C) {
+	err := runinhibit.LockWithHint("pkg", runinhibit.HintInhibitedForRefresh)
+	c.Assert(err, IsNil)
+
+	err = runinhibit.Unlock("pkg")
+	c.Assert(err, IsNil)
+
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileEquals, "")
+}
+
+// IsLocked doesn't fail when the lock directory or lock file is missing.
+func (s *runInhibitSuite) TestIsLockedMissing(c *C) {
+	_, err := os.Stat(runinhibit.InhibitDir)
+	c.Assert(os.IsNotExist(err), Equals, true)
+
+	hint, err := runinhibit.IsLocked("pkg")
+	c.Assert(err, IsNil)
+	c.Check(hint, Equals, runinhibit.HintNotInhibited)
+
+	err = os.MkdirAll(runinhibit.InhibitDir, 0755)
+	c.Assert(err, IsNil)
+
+	hint, err = runinhibit.IsLocked("pkg")
+	c.Assert(err, IsNil)
+	c.Check(hint, Equals, runinhibit.HintNotInhibited)
+}
+
+// IsLocked returns the previously set hint.
+func (s *runInhibitSuite) TestIsLockedLocked(c *C) {
+	err := runinhibit.LockWithHint("pkg", runinhibit.HintInhibitedForRefresh)
+	c.Assert(err, IsNil)
+
+	hint, err := runinhibit.IsLocked("pkg")
+	c.Assert(err, IsNil)
+	c.Check(hint, Equals, runinhibit.HintInhibitedForRefresh)
+}
+
+// IsLocked returns not-inhibited after unlocking.
+func (s *runInhibitSuite) TestIsLockedUnlocked(c *C) {
+	err := runinhibit.LockWithHint("pkg", runinhibit.HintInhibitedForRefresh)
+	c.Assert(err, IsNil)
+	err = runinhibit.Unlock("pkg")
+	c.Assert(err, IsNil)
+
+	hint, err := runinhibit.IsLocked("pkg")
+	c.Assert(err, IsNil)
+	c.Check(hint, Equals, runinhibit.HintNotInhibited)
+}
+
+func (s *runInhibitSuite) TestRemoveLockFile(c *C) {
+	c.Assert(runinhibit.LockWithHint("pkg", runinhibit.HintInhibitedForRefresh), IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FilePresent)
+
+	c.Assert(runinhibit.RemoveLockFile("pkg"), IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "pkg.lock"), testutil.FileAbsent)
+	// Removing an absent lock file is not an error.
+	c.Assert(runinhibit.RemoveLockFile("pkg"), IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-mgmt/snap-mgmt.sh.in snapd-2.48.3+20.04/cmd/snap-mgmt/snap-mgmt.sh.in
--- snapd-2.45.1+20.04.2/cmd/snap-mgmt/snap-mgmt.sh.in	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-mgmt/snap-mgmt.sh.in	2021-02-02 08:21:12.000000000 +0000
@@ -106,11 +106,19 @@
                 if [ -d /etc/dbus-1/system.d ]; then
                     find /etc/dbus-1/system.d -name "snap.${snap}.*.conf" -execdir rm -f "{}" \;
                 fi
+                # modules
+                rm -f "/etc/modules-load.d/snap.${snap}.conf"
                 # timer and socket units
                 find /etc/systemd/system -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" | while read -r f; do
                     systemctl_stop "$(basename "$f")"
                     rm -f "$f"
                 done
+                # user services, sockets, and timers - we make no attempt to stop any of them.
+                # TODO: ask snapd to ask each snapd.session-agent.service to stop snaps
+                # user-session services and stop itself.
+                find /etc/systemd/user -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" -o -name "snap.${snap}.*.service" | while read -r f; do
+                    rm -f "$f"
+                done
             fi
         fi
 
@@ -119,6 +127,15 @@
         rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
     done
 
+    # snapd session-agent
+    rm -f /etc/systemd/user/snapd.session-agent.socket
+    rm -f /etc/systemd/user/snapd.session-agent.service
+    rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+
+    # dbus activation configuration
+    rm -f /etc/dbus-1/session.d/snapd.session-services.conf
+    rm -f /etc/dbus-1/system.d/snapd.system-services.conf
+
     echo "Discarding preserved snap namespaces"
     # opportunistic as those might not be actually mounted
     if [ -d /run/snapd/ns ]; then
@@ -152,6 +169,7 @@
     rm -rf /var/lib/snapd/mount/*
     rm -rf /var/lib/snapd/sequence/*
     rm -rf /var/lib/snapd/apparmor/*
+    rm -rf /var/lib/snapd/inhibit/*
     rm -f /var/lib/snapd/state.json
     rm -f /var/lib/snapd/system-key
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-preseed/export_test.go snapd-2.48.3+20.04/cmd/snap-preseed/export_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-preseed/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-preseed/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,9 +24,9 @@
 )
 
 var (
-	Run                     = run
-	SystemSnapFromSeed      = systemSnapFromSeed
-	CheckTargetSnapdVersion = checkTargetSnapdVersion
+	Run                      = run
+	SystemSnapFromSeed       = systemSnapFromSeed
+	ChooseTargetSnapdVersion = chooseTargetSnapdVersion
 )
 
 func MockOsGetuid(f func() int) (restore func()) {
@@ -60,3 +60,7 @@
 		seedOpen = oldSeedOpen
 	}
 }
+
+func SnapdPathAndVersion(targetSnapd *targetSnapdInfo) (string, string) {
+	return targetSnapd.path, targetSnapd.version
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-preseed/main.go snapd-2.48.3+20.04/cmd/snap-preseed/main.go
--- snapd-2.45.1+20.04.2/cmd/snap-preseed/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-preseed/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,7 @@
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 
 	"github.com/jessevdk/go-flags"
 )
@@ -80,7 +81,11 @@
 		return fmt.Errorf("need chroot path as argument")
 	}
 
-	chrootDir := rest[0]
+	chrootDir, err := filepath.Abs(rest[0])
+	if err != nil {
+		return err
+	}
+
 	// safety check
 	if chrootDir == "/" {
 		return fmt.Errorf("cannot run snap-preseed against /")
@@ -94,13 +99,13 @@
 		return err
 	}
 
-	cleanup, err := prepareChroot(chrootDir)
+	targetSnapd, cleanup, err := prepareChroot(chrootDir)
 	if err != nil {
 		return err
 	}
 
 	// executing inside the chroot
-	err = runPreseedMode(chrootDir)
+	err = runPreseedMode(chrootDir, targetSnapd)
 	cleanup()
 	return err
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-preseed/main_test.go snapd-2.48.3+20.04/cmd/snap-preseed/main_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-preseed/main_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-preseed/main_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -24,6 +24,7 @@
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"testing"
 
@@ -35,6 +36,7 @@
 	"github.com/snapcore/snapd/cmd/snap-preseed"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/squashfs"
 	apparmor_sandbox "github.com/snapcore/snapd/sandbox/apparmor"
 	"github.com/snapcore/snapd/seed"
 	"github.com/snapcore/snapd/snap"
@@ -52,6 +54,8 @@
 
 func (s *startPreseedSuite) SetUpTest(c *C) {
 	s.BaseTest.SetUpTest(c)
+	restore := squashfs.MockNeedsFuse(false)
+	s.BaseTest.AddCleanup(restore)
 }
 
 func (s *startPreseedSuite) TearDownTest(c *C) {
@@ -66,10 +70,24 @@
 	return parser
 }
 
-func mockChrootDirs(c *C, rootDir string) {
-	c.Assert(os.MkdirAll(filepath.Join(rootDir, "/sys/kernel/security/apparmor"), 0755), IsNil)
-	c.Assert(os.MkdirAll(filepath.Join(rootDir, "/proc/self"), 0755), IsNil)
-	c.Assert(os.MkdirAll(filepath.Join(rootDir, "/dev/mem"), 0755), IsNil)
+func mockVersionFiles(c *C, rootDir1, version1, rootDir2, version2 string) {
+	versions := []string{version1, version2}
+	for i, root := range []string{rootDir1, rootDir2} {
+		c.Assert(os.MkdirAll(filepath.Join(root, dirs.CoreLibExecDir), 0755), IsNil)
+		infoFile := filepath.Join(root, dirs.CoreLibExecDir, "info")
+		c.Assert(ioutil.WriteFile(infoFile, []byte(fmt.Sprintf("VERSION=%s", versions[i])), 0644), IsNil)
+	}
+}
+
+func mockChrootDirs(c *C, rootDir string, apparmorDir bool) func() {
+	if apparmorDir {
+		c.Assert(os.MkdirAll(filepath.Join(rootDir, "/sys/kernel/security/apparmor"), 0755), IsNil)
+	}
+	mockMountInfo := `912 920 0:57 / ${rootDir}/proc rw,nosuid,nodev,noexec,relatime - proc proc rw
+914 913 0:7 / ${rootDir}/sys/kernel/security rw,nosuid,nodev,noexec,relatime master:8 - securityfs securityfs rw
+915 920 0:58 / ${rootDir}/dev rw,relatime - tmpfs none rw,size=492k,mode=755,uid=100000,gid=100000
+`
+	return osutil.MockMountInfo(strings.Replace(mockMountInfo, "${rootDir}", rootDir, -1))
 }
 
 func (s *startPreseedSuite) TestRequiresRoot(c *C) {
@@ -105,9 +123,21 @@
 	defer restore()
 
 	tmpDir := c.MkDir()
+	defer osutil.MockMountInfo("")()
+
+	parser := testParser(c)
+	c.Check(main.Run(parser, []string{tmpDir}), ErrorMatches, "cannot preseed without the following mountpoints:\n - .*/dev\n - .*/proc\n - .*/sys/kernel/security")
+}
+
+func (s *startPreseedSuite) TestChrootValidationUnhappyNoApparmor(c *C) {
+	restore := main.MockOsGetuid(func() int { return 0 })
+	defer restore()
+
+	tmpDir := c.MkDir()
+	defer mockChrootDirs(c, tmpDir, false)()
 
 	parser := testParser(c)
-	c.Check(main.Run(parser, []string{tmpDir}), ErrorMatches, `cannot pre-seed without access to ".*sys/kernel/security/apparmor"`)
+	c.Check(main.Run(parser, []string{tmpDir}), ErrorMatches, `cannot preseed without access to ".*sys/kernel/security/apparmor"`)
 }
 
 func (s *startPreseedSuite) TestChrootValidationAlreadyPreseeded(c *C) {
@@ -133,7 +163,7 @@
 	defer restoreSyscallChroot()
 
 	tmpDir := c.MkDir()
-	mockChrootDirs(c, tmpDir)
+	defer mockChrootDirs(c, tmpDir, true)()
 
 	parser := testParser(c)
 	c.Check(main.Run(parser, []string{tmpDir}), ErrorMatches, fmt.Sprintf("cannot chroot into %s: FAIL: %s", tmpDir, tmpDir))
@@ -142,7 +172,7 @@
 func (s *startPreseedSuite) TestRunPreseedHappy(c *C) {
 	tmpDir := c.MkDir()
 	dirs.SetRootDir(tmpDir)
-	mockChrootDirs(c, tmpDir)
+	defer mockChrootDirs(c, tmpDir, true)()
 
 	restoreOsGuid := main.MockOsGetuid(func() int { return 0 })
 	defer restoreOsGuid()
@@ -163,7 +193,6 @@
 	restoreSystemSnapFromSeed := main.MockSystemSnapFromSeed(func(string) (string, error) { return "/a/core.snap", nil })
 	defer restoreSystemSnapFromSeed()
 
-	c.Assert(os.MkdirAll(filepath.Join(targetSnapdRoot, "usr/lib/snapd/"), 0755), IsNil)
 	mockTargetSnapd := testutil.MockCommand(c, filepath.Join(targetSnapdRoot, "usr/lib/snapd/snapd"), `#!/bin/sh
 	if [ "$SNAPD_PRESEED" != "1" ]; then
 		exit 1
@@ -171,8 +200,13 @@
 `)
 	defer mockTargetSnapd.Restore()
 
-	infoFile := filepath.Join(filepath.Join(targetSnapdRoot, dirs.CoreLibExecDir, "info"))
-	c.Assert(ioutil.WriteFile(infoFile, []byte("VERSION=2.44.0"), 0644), IsNil)
+	mockSnapdFromDeb := testutil.MockCommand(c, filepath.Join(tmpDir, "usr/lib/snapd/snapd"), `#!/bin/sh
+	exit 1
+`)
+	defer mockSnapdFromDeb.Restore()
+
+	// snapd from the snap is newer than deb
+	mockVersionFiles(c, targetSnapdRoot, "2.44.0", tmpDir, "2.41.0")
 
 	parser := testParser(c)
 	c.Check(main.Run(parser, []string{tmpDir}), IsNil)
@@ -180,10 +214,75 @@
 	c.Assert(mockMountCmd.Calls(), HasLen, 1)
 	// note, tmpDir, targetSnapdRoot are contactenated again cause we're not really chrooting in the test
 	// and mocking dirs.RootDir
-	c.Check(mockMountCmd.Calls()[0], DeepEquals, []string{"mount", "-t", "squashfs", "/a/core.snap", filepath.Join(tmpDir, targetSnapdRoot)})
+	c.Check(mockMountCmd.Calls()[0], DeepEquals, []string{"mount", "-t", "squashfs", "-o", "ro,x-gdu.hide", "/a/core.snap", filepath.Join(tmpDir, targetSnapdRoot)})
 
 	c.Assert(mockTargetSnapd.Calls(), HasLen, 1)
 	c.Check(mockTargetSnapd.Calls()[0], DeepEquals, []string{"snapd"})
+
+	c.Assert(mockSnapdFromDeb.Calls(), HasLen, 0)
+
+	// relative chroot path works too
+	tmpDirPath, relativeChroot := filepath.Split(tmpDir)
+	pwd, err := os.Getwd()
+	c.Assert(err, IsNil)
+	defer func() {
+		os.Chdir(pwd)
+	}()
+	c.Assert(os.Chdir(tmpDirPath), IsNil)
+	c.Check(main.Run(parser, []string{relativeChroot}), IsNil)
+}
+
+func (s *startPreseedSuite) TestRunPreseedHappyDebVersionIsNewer(c *C) {
+	tmpDir := c.MkDir()
+	dirs.SetRootDir(tmpDir)
+	defer mockChrootDirs(c, tmpDir, true)()
+
+	restoreOsGuid := main.MockOsGetuid(func() int { return 0 })
+	defer restoreOsGuid()
+
+	restoreSyscallChroot := main.MockSyscallChroot(func(path string) error { return nil })
+	defer restoreSyscallChroot()
+
+	mockMountCmd := testutil.MockCommand(c, "mount", "")
+	defer mockMountCmd.Restore()
+
+	mockUmountCmd := testutil.MockCommand(c, "umount", "")
+	defer mockUmountCmd.Restore()
+
+	targetSnapdRoot := filepath.Join(tmpDir, "target-core-mounted-here")
+	restoreMountPath := main.MockSnapdMountPath(targetSnapdRoot)
+	defer restoreMountPath()
+
+	restoreSystemSnapFromSeed := main.MockSystemSnapFromSeed(func(string) (string, error) { return "/a/core.snap", nil })
+	defer restoreSystemSnapFromSeed()
+
+	c.Assert(os.MkdirAll(filepath.Join(targetSnapdRoot, "usr/lib/snapd/"), 0755), IsNil)
+	mockSnapdFromSnap := testutil.MockCommand(c, filepath.Join(targetSnapdRoot, "usr/lib/snapd/snapd"), `#!/bin/sh
+	exit 1
+`)
+	defer mockSnapdFromSnap.Restore()
+
+	mockSnapdFromDeb := testutil.MockCommand(c, filepath.Join(tmpDir, "usr/lib/snapd/snapd"), `#!/bin/sh
+	if [ "$SNAPD_PRESEED" != "1" ]; then
+		exit 1
+	fi
+`)
+	defer mockSnapdFromDeb.Restore()
+
+	// snapd from the deb is newer than snap
+	mockVersionFiles(c, targetSnapdRoot, "2.44.0", tmpDir, "2.45.0")
+
+	parser := testParser(c)
+	c.Check(main.Run(parser, []string{tmpDir}), IsNil)
+
+	c.Assert(mockMountCmd.Calls(), HasLen, 1)
+	// note, tmpDir, targetSnapdRoot are contactenated again cause we're not really chrooting in the test
+	// and mocking dirs.RootDir
+	c.Check(mockMountCmd.Calls()[0], DeepEquals, []string{"mount", "-t", "squashfs", "-o", "ro,x-gdu.hide", "/a/core.snap", filepath.Join(tmpDir, targetSnapdRoot)})
+
+	c.Assert(mockSnapdFromDeb.Calls(), HasLen, 1)
+	c.Check(mockSnapdFromDeb.Calls()[0], DeepEquals, []string{"snapd"})
+	c.Assert(mockSnapdFromSnap.Calls(), HasLen, 0)
 }
 
 type Fake16Seed struct {
@@ -213,8 +312,8 @@
 	return fs.LoadAssertionsErr
 }
 
-func (fs *Fake16Seed) Model() (*asserts.Model, error) {
-	return fs.AssertsModel, nil
+func (fs *Fake16Seed) Model() *asserts.Model {
+	return fs.AssertsModel
 }
 
 func (fs *Fake16Seed) Brand() (*asserts.Account, error) {
@@ -342,7 +441,8 @@
 func (s *startPreseedSuite) TestRunPreseedUnsupportedVersion(c *C) {
 	tmpDir := c.MkDir()
 	dirs.SetRootDir(tmpDir)
-	mockChrootDirs(c, tmpDir)
+	c.Assert(os.MkdirAll(filepath.Join(tmpDir, "usr/lib/snapd/"), 0755), IsNil)
+	defer mockChrootDirs(c, tmpDir, true)()
 
 	restoreOsGuid := main.MockOsGetuid(func() int { return 0 })
 	defer restoreOsGuid()
@@ -367,19 +467,93 @@
 	infoFile := filepath.Join(targetSnapdRoot, dirs.CoreLibExecDir, "info")
 	c.Assert(ioutil.WriteFile(infoFile, []byte("VERSION=2.43.0"), 0644), IsNil)
 
+	// simulate snapd version from the deb
+	infoFile = filepath.Join(filepath.Join(tmpDir, dirs.CoreLibExecDir, "info"))
+	c.Assert(ioutil.WriteFile(infoFile, []byte("VERSION=2.41.0"), 0644), IsNil)
+
 	parser := testParser(c)
 	c.Check(main.Run(parser, []string{tmpDir}), ErrorMatches,
 		`snapd 2.43.0 from the target system does not support preseeding, the minimum required version is 2.43.3\+`)
 }
 
-func (s *startPreseedSuite) TestVersionCheckWithGitVer(c *C) {
+func (s *startPreseedSuite) TestChooseTargetSnapdVersion(c *C) {
 	tmpDir := c.MkDir()
 	dirs.SetRootDir(tmpDir)
+	c.Assert(os.MkdirAll(filepath.Join(tmpDir, "usr/lib/snapd/"), 0755), IsNil)
 
-	infoFile := filepath.Join(tmpDir, "info")
-	c.Assert(ioutil.WriteFile(infoFile, []byte("VERSION=2.43.3+git123"), 0644), IsNil)
+	targetSnapdRoot := filepath.Join(tmpDir, "target-core-mounted-here")
+	c.Assert(os.MkdirAll(filepath.Join(targetSnapdRoot, "usr/lib/snapd/"), 0755), IsNil)
+	restoreMountPath := main.MockSnapdMountPath(targetSnapdRoot)
+	defer restoreMountPath()
 
-	c.Check(main.CheckTargetSnapdVersion(infoFile), IsNil)
+	var versions = []struct {
+		fromSnap        string
+		fromDeb         string
+		expectedPath    string
+		expectedVersion string
+		expectedErr     string
+	}{
+		{
+			fromDeb:  "2.44.0",
+			fromSnap: "2.45.3+git123",
+			// snap version wins
+			expectedVersion: "2.45.3+git123",
+			expectedPath:    filepath.Join(tmpDir, "target-core-mounted-here/usr/lib/snapd/snapd"),
+		},
+		{
+			fromDeb:  "2.44.0",
+			fromSnap: "2.44.0",
+			// snap version wins
+			expectedVersion: "2.44.0",
+			expectedPath:    filepath.Join(tmpDir, "target-core-mounted-here/usr/lib/snapd/snapd"),
+		},
+		{
+			fromDeb:  "2.45.1+20.04",
+			fromSnap: "2.45.1",
+			// deb version wins
+			expectedVersion: "2.45.1+20.04",
+			expectedPath:    filepath.Join(tmpDir, "usr/lib/snapd/snapd"),
+		},
+		{
+			fromDeb:  "2.45.2",
+			fromSnap: "2.45.1",
+			// deb version wins
+			expectedVersion: "2.45.2",
+			expectedPath:    filepath.Join(tmpDir, "usr/lib/snapd/snapd"),
+		},
+		{
+			fromSnap:    "2.45.1",
+			expectedErr: fmt.Sprintf("cannot open snapd info file %q.*", filepath.Join(tmpDir, "usr/lib/snapd/info")),
+		},
+		{
+			fromDeb:     "2.45.1",
+			expectedErr: fmt.Sprintf("cannot open snapd info file %q.*", filepath.Join(tmpDir, "target-core-mounted-here/usr/lib/snapd/info")),
+		},
+	}
+
+	for _, test := range versions {
+		infoFile := filepath.Join(tmpDir, "usr/lib/snapd/info")
+		os.Remove(infoFile)
+		if test.fromDeb != "" {
+			c.Assert(ioutil.WriteFile(infoFile, []byte(fmt.Sprintf("VERSION=%s", test.fromDeb)), 0644), IsNil)
+		}
+		infoFile = filepath.Join(targetSnapdRoot, "usr/lib/snapd/info")
+		os.Remove(infoFile)
+		if test.fromSnap != "" {
+			c.Assert(ioutil.WriteFile(infoFile, []byte(fmt.Sprintf("VERSION=%s", test.fromSnap)), 0644), IsNil)
+		}
+
+		targetSnapd, err := main.ChooseTargetSnapdVersion()
+		if test.expectedErr != "" {
+			c.Assert(err, ErrorMatches, test.expectedErr)
+		} else {
+			c.Assert(err, IsNil)
+			c.Assert(targetSnapd, NotNil)
+			path, version := main.SnapdPathAndVersion(targetSnapd)
+			c.Check(path, Equals, test.expectedPath)
+			c.Check(version, Equals, test.expectedVersion)
+		}
+	}
 }
 
 func (s *startPreseedSuite) TestRunPreseedAgainstFilesystemRoot(c *C) {
@@ -394,80 +568,111 @@
 	restore := main.MockOsGetuid(func() int { return 0 })
 	defer restore()
 
-	tmpDir := c.MkDir()
-
-	// mock some preseeding artifacts
-	artifacts := []struct {
-		path string
-		// if symlinkTarget is not empty, then a path -> symlinkTarget symlink
-		// will be created instead of a regular file.
-		symlinkTarget string
-	}{
-		{dirs.SnapStateFile, ""},
-		{dirs.SnapSystemKeyFile, ""},
-		{filepath.Join(dirs.SnapDesktopFilesDir, "foo.desktop"), ""},
-		{filepath.Join(dirs.SnapDesktopIconsDir, "foo.png"), ""},
-		{filepath.Join(dirs.SnapMountPolicyDir, "foo.fstab"), ""},
-		{filepath.Join(dirs.SnapBlobDir, "foo.snap"), ""},
-		{filepath.Join(dirs.SnapUdevRulesDir, "foo-snap.bar.rules"), ""},
-		{filepath.Join(dirs.SnapBusPolicyDir, "snap.foo.bar.conf"), ""},
-		{filepath.Join(dirs.SnapServicesDir, "snap.foo.service"), ""},
-		{filepath.Join(dirs.SnapServicesDir, "snap.foo.timer"), ""},
-		{filepath.Join(dirs.SnapServicesDir, "snap.foo.socket"), ""},
-		{filepath.Join(dirs.SnapServicesDir, "snap-foo.mount"), ""},
-		{filepath.Join(dirs.SnapServicesDir, "multi-user.target.wants", "snap-foo.mount"), ""},
-		{filepath.Join(dirs.SnapDataDir, "foo", "bar"), ""},
-		{filepath.Join(dirs.SnapCacheDir, "foocache", "bar"), ""},
-		{filepath.Join(apparmor_sandbox.CacheDir, "foo", "bar"), ""},
-		{filepath.Join(dirs.SnapAppArmorDir, "foo"), ""},
-		{filepath.Join(dirs.SnapAssertsDBDir, "foo"), ""},
-		{filepath.Join(dirs.FeaturesDir, "foo"), ""},
-		{filepath.Join(dirs.SnapDeviceDir, "foo-1", "bar"), ""},
-		{filepath.Join(dirs.SnapCookieDir, "foo"), ""},
-		{filepath.Join(dirs.SnapSeqDir, "foo.json"), ""},
-		{filepath.Join(dirs.SnapMountDir, "foo", "bin"), ""},
-		{filepath.Join(dirs.SnapSeccompDir, "foo.bin"), ""},
-		// bash-completion symlinks
-		{filepath.Join(dirs.CompletersDir, "foo.bar"), "/a/snapd/complete.sh"},
-		{filepath.Join(dirs.CompletersDir, "foo"), "foo.bar"},
-	}
+	startDir, err := os.Getwd()
+	c.Assert(err, IsNil)
+	defer func() {
+		os.Chdir(startDir)
+	}()
+
+	for _, isRelative := range []bool{false, true} {
+		tmpDir := c.MkDir()
+		resetDirArg := tmpDir
+		if isRelative {
+			var parentDir string
+			parentDir, resetDirArg = filepath.Split(tmpDir)
+			os.Chdir(parentDir)
+		}
 
-	for _, art := range artifacts {
-		fullPath := filepath.Join(tmpDir, art.path)
-		// create parent dir
-		c.Assert(os.MkdirAll(filepath.Dir(fullPath), 0755), IsNil)
-		if art.symlinkTarget != "" {
-			// note, symlinkTarget is not relative to tmpDir
-			c.Assert(os.Symlink(art.symlinkTarget, fullPath), IsNil)
-		} else {
-			c.Assert(ioutil.WriteFile(fullPath, nil, os.ModePerm), IsNil)
+		// mock some preseeding artifacts
+		artifacts := []struct {
+			path string
+			// if symlinkTarget is not empty, then a path -> symlinkTarget symlink
+			// will be created instead of a regular file.
+			symlinkTarget string
+		}{
+			{dirs.SnapStateFile, ""},
+			{dirs.SnapSystemKeyFile, ""},
+			{filepath.Join(dirs.SnapDesktopFilesDir, "foo.desktop"), ""},
+			{filepath.Join(dirs.SnapDesktopIconsDir, "foo.png"), ""},
+			{filepath.Join(dirs.SnapMountPolicyDir, "foo.fstab"), ""},
+			{filepath.Join(dirs.SnapBlobDir, "foo.snap"), ""},
+			{filepath.Join(dirs.SnapUdevRulesDir, "foo-snap.bar.rules"), ""},
+			{filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.foo.bar.conf"), ""},
+			{filepath.Join(dirs.SnapServicesDir, "snap.foo.service"), ""},
+			{filepath.Join(dirs.SnapServicesDir, "snap.foo.timer"), ""},
+			{filepath.Join(dirs.SnapServicesDir, "snap.foo.socket"), ""},
+			{filepath.Join(dirs.SnapServicesDir, "snap-foo.mount"), ""},
+			{filepath.Join(dirs.SnapServicesDir, "multi-user.target.wants", "snap-foo.mount"), ""},
+			{filepath.Join(dirs.SnapDataDir, "foo", "bar"), ""},
+			{filepath.Join(dirs.SnapCacheDir, "foocache", "bar"), ""},
+			{filepath.Join(apparmor_sandbox.CacheDir, "foo", "bar"), ""},
+			{filepath.Join(dirs.SnapAppArmorDir, "foo"), ""},
+			{filepath.Join(dirs.SnapAssertsDBDir, "foo"), ""},
+			{filepath.Join(dirs.FeaturesDir, "foo"), ""},
+			{filepath.Join(dirs.SnapDeviceDir, "foo-1", "bar"), ""},
+			{filepath.Join(dirs.SnapCookieDir, "foo"), ""},
+			{filepath.Join(dirs.SnapSeqDir, "foo.json"), ""},
+			{filepath.Join(dirs.SnapMountDir, "foo", "bin"), ""},
+			{filepath.Join(dirs.SnapSeccompDir, "foo.bin"), ""},
+			// bash-completion symlinks
+			{filepath.Join(dirs.CompletersDir, "foo.bar"), "/a/snapd/complete.sh"},
+			{filepath.Join(dirs.CompletersDir, "foo"), "foo.bar"},
 		}
-	}
 
-	checkArtifacts := func(exists bool) {
 		for _, art := range artifacts {
 			fullPath := filepath.Join(tmpDir, art.path)
+			// create parent dir
+			c.Assert(os.MkdirAll(filepath.Dir(fullPath), 0755), IsNil)
 			if art.symlinkTarget != "" {
-				c.Check(osutil.IsSymlink(fullPath), Equals, exists, Commentf("offending symlink: %s", fullPath))
+				// note, symlinkTarget is not relative to tmpDir
+				c.Assert(os.Symlink(art.symlinkTarget, fullPath), IsNil)
 			} else {
-				c.Check(osutil.FileExists(fullPath), Equals, exists, Commentf("offending file: %s", fullPath))
+				c.Assert(ioutil.WriteFile(fullPath, nil, os.ModePerm), IsNil)
 			}
 		}
-	}
-
-	// sanity
-	checkArtifacts(true)
 
-	snapdDir := filepath.Dir(dirs.SnapStateFile)
-	c.Assert(os.MkdirAll(filepath.Join(tmpDir, snapdDir), 0755), IsNil)
-	c.Assert(ioutil.WriteFile(filepath.Join(tmpDir, dirs.SnapStateFile), nil, os.ModePerm), IsNil)
+		checkArtifacts := func(exists bool) {
+			for _, art := range artifacts {
+				fullPath := filepath.Join(tmpDir, art.path)
+				if art.symlinkTarget != "" {
+					c.Check(osutil.IsSymlink(fullPath), Equals, exists, Commentf("offending symlink: %s", fullPath))
+				} else {
+					c.Check(osutil.FileExists(fullPath), Equals, exists, Commentf("offending file: %s", fullPath))
+				}
+			}
+		}
 
-	parser := testParser(c)
-	c.Assert(main.Run(parser, []string{"--reset", tmpDir}), IsNil)
+		// sanity
+		checkArtifacts(true)
 
-	checkArtifacts(false)
+		snapdDir := filepath.Dir(dirs.SnapStateFile)
+		c.Assert(os.MkdirAll(filepath.Join(tmpDir, snapdDir), 0755), IsNil)
+		c.Assert(ioutil.WriteFile(filepath.Join(tmpDir, dirs.SnapStateFile), nil, os.ModePerm), IsNil)
+
+		parser := testParser(c)
+		c.Assert(main.Run(parser, []string{"--reset", resetDirArg}), IsNil)
+
+		checkArtifacts(false)
+
+		// running reset again is ok
+		parser = testParser(c)
+		c.Assert(main.Run(parser, []string{"--reset", resetDirArg}), IsNil)
+
+		// reset complains if target directory doesn't exist
+		c.Assert(main.Run(parser, []string{"--reset", "/non/existing/chrootpath"}), ErrorMatches, `cannot reset non-existing directory "/non/existing/chrootpath"`)
+
+		// reset complains if target is not a directory
+		dummyFile := filepath.Join(resetDirArg, "foo")
+		c.Assert(ioutil.WriteFile(dummyFile, nil, os.ModePerm), IsNil)
+		err = main.Run(parser, []string{"--reset", dummyFile})
+		// the error message is always with an absolute file, so make the path
+		// absolute if we are running the relative test to properly match
+		if isRelative {
+			var err2 error
+			dummyFile, err2 = filepath.Abs(dummyFile)
+			c.Assert(err2, IsNil)
+		}
+		c.Assert(err, ErrorMatches, fmt.Sprintf(`cannot reset %q, it is not a directory`, dummyFile))
+	}
 
-	// running reset again is ok
-	parser = testParser(c)
-	c.Assert(main.Run(parser, []string{"--reset", tmpDir}), IsNil)
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-preseed/preseed_linux.go snapd-2.48.3+20.04/cmd/snap-preseed/preseed_linux.go
--- snapd-2.45.1+20.04.2/cmd/snap-preseed/preseed_linux.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-preseed/preseed_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -24,12 +24,15 @@
 	"os"
 	"os/exec"
 	"path/filepath"
+	"sort"
+	"strings"
 	"syscall"
 
-	"github.com/snapcore/snapd/cmd/cmdutil"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/squashfs"
 	"github.com/snapcore/snapd/seed"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/strutil"
 	"github.com/snapcore/snapd/timings"
 )
@@ -59,12 +62,35 @@
 		return fmt.Errorf("the system at %q appears to be preseeded, pass --reset flag to clean it up", preseedChroot)
 	}
 
-	// sanity checks of the critical mountpoints inside chroot directory
-	for _, p := range []string{"/sys/kernel/security/apparmor", "/proc/self", "/dev/mem"} {
-		path := filepath.Join(preseedChroot, p)
-		if exists := osutil.FileExists(path); !exists {
-			return fmt.Errorf("cannot pre-seed without access to %q", path)
+	// sanity checks of the critical mountpoints inside chroot directory.
+	required := map[string]bool{}
+	// required mountpoints are relative to the preseed chroot
+	for _, p := range []string{"/sys/kernel/security", "/proc", "/dev"} {
+		required[filepath.Join(preseedChroot, p)] = true
+	}
+	entries, err := osutil.LoadMountInfo()
+	if err != nil {
+		return fmt.Errorf("cannot parse mount info: %v", err)
+	}
+	for _, ent := range entries {
+		if _, ok := required[ent.MountDir]; ok {
+			delete(required, ent.MountDir)
+		}
+	}
+	// non empty required indicates missing mountpoint(s)
+	if len(required) > 0 {
+		var sorted []string
+		for path := range required {
+			sorted = append(sorted, path)
 		}
+		sort.Strings(sorted)
+		parts := append([]string{""}, sorted...)
+		return fmt.Errorf("cannot preseed without the following mountpoints:%s", strings.Join(parts, "\n - "))
+	}
+
+	path := filepath.Join(preseedChroot, "/sys/kernel/security/apparmor")
+	if exists := osutil.FileExists(path); !exists {
+		return fmt.Errorf("cannot preseed without access to %q", path)
 	}
 
 	return nil
@@ -83,17 +109,13 @@
 	if err := seed.LoadAssertions(nil, nil); err != nil {
 		return "", err
 	}
+	model := seed.Model()
 
 	tm := timings.New(nil)
 	if err := seed.LoadMeta(tm); err != nil {
 		return "", err
 	}
 
-	model, err := seed.Model()
-	if err != nil {
-		return "", err
-	}
-
 	// TODO: implement preseeding for core.
 	if !model.Classic() {
 		return "", fmt.Errorf("preseeding is only supported on classic systems")
@@ -124,30 +146,68 @@
 
 const snapdPreseedSupportVer = `2.43.3+`
 
-func checkTargetSnapdVersion(infoPath string) error {
-	ver, err := cmdutil.SnapdVersionFromInfoFile(infoPath)
+type targetSnapdInfo struct {
+	path    string
+	version string
+}
+
+// chooseTargetSnapdVersion checks if the version of snapd under chroot env
+// is good enough for preseeding. It checks both the snapd from the deb
+// and from the seeded snap mounted under snapdMountPath and returns the
+// information (path, version) about snapd to execute as part of preseeding
+// (it picks the newer version of the two).
+// The function must be called after syscall.Chroot(..).
+func chooseTargetSnapdVersion() (*targetSnapdInfo, error) {
+	// read snapd version from the mounted core/snapd snap
+	infoPath := filepath.Join(snapdMountPath, dirs.CoreLibExecDir, "info")
+	verFromSnap, err := snapdtool.SnapdVersionFromInfoFile(infoPath)
+	if err != nil {
+		return nil, err
+	}
+
+	// read snapd version from the main fs under chroot (snapd from the deb);
+	// assumes running under chroot already.
+	infoPath = filepath.Join(dirs.GlobalRootDir, dirs.CoreLibExecDir, "info")
+	verFromDeb, err := snapdtool.SnapdVersionFromInfoFile(infoPath)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	res, err := strutil.VersionCompare(ver, snapdPreseedSupportVer)
+	res, err := strutil.VersionCompare(verFromSnap, verFromDeb)
 	if err != nil {
-		return err
+		return nil, err
 	}
+
+	var whichVer, snapdPath string
 	if res < 0 {
-		return fmt.Errorf("snapd %s from the target system does not support preseeding, the minimum required version is %s",
-			ver, snapdPreseedSupportVer)
+		// snapd from the deb under chroot is the candidate to run
+		whichVer = verFromDeb
+		snapdPath = filepath.Join(dirs.GlobalRootDir, dirs.CoreLibExecDir, "snapd")
+	} else {
+		// snapd from the mounted core/snapd snap is the candidate to run
+		whichVer = verFromSnap
+		snapdPath = filepath.Join(snapdMountPath, dirs.CoreLibExecDir, "snapd")
 	}
-	return nil
+
+	res, err = strutil.VersionCompare(whichVer, snapdPreseedSupportVer)
+	if err != nil {
+		return nil, err
+	}
+	if res < 0 {
+		return nil, fmt.Errorf("snapd %s from the target system does not support preseeding, the minimum required version is %s",
+			whichVer, snapdPreseedSupportVer)
+	}
+
+	return &targetSnapdInfo{path: snapdPath, version: whichVer}, nil
 }
 
-func prepareChroot(preseedChroot string) (func(), error) {
+func prepareChroot(preseedChroot string) (*targetSnapdInfo, func(), error) {
 	if err := syscallChroot(preseedChroot); err != nil {
-		return nil, fmt.Errorf("cannot chroot into %s: %v", preseedChroot, err)
+		return nil, nil, fmt.Errorf("cannot chroot into %s: %v", preseedChroot, err)
 	}
 
 	if err := os.Chdir("/"); err != nil {
-		return nil, fmt.Errorf("cannot chdir to /: %v", err)
+		return nil, nil, fmt.Errorf("cannot chdir to /: %v", err)
 	}
 
 	// GlobalRootDir is now relative to chroot env. We assume all paths
@@ -159,13 +219,13 @@
 
 	coreSnapPath, err := systemSnapFromSeed(rootDir)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	// create mountpoint for core/snapd
 	where := filepath.Join(rootDir, snapdMountPath)
 	if err := os.MkdirAll(where, 0755); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	removeMountpoint := func() {
@@ -174,10 +234,11 @@
 		}
 	}
 
-	cmd := exec.Command("mount", "-t", "squashfs", coreSnapPath, where)
+	fstype, fsopts := squashfs.FsType()
+	cmd := exec.Command("mount", "-t", fstype, "-o", strings.Join(fsopts, ","), coreSnapPath, where)
 	if err := cmd.Run(); err != nil {
 		removeMountpoint()
-		return nil, fmt.Errorf("cannot mount %s at %s in preseed mode: %v ", coreSnapPath, where, err)
+		return nil, nil, fmt.Errorf("cannot mount %s at %s in preseed mode: %v ", coreSnapPath, where, err)
 	}
 
 	unmount := func() {
@@ -188,15 +249,14 @@
 		}
 	}
 
-	// read version from the mounted core snap
-	infoPath := filepath.Join(snapdMountPath, dirs.CoreLibExecDir, "info")
-	if err := checkTargetSnapdVersion(infoPath); err != nil {
+	targetSnapd, err := chooseTargetSnapdVersion()
+	if err != nil {
 		unmount()
 		removeMountpoint()
-		return nil, err
+		return nil, nil, err
 	}
 
-	return func() {
+	return targetSnapd, func() {
 		unmount()
 		removeMountpoint()
 	}, nil
@@ -204,18 +264,16 @@
 
 // runPreseedMode runs snapd in a preseed mode. It assumes running in a chroot.
 // The chroot is expected to be set-up and ready to use (critical system directories mounted).
-func runPreseedMode(preseedChroot string) error {
-	// exec snapd relative to new chroot, e.g. /snapd-preseed/usr/lib/snapd/snapd
-	path := filepath.Join(snapdMountPath, dirs.CoreLibExecDir, "snapd")
-
+func runPreseedMode(preseedChroot string, targetSnapd *targetSnapdInfo) error {
 	// run snapd in preseed mode
-	cmd := exec.Command(path)
+	cmd := exec.Command(targetSnapd.path)
 	cmd.Env = os.Environ()
 	cmd.Env = append(cmd.Env, "SNAPD_PRESEED=1")
 	cmd.Stderr = Stderr
 	cmd.Stdout = Stdout
 
-	fmt.Fprintf(Stdout, "starting to preseed root: %s\n", preseedChroot)
+	// note, snapdPath is relative to preseedChroot
+	fmt.Fprintf(Stdout, "starting to preseed root: %s\nusing snapd binary: %s (%s)\n", preseedChroot, targetSnapd.path, targetSnapd.version)
 
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("error running snapd in preseed mode: %v\n", err)
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-preseed/preseed_other.go snapd-2.48.3+20.04/cmd/snap-preseed/preseed_other.go
--- snapd-2.45.1+20.04.2/cmd/snap-preseed/preseed_other.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-preseed/preseed_other.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,7 +30,7 @@
 	return preseedNotAvailableError
 }
 
-func prepareChroot(preseedChroot string) (func(), error) {
+func prepareChroot(preseedChroot string) (*targetSnapdInfo, func(), error) {
 	return nil, preseedNotAvailableError
 }
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-preseed/reset.go snapd-2.48.3+20.04/cmd/snap-preseed/reset.go
--- snapd-2.45.1+20.04.2/cmd/snap-preseed/reset.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-preseed/reset.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,22 +26,40 @@
 	"path/filepath"
 
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
 	apparmor_sandbox "github.com/snapcore/snapd/sandbox/apparmor"
 )
 
 func resetPreseededChroot(preseedChroot string) error {
+	exists, isDir, err := osutil.DirExists(preseedChroot)
+	if err != nil {
+		return fmt.Errorf("cannot reset %q: %v", preseedChroot, err)
+	}
+	if !exists {
+		return fmt.Errorf("cannot reset non-existing directory %q", preseedChroot)
+	}
+	if !isDir {
+		return fmt.Errorf("cannot reset %q, it is not a directory", preseedChroot)
+	}
+
 	// globs that yield individual files
 	globs := []string{
 		dirs.SnapStateFile,
 		dirs.SnapSystemKeyFile,
 		filepath.Join(dirs.SnapBlobDir, "*.snap"),
 		filepath.Join(dirs.SnapUdevRulesDir, "*-snap.*.rules"),
-		filepath.Join(dirs.SnapBusPolicyDir, "snap.*.*.conf"),
+		filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.*.*.conf"),
 		filepath.Join(dirs.SnapServicesDir, "snap.*.service"),
 		filepath.Join(dirs.SnapServicesDir, "snap.*.timer"),
 		filepath.Join(dirs.SnapServicesDir, "snap.*.socket"),
 		filepath.Join(dirs.SnapServicesDir, "snap-*.mount"),
 		filepath.Join(dirs.SnapServicesDir, "multi-user.target.wants", "snap-*.mount"),
+		filepath.Join(dirs.SnapUserServicesDir, "snap.*.service"),
+		filepath.Join(dirs.SnapUserServicesDir, "snap.*.socket"),
+		filepath.Join(dirs.SnapUserServicesDir, "snap.*.timer"),
+		filepath.Join(dirs.SnapUserServicesDir, "default.target.wants", "snap.*.service"),
+		filepath.Join(dirs.SnapUserServicesDir, "sockets.target.wants", "snap.*.socket"),
+		filepath.Join(dirs.SnapUserServicesDir, "timers.target.wants", "snap.*.timer"),
 	}
 
 	for _, gl := range globs {
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-repair/main.go snapd-2.48.3+20.04/cmd/snap-repair/main.go
--- snapd-2.45.1+20.04.2/cmd/snap-repair/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-repair/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,10 +27,10 @@
 	// TODO: consider not using go-flags at all
 	"github.com/jessevdk/go-flags"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snapdenv"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 var (
@@ -76,7 +76,7 @@
 	if osGetuid() != 0 {
 		return fmt.Errorf("must be run as root")
 	}
-	snapdenv.SetUserAgentFromVersion(cmd.Version, nil, "snap-repair")
+	snapdenv.SetUserAgentFromVersion(snapdtool.Version, nil, "snap-repair")
 
 	if err := parseArgs(os.Args[1:]); err != nil {
 		return err
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-repair/main_test.go snapd-2.48.3+20.04/cmd/snap-repair/main_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-repair/main_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-repair/main_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -76,6 +76,11 @@
 	r.AddCleanup(func() { dirs.SetRootDir("/") })
 }
 
+func (r *repairSuite) TearDownTest(c *C) {
+	r.baseRunnerSuite.TearDownTest(c)
+	r.BaseTest.TearDownTest(c)
+}
+
 func (r *repairSuite) Stdout() string {
 	return r.stdout.String()
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-repair/runner.go snapd-2.48.3+20.04/cmd/snap-repair/runner.go
--- snapd-2.45.1+20.04.2/cmd/snap-repair/runner.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-repair/runner.go	2021-02-02 08:21:12.000000000 +0000
@@ -38,6 +38,7 @@
 	"syscall"
 	"time"
 
+	"github.com/mvo5/goconfigparser"
 	"gopkg.in/retry.v1"
 
 	"github.com/snapcore/snapd/arch"
@@ -304,9 +305,9 @@
 		},
 	))
 
-	peekRetryStrategy = retry.LimitCount(5, retry.LimitTime(44*time.Second,
+	peekRetryStrategy = retry.LimitCount(6, retry.LimitTime(44*time.Second,
 		retry.Exponential{
-			Initial: 300 * time.Millisecond,
+			Initial: 500 * time.Millisecond,
 			Factor:  2.5,
 		},
 	))
@@ -575,11 +576,9 @@
 	os.Remove(dirs.SnapRepairStateFile)
 	run.state = state{}
 	// initialize time lower bound with image built time/seed.yaml time
-	info, err := os.Stat(filepath.Join(dirs.SnapSeedDir, "seed.yaml"))
-	if err != nil {
+	if err := run.findTimeLowerBound(); err != nil {
 		return err
 	}
-	run.moveTimeLowerBound(info.ModTime())
 	// initialize device info
 	if err := run.initDeviceInfo(); err != nil {
 		return err
@@ -655,16 +654,67 @@
 	return nil
 }
 
-func (run *Runner) initDeviceInfo() error {
-	const errPrefix = "cannot set device information: "
+func (run *Runner) findTimeLowerBound() error {
+	timeLowerBoundSources := []string{
+		// uc16
+		filepath.Join(dirs.SnapSeedDir, "seed.yaml"),
+		// uc20+
+		dirs.SnapModeenvFile,
+	}
+	// add all model files from uc20 seeds
+	allModels, err := filepath.Glob(filepath.Join(dirs.SnapSeedDir, "systems/*/model"))
+	if err != nil {
+		return err
+	}
+	timeLowerBoundSources = append(timeLowerBoundSources, allModels...)
+
+	// use all files as potential time inputs
+	for _, p := range timeLowerBoundSources {
+		info, err := os.Stat(p)
+		if os.IsNotExist(err) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		run.moveTimeLowerBound(info.ModTime())
+	}
+	return nil
+}
 
+func findBrandAndModel() (string, string, error) {
+	if osutil.FileExists(dirs.SnapModeenvFile) {
+		return findBrandAndModel20()
+	}
+	return findBrandAndModel16()
+}
+
+func findBrandAndModel20() (brand, model string, err error) {
+	cfg := goconfigparser.New()
+	cfg.AllowNoSectionHeader = true
+	if err := cfg.ReadFile(dirs.SnapModeenvFile); err != nil {
+		return "", "", err
+	}
+	brandAndModel, err := cfg.Get("", "model")
+	if err != nil {
+		return "", "", err
+	}
+	l := strings.SplitN(brandAndModel, "/", 2)
+	if len(l) != 2 {
+		return "", "", fmt.Errorf("cannot find brand/model in modeenv model string %q", brandAndModel)
+	}
+
+	return l[0], l[1], nil
+}
+
+func findBrandAndModel16() (brand, model string, err error) {
 	workBS := asserts.NewMemoryBackstore()
 	assertSeedDir := filepath.Join(dirs.SnapSeedDir, "assertions")
 	dc, err := ioutil.ReadDir(assertSeedDir)
 	if err != nil {
-		return err
+		return "", "", err
 	}
-	var model *asserts.Model
+	var modelAs *asserts.Model
 	for _, fi := range dc {
 		fn := filepath.Join(assertSeedDir, fi.Name())
 		f, err := os.Open(fn)
@@ -681,37 +731,45 @@
 			}
 			switch a.Type() {
 			case asserts.ModelType:
-				if model != nil {
-					return fmt.Errorf(errPrefix + "multiple models in seed assertions")
+				if modelAs != nil {
+					return "", "", fmt.Errorf("multiple models in seed assertions")
 				}
-				model = a.(*asserts.Model)
+				modelAs = a.(*asserts.Model)
 			case asserts.AccountType, asserts.AccountKeyType:
 				workBS.Put(a.Type(), a)
 			}
 		}
 	}
-	if model == nil {
-		return fmt.Errorf(errPrefix + "no model assertion in seed data")
+	if modelAs == nil {
+		return "", "", fmt.Errorf("no model assertion in seed data")
 	}
 	trustedBS := trustedBackstore(sysdb.Trusted())
-	if err := verifySignatures(model, workBS, trustedBS); err != nil {
-		return fmt.Errorf(errPrefix+"%v", err)
+	if err := verifySignatures(modelAs, workBS, trustedBS); err != nil {
+		return "", "", err
 	}
-	acctPK := []string{model.BrandID()}
+	acctPK := []string{modelAs.BrandID()}
 	acctMaxSupFormat := asserts.AccountType.MaxSupportedFormat()
 	acct, err := trustedBS.Get(asserts.AccountType, acctPK, acctMaxSupFormat)
 	if err != nil {
 		var err error
 		acct, err = workBS.Get(asserts.AccountType, acctPK, acctMaxSupFormat)
 		if err != nil {
-			return fmt.Errorf(errPrefix + "no brand account assertion in seed data")
+			return "", "", fmt.Errorf("no brand account assertion in seed data")
 		}
 	}
 	if err := verifySignatures(acct, workBS, trustedBS); err != nil {
-		return fmt.Errorf(errPrefix+"%v", err)
+		return "", "", err
+	}
+	return modelAs.BrandID(), modelAs.Model(), nil
+}
+
+func (run *Runner) initDeviceInfo() error {
+	brandID, model, err := findBrandAndModel()
+	if err != nil {
+		return fmt.Errorf("cannot set device information: %v", err)
 	}
-	run.state.Device.Brand = model.BrandID()
-	run.state.Device.Model = model.Model()
+	run.state.Device.Brand = brandID
+	run.state.Device.Model = model
 	return nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-repair/runner_test.go snapd-2.48.3+20.04/cmd/snap-repair/runner_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-repair/runner_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-repair/runner_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -41,6 +41,7 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/asserts/sysdb"
+	"github.com/snapcore/snapd/boot"
 	repair "github.com/snapcore/snapd/cmd/snap-repair"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
@@ -50,6 +51,8 @@
 )
 
 type baseRunnerSuite struct {
+	testutil.BaseTest
+
 	tmpdir string
 
 	seedTime time.Time
@@ -73,6 +76,21 @@
 	restoreLogger func()
 }
 
+func makeReadOnly(c *C, dir string) (restore func()) {
+	// skip tests that need this because uid==0 does not honor
+	// write permissions in directories (yay, unix)
+	if os.Getuid() == 0 {
+		// FIXME: we could use osutil.Chattr() here
+		c.Skip("too lazy to make path readonly as root")
+	}
+	err := os.Chmod(dir, 0555)
+	c.Assert(err, IsNil)
+	return func() {
+		err := os.Chmod(dir, 0755)
+		c.Assert(err, IsNil)
+	}
+}
+
 func (s *baseRunnerSuite) SetUpSuite(c *C) {
 	s.storeSigning = assertstest.NewStoreStack("canonical", nil)
 
@@ -110,31 +128,14 @@
 }
 
 func (s *baseRunnerSuite) SetUpTest(c *C) {
-	_, s.restoreLogger = logger.MockLogger()
+	s.BaseTest.SetUpTest(c)
+
+	_, restoreLogger := logger.MockLogger()
+	s.AddCleanup(restoreLogger)
 
 	s.tmpdir = c.MkDir()
 	dirs.SetRootDir(s.tmpdir)
-
-	s.seedAssertsDir = filepath.Join(dirs.SnapSeedDir, "assertions")
-
-	// dummy seed yaml
-	err := os.MkdirAll(dirs.SnapSeedDir, 0755)
-	c.Assert(err, IsNil)
-	seedYamlFn := filepath.Join(dirs.SnapSeedDir, "seed.yaml")
-	err = ioutil.WriteFile(seedYamlFn, nil, 0644)
-	c.Assert(err, IsNil)
-	seedTime, err := time.Parse(time.RFC3339, "2017-08-11T15:49:49Z")
-	c.Assert(err, IsNil)
-	err = os.Chtimes(filepath.Join(dirs.SnapSeedDir, "seed.yaml"), seedTime, seedTime)
-	c.Assert(err, IsNil)
-	s.seedTime = seedTime
-
-	s.t0 = time.Now().UTC().Truncate(time.Minute)
-}
-
-func (s *baseRunnerSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-	s.restoreLogger()
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
 }
 
 func (s *baseRunnerSuite) signSeqRepairs(c *C, repairs []string) []string {
@@ -610,120 +611,15 @@
 	c.Check(model, Equals, "my-model")
 }
 
-func (s *runnerSuite) initSeed(c *C) {
-	err := os.MkdirAll(s.seedAssertsDir, 0775)
-	c.Assert(err, IsNil)
-}
-
-func (s *runnerSuite) writeSeedAssert(c *C, fname string, a asserts.Assertion) {
-	err := ioutil.WriteFile(filepath.Join(s.seedAssertsDir, fname), asserts.Encode(a), 0644)
-	c.Assert(err, IsNil)
-}
-
-func (s *runnerSuite) rmSeedAssert(c *C, fname string) {
-	err := os.Remove(filepath.Join(s.seedAssertsDir, fname))
-	c.Assert(err, IsNil)
-}
-
-func (s *runnerSuite) TestLoadStateInitState(c *C) {
-	// sanity
-	c.Check(osutil.IsDirectory(dirs.SnapRepairDir), Equals, false)
-	c.Check(osutil.FileExists(dirs.SnapRepairStateFile), Equals, false)
-	// setup realistic seed/assertions
-	r := sysdb.InjectTrusted(s.storeSigning.Trusted)
-	defer r()
-	s.initSeed(c)
-	s.writeSeedAssert(c, "store.account-key", s.storeSigning.StoreAccountKey(""))
-	s.writeSeedAssert(c, "brand.account", s.brandAcct)
-	s.writeSeedAssert(c, "brand.account-key", s.brandAcctKey)
-	s.writeSeedAssert(c, "model", s.modelAs)
-
-	runner := repair.NewRunner()
-	err := runner.LoadState()
-	c.Assert(err, IsNil)
-	c.Check(osutil.FileExists(dirs.SnapRepairStateFile), Equals, true)
-
-	brand, model := runner.BrandModel()
-	c.Check(brand, Equals, "my-brand")
-	c.Check(model, Equals, "my-model-2")
-
-	c.Check(runner.TimeLowerBound().Equal(s.seedTime), Equals, true)
-}
-
-func (s *runnerSuite) TestLoadStateInitDeviceInfoFail(c *C) {
-	// sanity
-	c.Check(osutil.IsDirectory(dirs.SnapRepairDir), Equals, false)
-	c.Check(osutil.FileExists(dirs.SnapRepairStateFile), Equals, false)
-	// setup realistic seed/assertions
-	r := sysdb.InjectTrusted(s.storeSigning.Trusted)
-	defer r()
-	s.initSeed(c)
-
-	const errPrefix = "cannot set device information: "
-	tests := []struct {
-		breakFunc   func()
-		expectedErr string
-	}{
-		{func() { s.rmSeedAssert(c, "model") }, errPrefix + "no model assertion in seed data"},
-		{func() { s.rmSeedAssert(c, "brand.account") }, errPrefix + "no brand account assertion in seed data"},
-		{func() { s.rmSeedAssert(c, "brand.account-key") }, errPrefix + `cannot find public key.*`},
-		{func() {
-			// broken signature
-			blob := asserts.Encode(s.brandAcct)
-			err := ioutil.WriteFile(filepath.Join(s.seedAssertsDir, "brand.account"), blob[:len(blob)-3], 0644)
-			c.Assert(err, IsNil)
-		}, errPrefix + "cannot decode signature:.*"},
-		{func() { s.writeSeedAssert(c, "model2", s.modelAs) }, errPrefix + "multiple models in seed assertions"},
-	}
-
-	for _, test := range tests {
-		s.writeSeedAssert(c, "store.account-key", s.storeSigning.StoreAccountKey(""))
-		s.writeSeedAssert(c, "brand.account", s.brandAcct)
-		s.writeSeedAssert(c, "brand.account-key", s.brandAcctKey)
-		s.writeSeedAssert(c, "model", s.modelAs)
-
-		test.breakFunc()
-
-		runner := repair.NewRunner()
-		err := runner.LoadState()
-		c.Check(err, ErrorMatches, test.expectedErr)
-	}
-}
-
-func (s *runnerSuite) TestTLSTime(c *C) {
-	s.freshState(c)
-	runner := repair.NewRunner()
-	err := runner.LoadState()
-	c.Assert(err, IsNil)
-	epoch := time.Unix(0, 0)
-	r := repair.MockTimeNow(func() time.Time {
-		return epoch
-	})
-	defer r()
-	c.Check(runner.TLSTime().Equal(s.seedTime), Equals, true)
-}
-
-func makeReadOnly(c *C, dir string) (restore func()) {
-	// skip tests that need this because uid==0 does not honor
-	// write permissions in directories (yay, unix)
-	if os.Getuid() == 0 {
-		// FIXME: we could use osutil.Chattr() here
-		c.Skip("too lazy to make path readonly as root")
-	}
-	err := os.Chmod(dir, 0555)
+func (s *runnerSuite) TestLoadStateInitStateFail(c *C) {
+	err := os.MkdirAll(dirs.SnapSeedDir, 0755)
 	c.Assert(err, IsNil)
-	return func() {
-		err := os.Chmod(dir, 0755)
-		c.Assert(err, IsNil)
-	}
-}
 
-func (s *runnerSuite) TestLoadStateInitStateFail(c *C) {
 	restore := makeReadOnly(c, filepath.Dir(dirs.SnapSeedDir))
 	defer restore()
 
 	runner := repair.NewRunner()
-	err := runner.LoadState()
+	err = runner.LoadState()
 	c.Check(err, ErrorMatches, `cannot create repair state directory:.*`)
 }
 
@@ -1513,6 +1409,7 @@
 	s.baseRunnerSuite.SetUpTest(c)
 
 	s.mockServer = makeMockServer(c, &s.seqRepairs, false)
+	s.AddCleanup(func() { s.mockServer.Close() })
 
 	s.runner = repair.NewRunner()
 	s.runner.BaseURL = mustParseURL(s.mockServer.URL)
@@ -1520,14 +1417,8 @@
 
 	s.runDir = filepath.Join(dirs.SnapRepairRunDir, "canonical", "1")
 
-	s.restoreErrTrackerReportRepair = repair.MockErrtrackerReportRepair(s.errtrackerReportRepair)
-}
-
-func (s *runScriptSuite) TearDownTest(c *C) {
-	s.baseRunnerSuite.TearDownTest(c)
-
-	s.restoreErrTrackerReportRepair()
-	s.mockServer.Close()
+	restoreErrTrackerReportRepair := repair.MockErrtrackerReportRepair(s.errtrackerReportRepair)
+	s.AddCleanup(restoreErrTrackerReportRepair)
 }
 
 func (s *runScriptSuite) errtrackerReportRepair(repair, errMsg, dupSig string, extra map[string]string) (string, error) {
@@ -1778,3 +1669,218 @@
 	c.Assert(err, IsNil)
 
 }
+
+// shared1620RunnerSuite is embedded by runner16Suite and
+// runner20Suite and the tests are run once with a simulated uc16 and
+// once with a simulated uc20 environment
+type shared1620RunnerSuite struct {
+	baseRunnerSuite
+
+	writeSeedAssert func(c *C, fname string, a asserts.Assertion)
+}
+
+func (s *shared1620RunnerSuite) TestTLSTime(c *C) {
+	s.freshState(c)
+	runner := repair.NewRunner()
+	err := runner.LoadState()
+	c.Assert(err, IsNil)
+	epoch := time.Unix(0, 0)
+	r := repair.MockTimeNow(func() time.Time {
+		return epoch
+	})
+	defer r()
+	c.Check(runner.TLSTime().Equal(s.seedTime), Equals, true)
+}
+
+func (s *shared1620RunnerSuite) TestLoadStateInitState(c *C) {
+	// sanity
+	c.Check(osutil.IsDirectory(dirs.SnapRepairDir), Equals, false)
+	c.Check(osutil.FileExists(dirs.SnapRepairStateFile), Equals, false)
+	// setup realistic seed/assertions
+	r := sysdb.InjectTrusted(s.storeSigning.Trusted)
+	defer r()
+	s.writeSeedAssert(c, "store.account-key", s.storeSigning.StoreAccountKey(""))
+	s.writeSeedAssert(c, "brand.account", s.brandAcct)
+	s.writeSeedAssert(c, "brand.account-key", s.brandAcctKey)
+	s.writeSeedAssert(c, "model", s.modelAs)
+
+	runner := repair.NewRunner()
+	err := runner.LoadState()
+	c.Assert(err, IsNil)
+	c.Check(osutil.FileExists(dirs.SnapRepairStateFile), Equals, true)
+
+	brand, model := runner.BrandModel()
+	c.Check(brand, Equals, "my-brand")
+	c.Check(model, Equals, "my-model-2")
+
+	c.Check(runner.TimeLowerBound().Equal(s.seedTime), Equals, true)
+}
+
+type runner16Suite struct {
+	shared1620RunnerSuite
+}
+
+var _ = Suite(&runner16Suite{})
+
+func (s *runner16Suite) SetUpTest(c *C) {
+	s.shared1620RunnerSuite.SetUpTest(c)
+
+	s.seedAssertsDir = filepath.Join(dirs.SnapSeedDir, "assertions")
+
+	// dummy seed yaml
+	err := os.MkdirAll(s.seedAssertsDir, 0755)
+	c.Assert(err, IsNil)
+	seedYamlFn := filepath.Join(dirs.SnapSeedDir, "seed.yaml")
+	err = ioutil.WriteFile(seedYamlFn, nil, 0644)
+	c.Assert(err, IsNil)
+	seedTime, err := time.Parse(time.RFC3339, "2017-08-11T15:49:49Z")
+	c.Assert(err, IsNil)
+	err = os.Chtimes(filepath.Join(dirs.SnapSeedDir, "seed.yaml"), seedTime, seedTime)
+	c.Assert(err, IsNil)
+	s.seedTime = seedTime
+
+	s.t0 = time.Now().UTC().Truncate(time.Minute)
+
+	s.writeSeedAssert = s.writeSeedAssert16
+}
+
+func (s *runner16Suite) writeSeedAssert16(c *C, fname string, a asserts.Assertion) {
+	err := ioutil.WriteFile(filepath.Join(s.seedAssertsDir, fname), asserts.Encode(a), 0644)
+	c.Assert(err, IsNil)
+}
+
+func (s *runner16Suite) rmSeedAssert16(c *C, fname string) {
+	err := os.Remove(filepath.Join(s.seedAssertsDir, fname))
+	c.Assert(err, IsNil)
+}
+
+func (s *runner16Suite) TestLoadStateInitDeviceInfoFail(c *C) {
+	// sanity
+	c.Check(osutil.IsDirectory(dirs.SnapRepairDir), Equals, false)
+	c.Check(osutil.FileExists(dirs.SnapRepairStateFile), Equals, false)
+	// setup realistic seed/assertions
+	r := sysdb.InjectTrusted(s.storeSigning.Trusted)
+	defer r()
+
+	const errPrefix = "cannot set device information: "
+	tests := []struct {
+		breakFunc   func()
+		expectedErr string
+	}{
+		{func() { s.rmSeedAssert16(c, "model") }, errPrefix + "no model assertion in seed data"},
+		{func() { s.rmSeedAssert16(c, "brand.account") }, errPrefix + "no brand account assertion in seed data"},
+		{func() { s.rmSeedAssert16(c, "brand.account-key") }, errPrefix + `cannot find public key.*`},
+		{func() {
+			// broken signature
+			blob := asserts.Encode(s.brandAcct)
+			err := ioutil.WriteFile(filepath.Join(s.seedAssertsDir, "brand.account"), blob[:len(blob)-3], 0644)
+			c.Assert(err, IsNil)
+		}, errPrefix + "cannot decode signature:.*"},
+		{func() { s.writeSeedAssert(c, "model2", s.modelAs) }, errPrefix + "multiple models in seed assertions"},
+	}
+
+	for _, test := range tests {
+		s.writeSeedAssert(c, "store.account-key", s.storeSigning.StoreAccountKey(""))
+		s.writeSeedAssert(c, "brand.account", s.brandAcct)
+		s.writeSeedAssert(c, "brand.account-key", s.brandAcctKey)
+		s.writeSeedAssert(c, "model", s.modelAs)
+
+		test.breakFunc()
+
+		runner := repair.NewRunner()
+		err := runner.LoadState()
+		c.Check(err, ErrorMatches, test.expectedErr)
+	}
+}
+
+type runner20Suite struct {
+	shared1620RunnerSuite
+}
+
+var _ = Suite(&runner20Suite{})
+
+var mockModeenv = []byte(`
+mode=run
+model=my-brand/my-model-2
+`)
+
+func (s *runner20Suite) SetUpTest(c *C) {
+	s.shared1620RunnerSuite.SetUpTest(c)
+
+	s.seedAssertsDir = filepath.Join(dirs.SnapSeedDir, "/systems/20201212/assertions")
+	err := os.MkdirAll(s.seedAssertsDir, 0755)
+	c.Assert(err, IsNil)
+
+	// write dummy modeenv
+	err = os.MkdirAll(filepath.Dir(dirs.SnapModeenvFile), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(dirs.SnapModeenvFile, mockModeenv, 0644)
+	c.Assert(err, IsNil)
+	// validate that modeenv is actually valid
+	_, err = boot.ReadModeenv("")
+	c.Assert(err, IsNil)
+
+	seedTime, err := time.Parse(time.RFC3339, "2017-08-11T15:49:49Z")
+	c.Assert(err, IsNil)
+	err = os.Chtimes(dirs.SnapModeenvFile, seedTime, seedTime)
+	c.Assert(err, IsNil)
+	s.seedTime = seedTime
+	s.t0 = time.Now().UTC().Truncate(time.Minute)
+
+	s.writeSeedAssert = s.writeSeedAssert20
+}
+
+func (s *runner20Suite) writeSeedAssert20(c *C, fname string, a asserts.Assertion) {
+	var fn string
+	if _, ok := a.(*asserts.Model); ok {
+		fn = filepath.Join(s.seedAssertsDir, "../model")
+	} else {
+		fn = filepath.Join(s.seedAssertsDir, fname)
+	}
+	err := ioutil.WriteFile(fn, asserts.Encode(a), 0644)
+	c.Assert(err, IsNil)
+
+	// ensure model assertion file has the correct seed time
+	if _, ok := a.(*asserts.Model); ok {
+		err = os.Chtimes(fn, s.seedTime, s.seedTime)
+		c.Assert(err, IsNil)
+	}
+}
+
+func (s *runner20Suite) TestLoadStateInitDeviceInfoModeenvInvalidContent(c *C) {
+	runner := repair.NewRunner()
+
+	for _, tc := range []struct {
+		modelStr    string
+		expectedErr string
+	}{
+		{
+			`invalid-key-value`,
+			"cannot set device information: No option model in section ",
+		}, {
+			`model=`,
+			`cannot set device information: cannot find brand/model in modeenv model string ""`,
+		}, {
+			`model=brand-but-no-model`,
+			`cannot set device information: cannot find brand/model in modeenv model string "brand-but-no-model"`,
+		},
+	} {
+		err := ioutil.WriteFile(dirs.SnapModeenvFile, []byte(tc.modelStr), 0644)
+		c.Assert(err, IsNil)
+		err = runner.LoadState()
+		c.Check(err, ErrorMatches, tc.expectedErr)
+	}
+}
+
+func (s *runner20Suite) TestLoadStateInitDeviceInfoModeenvIncorrectPermissions(c *C) {
+	runner := repair.NewRunner()
+
+	err := os.Chmod(dirs.SnapModeenvFile, 0300)
+	c.Assert(err, IsNil)
+	s.AddCleanup(func() {
+		err := os.Chmod(dirs.SnapModeenvFile, 0644)
+		c.Assert(err, IsNil)
+	})
+	err = runner.LoadState()
+	c.Check(err, ErrorMatches, "cannot set device information: open /.*/modeenv: permission denied")
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-seccomp/syscalls/syscalls.go snapd-2.48.3+20.04/cmd/snap-seccomp/syscalls/syscalls.go
--- snapd-2.45.1+20.04.2/cmd/snap-seccomp/syscalls/syscalls.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-seccomp/syscalls/syscalls.go	2021-02-02 08:21:12.000000000 +0000
@@ -86,6 +86,7 @@
 	"exit",
 	"exit_group",
 	"faccessat",
+	"faccessat2",
 	"fadvise64",
 	"fadvise64_64",
 	"fallocate",
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/change.go snapd-2.48.3+20.04/cmd/snap-update-ns/change.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/change.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/change.go	2021-02-02 08:21:12.000000000 +0000
@@ -95,10 +95,10 @@
 
 	// In case we need to create something, some constants.
 	const (
-		mode = 0755
-		uid  = 0
-		gid  = 0
+		uid = 0
+		gid = 0
 	)
+	mode := as.ModeForPath(path)
 
 	// If the element doesn't exist we can attempt to create it.  We will
 	// create the parent directory and then the final element relative to it.
@@ -361,6 +361,26 @@
 					umountOpts = append(umountOpts, fmt.Sprintf("%#x", unknownFlags))
 				}
 				logger.Debugf("umount %q %s (error: %v)", c.Entry.Dir, strings.Join(umountOpts, "|"), err)
+				if err == syscall.EINVAL {
+					// We attempted to unmount but got an EINVAL, one of the
+					// possibilities and the only one unless we provided wrong
+					// flags, is that the mount no longer exists.
+					//
+					// We can verify that now by scanning mountinfo:
+					entries, _ := osutil.LoadMountInfo()
+					for _, entry := range entries {
+						if entry.MountDir == c.Entry.Dir {
+							// Mount point still exists, EINVAL was unexpected.
+							return err
+						}
+					}
+					// We didn't find a mount point at the location we tried to
+					// unmount. The EINVAL we observed indicates that the mount
+					// profile no longer agrees with reality. The mount point
+					// no longer exists. As such, consume the error and carry on.
+					logger.Debugf("ignoring EINVAL from unmount, %q is not mounted", c.Entry.Dir)
+					err = nil
+				}
 				if err != nil {
 					return err
 				}
@@ -373,6 +393,10 @@
 			path := c.Entry.Dir
 			var fd int
 			fd, err = OpenPath(path)
+			// If the place does not exist anymore, we are done.
+			if os.IsNotExist(err) {
+				return nil
+			}
 			if err != nil {
 				return err
 			}
@@ -628,6 +652,20 @@
 			if !entry.XSnapdDetach() {
 				entry.Options = append(entry.Options, osutil.XSnapdDetach())
 			}
+		case entry.OptBool("bind") && entry.XSnapdKind() == "file":
+			// Bind mounted files are detached. If a bind mounted file open or
+			// mapped into a process as a library, then attempting to unmount
+			// it will result in EBUSY.
+			//
+			// This can happen when a snap has a service, for example one using
+			// a library mounted via a bind mount and an absent content
+			// connection. Subsequent connection of the content connection will
+			// trigger re-population of the mount namespace, which will start
+			// by tearing down the existing file bind-mount. To prevent this,
+			// detach the mount instead.
+			if !entry.XSnapdDetach() {
+				entry.Options = append(entry.Options, osutil.XSnapdDetach())
+			}
 		}
 		// Unmount all changes that were not eliminated.
 		changes = append(changes, &Change{Action: Unmount, Entry: entry})
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/change_test.go snapd-2.48.3+20.04/cmd/snap-update-ns/change_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/change_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/change_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -134,11 +134,18 @@
 func (s *changeSuite) TestNeededChangesNoChangeNew(c *C) {
 	s.enableRobustMountNamespaceUpdates(c)
 
-	current := &osutil.MountProfile{Entries: []osutil.MountEntry{{Dir: "/common/stuff"}}}
+	current := &osutil.MountProfile{
+		Entries: []osutil.MountEntry{
+			{Dir: "/common/stuff"},
+			{Dir: "/common/file", Options: []string{"bind", "x-snapd.kind=file"}},
+		},
+	}
 	desired := &osutil.MountProfile{Entries: []osutil.MountEntry{{Dir: "/common/stuff"}}}
 	changes := update.NeededChanges(current, desired)
 	c.Assert(changes, DeepEquals, []*update.Change{
 		{Entry: osutil.MountEntry{Dir: "/common/stuff"}, Action: update.Unmount},
+		// File bind mounts are detached.
+		{Entry: osutil.MountEntry{Dir: "/common/file", Options: []string{"bind", "x-snapd.kind=file", "x-snapd.detach"}}, Action: update.Unmount},
 		{Entry: osutil.MountEntry{Dir: "/common/stuff"}, Action: update.Mount},
 	})
 }
@@ -2984,3 +2991,40 @@
 		{Action: update.Mount, Entry: osutil.MountEntry{Name: "/snap/app/x2/b", Dir: "/snap/app/x2/d", Type: "none", Options: []string{"rbind", "rw", "x-snapd.origin=layout"}}},
 	})
 }
+
+func (s *changeSuite) TestUnmountFailsWithEINVALAndUnmounted(c *C) {
+	// We wanted to unmount /target, which failed with EINVAL.
+	// Because /target is no longer mounted, we consume the error and carry on.
+	restore := osutil.MockMountInfo("")
+	defer restore()
+	s.sys.InsertFault(`unmount "/target" UMOUNT_NOFOLLOW`, syscall.EINVAL)
+	s.sys.InsertFstatResult(`fstat 4 <ptr>`, syscall.Stat_t{})
+	s.sys.InsertFstatfsResult(`fstatfs 4 <ptr>`, syscall.Statfs_t{})
+	chg := &update.Change{Action: update.Unmount, Entry: osutil.MountEntry{Name: "tmpfs", Dir: "/target", Type: "tmpfs"}}
+	_, err := chg.Perform(s.as)
+	c.Assert(err, IsNil)
+	c.Assert(s.sys.RCalls(), testutil.SyscallsEqual, []testutil.CallResultError{
+		{C: `unmount "/target" UMOUNT_NOFOLLOW`, E: syscall.EINVAL},
+		{C: `open "/" O_NOFOLLOW|O_CLOEXEC|O_DIRECTORY|O_PATH 0`, R: 3},
+		{C: `openat 3 "target" O_NOFOLLOW|O_CLOEXEC|O_PATH 0`, R: 4},
+		{C: `fstat 4 <ptr>`, R: syscall.Stat_t{}},
+		{C: `close 3`},
+		{C: `fstatfs 4 <ptr>`, R: syscall.Statfs_t{}},
+		{C: `remove "/target"`},
+		{C: `close 4`},
+	})
+}
+
+func (s *changeSuite) TestUnmountFailsWithEINVALButStillMounted(c *C) {
+	// We wanted to unmount /target, which failed with EINVAL.
+	// Because /target is still mounted, we propagate the error.
+	restore := osutil.MockMountInfo("132 28 0:82 / /target rw,relatime shared:74 - tmpfs tmpfs rw")
+	defer restore()
+	s.sys.InsertFault(`unmount "/target" UMOUNT_NOFOLLOW`, syscall.EINVAL)
+	chg := &update.Change{Action: update.Unmount, Entry: osutil.MountEntry{Name: "tmpfs", Dir: "/target", Type: "tmpfs"}}
+	_, err := chg.Perform(s.as)
+	c.Assert(err, Equals, syscall.EINVAL)
+	c.Assert(s.sys.RCalls(), testutil.SyscallsEqual, []testutil.CallResultError{
+		{C: `unmount "/target" UMOUNT_NOFOLLOW`, E: syscall.EINVAL},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/sorting.go snapd-2.48.3+20.04/cmd/snap-update-ns/sorting.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/sorting.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/sorting.go	2021-02-02 08:21:12.000000000 +0000
@@ -38,11 +38,17 @@
 
 	iOrigin := iMe.XSnapdOrigin()
 	jOrigin := jMe.XSnapdOrigin()
-	if iOrigin == "overname" && iOrigin != jOrigin {
-		// should ith element be created by 'overname' mapping, it is
-		// always sorted before jth element, if that one comes from
-		// layouts or content interface
-		return true
+	if iOrigin != jOrigin {
+		// overname entries should always be sorted first, before
+		// entries from layouts or content interface
+		if iOrigin == "overname" {
+			// overname ith element should be sorted before
+			return true
+		}
+		if jOrigin == "overname" {
+			// non-overname ith element should be sorted after
+			return false
+		}
 	}
 
 	iDir := c[i].Dir
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/sorting_test.go snapd-2.48.3+20.04/cmd/snap-update-ns/sorting_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/sorting_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/sorting_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -52,21 +52,59 @@
 func (s *sortSuite) TestParallelInstancesAndSimple(c *C) {
 	// Naively sorted entries.
 	entries := []osutil.MountEntry{
-		{Dir: "/a/b"},
 		{Dir: "/a/b-1"},
+		{Dir: "/a/b", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/bar/baz", Options: []string{osutil.XSnapdOriginLayout()}},
 		{Dir: "/snap/bar", Options: []string{osutil.XSnapdOriginOvername()}},
 		{Dir: "/a/b-1/3"},
-		{Dir: "/foo/bar", Options: []string{osutil.XSnapdOriginOvername()}},
+		{Dir: "/var/snap/bar", Options: []string{osutil.XSnapdOriginOvername()}},
 		{Dir: "/a/b/c"},
 	}
 	sort.Sort(byOriginAndMagicDir(entries))
 	// Entries sorted as if they had a trailing slash.
 	c.Assert(entries, DeepEquals, []osutil.MountEntry{
-		{Dir: "/foo/bar", Options: []string{osutil.XSnapdOriginOvername()}},
 		{Dir: "/snap/bar", Options: []string{osutil.XSnapdOriginOvername()}},
+		{Dir: "/var/snap/bar", Options: []string{osutil.XSnapdOriginOvername()}},
 		{Dir: "/a/b-1"},
 		{Dir: "/a/b-1/3"},
-		{Dir: "/a/b"},
+		{Dir: "/a/b", Options: []string{osutil.XSnapdOriginLayout()}},
 		{Dir: "/a/b/c"},
+		{Dir: "/snap/bar/baz", Options: []string{osutil.XSnapdOriginLayout()}},
+	})
+}
+
+func (s *sortSuite) TestParallelInstancesAlmostSorted(c *C) {
+	// use a mount profile that was seen to be broken in the wild
+	entries := []osutil.MountEntry{
+		{Dir: "/snap/foo", Options: []string{osutil.XSnapdOriginOvername()}},
+		{Dir: "/var/snap/foo", Options: []string{osutil.XSnapdOriginOvername()}},
+		{Dir: "/snap/foo/44/foo/certs", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/foo/44/foo/config", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/foo/44/usr/bin/python", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/foo/44/usr/bin/python3", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/java", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/java8", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/node", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/nodejs12x", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/python2.7", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/python3.7", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/python3.8", Options: []string{osutil.XSnapdOriginLayout()}},
+	}
+	sort.Sort(byOriginAndMagicDir(entries))
+	// overname entries are always first
+	c.Assert(entries, DeepEquals, []osutil.MountEntry{
+		{Dir: "/snap/foo", Options: []string{osutil.XSnapdOriginOvername()}},
+		{Dir: "/var/snap/foo", Options: []string{osutil.XSnapdOriginOvername()}},
+		{Dir: "/snap/foo/44/foo/certs", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/foo/44/foo/config", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/foo/44/usr/bin/python", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/snap/foo/44/usr/bin/python3", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/java", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/java8", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/node", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/nodejs12x", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/python2.7", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/python3.7", Options: []string{osutil.XSnapdOriginLayout()}},
+		{Dir: "/usr/bin/python3.8", Options: []string{osutil.XSnapdOriginLayout()}},
 	})
 }
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/system.go snapd-2.48.3+20.04/cmd/snap-update-ns/system.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/system.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/system.go	2021-02-02 08:21:12.000000000 +0000
@@ -72,6 +72,19 @@
 	if snapName := snap.InstanceSnap(instanceName); snapName != instanceName {
 		as.AddUnrestrictedPaths("/snap/" + snapName)
 	}
+	// Allow snap-update-ns to write to host's /tmp directory. This is
+	// specifically here to allow two snaps to share X11 sockets that are placed
+	// in the /tmp/.X11-unix/ directory in the private /tmp directories provided
+	// by snap-confine. The X11 interface cannot offer a precise permission for
+	// the slot-side snap, as there is no mechanism to convey this information.
+	// As such, provide write access to all of /tmp.
+	as.AddUnrestrictedPaths("/var/lib/snapd/hostfs/tmp")
+	as.AddModeHint("/var/lib/snapd/hostfs/tmp/snap.*", 0700)
+	as.AddModeHint("/var/lib/snapd/hostfs/tmp/snap.*/tmp", 1777)
+	// This is to ensure that unprivileged users can create the socket. This
+	// permission only matters if the plug-side app constructs its mount
+	// namespace before the slot-side app is launched.
+	as.AddModeHint("/var/lib/snapd/hostfs/tmp/snap.*/tmp/.X11-unix", 1777)
 	return as
 }
 
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/system_test.go snapd-2.48.3+20.04/cmd/snap-update-ns/system_test.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/system_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/system_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -52,12 +52,19 @@
 	// Non-instances can access /tmp, /var/snap and /snap/$SNAP_NAME
 	upCtx := update.NewSystemProfileUpdateContext("foo", false)
 	as := upCtx.Assumptions()
-	c.Check(as.UnrestrictedPaths(), DeepEquals, []string{"/tmp", "/var/snap", "/snap/foo"})
+	c.Check(as.UnrestrictedPaths(), DeepEquals, []string{"/tmp", "/var/snap", "/snap/foo", "/var/lib/snapd/hostfs/tmp"})
+	c.Check(as.ModeForPath("/stuff"), Equals, os.FileMode(0755))
+	c.Check(as.ModeForPath("/tmp"), Equals, os.FileMode(0755))
+	c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp"), Equals, os.FileMode(0755))
+	c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap.x11-server"), Equals, os.FileMode(0700))
+	c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap.x11-server/tmp"), Equals, os.FileMode(1777))
+	c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap.x11-server/foo"), Equals, os.FileMode(0755))
+	c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap.x11-server/tmp/.X11-unix"), Equals, os.FileMode(1777))
 
 	// Instances can, in addition, access /snap/$SNAP_INSTANCE_NAME
 	upCtx = update.NewSystemProfileUpdateContext("foo_instance", false)
 	as = upCtx.Assumptions()
-	c.Check(as.UnrestrictedPaths(), DeepEquals, []string{"/tmp", "/var/snap", "/snap/foo_instance", "/snap/foo"})
+	c.Check(as.UnrestrictedPaths(), DeepEquals, []string{"/tmp", "/var/snap", "/snap/foo_instance", "/snap/foo", "/var/lib/snapd/hostfs/tmp"})
 }
 
 func (s *systemSuite) TestLoadDesiredProfile(c *C) {
diff -Nru snapd-2.45.1+20.04.2/cmd/snap-update-ns/trespassing.go snapd-2.48.3+20.04/cmd/snap-update-ns/trespassing.go
--- snapd-2.45.1+20.04.2/cmd/snap-update-ns/trespassing.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/snap-update-ns/trespassing.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,7 @@
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 	"syscall"
@@ -42,6 +43,16 @@
 	// major:minor number is packed into one uint64 as in syscall.Stat_t.Dev
 	// field.
 	verifiedDevices map[uint64]bool
+
+	// modeHints overrides implicit 0755 mode of directories created while
+	// ensuring source and target paths exist.
+	modeHints []ModeHint
+}
+
+// ModeHint provides mode for directories created to satisfy mount changes.
+type ModeHint struct {
+	PathGlob string
+	Mode     os.FileMode
 }
 
 // AddUnrestrictedPaths adds a list of directories where writing is allowed
@@ -52,6 +63,36 @@
 	as.unrestrictedPaths = append(as.unrestrictedPaths, paths...)
 }
 
+// AddModeHint adds a path glob and mode used when creating path elements.
+func (as *Assumptions) AddModeHint(pathGlob string, mode os.FileMode) {
+	as.modeHints = append(as.modeHints, ModeHint{PathGlob: pathGlob, Mode: mode})
+}
+
+// ModeForPath returns the mode for creating a directory at a given path.
+//
+// The default mode is 0755 but AddModeHint calls can influence the mode at a
+// specific path. When matching path elements, "*" does not match the directory
+// separator. In effect it can only be used as a wildcard for a specific
+// directory name. This constraint makes hints easier to model in practice.
+//
+// When multiple hints match the given path, ModeForPath panics.
+func (as *Assumptions) ModeForPath(path string) os.FileMode {
+	mode := os.FileMode(0755)
+	var foundHint *ModeHint
+	for _, hint := range as.modeHints {
+		if ok, _ := filepath.Match(hint.PathGlob, path); ok {
+			if foundHint == nil {
+				mode = hint.Mode
+				foundHint = &hint
+			} else {
+				panic(fmt.Errorf("cannot find unique mode for path %q: %q and %q both provide hints",
+					path, foundHint.PathGlob, foundHint.PathGlob))
+			}
+		}
+	}
+	return mode
+}
+
 // isRestricted checks whether a path falls under restricted writing scheme.
 //
 // Provided path is the full, absolute path of the entity that needs to be
diff -Nru snapd-2.45.1+20.04.2/cmd/version.go snapd-2.48.3+20.04/cmd/version.go
--- snapd-2.45.1+20.04.2/cmd/version.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/cmd/version.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,31 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2016 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package cmd
-
-//go:generate mkversion.sh
-
-// Version will be overwritten at build-time via mkversion.sh
-var Version = "unknown"
-
-func MockVersion(version string) (restore func()) {
-	old := Version
-	Version = version
-	return func() { Version = old }
-}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_console_conf.go snapd-2.48.3+20.04/daemon/api_console_conf.go
--- snapd-2.45.1+20.04.2/daemon/api_console_conf.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_console_conf.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,96 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/overlord/auth"
+)
+
+var (
+	routineConsoleConfStartCmd = &Command{
+		Path: "/v2/internal/console-conf-start",
+		POST: consoleConfStartRoutine,
+	}
+)
+
+var delayTime = 20 * time.Minute
+
+type consoleConfRoutine struct{}
+
+// ConsoleConfStartRoutineResult is the result of running the console-conf start
+// routine..
+type ConsoleConfStartRoutineResult struct {
+	ActiveAutoRefreshChanges []string `json:"active-auto-refreshes,omitempty"`
+	ActiveAutoRefreshSnaps   []string `json:"active-auto-refresh-snaps,omitempty"`
+}
+
+func consoleConfStartRoutine(c *Command, r *http.Request, _ *auth.UserState) Response {
+	// no body expected, error if we were provided anything
+	defer r.Body.Close()
+	var routineBody struct{}
+	decoder := json.NewDecoder(r.Body)
+	if err := decoder.Decode(&routineBody); err != nil && err != io.EOF {
+		return BadRequest("cannot decode request body into console-conf operation: %v", err)
+	}
+
+	// now run the start routine first by trying to grab a lock on the refreshes
+	// for all snaps, which fails if there are any active changes refreshing
+	// snaps
+	st := c.d.overlord.State()
+	st.Lock()
+	defer st.Unlock()
+
+	snapAutoRefreshChanges, err := c.d.overlord.SnapManager().EnsureAutoRefreshesAreDelayed(delayTime)
+	if err != nil {
+		return InternalError(err.Error())
+	}
+
+	logger.Debugf("Ensured that new auto refreshes are delayed by %s to allow console-conf to run", delayTime)
+
+	if len(snapAutoRefreshChanges) == 0 {
+		// no changes yet, and we delayed the refresh successfully so
+		// console-conf is okay to run normally
+		return SyncResponse(&ConsoleConfStartRoutineResult{}, nil)
+	}
+
+	chgIds := make([]string, 0, len(snapAutoRefreshChanges))
+	snapNames := make([]string, 0)
+	for _, chg := range snapAutoRefreshChanges {
+		chgIds = append(chgIds, chg.ID())
+		var updatedSnaps []string
+		err := chg.Get("snap-names", &updatedSnaps)
+		if err != nil {
+			return InternalError(err.Error())
+		}
+		snapNames = append(snapNames, updatedSnaps...)
+	}
+
+	// we have changes that the client should wait for before being ready
+	return SyncResponse(&ConsoleConfStartRoutineResult{
+		ActiveAutoRefreshChanges: chgIds,
+		ActiveAutoRefreshSnaps:   snapNames,
+	}, nil)
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_console_conf_test.go snapd-2.48.3+20.04/daemon/api_console_conf_test.go
--- snapd-2.45.1+20.04.2/daemon/api_console_conf_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_console_conf_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,116 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"bytes"
+	"net/http"
+	"sort"
+	"time"
+
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"gopkg.in/check.v1"
+	. "gopkg.in/check.v1"
+)
+
+var _ = Suite(&consoleConfSuite{})
+
+type consoleConfSuite struct {
+	apiBaseSuite
+}
+
+func (s *consoleConfSuite) TestPostConsoleConfStartRoutine(c *C) {
+	t0 := time.Now()
+	d := s.daemonWithOverlordMock(c)
+	snapMgr, err := snapstate.Manager(d.overlord.State(), d.overlord.TaskRunner())
+	c.Assert(err, check.IsNil)
+	d.overlord.AddManager(snapMgr)
+
+	st := d.overlord.State()
+
+	body := bytes.NewBuffer(nil)
+	req, err := http.NewRequest("POST", "/v2/internal/console-conf-start", body)
+	c.Assert(err, IsNil)
+
+	// no changes in state, no changes in response
+	rsp := consoleConfStartRoutine(routineConsoleConfStartCmd, req, nil).(*resp)
+	c.Check(rsp.Type, Equals, ResponseTypeSync)
+	c.Assert(rsp.Result, DeepEquals, &ConsoleConfStartRoutineResult{})
+
+	// we did set the refresh.hold time back 20 minutes though
+	st.Lock()
+	defer st.Unlock()
+
+	tr := config.NewTransaction(st)
+	var t1 time.Time
+	err = tr.Get("core", "refresh.hold", &t1)
+	c.Assert(err, IsNil)
+
+	c.Assert(t0.Add(20*time.Minute).After(t1), Equals, false)
+
+	// if we add some changes to state that are in progress, then they are
+	// returned
+
+	// now make some auto-refresh changes to make sure we get those figured out
+	chg0 := st.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg0.AddTask(st.NewTask("nop", "do nothing"))
+
+	// make it in doing state
+	chg0.SetStatus(state.DoingStatus)
+	chg0.Set("snap-names", []string{"doing-snap"})
+
+	// this one will be picked up too
+	chg1 := st.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg1.AddTask(st.NewTask("nop", "do nothing"))
+	chg1.SetStatus(state.DoStatus)
+	chg1.Set("snap-names", []string{"do-snap"})
+
+	// this one won't, it's Done
+	chg2 := st.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg2.AddTask(st.NewTask("nop", "do nothing"))
+	chg2.SetStatus(state.DoneStatus)
+	chg2.Set("snap-names", []string{"done-snap"})
+
+	// nor this one, it's Undone
+	chg3 := st.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg3.AddTask(st.NewTask("nop", "do nothing"))
+	chg3.SetStatus(state.UndoneStatus)
+	chg3.Set("snap-names", []string{"undone-snap"})
+
+	st.Unlock()
+	defer st.Lock()
+
+	req2, err := http.NewRequest("POST", "/v2/internal/console-conf-start", body)
+	c.Assert(err, IsNil)
+	rsp2 := consoleConfStartRoutine(routineConsoleConfStartCmd, req2, nil).(*resp)
+	c.Check(rsp2.Type, Equals, ResponseTypeSync)
+	c.Assert(rsp2.Result, FitsTypeOf, &ConsoleConfStartRoutineResult{})
+	res := rsp2.Result.(*ConsoleConfStartRoutineResult)
+	sort.Strings(res.ActiveAutoRefreshChanges)
+	sort.Strings(res.ActiveAutoRefreshSnaps)
+	expChgs := []string{chg0.ID(), chg1.ID()}
+	sort.Strings(expChgs)
+	c.Assert(res, DeepEquals, &ConsoleConfStartRoutineResult{
+		ActiveAutoRefreshChanges: expChgs,
+		ActiveAutoRefreshSnaps:   []string{"do-snap", "doing-snap"},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_debug.go snapd-2.48.3+20.04/daemon/api_debug.go
--- snapd-2.45.1+20.04.2/daemon/api_debug.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_debug.go	2021-02-02 08:21:12.000000000 +0000
@@ -288,6 +288,8 @@
 		startupTag := query.Get("startup")
 		all := query.Get("all")
 		return getChangeTimings(st, chgID, ensureTag, startupTag, all == "true")
+	case "seeding":
+		return getSeedingInfo(st)
 	default:
 		return BadRequest("unknown debug aspect %q", aspect)
 	}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_debug_seeding.go snapd-2.48.3+20.04/daemon/api_debug_seeding.go
--- snapd-2.45.1+20.04.2/daemon/api_debug_seeding.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_debug_seeding.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,131 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"time"
+
+	"github.com/snapcore/snapd/overlord/state"
+)
+
+type seedingInfo struct {
+	// Seeded is true when the device was seeded (same as "seeded" in the
+	// state).
+	Seeded bool `json:"seeded,omitempty"`
+
+	// Preseeded is true if snap-preseed was applied.
+	Preseeded bool `json:"preseeded,omitempty"`
+
+	// PreseedStartTime is when snap-preseed was started.
+	PreseedStartTime *time.Time `json:"preseed-start-time,omitempty"`
+
+	// PreseedTime is when snap-preseed work finished (i.e. before firstboot).
+	PreseedTime *time.Time `json:"preseed-time,omitempty"`
+
+	// SeedStartTime is when traditional seeding started (when not preseeding).
+	SeedStartTime *time.Time `json:"seed-start-time,omitempty"`
+
+	// SeedRestartTime is when seeding was started after first boot of preseeded
+	// image.
+	SeedRestartTime *time.Time `json:"seed-restart-time,omitempty"`
+
+	// SeedTime is when seeding finished.
+	SeedTime *time.Time `json:"seed-time,omitempty"`
+
+	// PreseedSystemKey is the system-key that was created during preseeding
+	// (when snap-preseed was ran).
+	PreseedSystemKey interface{} `json:"preseed-system-key,omitempty"`
+
+	// SeedRestartSystemKey is the system-key that was created on first boot of the
+	// preseeded image.
+	SeedRestartSystemKey interface{} `json:"seed-restart-system-key,omitempty"`
+
+	// SeedError is set if no seed change succeeded yet and at
+	// least one was in error. It is set to the error of the
+	// oldest known in error one.
+	SeedError string `json:"seed-error,omitempty"`
+}
+
+func getSeedingInfo(st *state.State) Response {
+	var seeded, preseeded bool
+	err := st.Get("seeded", &seeded)
+	if err != nil && err != state.ErrNoState {
+		return InternalError(err.Error())
+	}
+	if err = st.Get("preseeded", &preseeded); err != nil && err != state.ErrNoState {
+		return InternalError(err.Error())
+	}
+
+	var preseedSysKey, seedRestartSysKey interface{}
+	if err := st.Get("preseed-system-key", &preseedSysKey); err != nil && err != state.ErrNoState {
+		return InternalError(err.Error())
+	}
+	if err := st.Get("seed-restart-system-key", &seedRestartSysKey); err != nil && err != state.ErrNoState {
+		return InternalError(err.Error())
+	}
+
+	var seedError string
+	var seedErrorChangeTime time.Time
+	if !seeded {
+		for _, chg := range st.Changes() {
+			if chg.Kind() != "seed" && !chg.IsReady() {
+				continue
+			}
+			if err := chg.Err(); err != nil {
+				if seedErrorChangeTime.IsZero() || chg.SpawnTime().Before(seedErrorChangeTime) {
+					seedError = chg.Err().Error()
+					seedErrorChangeTime = chg.SpawnTime()
+				}
+			}
+		}
+	}
+
+	data := &seedingInfo{
+		Seeded:               seeded,
+		SeedError:            seedError,
+		Preseeded:            preseeded,
+		PreseedSystemKey:     preseedSysKey,
+		SeedRestartSystemKey: seedRestartSysKey,
+	}
+
+	for _, t := range []struct {
+		name   string
+		destTm **time.Time
+	}{
+		{"preseed-start-time", &data.PreseedStartTime},
+		{"preseed-time", &data.PreseedTime},
+		{"seed-start-time", &data.SeedStartTime},
+		{"seed-restart-time", &data.SeedRestartTime},
+		{"seed-time", &data.SeedTime},
+	} {
+		var tm time.Time
+		if err := st.Get(t.name, &tm); err != nil && err != state.ErrNoState {
+			return InternalError(err.Error())
+		}
+		if !tm.IsZero() {
+			*t.destTm = &tm
+		}
+	}
+
+	// XXX: consistency & sanity checks, e.g. if preseeded, then need to have
+	// preseed-start-time, preseeded-time, preseed-system-key etc?
+
+	return SyncResponse(data, nil)
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_debug_seeding_test.go snapd-2.48.3+20.04/daemon/api_debug_seeding_test.go
--- snapd-2.45.1+20.04.2/daemon/api_debug_seeding_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_debug_seeding_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,217 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"net/http"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/overlord/state"
+)
+
+var _ = Suite(&seedingDebugSuite{})
+
+type seedingDebugSuite struct {
+	apiBaseSuite
+}
+
+func (s *seedingDebugSuite) SetUpTest(c *C) {
+	s.apiBaseSuite.SetUpTest(c)
+	s.daemonWithOverlordMock(c)
+}
+
+func (s *seedingDebugSuite) getSeedingDebug(c *C) interface{} {
+	req, err := http.NewRequest("GET", "/v2/debug?aspect=seeding", nil)
+	c.Assert(err, IsNil)
+
+	rsp := getDebug(debugCmd, req, nil).(*resp)
+	c.Assert(rsp.Type, Equals, ResponseTypeSync)
+	return rsp.Result
+}
+
+func (s *seedingDebugSuite) TestNoData(c *C) {
+	data := s.getSeedingDebug(c)
+	c.Check(data, NotNil)
+	c.Check(data, DeepEquals, &seedingInfo{})
+}
+
+func (s *seedingDebugSuite) TestSeedingDebug(c *C) {
+	seeded := true
+	preseeded := true
+	key1 := "foo"
+	key2 := "bar"
+
+	preseedStartTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:00Z")
+	c.Assert(err, IsNil)
+	preseedTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:01Z")
+	c.Assert(err, IsNil)
+	seedRestartTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:03Z")
+	c.Assert(err, IsNil)
+	seedTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:07Z")
+	c.Assert(err, IsNil)
+
+	st := s.d.overlord.State()
+	st.Lock()
+
+	st.Set("preseeded", preseeded)
+	st.Set("seeded", seeded)
+
+	st.Set("preseed-system-key", key1)
+	st.Set("seed-restart-system-key", key2)
+
+	st.Set("preseed-start-time", preseedStartTime)
+	st.Set("seed-restart-time", seedRestartTime)
+
+	st.Set("preseed-time", preseedTime)
+	st.Set("seed-time", seedTime)
+
+	st.Unlock()
+
+	data := s.getSeedingDebug(c)
+	c.Check(data, DeepEquals, &seedingInfo{
+		Seeded:               true,
+		Preseeded:            true,
+		PreseedSystemKey:     "foo",
+		SeedRestartSystemKey: "bar",
+		PreseedStartTime:     &preseedStartTime,
+		PreseedTime:          &preseedTime,
+		SeedRestartTime:      &seedRestartTime,
+		SeedTime:             &seedTime,
+	})
+}
+
+func (s *seedingDebugSuite) TestSeedingDebugSeededNoTimes(c *C) {
+	seedTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:07Z")
+	c.Assert(err, IsNil)
+
+	st := s.d.overlord.State()
+	st.Lock()
+
+	// only set seed-time and seeded
+	st.Set("seed-time", seedTime)
+	st.Set("seeded", true)
+
+	st.Unlock()
+
+	data := s.getSeedingDebug(c)
+	c.Check(data, DeepEquals, &seedingInfo{
+		Seeded:   true,
+		SeedTime: &seedTime,
+	})
+}
+
+func (s *seedingDebugSuite) TestSeedingDebugPreseededStillSeeding(c *C) {
+	preseedStartTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:00Z")
+	c.Assert(err, IsNil)
+	preseedTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:01Z")
+	c.Assert(err, IsNil)
+	seedRestartTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:03Z")
+	c.Assert(err, IsNil)
+
+	st := s.d.overlord.State()
+	st.Lock()
+
+	st.Set("preseeded", true)
+	st.Set("seeded", false)
+
+	st.Set("preseed-system-key", "foo")
+	st.Set("seed-restart-system-key", "bar")
+
+	st.Set("preseed-start-time", preseedStartTime)
+	st.Set("seed-restart-time", seedRestartTime)
+
+	st.Set("preseed-time", preseedTime)
+
+	st.Unlock()
+
+	data := s.getSeedingDebug(c)
+	c.Check(data, DeepEquals, &seedingInfo{
+		Seeded:               false,
+		Preseeded:            true,
+		PreseedSystemKey:     "foo",
+		SeedRestartSystemKey: "bar",
+		PreseedStartTime:     &preseedStartTime,
+		PreseedTime:          &preseedTime,
+		SeedRestartTime:      &seedRestartTime,
+	})
+}
+
+func (s *seedingDebugSuite) TestSeedingDebugPreseededSeedError(c *C) {
+	preseedStartTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:00Z")
+	c.Assert(err, IsNil)
+	preseedTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:01Z")
+	c.Assert(err, IsNil)
+	seedRestartTime, err := time.Parse(time.RFC3339, "2020-01-01T10:00:03Z")
+	c.Assert(err, IsNil)
+
+	st := s.d.overlord.State()
+	st.Lock()
+
+	st.Set("preseeded", true)
+	st.Set("seeded", false)
+
+	st.Set("preseed-system-key", "foo")
+	st.Set("seed-restart-system-key", "bar")
+
+	st.Set("preseed-start-time", preseedStartTime)
+	st.Set("seed-restart-time", seedRestartTime)
+
+	st.Set("preseed-time", preseedTime)
+
+	chg1 := st.NewChange("seed", "tentative 1")
+	t11 := st.NewTask("seed task", "t11")
+	t12 := st.NewTask("seed task", "t12")
+	chg1.AddTask(t11)
+	chg1.AddTask(t12)
+	t11.SetStatus(state.UndoneStatus)
+	t11.Errorf("t11: undone")
+	t12.SetStatus(state.ErrorStatus)
+	t12.Errorf("t12: fail")
+
+	// ensure different spawn time
+	time.Sleep(50 * time.Millisecond)
+	chg2 := st.NewChange("seed", "tentative 2")
+	t21 := st.NewTask("seed task", "t21")
+	chg2.AddTask(t21)
+	t21.SetStatus(state.ErrorStatus)
+	t21.Errorf("t21: error")
+
+	chg3 := st.NewChange("seed", "tentative 3")
+	t31 := st.NewTask("seed task", "t31")
+	chg3.AddTask(t31)
+	t31.SetStatus(state.DoingStatus)
+
+	st.Unlock()
+
+	data := s.getSeedingDebug(c)
+	c.Check(data, DeepEquals, &seedingInfo{
+		Seeded:               false,
+		Preseeded:            true,
+		PreseedSystemKey:     "foo",
+		SeedRestartSystemKey: "bar",
+		PreseedStartTime:     &preseedStartTime,
+		PreseedTime:          &preseedTime,
+		SeedRestartTime:      &seedRestartTime,
+		SeedError: `cannot perform the following tasks:
+- t12 (t12: fail)`,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_download.go snapd-2.48.3+20.04/daemon/api_download.go
--- snapd-2.45.1+20.04.2/daemon/api_download.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_download.go	2021-02-02 08:21:12.000000000 +0000
@@ -125,7 +125,7 @@
 			CohortKey:    action.CohortKey,
 			Channel:      action.Channel,
 		}}
-		results, err := theStore.SnapAction(context.TODO(), nil, actions, user, nil)
+		results, _, err := theStore.SnapAction(context.TODO(), nil, actions, nil, user, nil)
 		if err != nil {
 			return errToResponse(err, []string{action.SnapName}, InternalError, "cannot download snap: %v")
 		}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_download_test.go snapd-2.48.3+20.04/daemon/api_download_test.go
--- snapd-2.45.1+20.04.2/daemon/api_download_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_download_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -125,7 +125,10 @@
 	},
 }
 
-func (s *snapDownloadSuite) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (s *snapDownloadSuite) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
 	if len(actions) != 1 {
 		panic(fmt.Sprintf("unexpected amount of actions: %v", len(actions)))
 	}
@@ -135,7 +138,7 @@
 	}
 	info, ok := storeSnaps[action.InstanceName]
 	if !ok {
-		return nil, store.ErrSnapNotFound
+		return nil, nil, store.ErrSnapNotFound
 	}
 	if action.Channel != info.Channel {
 		panic(fmt.Sprintf("unexpected channel %q for %v snap", action.Channel, action.InstanceName))
@@ -143,7 +146,7 @@
 	if !action.Revision.Unset() && action.Revision != info.Revision {
 		panic(fmt.Sprintf("unexpected revision %q for %s snap", action.Revision, action.InstanceName))
 	}
-	return []store.SnapActionResult{{Info: info}}, nil
+	return []store.SnapActionResult{{Info: info}}, nil, nil
 }
 
 func (s *snapDownloadSuite) DownloadStream(ctx context.Context, name string, downloadInfo *snap.DownloadInfo, resume int64, user *auth.UserState) (io.ReadCloser, int, error) {
diff -Nru snapd-2.45.1+20.04.2/daemon/api.go snapd-2.48.3+20.04/daemon/api.go
--- snapd-2.45.1+20.04.2/daemon/api.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api.go	2021-02-02 08:21:12.000000000 +0000
@@ -47,7 +47,7 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/snapasserts"
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
+	"github.com/snapcore/snapd/client/clientutil"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/httputil"
 	"github.com/snapcore/snapd/i18n"
@@ -106,14 +106,19 @@
 	debugPprofCmd,
 	debugCmd,
 	snapshotCmd,
+	snapshotExportCmd,
 	connectionsCmd,
 	modelCmd,
 	cohortsCmd,
 	serialModelCmd,
 	systemsCmd,
 	systemsActionCmd,
+	routineConsoleConfStartCmd,
+	systemRecoveryKeysCmd,
 }
 
+var servicestateControl = servicestate.Control
+
 var (
 	// see daemon.go:canAccess for details how the access is controlled
 	rootCmd = &Command{
@@ -265,6 +270,7 @@
 func sysInfo(c *Command, r *http.Request, user *auth.UserState) Response {
 	st := c.d.overlord.State()
 	snapMgr := c.d.overlord.SnapManager()
+	deviceMgr := c.d.overlord.DeviceManager()
 	st.Lock()
 	defer st.Unlock()
 	nextRefresh := snapMgr.NextRefresh()
@@ -304,6 +310,7 @@
 		},
 		"refresh":      refreshInfo,
 		"architecture": arch.DpkgArchitecture(),
+		"system-mode":  deviceMgr.SystemMode(),
 	}
 	if systemdVirt != "" {
 		m["virtualization"] = systemdVirt
@@ -411,7 +418,9 @@
 		return InternalError("cannot build URL for %q snap: %v", name, err)
 	}
 
-	result := webify(mapLocal(about), url.String())
+	sd := servicestate.NewStatusDecorator(progress.Null)
+
+	result := webify(mapLocal(about, sd), url.String())
 
 	return SyncResponse(result, nil)
 }
@@ -457,7 +466,7 @@
 	case store.ErrBadQuery:
 		return SyncResponse(&resp{
 			Type:   ResponseTypeError,
-			Result: &errorResult{Message: err.Error(), Kind: errorKindBadQuery},
+			Result: &errorResult{Message: err.Error(), Kind: client.ErrorKindBadQuery},
 			Status: 400,
 		}, nil)
 	case store.ErrUnauthenticated, store.ErrInvalidCredentials:
@@ -538,7 +547,7 @@
 	case store.ErrBadQuery:
 		return SyncResponse(&resp{
 			Type:   ResponseTypeError,
-			Result: &errorResult{Message: err.Error(), Kind: errorKindBadQuery},
+			Result: &errorResult{Message: err.Error(), Kind: client.ErrorKindBadQuery},
 			Status: 400,
 		}, nil)
 	case store.ErrUnauthenticated, store.ErrInvalidCredentials:
@@ -549,7 +558,7 @@
 				if dnserr, ok := neterr.Err.(*net.DNSError); ok {
 					return SyncResponse(&resp{
 						Type:   ResponseTypeError,
-						Result: &errorResult{Message: dnserr.Error(), Kind: errorKindDNSFailure},
+						Result: &errorResult{Message: dnserr.Error(), Kind: client.ErrorKindDNSFailure},
 						Status: 400,
 					}, nil)
 				}
@@ -558,14 +567,14 @@
 		if e, ok := err.(net.Error); ok && e.Timeout() {
 			return SyncResponse(&resp{
 				Type:   ResponseTypeError,
-				Result: &errorResult{Message: err.Error(), Kind: errorKindNetworkTimeout},
+				Result: &errorResult{Message: err.Error(), Kind: client.ErrorKindNetworkTimeout},
 				Status: 400,
 			}, nil)
 		}
-		if e, ok := err.(*httputil.PerstistentNetworkError); ok {
+		if e, ok := err.(*httputil.PersistentNetworkError); ok {
 			return SyncResponse(&resp{
 				Type:   ResponseTypeError,
-				Result: &errorResult{Message: e.Error(), Kind: errorKindDNSFailure},
+				Result: &errorResult{Message: e.Error(), Kind: client.ErrorKindDNSFailure},
 				Status: 400,
 			}, nil)
 		}
@@ -716,6 +725,7 @@
 
 	results := make([]*json.RawMessage, len(found))
 
+	sd := servicestate.NewStatusDecorator(progress.Null)
 	for i, x := range found {
 		name := x.info.InstanceName()
 		rev := x.info.Revision
@@ -726,7 +736,7 @@
 			continue
 		}
 
-		data, err := json.Marshal(webify(mapLocal(x), url.String()))
+		data, err := json.Marshal(webify(mapLocal(x, sd), url.String()))
 		if err != nil {
 			return InternalError("cannot serialize snap %q revision %s: %v", name, rev, err)
 		}
@@ -788,6 +798,7 @@
 	JailMode         bool `json:"jailmode"`
 	Classic          bool `json:"classic"`
 	IgnoreValidation bool `json:"ignore-validation"`
+	IgnoreRunning    bool `json:"ignore-running"`
 	Unaliased        bool `json:"unaliased"`
 	Purge            bool `json:"purge,omitempty"`
 	// dropping support temporarely until flag confusion is sorted,
@@ -823,6 +834,10 @@
 	if inst.Unaliased {
 		flags.Unaliased = true
 	}
+	if inst.IgnoreRunning {
+		flags.IgnoreRunning = true
+	}
+
 	return flags, nil
 }
 
@@ -875,6 +890,8 @@
 	snapshotForget  = snapshotstate.Forget
 	snapshotRestore = snapshotstate.Restore
 	snapshotSave    = snapshotstate.Save
+	snapshotExport  = snapshotstate.Export
+	snapshotImport  = snapshotstate.Import
 
 	assertstateRefreshSnapDeclarations = assertstate.RefreshSnapDeclarations
 )
@@ -1016,6 +1033,9 @@
 	if inst.IgnoreValidation {
 		flags.IgnoreValidation = true
 	}
+	if inst.IgnoreRunning {
+		flags.IgnoreRunning = true
+	}
 	if inst.Amend {
 		flags.Amend = true
 	}
@@ -1271,7 +1291,7 @@
 			Type: ResponseTypeError,
 			Result: &errorResult{
 				Message: err.Error(),
-				Kind:    errorKindNotSnap,
+				Kind:    client.ErrorKindNotSnap,
 			},
 			Status: 400,
 		}, nil)
@@ -1320,7 +1340,7 @@
 	}
 
 	// TODO: inst.Amend, etc?
-	if inst.Channel != "" || !inst.Revision.Unset() || inst.DevMode || inst.JailMode || inst.CohortKey != "" || inst.LeaveCohort {
+	if inst.Channel != "" || !inst.Revision.Unset() || inst.DevMode || inst.JailMode || inst.CohortKey != "" || inst.LeaveCohort || inst.Purge {
 		return BadRequest("unsupported option provided for multi-snap operation")
 	}
 	if err := inst.validate(); err != nil {
@@ -1371,7 +1391,16 @@
 func postSnaps(c *Command, r *http.Request, user *auth.UserState) Response {
 	contentType := r.Header.Get("Content-Type")
 
-	if contentType == "application/json" {
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return BadRequest("cannot parse content type: %v", err)
+	}
+
+	if mediaType == "application/json" {
+		charset := strings.ToUpper(params["charset"])
+		if charset != "" && charset != "UTF-8" {
+			return BadRequest("unknown charset in content type: %s", contentType)
+		}
 		return snapsOp(c, r, user)
 	}
 
@@ -1385,11 +1414,6 @@
 	}
 
 	// POSTs to sideload snaps must be a multipart/form-data file upload.
-	_, params, err := mime.ParseMediaType(contentType)
-	if err != nil {
-		return BadRequest("cannot parse POST body: %v", err)
-	}
-
 	form, err := multipart.NewReader(r.Body, params["boundary"]).ReadForm(maxReadBuflen)
 	if err != nil {
 		return BadRequest("cannot read POST form: %v", err)
@@ -1410,6 +1434,7 @@
 	flags.RemoveSnapPath = true
 
 	flags.Unaliased = isTrue(form, "unaliased")
+	flags.IgnoreRunning = isTrue(form, "ignore-running")
 
 	// find the file for the "snap" form field
 	var snapBody multipart.File
@@ -1615,7 +1640,7 @@
 					Type: ResponseTypeError,
 					Result: &errorResult{
 						Message: err.Error(),
-						Kind:    errorKindConfigNoSuchOption,
+						Kind:    client.ErrorKindConfigNoSuchOption,
 						Value:   err,
 					},
 					Status: 400,
@@ -1986,12 +2011,16 @@
 				return false
 			}
 
-			for _, snapName := range snapNames {
+			for _, name := range snapNames {
+				// due to
+				// https://bugs.launchpad.net/snapd/+bug/1880560
+				// the snap-names in service-control changes
+				// could have included <snap>.<app>
+				snapName, _ := snap.SplitSnapApp(name)
 				if snapName == wantedName {
 					return true
 				}
 			}
-
 			return false
 		}
 	}
@@ -2062,7 +2091,7 @@
 			Type: ResponseTypeError,
 			Result: &errorResult{
 				Message: err.Error(),
-				Kind:    errorKindLoginRequired,
+				Kind:    client.ErrorKindLoginRequired,
 			},
 			Status: 400,
 		}, nil)
@@ -2071,7 +2100,7 @@
 			Type: ResponseTypeError,
 			Result: &errorResult{
 				Message: err.Error(),
-				Kind:    errorKindTermsNotAccepted,
+				Kind:    client.ErrorKindTermsNotAccepted,
 			},
 			Status: 400,
 		}, nil)
@@ -2080,7 +2109,7 @@
 			Type: ResponseTypeError,
 			Result: &errorResult{
 				Message: err.Error(),
-				Kind:    errorKindNoPaymentMethods,
+				Kind:    client.ErrorKindNoPaymentMethods,
 			},
 			Status: 400,
 		}, nil)
@@ -2089,7 +2118,7 @@
 			Type: ResponseTypeError,
 			Result: &errorResult{
 				Message: err.Error(),
-				Kind:    errorKindPaymentDeclined,
+				Kind:    client.ErrorKindPaymentDeclined,
 			},
 			Status: 400,
 		}, nil)
@@ -2129,12 +2158,13 @@
 }
 
 func runSnapctl(c *Command, r *http.Request, user *auth.UserState) Response {
-	var snapctlOptions client.SnapCtlOptions
-	if err := jsonutil.DecodeWithNumber(r.Body, &snapctlOptions); err != nil {
+	var snapctlPostData client.SnapCtlPostData
+
+	if err := jsonutil.DecodeWithNumber(r.Body, &snapctlPostData); err != nil {
 		return BadRequest("cannot decode snapctl request: %s", err)
 	}
 
-	if len(snapctlOptions.Args) == 0 {
+	if len(snapctlPostData.Args) == 0 {
 		return BadRequest("snapctl cannot run without args")
 	}
 
@@ -2145,8 +2175,17 @@
 
 	// Ignore missing context error to allow 'snapctl -h' without a context;
 	// Actual context is validated later by get/set.
-	context, _ := c.d.overlord.HookManager().Context(snapctlOptions.ContextID)
-	stdout, stderr, err := ctlcmdRun(context, snapctlOptions.Args, uid)
+	context, _ := c.d.overlord.HookManager().Context(snapctlPostData.ContextID)
+
+	// make the data read from stdin available for the hook
+	// TODO: use a forwarded stdin here
+	if snapctlPostData.Stdin != nil {
+		context.Lock()
+		context.Set("stdin", snapctlPostData.Stdin)
+		context.Unlock()
+	}
+
+	stdout, stderr, err := ctlcmdRun(context, snapctlPostData.Args, uid)
 	if err != nil {
 		if e, ok := err.(*ctlcmd.UnsuccessfulError); ok {
 			result := map[string]interface{}{
@@ -2158,7 +2197,7 @@
 				Type: ResponseTypeError,
 				Result: &errorResult{
 					Message: e.Error(),
-					Kind:    errorKindUnsuccessful,
+					Kind:    client.ErrorKindUnsuccessful,
 					Value:   result,
 				},
 				Status: 200,
@@ -2338,7 +2377,9 @@
 		return rsp
 	}
 
-	clientAppInfos, err := cmd.ClientAppInfosFromSnapAppInfos(appInfos)
+	sd := servicestate.NewStatusDecorator(progress.Null)
+
+	clientAppInfos, err := clientutil.ClientAppInfosFromSnapAppInfos(appInfos, sd)
 	if err != nil {
 		return InternalError("%v", err)
 	}
@@ -2380,7 +2421,7 @@
 		serviceNames[i] = appInfo.ServiceName()
 	}
 
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, progress.Null)
+	sysd := systemd.New(systemd.SystemMode, progress.Null)
 	reader, err := sysd.LogReader(serviceNames, n, follow)
 	if err != nil {
 		return InternalError("cannot get logs: %v", err)
@@ -2392,6 +2433,21 @@
 	}
 }
 
+func namesToSnapNames(inst *servicestate.Instruction) []string {
+	seen := make(map[string]struct{}, len(inst.Names))
+	for _, snapOrSnapDotApp := range inst.Names {
+		snapName, _ := snap.SplitSnapApp(snapOrSnapDotApp)
+		seen[snapName] = struct{}{}
+	}
+	names := make([]string, 0, len(seen))
+	for k := range seen {
+		names = append(names, k)
+	}
+	// keep stable ordering
+	sort.Strings(names)
+	return names
+}
+
 func postApps(c *Command, r *http.Request, user *auth.UserState) Response {
 	var inst servicestate.Instruction
 	decoder := json.NewDecoder(r.Body)
@@ -2415,7 +2471,7 @@
 		return InternalError("no services found")
 	}
 
-	tss, err := servicestate.Control(st, appInfos, &inst, nil)
+	tss, err := servicestateControl(st, appInfos, &inst, nil)
 	if err != nil {
 		// TODO: use errToResponse here too and introduce a proper error kind ?
 		if _, ok := err.(servicestate.ServiceActionConflictError); ok {
@@ -2425,7 +2481,9 @@
 	}
 	st.Lock()
 	defer st.Unlock()
-	chg := newChange(st, "service-control", fmt.Sprintf("Running service command"), tss, inst.Names)
+	// names received in the request can be snap or snap.app, we need to
+	// extract the actual snap names before associating them with a change
+	chg := newChange(st, "service-control", fmt.Sprintf("Running service command"), tss, namesToSnapNames(&inst))
 	st.EnsureBefore(0)
 	return AsyncResponse(nil, &Meta{Change: chg.ID()})
 }
diff -Nru snapd-2.45.1+20.04.2/daemon/api_mock_test.go snapd-2.48.3+20.04/daemon/api_mock_test.go
--- snapd-2.45.1+20.04.2/daemon/api_mock_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_mock_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -51,7 +51,7 @@
 			},
 		},
 		Current:  snapInfo.Revision,
-		SnapType: string(snapInfo.GetType()),
+		SnapType: string(snapInfo.Type()),
 	})
 
 	// Put the snap into the interface repository
diff -Nru snapd-2.45.1+20.04.2/daemon/api_model.go snapd-2.48.3+20.04/daemon/api_model.go
--- snapd-2.45.1+20.04.2/daemon/api_model.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_model.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 	"net/http"
 
 	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/devicestate"
 	"github.com/snapcore/snapd/overlord/state"
@@ -108,7 +109,7 @@
 	if err == state.ErrNoState {
 		res := &errorResult{
 			Message: "no model assertion yet",
-			Kind:    errorKindAssertionNotFound,
+			Kind:    client.ErrorKindAssertionNotFound,
 			Value:   "model",
 		}
 
@@ -153,7 +154,7 @@
 	if err == state.ErrNoState {
 		res := &errorResult{
 			Message: "no serial assertion yet",
-			Kind:    errorKindAssertionNotFound,
+			Kind:    client.ErrorKindAssertionNotFound,
 			Value:   "serial",
 		}
 
diff -Nru snapd-2.45.1+20.04.2/daemon/api_model_test.go snapd-2.48.3+20.04/daemon/api_model_test.go
--- snapd-2.45.1+20.04.2/daemon/api_model_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_model_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,6 +29,7 @@
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
+	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/overlord/assertstate/assertstatetest"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/devicestate"
@@ -127,7 +128,7 @@
 	c.Assert(rsp.Status, check.Equals, 404)
 	c.Assert(rsp.Result, check.FitsTypeOf, &errorResult{})
 	errRes := rsp.Result.(*errorResult)
-	c.Assert(errRes.Kind, check.Equals, errorKindAssertionNotFound)
+	c.Assert(errRes.Kind, check.Equals, client.ErrorKindAssertionNotFound)
 	c.Assert(errRes.Value, check.Equals, "model")
 	c.Assert(errRes.Message, check.Equals, "no model assertion yet")
 }
@@ -227,7 +228,7 @@
 	c.Assert(rsp.Status, check.Equals, 404)
 	c.Assert(rsp.Result, check.FitsTypeOf, &errorResult{})
 	errRes := rsp.Result.(*errorResult)
-	c.Assert(errRes.Kind, check.Equals, errorKindAssertionNotFound)
+	c.Assert(errRes.Kind, check.Equals, client.ErrorKindAssertionNotFound)
 	c.Assert(errRes.Value, check.Equals, "serial")
 	c.Assert(errRes.Message, check.Equals, "no serial assertion yet")
 }
diff -Nru snapd-2.45.1+20.04.2/daemon/api_snapshots.go snapd-2.48.3+20.04/daemon/api_snapshots.go
--- snapd-2.45.1+20.04.2/daemon/api_snapshots.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_snapshots.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,7 @@
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -42,6 +43,11 @@
 	POST:     changeSnapshots,
 }
 
+var snapshotExportCmd = &Command{
+	Path: "/v2/snapshots/{id}/export",
+	GET:  getSnapshotExport,
+}
+
 func listSnapshots(c *Command, r *http.Request, user *auth.UserState) Response {
 	query := r.URL.Query()
 	var setID uint64
@@ -83,6 +89,11 @@
 }
 
 func changeSnapshots(c *Command, r *http.Request, user *auth.UserState) Response {
+	contentType := r.Header.Get("Content-Type")
+	if contentType == client.SnapshotExportMediaType {
+		return doSnapshotImport(c, r, user)
+	}
+
 	var action snapshotAction
 	decoder := json.NewDecoder(r.Body)
 	if err := decoder.Decode(&action); err != nil {
@@ -137,3 +148,55 @@
 
 	return AsyncResponse(nil, &Meta{Change: chg.ID()})
 }
+
+// getSnapshotExport streams an archive containing an export of existing snapshots.
+//
+// The snapshots are re-packaged into a single uncompressed tar archive and
+// internally contain multiple zip files.
+func getSnapshotExport(c *Command, r *http.Request, user *auth.UserState) Response {
+	st := c.d.overlord.State()
+	st.Lock()
+	defer st.Unlock()
+
+	vars := muxVars(r)
+	sid := vars["id"]
+	setID, err := strconv.ParseUint(sid, 10, 64)
+	if err != nil {
+		return BadRequest("'id' must be a positive base 10 number; got %q", sid)
+	}
+
+	export, err := snapshotExport(context.TODO(), setID)
+	if err != nil {
+		return BadRequest("cannot export %v: %v", setID, err)
+	}
+	// init (size calculation) can be slow so drop the lock
+	st.Unlock()
+	err = export.Init()
+	st.Lock()
+	if err != nil {
+		return BadRequest("cannot calculate size of exported snapshot %v: %v", setID, err)
+	}
+
+	return &snapshotExportResponse{SnapshotExport: export}
+}
+
+func doSnapshotImport(c *Command, r *http.Request, user *auth.UserState) Response {
+	defer r.Body.Close()
+
+	expectedSize, err := strconv.ParseInt(r.Header.Get("Content-Length"), 10, 64)
+	if err != nil {
+		return BadRequest("cannot parse Content-Length: %v", err)
+	}
+	// ensure we don't read more than we expect
+	limitedBodyReader := io.LimitReader(r.Body, expectedSize)
+
+	// XXX: check that we have enough space to import the compressed snapshots
+	st := c.d.overlord.State()
+	setID, snapNames, err := snapshotImport(context.TODO(), st, limitedBodyReader)
+	if err != nil {
+		return BadRequest(err.Error())
+	}
+
+	result := map[string]interface{}{"set-id": setID, "snaps": snapNames}
+	return SyncResponse(result, nil)
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_snapshots_test.go snapd-2.48.3+20.04/daemon/api_snapshots_test.go
--- snapd-2.45.1+20.04.2/daemon/api_snapshots_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_snapshots_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,10 +20,14 @@
 package daemon_test
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
+	"io"
+	"io/ioutil"
 	"net/http"
+	"strconv"
 	"strings"
 
 	"gopkg.in/check.v1"
@@ -33,6 +37,7 @@
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/overlord"
 	"github.com/snapcore/snapd/overlord/assertstate"
+	"github.com/snapcore/snapd/overlord/snapshotstate"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/store/storetest"
@@ -321,3 +326,133 @@
 
 	}
 }
+
+func (s *snapshotSuite) TestExportSnapshots(c *check.C) {
+	var snapshotExportCalled int
+
+	defer daemon.MockMuxVars(func(*http.Request) map[string]string {
+		return map[string]string{"id": "1"}
+	})()
+	defer daemon.MockSnapshotExport(func(ctx context.Context, setID uint64) (*snapshotstate.SnapshotExport, error) {
+		snapshotExportCalled++
+		c.Check(setID, check.Equals, uint64(1))
+		return &snapshotstate.SnapshotExport{}, nil
+	})()
+
+	c.Check(daemon.SnapshotExportCmd.Path, check.Equals, "/v2/snapshots/{id}/export")
+	req, err := http.NewRequest("GET", "/v2/snapshots/1/export", nil)
+	c.Assert(err, check.IsNil)
+
+	rsp := daemon.ExportSnapshot(daemon.SnapshotExportCmd, req, nil)
+	c.Check(rsp, check.FitsTypeOf, &daemon.SnapshotExportResponse{})
+	c.Check(snapshotExportCalled, check.Equals, 1)
+}
+
+func (s *snapshotSuite) TestExportSnapshotsBadRequestOnNonNumericID(c *check.C) {
+	defer daemon.MockMuxVars(func(*http.Request) map[string]string {
+		return map[string]string{"id": "xxx"}
+	})()
+
+	c.Check(daemon.SnapshotExportCmd.Path, check.Equals, "/v2/snapshots/{id}/export")
+	req, err := http.NewRequest("GET", "/v2/snapshots/xxx/export", nil)
+	c.Assert(err, check.IsNil)
+
+	rsp := daemon.ExportSnapshot(daemon.SnapshotExportCmd, req, nil).(*daemon.Resp)
+	c.Check(rsp.Type, check.Equals, daemon.ResponseTypeError)
+	c.Check(rsp.Status, check.Equals, 400)
+	c.Check(rsp.Result, check.DeepEquals, &daemon.ErrorResult{Message: `'id' must be a positive base 10 number; got "xxx"`})
+}
+
+func (s *snapshotSuite) TestExportSnapshotsBadRequestOnError(c *check.C) {
+	var snapshotExportCalled int
+
+	defer daemon.MockMuxVars(func(*http.Request) map[string]string {
+		return map[string]string{"id": "1"}
+	})()
+	defer daemon.MockSnapshotExport(func(ctx context.Context, setID uint64) (*snapshotstate.SnapshotExport, error) {
+		snapshotExportCalled++
+		return nil, fmt.Errorf("boom")
+	})()
+
+	c.Check(daemon.SnapshotExportCmd.Path, check.Equals, "/v2/snapshots/{id}/export")
+	req, err := http.NewRequest("GET", "/v2/snapshots/1/export", nil)
+	c.Assert(err, check.IsNil)
+
+	rsp := daemon.ExportSnapshot(daemon.SnapshotExportCmd, req, nil).(*daemon.Resp)
+	c.Check(rsp.Type, check.Equals, daemon.ResponseTypeError)
+	c.Check(rsp.Status, check.Equals, 400)
+	c.Check(rsp.Result, check.DeepEquals, &daemon.ErrorResult{Message: `cannot export 1: boom`})
+	c.Check(snapshotExportCalled, check.Equals, 1)
+}
+
+func (s *snapshotSuite) TestImportSnapshot(c *check.C) {
+	data := []byte("mocked snapshot export data file")
+
+	setID := uint64(3)
+	snapNames := []string{"baz", "bar", "foo"}
+	defer daemon.MockSnapshotImport(func(context.Context, *state.State, io.Reader) (uint64, []string, error) {
+		return setID, snapNames, nil
+	})()
+
+	req, err := http.NewRequest("POST", "/v2/snapshot/import", bytes.NewReader(data))
+	req.Header.Add("Content-Length", strconv.Itoa(len(data)))
+	c.Assert(err, check.IsNil)
+	req.Header.Set("Content-Type", client.SnapshotExportMediaType)
+
+	rsp := daemon.ChangeSnapshots(daemon.SnapshotCmd, req, nil)
+	c.Check(rsp.Type, check.Equals, daemon.ResponseTypeSync)
+	c.Check(rsp.Status, check.Equals, 200)
+	c.Check(rsp.Result, check.DeepEquals, map[string]interface{}{"set-id": setID, "snaps": snapNames})
+}
+
+func (s *snapshotSuite) TestImportSnapshotError(c *check.C) {
+	defer daemon.MockSnapshotImport(func(context.Context, *state.State, io.Reader) (uint64, []string, error) {
+		return uint64(0), nil, errors.New("no")
+	})()
+
+	data := []byte("mocked snapshot export data file")
+	req, err := http.NewRequest("POST", "/v2/snapshot/import", bytes.NewReader(data))
+	req.Header.Add("Content-Length", strconv.Itoa(len(data)))
+	c.Assert(err, check.IsNil)
+	req.Header.Set("Content-Type", client.SnapshotExportMediaType)
+
+	rsp := daemon.ChangeSnapshots(daemon.SnapshotCmd, req, nil)
+	c.Assert(rsp.Type, check.Equals, daemon.ResponseTypeError)
+	c.Check(rsp.Status, check.Equals, 400)
+	c.Check(rsp.ErrorResult().Message, check.Equals, "no")
+}
+
+func (s *snapshotSuite) TestImportSnapshotNoContentLengthError(c *check.C) {
+	data := []byte("mocked snapshot export data file")
+	req, err := http.NewRequest("POST", "/v2/snapshot/import", bytes.NewReader(data))
+	c.Assert(err, check.IsNil)
+	req.Header.Set("Content-Type", client.SnapshotExportMediaType)
+
+	rsp := daemon.ChangeSnapshots(daemon.SnapshotCmd, req, nil)
+	c.Assert(rsp.Type, check.Equals, daemon.ResponseTypeError)
+	c.Check(rsp.Status, check.Equals, 400)
+	c.Check(rsp.ErrorResult().Message, check.Equals, `cannot parse Content-Length: strconv.ParseInt: parsing "": invalid syntax`)
+}
+
+func (s *snapshotSuite) TestImportSnapshotLimits(c *check.C) {
+	var dataRead int
+
+	defer daemon.MockSnapshotImport(func(ctx context.Context, st *state.State, r io.Reader) (uint64, []string, error) {
+		data, err := ioutil.ReadAll(r)
+		c.Assert(err, check.IsNil)
+		dataRead = len(data)
+		return uint64(0), nil, nil
+	})()
+
+	data := []byte("much more data than expected from Content-Length")
+	req, err := http.NewRequest("POST", "/v2/snapshot/import", bytes.NewReader(data))
+	// limit to 10 and check that this is really all that is read
+	req.Header.Add("Content-Length", "10")
+	c.Assert(err, check.IsNil)
+	req.Header.Set("Content-Type", client.SnapshotExportMediaType)
+
+	rsp := daemon.ChangeSnapshots(daemon.SnapshotCmd, req, nil)
+	c.Assert(rsp.Type, check.Equals, daemon.ResponseTypeSync)
+	c.Check(rsp.Status, check.Equals, 200)
+	c.Check(dataRead, check.Equals, 10)
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_system_recovery_keys.go snapd-2.48.3+20.04/daemon/api_system_recovery_keys.go
--- snapd-2.45.1+20.04.2/daemon/api_system_recovery_keys.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_system_recovery_keys.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,54 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"net/http"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord/auth"
+	"github.com/snapcore/snapd/secboot"
+)
+
+var systemRecoveryKeysCmd = &Command{
+	Path:     "/v2/system-recovery-keys",
+	GET:      getSystemRecoveryKeys,
+	RootOnly: true,
+}
+
+func getSystemRecoveryKeys(c *Command, r *http.Request, user *auth.UserState) Response {
+	var rsp client.SystemRecoveryKeysResponse
+
+	rkey, err := secboot.RecoveryKeyFromFile(filepath.Join(dirs.SnapFDEDir, "recovery.key"))
+	if err != nil {
+		return InternalError(err.Error())
+	}
+	rsp.RecoveryKey = rkey.String()
+
+	reinstallKey, err := secboot.RecoveryKeyFromFile(filepath.Join(dirs.SnapFDEDir, "reinstall.key"))
+	if err != nil {
+		return InternalError(err.Error())
+	}
+	rsp.ReinstallKey = reinstallKey.String()
+
+	return SyncResponse(&rsp, nil)
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_system_recovery_keys_test.go snapd-2.48.3+20.04/daemon/api_system_recovery_keys_test.go
--- snapd-2.45.1+20.04.2/daemon/api_system_recovery_keys_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_system_recovery_keys_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,87 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"encoding/hex"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/secboot"
+)
+
+func mockSystemRecoveryKeys(c *C) {
+	// same inputs/outputs as secboot:crypt_test.go in this test
+	rkeystr, err := hex.DecodeString("e1f01302c5d43726a9b85b4a8d9c7f6e")
+	c.Assert(err, IsNil)
+	rkeyPath := filepath.Join(dirs.SnapFDEDir, "recovery.key")
+	err = os.MkdirAll(filepath.Dir(rkeyPath), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(rkeyPath, []byte(rkeystr), 0644)
+	c.Assert(err, IsNil)
+
+	skeystr := "1234567890123456"
+	c.Assert(err, IsNil)
+	skeyPath := filepath.Join(dirs.SnapFDEDir, "reinstall.key")
+	err = ioutil.WriteFile(skeyPath, []byte(skeystr), 0644)
+	c.Assert(err, IsNil)
+}
+
+func (s *apiSuite) TestSystemGetRecoveryKeysAsRootHappy(c *C) {
+	if (secboot.RecoveryKey{}).String() == "not-implemented" {
+		c.Skip("needs working secboot recovery key")
+	}
+
+	s.daemon(c)
+	mockSystemRecoveryKeys(c)
+
+	req, err := http.NewRequest("GET", "/v2/system-recovery-keys", nil)
+	c.Assert(err, IsNil)
+
+	rsp := getSystemRecoveryKeys(systemRecoveryKeysCmd, req, nil).(*resp)
+	c.Assert(rsp.Status, Equals, 200)
+	srk := rsp.Result.(*client.SystemRecoveryKeysResponse)
+	c.Assert(srk, DeepEquals, &client.SystemRecoveryKeysResponse{
+		RecoveryKey:  "61665-00531-54469-09783-47273-19035-40077-28287",
+		ReinstallKey: "12849-13363-13877-14391-12345-12849-13363-13877",
+	})
+}
+
+func (s *apiSuite) TestSystemGetRecoveryAsUserErrors(c *C) {
+	s.daemon(c)
+	mockSystemRecoveryKeys(c)
+
+	req, err := http.NewRequest("GET", "/v2/system-recovery-key", nil)
+	c.Assert(err, IsNil)
+
+	req.RemoteAddr = "pid=100;uid=1000;socket=;"
+	rec := httptest.NewRecorder()
+	systemsActionCmd.ServeHTTP(rec, req)
+
+	systemRecoveryKeysCmd.ServeHTTP(rec, req)
+	c.Assert(rec.Code, Equals, 401)
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_systems.go snapd-2.48.3+20.04/daemon/api_systems.go
--- snapd-2.45.1+20.04.2/daemon/api_systems.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_systems.go	2021-02-02 08:21:12.000000000 +0000
@@ -33,6 +33,13 @@
 var systemsCmd = &Command{
 	Path: "/v2/systems",
 	GET:  getSystems,
+	// this is awkward, we want the postSystemsAction function to be used
+	// when the label is empty too, but the router will not handle the request
+	// for /v2/systems with the systemsActionCmd and instead handles it through
+	// this command, so we need to set the POST for this command to essentially
+	// forward to that one
+	POST:     postSystemsAction,
+	RootOnly: true,
 }
 
 var systemsActionCmd = &Command{
@@ -98,11 +105,7 @@
 
 func postSystemsAction(c *Command, r *http.Request, user *auth.UserState) Response {
 	var req systemActionRequest
-
 	systemLabel := muxVars(r)["label"]
-	if systemLabel == "" {
-		return BadRequest("system action requires the system label to be provided")
-	}
 
 	decoder := json.NewDecoder(r.Body)
 	if err := decoder.Decode(&req); err != nil {
@@ -111,9 +114,46 @@
 	if decoder.More() {
 		return BadRequest("extra content found in request body")
 	}
-	if req.Action != "do" {
+	switch req.Action {
+	case "do":
+		return postSystemActionDo(c, systemLabel, &req)
+	case "reboot":
+		return postSystemActionReboot(c, systemLabel, &req)
+	default:
 		return BadRequest("unsupported action %q", req.Action)
 	}
+}
+
+// XXX: should deviceManager return more sensible errors here?
+//      E.g. UnsupportedActionError{systemLabel, mode}
+//           SystemDoesNotExistError{systemLabel}
+func handleSystemActionErr(err error, systemLabel string) Response {
+	if os.IsNotExist(err) {
+		return NotFound("requested seed system %q does not exist", systemLabel)
+	}
+	if err == devicestate.ErrUnsupportedAction {
+		return BadRequest("requested action is not supported by system %q", systemLabel)
+	}
+	return InternalError(err.Error())
+}
+
+// wrapped for unit tests
+var deviceManagerReboot = func(dm *devicestate.DeviceManager, systemLabel, mode string) error {
+	return dm.Reboot(systemLabel, mode)
+}
+
+func postSystemActionReboot(c *Command, systemLabel string, req *systemActionRequest) Response {
+	dm := c.d.overlord.DeviceManager()
+	if err := deviceManagerReboot(dm, systemLabel, req.Mode); err != nil {
+		return handleSystemActionErr(err, systemLabel)
+	}
+	return SyncResponse(nil, nil)
+}
+
+func postSystemActionDo(c *Command, systemLabel string, req *systemActionRequest) Response {
+	if systemLabel == "" {
+		return BadRequest("system action requires the system label to be provided")
+	}
 	if req.Mode == "" {
 		return BadRequest("system action requires the mode to be provided")
 	}
@@ -123,13 +163,7 @@
 		Mode:  req.Mode,
 	}
 	if err := c.d.overlord.DeviceManager().RequestSystemAction(systemLabel, sa); err != nil {
-		if os.IsNotExist(err) {
-			return NotFound("requested seed system %q does not exist", systemLabel)
-		}
-		if err == devicestate.ErrUnsupportedAction {
-			return BadRequest("requested action is not supported by system %q", systemLabel)
-		}
-		return InternalError(err.Error())
+		return handleSystemActionErr(err, systemLabel)
 	}
 	return SyncResponse(nil, nil)
 }
diff -Nru snapd-2.45.1+20.04.2/daemon/api_systems_test.go snapd-2.48.3+20.04/daemon/api_systems_test.go
--- snapd-2.45.1+20.04.2/daemon/api_systems_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_systems_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -106,7 +106,13 @@
 	return restore
 }
 
-func (s *apiSuite) TestGetSystemsSome(c *check.C) {
+func (s *apiSuite) TestSystemsGetSome(c *check.C) {
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err := m.WriteTo("")
+	c.Assert(err, check.IsNil)
+
 	d := s.daemonWithOverlordMock(c)
 	hookMgr, err := hookstate.Manager(d.overlord.State(), d.overlord.TaskRunner())
 	c.Assert(err, check.IsNil)
@@ -175,7 +181,13 @@
 		}})
 }
 
-func (s *apiSuite) TestGetSystemsNone(c *check.C) {
+func (s *apiSuite) TestSystemsGetNone(c *check.C) {
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err := m.WriteTo("")
+	c.Assert(err, check.IsNil)
+
 	// model assertion setup
 	d := s.daemonWithOverlordMock(c)
 	hookMgr, err := hookstate.Manager(d.overlord.State(), d.overlord.TaskRunner())
@@ -196,7 +208,15 @@
 }
 
 func (s *apiSuite) TestSystemActionRequestErrors(c *check.C) {
+	// modenev must be mocked before daemon is initialized
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err := m.WriteTo("")
+	c.Assert(err, check.IsNil)
+
 	d := s.daemonWithOverlordMock(c)
+
 	hookMgr, err := hookstate.Manager(d.overlord.State(), d.overlord.TaskRunner())
 	c.Assert(err, check.IsNil)
 	mgr, err := devicestate.Manager(d.overlord.State(), hookMgr, d.overlord.TaskRunner(), nil)
@@ -206,9 +226,12 @@
 	restore := s.mockSystemSeeds(c)
 	defer restore()
 
+	st := d.overlord.State()
+
 	type table struct {
 		label, body, error string
 		status             int
+		unseeded           bool
 	}
 	tests := []table{
 		{
@@ -242,9 +265,29 @@
 			body:   `{"action":"do","mode":"foobar"}`,
 			error:  `requested action is not supported by system "20191119"`,
 			status: 400,
+		}, {
+			// valid label and action, but seeding is not complete yet
+			label:    "20191119",
+			body:     `{"action":"do","mode":"install"}`,
+			error:    `cannot request system action, system is seeding`,
+			status:   500,
+			unseeded: true,
 		},
 	}
 	for _, tc := range tests {
+		st.Lock()
+		if tc.unseeded {
+			st.Set("seeded", nil)
+			m := boot.Modeenv{
+				Mode:           "run",
+				RecoverySystem: tc.label,
+			}
+			err := m.WriteTo("")
+			c.Assert(err, check.IsNil)
+		} else {
+			st.Set("seeded", true)
+		}
+		st.Unlock()
 		s.vars = map[string]string{"label": tc.label}
 		c.Logf("tc: %#v", tc)
 		req, err := http.NewRequest("POST", "/v2/systems/"+tc.label, strings.NewReader(tc.body))
@@ -337,9 +380,10 @@
 		},
 		{
 			// from recover mode -> recover mode is no-op
-			currentMode: "recover",
-			actionMode:  "recover",
-			comment:     "recover mode to recover mode",
+			currentMode:    "recover",
+			actionMode:     "recover",
+			expUnsupported: true,
+			comment:        "recover mode to recover mode",
 		},
 		{
 			// from install mode -> install mode is no-no
@@ -365,11 +409,15 @@
 	}
 	s.vars = map[string]string{"label": "20191119"}
 
-	for _, t := range tt {
+	for _, tc := range tt {
+		c.Logf("tc: %v", tc.comment)
 		// daemon setup - need to do this per-test because we need to re-read
 		// the modeenv during devicemgr startup
 		m := boot.Modeenv{
-			Mode: t.currentMode,
+			Mode: tc.currentMode,
+		}
+		if tc.currentMode != "run" {
+			m.RecoverySystem = "20191119"
 		}
 		err := m.WriteTo("")
 		c.Assert(err, check.IsNil)
@@ -382,34 +430,39 @@
 		assertstatetest.AddMany(st, s.storeSigning.StoreAccountKey(""))
 		assertstatetest.AddMany(st, s.brands.AccountsAndKeys("my-brand")...)
 		s.mockModel(c, st, model)
-		st.Set("seeded-systems", currentSystem)
+		if tc.currentMode == "run" {
+			// only set in run mode
+			st.Set("seeded-systems", currentSystem)
+		}
+		// the seeding is done
+		st.Set("seeded", true)
 		st.Unlock()
 
 		body := map[string]string{
 			"action": "do",
-			"mode":   t.actionMode,
+			"mode":   tc.actionMode,
 		}
 		b, err := json.Marshal(body)
-		c.Assert(err, check.IsNil, check.Commentf(t.comment))
+		c.Assert(err, check.IsNil, check.Commentf(tc.comment))
 		buf := bytes.NewBuffer(b)
 		req, err := http.NewRequest("POST", "/v2/systems/20191119", buf)
-		c.Assert(err, check.IsNil, check.Commentf(t.comment))
+		c.Assert(err, check.IsNil, check.Commentf(tc.comment))
 		// as root
 		req.RemoteAddr = "pid=100;uid=0;socket=;"
 		rec := httptest.NewRecorder()
 		systemsActionCmd.ServeHTTP(rec, req)
-		if t.expUnsupported {
-			c.Check(rec.Code, check.Equals, 400, check.Commentf(t.comment))
+		if tc.expUnsupported {
+			c.Check(rec.Code, check.Equals, 400, check.Commentf(tc.comment))
 		} else {
-			c.Check(rec.Code, check.Equals, 200, check.Commentf(t.comment))
+			c.Check(rec.Code, check.Equals, 200, check.Commentf(tc.comment))
 		}
 
 		var rspBody map[string]interface{}
 		err = json.Unmarshal(rec.Body.Bytes(), &rspBody)
-		c.Assert(err, check.IsNil, check.Commentf(t.comment))
+		c.Assert(err, check.IsNil, check.Commentf(tc.comment))
 
 		var expResp map[string]interface{}
-		if t.expUnsupported {
+		if tc.expUnsupported {
 			expResp = map[string]interface{}{
 				"result": map[string]interface{}{
 					"message": fmt.Sprintf("requested action is not supported by system %q", "20191119"),
@@ -425,7 +478,7 @@
 				"status-code": 200.0,
 				"type":        "sync",
 			}
-			if t.expRestart {
+			if tc.expRestart {
 				expResp["maintenance"] = map[string]interface{}{
 					"kind":    "system-restart",
 					"message": "system is restarting",
@@ -434,17 +487,17 @@
 				// daemon is not started, only check whether reboot was scheduled as expected
 
 				// reboot flag
-				c.Check(d.restartSystem, check.Equals, state.RestartSystemNow, check.Commentf(t.comment))
+				c.Check(d.requestedRestart, check.Equals, state.RestartSystemNow, check.Commentf(tc.comment))
 				// slow reboot schedule
 				c.Check(cmd.Calls(), check.DeepEquals, [][]string{
 					{"shutdown", "-r", "+10", "reboot scheduled to update the system"},
 				},
-					check.Commentf(t.comment),
+					check.Commentf(tc.comment),
 				)
 			}
 		}
 
-		c.Assert(rspBody, check.DeepEquals, expResp, check.Commentf(t.comment))
+		c.Assert(rspBody, check.DeepEquals, expResp, check.Commentf(tc.comment))
 
 		cmd.ForgetCalls()
 		s.d = nil
@@ -453,6 +506,12 @@
 }
 
 func (s *apiSuite) TestSystemActionBrokenSeed(c *check.C) {
+	m := boot.Modeenv{
+		Mode: "run",
+	}
+	err := m.WriteTo("")
+	c.Assert(err, check.IsNil)
+
 	d := s.daemonWithOverlordMock(c)
 	hookMgr, err := hookstate.Manager(d.overlord.State(), d.overlord.TaskRunner())
 	c.Assert(err, check.IsNil)
@@ -460,6 +519,12 @@
 	c.Assert(err, check.IsNil)
 	d.overlord.AddManager(mgr)
 
+	// the seeding is done
+	st := d.overlord.State()
+	st.Lock()
+	st.Set("seeded", true)
+	st.Unlock()
+
 	restore := s.mockSystemSeeds(c)
 	defer restore()
 
@@ -509,3 +574,100 @@
 		"type":        "error",
 	})
 }
+
+func (s *apiSuite) TestSystemRebootNeedsRoot(c *check.C) {
+	restore := MockDeviceManagerReboot(func(dm *devicestate.DeviceManager, systemLabel, mode string) error {
+		c.Fatalf("request reboot should not get called")
+		return nil
+	})
+	defer restore()
+
+	body := `{"action":"reboot"}`
+	url := "/v2/systems"
+	req, err := http.NewRequest("POST", url, strings.NewReader(body))
+	c.Assert(err, check.IsNil)
+	req.RemoteAddr = "pid=100;uid=1000;socket=;"
+
+	rec := httptest.NewRecorder()
+	systemsActionCmd.ServeHTTP(rec, req)
+	c.Check(rec.Code, check.Equals, 401)
+}
+
+func (s *apiSuite) TestSystemRebootHappy(c *check.C) {
+	s.daemon(c)
+
+	for _, tc := range []struct {
+		systemLabel, mode string
+	}{
+		{"", ""},
+		{"20200101", ""},
+		{"", "run"},
+		{"", "recover"},
+		{"20200101", "run"},
+		{"20200101", "recover"},
+	} {
+		called := 0
+		restore := MockDeviceManagerReboot(func(dm *devicestate.DeviceManager, systemLabel, mode string) error {
+			called++
+			c.Check(dm, check.NotNil)
+			c.Check(systemLabel, check.Equals, tc.systemLabel)
+			c.Check(mode, check.Equals, tc.mode)
+			return nil
+		})
+		defer restore()
+
+		body := fmt.Sprintf(`{"action":"reboot", "mode":"%s"}`, tc.mode)
+		url := "/v2/systems"
+		if tc.systemLabel != "" {
+			url += "/" + tc.systemLabel
+		}
+		s.vars = map[string]string{"label": tc.systemLabel}
+		req, err := http.NewRequest("POST", url, strings.NewReader(body))
+		c.Assert(err, check.IsNil)
+		req.RemoteAddr = "pid=100;uid=0;socket=;"
+
+		rec := httptest.NewRecorder()
+		systemsActionCmd.ServeHTTP(rec, req)
+		c.Check(rec.Code, check.Equals, 200)
+		c.Check(called, check.Equals, 1)
+	}
+}
+
+func (s *apiSuite) TestSystemRebootUnhappy(c *check.C) {
+	s.daemon(c)
+
+	for _, tc := range []struct {
+		rebootErr        error
+		expectedHttpCode int
+		expectedErr      string
+	}{
+		{fmt.Errorf("boom"), 500, "boom"},
+		{os.ErrNotExist, 404, `requested seed system "" does not exist`},
+		{devicestate.ErrUnsupportedAction, 400, `requested action is not supported by system ""`},
+	} {
+		called := 0
+		restore := MockDeviceManagerReboot(func(dm *devicestate.DeviceManager, systemLabel, mode string) error {
+			called++
+			return tc.rebootErr
+		})
+		defer restore()
+
+		body := fmt.Sprintf(`{"action":"reboot"}`)
+		url := "/v2/systems"
+		req, err := http.NewRequest("POST", url, strings.NewReader(body))
+		c.Assert(err, check.IsNil)
+		req.RemoteAddr = "pid=100;uid=0;socket=;"
+
+		rec := httptest.NewRecorder()
+		systemsActionCmd.ServeHTTP(rec, req)
+		c.Check(rec.Code, check.Equals, tc.expectedHttpCode)
+		c.Check(called, check.Equals, 1)
+
+		var rspBody map[string]interface{}
+		err = json.Unmarshal(rec.Body.Bytes(), &rspBody)
+		c.Check(err, check.IsNil)
+		c.Check(rspBody["status-code"], check.Equals, float64(tc.expectedHttpCode))
+		result := rspBody["result"].(map[string]interface{})
+		c.Check(result["message"], check.Equals, tc.expectedErr)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/api_test.go snapd-2.48.3+20.04/daemon/api_test.go
--- snapd-2.45.1+20.04.2/daemon/api_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2018 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -49,8 +49,8 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/asserts/sysdb"
+	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/builtin"
@@ -103,9 +103,7 @@
 	brands            *assertstest.SigningAccounts
 
 	systemctlRestorer func()
-	sysctlArgses      [][]string
 	sysctlBufs        [][]byte
-	sysctlErrs        []error
 
 	journalctlRestorer func()
 	jctlSvcses         [][]string
@@ -114,6 +112,9 @@
 	jctlRCs            []io.ReadCloser
 	jctlErrs           []error
 
+	serviceControlError error
+	serviceControlCalls []serviceControlArgs
+
 	connectivityResult     map[string]bool
 	loginUserStoreMacaroon string
 	loginUserDischarge     string
@@ -125,6 +126,12 @@
 	testutil.BaseTest
 }
 
+type serviceControlArgs struct {
+	action  string
+	options string
+	names   []string
+}
+
 func (s *apiBaseSuite) pokeStateLock() {
 	// the store should be called without the state lock held. Try
 	// to acquire it.
@@ -153,8 +160,17 @@
 	return s.rsnaps, s.err
 }
 
-func (s *apiBaseSuite) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (s *apiBaseSuite) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
 	s.pokeStateLock()
+	if assertQuery != nil {
+		toResolve, err := assertQuery.ToResolve()
+		if err != nil {
+			return nil, nil, err
+		}
+		if len(toResolve) != 0 {
+			panic("no assertion query support")
+		}
+	}
 
 	if ctx == nil {
 		panic("context required")
@@ -167,7 +183,7 @@
 	for i, rsnap := range s.rsnaps {
 		sars[i] = store.SnapActionResult{Info: rsnap}
 	}
-	return sars, s.err
+	return sars, nil, s.err
 }
 
 func (s *apiBaseSuite) SuggestedCurrency() string {
@@ -233,22 +249,6 @@
 }
 
 func (s *apiBaseSuite) systemctl(args ...string) (buf []byte, err error) {
-	s.sysctlArgses = append(s.sysctlArgses, args)
-
-	if len(args) > 2 && args[0] == "--root" && args[2] == "is-enabled" {
-		// drop the first 2 args which are "--root some-dir"
-		args = args[2:]
-	}
-
-	switch args[0] {
-	case "show", "start", "stop", "restart", "is-enabled":
-	default:
-		panic(fmt.Sprintf("unexpected systemctl call: %v", args))
-	}
-
-	if len(s.sysctlErrs) > 0 {
-		err, s.sysctlErrs = s.sysctlErrs[0], s.sysctlErrs[1:]
-	}
 	if len(s.sysctlBufs) > 0 {
 		buf, s.sysctlBufs = s.sysctlBufs[0], s.sysctlBufs[1:]
 	}
@@ -272,9 +272,7 @@
 }
 
 func (s *apiBaseSuite) SetUpTest(c *check.C) {
-	s.sysctlArgses = nil
 	s.sysctlBufs = nil
-	s.sysctlErrs = nil
 	s.jctlSvcses = nil
 	s.jctlNs = nil
 	s.jctlFollows = nil
@@ -325,6 +323,11 @@
 	snapstateSwitch = nil
 
 	devicestateRemodel = nil
+
+	s.serviceControlCalls = nil
+	s.serviceControlError = nil
+	restoreServicestateCtrl := MockServicestateControl(s.fakeServiceControl)
+	s.AddCleanup(restoreServicestateCtrl)
 }
 
 func (s *apiBaseSuite) TearDownTest(c *check.C) {
@@ -356,6 +359,36 @@
 	"kernel":       "kernel",
 }
 
+func (s *apiBaseSuite) fakeServiceControl(st *state.State, appInfos []*snap.AppInfo, inst *servicestate.Instruction, context *hookstate.Context) ([]*state.TaskSet, error) {
+	st.Lock()
+	defer st.Unlock()
+
+	if s.serviceControlError != nil {
+		return nil, s.serviceControlError
+	}
+
+	serviceCommand := serviceControlArgs{action: inst.Action}
+	if inst.RestartOptions.Reload {
+		serviceCommand.options = "reload"
+	}
+	// only one flag should ever be set (depending on Action), but appending
+	// them below acts as an extra sanity check.
+	if inst.StartOptions.Enable {
+		serviceCommand.options += "enable"
+	}
+	if inst.StopOptions.Disable {
+		serviceCommand.options += "disable"
+	}
+	for _, app := range appInfos {
+		serviceCommand.names = append(serviceCommand.names, fmt.Sprintf("%s.%s", app.Snap.InstanceName(), app.Name))
+	}
+	s.serviceControlCalls = append(s.serviceControlCalls, serviceCommand)
+
+	t := st.NewTask("dummy", "")
+	ts := state.NewTaskSet(t)
+	return []*state.TaskSet{ts}, nil
+}
+
 func (s *apiBaseSuite) mockModel(c *check.C, st *state.State, model *asserts.Model) {
 	// realistic model setup
 	if model == nil {
@@ -970,7 +1003,7 @@
 			{Snap: "some-snap_instance", Name: "foo"},
 		},
 	}
-	c.Check(mapLocal(about), check.DeepEquals, expected)
+	c.Check(mapLocal(about, nil), check.DeepEquals, expected)
 }
 
 func (s *apiSuite) TestMapLocalOfTryResolvesSymlink(c *check.C) {
@@ -982,17 +1015,17 @@
 	about := aboutSnap{info: &info, snapst: &snapst}
 
 	// if not a 'try', then MountedFrom is just MountFile()
-	c.Check(mapLocal(about).MountedFrom, check.Equals, mountFile)
+	c.Check(mapLocal(about, nil).MountedFrom, check.Equals, mountFile)
 
 	// if it's a try, then MountedFrom resolves the symlink
 	// (note it doesn't matter, here, whether the target of the link exists)
 	snapst.TryMode = true
 	c.Assert(os.Symlink("/xyzzy", mountFile), check.IsNil)
-	c.Check(mapLocal(about).MountedFrom, check.Equals, "/xyzzy")
+	c.Check(mapLocal(about, nil).MountedFrom, check.Equals, "/xyzzy")
 
 	// if the readlink fails, it's unset
 	c.Assert(os.Remove(mountFile), check.IsNil)
-	c.Check(mapLocal(about).MountedFrom, check.Equals, "")
+	c.Check(mapLocal(about, nil).MountedFrom, check.Equals, "")
 }
 
 func (s *apiSuite) TestListIncludesAll(c *check.C) {
@@ -1092,6 +1125,7 @@
 		"sandbox-features": map[string]interface{}{"confinement-options": []interface{}{"classic", "devmode"}},
 		"architecture":     arch.DpkgArchitecture(),
 		"virtualization":   "magic",
+		"system-mode":      "run",
 	}
 	var rsp resp
 	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), check.IsNil)
@@ -1170,6 +1204,83 @@
 		},
 		"architecture":   arch.DpkgArchitecture(),
 		"virtualization": "kvm",
+		"system-mode":    "run",
+	}
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), check.IsNil)
+	c.Check(rsp.Status, check.Equals, 200)
+	c.Check(rsp.Type, check.Equals, ResponseTypeSync)
+	const kernelVersionKey = "kernel-version"
+	delete(rsp.Result.(map[string]interface{}), kernelVersionKey)
+	c.Check(rsp.Result, check.DeepEquals, expected)
+}
+
+func (s *apiSuite) testSysInfoSystemMode(c *check.C, mode string) {
+	c.Assert(mode != "", check.Equals, true, check.Commentf("mode is unset for the test"))
+	rec := httptest.NewRecorder()
+
+	restore := release.MockReleaseInfo(&release.OS{ID: "distro-id", VersionID: "1.2"})
+	defer restore()
+	restore = release.MockOnClassic(false)
+	defer restore()
+	restore = sandbox.MockForceDevMode(false)
+	defer restore()
+	restore = mockSystemdVirt("")
+	defer restore()
+
+	// reload dirs for release info to have effect on paths
+	dirs.SetRootDir(dirs.GlobalRootDir)
+
+	// mock the modeenv file
+	m := boot.Modeenv{
+		Mode:           mode,
+		RecoverySystem: "20191127",
+	}
+	err := m.WriteTo("")
+	c.Assert(err, check.IsNil)
+
+	d := s.daemon(c)
+	d.Version = "42b1"
+
+	// add a test security backend
+	err = d.overlord.InterfaceManager().Repository().AddBackend(&ifacetest.TestSecurityBackend{
+		BackendName:             "apparmor",
+		SandboxFeaturesCallback: func() []string { return []string{"feature-1", "feature-2"} },
+	})
+	c.Assert(err, check.IsNil)
+
+	buildID := "this-is-my-build-id"
+	restore = MockBuildID(buildID)
+	defer restore()
+
+	sysInfoCmd.GET(sysInfoCmd, nil, nil).ServeHTTP(rec, nil)
+	c.Check(rec.Code, check.Equals, 200)
+	c.Check(rec.HeaderMap.Get("Content-Type"), check.Equals, "application/json")
+
+	expected := map[string]interface{}{
+		"series":  "16",
+		"version": "42b1",
+		"os-release": map[string]interface{}{
+			"id":         "distro-id",
+			"version-id": "1.2",
+		},
+		"build-id":   buildID,
+		"on-classic": false,
+		"managed":    false,
+		"locations": map[string]interface{}{
+			"snap-mount-dir": dirs.SnapMountDir,
+			"snap-bin-dir":   dirs.SnapBinariesDir,
+		},
+		"refresh": map[string]interface{}{
+			"timer": "00:00~24:00/4",
+		},
+		"confinement": "strict",
+		"sandbox-features": map[string]interface{}{
+			"apparmor":            []interface{}{"feature-1", "feature-2"},
+			"confinement-options": []interface{}{"devmode", "strict"}, // we know it's this because of the release.Mock... calls above
+		},
+		"architecture": arch.DpkgArchitecture(),
+		"system-mode":  mode,
 	}
 	var rsp resp
 	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), check.IsNil)
@@ -1180,6 +1291,18 @@
 	c.Check(rsp.Result, check.DeepEquals, expected)
 }
 
+func (s *apiSuite) TestSysInfoSystemModeRun(c *check.C) {
+	s.testSysInfoSystemMode(c, "run")
+}
+
+func (s *apiSuite) TestSysInfoSystemModeRecover(c *check.C) {
+	s.testSysInfoSystemMode(c, "recover")
+}
+
+func (s *apiSuite) TestSysInfoSystemModeInstall(c *check.C) {
+	s.testSysInfoSystemMode(c, "install")
+}
+
 func (s *apiSuite) TestLoginUser(c *check.C) {
 	d := s.daemon(c)
 	state := d.overlord.State()
@@ -1459,7 +1582,7 @@
 
 	c.Check(rsp.Type, check.Equals, ResponseTypeError)
 	c.Check(rsp.Status, check.Equals, 401)
-	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, errorKindTwoFactorRequired)
+	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, client.ErrorKindTwoFactorRequired)
 }
 
 func (s *apiSuite) TestLoginUserTwoFactorFailedError(c *check.C) {
@@ -1474,7 +1597,7 @@
 
 	c.Check(rsp.Type, check.Equals, ResponseTypeError)
 	c.Check(rsp.Status, check.Equals, 401)
-	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, errorKindTwoFactorFailed)
+	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, client.ErrorKindTwoFactorFailed)
 }
 
 func (s *apiSuite) TestLoginUserInvalidCredentialsError(c *check.C) {
@@ -2129,7 +2252,7 @@
 	c.Check(rsp.Type, check.Equals, ResponseTypeError)
 	c.Check(rsp.Status, check.Equals, 400)
 	c.Check(rsp.Result.(*errorResult).Message, check.Matches, "bad query")
-	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, errorKindBadQuery)
+	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, client.ErrorKindBadQuery)
 }
 
 func (s *apiSuite) TestFindPriced(c *check.C) {
@@ -2651,6 +2774,7 @@
 			"jailmode":     "true",
 			"cohort-key":   `"what"`,
 			"leave-cohort": "true",
+			"purge":        "true",
 		} {
 			buf := strings.NewReader(fmt.Sprintf(`{"action": "%s","snaps":["foo","bar"], "%s": %s}`, action, weird, v))
 			req, err := http.NewRequest("POST", "/v2/snaps", buf)
@@ -3094,7 +3218,7 @@
 
 	rsp := postSnaps(snapsCmd, req, nil).(*resp)
 	c.Assert(rsp.Type, check.Equals, ResponseTypeError)
-	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, errorKindSnapChangeConflict)
+	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, client.ErrorKindSnapChangeConflict)
 }
 
 func (s *apiSuite) TestSideloadSnapInstanceName(c *check.C) {
@@ -3297,7 +3421,7 @@
 
 	rsp := trySnap(snapsCmd, req, nil, tryDir, snapstate.Flags{}).(*resp)
 	c.Assert(rsp.Type, check.Equals, ResponseTypeError)
-	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, errorKindSnapChangeConflict)
+	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, client.ErrorKindSnapChangeConflict)
 }
 
 func (s *apiSuite) runGetConf(c *check.C, snapName string, keys []string, statusCode int) map[string]interface{} {
@@ -3929,6 +4053,43 @@
 	c.Check(summary, check.Equals, `Refresh "some-snap" snap`)
 }
 
+func (s *apiSuite) TestRefreshIgnoreRunning(c *check.C) {
+	var calledFlags snapstate.Flags
+	installQueue := []string{}
+
+	snapstateUpdate = func(s *state.State, name string, opts *snapstate.RevisionOptions, userID int, flags snapstate.Flags) (*state.TaskSet, error) {
+		calledFlags = flags
+		installQueue = append(installQueue, name)
+
+		t := s.NewTask("fake-refresh-snap", "Doing a fake install")
+		return state.NewTaskSet(t), nil
+	}
+	assertstateRefreshSnapDeclarations = func(s *state.State, userID int) error {
+		return nil
+	}
+
+	d := s.daemon(c)
+	inst := &snapInstruction{
+		Action:        "refresh",
+		IgnoreRunning: true,
+		Snaps:         []string{"some-snap"},
+	}
+
+	st := d.overlord.State()
+	st.Lock()
+	defer st.Unlock()
+	summary, _, err := inst.dispatch()(inst, st)
+	c.Check(err, check.IsNil)
+
+	flags := snapstate.Flags{}
+	flags.IgnoreRunning = true
+
+	c.Check(calledFlags, check.DeepEquals, flags)
+	c.Check(err, check.IsNil)
+	c.Check(installQueue, check.DeepEquals, []string{"some-snap"})
+	c.Check(summary, check.Equals, `Refresh "some-snap" snap`)
+}
+
 func (s *apiSuite) TestRefreshCohort(c *check.C) {
 	cohort := ""
 
@@ -4045,7 +4206,26 @@
 	}
 }
 
-func (s *apiSuite) TestPostSnapsOp(c *check.C) {
+func (s *apiSuite) TestPostSnapOp(c *check.C) {
+	s.testPostSnapsOp(c, "application/json")
+}
+
+func (s *apiSuite) TestPostSnapOpMoreComplexContentType(c *check.C) {
+	s.testPostSnapsOp(c, "application/json; charset=utf-8")
+}
+
+func (s *apiSuite) TestPostSnapOpInvalidCharset(c *check.C) {
+	buf := bytes.NewBufferString(`{"action": "refresh"}`)
+	req, err := http.NewRequest("POST", "/v2/snaps", buf)
+	c.Assert(err, check.IsNil)
+	req.Header.Set("Content-Type", "application/json; charset=iso-8859-1")
+
+	rsp := postSnaps(snapsCmd, req, nil).(*resp)
+	c.Check(rsp.Status, check.Equals, 400)
+	c.Check(rsp.Result.(*errorResult).Message, testutil.Contains, "unknown charset in content type")
+}
+
+func (s *apiSuite) testPostSnapsOp(c *check.C, contentType string) {
 	assertstateRefreshSnapDeclarations = func(*state.State, int) error { return nil }
 	snapstateUpdateMany = func(_ context.Context, s *state.State, names []string, userID int, flags *snapstate.Flags) ([]string, []*state.TaskSet, error) {
 		c.Check(names, check.HasLen, 0)
@@ -4056,9 +4236,9 @@
 	d := s.daemonWithOverlordMock(c)
 
 	buf := bytes.NewBufferString(`{"action": "refresh"}`)
-	req, err := http.NewRequest("POST", "/v2/login", buf)
+	req, err := http.NewRequest("POST", "/v2/snaps", buf)
 	c.Assert(err, check.IsNil)
-	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Content-Type", contentType)
 
 	rsp, ok := postSnaps(snapsCmd, req, nil).(*resp)
 	c.Assert(ok, check.Equals, true)
@@ -5636,6 +5816,41 @@
 	c.Assert(err, check.IsNil)
 }
 
+func (s *apiSuite) TestStateChangesForSnapNameWithApp(c *check.C) {
+	restore := state.MockTime(time.Date(2016, 04, 21, 1, 2, 3, 0, time.UTC))
+	defer restore()
+
+	// Setup
+	d := newTestDaemon(c)
+	st := d.overlord.State()
+	st.Lock()
+	chg1 := st.NewChange("service-control", "install...")
+	// as triggered by snap restart lxd.daemon
+	chg1.Set("snap-names", []string{"lxd.daemon"})
+	t1 := st.NewTask("exec-command", "1...")
+	chg1.AddAll(state.NewTaskSet(t1))
+	t1.Logf("foobar")
+
+	st.Unlock()
+
+	// Execute
+	req, err := http.NewRequest("GET", "/v2/changes?for=lxd&select=all", nil)
+	c.Assert(err, check.IsNil)
+	rsp := getChanges(stateChangesCmd, req, nil).(*resp)
+
+	// Verify
+	c.Check(rsp.Type, check.Equals, ResponseTypeSync)
+	c.Check(rsp.Status, check.Equals, 200)
+	c.Assert(rsp.Result, check.FitsTypeOf, []*changeInfo(nil))
+
+	res := rsp.Result.([]*changeInfo)
+	c.Assert(res, check.HasLen, 1)
+	c.Check(res[0].Kind, check.Equals, `service-control`)
+
+	_, err = rsp.MarshalJSON()
+	c.Assert(err, check.IsNil)
+}
+
 func (s *apiSuite) TestStateChange(c *check.C) {
 	restore := state.MockTime(time.Date(2016, 04, 21, 1, 2, 3, 0, time.UTC))
 	defer restore()
@@ -5970,7 +6185,7 @@
 		respType: ResponseTypeError,
 		response: &errorResult{
 			Message: "terms of service not accepted",
-			Kind:    errorKindTermsNotAccepted,
+			Kind:    client.ErrorKindTermsNotAccepted,
 		},
 	},
 	{
@@ -5980,7 +6195,7 @@
 		respType: ResponseTypeError,
 		response: &errorResult{
 			Message: "no payment methods",
-			Kind:    errorKindNoPaymentMethods,
+			Kind:    client.ErrorKindNoPaymentMethods,
 		},
 	},
 }
@@ -6573,6 +6788,33 @@
 	c.Check(calledFlags.Unaliased, check.Equals, true)
 }
 
+func (s *apiSuite) TestInstallIgnoreRunning(c *check.C) {
+	var calledFlags snapstate.Flags
+
+	snapstateInstall = func(ctx context.Context, s *state.State, name string, opts *snapstate.RevisionOptions, userID int, flags snapstate.Flags) (*state.TaskSet, error) {
+		calledFlags = flags
+
+		t := s.NewTask("fake-install-snap", "Doing a fake install")
+		return state.NewTaskSet(t), nil
+	}
+
+	d := s.daemon(c)
+	inst := &snapInstruction{
+		Action: "install",
+		// Install the snap without enabled automatic aliases
+		IgnoreRunning: true,
+		Snaps:         []string{"fake"},
+	}
+
+	st := d.overlord.State()
+	st.Lock()
+	defer st.Unlock()
+	_, _, err := inst.dispatch()(inst, st)
+	c.Check(err, check.IsNil)
+
+	c.Check(calledFlags.IgnoreRunning, check.Equals, true)
+}
+
 func (s *apiSuite) TestInstallPathUnaliased(c *check.C) {
 	body := "" +
 		"----hello--\r\n" +
@@ -6640,7 +6882,7 @@
 	c.Assert(err, check.IsNil)
 	rsp := runSnapctl(snapctlCmd, req, nil).(*resp)
 	c.Check(rsp.Status, check.Equals, 200)
-	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, errorKindUnsuccessful)
+	c.Check(rsp.Result.(*errorResult).Kind, check.Equals, client.ErrorKindUnsuccessful)
 	c.Check(rsp.Result.(*errorResult).Value, check.DeepEquals, map[string]interface{}{
 		"stdout":    "",
 		"stderr":    "",
@@ -6882,7 +7124,7 @@
 	appInfos, rsp := appInfosFor(st, []string{"snap-a"}, appInfoOptions{service: true})
 	c.Assert(rsp, check.IsNil)
 	c.Assert(appInfos, check.HasLen, 2)
-	sort.Sort(cmd.BySnapApp(appInfos))
+	sort.Sort(snap.AppInfoBySnapApp(appInfos))
 
 	c.Check(appInfos[0].Snap, check.DeepEquals, s.infoA)
 	c.Check(appInfos[0].Name, check.Equals, "svc1")
@@ -6895,7 +7137,7 @@
 	appInfos, rsp := appInfosFor(st, []string{"snap-a", "snap-a.svc1"}, appInfoOptions{service: true})
 	c.Assert(rsp, check.IsNil)
 	c.Assert(appInfos, check.HasLen, 2)
-	sort.Sort(cmd.BySnapApp(appInfos))
+	sort.Sort(snap.AppInfoBySnapApp(appInfos))
 
 	c.Check(appInfos[0].Snap, check.DeepEquals, s.infoA)
 	c.Check(appInfos[0].Name, check.Equals, "svc1")
@@ -6917,7 +7159,7 @@
 	}, appInfoOptions{service: true})
 	c.Assert(rsp, check.IsNil)
 	c.Assert(appInfos, check.HasLen, 3)
-	sort.Sort(cmd.BySnapApp(appInfos))
+	sort.Sort(snap.AppInfoBySnapApp(appInfos))
 
 	c.Check(appInfos[0].Snap, check.DeepEquals, s.infoA)
 	c.Check(appInfos[0].Name, check.Equals, "svc1")
@@ -6932,7 +7174,7 @@
 	appInfos, rsp := appInfosFor(st, []string{"snap-c"}, appInfoOptions{service: true})
 	c.Assert(rsp, check.FitsTypeOf, &resp{})
 	c.Check(rsp.(*resp).Status, check.Equals, 404)
-	c.Check(rsp.(*resp).Result.(*errorResult).Kind, check.Equals, errorKindAppNotFound)
+	c.Check(rsp.(*resp).Result.(*errorResult).Kind, check.Equals, client.ErrorKindAppNotFound)
 	c.Assert(appInfos, check.IsNil)
 }
 
@@ -6941,7 +7183,7 @@
 	appInfos, rsp := appInfosFor(st, []string{"snap-c.whatever"}, appInfoOptions{service: true})
 	c.Assert(rsp, check.FitsTypeOf, &resp{})
 	c.Check(rsp.(*resp).Status, check.Equals, 404)
-	c.Check(rsp.(*resp).Result.(*errorResult).Kind, check.Equals, errorKindAppNotFound)
+	c.Check(rsp.(*resp).Result.(*errorResult).Kind, check.Equals, client.ErrorKindAppNotFound)
 	c.Assert(appInfos, check.IsNil)
 }
 
@@ -6950,7 +7192,7 @@
 	appInfos, rsp := appInfosFor(st, []string{"snap-x"}, appInfoOptions{service: true})
 	c.Assert(rsp, check.FitsTypeOf, &resp{})
 	c.Check(rsp.(*resp).Status, check.Equals, 404)
-	c.Check(rsp.(*resp).Result.(*errorResult).Kind, check.Equals, errorKindSnapNotFound)
+	c.Check(rsp.(*resp).Result.(*errorResult).Kind, check.Equals, client.ErrorKindSnapNotFound)
 	c.Assert(appInfos, check.IsNil)
 }
 
@@ -7088,7 +7330,7 @@
 	c.Assert(rsp.Type, check.Equals, ResponseTypeError)
 }
 
-func (s *appSuite) testPostApps(c *check.C, inst servicestate.Instruction, systemctlCall [][]string) *state.Change {
+func (s *appSuite) testPostApps(c *check.C, inst servicestate.Instruction, servicecmds []serviceControlArgs) *state.Change {
 	postBody, err := json.Marshal(inst)
 	c.Assert(err, check.IsNil)
 
@@ -7105,74 +7347,104 @@
 	defer st.Unlock()
 	chg := st.Change(rsp.Change)
 	c.Assert(chg, check.NotNil)
-	c.Check(chg.Tasks(), check.HasLen, len(systemctlCall))
+	c.Check(chg.Tasks(), check.HasLen, len(servicecmds))
 
 	st.Unlock()
 	<-chg.Ready()
 	st.Lock()
 
-	c.Check(s.cmd.Calls(), check.DeepEquals, systemctlCall)
+	c.Check(s.serviceControlCalls, check.DeepEquals, servicecmds)
 	return chg
 }
 
 func (s *appSuite) TestPostAppsStartOne(c *check.C) {
 	inst := servicestate.Instruction{Action: "start", Names: []string{"snap-a.svc2"}}
-	expected := [][]string{{"systemctl", "start", "snap.snap-a.svc2.service"}}
-	s.testPostApps(c, inst, expected)
+	expected := []serviceControlArgs{
+		{action: "start", names: []string{"snap-a.svc2"}},
+	}
+	chg := s.testPostApps(c, inst, expected)
+	chg.State().Lock()
+	defer chg.State().Unlock()
+
+	var names []string
+	err := chg.Get("snap-names", &names)
+	c.Assert(err, check.IsNil)
+	c.Assert(names, check.DeepEquals, []string{"snap-a"})
 }
 
 func (s *appSuite) TestPostAppsStartTwo(c *check.C) {
 	inst := servicestate.Instruction{Action: "start", Names: []string{"snap-a"}}
-	expected := [][]string{{"systemctl", "start", "snap.snap-a.svc1.service", "snap.snap-a.svc2.service"}}
+	expected := []serviceControlArgs{
+		{action: "start", names: []string{"snap-a.svc1", "snap-a.svc2"}},
+	}
 	chg := s.testPostApps(c, inst, expected)
+
 	chg.State().Lock()
 	defer chg.State().Unlock()
-	// check the summary expands the snap into actual apps
-	c.Check(chg.Summary(), check.Equals, "Running service command")
-	c.Check(chg.Tasks()[0].Summary(), check.Equals, "start of [snap-a.svc1 snap-a.svc2]")
+
+	var names []string
+	err := chg.Get("snap-names", &names)
+	c.Assert(err, check.IsNil)
+	c.Assert(names, check.DeepEquals, []string{"snap-a"})
 }
 
 func (s *appSuite) TestPostAppsStartThree(c *check.C) {
 	inst := servicestate.Instruction{Action: "start", Names: []string{"snap-a", "snap-b"}}
-	expected := [][]string{{"systemctl", "start", "snap.snap-a.svc1.service", "snap.snap-a.svc2.service", "snap.snap-b.svc3.service"}}
+	expected := []serviceControlArgs{
+		{action: "start", names: []string{"snap-a.svc1", "snap-a.svc2", "snap-b.svc3"}},
+	}
 	chg := s.testPostApps(c, inst, expected)
 	// check the summary expands the snap into actual apps
 	c.Check(chg.Summary(), check.Equals, "Running service command")
 	chg.State().Lock()
 	defer chg.State().Unlock()
-	c.Check(chg.Tasks()[0].Summary(), check.Equals, "start of [snap-a.svc1 snap-a.svc2 snap-b.svc3]")
+
+	var names []string
+	err := chg.Get("snap-names", &names)
+	c.Assert(err, check.IsNil)
+	c.Assert(names, check.DeepEquals, []string{"snap-a", "snap-b"})
 }
 
-func (s *appSuite) TestPosetAppsStop(c *check.C) {
+func (s *appSuite) TestPostAppsStop(c *check.C) {
 	inst := servicestate.Instruction{Action: "stop", Names: []string{"snap-a.svc2"}}
-	expected := [][]string{{"systemctl", "stop", "snap.snap-a.svc2.service"}}
+	expected := []serviceControlArgs{
+		{action: "stop", names: []string{"snap-a.svc2"}},
+	}
 	s.testPostApps(c, inst, expected)
 }
 
-func (s *appSuite) TestPosetAppsRestart(c *check.C) {
+func (s *appSuite) TestPostAppsRestart(c *check.C) {
 	inst := servicestate.Instruction{Action: "restart", Names: []string{"snap-a.svc2"}}
-	expected := [][]string{{"systemctl", "restart", "snap.snap-a.svc2.service"}}
+	expected := []serviceControlArgs{
+		{action: "restart", names: []string{"snap-a.svc2"}},
+	}
 	s.testPostApps(c, inst, expected)
 }
 
-func (s *appSuite) TestPosetAppsReload(c *check.C) {
+func (s *appSuite) TestPostAppsReload(c *check.C) {
 	inst := servicestate.Instruction{Action: "restart", Names: []string{"snap-a.svc2"}}
 	inst.Reload = true
-	expected := [][]string{{"systemctl", "reload-or-restart", "snap.snap-a.svc2.service"}}
+	expected := []serviceControlArgs{
+		{action: "restart", options: "reload", names: []string{"snap-a.svc2"}},
+	}
 	s.testPostApps(c, inst, expected)
 }
 
-func (s *appSuite) TestPosetAppsEnableNow(c *check.C) {
+func (s *appSuite) TestPostAppsEnableNow(c *check.C) {
 	inst := servicestate.Instruction{Action: "start", Names: []string{"snap-a.svc2"}}
 	inst.Enable = true
-	expected := [][]string{{"systemctl", "enable", "snap.snap-a.svc2.service"}, {"systemctl", "start", "snap.snap-a.svc2.service"}}
+	expected := []serviceControlArgs{
+		{action: "start", options: "enable", names: []string{"snap-a.svc2"}},
+	}
 	s.testPostApps(c, inst, expected)
 }
 
-func (s *appSuite) TestPosetAppsDisableNow(c *check.C) {
+func (s *appSuite) TestPostAppsDisableNow(c *check.C) {
 	inst := servicestate.Instruction{Action: "stop", Names: []string{"snap-a.svc2"}}
 	inst.Disable = true
-	expected := [][]string{{"systemctl", "disable", "snap.snap-a.svc2.service"}, {"systemctl", "stop", "snap.snap-a.svc2.service"}}
+	expected := []serviceControlArgs{
+		{action: "stop", options: "disable", names: []string{"snap-a.svc2"}},
+	}
 	s.testPostApps(c, inst, expected)
 }
 
@@ -7212,34 +7484,20 @@
 	c.Check(rsp.Result.(*errorResult).Message, check.Equals, `snap "snap-a" has no service "what"`)
 }
 
-func (s *appSuite) TestPostAppsBadAction(c *check.C) {
-	req, err := http.NewRequest("POST", "/v2/apps", bytes.NewBufferString(`{"action": "discombobulate", "names": ["snap-a.svc1"]}`))
+func (s *appSuite) TestPostAppsServiceControlError(c *check.C) {
+	req, err := http.NewRequest("POST", "/v2/apps", bytes.NewBufferString(`{"action": "start", "names": ["snap-a.svc1"]}`))
 	c.Assert(err, check.IsNil)
+	s.serviceControlError = fmt.Errorf("total failure")
 	rsp := postApps(appsCmd, req, nil).(*resp)
 	c.Check(rsp.Status, check.Equals, 400)
 	c.Check(rsp.Type, check.Equals, ResponseTypeError)
-	c.Check(rsp.Result.(*errorResult).Message, check.Equals, `unknown action "discombobulate"`)
+	c.Check(rsp.Result.(*errorResult).Message, check.Equals, `total failure`)
 }
 
 func (s *appSuite) TestPostAppsConflict(c *check.C) {
-	st := s.d.overlord.State()
-	st.Lock()
-	locked := true
-	defer func() {
-		if locked {
-			st.Unlock()
-		}
-	}()
-
-	ts, err := snapstate.Remove(st, "snap-a", snap.R(0), nil)
-	c.Assert(err, check.IsNil)
-	// need a change to make the tasks visible
-	st.NewChange("enable", "...").AddAll(ts)
-	st.Unlock()
-	locked = false
-
 	req, err := http.NewRequest("POST", "/v2/apps", bytes.NewBufferString(`{"action": "start", "names": ["snap-a.svc1"]}`))
 	c.Assert(err, check.IsNil)
+	s.serviceControlError = &snapstate.ChangeConflictError{Snap: "snap-a", ChangeKind: "enable"}
 	rsp := postApps(appsCmd, req, nil).(*resp)
 	c.Check(rsp.Status, check.Equals, 400)
 	c.Check(rsp.Type, check.Equals, ResponseTypeError)
@@ -7301,7 +7559,7 @@
 		Type:   ResponseTypeError,
 		Result: &errorResult{
 			Message: "no snap revision on specified channel",
-			Kind:    errorKindSnapChannelNotAvailable,
+			Kind:    client.ErrorKindSnapChannelNotAvailable,
 			Value: map[string]interface{}{
 				"snap-name":    "foo",
 				"action":       "install",
@@ -7327,7 +7585,7 @@
 		Type:   ResponseTypeError,
 		Result: &errorResult{
 			Message: "no snap revision on specified architecture",
-			Kind:    errorKindSnapArchitectureNotAvailable,
+			Kind:    client.ErrorKindSnapArchitectureNotAvailable,
 			Value: map[string]interface{}{
 				"snap-name":    "foo",
 				"action":       "install",
@@ -7347,7 +7605,7 @@
 		Type:   ResponseTypeError,
 		Result: &errorResult{
 			Message: "no snap revision available as specified",
-			Kind:    errorKindSnapRevisionNotAvailable,
+			Kind:    client.ErrorKindSnapRevisionNotAvailable,
 			Value:   "foo",
 		},
 	})
@@ -7418,7 +7676,7 @@
 		Type:   ResponseTypeError,
 		Result: &errorResult{
 			Message: `snap "foo" has "install" change in progress`,
-			Kind:    errorKindSnapChangeConflict,
+			Kind:    client.ErrorKindSnapChangeConflict,
 			Value: map[string]interface{}{
 				"snap-name":   "foo",
 				"change-kind": "install",
@@ -7434,7 +7692,7 @@
 		Type:   ResponseTypeError,
 		Result: &errorResult{
 			Message: `snap "foo" has changes in progress`,
-			Kind:    errorKindSnapChangeConflict,
+			Kind:    client.ErrorKindSnapChangeConflict,
 			Value: map[string]interface{}{
 				"snap-name": "foo",
 			},
@@ -7449,7 +7707,7 @@
 		Type:   ResponseTypeError,
 		Result: &errorResult{
 			Message: "specific error msg",
-			Kind:    errorKindSnapChangeConflict,
+			Kind:    client.ErrorKindSnapChangeConflict,
 			Value: map[string]interface{}{
 				"change-kind": "some-global-op",
 			},
@@ -7457,6 +7715,28 @@
 	})
 }
 
+func (s *apiSuite) TestErrToResponseInsufficentSpace(c *check.C) {
+	err := &snapstate.InsufficientSpaceError{
+		Snaps:      []string{"foo", "bar"},
+		ChangeKind: "some-change",
+		Path:       "/path",
+		Message:    "specific error msg",
+	}
+	rsp := errToResponse(err, nil, BadRequest, "%s: %v", "ERR").(*resp)
+	c.Check(rsp, check.DeepEquals, &resp{
+		Status: 507,
+		Type:   ResponseTypeError,
+		Result: &errorResult{
+			Message: "specific error msg",
+			Kind:    client.ErrorKindInsufficientDiskSpace,
+			Value: map[string]interface{}{
+				"snap-names":  []string{"foo", "bar"},
+				"change-kind": "some-change",
+			},
+		},
+	})
+}
+
 func (s *apiSuite) TestErrToResponse(c *check.C) {
 	aie := &snap.AlreadyInstalledError{Snap: "foo"}
 	nie := &snap.NotInstalledError{Snap: "foo"}
@@ -7480,7 +7760,7 @@
 	// this one can't happen (but fun to test):
 	saXe := &store.SnapActionError{Refresh: map[string]error{"foo": sa1e}}
 
-	makeErrorRsp := func(kind errorKind, err error, value interface{}) Response {
+	makeErrorRsp := func(kind client.ErrorKind, err error, value interface{}) Response {
 		return SyncResponse(&resp{
 			Type:   ResponseTypeError,
 			Result: &errorResult{Message: err.Error(), Kind: kind, Value: value},
@@ -7493,16 +7773,16 @@
 		expectedRsp Response
 	}{
 		{store.ErrSnapNotFound, SnapNotFound("foo", store.ErrSnapNotFound)},
-		{store.ErrNoUpdateAvailable, makeErrorRsp(errorKindSnapNoUpdateAvailable, store.ErrNoUpdateAvailable, "")},
-		{store.ErrLocalSnap, makeErrorRsp(errorKindSnapLocal, store.ErrLocalSnap, "")},
-		{aie, makeErrorRsp(errorKindSnapAlreadyInstalled, aie, "foo")},
-		{nie, makeErrorRsp(errorKindSnapNotInstalled, nie, "foo")},
-		{ndme, makeErrorRsp(errorKindSnapNeedsDevMode, ndme, "foo")},
-		{nc, makeErrorRsp(errorKindSnapNotClassic, nc, "foo")},
-		{nce, makeErrorRsp(errorKindSnapNeedsClassic, nce, "foo")},
-		{ncse, makeErrorRsp(errorKindSnapNeedsClassicSystem, ncse, "foo")},
+		{store.ErrNoUpdateAvailable, makeErrorRsp(client.ErrorKindSnapNoUpdateAvailable, store.ErrNoUpdateAvailable, "")},
+		{store.ErrLocalSnap, makeErrorRsp(client.ErrorKindSnapLocal, store.ErrLocalSnap, "")},
+		{aie, makeErrorRsp(client.ErrorKindSnapAlreadyInstalled, aie, "foo")},
+		{nie, makeErrorRsp(client.ErrorKindSnapNotInstalled, nie, "foo")},
+		{ndme, makeErrorRsp(client.ErrorKindSnapNeedsDevMode, ndme, "foo")},
+		{nc, makeErrorRsp(client.ErrorKindSnapNotClassic, nc, "foo")},
+		{nce, makeErrorRsp(client.ErrorKindSnapNeedsClassic, nce, "foo")},
+		{ncse, makeErrorRsp(client.ErrorKindSnapNeedsClassicSystem, ncse, "foo")},
 		{cce, SnapChangeConflict(cce)},
-		{nettoute, makeErrorRsp(errorKindNetworkTimeout, nettoute, "")},
+		{nettoute, makeErrorRsp(client.ErrorKindNetworkTimeout, nettoute, "")},
 		{netoe, BadRequest("ERR: %v", netoe)},
 		{nettmpe, BadRequest("ERR: %v", nettmpe)},
 		{e, BadRequest("ERR: %v", e)},
diff -Nru snapd-2.45.1+20.04.2/daemon/api_users.go snapd-2.48.3+20.04/daemon/api_users.go
--- snapd-2.45.1+20.04.2/daemon/api_users.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_users.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,6 +29,7 @@
 	"time"
 
 	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/assertstate"
@@ -115,7 +116,7 @@
 			Type: ResponseTypeError,
 			Result: &errorResult{
 				Message: "please use a valid email address.",
-				Kind:    errorKindInvalidAuthData,
+				Kind:    client.ErrorKindInvalidAuthData,
 				Value:   map[string][]string{"email": {"invalid"}},
 			},
 			Status: 400,
@@ -131,7 +132,7 @@
 		return SyncResponse(&resp{
 			Type: ResponseTypeError,
 			Result: &errorResult{
-				Kind:    errorKindTwoFactorRequired,
+				Kind:    client.ErrorKindTwoFactorRequired,
 				Message: err.Error(),
 			},
 			Status: 401,
@@ -140,7 +141,7 @@
 		return SyncResponse(&resp{
 			Type: ResponseTypeError,
 			Result: &errorResult{
-				Kind:    errorKindTwoFactorFailed,
+				Kind:    client.ErrorKindTwoFactorFailed,
 				Message: err.Error(),
 			},
 			Status: 401,
@@ -152,7 +153,7 @@
 				Type: ResponseTypeError,
 				Result: &errorResult{
 					Message: err.Error(),
-					Kind:    errorKindInvalidAuthData,
+					Kind:    client.ErrorKindInvalidAuthData,
 					Value:   err,
 				},
 				Status: 400,
@@ -162,7 +163,7 @@
 				Type: ResponseTypeError,
 				Result: &errorResult{
 					Message: err.Error(),
-					Kind:    errorKindPasswordPolicy,
+					Kind:    client.ErrorKindPasswordPolicy,
 					Value:   err,
 				},
 				Status: 401,
@@ -314,6 +315,10 @@
 	}
 
 	if !createData.ForceManaged {
+		if len(users) > 0 && createData.Automatic {
+			// no users created but no error with the automatic flag
+			return SyncResponse([]userResponseData{}, nil)
+		}
 		if len(users) > 0 {
 			return BadRequest("cannot create user: device already managed")
 		}
@@ -321,8 +326,14 @@
 			return BadRequest("cannot create user: device is a classic system")
 		}
 	}
+	if createData.Automatic {
+		// Automatic implies known/sudoers
+		createData.Known = true
+		createData.Sudoer = true
+	}
 
 	var model *asserts.Model
+	var serial *asserts.Serial
 	createKnown := createData.Known
 	if createKnown {
 		var err error
@@ -332,12 +343,18 @@
 		if err != nil {
 			return InternalError("cannot create user: cannot get model assertion: %v", err)
 		}
+		st.Lock()
+		serial, err = c.d.overlord.DeviceManager().Serial()
+		st.Unlock()
+		if err != nil && err != state.ErrNoState {
+			return InternalError("cannot create user: cannot get serial: %v", err)
+		}
 	}
 
 	// special case: the user requested the creation of all known
 	// system-users
 	if createData.Email == "" && createKnown {
-		return createAllKnownSystemUsers(st, model, &createData)
+		return createAllKnownSystemUsers(st, model, serial, &createData)
 	}
 	if createData.Email == "" {
 		return BadRequest("cannot create user: 'email' field is empty")
@@ -346,7 +363,7 @@
 	var username string
 	var opts *osutil.AddUserOptions
 	if createKnown {
-		username, opts, err = getUserDetailsFromAssertion(st, model, createData.Email)
+		username, opts, err = getUserDetailsFromAssertion(st, model, serial, createData.Email)
 	} else {
 		username, opts, err = getUserDetailsFromStore(getStore(c), createData.Email)
 	}
@@ -396,7 +413,7 @@
 	return v.Username, opts, nil
 }
 
-func createAllKnownSystemUsers(st *state.State, modelAs *asserts.Model, createData *postUserCreateData) Response {
+func createAllKnownSystemUsers(st *state.State, modelAs *asserts.Model, serialAs *asserts.Serial, createData *postUserCreateData) Response {
 	var createdUsers []userResponseData
 	headers := map[string]string{
 		"brand-id": modelAs.BrandID(),
@@ -414,7 +431,7 @@
 		email := as.(*asserts.SystemUser).Email()
 		// we need to use getUserDetailsFromAssertion as this verifies
 		// the assertion against the current brand/model/time
-		username, opts, err := getUserDetailsFromAssertion(st, modelAs, email)
+		username, opts, err := getUserDetailsFromAssertion(st, modelAs, serialAs, email)
 		if err != nil {
 			logger.Noticef("ignoring system-user assertion for %q: %s", email, err)
 			continue
@@ -443,7 +460,7 @@
 	return SyncResponse(createdUsers, nil)
 }
 
-func getUserDetailsFromAssertion(st *state.State, modelAs *asserts.Model, email string) (string, *osutil.AddUserOptions, error) {
+func getUserDetailsFromAssertion(st *state.State, modelAs *asserts.Model, serialAs *asserts.Serial, email string) (string, *osutil.AddUserOptions, error) {
 	errorPrefix := fmt.Sprintf("cannot add system-user %q: ", email)
 
 	st.Lock()
@@ -477,6 +494,16 @@
 	if len(su.Models()) > 0 && !strutil.ListContains(su.Models(), model) {
 		return "", nil, fmt.Errorf(errorPrefix+"%q not in models %q", model, su.Models())
 	}
+	if len(su.Serials()) > 0 {
+		if serialAs == nil {
+			return "", nil, fmt.Errorf(errorPrefix + "bound to serial assertion but device not yet registered")
+		}
+		serial := serialAs.Serial()
+		if !strutil.ListContains(su.Serials(), serial) {
+			return "", nil, fmt.Errorf(errorPrefix+"%q not in serials %q", serial, su.Serials())
+		}
+	}
+
 	if !su.ValidAt(time.Now()) {
 		return "", nil, fmt.Errorf(errorPrefix + "assertion not valid anymore")
 	}
@@ -503,6 +530,7 @@
 	Sudoer       bool   `json:"sudoer"`
 	Known        bool   `json:"known"`
 	ForceManaged bool   `json:"force-managed"`
+	Automatic    bool   `json:"automatic"`
 
 	// singleUserResultCompat indicates whether to preserve
 	// backwards compatibility, which results in more clunky
diff -Nru snapd-2.45.1+20.04.2/daemon/api_users_test.go snapd-2.48.3+20.04/daemon/api_users_test.go
--- snapd-2.45.1+20.04.2/daemon/api_users_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/api_users_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -384,6 +384,21 @@
 	})
 	// now add model related stuff to the system
 	assertstatetest.AddMany(st, model)
+	// and a serial
+	deviceKey, _ := assertstest.GenerateKey(752)
+	encDevKey, err := asserts.EncodePublicKey(deviceKey.PublicKey())
+	c.Assert(err, check.IsNil)
+	serial, err := s.brands.Signing("my-brand").Sign(asserts.SerialType, map[string]interface{}{
+		"authority-id":        "my-brand",
+		"brand-id":            "my-brand",
+		"model":               "my-model",
+		"serial":              "serialserial",
+		"device-key":          string(encDevKey),
+		"device-key-sha3-384": deviceKey.PublicKey().ID(),
+		"timestamp":           time.Now().Format(time.RFC3339),
+	}, nil, "")
+	c.Assert(err, check.IsNil)
+	assertstatetest.AddMany(st, serial)
 
 	for _, suMap := range systemUsers {
 		su, err := s.brands.Signing(suMap["authority-id"].(string)).Sign(asserts.SystemUserType, suMap, nil, "")
@@ -393,7 +408,7 @@
 		assertstatetest.AddMany(st, su)
 	}
 	// create fake device
-	err := devicestatetest.SetDevice(st, &auth.DeviceState{
+	err = devicestatetest.SetDevice(st, &auth.DeviceState{
 		Brand:  "my-brand",
 		Model:  "my-model",
 		Serial: "serialserial",
@@ -427,6 +442,21 @@
 	"until":        time.Now().Add(24 * 30 * time.Hour).Format(time.RFC3339),
 }
 
+var serialUser = map[string]interface{}{
+	"format":       "1",
+	"authority-id": "my-brand",
+	"brand-id":     "my-brand",
+	"email":        "serial@bar.com",
+	"series":       []interface{}{"16", "18"},
+	"models":       []interface{}{"my-model"},
+	"serials":      []interface{}{"serialserial"},
+	"name":         "Serial Guy",
+	"username":     "goodserialguy",
+	"password":     "$6$salt$hash",
+	"since":        time.Now().Format(time.RFC3339),
+	"until":        time.Now().Add(24 * 30 * time.Hour).Format(time.RFC3339),
+}
+
 var badUser = map[string]interface{}{
 	// bad user (not valid for this model)
 	"authority-id": "my-brand",
@@ -441,6 +471,21 @@
 	"until":        time.Now().Add(24 * 30 * time.Hour).Format(time.RFC3339),
 }
 
+var badUserNoMatchingSerial = map[string]interface{}{
+	"format":       "1",
+	"authority-id": "my-brand",
+	"brand-id":     "my-brand",
+	"email":        "noserial@bar.com",
+	"series":       []interface{}{"16", "18"},
+	"models":       []interface{}{"my-model"},
+	"serials":      []interface{}{"different-serialserial"},
+	"name":         "No Serial Guy",
+	"username":     "noserial",
+	"password":     "$6$salt$hash",
+	"since":        time.Now().Format(time.RFC3339),
+	"until":        time.Now().Add(24 * 30 * time.Hour).Format(time.RFC3339),
+}
+
 var unknownUser = map[string]interface{}{
 	"authority-id": "unknown",
 	"brand-id":     "my-brand",
@@ -466,7 +511,7 @@
 
 	// ensure that if we query the details from the assert DB we get
 	// the expected user
-	username, opts, err := getUserDetailsFromAssertion(st, model, "foo@bar.com")
+	username, opts, err := getUserDetailsFromAssertion(st, model, nil, "foo@bar.com")
 	c.Check(username, check.Equals, "guy")
 	c.Check(opts, check.DeepEquals, &osutil.AddUserOptions{
 		Gecos:    "foo@bar.com,Boring Guy",
@@ -567,7 +612,18 @@
 }
 
 func (s *userSuite) TestPostCreateUserFromAssertionAllKnown(c *check.C) {
-	s.makeSystemUsers(c, []map[string]interface{}{goodUser, partnerUser, badUser, unknownUser})
+	expectSudoer := false
+	s.testPostCreateUserFromAssertion(c, `{"known":true}`, expectSudoer)
+}
+
+func (s *userSuite) TestPostCreateUserFromAssertionAllAutomatic(c *check.C) {
+	// automatic implies "sudoder"
+	expectSudoer := true
+	s.testPostCreateUserFromAssertion(c, `{"automatic":true}`, expectSudoer)
+}
+
+func (s *userSuite) testPostCreateUserFromAssertion(c *check.C, postData string, expectSudoer bool) {
+	s.makeSystemUsers(c, []map[string]interface{}{goodUser, partnerUser, serialUser, badUser, badUserNoMatchingSerial, unknownUser})
 	created := map[string]bool{}
 	// mock the calls that create the user
 	osutilAddUser = func(username string, opts *osutil.AddUserOptions) error {
@@ -576,11 +632,13 @@
 			c.Check(opts.Gecos, check.Equals, "foo@bar.com,Boring Guy")
 		case "partnerguy":
 			c.Check(opts.Gecos, check.Equals, "p@partner.com,Partner Guy")
+		case "goodserialguy":
+			c.Check(opts.Gecos, check.Equals, "serial@bar.com,Serial Guy")
 		default:
 			c.Logf("unexpected username %q", username)
 			c.Fail()
 		}
-		c.Check(opts.Sudoer, check.Equals, false)
+		c.Check(opts.Sudoer, check.Equals, expectSudoer)
 		c.Check(opts.Password, check.Equals, "$6$salt$hash")
 		created[username] = true
 		return nil
@@ -595,7 +653,7 @@
 	}
 
 	// do it!
-	buf := bytes.NewBufferString(`{"known":true}`)
+	buf := bytes.NewBufferString(postData)
 	req, err := http.NewRequest("POST", "/v2/create-user", buf)
 	c.Assert(err, check.IsNil)
 
@@ -611,8 +669,9 @@
 		c.Check(u, check.DeepEquals, userResponseData{Username: u.Username})
 	}
 	c.Check(seen, check.DeepEquals, map[string]bool{
-		"guy":        true,
-		"partnerguy": true,
+		"guy":           true,
+		"partnerguy":    true,
+		"goodserialguy": true,
 	})
 
 	// ensure the user was added to the state
@@ -621,7 +680,7 @@
 	users, err := auth.Users(st)
 	c.Assert(err, check.IsNil)
 	st.Unlock()
-	c.Check(users, check.HasLen, 2)
+	c.Check(users, check.HasLen, 3)
 }
 
 func (s *userSuite) TestPostCreateUserFromAssertionAllKnownClassicErrors(c *check.C) {
@@ -661,6 +720,29 @@
 	c.Check(rsp.Result.(*errorResult).Message, check.Matches, `cannot create user: device already managed`)
 }
 
+func (s *userSuite) TestPostCreateUserAutomaticManagedDoesNotActOrError(c *check.C) {
+	s.makeSystemUsers(c, []map[string]interface{}{goodUser})
+
+	st := s.d.overlord.State()
+	st.Lock()
+	_, err := auth.NewUser(st, "username", "email@test.com", "macaroon", []string{"discharge"})
+	st.Unlock()
+	c.Check(err, check.IsNil)
+
+	// do it!
+	buf := bytes.NewBufferString(`{"automatic":true}`)
+	req, err := http.NewRequest("POST", "/v2/create-user", buf)
+	c.Assert(err, check.IsNil)
+
+	rsp := postCreateUser(createUserCmd, req, nil).(*resp)
+
+	// expecting an empty reply
+	expected := []userResponseData{}
+	c.Check(rsp.Type, check.Equals, ResponseTypeSync)
+	c.Check(rsp.Result, check.FitsTypeOf, expected)
+	c.Check(rsp.Result, check.DeepEquals, expected)
+}
+
 func (s *userSuite) TestPostCreateUserFromAssertionAllKnownNoModelError(c *check.C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -683,6 +765,40 @@
 	c.Check(rsp.Result.(*errorResult).Message, check.Matches, `cannot create user: cannot get model assertion: no state entry for key`)
 }
 
+func (s *userSuite) TestPostCreateUserFromAssertionNoModel(c *check.C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	model := s.brands.Model("my-brand", "other-model", map[string]interface{}{
+		"architecture":          "amd64",
+		"gadget":                "pc",
+		"kernel":                "pc-kernel",
+		"system-user-authority": []interface{}{"my-brand", "partner"},
+	})
+	s.makeSystemUsers(c, []map[string]interface{}{serialUser})
+
+	st := s.d.overlord.State()
+	st.Lock()
+	assertstatetest.AddMany(st, model)
+	err := devicestatetest.SetDevice(st, &auth.DeviceState{
+		Brand:  "my-brand",
+		Model:  "my-model",
+		Serial: "other-serial-assertion",
+	})
+	st.Unlock()
+	c.Assert(err, check.IsNil)
+
+	// do it!
+	buf := bytes.NewBufferString(`{"email":"serial@bar.com", "known":true}`)
+	req, err := http.NewRequest("POST", "/v2/create-user", buf)
+	c.Assert(err, check.IsNil)
+
+	rsp := postCreateUser(createUserCmd, req, nil).(*resp)
+
+	c.Check(rsp.Type, check.Equals, ResponseTypeError)
+	c.Check(rsp.Result.(*errorResult).Message, check.Matches, `cannot add system-user "serial@bar.com": bound to serial assertion but device not yet registered`)
+}
+
 func (s *userSuite) TestPostCreateUserFromAssertionAllKnownButOwned(c *check.C) {
 	s.makeSystemUsers(c, []map[string]interface{}{goodUser})
 
@@ -760,6 +876,7 @@
 	c.Check(rsp.Result, check.DeepEquals, expected)
 }
 
+// XXX: wrong suite
 func (s *userSuite) TestSysInfoIsManaged(c *check.C) {
 	st := s.d.overlord.State()
 	st.Lock()
@@ -776,6 +893,7 @@
 	c.Check(rsp.Result.(map[string]interface{})["managed"], check.Equals, true)
 }
 
+// XXX: wrong suite
 func (s *userSuite) TestSysInfoWorksDegraded(c *check.C) {
 	s.d.SetDegradedMode(fmt.Errorf("some error"))
 
diff -Nru snapd-2.45.1+20.04.2/daemon/daemon.go snapd-2.48.3+20.04/daemon/daemon.go
--- snapd-2.45.1+20.04.2/daemon/daemon.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/daemon.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,7 +20,9 @@
 package daemon
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"net"
 	"net/http"
@@ -55,6 +57,12 @@
 
 var systemdSdNotify = systemd.SdNotify
 
+const (
+	daemonRestartMsg = "system is restarting"
+	systemRestartMsg = "daemon is restarting"
+	socketRestartMsg = "daemon is stopping to wait for socket activation"
+)
+
 // A Daemon listens for requests and routes them to the right command
 type Daemon struct {
 	Version         string
@@ -68,8 +76,8 @@
 	router          *mux.Router
 	standbyOpinions *standby.StandbyOpinions
 
-	// set to remember we need to restart the system
-	restartSystem state.RestartType
+	// set to what kind of restart was requested if any
+	requestedRestart state.RestartType
 	// set to remember that we need to exit the daemon in a way that
 	// prevents systemd from restarting it
 	restartSocket bool
@@ -259,14 +267,10 @@
 
 	if rsp, ok := rsp.(*resp); ok {
 		_, rst := st.Restarting()
-		switch rst {
-		case state.RestartSystem, state.RestartSystemNow:
-			rsp.transmitMaintenance(errorKindSystemRestart, "system is restarting")
-		case state.RestartDaemon:
-			rsp.transmitMaintenance(errorKindDaemonRestart, "daemon is restarting")
-		case state.RestartSocket:
-			rsp.transmitMaintenance(errorKindDaemonRestart, "daemon is stopping to wait for socket activation")
+		if rst != state.RestartUnset {
+			rsp.Maintenance = maintenanceForRestartType(rst)
 		}
+
 		if rsp.Type != ResponseTypeError {
 			st.Lock()
 			count, stamp := st.WarningsSummary()
@@ -450,6 +454,13 @@
 	// enable standby handling
 	d.initStandbyHandling()
 
+	// before serving actual connections remove the maintenance.json file as we
+	// are no longer down for maintenance, this state most closely corresponds
+	// to state.RestartUnset
+	if err := d.updateMaintenanceFile(state.RestartUnset); err != nil {
+		return err
+	}
+
 	// the loop runs in its own goroutine
 	d.overlord.Loop()
 
@@ -478,9 +489,14 @@
 
 // HandleRestart implements overlord.RestartBehavior.
 func (d *Daemon) HandleRestart(t state.RestartType) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
 	// die when asked to restart (systemd should get us back up!) etc
 	switch t {
 	case state.RestartDaemon:
+		// save the restart kind to write out a maintenance.json in a bit
+		d.requestedRestart = t
 	case state.RestartSystem, state.RestartSystemNow:
 		// try to schedule a fallback slow reboot already here
 		// in case we get stuck shutting down
@@ -488,19 +504,18 @@
 			logger.Noticef("%s", err)
 		}
 
-		d.mu.Lock()
-		defer d.mu.Unlock()
-		// remember we need to restart the system
-		d.restartSystem = t
+		// save the restart kind to write out a maintenance.json in a bit
+		d.requestedRestart = t
 	case state.RestartSocket:
-		d.mu.Lock()
-		defer d.mu.Unlock()
+		// save the restart kind to write out a maintenance.json in a bit
+		d.requestedRestart = t
 		d.restartSocket = true
 	case state.StopDaemon:
 		logger.Noticef("stopping snapd as requested")
 	default:
 		logger.Noticef("internal error: restart handler called with unknown restart type: %v", t)
 	}
+
 	d.tomb.Kill(nil)
 }
 
@@ -511,6 +526,27 @@
 	rebootMaxTentatives    = 3
 )
 
+func (d *Daemon) updateMaintenanceFile(rst state.RestartType) error {
+	// for unset restart, just remove the maintenance.json file
+	if rst == state.RestartUnset {
+		err := os.Remove(dirs.SnapdMaintenanceFile)
+		// only return err if the error was something other than the file not
+		// existing
+		if err != nil && !os.IsNotExist(err) {
+			return err
+		}
+		return nil
+	}
+
+	// otherwise marshal and write it out appropriately
+	b, err := json.Marshal(maintenanceForRestartType(rst))
+	if err != nil {
+		return err
+	}
+
+	return osutil.AtomicWrite(dirs.SnapdMaintenanceFile, bytes.NewBuffer(b), 0644, 0)
+}
+
 // Stop shuts down the Daemon
 func (d *Daemon) Stop(sigCh chan<- os.Signal) error {
 	// we need to schedule/wait for a system restart again
@@ -525,12 +561,23 @@
 
 	d.tomb.Kill(nil)
 
+	// check the state associated with a potential restart with the lock to
+	// prevent races
 	d.mu.Lock()
-	restartSystem := d.restartSystem != state.RestartUnset
-	immediateReboot := d.restartSystem == state.RestartSystemNow
+	// needsFullReboot is whether the entire system will be rebooted or not as
+	// a consequence of this restart
+	needsFullReboot := (d.requestedRestart == state.RestartSystemNow || d.requestedRestart == state.RestartSystem)
+	immediateReboot := d.requestedRestart == state.RestartSystemNow
 	restartSocket := d.restartSocket
 	d.mu.Unlock()
 
+	// before not accepting any new client connections we need to write the
+	// maintenance.json file for potential clients to see after the daemon stops
+	// responding so they can read it correctly and handle the maintenance
+	if err := d.updateMaintenanceFile(d.requestedRestart); err != nil {
+		logger.Noticef("error writing maintenance file: %v", err)
+	}
+
 	d.snapdListener.Close()
 	d.standbyOpinions.Stop()
 
@@ -547,7 +594,7 @@
 		d.snapListener.Close()
 	}
 
-	if restartSystem {
+	if needsFullReboot {
 		// give time to polling clients to notice restart
 		time.Sleep(rebootNoticeWait)
 	}
@@ -559,10 +606,9 @@
 	d.tomb.Kill(d.serve.Shutdown(ctx))
 	cancel()
 
-	if !restartSystem {
+	if !needsFullReboot {
 		// tell systemd that we are stopping
 		systemdSdNotify("STOPPING=1")
-
 	}
 
 	if restartSocket {
@@ -580,8 +626,7 @@
 	}
 	d.overlord.Stop()
 
-	err := d.tomb.Wait()
-	if err != nil {
+	if err := d.tomb.Wait(); err != nil {
 		if err == context.DeadlineExceeded {
 			logger.Noticef("WARNING: cannot gracefully shut down in-flight snapd API activity within: %v", shutdownTimeout)
 			// the process is shutting down anyway, so we may just
@@ -592,7 +637,7 @@
 			// because we already scheduled a slow shutdown and
 			// exiting here will just restart snapd (via systemd)
 			// which will lead to confusing results.
-			if restartSystem {
+			if needsFullReboot {
 				logger.Noticef("WARNING: cannot stop daemon: %v", err)
 			} else {
 				return err
@@ -600,7 +645,7 @@
 		}
 	}
 
-	if restartSystem {
+	if needsFullReboot {
 		return d.doReboot(sigCh, immediateReboot, rebootWaitTimeout)
 	}
 
diff -Nru snapd-2.45.1+20.04.2/daemon/daemon_test.go snapd-2.48.3+20.04/daemon/daemon_test.go
--- snapd-2.45.1+20.04.2/daemon/daemon_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/daemon_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -193,7 +193,7 @@
 	err = json.Unmarshal(rec.Body.Bytes(), &rst)
 	c.Assert(err, check.IsNil)
 	c.Check(rst.Maintenance, check.DeepEquals, &errorResult{
-		Kind:    errorKindSystemRestart,
+		Kind:    client.ErrorKindSystemRestart,
 		Message: "system is restarting",
 	})
 
@@ -204,11 +204,32 @@
 	err = json.Unmarshal(rec.Body.Bytes(), &rst)
 	c.Assert(err, check.IsNil)
 	c.Check(rst.Maintenance, check.DeepEquals, &errorResult{
-		Kind:    errorKindDaemonRestart,
+		Kind:    client.ErrorKindDaemonRestart,
 		Message: "daemon is restarting",
 	})
 }
 
+func (s *daemonSuite) TestMaintenanceJsonDeletedOnStart(c *check.C) {
+	// write a maintenance.json file that has that the system is restarting
+	maintErr := &errorResult{
+		Kind:    client.ErrorKindDaemonRestart,
+		Message: systemRestartMsg,
+	}
+
+	b, err := json.Marshal(maintErr)
+	c.Assert(err, check.IsNil)
+	c.Assert(os.MkdirAll(filepath.Dir(dirs.SnapdMaintenanceFile), 0755), check.IsNil)
+	c.Assert(ioutil.WriteFile(dirs.SnapdMaintenanceFile, b, 0644), check.IsNil)
+
+	d := newTestDaemon(c)
+	makeDaemonListeners(c, d)
+
+	// after starting, maintenance.json should be removed
+	d.Start()
+	c.Assert(dirs.SnapdMaintenanceFile, testutil.FileAbsent)
+	d.Stop(nil)
+}
+
 func (s *daemonSuite) TestFillsWarnings(c *check.C) {
 	d := newTestDaemon(c)
 
@@ -590,7 +611,12 @@
 	d.snapListener = &witnessAcceptListener{Listener: l, accept: snapAccept}
 
 	c.Assert(d.Start(), check.IsNil)
-	defer d.Stop(nil)
+	stoppedYet := false
+	defer func() {
+		if !stoppedYet {
+			d.Stop(nil)
+		}
+	}()
 
 	snapdDone := make(chan struct{})
 	go func() {
@@ -622,6 +648,11 @@
 	case <-time.After(2 * time.Second):
 		c.Fatal("RequestRestart -> overlord -> Kill chain didn't work")
 	}
+
+	d.Stop(nil)
+	stoppedYet = true
+
+	c.Assert(s.notified, check.DeepEquals, []string{"EXTEND_TIMEOUT_USEC=30000000", "READY=1", "STOPPING=1"})
 }
 
 func (s *daemonSuite) TestGracefulStop(c *check.C) {
@@ -877,7 +908,7 @@
 
 	defer func() {
 		d.mu.Lock()
-		d.restartSystem = state.RestartUnset
+		d.requestedRestart = state.RestartUnset
 		d.mu.Unlock()
 	}()
 
@@ -888,7 +919,7 @@
 	}
 
 	d.mu.Lock()
-	rs := d.restartSystem
+	rs := d.requestedRestart
 	d.mu.Unlock()
 
 	c.Check(rs, check.Equals, restartKind)
@@ -924,6 +955,17 @@
 		// should be good enough
 		c.Check(rebootAt.Before(now.Add(10*time.Second)), check.Equals, true)
 	}
+
+	// finally check that maintenance.json was written appropriate for this
+	// restart reason
+	b, err := ioutil.ReadFile(dirs.SnapdMaintenanceFile)
+	c.Assert(err, check.IsNil)
+
+	maintErr := &errorResult{}
+	c.Assert(json.Unmarshal(b, maintErr), check.IsNil)
+
+	exp := maintenanceForRestartType(restartKind)
+	c.Assert(maintErr, check.DeepEquals, exp)
 }
 
 func (s *daemonSuite) TestRestartSystemGracefulWiring(c *check.C) {
diff -Nru snapd-2.45.1+20.04.2/daemon/export_api_snapshots_test.go snapd-2.48.3+20.04/daemon/export_api_snapshots_test.go
--- snapd-2.45.1+20.04.2/daemon/export_api_snapshots_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/export_api_snapshots_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,12 +22,14 @@
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 
 	"gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/overlord/auth"
+	"github.com/snapcore/snapd/overlord/snapshotstate"
 	"github.com/snapcore/snapd/overlord/state"
 )
 
@@ -47,6 +49,14 @@
 	}
 }
 
+func MockSnapshotExport(newExport func(context.Context, uint64) (*snapshotstate.SnapshotExport, error)) (restore func()) {
+	oldExport := snapshotExport
+	snapshotExport = newExport
+	return func() {
+		snapshotExport = oldExport
+	}
+}
+
 func MockSnapshotCheck(newCheck func(*state.State, uint64, []string, []string) ([]string, *state.TaskSet, error)) (restore func()) {
 	oldCheck := snapshotCheck
 	snapshotCheck = newCheck
@@ -71,6 +81,14 @@
 	}
 }
 
+func MockSnapshotImport(newImport func(context.Context, *state.State, io.Reader) (uint64, []string, error)) (restore func()) {
+	oldImport := snapshotImport
+	snapshotImport = newImport
+	return func() {
+		snapshotImport = oldImport
+	}
+}
+
 func MustUnmarshalSnapInstruction(c *check.C, jinst string) *snapInstruction {
 	var inst snapInstruction
 	if err := json.Unmarshal([]byte(jinst), &inst); err != nil {
@@ -99,7 +117,14 @@
 	return changeSnapshots(c, r, user).(*resp)
 }
 
+func ExportSnapshot(c *Command, r *http.Request, user *auth.UserState) interface{} {
+	return getSnapshotExport(c, r, user)
+}
+
 var (
-	SnapshotMany = snapshotMany
-	SnapshotCmd  = snapshotCmd
+	SnapshotMany      = snapshotMany
+	SnapshotCmd       = snapshotCmd
+	SnapshotExportCmd = snapshotExportCmd
 )
+
+type SnapshotExportResponse = snapshotExportResponse
diff -Nru snapd-2.45.1+20.04.2/daemon/export_api_systems_test.go snapd-2.48.3+20.04/daemon/export_api_systems_test.go
--- snapd-2.45.1+20.04.2/daemon/export_api_systems_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/export_api_systems_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,32 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package daemon
+
+import (
+	"github.com/snapcore/snapd/overlord/devicestate"
+)
+
+func MockDeviceManagerReboot(f func(*devicestate.DeviceManager, string, string) error) (restore func()) {
+	old := deviceManagerReboot
+	deviceManagerReboot = f
+	return func() {
+		deviceManagerReboot = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/export_test.go snapd-2.48.3+20.04/daemon/export_test.go
--- snapd-2.45.1+20.04.2/daemon/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,10 @@
 	"time"
 
 	"github.com/snapcore/snapd/overlord"
+	"github.com/snapcore/snapd/overlord/hookstate"
+	"github.com/snapcore/snapd/overlord/servicestate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
 )
 
 type Resp = resp
@@ -60,3 +64,11 @@
 		shutdownTimeout = old
 	}
 }
+
+func MockServicestateControl(f func(st *state.State, appInfos []*snap.AppInfo, inst *servicestate.Instruction, context *hookstate.Context) ([]*state.TaskSet, error)) (restore func()) {
+	old := servicestateControl
+	servicestateControl = f
+	return func() {
+		servicestateControl = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/daemon/response.go snapd-2.48.3+20.04/daemon/response.go
--- snapd-2.45.1+20.04.2/daemon/response.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/response.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2018 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -35,7 +35,9 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/overlord/snapshotstate"
 	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/store"
 	"github.com/snapcore/snapd/systemd"
@@ -66,11 +68,23 @@
 	Maintenance *errorResult `json:"maintenance,omitempty"`
 }
 
-func (r *resp) transmitMaintenance(kind errorKind, message string) {
-	r.Maintenance = &errorResult{
-		Kind:    kind,
-		Message: message,
+func maintenanceForRestartType(rst state.RestartType) *errorResult {
+	e := &errorResult{}
+	switch rst {
+	case state.RestartSystem, state.RestartSystemNow:
+		e.Kind = client.ErrorKindSystemRestart
+		e.Message = daemonRestartMsg
+	case state.RestartDaemon:
+		e.Kind = client.ErrorKindDaemonRestart
+		e.Message = systemRestartMsg
+	case state.RestartSocket:
+		e.Kind = client.ErrorKindDaemonRestart
+		e.Message = socketRestartMsg
+	case state.RestartUnset:
+		// shouldn't happen, maintenance for unset type should just be nil
+		panic("internal error: cannot marshal maintenance for RestartUnset")
 	}
+	return e
 }
 
 func (r *resp) addWarningsToMeta(count int, stamp time.Time) {
@@ -91,7 +105,7 @@
 //      JSON representation in the API in time for the release.
 //      The right code style takes a bit more work and unifies
 //      these fields inside resp.
-// Increment the counter if you read this: 42
+// Increment the counter if you read this: 43
 type Meta struct {
 	Sources           []string   `json:"sources,omitempty"`
 	SuggestedCurrency string     `json:"suggested-currency,omitempty"`
@@ -145,61 +159,13 @@
 	w.Write(bs)
 }
 
-type errorKind string
-
-const (
-	errorKindTwoFactorRequired = errorKind("two-factor-required")
-	errorKindTwoFactorFailed   = errorKind("two-factor-failed")
-	errorKindLoginRequired     = errorKind("login-required")
-	errorKindInvalidAuthData   = errorKind("invalid-auth-data")
-	errorKindAuthCancelled     = errorKind("auth-cancelled")
-	errorKindTermsNotAccepted  = errorKind("terms-not-accepted")
-	errorKindNoPaymentMethods  = errorKind("no-payment-methods")
-	errorKindPaymentDeclined   = errorKind("payment-declined")
-	errorKindPasswordPolicy    = errorKind("password-policy")
-
-	errorKindSnapAlreadyInstalled  = errorKind("snap-already-installed")
-	errorKindSnapNotInstalled      = errorKind("snap-not-installed")
-	errorKindSnapNotFound          = errorKind("snap-not-found")
-	errorKindAppNotFound           = errorKind("app-not-found")
-	errorKindSnapLocal             = errorKind("snap-local")
-	errorKindSnapNoUpdateAvailable = errorKind("snap-no-update-available")
-
-	errorKindSnapRevisionNotAvailable     = errorKind("snap-revision-not-available")
-	errorKindSnapChannelNotAvailable      = errorKind("snap-channel-not-available")
-	errorKindSnapArchitectureNotAvailable = errorKind("snap-architecture-not-available")
-
-	errorKindSnapChangeConflict = errorKind("snap-change-conflict")
-
-	errorKindNotSnap = errorKind("snap-not-a-snap")
-
-	errorKindSnapNeedsDevMode       = errorKind("snap-needs-devmode")
-	errorKindSnapNeedsClassic       = errorKind("snap-needs-classic")
-	errorKindSnapNeedsClassicSystem = errorKind("snap-needs-classic-system")
-	errorKindSnapNotClassic         = errorKind("snap-not-classic")
-
-	errorKindBadQuery = errorKind("bad-query")
-
-	errorKindNetworkTimeout      = errorKind("network-timeout")
-	errorKindDNSFailure          = errorKind("dns-failure")
-	errorKindInterfacesUnchanged = errorKind("interfaces-unchanged")
-
-	errorKindConfigNoSuchOption = errorKind("option-not-found")
-
-	errorKindDaemonRestart = errorKind("daemon-restart")
-	errorKindSystemRestart = errorKind("system-restart")
-
-	errorKindAssertionNotFound = errorKind("assertion-not-found")
-
-	errorKindUnsuccessful = errorKind("unsuccessful")
-)
-
 type errorValue interface{}
 
 type errorResult struct {
-	Message string     `json:"message"` // note no omitempty
-	Kind    errorKind  `json:"kind,omitempty"`
-	Value   errorValue `json:"value,omitempty"`
+	Message string `json:"message"` // note no omitempty
+	// Kind is the error kind. See client/errors.go
+	Kind  client.ErrorKind `json:"kind,omitempty"`
+	Value errorValue       `json:"value,omitempty"`
 }
 
 // SyncResponse builds a "sync" response from the given result.
@@ -240,7 +206,7 @@
 			res.Message = fmt.Sprintf(format, v...)
 		}
 		if status == 401 {
-			res.Kind = errorKindLoginRequired
+			res.Kind = client.ErrorKindLoginRequired
 		}
 		return &resp{
 			Type:   ResponseTypeError,
@@ -298,6 +264,21 @@
 	}
 }
 
+// A snapshotExportResponse 's ServeHTTP method serves a specific snapshot ID
+type snapshotExportResponse struct {
+	*snapshotstate.SnapshotExport
+}
+
+// ServeHTTP from the Response interface
+func (s snapshotExportResponse) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	w.Header().Add("Content-Length", strconv.FormatInt(s.Size(), 10))
+	w.Header().Add("Content-Type", client.SnapshotExportMediaType)
+	if err := s.StreamTo(w); err != nil {
+		logger.Debugf("cannot export snapshot: %v", err)
+	}
+	s.Close()
+}
+
 // A fileResponse 's ServeHTTP method serves the file
 type fileResponse string
 
@@ -425,7 +406,7 @@
 		Type: ResponseTypeError,
 		Result: &errorResult{
 			Message: err.Error(),
-			Kind:    errorKindSnapNotFound,
+			Kind:    client.ErrorKindSnapNotFound,
 			Value:   snapName,
 		},
 		Status: 404,
@@ -438,7 +419,7 @@
 // channel when this channel is empty).
 func SnapRevisionNotAvailable(snapName string, rnaErr *store.RevisionNotAvailableError) Response {
 	var value interface{} = snapName
-	kind := errorKindSnapRevisionNotAvailable
+	kind := client.ErrorKindSnapRevisionNotAvailable
 	msg := rnaErr.Error()
 	if len(rnaErr.Releases) != 0 && rnaErr.Channel != "" {
 		thisArch := arch.DpkgArchitecture()
@@ -464,10 +445,10 @@
 		// the error kind whether there was anything at all
 		// available for this architecture
 		if archOK {
-			kind = errorKindSnapChannelNotAvailable
+			kind = client.ErrorKindSnapChannelNotAvailable
 			msg = "no snap revision on specified channel"
 		} else {
-			kind = errorKindSnapArchitectureNotAvailable
+			kind = client.ErrorKindSnapArchitectureNotAvailable
 			msg = "no snap revision on specified architecture"
 		}
 		values["releases"] = releases
@@ -499,19 +480,40 @@
 		Type: ResponseTypeError,
 		Result: &errorResult{
 			Message: cce.Error(),
-			Kind:    errorKindSnapChangeConflict,
+			Kind:    client.ErrorKindSnapChangeConflict,
 			Value:   value,
 		},
 		Status: 409,
 	}
 }
 
+// InsufficientSpace is an error responder used when an operation cannot
+// be performed due to low disk space.
+func InsufficientSpace(dserr *snapstate.InsufficientSpaceError) Response {
+	value := map[string]interface{}{}
+	if len(dserr.Snaps) > 0 {
+		value["snap-names"] = dserr.Snaps
+	}
+	if dserr.ChangeKind != "" {
+		value["change-kind"] = dserr.ChangeKind
+	}
+	return &resp{
+		Type: ResponseTypeError,
+		Result: &errorResult{
+			Message: dserr.Error(),
+			Kind:    client.ErrorKindInsufficientDiskSpace,
+			Value:   value,
+		},
+		Status: 507,
+	}
+}
+
 // AppNotFound is an error responder used when an operation is
 // requested on a app that doesn't exist.
 func AppNotFound(format string, v ...interface{}) Response {
 	res := &errorResult{
 		Message: fmt.Sprintf(format, v...),
-		Kind:    errorKindAppNotFound,
+		Kind:    client.ErrorKindAppNotFound,
 	}
 	return &resp{
 		Type:   ResponseTypeError,
@@ -525,7 +527,7 @@
 func AuthCancelled(format string, v ...interface{}) Response {
 	res := &errorResult{
 		Message: fmt.Sprintf(format, v...),
-		Kind:    errorKindAuthCancelled,
+		Kind:    client.ErrorKindAuthCancelled,
 	}
 	return &resp{
 		Type:   ResponseTypeError,
@@ -539,7 +541,7 @@
 func InterfacesUnchanged(format string, v ...interface{}) Response {
 	res := &errorResult{
 		Message: fmt.Sprintf(format, v...),
-		Kind:    errorKindInterfacesUnchanged,
+		Kind:    client.ErrorKindInterfacesUnchanged,
 	}
 	return &resp{
 		Type:   ResponseTypeError,
@@ -549,7 +551,7 @@
 }
 
 func errToResponse(err error, snaps []string, fallback func(format string, v ...interface{}) Response, format string, v ...interface{}) Response {
-	var kind errorKind
+	var kind client.ErrorKind
 	var snapName string
 
 	switch err {
@@ -565,9 +567,9 @@
 			return InternalError("store.SnapNotFound with %d snaps", len(snaps))
 		}
 	case store.ErrNoUpdateAvailable:
-		kind = errorKindSnapNoUpdateAvailable
+		kind = client.ErrorKindSnapNoUpdateAvailable
 	case store.ErrLocalSnap:
-		kind = errorKindSnapLocal
+		kind = client.ErrorKindSnapLocal
 	default:
 		handled := true
 		switch err := err.(type) {
@@ -583,28 +585,30 @@
 				return InternalError("store.RevisionNotAvailable with %d snaps", len(snaps))
 			}
 		case *snap.AlreadyInstalledError:
-			kind = errorKindSnapAlreadyInstalled
+			kind = client.ErrorKindSnapAlreadyInstalled
 			snapName = err.Snap
 		case *snap.NotInstalledError:
-			kind = errorKindSnapNotInstalled
+			kind = client.ErrorKindSnapNotInstalled
 			snapName = err.Snap
 		case *snapstate.ChangeConflictError:
 			return SnapChangeConflict(err)
 		case *snapstate.SnapNeedsDevModeError:
-			kind = errorKindSnapNeedsDevMode
+			kind = client.ErrorKindSnapNeedsDevMode
 			snapName = err.Snap
 		case *snapstate.SnapNeedsClassicError:
-			kind = errorKindSnapNeedsClassic
+			kind = client.ErrorKindSnapNeedsClassic
 			snapName = err.Snap
 		case *snapstate.SnapNeedsClassicSystemError:
-			kind = errorKindSnapNeedsClassicSystem
+			kind = client.ErrorKindSnapNeedsClassicSystem
 			snapName = err.Snap
 		case *snapstate.SnapNotClassicError:
-			kind = errorKindSnapNotClassic
+			kind = client.ErrorKindSnapNotClassic
 			snapName = err.Snap
+		case *snapstate.InsufficientSpaceError:
+			return InsufficientSpace(err)
 		case net.Error:
 			if err.Timeout() {
-				kind = errorKindNetworkTimeout
+				kind = client.ErrorKindNetworkTimeout
 			} else {
 				handled = false
 			}
diff -Nru snapd-2.45.1+20.04.2/daemon/snap.go snapd-2.48.3+20.04/daemon/snap.go
--- snapd-2.45.1+20.04.2/daemon/snap.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/daemon/snap.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -28,7 +28,7 @@
 	"strings"
 
 	"github.com/snapcore/snapd/client"
-	"github.com/snapcore/snapd/cmd"
+	"github.com/snapcore/snapd/client/clientutil"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/assertstate"
 	"github.com/snapcore/snapd/overlord/healthstate"
@@ -281,14 +281,14 @@
 		}
 	}
 
-	sort.Sort(cmd.BySnapApp(appInfos))
+	sort.Sort(snap.AppInfoBySnapApp(appInfos))
 
 	return appInfos, nil
 }
 
-func mapLocal(about aboutSnap) *client.Snap {
+func mapLocal(about aboutSnap, sd clientutil.StatusDecorator) *client.Snap {
 	localSnap, snapst := about.info, about.snapst
-	result, err := cmd.ClientSnapFromSnapInfo(localSnap)
+	result, err := clientutil.ClientSnapFromSnapInfo(localSnap, sd)
 	if err != nil {
 		logger.Noticef("cannot get full app info for snap %q: %v", localSnap.InstanceName(), err)
 	}
@@ -323,7 +323,7 @@
 }
 
 func mapRemote(remoteSnap *snap.Info) *client.Snap {
-	result, err := cmd.ClientSnapFromSnapInfo(remoteSnap)
+	result, err := clientutil.ClientSnapFromSnapInfo(remoteSnap, nil)
 	if err != nil {
 		logger.Noticef("cannot get full app info for snap %q: %v", remoteSnap.SnapName(), err)
 	}
diff -Nru snapd-2.45.1+20.04.2/data/dbus/Makefile snapd-2.48.3+20.04/data/dbus/Makefile
--- snapd-2.45.1+20.04.2/data/dbus/Makefile	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/dbus/Makefile	2021-02-02 08:21:12.000000000 +0000
@@ -14,7 +14,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 BINDIR := /usr/bin
-DBUSSERVICESDIR := /usr/share/dbus-1/services
+DBUSDIR = /usr/share/dbus-1
+DBUSSERVICESDIR := ${DBUSDIR}/services
 
 SERVICES_GENERATED := $(patsubst %.service.in,%.service,$(wildcard *.service.in))
 SERVICES := ${SERVICES_GENERATED}
@@ -24,10 +25,18 @@
 
 all: ${SERVICES}
 
-install: ${SERVICES}
+install:: ${SERVICES}
 	# NOTE: old (e.g. 14.04) GNU coreutils doesn't -D with -t
 	install -d -m 0755 ${DESTDIR}/${DBUSSERVICESDIR}
 	install -m 0644 -t ${DESTDIR}/${DBUSSERVICESDIR} $^
 
+install:: snapd.session-services.conf
+	install -d -m 0755 ${DESTDIR}/${DBUSDIR}/session.d
+	install -m 0644 -t ${DESTDIR}/${DBUSDIR}/session.d $^
+
+install:: snapd.system-services.conf
+	install -d -m 0755 ${DESTDIR}/${DBUSDIR}/system.d
+	install -m 0644 -t ${DESTDIR}/${DBUSDIR}/system.d $^
+
 clean:
 	rm -f ${SERVICES_GENERATED}
diff -Nru snapd-2.45.1+20.04.2/data/dbus/snapd.session-services.conf snapd-2.48.3+20.04/data/dbus/snapd.session-services.conf
--- snapd-2.45.1+20.04.2/data/dbus/snapd.session-services.conf	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/data/dbus/snapd.session-services.conf	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+<!-- keep in sync with dirs/dirs.go:SetRootDir() -->
+<busconfig>
+  <servicedir>/var/lib/snapd/dbus-1/services/</servicedir>
+</busconfig>
diff -Nru snapd-2.45.1+20.04.2/data/dbus/snapd.system-services.conf snapd-2.48.3+20.04/data/dbus/snapd.system-services.conf
--- snapd-2.45.1+20.04.2/data/dbus/snapd.system-services.conf	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/data/dbus/snapd.system-services.conf	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+<!-- keep in sync with dirs/dirs.go:SetRootDir() -->
+<busconfig>
+  <servicedir>/var/lib/snapd/dbus-1/system-services/</servicedir>
+</busconfig>
diff -Nru snapd-2.45.1+20.04.2/data/env/snapd.sh.in snapd-2.48.3+20.04/data/env/snapd.sh.in
--- snapd-2.45.1+20.04.2/data/env/snapd.sh.in	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/env/snapd.sh.in	2021-02-02 08:21:12.000000000 +0000
@@ -2,7 +2,7 @@
 
 # Expand $PATH to include the directory where snappy applications go.
 snap_bin_path="@SNAP_MOUNT_DIR@/bin"
-if [ -n "${PATH##*${snap_bin_path}}" -a -n "${PATH##*${snap_bin_path}:*}" ]; then
+if [ -n "${PATH##*${snap_bin_path}}" ] && [ -n "${PATH##*${snap_bin_path}:*}" ]; then
     export PATH=$PATH:${snap_bin_path}
 fi
 
@@ -16,7 +16,7 @@
 # looked for in XDG_DATA_DIRS; make sure it includes the relevant directory for
 # snappy applications' desktop files.
 snap_xdg_path="/var/lib/snapd/desktop"
-if [ -n "${XDG_DATA_DIRS##*${snap_xdg_path}}" -a -n "${XDG_DATA_DIRS##*${snap_xdg_path}:*}" ]; then
+if [ -n "${XDG_DATA_DIRS##*${snap_xdg_path}}" ] && [ -n "${XDG_DATA_DIRS##*${snap_xdg_path}:*}" ]; then
     export XDG_DATA_DIRS="${XDG_DATA_DIRS}:${snap_xdg_path}"
 fi
 
diff -Nru snapd-2.45.1+20.04.2/data/Makefile snapd-2.48.3+20.04/data/Makefile
--- snapd-2.45.1+20.04.2/data/Makefile	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/Makefile	2021-02-02 08:21:12.000000000 +0000
@@ -5,4 +5,3 @@
 	$(MAKE) -C dbus $@
 	$(MAKE) -C env $@
 	$(MAKE) -C desktop $@
-	$(MAKE) -C sudo $@
diff -Nru snapd-2.45.1+20.04.2/data/selinux/snappy.if snapd-2.48.3+20.04/data/selinux/snappy.if
--- snapd-2.45.1+20.04.2/data/selinux/snappy.if	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/selinux/snappy.if	2021-02-02 08:21:12.000000000 +0000
@@ -272,3 +272,42 @@
 	corecmd_search_bin($1)
 	domtrans_pattern($1, snappy_mount_exec_t, snappy_mount_t)
 ')
+
+########################################
+## <summary>
+##	Search snapd state directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`snappy_search_lib',`
+	gen_require(`
+		type snappy_var_lib_t;
+	')
+
+	allow $1 snappy_var_lib_t:dir search_dir_perms;
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Read snapd state files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`snappy_read_lib',`
+	gen_require(`
+		type snappy_var_lib_t;
+	')
+
+	snappy_search_lib($1)
+	list_dirs_pattern($1, snappy_var_lib_t, snappy_var_lib_t)
+	read_files_pattern($1, snappy_var_lib_t, snappy_var_lib_t)
+')
diff -Nru snapd-2.45.1+20.04.2/data/selinux/snappy.te snapd-2.48.3+20.04/data/selinux/snappy.te
--- snapd-2.45.1+20.04.2/data/selinux/snappy.te	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/selinux/snappy.te	2021-02-02 08:21:12.000000000 +0000
@@ -206,8 +206,8 @@
 miscfiles_read_localization(snappy_t)
 
 # Allow snapd to read its run files, those files are managed elsewhere
-read_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t)
-getattr_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t)
+manage_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t)
+manage_sock_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t)
 
 gen_require(`
 	type user_tmp_t;
@@ -261,8 +261,10 @@
 # Allow snapd to use ssh-keygen
 ssh_exec_keygen(snappy_t)
 
-# Allow snapd to access passwd file for lookup
+# Allow snapd to access passwd file for trivial user lookup
 auth_read_passwd(snappy_t)
+# also via nsswitch if called via libc
+auth_use_nsswitch(snappy_t)
 
 # because /run/snapd/ns/*.mnt gets a label of the process context
 gen_require(` type unconfined_t; ')
@@ -280,7 +282,7 @@
 allow snappy_t self:unix_stream_socket create_stream_socket_perms;
 allow snappy_t self:tcp_socket create_stream_socket_perms;
 allow snappy_t self:udp_socket create_stream_socket_perms;
-allow snappy_t self:unix_dgram_socket create_socket_perms;
+allow snappy_t self:unix_dgram_socket { create_socket_perms sendto };
 allow snappy_t self:capability2 block_suspend;
 
 # snapd needs to check for ipv6 support
@@ -351,12 +353,17 @@
 fs_getattr_xattr_fs(snappy_t)
 # probing cgroup version, /sys/fs/cgroup is a tmpfs for v1 or cgroup for v2
 fs_getattr_tmpfs(snappy_t)
+fs_list_tmpfs(snappy_t)
 fs_getattr_cgroup(snappy_t)
 # snapd checks whether <snap>.mnt exists before running the mount namespace
 # helper tool
 # fs_getattr_nsfs_files() is not available in selinux devel on CentOS 7.x
 getattr_files_pattern(snappy_t, nsfs_t, nsfs_t)
 
+# lxd snap has nsfs under common directory, this works around denials triggered
+# by snapshot size estimation.
+allow snappy_t unconfined_service_t:file getattr;
+
 # snapd attempts to read /run/cloud-init/instance-data.json
 sysnet_read_config(snappy_t)
 # however older policy may be missing the transition rules, and
@@ -808,3 +815,14 @@
 ')
 # mandb cache update scans whe whole directory tree looking for 'man'
 allow mandb_t snappy_var_lib_t:dir search_dir_perms;
+
+########################################
+#
+# extra policy for system dbus
+#
+gen_require(`
+	type system_dbusd_t;
+  ')
+# system dbus may look info /var/lib/snapd/dbus-1
+snappy_search_lib(system_dbusd_t)
+snappy_read_lib(system_dbusd_t)
diff -Nru snapd-2.45.1+20.04.2/data/sudo/99-snapd.conf.in snapd-2.48.3+20.04/data/sudo/99-snapd.conf.in
--- snapd-2.45.1+20.04.2/data/sudo/99-snapd.conf.in	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/sudo/99-snapd.conf.in	1970-01-01 00:00:00.000000000 +0000
@@ -1,3 +0,0 @@
-# Allow snap-provided applications to work with sudo
-
-Defaults    secure_path += @SNAP_MOUNT_DIR@/bin
diff -Nru snapd-2.45.1+20.04.2/data/sudo/Makefile snapd-2.48.3+20.04/data/sudo/Makefile
--- snapd-2.45.1+20.04.2/data/sudo/Makefile	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/data/sudo/Makefile	1970-01-01 00:00:00.000000000 +0000
@@ -1,36 +0,0 @@
-#
-# Copyright (C) 2020 Neal Gompa <ngompa13@gmail.com>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 3 as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-SNAP_MOUNT_DIR := /snap
-SUDOERD := /etc/sudoers.d
-
-%.conf: %.conf.in
-	sed   < $< > $@ \
-		s:@SNAP_MOUNT_DIR@:${SNAP_MOUNT_DIR}:g
-
-GENERATED = 99-snapd.conf
-
-all: ${GENERATED}
-.PHONY: all
-
-install: ${GENERATED}
-	# NOTE: old (e.g. 14.04) GNU coreutils doesn't -D with -t
-	install -d -m 0755 ${DESTDIR}/${SUDOERD}
-	install -m 0644 -t ${DESTDIR}/${SUDOERD} $^
-.PHONY: install
-
-clean:
-	$(RM) ${GENERATED}
-.PHONY: clean
diff -Nru snapd-2.45.1+20.04.2/dbusutil/dbustest/dbustest.go snapd-2.48.3+20.04/dbusutil/dbustest/dbustest.go
--- snapd-2.45.1+20.04.2/dbusutil/dbustest/dbustest.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/dbusutil/dbustest/dbustest.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,233 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package dbustest
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"sync"
+
+	"github.com/godbus/dbus"
+)
+
+// testDBusClientName is the unique name of the connected client.
+const testDBusClientName = ":test"
+
+// DBusHandlerFunc is the type of handler function for interacting with test DBus.
+//
+// The handler is called for each message that arrives to the bus from the test
+// client. The handler can respond by returning zero or more messages.
+// Typically one message is returned (method response or error). Additional
+// messages can be returned to represent signals emitted during message
+// handling.
+//
+// The handler is not called for internal messages related to DBus itself.
+type DBusHandlerFunc func(msg *dbus.Message, n int) ([]*dbus.Message, error)
+
+// testDBusStream provides io.ReadWriteCloser for dbus.NewConn.
+//
+// Internally the stream uses separate input and output buffers.  Input buffer
+// is written to by DBus. Output buffer is written to internally, in response
+// to internal interactions with DBus or in response to message handler
+// function, provided by test code, returning DBus messages to send.
+//
+// Before authentication is completed buffers are used to operate a
+// line-oriented, text protocol. After authentication the buffers exchange DBus
+// messages exclusively.
+//
+// The authentication phase is handled internally and is not exposed to tests.
+//
+// Anything written to the output buffer is passed to DBus for processing.
+// Anything read from input buffer is decoded and either handled internally or
+// delegated to the handler function.
+//
+// DBus implementation we use requires Read to block while data is unavailable
+// so a condition variable is used to provide blocking behavior.
+type testDBusStream struct {
+	handler DBusHandlerFunc
+
+	m        sync.Mutex
+	readable sync.Cond
+
+	outputBuf, inputBuf bytes.Buffer
+	closed              bool
+	authDone            bool
+	n                   int
+}
+
+func (s *testDBusStream) decodeRequest() {
+	// s.m is locked
+	if !s.authDone {
+		// Before authentication is done process the text protocol anticipating
+		// the TEST authentication used by NewDBusTestConn call below.
+		msg := s.inputBuf.String()
+		s.inputBuf.Reset()
+		switch msg {
+		case "\x00":
+			// initial NUL byte, ignore
+		case "AUTH\r\n":
+			s.outputBuf.WriteString("REJECTED TEST\r\n")
+		case "AUTH TEST TEST\r\n":
+			s.outputBuf.WriteString("OK test://\r\n")
+		case "CANCEL\r\n":
+			s.outputBuf.WriteString("REJECTED\r\n")
+		case "BEGIN\r\n":
+			s.authDone = true
+		default:
+			panic(fmt.Errorf("unrecognized authentication message %q", msg))
+		}
+		s.readable.Signal()
+		return
+	}
+
+	// After authentication the buffer must contain marshaled DBus messages.
+	msgIn, err := dbus.DecodeMessage(&s.inputBuf)
+	if err != nil {
+		panic(fmt.Errorf("cannot decode incoming message: %v", err))
+	}
+	switch s.n {
+	case 0:
+		// The very first message we receive is a Hello message sent from
+		// NewDBusTestConn below. This message, along with the NameAcquired
+		// signal we send below, allow DBus to associate the client with the
+		// responses sent by test.
+		s.sendMsg(&dbus.Message{
+			Type: dbus.TypeMethodReply,
+			Headers: map[dbus.HeaderField]dbus.Variant{
+				dbus.FieldDestination: dbus.MakeVariant(testDBusClientName),
+				dbus.FieldSender:      dbus.MakeVariant("org.freedesktop.DBus"),
+				dbus.FieldReplySerial: dbus.MakeVariant(msgIn.Serial()),
+				dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf("")),
+			},
+			Body: []interface{}{":test"},
+		})
+		s.sendMsg(&dbus.Message{
+			Type: dbus.TypeSignal,
+			Headers: map[dbus.HeaderField]dbus.Variant{
+				dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/DBus")),
+				dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.DBus"),
+				dbus.FieldMember:      dbus.MakeVariant("NameAcquired"),
+				dbus.FieldDestination: dbus.MakeVariant(testDBusClientName),
+				dbus.FieldSender:      dbus.MakeVariant("org.freedesktop.DBus"),
+				dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf("")),
+			},
+			Body: []interface{}{testDBusClientName},
+		})
+	default:
+		msgOutList, err := s.handler(msgIn, s.n-1)
+		if err != nil {
+			panic("cannot handle message: " + err.Error())
+		}
+		for _, msgOut := range msgOutList {
+			// Test code does not need to provide the address of the sender.
+			if _, ok := msgOut.Headers[dbus.FieldSender]; !ok {
+				msgOut.Headers[dbus.FieldSender] = dbus.MakeVariant(testDBusClientName)
+			}
+			s.sendMsg(msgOut)
+		}
+	}
+	s.n++
+}
+
+func (s *testDBusStream) sendMsg(msg *dbus.Message) {
+	// TODO: handle big endian if we ever get big endian machines again.
+	if err := msg.EncodeTo(&s.outputBuf, binary.LittleEndian); err != nil {
+		panic(fmt.Errorf("cannot encode outgoing message: %v", err))
+	}
+	// s.m is locked
+	s.readable.Signal()
+}
+
+func (s *testDBusStream) Read(p []byte) (n int, err error) {
+	s.m.Lock()
+	defer s.m.Unlock()
+
+	// When the buffer is empty block until more data arrives. DBus
+	// continuously blocks on reading and premature empty read is treated as an
+	// EOF, terminating the message flow.
+	if s.outputBuf.Len() == 0 {
+		s.readable.Wait()
+	}
+
+	if s.closed {
+		return 0, fmt.Errorf("stream is closed")
+	}
+	return s.outputBuf.Read(p)
+}
+
+func (s *testDBusStream) Write(p []byte) (n int, err error) {
+	s.m.Lock()
+	defer s.m.Unlock()
+
+	if s.closed {
+		return 0, fmt.Errorf("stream is closed")
+	}
+
+	n, err = s.inputBuf.Write(p)
+	s.decodeRequest()
+	return n, err
+}
+
+func (s *testDBusStream) Close() error {
+	s.m.Lock()
+	defer s.m.Unlock()
+	s.closed = true
+	s.readable.Signal()
+	return nil
+}
+
+func newTestDBusStream(handler DBusHandlerFunc) *testDBusStream {
+	s := &testDBusStream{handler: handler}
+	s.readable.L = &s.m
+	return s
+}
+
+// testAuth implements DBus authentication protocol used during testing.
+type testAuth struct{}
+
+func (a *testAuth) FirstData() (name, resp []byte, status dbus.AuthStatus) {
+	return []byte("TEST"), []byte("TEST"), dbus.AuthOk
+}
+
+func (a *testAuth) HandleData(data []byte) (resp []byte, status dbus.AuthStatus) {
+	return []byte(""), dbus.AuthOk
+}
+
+// Connection returns a DBus connection for writing unit tests.
+//
+// The handler function is called for each message sent to the bus. It can
+// return any number of messages to send in response. The counter aids in
+// testing a sequence of messages that is expected.
+func Connection(handler DBusHandlerFunc) (*dbus.Conn, error) {
+	conn, err := dbus.NewConn(newTestDBusStream(handler))
+	if err != nil {
+		return nil, err
+	}
+	if err = conn.Auth([]dbus.Auth{&testAuth{}}); err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	if err = conn.Hello(); err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	return conn, nil
+}
diff -Nru snapd-2.45.1+20.04.2/dbusutil/dbustest/stub.go snapd-2.48.3+20.04/dbusutil/dbustest/stub.go
--- snapd-2.45.1+20.04.2/dbusutil/dbustest/stub.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/dbusutil/dbustest/stub.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,47 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package dbustest
+
+import (
+	"github.com/godbus/dbus"
+)
+
+// stubReadWriteCloser implements ReadWriteCloser for dbus.NewConn
+type stubReadWriteCloser struct{}
+
+func (*stubReadWriteCloser) Read(p []byte) (n int, err error) {
+	return 0, nil
+}
+
+func (*stubReadWriteCloser) Write(p []byte) (n int, err error) {
+	return 0, nil
+}
+
+func (*stubReadWriteCloser) Close() error {
+	return nil
+}
+
+// StubConnection returns a dbus connection that does nothing.
+//
+// Using dbustest.Connection panics as the goroutines spawned by
+// go-dbus do not expect the connection to be immediately closed.
+func StubConnection() (*dbus.Conn, error) {
+	return dbus.NewConn(&stubReadWriteCloser{})
+}
diff -Nru snapd-2.45.1+20.04.2/dbusutil/dbusutil.go snapd-2.48.3+20.04/dbusutil/dbusutil.go
--- snapd-2.45.1+20.04.2/dbusutil/dbusutil.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/dbusutil/dbusutil.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,112 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package dbusutil
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/godbus/dbus"
+
+	"github.com/snapcore/snapd/dirs"
+)
+
+// isSessionBusLikelyPresent checks for the apparent availability of DBus session bus.
+//
+// The code matches what go-dbus does when it tries to detect the session bus:
+// - the presence of the environment variable DBUS_SESSION_BUS_ADDRESS
+// - the presence of the bus socket address in the file /run/user/UID/dbus-session
+// - the presence of the bus socket in /run/user/UID/bus
+func isSessionBusLikelyPresent() bool {
+	if address := os.Getenv("DBUS_SESSION_BUS_ADDRESS"); address != "" {
+		return true
+	}
+	uid := os.Getuid()
+	if fi, err := os.Stat(fmt.Sprintf("%s/%d/dbus-session", dirs.XdgRuntimeDirBase, uid)); err == nil {
+		if fi.Mode()&os.ModeType == 0 {
+			return true
+		}
+	}
+	if fi, err := os.Stat(fmt.Sprintf("%s/%d/bus", dirs.XdgRuntimeDirBase, uid)); err == nil {
+		if fi.Mode()&os.ModeType == os.ModeSocket {
+			return true
+		}
+	}
+	return false
+}
+
+// SessionBus is like dbus.SessionBus but it avoids auto-starting
+// a new dbus-daemon when a bus is not already available.
+//
+// The go-dbus package will launch a session bus instance on demand when none
+// is present, something we do not want to do. In all contexts where there is a need
+//  to use the session bus, we expect session bus daemon to have been started and
+// managed by the corresponding user session manager.
+//
+// This function is mockable by either MockConnections or
+// MockOnlySessionBusAvailable.
+var SessionBus = func() (*dbus.Conn, error) {
+	if isSessionBusLikelyPresent() {
+		return dbus.SessionBus()
+	}
+	return nil, fmt.Errorf("cannot find session bus")
+}
+
+// SystemBus is like dbus.SystemBus and is provided for completeness.
+//
+// This function is mockable by either MockConnections or
+// MockOnlySystemBusAvailable.
+var SystemBus = func() (*dbus.Conn, error) {
+	return dbus.SystemBus()
+}
+
+// MockConnections mocks the connection functions system and session buses.
+func MockConnections(system, session func() (*dbus.Conn, error)) (restore func()) {
+	oldSystem := SystemBus
+	oldSession := SessionBus
+	SystemBus = system
+	SessionBus = session
+	return func() {
+		SystemBus = oldSystem
+		SessionBus = oldSession
+	}
+}
+
+// MockOnlySystemBusAvailable makes SystemBus return the given connection.
+//
+// In addition calling SessionBus will panic.
+func MockOnlySystemBusAvailable(conn *dbus.Conn) (restore func()) {
+	systemBus := func() (*dbus.Conn, error) { return conn, nil }
+	sessionBus := func() (*dbus.Conn, error) {
+		panic("DBus session bus should not have been used")
+	}
+	return MockConnections(systemBus, sessionBus)
+}
+
+// MockOnlySessionBusAvailable makes SessionBus return the given connection.
+//
+// In addition calling SystemBus will panic.
+func MockOnlySessionBusAvailable(conn *dbus.Conn) (restore func()) {
+	systemBus := func() (*dbus.Conn, error) {
+		panic("DBus system bus should not have been used")
+	}
+	sessionBus := func() (*dbus.Conn, error) { return conn, nil }
+	return MockConnections(systemBus, sessionBus)
+}
diff -Nru snapd-2.45.1+20.04.2/dbusutil/dbusutil_test.go snapd-2.48.3+20.04/dbusutil/dbusutil_test.go
--- snapd-2.45.1+20.04.2/dbusutil/dbusutil_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/dbusutil/dbusutil_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,123 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package dbusutil_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dbusutil"
+	"github.com/snapcore/snapd/dbusutil/dbustest"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type dbusutilSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&dbusutilSuite{})
+
+const envVar = "DBUS_SESSION_BUS_ADDRESS"
+
+func (s *dbusutilSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	// Pretend we have an empty file system. This specifically makes
+	// /run/user/*/ empty as well.
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("") })
+
+	// Pretend that we don't have the environment variable with session bus
+	// address.
+	if value := os.Getenv(envVar); value != "" {
+		os.Unsetenv(envVar)
+		s.AddCleanup(func() { os.Setenv(envVar, value) })
+	}
+}
+
+func (*dbusutilSuite) TestIsSessionBusLikelyPresentNothing(c *C) {
+	c.Assert(dbusutil.IsSessionBusLikelyPresent(), Equals, false)
+}
+
+func (*dbusutilSuite) TestIsSessionBusLikelyPresentEnvVar(c *C) {
+	os.Setenv(envVar, "address")
+
+	c.Assert(dbusutil.IsSessionBusLikelyPresent(), Equals, true)
+}
+
+func (*dbusutilSuite) TestIsSessionBusLikelyPresentAddrFile(c *C) {
+	f := fmt.Sprintf("%s/%d/dbus-session", dirs.XdgRuntimeDirBase, os.Getuid())
+	c.Assert(os.MkdirAll(filepath.Dir(f), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(f, []byte("address"), 0644), IsNil)
+
+	c.Assert(dbusutil.IsSessionBusLikelyPresent(), Equals, true)
+}
+
+func (*dbusutilSuite) TestIsSessionBusLikelyPresentSocket(c *C) {
+	f := fmt.Sprintf("%s/%d/bus", dirs.XdgRuntimeDirBase, os.Getuid())
+	c.Assert(os.MkdirAll(filepath.Dir(f), 0755), IsNil)
+	l, err := net.Listen("unix", f)
+	c.Assert(err, IsNil)
+	defer l.Close()
+
+	c.Assert(dbusutil.IsSessionBusLikelyPresent(), Equals, true)
+}
+
+func (*dbusutilSuite) TestSessionBusWithoutBus(c *C) {
+	_, err := dbusutil.SessionBus()
+	c.Assert(err, ErrorMatches, "cannot find session bus")
+}
+
+func (*dbusutilSuite) TestMockOnlySessionBusAvailable(c *C) {
+	stub, err := dbustest.StubConnection()
+	c.Assert(err, IsNil)
+	defer stub.Close()
+	restore := dbusutil.MockOnlySessionBusAvailable(stub)
+	defer restore()
+
+	conn, err := dbusutil.SessionBus()
+	c.Assert(err, IsNil)
+	c.Check(conn, Equals, stub)
+
+	c.Check(func() { dbusutil.SystemBus() }, PanicMatches, "DBus system bus should not have been used")
+}
+
+func (*dbusutilSuite) TestMockOnlySystemBusAvailable(c *C) {
+	stub, err := dbustest.StubConnection()
+	c.Assert(err, IsNil)
+	defer stub.Close()
+	restore := dbusutil.MockOnlySystemBusAvailable(stub)
+	defer restore()
+
+	c.Check(func() { dbusutil.SessionBus() }, PanicMatches, "DBus session bus should not have been used")
+
+	conn, err := dbusutil.SystemBus()
+	c.Assert(err, IsNil)
+	c.Check(conn, Equals, stub)
+}
diff -Nru snapd-2.45.1+20.04.2/dbusutil/export_test.go snapd-2.48.3+20.04/dbusutil/export_test.go
--- snapd-2.45.1+20.04.2/dbusutil/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/dbusutil/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,22 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package dbusutil
+
+var IsSessionBusLikelyPresent = isSessionBusLikelyPresent
diff -Nru snapd-2.45.1+20.04.2/debian/changelog snapd-2.48.3+20.04/debian/changelog
--- snapd-2.45.1+20.04.2/debian/changelog	2020-07-10 13:59:20.000000000 +0000
+++ snapd-2.48.3+20.04/debian/changelog	2021-02-02 08:21:12.000000000 +0000
@@ -1,23 +1,1305 @@
-snapd (2.45.1+20.04.2) focal-security; urgency=medium
+snapd (2.48.3+20.04) focal-security; urgency=medium
 
-  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
-    (xdg-open)
-    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment 
+  * SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  * interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 02 Feb 2021 09:21:12 +0100
+
+snapd (2.48.2) xenial; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - tests: sign new nested-18|20* models to allow for generic serials
+    - secboot: add extra paranoia when waiting for that fde-reveal-key
+    - tests: backport netplan workarounds from #9785
+    - secboot: add workaround for snapcore/core-initrd issue #13
+    - devicestate: log checkEncryption errors via logger.Noticef
+    - tests: add nested spread end-to-end test for fde-hooks
+    - devicestate: implement checkFDEFeatures()
+    - boot: tweak resealing with fde-setup hooks
+    - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+      init restrict file
+    - secboot: add new LockSealedKeys() that uses either TPM or
+      fde-reveal-key
+    - gadget: use "sealed-keys" to determine what method to use for
+      reseal
+    - boot: add sealKeyToModeenvUsingFdeSetupHook()
+    - secboot: use `fde-reveal-key` if available to unseal key
+    - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+      other entries
+    - o/devicestate: save model with serial in the device save db
+    - devicestate: add runFDESetupHook() helper
+    - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+    - hookstate: add new HookManager.EphemeralRunHook()
+    - update-pot: fix typo in plural keyword spec
+    - store,cmd/snap-repair: increase initial expontential time
+      intervals
+    - o/devicestate,daemon: fix reboot system action to not require a
+      system label
+    - github: run nested suite when commit is pushed to release branch
+    - tests: reset fakestore unit status
+    - tests: fix uc20-create-parition-* tests for updated gadget
+    - hookstate: implement snapctl fde-setup-{request,result}
+    - devicestate: make checkEncryption fde-setup hook aware
+    - client,snapctl: add naive support for "stdin"
+    - devicestate: support "storage-safety" defaults during install
+    - snap: use the boot-base for kernel hooks
+    - vendor: update secboot repo to avoid including secboot.test binary
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 15 Dec 2020 20:21:44 +0100
+
+snapd (2.48.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - gadget: disable ubuntu-boot role validation check
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Dec 2020 17:43:30 +0100
+
+snapd (2.48) xenial; urgency=medium
+
+  * New upstream release, LP: #1904098
+    - osutil: add KernelCommandLineKeyValue
+    - devicestate: implement boot.HasFDESetupHook
+    - boot/makebootable.go: set snapd_recovery_mode=install at image-
+      build time
+    - bootloader: use ForGadget when installing boot config
+    - interfaces/raw_usb: allow read access to /proc/tty/drivers
+    - boot: add scaffolding for "fde-setup" hook support for sealing
+    - tests: fix basic20 test on arm devices
+    - seed: make a shared seed system label validation helper
+    - snap: add new "fde-setup" hooktype
+    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+      device handling
+    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+      messiness
+    - tests/nested/manual/refresh-revert-fundamentals: temporarily
+      disable secure boot
+    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+      boot modes
+    - many: address degraded recover mode feedback, cleanups
+    - tests: Use systemd-run on tests part2
+    - tests: set the opensuse tumbleweed system as manual in spread.yaml
+    - secboot: call BlockPCRProtectionPolicies even if the TPM is
+      disabled
+    - vendor: update to current secboot
+    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+      save
+    - spread.yaml: increase number of workers on 20.10
+    - snap: add new `snap recovery --show-keys` option
+    - tests: minor test tweaks suggested in the review of 9607
+    - snapd-generator: set standard snapfuse options when generating
+      units for containers
+    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+    - interfaces: share /tmp/.X11-unix/ from host or provider
+    - tests: enable main lxd test on 20.10
+    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+      degraded mode
+    - gadget/install: add progress logging
+    - packaging: keep secboot/encrypt_dummy.go in debian
+    - interfaces/udev: use distro specific path to snap-device-helper
+    - o/devistate: fix chaining of tasks related to regular snaps when
+      preseeding
+    - gadget, overlord/devicestate: validate that system supports
+      encrypted data before install
+    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+      ESP layout
+    - many: add /v2/system-recovery-keys API and client
+    - secboot, many: return UnlockMethod from Unlock* methods for future
+      usage
+    - many: mv keys to ubuntu-boot, move model file, rename keyring
+      prefix for secboot
+    - tests: using systemd-run instead of manually create a systemd unit
+      - part 1
+    - secboot, cmd/snap-bootstrap: enable or disable activation with
+      recovery key
+    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+      disks first
+    - secboot: add LockTPMSealedKeys() to lock access to keys
+      independently
+    - gadget: correct sfdisk arguments
+    - bootloader/assets/grub: adjust fwsetup menuentry label
+    - tests: new boot state tool
+    - spread: use the official image for Ubuntu 20.10, no longer an
+      unstable system
+    - tests/lib/nested: enable snapd logging to console for core18
+    - osutil/disks: re-implement partition searching for disk w/ non-
+      adjacent parts
+    - tests: using the nested-state tool in nested tests
+    - many: seal a fallback object to the recovery boot chain
+    - gadget, gadget/install: move helpers to install package, refactor
+      unit tests
+    - dirs: add "gentoo" to altDirDistros
+    - update-pot: include file locations in translation template, and
+      extract strings from desktop files
+    - gadget/many: drop usage of gpt attr 59 for indicating creation of
+      partitions
+    - gadget/quantity: tweak test name
+    - snap: fix failing unittest for quantity.FormatDuration()
+    - gadget/quantity: introduce a new package that captures quantities
+    - o/devicestate,a/sysdb: make a backup of the device serial to save
+    - tests: fix rare interaction of tests.session and specific tests
+    - features: enable classic-preserves-xdg-runtime-dir
+    - tests/nested/core20/save: check the bind mount and size bump
+    - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+    - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+      tests
+    - o/devicestate: unit test tweaks
+    - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+    - testutil, cmd/snap/version: fix misc little errors
+    - overlord/devicestate: bind mount ubuntu-save under
+      /var/lib/snapd/save on startup
+    - gadget/internal: tune ext4 setting for smaller filesystems
+    - tests/nested/core20/save: a test that verifies ubuntu-save is
+      present and set up
+    - tests: update google sru backend to support groovy
+    - o/ifacestate: handle interface hooks when preseeding
+    - tests: re-enable the apt hooks test
+    - interfaces,snap: use correct type: {os,snapd} for test data
+    - secboot: set metadata and keyslots sizes when formatting LUKS2
+      volumes
+    - tests: improve uc20-create-partitions-reinstall test
+    - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+    - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+    - secboot: fix doc comment on helper for unlocking volume with key
+    - tests: add spread test for refreshing from an old snapd and core18
+    - o/snapstate: generate snapd snap wrappers again after restart on
+      refresh
+    - secboot: version bump, unlock volume with key
+    - tests/snap-advise-command: re-enable test
+    - cmd/snap, snapmgr, tests: cleanups after #9418
+    - interfaces: deny connected x11 plugs access to ICE
+    - daemon,client: write and read a maintenance.json file for when
+      snapd is shut down
+    - many: update to secboot v1 (part 1)
+    - osutil/disks/mockdisk: panic if same mountpoint shows up again
+      with diff opts
+    - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+      reseal tests
+    - many: implement snap routine console-conf-start for synchronizing
+      auto-refreshes
+    - dirs, boot: add ubuntu-save directories and related locations
+    - usersession: fix typo in test name
+    - overlord/snapstate: refactor ihibitRefresh
+    - overlord/snapstate: stop warning about inhibited refreshes
+    - cmd/snap: do not hardcode snapshot age value
+    - overlord,usersession: initial notifications of pending refreshes
+    - tests: add a unit test for UpdateMany where a single snap fails
+    - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+      mode uc20
+    - tests: also check snapst.Current in undo-unlink tests
+    - tests: new nested tool
+    - o/snapstate: implement undo handler for unlink-snap
+    - tests: clean systems.sh helper and migrate last set of tests
+    - tests: moving the lib section from systems.sh helper to os.query
+      tool
+    - tests/uc20-create-partitions: don't check for grub.cfg
+    - packaging: make sure that static binaries are indeed static, fix
+      openSUSE
+    - many: have install return encryption keys for data and save,
+      improve tests
+    - overlord: add link participant for linkage transitions
+    - tests: lxd smoke test
+    - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+      seed too
+    - tests: moving main suite from systems.sh to os.query tool
+    - tests: moving the core test suite from systems.sh to os.query tool
+    - cmd/snap-confine: mask host's apparmor config
+    - o/snapstate: move setting updated SnapState after error paths
+    - tests: add value to INSTANCE_KEY/regular
+    - spread, tests: tweaks for openSUSE
+    - cmd/snap-confine: update path to snap-device-helper in AppArmor
+      profile
+    - tests: new os.query tool
+    - overlord/snapshotstate/backend: specify tar format for snapshots
+    - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+      UC20
+    - client,daemon,snap: auto-import does not error on managed devices
+    - interfaces: PTP hardware clock interface
+    - tests: use tests.backup tool
+    - many: verify that unit tests work with nosecboot tag and without
+      secboot package
+    - wrappers: do not error out on read-only /etc/dbus-1/session.d
+      filesystem on core18
+    - snapshots: import of a snapshot set
+    - tests: more output for sbuild test
+    - o/snapstate: re-order remove tasks for individual snap revisions
+      to remove current last
+    - boot: skip some unit tests when running as root
+    - o/assertstate: introduce
+      ValidationTrackingKey/ValidationSetTracking and basic methods
+    - many: allow ignoring running apps for specific request
+    - tests: allow the searching test to fail under load
+    - overlord/snapstate: inhibit startup while unlinked
+    - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+      features
+    - tests/main/sudo-env: snap bin is available on Fedora
+    - boot, overlord/devicestate: list trusted and managed assets
+      upfront
+    - gadget, gadget/install: support for ubuntu-save, create one during
+      install if needed
+    - spread-shellcheck: temporary workaround for deadlock, drop
+      unnecessary test
+    - snap: support different exit-code in the snap command
+    - logger: use strutil.KernelCommandLineSplit in
+      debugEnabledOnKernelCmdline
+    - logger: fix snapd.debug=1 parsing
+    - overlord: increase refresh postpone limit to 14 days
+    - spread-shellcheck: use single thread pool executor
+    - gadget/install,secboot: add debug messages
+    - spread-shellcheck: speed up spread-shellcheck even more
+    - spread-shellcheck: process paths from arguments in parallel
+    - tests: tweak error from tests.cleanup
+    - spread: remove workaround for openSUSE go issue
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - tests: new tests.backup tool
+    - tests: add tests.cleanup pop sub-command
+    - tests: migration of the main suite to snaps-state tool part 6
+    - tests: fix journal-state test
+    - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+      recover files
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - boot, gadget, bootloader: observer preserves managed bootloader
+      configs
+    - tests/nested/manual: add uc20 grade signed cloud-init test
+    - o/snapstate/autorefresh.go: eliminate race when launching
+      autorefresh
+    - daemon,snapshotstate: do not return "size" from Import()
+    - daemon: limit reading from snapshot import to Content-Length
+    - many: set/expect Content-Length header when importing snapshots
+    - github: switch from ::set-env command to environment file
+    - tests: migration of the main suite to snaps-state tool part 5
+    - client: cleanup the Client.raw* and Client.do* method families
+    - tests: moving main suite to snaps-state tool part 4
+    - client,daemon,snap: use constant for snapshot content-type
+    - many: fix typos and repeated "the"
+    - secboot: fix tpm connection leak when it's not enabled
+    - many: scaffolding for snapshots import API
+    - run-checks: run spread-shellcheck too
+    - interfaces: update network-manager interface to allow
+      ObjectManager access from unconfined clients
+    - tests: move core and regression suites to snaps-state tool
+    - tests: moving interfaces tests to snaps-state tool
+    - gadget: preserve files when indicated by content change observer
+    - tests: moving smoke test suite and some tests from main suite to
+      snaps-state tool
+    - o/snapshotstate: pass set id to backend.Open, update tests
+    - asserts/snapasserts: introduce ValidationSets
+    - o/snapshotstate: improve allocation of new set IDs
+    - boot: look at the gadget for run mode bootloader when making the
+      system bootable
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - usersession/userd: separate bus name ownership from defining
+      interfaces
+    - o/snapshotstate: set snapshot set id from its filename
+    - o/snapstate: move remove-related tests to snapstate_remove_test.go
+    - desktop/notification: switch ExpireTimeout to time.Duration
+    - desktop/notification: add unit tests
+    - snap: snap help output refresh
+    - tests/nested/manual/preseed: include a system-usernames snap when
+      preseeding
+    - tests: fix sudo-env test
+    - tests: fix nested core20 shellcheck bug
+    - tests/lib: move to new directory when restoring PWD, cleanup
+      unpacked unpacked snap directories
+    - desktop/notification: add bindings for FDO notifications
+    - dbustest: fix stale comment references
+    - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+      drop former
+    - snap-repair: add uc20 support
+    - tests: print all the serial logs for the nested test
+    - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+      bug in test
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+      as Unknown*
+    - asserts: deserialize grouping only once in Pool.AddBatch if needed
+    - gadget: allow content observer to have opinions about a change
+    - tests: new snaps-state command - part1
+    - o/assertstate: support refreshing any number of snap-declarations
+    - boot: use test helpers
+    - tests/core/snap-debug-bootvars: also check snap_mode
+    - many/apparmor: adjust rules for reading profile/ execing new
+      profiles for new kernel
+    - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+      vars
+    - tests/lib/nested.sh: more little tweaks
+    - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - overlord: explicitly set refresh-app-awareness in tests
+    - kernel: remove "edition" from kernel.yaml and add "update"
+    - spread: drop vendor from the packed project archive
+    - boot: fix debug bootloader variables dump on UC20 systems
+    - wrappers, systemd: allow empty root dir and conditionally do not
+      pass --root to systemctl
+    - tests/nested/manual: add test for grades above signed booting with
+      testkeys
+    - tests/nested: misc robustness fixes
+    - o/assertstate,asserts: use bulk refresh to refresh snap-
+      declarations
+    - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+      been updated now
+    - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+    - update-pot: ignore .go files inside .git when running xgettext-go
+    - tests: disable part of the lxd test completely on 16.04.
+    - o/snapshotstate: tweak comment regarding snapshot filename
+    - o/snapstate: improve snapshot iteration
+    - bootloader: lk cleanups
+    - tests: update to support nested kvm without reboots on UC20
+    - tests/nested/manual/preseed: disable system-key check for 20.04
+      image
+    - spread.yaml: add ubuntu-20.10-64 to qemu
+    - store: handle v2 error when fetching assertions
+    - gadget: resolve device mapper devices for fallback device lookup
+    - tests/nested/cloud-init-many: simplify tests and unify
+      helpers/seed inputs
+    - tests: copy /usr/lib/snapd/info to correct directory
+    - check-pr-title.py * : allow "*" in the first part of the title
+    - many: typos and small test tweak
+    - tests/main/lxd: disable cgroup combination for 16.04 that is
+      failing a lot
+    - tests: make nested signing helpers less confusing
+    - tests: misc nested changes
+    - tests/nested/manual/refresh-revert-fundamentals: disable
+      temporarily
+    - tests/lib/cla_check: default to Python 3, tweaks, formatting
+    - tests/lib/cl_check.py: use python3 compatible code
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 Nov 2020 17:51:02 +0100
+
+snapd (2.47.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - snap: snap help output refresh
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 08 Oct 2020 09:30:44 +0200
+
+snapd (2.47) xenial; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - tests: fix nested core20 shellcheck bug
+    - many/apparmor: adjust rule for reading apparmor profile for new
+      kernel
+    - snap-repair: add uc20 support
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - gadget: resolve device mapper devices for fallback device lookup
+    - secboot: add boot manager profile to pcr protection profile
+    - sysconfig,o/devicestate: mv DisableNoCloud to
+      DisableAfterLocalDatasourcesRun
+    - tests: make gadget-reseal more robust
+    - tests: skip nested images pre-configuration by default
+    - tests: fix for basic20 test running on external backend and rpi
+    - tests: improve kernel reseal test
+    - boot: adjust comments, naming, log success around reseal
+    - tests/nested, fakestore: changes necessary to run nested uc20
+      signed/secured tests
+    - tests: add nested core20 gadget reseal test
+    - boot/modeenv: track unknown keys in Read and put back into modeenv
+      during Write
+    - interfaces/process-control: add sched_setattr to seccomp
+    - boot: with unasserted kernels reseal if there's a hint modeenv
+      changed
+    - client: bump the default request timeout to 120s
+    - configcore: do not error in console-conf.disable for install mode
+    - boot: streamline bootstate20.go reseal and tests changes
+    - boot: reseal when changing kernel
+    - cmd/snap/model: specify grade in the model command output
+    - tests: simplify
+      repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+    - test: improve logging in nested tests
+    - nested: add support to telnet to serial port in nested VM
+    - secboot: use the snapcore/secboot native recovery key type
+    - tests/lib/nested.sh: use more focused cloud-init config for uc20
+    - tests/lib/nested.sh: wait for the tpm socket to exist
+    - spread.yaml, tests/nested: misc changes
+    - tests: add more checks to disk space awareness spread test
+    - tests: disk space awareness spread test
+    - boot: make MockUC20Device use a model and MockDevice more
+      realistic
+    - boot,many: reseal only when meaningful and necessary
+    - tests/nested/core20/kernel-failover: add test for failed refresh
+      of uc20 kernel
+    - tests: fix nested to work with qemu and kvm
+    - boot: reseal when updating boot assets
+    - tests: fix snap-routime-portal-info test
+    - boot: verify boot chain file in seal and reseal tests
+    - tests: use full path to test-snapd-refresh.version binary
+    - boot: store boot chains during install, helper for checking
+      whether reseal is needed
+    - boot: add call to reseal an existing key
+    - boot: consider boot chains with unrevisioned kernels incomparable
+    - overlord: assorted typos and miscellaneous changes
+    - boot: group SealKeyModelParams by model, improve testing
+    - secboot: adjust parameters to buildPCRProtectionProfile
+    - strutil: add SortedListsUniqueMergefrom the doc comment:
+    - snap/naming: upgrade TODO to TODO:UC20
+    - secboot: add call to reseal an existing key
+    - boot: in seal.go adjust error message and function names
+    - o/snapstate: check available disk space in RemoveMany
+    - boot: build bootchains data for sealing
+    - tests: remove "set -e" from function only shell libs
+    - o/snapstate: disk space check on UpdateMany
+    - o/snapstate: disk space check with snap update
+    - snap: implement new `snap reboot` command
+    - boot: do not reorder boot assets when generating predictable boot
+      chains and other small tweaks
+    - tests: some fixes and improvements for nested execution
+    - tests/core/uc20-recovery: fix check for at least specific calls to
+      mock-shutdown
+    - boot: be consistent using bootloader.Role* consts instead of
+      strings
+    - boot: helper for generating secboot load chains from a given boot
+      asset sequence
+    - boot: tweak boot chains to support a list of kernel command lines,
+      keep track of model and kernel boot file
+    - boot,secboot: switch to expose and use snapcore/secboot load event
+      trees
+    - tests: use `nested_exec` in core{20,}-early-config test
+    - devicestate: enable cloud-init on uc20 for grade signed and
+      secured
+    - boot: add "rootdir" to baseBootenvSuite and use in tests
+    - tests/lib/cla_check.py: don't allow users.noreply.github.com
+      commits to pass CLA
+    - boot: represent boot chains, helpers for marshalling and
+      equivalence checks
+    - boot: mark successful with boot assets
+    - client, api: handle insufficient space error
+    - o/snapstate: disk space check with single snap install
+    - configcore: "service.console-conf.disable" is gadget defaults only
+    - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+      AppArmor profile path
+    - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+    - packaging/debian-sid: tweak code preparing _build tree
+    - many: move seal code from gadget/install to boot
+    - tests: remove workaround for cups on ubuntu-20.10
+    - client: implement RebootToSystem
+    - many: seed.Model panics now if called before LoadAssertions
+    - daemon: add /v2/systems "reboot" action API
+    - github: run tests also on push to release branches
+    - interfaces/bluez: let slot access audio streams
+    - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+      new seed.ReadSystemEssential
+    - interfaces: allow snap-update-ns to read /proc/cmdline
+    - tests: new organization for nested tests
+    - o/snapstate, features: add feature flags for disk space awareness
+    - tests: workaround for cups issue on 20.10 where default printer is
+      not configured.
+    - interfaces: update cups-control and add cups for providing snaps
+    - boot: keep track of the original asset when observing updates
+    - tests: simplify and fix tests for disk space checks on snap remove
+    - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+      cloud.conf
+    - tests/main: mv core specific tests to core suite
+    - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+    - devicestate: rename "mockLogger" to "logbuf"
+    - many: introduce ContentChange for tracking gadget content in
+      observers
+    - many: fix partion vs partition typo
+    - bootloader: retrieve boot chains from bootloader
+    - devicestate: add tests around logging in RequestSystemAction
+    - boot: handle canceled update
+    - bootloader: tweak doc comments (thanks Samuele)
+    - seed/seedwriter: test local asserted snaps with UC20 grade signed
+    - sysconfig/cloudinit.go: add DisableNoCloud to
+      CloudInitRestrictOptions
+    - many: use BootFile type in load sequences
+    - boot,bootloader: clarifications after the changes to introduce
+      bootloader.Options.Role
+    - boot,bootloader,gadget: apply new bootloader.Options.Role
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - testutil: add checkers for symbolic link target
+    - many: refactor tpm seal parameter setting
+    - boot/bootstate20: reboot to rollback to previous kernel
+    - boot: add unit test helpers
+    - boot: observe update & rollback of trusted assets
+    - interfaces/utf: Add MIRKey to u2f devices
+    - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+      cloud-init tests
+    - many: check that users of BaseTest don't forget to consume
+      cleanups
+    - tests/nested/core20/tpm: verify trusted boot assets tracking
+    - github: run macOS job with Go 1.14
+    - many: misc doc-comment changes and typo fixes
+    - o/snapstate: disk space check with InstallMany
+    - many: cloud-init cleanups from previous PR's
+    - tests: running tests on opensuse leap 15.2
+    - run-checks: check for dirty build tree too
+    - vendor: run ./get-deps.sh to update the secboot hash
+    - tests: update listing test for "-dirty" versions
+    - overlord/devicestate: do not release the state lock when updating
+      gadget assets
+    - secboot: read kernel efi image from snap file
+    - snap: add size to the random access file return interface
+    - daemon: correctly parse Content-Type HTTP header.
+    - tests: account for apt-get on core18
+    - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+      loop
+    - mkversion.sh: simple hack to include dirty in version if the tree
+      is dirty
+    - cgroup,snap: track hooks on system bus only
+    - interfaces/systemd: compare dereferenced Service
+    - run-checks: only check files in git for misspelling
+    - osutil: add a package doc comment (via doc.go)
+    - boot: complain about reused asset name during initial install
+    - snapstate: installSize helper that calculates total size of snaps
+      and their prerequisites
+    - snapshots: export of snapshots
+    - boot/initramfs_test.go: reset boot vars on the bootloader for each
+      iteration
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Sep 2020 17:19:13 +0200
+
+snapd (2.46.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - interfaces: allow snap-update-ns to read
+      /proc/cmdline
+    - github: run macOS job with Go 1.14
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - tests: account for apt-get on core18
+    - mkversion.sh: include dirty in version if the tree
+      is dirty
+    - interfaces/systemd: compare dereferenced Service
+    - vendor.json: update mysterious secboot SHA again
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Sep 2020 17:42:54 +0200
+
+snapd (2.46) xenial; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - logger: add support for setting snapd.debug=1 on kernel cmdline
+    - o/snapstate: check disk space before creating automatic snapshot
+      on remove
+    - boot, o/devicestate: observe existing recovery bootloader trusted
+      boot assets
+    - many: use transient scope for tracking apps and hooks
+    - features: add HiddenSnapFolder feature flag
+    - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+      too
+    - runinhibit: open the lock file in read-only mode in IsLocked
+    - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+      automatic
+    - tests: update spread test for unknown plug/slot with snapctl is-
+      connected
+    - osutil: add OpenExistingLockForReading
+    - kernel: add kernel.Validate()
+    - interfaces: add vcio interface
+    - interfaces/{docker,kubernetes}-support: load overlay and support
+      systemd cgroup driver
+    - tests/lib/nested.sh: use more robust code for finding what loop
+      dev we mounted
+    - cmd/snap-update-ns: detach all bind-mounted file
+    - snap/snapenv: set SNAP_REAL_HOME
+    - packaging: umount /snap on purge in containers
+    - interfaces: misc policy updates xlvi
+    - secboot,cmd/snap-bootstrap: cross-check partitions before
+      unlocking, mounting
+    - boot: copy boot assets cache to new root
+    - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+    - o/hookstate/ctlcmd: make is-connected check whether the plug or
+      slot exists
+    - tests: find -ignore_readdir_race when scanning cgroups
+    - interfaces/many: deny arbitrary desktop files and misc from
+      /usr/share
+    - tests: use "set -ex" in prep-snapd-in-lxd.sh
+    - tests: re-enable udisks test on debian-sid
+    - cmd/snapd-generator: use PATH fallback if PATH is not set
+    - tests: disable udisks2 test on arch linux
+    - github: use latest/stable go, not latest/edge
+    - tests: remove support for ubuntu 19.10 from spread tests
+    - tests: fix lxd test wrongly tracking 'latest'
+    - secboot: document exported functions
+    - cmd: compile snap gdbserver shim correctly
+    - many: correctly calculate the desktop file prefix everywhere
+    - interfaces: add kernel-crypto-api interface
+    - corecfg: add "system.timezone" setting to the system settings
+    - cmd/snapd-generator: generate drop-in to use fuse in container
+    - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+      from previous PR
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+    - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+      the-tool
+    - tests: work around broken update of systemd-networkd
+    - tests/main/install-fontconfig-cache-gen: enhance test by
+      verifying, add fonts to test
+    - o/devicestate: wrap asset update observer error
+    - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+    - mkversion.sh: disallow changelog versions that have git in it, if
+      we also have git version
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - snap: fix repeated "cannot list recovery system" and add test
+    - boot: track trusted assets during initial install, assets cache
+    - vendor: update secboot to fix key data validation
+    - tests: unmount FUSE file-systems from XDG runtime dir
+    - overlord/devicestate: workaround non-nil interface with nil struct
+    - sandbox/cgroup: remove temporary workaround for multiple cgroup
+      writers
+    - sandbox/cgroup: detect dangling v2 cgroup
+    - bootloader: add helper for creating a bootloader based on gadget
+    - tests: support different images on nested execution
+    - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+    - packaging/arch: use external linker when building statically
+    - tests: cope with ghost cgroupv2
+    - tests: fix issues related to restarting systemd-logind.service
+    - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+      gadget updates
+    - vendor: update github.com/kr/pretty to fix diffs of values with
+      pointer cycles
+    - boot: move bootloaderKernelState20 impls to separate file
+    - .github/workflows: move snap building to test.yaml as separate
+      cached job
+    - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+      meeting minimal requirements
+    - osutil: add CommitAs to atomic file
+    - gadget: introduce content update observer
+    - bootloader: introduce TrustedAssetsBootloader, implement for grub
+    - o/snapshotstate: helpers for calculating disk space needed for an
+      automatic snapshot
+    - gadget/install: retrieve command lines from bootloader
+    - boot/bootstate20: unify commit method impls, rm
+      bootState20MarkSuccessful
+    - tests: add system information and image information when debug
+      info is displayed
+    - tests/main/cgroup-tracking: try to collect some information about
+      cgroups
+    - boot: introduce current_boot_assets and
+      current_recovery_boot_assets to modeenv
+    - tests: fix for timing issues on journal-state test
+    - many: remove usage and creation of hijacked pid cgroup
+    - tests: port regression-home-snap-root-owned to tests.session
+    - tests: run as hightest via tests.session
+    - github: run CLA checks on self-hosted workers
+    - github: remove Ubuntu 19.10 from actions workflow
+    - tests: remove End-Of-Life opensuse/fedora releases
+    - tests: remove End-Of-Life releases from spread.yaml
+    - tests: fix debug section of appstream-id test
+    - interfaces: check !b.preseed earlier
+    - tests: work around bug in systemd/debian
+    - boot: add deepEqual, Copy helpers for Modeenv to simplify
+      bootstate20 refactor
+    - cmd: add new "snap recovery" command
+    - interfaces/systemd: use emulation mode when preseeding
+    - interfaces/kmod: don't load kernel modules in kmod backend when
+      preseeding
+    - interfaces/udev: do not reload udevadm rules when preseeding
+    - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+    - boot: fancy marshaller for modeenv values
+    - gadget, osutil: use atomic file copy, adjust tests
+    - overlord: use new tracking cgroup for refresh app awareness
+    - github: do not skip gofmt with Go 1.9/1.10
+    - many: introduce content write observer, install mode glue, initial
+      seal stubs
+    - daemon,many: switch to use client.ErrorKind and drop the local
+      errorKind...
+    - tests: new parameters for nested execution
+    - client: move all error kinds into errors.go and add doc strings
+    - cmd/snap: display the error in snap debug seeding if seeding is in
+      error
+    - cmd/snap/debug/seeding: use unicode for proper yaml
+    - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+      recovery_mode
+    - osutil/disks: add mock disk and tests for happy path of mock disks
+    - tests: refresh/revert snapd in uc20
+    - osutil/disks: use a dedicated error to indicate a fs label wasn't
+      found
+    - interfaces/system-key: in WriteSystemKey during tests, don't call
+      ParserFeatures
+    - boot: add current recovery systems to modeenv
+    - bootloader: extend managed assets bootloader interface to compose
+      a candidate command line
+    - interfaces: make the unmarshal test match more the comment
+    - daemon/api: use pointers to time.Time for debug seeding aspect
+    - o/ifacestate: update security profiles in connect undo handler
+    - interfaces: add uinput interface
+    - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+      tests
+    - o/devicestate: save seeding/preseeding times for use with debug
+      seeding api
+    - cmd/snap/debug: add "snap debug seeding" command for preseeding
+      debugging
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+    - bootloader: compose command line with mode and extra arguments
+    - cmd/snap, daemon: detect and bail purge on multi-snap
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - interfaces/builtin/multipass: replace U+00A0 no-break space with
+      simple space
+    - bootloader/assets: generate bootloader assets from files
+    - many/tests/preseed: reset the preseeded images before preseeding
+      them
+    - tests: drop accidental accents from e
+    - secboot: improve key sealing tests
+    - tests: replace _wait_for_file_change with retry
+    - tests: new fs-state which replaces the files.sh helper
+    - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+      from path
+    - cmd/snap: track started apps and hooks
+    - tests/main/interfaces-pulseaudio: disable start limit checking for
+      pulseaudio service
+    - api: seeding debug api
+    - .github/workflows/snap-build.yaml: build the snapd snap via GH
+      Actions too
+    - tests: moving journalctl.sh to a new journal-state tool
+    - tests/nested/manual: add spread tests for cloud-init vuln
+    - bootloader/assets: helpers for registering per-edition snippets,
+      register snippets for grub
+    - data,packaging,wrappers: extend D-Bus service activation search
+      path
+    - spread: add opensuse 15.2 and tumbleweed for qemu
+    - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+    - sysconfig/cloudinit: add RestrictCloudInit
+    - cmd/snap-preseed: check that target path exists and is a directory
+      on --reset
+    - tests: check for pids correctly
+    - gadget,gadget/install: refactor partition table update
+    - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+      type
+    - interface/fwupd: add more policies for making fwupd upstream
+      strict
+    - tests: new to-one-line tool which replaces the strings.sh helper
+    - interfaces: new helpers to get and compare system key, for use
+      with seeding debug api
+    - osutil, many: add helper for checking whether the process is a go
+      test binary
+    - cmd/snap-seccomp/syscalls: add faccessat2
+    - tests: adjust xdg-open after launcher changes
+    - tests: new core config helper
+    - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+      open
+    - cmd/snap-preseed: handle relative chroot path
+    - snapshotstate: move sizer to osutil.Sizer()
+    - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+      kernel tests
+    - gadget/install,secboot: use snapcore/secboot luks2 api
+    - boot/initramfs_test.go: add Commentf to more Assert()'s
+    - tests/lib: account for changes in arch package file name extension
+    - bootloader/bootloadertest: fix comment typo
+    - bootloader: add helper for getting recovery system environment
+      variables
+    - tests: preinstall shellcheck and run tests on focal
+    - strutil: add a helper for parsing kernel command line
+    - osutil: add CheckFreeSpace helper
+    - secboot: update tpm connection error handling
+    - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+    - tests: add tests.cleanup helper
+    - packaging: add "ca-certificates" to build-depends
+    - tests: more checks in core20 early config spread test
+    - tests: fix some snapstate tests to use pointers for
+      snapmgrTestSuite
+    - boot: better naming of helpers for obtaining kernel command line
+    - many: use more specific check for unit test mocking
+    - systemd/escape: fix issues with "" and "\t" handling
+    - asserts: small improvements and corrections for sequence-forming
+      assertions' support
+    - boot, bootloader: query kernel command line of run mod and
+      recovery mode systems
+    - snap/validate.go: disallow snap layouts with new top-level
+      directories
+    - tests: allow to add a new label to run nested tests as part of PR
+      validation
+    - tests/core/gadget-update-pc: port to UC20
+    - tests: improve nested tests flexibility
+    - asserts: integer headers: disallow prefix zeros and make parsing
+      more uniform
+    - asserts: implement Database.FindSequence
+    - asserts: introduce SequenceMemberAfter in the asserts backstores
+    - spread.yaml: remove tests/lib/tools from PATH
+    - overlord: refuse to install snaps whose activatable D-Bus services
+      conflict with installed snaps
+    - tests: shorten lxd-state undo-mount-changes
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - tests: fix argument handling of apt-state
+    - tests: rename lxd-tool to lxd-state
+    - tests: rename user-tool to user-state, fix --help
+    - interfaces: add gconf interface
+    - sandbox/cgroup: avoid parsing security tags twice
+    - tests: rename version-tool to version-compare
+    - cmd/snap-update-ns: handle anomalies better
+    - tests: fix call to apt.Package.mark_install(auto_inst=True)
+    - tests: rename mountinfo-tool to mountinfo.query
+    - tests: rename memory-tool to memory-observe-do
+    - tests: rename invariant-tool to tests.invariant
+    - tests: rename apt-tool to apt-state
+    - many: managed boot config during run mode setup
+    - asserts: introduce the concept of sequence-forming assertion types
+    - tests: tweak comments/output in uc20-recovery test
+    - tests/lib/pkgdb: do not use quiet when purging debs
+    - interfaces/apparmor: allow snap-specific /run/lock
+    - interfaces: add system-source-code for access to /usr/src
+    - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+    - gadget/install: move udev trigger to gadget/install
+    - many: make nested spread tests more reliable
+    - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+      w/ external backend
+    - tests: enable tests on uc20 which now work with the real model
+      assertion
+    - tests: enable system-snap-refresh test on uc20
+    - gadget, bootloader: preserve managed boot assets during gadget
+      updates
+    - tests: fix leaked dbus-daemon in selinux-clean
+    - tests: add servicestate.Control tests
+    - tests: fix "restart.service"
+    - wrappers: helper for enabling services - extract and move enabling
+      of services into a helper
+    - tests: new test to validate refresh and revert of kernel and
+      gadget on uc20
+    - tests/lib/prepare-restore: collect debug info when prepare purge
+      fails
+    - bootloader: allow managed bootloader to update its boot config
+    - tests: Remove unity test from nightly test suite
+    - o/devicestate: set mark-seeded to done in the task itself
+    - tests: add spread test for disconnect undo caused by failing
+      disconnect hook
+    - sandbox/cgroup: allow discovering PIDs of given snap
+    - osutil/disks: support IsDecryptedDevice for mountpoints which are
+      dm devices
+    - osutil: detect autofs mounted in /home
+    - spread.yaml: allow amazon-linux-2-64 qemu with
+      ec2-user/ec2-user
+    - usersession: support additional zoom URL schemes
+    - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+    - sandbox/cgroup: add tracking helpers
+    - tests: detect stray dbus-daemon
+    - overlord: refuse to install snaps providing user daemons on Ubuntu
+      14.04
+    - many: move encryption and installer from snap-boostrap to gadget
+    - o/ifacestate: fix connect undo handler
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - bootloader: introduce managed bootloader, implement for grub
+    - tests: fix incorrect check in smoke/remove test
+    - asserts,seed: split handling of essential/not essential model
+      snaps
+    - gadget: fix typo in mounted filesystem updater
+    - gadget: do only one mount point lookup in mounted fs updater
+    - tests/core/snap-auto-mount: try to make the test more robust
+    - tests: adding ubuntu-20.04 to google-sru backend
+    - o/servicestate: add updateSnapstateServices helper
+    - bootloader: pull recovery grub config from internal assets
+    - tests/lib/tools: apply linger workaround when needed
+    - overlord/snapstate: graceful handling of denied "managed" refresh
+      schedule
+    - snapstate: fix autorefresh from classic->strict
+    - overlord/configstate: add system.kernel.printk.console-loglevel
+      option
+    - tests: fix assertion disk handling for nested UC systems
+    - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+    - tests: extra worker for google-nested backend to avoid timeout
+      error on uc20
+    - snapdtool: helper to check whether the current binary is reexeced
+      from a snap
+    - tests: mock servicestate in api tests to avoid systemctl checks
+    - many: rename back snap.Info.GetType to Type
+    - tests/lib/cla_check: expect explicit commit range
+    - osutil/disks: refactor diskFromMountPointImpl a bit
+    - o/snapstate: service-control task handler
+    - osutil: add disks pkg for associating mountpoints with
+      disks/partitions
+    - gadget,cmd/snap-bootstrap: move partitioning to gadget
+    - seed: fix LoadEssentialMeta when gadget is not loaded
+    - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+      secure_path
+    - asserts: introduce new assertion validation-set
+    - asserts,daemon: add support for "serials" field in system-user
+      assertion
+    - data/sudo: drop a failed sudo secure_path workaround
+    - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+    - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+    - spread.yaml: update secure boot attribute name
+    - interfaces/block_devices: add NVMe subsystem devices, support
+      multipath paths
+    - tests: use the "jq" snap from the edge channel
+    - tests: simplify the tpm test by removing the test-snapd-mokutil
+      snap
+    - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+      status too
+    - tests/main/sudo-env: check snap path under sudo
+    - tests/main/lxd: add test for snaps inside nested lxd containers
+      not working
+    - asserts/internal: expand errors about invalid serialized grouping
+      labels
+    - usersession/userd: add msteams url support
+    - tests/lib/prepare.sh: adjust comment about sgdisk
+    - tests: fix how gadget pc is detected when the snap does not exist
+      and ls fails
+    - tests: move a few more tests to snapstate_update_test.go
+    - tests/main: add spread test for running svc from install hook
+    - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+    - tests/special-home-can-run-classic-snaps: re-enable
+    - workflow: test PR title as part of the static checks again
+    - tests/main/xdg-open-compat: backup and restore original xdg-open
+    - tests: move update-related tests to snapstate_update_test.go
+    - cmd,many: move Version and bits related to snapd tools to
+      snapdtool, merge cmdutil
+    - tests/prepare-restore.sh: reset-failed systemd-journald before
+      restarting
+    - interfaces: misc small interface updates
+    - spread: use find rather than recursive ls, skip mounted snaps
+    - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+      /var/lib/snapd
+    - tests: enable snap-auto-mount test on core20
+    - cmd/snap: do not show $PATH warning when executing under sudo on a
+      known distro
+    - asserts/internal: add some iteration benchmarks
+    - sandbox/cgroup: improve pid parsing code
+    - snap: add new `snap run --experimental-gdbserver` option
+    - asserts/internal: limit Grouping size switching to a bitset
+      representationWe don't always use the bit-set representation
+      because:
+    - snap: add an activates-on property to apps for D-Bus activation
+    - dirs: delete unused Cloud var, fix typo
+    - sysconfig/cloudinit: make callers of DisableCloudInit use
+      WritableDefaultsDir
+    - tests: fix classic ubuntu core transition auth
+    - tests: fail in setup_reflash_magic() if there is snapd state left
+    - tests: port interfaces-many-core-provided to tests.session
+    - tests: wait after creating partitions with sfdisk
+    - bootloader: introduce bootloarder assets, import grub.cfg with an
+      edition marker
+    - riscv64: bump timeouts
+    - gadget: drop dead code, hide exports that are not used externally
+    - tests: port 2 uc20 part1
+    - tests: fix bug waiting for snap command to be ready
+    - tests: move try-related tests to snapstate_try_test.go
+    - tests: add debug for 20.04 prepare failure
+    - travis.yml: removed, all our checks run in GH actions now
+    - tests: clean up up the use of configcoreSuite in the configcore
+      tests
+    - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+    - sandbox/cgroup: add tests for ParsePids
+    - tests: fix the basic20 test for uc20 on external backend
+    - tests: use configcoreSuite in journalSuite and remove some
+      duplicated code
+    - tests: move a few more tests to snapstate_install_test
+    - tests: assorted small patches
+    - dbusutil/dbustest: separate license from package
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+    - tests: check that host settings like hostname are settable on core
+    - tests: port xdg-settings test to tests.session
+    - tests: port snap-handle-link test to tests.session
+    - arch: add riscv64
+    - tests: core20 early defaults spread test
+    - tests: move install tests from snapstate_test.go to
+      snapstate_install_test.go
+    - github: port macOS sanity checks from travis
+    - data/selinux: allow checking /var/cache/app-info
+    - o/devicestate: core20 early config from gadget defaults
+    - tests: autoremove after removing lxd in preseed-lxd test
+    - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+    - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+    - tests: update the file used to detect the boot path on uc20
+    - spread.yaml: show /var/lib/snapd in debug
+    - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+      netplan files
+    - snap/naming: add helpers to parse app and hook security tags
+    - tests: modernize retry tool
+    - tests: fix and trim debug section in xdg-open-portal
+    - tests: modernize and use snapd.tool
+    - vendor: update to latest github.com/snapcore/bolt for riscv64
+    - cmd/snap-confine: add support for libc6-lse
+    - interfaces: miscellaneous policy updates xlv
+    - interfaces/system-packages-doc: fix typo in variable names
+    - tests: port interfaces-calendar-service to tests.session
+    - tests: install/run the lzo test snap too
+    - snap: (small) refactor of `snap download` code for
+      testing/extending
+    - data: fix shellcheck warnings in snapd.sh.in
+    - packaging: disable buildmode=pie for riscv64
+    - tests: install test-snapd-rsync snap from edge channel
+    - tests: modernize tests.session and port everything using it
+    - tests: add ubuntu 20.10 to spread tests
+    - cmd/snap/remove: mention snap restore/automatic snapshots
+    - dbusutil: move all D-Bus helpers and D-Bus test helpers
+    - wrappers: pass 'disable' flag to StopServices wrapper
+    - osutil: enable riscv64 build
+    - snap/naming: add ParseSecurityTag and friends
+    - tests: port document-portal-activation to session-tool
+    - bootloader: rename test helpers to reflect we are mocking EFI boot
+      locations
+    - tests: disable test of nfs v3 with udp proto on debian-sid
+    - tests: plan to improve the naming and uniformity of utilities
+    - tests: move *-tool tests to their own suite
+    - snap-bootstrap: remove sealed key file on reinstall
+    - bootloader/ubootenv: don't panic with an empty uboot env
+    - systemd: rename actualFsTypeAndMountOptions to
+      hostFsTypeAndMountOptions
+    - daemon: fix filtering of service-control changes for snap.app
+    - tests: spread test for preseeding in lxd container
+    - tests: fix broken snapd.session agent.socket
+    - wrappers: add RestartServices function and ReloadOrRestart to
+      systemd
+    - o/cmdstate: handle ignore flag on exec-command tasks
+    - gadget: make ext4 filesystems with or without metadata checksum
+    - tests: update statx test to run on all LTS releases
+    - configcore: show better error when disabling services
+    - interfaces: add hugepages-control
+    - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+    - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+    - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+    - tests: reload systemd --user for root, if present
+    - tests: reload systemd after editing /etc/fstab
+    - tests: add missing dependencies needed for sbuild test on debian
+    - tests: reload systemd after removing pulseaudio
+    - image, tests: core18 early config.
+    - interfaces: add system-packages-doc interface
+    - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+      preseeding
+    - interfaces/fwupd: allow bind mount to /boot on core
+    - tests: improve oom-vitality tests
+    - tests: add fedora 32 to spread.yaml
+    - config: apply vitality-hint immediately when the config changes
+    - tests: port snap-routine-portal-info to session-tool
+    - configcore: add "service.console-conf.disable" config option
+    - tests: port xdg-open to session-tool
+    - tests: port xdg-open-compat to session-tool
+    - tests: port interfaces-desktop-* to session-tool
+    - spread.yaml: apply yaml formatter/linter
+    - tests: port interfaces-wayland to session-tool
+    - o/devicestate: refactor current system handling
+    - snap-mgmt: perform cleanup of user services
+    - snap/snapfile,squashfs: followups from 8729
+    - boot, many: require mode in modeenv
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests: log stderr from dbus-monitor
+    - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+      tag
+    - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+      layout
+    - interfaces/builtin/desktop: do not mount fonts cache on distros
+      with quirks
+    - data/selinux: allow snapd to remove/create the its socket
+    - testutil/exec.go: set PATH after running shellcheck
+    - tests: silence stderr from dbus-monitor
+    - snap,many: mv Open to snapfile pkg to support add'l options to
+      Container methods
+    - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+      gadget
+    - github: remove workaround for bug 133 in actions/cache
+    - tests: remove dbus.sh
+    - cmd/snap-preseed: improve mountpoint checks of the preseeded
+      chroot
+    - spread.yaml: add ps aux to debug section
+    - github: run all spread systems in a single go with cached results
+    - test: session-tool cli tweaks
+    - asserts: rest of the Pool API
+    - tests: port interfaces-network-status-classic to session-tool
+    - packaging: remove obsolete 16.10,17.04 symlinks
+    - tests: setup portals before starting user session
+    - o/devicestate: typo fix
+    - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+      devices
+    - cmd/snap/model: support store, system-user-authority keys in
+      --verbose
+    - o/devicestate: raise conflict when requesting system action while
+      seeding
+    - tests: detect signs of crashed snap-confine
+    - tests: sign kernel and gadget to run nested tests using current
+      snapd code
+    - tests: remove gnome-online-accounts we install
+    - tests: fix the issue where all the tests were executed on secboot
+      system
+    - tests: port interfaces-accounts-service to session-tool
+    - interfaces/network-control: bring /var/lib/dhcp from host
+    - image,cmd/snap,tests: add support for store-wide cohort keys
+    - configcore: add nomanagers buildtag for conditional build
+    - tests: port interfaces-password-manager-service to session-tool
+    - o/devicestate: cleanup system actions supported by recover mode
+    - snap-bootstrap: remove create-partitions and update tests
+    - tests: fix nested tests
+    - packaging/arch: update PKGBUILD to match one in AUR
+    - tests: port interfaces-location-control to session-tool
+    - tests: port interfaces-contacts-service to session-tool
+    - state: log task errors in the journal too
+    - o/devicestate: change how current system is reported for different
+      modes
+    - devicestate: do not report "ErrNoState" for seeded up
+    - tests: add a note about broken test sequence
+    - tests: port interfaces-autopilot-introspection to session-tool
+    - tests: port interfaces-dbus to session-tool
+    - packaging: update sid packaging to match 16.04+
+    - tests: enable degraded test on uc20
+    - c/snaplock/runinhibit: add run inhibition operations
+    - tests: detect and report root-owned files in /home
+    - tests: reload root's systemd --user after snapd tests
+    - tests: test registration with serial-authority: [generic]
+    - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+      key in recover
+    - tests/mount-ns: stop binfmt_misc mount unit
+    - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+      uuid if available
+    - daemon, tests: indicate system mode, test switching to recovery
+      and back to run
+    - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+      denials
+    - tests/mount-ns: update to reflect new UEFI boot mode
+    - usersession,tests: clean ups for userd/settings.go and move
+      xdgopenproxy under usersession
+    - tests: disable mount-ns test
+    - tests: test user belongs to systemd-journald, on core20
+    - tests: run core/snap-set-core-config on uc20 too
+    - tests: remove generated session-agent units
+    - sysconfig: use new _writable_defaults dir to create cloud config
+    - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+      future work
+    - asserts: make clearer that with label we mean a serialized label
+    - cmd/snap-bootstrap: tweak recovery trigger log messages
+    - asserts: introduce PoolTo 
+    - userd: allow setting default-url-scheme-handler
+    - secboot: append uuid to ubuntu-data when decrypting
+    - o/configcore: pass extra options to FileSystemOnlyApply
+    - tests: add dbus-user-session to bionic and reorder package names
+    - boot, bootloader: adjust comments, expand tests
+    - tests: improve debugging of user session agent tests
+    - packaging: add the inhibit directory
+    - many: add core.resiliance.vitality-hint config setting
+    - tests: test adjustments and fixes for recently published images
+    - cmd/snap: coldplug auto-import assertions from all removable
+      devices
+    - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+      secboot
+    - tests: not fail when boot dir cannot be determined
+    - tests: new directory used to store the cloud images on gce
+    - tests: inject snapd from edge into seeds of the image in manual
+      preseed test
+    - usersession/agent,wrappers: fix races between Shutdown and Serve
+    - tests: add dependency needed for next upgrade of bionic
+    - tests: new test user is used for external backend
+    - cmd/snap: fix the order of positional parameters in help output
+    - tests: don't create root-owned things in ~test
+    - tests/lib/prepare.sh: delete patching of the initrd
+    - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+      as well
+    - progress: tweak multibyte label unit test data
+    - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+    - gadget: fix fallback device lookup for 'mbr' type structures
+    - configcore: only reload journald if systemd is new enough
+    - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+    - wrappers: allow user mode systemd daemons
+    - progress: fix progress bar with multibyte duration units
+    - tests: fix raciness in pulseaudio test
+    - asserts/internal: introduce Grouping and Groupings
+    - tests: remove user.sh
+    - tests: pair of follow-ups from earlier reviews
+    - overlord/snapstate: warn of refresh/postpone events
+    - configcore,tests: use daemon-reexec to apply watchdog config
+    - c/snap-bootstrap: check mount states via initramfsMountStates
+    - store: implement DownloadAssertions
+    - tests: run smoke test with different bases
+    - tests: port user-mounts test to session-tool
+    - store: handle error-list in fetch-assertions results
+    - tests: port interfaces-audio-playback-record to session-tool
+    - data/completion: add `snap` command completion for zsh
+    - tests/degraded: ignore failure in systemd-vconsole-setup.service
+    - image: stub implementation of image.Prepare for darwin
+    - tests: session-tool --restore -u stops user-$UID.slice
+    - o/ifacestate/handlers.go: fix typo
+    - tests: port pulseaudio test to session-tool
+    - tests: port user-session-env to session-tool
+    - tests: work around journald bug in core16
+    - tests: add debug to core-persistent-journal test
+    - tests: port selinux-clean to session-tool
+    - tests: port portals test to session-tool, fix portal tests on sid
+    - tests: adding option --no-install-recommends option also when
+      install all the deps
+    - tests: add session-tool --has-systemd-and-dbus
+    - packaging/debian-sid: add gcc-multilib to build deps
+    - osutil: expand FileLock to support shared locks and more
+    - packaging: stop depending on python-docutils
+    - store,asserts,many: support the new action fetch-assertions
+    - tests: port snap-session-agent-* to session-tool
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - tests: fix for preseeding failures
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 25 Aug 2020 17:26:21 +0200
+
+snapd (2.45.3.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+
+ -- Samuele Pedroni <pedronis@lucediurna.net>  Tue, 28 Jul 2020 21:43:38 +0200
+
+snapd (2.45.3) xenial; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - many: backport _writable_defaults dir changes
+    - tests: fix incorrect check in smoke/remove test
+    - cmd/snap-bootstrap,seed: backport of uc20 PRs
+    - tests: avoid exit when nested type var is not defined
+    - cmd/snap-preseed: backport fixes
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - many: cherry-picks for 2.45, gh-action, test fixes
+    - tests/lib: account for changes in arch package file name extension
+    - postrm, snap-mgmt: cleanup modules and other cherry-picks
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests/main/interfaces-time-control: exercise setting time via date
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+
+ -- Zygmunt Krynicki <me@zygoon.pl>  Mon, 27 Jul 2020 12:01:14 +0200
+
+snapd (2.45.2) xenial; urgency=medium
+
+  * SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+    implementation
+    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
       variable modification when calling the system xdg-open. Patch
       thanks to James Henstridge
-    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
-      may autostart on next use. Patch thanks to Michael Vogt
+    - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+      restarted. Patch thanks to Michael Vogt
     - CVE-2020-11934
     - LP: #1880085
+  * SECURITY UPDATE: arbitrary code execution vulnerability on core
+    devices with access to physical removable media
+    - devicestate: Disable/restrict cloud-init after seeding.
+    - CVE-2020-11933
+    - LP: #1879530
 
- -- Emilia Torino <emilia.torino@canonical.com>  Fri, 10 Jul 2020 10:59:20 -0300
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 10 Jul 2020 20:06:29 +0200
 
-snapd (2.45.1+20.04) focal; urgency=medium
+snapd (2.45.1) xenial; urgency=medium
 
   * New upstream release, LP: #1875071
     - data/selinux: allow checking /var/cache/app-info
     - cmd/snap-confine: add support for libc6-lse
-    - interfaces: miscellanious policy updates xlv
+    - interfaces: miscellaneous policy updates xlv
     - snap-bootstrap: remove sealed key file on reinstall
     - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
     - gadget: make ext4 filesystems with or without metadata checksum
@@ -422,6 +1704,35 @@
 
  -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 May 2020 17:17:57 +0200
 
+snapd (2.44.5) xenial; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - spread.yaml: adding more workers for ubuntu 20.04
+    - packaging: stop depending on python-docutils on opensuse
+    - spread.yaml: do not run ubuntu-core-20-64 with snapd 2.44, snapd
+      is not recent enough to drive ubuntu-core-20
+    - spread.yaml: Preserve size for centos images on spread.yaml
+    - spread.yaml: use non-uefi enabled image for uc20
+    - tests: ensure $cache_dir is actually available
+    - tests: disable preseed tests, they work in master but require too
+      much cherry-picking here
+    - travis.yml: remove go/master unit tests from 2.44
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 30 Apr 2020 09:09:22 +0200
+
+snapd (2.44.4) xenial; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - interfaces/firewall-control: allow -legacy and -nft for core20
+    - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
+      syscalls
+    - tests: 16.04 and 18.04 now have mediating pulseaudio
+    - tests: ignore user@12345.service hierarchy
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Apr 2020 08:32:56 +0200
+
 snapd (2.44.3) xenial; urgency=medium
 
   * New upstream release, LP: #1864808
@@ -3576,7 +4887,7 @@
     - logger: try to not have double dates
     - debian: use deb-systemd-invoke instead of systemctl directly
     - tests: run all main tests on core18
-    - many: finish sharing a single TaskRunner with all the the managers
+    - many: finish sharing a single TaskRunner with all the managers
     - interfaces/repo: added AllHotplugInterfaces helper
     - snapstate: ensure kernel-track is honored on switch/refresh
     - overlord/ifacestate: support implicit slots on snapd
diff -Nru snapd-2.45.1+20.04.2/debian/control snapd-2.48.3+20.04/debian/control
--- snapd-2.45.1+20.04.2/debian/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/control	2021-02-02 08:21:12.000000000 +0000
@@ -6,6 +6,7 @@
                automake,
                autotools-dev,
                bash-completion,
+               ca-certificates,
                debhelper (>= 9),
                dbus,
                dh-apparmor,
@@ -25,6 +26,7 @@
                libfuse-dev,
                libglib2.0-dev,
                liblzma-dev,
+               liblzo2-dev,
                libseccomp-dev,
                libudev-dev,
                openssh-client,
diff -Nru snapd-2.45.1+20.04.2/debian/copyright snapd-2.48.3+20.04/debian/copyright
--- snapd-2.45.1+20.04.2/debian/copyright	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/copyright	2021-02-02 08:21:12.000000000 +0000
@@ -6,7 +6,7 @@
 Copyright: Copyright (C) 2014,2015 Canonical, Ltd.
 License: GPL-3
  This program is free software: you can redistribute it and/or modify it
- under the terms of the the GNU General Public License version 3, as
+ under the terms of the GNU General Public License version 3, as
  published by the Free Software Foundation.
  .
  This program is distributed in the hope that it will be useful, but
diff -Nru snapd-2.45.1+20.04.2/debian/rules snapd-2.48.3+20.04/debian/rules
--- snapd-2.45.1+20.04.2/debian/rules	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/rules	2021-02-02 08:21:12.000000000 +0000
@@ -60,10 +60,16 @@
 endif
 
 # build with "tpm" support on ubuntu by default
+# TAGS are the go build tags for all binaries, SNAP_TAGS are for snap and
+# snap-bootstrap build only.
 TAGS=
+SNAP_TAGS=
 # check if we need to include the testkeys in the binary
 ifneq (,$(filter testkeys,$(DEB_BUILD_OPTIONS)))
 	TAGS=-tags withtestkeys
+	SNAP_TAGS=-tags "nomanagers withtestkeys"
+else
+	SNAP_TAGS=-tags nomanagers
 endif
 
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
@@ -162,10 +168,14 @@
 	# Build golang bits
 	mkdir -p _build/src/$(DH_GOPKG)/cmd/snap/test-data
 	cp -a cmd/snap/test-data/*.gpg _build/src/$(DH_GOPKG)/cmd/snap/test-data/
+	cp -a bootloader/assets/data _build/src/$(DH_GOPKG)/bootloader/assets
 
 	# this is the main go build
 	SNAPD_VANILLA_GO=$$(which go) PATH="$$(pwd)/packaging/build-tools/:$$PATH" dh_auto_build -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
 
+	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build $(BUILDFLAGS) $(GCCGOFLAGS) $(SNAP_TAGS) $(DH_GOPKG)/cmd/snap)
+	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build $(BUILDFLAGS) $(GCCGOFLAGS) $(SNAP_TAGS) $(DH_GOPKG)/cmd/snap-bootstrap)
+
 	# Generate static snap-exec, snapctl and snap-update-ns - it somehow includes CGO so
 	# we must force a static build here. We need a static snap-{exec,update-ns}/snapctl
 	# inside the core snap because not all bases will have a libc
@@ -201,7 +211,7 @@
 	(cd vendor/github.com/snapcore/squashfuse/src && mkdir -p autom4te.cache && ./autogen.sh --disable-demo && ./configure --disable-demo && make && mv squashfuse_ll snapfuse)
 
 override_dh_auto_test:
-	dh_auto_test -- $(BUILDFLAGS) -tags "$(TAGS)" $(GCCGOFLAGS)
+	dh_auto_test -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
 # a tested default (production) build should have no test keys
 ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
 	# check that only the main trusted account-keys are included
@@ -237,6 +247,10 @@
 	fi
 	# chrorder generator
 	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
+	# bootloader assets generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/genasset
+	# docs generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/docs
 
 	# Install snapd's systemd units / upstart jobs, done
 	# here instead of debian/snapd.install because the
diff -Nru snapd-2.45.1+20.04.2/debian/snapd.dirs snapd-2.48.3+20.04/debian/snapd.dirs
--- snapd-2.45.1+20.04.2/debian/snapd.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/snapd.dirs	2021-02-02 08:21:12.000000000 +0000
@@ -1,12 +1,18 @@
 snap
 var/cache/snapd
 usr/lib/snapd
+usr/share/dbus-1/session.d
+usr/share/dbus-1/system.d
 var/lib/snapd/apparmor/snap-confine
 var/lib/snapd/desktop/applications
 var/lib/snapd/auto-import
+var/lib/snapd/dbus-1
+var/lib/snapd/dbus-1/services
+var/lib/snapd/dbus-1/system-services
 var/lib/snapd/desktop
 var/lib/snapd/environment
 var/lib/snapd/firstboot
+var/lib/snapd/inhibit
 var/lib/snapd/lib/gl
 var/lib/snapd/lib/gl32
 var/lib/snapd/lib/glvnd
diff -Nru snapd-2.45.1+20.04.2/debian/snapd.install snapd-2.48.3+20.04/debian/snapd.install
--- snapd-2.45.1+20.04.2/debian/snapd.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/snapd.install	2021-02-02 08:21:12.000000000 +0000
@@ -39,6 +39,7 @@
 
 # gdb helper
 usr/lib/snapd/snap-gdb-shim
+usr/lib/snapd/snap-gdbserver-shim
 
 # install squashfuse as snapfuse to ensure it is available in e.g. lxd
 vendor/github.com/snapcore/squashfuse/src/snapfuse usr/bin
diff -Nru snapd-2.45.1+20.04.2/debian/snapd.postrm snapd-2.48.3+20.04/debian/snapd.postrm
--- snapd-2.45.1+20.04.2/debian/snapd.postrm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/snapd.postrm	2021-02-02 08:21:12.000000000 +0000
@@ -82,11 +82,19 @@
             if [ -d /etc/dbus-1/system.d ]; then
                 find /etc/dbus-1/system.d -name "snap.${snap}.*.conf" -execdir rm -f "{}" \;
             fi
+            # modules
+            rm -f "/etc/modules-load.d/snap.${snap}.conf"
             # timer and socket units
             find /etc/systemd/system -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" | while read -r f; do
                 systemctl_stop "$(basename "$f")"
                 rm -f "$f"
             done
+            # user services, sockets, and timers - we make no attempt to stop any of them.
+            # TODO: ask snapd to ask each snapd.session-agent.service to stop snaps
+            # user-session services and stop itself.
+            find /etc/systemd/user -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" -o -name "snap.${snap}.*.service" | while read -r f; do
+                rm -f "$f"
+            done
         fi
 
         echo "Removing $unit"
@@ -94,6 +102,15 @@
         rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
     done
 
+    # snapd session-agent
+    rm -f /etc/systemd/user/snapd.session-agent.socket
+    rm -f /etc/systemd/user/snapd.session-agent.service
+    rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+
+    # dbus activation configuration
+    rm -f /etc/dbus-1/session.d/snapd.session-services.conf
+    rm -f /etc/dbus-1/system.d/snapd.system-services.conf
+
     # generated readme files
     rm -f "/snap/README"
 
@@ -119,6 +136,12 @@
         umount -l /run/snapd/ns/ || true
     fi
 
+    # inside containers we have a generator that creates a bind mount to /snap
+    if [ -e /run/systemd/container ]; then
+        echo "Unmount /snap inside a container"
+        umount /snap || true
+    fi
+
     echo "Removing extra snap-confine apparmor rules"
     rm -f /etc/apparmor.d/snap.core.*.usr.lib.snapd.snap-confine
 
diff -Nru snapd-2.45.1+20.04.2/debian/tests/integrationtests snapd-2.48.3+20.04/debian/tests/integrationtests
--- snapd-2.45.1+20.04.2/debian/tests/integrationtests	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/debian/tests/integrationtests	2021-02-02 08:21:12.000000000 +0000
@@ -63,8 +63,9 @@
 environment:
     PROJECT_PATH: /home/gopath/src/github.com/snapcore/snapd
     TESTSLIB: $PROJECT_PATH/tests/lib
+    TESTSTOOLS: $PROJECT_PATH/tests/lib/tools
     SNAPPY_TESTING: 1
-    PATH: $PATH:$PROJECT_PATH/tests/lib/bin
+    PATH: $PATH:$PROJECT_PATH/tests/bin
 backends:
     autopkgtest:
         type: adhoc
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/caps.go snapd-2.48.3+20.04/desktop/notification/caps.go
--- snapd-2.45.1+20.04.2/desktop/notification/caps.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/caps.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,67 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification
+
+const (
+	// ActionIconsCapability indicates that the server supports using icons
+	// instead of text for displaying actions. Using icons for actions must be
+	// enabled on a per-notification basis using the "action-icons" hint.
+	ActionIconsCapability ServerCapability = "action-icons"
+	// ActionsCapability indicates that the server will provide the specified
+	// actions to the user. Even if this cap is missing, actions may still be
+	// specified by the client, however the server is free to ignore them.
+	ActionsCapability ServerCapability = "actions"
+	// BodyCapability indicates that the server supports body text. Some
+	// implementations may only show the summary (for instance, onscreen
+	// displays, marquee/scrollers).
+	BodyCapability ServerCapability = "body"
+	// BodyHyperlinksCapability indicates that the server supports hyperlinks in
+	// the notifications.
+	BodyHyperlinksCapability ServerCapability = "body-hyperlinks"
+	// BodyImagesCapability indicates that the server supports images in the
+	// notifications.
+	BodyImagesCapability ServerCapability = "body-images"
+	// BodyMarkupCapability indicates that the server supports markup in the
+	// body text. If marked up text is sent to a server that does not give this
+	// cap, the markup will show through as regular text so must be stripped
+	// clientside.
+	BodyMarkupCapability ServerCapability = "body-markup"
+	// IconMultiCapability indicates that the server will render an animation of
+	// all the frames in a given image array. The client may still specify
+	// multiple frames even if this cap and/or "icon-static" is missing, however
+	// the server is free to ignore them and use only the primary frame.
+	IconMultiCapability ServerCapability = "icon-multi"
+	// IconStaticCapability indicates that the server supports display of
+	// exactly one frame of any given image array. This value is mutually
+	// exclusive with "icon-multi", it is a protocol error for the server to
+	// specify both.
+	IconStaticCapability ServerCapability = "icon-static"
+	// PersistenceCapability indicates that the server supports persistence of
+	// notifications. Notifications will be retained until they are acknowledged
+	// or removed by the user or recalled by the sender. The presence of this
+	// capability allows clients to depend on the server to ensure a
+	// notification is seen and eliminate the need for the client to display a
+	// reminding function (such as a status icon) of its own.
+	PersistenceCapability ServerCapability = "persistence"
+	// SoundCapability indicates that the server supports sounds on
+	// notifications. If returned, the server must support the "sound-file" and
+	// "suppress-sound" hints.
+	SoundCapability ServerCapability = "sound"
+)
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/export_test.go snapd-2.48.3+20.04/desktop/notification/export_test.go
--- snapd-2.45.1+20.04.2/desktop/notification/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,24 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification
+
+var (
+	ProcessSignal = processSignal
+)
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/fdo.go snapd-2.48.3+20.04/desktop/notification/fdo.go
--- snapd-2.45.1+20.04.2/desktop/notification/fdo.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/fdo.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,199 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/godbus/dbus"
+
+	"github.com/snapcore/snapd/logger"
+)
+
+const (
+	dBusName          = "org.freedesktop.Notifications"
+	dBusObjectPath    = "/org/freedesktop/Notifications"
+	dBusInterfaceName = "org.freedesktop.Notifications"
+)
+
+// Server holds a connection to a notification server interactions.
+type Server struct {
+	conn *dbus.Conn
+	obj  dbus.BusObject
+}
+
+// New returns new connection to a freedesktop.org message notification server.
+//
+// Each server offers specific capabilities. It is advised to provide graceful
+// degradation of functionality, depending on the supported capabilities, so
+// that the notification messages are useful on a wide range of desktop
+// environments.
+func New(conn *dbus.Conn) *Server {
+	return &Server{
+		conn: conn,
+		obj:  conn.Object(dBusName, dBusObjectPath),
+	}
+}
+
+// ServerInformation returns the information about the notification server.
+func (srv *Server) ServerInformation() (name, vendor, version, specVersion string, err error) {
+	call := srv.obj.Call(dBusInterfaceName+".GetServerInformation", 0)
+	if err := call.Store(&name, &vendor, &version, &specVersion); err != nil {
+		return "", "", "", "", err
+	}
+	return name, vendor, version, specVersion, nil
+}
+
+// ServerCapabilities returns the list of notification capabilities provided by the session.
+func (srv *Server) ServerCapabilities() ([]ServerCapability, error) {
+	call := srv.obj.Call(dBusInterfaceName+".GetCapabilities", 0)
+	var caps []ServerCapability
+	if err := call.Store(&caps); err != nil {
+		return nil, err
+	}
+	return caps, nil
+}
+
+// SendNotification sends a new notification or updates an existing
+// notification. In both cases the ID of the notification, as assigned by the
+// server, is returned. The ID can be used to cancel a notification, update it
+// or react to invoked user actions.
+func (srv *Server) SendNotification(msg *Message) (ID, error) {
+	call := srv.obj.Call(dBusInterfaceName+".Notify", 0,
+		msg.AppName, msg.ReplacesID, msg.Icon, msg.Summary, msg.Body,
+		flattenActions(msg.Actions), mapHints(msg.Hints),
+		int32(msg.ExpireTimeout.Nanoseconds()/1e6))
+	var id ID
+	if err := call.Store(&id); err != nil {
+		return 0, err
+	}
+	return id, nil
+}
+
+func flattenActions(actions []Action) []string {
+	result := make([]string, len(actions)*2)
+	for i, action := range actions {
+		result[i*2] = action.ActionKey
+		result[i*2+1] = action.LocalizedText
+	}
+	return result
+}
+
+func mapHints(hints []Hint) map[string]dbus.Variant {
+	result := make(map[string]dbus.Variant, len(hints))
+	for _, hint := range hints {
+		result[hint.Name] = dbus.MakeVariant(hint.Value)
+	}
+	return result
+}
+
+// CloseNotification closes a notification message with the given ID.
+func (srv *Server) CloseNotification(id ID) error {
+	call := srv.obj.Call(dBusInterfaceName+".CloseNotification", 0, id)
+	return call.Store()
+}
+
+// ObserveNotifications blocks and processes message notification signals.
+//
+// The bus connection is configured to deliver signals from the notification
+// server. All received signals are dispatched to the provided observer. This
+// process continues until stopped by the context, or if an error occurs.
+func (srv *Server) ObserveNotifications(ctx context.Context, observer Observer) (err error) {
+	// TODO: upgrade godbus and use un-buffered channel.
+	ch := make(chan *dbus.Signal, 10)
+	defer close(ch)
+
+	srv.conn.Signal(ch)
+	defer srv.conn.RemoveSignal(ch)
+
+	matchRules := []dbus.MatchOption{
+		dbus.WithMatchSender(dBusName),
+		dbus.WithMatchObjectPath(dBusObjectPath),
+		dbus.WithMatchInterface(dBusInterfaceName),
+	}
+	if err := srv.conn.AddMatchSignal(matchRules...); err != nil {
+		return err
+	}
+	defer func() {
+		if err := srv.conn.RemoveMatchSignal(matchRules...); err != nil {
+			// XXX: this should not fail for us in practice but we don't want
+			// to clobber the actual error being returned from the function in
+			// general, so ignore RemoveMatchSignal errors and just log them
+			// instead.
+			logger.Noticef("Cannot remove D-Bus signal matcher: %v", err)
+		}
+	}()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case sig := <-ch:
+			if err := processSignal(sig, observer); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func processSignal(sig *dbus.Signal, observer Observer) error {
+	switch sig.Name {
+	case dBusInterfaceName + ".NotificationClosed":
+		if err := processNotificationClosed(sig, observer); err != nil {
+			return fmt.Errorf("cannot process NotificationClosed signal: %v", err)
+		}
+	case dBusInterfaceName + ".ActionInvoked":
+		if err := processActionInvoked(sig, observer); err != nil {
+			return fmt.Errorf("cannot process ActionInvoked signal: %v", err)
+		}
+	}
+	return nil
+}
+
+func processNotificationClosed(sig *dbus.Signal, observer Observer) error {
+	if len(sig.Body) != 2 {
+		return fmt.Errorf("unexpected number of body elements: %d", len(sig.Body))
+	}
+	id, ok := sig.Body[0].(uint32)
+	if !ok {
+		return fmt.Errorf("expected first body element to be uint32, got %T", sig.Body[0])
+	}
+	reason, ok := sig.Body[1].(uint32)
+	if !ok {
+		return fmt.Errorf("expected second body element to be uint32, got %T", sig.Body[1])
+	}
+	return observer.NotificationClosed(ID(id), CloseReason(reason))
+}
+
+func processActionInvoked(sig *dbus.Signal, observer Observer) error {
+	if len(sig.Body) != 2 {
+		return fmt.Errorf("unexpected number of body elements: %d", len(sig.Body))
+	}
+	id, ok := sig.Body[0].(uint32)
+	if !ok {
+		return fmt.Errorf("expected first body element to be uint32, got %T", sig.Body[0])
+	}
+	actionKey, ok := sig.Body[1].(string)
+	if !ok {
+		return fmt.Errorf("expected second body element to be string, got %T", sig.Body[1])
+	}
+	return observer.ActionInvoked(ID(id), actionKey)
+}
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/fdo_test.go snapd-2.48.3+20.04/desktop/notification/fdo_test.go
--- snapd-2.45.1+20.04.2/desktop/notification/fdo_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/fdo_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,640 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification_test
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/godbus/dbus"
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dbusutil"
+	"github.com/snapcore/snapd/dbusutil/dbustest"
+	"github.com/snapcore/snapd/desktop/notification"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type fdoSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&fdoSuite{})
+
+func (s *fdoSuite) connectWithHandler(c *C, handler dbustest.DBusHandlerFunc) *notification.Server {
+	conn, err := dbustest.Connection(handler)
+	c.Assert(err, IsNil)
+	restore := dbusutil.MockOnlySessionBusAvailable(conn)
+	s.AddCleanup(restore)
+	return notification.New(conn)
+}
+
+func (s *fdoSuite) checkGetServerInformationRequest(c *C, msg *dbus.Message) {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/Notifications")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldMember:      dbus.MakeVariant("GetServerInformation"),
+	})
+	c.Check(msg.Body, HasLen, 0)
+}
+
+func (s *fdoSuite) checkGetCapabilitiesRequest(c *C, msg *dbus.Message) {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/Notifications")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldMember:      dbus.MakeVariant("GetCapabilities"),
+	})
+	c.Check(msg.Body, HasLen, 0)
+}
+
+func (s *fdoSuite) checkNotifyRequest(c *C, msg *dbus.Message) {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/Notifications")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldMember:      dbus.MakeVariant("Notify"),
+		dbus.FieldSignature: dbus.MakeVariant(dbus.SignatureOf(
+			"", uint32(0), "", "", "", []string{}, map[string]dbus.Variant{}, int32(0),
+		)),
+	})
+	c.Check(msg.Body, HasLen, 8)
+}
+
+func (s *fdoSuite) checkCloseNotificationRequest(c *C, msg *dbus.Message) {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/Notifications")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.Notifications"),
+		dbus.FieldMember:      dbus.MakeVariant("CloseNotification"),
+		dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf(uint32(0))),
+	})
+	c.Check(msg.Body, HasLen, 1)
+}
+
+func (s *fdoSuite) nameHasNoOwnerResponse(c *C, msg *dbus.Message) *dbus.Message {
+	return &dbus.Message{
+		Type: dbus.TypeError,
+		Headers: map[dbus.HeaderField]dbus.Variant{
+			dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+			dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+			// dbus.FieldDestination is provided automatically by DBus test helper.
+			dbus.FieldErrorName: dbus.MakeVariant("org.freedesktop.DBus.Error.NameHasNoOwner"),
+		},
+	}
+}
+
+func (s *fdoSuite) TestServerInformationSuccess(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkGetServerInformationRequest(c, msg)
+			responseSig := dbus.SignatureOf("", "", "", "")
+			response := &dbus.Message{
+				Type: dbus.TypeMethodReply,
+				Headers: map[dbus.HeaderField]dbus.Variant{
+					dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+					dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+					// dbus.FieldDestination is provided automatically by DBus test helper.
+					dbus.FieldSignature: dbus.MakeVariant(responseSig),
+				},
+				Body: []interface{}{"name", "vendor", "version", "specVersion"},
+			}
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	name, vendor, version, specVersion, err := srv.ServerInformation()
+	c.Assert(err, IsNil)
+	c.Check(name, Equals, "name")
+	c.Check(vendor, Equals, "vendor")
+	c.Check(version, Equals, "version")
+	c.Check(specVersion, Equals, "specVersion")
+}
+
+func (s *fdoSuite) TestServerInformationError(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkGetServerInformationRequest(c, msg)
+			response := s.nameHasNoOwnerResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	_, _, _, _, err := srv.ServerInformation()
+	c.Assert(err, ErrorMatches, "org.freedesktop.DBus.Error.NameHasNoOwner")
+}
+
+func (s *fdoSuite) TestServerCapabilitiesSuccess(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkGetCapabilitiesRequest(c, msg)
+			responseSig := dbus.SignatureOf([]string{})
+			response := &dbus.Message{
+				Type: dbus.TypeMethodReply,
+				Headers: map[dbus.HeaderField]dbus.Variant{
+					dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+					dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+					// dbus.FieldDestination is provided automatically by DBus test helper.
+					dbus.FieldSignature: dbus.MakeVariant(responseSig),
+				},
+				Body: []interface{}{
+					[]string{"cap-foo", "cap-bar"},
+				},
+			}
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	caps, err := srv.ServerCapabilities()
+	c.Assert(err, IsNil)
+	c.Check(caps, DeepEquals, []notification.ServerCapability{"cap-foo", "cap-bar"})
+}
+
+func (s *fdoSuite) TestServerCapabilitiesError(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkGetCapabilitiesRequest(c, msg)
+			response := s.nameHasNoOwnerResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	_, err := srv.ServerCapabilities()
+	c.Assert(err, ErrorMatches, "org.freedesktop.DBus.Error.NameHasNoOwner")
+}
+
+func (s *fdoSuite) TestSendNotificationSuccess(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkNotifyRequest(c, msg)
+			c.Check(msg.Body[0], Equals, "app-name")
+			c.Check(msg.Body[1], Equals, uint32(42))
+			c.Check(msg.Body[2], Equals, "icon")
+			c.Check(msg.Body[3], Equals, "summary")
+			c.Check(msg.Body[4], Equals, "body")
+			c.Check(msg.Body[5], DeepEquals, []string{"key-1", "text-1", "key-2", "text-2"})
+			c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+				"hint-str":  dbus.MakeVariant("str"),
+				"hint-bool": dbus.MakeVariant(true),
+			})
+			c.Check(msg.Body[7], Equals, int32(1000))
+			responseSig := dbus.SignatureOf(uint32(0))
+			response := &dbus.Message{
+				Type: dbus.TypeMethodReply,
+				Headers: map[dbus.HeaderField]dbus.Variant{
+					dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+					dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+					// dbus.FieldDestination is provided automatically by DBus test helper.
+					dbus.FieldSignature: dbus.MakeVariant(responseSig),
+				},
+				Body: []interface{}{uint32(7)},
+			}
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	id, err := srv.SendNotification(&notification.Message{
+		AppName:       "app-name",
+		Icon:          "icon",
+		Summary:       "summary",
+		Body:          "body",
+		ExpireTimeout: time.Second * 1,
+		ReplacesID:    notification.ID(42),
+		Actions: []notification.Action{
+			{ActionKey: "key-1", LocalizedText: "text-1"},
+			{ActionKey: "key-2", LocalizedText: "text-2"},
+		},
+		Hints: []notification.Hint{
+			{Name: "hint-str", Value: "str"},
+			{Name: "hint-bool", Value: true},
+		},
+	})
+	c.Assert(err, IsNil)
+	c.Check(id, Equals, notification.ID(7))
+}
+
+func (s *fdoSuite) TestSendNotificationWithServerDecitedExpireTimeout(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkNotifyRequest(c, msg)
+			c.Check(msg.Body[7], Equals, int32(-1))
+			responseSig := dbus.SignatureOf(uint32(0))
+			response := &dbus.Message{
+				Type: dbus.TypeMethodReply,
+				Headers: map[dbus.HeaderField]dbus.Variant{
+					dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+					dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+					// dbus.FieldDestination is provided automatically by DBus test helper.
+					dbus.FieldSignature: dbus.MakeVariant(responseSig),
+				},
+				Body: []interface{}{uint32(7)},
+			}
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	id, err := srv.SendNotification(&notification.Message{
+		ExpireTimeout: notification.ServerSelectedExpireTimeout,
+	})
+	c.Assert(err, IsNil)
+	c.Check(id, Equals, notification.ID(7))
+}
+
+func (s *fdoSuite) TestSendNotificationError(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkNotifyRequest(c, msg)
+			response := s.nameHasNoOwnerResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	_, err := srv.SendNotification(&notification.Message{})
+	c.Assert(err, ErrorMatches, "org.freedesktop.DBus.Error.NameHasNoOwner")
+}
+
+func (s *fdoSuite) TestCloseNotificationSuccess(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkCloseNotificationRequest(c, msg)
+			c.Check(msg.Body[0], Equals, uint32(42))
+			response := &dbus.Message{
+				Type: dbus.TypeMethodReply,
+				Headers: map[dbus.HeaderField]dbus.Variant{
+					dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+					dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+					// dbus.FieldDestination is provided automatically by DBus test helper.
+				},
+			}
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	err := srv.CloseNotification(notification.ID(42))
+	c.Assert(err, IsNil)
+}
+
+func (s *fdoSuite) TestCloseNotificationError(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkCloseNotificationRequest(c, msg)
+			response := s.nameHasNoOwnerResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	err := srv.CloseNotification(notification.ID(42))
+	c.Assert(err, ErrorMatches, "org.freedesktop.DBus.Error.NameHasNoOwner")
+}
+
+type testObserver struct {
+	notificationClosed func(notification.ID, notification.CloseReason) error
+	actionInvoked      func(notification.ID, string) error
+}
+
+func (o *testObserver) NotificationClosed(id notification.ID, reason notification.CloseReason) error {
+	if o.notificationClosed != nil {
+		return o.notificationClosed(id, reason)
+	}
+	return nil
+}
+
+func (o *testObserver) ActionInvoked(id notification.ID, actionKey string) error {
+	if o.actionInvoked != nil {
+		return o.actionInvoked(id, actionKey)
+	}
+	return nil
+}
+
+func (s *fdoSuite) checkAddMatchRequest(c *C, msg *dbus.Message) {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.DBus"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/DBus")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.DBus"),
+		dbus.FieldMember:      dbus.MakeVariant("AddMatch"),
+		dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf("")),
+	})
+}
+
+func (s *fdoSuite) checkRemoveMatchRequest(c *C, msg *dbus.Message) {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.DBus"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/DBus")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.DBus"),
+		dbus.FieldMember:      dbus.MakeVariant("RemoveMatch"),
+		dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf("")),
+	})
+}
+
+func (s *fdoSuite) addMatchResponse(c *C, msg *dbus.Message) *dbus.Message {
+	return &dbus.Message{
+		Type: dbus.TypeMethodReply,
+		Headers: map[dbus.HeaderField]dbus.Variant{
+			dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+			dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+			// dbus.FieldDestination is provided automatically by DBus test helper.
+		},
+	}
+}
+
+func (s *fdoSuite) removeMatchResponse(c *C, msg *dbus.Message) *dbus.Message {
+	return &dbus.Message{
+		Type: dbus.TypeMethodReply,
+		Headers: map[dbus.HeaderField]dbus.Variant{
+			dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+			dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+			// dbus.FieldDestination is provided automatically by DBus test helper.
+		},
+	}
+}
+
+func (s *fdoSuite) TestObserveNotificationsContextAndSignalWatch(c *C) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	msgsSeen := 0
+	addMatchSeen := make(chan struct{}, 1)
+	defer close(addMatchSeen)
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		msgsSeen++
+		switch n {
+		case 0:
+			s.checkAddMatchRequest(c, msg)
+			c.Check(msg.Body, HasLen, 1)
+			c.Check(msg.Body[0], Equals, "type='signal',sender='org.freedesktop.Notifications',path='/org/freedesktop/Notifications',interface='org.freedesktop.Notifications'")
+			response := s.addMatchResponse(c, msg)
+			addMatchSeen <- struct{}{}
+			return []*dbus.Message{response}, nil
+		case 1:
+			s.checkRemoveMatchRequest(c, msg)
+			c.Check(msg.Body, HasLen, 1)
+			c.Check(msg.Body[0], Equals, "type='signal',sender='org.freedesktop.Notifications',path='/org/freedesktop/Notifications',interface='org.freedesktop.Notifications'")
+			response := s.removeMatchResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		default:
+			return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+		}
+	})
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		err := srv.ObserveNotifications(ctx, &testObserver{})
+		c.Assert(err, ErrorMatches, "context canceled")
+		wg.Done()
+	}()
+	// Wait for the signal that we saw the AddMatch message and then stop.
+	<-addMatchSeen
+	cancel()
+	// Wait for ObserveNotifications to return
+	wg.Wait()
+	c.Check(msgsSeen, Equals, 2)
+}
+
+func (s *fdoSuite) TestObserveNotificationsAddWatchError(c *C) {
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			s.checkAddMatchRequest(c, msg)
+			response := s.nameHasNoOwnerResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		default:
+			return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+		}
+	})
+	err := srv.ObserveNotifications(context.TODO(), &testObserver{})
+	c.Assert(err, ErrorMatches, "org.freedesktop.DBus.Error.NameHasNoOwner")
+}
+
+func (s *fdoSuite) TestObserveNotificationsRemoveWatchError(c *C) {
+	logBuffer, restore := logger.MockLogger()
+	defer restore()
+
+	ctx, cancel := context.WithCancel(context.TODO())
+	msgsSeen := 0
+	addMatchSeen := make(chan struct{}, 1)
+	defer close(addMatchSeen)
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		msgsSeen++
+		switch n {
+		case 0:
+			s.checkAddMatchRequest(c, msg)
+			response := s.addMatchResponse(c, msg)
+			addMatchSeen <- struct{}{}
+			return []*dbus.Message{response}, nil
+		case 1:
+			s.checkRemoveMatchRequest(c, msg)
+			response := s.nameHasNoOwnerResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		default:
+			return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+		}
+	})
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		err := srv.ObserveNotifications(ctx, &testObserver{})
+		// The error from RemoveWatch is not clobbering the return value of ObserveNotifications.
+		c.Assert(err, ErrorMatches, "context canceled")
+		c.Check(logBuffer.String(), testutil.Contains, "Cannot remove D-Bus signal matcher: org.freedesktop.DBus.Error.NameHasNoOwner\n")
+		wg.Done()
+	}()
+	// Wait for the signal that we saw the AddMatch message and then stop.
+	<-addMatchSeen
+	cancel()
+	// Wait for ObserveNotifications to return
+	wg.Wait()
+	c.Check(msgsSeen, Equals, 2)
+}
+
+func (s *fdoSuite) TestObserveNotificationsProcessingError(c *C) {
+	msgsSeen := 0
+	srv := s.connectWithHandler(c, func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		msgsSeen++
+		switch n {
+		case 0:
+			s.checkAddMatchRequest(c, msg)
+			response := s.addMatchResponse(c, msg)
+			sig := &dbus.Message{
+				Type: dbus.TypeSignal,
+				Headers: map[dbus.HeaderField]dbus.Variant{
+					dbus.FieldPath:      dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/Notifications")),
+					dbus.FieldInterface: dbus.MakeVariant("org.freedesktop.Notifications"),
+					dbus.FieldMember:    dbus.MakeVariant("ActionInvoked"),
+					dbus.FieldSender:    dbus.MakeVariant("org.freedesktop.Notifications"),
+					dbus.FieldSignature: dbus.MakeVariant(dbus.SignatureOf(uint32(0), "")),
+				},
+				Body: []interface{}{uint32(42), "action-key"},
+			}
+			// Send the DBus response for the method call and an additional signal.
+			return []*dbus.Message{response, sig}, nil
+		case 1:
+			s.checkRemoveMatchRequest(c, msg)
+			response := s.removeMatchResponse(c, msg)
+			return []*dbus.Message{response}, nil
+		default:
+			return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+		}
+	})
+	err := srv.ObserveNotifications(context.TODO(), &testObserver{
+		actionInvoked: func(id notification.ID, actionKey string) error {
+			c.Check(id, Equals, notification.ID(42))
+			c.Check(actionKey, Equals, "action-key")
+			return fmt.Errorf("boom")
+		},
+	})
+	c.Assert(err, ErrorMatches, "cannot process ActionInvoked signal: boom")
+	c.Check(msgsSeen, Equals, 2)
+}
+
+func (s *fdoSuite) TestProcessActionInvokedSignalSuccess(c *C) {
+	called := false
+	err := notification.ProcessSignal(&dbus.Signal{
+		// Sender and Path are not used
+		Name: "org.freedesktop.Notifications.ActionInvoked",
+		Body: []interface{}{uint32(42), "action-key"},
+	}, &testObserver{
+		actionInvoked: func(id notification.ID, actionKey string) error {
+			called = true
+			c.Check(id, Equals, notification.ID(42))
+			c.Check(actionKey, Equals, "action-key")
+			return nil
+		},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(called, Equals, true)
+}
+
+func (s *fdoSuite) TestProcessActionInvokedSignalError(c *C) {
+	err := notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.ActionInvoked",
+		Body: []interface{}{uint32(42), "action-key"},
+	}, &testObserver{
+		actionInvoked: func(id notification.ID, actionKey string) error {
+			return fmt.Errorf("boom")
+		},
+	})
+	c.Assert(err, ErrorMatches, "cannot process ActionInvoked signal: boom")
+}
+
+func (s *fdoSuite) TestProcessActionInvokedSignalBodyParseErrors(c *C) {
+	err := notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.ActionInvoked",
+		Body: []interface{}{uint32(42), "action-key", "unexpected"},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process ActionInvoked signal: unexpected number of body elements: 3")
+
+	err = notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.ActionInvoked",
+		Body: []interface{}{uint32(42)},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process ActionInvoked signal: unexpected number of body elements: 1")
+
+	err = notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.ActionInvoked",
+		Body: []interface{}{uint32(42), true},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process ActionInvoked signal: expected second body element to be string, got bool")
+
+	err = notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.ActionInvoked",
+		Body: []interface{}{true, "action-key"},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process ActionInvoked signal: expected first body element to be uint32, got bool")
+}
+
+func (s *fdoSuite) TestProcessNotificationClosedSignalSuccess(c *C) {
+	called := false
+	err := notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.NotificationClosed",
+		Body: []interface{}{uint32(42), uint32(2)},
+	}, &testObserver{
+		notificationClosed: func(id notification.ID, reason notification.CloseReason) error {
+			called = true
+			c.Check(id, Equals, notification.ID(42))
+			c.Check(reason, Equals, notification.CloseReason(2))
+			return nil
+		},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(called, Equals, true)
+}
+
+func (s *fdoSuite) TestProcessNotificationClosedSignalError(c *C) {
+	err := notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.NotificationClosed",
+		Body: []interface{}{uint32(42), uint32(2)},
+	}, &testObserver{
+		notificationClosed: func(id notification.ID, reason notification.CloseReason) error {
+			return fmt.Errorf("boom")
+		},
+	})
+	c.Assert(err, ErrorMatches, "cannot process NotificationClosed signal: boom")
+}
+
+func (s *fdoSuite) TestProcessNotificationClosedSignalBodyParseErrors(c *C) {
+	err := notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.NotificationClosed",
+		Body: []interface{}{uint32(42), uint32(2), "unexpected"},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process NotificationClosed signal: unexpected number of body elements: 3")
+
+	err = notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.NotificationClosed",
+		Body: []interface{}{uint32(42)},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process NotificationClosed signal: unexpected number of body elements: 1")
+
+	err = notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.NotificationClosed",
+		Body: []interface{}{uint32(42), true},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process NotificationClosed signal: expected second body element to be uint32, got bool")
+
+	err = notification.ProcessSignal(&dbus.Signal{
+		Name: "org.freedesktop.Notifications.NotificationClosed",
+		Body: []interface{}{true, uint32(2)},
+	}, &testObserver{})
+	c.Assert(err, ErrorMatches, "cannot process NotificationClosed signal: expected first body element to be uint32, got bool")
+}
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/hints.go snapd-2.48.3+20.04/desktop/notification/hints.go
--- snapd-2.45.1+20.04.2/desktop/notification/hints.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/hints.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,206 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification
+
+import "fmt"
+
+// WithActionIcons returns a hint asking the server to use action key as icon names.
+//
+// A server that has the "action-icons" capability will attempt to interpret any
+// action key as a named icon. The localized display name will be used to
+// annotate the icon for accessibility purposes. The icon name should be
+// compliant with the Freedesktop.org Icon Naming Specification.
+//
+// Requires server version >= 1.2
+func WithActionIcons() Hint {
+	t := true
+	return Hint{Name: "action-icons", Value: &t}
+}
+
+// Urgency describes the importance of a notification message.
+//
+// Specification: https://developer.gnome.org/notification-spec/#urgency-levels
+type Urgency byte
+
+const (
+	// LowUrgency indicates that a notification message is below normal priority.
+	LowUrgency Urgency = 0
+	// NormalUrgency indicates that a notification message has the regular priority.
+	NormalUrgency Urgency = 1
+	// CriticalUrgency indicates that a notification message is above normal priority.
+	CriticalUrgency Urgency = 2
+)
+
+// String implements the Stringer interface.
+func (u Urgency) String() string {
+	switch u {
+	case LowUrgency:
+		return "low"
+	case NormalUrgency:
+		return "normal"
+	case CriticalUrgency:
+		return "critical"
+	default:
+		return fmt.Sprintf("Urgency(%d)", byte(u))
+	}
+}
+
+// WithUrgency returns a hint asking the server to set message urgency.
+//
+// Notification servers may show messages with higher urgency before messages
+// with lower urgency. In addition some urgency levels may not be shown when the
+// user has enabled a do-not-distrub mode.
+func WithUrgency(u Urgency) Hint {
+	return Hint{Name: "urgency", Value: &u}
+}
+
+// Category is a string indicating the category of a notification message.
+//
+// Specification: https://developer.gnome.org/notification-spec/#categories
+type Category string
+
+const (
+	// DeviceCategory is a generic notification category related to hardware devices.
+	DeviceCategory Category = "device"
+	// DeviceAddedCategory indicates that a device was added to the system.
+	DeviceAddedCategory Category = "device.added"
+	// DeviceErrorCategory indicates that a device error occurred.
+	DeviceErrorCategory Category = "device.error"
+	// DeviceRemovedCategory indicates that a device was removed from the system.
+	DeviceRemovedCategory Category = "device.removed"
+
+	// EmailCategory is a generic notification category related to electronic mail.
+	EmailCategory Category = "email"
+	//EmailArrivedCategory indicates that an e-mail has arrived.
+	EmailArrivedCategory Category = "email.arrived"
+	// EmailBouncedCategory indicates that an e-mail message has bounced.
+	EmailBouncedCategory Category = "email.bounced"
+
+	// InstantMessageCategory is a generic notification category related to instant messages.
+	InstantMessageCategory Category = "im"
+	// InstantMessageErrorCategory indicates that an instant message error occurred.
+	InstantMessageErrorCategory Category = "im.error"
+	// InstantMessageReceivedCategory indicates that an instant mesage has been received.
+	InstantMessageReceivedCategory Category = "im.received"
+
+	// NetworkCategory is a generic notification category related to network.
+	NetworkCategory Category = "network"
+	// NetworkConnectedCategory indicates that a network connection has been established.
+	NetworkConnectedCategory Category = "network.connected"
+	// NetworkDisconnectedCategory indicates that a network connection has been lost.
+	NetworkDisconnectedCategory Category = "network.disconnected"
+	// NetworkErrorCategory indicates that a network error occurred.
+	NetworkErrorCategory Category = "network.error"
+
+	// PresenceCategory is a generic notification category related to on-line presence.
+	PresenceCategory Category = "presence"
+	// PresenceOfflineCategory indicates that a contact disconnected from the network.
+	PresenceOfflineCategory Category = "presence.offline"
+	// PresenceOnlineCategory indicates that a contact connected to the network.
+	PresenceOnlineCategory Category = "presence.online"
+
+	// TransferCategory is a generic notification category for file transfers or downloads.
+	TransferCategory Category = "transfer"
+	// TransferCompleteCategory indicates that a file transfer has completed.
+	TransferCompleteCategory Category = "transfer.complete"
+	// TransferErrorCategory indicates that a file transfer error occurred.
+	TransferErrorCategory Category = "transfer.error"
+)
+
+// WithCategory returns a hint asking the server to set message category.
+func WithCategory(c Category) Hint {
+	return Hint{Name: "category", Value: &c}
+}
+
+// WithDesktopEntry returns a hint asking the server to associate a desktop file with a message.
+//
+// The desktopEntryName is the name of the desktop file without the ".desktop"
+// extension. The server may use this information to derive correct icon, for
+// logging, etc.
+func WithDesktopEntry(desktopEntryName string) Hint {
+	return Hint{Name: "desktop-entry", Value: &desktopEntryName}
+}
+
+// WithTransient returns a hint asking the server to bypass message persistence.
+//
+// When set the server will treat the notification as transient and by-pass the
+// server's persistence capability, if it should exist.
+//
+// Requires server version >= 1.2
+func WithTransient() Hint {
+	t := true
+	return Hint{Name: "transient", Value: &t}
+}
+
+// WithResident returns a hint asking the server to keep the message after an action is invoked.
+//
+// When set the server will not automatically remove the notification when an
+// action has been invoked. The notification will remain resident in the server
+// until it is explicitly removed by the user or by the sender. This hint is
+// likely only useful when the server has the "persistence" capability.
+//
+// Requires server version >= 1.2
+func WithResident() Hint {
+	t := true
+	return Hint{Name: "resident", Value: &t}
+}
+
+// WithPointToX returns a hint asking the server to point the notification at a specific X coordinate.
+//
+// The coordinate is in desktop pixel units. Both X and Y hints must be included in the message.
+func WithPointToX(x int) Hint {
+	return Hint{Name: "x", Value: &x}
+}
+
+// WithPointToY returns a hint asking the server to point the notification at a specific Y coordinate.
+//
+// The coordinate is in desktop pixel units. Both X and Y hints must be included in the message.
+func WithPointToY(y int) Hint {
+	return Hint{Name: "y", Value: &y}
+}
+
+// WithImageFile returns a hint asking the server display an image loaded from file.
+//
+// When multiple hits related to images are used, the following priority list applies:
+// 1) "image-data" (not implemented in Go).
+// 2) "image-path", as provided by WithImageFile.
+// 3) Message.Icon field.
+func WithImageFile(path string) Hint {
+	// The hint name is image-path but the function is called WithImageFile for consistency with WithSoundFile.
+	return Hint{Name: "image-path", Value: &path}
+}
+
+// TODO: add WithImageData
+
+// WithSoundFile returns a hint asking the server to play a sound loaded from file.
+func WithSoundFile(path string) Hint {
+	return Hint{Name: "sound-file", Value: &path}
+}
+
+// WithSoundName returns a hint asking the server to play a sound from the sound theme.
+func WithSoundName(name string) Hint {
+	return Hint{Name: "sound-name", Value: &name}
+}
+
+// WithSuppressSound returns a hint asking the server not to play any notification sounds.
+func WithSuppressSound() Hint {
+	t := true
+	return Hint{Name: "suppress-sound", Value: &t}
+}
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/hints_test.go snapd-2.48.3+20.04/desktop/notification/hints_test.go
--- snapd-2.45.1+20.04.2/desktop/notification/hints_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/hints_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,101 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/desktop/notification"
+)
+
+type hintsSuite struct{}
+
+var _ = Suite(&hintsSuite{})
+
+func (s *hintsSuite) TestWithActionIcons(c *C) {
+	val := true
+	c.Check(notification.WithActionIcons(), DeepEquals, notification.Hint{Name: "action-icons", Value: &val})
+}
+
+func (s *hintsSuite) TestWithUrgency(c *C) {
+	val := notification.LowUrgency
+	c.Check(notification.WithUrgency(val), DeepEquals, notification.Hint{Name: "urgency", Value: &val})
+}
+
+func (s *hintsSuite) TestWithCategory(c *C) {
+	val := notification.DeviceCategory
+	c.Check(notification.WithCategory(val), DeepEquals, notification.Hint{Name: "category", Value: &val})
+}
+
+func (s *hintsSuite) TestWithDesktopEntry(c *C) {
+	val := "desktop-name"
+	c.Check(notification.WithDesktopEntry(val), DeepEquals, notification.Hint{Name: "desktop-entry", Value: &val})
+}
+
+func (s *hintsSuite) TestWithTransient(c *C) {
+	val := true
+	c.Check(notification.WithTransient(), DeepEquals, notification.Hint{Name: "transient", Value: &val})
+}
+
+func (s *hintsSuite) TestWithResident(c *C) {
+	val := true
+	c.Check(notification.WithResident(), DeepEquals, notification.Hint{Name: "resident", Value: &val})
+}
+
+func (s *hintsSuite) TestWithPointToX(c *C) {
+	val := 10
+	c.Check(notification.WithPointToX(val), DeepEquals, notification.Hint{Name: "x", Value: &val})
+}
+
+func (s *hintsSuite) TestWithPointToY(c *C) {
+	val := 10
+	c.Check(notification.WithPointToY(val), DeepEquals, notification.Hint{Name: "y", Value: &val})
+}
+
+func (s *hintsSuite) TestWithImageFile(c *C) {
+	val := "/path/to/img"
+	c.Check(notification.WithImageFile(val), DeepEquals, notification.Hint{Name: "image-path", Value: &val})
+}
+
+func (s *hintsSuite) TestWithSoundFile(c *C) {
+	val := "/path/to/snd"
+	c.Check(notification.WithSoundFile(val), DeepEquals, notification.Hint{Name: "sound-file", Value: &val})
+}
+
+func (s *hintsSuite) TestWithSoundName(c *C) {
+	val := "sound"
+	c.Check(notification.WithSoundName(val), DeepEquals, notification.Hint{Name: "sound-name", Value: &val})
+}
+
+func (s *hintsSuite) TestWithSuppressSound(c *C) {
+	val := true
+	c.Check(notification.WithSuppressSound(), DeepEquals, notification.Hint{Name: "suppress-sound", Value: &val})
+}
+
+type urgencySuite struct{}
+
+var _ = Suite(&urgencySuite{})
+
+func (s *urgencySuite) TestString(c *C) {
+	c.Check(notification.LowUrgency.String(), Equals, "low")
+	c.Check(notification.NormalUrgency.String(), Equals, "normal")
+	c.Check(notification.CriticalUrgency.String(), Equals, "critical")
+	c.Check(notification.Urgency(13).String(), Equals, "Urgency(13)")
+}
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/notify.go snapd-2.48.3+20.04/desktop/notification/notify.go
--- snapd-2.45.1+20.04.2/desktop/notification/notify.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/notify.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,152 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Package notification implements bindings to D-Bus notification
+// specification, version 1.2, as documented at https://developer.gnome.org/notification-spec/
+package notification
+
+import (
+	"fmt"
+	"time"
+)
+
+// Message describes a single notification message.
+//
+// The notification should be related to a specific application, as indicated by
+// AppName. In practice this should be the name of the desktop file and could be
+// also accompanied by an appropriate hint indicating which icon to use.
+//
+// Message must include a summary and should include a body. The body may use
+// HTML-like markup language to include bold, italic or underline text, as well
+// as to include images and hyperlinks.
+//
+// A notification can automatically expire after the given number of
+// milliseconds. This is separate from the notification being visible or
+// invisible on-screen. Expired notifications are removed from persistent
+// message roster, if one is supported. Two special values are recognized. When
+// the expiration timeout is zero a message never expires. When the expiration
+// timeout is -1 a message expires after a server-defined duration which may
+// vary for the type of the notification message sent.
+//
+// A notification may replace an existing notification by setting the ReplacesID
+// to a non-zero value. This only works if the notification server was not
+// re-started and should be used for as long as the sender process is alive, as
+// sending the identifier across session startup boundary has no chance of
+// working correctly.
+//
+// A notification may optionally carry a number of hints that further customize it
+// in a specific way. Refer to various hint constructors for details.
+//
+// A notification may optionally also carry one of several actions. If
+// supported, actions can be invoked by the user, broadcasting a notification
+// response back to the session. This mechanism only works if there is someone
+// listening for the action being triggered.
+//
+// In all cases, the specific notification must take into account the
+// capabilities of the server. For instance, if a server does not support body
+// markup, then such markup is not automatically stripped by either the client
+// or the server.
+type Message struct {
+	AppName       string
+	Icon          string
+	Summary       string
+	Body          string
+	ExpireTimeout time.Duration // Effective resolution in milliseconds with 31-bit range.
+	ReplacesID    ID
+	Actions       []Action
+	Hints         []Hint
+}
+
+// ServerSelectedExpireTimeout requests the server to pick an expiration timeout
+// appropriate for the message type.
+const ServerSelectedExpireTimeout = time.Millisecond * -1
+
+// ID is the opaque identifier of a notification assigned by the server.
+//
+// Notifications with known identifiers can be closed or updated. The identifier
+// is valid within one desktop session and should not be used unless the calling
+// process initially sent the message.
+type ID uint32
+
+// Action describes a single notification action.
+//
+// ActionKey is returned in an D-Bus signal when an action is activated by the
+// user. The text must be localized for the appropriate language.
+type Action struct {
+	ActionKey     string
+	LocalizedText string
+}
+
+// Hint describes supplementeary information that may be used by the server.
+//
+// Various helpers create hint objects of specifc purpose.
+//
+// Specification: https://developer.gnome.org/notification-spec/#hints
+type Hint struct {
+	Name  string
+	Value interface{}
+}
+
+// ServerCapability describes a single capability of the notification server.
+type ServerCapability string
+
+// CloseReason indicates why a notification message was closed.
+type CloseReason uint32
+
+const (
+	// CloseReasonExpired indicates that a notification message has expired.
+	CloseReasonExpired CloseReason = 1
+	// CloseReasonDismissed indicates that a notification message was dismissed by the user.
+	CloseReasonDismissed CloseReason = 2
+	// CloseReasonClosed indicates that a notification message was closed with an API call.
+	CloseReasonClosed CloseReason = 3
+	// CloseReasonUndefined indicates that no other well-known reason applies.
+	CloseReasonUndefined CloseReason = 4
+)
+
+// String implements the Stringer interface.
+func (r CloseReason) String() string {
+	switch r {
+	case CloseReasonExpired:
+		return "expired"
+	case CloseReasonDismissed:
+		return "dismissed"
+	case CloseReasonClosed:
+		return "closed"
+	case CloseReasonUndefined:
+		return "undefined"
+	default:
+		return fmt.Sprintf("CloseReason(%d)", uint32(r))
+	}
+}
+
+// Observer is an interface for observing interactions with notification messages.
+//
+// An observer can be used to either observe a notification being closed or
+// dismissed or to react to actions being invoked by the user. Practical
+// implementations must remember the ID of the message they have sent to filter
+// out other notifications.
+type Observer interface {
+	// NotificationClosed is called when a notification is either closed or removed
+	// from the persistent roster.
+	NotificationClosed(id ID, reason CloseReason) error
+	// ActionInvoked is caliled when one of the notification message actions is
+	// clicked by the user.
+	ActionInvoked(id ID, actionKey string) error
+}
diff -Nru snapd-2.45.1+20.04.2/desktop/notification/notify_test.go snapd-2.48.3+20.04/desktop/notification/notify_test.go
--- snapd-2.45.1+20.04.2/desktop/notification/notify_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/desktop/notification/notify_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package notification_test
+
+import (
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/desktop/notification"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type notifySuite struct{}
+
+var _ = Suite(&notifySuite{})
+
+func (s *notifySuite) TestCloseReasonString(c *C) {
+	c.Check(notification.CloseReasonExpired.String(), Equals, "expired")
+	c.Check(notification.CloseReasonDismissed.String(), Equals, "dismissed")
+	c.Check(notification.CloseReasonClosed.String(), Equals, "closed")
+	c.Check(notification.CloseReasonUndefined.String(), Equals, "undefined")
+	c.Check(notification.CloseReason(42).String(), Equals, "CloseReason(42)")
+}
diff -Nru snapd-2.45.1+20.04.2/dirs/dirs.go snapd-2.48.3+20.04/dirs/dirs.go
--- snapd-2.45.1+20.04.2/dirs/dirs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/dirs/dirs.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,7 @@
 	"fmt"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 
 	"github.com/snapcore/snapd/release"
@@ -57,6 +58,8 @@
 	SnapRunLockDir            string
 	SnapBootstrapRunDir       string
 
+	SnapdMaintenanceFile string
+
 	SnapdStoreSSLCertsDir string
 
 	SnapSeedDir   string
@@ -91,9 +94,17 @@
 	SnapSystemdConfDir  string
 	SnapDesktopFilesDir string
 	SnapDesktopIconsDir string
-	SnapBusPolicyDir    string
 
-	SnapModeenvFile string
+	SnapDBusSessionPolicyDir   string
+	SnapDBusSystemPolicyDir    string
+	SnapDBusSessionServicesDir string
+	SnapDBusSystemServicesDir  string
+
+	SnapModeenvFile   string
+	SnapBootAssetsDir string
+	SnapFDEDir        string
+	SnapSaveDir       string
+	SnapDeviceSaveDir string
 
 	CloudMetaDataFile     string
 	CloudInstanceDataFile string
@@ -110,9 +121,6 @@
 	SystemLocalFontsDir       string
 	SystemFontconfigCacheDirs []string
 
-	FreezerCgroupDir string
-	PidsCgroupDir    string
-
 	SnapshotsDir string
 
 	ErrtrackerDbDir string
@@ -210,6 +218,11 @@
 	return err == nil, err
 }
 
+// SnapdStateDir returns the path to /var/lib/snapd dir under rootdir.
+func SnapdStateDir(rootdir string) string {
+	return filepath.Join(rootdir, snappyDir)
+}
+
 // SnapBlobDirUnder returns the path to the snap blob dir under rootdir.
 func SnapBlobDirUnder(rootdir string) string {
 	return filepath.Join(rootdir, snappyDir, "snaps")
@@ -241,6 +254,34 @@
 	return filepath.Join(rootdir, "/etc/systemd/system.conf.d")
 }
 
+// SnapBootAssetsDirUnder returns the path to boot assets directory under a
+// rootdir.
+func SnapBootAssetsDirUnder(rootdir string) string {
+	return filepath.Join(rootdir, snappyDir, "boot-assets")
+}
+
+// SnapDeviceDirUnder returns the path to device directory under rootdir.
+func SnapDeviceDirUnder(rootdir string) string {
+	return filepath.Join(rootdir, snappyDir, "device")
+}
+
+// SnapFDEDirUnder returns the path to full disk encryption state directory
+// under rootdir.
+func SnapFDEDirUnder(rootdir string) string {
+	return filepath.Join(SnapDeviceDirUnder(rootdir), "fde")
+}
+
+// SnapSaveDirUnder returns the path to device save directory under rootdir.
+func SnapSaveDirUnder(rootdir string) string {
+	return filepath.Join(rootdir, snappyDir, "save")
+}
+
+// SnapFDEDirUnderSave returns the path to full disk encryption state directory
+// inside the given save tree dir.
+func SnapFDEDirUnderSave(savedir string) string {
+	return filepath.Join(savedir, "device/fde")
+}
+
 // AddRootDirCallback registers a callback for whenever the global root
 // directory (set by SetRootDir) is changed to enable updates to variables in
 // other packages that depend on its location.
@@ -261,6 +302,7 @@
 		"arch",
 		"archlinux",
 		"fedora",
+		"gentoo",
 		"manjaro",
 		"manjaro-arm",
 	}
@@ -282,6 +324,7 @@
 	SnapSeccompDir = filepath.Join(SnapSeccompBase, "bpf")
 	SnapMountPolicyDir = filepath.Join(rootdir, snappyDir, "mount")
 	SnapMetaDir = filepath.Join(rootdir, snappyDir, "meta")
+	SnapdMaintenanceFile = filepath.Join(rootdir, snappyDir, "maintenance.json")
 	SnapBlobDir = SnapBlobDirUnder(rootdir)
 	// ${snappyDir}/desktop is added to $XDG_DATA_DIRS.
 	// Subdirectories are interpreted according to the relevant
@@ -315,9 +358,13 @@
 	SnapAuxStoreInfoDir = filepath.Join(SnapCacheDir, "aux")
 
 	SnapSeedDir = SnapSeedDirUnder(rootdir)
-	SnapDeviceDir = filepath.Join(rootdir, snappyDir, "device")
+	SnapDeviceDir = SnapDeviceDirUnder(rootdir)
 
 	SnapModeenvFile = SnapModeenvFileUnder(rootdir)
+	SnapBootAssetsDir = SnapBootAssetsDirUnder(rootdir)
+	SnapFDEDir = SnapFDEDirUnder(rootdir)
+	SnapSaveDir = SnapSaveDirUnder(rootdir)
+	SnapDeviceSaveDir = filepath.Join(SnapSaveDir, "device")
 
 	SnapRepairDir = filepath.Join(rootdir, snappyDir, "repair")
 	SnapRepairStateFile = filepath.Join(SnapRepairDir, "repair.json")
@@ -331,9 +378,14 @@
 	SnapServicesDir = filepath.Join(rootdir, "/etc/systemd/system")
 	SnapUserServicesDir = filepath.Join(rootdir, "/etc/systemd/user")
 	SnapSystemdConfDir = SnapSystemdConfDirUnder(rootdir)
-	SnapBusPolicyDir = filepath.Join(rootdir, "/etc/dbus-1/system.d")
 
-	CloudMetaDataFile = filepath.Join(rootdir, "/var/lib/cloud/seed/nocloud-net/meta-data")
+	SnapDBusSystemPolicyDir = filepath.Join(rootdir, "/etc/dbus-1/system.d")
+	SnapDBusSessionPolicyDir = filepath.Join(rootdir, "/etc/dbus-1/session.d")
+	// Use 'dbus-1/services' and `dbus-1/system-services' to mirror
+	// '/usr/share/dbus-1' hierarchy.
+	SnapDBusSessionServicesDir = filepath.Join(rootdir, snappyDir, "dbus-1", "services")
+	SnapDBusSystemServicesDir = filepath.Join(rootdir, snappyDir, "dbus-1", "system-services")
+
 	CloudInstanceDataFile = filepath.Join(rootdir, "/run/cloud-init/instance-data.json")
 
 	SnapUdevRulesDir = filepath.Join(rootdir, "/etc/udev/rules.d")
@@ -343,9 +395,28 @@
 	LocaleDir = filepath.Join(rootdir, "/usr/share/locale")
 	ClassicDir = filepath.Join(rootdir, "/writable/classic")
 
-	if release.DistroLike("fedora") {
-		// rhel, centos, fedora and derivatives
-		// both rhel and centos list "fedora" in ID_LIKE
+	opensuseTWWithLibexec := func() bool {
+		// XXX: this is pretty naive if openSUSE ever starts going back
+		// and forth about the change
+		if !release.DistroLike("opensuse-tumbleweed") {
+			return false
+		}
+		v, err := strconv.Atoi(release.ReleaseInfo.VersionID)
+		if err != nil {
+			// nothing we can do here
+			return false
+		}
+		// first seen on snapshot "20200826"
+		if v < 20200826 {
+			return false
+		}
+		return true
+	}
+
+	if release.DistroLike("fedora") || opensuseTWWithLibexec() {
+		// RHEL, CentOS, Fedora and derivatives, some more recent
+		// snapshots of openSUSE Tumbleweed;
+		// both RHEL and CentOS list "fedora" in ID_LIKE
 		DistroLibExecDir = filepath.Join(rootdir, "/usr/libexec/snapd")
 	} else {
 		DistroLibExecDir = filepath.Join(rootdir, "/usr/lib/snapd")
@@ -377,8 +448,6 @@
 		SystemFontconfigCacheDirs = append(SystemFontconfigCacheDirs, filepath.Join(rootdir, "/usr/lib/fontconfig/cache"))
 	}
 
-	FreezerCgroupDir = filepath.Join(rootdir, "/sys/fs/cgroup/freezer/")
-	PidsCgroupDir = filepath.Join(rootdir, "/sys/fs/cgroup/pids/")
 	SnapshotsDir = filepath.Join(rootdir, snappyDir, "snapshots")
 
 	ErrtrackerDbDir = filepath.Join(rootdir, snappyDir, "errtracker.db")
diff -Nru snapd-2.45.1+20.04.2/dirs/dirs_test.go snapd-2.48.3+20.04/dirs/dirs_test.go
--- snapd-2.45.1+20.04.2/dirs/dirs_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/dirs/dirs_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -189,3 +189,20 @@
 	c.Assert(someVar, Equals, filepath.Join("/hello", "my", "path"))
 	c.Assert(someDerivedVar, Equals, filepath.Join("/hello", "var", "snap", "other", "mnt"))
 }
+
+func (s *DirsTestSuite) TestLibexecdirOpenSUSETW(c *C) {
+	restore := release.MockReleaseInfo(&release.OS{ID: "opensuse-tumbleweed", VersionID: "20200820"})
+	defer restore()
+	dirs.SetRootDir("/")
+	c.Check(dirs.DistroLibExecDir, Equals, "/usr/lib/snapd")
+
+	restore = release.MockReleaseInfo(&release.OS{ID: "opensuse-tumbleweed", VersionID: "20200826"})
+	defer restore()
+	dirs.SetRootDir("/")
+	c.Check(dirs.DistroLibExecDir, Equals, "/usr/libexec/snapd")
+
+	restore = release.MockReleaseInfo(&release.OS{ID: "opensuse-tumbleweed", VersionID: "20200901"})
+	defer restore()
+	dirs.SetRootDir("/")
+	c.Check(dirs.DistroLibExecDir, Equals, "/usr/libexec/snapd")
+}
diff -Nru snapd-2.45.1+20.04.2/docs/error-kinds.go snapd-2.48.3+20.04/docs/error-kinds.go
--- snapd-2.45.1+20.04.2/docs/error-kinds.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/docs/error-kinds.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,100 @@
+package main
+
+import (
+	"fmt"
+	"go/ast"
+	"go/doc"
+	"go/parser"
+	"go/token"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+const (
+	errorKindsHdr      = `## <h3 id='heading--errors'>Error kinds</h3>`
+	maintErrorKindsHdr = `## <h4 id='heading--maint-errors'>Maintenance error kinds</h4>
+
+These are used only inside the ` + "`maintenance` field of responses."
+)
+
+func fail(err error) {
+	fmt.Fprintf(os.Stderr, "error: %v", err)
+	os.Exit(1)
+}
+
+func main() {
+	fset := token.NewFileSet()
+	pkgs, err := parser.ParseDir(fset, "../client", nil, parser.ParseComments)
+	if err != nil {
+		fail(err)
+	}
+
+	p := doc.New(pkgs["client"], "github.com/snapcore/snapd/client", 0)
+	var errorKindT *doc.Type
+	for _, t := range p.Types {
+		if t.Name == "ErrorKind" {
+			errorKindT = t
+			break
+		}
+	}
+	if errorKindT == nil {
+		fail(fmt.Errorf("expected ErrorKind type not defined"))
+	}
+	for _, c := range errorKindT.Consts {
+		if strings.HasPrefix(c.Doc, "Error kinds.") {
+			fmt.Println(errorKindsHdr)
+		} else if strings.HasPrefix(c.Doc, "Maintenance error kinds") {
+			fmt.Println()
+			fmt.Println(maintErrorKindsHdr)
+		} else {
+			fmt.Fprintf(os.Stderr, "unexpected error kind group: %v\n", c.Doc)
+			continue
+		}
+		fmt.Println()
+
+		kinds := make([]string, 0, len(c.Decl.Specs))
+		docs := make(map[string]string, len(c.Decl.Specs))
+		for _, spec := range c.Decl.Specs {
+			vs, ok := spec.(*ast.ValueSpec)
+			if !ok {
+				fmt.Printf("%#v\n", spec)
+				continue
+			}
+			kind, err := strconv.Unquote(vs.Values[0].(*ast.BasicLit).Value)
+			if err != nil {
+				// unexpected
+				fail(err)
+			}
+			doc := vs.Doc.Text()
+			name := vs.Names[0]
+			pfx := name.String() + ":"
+			if !strings.HasPrefix(doc, pfx) {
+				fmt.Fprintf(os.Stderr, "expected %s: doc string prefix, got %q\n", name, doc)
+			} else {
+				doc = doc[len(pfx):]
+			}
+			doc = strings.Replace(doc, "\n", " ", -1)
+			doc = strings.Replace(doc, "  ", " ", -1)
+			doc = strings.TrimSpace(doc)
+			if !strings.HasSuffix(doc, ".") {
+				fmt.Fprintf(os.Stderr, "expected dot at the end %q for %s\n", doc, name)
+			}
+			if strings.HasPrefix(doc, "deprecated") {
+				// skip
+				continue
+			}
+			if doc == "" {
+				doc = name.String() + "..."
+			}
+			kinds = append(kinds, kind)
+			docs[kind] = doc
+		}
+
+		sort.Strings(kinds)
+		for _, kind := range kinds {
+			fmt.Printf("* `%s`: %s\n", kind, docs[kind])
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/errtracker/errtracker.go snapd-2.48.3+20.04/errtracker/errtracker.go
--- snapd-2.45.1+20.04.2/errtracker/errtracker.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/errtracker/errtracker.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,6 +42,7 @@
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snapdenv"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 var (
@@ -216,12 +217,11 @@
 }
 
 var didSnapdReExec = func() string {
-	// TODO: move this into osutil.Reexeced() ?
-	exe, err := os.Readlink(procSelfExe)
+	didReexec, err := snapdtool.IsReexecd()
 	if err != nil {
 		return "unknown"
 	}
-	if strings.HasPrefix(exe, dirs.SnapMountDir) {
+	if didReexec {
 		return "yes"
 	}
 	return "no"
diff -Nru snapd-2.45.1+20.04.2/features/features.go snapd-2.48.3+20.04/features/features.go
--- snapd-2.45.1+20.04.2/features/features.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/features/features.go	2021-02-02 08:21:12.000000000 +0000
@@ -47,6 +47,19 @@
 	ClassicPreservesXdgRuntimeDir
 	// RobustMountNamespaceUpdates controls how snap-update-ns updates existing mount namespaces.
 	RobustMountNamespaceUpdates
+	// UserDaemons controls availability of user mode service support.
+	UserDaemons
+	// DbusActivation controls whether snaps daemons can be activated via D-Bus
+	DbusActivation
+	// HiddenSnapFolder moves ~/snap to ~/.snapdata.
+	HiddenSnapFolder
+	// CheckDiskSpaceRemove controls free disk space check on remove whenever automatic snapshot needs to be created.
+	CheckDiskSpaceRemove
+	// CheckDiskSpaceInstall controls free disk space check on snap install.
+	CheckDiskSpaceInstall
+	// CheckDiskSpaceRefresh controls free disk space check on snap refresh.
+	CheckDiskSpaceRefresh
+
 	// lastFeature is the final known feature, it is only used for testing.
 	lastFeature
 )
@@ -72,12 +85,22 @@
 
 	ClassicPreservesXdgRuntimeDir: "classic-preserves-xdg-runtime-dir",
 	RobustMountNamespaceUpdates:   "robust-mount-namespace-updates",
+
+	UserDaemons:    "user-daemons",
+	DbusActivation: "dbus-activation",
+
+	HiddenSnapFolder: "hidden-snap-folder",
+
+	CheckDiskSpaceInstall: "check-disk-space-install",
+	CheckDiskSpaceRefresh: "check-disk-space-refresh",
+	CheckDiskSpaceRemove:  "check-disk-space-remove",
 }
 
 // featuresEnabledWhenUnset contains a set of features that are enabled when not explicitly configured.
 var featuresEnabledWhenUnset = map[SnapdFeature]bool{
-	Layouts:                     true,
-	RobustMountNamespaceUpdates: true,
+	Layouts:                       true,
+	RobustMountNamespaceUpdates:   true,
+	ClassicPreservesXdgRuntimeDir: true,
 }
 
 // featuresExported contains a set of features that are exported outside of snapd.
@@ -88,6 +111,7 @@
 
 	ClassicPreservesXdgRuntimeDir: true,
 	RobustMountNamespaceUpdates:   true,
+	HiddenSnapFolder:              true,
 }
 
 // String returns the name of a snapd feature.
diff -Nru snapd-2.45.1+20.04.2/features/features_test.go snapd-2.48.3+20.04/features/features_test.go
--- snapd-2.45.1+20.04.2/features/features_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/features/features_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -47,6 +47,12 @@
 	c.Check(features.RefreshAppAwareness.String(), Equals, "refresh-app-awareness")
 	c.Check(features.ClassicPreservesXdgRuntimeDir.String(), Equals, "classic-preserves-xdg-runtime-dir")
 	c.Check(features.RobustMountNamespaceUpdates.String(), Equals, "robust-mount-namespace-updates")
+	c.Check(features.UserDaemons.String(), Equals, "user-daemons")
+	c.Check(features.DbusActivation.String(), Equals, "dbus-activation")
+	c.Check(features.HiddenSnapFolder.String(), Equals, "hidden-snap-folder")
+	c.Check(features.CheckDiskSpaceInstall.String(), Equals, "check-disk-space-install")
+	c.Check(features.CheckDiskSpaceRefresh.String(), Equals, "check-disk-space-refresh")
+	c.Check(features.CheckDiskSpaceRemove.String(), Equals, "check-disk-space-remove")
 	c.Check(func() { _ = features.SnapdFeature(1000).String() }, PanicMatches, "unknown feature flag code 1000")
 }
 
@@ -68,6 +74,12 @@
 	c.Check(features.PerUserMountNamespace.IsExported(), Equals, true)
 	c.Check(features.RefreshAppAwareness.IsExported(), Equals, true)
 	c.Check(features.ClassicPreservesXdgRuntimeDir.IsExported(), Equals, true)
+	c.Check(features.UserDaemons.IsExported(), Equals, false)
+	c.Check(features.DbusActivation.IsExported(), Equals, false)
+	c.Check(features.HiddenSnapFolder.IsExported(), Equals, true)
+	c.Check(features.CheckDiskSpaceInstall.IsExported(), Equals, false)
+	c.Check(features.CheckDiskSpaceRefresh.IsExported(), Equals, false)
+	c.Check(features.CheckDiskSpaceRemove.IsExported(), Equals, false)
 }
 
 func (*featureSuite) TestIsEnabled(c *C) {
@@ -96,8 +108,14 @@
 	c.Check(features.SnapdSnap.IsEnabledWhenUnset(), Equals, false)
 	c.Check(features.PerUserMountNamespace.IsEnabledWhenUnset(), Equals, false)
 	c.Check(features.RefreshAppAwareness.IsEnabledWhenUnset(), Equals, false)
-	c.Check(features.ClassicPreservesXdgRuntimeDir.IsEnabledWhenUnset(), Equals, false)
+	c.Check(features.ClassicPreservesXdgRuntimeDir.IsEnabledWhenUnset(), Equals, true)
 	c.Check(features.RobustMountNamespaceUpdates.IsEnabledWhenUnset(), Equals, true)
+	c.Check(features.UserDaemons.IsEnabledWhenUnset(), Equals, false)
+	c.Check(features.DbusActivation.IsEnabledWhenUnset(), Equals, false)
+	c.Check(features.HiddenSnapFolder.IsEnabledWhenUnset(), Equals, false)
+	c.Check(features.CheckDiskSpaceInstall.IsEnabledWhenUnset(), Equals, false)
+	c.Check(features.CheckDiskSpaceRefresh.IsEnabledWhenUnset(), Equals, false)
+	c.Check(features.CheckDiskSpaceRemove.IsEnabledWhenUnset(), Equals, false)
 }
 
 func (*featureSuite) TestControlFile(c *C) {
@@ -105,6 +123,7 @@
 	c.Check(features.RefreshAppAwareness.ControlFile(), Equals, "/var/lib/snapd/features/refresh-app-awareness")
 	c.Check(features.ParallelInstances.ControlFile(), Equals, "/var/lib/snapd/features/parallel-instances")
 	c.Check(features.RobustMountNamespaceUpdates.ControlFile(), Equals, "/var/lib/snapd/features/robust-mount-namespace-updates")
+	c.Check(features.HiddenSnapFolder.ControlFile(), Equals, "/var/lib/snapd/features/hidden-snap-folder")
 	// Features that are not exported don't have a control file.
 	c.Check(features.Layouts.ControlFile, PanicMatches, `cannot compute the control file of feature "layouts" because that feature is not exported`)
 }
diff -Nru snapd-2.45.1+20.04.2/gadget/device_darwin.go snapd-2.48.3+20.04/gadget/device_darwin.go
--- snapd-2.45.1+20.04.2/gadget/device_darwin.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/device_darwin.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,8 @@
 
 import (
 	"errors"
+
+	"github.com/snapcore/snapd/gadget/quantity"
 )
 
 var errNotImplemented = errors.New("not implemented")
@@ -29,10 +31,10 @@
 	return "", errNotImplemented
 }
 
-func FindDeviceForStructureWithFallback(ps *LaidOutStructure) (string, Size, error) {
+func findDeviceForStructureWithFallback(ps *LaidOutStructure) (string, quantity.Size, error) {
 	return "", 0, errNotImplemented
 }
 
-func FindMountPointForStructure(ps *LaidOutStructure) (string, error) {
+func findMountPointForStructure(ps *LaidOutStructure) (string, error) {
 	return "", errNotImplemented
 }
diff -Nru snapd-2.45.1+20.04.2/gadget/device_linux.go snapd-2.48.3+20.04/gadget/device_linux.go
--- snapd-2.45.1+20.04.2/gadget/device_linux.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/device_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,15 +20,16 @@
 package gadget
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
-	"unicode/utf8"
 
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/disks"
 )
 
 var ErrDeviceNotFound = errors.New("device not found")
@@ -45,7 +46,7 @@
 	var candidates []string
 
 	if ps.Name != "" {
-		byPartlabel := filepath.Join(dirs.GlobalRootDir, "/dev/disk/by-partlabel/", encodeLabel(ps.Name))
+		byPartlabel := filepath.Join(dirs.GlobalRootDir, "/dev/disk/by-partlabel/", disks.BlkIDEncodeLabel(ps.Name))
 		candidates = append(candidates, byPartlabel)
 	}
 	if ps.HasFilesystem() {
@@ -57,7 +58,7 @@
 			fsLabel = ps.Name
 		}
 		if fsLabel != "" {
-			byFsLabel := filepath.Join(dirs.GlobalRootDir, "/dev/disk/by-label/", encodeLabel(fsLabel))
+			byFsLabel := filepath.Join(dirs.GlobalRootDir, "/dev/disk/by-label/", disks.BlkIDEncodeLabel(fsLabel))
 			candidates = append(candidates, byFsLabel)
 		}
 	}
@@ -94,7 +95,7 @@
 	return found, nil
 }
 
-// FindDeviceForStructureWithFallback attempts to find an existing block device
+// findDeviceForStructureWithFallback attempts to find an existing block device
 // partition containing given non-filesystem volume structure, by inspecting the
 // structure's name.
 //
@@ -111,7 +112,7 @@
 //
 // Returns the device name and an offset at which the structure content starts
 // within the device or an error.
-func FindDeviceForStructureWithFallback(ps *LaidOutStructure) (dev string, offs Size, err error) {
+func findDeviceForStructureWithFallback(ps *LaidOutStructure) (dev string, offs quantity.Size, err error) {
 	if ps.HasFilesystem() {
 		return "", 0, fmt.Errorf("internal error: cannot use with filesystem structures")
 	}
@@ -143,30 +144,10 @@
 	return dev, ps.StartOffset, nil
 }
 
-// encodeLabel encodes a name for use a partition or filesystem label symlink by
-// udev. The result matches the output of blkid_encode_string().
-func encodeLabel(in string) string {
-	const allowed = `#+-.:=@_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789`
-
-	buf := &bytes.Buffer{}
-
-	for _, r := range in {
-		switch {
-		case utf8.RuneLen(r) > 1:
-			buf.WriteRune(r)
-		case !strings.ContainsRune(allowed, r):
-			fmt.Fprintf(buf, `\x%x`, r)
-		default:
-			buf.WriteRune(r)
-		}
-	}
-	return buf.String()
-}
-
-// FindMountPointForStructure locates a mount point of a device that matches
+// findMountPointForStructure locates a mount point of a device that matches
 // given structure. The structure must have a filesystem defined, otherwise an
 // error is raised.
-func FindMountPointForStructure(ps *LaidOutStructure) (string, error) {
+func findMountPointForStructure(ps *LaidOutStructure) (string, error) {
 	if !ps.HasFilesystem() {
 		return "", ErrNoFilesystemDefined
 	}
@@ -224,17 +205,47 @@
 	if err != nil {
 		return "", err
 	}
-	return ParentDiskFromPartition(partitionWritable)
+	return ParentDiskFromMountSource(partitionWritable)
 }
 
-// ParentDiskFromPartition will find the parent disk device for the
-// given partition. E.g. /dev/nvmen0n1p5 -> /dev/nvme0n1
+// ParentDiskFromMountSource will find the parent disk device for the given
+// partition. E.g. /dev/nvmen0n1p5 -> /dev/nvme0n1.
+//
+// When the mount source is a symlink, it is resolved to the actual device that
+// is mounted. Should the device be one created by device mapper, it is followed
+// up to the actual underlying block device. As an example, this is how devices
+// are followed with a /writable mounted from an encrypted volume:
 //
-// Note that this does not work for anything using device mapper (like
-// LUKS/LVM) yet.
-func ParentDiskFromPartition(partition string) (string, error) {
+// /dev/mapper/ubuntu-data-<uuid> (a symlink)
+//   ⤷ /dev/dm-0 (set up by device mapper)
+//       ⤷ /dev/hda4 (actual partition with the content)
+//          ⤷ /dev/hda (returned by this function)
+//
+func ParentDiskFromMountSource(mountSource string) (string, error) {
+	// mount source can be a symlink
+	st, err := os.Lstat(mountSource)
+	if err != nil {
+		return "", err
+	}
+	if mode := st.Mode(); mode&os.ModeSymlink != 0 {
+		// resolve to actual device
+		target, err := filepath.EvalSymlinks(mountSource)
+		if err != nil {
+			return "", fmt.Errorf("cannot resolve mount source symlink %v: %v", mountSource, err)
+		}
+		mountSource = target
+	}
 	// /dev/sda3 -> sda3
-	devname := filepath.Base(partition)
+	devname := filepath.Base(mountSource)
+
+	if strings.HasPrefix(devname, "dm-") {
+		// looks like a device set up by device mapper
+		resolved, err := resolveParentOfDeviceMapperDevice(devname)
+		if err != nil {
+			return "", fmt.Errorf("cannot resolve device mapper device %v: %v", devname, err)
+		}
+		devname = resolved
+	}
 
 	// do not bother with investigating major/minor devices (inconsistent
 	// across block device types) or mangling strings, but look at sys
@@ -261,3 +272,31 @@
 	}
 	return mainDev, nil
 }
+
+func resolveParentOfDeviceMapperDevice(devname string) (string, error) {
+	// devices set up by device mapper have /dev/block/dm-*/slaves directory
+	// which lists the devices that are upper in the chain, follow that to
+	// find the first device that is non-dm one
+	dmSlavesLevel := 0
+	const maxDmSlavesLevel = 5
+	for strings.HasPrefix(devname, "dm-") {
+		// /sys/block/dm-*/slaves/ lists a device that this dm device is part of
+		slavesGlob := filepath.Join(dirs.GlobalRootDir, "/sys/block", devname, "slaves/*")
+		slaves, err := filepath.Glob(slavesGlob)
+		if err != nil {
+			return "", fmt.Errorf("cannot glob slaves of dm device %v: %v", devname, err)
+		}
+		if len(slaves) != 1 {
+			return "", fmt.Errorf("unexpected number of dm device %v slaves: %v", devname, len(slaves))
+		}
+		devname = filepath.Base(slaves[0])
+
+		// if we're this deep in resolving dm devices, things are clearly getting out of hand
+		dmSlavesLevel++
+		if dmSlavesLevel >= maxDmSlavesLevel {
+			return "", fmt.Errorf("too many levels")
+		}
+
+	}
+	return devname, nil
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/device_test.go snapd-2.48.3+20.04/gadget/device_test.go
--- snapd-2.45.1+20.04.2/gadget/device_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/device_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,7 @@
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -30,6 +31,7 @@
 
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/osutil"
 )
 
@@ -73,12 +75,33 @@
 
 func (d *deviceSuite) setupMockSysfsForDevMapper(c *C) {
 	// setup a mock /dev/mapper environment (incomplete we have no "happy"
-	// test
-	err := os.Symlink("../dm-0", filepath.Join(d.dir, "/dev/mapper/nvme0n1p6_crypt"))
+	// test; use a complex setup that mimics LVM in LUKS:
+	// /dev/mapper/data_crypt (symlink)
+	//   ⤷ /dev/dm-1 (LVM)
+	//      ⤷ /dev/dm-0 (LUKS)
+	//         ⤷ /dev/fakedevice0 (actual device)
+	err := ioutil.WriteFile(filepath.Join(d.dir, "/dev/dm-0"), nil, 0644)
 	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(d.dir, "/dev/dm-0"), nil, 0644)
+	err = ioutil.WriteFile(filepath.Join(d.dir, "/dev/dm-1"), nil, 0644)
 	c.Assert(err, IsNil)
-	err = os.MkdirAll(filepath.Join(d.dir, "/sys/block/dm-0"), 0755)
+	err = ioutil.WriteFile(filepath.Join(d.dir, "/dev/fakedevice0"), []byte(""), 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(d.dir, "/dev/fakedevice"), []byte(""), 0644)
+	c.Assert(err, IsNil)
+	// symlinks added by dm/udev are relative
+	err = os.Symlink("../dm-1", filepath.Join(d.dir, "/dev/mapper/data_crypt"))
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Join(d.dir, "/sys/block/dm-1/slaves/"), 0755)
+	c.Assert(err, IsNil)
+	// sys symlinks are relative too
+	err = os.Symlink("../../dm-0", filepath.Join(d.dir, "/sys/block/dm-1/slaves/dm-0"))
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Join(d.dir, "/sys/block/dm-0/slaves/"), 0755)
+	c.Assert(err, IsNil)
+	// real symlink would point to ../../../../<bus, eg. pci>/<addr>/block/fakedevice/fakedevice0
+	err = os.Symlink("../../../../fakedevice/fakedevice0", filepath.Join(d.dir, "/sys/block/dm-0/slaves/fakedevice0"))
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Join(d.dir, "/sys/block/fakedevice/fakedevice0"), 0755)
 	c.Assert(err, IsNil)
 }
 
@@ -293,11 +316,11 @@
 	c.Check(found, Equals, "")
 }
 
-var writableMountInfo = `26 27 8:3 / /writable rw,relatime shared:7 - ext4 /dev/fakedevice0p1 rw,data=ordered`
+var writableMountInfoFmt = `26 27 8:3 / /writable rw,relatime shared:7 - ext4 %s/dev/fakedevice0p1 rw,data=ordered`
 
 func (d *deviceSuite) TestDeviceFindFallbackNotFoundNoWritable(c *C) {
-	badMountInfo := `26 27 8:3 / /not-writable rw,relatime shared:7 - ext4 /dev/fakedevice0p1 rw,data=ordered`
-	restore := osutil.MockMountInfo(badMountInfo)
+	badMountInfoFmt := `26 27 8:3 / /not-writable rw,relatime shared:7 - ext4 %s/dev/fakedevice0p1 rw,data=ordered`
+	restore := osutil.MockMountInfo(fmt.Sprintf(badMountInfoFmt, d.dir))
 	defer restore()
 
 	found, offs, err := gadget.FindDeviceForStructureWithFallback(&gadget.LaidOutStructure{
@@ -308,11 +331,11 @@
 	})
 	c.Check(err, ErrorMatches, `device not found`)
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 }
 
 func (d *deviceSuite) TestDeviceFindFallbackBadWritable(c *C) {
-	restore := osutil.MockMountInfo(writableMountInfo)
+	restore := osutil.MockMountInfo(fmt.Sprintf(writableMountInfoFmt, d.dir))
 	defer restore()
 
 	ps := &gadget.LaidOutStructure{
@@ -323,9 +346,16 @@
 	}
 
 	found, offs, err := gadget.FindDeviceForStructureWithFallback(ps)
+	c.Check(err, ErrorMatches, `lstat .*/dev/fakedevice0p1: no such file or directory`)
+	c.Check(found, Equals, "")
+	c.Check(offs, Equals, quantity.Size(0))
+
+	c.Assert(ioutil.WriteFile(filepath.Join(d.dir, "dev/fakedevice0p1"), nil, 064), IsNil)
+
+	found, offs, err = gadget.FindDeviceForStructureWithFallback(ps)
 	c.Check(err, ErrorMatches, `unexpected number of matches \(0\) for /sys/block/\*/fakedevice0p1`)
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 
 	err = os.MkdirAll(filepath.Join(d.dir, "/sys/block/fakedevice0/fakedevice0p1"), 0755)
 	c.Assert(err, IsNil)
@@ -333,12 +363,12 @@
 	found, offs, err = gadget.FindDeviceForStructureWithFallback(ps)
 	c.Check(err, ErrorMatches, `device .*/dev/fakedevice0 does not exist`)
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 }
 
 func (d *deviceSuite) TestDeviceFindFallbackHappyWritable(c *C) {
 	d.setupMockSysfs(c)
-	restore := osutil.MockMountInfo(writableMountInfo)
+	restore := osutil.MockMountInfo(fmt.Sprintf(writableMountInfoFmt, d.dir))
 	defer restore()
 
 	psJustBare := &gadget.LaidOutStructure{
@@ -371,16 +401,16 @@
 		c.Check(err, IsNil)
 		c.Check(found, Equals, filepath.Join(d.dir, "/dev/fakedevice0"))
 		if ps.Type != "mbr" {
-			c.Check(offs, Equals, gadget.Size(123))
+			c.Check(offs, Equals, quantity.Size(123))
 		} else {
-			c.Check(offs, Equals, gadget.Size(0))
+			c.Check(offs, Equals, quantity.Size(0))
 		}
 	}
 }
 
 func (d *deviceSuite) TestDeviceFindFallbackNotForNamedWritable(c *C) {
 	d.setupMockSysfs(c)
-	restore := osutil.MockMountInfo(writableMountInfo)
+	restore := osutil.MockMountInfo(fmt.Sprintf(writableMountInfoFmt, d.dir))
 	defer restore()
 
 	// should not hit the fallback path
@@ -393,12 +423,12 @@
 	found, offs, err := gadget.FindDeviceForStructureWithFallback(psNamed)
 	c.Check(err, Equals, gadget.ErrDeviceNotFound)
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 }
 
 func (d *deviceSuite) TestDeviceFindFallbackNotForFilesystem(c *C) {
 	d.setupMockSysfs(c)
-	restore := osutil.MockMountInfo(writableMountInfo)
+	restore := osutil.MockMountInfo(writableMountInfoFmt)
 	defer restore()
 
 	psFs := &gadget.LaidOutStructure{
@@ -411,7 +441,7 @@
 	found, offs, err := gadget.FindDeviceForStructureWithFallback(psFs)
 	c.Check(err, ErrorMatches, "internal error: cannot use with filesystem structures")
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 }
 
 func (d *deviceSuite) TestDeviceFindFallbackBadMountInfo(c *C) {
@@ -428,7 +458,7 @@
 	found, offs, err := gadget.FindDeviceForStructureWithFallback(psFs)
 	c.Check(err, ErrorMatches, "cannot read mount info: .*")
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 }
 
 func (d *deviceSuite) TestDeviceFindFallbackPassThrough(c *C) {
@@ -443,7 +473,7 @@
 	found, offs, err := gadget.FindDeviceForStructureWithFallback(ps)
 	c.Check(err, ErrorMatches, `candidate .*/dev/disk/by-partlabel/foo is not a symlink`)
 	c.Check(found, Equals, "")
-	c.Check(offs, Equals, gadget.Size(0))
+	c.Check(offs, Equals, quantity.Size(0))
 
 	// create a proper symlink
 	err = os.Remove(filepath.Join(d.dir, "/dev/disk/by-partlabel/foo"))
@@ -455,46 +485,7 @@
 	found, offs, err = gadget.FindDeviceForStructureWithFallback(ps)
 	c.Assert(err, IsNil)
 	c.Check(found, Equals, filepath.Join(d.dir, "/dev/fakedevice"))
-	c.Check(offs, Equals, gadget.Size(0))
-}
-
-func (d *deviceSuite) TestDeviceEncodeLabel(c *C) {
-	// Test output obtained with the following program:
-	//
-	// #include <string.h>
-	// #include <stdio.h>
-	// #include <blkid/blkid.h>
-	// int main(int argc, char *argv[]) {
-	//   char out[2048] = {0};
-	//   if (blkid_encode_string(argv[1], out, sizeof(out)) != 0) {
-	//     fprintf(stderr, "failed to encode string\n");
-	//     return 1;
-	//   }
-	//   fprintf(stdout, out);
-	//   return 0;
-	// }
-	for i, tc := range []struct {
-		what string
-		exp  string
-	}{
-		{"foo", "foo"},
-		{"foo bar", `foo\x20bar`},
-		{"foo/bar", `foo\x2fbar`},
-		{"foo:#.@bar", `foo:#.@bar`},
-		{"foo..bar", `foo..bar`},
-		{"foo/../bar", `foo\x2f..\x2fbar`},
-		{"foo\\bar", `foo\x5cbar`},
-		{"Новый_том", "Новый_том"},
-		{"befs_test", "befs_test"},
-		{"P01_S16A", "P01_S16A"},
-		{"pinkié pie", `pinkié\x20pie`},
-		{"(EFI Boot)", `\x28EFI\x20Boot\x29`},
-		{"[System Boot]", `\x5bSystem\x20Boot\x5d`},
-	} {
-		c.Logf("tc: %v %q", i, tc)
-		res := gadget.EncodeLabel(tc.what)
-		c.Check(res, Equals, tc.exp)
-	}
+	c.Check(offs, Equals, quantity.Size(0))
 }
 
 func (d *deviceSuite) TestDeviceFindMountPointErrorsWithBare(c *C) {
@@ -697,17 +688,71 @@
 	c.Check(found, Equals, "")
 }
 
-func (d *deviceSuite) TestParentDiskFromPartition(c *C) {
+func (d *deviceSuite) TestParentDiskFromMountSource(c *C) {
 	d.setupMockSysfs(c)
 
-	disk, err := gadget.ParentDiskFromPartition("/dev/fakedevice0p1")
+	disk, err := gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/fakedevice0p1"))
 	c.Assert(err, IsNil)
 	c.Check(disk, Matches, ".*/dev/fakedevice0")
 }
 
-func (d *deviceSuite) TestParentDiskFromPartitionError(c *C) {
+func (d *deviceSuite) TestParentDiskFromMountSourceBadSymlinkErr(c *C) {
+	d.setupMockSysfs(c)
+
+	err := os.Symlink("../bad-target", filepath.Join(d.dir, "/dev/mapper/bad-target-symlink"))
+	c.Assert(err, IsNil)
+
+	_, err = gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/mapper/bad-target-symlink"))
+	c.Assert(err, ErrorMatches, `cannot resolve mount source symlink .*/dev/mapper/bad-target-symlink: lstat .*/dev/bad-target: no such file or directory`)
+}
+
+func (d *deviceSuite) TestParentDiskFromMountSourceDeviceMapperHappy(c *C) {
+	d.setupMockSysfsForDevMapper(c)
+
+	disk, err := gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/mapper/data_crypt"))
+
+	c.Assert(err, IsNil)
+	c.Check(disk, Matches, ".*/dev/fakedevice")
+}
+
+func (d *deviceSuite) TestParentDiskFromMountSourceDeviceMapperErrGlob(c *C) {
 	d.setupMockSysfsForDevMapper(c)
 
-	_, err := gadget.ParentDiskFromPartition("/dev/mapper/nvme0n1p6_crypt")
-	c.Assert(err, ErrorMatches, `unexpected number of matches \(0\) for /sys/block/\*/nvme0n1p6_crypt`)
+	// break the intermediate slaves directory
+	c.Assert(os.RemoveAll(filepath.Join(d.dir, "/sys/block/dm-0/slaves/fakedevice0")), IsNil)
+
+	_, err := gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/mapper/data_crypt"))
+	c.Assert(err, ErrorMatches, "cannot resolve device mapper device dm-1: unexpected number of dm device dm-0 slaves: 0")
+
+	c.Assert(os.Chmod(filepath.Join(d.dir, "/sys/block/dm-0"), 0000), IsNil)
+	defer os.Chmod(filepath.Join(d.dir, "/sys/block/dm-0"), 0755)
+
+	_, err = gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/mapper/data_crypt"))
+	c.Assert(err, ErrorMatches, "cannot resolve device mapper device dm-1: unexpected number of dm device dm-0 slaves: 0")
+}
+
+func (d *deviceSuite) TestParentDiskFromMountSourceDeviceMapperErrTargetDevice(c *C) {
+	d.setupMockSysfsForDevMapper(c)
+
+	c.Assert(os.RemoveAll(filepath.Join(d.dir, "/sys/block/fakedevice")), IsNil)
+
+	_, err := gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/mapper/data_crypt"))
+	c.Assert(err, ErrorMatches, `unexpected number of matches \(0\) for /sys/block/\*/fakedevice0`)
+}
+
+func (d *deviceSuite) TestParentDiskFromMountSourceDeviceMapperLevels(c *C) {
+	err := os.Symlink("../dm-6", filepath.Join(d.dir, "/dev/mapper/data_crypt"))
+	c.Assert(err, IsNil)
+	for i := 6; i > 0; i-- {
+		err := ioutil.WriteFile(filepath.Join(d.dir, fmt.Sprintf("/dev/dm-%v", i)), nil, 0644)
+		c.Assert(err, IsNil)
+		err = os.MkdirAll(filepath.Join(d.dir, fmt.Sprintf("/sys/block/dm-%v/slaves/", i)), 0755)
+		c.Assert(err, IsNil)
+		// sys symlinks are relative too
+		err = os.Symlink(fmt.Sprintf("../../dm-%v", i-1), filepath.Join(d.dir, fmt.Sprintf("/sys/block/dm-%v/slaves/dm-%v", i, i-1)))
+		c.Assert(err, IsNil)
+	}
+
+	_, err = gadget.ParentDiskFromMountSource(filepath.Join(dirs.GlobalRootDir, "/dev/mapper/data_crypt"))
+	c.Assert(err, ErrorMatches, `cannot resolve device mapper device dm-6: too many levels`)
 }
diff -Nru snapd-2.45.1+20.04.2/gadget/edition/number.go snapd-2.48.3+20.04/gadget/edition/number.go
--- snapd-2.45.1+20.04.2/gadget/edition/number.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/edition/number.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,45 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package edition
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+)
+
+// Number can hold (and unmarshal) an edition number, used in
+// gadget.yaml and kernel.yaml to control whether updates should be
+// applied.
+type Number uint32
+
+func (e *Number) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var es string
+	if err := unmarshal(&es); err != nil {
+		return errors.New(`cannot unmarshal "edition"`)
+	}
+
+	u, err := strconv.ParseUint(es, 10, 32)
+	if err != nil {
+		return fmt.Errorf(`"edition" must be a positive number, not %q`, es)
+	}
+	*e = Number(u)
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/edition/number_test.go snapd-2.48.3+20.04/gadget/edition/number_test.go
--- snapd-2.45.1+20.04.2/gadget/edition/number_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/edition/number_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,69 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package edition_test
+
+import (
+	"testing"
+
+	. "gopkg.in/check.v1"
+	"gopkg.in/yaml.v2"
+
+	"github.com/snapcore/snapd/gadget/edition"
+)
+
+type editionSuite struct{}
+
+var _ = Suite(&editionSuite{})
+
+func TestCommand(t *testing.T) { TestingT(t) }
+
+var mockEditionYaml = []byte(`
+foo:
+  edition: 1
+`)
+
+func (s *editionSuite) TestUnmarshalIntegration(c *C) {
+	type editionStruct struct {
+		Edition edition.Number `yaml:"edition"`
+	}
+
+	for _, tc := range []struct {
+		input          string
+		expectedNumber edition.Number
+		expectedErr    string
+	}{
+		{"edition: 1", edition.Number(1), ""},
+		{"edition: 0", edition.Number(0), ""},
+		{"edition: 9999999", edition.Number(9999999), ""},
+		{"edition: -1", edition.Number(0), `"edition" must be a positive number, not "-1"`},
+		{"edition: random-string", edition.Number(0), `"edition" must be a positive number, not "random-string"`},
+		{"edition: NaN", edition.Number(0), `"edition" must be a positive number, not "NaN"`},
+		{"edition: 3.14", edition.Number(0), `"edition" must be a positive number, not "3.14"`},
+	} {
+		var en editionStruct
+		err := yaml.Unmarshal([]byte(tc.input), &en)
+		if tc.expectedErr != "" {
+			c.Assert(err, ErrorMatches, tc.expectedErr, Commentf(tc.input))
+		} else {
+			c.Assert(err, IsNil, Commentf(tc.input))
+			c.Check(en.Edition, Equals, tc.expectedNumber, Commentf(tc.input))
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/export_test.go snapd-2.48.3+20.04/gadget/export_test.go
--- snapd-2.45.1+20.04.2/gadget/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,7 +19,16 @@
 
 package gadget
 
-type ValidationState = validationState
+type (
+	ValidationState          = validationState
+	MountedFilesystemUpdater = mountedFilesystemUpdater
+	RawStructureUpdater      = rawStructureUpdater
+)
+
+type LsblkFilesystemInfo = lsblkFilesystemInfo
+type LsblkBlockDevice = lsblkBlockDevice
+type SFDiskPartitionTable = sfdiskPartitionTable
+type SFDiskPartition = sfdiskPartition
 
 var (
 	ValidateStructureType   = validateStructureType
@@ -31,10 +40,7 @@
 	CanUpdateStructure = canUpdateStructure
 	CanUpdateVolume    = canUpdateVolume
 
-	EncodeLabel = encodeLabel
-
-	WriteFile      = writeFileOrSymlink
-	WriteDirectory = writeDirectory
+	WriteFile = writeFileOrSymlink
 
 	RawContentBackupPath = rawContentBackupPath
 
@@ -43,6 +49,17 @@
 	EnsureVolumeConsistency = ensureVolumeConsistency
 
 	Flatten = flatten
+
+	FilesystemInfo                 = filesystemInfo
+	OnDiskVolumeFromPartitionTable = onDiskVolumeFromPartitionTable
+
+	NewRawStructureUpdater      = newRawStructureUpdater
+	NewMountedFilesystemUpdater = newMountedFilesystemUpdater
+
+	FindDeviceForStructureWithFallback = findDeviceForStructureWithFallback
+	FindMountPointForStructure         = findMountPointForStructure
+
+	ParseRelativeOffset = parseRelativeOffset
 )
 
 func MockEvalSymlinks(mock func(path string) (string, error)) (restore func()) {
@@ -53,10 +70,6 @@
 	}
 }
 
-func MockMkfsHandlers(mock map[string]MkfsFunc) (restore func()) {
-	old := mkfsHandlers
-	mkfsHandlers = mock
-	return func() {
-		mkfsHandlers = old
-	}
+func (m *MountedFilesystemWriter) WriteDirectory(volumeRoot, src, dst string, preserveInDst []string) error {
+	return m.writeDirectory(volumeRoot, src, dst, preserveInDst)
 }
diff -Nru snapd-2.45.1+20.04.2/gadget/filesystemimage.go snapd-2.48.3+20.04/gadget/filesystemimage.go
--- snapd-2.45.1+20.04.2/gadget/filesystemimage.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/filesystemimage.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,137 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/snapcore/snapd/logger"
-	"github.com/snapcore/snapd/osutil"
-)
-
-type MkfsFunc func(imgFile, label, contentsRootDir string) error
-
-var (
-	mkfsHandlers = map[string]MkfsFunc{
-		"vfat": MkfsVfat,
-		"ext4": MkfsExt4,
-	}
-)
-
-// FilesystemImageWriter is capable of creating filesystem images described by
-// laid out structures.
-type FilesystemImageWriter struct {
-	contentDir string
-	ps         *LaidOutStructure
-	workDir    string
-}
-
-// PostStageFunc is called after the filesystem contents for the given structure
-// have been staged at a temporary location, but before the filesystem image is
-// created. The function can be used to manipulate the staged data.
-type PostStageFunc func(rootDir string, ps *LaidOutStructure) error
-
-// NewFilesystemImageWriter returns a writer capable of creating filesystem
-// images corresponding to the provided structure, with content from the given
-// content directory. A staging directory will be created in either, the
-// optionally provided work directory, or the default temp location.
-func NewFilesystemImageWriter(contentDir string, ps *LaidOutStructure, workDir string) (*FilesystemImageWriter, error) {
-	if ps == nil {
-		return nil, fmt.Errorf("internal error: *LaidOutStructure is nil")
-	}
-	if !ps.HasFilesystem() {
-		return nil, fmt.Errorf("internal error: structure has no filesystem")
-	}
-	if contentDir == "" {
-		return nil, fmt.Errorf("internal error: gadget content directory cannot be unset")
-	}
-	if _, ok := mkfsHandlers[ps.Filesystem]; !ok {
-		return nil, fmt.Errorf("internal error: filesystem %q has no handler", ps.Filesystem)
-	}
-
-	fiw := &FilesystemImageWriter{
-		contentDir: contentDir,
-		ps:         ps,
-		workDir:    workDir,
-	}
-	return fiw, nil
-}
-
-// Write creates the filesystem inside the provided image file and populates it
-// with data according to content declartion of the structure. Content data is
-// staged in a temporary location. An optional post-stage helper function can be
-// used to manipulate the data before it is copied over to the image.
-func (f *FilesystemImageWriter) Write(fname string, postStage PostStageFunc) error {
-	st, err := os.Stat(fname)
-	if err != nil {
-		return fmt.Errorf("cannot stat image file: %v", err)
-	}
-	if sz := st.Size(); sz != int64(f.ps.Size) {
-		return fmt.Errorf("size of image file %v is different from declared structure size %v", sz, f.ps.Size)
-	}
-
-	mkfsWithContent := mkfsHandlers[f.ps.Filesystem]
-	if mkfsWithContent == nil {
-		return fmt.Errorf("internal error: filesystem %q has no handler", f.ps.Filesystem)
-	}
-
-	stagingDir := filepath.Join(f.workDir, fmt.Sprintf("snap-stage-content-part-%04d", f.ps.Index))
-	if osutil.IsDirectory(stagingDir) {
-		return fmt.Errorf("cannot prepare staging directory %s: path exists", stagingDir)
-	}
-
-	if err := os.Mkdir(stagingDir, 0755); err != nil {
-		return fmt.Errorf("cannot prepare staging directory: %v", err)
-	}
-
-	if os.Getenv("SNAP_DEBUG_IMAGE_NO_CLEANUP") == "" {
-		defer func() {
-			if err := os.RemoveAll(stagingDir); err != nil {
-				logger.Noticef("cannot remove filesystem staging directory %q: %v", stagingDir, err)
-			}
-		}()
-	}
-
-	// use a mounted filesystem writer to populate the staging directory
-	// with contents of given structure
-	mrw, err := NewMountedFilesystemWriter(f.contentDir, f.ps)
-	if err != nil {
-		return fmt.Errorf("cannot prepare filesystem writer for %v: %v", f.ps, err)
-	}
-	// drop all contents to the staging directory
-	if err := mrw.Write(stagingDir, nil); err != nil {
-		return fmt.Errorf("cannot prepare filesystem content: %v", err)
-	}
-
-	if postStage != nil {
-		if err := postStage(stagingDir, f.ps); err != nil {
-			return fmt.Errorf("post stage callback failed: %v", err)
-		}
-	}
-
-	// create a filesystem with contents of the staging directory
-	if err := mkfsWithContent(fname, f.ps.Label, stagingDir); err != nil {
-		return fmt.Errorf("cannot create %q filesystem: %v", f.ps.Filesystem, err)
-	}
-
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/filesystemimage_test.go snapd-2.48.3+20.04/gadget/filesystemimage_test.go
--- snapd-2.45.1+20.04.2/gadget/filesystemimage_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/filesystemimage_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,440 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget_test
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type filesystemImageTestSuite struct {
-	testutil.BaseTest
-
-	dir       string
-	work      string
-	content   string
-	psTrivial *gadget.LaidOutStructure
-}
-
-var _ = Suite(&filesystemImageTestSuite{})
-
-func (s *filesystemImageTestSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
-
-	s.dir = c.MkDir()
-	// work directory
-	s.work = filepath.Join(s.dir, "work")
-	err := os.MkdirAll(s.work, 0755)
-	c.Assert(err, IsNil)
-
-	// gadget content directory
-	s.content = filepath.Join(s.dir, "content")
-
-	s.psTrivial = &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "happyfs",
-			Size:       2 * gadget.SizeMiB,
-			Content:    []gadget.VolumeContent{},
-		},
-		Index: 1,
-	}
-}
-
-func (s *filesystemImageTestSuite) TearDownTest(c *C) {
-	s.BaseTest.TearDownTest(c)
-}
-
-func (s *filesystemImageTestSuite) imgForPs(c *C, ps *gadget.LaidOutStructure) string {
-	c.Assert(ps, NotNil)
-	img := filepath.Join(s.dir, "img")
-	makeSizedFile(c, img, ps.Size, nil)
-	return img
-}
-
-type filesystemImageMockedTestSuite struct {
-	filesystemImageTestSuite
-}
-
-var _ = Suite(&filesystemImageMockedTestSuite{})
-
-func (s *filesystemImageMockedTestSuite) SetUpTest(c *C) {
-	s.filesystemImageTestSuite.SetUpTest(c)
-
-	unexpectedMkfs := func(imgFile, label, contentsRootDir string) error {
-		return errors.New("unexpected mkfs call")
-	}
-	s.AddCleanup(gadget.MockMkfsHandlers(map[string]gadget.MkfsFunc{
-		"happyfs": unexpectedMkfs,
-	}))
-}
-
-func (s *filesystemImageMockedTestSuite) TearDownTest(c *C) {
-	s.filesystemImageTestSuite.TearDownTest(c)
-}
-
-func (s *filesystemImageMockedTestSuite) TestSimpleErrors(c *C) {
-	psValid := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "ext4",
-			Size:       2 * gadget.SizeMiB,
-		},
-	}
-
-	fiw, err := gadget.NewFilesystemImageWriter("", psValid, "")
-	c.Assert(err, ErrorMatches, "internal error: gadget content directory cannot be unset")
-	c.Assert(fiw, IsNil)
-
-	fiw, err = gadget.NewFilesystemImageWriter(s.dir, nil, "")
-	c.Assert(err, ErrorMatches, `internal error: \*LaidOutStructure is nil`)
-	c.Assert(fiw, IsNil)
-
-	psNoFs := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "none",
-			Size:       2 * gadget.SizeMiB,
-		},
-	}
-
-	fiw, err = gadget.NewFilesystemImageWriter(s.dir, psNoFs, "")
-	c.Assert(err, ErrorMatches, "internal error: structure has no filesystem")
-	c.Assert(fiw, IsNil)
-
-	psInvalidFs := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "xfs",
-			Size:       2 * gadget.SizeMiB,
-		},
-	}
-	fiw, err = gadget.NewFilesystemImageWriter(s.dir, psInvalidFs, "")
-	c.Assert(err, ErrorMatches, `internal error: filesystem "xfs" has no handler`)
-	c.Assert(fiw, IsNil)
-}
-
-func (s *filesystemImageMockedTestSuite) TestHappyFull(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "happyfs",
-			Label:      "so-happy",
-			Size:       2 * gadget.SizeMiB,
-			Content: []gadget.VolumeContent{
-				{Source: "/foo", Target: "/"},
-			},
-		},
-		Index: 2,
-	}
-
-	// image file
-	img := s.imgForPs(c, ps)
-
-	// mock gadget data
-	gd := []gadgetData{
-		{name: "foo", target: "foo", content: "hello foo"},
-	}
-	makeGadgetData(c, s.content, gd)
-
-	var cbCalled bool
-	var mkfsCalled bool
-
-	cb := func(rootDir string, cbPs *gadget.LaidOutStructure) error {
-		c.Assert(cbPs, DeepEquals, ps)
-		c.Assert(rootDir, Equals, filepath.Join(s.work, "snap-stage-content-part-0002"))
-		verifyWrittenGadgetData(c, rootDir, gd)
-
-		cbCalled = true
-		return nil
-	}
-
-	mkfsHappyFs := func(imgFile, label, contentsRootDir string) error {
-		c.Assert(imgFile, Equals, img)
-		c.Assert(label, Equals, "so-happy")
-		c.Assert(contentsRootDir, Equals, filepath.Join(s.work, "snap-stage-content-part-0002"))
-		mkfsCalled = true
-		return nil
-	}
-
-	restore := gadget.MockMkfsHandlers(map[string]gadget.MkfsFunc{
-		"happyfs": mkfsHappyFs,
-	})
-	defer restore()
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, ps, s.work)
-	c.Assert(err, IsNil)
-
-	err = fiw.Write(img, cb)
-	c.Assert(err, IsNil)
-	c.Assert(cbCalled, Equals, true)
-	c.Assert(mkfsCalled, Equals, true)
-	// nothing left in temporary staging location
-	matches, err := filepath.Glob(s.work + "/*")
-	c.Assert(err, IsNil)
-	c.Assert(matches, HasLen, 0)
-}
-
-func (s *filesystemImageMockedTestSuite) TestPostStageOptional(c *C) {
-	var mkfsCalled bool
-	mkfsHappyFs := func(imgFile, label, contentsRootDir string) error {
-		mkfsCalled = true
-		return nil
-	}
-
-	restore := gadget.MockMkfsHandlers(map[string]gadget.MkfsFunc{
-		"happyfs": mkfsHappyFs,
-	})
-	defer restore()
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, s.psTrivial, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, s.psTrivial)
-
-	err = fiw.Write(img, nil)
-	c.Assert(err, IsNil)
-	c.Assert(mkfsCalled, Equals, true)
-}
-
-func (s *filesystemImageMockedTestSuite) TestChecksImage(c *C) {
-	cb := func(rootDir string, cbPs *gadget.LaidOutStructure) error {
-		return errors.New("unexpected call")
-	}
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, s.psTrivial, s.work)
-	c.Assert(err, IsNil)
-
-	img := filepath.Join(s.dir, "img")
-
-	// no image file
-	err = fiw.Write(img, cb)
-	c.Assert(err, ErrorMatches, "cannot stat image file: .*/img: no such file or directory")
-
-	// image file smaller than expected
-	makeSizedFile(c, img, s.psTrivial.Size/2, nil)
-
-	err = fiw.Write(img, cb)
-	c.Assert(err, ErrorMatches, fmt.Sprintf("size of image file %v is different from declared structure size %v", s.psTrivial.Size/2, s.psTrivial.Size))
-}
-
-func (s *filesystemImageMockedTestSuite) TestPostStageError(c *C) {
-	cb := func(rootDir string, cbPs *gadget.LaidOutStructure) error {
-		return errors.New("post stage exploded")
-	}
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, s.psTrivial, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, s.psTrivial)
-
-	err = fiw.Write(img, cb)
-	c.Assert(err, ErrorMatches, "post stage callback failed: post stage exploded")
-}
-
-func (s *filesystemImageMockedTestSuite) TestMkfsError(c *C) {
-	mkfsHappyFs := func(imgFile, label, contentsRootDir string) error {
-		return errors.New("will not mkfs")
-	}
-	restore := gadget.MockMkfsHandlers(map[string]gadget.MkfsFunc{
-		"happyfs": mkfsHappyFs,
-	})
-	defer restore()
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, s.psTrivial, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, s.psTrivial)
-
-	err = fiw.Write(img, nil)
-	c.Assert(err, ErrorMatches, `cannot create "happyfs" filesystem: will not mkfs`)
-}
-
-func (s *filesystemImageMockedTestSuite) TestFilesystemExtraCheckError(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "happyfs",
-			Size:       2 * gadget.SizeMiB,
-			Content:    []gadget.VolumeContent{},
-		},
-	}
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, ps, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, ps)
-
-	// modify filesystem
-	ps.Filesystem = "foofs"
-
-	err = fiw.Write(img, nil)
-	c.Assert(err, ErrorMatches, `internal error: filesystem "foofs" has no handler`)
-}
-
-func (s *filesystemImageMockedTestSuite) TestMountedWriterError(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "happyfs",
-			Size:       2 * gadget.SizeMiB,
-			Content: []gadget.VolumeContent{
-				{Source: "/foo", Target: "/"},
-			},
-		},
-	}
-
-	cb := func(rootDir string, cbPs *gadget.LaidOutStructure) error {
-		return errors.New("unexpected call")
-	}
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, ps, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, ps)
-
-	// declared content does not exist in the content directory
-	err = fiw.Write(img, cb)
-	c.Assert(err, ErrorMatches, `cannot prepare filesystem content: cannot write filesystem content of source:/foo: .* no such file or directory`)
-}
-
-func (s *filesystemImageMockedTestSuite) TestBadWorkDirError(c *C) {
-	cb := func(rootDir string, cbPs *gadget.LaidOutStructure) error {
-		return errors.New("unexpected call")
-	}
-
-	badWork := filepath.Join(s.dir, "bad-work")
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, s.psTrivial, badWork)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, s.psTrivial)
-
-	err = fiw.Write(img, cb)
-	c.Assert(err, ErrorMatches, `cannot prepare staging directory: mkdir .*/bad-work/snap-stage-content-part-0001: no such file or directory`)
-
-	err = os.MkdirAll(filepath.Join(badWork, "snap-stage-content-part-0001"), 0755)
-	c.Assert(err, IsNil)
-
-	err = fiw.Write(img, cb)
-	c.Assert(err, ErrorMatches, `cannot prepare staging directory .*/bad-work/snap-stage-content-part-0001: path exists`)
-}
-
-func (s *filesystemImageMockedTestSuite) TestKeepsStagingDir(c *C) {
-	cb := func(rootDir string, cbPs *gadget.LaidOutStructure) error {
-		return nil
-	}
-	mkfsHappyFs := func(imgFile, label, contentsRootDir string) error {
-		return nil
-	}
-	restore := gadget.MockMkfsHandlers(map[string]gadget.MkfsFunc{
-		"happyfs": mkfsHappyFs,
-	})
-	defer restore()
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, s.psTrivial, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, s.psTrivial)
-
-	os.Setenv("SNAP_DEBUG_IMAGE_NO_CLEANUP", "1")
-	defer os.Unsetenv("SNAP_DEBUG_IMAGE_NO_CLEANUP")
-	err = fiw.Write(img, cb)
-	c.Assert(err, IsNil)
-
-	matches, err := filepath.Glob(s.work + "/*")
-	c.Assert(err, IsNil)
-	c.Assert(matches, HasLen, 1)
-	c.Assert(osutil.IsDirectory(filepath.Join(s.work, "snap-stage-content-part-0001")), Equals, true)
-}
-
-type filesystemImageMkfsTestSuite struct {
-	filesystemImageTestSuite
-
-	cmdFakeroot *testutil.MockCmd
-	cmdMkfsVfat *testutil.MockCmd
-	cmdMcopy    *testutil.MockCmd
-}
-
-func (s *filesystemImageMkfsTestSuite) SetUpTest(c *C) {
-	s.filesystemImageTestSuite.SetUpTest(c)
-
-	// mkfs.ext4 is called via fakeroot wrapper
-	s.cmdFakeroot = testutil.MockCommand(c, "fakeroot", "")
-	s.AddCleanup(s.cmdFakeroot.Restore)
-
-	s.cmdMkfsVfat = testutil.MockCommand(c, "mkfs.vfat", "")
-	s.AddCleanup(s.cmdMkfsVfat.Restore)
-
-	s.cmdMcopy = testutil.MockCommand(c, "mcopy", "")
-	s.AddCleanup(s.cmdMcopy.Restore)
-}
-
-func (s *filesystemImageMkfsTestSuite) TearDownTest(c *C) {
-	s.filesystemImageTestSuite.TearDownTest(c)
-}
-
-var _ = Suite(&filesystemImageMkfsTestSuite{})
-
-func (s *filesystemImageMkfsTestSuite) TestExt4(c *C) {
-	psExt4 := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "ext4",
-			Size:       2 * gadget.SizeMiB,
-			Content:    []gadget.VolumeContent{{Source: "/", Target: "/"}},
-		},
-	}
-
-	makeSizedFile(c, filepath.Join(s.content, "foo"), 1024, nil)
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, psExt4, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, psExt4)
-	err = fiw.Write(img, nil)
-	c.Assert(err, IsNil)
-
-	c.Check(s.cmdFakeroot.Calls(), HasLen, 1)
-	c.Check(s.cmdMkfsVfat.Calls(), HasLen, 0)
-	c.Check(s.cmdMcopy.Calls(), HasLen, 0)
-}
-
-func (s *filesystemImageMkfsTestSuite) TestVfat(c *C) {
-	psVfat := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Filesystem: "vfat",
-			Size:       2 * gadget.SizeMiB,
-			Content:    []gadget.VolumeContent{{Source: "/", Target: "/"}},
-		},
-	}
-
-	makeSizedFile(c, filepath.Join(s.content, "foo"), 1024, nil)
-
-	fiw, err := gadget.NewFilesystemImageWriter(s.content, psVfat, s.work)
-	c.Assert(err, IsNil)
-
-	img := s.imgForPs(c, psVfat)
-	err = fiw.Write(img, nil)
-	c.Assert(err, IsNil)
-
-	c.Check(s.cmdFakeroot.Calls(), HasLen, 0)
-	c.Check(s.cmdMkfsVfat.Calls(), HasLen, 1)
-	c.Check(s.cmdMcopy.Calls(), HasLen, 1)
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/gadget.go snapd-2.48.3+20.04/gadget/gadget.go
--- snapd-2.45.1+20.04.2/gadget/gadget.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/gadget.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,17 +23,17 @@
 	"errors"
 	"fmt"
 	"io/ioutil"
-	"math"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
-	"strconv"
 	"strings"
 
 	"gopkg.in/yaml.v2"
 
 	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/gadget/edition"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/metautil"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/naming"
@@ -41,25 +41,27 @@
 )
 
 const (
-	// MBR identifies a Master Boot Record partitioning schema, or an MBR like role
-	MBR = "mbr"
-	// GPT identifies a GUID Partition Table partitioning schema
-	GPT = "gpt"
+	// schemaMBR identifies a Master Boot Record partitioning schema, or an
+	// MBR like role
+	schemaMBR = "mbr"
+	// schemaGPT identifies a GUID Partition Table partitioning schema
+	schemaGPT = "gpt"
 
 	SystemBoot = "system-boot"
 	SystemData = "system-data"
 	SystemSeed = "system-seed"
+	SystemSave = "system-save"
 
-	BootImage  = "system-boot-image"
-	BootSelect = "system-boot-select"
+	bootImage  = "system-boot-image"
+	bootSelect = "system-boot-select"
 
-	// ImplicitSystemDataLabel is the implicit filesystem label of structure
+	// implicitSystemDataLabel is the implicit filesystem label of structure
 	// of system-data role
-	ImplicitSystemDataLabel = "writable"
+	implicitSystemDataLabel = "writable"
 
 	// only supported for legacy reasons
-	LegacyBootImage  = "bootimg"
-	LegacyBootSelect = "bootselect"
+	legacyBootImage  = "bootimg"
+	legacyBootSelect = "bootselect"
 )
 
 var (
@@ -92,7 +94,7 @@
 
 func (v *Volume) EffectiveSchema() string {
 	if v.Schema == "" {
-		return GPT
+		return schemaGPT
 	}
 	return v.Schema
 }
@@ -106,13 +108,13 @@
 	// Label provides the filesystem label
 	Label string `yaml:"filesystem-label"`
 	// Offset defines a starting offset of the structure
-	Offset *Size `yaml:"offset"`
+	Offset *quantity.Size `yaml:"offset"`
 	// OffsetWrite describes a 32-bit address, within the volume, at which
 	// the offset of current structure will be written. The position may be
 	// specified as a byte offset relative to the start of a named structure
 	OffsetWrite *RelativeOffset `yaml:"offset-write"`
 	// Size of the structure
-	Size Size `yaml:"size"`
+	Size quantity.Size `yaml:"size"`
 	// Type of the structure, which can be 2-hex digit MBR partition,
 	// 36-char GUID partition, comma separated <mbr>,<guid> for hybrid
 	// partitioning schemes, or 'bare' when the structure is not considered
@@ -144,7 +146,7 @@
 // IsPartition returns true when the structure describes a partition in a block
 // device.
 func (vs *VolumeStructure) IsPartition() bool {
-	return vs.Type != "bare" && vs.EffectiveRole() != MBR
+	return vs.Type != "bare" && vs.EffectiveRole() != schemaMBR
 }
 
 // EffectiveRole returns the role of given structure
@@ -152,8 +154,8 @@
 	if vs.Role != "" {
 		return vs.Role
 	}
-	if vs.Role == "" && vs.Type == MBR {
-		return MBR
+	if vs.Role == "" && vs.Type == schemaMBR {
+		return schemaMBR
 	}
 	if vs.Label == SystemBoot {
 		// for gadgets that only specify a filesystem-label, eg. pc
@@ -166,7 +168,7 @@
 // explicitly provided or implied by the structure's role
 func (vs *VolumeStructure) EffectiveFilesystemLabel() string {
 	if vs.EffectiveRole() == SystemData {
-		return ImplicitSystemDataLabel
+		return implicitSystemDataLabel
 	}
 	return vs.Label
 }
@@ -185,14 +187,14 @@
 	// for a 'bare' type structure
 	Image string `yaml:"image"`
 	// Offset the image is written at
-	Offset *Size `yaml:"offset"`
+	Offset *quantity.Size `yaml:"offset"`
 	// OffsetWrite describes a 32-bit address, within the volume, at which
 	// the offset of current image will be written. The position may be
 	// specified as a byte offset relative to the start of a named structure
 	OffsetWrite *RelativeOffset `yaml:"offset-write"`
 	// Size of the image, when empty size is calculated by looking at the
 	// image
-	Size Size `yaml:"size"`
+	Size quantity.Size `yaml:"size"`
 
 	Unpack bool `yaml:"unpack"`
 }
@@ -205,8 +207,8 @@
 }
 
 type VolumeUpdate struct {
-	Edition  editionNumber `yaml:"edition"`
-	Preserve []string      `yaml:"preserve"`
+	Edition  edition.Number `yaml:"edition"`
+	Preserve []string       `yaml:"preserve"`
 }
 
 // GadgetConnect describes an interface connection requested by the gadget
@@ -380,18 +382,14 @@
 }
 
 // ReadInfo reads the gadget specific metadata from meta/gadget.yaml in the snap
-// root directory. If constraints is nil, ReadInfo will just check for
-// self-consistency, otherwise rules for the classic or system seed cases are
-// enforced.
+// root directory.
 func ReadInfo(gadgetSnapRootDir string, model Model) (*Info, error) {
 	gadgetYamlFn := filepath.Join(gadgetSnapRootDir, "meta", "gadget.yaml")
 	return readInfo(ioutil.ReadFile, gadgetYamlFn, model)
 }
 
 // ReadInfoFromSnapFile reads the gadget specific metadata from
-// meta/gadget.yaml in the given snap container. If constraints is
-// nil, ReadInfo will just check for self-consistency, otherwise rules
-// for the classic or system seed cases are enforced.
+// meta/gadget.yaml in the given snap container.
 func ReadInfoFromSnapFile(snapf snap.Container, model Model) (*Info, error) {
 	gadgetYamlFn := "meta/gadget.yaml"
 	return readInfo(snapf.ReadFile, gadgetYamlFn, model)
@@ -408,13 +406,14 @@
 	SystemSeed *VolumeStructure
 	SystemData *VolumeStructure
 	SystemBoot *VolumeStructure
+	SystemSave *VolumeStructure
 }
 
 func validateVolume(name string, vol *Volume, model Model) error {
 	if !validVolumeName.MatchString(name) {
 		return errors.New("invalid name")
 	}
-	if vol.Schema != "" && vol.Schema != GPT && vol.Schema != MBR {
+	if vol.Schema != "" && vol.Schema != schemaGPT && vol.Schema != schemaMBR {
 		return fmt.Errorf("invalid schema %q", vol.Schema)
 	}
 
@@ -426,12 +425,12 @@
 	structures := make([]LaidOutStructure, len(vol.Structure))
 
 	state := &validationState{}
-	previousEnd := Size(0)
+	previousEnd := quantity.Size(0)
 	for idx, s := range vol.Structure {
 		if err := validateVolumeStructure(&s, vol); err != nil {
 			return fmt.Errorf("invalid structure %v: %v", fmtIndexAndName(idx, s.Name), err)
 		}
-		var start Size
+		var start quantity.Size
 		if s.Offset != nil {
 			start = *s.Offset
 		} else {
@@ -474,6 +473,11 @@
 				return fmt.Errorf("cannot have more than one partition with system-boot role")
 			}
 			state.SystemBoot = &vol.Structure[idx]
+		case SystemSave:
+			if state.SystemSave != nil {
+				return fmt.Errorf("cannot have more than one partition with system-save role")
+			}
+			state.SystemSave = &vol.Structure[idx]
 		}
 
 		previousEnd = end
@@ -492,18 +496,23 @@
 func ensureVolumeConsistencyNoConstraints(state *validationState) error {
 	switch {
 	case state.SystemSeed == nil && state.SystemData == nil:
-		return nil
+		// happy so far
 	case state.SystemSeed != nil && state.SystemData == nil:
 		return fmt.Errorf("the system-seed role requires system-data to be defined")
 	case state.SystemSeed == nil && state.SystemData != nil:
-		if state.SystemData.Label != "" && state.SystemData.Label != ImplicitSystemDataLabel {
-			return fmt.Errorf("system-data structure must have an implicit label or %q, not %q", ImplicitSystemDataLabel, state.SystemData.Label)
+		if state.SystemData.Label != "" && state.SystemData.Label != implicitSystemDataLabel {
+			return fmt.Errorf("system-data structure must have an implicit label or %q, not %q", implicitSystemDataLabel, state.SystemData.Label)
 		}
 	case state.SystemSeed != nil && state.SystemData != nil:
 		if err := ensureSeedDataLabelsUnset(state); err != nil {
 			return err
 		}
 	}
+	if state.SystemSave != nil {
+		if err := ensureSystemSaveConsistency(state); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
@@ -513,7 +522,6 @@
 		if wantsSystemSeed(model) {
 			return fmt.Errorf("model requires system-seed partition, but no system-seed or system-data partition found")
 		}
-		return nil
 	case state.SystemSeed != nil && state.SystemData == nil:
 		return fmt.Errorf("the system-seed role requires system-data to be defined")
 	case state.SystemSeed == nil && state.SystemData != nil:
@@ -522,9 +530,9 @@
 			return fmt.Errorf("model requires system-seed structure, but none was found")
 		}
 		// without SystemSeed, system-data label must be implicit or writable
-		if state.SystemData != nil && state.SystemData.Label != "" && state.SystemData.Label != ImplicitSystemDataLabel {
+		if state.SystemData.Label != "" && state.SystemData.Label != implicitSystemDataLabel {
 			return fmt.Errorf("system-data structure must have an implicit label or %q, not %q",
-				ImplicitSystemDataLabel, state.SystemData.Label)
+				implicitSystemDataLabel, state.SystemData.Label)
 		}
 	case state.SystemSeed != nil && state.SystemData != nil:
 		// error if we don't have the SystemSeed constraint but we have a system-seed structure
@@ -535,6 +543,11 @@
 			return err
 		}
 	}
+	if state.SystemSave != nil {
+		if err := ensureSystemSaveConsistency(state); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
@@ -552,18 +565,27 @@
 	if state.SystemSeed.Label != "" {
 		return fmt.Errorf("system-seed structure must not have a label")
 	}
+	return nil
+}
 
+func ensureSystemSaveConsistency(state *validationState) error {
+	if state.SystemData == nil || state.SystemSeed == nil {
+		return fmt.Errorf("system-save requires system-seed and system-data structures")
+	}
+	if state.SystemSave.Label != "" {
+		return fmt.Errorf("system-save structure must not have a label")
+	}
 	return nil
 }
 
 func validateCrossVolumeStructure(structures []LaidOutStructure, knownStructures map[string]*LaidOutStructure) error {
-	previousEnd := Size(0)
+	previousEnd := quantity.Size(0)
 	// cross structure validation:
 	// - relative offsets that reference other structures by name
 	// - laid out structure overlap
 	// use structures laid out within the volume
 	for pidx, ps := range structures {
-		if ps.EffectiveRole() == MBR {
+		if ps.EffectiveRole() == schemaMBR {
 			if ps.StartOffset != 0 {
 				return fmt.Errorf(`structure %v has "mbr" role and must start at offset 0`, ps)
 			}
@@ -601,6 +623,31 @@
 	return nil
 }
 
+var (
+	reservedLabels = []string{
+		// 2020-12-02 disabled because of customer gadget hotfix
+		/*ubuntuBootLabel,*/
+		ubuntuSeedLabel,
+		ubuntuDataLabel,
+		ubuntuSaveLabel,
+	}
+)
+
+func validateReservedLabels(vs *VolumeStructure) error {
+	if vs.Role != "" {
+		// structure specifies a role, its labels will be checked later
+		return nil
+	}
+	if vs.Label == "" {
+		return nil
+	}
+	if strutil.ListContains(reservedLabels, vs.Label) {
+		// a structure without a role uses one of reserved labels
+		return fmt.Errorf("label %q is reserved", vs.Label)
+	}
+	return nil
+}
+
 func validateVolumeStructure(vs *VolumeStructure, vol *Volume) error {
 	if vs.Size == 0 {
 		return errors.New("missing size")
@@ -638,6 +685,10 @@
 		return err
 	}
 
+	if err := validateReservedLabels(vs); err != nil {
+		return err
+	}
+
 	// TODO: validate structure size against sector-size; ubuntu-image uses
 	// a tmp file to find out the default sector size of the device the tmp
 	// file is created on
@@ -657,7 +708,7 @@
 
 	schema := vol.Schema
 	if schema == "" {
-		schema = GPT
+		schema = schemaGPT
 	}
 
 	if s == "" {
@@ -669,7 +720,7 @@
 		return nil
 	}
 
-	if s == MBR {
+	if s == schemaMBR {
 		// backward compatibility for type: mbr
 		return nil
 	}
@@ -696,11 +747,11 @@
 		}
 	}
 
-	if schema != GPT && isGPT {
+	if schema != schemaGPT && isGPT {
 		// type: <uuid> is only valid for GPT volumes
 		return fmt.Errorf("GUID structure type with non-GPT schema %q", vol.Schema)
 	}
-	if schema != MBR && isMBR {
+	if schema != schemaMBR && isMBR {
 		return fmt.Errorf("MBR structure type with non-MBR schema %q", vol.Schema)
 	}
 
@@ -709,24 +760,24 @@
 
 func validateRole(vs *VolumeStructure, vol *Volume) error {
 	if vs.Type == "bare" {
-		if vs.Role != "" && vs.Role != MBR {
+		if vs.Role != "" && vs.Role != schemaMBR {
 			return fmt.Errorf("conflicting type: %q", vs.Type)
 		}
 	}
 	vsRole := vs.Role
-	if vs.Type == MBR {
-		if vsRole != "" && vsRole != MBR {
+	if vs.Type == schemaMBR {
+		if vsRole != "" && vsRole != schemaMBR {
 			return fmt.Errorf(`conflicting legacy type: "mbr"`)
 		}
 		// backward compatibility
-		vsRole = MBR
+		vsRole = schemaMBR
 	}
 
 	switch vsRole {
-	case SystemData, SystemSeed:
+	case SystemData, SystemSeed, SystemSave:
 		// roles have cross dependencies, consistency checks are done at
 		// the volume level
-	case MBR:
+	case schemaMBR:
 		if vs.Size > SizeMBR {
 			return errors.New("mbr structures cannot be larger than 446 bytes")
 		}
@@ -739,9 +790,9 @@
 		if vs.Filesystem != "" && vs.Filesystem != "none" {
 			return errors.New("mbr structures must not specify a file system")
 		}
-	case SystemBoot, BootImage, BootSelect, "":
+	case SystemBoot, bootImage, bootSelect, "":
 		// noop
-	case LegacyBootImage, LegacyBootSelect:
+	case legacyBootImage, legacyBootSelect:
 		// noop
 		// legacy role names were added in 2.42 can be removed
 		// on snapd epoch bump
@@ -786,107 +837,14 @@
 	return nil
 }
 
-type editionNumber uint32
-
-func (e *editionNumber) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	var es string
-	if err := unmarshal(&es); err != nil {
-		return errors.New(`cannot unmarshal "edition"`)
-	}
-
-	u, err := strconv.ParseUint(es, 10, 32)
-	if err != nil {
-		return fmt.Errorf(`"edition" must be a positive number, not %q`, es)
-	}
-	*e = editionNumber(u)
-	return nil
-}
-
-// Size describes the size of a structure item or an offset within the
-// structure.
-type Size uint64
-
 const (
-	SizeKiB = Size(1 << 10)
-	SizeMiB = Size(1 << 20)
-	SizeGiB = Size(1 << 30)
-
 	// SizeMBR is the maximum byte size of a structure of role 'mbr'
-	SizeMBR = Size(446)
+	SizeMBR = quantity.Size(446)
 	// SizeLBA48Pointer is the byte size of a pointer value written at the
 	// location described by 'offset-write'
-	SizeLBA48Pointer = Size(4)
+	SizeLBA48Pointer = quantity.Size(4)
 )
 
-func (s *Size) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	var gs string
-	if err := unmarshal(&gs); err != nil {
-		return errors.New(`cannot unmarshal gadget size`)
-	}
-
-	var err error
-	*s, err = ParseSize(gs)
-	if err != nil {
-		return fmt.Errorf("cannot parse size %q: %v", gs, err)
-	}
-	return err
-}
-
-// ParseSize parses a string expressing size in gadget declaration. The
-// accepted format is one of: <bytes> | <bytes/2^20>M | <bytes/2^30>G.
-func ParseSize(gs string) (Size, error) {
-	number, unit, err := strutil.SplitUnit(gs)
-	if err != nil {
-		return 0, err
-	}
-	if number < 0 {
-		return 0, errors.New("size cannot be negative")
-	}
-	var size Size
-	switch unit {
-	case "M":
-		// MiB
-		size = Size(number) * SizeMiB
-	case "G":
-		// GiB
-		size = Size(number) * SizeGiB
-	case "":
-		// straight bytes
-		size = Size(number)
-	default:
-		return 0, fmt.Errorf("invalid suffix %q", unit)
-	}
-	return size, nil
-}
-
-func (s *Size) String() string {
-	if s == nil {
-		return "unspecified"
-	}
-	return fmt.Sprintf("%d", *s)
-}
-
-// IECString formats the size using multiples from IEC units (i.e. kibibytes,
-// mebibytes), that is as multiples of 1024. Printed values are truncated to 2
-// decimal points.
-func (s *Size) IECString() string {
-	maxFloat := float64(1023.5)
-	r := float64(*s)
-	unit := "B"
-	for _, rangeUnit := range []string{"KiB", "MiB", "GiB", "TiB", "PiB"} {
-		if r < maxFloat {
-			break
-		}
-		r /= 1024
-		unit = rangeUnit
-	}
-	precision := 0
-	if math.Floor(r) != r {
-		precision = 2
-	}
-	return fmt.Sprintf("%.*f %s", precision, r, unit)
-}
-
 // RelativeOffset describes an offset where structure data is written at.
 // The position can be specified as byte-offset relative to the start of another
 // named structure.
@@ -895,7 +853,7 @@
 	// address write will be calculated.
 	RelativeTo string
 	// Offset is a 32-bit value
-	Offset Size
+	Offset quantity.Size
 }
 
 func (r *RelativeOffset) String() string {
@@ -908,9 +866,9 @@
 	return fmt.Sprintf("%d", r.Offset)
 }
 
-// ParseRelativeOffset parses a string describing an offset that can be
+// parseRelativeOffset parses a string describing an offset that can be
 // expressed relative to a named structure, with the format: [<name>+]<size>.
-func ParseRelativeOffset(grs string) (*RelativeOffset, error) {
+func parseRelativeOffset(grs string) (*RelativeOffset, error) {
 	toWhat := ""
 	sizeSpec := grs
 	if idx := strings.IndexRune(grs, '+'); idx != -1 {
@@ -923,11 +881,11 @@
 		return nil, errors.New("missing offset")
 	}
 
-	size, err := ParseSize(sizeSpec)
+	size, err := quantity.ParseSize(sizeSpec)
 	if err != nil {
 		return nil, fmt.Errorf("cannot parse offset %q: %v", sizeSpec, err)
 	}
-	if size > 4*SizeGiB {
+	if size > 4*quantity.SizeGiB {
 		return nil, fmt.Errorf("offset above 4G limit")
 	}
 
@@ -943,7 +901,7 @@
 		return errors.New(`cannot unmarshal gadget relative offset`)
 	}
 
-	ro, err := ParseRelativeOffset(grs)
+	ro, err := parseRelativeOffset(grs)
 	if err != nil {
 		return fmt.Errorf("cannot parse relative offset %q: %v", grs, err)
 	}
@@ -988,12 +946,6 @@
 // PositionedVolumeFromGadget takes a gadget rootdir and positions the
 // partitions as specified.
 func PositionedVolumeFromGadget(gadgetRoot string) (*LaidOutVolume, error) {
-	// TODO:UC20: since this is unconstrained via the model, it returns an
-	//            err == nil and an empty info when the gadgetRoot does not
-	//            actually contain the required gadget.yaml file (for example
-	//            when you have a typo in the args to snap-bootstrap
-	//            create-partitions). anyways just verify this more because
-	//            otherwise it's unhelpful :-/
 	info, err := ReadInfo(gadgetRoot, nil)
 	if err != nil {
 		return nil, err
@@ -1004,7 +956,7 @@
 	}
 
 	constraints := LayoutConstraints{
-		NonMBRStartOffset: 1 * SizeMiB,
+		NonMBRStartOffset: 1 * quantity.SizeMiB,
 		SectorSize:        512,
 	}
 
diff -Nru snapd-2.45.1+20.04.2/gadget/gadget_test.go snapd-2.48.3+20.04/gadget/gadget_test.go
--- snapd-2.45.1+20.04.2/gadget/gadget_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/gadget_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,6 +34,7 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/snap/snapfile"
 	"github.com/snapcore/snapd/snap/snaptest"
 )
@@ -287,8 +288,8 @@
 
 func TestRun(t *testing.T) { TestingT(t) }
 
-func mustParseGadgetSize(c *C, s string) gadget.Size {
-	gs, err := gadget.ParseSize(s)
+func mustParseGadgetSize(c *C, s string) quantity.Size {
+	gs, err := quantity.ParseSize(s)
 	c.Assert(err, IsNil)
 	return gs
 }
@@ -432,8 +433,8 @@
 	})
 }
 
-func asSizePtr(size gadget.Size) *gadget.Size {
-	gsz := gadget.Size(size)
+func asSizePtr(size quantity.Size) *quantity.Size {
+	gsz := quantity.Size(size)
 	return &gsz
 }
 
@@ -454,7 +455,7 @@
 		},
 		Volumes: map[string]gadget.Volume{
 			"volumename": {
-				Schema:     gadget.MBR,
+				Schema:     "mbr",
 				Bootloader: "u-boot",
 				ID:         "0C",
 				Structure: []gadget.VolumeStructure{
@@ -494,7 +495,7 @@
 	c.Assert(ginfo, DeepEquals, &gadget.Info{
 		Volumes: map[string]gadget.Volume{
 			"frobinator-image": {
-				Schema:     gadget.MBR,
+				Schema:     "mbr",
 				Bootloader: "u-boot",
 				Structure: []gadget.VolumeStructure{
 					{
@@ -627,7 +628,7 @@
 	c.Assert(ginfo, DeepEquals, &gadget.Info{
 		Volumes: map[string]gadget.Volume{
 			"bootloader": {
-				Schema:     gadget.MBR,
+				Schema:     "mbr",
 				Bootloader: "u-boot",
 				ID:         "0C",
 				Structure: []gadget.VolumeStructure{
@@ -673,37 +674,6 @@
 	c.Check(err, ErrorMatches, `cannot parse gadget metadata: "edition" must be a positive number, not "-5"`)
 }
 
-func (s *gadgetYamlTestSuite) TestUnmarshalGadgetSize(c *C) {
-	type foo struct {
-		Size gadget.Size `yaml:"size"`
-	}
-
-	for i, tc := range []struct {
-		s   string
-		sz  gadget.Size
-		err string
-	}{
-		{"1234", 1234, ""},
-		{"1234M", 1234 * gadget.SizeMiB, ""},
-		{"1234G", 1234 * gadget.SizeGiB, ""},
-		{"0", 0, ""},
-		{"a0M", 0, `cannot parse size "a0M": no numerical prefix.*`},
-		{"-123", 0, `cannot parse size "-123": size cannot be negative`},
-		{"123a", 0, `cannot parse size "123a": invalid suffix "a"`},
-	} {
-		c.Logf("tc: %v", i)
-
-		var f foo
-		err := yaml.Unmarshal([]byte(fmt.Sprintf("size: %s", tc.s)), &f)
-		if tc.err != "" {
-			c.Check(err, ErrorMatches, tc.err)
-		} else {
-			c.Check(err, IsNil)
-			c.Check(f.Size, Equals, tc.sz)
-		}
-	}
-}
-
 func (s *gadgetYamlTestSuite) TestUnmarshalGadgetRelativeOffset(c *C) {
 	type foo struct {
 		OffsetWrite gadget.RelativeOffset `yaml:"offset-write"`
@@ -715,13 +685,13 @@
 		err string
 	}{
 		{"1234", &gadget.RelativeOffset{Offset: 1234}, ""},
-		{"1234M", &gadget.RelativeOffset{Offset: 1234 * gadget.SizeMiB}, ""},
-		{"4096M", &gadget.RelativeOffset{Offset: 4096 * gadget.SizeMiB}, ""},
+		{"1234M", &gadget.RelativeOffset{Offset: 1234 * quantity.SizeMiB}, ""},
+		{"4096M", &gadget.RelativeOffset{Offset: 4096 * quantity.SizeMiB}, ""},
 		{"0", &gadget.RelativeOffset{}, ""},
-		{"mbr+0", &gadget.RelativeOffset{RelativeTo: gadget.MBR}, ""},
-		{"foo+1234M", &gadget.RelativeOffset{RelativeTo: "foo", Offset: 1234 * gadget.SizeMiB}, ""},
-		{"foo+1G", &gadget.RelativeOffset{RelativeTo: "foo", Offset: 1 * gadget.SizeGiB}, ""},
-		{"foo+1G", &gadget.RelativeOffset{RelativeTo: "foo", Offset: 1 * gadget.SizeGiB}, ""},
+		{"mbr+0", &gadget.RelativeOffset{RelativeTo: "mbr"}, ""},
+		{"foo+1234M", &gadget.RelativeOffset{RelativeTo: "foo", Offset: 1234 * quantity.SizeMiB}, ""},
+		{"foo+1G", &gadget.RelativeOffset{RelativeTo: "foo", Offset: 1 * quantity.SizeGiB}, ""},
+		{"foo+1G", &gadget.RelativeOffset{RelativeTo: "foo", Offset: 1 * quantity.SizeGiB}, ""},
 		{"foo+4097M", nil, `cannot parse relative offset "foo\+4097M": offset above 4G limit`},
 		{"foo+", nil, `cannot parse relative offset "foo\+": missing offset`},
 		{"foo+++12", nil, `cannot parse relative offset "foo\+\+\+12": cannot parse offset "\+\+12": .*`},
@@ -801,11 +771,11 @@
 		// special case
 		{"bare", "", ""},
 		// plain MBR type
-		{"0C", "", gadget.MBR},
+		{"0C", "", "mbr"},
 		// GPT UUID
-		{"21686148-6449-6E6F-744E-656564454649", "", gadget.GPT},
+		{"21686148-6449-6E6F-744E-656564454649", "", "gpt"},
 		// GPT UUID (lowercase)
-		{"21686148-6449-6e6f-744e-656564454649", "", gadget.GPT},
+		{"21686148-6449-6e6f-744e-656564454649", "", "gpt"},
 		// hybrid ID
 		{"EF,21686148-6449-6E6F-744E-656564454649", "", ""},
 		// hybrid ID (UUID lowercase)
@@ -819,7 +789,7 @@
 		// plain MBR type without mbr schema
 		{"0C", `invalid type "0C": MBR structure type with non-MBR schema ""`, ""},
 		// GPT UUID with non GPT schema
-		{"21686148-6449-6E6F-744E-656564454649", `invalid type "21686148-6449-6E6F-744E-656564454649": GUID structure type with non-GPT schema "mbr"`, gadget.MBR},
+		{"21686148-6449-6E6F-744E-656564454649", `invalid type "21686148-6449-6E6F-744E-656564454649": GUID structure type with non-GPT schema "mbr"`, "mbr"},
 		// invalid
 		{"1234", `invalid type "1234": invalid format`, ""},
 		// outside of hex range
@@ -836,7 +806,7 @@
 		// hybrid, GPT UUID too long
 		{"EF,AAAA686148-6449-6E6F-744E-656564454649", `invalid type "EF,AAAA686148-6449-6E6F-744E-656564454649": invalid format of hybrid type`, ""},
 		// GPT schema with non GPT type
-		{"EF,AAAA686148-6449-6E6F-744E-656564454649", `invalid type "EF,AAAA686148-6449-6E6F-744E-656564454649": invalid format of hybrid type`, gadget.GPT},
+		{"EF,AAAA686148-6449-6E6F-744E-656564454649", `invalid type "EF,AAAA686148-6449-6E6F-744E-656564454649": invalid format of hybrid type`, "gpt"},
 	} {
 		c.Logf("tc: %v %q", i, tc.s)
 
@@ -894,6 +864,10 @@
 	validSystemSeed := uuidType + `
 role: system-seed
 `
+	validSystemSave := uuidType + `
+role: system-save
+size: 5M
+`
 	emptyRole := uuidType + `
 role: system-boot
 size: 123M
@@ -917,7 +891,7 @@
 type: mbr
 size: 447`
 	vol := &gadget.Volume{}
-	mbrVol := &gadget.Volume{Schema: gadget.MBR}
+	mbrVol := &gadget.Volume{Schema: "mbr"}
 	for i, tc := range []struct {
 		s   *gadget.VolumeStructure
 		v   *gadget.Volume
@@ -930,8 +904,8 @@
 		{mustParseStructure(c, bogusRole), vol, `invalid role "foobar": unsupported role`},
 		// the system-seed role
 		{mustParseStructure(c, validSystemSeed), vol, ""},
-		{mustParseStructure(c, validSystemSeed), vol, ""},
-		{mustParseStructure(c, validSystemSeed), vol, ""},
+		// system-save role
+		{mustParseStructure(c, validSystemSave), vol, ""},
 		// mbr
 		{mustParseStructure(c, mbrTooLarge), mbrVol, `invalid role "mbr": mbr structures cannot be larger than 446 bytes`},
 		{mustParseStructure(c, mbrBadOffset), mbrVol, `invalid role "mbr": mbr structure must start at offset 0`},
@@ -984,8 +958,8 @@
 		s   string
 		err string
 	}{
-		{gadget.GPT, ""},
-		{gadget.MBR, ""},
+		{"gpt", ""},
+		{"mbr", ""},
 		// implicit GPT
 		{"", ""},
 		// invalid
@@ -1045,8 +1019,8 @@
 func (s *gadgetYamlTestSuite) TestValidateVolumeDuplicateFsLabel(c *C) {
 	err := gadget.ValidateVolume("name", &gadget.Volume{
 		Structure: []gadget.VolumeStructure{
-			{Label: "foo", Type: "21686148-6449-6E6F-744E-656564454123", Size: gadget.SizeMiB},
-			{Label: "foo", Type: "21686148-6449-6E6F-744E-656564454649", Size: gadget.SizeMiB},
+			{Label: "foo", Type: "21686148-6449-6E6F-744E-656564454123", Size: quantity.SizeMiB},
+			{Label: "foo", Type: "21686148-6449-6E6F-744E-656564454649", Size: quantity.SizeMiB},
 		},
 	}, nil)
 	c.Assert(err, ErrorMatches, `filesystem label "foo" is not unique`)
@@ -1072,13 +1046,13 @@
 					Role:  gadget.SystemData,
 					Label: x.label,
 					Type:  "21686148-6449-6E6F-744E-656564454123",
-					Size:  gadget.SizeMiB,
+					Size:  quantity.SizeMiB,
 				}, {
 					Name:  "data2",
 					Role:  gadget.SystemData,
 					Label: x.label,
 					Type:  "21686148-6449-6E6F-744E-656564454649",
-					Size:  gadget.SizeMiB,
+					Size:  quantity.SizeMiB,
 				}},
 			}, constraints)
 			c.Assert(err, ErrorMatches, x.errMsg)
@@ -1091,12 +1065,12 @@
 			Name:  "boot1",
 			Label: "system-boot",
 			Type:  "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
-			Size:  gadget.SizeMiB,
+			Size:  quantity.SizeMiB,
 		}, {
 			Name:  "boot2",
 			Label: "system-boot",
 			Type:  "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
-			Size:  gadget.SizeMiB,
+			Size:  quantity.SizeMiB,
 		}},
 	}, nil)
 	c.Assert(err, ErrorMatches, `filesystem label "system-boot" is not unique`)
@@ -1314,6 +1288,38 @@
 	c.Check(err, IsNil)
 }
 
+func (s *gadgetYamlTestSuite) TestValidateStructureReservedLabels(c *C) {
+
+	gv := &gadget.Volume{}
+
+	for _, tc := range []struct {
+		role, label, err string
+	}{
+		{label: "ubuntu-seed", err: `label "ubuntu-seed" is reserved`},
+		// 2020-12-02: disable for customer hotfix
+		/*{label: "ubuntu-boot", err: `label "ubuntu-boot" is reserved`},*/
+		{label: "ubuntu-data", err: `label "ubuntu-data" is reserved`},
+		{label: "ubuntu-save", err: `label "ubuntu-save" is reserved`},
+		// these are ok
+		{role: "system-boot", label: "ubuntu-boot"},
+		{label: "random-ubuntu-label"},
+	} {
+		err := gadget.ValidateVolumeStructure(&gadget.VolumeStructure{
+			Type:       "21686148-6449-6E6F-744E-656564454649",
+			Role:       tc.role,
+			Filesystem: "ext4",
+			Label:      tc.label,
+			Size:       10 * 1024,
+		}, gv)
+		if tc.err == "" {
+			c.Check(err, IsNil)
+		} else {
+			c.Check(err, ErrorMatches, tc.err)
+		}
+	}
+
+}
+
 func (s *gadgetYamlTestSuite) TestValidateLayoutOverlapPreceding(c *C) {
 	overlappingGadgetYaml := `
 volumes:
@@ -1425,16 +1431,16 @@
 	c.Check(vs.EffectiveRole(), Equals, "")
 
 	// explicitly set role trumps all
-	vs = gadget.VolumeStructure{Role: "foobar", Type: gadget.MBR, Label: gadget.SystemBoot}
+	vs = gadget.VolumeStructure{Role: "foobar", Type: "mbr", Label: gadget.SystemBoot}
 
 	c.Check(vs.EffectiveRole(), Equals, "foobar")
 
-	vs = gadget.VolumeStructure{Role: gadget.MBR}
-	c.Check(vs.EffectiveRole(), Equals, gadget.MBR)
+	vs = gadget.VolumeStructure{Role: "mbr"}
+	c.Check(vs.EffectiveRole(), Equals, "mbr")
 
 	// legacy fallback
-	vs = gadget.VolumeStructure{Role: "", Type: gadget.MBR}
-	c.Check(vs.EffectiveRole(), Equals, gadget.MBR)
+	vs = gadget.VolumeStructure{Role: "", Type: "mbr"}
+	c.Check(vs.EffectiveRole(), Equals, "mbr")
 
 	// fallback role based on fs label applies only to system-boot
 	vs = gadget.VolumeStructure{Role: "", Label: gadget.SystemBoot}
@@ -1456,9 +1462,9 @@
 
 	// inferred based on role
 	vs = gadget.VolumeStructure{Role: gadget.SystemData, Label: "unused-label"}
-	c.Check(vs.EffectiveFilesystemLabel(), Equals, gadget.ImplicitSystemDataLabel)
+	c.Check(vs.EffectiveFilesystemLabel(), Equals, "writable")
 	vs = gadget.VolumeStructure{Role: gadget.SystemData}
-	c.Check(vs.EffectiveFilesystemLabel(), Equals, gadget.ImplicitSystemDataLabel)
+	c.Check(vs.EffectiveFilesystemLabel(), Equals, "writable")
 
 	// only system-data role is special
 	vs = gadget.VolumeStructure{Role: gadget.SystemBoot}
@@ -1532,6 +1538,26 @@
 	vs.SystemSeed = &gadget.VolumeStructure{}
 	err = gadget.EnsureVolumeConsistency(vs, nil)
 	c.Assert(err, ErrorMatches, "the system-seed role requires system-data to be defined")
+
+	// Check system-save
+	vsWithSave := &gadget.ValidationState{
+		SystemData: &gadget.VolumeStructure{},
+		SystemSeed: &gadget.VolumeStructure{},
+		SystemSave: &gadget.VolumeStructure{},
+	}
+	err = gadget.EnsureVolumeConsistency(vsWithSave, nil)
+	c.Assert(err, IsNil)
+	// use illegal label on system-save
+	vsWithSave.SystemSave.Label = "foo"
+	err = gadget.EnsureVolumeConsistency(vsWithSave, nil)
+	c.Assert(err, ErrorMatches, "system-save structure must not have a label")
+	// complains when either system-seed or system-data is missing
+	vsWithSave.SystemSeed = nil
+	err = gadget.EnsureVolumeConsistency(vsWithSave, nil)
+	c.Assert(err, ErrorMatches, "system-save requires system-seed and system-data structures")
+	vsWithSave.SystemData = nil
+	err = gadget.EnsureVolumeConsistency(vsWithSave, nil)
+	c.Assert(err, ErrorMatches, "system-save requires system-seed and system-data structures")
 }
 
 func (s *gadgetYamlTestSuite) TestGadgetConsistencyWithoutConstraints(c *C) {
@@ -1596,29 +1622,40 @@
     structure:`
 
 	for i, tc := range []struct {
-		role       string
-		label      string
-		systemSeed bool
-		err        string
+		addSeed     bool
+		dataLabel   string
+		requireSeed bool
+		addSave     bool
+		saveLabel   string
+		err         string
 	}{
 		// when constraints are nil, the system-seed role and ubuntu-data label on the
 		// system-data structure should be consistent
-		{"system-seed", "", true, ""},
-		{"system-seed", "", false, `.* model does not support the system-seed role`},
-		{"system-seed", "writable", true, ".* system-data structure must not have a label"},
-		{"system-seed", "writable", false, `.* model does not support the system-seed role`},
-		{"system-seed", "ubuntu-data", true, ".* system-data structure must not have a label"},
-		{"system-seed", "ubuntu-data", false, `.* model does not support the system-seed role`},
-		{"", "writable", true, `.* model requires system-seed structure, but none was found`},
-		{"", "writable", false, ""},
-		{"", "ubuntu-data", true, `.* model requires system-seed structure, but none was found`},
-		{"", "ubuntu-data", false, `.* must have an implicit label or "writable", not "ubuntu-data"`},
+		{addSeed: true, requireSeed: true},
+		{addSeed: true, err: `.* model does not support the system-seed role`},
+		{addSeed: true, dataLabel: "writable", requireSeed: true,
+			err: ".* system-data structure must not have a label"},
+		{addSeed: true, dataLabel: "writable",
+			err: `.* model does not support the system-seed role`},
+		{addSeed: true, dataLabel: "ubuntu-data", requireSeed: true,
+			err: ".* system-data structure must not have a label"},
+		{addSeed: true, dataLabel: "ubuntu-data",
+			err: `.* model does not support the system-seed role`},
+		{dataLabel: "writable", requireSeed: true,
+			err: `.* model requires system-seed structure, but none was found`},
+		{dataLabel: "writable"},
+		{dataLabel: "ubuntu-data", requireSeed: true,
+			err: `.* model requires system-seed structure, but none was found`},
+		{dataLabel: "ubuntu-data", err: `.* must have an implicit label or "writable", not "ubuntu-data"`},
+		{addSave: true, err: `.* system-save requires system-seed and system-data structures`},
+		{addSeed: true, requireSeed: true, addSave: true, saveLabel: "foo",
+			err: `.* system-save structure must not have a label`},
 	} {
-		c.Logf("tc: %v %v %v %v", i, tc.role, tc.label, tc.systemSeed)
+		c.Logf("tc: %v %v %v %v", i, tc.addSeed, tc.dataLabel, tc.requireSeed)
 		b := &bytes.Buffer{}
 
 		fmt.Fprintf(b, bloader)
-		if tc.role == "system-seed" {
+		if tc.addSeed {
 			fmt.Fprintf(b, `
       - name: Recovery
         size: 10M
@@ -1631,14 +1668,26 @@
         size: 10M
         type: 83
         role: system-data
-        filesystem-label: %s`, tc.label)
+        filesystem-label: %s`, tc.dataLabel)
+		if tc.addSave {
+			fmt.Fprintf(b, `
+      - name: Save
+        size: 10M
+        type: 83
+        role: system-save`)
+			if tc.saveLabel != "" {
+				fmt.Fprintf(b, `
+        filesystem-label: %s`, tc.saveLabel)
+
+			}
+		}
 
 		err := ioutil.WriteFile(s.gadgetYamlPath, b.Bytes(), 0644)
 		c.Assert(err, IsNil)
 
 		constraints := &modelConstraints{
 			classic:    false,
-			systemSeed: tc.systemSeed,
+			systemSeed: tc.requireSeed,
 		}
 
 		_, err = gadget.ReadInfo(s.dir, constraints)
@@ -2002,27 +2051,3 @@
 	err = gadget.IsCompatible(gi, giNew)
 	c.Check(err, IsNil)
 }
-
-type gadgetSizeTestSuite struct{}
-
-var _ = Suite(&gadgetSizeTestSuite{})
-
-func (s *gadgetSizeTestSuite) TestIECString(c *C) {
-	for _, tc := range []struct {
-		size gadget.Size
-		exp  string
-	}{
-		{512, "512 B"},
-		{1000, "1000 B"},
-		{1030, "1.01 KiB"},
-		{gadget.SizeKiB + 512, "1.50 KiB"},
-		{123 * gadget.SizeKiB, "123 KiB"},
-		{512 * gadget.SizeKiB, "512 KiB"},
-		{578 * gadget.SizeMiB, "578 MiB"},
-		{1*gadget.SizeGiB + 123*gadget.SizeMiB, "1.12 GiB"},
-		{1024 * gadget.SizeGiB, "1 TiB"},
-		{2 * 1024 * 1024 * 1024 * gadget.SizeGiB, "2048 PiB"},
-	} {
-		c.Check(tc.size.IECString(), Equals, tc.exp)
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/content.go snapd-2.48.3+20.04/gadget/install/content.go
--- snapd-2.45.1+20.04.2/gadget/install/content.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/content.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,140 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/internal"
+	"github.com/snapcore/snapd/logger"
+)
+
+var contentMountpoint string
+
+func init() {
+	contentMountpoint = filepath.Join(dirs.SnapRunDir, "gadget-install")
+}
+
+// makeFilesystem creates a filesystem on the on-disk structure, according
+// to the filesystem type defined in the gadget.
+func makeFilesystem(ds *gadget.OnDiskStructure) error {
+	if ds.HasFilesystem() {
+		logger.Debugf("create %s filesystem on %s with label %q", ds.VolumeStructure.Filesystem, ds.Node, ds.VolumeStructure.Label)
+		if err := internal.Mkfs(ds.VolumeStructure.Filesystem, ds.Node, ds.VolumeStructure.Label, ds.Size); err != nil {
+			return err
+		}
+		if err := udevTrigger(ds.Node); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// writeContent populates the given on-disk structure, according to the contents
+// defined in the gadget.
+func writeContent(ds *gadget.OnDiskStructure, gadgetRoot string, observer gadget.ContentObserver) error {
+	switch {
+	case !ds.IsPartition():
+		return fmt.Errorf("cannot write non-partitions yet")
+	case !ds.HasFilesystem():
+		if err := writeNonFSContent(ds, gadgetRoot); err != nil {
+			return err
+		}
+	case ds.HasFilesystem():
+		if err := writeFilesystemContent(ds, gadgetRoot, observer); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// mountFilesystem mounts the on-disk structure filesystem under the given base
+// directory, using the label defined in the gadget as the mount point name.
+func mountFilesystem(ds *gadget.OnDiskStructure, baseMntPoint string) error {
+	if !ds.HasFilesystem() {
+		return fmt.Errorf("cannot mount a partition with no filesystem")
+	}
+	if ds.Label == "" {
+		return fmt.Errorf("cannot mount a filesystem with no label")
+	}
+
+	mountpoint := filepath.Join(baseMntPoint, ds.Label)
+	if err := os.MkdirAll(mountpoint, 0755); err != nil {
+		return fmt.Errorf("cannot create mountpoint: %v", err)
+	}
+	if err := sysMount(ds.Node, mountpoint, ds.Filesystem, 0, ""); err != nil {
+		return fmt.Errorf("cannot mount filesystem %q at %q: %v", ds.Node, mountpoint, err)
+	}
+
+	return nil
+}
+
+func writeFilesystemContent(ds *gadget.OnDiskStructure, gadgetRoot string, observer gadget.ContentObserver) (err error) {
+	mountpoint := filepath.Join(contentMountpoint, strconv.Itoa(ds.Index))
+	if err := os.MkdirAll(mountpoint, 0755); err != nil {
+		return err
+	}
+
+	// temporarily mount the filesystem
+	if err := sysMount(ds.Node, mountpoint, ds.Filesystem, 0, ""); err != nil {
+		return fmt.Errorf("cannot mount filesystem %q at %q: %v", ds.Node, mountpoint, err)
+	}
+	defer func() {
+		errUnmount := sysUnmount(mountpoint, 0)
+		if err == nil {
+			err = errUnmount
+		}
+	}()
+	fs, err := gadget.NewMountedFilesystemWriter(gadgetRoot, &ds.LaidOutStructure, observer)
+	if err != nil {
+		return fmt.Errorf("cannot create filesystem image writer: %v", err)
+	}
+
+	var noFilesToPreserve []string
+	if err := fs.Write(mountpoint, noFilesToPreserve); err != nil {
+		return fmt.Errorf("cannot create filesystem image: %v", err)
+	}
+
+	return nil
+}
+
+func writeNonFSContent(ds *gadget.OnDiskStructure, gadgetRoot string) error {
+	f, err := os.OpenFile(ds.Node, os.O_RDWR, 0644)
+	if err != nil {
+		return fmt.Errorf("cannot write bare content for %q: %v", ds.Node, err)
+	}
+	defer f.Close()
+
+	// Laid out structures start relative to the beginning of the
+	// volume, shift the structure offsets to 0, so that it starts
+	// at the beginning of the partition
+	l := gadget.ShiftStructureTo(ds.LaidOutStructure, 0)
+	raw, err := gadget.NewRawStructureWriter(gadgetRoot, &l)
+	if err != nil {
+		return err
+	}
+	return raw.Write(f)
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/content_test.go snapd-2.48.3+20.04/gadget/install/content_test.go
--- snapd-2.45.1+20.04.2/gadget/install/content_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/content_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,332 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install_test
+
+import (
+	"errors"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
+	"github.com/snapcore/snapd/gadget/quantity"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type contentTestSuite struct {
+	testutil.BaseTest
+
+	dir string
+
+	gadgetRoot string
+
+	mockMountPoint   string
+	mockMountCalls   []struct{ source, target, fstype string }
+	mockUnmountCalls []string
+
+	mockMountErr error
+}
+
+var _ = Suite(&contentTestSuite{})
+
+func (s *contentTestSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.dir = c.MkDir()
+
+	s.mockMountErr = nil
+	s.mockMountCalls = nil
+	s.mockUnmountCalls = nil
+
+	s.gadgetRoot = c.MkDir()
+	err := makeMockGadget(s.gadgetRoot, gadgetContent)
+	c.Assert(err, IsNil)
+
+	s.mockMountPoint = c.MkDir()
+	restore := install.MockContentMountpoint(s.mockMountPoint)
+	s.AddCleanup(restore)
+
+	restore = install.MockSysMount(func(source, target, fstype string, flags uintptr, data string) error {
+		s.mockMountCalls = append(s.mockMountCalls, struct{ source, target, fstype string }{source, target, fstype})
+		return s.mockMountErr
+	})
+	s.AddCleanup(restore)
+
+	restore = install.MockSysUnmount(func(target string, flags int) error {
+		s.mockUnmountCalls = append(s.mockUnmountCalls, target)
+		return nil
+	})
+	s.AddCleanup(restore)
+}
+
+var mockOnDiskStructureBiosBoot = gadget.OnDiskStructure{
+	Node: "/dev/node1",
+	LaidOutStructure: gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Name: "BIOS Boot",
+			Size: 1 * 1024 * 1024,
+			Type: "DA,21686148-6449-6E6F-744E-656564454649",
+			Content: []gadget.VolumeContent{
+				{
+					Image: "pc-core.img",
+				},
+			},
+		},
+		StartOffset: 0,
+		Index:       1,
+	},
+}
+
+var mockOnDiskStructureSystemSeed = gadget.OnDiskStructure{
+	Node: "/dev/node2",
+	LaidOutStructure: gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Name:       "Recovery",
+			Size:       1258291200,
+			Type:       "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+			Role:       "system-seed",
+			Label:      "ubuntu-seed",
+			Filesystem: "vfat",
+			Content: []gadget.VolumeContent{
+				{
+					Source: "grubx64.efi",
+					Target: "EFI/boot/grubx64.efi",
+				},
+			},
+		},
+		StartOffset: 2097152,
+		Index:       2,
+	},
+}
+
+func makeMockGadget(gadgetRoot, gadgetContent string) error {
+	if err := os.MkdirAll(filepath.Join(gadgetRoot, "meta"), 0755); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "meta", "gadget.yaml"), []byte(gadgetContent), 0644); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "pc-boot.img"), []byte("pc-boot.img content"), 0644); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "pc-core.img"), []byte("pc-core.img content"), 0644); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "grubx64.efi"), []byte("grubx64.efi content"), 0644); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+const gadgetContent = `volumes:
+  pc:
+    bootloader: grub
+    structure:
+      - name: mbr
+        type: mbr
+        size: 440
+        content:
+          - image: pc-boot.img
+      - name: BIOS Boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        offset: 1M
+        offset-write: mbr+92
+        content:
+          - image: pc-core.img
+      - name: Recovery
+        role: system-seed
+        filesystem: vfat
+        # UEFI will boot the ESP partition by default first
+        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+        size: 1200M
+        content:
+          - source: grubx64.efi
+            target: EFI/boot/grubx64.efi
+      - name: Writable
+        role: system-data
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 1200M
+`
+
+type mockContentChange struct {
+	path   string
+	change *gadget.ContentChange
+}
+
+type mockWriteObserver struct {
+	content        map[string][]*mockContentChange
+	observeErr     error
+	expectedStruct *gadget.LaidOutStructure
+	c              *C
+}
+
+func (m *mockWriteObserver) Observe(op gadget.ContentOperation, sourceStruct *gadget.LaidOutStructure,
+	targetRootDir, relativeTargetPath string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	if m.content == nil {
+		m.content = make(map[string][]*mockContentChange)
+	}
+	m.content[targetRootDir] = append(m.content[targetRootDir],
+		&mockContentChange{path: relativeTargetPath, change: data})
+	m.c.Assert(sourceStruct, NotNil)
+	m.c.Check(sourceStruct, DeepEquals, m.expectedStruct)
+	return gadget.ChangeApply, m.observeErr
+}
+
+func (s *contentTestSuite) TestWriteFilesystemContent(c *C) {
+	for _, tc := range []struct {
+		mountErr   error
+		unmountErr error
+		observeErr error
+		err        string
+	}{
+		{
+			mountErr:   nil,
+			unmountErr: nil,
+			err:        "",
+		}, {
+			mountErr:   errors.New("mount error"),
+			unmountErr: nil,
+			err:        "cannot mount filesystem .*: mount error",
+		}, {
+			mountErr:   nil,
+			unmountErr: errors.New("unmount error"),
+			err:        "unmount error",
+		}, {
+			observeErr: errors.New("observe error"),
+			err:        "cannot create filesystem image: cannot write filesystem content of source:grubx64.efi: cannot observe file write: observe error",
+		},
+	} {
+		mockMountpoint := c.MkDir()
+
+		restore := install.MockContentMountpoint(mockMountpoint)
+		defer restore()
+
+		restore = install.MockSysMount(func(source, target, fstype string, flags uintptr, data string) error {
+			return tc.mountErr
+		})
+		defer restore()
+
+		restore = install.MockSysUnmount(func(target string, flags int) error {
+			return tc.unmountErr
+		})
+		defer restore()
+
+		// copy existing mock
+		m := mockOnDiskStructureSystemSeed
+		m.LaidOutContent = []gadget.LaidOutContent{
+			{
+				VolumeContent: &gadget.VolumeContent{
+					Source: "grubx64.efi",
+					Target: "EFI/boot/grubx64.efi",
+				},
+			},
+		}
+		obs := &mockWriteObserver{
+			c:              c,
+			observeErr:     tc.observeErr,
+			expectedStruct: &m.LaidOutStructure,
+		}
+		err := install.WriteContent(&m, s.gadgetRoot, obs)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+
+		if err == nil {
+			// the target file system is mounted on a directory named after the structure index
+			content, err := ioutil.ReadFile(filepath.Join(mockMountpoint, "2", "EFI/boot/grubx64.efi"))
+			c.Assert(err, IsNil)
+			c.Check(string(content), Equals, "grubx64.efi content")
+			c.Assert(obs.content, DeepEquals, map[string][]*mockContentChange{
+				filepath.Join(mockMountpoint, "2"): {
+					{
+						path:   "EFI/boot/grubx64.efi",
+						change: &gadget.ContentChange{After: filepath.Join(s.gadgetRoot, "grubx64.efi")},
+					},
+				},
+			})
+		}
+	}
+}
+
+func (s *contentTestSuite) TestWriteRawContent(c *C) {
+	mockNode := filepath.Join(s.dir, "mock-node")
+	err := ioutil.WriteFile(mockNode, nil, 0644)
+	c.Assert(err, IsNil)
+
+	// copy existing mock
+	m := mockOnDiskStructureBiosBoot
+	m.Node = mockNode
+	m.LaidOutContent = []gadget.LaidOutContent{
+		{
+			VolumeContent: &gadget.VolumeContent{
+				Image: "pc-core.img",
+			},
+			StartOffset: 2,
+			Size:        quantity.Size(len("pc-core.img content")),
+		},
+	}
+
+	err = install.WriteContent(&m, s.gadgetRoot, nil)
+	c.Assert(err, IsNil)
+
+	content, err := ioutil.ReadFile(m.Node)
+	c.Assert(err, IsNil)
+	// note the 2 zero byte start offset
+	c.Check(string(content), Equals, "\x00\x00pc-core.img content")
+}
+
+func (s *contentTestSuite) TestMountFilesystem(c *C) {
+	dirs.SetRootDir(c.MkDir())
+	defer dirs.SetRootDir("")
+
+	// mounting will only happen for devices with a label
+	mockOnDiskStructureBiosBoot.Label = "bios-boot"
+	defer func() { mockOnDiskStructureBiosBoot.Label = "" }()
+
+	err := install.MountFilesystem(&mockOnDiskStructureBiosBoot, boot.InitramfsRunMntDir)
+	c.Assert(err, ErrorMatches, "cannot mount a partition with no filesystem")
+
+	// mount a filesystem...
+	err = install.MountFilesystem(&mockOnDiskStructureSystemSeed, boot.InitramfsRunMntDir)
+	c.Assert(err, IsNil)
+
+	// ...and check if it was mounted at the right mount point
+	c.Check(s.mockMountCalls, HasLen, 1)
+	c.Check(s.mockMountCalls, DeepEquals, []struct{ source, target, fstype string }{
+		{"/dev/node2", boot.InitramfsUbuntuSeedDir, "vfat"},
+	})
+
+	// now try to mount a filesystem with no label
+	mockOnDiskStructureSystemSeed.Label = ""
+	defer func() { mockOnDiskStructureSystemSeed.Label = "ubuntu-seed" }()
+
+	err = install.MountFilesystem(&mockOnDiskStructureSystemSeed, boot.InitramfsRunMntDir)
+	c.Assert(err, ErrorMatches, "cannot mount a filesystem with no label")
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/encrypt.go snapd-2.48.3+20.04/gadget/install/encrypt.go
--- snapd-2.45.1+20.04.2/gadget/install/encrypt.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/encrypt.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,95 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os/exec"
+
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/secboot"
+)
+
+var (
+	tempFile = ioutil.TempFile
+)
+
+var (
+	secbootFormatEncryptedDevice = secboot.FormatEncryptedDevice
+	secbootAddRecoveryKey        = secboot.AddRecoveryKey
+)
+
+// encryptedDevice represents a LUKS-backed encrypted block device.
+type encryptedDevice struct {
+	parent *gadget.OnDiskStructure
+	name   string
+	Node   string
+}
+
+// newEncryptedDevice creates an encrypted device in the existing partition using the
+// specified key.
+func newEncryptedDevice(part *gadget.OnDiskStructure, key secboot.EncryptionKey, name string) (*encryptedDevice, error) {
+	dev := &encryptedDevice{
+		parent: part,
+		name:   name,
+		// A new block device is used to access the encrypted data. Note that
+		// you can't open an encrypted device under different names and a name
+		// can't be used in more than one device at the same time.
+		Node: fmt.Sprintf("/dev/mapper/%s", name),
+	}
+
+	if err := secbootFormatEncryptedDevice(key, name+"-enc", part.Node); err != nil {
+		return nil, fmt.Errorf("cannot format encrypted device: %v", err)
+	}
+
+	if err := cryptsetupOpen(key, part.Node, name); err != nil {
+		return nil, fmt.Errorf("cannot open encrypted device on %s: %s", part.Node, err)
+	}
+
+	return dev, nil
+}
+
+func (dev *encryptedDevice) AddRecoveryKey(key secboot.EncryptionKey, rkey secboot.RecoveryKey) error {
+	return secbootAddRecoveryKey(key, rkey, dev.parent.Node)
+}
+
+func (dev *encryptedDevice) Close() error {
+	return cryptsetupClose(dev.name)
+}
+
+func cryptsetupOpen(key secboot.EncryptionKey, node, name string) error {
+	cmd := exec.Command("cryptsetup", "open", "--key-file", "-", node, name)
+	cmd.Stdin = bytes.NewReader(key[:])
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
+
+func cryptsetupClose(name string) error {
+	if output, err := exec.Command("cryptsetup", "close", name).CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/encrypt_test.go snapd-2.48.3+20.04/gadget/install/encrypt_test.go
--- snapd-2.45.1+20.04.2/gadget/install/encrypt_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/encrypt_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,178 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install_test
+
+import (
+	"errors"
+	"fmt"
+	"os"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type encryptSuite struct {
+	testutil.BaseTest
+
+	mockCryptsetup *testutil.MockCmd
+
+	mockedEncryptionKey secboot.EncryptionKey
+	mockedRecoveryKey   secboot.RecoveryKey
+}
+
+var _ = Suite(&encryptSuite{})
+
+var mockDeviceStructure = gadget.OnDiskStructure{
+	LaidOutStructure: gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Name: "Test structure",
+			Size: 0x100000,
+		},
+		StartOffset: 0,
+		Index:       1,
+	},
+	Node: "/dev/node1",
+}
+
+func (s *encryptSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+	c.Assert(os.MkdirAll(dirs.SnapRunDir, 0755), IsNil)
+
+	// create empty key to prevent blocking on lack of system entropy
+	s.mockedEncryptionKey = secboot.EncryptionKey{}
+	for i := range s.mockedEncryptionKey {
+		s.mockedEncryptionKey[i] = byte(i)
+	}
+	s.mockedRecoveryKey = secboot.RecoveryKey{15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0}
+}
+
+func (s *encryptSuite) TestNewEncryptedDevice(c *C) {
+	for _, tc := range []struct {
+		mockedFormatErr error
+		mockedOpenErr   string
+		expectedErr     string
+	}{
+		{
+			mockedFormatErr: nil,
+			mockedOpenErr:   "",
+			expectedErr:     "",
+		},
+		{
+			mockedFormatErr: errors.New("format error"),
+			mockedOpenErr:   "",
+			expectedErr:     "cannot format encrypted device: format error",
+		},
+		{
+			mockedFormatErr: nil,
+			mockedOpenErr:   "open error",
+			expectedErr:     "cannot open encrypted device on /dev/node1: open error",
+		},
+	} {
+		script := ""
+		if tc.mockedOpenErr != "" {
+			script = fmt.Sprintf("echo '%s'>&2; exit 1", tc.mockedOpenErr)
+
+		}
+		s.mockCryptsetup = testutil.MockCommand(c, "cryptsetup", script)
+		s.AddCleanup(s.mockCryptsetup.Restore)
+
+		calls := 0
+		restore := install.MockSecbootFormatEncryptedDevice(func(key secboot.EncryptionKey, label, node string) error {
+			calls++
+			c.Assert(key, DeepEquals, s.mockedEncryptionKey)
+			c.Assert(label, Equals, "some-label-enc")
+			c.Assert(node, Equals, "/dev/node1")
+			return tc.mockedFormatErr
+		})
+		defer restore()
+
+		dev, err := install.NewEncryptedDevice(&mockDeviceStructure, s.mockedEncryptionKey, "some-label")
+		c.Assert(calls, Equals, 1)
+		if tc.expectedErr == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.expectedErr)
+			continue
+		}
+		c.Assert(dev.Node, Equals, "/dev/mapper/some-label")
+
+		err = dev.Close()
+		c.Assert(err, IsNil)
+
+		c.Assert(s.mockCryptsetup.Calls(), DeepEquals, [][]string{
+			{"cryptsetup", "open", "--key-file", "-", "/dev/node1", "some-label"},
+			{"cryptsetup", "close", "some-label"},
+		})
+	}
+}
+
+func (s *encryptSuite) TestAddRecoveryKey(c *C) {
+	for _, tc := range []struct {
+		mockedAddErr error
+		expectedErr  string
+	}{
+		{mockedAddErr: nil, expectedErr: ""},
+		{mockedAddErr: errors.New("add key error"), expectedErr: "add key error"},
+	} {
+		s.mockCryptsetup = testutil.MockCommand(c, "cryptsetup", "")
+		s.AddCleanup(s.mockCryptsetup.Restore)
+
+		restore := install.MockSecbootFormatEncryptedDevice(func(key secboot.EncryptionKey, label, node string) error {
+			return nil
+		})
+		defer restore()
+
+		calls := 0
+		restore = install.MockSecbootAddRecoveryKey(func(key secboot.EncryptionKey, rkey secboot.RecoveryKey, node string) error {
+			calls++
+			c.Assert(key, DeepEquals, s.mockedEncryptionKey)
+			c.Assert(rkey, DeepEquals, s.mockedRecoveryKey)
+			c.Assert(node, Equals, "/dev/node1")
+			return tc.mockedAddErr
+		})
+		defer restore()
+
+		dev, err := install.NewEncryptedDevice(&mockDeviceStructure, s.mockedEncryptionKey, "some-label")
+		c.Assert(err, IsNil)
+
+		err = dev.AddRecoveryKey(s.mockedEncryptionKey, s.mockedRecoveryKey)
+		c.Assert(calls, Equals, 1)
+		if tc.expectedErr == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.expectedErr)
+			continue
+		}
+
+		err = dev.Close()
+		c.Assert(err, IsNil)
+
+		c.Assert(s.mockCryptsetup.Calls(), DeepEquals, [][]string{
+			{"cryptsetup", "open", "--key-file", "-", "/dev/node1", "some-label"},
+			{"cryptsetup", "close", "some-label"},
+		})
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/export_secboot_test.go snapd-2.48.3+20.04/gadget/install/export_secboot_test.go
--- snapd-2.45.1+20.04.2/gadget/install/export_secboot_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/export_secboot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,47 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"github.com/snapcore/snapd/secboot"
+)
+
+var (
+	EnsureLayoutCompatibility = ensureLayoutCompatibility
+	DeviceFromRole            = deviceFromRole
+	NewEncryptedDevice        = newEncryptedDevice
+)
+
+func MockSecbootFormatEncryptedDevice(f func(key secboot.EncryptionKey, label, node string) error) (restore func()) {
+	old := secbootFormatEncryptedDevice
+	secbootFormatEncryptedDevice = f
+	return func() {
+		secbootFormatEncryptedDevice = old
+	}
+}
+
+func MockSecbootAddRecoveryKey(f func(key secboot.EncryptionKey, rkey secboot.RecoveryKey, node string) error) (restore func()) {
+	old := secbootAddRecoveryKey
+	secbootAddRecoveryKey = f
+	return func() {
+		secbootAddRecoveryKey = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/export_test.go snapd-2.48.3+20.04/gadget/install/export_test.go
--- snapd-2.45.1+20.04.2/gadget/install/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,70 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"time"
+
+	"github.com/snapcore/snapd/gadget"
+)
+
+var (
+	MakeFilesystem  = makeFilesystem
+	WriteContent    = writeContent
+	MountFilesystem = mountFilesystem
+
+	CreateMissingPartitions = createMissingPartitions
+	RemoveCreatedPartitions = removeCreatedPartitions
+	EnsureNodesExist        = ensureNodesExist
+
+	CreatedDuringInstall = createdDuringInstall
+)
+
+func MockContentMountpoint(new string) (restore func()) {
+	old := contentMountpoint
+	contentMountpoint = new
+	return func() {
+		contentMountpoint = old
+	}
+}
+
+func MockSysMount(f func(source, target, fstype string, flags uintptr, data string) error) (restore func()) {
+	old := sysMount
+	sysMount = f
+	return func() {
+		sysMount = old
+	}
+}
+
+func MockSysUnmount(f func(target string, flags int) error) (restore func()) {
+	old := sysUnmount
+	sysUnmount = f
+	return func() {
+		sysUnmount = old
+	}
+}
+
+func MockEnsureNodesExist(f func(dss []gadget.OnDiskStructure, timeout time.Duration) error) (restore func()) {
+	old := ensureNodesExist
+	ensureNodesExist = f
+	return func() {
+		ensureNodesExist = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/install_dummy.go snapd-2.48.3+20.04/gadget/install/install_dummy.go
--- snapd-2.45.1+20.04.2/gadget/install/install_dummy.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/install_dummy.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,31 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build nosecboot
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/gadget"
+)
+
+func Run(gadgetRoot, device string, options Options, _ gadget.ContentObserver) (*InstalledSystemSideData, error) {
+	return nil, fmt.Errorf("build without secboot support")
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/install.go snapd-2.48.3+20.04/gadget/install/install.go
--- snapd-2.45.1+20.04.2/gadget/install/install.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/install.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,292 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/secboot"
+)
+
+const (
+	ubuntuDataLabel = "ubuntu-data"
+	ubuntuSaveLabel = "ubuntu-save"
+)
+
+func deviceFromRole(lv *gadget.LaidOutVolume, role string) (device string, err error) {
+	for _, vs := range lv.LaidOutStructure {
+		// XXX: this part of the finding maybe should be a
+		// method on gadget.*Volume
+		if vs.Role == role {
+			device, err = gadget.FindDeviceForStructure(&vs)
+			if err != nil {
+				return "", fmt.Errorf("cannot find device for role %q: %v", role, err)
+			}
+			return gadget.ParentDiskFromMountSource(device)
+		}
+	}
+	return "", fmt.Errorf("cannot find role %s in gadget", role)
+}
+
+// Run bootstraps the partitions of a device, by either creating
+// missing ones or recreating installed ones.
+func Run(gadgetRoot, device string, options Options, observer gadget.ContentObserver) (*InstalledSystemSideData, error) {
+	logger.Noticef("installing a new system")
+	logger.Noticef("        gadget data from: %v", gadgetRoot)
+	if options.Encrypt {
+		logger.Noticef("        encryption: on")
+	}
+	if gadgetRoot == "" {
+		return nil, fmt.Errorf("cannot use empty gadget root directory")
+	}
+
+	lv, err := gadget.PositionedVolumeFromGadget(gadgetRoot)
+	if err != nil {
+		return nil, fmt.Errorf("cannot layout the volume: %v", err)
+	}
+
+	// XXX: the only situation where auto-detect is not desired is
+	//      in (spread) testing - consider to remove forcing a device
+	//
+	// auto-detect device if no device is forced
+	if device == "" {
+		device, err = deviceFromRole(lv, gadget.SystemSeed)
+		if err != nil {
+			return nil, fmt.Errorf("cannot find device to create partitions on: %v", err)
+		}
+	}
+
+	diskLayout, err := gadget.OnDiskVolumeFromDevice(device)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read %v partitions: %v", device, err)
+	}
+
+	// check if the current partition table is compatible with the gadget,
+	// ignoring partitions added by the installer (will be removed later)
+	if err := ensureLayoutCompatibility(lv, diskLayout); err != nil {
+		return nil, fmt.Errorf("gadget and %v partition table not compatible: %v", device, err)
+	}
+
+	// remove partitions added during a previous install attempt
+	if err := removeCreatedPartitions(lv, diskLayout); err != nil {
+		return nil, fmt.Errorf("cannot remove partitions from previous install: %v", err)
+	}
+	// at this point we removed any existing partition, nuke any
+	// of the existing sealed key files placed outside of the
+	// encrypted partitions (LP: #1879338)
+	sealedKeyFiles, _ := filepath.Glob(filepath.Join(boot.InitramfsSeedEncryptionKeyDir, "*.sealed-key"))
+	for _, keyFile := range sealedKeyFiles {
+		if err := os.Remove(keyFile); err != nil && !os.IsNotExist(err) {
+			return nil, fmt.Errorf("cannot cleanup obsolete key file: %v", keyFile)
+		}
+	}
+
+	created, err := createMissingPartitions(diskLayout, lv)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create the partitions: %v", err)
+	}
+
+	makeKeySet := func() (*EncryptionKeySet, error) {
+		key, err := secboot.NewEncryptionKey()
+		if err != nil {
+			return nil, fmt.Errorf("cannot create encryption key: %v", err)
+		}
+
+		rkey, err := secboot.NewRecoveryKey()
+		if err != nil {
+			return nil, fmt.Errorf("cannot create recovery key: %v", err)
+		}
+		return &EncryptionKeySet{
+			Key:         key,
+			RecoveryKey: rkey,
+		}, nil
+	}
+	roleNeedsEncryption := func(role string) bool {
+		return role == gadget.SystemData || role == gadget.SystemSave
+	}
+	var keysForRoles map[string]*EncryptionKeySet
+
+	for _, part := range created {
+		roleFmt := ""
+		if part.Role != "" {
+			roleFmt = fmt.Sprintf("role %v", part.Role)
+		}
+		logger.Noticef("created new partition %v for structure %v (size %v) %s",
+			part.Node, part, part.Size.IECString(), roleFmt)
+		if options.Encrypt && roleNeedsEncryption(part.Role) {
+			keys, err := makeKeySet()
+			if err != nil {
+				return nil, err
+			}
+			logger.Noticef("encrypting partition device %v", part.Node)
+			dataPart, err := newEncryptedDevice(&part, keys.Key, part.Label)
+			if err != nil {
+				return nil, err
+			}
+
+			if err := dataPart.AddRecoveryKey(keys.Key, keys.RecoveryKey); err != nil {
+				return nil, err
+			}
+
+			// update the encrypted device node
+			part.Node = dataPart.Node
+			if keysForRoles == nil {
+				keysForRoles = map[string]*EncryptionKeySet{}
+			}
+			keysForRoles[part.Role] = keys
+			logger.Noticef("encrypted device %v", part.Node)
+		}
+
+		if err := makeFilesystem(&part); err != nil {
+			return nil, err
+		}
+
+		if err := writeContent(&part, gadgetRoot, observer); err != nil {
+			return nil, err
+		}
+
+		if options.Mount && part.Label != "" && part.HasFilesystem() {
+			if err := mountFilesystem(&part, boot.InitramfsRunMntDir); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return &InstalledSystemSideData{
+		KeysForRoles: keysForRoles,
+	}, nil
+}
+
+// isCreatableAtInstall returns whether the gadget structure would be created at
+// install - currently that is only ubuntu-save, ubuntu-data, and ubuntu-boot
+func isCreatableAtInstall(gv *gadget.VolumeStructure) bool {
+	// a structure is creatable at install if it is one of the roles for
+	// system-save, system-data, or system-boot
+	switch gv.Role {
+	case gadget.SystemSave, gadget.SystemData, gadget.SystemBoot:
+		return true
+	default:
+		return false
+	}
+}
+
+func ensureLayoutCompatibility(gadgetLayout *gadget.LaidOutVolume, diskLayout *gadget.OnDiskVolume) error {
+	eq := func(ds gadget.OnDiskStructure, gs gadget.LaidOutStructure) (bool, string) {
+		dv := ds.VolumeStructure
+		gv := gs.VolumeStructure
+		nameMatch := gv.Name == dv.Name
+		if gadgetLayout.Schema == "mbr" {
+			// partitions have no names in MBR so bypass the name check
+			nameMatch = true
+		}
+		// Previous installation may have failed before filesystem creation or
+		// partition may be encrypted, so if the on disk offset matches the
+		// gadget offset, and the gadget structure is creatable during install,
+		// then they are equal
+		// otherwise, if they are not created during installation, the
+		// filesystem must be the same
+		check := nameMatch && ds.StartOffset == gs.StartOffset && (isCreatableAtInstall(gv) || dv.Filesystem == gv.Filesystem)
+		sizeMatches := dv.Size == gv.Size
+		if gv.Role == gadget.SystemData {
+			// system-data may have been expanded
+			sizeMatches = dv.Size >= gv.Size
+		}
+		if check && sizeMatches {
+			return true, ""
+		}
+		switch {
+		case !nameMatch:
+			// don't return a reason if the names don't match
+			return false, ""
+		case ds.StartOffset != gs.StartOffset:
+			return false, fmt.Sprintf("start offsets do not match (disk: %d (%s) and gadget: %d (%s))", ds.StartOffset, ds.StartOffset.IECString(), gs.StartOffset, gs.StartOffset.IECString())
+		case !isCreatableAtInstall(gv) && dv.Filesystem != gv.Filesystem:
+			return false, "filesystems do not match and the partition is not creatable at install"
+		case dv.Size < gv.Size:
+			return false, "on disk size is smaller than gadget size"
+		case gv.Role != gadget.SystemData && dv.Size > gv.Size:
+			return false, "on disk size is larger than gadget size (and the role should not be expanded)"
+		default:
+			return false, "some other logic condition (should be impossible?)"
+		}
+	}
+
+	contains := func(haystack []gadget.LaidOutStructure, needle gadget.OnDiskStructure) (bool, string) {
+		reasonAbsent := ""
+		for _, h := range haystack {
+			matches, reasonNotMatches := eq(needle, h)
+			if matches {
+				return true, ""
+			}
+			// this has the effect of only returning the last non-empty reason
+			// string
+			if reasonNotMatches != "" {
+				reasonAbsent = reasonNotMatches
+			}
+		}
+		return false, reasonAbsent
+	}
+
+	if gadgetLayout.Size > diskLayout.Size {
+		return fmt.Errorf("device %v (%s) is too small to fit the requested layout (%s)", diskLayout.Device,
+			diskLayout.Size.IECString(), gadgetLayout.Size.IECString())
+	}
+
+	// Check if top level properties match
+	if !isCompatibleSchema(gadgetLayout.Volume.Schema, diskLayout.Schema) {
+		return fmt.Errorf("disk partitioning schema %q doesn't match gadget schema %q", diskLayout.Schema, gadgetLayout.Volume.Schema)
+	}
+	if gadgetLayout.Volume.ID != "" && gadgetLayout.Volume.ID != diskLayout.ID {
+		return fmt.Errorf("disk ID %q doesn't match gadget volume ID %q", diskLayout.ID, gadgetLayout.Volume.ID)
+	}
+
+	// Check if all existing device partitions are also in gadget
+	for _, ds := range diskLayout.Structure {
+		present, reasonAbsent := contains(gadgetLayout.LaidOutStructure, ds)
+		if !present {
+			if reasonAbsent != "" {
+				// use the right format so that it can be
+				// appended to the error message
+				reasonAbsent = fmt.Sprintf(": %s", reasonAbsent)
+			}
+			return fmt.Errorf("cannot find disk partition %s (starting at %d) in gadget%s", ds.Node, ds.StartOffset, reasonAbsent)
+		}
+	}
+
+	return nil
+}
+
+func isCompatibleSchema(gadgetSchema, diskSchema string) bool {
+	switch gadgetSchema {
+	// XXX: "mbr,gpt" is currently unsupported
+	case "", "gpt":
+		return diskSchema == "gpt"
+	case "mbr":
+		return diskSchema == "dos"
+	default:
+		return false
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/install_test.go snapd-2.48.3+20.04/gadget/install/install_test.go
--- snapd-2.45.1+20.04.2/gadget/install/install_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/install_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,453 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
+	"github.com/snapcore/snapd/gadget/quantity"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func TestInstall(t *testing.T) { TestingT(t) }
+
+type installSuite struct {
+	testutil.BaseTest
+
+	dir string
+}
+
+var _ = Suite(&installSuite{})
+
+// XXX: write a very high level integration like test here that
+// mocks the world (sfdisk,lsblk,mkfs,...)? probably silly as
+// each part inside bootstrap is tested and we have a spread test
+
+func (s *installSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.dir = c.MkDir()
+	dirs.SetRootDir(s.dir)
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
+}
+
+func (s *installSuite) TestInstallRunError(c *C) {
+	sys, err := install.Run("", "", install.Options{}, nil)
+	c.Assert(err, ErrorMatches, "cannot use empty gadget root directory")
+	c.Check(sys, IsNil)
+}
+
+const mockGadgetYaml = `volumes:
+  pc:
+    bootloader: grub
+    structure:
+      - name: mbr
+        type: mbr
+        size: 440
+      - name: BIOS Boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        offset: 1M
+        offset-write: mbr+92
+`
+
+const mockExtraStructure = `
+      - name: Writable
+        role: system-data
+        filesystem-label: writable
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 1200M
+`
+
+var mockDeviceLayout = gadget.OnDiskVolume{
+	Structure: []gadget.OnDiskStructure{
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Name: "mbr",
+					Size: 440,
+				},
+				StartOffset: 0,
+			},
+			Node: "/dev/node1",
+		},
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Name: "BIOS Boot",
+					Size: 1 * quantity.SizeMiB,
+				},
+				StartOffset: 1 * quantity.SizeMiB,
+			},
+			Node: "/dev/node2",
+		},
+	},
+	ID:         "anything",
+	Device:     "/dev/node",
+	Schema:     "gpt",
+	Size:       2 * quantity.SizeGiB,
+	SectorSize: 512,
+}
+
+func (s *installSuite) TestLayoutCompatibility(c *C) {
+	// same contents (the locally created structure should be ignored)
+	gadgetLayout := layoutFromYaml(c, mockGadgetYaml)
+	err := install.EnsureLayoutCompatibility(gadgetLayout, &mockDeviceLayout)
+	c.Assert(err, IsNil)
+
+	// missing structure (that's ok)
+	gadgetLayoutWithExtras := layoutFromYaml(c, mockGadgetYaml+mockExtraStructure)
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &mockDeviceLayout)
+	c.Assert(err, IsNil)
+
+	deviceLayoutWithExtras := mockDeviceLayout
+	deviceLayoutWithExtras.Structure = append(deviceLayoutWithExtras.Structure,
+		gadget.OnDiskStructure{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Name:  "Extra partition",
+					Size:  10 * quantity.SizeMiB,
+					Label: "extra",
+				},
+				StartOffset: 2 * quantity.SizeMiB,
+			},
+			Node: "/dev/node3",
+		},
+	)
+	// extra structure (should fail)
+	err = install.EnsureLayoutCompatibility(gadgetLayout, &deviceLayoutWithExtras)
+	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node3.* in gadget`)
+
+	// layout is not compatible if the device is too small
+	smallDeviceLayout := mockDeviceLayout
+	smallDeviceLayout.Size = 100 * quantity.SizeMiB
+	// sanity check
+	c.Check(gadgetLayoutWithExtras.Size > smallDeviceLayout.Size, Equals, true)
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &smallDeviceLayout)
+	c.Assert(err, ErrorMatches, `device /dev/node \(100 MiB\) is too small to fit the requested layout \(1\.17 GiB\)`)
+}
+
+func (s *installSuite) TestMBRLayoutCompatibility(c *C) {
+	const mockMBRGadgetYaml = `volumes:
+  pc:
+    schema: mbr
+    bootloader: grub
+    structure:
+      - name: mbr
+        type: mbr
+        size: 440
+      - name: BIOS Boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        offset: 1M
+        offset-write: mbr+92
+`
+	var mockMBRDeviceLayout = gadget.OnDiskVolume{
+		Structure: []gadget.OnDiskStructure{
+			{
+				LaidOutStructure: gadget.LaidOutStructure{
+					VolumeStructure: &gadget.VolumeStructure{
+						// partition names have no
+						// meaning in MBR schema
+						Name: "other",
+						Size: 440,
+					},
+					StartOffset: 0,
+				},
+				Node: "/dev/node1",
+			},
+			{
+				LaidOutStructure: gadget.LaidOutStructure{
+					VolumeStructure: &gadget.VolumeStructure{
+						// partition names have no
+						// meaning in MBR schema
+						Name: "different BIOS Boot",
+						Size: 1 * quantity.SizeMiB,
+					},
+					StartOffset: 1 * quantity.SizeMiB,
+				},
+				Node: "/dev/node2",
+			},
+		},
+		ID:         "anything",
+		Device:     "/dev/node",
+		Schema:     "dos",
+		Size:       2 * quantity.SizeGiB,
+		SectorSize: 512,
+	}
+	gadgetLayout := layoutFromYaml(c, mockMBRGadgetYaml)
+	err := install.EnsureLayoutCompatibility(gadgetLayout, &mockMBRDeviceLayout)
+	c.Assert(err, IsNil)
+	// structure is missing from disk
+	gadgetLayoutWithExtras := layoutFromYaml(c, mockMBRGadgetYaml+mockExtraStructure)
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &mockMBRDeviceLayout)
+	c.Assert(err, IsNil)
+	// add it now
+	deviceLayoutWithExtras := mockMBRDeviceLayout
+	deviceLayoutWithExtras.Structure = append(deviceLayoutWithExtras.Structure,
+		gadget.OnDiskStructure{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					// name is ignored with MBR schema
+					Name:       "Extra partition",
+					Size:       1200 * quantity.SizeMiB,
+					Label:      "extra",
+					Filesystem: "ext4",
+					Type:       "83",
+				},
+				StartOffset: 2 * quantity.SizeMiB,
+			},
+			Node: "/dev/node3",
+		},
+	)
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayoutWithExtras)
+	c.Assert(err, IsNil)
+	// add another structure that's not part of the gadget
+	deviceLayoutWithExtras.Structure = append(deviceLayoutWithExtras.Structure,
+		gadget.OnDiskStructure{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					// name is ignored with MBR schema
+					Name: "Extra extra partition",
+					Size: 1 * quantity.SizeMiB,
+				},
+				StartOffset: 1202 * quantity.SizeMiB,
+			},
+			Node: "/dev/node4",
+		},
+	)
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayoutWithExtras)
+	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node4 \(starting at 1260388352\) in gadget: start offsets do not match \(disk: 1260388352 \(1.17 GiB\) and gadget: 2097152 \(2 MiB\)\)`)
+}
+
+func (s *installSuite) TestLayoutCompatibilityWithCreatedPartitions(c *C) {
+	gadgetLayoutWithExtras := layoutFromYaml(c, mockGadgetYaml+mockExtraStructure)
+	deviceLayout := mockDeviceLayout
+
+	// device matches gadget except for the filesystem type
+	deviceLayout.Structure = append(deviceLayout.Structure,
+		gadget.OnDiskStructure{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Name:       "Writable",
+					Size:       1200 * quantity.SizeMiB,
+					Label:      "writable",
+					Filesystem: "something_else",
+				},
+				StartOffset: 2 * quantity.SizeMiB,
+			},
+			Node: "/dev/node3",
+		},
+	)
+	err := install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
+	c.Assert(err, IsNil)
+
+	// we are going to manipulate last structure, which has system-data role
+	c.Assert(gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Role, Equals, gadget.SystemData)
+
+	// change the role for the laid out volume to not be a partition role that
+	// is created at install time (note that the duplicated seed role here is
+	// technically incorrect, you can't have duplicated roles, but this
+	// demonstrates that a structure that otherwise fits the bill but isn't a
+	// role that is created during install will fail the filesystem match check)
+	gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Role = gadget.SystemSeed
+
+	// now we fail to find the /dev/node3 structure from the gadget on disk
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
+	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node3 \(starting at 2097152\) in gadget: filesystems do not match and the partition is not creatable at install`)
+
+	// undo the role change
+	gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Role = gadget.SystemData
+
+	// change the gadget size to be bigger than the on disk size
+	gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Size = 10000000 * quantity.SizeMiB
+
+	// now we fail to find the /dev/node3 structure from the gadget on disk because the gadget says it must be bigger
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
+	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node3 \(starting at 2097152\) in gadget: on disk size is smaller than gadget size`)
+
+	// change the gadget size to be smaller than the on disk size and the role to be one that is not expanded
+	gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Size = 1 * quantity.SizeMiB
+	gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Role = gadget.SystemBoot
+
+	// now we fail because the gadget says it should be smaller and it can't be expanded
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
+	c.Assert(err, ErrorMatches, `cannot find disk partition /dev/node3 \(starting at 2097152\) in gadget: on disk size is larger than gadget size \(and the role should not be expanded\)`)
+
+	// but a smaller partition on disk for SystemData role is okay
+	gadgetLayoutWithExtras.Structure[len(deviceLayout.Structure)-1].Role = gadget.SystemData
+	err = install.EnsureLayoutCompatibility(gadgetLayoutWithExtras, &deviceLayout)
+	c.Assert(err, IsNil)
+}
+
+func (s *installSuite) TestSchemaCompatibility(c *C) {
+	gadgetLayout := layoutFromYaml(c, mockGadgetYaml)
+	deviceLayout := mockDeviceLayout
+
+	error_msg := "disk partitioning.* doesn't match gadget.*"
+
+	for i, tc := range []struct {
+		gs string
+		ds string
+		e  string
+	}{
+		{"", "dos", error_msg},
+		{"", "gpt", ""},
+		{"", "xxx", error_msg},
+		{"mbr", "dos", ""},
+		{"mbr", "gpt", error_msg},
+		{"mbr", "xxx", error_msg},
+		{"gpt", "dos", error_msg},
+		{"gpt", "gpt", ""},
+		{"gpt", "xxx", error_msg},
+		// XXX: "mbr,gpt" is currently unsupported
+		{"mbr,gpt", "dos", error_msg},
+		{"mbr,gpt", "gpt", error_msg},
+		{"mbr,gpt", "xxx", error_msg},
+	} {
+		c.Logf("%d: %q %q\n", i, tc.gs, tc.ds)
+		gadgetLayout.Volume.Schema = tc.gs
+		deviceLayout.Schema = tc.ds
+		err := install.EnsureLayoutCompatibility(gadgetLayout, &deviceLayout)
+		if tc.e == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.e)
+		}
+	}
+	c.Logf("-----")
+}
+
+func (s *installSuite) TestIDCompatibility(c *C) {
+	gadgetLayout := layoutFromYaml(c, mockGadgetYaml)
+	deviceLayout := mockDeviceLayout
+
+	error_msg := "disk ID.* doesn't match gadget volume ID.*"
+
+	for i, tc := range []struct {
+		gid string
+		did string
+		e   string
+	}{
+		{"", "", ""},
+		{"", "123", ""},
+		{"123", "345", error_msg},
+		{"123", "123", ""},
+	} {
+		c.Logf("%d: %q %q\n", i, tc.gid, tc.did)
+		gadgetLayout.Volume.ID = tc.gid
+		deviceLayout.ID = tc.did
+		err := install.EnsureLayoutCompatibility(gadgetLayout, &deviceLayout)
+		if tc.e == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.e)
+		}
+	}
+	c.Logf("-----")
+}
+
+func layoutFromYaml(c *C, gadgetYaml string) *gadget.LaidOutVolume {
+	gadgetRoot := filepath.Join(c.MkDir(), "gadget")
+	err := os.MkdirAll(filepath.Join(gadgetRoot, "meta"), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(gadgetRoot, "meta", "gadget.yaml"), []byte(gadgetYaml), 0644)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(gadgetRoot)
+	c.Assert(err, IsNil)
+	return pv
+}
+
+const mockUC20GadgetYaml = `volumes:
+  pc:
+    bootloader: grub
+    structure:
+      - name: mbr
+        type: mbr
+        size: 440
+      - name: BIOS Boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        offset: 1M
+        offset-write: mbr+92
+      - name: ubuntu-seed
+        role: system-seed
+        filesystem: vfat
+        # UEFI will boot the ESP partition by default first
+        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+        size: 1200M
+      - name: ubuntu-data
+        role: system-data
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 750M
+`
+
+func (s *installSuite) setupMockSysfs(c *C) {
+	err := os.MkdirAll(filepath.Join(s.dir, "/dev/disk/by-partlabel"), 0755)
+	c.Assert(err, IsNil)
+
+	err = ioutil.WriteFile(filepath.Join(s.dir, "/dev/fakedevice0p1"), nil, 0644)
+	c.Assert(err, IsNil)
+	err = os.Symlink("../../fakedevice0p1", filepath.Join(s.dir, "/dev/disk/by-partlabel/ubuntu-seed"))
+	c.Assert(err, IsNil)
+
+	// make parent device
+	err = ioutil.WriteFile(filepath.Join(s.dir, "/dev/fakedevice0"), nil, 0644)
+	c.Assert(err, IsNil)
+	// and fake /sys/block structure
+	err = os.MkdirAll(filepath.Join(s.dir, "/sys/block/fakedevice0/fakedevice0p1"), 0755)
+	c.Assert(err, IsNil)
+}
+
+func (s *installSuite) TestDeviceFromRoleHappy(c *C) {
+	s.setupMockSysfs(c)
+	lv := layoutFromYaml(c, mockUC20GadgetYaml)
+
+	device, err := install.DeviceFromRole(lv, gadget.SystemSeed)
+	c.Assert(err, IsNil)
+	c.Check(device, Matches, ".*/dev/fakedevice0")
+}
+
+func (s *installSuite) TestDeviceFromRoleErrorNoMatchingSysfs(c *C) {
+	// note no sysfs mocking
+	lv := layoutFromYaml(c, mockUC20GadgetYaml)
+
+	_, err := install.DeviceFromRole(lv, gadget.SystemSeed)
+	c.Assert(err, ErrorMatches, `cannot find device for role "system-seed": device not found`)
+}
+
+func (s *installSuite) TestDeviceFromRoleErrorNoRole(c *C) {
+	s.setupMockSysfs(c)
+	lv := layoutFromYaml(c, mockGadgetYaml)
+
+	_, err := install.DeviceFromRole(lv, gadget.SystemSeed)
+	c.Assert(err, ErrorMatches, "cannot find role system-seed in gadget")
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/mount_linux.go snapd-2.48.3+20.04/gadget/install/mount_linux.go
--- snapd-2.45.1+20.04.2/gadget/install/mount_linux.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/mount_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,29 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"syscall"
+)
+
+var (
+	sysMount   = syscall.Mount
+	sysUnmount = syscall.Unmount
+)
diff -Nru snapd-2.45.1+20.04.2/gadget/install/mount_other.go snapd-2.48.3+20.04/gadget/install/mount_other.go
--- snapd-2.45.1+20.04.2/gadget/install/mount_other.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/mount_other.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,35 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !linux
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"errors"
+	"syscall"
+)
+
+var (
+	sysMount   = unimplementedMount
+	sysUnmount = syscall.Unmount
+)
+
+func unimplementedMount(source string, target string, fstype string, flags uintptr, data string) error {
+	return errors.New("mount not implemented")
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/params.go snapd-2.48.3+20.04/gadget/install/params.go
--- snapd-2.45.1+20.04.2/gadget/install/params.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/params.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,44 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"github.com/snapcore/snapd/secboot"
+)
+
+type Options struct {
+	// Also mount the filesystems after creation
+	Mount bool
+	// Encrypt the data partition
+	Encrypt bool
+}
+
+// EncryptionKeySet is a set of encryption keys.
+type EncryptionKeySet struct {
+	Key         secboot.EncryptionKey
+	RecoveryKey secboot.RecoveryKey
+}
+
+// InstalledSystemSideData carries side data of an installed system, eg. secrets
+// to access its partitions.
+type InstalledSystemSideData struct {
+	// KeysForRoles contains key sets for the relevant structure roles.
+	KeysForRoles map[string]*EncryptionKeySet
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/partition.go snapd-2.48.3+20.04/gadget/install/partition.go
--- snapd-2.45.1+20.04.2/gadget/install/partition.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/partition.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,197 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install
+
+import (
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+)
+
+var (
+	ensureNodesExist = ensureNodesExistImpl
+)
+
+// createMissingPartitions creates the partitions listed in the laid out volume
+// pv that are missing from the existing device layout, returning a list of
+// structures that have been created.
+func createMissingPartitions(dl *gadget.OnDiskVolume, pv *gadget.LaidOutVolume) ([]gadget.OnDiskStructure, error) {
+	buf, created := gadget.BuildPartitionList(dl, pv)
+	if len(created) == 0 {
+		return created, nil
+	}
+
+	logger.Debugf("create partitions on %s: %s", dl.Device, buf.String())
+
+	// Write the partition table. By default sfdisk will try to re-read the
+	// partition table with the BLKRRPART ioctl but will fail because the
+	// kernel side rescan removes and adds partitions and we have partitions
+	// mounted (so it fails on removal). Use --no-reread to skip this attempt.
+	cmd := exec.Command("sfdisk", "--append", "--no-reread", dl.Device)
+	cmd.Stdin = buf
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return created, osutil.OutputErr(output, err)
+	}
+
+	// Re-read the partition table
+	if err := reloadPartitionTable(dl.Device); err != nil {
+		return nil, err
+	}
+
+	// Make sure the devices for the partitions we created are available
+	if err := ensureNodesExist(created, 5*time.Second); err != nil {
+		return nil, fmt.Errorf("partition not available: %v", err)
+	}
+
+	return created, nil
+}
+
+// removeCreatedPartitions removes partitions added during a previous install.
+func removeCreatedPartitions(lv *gadget.LaidOutVolume, dl *gadget.OnDiskVolume) error {
+	indexes := make([]string, 0, len(dl.Structure))
+	for i, s := range dl.Structure {
+		if wasCreatedDuringInstall(lv, s) {
+			logger.Noticef("partition %s was created during previous install", s.Node)
+			indexes = append(indexes, strconv.Itoa(i+1))
+		}
+	}
+	if len(indexes) == 0 {
+		return nil
+	}
+
+	// Delete disk partitions
+	logger.Debugf("delete disk partitions %v", indexes)
+	cmd := exec.Command("sfdisk", append([]string{"--no-reread", "--delete", dl.Device}, indexes...)...)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+
+	// Reload the partition table
+	if err := reloadPartitionTable(dl.Device); err != nil {
+		return err
+	}
+
+	// Re-read the partition table from the device to update our partition list
+	if err := gadget.UpdatePartitionList(dl); err != nil {
+		return err
+	}
+
+	// Ensure all created partitions were removed
+	if remaining := createdDuringInstall(lv, dl); len(remaining) > 0 {
+		return fmt.Errorf("cannot remove partitions: %s", strings.Join(remaining, ", "))
+	}
+
+	return nil
+}
+
+// ensureNodeExists makes sure the device nodes for all device structures are
+// available and notified to udev, within a specified amount of time.
+func ensureNodesExistImpl(dss []gadget.OnDiskStructure, timeout time.Duration) error {
+	t0 := time.Now()
+	for _, ds := range dss {
+		found := false
+		for time.Since(t0) < timeout {
+			if osutil.FileExists(ds.Node) {
+				found = true
+				break
+			}
+			time.Sleep(100 * time.Millisecond)
+		}
+		if found {
+			if err := udevTrigger(ds.Node); err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("device %s not available", ds.Node)
+		}
+	}
+	return nil
+}
+
+// reloadPartitionTable instructs the kernel to re-read the partition
+// table of a given block device.
+func reloadPartitionTable(device string) error {
+	// Re-read the partition table using the BLKPG ioctl, which doesn't
+	// remove existing partitions, only appends new partitions with the right
+	// size and offset. As long as we provide consistent partitioning from
+	// userspace we're safe.
+	output, err := exec.Command("partx", "-u", device).CombinedOutput()
+	if err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
+
+// udevTrigger triggers udev for the specified device and waits until
+// all events in the udev queue are handled.
+func udevTrigger(device string) error {
+	if output, err := exec.Command("udevadm", "trigger", "--settle", device).CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
+
+// wasCreatedDuringInstall returns if the OnDiskStructure was created during
+// install by referencing the gadget volume. A structure is only considered to
+// be created during install if it is a role that is created during install and
+// the start offsets match. We specifically don't look at anything on the
+// structure such as filesystem information since this may be incomplete due to
+// a failed installation, or due to the partial layout that is created by some
+// ARM tools (i.e. ptool and fastboot) when flashing images to internal MMC.
+func wasCreatedDuringInstall(lv *gadget.LaidOutVolume, s gadget.OnDiskStructure) bool {
+	// for a structure to have been created during install, it must be one of
+	// the system-boot, system-data, or system-save roles from the gadget, and
+	// as such the on disk structure must exist in the exact same location as
+	// the role from the gadget, so only return true if the provided structure
+	// has the exact same StartOffset as one of those roles
+	for _, gs := range lv.LaidOutStructure {
+		// TODO: how to handle ubuntu-save here? maybe a higher level function
+		//       should decide whether to delete it or not?
+		switch gs.Role {
+		case gadget.SystemSave, gadget.SystemData, gadget.SystemBoot:
+			// then it was created during install or is to be created during
+			// install, see if the offset matches the provided on disk structure
+			// has
+			if s.StartOffset == gs.StartOffset {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// createdDuringInstall returns a list of partitions created during the
+// install process.
+func createdDuringInstall(lv *gadget.LaidOutVolume, layout *gadget.OnDiskVolume) (created []string) {
+	created = make([]string, 0, len(layout.Structure))
+	for _, s := range layout.Structure {
+		if wasCreatedDuringInstall(lv, s) {
+			created = append(created, s.Node)
+		}
+	}
+	return created
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/install/partition_test.go snapd-2.48.3+20.04/gadget/install/partition_test.go
--- snapd-2.45.1+20.04.2/gadget/install/partition_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/install/partition_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,607 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package install_test
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
+	"github.com/snapcore/snapd/gadget/quantity"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type partitionTestSuite struct {
+	testutil.BaseTest
+
+	dir        string
+	gadgetRoot string
+	cmdPartx   *testutil.MockCmd
+}
+
+var _ = Suite(&partitionTestSuite{})
+
+func (s *partitionTestSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.dir = c.MkDir()
+	s.gadgetRoot = filepath.Join(c.MkDir(), "gadget")
+
+	s.cmdPartx = testutil.MockCommand(c, "partx", "")
+	s.AddCleanup(s.cmdPartx.Restore)
+
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `echo "sfdisk was not mocked"; exit 1`)
+	s.AddCleanup(cmdSfdisk.Restore)
+	cmdLsblk := testutil.MockCommand(c, "lsblk", `echo "lsblk was not mocked"; exit 1`)
+	s.AddCleanup(cmdLsblk.Restore)
+}
+
+const (
+	scriptPartitionsBios = iota
+	scriptPartitionsBiosSeed
+	scriptPartitionsBiosSeedData
+)
+
+func makeSfdiskScript(num int) string {
+	var b bytes.Buffer
+
+	b.WriteString(`
+>&2 echo "Some warning from sfdisk"
+echo '{
+  "partitiontable": {
+    "label": "gpt",
+    "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+    "device": "/dev/node",
+    "unit": "sectors",
+    "firstlba": 34,
+    "lastlba": 8388574,
+    "partitions": [`)
+
+	// BIOS boot partition
+	if num >= scriptPartitionsBios {
+		b.WriteString(`
+      {
+        "node": "/dev/node1",
+        "start": 2048,
+        "size": 2048,
+        "type": "21686148-6449-6E6F-744E-656564454649",
+        "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F",
+        "name": "BIOS Boot"
+      }`)
+	}
+
+	// Seed partition
+	if num >= scriptPartitionsBiosSeed {
+		b.WriteString(`,
+      {
+        "node": "/dev/node2",
+        "start": 4096,
+        "size": 2457600,
+        "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+        "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F",
+        "name": "Recovery"
+      }`)
+	}
+
+	// Data partition
+	if num >= scriptPartitionsBiosSeedData {
+		b.WriteString(`,
+      {
+        "node": "/dev/node3",
+        "start": 2461696,
+        "size": 2457600,
+        "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
+        "uuid": "f940029d-bfbb-4887-9d44-321e85c63866",
+        "name": "Writable"
+      }`)
+	}
+
+	b.WriteString(`
+    ]
+  }
+}'`)
+	return b.String()
+}
+
+func makeLsblkScript(num int) string {
+	var b bytes.Buffer
+
+	// BIOS boot partition
+	if num >= scriptPartitionsBios {
+		b.WriteString(`
+[ "$3" == "/dev/node1" ] && echo '{
+    "blockdevices": [ {"name": "node1", "fstype": null, "label": null, "uuid": null, "mountpoint": null} ]
+}'`)
+	}
+
+	// Seed partition
+	if num >= scriptPartitionsBiosSeed {
+		b.WriteString(`
+[ "$3" == "/dev/node2" ] && echo '{
+    "blockdevices": [ {"name": "node2", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "A644-B807", "mountpoint": null} ]
+}'`)
+	}
+
+	// Data partition
+	if num >= scriptPartitionsBiosSeedData {
+		b.WriteString(`
+[ "$3" == "/dev/node3" ] && echo '{
+    "blockdevices": [ {"name": "node3", "fstype": "ext4", "label": "ubuntu-data", "uuid": "8781-433a", "mountpoint": null} ]
+}'`)
+	}
+
+	b.WriteString(`
+exit 0`)
+
+	return b.String()
+}
+
+var mockOnDiskStructureWritable = gadget.OnDiskStructure{
+	Node: "/dev/node3",
+	LaidOutStructure: gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Name:       "Writable",
+			Size:       1258291200,
+			Type:       "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
+			Role:       "system-data",
+			Label:      "ubuntu-data",
+			Filesystem: "ext4",
+		},
+		StartOffset: 1260388352,
+		Index:       3,
+	},
+	// expanded to fill the disk
+	Size: 2*quantity.SizeGiB + 845*quantity.SizeMiB + 1031680,
+}
+
+func (s *partitionTestSuite) TestCreatePartitions(c *C) {
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", makeSfdiskScript(scriptPartitionsBiosSeed))
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", makeLsblkScript(scriptPartitionsBiosSeed))
+	defer cmdLsblk.Restore()
+
+	calls := 0
+	restore := install.MockEnsureNodesExist(func(ds []gadget.OnDiskStructure, timeout time.Duration) error {
+		calls++
+		c.Assert(ds, HasLen, 1)
+		c.Assert(ds[0].Node, Equals, "/dev/node3")
+		return nil
+	})
+	defer restore()
+
+	err := makeMockGadget(s.gadgetRoot, gadgetContent)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, IsNil)
+	created, err := install.CreateMissingPartitions(dl, pv)
+	c.Assert(err, IsNil)
+	c.Assert(created, DeepEquals, []gadget.OnDiskStructure{mockOnDiskStructureWritable})
+	c.Assert(calls, Equals, 1)
+
+	// Check partition table read and write
+	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
+		{"sfdisk", "--json", "/dev/node"},
+		{"sfdisk", "--append", "--no-reread", "/dev/node"},
+	})
+
+	// Check partition table update
+	c.Assert(s.cmdPartx.Calls(), DeepEquals, [][]string{
+		{"partx", "-u", "/dev/node"},
+	})
+}
+
+func (s *partitionTestSuite) TestRemovePartitionsTrivial(c *C) {
+	// no locally created partitions
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", makeSfdiskScript(scriptPartitionsBios))
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", makeLsblkScript(scriptPartitionsBios))
+	defer cmdLsblk.Restore()
+
+	err := makeMockGadget(s.gadgetRoot, gadgetContent)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, IsNil)
+
+	err = install.RemoveCreatedPartitions(pv, dl)
+	c.Assert(err, IsNil)
+
+	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
+		{"sfdisk", "--json", "/dev/node"},
+	})
+
+	c.Assert(cmdLsblk.Calls(), DeepEquals, [][]string{
+		{"lsblk", "--fs", "--json", "/dev/node1"},
+	})
+}
+
+func (s *partitionTestSuite) TestRemovePartitions(c *C) {
+	const mockSfdiskScriptRemovablePartition = `
+if [ -f %[1]s/2 ]; then
+   rm %[1]s/[0-9]
+elif [ -f %[1]s/1 ]; then
+   touch %[1]s/2
+   exit 0
+else
+   PART=',
+   {"node": "/dev/node2", "start": 4096, "size": 2457600, "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4", "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F", "name": "Recovery"},
+   {"node": "/dev/node3", "start": 2461696, "size": 2457600, "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4", "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F", "name": "Recovery"}
+   '
+   touch %[1]s/1
+fi
+echo '{
+   "partitiontable": {
+      "label": "gpt",
+      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+      "device": "/dev/node",
+      "unit": "sectors",
+      "firstlba": 34,
+      "lastlba": 8388574,
+      "partitions": [
+         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"}
+         '"$PART
+      ]
+   }
+}"`
+
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", fmt.Sprintf(mockSfdiskScriptRemovablePartition, s.dir))
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", makeLsblkScript(scriptPartitionsBiosSeedData))
+	defer cmdLsblk.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, IsNil)
+
+	c.Assert(cmdLsblk.Calls(), DeepEquals, [][]string{
+		{"lsblk", "--fs", "--json", "/dev/node1"},
+		{"lsblk", "--fs", "--json", "/dev/node2"},
+		{"lsblk", "--fs", "--json", "/dev/node3"},
+	})
+
+	err = makeMockGadget(s.gadgetRoot, gadgetContent)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	err = install.RemoveCreatedPartitions(pv, dl)
+	c.Assert(err, IsNil)
+
+	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
+		{"sfdisk", "--json", "/dev/node"},
+		{"sfdisk", "--no-reread", "--delete", "/dev/node", "3"},
+		{"sfdisk", "--json", "/dev/node"},
+	})
+}
+
+func (s *partitionTestSuite) TestRemovePartitionsError(c *C) {
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", makeSfdiskScript(scriptPartitionsBiosSeedData))
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", makeLsblkScript(scriptPartitionsBiosSeedData))
+	defer cmdLsblk.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("node")
+	c.Assert(err, IsNil)
+
+	err = makeMockGadget(s.gadgetRoot, gadgetContent)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	err = install.RemoveCreatedPartitions(pv, dl)
+	c.Assert(err, ErrorMatches, "cannot remove partitions: /dev/node3")
+}
+
+func (s *partitionTestSuite) TestEnsureNodesExist(c *C) {
+	const mockUdevadmScript = `err=%q; echo "$err"; [ -n "$err" ] && exit 1 || exit 0`
+	for _, tc := range []struct {
+		utErr string
+		err   string
+	}{
+		{utErr: "", err: ""},
+		{utErr: "some error", err: "some error"},
+	} {
+		c.Logf("utErr:%q err:%q", tc.utErr, tc.err)
+
+		node := filepath.Join(c.MkDir(), "node")
+		err := ioutil.WriteFile(node, nil, 0644)
+		c.Assert(err, IsNil)
+
+		cmdUdevadm := testutil.MockCommand(c, "udevadm", fmt.Sprintf(mockUdevadmScript, tc.utErr))
+		defer cmdUdevadm.Restore()
+
+		ds := []gadget.OnDiskStructure{{Node: node}}
+		err = install.EnsureNodesExist(ds, 10*time.Millisecond)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+
+		c.Assert(cmdUdevadm.Calls(), DeepEquals, [][]string{
+			{"udevadm", "trigger", "--settle", node},
+		})
+	}
+}
+
+func (s *partitionTestSuite) TestEnsureNodesExistTimeout(c *C) {
+	cmdUdevadm := testutil.MockCommand(c, "udevadm", "")
+	defer cmdUdevadm.Restore()
+
+	node := filepath.Join(c.MkDir(), "node")
+	ds := []gadget.OnDiskStructure{{Node: node}}
+	t := time.Now()
+	timeout := 1 * time.Second
+	err := install.EnsureNodesExist(ds, timeout)
+	c.Assert(err, ErrorMatches, fmt.Sprintf("device %s not available", node))
+	c.Assert(time.Since(t) >= timeout, Equals, true)
+	c.Assert(cmdUdevadm.Calls(), HasLen, 0)
+}
+
+const gptGadgetContentWithSave = `volumes:
+  pc:
+    bootloader: grub
+    structure:
+      - name: mbr
+        type: mbr
+        size: 440
+        content:
+          - image: pc-boot.img
+      - name: BIOS Boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        offset: 1M
+        offset-write: mbr+92
+        content:
+          - image: pc-core.img
+      - name: Recovery
+        role: system-seed
+        filesystem: vfat
+        # UEFI will boot the ESP partition by default first
+        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+        size: 1200M
+        content:
+          - source: grubx64.efi
+            target: EFI/boot/grubx64.efi
+      - name: Save
+        role: system-save
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 128M
+      - name: Writable
+        role: system-data
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 1200M
+`
+
+func (s *partitionTestSuite) TestCreatedDuringInstallGPT(c *C) {
+	cmdLsblk := testutil.MockCommand(c, "lsblk", `
+case $3 in
+	/dev/node1)
+		echo '{ "blockdevices": [ {"fstype":"ext4", "label":null} ] }'
+		;;
+	/dev/node2)
+		echo '{ "blockdevices": [ {"fstype":"ext4", "label":"ubuntu-seed"} ] }'
+		;;
+	/dev/node3)
+		echo '{ "blockdevices": [ {"fstype":"ext4", "label":"ubuntu-save"} ] }'
+		;;
+	/dev/node4)
+		echo '{ "blockdevices": [ {"fstype":"ext4", "label":"ubuntu-data"} ] }'
+		;;
+	*)
+		echo "unexpected args: $*"
+		exit 1
+		;;
+esac
+`)
+	defer cmdLsblk.Restore()
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `
+echo '{
+  "partitiontable": {
+    "label": "gpt",
+    "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+    "device": "/dev/node",
+    "unit": "sectors",
+    "firstlba": 34,
+    "lastlba": 8388574,
+    "partitions": [
+     {
+         "node": "/dev/node1",
+         "start": 2048,
+         "size": 2048,
+         "type": "21686148-6449-6E6F-744E-656564454649",
+         "uuid": "30a26851-4b08-4b8d-8aea-f686e723ed8c",
+         "name": "BIOS boot partition"
+     },
+     {
+         "node": "/dev/node2",
+         "start": 4096,
+         "size": 2457600,
+         "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+         "uuid": "7ea3a75a-3f6d-4647-8134-89ae61fe88d5",
+         "name": "Linux filesystem"
+     },
+     {
+         "node": "/dev/node3",
+         "start": 2461696,
+         "size": 262144,
+         "type": "0fc63daf-8483-4772-8e79-3d69d8477de4",
+         "uuid": "641764aa-a680-4d36-a7ad-f7bd01fd8d12",
+         "name": "Linux filesystem"
+     },
+     {
+         "node": "/dev/node4",
+         "start": 2723840,
+         "size": 2457600,
+         "type": "0fc63daf-8483-4772-8e79-3d69d8477de4",
+         "uuid": "8ab3e8fd-d53d-4d72-9c5e-56146915fd07",
+         "name": "Another Linux filesystem"
+     }
+     ]
+  }
+}'
+`)
+	defer cmdSfdisk.Restore()
+
+	err := makeMockGadget(s.gadgetRoot, gptGadgetContentWithSave)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	dl, err := gadget.OnDiskVolumeFromDevice("node")
+	c.Assert(err, IsNil)
+
+	list := install.CreatedDuringInstall(pv, dl)
+	// only save and writable should show up
+	c.Check(list, DeepEquals, []string{"/dev/node3", "/dev/node4"})
+}
+
+// this is an mbr gadget like the pi, but doesn't have the amd64 mbr structure
+// so it's probably not representative, but still useful for unit tests here
+const mbrGadgetContentWithSave = `volumes:
+  pc:
+    schema: mbr
+    bootloader: grub
+    structure:
+      - name: Recovery
+        role: system-seed
+        filesystem: vfat
+        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+        offset: 2M
+        size: 1200M
+        content:
+          - source: grubx64.efi
+            target: EFI/boot/grubx64.efi
+      - name: Boot
+        role: system-boot
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 1200M
+      - name: Save
+        role: system-save
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 128M
+      - name: Writable
+        role: system-data
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 1200M
+`
+
+func (s *partitionTestSuite) TestCreatedDuringInstallMBR(c *C) {
+	cmdLsblk := testutil.MockCommand(c, "lsblk", `
+what=
+shift 2
+case "$1" in
+   /dev/node1)
+      what='{"name": "node1", "fstype":"ext4", "label":"ubuntu-seed"}'
+      ;;
+   /dev/node2)
+      what='{"name": "node2", "fstype":"vfat", "label":"ubuntu-boot"}'
+      ;;
+   /dev/node3)
+      what='{"name": "node3", "fstype":"ext4", "label":"ubuntu-save"}'
+      ;;
+   /dev/node4)
+      what='{"name": "node4", "fstype":"ext4", "label":"ubuntu-data"}'
+      ;;
+  *)
+    echo "unexpected call"
+    exit 1
+esac
+
+cat <<EOF
+{
+"blockdevices": [
+   $what
+  ]
+}
+EOF`)
+	defer cmdLsblk.Restore()
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `
+echo '{
+  "partitiontable": {
+    "label": "dos",
+    "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+    "device": "/dev/node",
+    "unit": "sectors",
+    "firstlba": 0,
+    "lastlba": 8388574,
+    "partitions": [
+     {
+         "node": "/dev/node1",
+         "start": 0,
+         "size": 2460672,
+         "type": "0a"
+     },
+     {
+         "node": "/dev/node2",
+         "start": 2461696,
+         "size": 2460672,
+         "type": "b"
+     },
+     {
+         "node": "/dev/node3",
+         "start": 4919296,
+         "size": 262144,
+         "type": "c"
+     },
+     {
+         "node": "/dev/node4",
+         "start": 5181440,
+         "size": 2460672,
+         "type": "0d"
+     }
+     ]
+  }
+}'
+`)
+	defer cmdSfdisk.Restore()
+	cmdBlockdev := testutil.MockCommand(c, "blockdev", `echo '1234567'`)
+	defer cmdBlockdev.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("node")
+	c.Assert(err, IsNil)
+
+	err = makeMockGadget(s.gadgetRoot, mbrGadgetContentWithSave)
+	c.Assert(err, IsNil)
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	list := install.CreatedDuringInstall(pv, dl)
+	c.Assert(list, DeepEquals, []string{"/dev/node2", "/dev/node3", "/dev/node4"})
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/internal/mkfs.go snapd-2.48.3+20.04/gadget/internal/mkfs.go
--- snapd-2.45.1+20.04.2/gadget/internal/mkfs.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/internal/mkfs.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,170 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/gadget/quantity"
+	"github.com/snapcore/snapd/osutil"
+)
+
+type MkfsFunc func(imgFile, label, contentsRootDir string, deviceSize quantity.Size) error
+
+var (
+	mkfsHandlers = map[string]MkfsFunc{
+		"vfat": mkfsVfat,
+		"ext4": mkfsExt4,
+	}
+)
+
+// Mkfs creates a filesystem of given type and provided label in the device or
+// file. The device size provides hints for additional tuning of the created
+// filesystem.
+func Mkfs(typ, img, label string, deviceSize quantity.Size) error {
+	return MkfsWithContent(typ, img, label, "", deviceSize)
+}
+
+// Mkfs creates a filesystem of given type and provided label in the device or
+// file. The filesystem is populated with contents of contentRootDir. The device
+// size provides hints for additional tuning of the created filesystem.
+func MkfsWithContent(typ, img, label, contentRootDir string, deviceSize quantity.Size) error {
+	h, ok := mkfsHandlers[typ]
+	if !ok {
+		return fmt.Errorf("cannot create unsupported filesystem %q", typ)
+	}
+	return h(img, label, contentRootDir, deviceSize)
+}
+
+// mkfsExt4 creates an EXT4 filesystem in given image file, with an optional
+// filesystem label, and populates it with the contents of provided root
+// directory.
+func mkfsExt4(img, label, contentsRootDir string, deviceSize quantity.Size) error {
+	// Originally taken from ubuntu-image
+	// Switched to use mkfs defaults for https://bugs.launchpad.net/snappy/+bug/1878374
+	// For caveats/requirements in case we need support for older systems:
+	// https://github.com/snapcore/snapd/pull/6997#discussion_r293967140
+	mkfsArgs := []string{"mkfs.ext4"}
+	const size32MiB = 32 * quantity.SizeMiB
+	if deviceSize != 0 && deviceSize <= size32MiB {
+		// With the default of 4096 bytes, the minimal journal size is
+		// 4M, meaning we loose a lot of usable space. Try to follow the
+		// e2fsprogs upstream and use a 1k block size for smaller
+		// filesystems, note that this may cause issues like
+		// https://bugs.launchpad.net/ubuntu/+source/lvm2/+bug/1817097
+		// if one migrates the filesystem to a device with a different
+		// block size
+		mkfsArgs = append(mkfsArgs, "-b", "1024")
+	}
+	if contentsRootDir != "" {
+		// mkfs.ext4 can populate the filesystem with contents of given
+		// root directory
+		// TODO: support e2fsprogs 1.42 without -d in Ubuntu 16.04
+		mkfsArgs = append(mkfsArgs, "-d", contentsRootDir)
+	}
+	if label != "" {
+		mkfsArgs = append(mkfsArgs, "-L", label)
+	}
+	mkfsArgs = append(mkfsArgs, img)
+
+	var cmd *exec.Cmd
+	if os.Geteuid() != 0 {
+		// run through fakeroot so that files are owned by root
+		cmd = exec.Command("fakeroot", mkfsArgs...)
+	} else {
+		// no need to fake it if we're already root
+		cmd = exec.Command(mkfsArgs[0], mkfsArgs[1:]...)
+	}
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return osutil.OutputErr(out, err)
+	}
+	return nil
+}
+
+// mkfsVfat creates a VFAT filesystem in given image file, with an optional
+// filesystem label, and populates it with the contents of provided root
+// directory.
+func mkfsVfat(img, label, contentsRootDir string, deviceSize quantity.Size) error {
+	// taken from ubuntu-image
+	mkfsArgs := []string{
+		// 512B logical sector size
+		"-S", "512",
+		// 1 sector per cluster
+		"-s", "1",
+		// 32b FAT size
+		"-F", "32",
+	}
+	if label != "" {
+		mkfsArgs = append(mkfsArgs, "-n", label)
+	}
+	mkfsArgs = append(mkfsArgs, img)
+
+	cmd := exec.Command("mkfs.vfat", mkfsArgs...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return osutil.OutputErr(out, err)
+	}
+
+	// if there is no content to copy we are done now
+	if contentsRootDir == "" {
+		return nil
+	}
+
+	// mkfs.vfat does not know how to populate the filesystem with contents,
+	// we need to do the work ourselves
+
+	fis, err := ioutil.ReadDir(contentsRootDir)
+	if err != nil {
+		return fmt.Errorf("cannot list directory contents: %v", err)
+	}
+	if len(fis) == 0 {
+		// nothing to copy to the image
+		return nil
+	}
+
+	mcopyArgs := make([]string, 0, 4+len(fis))
+	mcopyArgs = append(mcopyArgs,
+		// recursive copy
+		"-s",
+		// image file
+		"-i", img)
+	for _, fi := range fis {
+		mcopyArgs = append(mcopyArgs, filepath.Join(contentsRootDir, fi.Name()))
+	}
+	mcopyArgs = append(mcopyArgs,
+		// place content at the / of the filesystem
+		"::")
+
+	cmd = exec.Command("mcopy", mcopyArgs...)
+	cmd.Env = os.Environ()
+	// skip mtools checks to avoid unnecessary warnings
+	cmd.Env = append(cmd.Env, "MTOOLS_SKIP_CHECK=1")
+
+	out, err = cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("cannot populate vfat filesystem with contents: %v", osutil.OutputErr(out, err))
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/internal/mkfs_test.go snapd-2.48.3+20.04/gadget/internal/mkfs_test.go
--- snapd-2.45.1+20.04.2/gadget/internal/mkfs_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/internal/mkfs_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,314 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal_test
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/gadget/internal"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func TestRun(t *testing.T) { TestingT(t) }
+
+type mkfsSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&mkfsSuite{})
+
+func (m *mkfsSuite) SetUpTest(c *C) {
+	m.BaseTest.SetUpTest(c)
+
+	// fakeroot, mkfs.ext4, mkfs.vfat and mcopy are commonly installed in
+	// the host system, set up some overrides so that we avoid calling the
+	// host tools
+	cmdFakeroot := testutil.MockCommand(c, "fakeroot", "echo 'override in test' ; exit 1")
+	m.AddCleanup(cmdFakeroot.Restore)
+
+	cmdMkfsExt4 := testutil.MockCommand(c, "mkfs.ext4", "echo 'override in test' ; exit 1")
+	m.AddCleanup(cmdMkfsExt4.Restore)
+
+	cmdMkfsVfat := testutil.MockCommand(c, "mkfs.vfat", "echo 'override in test'; exit 1")
+	m.AddCleanup(cmdMkfsVfat.Restore)
+
+	cmdMcopy := testutil.MockCommand(c, "mcopy", "echo 'override in test'; exit 1")
+	m.AddCleanup(cmdMcopy.Restore)
+}
+
+func (m *mkfsSuite) TestMkfsExt4Happy(c *C) {
+	cmd := testutil.MockCommand(c, "fakeroot", "")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("ext4", "foo.img", "my-label", "contents", 0)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"fakeroot",
+			"mkfs.ext4",
+			"-d", "contents",
+			"-L", "my-label",
+			"foo.img",
+		},
+	})
+
+	cmd.ForgetCalls()
+
+	// empty label
+	err = internal.MkfsWithContent("ext4", "foo.img", "", "contents", 0)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"fakeroot",
+			"mkfs.ext4",
+			"-d", "contents",
+			"foo.img",
+		},
+	})
+
+	cmd.ForgetCalls()
+
+	// no content
+	err = internal.Mkfs("ext4", "foo.img", "my-label", 0)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"fakeroot",
+			"mkfs.ext4",
+			"-L", "my-label",
+			"foo.img",
+		},
+	})
+
+}
+
+func (m *mkfsSuite) TestMkfsExt4WithSize(c *C) {
+	cmd := testutil.MockCommand(c, "fakeroot", "")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("ext4", "foo.img", "my-label", "contents", 250*1024*1024)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"fakeroot",
+			"mkfs.ext4",
+			"-d", "contents",
+			"-L", "my-label",
+			"foo.img",
+		},
+	})
+
+	cmd.ForgetCalls()
+
+	// empty label
+	err = internal.MkfsWithContent("ext4", "foo.img", "", "contents", 32*1024*1024)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"fakeroot",
+			"mkfs.ext4",
+			"-b", "1024",
+			"-d", "contents",
+			"foo.img",
+		},
+	})
+
+	cmd.ForgetCalls()
+}
+
+func (m *mkfsSuite) TestMkfsExt4Error(c *C) {
+	cmd := testutil.MockCommand(c, "fakeroot", "echo 'command failed'; exit 1")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("ext4", "foo.img", "my-label", "contents", 0)
+	c.Assert(err, ErrorMatches, "command failed")
+}
+
+func (m *mkfsSuite) TestMkfsVfatHappySimple(c *C) {
+	// no contents, should not fail
+	d := c.MkDir()
+
+	cmd := testutil.MockCommand(c, "mkfs.vfat", "")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", d, 0)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"mkfs.vfat",
+			"-S", "512",
+			"-s", "1",
+			"-F", "32",
+			"-n", "my-label",
+			"foo.img",
+		},
+	})
+
+	cmd.ForgetCalls()
+
+	// empty label
+	err = internal.MkfsWithContent("vfat", "foo.img", "", d, 0)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"mkfs.vfat",
+			"-S", "512",
+			"-s", "1",
+			"-F", "32",
+			"foo.img",
+		},
+	})
+
+	cmd.ForgetCalls()
+
+	// no content
+	err = internal.Mkfs("vfat", "foo.img", "my-label", 0)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"mkfs.vfat",
+			"-S", "512",
+			"-s", "1",
+			"-F", "32",
+			"-n", "my-label",
+			"foo.img",
+		},
+	})
+}
+
+func (m *mkfsSuite) TestMkfsVfatWithSize(c *C) {
+	d := c.MkDir()
+
+	cmd := testutil.MockCommand(c, "mkfs.vfat", "")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", d, 32*1024*1024)
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{
+			"mkfs.vfat",
+			"-S", "512",
+			"-s", "1",
+			"-F", "32",
+			"-n", "my-label",
+			"foo.img",
+		},
+	})
+}
+
+func (m *mkfsSuite) TestMkfsVfatHappyContents(c *C) {
+	d := c.MkDir()
+	makeSizedFile(c, filepath.Join(d, "foo"), 128, []byte("foo foo foo"))
+	makeSizedFile(c, filepath.Join(d, "bar/bar-content"), 128, []byte("bar bar bar"))
+
+	cmdMkfs := testutil.MockCommand(c, "mkfs.vfat", "")
+	defer cmdMkfs.Restore()
+
+	cmdMcopy := testutil.MockCommand(c, "mcopy", "")
+	defer cmdMcopy.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", d, 0)
+	c.Assert(err, IsNil)
+	c.Assert(cmdMkfs.Calls(), HasLen, 1)
+
+	c.Assert(cmdMcopy.Calls(), DeepEquals, [][]string{
+		{"mcopy", "-s", "-i", "foo.img", filepath.Join(d, "bar"), filepath.Join(d, "foo"), "::"},
+	})
+}
+
+func (m *mkfsSuite) TestMkfsVfatErrorSimpleFail(c *C) {
+	d := c.MkDir()
+
+	cmd := testutil.MockCommand(c, "mkfs.vfat", "echo 'failed'; false")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", d, 0)
+	c.Assert(err, ErrorMatches, "failed")
+}
+
+func (m *mkfsSuite) TestMkfsVfatErrorUnreadableDir(c *C) {
+	cmd := testutil.MockCommand(c, "mkfs.vfat", "")
+	defer cmd.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", "dir-does-not-exist", 0)
+	c.Assert(err, ErrorMatches, "cannot list directory contents: .* no such file or directory")
+	c.Assert(cmd.Calls(), HasLen, 1)
+}
+
+func (m *mkfsSuite) TestMkfsVfatErrorInMcopy(c *C) {
+	d := c.MkDir()
+	makeSizedFile(c, filepath.Join(d, "foo"), 128, []byte("foo foo foo"))
+
+	cmdMkfs := testutil.MockCommand(c, "mkfs.vfat", "")
+	defer cmdMkfs.Restore()
+
+	cmdMcopy := testutil.MockCommand(c, "mcopy", "echo 'hard fail'; exit 1")
+	defer cmdMcopy.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", d, 0)
+	c.Assert(err, ErrorMatches, "cannot populate vfat filesystem with contents: hard fail")
+	c.Assert(cmdMkfs.Calls(), HasLen, 1)
+	c.Assert(cmdMcopy.Calls(), HasLen, 1)
+}
+
+func (m *mkfsSuite) TestMkfsVfatHappyNoContents(c *C) {
+	cmdMkfs := testutil.MockCommand(c, "mkfs.vfat", "")
+	defer cmdMkfs.Restore()
+
+	cmdMcopy := testutil.MockCommand(c, "mcopy", "")
+	defer cmdMcopy.Restore()
+
+	err := internal.MkfsWithContent("vfat", "foo.img", "my-label", "", 0)
+	c.Assert(err, IsNil)
+	c.Assert(cmdMkfs.Calls(), HasLen, 1)
+	// mcopy was not called
+	c.Assert(cmdMcopy.Calls(), HasLen, 0)
+}
+
+func (m *mkfsSuite) TestMkfsInvalidFs(c *C) {
+	err := internal.MkfsWithContent("no-fs", "foo.img", "my-label", "", 0)
+	c.Assert(err, ErrorMatches, `cannot create unsupported filesystem "no-fs"`)
+
+	err = internal.Mkfs("no-fs", "foo.img", "my-label", 0)
+	c.Assert(err, ErrorMatches, `cannot create unsupported filesystem "no-fs"`)
+}
+
+func makeSizedFile(c *C, path string, size int64, content []byte) {
+	err := os.MkdirAll(filepath.Dir(path), 0755)
+	c.Assert(err, IsNil)
+
+	f, err := os.Create(path)
+	c.Assert(err, IsNil)
+	defer f.Close()
+	if size != 0 {
+		err = f.Truncate(size)
+		c.Assert(err, IsNil)
+	}
+	if content != nil {
+		_, err := io.Copy(f, bytes.NewReader(content))
+		c.Assert(err, IsNil)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/layout.go snapd-2.48.3+20.04/gadget/layout.go
--- snapd-2.45.1+20.04.2/gadget/layout.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/layout.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,8 @@
 	"os"
 	"path/filepath"
 	"sort"
+
+	"github.com/snapcore/snapd/gadget/quantity"
 )
 
 // LayoutConstraints defines the constraints for arranging structures within a
@@ -31,9 +33,9 @@
 type LayoutConstraints struct {
 	// NonMBRStartOffset is the default start offset of non-MBR structure in
 	// the volume.
-	NonMBRStartOffset Size
+	NonMBRStartOffset quantity.Size
 	// SectorSize is the size of the sector to be used for calculations
-	SectorSize Size
+	SectorSize quantity.Size
 }
 
 // LaidOutVolume defines the size of a volume and arrangement of all the
@@ -41,9 +43,9 @@
 type LaidOutVolume struct {
 	*Volume
 	// Size is the total size of the volume
-	Size Size
+	Size quantity.Size
 	// SectorSize sector size of the volume
-	SectorSize Size
+	SectorSize quantity.Size
 	// LaidOutStructure is a list of structures within the volume, sorted
 	// by their start offsets
 	LaidOutStructure []LaidOutStructure
@@ -56,7 +58,7 @@
 type PartiallyLaidOutVolume struct {
 	*Volume
 	// SectorSize sector size of the volume
-	SectorSize Size
+	SectorSize quantity.Size
 	// LaidOutStructure is a list of structures within the volume, sorted
 	// by their start offsets
 	LaidOutStructure []LaidOutStructure
@@ -68,10 +70,10 @@
 	*VolumeStructure
 	// StartOffset defines the start offset of the structure within the
 	// enclosing volume
-	StartOffset Size
+	StartOffset quantity.Size
 	// AbsoluteOffsetWrite is the resolved absolute position of offset-write
 	// for this structure element within the enclosing volume
-	AbsoluteOffsetWrite *Size
+	AbsoluteOffsetWrite *quantity.Size
 	// Index of the structure definition in gadget YAML
 	Index int
 	// LaidOutContent is a list of raw content inside the structure
@@ -94,12 +96,12 @@
 	*VolumeContent
 
 	// StartOffset defines the start offset of this content image
-	StartOffset Size
+	StartOffset quantity.Size
 	// AbsoluteOffsetWrite is the resolved absolute position of offset-write
 	// for this content element within the enclosing volume
-	AbsoluteOffsetWrite *Size
+	AbsoluteOffsetWrite *quantity.Size
 	// Size is the maximum size occupied by this image
-	Size Size
+	Size quantity.Size
 	// Index of the content in structure declaration inside gadget YAML
 	Index int
 }
@@ -112,7 +114,7 @@
 }
 
 func layoutVolumeStructures(volume *Volume, constraints LayoutConstraints) (structures []LaidOutStructure, byName map[string]*LaidOutStructure, err error) {
-	previousEnd := Size(0)
+	previousEnd := quantity.Size(0)
 	structures = make([]LaidOutStructure, len(volume.Structure))
 	byName = make(map[string]*LaidOutStructure, len(volume.Structure))
 
@@ -121,9 +123,9 @@
 	}
 
 	for idx, s := range volume.Structure {
-		var start Size
+		var start quantity.Size
 		if s.Offset == nil {
-			if s.EffectiveRole() != MBR && previousEnd < constraints.NonMBRStartOffset {
+			if s.EffectiveRole() != schemaMBR && previousEnd < constraints.NonMBRStartOffset {
 				start = constraints.NonMBRStartOffset
 			} else {
 				start = previousEnd
@@ -139,7 +141,7 @@
 			Index:           idx,
 		}
 
-		if ps.EffectiveRole() != MBR {
+		if ps.EffectiveRole() != schemaMBR {
 			if s.Size%constraints.SectorSize != 0 {
 				return nil, nil, fmt.Errorf("cannot lay out volume, structure %v size is not a multiple of sector size %v",
 					ps, constraints.SectorSize)
@@ -158,7 +160,7 @@
 	// sort by starting offset
 	sort.Sort(byStartOffset(structures))
 
-	previousEnd = Size(0)
+	previousEnd = quantity.Size(0)
 	for idx, ps := range structures {
 		if ps.StartOffset < previousEnd {
 			return nil, nil, fmt.Errorf("cannot lay out volume, structure %v overlaps with preceding structure %v", ps, structures[idx-1])
@@ -198,8 +200,8 @@
 		return nil, err
 	}
 
-	farthestEnd := Size(0)
-	fartherstOffsetWrite := Size(0)
+	farthestEnd := quantity.Size(0)
+	fartherstOffsetWrite := quantity.Size(0)
 
 	for idx, ps := range structures {
 		if ps.AbsoluteOffsetWrite != nil && *ps.AbsoluteOffsetWrite > fartherstOffsetWrite {
@@ -244,12 +246,12 @@
 func (b byContentStartOffset) Swap(i, j int)      { b[i], b[j] = b[j], b[i] }
 func (b byContentStartOffset) Less(i, j int) bool { return b[i].StartOffset < b[j].StartOffset }
 
-func getImageSize(path string) (Size, error) {
+func getImageSize(path string) (quantity.Size, error) {
 	stat, err := os.Stat(path)
 	if err != nil {
 		return 0, err
 	}
-	return Size(stat.Size()), nil
+	return quantity.Size(stat.Size()), nil
 }
 
 func layOutStructureContent(gadgetRootDir string, ps *LaidOutStructure, known map[string]*LaidOutStructure) ([]LaidOutContent, error) {
@@ -262,7 +264,7 @@
 	}
 
 	content := make([]LaidOutContent, len(ps.Content))
-	previousEnd := Size(0)
+	previousEnd := quantity.Size(0)
 
 	for idx, c := range ps.Content {
 		imageSize, err := getImageSize(filepath.Join(gadgetRootDir, c.Image))
@@ -270,7 +272,7 @@
 			return nil, fmt.Errorf("cannot lay out structure %v: content %q: %v", ps, c.Image, err)
 		}
 
-		var start Size
+		var start quantity.Size
 		if c.Offset != nil {
 			start = *c.Offset
 		} else {
@@ -318,12 +320,12 @@
 	return content, nil
 }
 
-func resolveOffsetWrite(offsetWrite *RelativeOffset, knownStructs map[string]*LaidOutStructure) (*Size, error) {
+func resolveOffsetWrite(offsetWrite *RelativeOffset, knownStructs map[string]*LaidOutStructure) (*quantity.Size, error) {
 	if offsetWrite == nil {
 		return nil, nil
 	}
 
-	var relativeToOffset Size
+	var relativeToOffset quantity.Size
 	if offsetWrite.RelativeTo != "" {
 		otherStruct, ok := knownStructs[offsetWrite.RelativeTo]
 		if !ok {
@@ -338,16 +340,16 @@
 
 // ShiftStructureTo translates the starting offset of a laid out structure and
 // its content to the provided offset.
-func ShiftStructureTo(ps LaidOutStructure, offset Size) LaidOutStructure {
+func ShiftStructureTo(ps LaidOutStructure, offset quantity.Size) LaidOutStructure {
 	change := int64(offset - ps.StartOffset)
 
 	newPs := ps
-	newPs.StartOffset = Size(int64(ps.StartOffset) + change)
+	newPs.StartOffset = quantity.Size(int64(ps.StartOffset) + change)
 
 	newPs.LaidOutContent = make([]LaidOutContent, len(ps.LaidOutContent))
 	for idx, pc := range ps.LaidOutContent {
 		newPc := pc
-		newPc.StartOffset = Size(int64(pc.StartOffset) + change)
+		newPc.StartOffset = quantity.Size(int64(pc.StartOffset) + change)
 		newPs.LaidOutContent[idx] = newPc
 	}
 	return newPs
diff -Nru snapd-2.45.1+20.04.2/gadget/layout_test.go snapd-2.48.3+20.04/gadget/layout_test.go
--- snapd-2.45.1+20.04.2/gadget/layout_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/layout_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,6 +30,7 @@
 	"gopkg.in/yaml.v2"
 
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
 )
 
 type layoutTestSuite struct {
@@ -43,14 +44,14 @@
 }
 
 var defaultConstraints = gadget.LayoutConstraints{
-	NonMBRStartOffset: 1 * gadget.SizeMiB,
+	NonMBRStartOffset: 1 * quantity.SizeMiB,
 	SectorSize:        512,
 }
 
 func (p *layoutTestSuite) TestVolumeSize(c *C) {
 	vol := gadget.Volume{
 		Structure: []gadget.VolumeStructure{
-			{Size: 2 * gadget.SizeMiB},
+			{Size: 2 * quantity.SizeMiB},
 		},
 	}
 	v, err := gadget.LayoutVolume(p.dir, &vol, defaultConstraints)
@@ -59,14 +60,14 @@
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume: &gadget.Volume{
 			Structure: []gadget.VolumeStructure{
-				{Size: 2 * gadget.SizeMiB},
+				{Size: 2 * quantity.SizeMiB},
 			},
 		},
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
-			{VolumeStructure: &gadget.VolumeStructure{Size: 2 * gadget.SizeMiB}, StartOffset: 1 * gadget.SizeMiB},
+			{VolumeStructure: &gadget.VolumeStructure{Size: 2 * quantity.SizeMiB}, StartOffset: 1 * quantity.SizeMiB},
 		},
 	})
 }
@@ -102,18 +103,18 @@
 
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       501 * gadget.SizeMiB,
+		Size:       501 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           0,
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     401 * gadget.SizeMiB,
+				StartOffset:     401 * quantity.SizeMiB,
 				Index:           1,
 			},
 		},
@@ -145,28 +146,28 @@
 
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       1101 * gadget.SizeMiB,
+		Size:       1101 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           0,
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     401 * gadget.SizeMiB,
+				StartOffset:     401 * quantity.SizeMiB,
 				Index:           1,
 			},
 			{
 				VolumeStructure: &vol.Structure[2],
-				StartOffset:     901 * gadget.SizeMiB,
+				StartOffset:     901 * quantity.SizeMiB,
 				Index:           2,
 			},
 			{
 				VolumeStructure: &vol.Structure[3],
-				StartOffset:     1001 * gadget.SizeMiB,
+				StartOffset:     1001 * quantity.SizeMiB,
 				Index:           3,
 			},
 		},
@@ -202,28 +203,28 @@
 
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       1300 * gadget.SizeMiB,
+		Size:       1300 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[3],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           3,
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     200 * gadget.SizeMiB,
+				StartOffset:     200 * quantity.SizeMiB,
 				Index:           1,
 			},
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     800 * gadget.SizeMiB,
+				StartOffset:     800 * quantity.SizeMiB,
 				Index:           0,
 			},
 			{
 				VolumeStructure: &vol.Structure[2],
-				StartOffset:     1200 * gadget.SizeMiB,
+				StartOffset:     1200 * quantity.SizeMiB,
 				Index:           2,
 			},
 		},
@@ -258,28 +259,28 @@
 
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       1200 * gadget.SizeMiB,
+		Size:       1200 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[3],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           3,
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     200 * gadget.SizeMiB,
+				StartOffset:     200 * quantity.SizeMiB,
 				Index:           1,
 			},
 			{
 				VolumeStructure: &vol.Structure[2],
-				StartOffset:     700 * gadget.SizeMiB,
+				StartOffset:     700 * quantity.SizeMiB,
 				Index:           2,
 			},
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     800 * gadget.SizeMiB,
+				StartOffset:     800 * quantity.SizeMiB,
 				Index:           0,
 			},
 		},
@@ -305,7 +306,7 @@
 	c.Assert(err, ErrorMatches, `cannot lay out structure #0: content "foo.img":.*no such file or directory`)
 }
 
-func makeSizedFile(c *C, path string, size gadget.Size, content []byte) {
+func makeSizedFile(c *C, path string, size quantity.Size, content []byte) {
 	err := os.MkdirAll(filepath.Dir(path), 0755)
 	c.Assert(err, IsNil)
 
@@ -334,7 +335,7 @@
           content:
               - image: foo.img
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB+1, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB+1, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 
@@ -356,13 +357,13 @@
               - image: foo.img
               - image: bar.img
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB+1, nil)
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), gadget.SizeMiB+1, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB+1, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), quantity.SizeMiB+1, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 
 	constraints := gadget.LayoutConstraints{
-		NonMBRStartOffset: 1 * gadget.SizeMiB,
+		NonMBRStartOffset: 1 * quantity.SizeMiB,
 		SectorSize:        512,
 	}
 	v, err := gadget.LayoutVolume(p.dir, vol, constraints)
@@ -384,7 +385,7 @@
                 # 512kB
                 offset: 524288
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 
@@ -406,13 +407,13 @@
               - image: foo.img
                 size: 1M
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB+1, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB+1, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 
 	v, err := gadget.LayoutVolume(p.dir, vol, defaultConstraints)
 	c.Assert(v, IsNil)
-	c.Assert(err, ErrorMatches, fmt.Sprintf(`cannot lay out structure #0: content "foo.img" size %v is larger than declared %v`, gadget.SizeMiB+1, gadget.SizeMiB))
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`cannot lay out structure #0: content "foo.img" size %v is larger than declared %v`, quantity.SizeMiB+1, quantity.SizeMiB))
 }
 
 func (p *layoutTestSuite) TestLayoutVolumeErrorsContentOverlap(c *C) {
@@ -433,8 +434,8 @@
                 size: 1M
                 offset: 0
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB, nil)
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), quantity.SizeMiB, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 
@@ -460,8 +461,8 @@
                 size: 1M
                 offset: 0
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB, nil)
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), quantity.SizeMiB, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 	c.Assert(vol.Structure, HasLen, 1)
@@ -471,24 +472,24 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				LaidOutContent: []gadget.LaidOutContent{
 					{
 						VolumeContent: &vol.Structure[0].Content[1],
-						StartOffset:   1 * gadget.SizeMiB,
-						Size:          gadget.SizeMiB,
+						StartOffset:   1 * quantity.SizeMiB,
+						Size:          quantity.SizeMiB,
 						Index:         1,
 					},
 					{
 						VolumeContent: &vol.Structure[0].Content[0],
-						StartOffset:   2 * gadget.SizeMiB,
-						Size:          gadget.SizeMiB,
+						StartOffset:   2 * quantity.SizeMiB,
+						Size:          quantity.SizeMiB,
 						Index:         0,
 					},
 				},
@@ -512,8 +513,8 @@
               - image: bar.img
                 size: 1M
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), gadget.SizeMiB, nil)
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), quantity.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), quantity.SizeMiB, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
 	c.Assert(vol.Structure, HasLen, 1)
@@ -523,24 +524,24 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				LaidOutContent: []gadget.LaidOutContent{
 					{
 						VolumeContent: &vol.Structure[0].Content[0],
-						StartOffset:   1 * gadget.SizeMiB,
-						Size:          gadget.SizeMiB,
+						StartOffset:   1 * quantity.SizeMiB,
+						Size:          quantity.SizeMiB,
 						Index:         0,
 					},
 					{
 						VolumeContent: &vol.Structure[0].Content[1],
-						StartOffset:   2 * gadget.SizeMiB,
-						Size:          gadget.SizeMiB,
+						StartOffset:   2 * quantity.SizeMiB,
+						Size:          quantity.SizeMiB,
 						Index:         1,
 					},
 				},
@@ -561,7 +562,7 @@
           content:
               - image: foo.img
 `
-	size1_5MiB := gadget.SizeMiB + gadget.SizeMiB/2
+	size1_5MiB := quantity.SizeMiB + quantity.SizeMiB/2
 	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), size1_5MiB, nil)
 
 	vol := mustParseVolume(c, gadgetYaml, "first")
@@ -572,17 +573,17 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				LaidOutContent: []gadget.LaidOutContent{
 					{
 						VolumeContent: &vol.Structure[0].Content[0],
-						StartOffset:   1 * gadget.SizeMiB,
+						StartOffset:   1 * quantity.SizeMiB,
 						Size:          size1_5MiB,
 					},
 				},
@@ -615,13 +616,13 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 			},
 		},
 	})
@@ -655,7 +656,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
@@ -666,7 +667,7 @@
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           1,
 			},
 		},
@@ -675,14 +676,14 @@
 	// still valid
 	constraints := gadget.LayoutConstraints{
 		// 512kiB
-		NonMBRStartOffset: 512 * gadget.SizeKiB,
+		NonMBRStartOffset: 512 * quantity.SizeKiB,
 		SectorSize:        512,
 	}
 	v, err = gadget.LayoutVolume(p.dir, vol, constraints)
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       2*gadget.SizeMiB + 512*gadget.SizeKiB,
+		Size:       2*quantity.SizeMiB + 512*quantity.SizeKiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
@@ -693,7 +694,7 @@
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     512 * gadget.SizeKiB,
+				StartOffset:     512 * quantity.SizeKiB,
 				Index:           1,
 			},
 		},
@@ -710,7 +711,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       2*gadget.SizeMiB + 446,
+		Size:       2*quantity.SizeMiB + 446,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
@@ -728,14 +729,14 @@
 
 	// sector size is properly recorded
 	constraintsSector := gadget.LayoutConstraints{
-		NonMBRStartOffset: 1 * gadget.SizeMiB,
+		NonMBRStartOffset: 1 * quantity.SizeMiB,
 		SectorSize:        1024,
 	}
 	v, err = gadget.LayoutVolume(p.dir, vol, constraintsSector)
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 1024,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
@@ -745,7 +746,7 @@
 			},
 			{
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           1,
 			},
 		},
@@ -775,7 +776,7 @@
 	vol := mustParseVolume(c, gadgetYaml, "first")
 
 	constraintsBadSectorSize := gadget.LayoutConstraints{
-		NonMBRStartOffset: 1 * gadget.SizeMiB,
+		NonMBRStartOffset: 1 * quantity.SizeMiB,
 		SectorSize:        384,
 	}
 	_, err := gadget.LayoutVolume(p.dir, vol, constraintsBadSectorSize)
@@ -784,7 +785,7 @@
 
 func (p *layoutTestSuite) TestLayoutVolumeConstraintsNeedsSectorSize(c *C) {
 	constraintsBadSectorSize := gadget.LayoutConstraints{
-		NonMBRStartOffset: 1 * gadget.SizeMiB,
+		NonMBRStartOffset: 1 * quantity.SizeMiB,
 		// SectorSize left unspecified
 	}
 	_, err := gadget.LayoutVolume(p.dir, &gadget.Volume{}, constraintsBadSectorSize)
@@ -813,7 +814,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       2 * gadget.SizeMiB,
+		Size:       2 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
@@ -824,7 +825,7 @@
 				Index:           0,
 			}, {
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           1,
 			},
 		},
@@ -856,8 +857,8 @@
           - image: bar.img
             offset-write: 450
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*gadget.SizeKiB, []byte(""))
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), 150*gadget.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*quantity.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), 150*quantity.SizeKiB, []byte(""))
 
 	vol := mustParseVolume(c, gadgetYaml, "pc")
 	c.Assert(vol.Structure, HasLen, 3)
@@ -866,7 +867,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(v, DeepEquals, &gadget.LaidOutVolume{
 		Volume:     vol,
-		Size:       3 * gadget.SizeMiB,
+		Size:       3 * quantity.SizeMiB,
 		SectorSize: 512,
 		RootDir:    p.dir,
 		LaidOutStructure: []gadget.LaidOutStructure{
@@ -878,31 +879,31 @@
 			}, {
 				// foo
 				VolumeStructure: &vol.Structure[1],
-				StartOffset:     1 * gadget.SizeMiB,
+				StartOffset:     1 * quantity.SizeMiB,
 				Index:           1,
 				// break for gofmt < 1.11
 				AbsoluteOffsetWrite: asSizePtr(92),
 				LaidOutContent: []gadget.LaidOutContent{
 					{
 						VolumeContent: &vol.Structure[1].Content[0],
-						Size:          200 * gadget.SizeKiB,
-						StartOffset:   1 * gadget.SizeMiB,
+						Size:          200 * quantity.SizeKiB,
+						StartOffset:   1 * quantity.SizeMiB,
 						// offset-write: bar+10
-						AbsoluteOffsetWrite: asSizePtr(2*gadget.SizeMiB + 10),
+						AbsoluteOffsetWrite: asSizePtr(2*quantity.SizeMiB + 10),
 					},
 				},
 			}, {
 				// bar
 				VolumeStructure: &vol.Structure[2],
-				StartOffset:     2 * gadget.SizeMiB,
+				StartOffset:     2 * quantity.SizeMiB,
 				Index:           2,
 				// break for gofmt < 1.11
 				AbsoluteOffsetWrite: asSizePtr(600),
 				LaidOutContent: []gadget.LaidOutContent{
 					{
 						VolumeContent: &vol.Structure[2].Content[0],
-						Size:          150 * gadget.SizeKiB,
-						StartOffset:   2 * gadget.SizeMiB,
+						Size:          150 * quantity.SizeKiB,
+						StartOffset:   2 * quantity.SizeMiB,
 						// offset-write: bar+10
 						AbsoluteOffsetWrite: asSizePtr(450),
 					},
@@ -919,7 +920,7 @@
 			{
 				Name: "foo",
 				Type: "DA,21686148-6449-6E6F-744E-656564454649",
-				Size: 1 * gadget.SizeMiB,
+				Size: 1 * quantity.SizeMiB,
 				OffsetWrite: &gadget.RelativeOffset{
 					RelativeTo: "bar",
 					Offset:     10,
@@ -932,7 +933,7 @@
 			{
 				Name: "foo",
 				Type: "DA,21686148-6449-6E6F-744E-656564454649",
-				Size: 1 * gadget.SizeMiB,
+				Size: 1 * quantity.SizeMiB,
 				Content: []gadget.VolumeContent{
 					{
 						Image: "foo.img",
@@ -946,7 +947,7 @@
 		},
 	}
 
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*gadget.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*quantity.SizeKiB, []byte(""))
 
 	v, err := gadget.LayoutVolume(p.dir, &volBadStructure, defaultConstraints)
 	c.Check(v, IsNil)
@@ -979,7 +980,7 @@
 	v, err := gadget.LayoutVolume(p.dir, vol, defaultConstraints)
 	c.Assert(err, IsNil)
 	// offset-write is at 1GB
-	c.Check(v.Size, Equals, 1*gadget.SizeGiB+gadget.SizeLBA48Pointer)
+	c.Check(v.Size, Equals, 1*quantity.SizeGiB+gadget.SizeLBA48Pointer)
 
 	var gadgetYamlContent = `
 volumes:
@@ -1005,16 +1006,16 @@
             offset-write: mbr+3221225472
 
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*gadget.SizeKiB, []byte(""))
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), 150*gadget.SizeKiB, []byte(""))
-	makeSizedFile(c, filepath.Join(p.dir, "baz.img"), 100*gadget.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*quantity.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), 150*quantity.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "baz.img"), 100*quantity.SizeKiB, []byte(""))
 
 	vol = mustParseVolume(c, gadgetYamlContent, "pc")
 
 	v, err = gadget.LayoutVolume(p.dir, vol, defaultConstraints)
 	c.Assert(err, IsNil)
 	// foo.img offset-write is at 3GB
-	c.Check(v.Size, Equals, 3*gadget.SizeGiB+gadget.SizeLBA48Pointer)
+	c.Check(v.Size, Equals, 3*quantity.SizeGiB+gadget.SizeLBA48Pointer)
 }
 
 func (p *layoutTestSuite) TestLayoutVolumePartialNoSuchFile(c *C) {
@@ -1040,7 +1041,7 @@
 		LaidOutStructure: []gadget.LaidOutStructure{
 			{
 				VolumeStructure: &vol.Structure[0],
-				StartOffset:     800 * gadget.SizeMiB,
+				StartOffset:     800 * quantity.SizeMiB,
 				Index:           0,
 			},
 		},
@@ -1065,8 +1066,8 @@
             offset: 307200
 
 `
-	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*gadget.SizeKiB, []byte(""))
-	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), 150*gadget.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "foo.img"), 200*quantity.SizeKiB, []byte(""))
+	makeSizedFile(c, filepath.Join(p.dir, "bar.img"), 150*quantity.SizeKiB, []byte(""))
 
 	vol := mustParseVolume(c, gadgetYamlContent, "pc")
 
@@ -1080,18 +1081,18 @@
 	c.Assert(ps, DeepEquals, gadget.LaidOutStructure{
 		// foo
 		VolumeStructure: &vol.Structure[0],
-		StartOffset:     1 * gadget.SizeMiB,
+		StartOffset:     1 * quantity.SizeMiB,
 		Index:           0,
 		LaidOutContent: []gadget.LaidOutContent{
 			{
 				VolumeContent: &vol.Structure[0].Content[0],
-				Size:          200 * gadget.SizeKiB,
-				StartOffset:   1 * gadget.SizeMiB,
+				Size:          200 * quantity.SizeKiB,
+				StartOffset:   1 * quantity.SizeMiB,
 				Index:         0,
 			}, {
 				VolumeContent: &vol.Structure[0].Content[1],
-				Size:          150 * gadget.SizeKiB,
-				StartOffset:   1*gadget.SizeMiB + 300*gadget.SizeKiB,
+				Size:          150 * quantity.SizeKiB,
+				StartOffset:   1*quantity.SizeMiB + 300*quantity.SizeKiB,
 				Index:         1,
 			},
 		},
@@ -1106,34 +1107,34 @@
 		LaidOutContent: []gadget.LaidOutContent{
 			{
 				VolumeContent: &vol.Structure[0].Content[0],
-				Size:          200 * gadget.SizeKiB,
+				Size:          200 * quantity.SizeKiB,
 				StartOffset:   0,
 				Index:         0,
 			}, {
 				VolumeContent: &vol.Structure[0].Content[1],
-				Size:          150 * gadget.SizeKiB,
-				StartOffset:   300 * gadget.SizeKiB,
+				Size:          150 * quantity.SizeKiB,
+				StartOffset:   300 * quantity.SizeKiB,
 				Index:         1,
 			},
 		},
 	})
 
-	shiftedTo2M := gadget.ShiftStructureTo(ps, 2*gadget.SizeMiB)
+	shiftedTo2M := gadget.ShiftStructureTo(ps, 2*quantity.SizeMiB)
 	c.Assert(shiftedTo2M, DeepEquals, gadget.LaidOutStructure{
 		// foo
 		VolumeStructure: &vol.Structure[0],
-		StartOffset:     2 * gadget.SizeMiB,
+		StartOffset:     2 * quantity.SizeMiB,
 		Index:           0,
 		LaidOutContent: []gadget.LaidOutContent{
 			{
 				VolumeContent: &vol.Structure[0].Content[0],
-				Size:          200 * gadget.SizeKiB,
-				StartOffset:   2 * gadget.SizeMiB,
+				Size:          200 * quantity.SizeKiB,
+				StartOffset:   2 * quantity.SizeMiB,
 				Index:         0,
 			}, {
 				VolumeContent: &vol.Structure[0].Content[1],
-				Size:          150 * gadget.SizeKiB,
-				StartOffset:   2*gadget.SizeMiB + 300*gadget.SizeKiB,
+				Size:          150 * quantity.SizeKiB,
+				StartOffset:   2*quantity.SizeMiB + 300*quantity.SizeKiB,
 				Index:         1,
 			},
 		},
diff -Nru snapd-2.45.1+20.04.2/gadget/mkfs.go snapd-2.48.3+20.04/gadget/mkfs.go
--- snapd-2.45.1+20.04.2/gadget/mkfs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/mkfs.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,135 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path/filepath"
-
-	"github.com/snapcore/snapd/osutil"
-)
-
-// MkfsExt4 creates an EXT4 filesystem in given image file, with an optional
-// filesystem label, and populates it with the contents of provided root
-// directory.
-func MkfsExt4(img, label, contentsRootDir string) error {
-	// Originally taken from ubuntu-image
-	// Switched to use mkfs defaults for https://bugs.launchpad.net/snappy/+bug/1878374
-	// For caveats/requirements in case we need support for older systems:
-	// https://github.com/snapcore/snapd/pull/6997#discussion_r293967140
-	mkfsArgs := []string{
-		"mkfs.ext4",
-		// default usage type
-		"-T", "default",
-	}
-	if contentsRootDir != "" {
-		// mkfs.ext4 can populate the filesystem with contents of given
-		// root directory
-		// TODO: support e2fsprogs 1.42 without -d in Ubuntu 16.04
-		mkfsArgs = append(mkfsArgs, "-d", contentsRootDir)
-	}
-	if label != "" {
-		mkfsArgs = append(mkfsArgs, "-L", label)
-	}
-	mkfsArgs = append(mkfsArgs, img)
-
-	var cmd *exec.Cmd
-	if os.Geteuid() != 0 {
-		// run through fakeroot so that files are owned by root
-		cmd = exec.Command("fakeroot", mkfsArgs...)
-	} else {
-		// no need to fake it if we're already root
-		cmd = exec.Command(mkfsArgs[0], mkfsArgs[1:]...)
-	}
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return osutil.OutputErr(out, err)
-	}
-	return nil
-}
-
-// MkfsVfat creates a VFAT filesystem in given image file, with an optional
-// filesystem label, and populates it with the contents of provided root
-// directory.
-func MkfsVfat(img, label, contentsRootDir string) error {
-	// taken from ubuntu-image
-	mkfsArgs := []string{
-		// 512B logical sector size
-		"-S", "512",
-		// 1 sector per cluster
-		"-s", "1",
-		// 32b FAT size
-		"-F", "32",
-	}
-	if label != "" {
-		mkfsArgs = append(mkfsArgs, "-n", label)
-	}
-	mkfsArgs = append(mkfsArgs, img)
-
-	cmd := exec.Command("mkfs.vfat", mkfsArgs...)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return osutil.OutputErr(out, err)
-	}
-
-	// if there is no content to copy we are done now
-	if contentsRootDir == "" {
-		return nil
-	}
-
-	// mkfs.vfat does not know how to populate the filesystem with contents,
-	// we need to do the work ourselves
-
-	fis, err := ioutil.ReadDir(contentsRootDir)
-	if err != nil {
-		return fmt.Errorf("cannot list directory contents: %v", err)
-	}
-	if len(fis) == 0 {
-		// nothing to copy to the image
-		return nil
-	}
-
-	mcopyArgs := make([]string, 0, 4+len(fis))
-	mcopyArgs = append(mcopyArgs,
-		// recursive copy
-		"-s",
-		// image file
-		"-i", img)
-	for _, fi := range fis {
-		mcopyArgs = append(mcopyArgs, filepath.Join(contentsRootDir, fi.Name()))
-	}
-	mcopyArgs = append(mcopyArgs,
-		// place content at the / of the filesystem
-		"::")
-
-	cmd = exec.Command("mcopy", mcopyArgs...)
-	cmd.Env = os.Environ()
-	// skip mtools checks to avoid unnecessary warnings
-	cmd.Env = append(cmd.Env, "MTOOLS_SKIP_CHECK=1")
-
-	out, err = cmd.CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("cannot populate vfat filesystem with contents: %v", osutil.OutputErr(out, err))
-	}
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/mkfs_test.go snapd-2.48.3+20.04/gadget/mkfs_test.go
--- snapd-2.45.1+20.04.2/gadget/mkfs_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/mkfs_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,216 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget_test
-
-import (
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type mkfsSuite struct {
-	testutil.BaseTest
-}
-
-var _ = Suite(&mkfsSuite{})
-
-func (m *mkfsSuite) SetUpTest(c *C) {
-	m.BaseTest.SetUpTest(c)
-
-	// fakeroot, mkfs.ext4, mkfs.vfat and mcopy are commonly installed in
-	// the host system, set up some overrides so that we avoid calling the
-	// host tools
-	cmdFakeroot := testutil.MockCommand(c, "fakeroot", "echo 'override in test' ; exit 1")
-	m.AddCleanup(cmdFakeroot.Restore)
-
-	cmdMkfsExt4 := testutil.MockCommand(c, "mkfs.ext4", "echo 'override in test' ; exit 1")
-	m.AddCleanup(cmdMkfsExt4.Restore)
-
-	cmdMkfsVfat := testutil.MockCommand(c, "mkfs.vfat", "echo 'override in test'; exit 1")
-	m.AddCleanup(cmdMkfsVfat.Restore)
-
-	cmdMcopy := testutil.MockCommand(c, "mcopy", "echo 'override in test'; exit 1")
-	m.AddCleanup(cmdMcopy.Restore)
-}
-
-func (m *mkfsSuite) TestMkfsExt4Happy(c *C) {
-	cmd := testutil.MockCommand(c, "fakeroot", "")
-	defer cmd.Restore()
-
-	err := gadget.MkfsExt4("foo.img", "my-label", "contents")
-	c.Assert(err, IsNil)
-	c.Check(cmd.Calls(), DeepEquals, [][]string{
-		{
-			"fakeroot",
-			"mkfs.ext4",
-			"-T", "default",
-			"-d", "contents",
-			"-L", "my-label",
-			"foo.img",
-		},
-	})
-
-	cmd.ForgetCalls()
-
-	// empty label
-	err = gadget.MkfsExt4("foo.img", "", "contents")
-	c.Assert(err, IsNil)
-	c.Check(cmd.Calls(), DeepEquals, [][]string{
-		{
-			"fakeroot",
-			"mkfs.ext4",
-			"-T", "default",
-			"-d", "contents",
-			"foo.img",
-		},
-	})
-
-	cmd.ForgetCalls()
-
-	// no content
-	err = gadget.MkfsExt4("foo.img", "my-label", "")
-	c.Assert(err, IsNil)
-	c.Check(cmd.Calls(), DeepEquals, [][]string{
-		{
-			"fakeroot",
-			"mkfs.ext4",
-			"-T", "default",
-			"-L", "my-label",
-			"foo.img",
-		},
-	})
-
-}
-
-func (m *mkfsSuite) TestMkfsExt4Error(c *C) {
-	cmd := testutil.MockCommand(c, "fakeroot", "echo 'command failed'; exit 1")
-	defer cmd.Restore()
-
-	err := gadget.MkfsExt4("foo.img", "my-label", "contents")
-	c.Assert(err, ErrorMatches, "command failed")
-}
-
-func (m *mkfsSuite) TestMkfsVfatHappySimple(c *C) {
-	// no contents, should not fail
-	d := c.MkDir()
-
-	cmd := testutil.MockCommand(c, "mkfs.vfat", "")
-	defer cmd.Restore()
-
-	err := gadget.MkfsVfat("foo.img", "my-label", d)
-	c.Assert(err, IsNil)
-	c.Check(cmd.Calls(), DeepEquals, [][]string{
-		{
-			"mkfs.vfat",
-			"-S", "512",
-			"-s", "1",
-			"-F", "32",
-			"-n", "my-label",
-			"foo.img",
-		},
-	})
-
-	cmd.ForgetCalls()
-
-	// empty label
-	err = gadget.MkfsVfat("foo.img", "", d)
-	c.Assert(err, IsNil)
-	c.Check(cmd.Calls(), DeepEquals, [][]string{
-		{
-			"mkfs.vfat",
-			"-S", "512",
-			"-s", "1",
-			"-F", "32",
-			"foo.img",
-		},
-	})
-}
-
-func (m *mkfsSuite) TestMkfsVfatHappyContents(c *C) {
-	d := c.MkDir()
-	makeSizedFile(c, filepath.Join(d, "foo"), 128, []byte("foo foo foo"))
-	makeSizedFile(c, filepath.Join(d, "bar/bar-content"), 128, []byte("bar bar bar"))
-
-	cmdMkfs := testutil.MockCommand(c, "mkfs.vfat", "")
-	defer cmdMkfs.Restore()
-
-	cmdMcopy := testutil.MockCommand(c, "mcopy", "")
-	defer cmdMcopy.Restore()
-
-	err := gadget.MkfsVfat("foo.img", "my-label", d)
-	c.Assert(err, IsNil)
-	c.Assert(cmdMkfs.Calls(), HasLen, 1)
-
-	c.Assert(cmdMcopy.Calls(), DeepEquals, [][]string{
-		{"mcopy", "-s", "-i", "foo.img", filepath.Join(d, "bar"), filepath.Join(d, "foo"), "::"},
-	})
-}
-
-func (m *mkfsSuite) TestMkfsVfatErrorSimpleFail(c *C) {
-	d := c.MkDir()
-
-	cmd := testutil.MockCommand(c, "mkfs.vfat", "echo 'failed'; false")
-	defer cmd.Restore()
-
-	err := gadget.MkfsVfat("foo.img", "my-label", d)
-	c.Assert(err, ErrorMatches, "failed")
-}
-
-func (m *mkfsSuite) TestMkfsVfatErrorUnreadableDir(c *C) {
-	cmd := testutil.MockCommand(c, "mkfs.vfat", "")
-	defer cmd.Restore()
-
-	err := gadget.MkfsVfat("foo.img", "my-label", "dir-does-not-exist")
-	c.Assert(err, ErrorMatches, "cannot list directory contents: .* no such file or directory")
-	c.Assert(cmd.Calls(), HasLen, 1)
-}
-
-func (m *mkfsSuite) TestMkfsVfatErrorInMcopy(c *C) {
-	d := c.MkDir()
-	makeSizedFile(c, filepath.Join(d, "foo"), 128, []byte("foo foo foo"))
-
-	cmdMkfs := testutil.MockCommand(c, "mkfs.vfat", "")
-	defer cmdMkfs.Restore()
-
-	cmdMcopy := testutil.MockCommand(c, "mcopy", "echo 'hard fail'; exit 1")
-	defer cmdMcopy.Restore()
-
-	err := gadget.MkfsVfat("foo.img", "my-label", d)
-	c.Assert(err, ErrorMatches, "cannot populate vfat filesystem with contents: hard fail")
-	c.Assert(cmdMkfs.Calls(), HasLen, 1)
-	c.Assert(cmdMcopy.Calls(), HasLen, 1)
-}
-
-func (m *mkfsSuite) TestMkfsVfatHappyNoContents(c *C) {
-	cmdMkfs := testutil.MockCommand(c, "mkfs.vfat", "")
-	defer cmdMkfs.Restore()
-
-	cmdMcopy := testutil.MockCommand(c, "mcopy", "")
-	defer cmdMcopy.Restore()
-
-	err := gadget.MkfsVfat("foo.img", "my-label", "")
-	c.Assert(err, IsNil)
-	c.Assert(cmdMkfs.Calls(), HasLen, 1)
-	// mcopy was not called
-	c.Assert(cmdMcopy.Calls(), HasLen, 0)
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/mountedfilesystem.go snapd-2.48.3+20.04/gadget/mountedfilesystem.go
--- snapd-2.45.1+20.04.2/gadget/mountedfilesystem.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/mountedfilesystem.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -56,16 +56,35 @@
 	return nil
 }
 
+func observe(observer ContentObserver, op ContentOperation, ps *LaidOutStructure, root, dst string, data *ContentChange) (ContentChangeAction, error) {
+	if observer == nil {
+		return ChangeApply, nil
+	}
+	relativeTarget := dst
+	if strings.HasPrefix(dst, root) {
+		// target path isn't really relative, make it so now
+		relative, err := filepath.Rel(root, dst)
+		if err != nil {
+			return ChangeAbort, err
+		}
+		relativeTarget = relative
+	}
+	return observer.Observe(op, ps, root, relativeTarget, data)
+}
+
+// TODO: MountedFilesystemWriter should not be exported
+
 // MountedFilesystemWriter assists in writing contents of a structure to a
 // mounted filesystem.
 type MountedFilesystemWriter struct {
 	contentDir string
 	ps         *LaidOutStructure
+	observer   ContentObserver
 }
 
 // NewMountedFilesystemWriter returns a writer capable of writing provided
 // structure, with content of the structure stored in the given root directory.
-func NewMountedFilesystemWriter(contentDir string, ps *LaidOutStructure) (*MountedFilesystemWriter, error) {
+func NewMountedFilesystemWriter(contentDir string, ps *LaidOutStructure, observer ContentObserver) (*MountedFilesystemWriter, error) {
 	if ps == nil {
 		return nil, fmt.Errorf("internal error: *LaidOutStructure is nil")
 	}
@@ -78,6 +97,7 @@
 	fw := &MountedFilesystemWriter{
 		contentDir: contentDir,
 		ps:         ps,
+		observer:   observer,
 	}
 	return fw, nil
 }
@@ -107,6 +127,7 @@
 		return fmt.Errorf("internal error: destination directory cannot be unset")
 	}
 
+	// TODO:UC20: preserve managed boot assets
 	preserveInDst, err := mapPreserve(whereDir, preserve)
 	if err != nil {
 		return fmt.Errorf("cannot map preserve entries for destination %q: %v", whereDir, err)
@@ -124,7 +145,7 @@
 // location dst. Follows rsync like semantics, that is:
 //   /foo/ -> /bar - writes contents of foo under /bar
 //   /foo  -> /bar - writes foo and its subtree under /bar
-func writeDirectory(src, dst string, preserveInDst []string) error {
+func (m *MountedFilesystemWriter) writeDirectory(volumeRoot, src, dst string, preserveInDst []string) error {
 	hasDirSourceSlash := strings.HasSuffix(src, "/")
 
 	if err := checkSourceIsDir(src); err != nil {
@@ -145,16 +166,16 @@
 		pSrc := filepath.Join(src, fi.Name())
 		pDst := filepath.Join(dst, fi.Name())
 
-		write := writeFileOrSymlink
+		write := m.observedWriteFileOrSymlink
 		if fi.IsDir() {
 			if err := os.MkdirAll(pDst, 0755); err != nil {
 				return fmt.Errorf("cannot create directory prefix: %v", err)
 			}
 
-			write = writeDirectory
+			write = m.writeDirectory
 			pSrc += "/"
 		}
-		if err := write(pSrc, pDst, preserveInDst); err != nil {
+		if err := write(volumeRoot, pSrc, pDst, preserveInDst); err != nil {
 			return err
 		}
 	}
@@ -162,6 +183,28 @@
 	return nil
 }
 
+func (m *MountedFilesystemWriter) observedWriteFileOrSymlink(volumeRoot, src, dst string, preserveInDst []string) error {
+	if strings.HasSuffix(dst, "/") {
+		// write to directory
+		dst = filepath.Join(dst, filepath.Base(src))
+	}
+
+	data := &ContentChange{
+		// we are writing a new thing
+		Before: "",
+		// with content in this file
+		After: src,
+	}
+	act, err := observe(m.observer, ContentWrite, m.ps, volumeRoot, dst, data)
+	if err != nil {
+		return fmt.Errorf("cannot observe file write: %v", err)
+	}
+	if act == ChangeIgnore {
+		return nil
+	}
+	return writeFileOrSymlink(src, dst, preserveInDst)
+}
+
 // writeFileOrSymlink writes the source file or a symlink at given location or
 // under given directory. Follows rsync like semantics, that is:
 //   /foo -> /bar/ - writes foo as /bar/foo
@@ -192,12 +235,11 @@
 			return fmt.Errorf("cannot write a symlink: %v", err)
 		}
 	} else {
-		// overwrite & sync by default
-		copyFlags := osutil.CopyFlagOverwrite | osutil.CopyFlagSync
-
-		// TODO use osutil.AtomicFile
 		// TODO try to preserve ownership and permission bits
-		if err := osutil.CopyFile(src, dst, copyFlags); err != nil {
+
+		// do not follow sylimks, dst is a reflection of the src which
+		// is a file
+		if err := osutil.AtomicWriteFileCopy(dst, src, 0); err != nil {
 			return fmt.Errorf("cannot copy %s: %v", src, err)
 		}
 	}
@@ -221,10 +263,10 @@
 
 	if osutil.IsDirectory(realSource) || strings.HasSuffix(content.Source, "/") {
 		// write a directory
-		return writeDirectory(realSource, realTarget, preserveInDst)
+		return m.writeDirectory(volumeRoot, realSource, realTarget, preserveInDst)
 	} else {
 		// write a file
-		return writeFileOrSymlink(realSource, realTarget, preserveInDst)
+		return m.observedWriteFileOrSymlink(volumeRoot, realSource, realTarget, preserveInDst)
 	}
 }
 
@@ -245,7 +287,7 @@
 
 type mountLookupFunc func(ps *LaidOutStructure) (string, error)
 
-// MountedFilesystemUpdater assits in applying updates to a mounted filesystem.
+// mountedFilesystemUpdater assists in applying updates to a mounted filesystem.
 //
 // The update process is composed of 2 main passes, and an optional rollback:
 //
@@ -259,18 +301,20 @@
 //
 // 3) rollback (optional), where update data is rolled back and replaced with
 // backup copies of files, newly created directories are removed
-type MountedFilesystemUpdater struct {
+type mountedFilesystemUpdater struct {
 	*MountedFilesystemWriter
-	backupDir   string
-	mountLookup mountLookupFunc
+	backupDir      string
+	mountPoint     string
+	updateObserver ContentObserver
 }
 
-// NewMountedFilesystemUpdater returns an updater for given filesystem
+// newMountedFilesystemUpdater returns an updater for given filesystem
 // structure, with structure content coming from provided root directory. The
 // mount is located by calling a mount lookup helper. The backup directory
 // contains backup state information for use during rollback.
-func NewMountedFilesystemUpdater(rootDir string, ps *LaidOutStructure, backupDir string, mountLookup mountLookupFunc) (*MountedFilesystemUpdater, error) {
-	fw, err := NewMountedFilesystemWriter(rootDir, ps)
+func newMountedFilesystemUpdater(rootDir string, ps *LaidOutStructure, backupDir string, mountLookup mountLookupFunc, observer ContentObserver) (*mountedFilesystemUpdater, error) {
+	// avoid passing observer, writes will not be observed
+	fw, err := NewMountedFilesystemWriter(rootDir, ps, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -280,10 +324,16 @@
 	if backupDir == "" {
 		return nil, fmt.Errorf("internal error: backup directory must not be unset")
 	}
-	fu := &MountedFilesystemUpdater{
+	mount, err := mountLookup(ps)
+	if err != nil {
+		return nil, fmt.Errorf("cannot find mount location of structure %v: %v", ps, err)
+	}
+
+	fu := &mountedFilesystemUpdater{
 		MountedFilesystemWriter: fw,
 		backupDir:               backupDir,
-		mountLookup:             mountLookup,
+		mountPoint:              mount,
+		updateObserver:          observer,
 	}
 	return fu, nil
 }
@@ -295,7 +345,7 @@
 // entryDestPaths resolves destination and backup paths for given
 // source/target combination. Backup location is within provided
 // backup directory or empty if directory was not provided.
-func (f *MountedFilesystemUpdater) entryDestPaths(dstRoot, source, target, backupDir string) (dstPath, backupPath string) {
+func (f *mountedFilesystemUpdater) entryDestPaths(dstRoot, source, target, backupDir string) (dstPath, backupPath string) {
 	dstBasePath := target
 	if strings.HasSuffix(target, "/") {
 		// write to a directory
@@ -312,7 +362,7 @@
 
 // entrySourcePath returns the path of given source entry within the root
 // directory provided during initialization.
-func (f *MountedFilesystemUpdater) entrySourcePath(source string) string {
+func (f *mountedFilesystemUpdater) entrySourcePath(source string) string {
 	srcPath := filepath.Join(f.contentDir, source)
 
 	if strings.HasSuffix(source, "/") {
@@ -324,22 +374,17 @@
 
 // Update applies an update to a mounted filesystem. The caller must have
 // executed a Backup() before, to prepare a data set for rollback purpose.
-func (f *MountedFilesystemUpdater) Update() error {
-	mount, err := f.mountLookup(f.ps)
-	if err != nil {
-		return fmt.Errorf("cannot find mount location of structure %v: %v", f.ps, err)
-	}
-
-	preserveInDst, err := mapPreserve(mount, f.ps.Update.Preserve)
+func (f *mountedFilesystemUpdater) Update() error {
+	preserveInDst, err := mapPreserve(f.mountPoint, f.ps.Update.Preserve)
 	if err != nil {
-		return fmt.Errorf("cannot map preserve entries for mount location %q: %v", mount, err)
+		return fmt.Errorf("cannot map preserve entries for mount location %q: %v", f.mountPoint, err)
 	}
 
 	backupRoot := fsStructBackupPath(f.backupDir, f.ps)
 
 	skipped := 0
 	for _, c := range f.ps.Content {
-		if err := f.updateVolumeContent(mount, &c, preserveInDst, backupRoot); err != nil {
+		if err := f.updateVolumeContent(f.mountPoint, &c, preserveInDst, backupRoot); err != nil {
 			if err == ErrNoUpdate {
 				skipped++
 				continue
@@ -355,7 +400,7 @@
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) sourceDirectoryEntries(source string) ([]os.FileInfo, error) {
+func (f *mountedFilesystemUpdater) sourceDirectoryEntries(source string) ([]os.FileInfo, error) {
 	srcPath := f.entrySourcePath(source)
 
 	if err := checkSourceIsDir(srcPath); err != nil {
@@ -383,7 +428,7 @@
 	return filepath.Join(target, filepath.Base(source))
 }
 
-func (f *MountedFilesystemUpdater) updateDirectory(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) updateDirectory(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
 	fis, err := f.sourceDirectoryEntries(source)
 	if err != nil {
 		return fmt.Errorf("cannot list source directory %q: %v", source, err)
@@ -425,35 +470,44 @@
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) updateOrSkipFile(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) updateOrSkipFile(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
 	srcPath := f.entrySourcePath(source)
 	dstPath, backupPath := f.entryDestPaths(dstRoot, source, target, backupDir)
+	backupName := backupPath + ".backup"
+	sameStamp := backupPath + ".same"
+	preserveStamp := backupPath + ".preserve"
+	ignoreStamp := backupPath + ".ignore"
 
 	// TODO: enable support for symlinks when needed
 	if osutil.IsSymlink(srcPath) {
 		return fmt.Errorf("cannot update file %s: symbolic links are not supported", source)
 	}
 
+	if osutil.FileExists(ignoreStamp) {
+		// explicitly ignored by request of the observer
+		return ErrNoUpdate
+	}
+
 	if osutil.FileExists(dstPath) {
-		if strutil.SortedListContains(preserveInDst, dstPath) {
+		if strutil.SortedListContains(preserveInDst, dstPath) || osutil.FileExists(preserveStamp) {
 			// file is to be preserved
 			return ErrNoUpdate
 		}
-		if osutil.FileExists(backupPath + ".same") {
+		if osutil.FileExists(sameStamp) {
 			// file is the same as current copy
 			return ErrNoUpdate
 		}
-		if !osutil.FileExists(backupPath + ".backup") {
+		if !osutil.FileExists(backupName) {
 			// not preserved & different than the update, error out
 			// as there is no backup
-			return fmt.Errorf("missing backup file %q for %v", backupPath+".backup", target)
+			return fmt.Errorf("missing backup file %q for %v", backupName, target)
 		}
 	}
 
 	return writeFileOrSymlink(srcPath, dstPath, preserveInDst)
 }
 
-func (f *MountedFilesystemUpdater) updateVolumeContent(volumeRoot string, content *VolumeContent, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) updateVolumeContent(volumeRoot string, content *VolumeContent, preserveInDst []string, backupDir string) error {
 	if err := checkContent(content); err != nil {
 		return err
 	}
@@ -473,7 +527,7 @@
 // identical/preserved files may be stamped to improve the later step of update
 // process.
 //
-// The backup directory structure mirrors the the structure of destination
+// The backup directory structure mirrors the structure of destination
 // location. Given the following destination structure:
 //
 // foo
@@ -483,7 +537,8 @@
 // │   ├── baz
 // │   │   └── d
 // │   └── z
-// └── c
+// ├── c
+// └── d
 //
 // The structure of backup looks like this:
 //
@@ -495,27 +550,23 @@
 // │   └── baz.backup     <-- stamp indicating ./bar/baz existed before the update
 // ├── bar.backup         <-- stamp indicating ./bar existed before the update
 // ├── b.same             <-- stamp indicating ./b is identical to the update data
-// └── c.preserve         <-- stamp indicating ./c is to be preserved
+// ├── c.ignore           <-- stamp indicating change to ./c was requested to be ignored
+// └── d.preserve         <-- stamp indicating ./d is to be preserved
 //
-func (f *MountedFilesystemUpdater) Backup() error {
-	mount, err := f.mountLookup(f.ps)
-	if err != nil {
-		return fmt.Errorf("cannot find mount location of structure %v: %v", f.ps, err)
-	}
-
+func (f *mountedFilesystemUpdater) Backup() error {
 	backupRoot := fsStructBackupPath(f.backupDir, f.ps)
 
 	if err := os.MkdirAll(backupRoot, 0755); err != nil {
 		return fmt.Errorf("cannot create backup directory: %v", err)
 	}
 
-	preserveInDst, err := mapPreserve(mount, f.ps.Update.Preserve)
+	preserveInDst, err := mapPreserve(f.mountPoint, f.ps.Update.Preserve)
 	if err != nil {
-		return fmt.Errorf("cannot map preserve entries for mount location %q: %v", mount, err)
+		return fmt.Errorf("cannot map preserve entries for mount location %q: %v", f.mountPoint, err)
 	}
 
 	for _, c := range f.ps.Content {
-		if err := f.backupVolumeContent(mount, &c, preserveInDst, backupRoot); err != nil {
+		if err := f.backupVolumeContent(f.mountPoint, &c, preserveInDst, backupRoot); err != nil {
 			return fmt.Errorf("cannot backup content: %v", err)
 		}
 	}
@@ -523,7 +574,7 @@
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) backupOrCheckpointDirectory(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) backupOrCheckpointDirectory(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
 	fis, err := f.sourceDirectoryEntries(source)
 	if err != nil {
 		return fmt.Errorf("cannot backup directory %q: %v", source, err)
@@ -535,7 +586,7 @@
 		pSrc := filepath.Join(source, fi.Name())
 		pDst := filepath.Join(target, fi.Name())
 
-		backup := f.backupOrCheckpointFile
+		backup := f.observedBackupOrCheckpointFile
 		if fi.IsDir() {
 			// continue backing up the contents of the directory
 			// rather than the directory itself
@@ -555,7 +606,7 @@
 }
 
 // checkpointPrefix creates stamps for each part of the destination prefix that exists
-func (f *MountedFilesystemUpdater) checkpointPrefix(dstRoot, target string, backupDir string) error {
+func (f *mountedFilesystemUpdater) checkpointPrefix(dstRoot, target string, backupDir string) error {
 	// check how much of the prefix needs to be created
 	for prefix := filepath.Dir(target); prefix != "." && prefix != "/"; prefix = filepath.Dir(prefix) {
 		prefixDst, prefixBackupBase := f.entryDestPaths(dstRoot, "", prefix, backupDir)
@@ -584,47 +635,109 @@
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) backupOrCheckpointFile(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) ignoreChange(change *ContentChange, backupPath string) error {
+	preserveStamp := backupPath + ".preserve"
+	backupName := backupPath + ".backup"
+	sameStamp := backupPath + ".same"
+	ignoreStamp := backupPath + ".ignore"
+	if err := makeStamp(ignoreStamp); err != nil {
+		return fmt.Errorf("cannot create a checkpoint file: %v", err)
+	}
+	for _, name := range []string{backupName, sameStamp, preserveStamp} {
+		if err := os.Remove(name); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("cannot remove existing stamp file: %v", err)
+		}
+	}
+	return nil
+}
+
+func (f *mountedFilesystemUpdater) observedBackupOrCheckpointFile(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+	change, err := f.backupOrCheckpointFile(dstRoot, source, target, preserveInDst, backupDir)
+	if err != nil {
+		return err
+	}
+	if change != nil {
+		dstPath, backupPath := f.entryDestPaths(dstRoot, source, target, backupDir)
+		act, err := observe(f.updateObserver, ContentUpdate, f.ps, f.mountPoint, dstPath, change)
+		if err != nil {
+			return fmt.Errorf("cannot observe pending file write %v\n", err)
+		}
+		if act == ChangeIgnore {
+			// observer asked for the change to be ignored
+			if err := f.ignoreChange(change, backupPath); err != nil {
+				return fmt.Errorf("cannot ignore content change: %v", err)
+			}
+		}
+	}
+	return nil
+}
+
+// backupOrCheckpointFile analyzes a given source file from the gadget and a
+// target location under the provided destination root directory. When both
+// files are identical, creates a stamp that allows the update to skip the file.
+// When content of the new file is different, a backup of the original file is
+// created. Returns a content change if a file will be written by the update
+// pass.
+func (f *mountedFilesystemUpdater) backupOrCheckpointFile(dstRoot, source, target string, preserveInDst []string, backupDir string) (change *ContentChange, err error) {
 	srcPath := f.entrySourcePath(source)
 	dstPath, backupPath := f.entryDestPaths(dstRoot, source, target, backupDir)
 
 	backupName := backupPath + ".backup"
 	sameStamp := backupPath + ".same"
 	preserveStamp := backupPath + ".preserve"
+	ignoreStamp := backupPath + ".ignore"
+
+	changeWithBackup := &ContentChange{
+		// content of the new data
+		After: srcPath,
+		// this is the original data that was present before the
+		// update
+		Before: backupName,
+	}
+	changeNewFile := &ContentChange{
+		// content of the new data
+		After: srcPath,
+	}
+
+	if osutil.FileExists(ignoreStamp) {
+		// observer already requested the change to the target location
+		// to be ignored
+		return nil, nil
+	}
 
 	// TODO: enable support for symlinks when needed
 	if osutil.IsSymlink(dstPath) {
-		return fmt.Errorf("cannot backup file %s: symbolic links are not supported", target)
+		return nil, fmt.Errorf("cannot backup file %s: symbolic links are not supported", target)
 	}
 
 	if !osutil.FileExists(dstPath) {
 		// destination does not exist and will be created when writing
 		// the udpate, no need for backup
-		return nil
+		return changeNewFile, nil
 	}
+	// destination file exists beyond this point
 
-	if osutil.FileExists(backupName) || osutil.FileExists(sameStamp) {
-		// file already checked, either has a backup or is the same as
-		// the update, move on
-		return nil
+	if osutil.FileExists(backupName) {
+		// file already checked and backed up
+		return changeWithBackup, nil
 	}
+	if osutil.FileExists(sameStamp) {
+		// file already checked, same as the update, move on
+		return nil, nil
+	}
+	// TODO: correctly identify new files that were written by a partially
+	// executed update pass
 
 	if strutil.SortedListContains(preserveInDst, dstPath) {
-		// file is to be preserved, create a relevant stamp
-
-		if !osutil.FileExists(dstPath) {
-			// preserve, but does not exist, will be written anyway
-			return nil
-		}
 		if osutil.FileExists(preserveStamp) {
 			// already stamped
-			return nil
+			return nil, nil
 		}
 		// make a stamp
 		if err := makeStamp(preserveStamp); err != nil {
-			return fmt.Errorf("cannot create preserve stamp: %v", err)
+			return nil, fmt.Errorf("cannot create preserve stamp: %v", err)
 		}
-		return nil
+		return nil, nil
 	}
 
 	// try to find out whether the update and the existing file are
@@ -632,13 +745,13 @@
 
 	orig, err := os.Open(dstPath)
 	if err != nil {
-		return fmt.Errorf("cannot open destination file: %v", err)
+		return nil, fmt.Errorf("cannot open destination file: %v", err)
 	}
 
 	// backup of the original content
 	backup, err := newStampFile(backupName)
 	if err != nil {
-		return fmt.Errorf("cannot create backup file: %v", err)
+		return nil, fmt.Errorf("cannot create backup file: %v", err)
 	}
 	// becomes a backup copy or a noop if canceled
 	defer backup.Commit()
@@ -650,14 +763,14 @@
 	_, err = io.Copy(backup, htr)
 	if err != nil {
 		backup.Cancel()
-		return fmt.Errorf("cannot backup original file: %v", err)
+		return nil, fmt.Errorf("cannot backup original file: %v", err)
 	}
 
 	// digest of the update
 	updateDigest, _, err := osutil.FileDigest(srcPath, crypto.SHA1)
 	if err != nil {
 		backup.Cancel()
-		return fmt.Errorf("cannot checksum update file: %v", err)
+		return nil, fmt.Errorf("cannot checksum update file: %v", err)
 	}
 	// digest of the currently present data
 	origDigest := origHash.Sum(nil)
@@ -667,20 +780,20 @@
 		// mark that files are identical and update can be skipped, no
 		// backup is needed
 		if err := makeStamp(sameStamp); err != nil {
-			return fmt.Errorf("cannot create a checkpoint file: %v", err)
+			return nil, fmt.Errorf("cannot create a checkpoint file: %v", err)
 		}
 
 		// makes the deferred commit a noop
 		backup.Cancel()
-		return nil
+		return nil, nil
 	}
 
 	// update will overwrite existing file, a backup copy is created on
 	// Commit()
-	return nil
+	return changeWithBackup, nil
 }
 
-func (f *MountedFilesystemUpdater) backupVolumeContent(volumeRoot string, content *VolumeContent, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) backupVolumeContent(volumeRoot string, content *VolumeContent, preserveInDst []string, backupDir string) error {
 	if err := checkContent(content); err != nil {
 		return err
 	}
@@ -695,7 +808,7 @@
 		return f.backupOrCheckpointDirectory(volumeRoot, content.Source, content.Target, preserveInDst, backupDir)
 	} else {
 		// backup a file
-		return f.backupOrCheckpointFile(volumeRoot, content.Source, content.Target, preserveInDst, backupDir)
+		return f.observedBackupOrCheckpointFile(volumeRoot, content.Source, content.Target, preserveInDst, backupDir)
 	}
 }
 
@@ -703,29 +816,23 @@
 // information collected during backup phase. Files that were modified by the
 // update are stored from their backup copies, newly added directories are
 // removed.
-func (f *MountedFilesystemUpdater) Rollback() error {
-	mount, err := f.mountLookup(f.ps)
-	if err != nil {
-		return fmt.Errorf("cannot find mount location of structure %v: %v", f.ps, err)
-	}
-
+func (f *mountedFilesystemUpdater) Rollback() error {
 	backupRoot := fsStructBackupPath(f.backupDir, f.ps)
 
-	preserveInDst, err := mapPreserve(mount, f.ps.Update.Preserve)
+	preserveInDst, err := mapPreserve(f.mountPoint, f.ps.Update.Preserve)
 	if err != nil {
-		return fmt.Errorf("cannot map preserve entries for mount location %q: %v", mount, err)
+		return fmt.Errorf("cannot map preserve entries for mount location %q: %v", f.mountPoint, err)
 	}
 
 	for _, c := range f.ps.Content {
-		if err := f.rollbackVolumeContent(mount, &c, preserveInDst, backupRoot); err != nil {
+		if err := f.rollbackVolumeContent(f.mountPoint, &c, preserveInDst, backupRoot); err != nil {
 			return fmt.Errorf("cannot rollback content: %v", err)
 		}
 	}
-
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) rollbackPrefix(dstRoot, target string, backupDir string) error {
+func (f *mountedFilesystemUpdater) rollbackPrefix(dstRoot, target string, backupDir string) error {
 	for prefix := filepath.Dir(target); prefix != "/" && prefix != "."; prefix = filepath.Dir(prefix) {
 		prefixDstPath, prefixBackupPath := f.entryDestPaths(dstRoot, "", prefix, backupDir)
 		if !osutil.FileExists(prefixBackupPath + ".backup") {
@@ -738,7 +845,7 @@
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) rollbackDirectory(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) rollbackDirectory(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
 	fis, err := f.sourceDirectoryEntries(source)
 	if err != nil {
 		return fmt.Errorf("cannot rollback directory %q: %v", source, err)
@@ -769,38 +876,59 @@
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) rollbackFile(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) rollbackFile(dstRoot, source, target string, preserveInDst []string, backupDir string) error {
+	srcPath := f.entrySourcePath(source)
 	dstPath, backupPath := f.entryDestPaths(dstRoot, source, target, backupDir)
 
 	backupName := backupPath + ".backup"
 	sameStamp := backupPath + ".same"
 	preserveStamp := backupPath + ".preserve"
+	ignoreStamp := backupPath + ".ignore"
 
 	if strutil.SortedListContains(preserveInDst, dstPath) && osutil.FileExists(preserveStamp) {
-		// file was preserved at original location, do nothing
+		// file was preserved at original location by being
+		// explicitly listed
 		return nil
 	}
 	if osutil.FileExists(sameStamp) {
 		// contents are the same as original, do nothing
 		return nil
 	}
+	if osutil.FileExists(ignoreStamp) {
+		// observer requested the changes to the target to be ignored
+		// previously
+		return nil
+	}
+
+	data := &ContentChange{
+		After: srcPath,
+		// original content was in the backup file
+		Before: backupName,
+	}
 
 	if osutil.FileExists(backupName) {
 		// restore backup -> destination
-		return writeFileOrSymlink(backupName, dstPath, nil)
+		if err := writeFileOrSymlink(backupName, dstPath, nil); err != nil {
+			return err
+		}
+	} else {
+		if err := os.Remove(dstPath); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("cannot remove written update: %v", err)
+		}
+		// since it's a new file, there was no original content
+		data.Before = ""
 	}
-
-	// none of the markers exists, file is not preserved, meaning, it has
-	// been added by the update
-
-	if err := os.Remove(dstPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("cannot remove written update: %v", err)
+	// avoid passing source path during rollback, the file has been restored
+	// to the disk already
+	_, err := observe(f.updateObserver, ContentRollback, f.ps, f.mountPoint, dstPath, data)
+	if err != nil {
+		return fmt.Errorf("cannot observe pending file rollback %v\n", err)
 	}
 
 	return nil
 }
 
-func (f *MountedFilesystemUpdater) rollbackVolumeContent(volumeRoot string, content *VolumeContent, preserveInDst []string, backupDir string) error {
+func (f *mountedFilesystemUpdater) rollbackVolumeContent(volumeRoot string, content *VolumeContent, preserveInDst []string, backupDir string) error {
 	if err := checkContent(content); err != nil {
 		return err
 	}
diff -Nru snapd-2.45.1+20.04.2/gadget/mountedfilesystem_test.go snapd-2.48.3+20.04/gadget/mountedfilesystem_test.go
--- snapd-2.45.1+20.04.2/gadget/mountedfilesystem_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/mountedfilesystem_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,6 +30,7 @@
 
 	"github.com/snapcore/snapd/gadget"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/strutil"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -116,7 +117,10 @@
 	cleanWhere := filepath.Clean(where)
 
 	got := make(map[string]contentType)
-	filepath.Walk(where, func(name string, fi os.FileInfo, err error) error {
+	err := filepath.Walk(where, func(name string, fi os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
 		if name == where {
 			return nil
 		}
@@ -133,8 +137,12 @@
 
 		return nil
 	})
-
-	c.Assert(got, DeepEquals, expected)
+	c.Assert(err, IsNil)
+	if len(expected) > 0 {
+		c.Assert(got, DeepEquals, expected)
+	} else {
+		c.Assert(got, HasLen, 0)
+	}
 }
 
 func (s *mountedfilesystemTestSuite) TestWriteFile(c *C) {
@@ -179,9 +187,17 @@
 	}
 	makeGadgetData(c, s.dir, gd)
 
+	ps := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Filesystem: "ext4",
+		},
+	}
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
+	c.Assert(err, IsNil)
+
 	outDir := c.MkDir()
 	// boot-assets/ -> / (contents of boot assets under /)
-	err := gadget.WriteDirectory(filepath.Join(s.dir, "boot-assets")+"/", outDir+"/", nil)
+	err = rw.WriteDirectory(outDir, filepath.Join(s.dir, "boot-assets")+"/", outDir+"/", nil)
 	c.Assert(err, IsNil)
 
 	verifyWrittenGadgetData(c, outDir, gd)
@@ -197,9 +213,17 @@
 	}
 	makeGadgetData(c, s.dir, gd)
 
+	ps := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Filesystem: "ext4",
+		},
+	}
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
+	c.Assert(err, IsNil)
+
 	outDir := c.MkDir()
 	// boot-assets -> / (boot-assets and children under /)
-	err := gadget.WriteDirectory(filepath.Join(s.dir, "boot-assets"), outDir+"/", nil)
+	err = rw.WriteDirectory(outDir, filepath.Join(s.dir, "boot-assets"), outDir+"/", nil)
 	c.Assert(err, IsNil)
 
 	verifyWrittenGadgetData(c, outDir, gd)
@@ -210,16 +234,66 @@
 		{name: "foo", content: "nested"},
 	}
 	makeGadgetData(c, s.dir, gd)
+	ps := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Filesystem: "ext4",
+		},
+	}
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
+	c.Assert(err, IsNil)
 
 	outDir := c.MkDir()
 
-	err := gadget.WriteDirectory(filepath.Join(s.dir, "foo")+"/", outDir, nil)
+	err = rw.WriteDirectory(outDir, filepath.Join(s.dir, "foo")+"/", outDir, nil)
 	c.Assert(err, ErrorMatches, `cannot specify trailing / for a source which is not a directory`)
 
-	err = gadget.WriteDirectory(filepath.Join(s.dir, "foo"), outDir, nil)
+	err = rw.WriteDirectory(outDir, filepath.Join(s.dir, "foo"), outDir, nil)
 	c.Assert(err, ErrorMatches, `source is not a directory`)
 }
 
+type mockContentChange struct {
+	path   string
+	change *gadget.ContentChange
+}
+
+type mockWriteObserver struct {
+	content         map[string][]*mockContentChange
+	preserveTargets []string
+	observeErr      error
+	expectedStruct  *gadget.LaidOutStructure
+	c               *C
+}
+
+func (m *mockWriteObserver) Observe(op gadget.ContentOperation, sourceStruct *gadget.LaidOutStructure,
+	targetRootDir, relativeTargetPath string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	if m.c == nil {
+		panic("c is unset")
+	}
+	m.c.Assert(data, NotNil)
+	m.c.Assert(op, Equals, gadget.ContentWrite, Commentf("unexpected operation %v", op))
+	if m.content == nil {
+		m.content = make(map[string][]*mockContentChange)
+	}
+	// the file with content that will be written must exist
+	m.c.Check(osutil.FileExists(data.After) && !osutil.IsDirectory(data.After), Equals, true,
+		Commentf("path %q does not exist or is a directory", data.After))
+	// all files are treated as new by the writer
+	m.c.Check(data.Before, Equals, "")
+	m.c.Check(filepath.IsAbs(relativeTargetPath), Equals, false,
+		Commentf("target path %q is absolute", relativeTargetPath))
+
+	m.content[targetRootDir] = append(m.content[targetRootDir],
+		&mockContentChange{path: relativeTargetPath, change: data})
+
+	m.c.Assert(sourceStruct, NotNil)
+	m.c.Check(m.expectedStruct, DeepEquals, sourceStruct)
+
+	if strutil.ListContains(m.preserveTargets, relativeTargetPath) {
+		return gadget.ChangeIgnore, nil
+	}
+	return gadget.ChangeApply, m.observeErr
+}
+
 func (s *mountedfilesystemTestSuite) TestMountedWriterHappy(c *C) {
 	gd := []gadgetData{
 		{name: "foo", target: "foo-dir/foo", content: "foo foo foo"},
@@ -230,6 +304,7 @@
 		{name: "boot-assets/some-dir/empty-file", target: "some-dir/empty-file"},
 		{name: "boot-assets/nested-dir/nested", target: "/nested-copy/nested", content: "nested"},
 		{name: "boot-assets/nested-dir/more-nested/more", target: "/nested-copy/more-nested/more", content: "more"},
+		{name: "baz", target: "/baz", content: "baz"},
 	}
 	makeGadgetData(c, s.dir, gd)
 	err := os.MkdirAll(filepath.Join(s.dir, "boot-assets/empty-dir"), 0755)
@@ -237,6 +312,7 @@
 
 	ps := &gadget.LaidOutStructure{
 		VolumeStructure: &gadget.VolumeStructure{
+			Name:       "hello",
 			Size:       2048,
 			Filesystem: "ext4",
 			Content: []gadget.VolumeContent{
@@ -260,6 +336,10 @@
 					// contents of nested directory under new target directory
 					Source: "boot-assets/nested-dir/",
 					Target: "/nested-copy/",
+				}, {
+					// contents of nested directory under new target directory
+					Source: "baz",
+					Target: "baz",
 				},
 			},
 		},
@@ -267,7 +347,11 @@
 
 	outDir := c.MkDir()
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	obs := &mockWriteObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, obs)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -276,6 +360,43 @@
 
 	verifyWrittenGadgetData(c, outDir, gd)
 	c.Assert(osutil.IsDirectory(filepath.Join(outDir, "empty-dir")), Equals, true)
+
+	// verify observer was notified of writes for files only
+	c.Assert(obs.content, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			{"foo-dir/foo", &gadget.ContentChange{After: filepath.Join(s.dir, "foo")}},
+			{"bar-name", &gadget.ContentChange{After: filepath.Join(s.dir, "bar")}},
+
+			{"nested-dir/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more"),
+			}},
+			{"nested-dir/nested", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/nested"),
+			}},
+			{"some-dir/data", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/data"),
+			}},
+			{"some-dir/empty-file", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/empty-file"),
+			}},
+			{"splash", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/splash"),
+			}},
+
+			{"data-copy", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/data"),
+			}},
+
+			{"nested-copy/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more"),
+			}},
+			{"nested-copy/nested", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/nested"),
+			}},
+
+			{"baz", &gadget.ContentChange{After: filepath.Join(s.dir, "baz")}},
+		},
+	})
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedWriterNonDirectory(c *C) {
@@ -300,7 +421,7 @@
 
 	outDir := c.MkDir()
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -325,7 +446,7 @@
 
 	outDir := c.MkDir()
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -334,6 +455,10 @@
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedWriterErrorBadDestination(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	makeSizedFile(c, filepath.Join(s.dir, "foo"), 0, []byte("foo foo foo"))
 
 	ps := &gadget.LaidOutStructure{
@@ -355,7 +480,7 @@
 	err := os.Chmod(outDir, 0000)
 	c.Assert(err, IsNil)
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -389,13 +514,13 @@
 
 	outDir := c.MkDir()
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, psOverwritesDirectoryWithFile)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, psOverwritesDirectoryWithFile, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
 	// can't overwrite a directory with a file
 	err = rw.Write(outDir, nil)
-	c.Assert(err, ErrorMatches, fmt.Sprintf("cannot write filesystem content of source:foo-dir: cannot copy .*: unable to create %s/foo-dir: .* is a directory", outDir))
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`cannot write filesystem content of source:foo-dir: cannot copy .*: cannot commit atomic file copy: rename %[1]s/foo-dir\.[a-zA-Z0-9]+~ %[1]s/foo-dir: file exists`, outDir))
 
 }
 
@@ -423,7 +548,7 @@
 
 	outDir := c.MkDir()
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, psOverwritesFile)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, psOverwritesFile, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -459,7 +584,7 @@
 
 	makeSizedFile(c, filepath.Join(outDir, "/foo-dir/foo/bar"), 0, nil)
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -540,7 +665,7 @@
 		},
 	}
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -556,6 +681,52 @@
 	verifyWrittenGadgetData(c, outDir, gdWritten)
 }
 
+func (s *mountedfilesystemTestSuite) TestMountedWriterPreserveWithObserver(c *C) {
+	// some data for the gadget
+	gd := []gadgetData{
+		{name: "foo", target: "foo-dir/foo", content: "foo from gadget"},
+	}
+	makeGadgetData(c, s.dir, gd)
+
+	outDir := filepath.Join(c.MkDir(), "out-dir")
+	makeSizedFile(c, filepath.Join(outDir, "foo"), 0, []byte("foo from disk"))
+
+	ps := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Size:       2048,
+			Filesystem: "ext4",
+			Content: []gadget.VolumeContent{
+				{
+					Source: "foo",
+					// would overwrite existing foo
+					Target: "foo",
+				}, {
+					Source: "foo",
+					// does not exist
+					Target: "foo-new",
+				},
+			},
+		},
+	}
+
+	obs := &mockWriteObserver{
+		c:              c,
+		expectedStruct: ps,
+		preserveTargets: []string{
+			"foo",
+			"foo-new",
+		},
+	}
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, obs)
+	c.Assert(err, IsNil)
+	c.Assert(rw, NotNil)
+
+	err = rw.Write(outDir, nil)
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "foo from disk")
+	c.Check(filepath.Join(outDir, "foo-new"), testutil.FileAbsent)
+}
+
 func (s *mountedfilesystemTestSuite) TestMountedWriterNonFilePreserveError(c *C) {
 	// some data for the gadget
 	gd := []gadgetData{
@@ -585,7 +756,7 @@
 		},
 	}
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -616,7 +787,7 @@
 
 	outDir := c.MkDir()
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -641,13 +812,13 @@
 		},
 	}
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, ErrorMatches, "structure #0 has no filesystem")
 	c.Assert(rw, IsNil)
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedWriterTrivialValidation(c *C) {
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, nil)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, nil, nil)
 	c.Assert(err, ErrorMatches, `internal error: \*LaidOutStructure.*`)
 	c.Assert(rw, IsNil)
 
@@ -665,11 +836,11 @@
 		},
 	}
 
-	rw, err = gadget.NewMountedFilesystemWriter("", ps)
+	rw, err = gadget.NewMountedFilesystemWriter("", ps, nil)
 	c.Assert(err, ErrorMatches, `internal error: gadget content directory cannot be unset`)
 	c.Assert(rw, IsNil)
 
-	rw, err = gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err = gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 
 	err = rw.Write("", nil)
@@ -706,7 +877,7 @@
 		},
 	}
 
-	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps)
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -724,6 +895,66 @@
 	})
 }
 
+type mockContentUpdateObserver struct {
+	contentUpdate   map[string][]*mockContentChange
+	contentRollback map[string][]*mockContentChange
+	preserveTargets []string
+	observeErr      error
+	expectedStruct  *gadget.LaidOutStructure
+	c               *C
+}
+
+func (m *mockContentUpdateObserver) reset() {
+	m.contentUpdate = nil
+	m.contentRollback = nil
+}
+
+func (m *mockContentUpdateObserver) Observe(op gadget.ContentOperation, sourceStruct *gadget.LaidOutStructure,
+	targetRootDir, relativeTargetPath string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	if m.c == nil {
+		panic("c is unset")
+	}
+	if m.contentUpdate == nil {
+		m.contentUpdate = make(map[string][]*mockContentChange)
+	}
+	if m.contentRollback == nil {
+		m.contentRollback = make(map[string][]*mockContentChange)
+	}
+	m.c.Assert(data, NotNil)
+
+	// the after content must always be set
+	m.c.Check(osutil.FileExists(data.After) && !osutil.IsDirectory(data.After), Equals, true,
+		Commentf("after reference path %q does not exist or is a directory", data.After))
+	// they may be no before content for new files
+	if data.Before != "" {
+		m.c.Check(osutil.FileExists(data.Before) && !osutil.IsDirectory(data.Before), Equals, true,
+			Commentf("before reference path %q does not exist or is a directory", data.Before))
+	}
+	m.c.Check(filepath.IsAbs(relativeTargetPath), Equals, false,
+		Commentf("target path %q is absolute", relativeTargetPath))
+
+	opData := &mockContentChange{path: relativeTargetPath, change: data}
+	switch op {
+	case gadget.ContentUpdate:
+		m.contentUpdate[targetRootDir] = append(m.contentUpdate[targetRootDir], opData)
+	case gadget.ContentRollback:
+		m.contentRollback[targetRootDir] = append(m.contentRollback[targetRootDir], opData)
+	default:
+		m.c.Fatalf("unexpected observe operation %v", op)
+	}
+
+	m.c.Assert(sourceStruct, NotNil)
+	m.c.Check(m.expectedStruct, DeepEquals, sourceStruct)
+
+	if m.observeErr != nil {
+		return gadget.ChangeAbort, m.observeErr
+	}
+	if strutil.ListContains(m.preserveTargets, relativeTargetPath) {
+		return gadget.ChangeIgnore, nil
+	}
+	return gadget.ChangeApply, nil
+}
+
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterBackupSimple(c *C) {
 	// some data for the gadget
 	gdWritten := []gadgetData{
@@ -778,10 +1009,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -802,10 +1037,86 @@
 			c.Check(backup, testutil.FileEquals, "can't touch this")
 		}
 	}
+	// notified for both updated and new content
+	c.Check(muo.contentUpdate, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// bar-name is a new file
+			{"bar-name", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+			// updates
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/foo.backup"),
+			}},
+			{"nested/foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/nested/foo.backup"),
+			}},
+		},
+	})
 
-	// running backup again does not error out
+	// running backup again (eg. after a reboot) does not error out
 	err = rw.Backup()
 	c.Assert(err, IsNil)
+	// we are notified of all files again
+	c.Check(muo.contentUpdate, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// bar-name is a new file
+			{"bar-name", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/foo.backup"),
+			}},
+			{"nested/foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/nested/foo.backup"),
+			}},
+			// same set of calls once more
+			{"bar-name", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/foo.backup"),
+			}},
+			{"nested/foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/nested/foo.backup"),
+			}},
+		},
+	})
+}
+
+func (s *mountedfilesystemTestSuite) TestMountedWriterObserverErr(c *C) {
+	makeGadgetData(c, s.dir, []gadgetData{
+		{name: "foo", content: "data"},
+	})
+
+	ps := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Size:       2048,
+			Filesystem: "ext4",
+			Content: []gadget.VolumeContent{
+				{Source: "/", Target: "/"},
+			},
+		},
+	}
+
+	outDir := c.MkDir()
+	obs := &mockWriteObserver{
+		c:              c,
+		observeErr:     errors.New("observe fail"),
+		expectedStruct: ps,
+	}
+	rw, err := gadget.NewMountedFilesystemWriter(s.dir, ps, obs)
+	c.Assert(err, IsNil)
+	c.Assert(rw, NotNil)
+
+	err = rw.Write(outDir, nil)
+	c.Assert(err, ErrorMatches, "cannot write filesystem content of source:/: cannot observe file write: observe fail")
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterBackupWithDirectories(c *C) {
@@ -860,7 +1171,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -914,7 +1225,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -927,6 +1238,10 @@
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterBackupFailsOnBackupDirErrors(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	outDir := filepath.Join(c.MkDir(), "out-dir")
 
 	ps := &gadget.LaidOutStructure{
@@ -948,7 +1263,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -961,6 +1276,10 @@
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterBackupFailsOnDestinationErrors(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	// some data for the gadget
 	gd := []gadgetData{
 		{name: "bar", content: "data"},
@@ -994,7 +1313,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1003,6 +1322,10 @@
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterBackupFailsOnBadSrcComparison(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	// some data for the gadget
 	gd := []gadgetData{
 		{name: "bar", content: "data"},
@@ -1035,7 +1358,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1101,7 +1424,7 @@
 		rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, tc.backupDir, func(to *gadget.LaidOutStructure) (string, error) {
 			c.Check(to, DeepEquals, ps)
 			return tc.outDir, nil
-		})
+		}, nil)
 		c.Assert(err, IsNil)
 		c.Assert(rw, NotNil)
 
@@ -1149,7 +1472,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1195,7 +1518,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1232,7 +1555,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1333,10 +1656,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1348,6 +1675,72 @@
 		c.Check(filepath.Join(s.backup, "struct-0", en.target)+".same", testutil.FilePresent)
 	}
 
+	// only notified about content getting updated
+	c.Check(muo.contentUpdate, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// the following files were not observed because they
+			// are the same as the ones on disk:
+			// - nested-copy/more-nested/identical
+			// - nested-copy/same-as-target-dir/identical
+			//
+			// we still get notified about new files:
+			{"foo-dir/foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "foo"),
+			}},
+			// in the preserve list but not present
+			{"bar-name", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+			// boot-assets/ -> /
+			{"nested-dir/more-nested/identical", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/identical"),
+			}},
+			{"nested-dir/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more"),
+			}},
+			{"nested-dir/nested", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/nested"),
+			}},
+			{"nested-dir/same-as-target-dir/identical", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/same-as-target-dir/identical"),
+			}},
+			// in the preserve list but not present
+			{"some-dir/data", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/data"),
+			}},
+			{"some-dir/empty-file", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/empty-file"),
+			}},
+			{"splash", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/splash"),
+			}},
+			// boot-assets/nested-dir/ -> /nested-copy/
+			{"nested-copy/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more"),
+			}},
+			// boot-assets -> /boot-assets-copy/
+			{"boot-assets-copy/boot-assets/nested-dir/more-nested/identical", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/identical")}},
+			{"boot-assets-copy/boot-assets/nested-dir/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more")}},
+			{"boot-assets-copy/boot-assets/nested-dir/nested", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/nested"),
+			}},
+			{"boot-assets-copy/boot-assets/nested-dir/same-as-target-dir/identical", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/same-as-target-dir/identical"),
+			}},
+			{"boot-assets-copy/boot-assets/some-dir/data", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/data"),
+			}},
+			{"boot-assets-copy/boot-assets/some-dir/empty-file", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/empty-file"),
+			}},
+			{"boot-assets-copy/boot-assets/splash", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/splash"),
+			}},
+		},
+	})
+
 	err = rw.Update()
 	c.Assert(err, IsNil)
 
@@ -1360,37 +1753,6 @@
 	verifyWrittenGadgetData(c, outDir, append(gdWritten, gdIdentical...))
 }
 
-func (s *mountedfilesystemTestSuite) TestMountedUpdaterUpdateLookupFails(c *C) {
-	makeGadgetData(c, s.dir, []gadgetData{
-		{name: "canary", target: "canary", content: "data"},
-	})
-
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size:       2048,
-			Filesystem: "ext4",
-			Content: []gadget.VolumeContent{
-				{
-					Source: "/",
-					Target: "/",
-				},
-			},
-			Update: gadget.VolumeUpdate{
-				Edition: 1,
-			},
-		},
-	}
-
-	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
-		c.Check(to, DeepEquals, ps)
-		return "", errors.New("failed")
-	})
-	c.Assert(err, IsNil)
-	c.Assert(rw, NotNil)
-
-	err = rw.Update()
-	c.Assert(err, ErrorMatches, "cannot find mount location of structure #0: failed")
-}
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterDirContents(c *C) {
 	// some data for the gadget
 	gdWritten := []gadgetData{
@@ -1432,7 +1794,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1487,7 +1849,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1545,7 +1907,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1602,7 +1964,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1655,7 +2017,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1691,7 +2053,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1729,7 +2091,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1774,10 +2136,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1792,6 +2158,21 @@
 		{target: "foo", content: "backup"},
 		{target: "some-dir/foo", content: "backup"},
 	})
+
+	// only notified about content getting updated
+	c.Check(muo.contentRollback, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// rollback restores from the backups
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "bar"),
+				Before: filepath.Join(s.backup, "struct-0/foo.backup"),
+			}},
+			{"some-dir/foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "bar"),
+				Before: filepath.Join(s.backup, "struct-0/some-dir/foo.backup"),
+			}},
+		},
+	})
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterRollbackSkipSame(c *C) {
@@ -1822,10 +2203,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1838,6 +2223,8 @@
 	verifyWrittenGadgetData(c, outDir, []gadgetData{
 		{target: "foo", content: "same"},
 	})
+	// identical content did not need a rollback, no notifications
+	c.Check(muo.contentRollback, HasLen, 0)
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterRollbackSkipPreserved(c *C) {
@@ -1869,10 +2256,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1885,6 +2276,8 @@
 	verifyWrittenGadgetData(c, outDir, []gadgetData{
 		{target: "foo", content: "preserved"},
 	})
+	// preserved content did not need a rollback, no notifications
+	c.Check(muo.contentRollback, HasLen, 0)
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterRollbackNewFiles(c *C) {
@@ -1921,10 +2314,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1933,9 +2330,31 @@
 	c.Assert(err, IsNil)
 	// everything was removed
 	verifyDirContents(c, outDir, map[string]contentType{})
+	// new files were rolled back
+	c.Check(muo.contentRollback, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// files did not exist, so there was no 'before' content
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "bar"),
+				Before: "",
+			}},
+			{"some-dir/bar", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "bar"),
+				Before: "",
+			}},
+			{"this/is/some/deep/nesting/bar", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "bar"),
+				Before: "",
+			}},
+		},
+	})
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterRollbackRestoreFails(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	makeGadgetData(c, s.dir, []gadgetData{
 		{name: "bar", content: "data"},
 	})
@@ -1945,7 +2364,8 @@
 		{target: "foo", content: "written"},
 		{target: "some-dir/foo", content: "written"},
 	})
-	// make rollback fail when restoring
+	// the file exists, and cannot be modified directly, rollback will still
+	// restore the backup as we atomically swap copies with rename()
 	err := os.Chmod(filepath.Join(outDir, "foo"), 0000)
 	c.Assert(err, IsNil)
 
@@ -1971,7 +2391,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -1979,12 +2399,19 @@
 	makeSizedFile(c, filepath.Join(s.backup, "struct-0/foo.backup"), 0, []byte("backup"))
 
 	err = rw.Rollback()
-	c.Assert(err, ErrorMatches, "cannot rollback content: cannot copy .*: unable to create .*/out-dir/foo: permission denied")
+	c.Assert(err, IsNil)
+	// the file was restored
+	c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "backup")
+	// directory was removed
+	c.Check(osutil.IsDirectory(filepath.Join(outDir, "some-dir")), Equals, false)
 
-	// remove offending file
-	c.Assert(os.Remove(filepath.Join(outDir, "foo")), IsNil)
+	// mock the data again
+	makeExistingData(c, outDir, []gadgetData{
+		{target: "foo", content: "written"},
+		{target: "some-dir/foo", content: "written"},
+	})
 
-	// make destination dir non-writable
+	// make the directory non-writable
 	err = os.Chmod(filepath.Join(outDir, "some-dir"), 0555)
 	c.Assert(err, IsNil)
 	// restore permissions later, otherwise test suite cleanup complains
@@ -2020,16 +2447,33 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
 	// rollback does not error out if files were not written
 	err = rw.Rollback()
 	c.Assert(err, IsNil)
+	// observer would be notified that files were to be written, and so it
+	// must be notified when they would be rolled back
+	c.Check(muo.contentRollback, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// rollback restores from the backups
+			{"foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+			{"some-dir/foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+		},
+	})
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterRollbackDirectory(c *C) {
@@ -2038,6 +2482,7 @@
 		{name: "some-dir/foo", content: "data"},
 		{name: "some-dir/nested/nested-foo", content: "data"},
 		{name: "empty-dir/"},
+		{name: "bar", content: "data"},
 	})
 
 	outDir := filepath.Join(c.MkDir(), "out-dir")
@@ -2085,10 +2530,14 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -2112,6 +2561,38 @@
 	// this one got restored
 	c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "backup")
 
+	c.Check(muo.contentRollback, DeepEquals, map[string][]*mockContentChange{
+		outDir: {
+			// a new file
+			{"bar", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "some-dir/bar"),
+			}},
+			// this file was restored from backup
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "some-dir/foo"),
+				Before: filepath.Join(s.backup, "struct-0/foo.backup"),
+			}},
+			// new files till the end
+			{"nested/nested-foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "some-dir/nested/nested-foo"),
+			}},
+			{"other-dir/bar", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "some-dir/bar"),
+			}},
+			{"other-dir/foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "some-dir/foo"),
+			}},
+			{"other-dir/nested/nested-foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "some-dir/nested/nested-foo"),
+			}},
+			{"other-dir/nested/nested/nested-foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "some-dir/nested/nested-foo"),
+			}},
+			{"this/is/some/deep/nesting/bar", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+		},
+	})
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterEndToEndOne(c *C) {
@@ -2120,6 +2601,7 @@
 		{name: "foo", target: "foo-dir/foo", content: "data"},
 		{name: "bar", target: "bar-name", content: "data"},
 		{name: "boot-assets/splash", target: "splash", content: "data"},
+		{name: "boot-assets/dtb", target: "dtb", content: "data"},
 		{name: "boot-assets/some-dir/data", target: "some-dir/data", content: "data"},
 		{name: "boot-assets/some-dir/empty-file", target: "some-dir/empty-file", content: ""},
 		{name: "boot-assets/nested-dir/more-nested/more", target: "/nested-copy/more-nested/more", content: "data"},
@@ -2128,6 +2610,10 @@
 		{name: "foo", target: "/foo", content: "data"},
 		{name: "boot-assets/some-dir/data", target: "data-copy", content: "data"},
 		{name: "boot-assets/nested-dir/nested", target: "/nested-copy/nested", content: "data"},
+		{name: "preserved/same-content", target: "preserved/same-content", content: "can't touch this"},
+	}
+	gdSameContent := []gadgetData{
+		{name: "foo", target: "/foo-same", content: "data"},
 	}
 	makeGadgetData(c, s.dir, append(gdWritten, gdNotWritten...))
 	err := os.MkdirAll(filepath.Join(s.dir, "boot-assets/empty-dir"), 0755)
@@ -2136,13 +2622,17 @@
 	outDir := filepath.Join(c.MkDir(), "out-dir")
 
 	makeExistingData(c, outDir, []gadgetData{
+		{target: "dtb", content: "updated"},
 		{target: "foo", content: "can't touch this"},
+		{target: "foo-same", content: "data"},
 		{target: "data-copy-preserved", content: "can't touch this"},
 		{target: "data-copy", content: "can't touch this"},
 		{target: "nested-copy/nested", content: "can't touch this"},
 		{target: "nested-copy/more-nested/"},
 		{target: "not-listed", content: "can't touch this"},
 		{target: "unrelated/data/here", content: "unrelated"},
+		{target: "preserved/same-content-for-list", content: "can't touch this"},
+		{target: "preserved/same-content-for-observer", content: "can't touch this"},
 	})
 	// these exist in the root directory and are preserved
 	preserve := []string{
@@ -2151,6 +2641,7 @@
 		"/data-copy-preserved",
 		"nested-copy/nested",
 		"not-listed", // not present in 'gadget' contents
+		"preserved/same-content-for-list",
 	}
 	// these are preserved, but don't exist in the root, so data from gadget
 	// will be written
@@ -2172,6 +2663,10 @@
 					Source: "foo",
 					Target: "/",
 				}, {
+					// nothing written, content is unchanged
+					Source: "foo",
+					Target: "/foo-same",
+				}, {
 					// preserved, but not present, will be
 					// written
 					Source: "bar",
@@ -2198,6 +2693,12 @@
 				}, {
 					Source: "/boot-assets/empty-dir/",
 					Target: "/lone-dir/nested/",
+				}, {
+					Source: "preserved/same-content",
+					Target: "preserved/same-content-for-list",
+				}, {
+					Source: "preserved/same-content",
+					Target: "preserved/same-content-for-observer",
 				},
 			},
 			Update: gadget.VolumeUpdate{
@@ -2207,21 +2708,32 @@
 		},
 	}
 
+	muo := &mockContentUpdateObserver{
+		c:              c,
+		expectedStruct: ps,
+		preserveTargets: []string{
+			"preserved/same-content-for-observer",
+		},
+	}
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, muo)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
 	originalState := map[string]contentType{
-		"foo":                     typeFile,
-		"data-copy":               typeFile,
-		"not-listed":              typeFile,
-		"data-copy-preserved":     typeFile,
-		"nested-copy/nested":      typeFile,
-		"nested-copy/more-nested": typeDir,
-		"unrelated/data/here":     typeFile,
+		"foo":                                 typeFile,
+		"foo-same":                            typeFile,
+		"dtb":                                 typeFile,
+		"data-copy":                           typeFile,
+		"not-listed":                          typeFile,
+		"data-copy-preserved":                 typeFile,
+		"nested-copy/nested":                  typeFile,
+		"nested-copy/more-nested":             typeDir,
+		"unrelated/data/here":                 typeFile,
+		"preserved/same-content-for-list":     typeFile,
+		"preserved/same-content-for-observer": typeFile,
 	}
 	verifyDirContents(c, outDir, originalState)
 
@@ -2230,13 +2742,82 @@
 	c.Assert(err, IsNil)
 
 	verifyDirContents(c, filepath.Join(s.backup, "struct-0"), map[string]contentType{
-		"nested-copy.backup":             typeFile,
-		"nested-copy/nested.preserve":    typeFile,
-		"nested-copy/more-nested.backup": typeFile,
-		"foo.preserve":                   typeFile,
-		"data-copy-preserved.preserve":   typeFile,
-		"data-copy.backup":               typeFile,
-	})
+		"nested-copy.backup":                       typeFile,
+		"nested-copy/nested.preserve":              typeFile,
+		"nested-copy/more-nested.backup":           typeFile,
+		"foo.preserve":                             typeFile,
+		"foo-same.same":                            typeFile,
+		"data-copy-preserved.preserve":             typeFile,
+		"data-copy.backup":                         typeFile,
+		"dtb.backup":                               typeFile,
+		"preserved.backup":                         typeFile,
+		"preserved/same-content-for-list.preserve": typeFile,
+		"preserved/same-content-for-observer.same": typeFile,
+	})
+
+	expectedObservedContentChange := map[string][]*mockContentChange{
+		// observer is notified about changed and new files
+		outDir: {
+			{"foo-dir/foo", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "foo"),
+			}},
+			{"bar-name", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "bar"),
+			}},
+			// update with changed content
+			{"dtb", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "boot-assets/dtb"),
+				Before: filepath.Join(s.backup, "struct-0/dtb.backup"),
+			}},
+			// new files
+			{"nested-dir/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more"),
+			}},
+			{"nested-dir/nested", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/nested"),
+			}},
+			{"some-dir/data", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/data"),
+			}},
+			// new files
+			{"some-dir/empty-file", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/empty-file"),
+			}},
+			{"splash", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/splash"),
+			}},
+			// update with changed content
+			{"data-copy", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "boot-assets/some-dir/data"),
+				Before: filepath.Join(s.backup, "struct-0/data-copy.backup"),
+			}},
+			// new files
+			{"nested-copy/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more"),
+			}},
+			{"boot-assets-copy/boot-assets/dtb", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/dtb"),
+			}},
+			{"boot-assets-copy/boot-assets/nested-dir/more-nested/more", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/more-nested/more")},
+			},
+			{"boot-assets-copy/boot-assets/nested-dir/nested", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/nested-dir/nested"),
+			}},
+			{"boot-assets-copy/boot-assets/some-dir/data", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/data"),
+			}},
+			{"boot-assets-copy/boot-assets/some-dir/empty-file", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/some-dir/empty-file"),
+			}},
+			{"boot-assets-copy/boot-assets/splash", &gadget.ContentChange{
+				After: filepath.Join(s.dir, "boot-assets/splash"),
+			}},
+		},
+	}
+
+	// observe calls happen in the order the structure content gets analyzed
+	c.Check(muo.contentUpdate, DeepEquals, expectedObservedContentChange)
 
 	// run the update phase
 	err = rw.Update()
@@ -2244,6 +2825,7 @@
 
 	verifyDirContents(c, outDir, map[string]contentType{
 		"foo":        typeFile,
+		"foo-same":   typeFile,
 		"not-listed": typeFile,
 
 		// boot-assets/some-dir/data -> /data-copy
@@ -2259,6 +2841,7 @@
 		"bar-name": typeFile,
 
 		// boot-assets/ -> /
+		"dtb":                         typeFile,
 		"splash":                      typeFile,
 		"some-dir/data":               typeFile,
 		"some-dir/empty-file":         typeFile,
@@ -2267,6 +2850,7 @@
 		"empty-dir":                   typeDir,
 
 		// boot-assets -> /boot-assets-copy/
+		"boot-assets-copy/boot-assets/dtb":                         typeFile,
 		"boot-assets-copy/boot-assets/splash":                      typeFile,
 		"boot-assets-copy/boot-assets/some-dir/data":               typeFile,
 		"boot-assets-copy/boot-assets/some-dir/empty-file":         typeFile,
@@ -2283,6 +2867,9 @@
 
 		// boot-assets/empty-dir/ -> /lone-dir/nested/
 		"lone-dir/nested": typeDir,
+
+		"preserved/same-content-for-list":     typeFile,
+		"preserved/same-content-for-observer": typeFile,
 	})
 
 	// files that existed were preserved
@@ -2291,12 +2878,21 @@
 		c.Check(p, testutil.FileEquals, "can't touch this")
 	}
 	// everything else was written
-	verifyWrittenGadgetData(c, outDir, gdWritten)
+	verifyWrittenGadgetData(c, outDir, append(gdWritten, gdSameContent...))
 
 	err = rw.Rollback()
 	c.Assert(err, IsNil)
 	// back to square one
 	verifyDirContents(c, outDir, originalState)
+
+	c.Check(muo.contentRollback, DeepEquals, expectedObservedContentChange)
+	// call rollback once more, we should observe the same files again
+	muo.contentRollback = nil
+	err = rw.Rollback()
+	c.Assert(err, IsNil)
+	c.Check(muo.contentRollback, DeepEquals, expectedObservedContentChange)
+	// file contents are unchanged
+	verifyDirContents(c, outDir, originalState)
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterTrivialValidation(c *C) {
@@ -2313,7 +2909,7 @@
 		return "", nil
 	}
 
-	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, psNoFs, s.backup, lookupFail)
+	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, psNoFs, s.backup, lookupFail, nil)
 	c.Assert(err, ErrorMatches, "structure #0 has no filesystem")
 	c.Assert(rw, IsNil)
 
@@ -2325,19 +2921,19 @@
 		},
 	}
 
-	rw, err = gadget.NewMountedFilesystemUpdater("", ps, s.backup, lookupFail)
+	rw, err = gadget.NewMountedFilesystemUpdater("", ps, s.backup, lookupFail, nil)
 	c.Assert(err, ErrorMatches, `internal error: gadget content directory cannot be unset`)
 	c.Assert(rw, IsNil)
 
-	rw, err = gadget.NewMountedFilesystemUpdater(s.dir, ps, "", lookupFail)
+	rw, err = gadget.NewMountedFilesystemUpdater(s.dir, ps, "", lookupFail, nil)
 	c.Assert(err, ErrorMatches, `internal error: backup directory must not be unset`)
 	c.Assert(rw, IsNil)
 
-	rw, err = gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, nil)
+	rw, err = gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, nil, nil)
 	c.Assert(err, ErrorMatches, `internal error: mount lookup helper must be provided`)
 	c.Assert(rw, IsNil)
 
-	rw, err = gadget.NewMountedFilesystemUpdater(s.dir, nil, s.backup, lookupFail)
+	rw, err = gadget.NewMountedFilesystemUpdater(s.dir, nil, s.backup, lookupFail, nil)
 	c.Assert(err, ErrorMatches, `internal error: \*LaidOutStructure.*`)
 	c.Assert(rw, IsNil)
 
@@ -2360,7 +2956,7 @@
 			},
 		}
 
-		rw, err := gadget.NewMountedFilesystemUpdater(s.dir, testPs, s.backup, lookupOk)
+		rw, err := gadget.NewMountedFilesystemUpdater(s.dir, testPs, s.backup, lookupOk, nil)
 		c.Assert(err, IsNil)
 		c.Assert(rw, NotNil)
 
@@ -2383,25 +2979,20 @@
 			Content: []gadget.VolumeContent{
 				{Source: "/", Target: "/"},
 			},
+			Update: gadget.VolumeUpdate{
+				Edition: 1,
+			},
 		},
 	}
 
 	lookupFail := func(to *gadget.LaidOutStructure) (string, error) {
+		c.Check(to, DeepEquals, ps)
 		return "", errors.New("fail fail fail")
 	}
 
-	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, lookupFail)
-	c.Assert(err, IsNil)
-	c.Assert(rw, NotNil)
-
-	err = rw.Update()
-	c.Assert(err, ErrorMatches, "cannot find mount location of structure #0: fail fail fail")
-
-	err = rw.Backup()
-	c.Assert(err, ErrorMatches, "cannot find mount location of structure #0: fail fail fail")
-
-	err = rw.Rollback()
+	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, lookupFail, nil)
 	c.Assert(err, ErrorMatches, "cannot find mount location of structure #0: fail fail fail")
+	c.Assert(rw, IsNil)
 }
 
 func (s *mountedfilesystemTestSuite) TestMountedUpdaterNonFilePreserveError(c *C) {
@@ -2433,7 +3024,7 @@
 	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup, func(to *gadget.LaidOutStructure) (string, error) {
 		c.Check(to, DeepEquals, ps)
 		return outDir, nil
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(rw, NotNil)
 
@@ -2444,3 +3035,235 @@
 	err = rw.Rollback()
 	c.Check(err, ErrorMatches, `cannot map preserve entries for mount location ".*/out-dir": preserved entry "foo" cannot be a directory`)
 }
+
+func (s *mountedfilesystemTestSuite) TestMountedUpdaterObserverPreservesBootAssets(c *C) {
+	// mirror pc-amd64-gadget
+	gd := []gadgetData{
+		{name: "grub.conf", content: "grub.conf from gadget"},
+		{name: "grubx64.efi", content: "grubx64.efi from gadget"},
+		{name: "foo", content: "foo from gadget"},
+	}
+	makeGadgetData(c, s.dir, gd)
+
+	outDir := filepath.Join(c.MkDir(), "out-dir")
+
+	existingGrubCfg := `# Snapd-Boot-Config-Edition: 1
+managed grub.cfg from disk`
+	makeExistingData(c, outDir, []gadgetData{
+		{target: "EFI/boot/grubx64.efi", content: "grubx64.efi from disk"},
+		{target: "EFI/ubuntu/grub.cfg", content: existingGrubCfg},
+		{target: "foo", content: "foo from disk"},
+	})
+	// based on pc gadget
+	ps := &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Size:       2048,
+			Role:       gadget.SystemBoot,
+			Filesystem: "ext4",
+			Content: []gadget.VolumeContent{
+				{Source: "grubx64.efi", Target: "EFI/boot/grubx64.efi"},
+				{Source: "grub.conf", Target: "EFI/ubuntu/grub.cfg"},
+				{Source: "foo", Target: "foo"},
+			},
+			Update: gadget.VolumeUpdate{
+				Preserve: []string{"foo"},
+				Edition:  1,
+			},
+		},
+	}
+	obs := &mockContentUpdateObserver{
+		c:               c,
+		expectedStruct:  ps,
+		preserveTargets: []string{"EFI/ubuntu/grub.cfg"},
+	}
+	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, ps, s.backup,
+		func(to *gadget.LaidOutStructure) (string, error) {
+			c.Check(to, DeepEquals, ps)
+			return outDir, nil
+		},
+		obs)
+	c.Assert(err, IsNil)
+	c.Assert(rw, NotNil)
+
+	expectedFileStamps := map[string]contentType{
+		"EFI.backup":                  typeFile,
+		"EFI/boot/grubx64.efi.backup": typeFile,
+		"EFI/boot.backup":             typeFile,
+		"EFI/ubuntu.backup":           typeFile,
+
+		// listed explicitly in the structure
+		"foo.preserve": typeFile,
+		// requested by observer
+		"EFI/ubuntu/grub.cfg.ignore": typeFile,
+	}
+
+	for _, step := range []struct {
+		name string
+		call func() error
+	}{
+		{name: "backup", call: rw.Backup},
+		{name: "update", call: rw.Update},
+		{name: "rollback", call: rw.Rollback},
+	} {
+		c.Logf("step: %v", step.name)
+		err := step.call()
+		c.Assert(err, IsNil)
+
+		switch step.name {
+		case "backup":
+			c.Check(filepath.Join(outDir, "EFI/boot/grubx64.efi"), testutil.FileEquals, "grubx64.efi from disk")
+			c.Check(filepath.Join(outDir, "EFI/ubuntu/grub.cfg"), testutil.FileEquals, existingGrubCfg)
+			c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "foo from disk")
+		case "update":
+			c.Check(filepath.Join(outDir, "EFI/boot/grubx64.efi"), testutil.FileEquals, "grubx64.efi from gadget")
+			c.Check(filepath.Join(outDir, "EFI/ubuntu/grub.cfg"), testutil.FileEquals,
+				`# Snapd-Boot-Config-Edition: 1
+managed grub.cfg from disk`)
+			c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "foo from disk")
+		case "rollback":
+			c.Check(filepath.Join(outDir, "EFI/boot/grubx64.efi"), testutil.FileEquals, "grubx64.efi from disk")
+			c.Check(filepath.Join(outDir, "EFI/ubuntu/grub.cfg"), testutil.FileEquals, existingGrubCfg)
+			c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "foo from disk")
+		default:
+			c.Fatalf("unexpected step: %q", step.name)
+		}
+		verifyDirContents(c, filepath.Join(s.backup, "struct-0"), expectedFileStamps)
+	}
+}
+
+var (
+	// based on pc gadget
+	psForObserver = &gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Size:       2048,
+			Role:       gadget.SystemBoot,
+			Filesystem: "ext4",
+			Content: []gadget.VolumeContent{
+				{Source: "foo", Target: "foo"},
+			},
+			Update: gadget.VolumeUpdate{
+				Edition: 1,
+			},
+		},
+	}
+)
+
+func (s *mountedfilesystemTestSuite) TestMountedUpdaterObserverPreserveNewFile(c *C) {
+	gd := []gadgetData{
+		{name: "foo", content: "foo from gadget"},
+	}
+	makeGadgetData(c, s.dir, gd)
+
+	outDir := filepath.Join(c.MkDir(), "out-dir")
+
+	obs := &mockContentUpdateObserver{
+		c:               c,
+		expectedStruct:  psForObserver,
+		preserveTargets: []string{"foo"},
+	}
+	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, psForObserver, s.backup,
+		func(to *gadget.LaidOutStructure) (string, error) {
+			c.Check(to, DeepEquals, psForObserver)
+			return outDir, nil
+		},
+		obs)
+	c.Assert(err, IsNil)
+	c.Assert(rw, NotNil)
+
+	expectedNewFileChanges := map[string][]*mockContentChange{
+		outDir: {
+			{"foo", &gadget.ContentChange{After: filepath.Join(s.dir, "foo")}},
+		},
+	}
+	expectedStamps := map[string]contentType{
+		"foo.ignore": typeFile,
+	}
+	// file does not exist
+	err = rw.Backup()
+	c.Assert(err, IsNil)
+	// no stamps
+	verifyDirContents(c, filepath.Join(s.backup, "struct-0"), expectedStamps)
+	// observer got notified about change
+	c.Assert(obs.contentUpdate, DeepEquals, expectedNewFileChanges)
+
+	obs.reset()
+
+	// try the same pass again
+	err = rw.Backup()
+	c.Assert(err, IsNil)
+	verifyDirContents(c, filepath.Join(s.backup, "struct-0"), expectedStamps)
+	// observer already requested the change to be ignored once
+	c.Assert(obs.contentUpdate, HasLen, 0)
+
+	// file does not exist and is not written
+	err = rw.Update()
+	c.Assert(err, Equals, gadget.ErrNoUpdate)
+	c.Assert(filepath.Join(outDir, "foo"), testutil.FileAbsent)
+
+	// nothing happens on rollback
+	err = rw.Rollback()
+	c.Assert(err, IsNil)
+	c.Assert(filepath.Join(outDir, "foo"), testutil.FileAbsent)
+}
+
+func (s *mountedfilesystemTestSuite) TestMountedUpdaterObserverPreserveExistingFile(c *C) {
+	gd := []gadgetData{
+		{name: "foo", content: "foo from gadget"},
+	}
+	makeGadgetData(c, s.dir, gd)
+
+	outDir := filepath.Join(c.MkDir(), "out-dir")
+
+	obs := &mockContentUpdateObserver{
+		c:               c,
+		expectedStruct:  psForObserver,
+		preserveTargets: []string{"foo"},
+	}
+	rw, err := gadget.NewMountedFilesystemUpdater(s.dir, psForObserver, s.backup,
+		func(to *gadget.LaidOutStructure) (string, error) {
+			c.Check(to, DeepEquals, psForObserver)
+			return outDir, nil
+		},
+		obs)
+	c.Assert(err, IsNil)
+	c.Assert(rw, NotNil)
+
+	// file exists now
+	makeExistingData(c, outDir, []gadgetData{
+		{target: "foo", content: "foo from disk"},
+	})
+	expectedExistingFileChanges := map[string][]*mockContentChange{
+		outDir: {
+			{"foo", &gadget.ContentChange{
+				After:  filepath.Join(s.dir, "foo"),
+				Before: filepath.Join(s.backup, "struct-0/foo.backup"),
+			}},
+		},
+	}
+	expectedExistingFileStamps := map[string]contentType{
+		"foo.ignore": typeFile,
+	}
+	err = rw.Backup()
+	c.Assert(err, IsNil)
+	verifyDirContents(c, filepath.Join(s.backup, "struct-0"), expectedExistingFileStamps)
+	// get notified about change
+	c.Assert(obs.contentUpdate, DeepEquals, expectedExistingFileChanges)
+
+	obs.reset()
+	// backup called again (eg. after reset)
+	err = rw.Backup()
+	c.Assert(err, IsNil)
+	verifyDirContents(c, filepath.Join(s.backup, "struct-0"), expectedExistingFileStamps)
+	// observer already requested the change to be ignored once
+	c.Assert(obs.contentUpdate, HasLen, 0)
+
+	// and nothing gets updated
+	err = rw.Update()
+	c.Assert(err, Equals, gadget.ErrNoUpdate)
+	c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "foo from disk")
+
+	// the file existed and was preserved, nothing gets removed on rollback
+	err = rw.Rollback()
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(outDir, "foo"), testutil.FileEquals, "foo from disk")
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/offset.go snapd-2.48.3+20.04/gadget/offset.go
--- snapd-2.45.1+20.04.2/gadget/offset.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/offset.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,91 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget
-
-import (
-	"encoding/binary"
-	"fmt"
-	"io"
-)
-
-// OffsetWriter implements support for writing the start offsets of structure
-// and its content at locations defined by offset-write property. structures and
-// their content.
-type OffsetWriter struct {
-	ps         *LaidOutStructure
-	sectorSize Size
-}
-
-func asLBA(value, sectorSize Size) uint32 {
-	return uint32(value / sectorSize)
-}
-
-func offsetWrite(out io.WriteSeeker, offset Size, value uint32) error {
-	if _, err := out.Seek(int64(offset), io.SeekStart); err != nil {
-		return fmt.Errorf("cannot seek to offset %v: %v", offset, err)
-	}
-	if err := binary.Write(out, binary.LittleEndian, value); err != nil {
-		return fmt.Errorf("cannot write LBA value %#x at offset %v: %v", value, offset, err)
-	}
-	return nil
-}
-
-// NewOffsetWriter returns a writer for given structure.
-func NewOffsetWriter(ps *LaidOutStructure, sectorSize Size) (*OffsetWriter, error) {
-	if ps == nil {
-		return nil, fmt.Errorf("internal error: *LaidOutStructure is nil")
-	}
-	if sectorSize == 0 {
-		return nil, fmt.Errorf("internal error: sector size cannot be 0")
-	}
-	ow := &OffsetWriter{
-		ps:         ps,
-		sectorSize: sectorSize,
-	}
-	return ow, nil
-}
-
-// Write writes the start offset of the structure and the raw content of the
-// structure, at the locations defined by offset-writer property of respective
-// element, in the format of LBA pointer.
-func (w *OffsetWriter) Write(out io.WriteSeeker) error {
-	// layout step guarantees that start offset is aligned to sector size
-
-	if w.ps.AbsoluteOffsetWrite != nil {
-		if err := offsetWrite(out, *w.ps.AbsoluteOffsetWrite, asLBA(w.ps.StartOffset, w.sectorSize)); err != nil {
-			return err
-		}
-	}
-
-	if w.ps.HasFilesystem() {
-		// only raw content uses offset-writes
-		return nil
-	}
-
-	for _, pc := range w.ps.LaidOutContent {
-		if pc.AbsoluteOffsetWrite == nil {
-			continue
-		}
-		if err := offsetWrite(out, *pc.AbsoluteOffsetWrite, asLBA(pc.StartOffset, w.sectorSize)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/offset_test.go snapd-2.48.3+20.04/gadget/offset_test.go
--- snapd-2.45.1+20.04.2/gadget/offset_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/offset_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,237 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget_test
-
-import (
-	"errors"
-	"io"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/gadget"
-)
-
-type offsetSuite struct{}
-
-var _ = Suite(&offsetSuite{})
-
-func (m *offsetSuite) TestOffsetWriterOnlyStructure(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size:        1 * gadget.SizeMiB,
-			OffsetWrite: &gadget.RelativeOffset{Offset: 512},
-		},
-		StartOffset: 1024,
-		// start offset written at this location
-		AbsoluteOffsetWrite: asSizePtr(512),
-
-		LaidOutContent: []gadget.LaidOutContent{
-			{
-				VolumeContent: &gadget.VolumeContent{
-					Image: "foo.img",
-				},
-				Size:        128,
-				StartOffset: 2048,
-			},
-		},
-	}
-
-	const sectorSize = 512
-	ow, err := gadget.NewOffsetWriter(ps, sectorSize)
-	c.Assert(err, IsNil)
-
-	mw := &mockWriteSeeker{
-		seek: func(offs int64, whence int) (int64, error) {
-			c.Assert(offs, Equals, int64(512))
-			c.Assert(whence, Equals, io.SeekStart)
-			return offs, nil
-		},
-		write: func(what []byte) (int, error) {
-			// start-offset / sector-size -> 1024 / 512 -> 2
-			// 0x2 -> little endian 0x02 0x00 0x00 0x00
-			c.Assert(what, DeepEquals, []byte{0x02, 0x00, 0x00, 0x00})
-			return len(what), nil
-		},
-	}
-	err = ow.Write(mw)
-	c.Assert(err, IsNil)
-}
-
-func (m *offsetSuite) TestOffsetWriterOnlyRawContent(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size: 1 * gadget.SizeMiB,
-		},
-		StartOffset: gadget.Size(1024),
-
-		LaidOutContent: []gadget.LaidOutContent{
-			{
-				VolumeContent: &gadget.VolumeContent{
-					Image: "foo.img",
-					// absolute within the volume
-					OffsetWrite: &gadget.RelativeOffset{Offset: 4096},
-				},
-				Size:        128,
-				StartOffset: 2048,
-				// start offset written here
-				AbsoluteOffsetWrite: asSizePtr(4096),
-			},
-		},
-	}
-
-	const sectorSize = 512
-	ow, err := gadget.NewOffsetWriter(ps, sectorSize)
-	c.Assert(err, IsNil)
-
-	mw := &mockWriteSeeker{
-		seek: func(offs int64, whence int) (int64, error) {
-			c.Assert(offs, Equals, int64(4096))
-			c.Assert(whence, Equals, io.SeekStart)
-			return offs, nil
-		},
-		write: func(what []byte) (int, error) {
-			// start-offset / sector-size -> 2048 / 512 -> 4
-			// 0x4 -> little endian 0x04 0x00 0x00 0x00
-			c.Assert(what, DeepEquals, []byte{0x04, 0x00, 0x00, 0x00})
-			return 0, nil
-		},
-	}
-	err = ow.Write(mw)
-	c.Assert(err, IsNil)
-}
-
-func (m *offsetSuite) TestOffsetWriterOnlyFsStructure(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size:       1 * gadget.SizeMiB,
-			Filesystem: "ext4",
-			// same as in pc gadget
-			OffsetWrite: &gadget.RelativeOffset{Offset: 92},
-		},
-		StartOffset:         gadget.Size(348 * gadget.SizeKiB),
-		AbsoluteOffsetWrite: asSizePtr(92),
-	}
-
-	const sectorSize = 512
-	ow, err := gadget.NewOffsetWriter(ps, sectorSize)
-	c.Assert(err, IsNil)
-
-	mw := &mockWriteSeeker{
-		seek: func(offs int64, whence int) (int64, error) {
-			c.Assert(offs, Equals, int64(92))
-			c.Assert(whence, Equals, io.SeekStart)
-			return offs, nil
-		},
-		write: func(what []byte) (int, error) {
-			// start-offset / sector-size -> 356352 / 512 -> 696
-			// 0x2b8 -> little endian 0xb8 0x02 0x00 0x00
-			c.Assert(what, DeepEquals, []byte{0xb8, 0x02, 0x00, 0x00})
-			return 0, nil
-		},
-	}
-	err = ow.Write(mw)
-	c.Assert(err, IsNil)
-}
-
-func (m *offsetSuite) TestOffsetWriterErrors(c *C) {
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size:       1 * gadget.SizeMiB,
-			Filesystem: "ext4",
-			// same as in pc gadget
-			OffsetWrite: &gadget.RelativeOffset{Offset: 92},
-		},
-		StartOffset:         gadget.Size(348 * gadget.SizeKiB),
-		AbsoluteOffsetWrite: asSizePtr(92),
-	}
-
-	const sectorSize = 512
-	ow, err := gadget.NewOffsetWriter(ps, sectorSize)
-	c.Assert(err, IsNil)
-
-	mwBadSeeker := &mockWriteSeeker{
-		seek: func(offs int64, whence int) (int64, error) {
-			return 0, errors.New("bad seeker")
-		},
-		write: func(what []byte) (int, error) {
-			return 0, errors.New("unexpected call")
-		},
-	}
-	err = ow.Write(mwBadSeeker)
-	c.Assert(err, ErrorMatches, "cannot seek to offset 92: bad seeker")
-
-	mwBadWriter := &mockWriteSeeker{
-		seek: func(offs int64, whence int) (int64, error) {
-			return offs, nil
-		},
-		write: func(what []byte) (int, error) {
-			return 0, errors.New("bad writer")
-		},
-	}
-	err = ow.Write(mwBadWriter)
-	c.Assert(err, ErrorMatches, "cannot write LBA value 0x2b8 at offset 92: bad writer")
-
-	psOnlyContent := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size: 1 * gadget.SizeMiB,
-		},
-		StartOffset: gadget.Size(348 * gadget.SizeKiB),
-		LaidOutContent: []gadget.LaidOutContent{
-			{
-				VolumeContent: &gadget.VolumeContent{
-					Image: "foo.img",
-					// absolute within the volume
-					OffsetWrite: &gadget.RelativeOffset{Offset: 4096},
-				},
-				Size:        128,
-				StartOffset: 2048,
-				// start offset written here
-				AbsoluteOffsetWrite: asSizePtr(4096),
-			},
-		},
-	}
-
-	ow, err = gadget.NewOffsetWriter(psOnlyContent, sectorSize)
-	c.Assert(err, IsNil)
-
-	err = ow.Write(mwBadWriter)
-	c.Assert(err, ErrorMatches, "cannot write LBA value 0x4 at offset 4096: bad writer")
-}
-
-func (m *offsetSuite) TestOffsetWriterErrorSimpleValidation(c *C) {
-	ow, err := gadget.NewOffsetWriter(nil, 512)
-	c.Assert(err, ErrorMatches, `internal error: \*LaidOutStructure is nil`)
-	c.Assert(ow, IsNil)
-
-	ps := &gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size:       1 * gadget.SizeMiB,
-			Filesystem: "ext4",
-			// same as in pc gadget
-			OffsetWrite: &gadget.RelativeOffset{Offset: 92},
-		},
-		StartOffset:         gadget.Size(348 * gadget.SizeKiB),
-		AbsoluteOffsetWrite: asSizePtr(92),
-	}
-
-	ow, err = gadget.NewOffsetWriter(ps, 0)
-	c.Assert(err, ErrorMatches, `internal error: sector size cannot be 0`)
-	c.Assert(ow, IsNil)
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/ondisk.go snapd-2.48.3+20.04/gadget/ondisk.go
--- snapd-2.45.1+20.04.2/gadget/ondisk.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/ondisk.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,393 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package gadget
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"github.com/snapcore/snapd/gadget/quantity"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/strutil"
+)
+
+const (
+	ubuntuBootLabel = "ubuntu-boot"
+	ubuntuSeedLabel = "ubuntu-seed"
+	ubuntuDataLabel = "ubuntu-data"
+	ubuntuSaveLabel = "ubuntu-save"
+
+	sectorSize quantity.Size = 512
+)
+
+var createdPartitionGUID = []string{
+	"0FC63DAF-8483-4772-8E79-3D69D8477DE4", // Linux filesystem data
+	"0657FD6D-A4AB-43C4-84E5-0933C84B4F4F", // Linux swap partition
+}
+
+// creationSupported returns whether we support and expect to create partitions
+// of the given type, it also means we are ready to remove them for re-installation
+// or retried installation if they are appropriately marked with createdPartitionAttr.
+func creationSupported(ptype string) bool {
+	return strutil.ListContains(createdPartitionGUID, strings.ToUpper(ptype))
+}
+
+// sfdiskDeviceDump represents the sfdisk --dump JSON output format.
+type sfdiskDeviceDump struct {
+	PartitionTable sfdiskPartitionTable `json:"partitiontable"`
+}
+
+type sfdiskPartitionTable struct {
+	Label      string            `json:"label"`
+	ID         string            `json:"id"`
+	Device     string            `json:"device"`
+	Unit       string            `json:"unit"`
+	FirstLBA   uint64            `json:"firstlba"`
+	LastLBA    uint64            `json:"lastlba"`
+	Partitions []sfdiskPartition `json:"partitions"`
+}
+
+type sfdiskPartition struct {
+	Node  string `json:"node"`
+	Start uint64 `json:"start"`
+	Size  uint64 `json:"size"`
+	// List of GPT partition attributes in <attr>[ <attr>] format, numeric attributes
+	// are listed as GUID:<bit>[,<bit>]. Note that the even though the sfdisk(8) manpage
+	// says --part-attrs takes a space or comma separated list, the output from
+	// --json/--dump uses a different format.
+	Attrs string `json:"attrs"`
+	Type  string `json:"type"`
+	UUID  string `json:"uuid"`
+	Name  string `json:"name"`
+}
+
+// TODO: consider looking into merging LaidOutVolume/Structure OnDiskVolume/Structure
+
+// OnDiskStructure represents a gadget structure laid on a block device.
+type OnDiskStructure struct {
+	LaidOutStructure
+
+	// Node identifies the device node of the block device.
+	Node string
+
+	// Size of the on disk structure, which is at least equal to the
+	// LaidOutStructure.Size but may be bigger if the partition was
+	// expanded.
+	Size quantity.Size
+}
+
+// OnDiskVolume holds information about the disk device including its partitioning
+// schema, the partition table, and the structure layout it contains.
+type OnDiskVolume struct {
+	Structure []OnDiskStructure
+	ID        string
+	Device    string
+	Schema    string
+	// size in bytes
+	Size quantity.Size
+	// sector size in bytes
+	SectorSize     quantity.Size
+	partitionTable *sfdiskPartitionTable
+}
+
+// OnDiskVolumeFromDevice obtains the partitioning and filesystem information from
+// the block device.
+func OnDiskVolumeFromDevice(device string) (*OnDiskVolume, error) {
+	output, err := exec.Command("sfdisk", "--json", device).Output()
+	if err != nil {
+		return nil, osutil.OutputErr(output, err)
+	}
+
+	var dump sfdiskDeviceDump
+	if err := json.Unmarshal(output, &dump); err != nil {
+		return nil, fmt.Errorf("cannot parse sfdisk output: %v", err)
+	}
+
+	dl, err := onDiskVolumeFromPartitionTable(dump.PartitionTable)
+	if err != nil {
+		return nil, err
+	}
+	dl.Device = device
+
+	return dl, nil
+}
+
+func fromSfdiskPartitionType(st string, sfdiskLabel string) (string, error) {
+	switch sfdiskLabel {
+	case "dos":
+		// sometimes sfdisk reports what is "0C" in gadget.yaml as "c",
+		// normalize the values
+		v, err := strconv.ParseUint(st, 16, 8)
+		if err != nil {
+			return "", fmt.Errorf("cannot convert MBR partition type %q", st)
+		}
+		return fmt.Sprintf("%02X", v), nil
+	case "gpt":
+		return st, nil
+	default:
+		return "", fmt.Errorf("unsupported partitioning schema %q", sfdiskLabel)
+	}
+}
+
+func blockDeviceSizeInSectors(devpath string) (quantity.Size, error) {
+	// the size is reported in 512-byte sectors
+	// XXX: consider using /sys/block/<dev>/size directly
+	out, err := exec.Command("blockdev", "--getsz", devpath).CombinedOutput()
+	if err != nil {
+		return 0, osutil.OutputErr(out, err)
+	}
+	nospace := strings.TrimSpace(string(out))
+	sz, err := strconv.Atoi(nospace)
+	if err != nil {
+		return 0, fmt.Errorf("cannot parse device size %q: %v", nospace, err)
+	}
+	return quantity.Size(sz), nil
+}
+
+// onDiskVolumeFromPartitionTable takes an sfdisk dump partition table and returns
+// the partitioning information as an on-disk volume.
+func onDiskVolumeFromPartitionTable(ptable sfdiskPartitionTable) (*OnDiskVolume, error) {
+	if ptable.Unit != "sectors" {
+		return nil, fmt.Errorf("cannot position partitions: unknown unit %q", ptable.Unit)
+	}
+
+	structure := make([]VolumeStructure, len(ptable.Partitions))
+	ds := make([]OnDiskStructure, len(ptable.Partitions))
+
+	for i, p := range ptable.Partitions {
+		info, err := filesystemInfo(p.Node)
+		if err != nil {
+			return nil, fmt.Errorf("cannot obtain filesystem information: %v", err)
+		}
+		switch {
+		case len(info.BlockDevices) == 0:
+			continue
+		case len(info.BlockDevices) > 1:
+			return nil, fmt.Errorf("unexpected number of blockdevices for node %q: %v", p.Node, info.BlockDevices)
+		}
+		bd := info.BlockDevices[0]
+
+		vsType, err := fromSfdiskPartitionType(p.Type, ptable.Label)
+		if err != nil {
+			return nil, fmt.Errorf("cannot convert sfdisk partition type %q: %v", p.Type, err)
+		}
+
+		structure[i] = VolumeStructure{
+			Name:       p.Name,
+			Size:       quantity.Size(p.Size) * sectorSize,
+			Label:      bd.Label,
+			Type:       vsType,
+			Filesystem: bd.FSType,
+		}
+
+		ds[i] = OnDiskStructure{
+			LaidOutStructure: LaidOutStructure{
+				VolumeStructure: &structure[i],
+				StartOffset:     quantity.Size(p.Start) * sectorSize,
+				Index:           i + 1,
+			},
+			Node: p.Node,
+		}
+	}
+
+	var numSectors quantity.Size
+	if ptable.LastLBA != 0 {
+		// sfdisk reports the last usable LBA for GPT disks only
+		numSectors = quantity.Size(ptable.LastLBA + 1)
+	} else {
+		// sfdisk does not report any information about the size of a
+		// MBR partitioned disk, find out the size of the device by
+		// other means
+		sz, err := blockDeviceSizeInSectors(ptable.Device)
+		if err != nil {
+			return nil, fmt.Errorf("cannot obtain the size of device %q: %v", ptable.Device, err)
+		}
+		numSectors = sz
+	}
+
+	dl := &OnDiskVolume{
+		Structure:      ds,
+		ID:             ptable.ID,
+		Device:         ptable.Device,
+		Schema:         ptable.Label,
+		Size:           numSectors * sectorSize,
+		SectorSize:     sectorSize,
+		partitionTable: &ptable,
+	}
+
+	return dl, nil
+}
+
+func deviceName(name string, index int) string {
+	if len(name) > 0 {
+		last := name[len(name)-1]
+		if last >= '0' && last <= '9' {
+			return fmt.Sprintf("%sp%d", name, index)
+		}
+	}
+	return fmt.Sprintf("%s%d", name, index)
+}
+
+// BuildPartitionList builds a list of partitions based on the current
+// device contents and gadget structure list, in sfdisk dump format, and
+// returns a partitioning description suitable for sfdisk input and a
+// list of the partitions to be created.
+func BuildPartitionList(dl *OnDiskVolume, pv *LaidOutVolume) (sfdiskInput *bytes.Buffer, toBeCreated []OnDiskStructure) {
+	ptable := dl.partitionTable
+
+	// Keep track what partitions we already have on disk
+	seen := map[uint64]bool{}
+	for _, p := range ptable.Partitions {
+		seen[p.Start] = true
+	}
+
+	// Check if the last partition has a system-data role
+	canExpandData := false
+	if n := len(pv.LaidOutStructure); n > 0 {
+		last := pv.LaidOutStructure[n-1]
+		if last.VolumeStructure.Role == SystemData {
+			canExpandData = true
+		}
+	}
+
+	// The partition index
+	pIndex := 0
+
+	// Write new partition data in named-fields format
+	buf := &bytes.Buffer{}
+	for _, p := range pv.LaidOutStructure {
+		if !p.IsPartition() {
+			continue
+		}
+
+		pIndex++
+		s := p.VolumeStructure
+
+		// Skip partitions that are already in the volume
+		start := p.StartOffset / sectorSize
+		if seen[uint64(start)] {
+			continue
+		}
+
+		// Only allow the creation of partitions with known GUIDs
+		// TODO:UC20: also provide a mechanism for MBR (RPi)
+		ptype := partitionType(ptable.Label, p.Type)
+		if ptable.Label == "gpt" && !creationSupported(ptype) {
+			logger.Noticef("cannot create partition with unsupported type %s", ptype)
+			continue
+		}
+
+		// Check if the data partition should be expanded
+		size := s.Size
+		if s.Role == SystemData && canExpandData && p.StartOffset+s.Size < dl.Size {
+			size = dl.Size - p.StartOffset
+		}
+
+		// Can we use the index here? Get the largest existing partition number and
+		// build from there could be safer if the disk partitions are not consecutive
+		// (can this actually happen in our images?)
+		node := deviceName(ptable.Device, pIndex)
+		fmt.Fprintf(buf, "%s : start=%12d, size=%12d, type=%s, name=%q\n", node,
+			p.StartOffset/sectorSize, size/sectorSize, ptype, s.Name)
+
+		// Set expected labels based on role
+		switch s.Role {
+		case SystemBoot:
+			s.Label = ubuntuBootLabel
+		case SystemSeed:
+			s.Label = ubuntuSeedLabel
+		case SystemData:
+			s.Label = ubuntuDataLabel
+		case SystemSave:
+			s.Label = ubuntuSaveLabel
+		}
+
+		toBeCreated = append(toBeCreated, OnDiskStructure{
+			LaidOutStructure: p,
+			Node:             node,
+			Size:             size,
+		})
+	}
+
+	return buf, toBeCreated
+}
+
+// UpdatePartitionList re-reads the partitioning data from the device and
+// updates the partition list in the specified volume.
+func UpdatePartitionList(dl *OnDiskVolume) error {
+	layout, err := OnDiskVolumeFromDevice(dl.Device)
+	if err != nil {
+		return fmt.Errorf("cannot read disk layout: %v", err)
+	}
+	if dl.ID != layout.ID {
+		return fmt.Errorf("partition table IDs don't match")
+	}
+
+	dl.Structure = layout.Structure
+	dl.partitionTable = layout.partitionTable
+
+	return nil
+}
+
+func partitionType(label, ptype string) string {
+	t := strings.Split(ptype, ",")
+	if len(t) < 1 {
+		return ""
+	}
+	if len(t) == 1 {
+		return t[0]
+	}
+	if label == "gpt" {
+		return t[1]
+	}
+	return t[0]
+}
+
+// lsblkFilesystemInfo represents the lsblk --fs JSON output format.
+type lsblkFilesystemInfo struct {
+	BlockDevices []lsblkBlockDevice `json:"blockdevices"`
+}
+
+type lsblkBlockDevice struct {
+	Name       string `json:"name"`
+	FSType     string `json:"fstype"`
+	Label      string `json:"label"`
+	UUID       string `json:"uuid"`
+	Mountpoint string `json:"mountpoint"`
+}
+
+func filesystemInfo(node string) (*lsblkFilesystemInfo, error) {
+	output, err := exec.Command("lsblk", "--fs", "--json", node).CombinedOutput()
+	if err != nil {
+		return nil, osutil.OutputErr(output, err)
+	}
+
+	var info lsblkFilesystemInfo
+	if err := json.Unmarshal(output, &info); err != nil {
+		return nil, fmt.Errorf("cannot parse lsblk output: %v", err)
+	}
+
+	return &info, nil
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/ondisk_test.go snapd-2.48.3+20.04/gadget/ondisk_test.go
--- snapd-2.45.1+20.04.2/gadget/ondisk_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/ondisk_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,567 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package gadget_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type ondiskTestSuite struct {
+	testutil.BaseTest
+
+	dir string
+
+	gadgetRoot string
+}
+
+var _ = Suite(&ondiskTestSuite{})
+
+func (s *ondiskTestSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.dir = c.MkDir()
+
+	s.gadgetRoot = c.MkDir()
+	err := makeMockGadget(s.gadgetRoot, gadgetContent)
+	c.Assert(err, IsNil)
+}
+
+const mockSfdiskScriptBiosSeed = `
+>&2 echo "Some warning from sfdisk"
+echo '{
+  "partitiontable": {
+    "label": "gpt",
+    "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+    "device": "/dev/node",
+    "unit": "sectors",
+    "firstlba": 34,
+    "lastlba": 8388574,
+    "partitions": [
+      {
+        "node": "/dev/node1",
+        "start": 2048,
+        "size": 2048,
+        "type": "21686148-6449-6E6F-744E-656564454649",
+        "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F",
+        "name": "BIOS Boot"
+      },
+      {
+        "node": "/dev/node2",
+        "start": 4096,
+        "size": 2457600,
+        "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+        "uuid": "44C3D5C3-CAE1-4306-83E8-DF437ACDB32F",
+        "name": "Recovery"
+      }
+    ]
+  }
+}'`
+
+const mockLsblkScriptBiosSeed = `
+[ "$3" == "/dev/node1" ] && echo '{
+    "blockdevices": [ {"name": "node1", "fstype": null, "label": null, "uuid": null, "mountpoint": null} ]
+}'
+[ "$3" == "/dev/node2" ] && echo '{
+    "blockdevices": [ {"name": "node2", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "A644-B807", "mountpoint": null} ]
+}'
+exit 0`
+
+func makeMockGadget(gadgetRoot, gadgetContent string) error {
+	if err := os.MkdirAll(filepath.Join(gadgetRoot, "meta"), 0755); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "meta", "gadget.yaml"), []byte(gadgetContent), 0644); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "pc-boot.img"), []byte("pc-boot.img content"), 0644); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "pc-core.img"), []byte("pc-core.img content"), 0644); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(filepath.Join(gadgetRoot, "grubx64.efi"), []byte("grubx64.efi content"), 0644); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+const gadgetContent = `volumes:
+  pc:
+    bootloader: grub
+    structure:
+      - name: mbr
+        type: mbr
+        size: 440
+        content:
+          - image: pc-boot.img
+      - name: BIOS Boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        offset: 1M
+        offset-write: mbr+92
+        content:
+          - image: pc-core.img
+      - name: Recovery
+        role: system-seed
+        filesystem: vfat
+        # UEFI will boot the ESP partition by default first
+        type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+        size: 1200M
+        content:
+          - source: grubx64.efi
+            target: EFI/boot/grubx64.efi
+      - name: Save
+        role: system-save
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 128M
+      - name: Writable
+        role: system-data
+        filesystem: ext4
+        type: 83,0FC63DAF-8483-4772-8E79-3D69D8477DE4
+        size: 1200M
+`
+
+var mockOnDiskStructureSave = gadget.OnDiskStructure{
+	Node: "/dev/node3",
+	LaidOutStructure: gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Name:       "Save",
+			Size:       128 * quantity.SizeMiB,
+			Type:       "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
+			Role:       "system-save",
+			Label:      "ubuntu-save",
+			Filesystem: "ext4",
+		},
+		StartOffset: 1260388352,
+		Index:       3,
+	},
+	Size: 128 * quantity.SizeMiB,
+}
+
+var mockOnDiskStructureWritable = gadget.OnDiskStructure{
+	Node: "/dev/node4",
+	LaidOutStructure: gadget.LaidOutStructure{
+		VolumeStructure: &gadget.VolumeStructure{
+			Name:       "Writable",
+			Size:       1200 * quantity.SizeMiB,
+			Type:       "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
+			Role:       "system-data",
+			Label:      "ubuntu-data",
+			Filesystem: "ext4",
+		},
+		StartOffset: 1394606080,
+		Index:       4,
+	},
+	// expanded to fill the disk
+	Size: 2*quantity.SizeGiB + 717*quantity.SizeMiB + 1031680,
+}
+
+func (s *ondiskTestSuite) TestDeviceInfoGPT(c *C) {
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosSeed)
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosSeed)
+	defer cmdLsblk.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, IsNil)
+	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
+		{"sfdisk", "--json", "/dev/node"},
+	})
+	c.Assert(cmdLsblk.Calls(), DeepEquals, [][]string{
+		{"lsblk", "--fs", "--json", "/dev/node1"},
+		{"lsblk", "--fs", "--json", "/dev/node2"},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(dl.Schema, Equals, "gpt")
+	c.Assert(dl.ID, Equals, "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA")
+	c.Assert(dl.Device, Equals, "/dev/node")
+	c.Assert(dl.SectorSize, Equals, quantity.Size(512))
+	c.Assert(dl.Size, Equals, quantity.Size(8388575*512))
+	c.Assert(len(dl.Structure), Equals, 2)
+
+	c.Assert(dl.Structure, DeepEquals, []gadget.OnDiskStructure{
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Name:       "BIOS Boot",
+					Size:       0x100000,
+					Label:      "",
+					Type:       "21686148-6449-6E6F-744E-656564454649",
+					Filesystem: "",
+				},
+				StartOffset: 0x100000,
+				Index:       1,
+			},
+			Node: "/dev/node1",
+		},
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Name:       "Recovery",
+					Size:       0x4b000000,
+					Label:      "ubuntu-seed",
+					Type:       "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+					Filesystem: "vfat",
+				},
+				StartOffset: 0x200000,
+				Index:       2,
+			},
+			Node: "/dev/node2",
+		},
+	})
+}
+
+func (s *ondiskTestSuite) TestDeviceInfoMBR(c *C) {
+	const mockSfdiskWithMBR = `
+>&2 echo "Some warning from sfdisk"
+echo '{
+   "partitiontable": {
+      "label": "dos",
+      "device": "/dev/node",
+      "unit": "sectors",
+      "partitions": [
+         {"node": "/dev/node1", "start": 4096, "size": 2457600, "type": "c"},
+         {"node": "/dev/node2", "start": 2461696, "size": 1048576, "type": "d"},
+         {"node": "/dev/node3", "start": 3510272, "size": 1048576, "type": "d"},
+         {"node": "/dev/node4", "start": 4558848, "size": 1048576, "type": "d"}
+      ]
+   }
+}'`
+	const mockLsblkForMBR = `
+[ "$3" == "/dev/node1" ] && echo '{
+    "blockdevices": [ {"name": "node1", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "A644-B807", "mountpoint": null} ]
+}'
+[ "$3" == "/dev/node2" ] && echo '{
+    "blockdevices": [ {"name": "node2", "fstype": "vfat", "label": "ubuntu-boot", "uuid": "A644-B808", "mountpoint": null} ]
+}'
+[ "$3" == "/dev/node3" ] && echo '{
+    "blockdevices": [ {"name": "node3", "fstype": "ext4", "label": "ubuntu-save", "mountpoint": null} ]
+}'
+[ "$3" == "/dev/node4" ] && echo '{
+    "blockdevices": [ {"name": "node3", "fstype": "ext4", "label": "ubuntu-data", "mountpoint": null} ]
+}'
+exit 0`
+
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskWithMBR)
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkForMBR)
+	defer cmdLsblk.Restore()
+
+	cmdBlockdev := testutil.MockCommand(c, "blockdev", "echo 12345670")
+	defer cmdBlockdev.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, IsNil)
+	c.Assert(cmdSfdisk.Calls(), DeepEquals, [][]string{
+		{"sfdisk", "--json", "/dev/node"},
+	})
+	c.Assert(cmdLsblk.Calls(), DeepEquals, [][]string{
+		{"lsblk", "--fs", "--json", "/dev/node1"},
+		{"lsblk", "--fs", "--json", "/dev/node2"},
+		{"lsblk", "--fs", "--json", "/dev/node3"},
+		{"lsblk", "--fs", "--json", "/dev/node4"},
+	})
+	c.Assert(cmdBlockdev.Calls(), DeepEquals, [][]string{
+		{"blockdev", "--getsz", "/dev/node"},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(dl.ID, Equals, "")
+	c.Assert(dl.Schema, Equals, "dos")
+	c.Assert(dl.Device, Equals, "/dev/node")
+	c.Assert(dl.SectorSize, Equals, quantity.Size(512))
+	c.Assert(dl.Size, Equals, quantity.Size(12345670*512))
+	c.Assert(len(dl.Structure), Equals, 4)
+
+	c.Assert(dl.Structure, DeepEquals, []gadget.OnDiskStructure{
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Size:       0x4b000000,
+					Label:      "ubuntu-seed",
+					Type:       "0C",
+					Filesystem: "vfat",
+				},
+				StartOffset: 0x200000,
+				Index:       1,
+			},
+			Node: "/dev/node1",
+		},
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Size:       0x20000000,
+					Label:      "ubuntu-boot",
+					Type:       "0D",
+					Filesystem: "vfat",
+				},
+				StartOffset: 0x4b200000,
+				Index:       2,
+			},
+			Node: "/dev/node2",
+		},
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Size:       0x20000000,
+					Label:      "ubuntu-save",
+					Type:       "0D",
+					Filesystem: "ext4",
+				},
+				StartOffset: 0x6b200000,
+				Index:       3,
+			},
+			Node: "/dev/node3",
+		},
+		{
+			LaidOutStructure: gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Size:       0x20000000,
+					Label:      "ubuntu-data",
+					Type:       "0D",
+					Filesystem: "ext4",
+				},
+				StartOffset: 0x8b200000,
+				Index:       4,
+			},
+			Node: "/dev/node4",
+		},
+	})
+}
+
+func (s *ondiskTestSuite) TestDeviceInfoNotSectors(c *C) {
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `echo '{
+   "partitiontable": {
+      "label": "gpt",
+      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+      "device": "/dev/node",
+      "unit": "not_sectors",
+      "firstlba": 34,
+      "lastlba": 8388574,
+      "partitions": [
+         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"}
+      ]
+   }
+}'`)
+	defer cmdSfdisk.Restore()
+
+	_, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, ErrorMatches, "cannot position partitions: unknown unit .*")
+}
+
+func (s *ondiskTestSuite) TestDeviceInfoFilesystemInfoError(c *C) {
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", `echo '{
+   "partitiontable": {
+      "label": "gpt",
+      "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+      "device": "/dev/node",
+      "unit": "sectors",
+      "firstlba": 34,
+      "lastlba": 8388574,
+      "partitions": [
+         {"node": "/dev/node1", "start": 2048, "size": 2048, "type": "21686148-6449-6E6F-744E-656564454649", "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F", "name": "BIOS Boot"}
+      ]
+   }
+}'`)
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", "echo lsblk error; exit 1")
+	defer cmdLsblk.Restore()
+
+	_, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, ErrorMatches, "cannot obtain filesystem information: lsblk error")
+}
+
+func (s *ondiskTestSuite) TestDeviceInfoJsonError(c *C) {
+	cmd := testutil.MockCommand(c, "sfdisk", `echo 'This is not a json'`)
+	defer cmd.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, ErrorMatches, "cannot parse sfdisk output: invalid .*")
+	c.Assert(dl, IsNil)
+}
+
+func (s *ondiskTestSuite) TestDeviceInfoError(c *C) {
+	cmd := testutil.MockCommand(c, "sfdisk", "echo 'sfdisk: not found'; exit 127")
+	defer cmd.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, ErrorMatches, "sfdisk: not found")
+	c.Assert(dl, IsNil)
+}
+
+func (s *ondiskTestSuite) TestBuildPartitionList(c *C) {
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosSeed)
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosSeed)
+	defer cmdLsblk.Restore()
+
+	ptable := gadget.SFDiskPartitionTable{
+		Label:    "gpt",
+		ID:       "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+		Device:   "/dev/node",
+		Unit:     "sectors",
+		FirstLBA: 34,
+		LastLBA:  8388574,
+		Partitions: []gadget.SFDiskPartition{
+			{
+				Node:  "/dev/node1",
+				Start: 2048,
+				Size:  2048,
+				Type:  "21686148-6449-6E6F-744E-656564454649",
+				UUID:  "2E59D969-52AB-430B-88AC-F83873519F6F",
+				Name:  "BIOS Boot",
+			},
+			{
+				Node:  "/dev/node2",
+				Start: 4096,
+				Size:  2457600,
+				Type:  "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
+				UUID:  "216c34ff-9be6-4787-9ab3-a4c1429c3e73",
+				Name:  "Recovery",
+			},
+		},
+	}
+
+	pv, err := gadget.PositionedVolumeFromGadget(s.gadgetRoot)
+	c.Assert(err, IsNil)
+
+	dl, err := gadget.OnDiskVolumeFromPartitionTable(ptable)
+	c.Assert(err, IsNil)
+
+	// the expected expanded writable partition size is:
+	// start offset = (2M + 1200M), expanded size in sectors = (8388575*512 - start offset)/512
+	sfdiskInput, create := gadget.BuildPartitionList(dl, pv)
+	c.Assert(sfdiskInput.String(), Equals,
+		`/dev/node3 : start=     2461696, size=      262144, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, name="Save"
+/dev/node4 : start=     2723840, size=     5664735, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, name="Writable"
+`)
+	c.Assert(create, DeepEquals, []gadget.OnDiskStructure{mockOnDiskStructureSave, mockOnDiskStructureWritable})
+}
+
+func (s *ondiskTestSuite) TestUpdatePartitionList(c *C) {
+	const mockSfdiskScriptBios = `
+>&2 echo "Some warning from sfdisk"
+echo '{
+  "partitiontable": {
+    "label": "gpt",
+    "id": "9151F25B-CDF0-48F1-9EDE-68CBD616E2CA",
+    "device": "/dev/node",
+    "unit": "sectors",
+    "firstlba": 34,
+    "lastlba": 8388574,
+    "partitions": [
+      {
+        "node": "/dev/node1",
+        "start": 2048,
+        "size": 2048,
+        "type": "21686148-6449-6E6F-744E-656564454649",
+        "uuid": "2E59D969-52AB-430B-88AC-F83873519F6F",
+        "name": "BIOS Boot"
+      }
+    ]
+  }
+}'`
+
+	const mockLsblkScriptBios = `
+[ "$3" == "/dev/node1" ] && echo '{
+    "blockdevices": [ {"name": "node1", "fstype": null, "label": null, "uuid": null, "mountpoint": null} ]
+}'
+exit 0`
+
+	// start with a single partition
+	cmdSfdisk := testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBios)
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk := testutil.MockCommand(c, "lsblk", mockLsblkScriptBios)
+	defer cmdLsblk.Restore()
+
+	dl, err := gadget.OnDiskVolumeFromDevice("/dev/node")
+	c.Assert(err, IsNil)
+	c.Assert(len(dl.Structure), Equals, 1)
+	c.Assert(dl.Structure[0].Node, Equals, "/dev/node1")
+
+	// add a partition
+	cmdSfdisk = testutil.MockCommand(c, "sfdisk", mockSfdiskScriptBiosSeed)
+	defer cmdSfdisk.Restore()
+
+	cmdLsblk = testutil.MockCommand(c, "lsblk", mockLsblkScriptBiosSeed)
+	defer cmdLsblk.Restore()
+
+	// update the partition list
+	err = gadget.UpdatePartitionList(dl)
+	c.Assert(err, IsNil)
+
+	// check if the partition list was updated
+	c.Assert(len(dl.Structure), Equals, 2)
+	c.Assert(dl.Structure[0].Node, Equals, "/dev/node1")
+	c.Assert(dl.Structure[1].Node, Equals, "/dev/node2")
+}
+
+func (s *ondiskTestSuite) TestFilesystemInfo(c *C) {
+	cmd := testutil.MockCommand(c, "lsblk", `echo '{
+   "blockdevices": [
+      {"name": "loop8p2", "fstype": "vfat", "label": "ubuntu-seed", "uuid": "C1F4-CE43", "mountpoint": null}
+   ]
+}'`)
+	defer cmd.Restore()
+
+	info, err := gadget.FilesystemInfo("/dev/node")
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"lsblk", "--fs", "--json", "/dev/node"},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(len(info.BlockDevices), Equals, 1)
+	bd := info.BlockDevices[0]
+	c.Assert(bd.Name, Equals, "loop8p2")
+	c.Assert(bd.FSType, Equals, "vfat")
+	c.Assert(bd.Label, Equals, "ubuntu-seed")
+	c.Assert(bd.UUID, Equals, "C1F4-CE43")
+}
+
+func (s *ondiskTestSuite) TestFilesystemInfoJsonError(c *C) {
+	cmd := testutil.MockCommand(c, "lsblk", `echo 'This is not a json'`)
+	defer cmd.Restore()
+
+	info, err := gadget.FilesystemInfo("/dev/node")
+	c.Assert(err, ErrorMatches, "cannot parse lsblk output: invalid .*")
+	c.Assert(info, IsNil)
+}
+
+func (s *ondiskTestSuite) TestFilesystemInfoError(c *C) {
+	cmd := testutil.MockCommand(c, "lsblk", "echo 'lsblk: not found'; exit 127")
+	defer cmd.Restore()
+
+	info, err := gadget.FilesystemInfo("/dev/node")
+	c.Assert(err, ErrorMatches, "lsblk: not found")
+	c.Assert(info, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/partition.go snapd-2.48.3+20.04/gadget/partition.go
--- snapd-2.45.1+20.04.2/gadget/partition.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/partition.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,116 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget
-
-import (
-	"bytes"
-	"fmt"
-	"os/exec"
-	"strings"
-
-	"github.com/snapcore/snapd/logger"
-	"github.com/snapcore/snapd/osutil"
-)
-
-func splitType(maybeHybridType string) (mbrTypeID, gptTypeID string) {
-	switch {
-	case validTypeID.MatchString(maybeHybridType):
-		// only MBR type
-		return maybeHybridType, ""
-	case validGUUID.MatchString(maybeHybridType):
-		// only GPT type
-		return "", maybeHybridType
-	}
-	idx := strings.IndexRune(maybeHybridType, ',')
-	if idx == -1 {
-		return "", ""
-	}
-	// mbr,GUUID
-	return maybeHybridType[:idx], maybeHybridType[idx+1:]
-}
-
-func Partition(image string, pv *LaidOutVolume) error {
-	if image == "" {
-		return fmt.Errorf("internal error: image path is unset")
-	}
-	if pv.SectorSize != 512 {
-		// check for unsupported sector size
-		return fmt.Errorf("cannot use sector size %v", pv.SectorSize)
-	}
-
-	asSector := func(v Size) Size {
-		return v / pv.SectorSize
-	}
-
-	script := &bytes.Buffer{}
-	// only sector unit is supported
-	fmt.Fprintf(script, "unit: sectors\n")
-	switch pv.EffectiveSchema() {
-	case GPT:
-		fmt.Fprintf(script, "label: gpt\n")
-		fmt.Fprintf(script, "first-lba: 34\n")
-	case MBR:
-		fmt.Fprintf(script, "label: dos\n")
-	}
-	if pv.ID != "" {
-		fmt.Fprintf(script, "label-id: %v\n", pv.ID)
-	}
-	fmt.Fprintf(script, "\n")
-
-	for _, ps := range pv.LaidOutStructure {
-		if !ps.IsPartition() {
-			continue
-		}
-
-		start := asSector(ps.StartOffset)
-		size := asSector(ps.Size)
-		fmt.Fprintf(script, "start=%v, size=%v", start, size)
-
-		mbrType, gptType := splitType(ps.Type)
-		pType := mbrType
-		if pv.EffectiveSchema() == GPT {
-			pType = gptType
-		}
-		if pType != "" {
-			fmt.Fprintf(script, ", type=%v", pType)
-		}
-
-		if pv.EffectiveSchema() == GPT && ps.Name != "" {
-			fmt.Fprintf(script, ", name=%q", ps.Name)
-		}
-		if pv.EffectiveSchema() == MBR && ps.EffectiveRole() == SystemBoot {
-			fmt.Fprintf(script, ", bootable")
-		}
-
-		fmt.Fprintf(script, "\n")
-	}
-	return runSfdisk(image, script.String())
-}
-
-func runSfdisk(image string, script string) error {
-	cmd := exec.Command("sfdisk", image)
-	cmd.Stdin = bytes.NewBufferString(script)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		logger.Noticef("failed sfdisk script:\n%v", script)
-		return fmt.Errorf("cannot partition image using sfdisk: %v", osutil.OutputErr(out, err))
-	}
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/partition_test.go snapd-2.48.3+20.04/gadget/partition_test.go
--- snapd-2.45.1+20.04.2/gadget/partition_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/partition_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,273 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2019 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package gadget_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"path/filepath"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/gadget"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type partitionSuite struct {
-	sfdisk *testutil.MockCmd
-	dir    string
-}
-
-var _ = Suite(&partitionSuite{})
-
-func (s *partitionSuite) SetUpTest(c *C) {
-	s.dir = c.MkDir()
-	s.sfdisk = testutil.MockCommand(c, "sfdisk", fmt.Sprintf("cat > %s/input", s.dir))
-}
-
-func (s *partitionSuite) TearDownTest(c *C) {
-	if s.sfdisk != nil {
-		s.sfdisk.Restore()
-		s.sfdisk = nil
-	}
-}
-
-func (s *partitionSuite) input(c *C) string {
-	data, err := ioutil.ReadFile(filepath.Join(s.dir, "input"))
-	c.Assert(err, IsNil)
-	return string(data)
-}
-
-func (s *partitionSuite) TestGPTHappy(c *C) {
-	pv := &gadget.LaidOutVolume{
-		Volume: &gadget.Volume{
-			Schema: "gpt",
-			ID:     "123-123",
-		},
-		Size:       3 * gadget.SizeMiB,
-		SectorSize: 512,
-		LaidOutStructure: []gadget.LaidOutStructure{
-			{
-				// does not appear as partition
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 128 * gadget.SizeKiB,
-					Name: "not-visible",
-					Type: "bare",
-				},
-				StartOffset: 128 * gadget.SizeKiB,
-				Index:       0,
-			}, {
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 4 * gadget.SizeMiB,
-					Name: "foo",
-					Type: "21686148-6449-6E6F-744E-656564454649",
-					Role: "system-boot",
-				},
-				StartOffset: 1 * gadget.SizeMiB,
-				Index:       1,
-			}, {
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 12 * gadget.SizeMiB,
-					Name: "bar",
-					Type: "21686148-6449-6E6F-744E-656564454650",
-					Role: "system-data",
-				},
-				StartOffset: 5 * gadget.SizeMiB,
-				Index:       2,
-			},
-		},
-	}
-	err := gadget.Partition("foo", pv)
-	c.Assert(err, IsNil)
-	c.Assert(s.input(c), Equals, `unit: sectors
-label: gpt
-first-lba: 34
-label-id: 123-123
-
-start=2048, size=8192, type=21686148-6449-6E6F-744E-656564454649, name="foo"
-start=10240, size=24576, type=21686148-6449-6E6F-744E-656564454650, name="bar"
-`)
-	c.Assert(s.sfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "foo"},
-	})
-}
-
-func (s *partitionSuite) TestMBRHappy(c *C) {
-	pv := &gadget.LaidOutVolume{
-		Volume: &gadget.Volume{
-			Schema: "mbr",
-			ID:     "0x123",
-		},
-		Size:       3 * gadget.SizeMiB,
-		SectorSize: 512,
-		LaidOutStructure: []gadget.LaidOutStructure{
-			{
-				// does not appear as partition
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 446,
-					Name: "not-visible",
-					Type: "mbr",
-				},
-				StartOffset: 0,
-				Index:       0,
-			}, {
-				// does not appear as partition
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 128 * gadget.SizeKiB,
-					Name: "not-visible",
-					Type: "bare",
-				},
-				StartOffset: 128 * gadget.SizeKiB,
-				Index:       1,
-			}, {
-				VolumeStructure: &gadget.VolumeStructure{
-					Size:       128 * gadget.SizeMiB,
-					Name:       "foo",
-					Type:       "0C",
-					Role:       "system-boot",
-					Filesystem: "vfat",
-				},
-				StartOffset: 1 * gadget.SizeMiB,
-				Index:       2,
-			}, {
-				VolumeStructure: &gadget.VolumeStructure{
-					Size:       12 * gadget.SizeMiB,
-					Name:       "bar",
-					Role:       "system-data",
-					Filesystem: "ext4",
-					Label:      "writable",
-				},
-				StartOffset: 129 * gadget.SizeMiB,
-				Index:       3,
-			},
-		},
-	}
-	err := gadget.Partition("foo", pv)
-	c.Assert(err, IsNil)
-	c.Assert(s.input(c), Equals, `unit: sectors
-label: dos
-label-id: 0x123
-
-start=2048, size=262144, type=0C, bootable
-start=264192, size=24576
-`)
-	c.Assert(s.sfdisk.Calls(), DeepEquals, [][]string{
-		{"sfdisk", "foo"},
-	})
-}
-
-func (s *partitionSuite) TestHybridType(c *C) {
-	ps := gadget.LaidOutStructure{
-		VolumeStructure: &gadget.VolumeStructure{
-			Size: 2 * gadget.SizeMiB,
-			Type: "0C,21686148-6449-6E6F-744E-656564454649",
-		},
-		StartOffset: 1 * gadget.SizeMiB,
-	}
-	pvGPT := &gadget.LaidOutVolume{
-		Volume: &gadget.Volume{
-			Schema: "gpt",
-		},
-		Size:             3 * gadget.SizeMiB,
-		SectorSize:       512,
-		LaidOutStructure: []gadget.LaidOutStructure{ps},
-	}
-
-	err := gadget.Partition("foo", pvGPT)
-	c.Assert(err, IsNil)
-	c.Assert(s.input(c), Equals, `unit: sectors
-label: gpt
-first-lba: 34
-
-start=2048, size=4096, type=21686148-6449-6E6F-744E-656564454649
-`)
-
-	pvMBR := &gadget.LaidOutVolume{
-		Volume: &gadget.Volume{
-			Schema: "mbr",
-		},
-		Size:             3 * gadget.SizeMiB,
-		SectorSize:       512,
-		LaidOutStructure: []gadget.LaidOutStructure{ps},
-	}
-	err = gadget.Partition("foo", pvMBR)
-	c.Assert(err, IsNil)
-	c.Assert(s.input(c), Equals, `unit: sectors
-label: dos
-
-start=2048, size=4096, type=0C
-`)
-}
-
-func (s *partitionSuite) TestInputErrors(c *C) {
-	pv := &gadget.LaidOutVolume{
-		Volume: &gadget.Volume{
-			Schema: "gpt",
-		},
-		Size:       3 * gadget.SizeMiB,
-		SectorSize: 512,
-		LaidOutStructure: []gadget.LaidOutStructure{
-			{
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 2 * gadget.SizeMiB,
-					Type: "0C,21686148-6449-6E6F-744E-656564454649",
-				},
-				StartOffset: 1 * gadget.SizeMiB,
-			},
-		},
-	}
-
-	err := gadget.Partition("", pv)
-	c.Assert(err, ErrorMatches, "internal error: image path is unset")
-	c.Assert(s.sfdisk.Calls(), HasLen, 0)
-
-	// unsupported sector size
-	pv.SectorSize = 384
-
-	err = gadget.Partition("foo", pv)
-	c.Assert(err, ErrorMatches, "cannot use sector size 384")
-	c.Assert(s.sfdisk.Calls(), HasLen, 0)
-}
-
-func (s *partitionSuite) TestCommandError(c *C) {
-	pv := &gadget.LaidOutVolume{
-		Volume: &gadget.Volume{
-			Schema: "gpt",
-		},
-		Size:       3 * gadget.SizeMiB,
-		SectorSize: 512,
-		LaidOutStructure: []gadget.LaidOutStructure{
-			{
-				VolumeStructure: &gadget.VolumeStructure{
-					Size: 2 * gadget.SizeMiB,
-					Type: "0C,21686148-6449-6E6F-744E-656564454649",
-				},
-				StartOffset: 1 * gadget.SizeMiB,
-			},
-		},
-	}
-
-	sfdiskBad := testutil.MockCommand(c, "sfdisk", "echo 'failed'; false")
-	defer sfdiskBad.Restore()
-
-	err := gadget.Partition("foo", pv)
-	c.Assert(err, ErrorMatches, "cannot partition image using sfdisk: failed")
-	c.Assert(s.sfdisk.Calls(), HasLen, 0)
-}
diff -Nru snapd-2.45.1+20.04.2/gadget/quantity/size.go snapd-2.48.3+20.04/gadget/quantity/size.go
--- snapd-2.45.1+20.04.2/gadget/quantity/size.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/quantity/size.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,109 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package quantity
+
+import (
+	"errors"
+	"fmt"
+	"math"
+
+	"github.com/snapcore/snapd/strutil"
+)
+
+// Size describes the size in bytes.
+type Size uint64
+
+const (
+	// SizeKiB is the byte size of one kibibyte (2^10 = 1024 bytes)
+	SizeKiB = Size(1 << 10)
+	// SizeMiB is the size of one mebibyte (2^20)
+	SizeMiB = Size(1 << 20)
+	// SizeGiB is the size of one gibibyte (2^30)
+	SizeGiB = Size(1 << 30)
+)
+
+func (s *Size) String() string {
+	if s == nil {
+		return "unspecified"
+	}
+	return fmt.Sprintf("%d", *s)
+}
+
+// IECString formats the size using multiples from IEC units (i.e. kibibytes,
+// mebibytes), that is as multiples of 1024. Printed values are truncated to 2
+// decimal points.
+func (s *Size) IECString() string {
+	maxFloat := float64(1023.5)
+	r := float64(*s)
+	unit := "B"
+	for _, rangeUnit := range []string{"KiB", "MiB", "GiB", "TiB", "PiB"} {
+		if r < maxFloat {
+			break
+		}
+		r /= 1024
+		unit = rangeUnit
+	}
+	precision := 0
+	if math.Floor(r) != r {
+		precision = 2
+	}
+	return fmt.Sprintf("%.*f %s", precision, r, unit)
+}
+
+func (s *Size) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var gs string
+	if err := unmarshal(&gs); err != nil {
+		return errors.New(`cannot unmarshal gadget size`)
+	}
+
+	var err error
+	*s, err = ParseSize(gs)
+	if err != nil {
+		return fmt.Errorf("cannot parse size %q: %v", gs, err)
+	}
+	return err
+}
+
+// ParseSize parses a string expressing size in a gadget specific format. The
+// accepted format is one of: <bytes> | <bytes/2^20>M | <bytes/2^30>G.
+func ParseSize(gs string) (Size, error) {
+	number, unit, err := strutil.SplitUnit(gs)
+	if err != nil {
+		return 0, err
+	}
+	if number < 0 {
+		return 0, errors.New("size cannot be negative")
+	}
+	var size Size
+	switch unit {
+	case "M":
+		// MiB
+		size = Size(number) * SizeMiB
+	case "G":
+		// GiB
+		size = Size(number) * SizeGiB
+	case "":
+		// straight bytes
+		size = Size(number)
+	default:
+		return 0, fmt.Errorf("invalid suffix %q", unit)
+	}
+	return size, nil
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/quantity/size_test.go snapd-2.48.3+20.04/gadget/quantity/size_test.go
--- snapd-2.45.1+20.04.2/gadget/quantity/size_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/quantity/size_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,87 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package quantity_test
+
+import (
+	"fmt"
+	"testing"
+
+	. "gopkg.in/check.v1"
+	"gopkg.in/yaml.v2"
+
+	"github.com/snapcore/snapd/gadget/quantity"
+)
+
+func TestRun(t *testing.T) { TestingT(t) }
+
+type sizeTestSuite struct{}
+
+var _ = Suite(&sizeTestSuite{})
+
+func (s *sizeTestSuite) TestIECString(c *C) {
+	for _, tc := range []struct {
+		size quantity.Size
+		exp  string
+	}{
+		{512, "512 B"},
+		{1000, "1000 B"},
+		{1030, "1.01 KiB"},
+		{quantity.SizeKiB + 512, "1.50 KiB"},
+		{123 * quantity.SizeKiB, "123 KiB"},
+		{512 * quantity.SizeKiB, "512 KiB"},
+		{578 * quantity.SizeMiB, "578 MiB"},
+		{1*quantity.SizeGiB + 123*quantity.SizeMiB, "1.12 GiB"},
+		{1024 * quantity.SizeGiB, "1 TiB"},
+		{2 * 1024 * 1024 * 1024 * quantity.SizeGiB, "2048 PiB"},
+	} {
+		c.Check(tc.size.IECString(), Equals, tc.exp)
+	}
+}
+
+func (s *sizeTestSuite) TestUnmarshalYAMLSize(c *C) {
+	type foo struct {
+		Size quantity.Size `yaml:"size"`
+	}
+
+	for i, tc := range []struct {
+		s   string
+		sz  quantity.Size
+		err string
+	}{
+		{"1234", 1234, ""},
+		{"1234M", 1234 * quantity.SizeMiB, ""},
+		{"1234G", 1234 * quantity.SizeGiB, ""},
+		{"0", 0, ""},
+		{"a0M", 0, `cannot parse size "a0M": no numerical prefix.*`},
+		{"-123", 0, `cannot parse size "-123": size cannot be negative`},
+		{"123a", 0, `cannot parse size "123a": invalid suffix "a"`},
+	} {
+		c.Logf("tc: %v", i)
+
+		var f foo
+		err := yaml.Unmarshal([]byte(fmt.Sprintf("size: %s", tc.s)), &f)
+		if tc.err != "" {
+			c.Check(err, ErrorMatches, tc.err)
+		} else {
+			c.Check(err, IsNil)
+			c.Check(f.Size, Equals, tc.sz)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/gadget/raw.go snapd-2.48.3+20.04/gadget/raw.go
--- snapd-2.45.1+20.04.2/gadget/raw.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/raw.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,9 +28,12 @@
 	"os"
 	"path/filepath"
 
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/osutil"
 )
 
+// TODO: RawStructureWriter should not be exported
+
 // RawStructureWriter implements support for writing raw (bare) structures.
 type RawStructureWriter struct {
 	contentDir string
@@ -95,20 +98,20 @@
 	return nil
 }
 
-// RawStructureUpdater implements support for updating raw (bare) structures.
-type RawStructureUpdater struct {
+// rawStructureUpdater implements support for updating raw (bare) structures.
+type rawStructureUpdater struct {
 	*RawStructureWriter
 	backupDir    string
 	deviceLookup deviceLookupFunc
 }
 
-type deviceLookupFunc func(ps *LaidOutStructure) (device string, offs Size, err error)
+type deviceLookupFunc func(ps *LaidOutStructure) (device string, offs quantity.Size, err error)
 
-// NewRawStructureUpdater returns an updater for the given raw (bare) structure.
+// newRawStructureUpdater returns an updater for the given raw (bare) structure.
 // Update data will be loaded from the provided gadget content directory.
 // Backups of replaced structures are temporarily kept in the rollback
 // directory.
-func NewRawStructureUpdater(contentDir string, ps *LaidOutStructure, backupDir string, deviceLookup deviceLookupFunc) (*RawStructureUpdater, error) {
+func newRawStructureUpdater(contentDir string, ps *LaidOutStructure, backupDir string, deviceLookup deviceLookupFunc) (*rawStructureUpdater, error) {
 	if deviceLookup == nil {
 		return nil, fmt.Errorf("internal error: device lookup helper must be provided")
 	}
@@ -120,7 +123,7 @@
 	if err != nil {
 		return nil, err
 	}
-	ru := &RawStructureUpdater{
+	ru := &rawStructureUpdater{
 		RawStructureWriter: rw,
 		backupDir:          backupDir,
 		deviceLookup:       deviceLookup,
@@ -132,7 +135,7 @@
 	return filepath.Join(backupDir, fmt.Sprintf("struct-%v-%v", ps.Index, pc.Index))
 }
 
-func (r *RawStructureUpdater) backupOrCheckpointContent(disk io.ReadSeeker, pc *LaidOutContent) error {
+func (r *rawStructureUpdater) backupOrCheckpointContent(disk io.ReadSeeker, pc *LaidOutContent) error {
 	backupPath := rawContentBackupPath(r.backupDir, r.ps, pc)
 	backupName := backupPath + ".backup"
 	sameName := backupPath + ".same"
@@ -192,7 +195,7 @@
 
 // matchDevice identifies the device matching the configured structure, returns
 // device path and a shifted structure should any offset adjustments be needed
-func (r *RawStructureUpdater) matchDevice() (device string, shifted *LaidOutStructure, err error) {
+func (r *rawStructureUpdater) matchDevice() (device string, shifted *LaidOutStructure, err error) {
 	device, offs, err := r.deviceLookup(r.ps)
 	if err != nil {
 		return "", nil, fmt.Errorf("cannot find device matching structure %v: %v", r.ps, err)
@@ -209,11 +212,11 @@
 
 // Backup attempts to analyze and prepare a backup copy of data that will be
 // replaced during subsequent update. Backups are kept in the backup directory
-// passed to NewRawStructureUpdater(). Each region replaced by new content is
+// passed to newRawStructureUpdater(). Each region replaced by new content is
 // copied out to a separate file. Only differing regions are backed up. Analysis
 // and backup of each region is checkpointed. Regions that have been backed up
 // or determined to be identical will not be analyzed on subsequent calls.
-func (r *RawStructureUpdater) Backup() error {
+func (r *rawStructureUpdater) Backup() error {
 	device, structForDevice, err := r.matchDevice()
 	if err != nil {
 		return err
@@ -234,7 +237,7 @@
 	return nil
 }
 
-func (r *RawStructureUpdater) rollbackDifferent(out io.WriteSeeker, pc *LaidOutContent) error {
+func (r *rawStructureUpdater) rollbackDifferent(out io.WriteSeeker, pc *LaidOutContent) error {
 	backupPath := rawContentBackupPath(r.backupDir, r.ps, pc)
 
 	if osutil.FileExists(backupPath + ".same") {
@@ -255,7 +258,7 @@
 }
 
 // Rollback attempts to restore original content from the backup copies prepared during Backup().
-func (r *RawStructureUpdater) Rollback() error {
+func (r *rawStructureUpdater) Rollback() error {
 	device, structForDevice, err := r.matchDevice()
 	if err != nil {
 		return err
@@ -276,7 +279,7 @@
 	return nil
 }
 
-func (r *RawStructureUpdater) updateDifferent(disk io.WriteSeeker, pc *LaidOutContent) error {
+func (r *rawStructureUpdater) updateDifferent(disk io.WriteSeeker, pc *LaidOutContent) error {
 	backupPath := rawContentBackupPath(r.backupDir, r.ps, pc)
 
 	if osutil.FileExists(backupPath + ".same") {
@@ -299,7 +302,7 @@
 
 // Update attempts to update the structure. The structure must have been
 // analyzed and backed up by a prior Backup() call.
-func (r *RawStructureUpdater) Update() error {
+func (r *rawStructureUpdater) Update() error {
 	device, structForDevice, err := r.matchDevice()
 	if err != nil {
 		return err
diff -Nru snapd-2.45.1+20.04.2/gadget/raw_test.go snapd-2.48.3+20.04/gadget/raw_test.go
--- snapd-2.45.1+20.04.2/gadget/raw_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/raw_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,6 +28,7 @@
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/testutil"
 )
@@ -44,7 +45,7 @@
 	r.backup = c.MkDir()
 }
 
-func openSizedFile(c *C, path string, size gadget.Size) *os.File {
+func openSizedFile(c *C, path string, size quantity.Size) *os.File {
 	f, err := os.Create(path)
 	c.Assert(err, IsNil)
 
@@ -61,7 +62,7 @@
 	off  int64
 }
 
-func mutateFile(c *C, path string, size gadget.Size, writes []mutateWrite) {
+func mutateFile(c *C, path string, size quantity.Size, writes []mutateWrite) {
 	out := openSizedFile(c, path, size)
 	for _, op := range writes {
 		_, err := out.WriteAt(op.what, op.off)
@@ -278,7 +279,7 @@
 		},
 	}
 
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Fatalf("unexpected call")
 		return "", 0, nil
 	})
@@ -300,25 +301,25 @@
 		VolumeStructure: &gadget.VolumeStructure{
 			Size: 2048,
 		},
-		StartOffset: 1 * gadget.SizeMiB,
+		StartOffset: 1 * quantity.SizeMiB,
 		LaidOutContent: []gadget.LaidOutContent{
 			{
 				VolumeContent: &gadget.VolumeContent{
 					Image: "foo.img",
 				},
-				StartOffset: 1 * gadget.SizeMiB,
+				StartOffset: 1 * quantity.SizeMiB,
 				Size:        128,
 			}, {
 				VolumeContent: &gadget.VolumeContent{
 					Image: "bar.img",
 				},
-				StartOffset: 1*gadget.SizeMiB + 1024,
+				StartOffset: 1*quantity.SizeMiB + 1024,
 				Size:        128,
 				Index:       1,
 			},
 		},
 	}
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		// Structure has a partition, thus it starts at 0 offset.
 		return partitionPath, 0, nil
@@ -337,7 +338,7 @@
 	c.Assert(err, IsNil)
 	// update should be a noop now, use the same locations, point to a file
 	// of 0 size, so that seek fails and write would increase the size
-	ru, err = gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err = gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		return emptyDiskPath, 0, nil
 	})
 	c.Assert(err, IsNil)
@@ -380,32 +381,32 @@
 		VolumeStructure: &gadget.VolumeStructure{
 			Size: 4096,
 		},
-		StartOffset: 1 * gadget.SizeMiB,
+		StartOffset: 1 * quantity.SizeMiB,
 		LaidOutContent: []gadget.LaidOutContent{
 			{
 				VolumeContent: &gadget.VolumeContent{
 					Image: "foo.img",
 				},
-				StartOffset: 1 * gadget.SizeMiB,
+				StartOffset: 1 * quantity.SizeMiB,
 				Size:        128,
 			}, {
 				VolumeContent: &gadget.VolumeContent{
 					Image: "bar.img",
 				},
-				StartOffset: 1*gadget.SizeMiB + 1024,
+				StartOffset: 1*quantity.SizeMiB + 1024,
 				Size:        256,
 				Index:       1,
 			}, {
 				VolumeContent: &gadget.VolumeContent{
 					Image: "unchanged.img",
 				},
-				StartOffset: 1*gadget.SizeMiB + 2048,
+				StartOffset: 1*quantity.SizeMiB + 2048,
 				Size:        128,
 				Index:       2,
 			},
 		},
 	}
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		// Structure has a partition, thus it starts at 0 offset.
 		return diskPath, 0, nil
@@ -453,9 +454,9 @@
 func (r *rawTestSuite) TestRawUpdaterBackupUpdateRestoreNoPartition(c *C) {
 	diskPath := filepath.Join(r.dir, "disk.img")
 
-	mutateFile(c, diskPath, gadget.SizeMiB+2048, []mutateWrite{
-		{[]byte("baz baz baz"), int64(gadget.SizeMiB)},
-		{[]byte("oof oof oof"), int64(gadget.SizeMiB + 1024)},
+	mutateFile(c, diskPath, quantity.SizeMiB+2048, []mutateWrite{
+		{[]byte("baz baz baz"), int64(quantity.SizeMiB)},
+		{[]byte("oof oof oof"), int64(quantity.SizeMiB + 1024)},
 	})
 
 	pristinePath := filepath.Join(r.dir, "pristine.img")
@@ -463,9 +464,9 @@
 	c.Assert(err, IsNil)
 
 	expectedPath := filepath.Join(r.dir, "expected.img")
-	mutateFile(c, expectedPath, gadget.SizeMiB+2048, []mutateWrite{
-		{[]byte("zzz zzz zzz zzz"), int64(gadget.SizeMiB)},
-		{[]byte("xxx xxx xxx xxx"), int64(gadget.SizeMiB + 1024)},
+	mutateFile(c, expectedPath, quantity.SizeMiB+2048, []mutateWrite{
+		{[]byte("zzz zzz zzz zzz"), int64(quantity.SizeMiB)},
+		{[]byte("xxx xxx xxx xxx"), int64(quantity.SizeMiB + 1024)},
 	})
 
 	makeSizedFile(c, filepath.Join(r.dir, "foo.img"), 128, []byte("zzz zzz zzz zzz"))
@@ -476,25 +477,25 @@
 			Type: "bare",
 			Size: 2048,
 		},
-		StartOffset: 1 * gadget.SizeMiB,
+		StartOffset: 1 * quantity.SizeMiB,
 		LaidOutContent: []gadget.LaidOutContent{
 			{
 				VolumeContent: &gadget.VolumeContent{
 					Image: "foo.img",
 				},
-				StartOffset: 1 * gadget.SizeMiB,
+				StartOffset: 1 * quantity.SizeMiB,
 				Size:        128,
 			}, {
 				VolumeContent: &gadget.VolumeContent{
 					Image: "bar.img",
 				},
-				StartOffset: 1*gadget.SizeMiB + 1024,
+				StartOffset: 1*quantity.SizeMiB + 1024,
 				Size:        256,
 				Index:       1,
 			},
 		},
 	}
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		// No partition table, returned path corresponds to a disk, start offset is non-0.
 		return diskPath, ps.StartOffset, nil
@@ -548,7 +549,7 @@
 		},
 	}
 
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		return diskPath, 0, nil
 	})
@@ -597,7 +598,7 @@
 		},
 	}
 
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		return diskPath, 0, nil
 	})
@@ -643,7 +644,7 @@
 	c.Assert(err, ErrorMatches, "internal error: device lookup helper must be provided")
 	c.Assert(ru, IsNil)
 
-	ru, err = gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err = gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		return "", 0, errors.New("failed")
 	})
@@ -661,6 +662,10 @@
 }
 
 func (r *rawTestSuite) TestRawUpdaterRollbackErrors(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	diskPath := filepath.Join(r.dir, "disk.img")
 	// 0 sized disk, copying will fail with early EOF
 	makeSizedFile(c, diskPath, 0, nil)
@@ -681,7 +686,7 @@
 		},
 	}
 
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		return diskPath, 0, nil
 	})
@@ -707,6 +712,10 @@
 }
 
 func (r *rawTestSuite) TestRawUpdaterUpdateErrors(c *C) {
+	if os.Geteuid() == 0 {
+		c.Skip("the test cannot be run by the root user")
+	}
+
 	diskPath := filepath.Join(r.dir, "disk.img")
 	// 0 sized disk, copying will fail with early EOF
 	makeSizedFile(c, diskPath, 2048, nil)
@@ -727,7 +736,7 @@
 		},
 	}
 
-	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	ru, err := gadget.NewRawStructureUpdater(r.dir, ps, r.backup, func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		c.Check(to, DeepEquals, ps)
 		return diskPath, 0, nil
 	})
@@ -784,7 +793,7 @@
 		},
 	}
 
-	f := func(to *gadget.LaidOutStructure) (string, gadget.Size, error) {
+	f := func(to *gadget.LaidOutStructure) (string, quantity.Size, error) {
 		return "", 0, errors.New("unexpected call")
 	}
 	rw, err := gadget.NewRawStructureUpdater("", ps, r.backup, f)
diff -Nru snapd-2.45.1+20.04.2/gadget/update.go snapd-2.48.3+20.04/gadget/update.go
--- snapd-2.45.1+20.04.2/gadget/update.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/update.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,7 @@
 	"errors"
 	"fmt"
 
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/logger"
 )
 
@@ -33,7 +34,7 @@
 var (
 	// default positioning constraints that match ubuntu-image
 	defaultConstraints = LayoutConstraints{
-		NonMBRStartOffset: 1 * SizeMiB,
+		NonMBRStartOffset: 1 * quantity.SizeMiB,
 		SectorSize:        512,
 	}
 )
@@ -50,6 +51,63 @@
 // and returns true when the pair should be part of an update.
 type UpdatePolicyFunc func(from, to *LaidOutStructure) bool
 
+// ContentChange carries paths to files containing the content data being
+// modified by the operation.
+type ContentChange struct {
+	// Before is a path to a file containing the original data before the
+	// operation takes place (or took place in case of ContentRollback).
+	Before string
+	// After is a path to a file location of the data applied by the operation.
+	After string
+}
+
+type ContentOperation int
+type ContentChangeAction int
+
+const (
+	ContentWrite ContentOperation = iota
+	ContentUpdate
+	ContentRollback
+
+	ChangeAbort ContentChangeAction = iota
+	ChangeApply
+	ChangeIgnore
+)
+
+// ContentObserver allows for observing operations on the content of the gadget
+// structures.
+type ContentObserver interface {
+	// Observe is called to observe an pending or completed action, related
+	// to content being written, updated or being rolled back. In each of
+	// the scenarios, the target path is relative under the root.
+	//
+	// For a file write or update, the source path points to the content
+	// that will be written. When called during rollback, observe call
+	// happens after the original file has been restored (or removed if the
+	// file was added during the update), the source path is empty.
+	//
+	// Returning ChangeApply indicates that the observer agrees for a given
+	// change to be applied. When called with a ContentUpdate or
+	// ContentWrite operation, returning ChangeIgnore indicates that the
+	// change shall be ignored. ChangeAbort is expected to be returned along
+	// with a non-nil error.
+	Observe(op ContentOperation, sourceStruct *LaidOutStructure,
+		targetRootDir, relativeTargetPath string, dataChange *ContentChange) (ContentChangeAction, error)
+}
+
+// ContentUpdateObserver allows for observing update (and potentially a
+// rollback) of the gadget structure content.
+type ContentUpdateObserver interface {
+	ContentObserver
+	// BeforeWrite is called when the backups of content that will get
+	// modified during the update are complete and update is ready to be
+	// applied.
+	BeforeWrite() error
+	// Canceled is called when the update has been canceled, or if changes
+	// were written and the update has been reverted.
+	Canceled() error
+}
+
 // Update applies the gadget update given the gadget information and data from
 // old and new revisions. It errors out when the update is not possible or
 // illegal, or a failure occurs at any of the steps. When there is no update, a
@@ -63,7 +121,7 @@
 // Data that would be modified during the update is first backed up inside the
 // rollback directory. Should the apply step fail, the modified data is
 // recovered.
-func Update(old, new GadgetData, rollbackDirPath string, updatePolicy UpdatePolicyFunc) error {
+func Update(old, new GadgetData, rollbackDirPath string, updatePolicy UpdatePolicyFunc, observer ContentUpdateObserver) error {
 	// TODO: support multi-volume gadgets. But for now we simply
 	//       do not do any gadget updates on those. We cannot error
 	//       here because this would break refreshes of gadgets even
@@ -115,7 +173,7 @@
 		}
 	}
 
-	return applyUpdates(new, updates, rollbackDirPath)
+	return applyUpdates(new, updates, rollbackDirPath, observer)
 }
 
 func resolveVolume(old *Info, new *Info) (oldVol, newVol *Volume, err error) {
@@ -139,7 +197,7 @@
 	return &oldV, &newV, nil
 }
 
-func isSameOffset(one *Size, two *Size) bool {
+func isSameOffset(one *quantity.Size, two *quantity.Size) bool {
 	if one == nil && two == nil {
 		return true
 	}
@@ -162,11 +220,11 @@
 func isLegacyMBRTransition(from *LaidOutStructure, to *LaidOutStructure) bool {
 	// legacy MBR could have been specified by setting type: mbr, with no
 	// role
-	return from.Type == MBR && to.EffectiveRole() == MBR
+	return from.Type == schemaMBR && to.EffectiveRole() == schemaMBR
 }
 
 func canUpdateStructure(from *LaidOutStructure, to *LaidOutStructure, schema string) error {
-	if schema == GPT && from.Name != to.Name {
+	if schema == schemaGPT && from.Name != to.Name {
 		// partition names are only effective when GPT is used
 		return fmt.Errorf("cannot change structure name from %q to %q", from.Name, to.Name)
 	}
@@ -240,7 +298,7 @@
 // RemodelUpdatePolicy implements the update policy of a remodel scenario. The
 // policy selects all non-MBR structures for the update.
 func RemodelUpdatePolicy(from, _ *LaidOutStructure) bool {
-	if from.EffectiveRole() == MBR {
+	if from.EffectiveRole() == schemaMBR {
 		return false
 	}
 	return true
@@ -278,20 +336,35 @@
 	Rollback() error
 }
 
-func applyUpdates(new GadgetData, updates []updatePair, rollbackDir string) error {
+func applyUpdates(new GadgetData, updates []updatePair, rollbackDir string, observer ContentUpdateObserver) error {
 	updaters := make([]Updater, len(updates))
 
 	for i, one := range updates {
-		up, err := updaterForStructure(one.to, new.RootDir, rollbackDir)
+		up, err := updaterForStructure(one.to, new.RootDir, rollbackDir, observer)
 		if err != nil {
 			return fmt.Errorf("cannot prepare update for volume structure %v: %v", one.to, err)
 		}
 		updaters[i] = up
 	}
 
+	var backupErr error
 	for i, one := range updaters {
 		if err := one.Backup(); err != nil {
-			return fmt.Errorf("cannot backup volume structure %v: %v", updates[i].to, err)
+			backupErr = fmt.Errorf("cannot backup volume structure %v: %v", updates[i].to, err)
+			break
+		}
+	}
+	if backupErr != nil {
+		if observer != nil {
+			if err := observer.Canceled(); err != nil {
+				logger.Noticef("cannot observe canceled prepare update: %v", err)
+			}
+		}
+		return backupErr
+	}
+	if observer != nil {
+		if err := observer.BeforeWrite(); err != nil {
+			return fmt.Errorf("cannot observe prepared update: %v", err)
 		}
 	}
 
@@ -329,24 +402,30 @@
 		}
 	}
 
+	if observer != nil {
+		if err := observer.Canceled(); err != nil {
+			logger.Noticef("cannot observe canceled update: %v", err)
+		}
+	}
+
 	return updateErr
 }
 
 var updaterForStructure = updaterForStructureImpl
 
-func updaterForStructureImpl(ps *LaidOutStructure, newRootDir, rollbackDir string) (Updater, error) {
+func updaterForStructureImpl(ps *LaidOutStructure, newRootDir, rollbackDir string, observer ContentUpdateObserver) (Updater, error) {
 	var updater Updater
 	var err error
 	if !ps.HasFilesystem() {
-		updater, err = NewRawStructureUpdater(newRootDir, ps, rollbackDir, FindDeviceForStructureWithFallback)
+		updater, err = newRawStructureUpdater(newRootDir, ps, rollbackDir, findDeviceForStructureWithFallback)
 	} else {
-		updater, err = NewMountedFilesystemUpdater(newRootDir, ps, rollbackDir, FindMountPointForStructure)
+		updater, err = newMountedFilesystemUpdater(newRootDir, ps, rollbackDir, findMountPointForStructure, observer)
 	}
 	return updater, err
 }
 
 // MockUpdaterForStructure replace internal call with a mocked one, for use in tests only
-func MockUpdaterForStructure(mock func(ps *LaidOutStructure, rootDir, rollbackDir string) (Updater, error)) (restore func()) {
+func MockUpdaterForStructure(mock func(ps *LaidOutStructure, rootDir, rollbackDir string, observer ContentUpdateObserver) (Updater, error)) (restore func()) {
 	old := updaterForStructure
 	updaterForStructure = mock
 	return func() {
diff -Nru snapd-2.45.1+20.04.2/gadget/update_test.go snapd-2.48.3+20.04/gadget/update_test.go
--- snapd-2.45.1+20.04.2/gadget/update_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/update_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,13 +21,19 @@
 
 import (
 	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strings"
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -99,7 +105,7 @@
 		c.Logf("tc: %v", idx)
 		schema := tc.schema
 		if schema == "" {
-			schema = gadget.GPT
+			schema = "gpt"
 		}
 		err := gadget.CanUpdateStructure(&tc.from, &tc.to, schema)
 		if tc.err == "" {
@@ -116,19 +122,19 @@
 		{
 			// size change
 			from: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB},
 			},
 			to: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1*gadget.SizeMiB + 1*gadget.SizeKiB},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1*quantity.SizeMiB + 1*quantity.SizeKiB},
 			},
 			err: "cannot change structure size from [0-9]+ to [0-9]+",
 		}, {
 			// size change
 			from: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB},
 			},
 			to: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB},
 			},
 			err: "",
 		},
@@ -242,22 +248,22 @@
 		{
 			// explicitly declared start offset change
 			from: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB, Offset: asSizePtr(1024)},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB, Offset: asSizePtr(1024)},
 				StartOffset:     1024,
 			},
 			to: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB, Offset: asSizePtr(2048)},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB, Offset: asSizePtr(2048)},
 				StartOffset:     2048,
 			},
 			err: "cannot change structure offset from [0-9]+ to [0-9]+",
 		}, {
 			// explicitly declared start offset in new structure
 			from: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB, Offset: nil},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB, Offset: nil},
 				StartOffset:     1024,
 			},
 			to: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB, Offset: asSizePtr(2048)},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB, Offset: asSizePtr(2048)},
 				StartOffset:     2048,
 			},
 			err: "cannot change structure offset from unspecified to [0-9]+",
@@ -265,23 +271,23 @@
 			// explicitly declared start offset in old structure,
 			// missing from new
 			from: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB, Offset: asSizePtr(1024)},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB, Offset: asSizePtr(1024)},
 				StartOffset:     1024,
 			},
 			to: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB, Offset: nil},
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB, Offset: nil},
 				StartOffset:     2048,
 			},
 			err: "cannot change structure offset from [0-9]+ to unspecified",
 		}, {
 			// start offset changed due to layout
 			from: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB},
-				StartOffset:     1 * gadget.SizeMiB,
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB},
+				StartOffset:     1 * quantity.SizeMiB,
 			},
 			to: gadget.LaidOutStructure{
-				VolumeStructure: &gadget.VolumeStructure{Size: 1 * gadget.SizeMiB},
-				StartOffset:     2 * gadget.SizeMiB,
+				VolumeStructure: &gadget.VolumeStructure{Size: 1 * quantity.SizeMiB},
+				StartOffset:     2 * quantity.SizeMiB,
 			},
 			err: "cannot change structure start offset from [0-9]+ to [0-9]+",
 		},
@@ -508,7 +514,7 @@
 				VolumeStructure: &gadget.VolumeStructure{Name: "mbr-ok", Type: "0C"},
 			},
 			err:    ``,
-			schema: gadget.MBR,
+			schema: "mbr",
 		}, {
 			from: gadget.LaidOutStructure{
 				VolumeStructure: &gadget.VolumeStructure{Name: "foo", Type: "00000000-0000-0000-0000-dd00deadbeef"},
@@ -517,7 +523,7 @@
 				VolumeStructure: &gadget.VolumeStructure{Name: "gpt-unhappy", Type: "00000000-0000-0000-0000-dd00deadbeef"},
 			},
 			err:    `cannot change structure name from "foo" to "gpt-unhappy"`,
-			schema: gadget.GPT,
+			schema: "gpt",
 		},
 	}
 	u.testCanUpdate(c, cases)
@@ -640,14 +646,14 @@
 	// prepare the stage
 	bareStruct := gadget.VolumeStructure{
 		Name: "first",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
 	}
 	fsStruct := gadget.VolumeStructure{
 		Name:       "second",
-		Size:       10 * gadget.SizeMiB,
+		Size:       10 * quantity.SizeMiB,
 		Filesystem: "ext4",
 		Content: []gadget.VolumeContent{
 			{Source: "/second-content", Target: "/"},
@@ -655,7 +661,7 @@
 	}
 	lastStruct := gadget.VolumeStructure{
 		Name:       "third",
-		Size:       5 * gadget.SizeMiB,
+		Size:       5 * quantity.SizeMiB,
 		Filesystem: "vfat",
 		Content: []gadget.VolumeContent{
 			{Source: "/third-content", Target: "/"},
@@ -667,7 +673,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct, fsStruct, lastStruct},
 			},
 		},
@@ -676,60 +682,85 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct, fsStruct, lastStruct},
 			},
 		},
 	}
 
 	oldRootDir := c.MkDir()
-	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), quantity.SizeMiB, nil)
 	makeSizedFile(c, filepath.Join(oldRootDir, "/second-content/foo"), 0, nil)
 	makeSizedFile(c, filepath.Join(oldRootDir, "/third-content/bar"), 0, nil)
 	oldData = gadget.GadgetData{Info: oldInfo, RootDir: oldRootDir}
 
 	newRootDir := c.MkDir()
-	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), 900*gadget.SizeKiB, nil)
-	makeSizedFile(c, filepath.Join(newRootDir, "/second-content/foo"), gadget.SizeKiB, nil)
-	makeSizedFile(c, filepath.Join(newRootDir, "/third-content/bar"), gadget.SizeKiB, nil)
+	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), 900*quantity.SizeKiB, nil)
+	makeSizedFile(c, filepath.Join(newRootDir, "/second-content/foo"), quantity.SizeKiB, nil)
+	makeSizedFile(c, filepath.Join(newRootDir, "/third-content/bar"), quantity.SizeKiB, nil)
 	newData = gadget.GadgetData{Info: newInfo, RootDir: newRootDir}
 
 	rollbackDir = c.MkDir()
 	return oldData, newData, rollbackDir
 }
 
+type mockUpdateProcessObserver struct {
+	beforeWriteCalled int
+	canceledCalled    int
+	beforeWriteErr    error
+	canceledErr       error
+}
+
+func (m *mockUpdateProcessObserver) Observe(op gadget.ContentOperation, sourceStruct *gadget.LaidOutStructure,
+	targetRootDir, relativeTargetPath string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	return gadget.ChangeAbort, errors.New("unexpected call")
+}
+
+func (m *mockUpdateProcessObserver) BeforeWrite() error {
+	m.beforeWriteCalled++
+	return m.beforeWriteErr
+}
+
+func (m *mockUpdateProcessObserver) Canceled() error {
+	m.canceledCalled++
+	return m.canceledErr
+}
+
 func (u *updateTestSuite) TestUpdateApplyHappy(c *C) {
 	oldData, newData, rollbackDir := updateDataSet(c)
 	// update two structs
 	newData.Info.Volumes["foo"].Structure[0].Update.Edition = 1
 	newData.Info.Volumes["foo"].Structure[1].Update.Edition = 1
 
+	muo := &mockUpdateProcessObserver{}
 	updaterForStructureCalls := 0
 	updateCalls := make(map[string]bool)
 	backupCalls := make(map[string]bool)
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		c.Assert(psRootDir, Equals, newData.RootDir)
 		c.Assert(psRollbackDir, Equals, rollbackDir)
+		c.Assert(observer, Equals, muo)
+		// TODO:UC20 verify observer
 
 		switch updaterForStructureCalls {
 		case 0:
 			c.Check(ps.Name, Equals, "first")
 			c.Check(ps.HasFilesystem(), Equals, false)
-			c.Check(ps.Size, Equals, 5*gadget.SizeMiB)
+			c.Check(ps.Size, Equals, 5*quantity.SizeMiB)
 			c.Check(ps.IsPartition(), Equals, true)
 			// non MBR start offset defaults to 1MiB
-			c.Check(ps.StartOffset, Equals, 1*gadget.SizeMiB)
+			c.Check(ps.StartOffset, Equals, 1*quantity.SizeMiB)
 			c.Assert(ps.LaidOutContent, HasLen, 1)
 			c.Check(ps.LaidOutContent[0].Image, Equals, "first.img")
-			c.Check(ps.LaidOutContent[0].Size, Equals, 900*gadget.SizeKiB)
+			c.Check(ps.LaidOutContent[0].Size, Equals, 900*quantity.SizeKiB)
 		case 1:
 			c.Check(ps.Name, Equals, "second")
 			c.Check(ps.HasFilesystem(), Equals, true)
 			c.Check(ps.Filesystem, Equals, "ext4")
 			c.Check(ps.IsPartition(), Equals, true)
-			c.Check(ps.Size, Equals, 10*gadget.SizeMiB)
+			c.Check(ps.Size, Equals, 10*quantity.SizeMiB)
 			// foo's start offset + foo's size
-			c.Check(ps.StartOffset, Equals, (1+5)*gadget.SizeMiB)
+			c.Check(ps.StartOffset, Equals, (1+5)*quantity.SizeMiB)
 			c.Assert(ps.LaidOutContent, HasLen, 0)
 			c.Assert(ps.Content, HasLen, 1)
 			c.Check(ps.Content[0].Source, Equals, "/second-content")
@@ -757,7 +788,7 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, IsNil)
 	c.Assert(backupCalls, DeepEquals, map[string]bool{
 		"first":  true,
@@ -768,6 +799,8 @@
 		"second": true,
 	})
 	c.Assert(updaterForStructureCalls, Equals, 2)
+	c.Assert(muo.beforeWriteCalled, Equals, 1)
+	c.Assert(muo.canceledCalled, Equals, 0)
 }
 
 func (u *updateTestSuite) TestUpdateApplyOnlyWhenNeeded(c *C) {
@@ -782,8 +815,9 @@
 	oldData.Info.Volumes["foo"].Structure[2].Update.Edition = 3
 	newData.Info.Volumes["foo"].Structure[2].Update.Edition = 3
 
+	muo := &mockUpdateProcessObserver{}
 	updaterForStructureCalls := 0
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		c.Assert(psRootDir, Equals, newData.RootDir)
 		c.Assert(psRollbackDir, Equals, rollbackDir)
 
@@ -806,15 +840,18 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, IsNil)
+
+	c.Assert(muo.beforeWriteCalled, Equals, 1)
+	c.Assert(muo.canceledCalled, Equals, 0)
 }
 
 func (u *updateTestSuite) TestUpdateApplyErrorLayout(c *C) {
 	// prepare the stage
 	bareStruct := gadget.VolumeStructure{
 		Name: "foo",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
@@ -824,7 +861,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct},
 			},
 		},
@@ -833,7 +870,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStructUpdate},
 			},
 		},
@@ -850,13 +887,13 @@
 	// both old and new bare struct data is missing
 
 	// cannot lay out the new volume when bare struct data is missing
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	c.Assert(err, ErrorMatches, `cannot lay out the new volume: cannot lay out structure #0 \("foo"\): content "first.img": .* no such file or directory`)
 
-	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), quantity.SizeMiB, nil)
 
 	// Update does not error out when when the bare struct data of the old volume is missing
-	err = gadget.Update(oldData, newData, rollbackDir, nil)
+	err = gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	c.Assert(err, Equals, gadget.ErrNoUpdate)
 }
 
@@ -864,7 +901,7 @@
 	// prepare the stage
 	bareStruct := gadget.VolumeStructure{
 		Name: "foo",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
@@ -876,7 +913,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct},
 			},
 		},
@@ -885,7 +922,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				// more structures than old
 				Structure: []gadget.VolumeStructure{bareStruct, bareStructUpdate},
 			},
@@ -900,10 +937,10 @@
 
 	rollbackDir := c.MkDir()
 
-	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), gadget.SizeMiB, nil)
-	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), 900*gadget.SizeKiB, nil)
+	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), quantity.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), 900*quantity.SizeKiB, nil)
 
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	c.Assert(err, ErrorMatches, `cannot apply update to volume: cannot change the number of structures within volume from 1 to 2`)
 }
 
@@ -911,7 +948,7 @@
 	// prepare the stage
 	bareStruct := gadget.VolumeStructure{
 		Name: "foo",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
@@ -919,7 +956,7 @@
 	fsStruct := gadget.VolumeStructure{
 		Name:       "foo",
 		Filesystem: "ext4",
-		Size:       5 * gadget.SizeMiB,
+		Size:       5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Source: "/", Target: "/"},
 		},
@@ -929,7 +966,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct},
 			},
 		},
@@ -938,7 +975,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{fsStruct},
 			},
 		},
@@ -952,9 +989,9 @@
 
 	rollbackDir := c.MkDir()
 
-	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), quantity.SizeMiB, nil)
 
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	c.Assert(err, ErrorMatches, `cannot update volume structure #0 \("foo"\): cannot change a bare structure to filesystem one`)
 }
 
@@ -962,7 +999,7 @@
 	// prepare the stage
 	bareStruct := gadget.VolumeStructure{
 		Name: "foo",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
@@ -971,7 +1008,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct},
 			},
 		},
@@ -987,13 +1024,13 @@
 	newData := gadget.GadgetData{Info: newInfo, RootDir: c.MkDir()}
 	rollbackDir := c.MkDir()
 
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		c.Fatalf("unexpected call")
 		return &mockUpdater{}, nil
 	})
 	defer restore()
 
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	c.Assert(err, ErrorMatches, `cannot find entry for volume "foo" in updated gadget info`)
 }
 
@@ -1001,7 +1038,7 @@
 	// prepare the stage
 	bareStruct := gadget.VolumeStructure{
 		Name: "foo",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
@@ -1013,7 +1050,7 @@
 		Volumes: map[string]gadget.Volume{
 			"foo": {
 				Bootloader: "grub",
-				Schema:     gadget.GPT,
+				Schema:     "gpt",
 				Structure:  []gadget.VolumeStructure{bareStruct},
 			},
 		},
@@ -1021,24 +1058,29 @@
 
 	oldRootDir := c.MkDir()
 	oldData := gadget.GadgetData{Info: oldInfo, RootDir: oldRootDir}
-	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), gadget.SizeMiB, nil)
+	makeSizedFile(c, filepath.Join(oldRootDir, "first.img"), quantity.SizeMiB, nil)
 
 	newRootDir := c.MkDir()
 	// same volume description
 	newData := gadget.GadgetData{Info: oldInfo, RootDir: newRootDir}
 	// different content, but updates are opt in
-	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), 900*gadget.SizeKiB, nil)
+	makeSizedFile(c, filepath.Join(newRootDir, "first.img"), 900*quantity.SizeKiB, nil)
 
 	rollbackDir := c.MkDir()
 
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	muo := &mockUpdateProcessObserver{}
+
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		c.Fatalf("unexpected call")
 		return &mockUpdater{}, nil
 	})
 	defer restore()
 
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, Equals, gadget.ErrNoUpdate)
+
+	// nothing was updated
+	c.Assert(muo.beforeWriteCalled, Equals, 0)
 }
 
 func policyDataSet(c *C) (oldData gadget.GadgetData, newData gadget.GadgetData, rollbackDir string) {
@@ -1046,7 +1088,7 @@
 	noPartitionStruct := gadget.VolumeStructure{
 		Name: "no-partition",
 		Type: "bare",
-		Size: 5 * gadget.SizeMiB,
+		Size: 5 * quantity.SizeMiB,
 		Content: []gadget.VolumeContent{
 			{Image: "first.img"},
 		},
@@ -1084,7 +1126,7 @@
 	newData.Info.Volumes["foo"].Structure[4].Update.Edition = 5
 
 	toUpdate := map[string]int{}
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		toUpdate[ps.Name]++
 		return &mockUpdater{}, nil
 	})
@@ -1094,7 +1136,7 @@
 	err := gadget.Update(oldData, newData, rollbackDir, func(_, to *gadget.LaidOutStructure) bool {
 		policySeen[to.Name]++
 		return false
-	})
+	}, nil)
 	c.Assert(err, Equals, gadget.ErrNoUpdate)
 	c.Assert(policySeen, DeepEquals, map[string]int{
 		"first":        1,
@@ -1110,7 +1152,7 @@
 	err = gadget.Update(oldData, newData, rollbackDir, func(_, to *gadget.LaidOutStructure) bool {
 		policySeen[to.Name]++
 		return to.Name == "second"
-	})
+	}, nil)
 	c.Assert(err, IsNil)
 	c.Assert(policySeen, DeepEquals, map[string]int{
 		"first":        1,
@@ -1135,13 +1177,13 @@
 	oldData.Info.Volumes["foo"].Structure[4].Update.Edition = 5
 
 	toUpdate := map[string]int{}
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		toUpdate[ps.Name] = toUpdate[ps.Name] + 1
 		return &mockUpdater{}, nil
 	})
 	defer restore()
 
-	err := gadget.Update(oldData, newData, rollbackDir, gadget.RemodelUpdatePolicy)
+	err := gadget.Update(oldData, newData, rollbackDir, gadget.RemodelUpdatePolicy, nil)
 	c.Assert(err, IsNil)
 	c.Assert(toUpdate, DeepEquals, map[string]int{
 		"first":        1,
@@ -1159,8 +1201,9 @@
 	newData.Info.Volumes["foo"].Structure[1].Update.Edition = 1
 	newData.Info.Volumes["foo"].Structure[2].Update.Edition = 3
 
+	muo := &mockUpdateProcessObserver{}
 	updaterForStructureCalls := 0
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		updater := &mockUpdater{
 			updateCb: func() error {
 				c.Fatalf("unexpected update call")
@@ -1183,8 +1226,12 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, ErrorMatches, `cannot backup volume structure #1 \("second"\): failed`)
+
+	// update was canceled before backup pass completed
+	c.Check(muo.canceledCalled, Equals, 1)
+	c.Check(muo.beforeWriteCalled, Equals, 0)
 }
 
 func (u *updateTestSuite) TestUpdateApplyUpdateFailsThenRollback(c *C) {
@@ -1194,11 +1241,12 @@
 	newData.Info.Volumes["foo"].Structure[1].Update.Edition = 2
 	newData.Info.Volumes["foo"].Structure[2].Update.Edition = 3
 
+	muo := &mockUpdateProcessObserver{}
 	updateCalls := make(map[string]bool)
 	backupCalls := make(map[string]bool)
 	rollbackCalls := make(map[string]bool)
 	updaterForStructureCalls := 0
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		updater := &mockUpdater{
 			backupCb: func() error {
 				backupCalls[ps.Name] = true
@@ -1227,7 +1275,7 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, ErrorMatches, `cannot update volume structure #1 \("second"\): failed`)
 	c.Assert(backupCalls, DeepEquals, map[string]bool{
 		// all were backed up
@@ -1245,6 +1293,10 @@
 		"second": true,
 		// third does not need as it was not updated
 	})
+	// backup pass completed
+	c.Check(muo.beforeWriteCalled, Equals, 1)
+	// and then the update was canceled
+	c.Check(muo.canceledCalled, Equals, 1)
 }
 
 func (u *updateTestSuite) TestUpdateApplyUpdateErrorRollbackFail(c *C) {
@@ -1261,7 +1313,7 @@
 	backupCalls := make(map[string]bool)
 	rollbackCalls := make(map[string]bool)
 	updaterForStructureCalls := 0
-	restore = gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore = gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		updater := &mockUpdater{
 			backupCb: func() error {
 				backupCalls[ps.Name] = true
@@ -1298,7 +1350,7 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	// preserves update error
 	c.Assert(err, ErrorMatches, `cannot update volume structure #2 \("third"\): update error`)
 	c.Assert(backupCalls, DeepEquals, map[string]bool{
@@ -1329,48 +1381,68 @@
 	newData.Info.Volumes["foo"].Structure[1].Update.Edition = 2
 	newData.Info.Volumes["foo"].Structure[2].Update.Edition = 3
 
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		return nil, errors.New("bad updater for structure")
 	})
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, nil)
 	c.Assert(err, ErrorMatches, `cannot prepare update for volume structure #0 \("first"\): bad updater for structure`)
 }
 
 func (u *updateTestSuite) TestUpdaterForStructure(c *C) {
-	rootDir := c.MkDir()
+	gadgetRootDir := c.MkDir()
 	rollbackDir := c.MkDir()
+	rootDir := c.MkDir()
+
+	dirs.SetRootDir(rootDir)
+	defer dirs.SetRootDir("/")
+
+	// prepare some state for mocked mount point lookup
+	err := os.MkdirAll(filepath.Join(rootDir, "/dev"), 0755)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(filepath.Join(rootDir, "/dev/disk/by-label"), 0755)
+	c.Assert(err, IsNil)
+	fakedevice := filepath.Join(rootDir, "/dev/sdxxx2")
+	err = ioutil.WriteFile(fakedevice, []byte(""), 0644)
+	c.Assert(err, IsNil)
+	err = os.Symlink(fakedevice, filepath.Join(rootDir, "/dev/disk/by-label/writable"))
+	c.Assert(err, IsNil)
+	mountInfo := `170 27 8:2 / /some/mount/point rw,relatime shared:58 - ext4 %s/dev/sdxxx2 rw
+`
+	restore := osutil.MockMountInfo(fmt.Sprintf(mountInfo, rootDir))
+	defer restore()
 
 	psBare := &gadget.LaidOutStructure{
 		VolumeStructure: &gadget.VolumeStructure{
 			Filesystem: "none",
-			Size:       10 * gadget.SizeMiB,
+			Size:       10 * quantity.SizeMiB,
 		},
-		StartOffset: 1 * gadget.SizeMiB,
+		StartOffset: 1 * quantity.SizeMiB,
 	}
-	updater, err := gadget.UpdaterForStructure(psBare, rootDir, rollbackDir)
+	updater, err := gadget.UpdaterForStructure(psBare, gadgetRootDir, rollbackDir, nil)
 	c.Assert(err, IsNil)
 	c.Assert(updater, FitsTypeOf, &gadget.RawStructureUpdater{})
 
 	psFs := &gadget.LaidOutStructure{
 		VolumeStructure: &gadget.VolumeStructure{
 			Filesystem: "ext4",
-			Size:       10 * gadget.SizeMiB,
+			Size:       10 * quantity.SizeMiB,
+			Label:      "writable",
 		},
-		StartOffset: 1 * gadget.SizeMiB,
+		StartOffset: 1 * quantity.SizeMiB,
 	}
-	updater, err = gadget.UpdaterForStructure(psFs, rootDir, rollbackDir)
+	updater, err = gadget.UpdaterForStructure(psFs, gadgetRootDir, rollbackDir, nil)
 	c.Assert(err, IsNil)
 	c.Assert(updater, FitsTypeOf, &gadget.MountedFilesystemUpdater{})
 
 	// trigger errors
-	updater, err = gadget.UpdaterForStructure(psBare, rootDir, "")
+	updater, err = gadget.UpdaterForStructure(psBare, gadgetRootDir, "", nil)
 	c.Assert(err, ErrorMatches, "internal error: backup directory cannot be unset")
 	c.Assert(updater, IsNil)
 
-	updater, err = gadget.UpdaterForStructure(psFs, "", rollbackDir)
+	updater, err = gadget.UpdaterForStructure(psFs, "", rollbackDir, nil)
 	c.Assert(err, ErrorMatches, "internal error: gadget content directory cannot be unset")
 	c.Assert(updater, IsNil)
 }
@@ -1396,13 +1468,13 @@
 	}
 
 	// a new multi volume gadget update gives no error
-	err := gadget.Update(singleVolume, multiVolume, "some-rollback-dir", nil)
+	err := gadget.Update(singleVolume, multiVolume, "some-rollback-dir", nil, nil)
 	c.Assert(err, IsNil)
 	// but it warns that nothing happens either
 	c.Assert(logbuf.String(), testutil.Contains, "WARNING: gadget assests cannot be updated yet when multiple volumes are used")
 
 	// same for old
-	err = gadget.Update(multiVolume, singleVolume, "some-rollback-dir", nil)
+	err = gadget.Update(multiVolume, singleVolume, "some-rollback-dir", nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(strings.Count(logbuf.String(), "WARNING: gadget assests cannot be updated yet when multiple volumes are used"), Equals, 2)
 }
@@ -1416,9 +1488,10 @@
 	oldData.Info.Volumes["foo"].Structure[1].Update.Edition = 1
 	newData.Info.Volumes["foo"].Structure[1].Update.Edition = 2
 
+	muo := &mockUpdateProcessObserver{}
 	expectedStructs := []string{"first", "second"}
 	updateCalls := 0
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		mu := &mockUpdater{
 			updateCb: func() error {
 				c.Assert(expectedStructs, testutil.Contains, ps.Name)
@@ -1435,10 +1508,13 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, Equals, gadget.ErrNoUpdate)
 	// update called for 2 structures
 	c.Assert(updateCalls, Equals, 2)
+	// nothing was updated, but the backup pass still executed
+	c.Assert(muo.beforeWriteCalled, Equals, 1)
+	c.Assert(muo.canceledCalled, Equals, 0)
 }
 
 func (u *updateTestSuite) TestUpdateApplyNoChangedContentInSome(c *C) {
@@ -1450,9 +1526,10 @@
 	oldData.Info.Volumes["foo"].Structure[1].Update.Edition = 1
 	newData.Info.Volumes["foo"].Structure[1].Update.Edition = 2
 
+	muo := &mockUpdateProcessObserver{}
 	expectedStructs := []string{"first", "second"}
 	updateCalls := 0
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		mu := &mockUpdater{
 			updateCb: func() error {
 				c.Assert(expectedStructs, testutil.Contains, ps.Name)
@@ -1472,8 +1549,78 @@
 	defer restore()
 
 	// go go go
-	err := gadget.Update(oldData, newData, rollbackDir, nil)
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
 	c.Assert(err, IsNil)
 	// update called for 2 structures
 	c.Assert(updateCalls, Equals, 2)
+	// at least one structure had an update
+	c.Assert(muo.beforeWriteCalled, Equals, 1)
+	c.Assert(muo.canceledCalled, Equals, 0)
+}
+
+func (u *updateTestSuite) TestUpdateApplyObserverBeforeWriteErrs(c *C) {
+	oldData, newData, rollbackDir := updateDataSet(c)
+	newData.Info.Volumes["foo"].Structure[0].Update.Edition = 1
+
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
+		updater := &mockUpdater{
+			updateCb: func() error {
+				c.Fatalf("unexpected call")
+				return fmt.Errorf("unexpected call")
+			},
+		}
+		return updater, nil
+	})
+	defer restore()
+
+	// go go go
+	muo := &mockUpdateProcessObserver{
+		beforeWriteErr: errors.New("before write fail"),
+	}
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
+	c.Assert(err, ErrorMatches, `cannot observe prepared update: before write fail`)
+	// update was canceled before backup pass completed
+	c.Check(muo.canceledCalled, Equals, 0)
+	c.Check(muo.beforeWriteCalled, Equals, 1)
+}
+
+func (u *updateTestSuite) TestUpdateApplyObserverCanceledErrs(c *C) {
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	oldData, newData, rollbackDir := updateDataSet(c)
+	newData.Info.Volumes["foo"].Structure[0].Update.Edition = 1
+
+	backupErr := errors.New("backup fails")
+	updateErr := errors.New("update fails")
+	restore = gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, psRootDir, psRollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
+		updater := &mockUpdater{
+			backupCb: func() error { return backupErr },
+			updateCb: func() error { return updateErr },
+		}
+		return updater, nil
+	})
+	defer restore()
+
+	// go go go
+	muo := &mockUpdateProcessObserver{
+		canceledErr: errors.New("canceled fail"),
+	}
+	err := gadget.Update(oldData, newData, rollbackDir, nil, muo)
+	c.Assert(err, ErrorMatches, `cannot backup volume structure #0 .*: backup fails`)
+	// canceled called after backup pass
+	c.Check(muo.canceledCalled, Equals, 1)
+	c.Check(muo.beforeWriteCalled, Equals, 0)
+
+	c.Check(logbuf.String(), testutil.Contains, `cannot observe canceled prepare update: canceled fail`)
+
+	// backup works, update fails, triggers another canceled call
+	backupErr = nil
+	err = gadget.Update(oldData, newData, rollbackDir, nil, muo)
+	c.Assert(err, ErrorMatches, `cannot update volume structure #0 .*: update fails`)
+	// canceled called after backup pass
+	c.Check(muo.canceledCalled, Equals, 2)
+	c.Check(muo.beforeWriteCalled, Equals, 1)
+
+	c.Check(logbuf.String(), testutil.Contains, `cannot observe canceled update: canceled fail`)
 }
diff -Nru snapd-2.45.1+20.04.2/gadget/validate.go snapd-2.48.3+20.04/gadget/validate.go
--- snapd-2.45.1+20.04.2/gadget/validate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/validate.go	2021-02-02 08:21:12.000000000 +0000
@@ -50,10 +50,33 @@
 	return nil
 }
 
+func validateEncryptionSupport(info *Info) error {
+	for name, vol := range info.Volumes {
+		var haveSave bool
+		for _, s := range vol.Structure {
+			if s.Role == SystemSave {
+				haveSave = true
+			}
+		}
+		if !haveSave {
+			return fmt.Errorf("volume %q has no structure with system-save role", name)
+		}
+		// XXX: shall we make sure that size of ubuntu-save is reasonable?
+	}
+	return nil
+}
+
+type ValidationConstraints struct {
+	// EncryptedData when true indicates that the gadget will be used on a
+	// device where the data partition will be encrypted.
+	EncryptedData bool
+}
+
 // Validate checks whether the given directory contains valid gadget snap
 // metadata and a matching content, under the provided model constraints, which
-// are handled identically to ReadInfo().
-func Validate(gadgetSnapRootDir string, model Model) error {
+// are handled identically to ReadInfo(). Optionally takes additional validation
+// constraints, which for instance may only be known at run time,
+func Validate(gadgetSnapRootDir string, model Model, extra *ValidationConstraints) error {
 	info, err := ReadInfo(gadgetSnapRootDir, model)
 	if err != nil {
 		return fmt.Errorf("invalid gadget metadata: %v", err)
@@ -68,6 +91,12 @@
 			return fmt.Errorf("invalid volume %q: %v", name, err)
 		}
 	}
-
+	if extra != nil {
+		if extra.EncryptedData {
+			if err := validateEncryptionSupport(info); err != nil {
+				return fmt.Errorf("gadget does not support encrypted data: %v", err)
+			}
+		}
+	}
 	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/gadget/validate_test.go snapd-2.48.3+20.04/gadget/validate_test.go
--- snapd-2.45.1+20.04.2/gadget/validate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/gadget/validate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -55,7 +55,7 @@
 `
 	makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContent))
 
-	err := gadget.Validate(s.dir, nil)
+	err := gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, ErrorMatches, `invalid layout of volume "pc": cannot lay out structure #0 \("foo"\): content "foo.img": stat .*/foo.img: no such file or directory`)
 }
 
@@ -83,7 +83,7 @@
 	// only content for the first volume
 	makeSizedFile(c, filepath.Join(s.dir, "first.img"), 1, nil)
 
-	err := gadget.Validate(s.dir, nil)
+	err := gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, ErrorMatches, `invalid layout of volume "second": cannot lay out structure #0 \("second-foo"\): content "second.img": stat .*/second.img: no such file or directory`)
 }
 
@@ -100,7 +100,7 @@
 `
 	makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContent))
 
-	err := gadget.Validate(s.dir, nil)
+	err := gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, ErrorMatches, `invalid gadget metadata: bootloader must be one of .*`)
 }
 
@@ -121,13 +121,13 @@
 `
 	makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContent))
 
-	err := gadget.Validate(s.dir, nil)
+	err := gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, ErrorMatches, `invalid volume "bad": structure #0 \("bad-struct"\), content source:foo/: source path does not exist`)
 
 	// make it a file, which conflicts with foo/ as 'source'
 	fooPath := filepath.Join(s.dir, "foo")
 	makeSizedFile(c, fooPath, 1, nil)
-	err = gadget.Validate(s.dir, nil)
+	err = gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, ErrorMatches, `invalid volume "bad": structure #0 \("bad-struct"\), content source:foo/: cannot specify trailing / for a source which is not a directory`)
 
 	// make it a directory
@@ -136,7 +136,7 @@
 	err = os.Mkdir(fooPath, 0755)
 	c.Assert(err, IsNil)
 	// validate should no longer complain
-	err = gadget.Validate(s.dir, nil)
+	err = gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, IsNil)
 }
 
@@ -146,13 +146,13 @@
 `
 	makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContent))
 
-	err := gadget.Validate(s.dir, nil)
+	err := gadget.Validate(s.dir, nil, nil)
 	c.Assert(err, IsNil)
 
-	err = gadget.Validate(s.dir, &modelConstraints{classic: true})
+	err = gadget.Validate(s.dir, &modelConstraints{classic: true}, nil)
 	c.Assert(err, IsNil)
 
-	err = gadget.Validate(s.dir, &modelConstraints{classic: false})
+	err = gadget.Validate(s.dir, &modelConstraints{classic: false}, nil)
 	c.Assert(err, ErrorMatches, "invalid gadget metadata: bootloader not declared in any volume")
 }
 
@@ -174,7 +174,52 @@
         role: %[1]s
 `, role)
 		makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContent))
-		err := gadget.Validate(s.dir, nil)
+		err := gadget.Validate(s.dir, nil, nil)
 		c.Assert(err, ErrorMatches, fmt.Sprintf(`invalid gadget metadata: invalid volume "pc": cannot have more than one partition with %s role`, role))
 	}
 }
+
+var gadgetYamlContentNoSave = `
+volumes:
+  vol1:
+    bootloader: grub
+    structure:
+      - name: ubuntu-seed
+        role: system-seed
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        filesystem: ext4
+      - name: ubuntu-boot
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        filesystem: ext4
+      - name: ubuntu-data
+        role: system-data
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        filesystem: ext4
+`
+
+var gadgetYamlContentWithSave = gadgetYamlContentNoSave + `
+      - name: ubuntu-save
+        role: system-save
+        type: DA,21686148-6449-6E6F-744E-656564454649
+        size: 1M
+        filesystem: ext4
+`
+
+func (s *validateGadgetTestSuite) TestValidateEncryptionSupportErr(c *C) {
+	makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContentNoSave))
+	err := gadget.Validate(s.dir, &modelConstraints{systemSeed: true}, &gadget.ValidationConstraints{
+		EncryptedData: true,
+	})
+	c.Assert(err, ErrorMatches, `gadget does not support encrypted data: volume "vol1" has no structure with system-save role`)
+}
+
+func (s *validateGadgetTestSuite) TestValidateEncryptionSupportHappy(c *C) {
+	makeSizedFile(c, filepath.Join(s.dir, "meta/gadget.yaml"), 0, []byte(gadgetYamlContentWithSave))
+	err := gadget.Validate(s.dir, &modelConstraints{systemSeed: true}, &gadget.ValidationConstraints{
+		EncryptedData: true,
+	})
+	c.Assert(err, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/cla-check.yaml snapd-2.48.3+20.04/.github/workflows/cla-check.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/cla-check.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/cla-check.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,17 +6,23 @@
 
 jobs:
   cla-check:
-    runs-on: ubuntu-16.04
+    runs-on: self-hosted
     steps:
       - name: Install dependencies
         run: |
-          sudo apt-get update
-          sudo apt-get install python-launchpadlib
+          # sudo apt-get update
+          # sudo apt-get install python-launchpadlib
+          # TODO: make this conditional on self-hosted or not
+          echo "dependencies are baked into unprivileged test containers"
       - name: Checkout code
         uses: actions/checkout@v2
         with:
           # The cla_check script reads git commit history, so can't
           # use a shallow checkout.
           fetch-depth: 0
+          # ensure we pull PR /head, not autogenerated /merge commit
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Fetching base ref ${{ github.base_ref }}
+        run: git fetch origin ${{ github.base_ref }}:${{ github.base_ref }}
       - name: CLA check
-        run: ./tests/lib/cla_check.py
+        run: ./tests/lib/cla_check.py "${{ github.base_ref }}..HEAD"
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/macos-sanity.yaml snapd-2.48.3+20.04/.github/workflows/macos-sanity.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/macos-sanity.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/macos-sanity.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,48 @@
+name: MacOS sanity checks
+on:
+  # Only run on pull requests: not pushes
+  pull_request:
+    branches: [ "master", "release/**" ]
+
+jobs:
+  macos-sanity:
+    runs-on: macos-latest
+    env:
+      GOPATH: ${{ github.workspace }}
+      GO111MODULE: off
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: "1.14.x"
+
+      - name: Checkout code
+        uses: actions/checkout@v2
+        with:
+          # NOTE: checkout the code in a fixed location, even for forks, as this
+          # is relevant for go's import system.
+          path: ./src/github.com/snapcore/snapd
+
+      - name: Install squashfs from homebrew
+        run: |
+          brew install squashfs
+
+      - name: Install Go package dependencies
+        working-directory: ./src/github.com/snapcore/snapd
+        run: |
+          ./mkversion.sh
+          ./get-deps.sh
+          # extra dependency on darwin:
+          go get golang.org/x/sys/unix
+
+      - name: Build sanity checks
+        run: |
+          go build -tags nosecboot -o /tmp/snp github.com/snapcore/snapd/cmd/snap
+
+      - name: Runtime sanity checks
+        working-directory: ./src/github.com/snapcore/snapd
+        run: |
+          /tmp/snp download hello
+          /tmp/snp version
+          # TODO: homebrew appears to be broken, brew install of squashfs fails
+          # and goes unnoticed by travis
+          if command -v mksquashfs; then /tmp/snp pack tests/lib/snaps/test-snapd-tools/ /tmp ; fi
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/test-go1.10.yaml snapd-2.48.3+20.04/.github/workflows/test-go1.10.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/test-go1.10.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/test-go1.10.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,115 +0,0 @@
-name: Tests go1.10
-on:
-  pull_request:
-    branches: [ "master", "release/**" ]
-jobs:
-  unit-tests-1_10:
-    runs-on: ubuntu-16.04
-    env:
-      GOPATH: ${{ github.workspace }}
-      GO111MODULE: off
-      # Set PATH to ignore the load of magic binaries from /usr/local/bin And
-      # to use the go snap automatically. Note that we install go from the
-      # snap in a step below. Without this we get the GitHub-controlled latest
-      # version of go.
-      PATH: /snap/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
-      GOROOT: ""
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-      with:
-        # NOTE: checkout the code in a fixed location, even for forks, as this
-        # is relevant for go's import system.
-        path: ./src/github.com/snapcore/snapd
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Cache Debian dependencies
-      id: cache-deb-downloads
-      uses: actions/cache@v1
-      with:
-        path: /var/cache/apt
-        key: var-cache-apt-{{ hashFiles('**/debian/control') }}
-    - name: Run "apt update"
-      run: |
-          sudo apt update
-    - name: Download Debian dependencies
-      if: steps.cache-deb-downloads.outputs.cache-hit != 'true'
-      run: |
-          sudo apt clean
-          sudo apt build-dep -d -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # Work around caching files owned by root https://github.com/actions/cache/issues/133
-    - name: Install Debian dependencies
-      run: sudo apt build-dep -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # golang 1.10 is used on 14.04/16.04/18.04
-    - name: Install the go snap
-      run: |
-          sudo snap install --classic --channel=1.10 go
-    - name: Install ShellCheck as a snap
-      run: |
-          sudo apt-get remove --purge shellcheck
-          sudo snap install shellcheck
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Install govendor
-      run: go get -u github.com/kardianos/govendor
-    - name: Cache Go dependencies
-      id: cache-go-govendor
-      uses: actions/cache@v1
-      with:
-        path: ${{ github.workspace }}/.cache/govendor
-        key: go-govendor-{{ hashFiles('**/vendor.json') }}
-    - name: Get Go dependencies
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ${{ github.workspace }}/bin/govendor sync
-    - name: Run static checks
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --static
-    - name: Build C
-      run: |
-          cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/
-          ./autogen.sh
-          make -j2
-    - name: Build Go
-      run: go build github.com/snapcore/snapd/...
-    - name: Test C
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/ && make check
-    - name: Test Go
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --unit
-
-  spread:
-    needs: [unit-tests-1_10]
-    runs-on: self-hosted
-    strategy:
-      # FIXME: enable fail-fast mode once spread can cancel an executing job.
-      #
-      # Disable fail-fast mode as it doesn't function with spread. It seems
-      # that cancelling tasks requires short, interruptible actions and
-      # interrupting spread, notably, does not work today. As such disable
-      # fail-fast while we tackle that problem upstream.
-      fail-fast: false
-      matrix:
-        system:
-        - ubuntu-14.04-64
-        - ubuntu-18.04-64
-        - ubuntu-core-18-64
-        - debian-9-64
-        - arch-linux-64
-        - amazon-linux-2-64
-        - centos-7-64
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: Run spread tests
-      env:
-          SPREAD_GOOGLE_KEY: ${{ secrets.SPREAD_GOOGLE_KEY }}
-      if: "!contains(github.event.pull_request.labels.*.name, 'Skip spread')"
-      run: |
-          # Register a problem matcher to highlight spread failures
-          echo "::add-matcher::.github/spread-problem-matcher.json"
-          spread google:${{ matrix.system }}:tests/...
-    - name: Discard spread workers
-      if: always()
-      run: |
-        shopt -s nullglob;
-        for r in .spread-reuse.*.yaml; do
-          spread -discard -reuse-pid="$(echo "$r" | grep -o -E '[0-9]+')";
-        done
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/test-go1.13.yaml snapd-2.48.3+20.04/.github/workflows/test-go1.13.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/test-go1.13.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/test-go1.13.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,116 +0,0 @@
-name: Tests go1.13
-on:
-  pull_request:
-    branches: [ "master", "release/**" ]
-jobs:
-  unit-tests-1_13:
-    runs-on: ubuntu-18.04
-    env:
-      GOPATH: ${{ github.workspace }}
-      GO111MODULE: off
-      # Set PATH to ignore the load of magic binaries from /usr/local/bin And
-      # to use the go snap automatically. Note that we install go from the
-      # snap in a step below. Without this we get the GitHub-controlled latest
-      # version of go.
-      PATH: /snap/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
-      GOROOT: ""
-      # skip format checks on 1.13+
-      SKIP_GOFMT: 1
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-      with:
-        # NOTE: checkout the code in a fixed location, even for forks, as this
-        # is relevant for go's import system.
-        path: ./src/github.com/snapcore/snapd
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Cache Debian dependencies
-      id: cache-deb-downloads
-      uses: actions/cache@v1
-      with:
-        path: /var/cache/apt
-        key: var-cache-apt-{{ hashFiles('**/debian/control') }}
-    - name: Run "apt update"
-      run: |
-          sudo apt update
-    - name: Download Debian dependencies
-      if: steps.cache-deb-downloads.outputs.cache-hit != 'true'
-      run: |
-          sudo apt clean
-          sudo apt build-dep -d -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # Work around caching files owned by root https://github.com/actions/cache/issues/133
-    - name: Install Debian dependencies
-      run: sudo apt build-dep -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # golang 1.13 is used on 20.04
-    - name: Install the go snap
-      run: |
-          sudo snap install --classic --channel=1.13 go
-    - name: Install ShellCheck as a snap
-      run: |
-          sudo apt-get remove --purge shellcheck
-          sudo snap install shellcheck
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Install govendor
-      run: go get -u github.com/kardianos/govendor
-    - name: Cache Go dependencies
-      id: cache-go-govendor
-      uses: actions/cache@v1
-      with:
-        path: ${{ github.workspace }}/.cache/govendor
-        key: go-govendor-{{ hashFiles('**/vendor.json') }}
-    - name: Get Go dependencies
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ${{ github.workspace }}/bin/govendor sync
-    - name: Run static checks
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --static
-    - name: Build C
-      run: |
-          cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/
-          ./autogen.sh
-          make -j2
-    - name: Build Go
-      run: go build github.com/snapcore/snapd/...
-    - name: Test C
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/ && make check
-    - name: Test Go
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --unit
-
-  spread:
-    needs: [unit-tests-1_13]
-    runs-on: self-hosted
-    strategy:
-      # FIXME: enable fail-fast mode once spread can cancel an executing job.
-      #
-      # Disable fail-fast mode as it doesn't function with spread. It seems
-      # that cancelling tasks requires short, interruptible actions and
-      # interrupting spread, notably, does not work today. As such disable
-      # fail-fast while we tackle that problem upstream.
-      fail-fast: false
-      matrix:
-        system:
-        - ubuntu-19.10-64
-        - ubuntu-20.04-64
-        - ubuntu-core-20-64
-        - debian-sid-64
-        - fedora-30-64
-        - fedora-31-64
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: Run spread tests
-      env:
-          SPREAD_GOOGLE_KEY: ${{ secrets.SPREAD_GOOGLE_KEY }}
-      if: "!contains(github.event.pull_request.labels.*.name, 'Skip spread')"
-      run: |
-          # Register a problem matcher to highlight spread failures
-          echo "::add-matcher::.github/spread-problem-matcher.json"
-          spread google:${{ matrix.system }}:tests/...
-    - name: Discard spread workers
-      if: always()
-      run: |
-        shopt -s nullglob;
-        for r in .spread-reuse.*.yaml; do
-          spread -discard -reuse-pid="$(echo "$r" | grep -o -E '[0-9]+')";
-        done
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/test-go1.9.yaml snapd-2.48.3+20.04/.github/workflows/test-go1.9.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/test-go1.9.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/test-go1.9.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,105 +0,0 @@
-name: Tests go1.9
-on:
-  pull_request:
-    branches: [ "master", "release/**" ]
-jobs:
-  unit-tests-1_9:
-    runs-on: ubuntu-16.04
-    env:
-      GOPATH: ${{ github.workspace }}
-      GO111MODULE: off
-      # Set PATH to ignore the load of magic binaries from /usr/local/bin And
-      # to use the go snap automatically. Note that we install go from the
-      # snap in a step below. Without this we get the GitHub-controlled latest
-      # version of go.
-      PATH: /snap/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
-      GOROOT: ""
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-      with:
-        # NOTE: checkout the code in a fixed location, even for forks, as this
-        # is relevant for go's import system.
-        path: ./src/github.com/snapcore/snapd
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Cache Debian dependencies
-      id: cache-deb-downloads
-      uses: actions/cache@v1
-      with:
-        path: /var/cache/apt
-        key: var-cache-apt-{{ hashFiles('**/debian/control') }}
-    - name: Run "apt update"
-      run: |
-          sudo apt update
-    - name: Download Debian dependencies
-      if: steps.cache-deb-downloads.outputs.cache-hit != 'true'
-      run: |
-          sudo apt clean
-          sudo apt build-dep -d -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # Work around caching files owned by root https://github.com/actions/cache/issues/133
-    - name: Install Debian dependencies
-      run: sudo apt build-dep -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # golang 1.9 is used on centos-7 so we need to support it
-    - name: Install the go snap
-      run: |
-          sudo snap install --classic --channel=1.9 go
-    - name: Install ShellCheck as a snap
-      run: |
-          sudo apt-get remove --purge shellcheck
-          sudo snap install shellcheck
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Install govendor
-      run: go get -u github.com/kardianos/govendor
-    - name: Cache Go dependencies
-      id: cache-go-govendor
-      uses: actions/cache@v1
-      with:
-        path: ${{ github.workspace }}/.cache/govendor
-        key: go-govendor-{{ hashFiles('**/vendor.json') }}
-    - name: Get Go dependencies
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ${{ github.workspace }}/bin/govendor sync
-    - name: Run static checks
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --static
-    - name: Build C
-      run: |
-          cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/
-          ./autogen.sh
-          make -j2
-    - name: Build Go
-      run: go build github.com/snapcore/snapd/...
-    - name: Test C
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/ && make check
-    - name: Test Go
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --unit
-
-  spread:
-    needs: [ unit-tests-1_9 ]
-    runs-on: self-hosted
-    strategy:
-      fail-fast: false
-      matrix:
-        system:
-        - ubuntu-16.04-64
-        - ubuntu-16.04-32
-        - ubuntu-core-16-64
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: Run spread tests
-      env:
-          SPREAD_GOOGLE_KEY: ${{ secrets.SPREAD_GOOGLE_KEY }}
-      if: "!contains(github.event.pull_request.labels.*.name, 'Skip spread')"
-      run: |
-          # Register a problem matcher to highlight spread failures
-          echo "::add-matcher::.github/spread-problem-matcher.json"
-          spread -abend google:${{ matrix.system }}:tests/...
-    - name: Discard spread workers
-      if: always()
-      run: |
-        shopt -s nullglob;
-        for r in .spread-reuse.*.yaml; do
-          spread -discard -reuse-pid="$(echo "$r" | grep -o -E '[0-9]+')";
-        done
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/test-go-latest.yaml snapd-2.48.3+20.04/.github/workflows/test-go-latest.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/test-go-latest.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/test-go-latest.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,108 +0,0 @@
-name: Tests go-latest
-on:
-  pull_request:
-    branches: [ "master", "release/**" ]
-jobs:
-  unit-tests-go-latest:
-    runs-on: ubuntu-18.04
-    env:
-      GOPATH: ${{ github.workspace }}
-      GO111MODULE: off
-      # Set PATH to ignore the load of magic binaries from /usr/local/bin And
-      # to use the go snap automatically. Note that we install go from the
-      # snap in a step below. Without this we get the GitHub-controlled latest
-      # version of go.
-      PATH: /snap/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
-      GOROOT: ""
-      # skip format checks on 1.13+
-      SKIP_GOFMT: 1
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-      with:
-        # NOTE: checkout the code in a fixed location, even for forks, as this
-        # is relevant for go's import system.
-        path: ./src/github.com/snapcore/snapd
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Cache Debian dependencies
-      id: cache-deb-downloads
-      uses: actions/cache@v1
-      with:
-        path: /var/cache/apt
-        key: var-cache-apt-{{ hashFiles('**/debian/control') }}
-    - name: Run "apt update"
-      run: |
-          sudo apt update
-    - name: Download Debian dependencies
-      if: steps.cache-deb-downloads.outputs.cache-hit != 'true'
-      run: |
-          sudo apt clean
-          sudo apt build-dep -d -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # Work around caching files owned by root https://github.com/actions/cache/issues/133
-    - name: Install Debian dependencies
-      run: sudo apt build-dep -y ${{ github.workspace }}/src/github.com/snapcore/snapd
-    # golang latest ensures things work on the edge
-    - name: Install the go snap
-      run: |
-          sudo snap install --classic --channel=latest/edge go
-    - name: Install ShellCheck as a snap
-      run: |
-          sudo apt-get remove --purge shellcheck
-          sudo snap install shellcheck
-    - name: Make /var/cache/apt owned by current user
-      run: sudo chown -R $(id -u) /var/cache/apt
-    - name: Install govendor
-      run: go get -u github.com/kardianos/govendor
-    - name: Cache Go dependencies
-      id: cache-go-govendor
-      uses: actions/cache@v1
-      with:
-        path: ${{ github.workspace }}/.cache/govendor
-        key: go-govendor-{{ hashFiles('**/vendor.json') }}
-    - name: Get Go dependencies
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ${{ github.workspace }}/bin/govendor sync
-    - name: Run static checks
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --static
-    - name: Build C
-      run: |
-          cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/
-          ./autogen.sh
-          make -j2
-    - name: Build Go
-      run: go build github.com/snapcore/snapd/...
-    - name: Test C
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/ && make check
-    - name: Test Go
-      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ./run-checks --unit
-
-  spread-unstable:
-    needs: [unit-tests-go-latest]
-    runs-on: self-hosted
-    strategy:
-      # FIXME: enable fail-fast mode once spread can cancel an executing job.
-      fail-fast: false
-      matrix:
-        system:
-        - centos-8-64
-        - opensuse-15.1-64
-        - opensuse-tumbleweed-64
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: Run spread tests
-      env:
-          SPREAD_GOOGLE_KEY: ${{ secrets.SPREAD_GOOGLE_KEY }}
-      if: "!contains(github.event.pull_request.labels.*.name, 'Skip spread')"
-      run: |
-          # Register a problem matcher to highlight spread failures
-          echo "::add-matcher::.github/spread-problem-matcher.json"
-          spread -abend google-unstable:${{ matrix.system }}:tests/...
-    - name: Discard spread workers
-      if: always()
-      run: |
-        shopt -s nullglob;
-        for r in .spread-reuse.*.yaml; do
-          spread -discard -reuse-pid="$(echo "$r" | grep -o -E '[0-9]+')";
-        done
diff -Nru snapd-2.45.1+20.04.2/.github/workflows/test.yaml snapd-2.48.3+20.04/.github/workflows/test.yaml
--- snapd-2.45.1+20.04.2/.github/workflows/test.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/.github/workflows/test.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,310 @@
+name: Tests
+on:
+  pull_request:
+    branches: [ "master", "release/**" ]
+  push:
+    branches: [ "release/**" ]
+
+jobs:
+  snap-builds:
+    runs-on: ubuntu-16.04
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: Cache snapd snap build status
+      id: cache-snapd-build-status
+      uses: actions/cache@v1
+      with:
+        path: "${{ github.workspace }}/.test-results"
+        key: "${{ github.run_id }}-${{ github.job }}-results"
+    - name: Check cached snap build
+      id: cached-results
+      run: |
+          CACHE_RESULT_STAMP="${{ github.workspace }}/.test-results/snap-build-success"
+          echo "CACHE_RESULT_STAMP=$CACHE_RESULT_STAMP" >> $GITHUB_ENV
+          if [ -e "$CACHE_RESULT_STAMP" ]; then
+              has_cached_snap=0
+              while read name; do
+                  has_cached_snap=1
+                  # bring back artifacts from the cache
+                  cp -v "$name" "${{ github.workspace }}"
+              done < <(find "$(dirname $CACHE_RESULT_STAMP)" -name "*.snap")
+              if [ "$has_cached_snap" = "1" ]; then
+                  # we have restored an artifact from the cache
+                  echo "::set-output name=already-ran::true"
+              fi
+          fi
+    - name: Build snapd snap
+      if: steps.cached-results.outputs.already-ran != 'true'
+      uses: snapcore/action-build@v1
+    - name: Cache built artifact
+      run: |
+        mkdir -p $(dirname "$CACHE_RESULT_STAMP")
+        cp -v *.snap "$(dirname $CACHE_RESULT_STAMP)/"
+    - name: Uploading snapd snap artifact
+      uses: actions/upload-artifact@v2
+      with:
+        name: snap-files
+        path: "*.snap"
+    - name: Mark successful snap build
+      run: |
+        mkdir -p $(dirname "$CACHE_RESULT_STAMP")
+        touch "$CACHE_RESULT_STAMP"
+
+  unit-tests:
+    runs-on: ubuntu-16.04
+    env:
+      GOPATH: ${{ github.workspace }}
+      GO111MODULE: off
+      # Set PATH to ignore the load of magic binaries from /usr/local/bin And
+      # to use the go snap automatically. Note that we install go from the
+      # snap in a step below. Without this we get the GitHub-controlled latest
+      # version of go.
+      PATH: /snap/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
+      GOROOT: ""
+      # XXX: compat env for "check-pr-title.py" in "run-checks", can go
+      #      once we switch away from that. Note that we cannot currently
+      #      use a github action check (like deepakputhraya/action-pr-title)
+      #      because an update of the PR title in the github UI is not visible
+      #      to the github action.
+      TRAVIS_PULL_REQUEST: ${{ github.event.number }}
+    strategy:
+      # we cache successful runs so it's fine to keep going
+      fail-fast: false      
+      matrix:
+        gochannel:
+          - 1.9
+          - latest/stable
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+      with:
+        # NOTE: checkout the code in a fixed location, even for forks, as this
+        # is relevant for go's import system.
+        path: ./src/github.com/snapcore/snapd
+
+    - name: Cache Debian dependencies
+      id: cache-deb-downloads
+      uses: actions/cache@v1
+      with:
+        path: /var/cache/apt
+        key: var-cache-apt-{{ hashFiles('**/debian/control') }}
+    - name: Run "apt update"
+      run: |
+          sudo apt update
+    - name: Download Debian dependencies
+      if: steps.cache-deb-downloads.outputs.cache-hit != 'true'
+      run: |
+          sudo apt clean
+          sudo apt build-dep -d -y ${{ github.workspace }}/src/github.com/snapcore/snapd
+
+    - name: Cache snapd test results
+      id: cache-snapd-test-results
+      uses: actions/cache@v1
+      with:
+        path: "${{ github.workspace }}/.test-results"
+        # must include matrix or things get racy, i.e. when latest/edge
+        # finishes after 1.9 it overrides the results from 1.9
+        key: "${{ github.run_id }}-${{ github.job }}-${{ matrix.gochannel }}-results"
+    - name: Check cached test results
+      id: cached-results
+      run: |
+          CACHE_RESULT_STAMP="${{ github.workspace }}/.test-results/${{ matrix.gochannel }}-success"
+          echo "CACHE_RESULT_STAMP=$CACHE_RESULT_STAMP" >> $GITHUB_ENV
+          if [ -e "$CACHE_RESULT_STAMP" ]; then
+              echo "::set-output name=already-ran::true"
+          fi
+    - name: Install Debian dependencies
+      if: steps.cached-results.outputs.cached-resulsts != 'true'
+      run: |
+          sudo apt build-dep -y ${{ github.workspace }}/src/github.com/snapcore/snapd
+    # golang latest ensures things work on the edge
+    - name: Install the go snap
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+          sudo snap install --classic --channel=${{ matrix.gochannel }} go
+    - name: Install ShellCheck as a snap
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+          sudo apt-get remove --purge shellcheck
+          sudo snap install shellcheck
+    - name: Install govendor
+      run: go get -u github.com/kardianos/govendor
+    - name: Cache Go dependencies
+      id: cache-go-govendor
+      uses: actions/cache@v1
+      with:
+        path: ${{ github.workspace }}/.cache/govendor
+        key: go-govendor-{{ hashFiles('**/vendor.json') }}
+    - name: Get Go dependencies
+      run: cd ${{ github.workspace }}/src/github.com/snapcore/snapd && ${{ github.workspace }}/bin/govendor sync
+    - name: Run static checks
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+          cd ${{ github.workspace }}/src/github.com/snapcore/snapd || exit 1
+          # run gofmt checks only with Go 1.9 and 1.10
+          if ! echo "${{ matrix.gochannel }}" | grep -E '1\.(9|10)' ; then
+              # and skip with other versions
+              export SKIP_GOFMT=1
+              echo "Formatting checks will be skipped due to the use of Go version ${{ matrix.gochannel }}"
+          fi
+          ./run-checks --static
+    - name: Build C
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+          cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/
+          ./autogen.sh
+          make -j2
+    - name: Build Go
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+          go build github.com/snapcore/snapd/...
+    - name: Test C
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+          cd ${{ github.workspace }}/src/github.com/snapcore/snapd/cmd/ && make check
+    - name: Test Go
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+        cd ${{ github.workspace }}/src/github.com/snapcore/snapd || exit 1
+        ./run-checks --unit
+    - name: Test Go (nosecboot)
+      if: steps.cached-results.outputs.already-ran != 'true'
+      run: |
+        cd ${{ github.workspace }}/src/github.com/snapcore/snapd || exit 1
+        echo "Dropping github.com/snapcore/secboot"
+        # use govendor remove so that a subsequent govendor sync does not
+        # install secboot again
+        ${{ github.workspace }}/bin/govendor remove github.com/snapcore/secboot
+        ${{ github.workspace }}/bin/govendor remove +unused
+        SKIP_DIRTY_CHECK=1 GO_BUILD_TAGS=nosecboot ./run-checks --unit
+    - name: Cache successful run
+      run: |
+        mkdir -p $(dirname "$CACHE_RESULT_STAMP")
+        touch "$CACHE_RESULT_STAMP"
+
+  spread:
+    needs: [unit-tests]
+    runs-on: self-hosted
+    strategy:
+      # FIXME: enable fail-fast mode once spread can cancel an executing job.
+      # Disable fail-fast mode as it doesn't function with spread. It seems
+      # that cancelling tasks requires short, interruptible actions and
+      # interrupting spread, notably, does not work today. As such disable
+      # fail-fast while we tackle that problem upstream.
+      fail-fast: false
+      matrix:
+        system:
+        - amazon-linux-2-64
+        - arch-linux-64
+        - centos-7-64
+        - centos-8-64
+        - debian-9-64
+        - debian-sid-64
+        - fedora-31-64
+        - fedora-32-64
+        - opensuse-15.1-64
+        - opensuse-15.2-64
+        - opensuse-tumbleweed-64
+        - ubuntu-14.04-64
+        - ubuntu-16.04-32
+        - ubuntu-16.04-64
+        - ubuntu-18.04-64
+        - ubuntu-20.04-64
+        - ubuntu-20.10-64
+        - ubuntu-core-16-64
+        - ubuntu-core-18-64
+        - ubuntu-core-20-64
+        - ubuntu-secboot-20.04-64
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: Cache snapd test results
+      id: cache-snapd-test-results
+      uses: actions/cache@v1
+      with:
+        path: "${{ github.workspace }}/.test-results"
+        key: "${{ github.run_id }}-${{ github.job }}-${{ matrix.system }}-results"
+    - name: Check cached test results
+      id: cached-results
+      run: |
+          CACHE_RESULT_STAMP="${{ github.workspace }}/.test-results/${{ matrix.system }}-success"
+          echo "CACHE_RESULT_STAMP=$CACHE_RESULT_STAMP" >> $GITHUB_ENV
+          if [ -e "$CACHE_RESULT_STAMP" ]; then
+              echo "::set-output name=already-ran::true"
+          fi
+    - name: Run spread tests
+      if: "!contains(github.event.pull_request.labels.*.name, 'Skip spread') && steps.cached-results.outputs.already-ran != 'true'"
+      env:
+          SPREAD_GOOGLE_KEY: ${{ secrets.SPREAD_GOOGLE_KEY }}
+      run: |
+          # Register a problem matcher to highlight spread failures
+          echo "::add-matcher::.github/spread-problem-matcher.json"
+          spread -abend google:${{ matrix.system }}:tests/...
+    - name: Cache successful run
+      run: |
+        mkdir -p $(dirname "$CACHE_RESULT_STAMP")
+        touch "$CACHE_RESULT_STAMP"
+    - name: Discard spread workers
+      if: always()
+      run: |
+        shopt -s nullglob;
+        for r in .spread-reuse.*.yaml; do
+          spread -discard -reuse-pid="$(echo "$r" | grep -o -E '[0-9]+')";
+        done
+
+  spread-nested:
+    needs: [unit-tests]
+    runs-on: self-hosted
+    strategy:
+      # FIXME: enable fail-fast mode once spread can cancel an executing job.
+      # Disable fail-fast mode as it doesn't function with spread. It seems
+      # that cancelling tasks requires short, interruptible actions and
+      # interrupting spread, notably, does not work today. As such disable
+      # fail-fast while we tackle that problem upstream.
+      fail-fast: false
+      matrix:
+        system:
+        - ubuntu-16.04-64
+        - ubuntu-18.04-64
+        - ubuntu-20.04-64
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: Cache snapd test results
+      id: cache-snapd-test-results
+      uses: actions/cache@v1
+      with:
+        path: "${{ github.workspace }}/.test-results"
+        key: "${{ github.run_id }}-${{ github.job }}-${{ matrix.system }}-nested-results"
+    - name: Check cached test results
+      id: cached-results
+      run: |
+          CACHE_RESULT_STAMP="${{ github.workspace }}/.test-results/${{ matrix.system }}-nested-success"
+          echo "CACHE_RESULT_STAMP=$CACHE_RESULT_STAMP" >> $GITHUB_ENV
+          if [ -e "$CACHE_RESULT_STAMP" ]; then
+              echo "::set-output name=already-ran::true"
+          fi
+    - name: Run spread tests
+      # run if the commit is pushed to the release/* branch or there is a 'Run
+      # nested' label set on the PR
+      if: "(contains(github.event.pull_request.labels.*.name, 'Run nested') || contains(github.ref, 'refs/heads/release/')) && steps.cached-results.outputs.already-ran != 'true'"
+      env:
+          SPREAD_GOOGLE_KEY: ${{ secrets.SPREAD_GOOGLE_KEY }}
+      run: |
+          # Register a problem matcher to highlight spread failures
+          echo "::add-matcher::.github/spread-problem-matcher.json"
+          export NESTED_BUILD_SNAPD_FROM_CURRENT=true
+          export NESTED_ENABLE_KVM=true
+          spread -abend google-nested:${{ matrix.system }}:tests/nested/...
+    - name: Cache successful run
+      run: |
+        mkdir -p $(dirname "$CACHE_RESULT_STAMP")
+        touch "$CACHE_RESULT_STAMP"
+    - name: Discard spread workers
+      if: always()
+      run: |
+        shopt -s nullglob;
+        for r in .spread-reuse.*.yaml; do
+          spread -discard -reuse-pid="$(echo "$r" | grep -o -E '[0-9]+')";
+        done
diff -Nru snapd-2.45.1+20.04.2/HACKING.md snapd-2.48.3+20.04/HACKING.md
--- snapd-2.45.1+20.04.2/HACKING.md	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/HACKING.md	2021-02-02 08:21:12.000000000 +0000
@@ -222,10 +222,55 @@
 you are testing. To do this, simply backup /usr/lib/snapd/snap-seccomp and overwrite it with 
 the testing one. Don't forget to rollback to the original when finish testing)
 
+### Running nested tests
+
+Nested tests are used to validate features which cannot be tested on regular tests.
+
+The nested test suites work different from the other test suites in snapd. In this case each test runs in a new image
+which is created following the rules defined for the test.
+
+The nested tests are executed using spread tool. See the following examples using the qemu and google backends.
+
+    . `qemu: spread qemu-nested:ubuntu-20.04-64:tests/nested/core20/tpm`
+    . `google: spread google-nested:ubuntu-20.04-64:tests/nested/core20/tpm`
+
+The nested system in all the cases is selected based on the host system. The folloing lines show the relation between host and nested systemd (same applies for classic nested tests):
+
+    . ubuntu-16.04-64 => ubuntu-core-16-64
+    . ubuntu-18.04-64 => ubuntu-core-18-64
+    . ubuntu-20.04-64 => ubuntu-core-20-64
+
+The tools used for creating and hosting the nested vms are:
+
+    . ubuntu-image snap is used to building the images
+    . QEMU is used for the virtualization (with kvm acceleration)
+
+Nested test suite is composed by the following 4 suites:
+
+    classic: the nested suite contains an image of a classic system downloaded from cloud-images.ubuntu.com 
+    core: it tests a core nested system and the images are generated by using ubuntu-image snap
+    core20: this is similar to core suite but tests on it are focused on UC20
+    manual: tests on this suite create a non generic image with spedific conditions
+
+The nested suites use some environment variables to configure the suite and the tests inside it, the most important ones are the described bellow:
+
+    NESTED_WORK_DIR: It is path to the directory where all the nested assets and images are stored
+    NESTED_TYPE: Use core for ubuntu core nested systems or classic instead.
+    NESTED_CORE_CHANNEL: The images are created using ubuntu-image snap, use it to define the default branch
+    NESTED_CORE_REFRESH_CHANNEL: The images can be refreshed to a specific channel, use it to specify the channel
+    NESTED_USE_CLOUD_INIT: Use cloud init to make initial system configuration instead of user assertion
+    NESTED_ENABLE_KVM: Enable kvm in the qemu command line
+    NESTED_ENABLE_TPM: re boot in the nested vm in case it is supported (just supported on UC20)
+    NESTED_ENABLE_SECURE_BOOT: Enable secure boot in the nested vm in case it is supported (just supported on UC20)
+    NESTED_BUILD_SNAPD_FROM_CURRENT: Build and use either core or snapd snapd from current branch
+    NESTED_CUSTOM_IMAGE_URL: Download and use an custom image from this url
+
+
 # Quick intro to hacking on snap-confine
 
 Hey, welcome to the nice, low-level world of snap-confine
 
+
 ## Building the code locally
 
 To get started from a pristine tree you want to do this:
diff -Nru snapd-2.45.1+20.04.2/httputil/retry.go snapd-2.48.3+20.04/httputil/retry.go
--- snapd-2.45.1+20.04.2/httputil/retry.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/httputil/retry.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,11 +36,11 @@
 	"github.com/snapcore/snapd/osutil"
 )
 
-type PerstistentNetworkError struct {
+type PersistentNetworkError struct {
 	Err error
 }
 
-func (e *PerstistentNetworkError) Error() string {
+func (e *PersistentNetworkError) Error() string {
 	return fmt.Sprintf("persistent network error: %v", e.Err)
 }
 
@@ -264,7 +264,7 @@
 			}
 
 			if isNetworkDown(err) || isDnsUnavailable(err) {
-				err = &PerstistentNetworkError{Err: err}
+				err = &PersistentNetworkError{Err: err}
 			}
 			break
 		}
diff -Nru snapd-2.45.1+20.04.2/i18n/xgettext-go/main.go snapd-2.48.3+20.04/i18n/xgettext-go/main.go
--- snapd-2.45.1+20.04.2/i18n/xgettext-go/main.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/i18n/xgettext-go/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -10,6 +10,7 @@
 	"io/ioutil"
 	"log"
 	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 	"time"
@@ -170,8 +171,26 @@
 	return nil
 }
 
+func readContent(fname string) (content []byte, err error) {
+	// If no search directories have been specified or we have an
+	// absolute path, just try to read the contents directly.
+	if len(opts.Directories) == 0 || filepath.IsAbs(fname) {
+		return ioutil.ReadFile(fname)
+	}
+
+	// Otherwise, search for the file in each of the configured
+	// directories.
+	for _, dir := range opts.Directories {
+		content, err = ioutil.ReadFile(filepath.Join(dir, fname))
+		if !os.IsNotExist(err) {
+			break
+		}
+	}
+	return content, err
+}
+
 func processSingleGoSource(fset *token.FileSet, fname string) error {
-	fnameContent, err := ioutil.ReadFile(fname)
+	fnameContent, err := readContent(fname)
 	if err != nil {
 		return err
 	}
@@ -277,6 +296,8 @@
 var opts struct {
 	FilesFrom string `short:"f" long:"files-from" description:"get list of input files from FILE"`
 
+	Directories []string `short:"D" long:"directory" description:"add DIRECTORY to list for input files search"`
+
 	Output string `short:"o" long:"output" description:"output to specified file"`
 
 	AddComments bool `short:"c" long:"add-comments" description:"place all comment blocks preceding keyword lines in output file"`
diff -Nru snapd-2.45.1+20.04.2/image/helpers.go snapd-2.48.3+20.04/image/helpers.go
--- snapd-2.45.1+20.04.2/image/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/image/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -53,7 +53,7 @@
 
 // A Store can find metadata on snaps, download snaps and fetch assertions.
 type Store interface {
-	SnapAction(context.Context, []*store.CurrentSnap, []*store.SnapAction, *auth.UserState, *store.RefreshOptions) ([]store.SnapActionResult, error)
+	SnapAction(context.Context, []*store.CurrentSnap, []*store.SnapAction, store.AssertionQuery, *auth.UserState, *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error)
 	Download(ctx context.Context, name, targetFn string, downloadInfo *snap.DownloadInfo, pbar progress.Meter, user *auth.UserState, dlOpts *store.DownloadOptions) error
 
 	Assertion(assertType *asserts.AssertionType, primaryKey []string, user *auth.UserState) (asserts.Assertion, error)
@@ -294,7 +294,7 @@
 		Channel:      opts.Channel,
 	}}
 
-	sars, err := sto.SnapAction(context.TODO(), nil, actions, tsto.user, nil)
+	sars, _, err := sto.SnapAction(context.TODO(), nil, actions, nil, tsto.user, nil)
 	if err != nil {
 		// err will be 'cannot download snap "foo": <reasons>'
 		return "", nil, "", err
diff -Nru snapd-2.45.1+20.04.2/image/helpers_test.go snapd-2.48.3+20.04/image/helpers_test.go
--- snapd-2.45.1+20.04.2/image/helpers_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/image/helpers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -116,7 +116,7 @@
 
 	s.setupSnaps(c, map[string]string{
 		"core": "canonical",
-	})
+	}, "")
 
 	dlDir := c.MkDir()
 	opts := image.DownloadOptions{
diff -Nru snapd-2.45.1+20.04.2/image/image_darwin.go snapd-2.48.3+20.04/image/image_darwin.go
--- snapd-2.45.1+20.04.2/image/image_darwin.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/image/image_darwin.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,28 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package image
+
+import (
+	"github.com/snapcore/snapd/osutil"
+)
+
+func Prepare(opts *Options) error {
+	return osutil.ErrDarwin
+}
diff -Nru snapd-2.45.1+20.04.2/image/image.go snapd-2.48.3+20.04/image/image.go
--- snapd-2.45.1+20.04.2/image/image.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/image/image.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,441 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2014-2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package image
-
-import (
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/asserts/sysdb"
-	"github.com/snapcore/snapd/boot"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/release"
-	"github.com/snapcore/snapd/seed/seedwriter"
-	"github.com/snapcore/snapd/snap"
-	"github.com/snapcore/snapd/snap/snapfile"
-	"github.com/snapcore/snapd/snap/squashfs"
-	"github.com/snapcore/snapd/strutil"
-)
-
-var (
-	Stdout io.Writer = os.Stdout
-	Stderr io.Writer = os.Stderr
-)
-
-type Options struct {
-	ModelFile string
-	Classic   bool
-
-	Channel string
-
-	// TODO: use OptionsSnap directly here?
-	Snaps        []string
-	SnapChannels map[string]string
-
-	PrepareDir string
-
-	// Architecture to use if none is specified by the model,
-	// useful only for classic mode. If set must match the model otherwise.
-	Architecture string
-}
-
-// classicHasSnaps returns whether the model or options specify any snaps for the classic case
-func classicHasSnaps(model *asserts.Model, opts *Options) bool {
-	return model.Gadget() != "" || len(model.RequiredNoEssentialSnaps()) != 0 || len(opts.Snaps) != 0
-}
-
-func Prepare(opts *Options) error {
-	model, err := decodeModelAssertion(opts)
-	if err != nil {
-		return err
-	}
-
-	if model.Architecture() != "" && opts.Architecture != "" && model.Architecture() != opts.Architecture {
-		return fmt.Errorf("cannot override model architecture: %s", model.Architecture())
-	}
-
-	if !opts.Classic {
-		if model.Classic() {
-			return fmt.Errorf("--classic mode is required to prepare the image for a classic model")
-		}
-	} else {
-		if !model.Classic() {
-			return fmt.Errorf("cannot prepare the image for a core model with --classic mode specified")
-		}
-		if model.Architecture() == "" && classicHasSnaps(model, opts) && opts.Architecture == "" {
-			return fmt.Errorf("cannot have snaps for a classic image without an architecture in the model or from --arch")
-		}
-	}
-
-	tsto, err := NewToolingStoreFromModel(model, opts.Architecture)
-	if err != nil {
-		return err
-	}
-
-	// FIXME: limitation until we can pass series parametrized much more
-	if model.Series() != release.Series {
-		return fmt.Errorf("model with series %q != %q unsupported", model.Series(), release.Series)
-	}
-
-	return setupSeed(tsto, model, opts)
-}
-
-// these are postponed, not implemented or abandoned, not finalized,
-// don't let them sneak in into a used model assertion
-var reserved = []string{"core", "os", "class", "allowed-modes"}
-
-func decodeModelAssertion(opts *Options) (*asserts.Model, error) {
-	fn := opts.ModelFile
-
-	rawAssert, err := ioutil.ReadFile(fn)
-	if err != nil {
-		return nil, fmt.Errorf("cannot read model assertion: %s", err)
-	}
-
-	ass, err := asserts.Decode(rawAssert)
-	if err != nil {
-		return nil, fmt.Errorf("cannot decode model assertion %q: %s", fn, err)
-	}
-	modela, ok := ass.(*asserts.Model)
-	if !ok {
-		return nil, fmt.Errorf("assertion in %q is not a model assertion", fn)
-	}
-
-	for _, rsvd := range reserved {
-		if modela.Header(rsvd) != nil {
-			return nil, fmt.Errorf("model assertion cannot have reserved/unsupported header %q set", rsvd)
-		}
-	}
-
-	return modela, nil
-}
-
-func unpackGadget(gadgetFname, gadgetUnpackDir string) error {
-	// FIXME: jumping through layers here, we need to make
-	//        unpack part of the container interface (again)
-	snap := squashfs.New(gadgetFname)
-	return snap.Unpack("*", gadgetUnpackDir)
-}
-
-func installCloudConfig(rootDir, gadgetDir string) error {
-	cloudConfig := filepath.Join(gadgetDir, "cloud.conf")
-	if !osutil.FileExists(cloudConfig) {
-		return nil
-	}
-
-	cloudDir := filepath.Join(rootDir, "/etc/cloud")
-	if err := os.MkdirAll(cloudDir, 0755); err != nil {
-		return err
-	}
-	dst := filepath.Join(cloudDir, "cloud.cfg")
-	return osutil.CopyFile(cloudConfig, dst, osutil.CopyFlagOverwrite)
-}
-
-var trusted = sysdb.Trusted()
-
-func MockTrusted(mockTrusted []asserts.Assertion) (restore func()) {
-	prevTrusted := trusted
-	trusted = mockTrusted
-	return func() {
-		trusted = prevTrusted
-	}
-}
-
-func makeLabel(now time.Time) string {
-	return now.UTC().Format("20060102")
-}
-
-func setupSeed(tsto *ToolingStore, model *asserts.Model, opts *Options) error {
-	if model.Classic() != opts.Classic {
-		return fmt.Errorf("internal error: classic model but classic mode not set")
-	}
-
-	core20 := model.Grade() != asserts.ModelGradeUnset
-	var rootDir string
-	var bootRootDir string
-	var seedDir string
-	var label string
-	if !core20 {
-		if opts.Classic {
-			// Classic, PrepareDir is the root dir itself
-			rootDir = opts.PrepareDir
-		} else {
-			// Core 16/18,  writing for the writeable partion
-			rootDir = filepath.Join(opts.PrepareDir, "image")
-			bootRootDir = rootDir
-		}
-		seedDir = dirs.SnapSeedDirUnder(rootDir)
-
-		// sanity check target
-		if osutil.FileExists(dirs.SnapStateFileUnder(rootDir)) {
-			return fmt.Errorf("cannot prepare seed over existing system or an already booted image, detected state file %s", dirs.SnapStateFileUnder(rootDir))
-		}
-		if snaps, _ := filepath.Glob(filepath.Join(dirs.SnapBlobDirUnder(rootDir), "*.snap")); len(snaps) > 0 {
-			return fmt.Errorf("expected empty snap dir in rootdir, got: %v", snaps)
-		}
-
-	} else {
-		// Core 20, writing for the system-seed partition
-		seedDir = filepath.Join(opts.PrepareDir, "system-seed")
-		label = makeLabel(time.Now())
-		bootRootDir = seedDir
-
-		// sanity check target
-		if systems, _ := filepath.Glob(filepath.Join(seedDir, "systems", "*")); len(systems) > 0 {
-			return fmt.Errorf("expected empty systems dir in system-seed, got: %v", systems)
-		}
-	}
-
-	// TODO: developer database in home or use snapd (but need
-	// a bit more API there, potential issues when crossing stores/series)
-	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
-		Backstore: asserts.NewMemoryBackstore(),
-		Trusted:   trusted,
-	})
-	if err != nil {
-		return err
-	}
-
-	wOpts := &seedwriter.Options{
-		SeedDir:        seedDir,
-		Label:          label,
-		DefaultChannel: opts.Channel,
-
-		TestSkipCopyUnverifiedModel: osutil.GetenvBool("UBUNTU_IMAGE_SKIP_COPY_UNVERIFIED_MODEL"),
-	}
-
-	w, err := seedwriter.New(model, wOpts)
-	if err != nil {
-		return err
-	}
-
-	optSnaps := make([]*seedwriter.OptionsSnap, 0, len(opts.Snaps))
-	for _, snapName := range opts.Snaps {
-		var optSnap seedwriter.OptionsSnap
-		if strings.HasSuffix(snapName, ".snap") {
-			// local
-			optSnap.Path = snapName
-		} else {
-			optSnap.Name = snapName
-		}
-		optSnap.Channel = opts.SnapChannels[snapName]
-		optSnaps = append(optSnaps, &optSnap)
-	}
-
-	if err := w.SetOptionsSnaps(optSnaps); err != nil {
-		return err
-	}
-
-	var gadgetUnpackDir string
-	// create directory for later unpacking the gadget in
-	if !opts.Classic {
-		gadgetUnpackDir = filepath.Join(opts.PrepareDir, "gadget")
-		if err := os.MkdirAll(gadgetUnpackDir, 0755); err != nil {
-			return fmt.Errorf("cannot create gadget unpack dir %q: %s", gadgetUnpackDir, err)
-		}
-	}
-
-	newFetcher := func(save func(asserts.Assertion) error) asserts.Fetcher {
-		return tsto.AssertionFetcher(db, save)
-	}
-	f, err := w.Start(db, newFetcher)
-	if err != nil {
-		return err
-	}
-
-	localSnaps, err := w.LocalSnaps()
-	if err != nil {
-		return err
-	}
-
-	for _, sn := range localSnaps {
-		si, aRefs, err := seedwriter.DeriveSideInfo(sn.Path, f, db)
-		if err != nil && !asserts.IsNotFound(err) {
-			return err
-		}
-
-		snapFile, err := snapfile.Open(sn.Path)
-		if err != nil {
-			return err
-		}
-		info, err := snap.ReadInfoFromSnapFile(snapFile, si)
-		if err != nil {
-			return err
-		}
-
-		if err := w.SetInfo(sn, info); err != nil {
-			return err
-		}
-		sn.ARefs = aRefs
-	}
-
-	if err := w.InfoDerived(); err != nil {
-		return err
-	}
-
-	for {
-		toDownload, err := w.SnapsToDownload()
-		if err != nil {
-			return err
-		}
-
-		for _, sn := range toDownload {
-			fmt.Fprintf(Stdout, "Fetching %s\n", sn.SnapName())
-
-			targetPathFunc := func(info *snap.Info) (string, error) {
-				if err := w.SetInfo(sn, info); err != nil {
-					return "", err
-				}
-				return sn.Path, nil
-			}
-
-			dlOpts := DownloadOptions{
-				TargetPathFunc: targetPathFunc,
-				Channel:        sn.Channel,
-			}
-			fn, info, redirectChannel, err := tsto.DownloadSnap(sn.SnapName(), dlOpts) // TODO|XXX make this take the SnapRef really
-			if err != nil {
-				return err
-			}
-			if err := w.SetRedirectChannel(sn, redirectChannel); err != nil {
-				return err
-			}
-
-			// fetch snap assertions
-			prev := len(f.Refs())
-			if _, err = FetchAndCheckSnapAssertions(fn, info, f, db); err != nil {
-				return err
-			}
-			aRefs := f.Refs()[prev:]
-			sn.ARefs = aRefs
-		}
-
-		complete, err := w.Downloaded()
-		if err != nil {
-			return err
-		}
-		if complete {
-			break
-		}
-	}
-
-	for _, warn := range w.Warnings() {
-		fmt.Fprintf(Stderr, "WARNING: %s\n", warn)
-	}
-
-	unassertedSnaps, err := w.UnassertedSnaps()
-	if err != nil {
-		return err
-	}
-	if len(unassertedSnaps) > 0 {
-		locals := make([]string, len(unassertedSnaps))
-		for i, sn := range unassertedSnaps {
-			locals[i] = sn.SnapName()
-		}
-		fmt.Fprintf(Stderr, "WARNING: %s installed from local snaps disconnected from a store cannot be refreshed subsequently!\n", strutil.Quoted(locals))
-	}
-
-	copySnap := func(name, src, dst string) error {
-		fmt.Fprintf(Stdout, "Copying %q (%s)\n", src, name)
-		return osutil.CopyFile(src, dst, 0)
-	}
-	if err := w.SeedSnaps(copySnap); err != nil {
-		return err
-	}
-
-	if err := w.WriteMeta(); err != nil {
-		return err
-	}
-
-	if opts.Classic {
-		// TODO:UC20: consider Core 20 extended models vs classic
-		seedFn := filepath.Join(seedDir, "seed.yaml")
-		// warn about ownership if not root:root
-		fi, err := os.Stat(seedFn)
-		if err != nil {
-			return fmt.Errorf("cannot stat seed.yaml: %s", err)
-		}
-		if st, ok := fi.Sys().(*syscall.Stat_t); ok {
-			if st.Uid != 0 || st.Gid != 0 {
-				fmt.Fprintf(Stderr, "WARNING: ensure that the contents under %s are owned by root:root in the (final) image", seedDir)
-			}
-		}
-		// done already
-		return nil
-	}
-
-	bootSnaps, err := w.BootSnaps()
-	if err != nil {
-		return err
-	}
-
-	bootWith := &boot.BootableSet{
-		UnpackedGadgetDir: gadgetUnpackDir,
-		Recovery:          core20,
-	}
-	if label != "" {
-		bootWith.RecoverySystemDir = filepath.Join("/systems/", label)
-		bootWith.RecoverySystemLabel = label
-	}
-
-	// find the gadget file
-	// find the snap.Info/path for kernel/os/base so
-	// that boot.MakeBootable can DTRT
-	gadgetFname := ""
-	for _, sn := range bootSnaps {
-		switch sn.Info.GetType() {
-		case snap.TypeGadget:
-			gadgetFname = sn.Path
-		case snap.TypeOS, snap.TypeBase:
-			bootWith.Base = sn.Info
-			bootWith.BasePath = sn.Path
-		case snap.TypeKernel:
-			bootWith.Kernel = sn.Info
-			bootWith.KernelPath = sn.Path
-		}
-	}
-
-	// unpacking the gadget for core models
-	if err := unpackGadget(gadgetFname, gadgetUnpackDir); err != nil {
-		return err
-	}
-
-	if err := boot.MakeBootable(model, bootRootDir, bootWith); err != nil {
-		return err
-	}
-
-	// cloud-init config (done at install for Core 20)
-	if !core20 {
-		// and the cloud-init things
-		if err := installCloudConfig(rootDir, gadgetUnpackDir); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/image/image_linux.go snapd-2.48.3+20.04/image/image_linux.go
--- snapd-2.45.1+20.04.2/image/image_linux.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/image/image_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,445 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package image
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	// to set sysconfig.ApplyFilesystemOnlyDefaults hook
+	_ "github.com/snapcore/snapd/overlord/configstate/configcore"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/sysdb"
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/seed/seedwriter"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snapfile"
+	"github.com/snapcore/snapd/snap/squashfs"
+	"github.com/snapcore/snapd/strutil"
+	"github.com/snapcore/snapd/sysconfig"
+)
+
+var (
+	Stdout io.Writer = os.Stdout
+	Stderr io.Writer = os.Stderr
+)
+
+// classicHasSnaps returns whether the model or options specify any snaps for the classic case
+func classicHasSnaps(model *asserts.Model, opts *Options) bool {
+	return model.Gadget() != "" || len(model.RequiredNoEssentialSnaps()) != 0 || len(opts.Snaps) != 0
+}
+
+func Prepare(opts *Options) error {
+	model, err := decodeModelAssertion(opts)
+	if err != nil {
+		return err
+	}
+
+	if model.Architecture() != "" && opts.Architecture != "" && model.Architecture() != opts.Architecture {
+		return fmt.Errorf("cannot override model architecture: %s", model.Architecture())
+	}
+
+	if !opts.Classic {
+		if model.Classic() {
+			return fmt.Errorf("--classic mode is required to prepare the image for a classic model")
+		}
+	} else {
+		if !model.Classic() {
+			return fmt.Errorf("cannot prepare the image for a core model with --classic mode specified")
+		}
+		if model.Architecture() == "" && classicHasSnaps(model, opts) && opts.Architecture == "" {
+			return fmt.Errorf("cannot have snaps for a classic image without an architecture in the model or from --arch")
+		}
+	}
+
+	tsto, err := NewToolingStoreFromModel(model, opts.Architecture)
+	if err != nil {
+		return err
+	}
+
+	// FIXME: limitation until we can pass series parametrized much more
+	if model.Series() != release.Series {
+		return fmt.Errorf("model with series %q != %q unsupported", model.Series(), release.Series)
+	}
+
+	return setupSeed(tsto, model, opts)
+}
+
+// these are postponed, not implemented or abandoned, not finalized,
+// don't let them sneak in into a used model assertion
+var reserved = []string{"core", "os", "class", "allowed-modes"}
+
+func decodeModelAssertion(opts *Options) (*asserts.Model, error) {
+	fn := opts.ModelFile
+
+	rawAssert, err := ioutil.ReadFile(fn)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read model assertion: %s", err)
+	}
+
+	ass, err := asserts.Decode(rawAssert)
+	if err != nil {
+		return nil, fmt.Errorf("cannot decode model assertion %q: %s", fn, err)
+	}
+	modela, ok := ass.(*asserts.Model)
+	if !ok {
+		return nil, fmt.Errorf("assertion in %q is not a model assertion", fn)
+	}
+
+	for _, rsvd := range reserved {
+		if modela.Header(rsvd) != nil {
+			return nil, fmt.Errorf("model assertion cannot have reserved/unsupported header %q set", rsvd)
+		}
+	}
+
+	return modela, nil
+}
+
+func unpackGadget(gadgetFname, gadgetUnpackDir string) error {
+	// FIXME: jumping through layers here, we need to make
+	//        unpack part of the container interface (again)
+	snap := squashfs.New(gadgetFname)
+	return snap.Unpack("*", gadgetUnpackDir)
+}
+
+func installCloudConfig(rootDir, gadgetDir string) error {
+	cloudConfig := filepath.Join(gadgetDir, "cloud.conf")
+	if !osutil.FileExists(cloudConfig) {
+		return nil
+	}
+
+	cloudDir := filepath.Join(rootDir, "/etc/cloud")
+	if err := os.MkdirAll(cloudDir, 0755); err != nil {
+		return err
+	}
+	dst := filepath.Join(cloudDir, "cloud.cfg")
+	return osutil.CopyFile(cloudConfig, dst, osutil.CopyFlagOverwrite)
+}
+
+var trusted = sysdb.Trusted()
+
+func MockTrusted(mockTrusted []asserts.Assertion) (restore func()) {
+	prevTrusted := trusted
+	trusted = mockTrusted
+	return func() {
+		trusted = prevTrusted
+	}
+}
+
+func makeLabel(now time.Time) string {
+	return now.UTC().Format("20060102")
+}
+
+func setupSeed(tsto *ToolingStore, model *asserts.Model, opts *Options) error {
+	if model.Classic() != opts.Classic {
+		return fmt.Errorf("internal error: classic model but classic mode not set")
+	}
+
+	core20 := model.Grade() != asserts.ModelGradeUnset
+	var rootDir string
+	var bootRootDir string
+	var seedDir string
+	var label string
+	if !core20 {
+		if opts.Classic {
+			// Classic, PrepareDir is the root dir itself
+			rootDir = opts.PrepareDir
+		} else {
+			// Core 16/18,  writing for the writeable partition
+			rootDir = filepath.Join(opts.PrepareDir, "image")
+			bootRootDir = rootDir
+		}
+		seedDir = dirs.SnapSeedDirUnder(rootDir)
+
+		// sanity check target
+		if osutil.FileExists(dirs.SnapStateFileUnder(rootDir)) {
+			return fmt.Errorf("cannot prepare seed over existing system or an already booted image, detected state file %s", dirs.SnapStateFileUnder(rootDir))
+		}
+		if snaps, _ := filepath.Glob(filepath.Join(dirs.SnapBlobDirUnder(rootDir), "*.snap")); len(snaps) > 0 {
+			return fmt.Errorf("expected empty snap dir in rootdir, got: %v", snaps)
+		}
+
+	} else {
+		// Core 20, writing for the system-seed partition
+		seedDir = filepath.Join(opts.PrepareDir, "system-seed")
+		label = makeLabel(time.Now())
+		bootRootDir = seedDir
+
+		// sanity check target
+		if systems, _ := filepath.Glob(filepath.Join(seedDir, "systems", "*")); len(systems) > 0 {
+			return fmt.Errorf("expected empty systems dir in system-seed, got: %v", systems)
+		}
+	}
+
+	// TODO: developer database in home or use snapd (but need
+	// a bit more API there, potential issues when crossing stores/series)
+	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
+		Backstore: asserts.NewMemoryBackstore(),
+		Trusted:   trusted,
+	})
+	if err != nil {
+		return err
+	}
+
+	wOpts := &seedwriter.Options{
+		SeedDir:        seedDir,
+		Label:          label,
+		DefaultChannel: opts.Channel,
+
+		TestSkipCopyUnverifiedModel: osutil.GetenvBool("UBUNTU_IMAGE_SKIP_COPY_UNVERIFIED_MODEL"),
+	}
+
+	w, err := seedwriter.New(model, wOpts)
+	if err != nil {
+		return err
+	}
+
+	optSnaps := make([]*seedwriter.OptionsSnap, 0, len(opts.Snaps))
+	for _, snapName := range opts.Snaps {
+		var optSnap seedwriter.OptionsSnap
+		if strings.HasSuffix(snapName, ".snap") {
+			// local
+			optSnap.Path = snapName
+		} else {
+			optSnap.Name = snapName
+		}
+		optSnap.Channel = opts.SnapChannels[snapName]
+		optSnaps = append(optSnaps, &optSnap)
+	}
+
+	if err := w.SetOptionsSnaps(optSnaps); err != nil {
+		return err
+	}
+
+	var gadgetUnpackDir string
+	// create directory for later unpacking the gadget in
+	if !opts.Classic {
+		gadgetUnpackDir = filepath.Join(opts.PrepareDir, "gadget")
+		if err := os.MkdirAll(gadgetUnpackDir, 0755); err != nil {
+			return fmt.Errorf("cannot create gadget unpack dir %q: %s", gadgetUnpackDir, err)
+		}
+	}
+
+	newFetcher := func(save func(asserts.Assertion) error) asserts.Fetcher {
+		return tsto.AssertionFetcher(db, save)
+	}
+	f, err := w.Start(db, newFetcher)
+	if err != nil {
+		return err
+	}
+
+	localSnaps, err := w.LocalSnaps()
+	if err != nil {
+		return err
+	}
+
+	for _, sn := range localSnaps {
+		si, aRefs, err := seedwriter.DeriveSideInfo(sn.Path, f, db)
+		if err != nil && !asserts.IsNotFound(err) {
+			return err
+		}
+
+		snapFile, err := snapfile.Open(sn.Path)
+		if err != nil {
+			return err
+		}
+		info, err := snap.ReadInfoFromSnapFile(snapFile, si)
+		if err != nil {
+			return err
+		}
+
+		if err := w.SetInfo(sn, info); err != nil {
+			return err
+		}
+		sn.ARefs = aRefs
+	}
+
+	if err := w.InfoDerived(); err != nil {
+		return err
+	}
+
+	for {
+		toDownload, err := w.SnapsToDownload()
+		if err != nil {
+			return err
+		}
+
+		for _, sn := range toDownload {
+			fmt.Fprintf(Stdout, "Fetching %s\n", sn.SnapName())
+
+			targetPathFunc := func(info *snap.Info) (string, error) {
+				if err := w.SetInfo(sn, info); err != nil {
+					return "", err
+				}
+				return sn.Path, nil
+			}
+
+			dlOpts := DownloadOptions{
+				TargetPathFunc: targetPathFunc,
+				Channel:        sn.Channel,
+				CohortKey:      opts.WideCohortKey,
+			}
+			fn, info, redirectChannel, err := tsto.DownloadSnap(sn.SnapName(), dlOpts) // TODO|XXX make this take the SnapRef really
+			if err != nil {
+				return err
+			}
+			if err := w.SetRedirectChannel(sn, redirectChannel); err != nil {
+				return err
+			}
+
+			// fetch snap assertions
+			prev := len(f.Refs())
+			if _, err = FetchAndCheckSnapAssertions(fn, info, f, db); err != nil {
+				return err
+			}
+			aRefs := f.Refs()[prev:]
+			sn.ARefs = aRefs
+		}
+
+		complete, err := w.Downloaded()
+		if err != nil {
+			return err
+		}
+		if complete {
+			break
+		}
+	}
+
+	for _, warn := range w.Warnings() {
+		fmt.Fprintf(Stderr, "WARNING: %s\n", warn)
+	}
+
+	unassertedSnaps, err := w.UnassertedSnaps()
+	if err != nil {
+		return err
+	}
+	if len(unassertedSnaps) > 0 {
+		locals := make([]string, len(unassertedSnaps))
+		for i, sn := range unassertedSnaps {
+			locals[i] = sn.SnapName()
+		}
+		fmt.Fprintf(Stderr, "WARNING: %s installed from local snaps disconnected from a store cannot be refreshed subsequently!\n", strutil.Quoted(locals))
+	}
+
+	copySnap := func(name, src, dst string) error {
+		fmt.Fprintf(Stdout, "Copying %q (%s)\n", src, name)
+		return osutil.CopyFile(src, dst, 0)
+	}
+	if err := w.SeedSnaps(copySnap); err != nil {
+		return err
+	}
+
+	if err := w.WriteMeta(); err != nil {
+		return err
+	}
+
+	if opts.Classic {
+		// TODO:UC20: consider Core 20 extended models vs classic
+		seedFn := filepath.Join(seedDir, "seed.yaml")
+		// warn about ownership if not root:root
+		fi, err := os.Stat(seedFn)
+		if err != nil {
+			return fmt.Errorf("cannot stat seed.yaml: %s", err)
+		}
+		if st, ok := fi.Sys().(*syscall.Stat_t); ok {
+			if st.Uid != 0 || st.Gid != 0 {
+				fmt.Fprintf(Stderr, "WARNING: ensure that the contents under %s are owned by root:root in the (final) image", seedDir)
+			}
+		}
+		// done already
+		return nil
+	}
+
+	bootSnaps, err := w.BootSnaps()
+	if err != nil {
+		return err
+	}
+
+	bootWith := &boot.BootableSet{
+		UnpackedGadgetDir: gadgetUnpackDir,
+		Recovery:          core20,
+	}
+	if label != "" {
+		bootWith.RecoverySystemDir = filepath.Join("/systems/", label)
+		bootWith.RecoverySystemLabel = label
+	}
+
+	// find the gadget file
+	// find the snap.Info/path for kernel/os/base so
+	// that boot.MakeBootable can DTRT
+	gadgetFname := ""
+	for _, sn := range bootSnaps {
+		switch sn.Info.Type() {
+		case snap.TypeGadget:
+			gadgetFname = sn.Path
+		case snap.TypeOS, snap.TypeBase:
+			bootWith.Base = sn.Info
+			bootWith.BasePath = sn.Path
+		case snap.TypeKernel:
+			bootWith.Kernel = sn.Info
+			bootWith.KernelPath = sn.Path
+		}
+	}
+
+	// unpacking the gadget for core models
+	if err := unpackGadget(gadgetFname, gadgetUnpackDir); err != nil {
+		return err
+	}
+
+	if err := boot.MakeBootable(model, bootRootDir, bootWith, nil); err != nil {
+		return err
+	}
+
+	// early config & cloud-init config (done at install for Core 20)
+	if !core20 {
+		// and the cloud-init things
+		if err := installCloudConfig(rootDir, gadgetUnpackDir); err != nil {
+			return err
+		}
+
+		gadgetInfo, err := gadget.ReadInfo(gadgetUnpackDir, model)
+		if err != nil {
+			return err
+		}
+
+		defaultsDir := sysconfig.WritableDefaultsDir(rootDir)
+		defaults := gadget.SystemDefaults(gadgetInfo.Defaults)
+		if len(defaults) > 0 {
+			if err := os.MkdirAll(sysconfig.WritableDefaultsDir(rootDir, "/etc"), 0755); err != nil {
+				return err
+			}
+			applyOpts := &sysconfig.FilesystemOnlyApplyOptions{Classic: opts.Classic}
+			return sysconfig.ApplyFilesystemOnlyDefaults(defaultsDir, defaults, applyOpts)
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/image/image_test.go snapd-2.48.3+20.04/image/image_test.go
--- snapd-2.45.1+20.04.2/image/image_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/image/image_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,7 +36,9 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/assets"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
+	"github.com/snapcore/snapd/bootloader/grubenv"
 	"github.com/snapcore/snapd/bootloader/ubootenv"
 	"github.com/snapcore/snapd/image"
 	"github.com/snapcore/snapd/osutil"
@@ -127,17 +129,21 @@
 }
 
 // interface for the store
-func (s *imageSuite) SnapAction(_ context.Context, _ []*store.CurrentSnap, actions []*store.SnapAction, _ *auth.UserState, _ *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (s *imageSuite) SnapAction(_ context.Context, _ []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, _ *auth.UserState, _ *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		return nil, nil, fmt.Errorf("unexpected assertion query")
+	}
+
 	if len(actions) != 1 {
-		return nil, fmt.Errorf("expected 1 action, got %d", len(actions))
+		return nil, nil, fmt.Errorf("expected 1 action, got %d", len(actions))
 	}
 
 	if actions[0].Action != "download" {
-		return nil, fmt.Errorf("unexpected action %q", actions[0].Action)
+		return nil, nil, fmt.Errorf("unexpected action %q", actions[0].Action)
 	}
 
 	if _, instanceKey := snap.SplitInstanceName(actions[0].InstanceName); instanceKey != "" {
-		return nil, fmt.Errorf("unexpected instance key in %q", actions[0].InstanceName)
+		return nil, nil, fmt.Errorf("unexpected instance key in %q", actions[0].InstanceName)
 	}
 	// record
 	s.storeActions = append(s.storeActions, actions[0])
@@ -151,9 +157,9 @@
 			redirectChannel = channel
 		}
 		info1.Channel = channel
-		return []store.SnapActionResult{{Info: &info1, RedirectChannel: redirectChannel}}, nil
+		return []store.SnapActionResult{{Info: &info1, RedirectChannel: redirectChannel}}, nil, nil
 	}
-	return nil, fmt.Errorf("no %q in the fake store", actions[0].InstanceName)
+	return nil, nil, fmt.Errorf("no %q in the fake store", actions[0].InstanceName)
 }
 
 func (s *imageSuite) Download(ctx context.Context, name, targetFn string, downloadInfo *snap.DownloadInfo, pbar progress.Meter, user *auth.UserState, dlOpts *store.DownloadOptions) error {
@@ -475,17 +481,18 @@
      bootloader: grub
  `
 
-func (s *imageSuite) setupSnaps(c *C, publishers map[string]string) {
+func (s *imageSuite) setupSnaps(c *C, publishers map[string]string, defaultsYaml string) {
+	gadgetYaml := pcGadgetYaml + defaultsYaml
 	if _, ok := publishers["pc"]; ok {
 		s.MakeAssertedSnap(c, packageGadget, [][]string{
 			{"grub.conf", ""}, {"grub.cfg", "I'm a grub.cfg"},
-			{"meta/gadget.yaml", pcGadgetYaml},
+			{"meta/gadget.yaml", gadgetYaml},
 		}, snap.R(1), publishers["pc"])
 	}
 	if _, ok := publishers["pc18"]; ok {
 		s.MakeAssertedSnap(c, packageGadgetWithBase, [][]string{
 			{"grub.conf", ""}, {"grub.cfg", "I'm a grub.cfg"},
-			{"meta/gadget.yaml", pcGadgetYaml},
+			{"meta/gadget.yaml", gadgetYaml},
 		}, snap.R(4), publishers["pc18"])
 	}
 
@@ -574,7 +581,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -601,7 +608,7 @@
 
 			SideInfo: &info.SideInfo,
 
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 
@@ -694,7 +701,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "my-brand",
-	})
+	}, "")
 
 	coreFn := snaptest.MakeTestSnapWithFiles(c, packageCore, [][]string{{"local", ""}})
 	requiredSnap1Fn := snaptest.MakeTestSnapWithFiles(c, requiredSnap1, [][]string{{"local", ""}})
@@ -736,7 +743,7 @@
 			}
 		} else {
 			sideInfo = &info.SideInfo
-			snapType = info.GetType()
+			snapType = info.Type()
 		}
 
 		fn := pinfo.Filename()
@@ -780,7 +787,7 @@
 	c.Check(s.stderr.String(), Equals, "WARNING: \"core\", \"required-snap1\" installed from local snaps disconnected from a store cannot be refreshed subsequently!\n")
 }
 
-func (s *imageSuite) TestSetupSeedDevmodeSnap(c *C) {
+func (s *imageSuite) TestSetupSeedWithWideCohort(c *C) {
 	restore := image.MockTrusted(s.StoreSigning.Trusted)
 	defer restore()
 
@@ -788,7 +795,57 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
+	}, "")
+
+	snapFile := snaptest.MakeTestSnapWithFiles(c, devmodeSnap, nil)
+
+	opts := &image.Options{
+		Snaps: []string{snapFile},
+
+		PrepareDir:    filepath.Dir(rootdir),
+		WideCohortKey: "wide-cohort-key",
+	}
+
+	err := image.SetupSeed(s.tsto, s.model, opts)
+	c.Assert(err, IsNil)
+
+	// check the downloads
+	c.Check(s.storeActions, HasLen, 4)
+	c.Check(s.storeActions[0], DeepEquals, &store.SnapAction{
+		Action:       "download",
+		InstanceName: "core",
+		Channel:      stableChannel,
+		CohortKey:    "wide-cohort-key",
+	})
+	c.Check(s.storeActions[1], DeepEquals, &store.SnapAction{
+		Action:       "download",
+		InstanceName: "pc-kernel",
+		Channel:      stableChannel,
+		CohortKey:    "wide-cohort-key",
+	})
+	c.Check(s.storeActions[2], DeepEquals, &store.SnapAction{
+		Action:       "download",
+		InstanceName: "pc",
+		Channel:      stableChannel,
+		CohortKey:    "wide-cohort-key",
+	})
+	c.Check(s.storeActions[3], DeepEquals, &store.SnapAction{
+		Action:       "download",
+		InstanceName: "required-snap1",
+		Channel:      stableChannel,
+		CohortKey:    "wide-cohort-key",
 	})
+}
+
+func (s *imageSuite) TestSetupSeedDevmodeSnap(c *C) {
+	restore := image.MockTrusted(s.StoreSigning.Trusted)
+	defer restore()
+
+	rootdir := filepath.Join(c.MkDir(), "image")
+	s.setupSnaps(c, map[string]string{
+		"pc":        "canonical",
+		"pc-kernel": "canonical",
+	}, "")
 
 	snapFile := snaptest.MakeTestSnapWithFiles(c, devmodeSnap, nil)
 
@@ -814,7 +871,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          filepath.Join(seedsnapsdir, info.Filename()),
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       "beta",
@@ -848,7 +905,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	s.MakeAssertedSnap(c, classicSnap, nil, snap.R(1), "other")
 
@@ -884,7 +941,7 @@
 		"pc-kernel":  "canonical",
 		"snapd":      "canonical",
 		"other-base": "other",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -923,7 +980,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       stableChannel,
@@ -1005,7 +1062,7 @@
 		"core18":    "canonical",
 		"pc-kernel": "canonical",
 		"snapd":     "canonical",
-	})
+	}, "")
 	s.MakeAssertedSnap(c, packageGadgetWithBase, [][]string{
 		{"grub.conf", ""},
 		{"grub.cfg", "I'm a grub.cfg"},
@@ -1045,7 +1102,7 @@
 		"pc18":      "canonical",
 		"pc-kernel": "canonical",
 		"snapd":     "canonical",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -1084,7 +1141,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       stableChannel,
@@ -1140,7 +1197,7 @@
 		"pc18":      "canonical",
 		"pc-kernel": "canonical",
 		"snapd":     "canonical",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -1179,7 +1236,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       stableChannel,
@@ -1208,7 +1265,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "other",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -1287,7 +1344,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "my-brand",
-	})
+	}, "")
 
 	opts := &image.Options{
 		Snaps: []string{
@@ -1332,7 +1389,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       stableChannel,
@@ -1377,7 +1434,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc":        "canonical",
 		"pc-kernel": "my-brand",
-	})
+	}, "")
 
 	opts := &image.Options{
 		Snaps: []string{
@@ -1429,7 +1486,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       channel,
@@ -1584,7 +1641,7 @@
 		"core":      "canonical",
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -1660,7 +1717,7 @@
 		"core":      "canonical",
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	rootdir := filepath.Join(c.MkDir(), "image")
 	opts := &image.Options{
@@ -1720,7 +1777,7 @@
 		"core":      "canonical",
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	// pretend we downloaded the core,kernel already
 	cfn := s.AssertedSnap("core")
@@ -1777,7 +1834,7 @@
 		"core18":    "canonical",
 		"pc18":      "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	coreFn := snaptest.MakeTestSnapWithFiles(c, packageCore, [][]string{{"local", ""}})
 
@@ -1826,7 +1883,7 @@
 		"core":      "canonical",
 		"pc18":      "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -1869,7 +1926,7 @@
 		"core18":    "canonical",
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -1894,7 +1951,7 @@
 		"pc":                  "canonical",
 		"pc-kernel":           "canonical",
 		"snap-req-other-base": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -1919,7 +1976,7 @@
 		"pc":             "canonical",
 		"pc-kernel":      "canonical",
 		"snap-base-none": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -1927,6 +1984,51 @@
 	c.Assert(image.SetupSeed(s.tsto, model, opts), IsNil)
 }
 
+func (s *imageSuite) TestSetupSeedCore18GadgetDefaults(c *C) {
+	systemctlMock := testutil.MockCommand(c, "systemctl", "")
+	defer systemctlMock.Restore()
+
+	restore := image.MockTrusted(s.StoreSigning.Trusted)
+	defer restore()
+
+	// replace model with a model that uses core18
+	model := s.Brands.Model("my-brand", "my-model", map[string]interface{}{
+		"architecture": "amd64",
+		"gadget":       "pc18",
+		"kernel":       "pc-kernel",
+		"base":         "core18",
+	})
+
+	defaults := `defaults:
+  system:
+       service:
+         ssh:
+           disable: true
+`
+
+	rootdir := filepath.Join(c.MkDir(), "image")
+	s.setupSnaps(c, map[string]string{
+		"pc18":      "canonical",
+		"pc-kernel": "canonical",
+	}, defaults)
+
+	snapdFn := snaptest.MakeTestSnapWithFiles(c, snapdSnap, [][]string{{"local", ""}})
+	core18Fn := snaptest.MakeTestSnapWithFiles(c, packageCore18, [][]string{{"local", ""}})
+
+	opts := &image.Options{
+		Snaps: []string{
+			snapdFn,
+			core18Fn,
+		},
+
+		PrepareDir: filepath.Dir(rootdir),
+	}
+
+	err := image.SetupSeed(s.tsto, model, opts)
+	c.Assert(err, IsNil)
+	c.Check(osutil.FileExists(filepath.Join(rootdir, "_writable_defaults/etc/ssh/sshd_not_to_be_run")), Equals, true)
+}
+
 func (s *imageSuite) TestSetupSeedSnapCoreSatisfiesCore16(c *C) {
 	restore := image.MockTrusted(s.StoreSigning.Trusted)
 	defer restore()
@@ -1943,7 +2045,7 @@
 		"pc":                  "canonical",
 		"pc-kernel":           "canonical",
 		"snap-req-other-base": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -1967,7 +2069,7 @@
 		"core":      "canonical",
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -2002,7 +2104,7 @@
 		"core":      "canonical",
 		"pc":        "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -2042,7 +2144,7 @@
 		"pc-kernel":           "canonical",
 		"snap-req-other-base": "canonical",
 		"other-base":          "canonical",
-	})
+	}, "")
 	bfn := s.AssertedSnap("other-base")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -2070,7 +2172,7 @@
 		"pc-kernel":           "canonical",
 		"snap-req-other-base": "canonical",
 		"other-base":          "canonical",
-	})
+	}, "")
 	bfn := s.AssertedSnap("other-base")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
@@ -2097,7 +2199,7 @@
 		"pc":                    "canonical",
 		"pc-kernel":             "canonical",
 		"snap-req-content-snap": "canonical",
-	})
+	}, "")
 	opts := &image.Options{
 		PrepareDir: filepath.Dir(rootdir),
 	}
@@ -2121,7 +2223,7 @@
 	rootdir := c.MkDir()
 	s.setupSnaps(c, map[string]string{
 		"classic-gadget": "my-brand",
-	})
+	}, "")
 
 	opts := &image.Options{
 		Classic:    true,
@@ -2195,7 +2297,7 @@
 	})
 
 	rootdir := c.MkDir()
-	s.setupSnaps(c, nil)
+	s.setupSnaps(c, nil, "")
 
 	snapFile := snaptest.MakeTestSnapWithFiles(c, classicSnap, nil)
 
@@ -2262,7 +2364,7 @@
 	rootdir := c.MkDir()
 	s.setupSnaps(c, map[string]string{
 		"classic-gadget18": "my-brand",
-	})
+	}, "")
 
 	opts := &image.Options{
 		Classic:    true,
@@ -2289,7 +2391,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       stableChannel,
@@ -2380,7 +2482,7 @@
 	rootdir := c.MkDir()
 	s.setupSnaps(c, map[string]string{
 		"classic-gadget18": "my-brand",
-	})
+	}, "")
 
 	opts := &image.Options{
 		Classic:    true,
@@ -2407,7 +2509,7 @@
 	s.setupSnaps(c, map[string]string{
 		"pc18":      "canonical",
 		"pc-kernel": "canonical",
-	})
+	}, "")
 
 	snapdFn := snaptest.MakeTestSnapWithFiles(c, snapdSnap, [][]string{{"local", ""}})
 	core18Fn := snaptest.MakeTestSnapWithFiles(c, packageCore18, [][]string{{"local", ""}})
@@ -2467,10 +2569,8 @@
 	return s.Brands.Model("my-brand", "my-model", headers)
 }
 
-func (s *imageSuite) TestSetupSeedCore20(c *C) {
-	bl := bootloadertest.Mock("grub", c.MkDir()).RecoveryAware()
-	bootloader.Force(bl)
-
+func (s *imageSuite) TestSetupSeedCore20Grub(c *C) {
+	bootloader.Force(nil)
 	restore := image.MockTrusted(s.StoreSigning.Trusted)
 	defer restore()
 
@@ -2484,9 +2584,9 @@
 	s.makeSnap(c, "pc-kernel=20", nil, snap.R(1), "")
 	gadgetContent := [][]string{
 		{"grub-recovery.conf", "# recovery grub.cfg"},
-		{"grub.cfg", "boot grub.cfg"},
+		{"grub.conf", "# boot grub.cfg"},
 	}
-	s.makeSnap(c, "pc=20", gadgetContent, snap.R(22), "") // XXX likely don't need grub.cfg there
+	s.makeSnap(c, "pc=20", gadgetContent, snap.R(22), "")
 	s.makeSnap(c, "required20", nil, snap.R(21), "other")
 
 	opts := &image.Options{
@@ -2521,7 +2621,7 @@
 		c.Check(essSnaps[i], DeepEquals, &seed.Snap{
 			Path:          p,
 			SideInfo:      &info.SideInfo,
-			EssentialType: info.GetType(),
+			EssentialType: info.Type(),
 			Essential:     true,
 			Required:      true,
 			Channel:       channel,
@@ -2541,22 +2641,34 @@
 
 	// check boot config
 	grubCfg := filepath.Join(prepareDir, "system-seed", "EFI/ubuntu/grub.cfg")
-	c.Check(grubCfg, testutil.FileMatches, "# recovery grub.cfg")
-
-	c.Check(s.stderr.String(), Equals, "")
+	seedGrubenv := filepath.Join(prepareDir, "system-seed", "EFI/ubuntu/grubenv")
+	grubRecoveryCfgAsset := assets.Internal("grub-recovery.cfg")
+	c.Assert(grubRecoveryCfgAsset, NotNil)
+	c.Check(grubCfg, testutil.FileEquals, string(grubRecoveryCfgAsset))
+	// make sure that grub.cfg and grubenv are the only files present inside
+	// the directory
+	gl, err := filepath.Glob(filepath.Join(prepareDir, "system-seed/EFI/ubuntu/*"))
+	c.Assert(err, IsNil)
+	c.Check(gl, DeepEquals, []string{
+		grubCfg,
+		seedGrubenv,
+	})
 
 	// check recovery system specific config
 	systems, err := filepath.Glob(filepath.Join(seeddir, "systems", "*"))
 	c.Assert(err, IsNil)
 	c.Assert(systems, HasLen, 1)
 
-	c.Check(bl.RecoverySystemDir, Equals, fmt.Sprintf("/systems/%s", filepath.Base(systems[0])))
-	c.Check(bl.RecoverySystemBootVars, DeepEquals, map[string]string{
-		"snapd_recovery_kernel": "/snaps/pc-kernel_1.snap",
-	})
-	c.Check(bl.BootVars, DeepEquals, map[string]string{
-		"snapd_recovery_system": filepath.Base(systems[0]),
-	})
+	seedGenv := grubenv.NewEnv(seedGrubenv)
+	c.Assert(seedGenv.Load(), IsNil)
+	c.Check(seedGenv.Get("snapd_recovery_system"), Equals, filepath.Base(systems[0]))
+	c.Check(seedGenv.Get("snapd_recovery_mode"), Equals, "install")
+
+	c.Check(s.stderr.String(), Equals, "")
+
+	systemGenv := grubenv.NewEnv(filepath.Join(systems[0], "grubenv"))
+	c.Assert(systemGenv.Load(), IsNil)
+	c.Check(systemGenv.Get("snapd_recovery_kernel"), Equals, "/snaps/pc-kernel_1.snap")
 
 	// check the downloads
 	c.Check(s.storeActions, HasLen, 5)
@@ -2662,6 +2774,7 @@
 	env, err := ubootenv.Open(bootSel)
 	c.Assert(err, IsNil)
 	c.Assert(env.Get("snapd_recovery_system"), Equals, expectedLabel)
+	c.Assert(env.Get("snapd_recovery_mode"), Equals, "install")
 
 	// check recovery system specific config
 	systems, err := filepath.Glob(filepath.Join(seeddir, "systems", "*"))
diff -Nru snapd-2.45.1+20.04.2/image/options.go snapd-2.48.3+20.04/image/options.go
--- snapd-2.45.1+20.04.2/image/options.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/image/options.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package image
+
+type Options struct {
+	ModelFile string
+	Classic   bool
+
+	Channel string
+
+	// TODO: use OptionsSnap directly here?
+	Snaps        []string
+	SnapChannels map[string]string
+
+	// WideCohortKey can be used to supply a cohort covering all
+	// the snaps in the image, there is no generally suppported API
+	// to create such a cohort key.
+	WideCohortKey string
+
+	PrepareDir string
+
+	// Architecture to use if none is specified by the model,
+	// useful only for classic mode. If set must match the model otherwise.
+	Architecture string
+}
diff -Nru snapd-2.45.1+20.04.2/include/lk/snappy_boot_v1.h snapd-2.48.3+20.04/include/lk/snappy_boot_v1.h
--- snapd-2.45.1+20.04.2/include/lk/snappy_boot_v1.h	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/include/lk/snappy_boot_v1.h	2021-02-02 08:21:12.000000000 +0000
@@ -65,7 +65,7 @@
     char reboot_reason[SNAP_NAME_MAX_LEN];
 
     /**
-     * Matrix for mapping of boot img partion to installed kernel snap revision
+     * Matrix for mapping of boot img partition to installed kernel snap revision
      *
      * First column represents boot image partition label (e.g. boot_a,boot_b )
      *   value are static and should be populated at gadget built time
@@ -104,7 +104,7 @@
     char bootimg_file_name[SNAP_NAME_MAX_LEN];
 
     /**
-     * gadget assets: Matrix for mapping of gadget asset partions
+     * gadget assets: Matrix for mapping of gadget asset partitions
      * Optional boot asset tracking, based on bootloader support
      * Some boot chains support A/B boot assets for increased robustness
      * example being A/B TrustExecutionEnvironment
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/backend.go snapd-2.48.3+20.04/interfaces/apparmor/backend.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -357,7 +357,7 @@
 	// Deal with the "snapd" snap - we do the setup slightly differently
 	// here because this will run both on classic and on Ubuntu Core 18
 	// systems but /etc/apparmor.d is not writable on core18 systems
-	if snapInfo.GetType() == snap.TypeSnapd && apparmor_sandbox.ProbedLevel() != apparmor_sandbox.Unsupported {
+	if snapInfo.Type() == snap.TypeSnapd && apparmor_sandbox.ProbedLevel() != apparmor_sandbox.Unsupported {
 		if err := b.setupSnapConfineReexec(snapInfo); err != nil {
 			return nil, fmt.Errorf("cannot create host snap-confine apparmor configuration: %s", err)
 		}
@@ -368,7 +368,7 @@
 	// See LP:#1460152 and
 	// https://forum.snapcraft.io/t/core-snap-revert-issues-on-core-devices/
 	//
-	if (snapInfo.GetType() == snap.TypeOS || snapInfo.GetType() == snap.TypeSnapd) && !release.OnClassic {
+	if (snapInfo.Type() == snap.TypeOS || snapInfo.Type() == snap.TypeSnapd) && !release.OnClassic {
 		if li, err := filepath.Glob(filepath.Join(apparmor_sandbox.SystemCacheDir, "*")); err == nil {
 			for _, p := range li {
 				if st, err := os.Stat(p); err == nil && st.Mode().IsRegular() && profileIsRemovableOnCoreSetup(p) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/backend_test.go snapd-2.48.3+20.04/interfaces/apparmor/backend_test.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/backend_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/backend_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -859,6 +859,7 @@
 @{SNAP_NAME}="samba"
 # This is a snap name with instance key
 @{SNAP_INSTANCE_NAME}="samba"
+@{SNAP_INSTANCE_DESKTOP}="samba"
 @{SNAP_COMMAND_NAME}="smbd"
 @{SNAP_REVISION}="1"
 @{PROFILE_DBUS}="snap_2esamba_2esmbd"
@@ -1017,6 +1018,7 @@
 @{SNAP_NAME}="samba"
 # This is a snap name with instance key
 @{SNAP_INSTANCE_NAME}="samba_foo"
+@{SNAP_INSTANCE_DESKTOP}="samba+foo"
 @{SNAP_COMMAND_NAME}="smbd"
 @{SNAP_REVISION}="1"
 @{PROFILE_DBUS}="snap_2esamba_5ffoo_2esmbd"
@@ -1055,6 +1057,7 @@
 @{SNAP_NAME}="foo"
 # This is a snap name with instance key
 @{SNAP_INSTANCE_NAME}="foo"
+@{SNAP_INSTANCE_DESKTOP}="foo"
 @{SNAP_COMMAND_NAME}="hook.configure"
 @{SNAP_REVISION}="1"
 @{PROFILE_DBUS}="snap_2efoo_2ehook_2econfigure"
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/export_test.go snapd-2.48.3+20.04/interfaces/apparmor/export_test.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -114,3 +114,7 @@
 func (b *Backend) SetupSnapConfineReexec(info *snap.Info) error {
 	return b.setupSnapConfineReexec(info)
 }
+
+func (s *Specification) SnippetsForTag(tag string) []string {
+	return s.snippetsForTag(tag)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/spec.go snapd-2.48.3+20.04/interfaces/apparmor/spec.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/spec.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/spec.go	2021-02-02 08:21:12.000000000 +0000
@@ -46,6 +46,20 @@
 	// rules by apparmor_parser.
 	dedupSnippets map[string]*strutil.OrderedSet
 
+	// parametricSnippets are like snippets but are further parametrized where
+	// one template is instantiated with multiple values that end up producing
+	// a single apparmor rule that is computationally cheaper than naive
+	// repetition of the template alone. The first map index is the security
+	// tag, the second map index is the template. The final map value is the
+	// set of strings that the template is instantiated with across all the
+	// interfaces.
+	//
+	// As a simple example, it can be used to craft rules like
+	// "/sys/**/foo{1,2,3}/** r,", which do not triggering the exponential
+	// cost of parsing "/sys/**/foo1/** r,", followed by two similar rules for
+	// "2" and "3".
+	parametricSnippets map[string]map[string]*strutil.OrderedSet
+
 	// updateNS describe parts of apparmor policy for snap-update-ns executing
 	// on behalf of a given snap.
 	updateNS strutil.OrderedSet
@@ -122,6 +136,86 @@
 	}
 }
 
+// AddParametricSnippet adds a new apparmor snippet both de-duplicated and optimized for the parser.
+//
+// Conceptually the function takes a parametric template and a single value to
+// remember. The resulting snippet text is a single entry resulting from the
+// expanding the template and all the unique values observed, in the order they
+// were observed.
+//
+// The template is expressed as a slice of strings, with the parameter
+// automatically injected between any two of them, or in the special case of
+// only one fragment, after that fragment.
+//
+// The resulting expansion depends on the number of values seen. If only one
+// value is seen the resulting snippet is just the plain string one would
+// expect if no parametric optimization had taken place. If more than one
+// distinct value was seen then the resulting apparmor rule uses alternation
+// syntax {param1,param2,...,paramN} which has better compilation time and
+// memory complexity as compared to a set of naive expansions of the full
+// snippet one after another.
+//
+// For example the code:
+//
+// 		AddParametricSnippet([]string{"/dev/", "rw,"}, "sda1")
+//		AddParametricSnippet([]string{"/dev/", "rw,"}, "sda3")
+//		AddParametricSnippet([]string{"/dev/", "rw,"}, "sdb2")
+//
+// Results in a single apparmor rule:
+//
+//		"/dev/{sda1,sda3,sdb2} rw,"
+//
+// This function should be used whenever the apparmor template features more
+// than one use of "**" syntax (which represent arbitrary many directories or
+// files) and a variable component, like a device name or similar. Repeated
+// instances of this pattern require exponential memory when compiled with
+// apparmor_parser -O no-expr-simplify.
+func (spec *Specification) AddParametricSnippet(templateFragment []string, value string) {
+	if len(spec.securityTags) == 0 {
+		return
+	}
+
+	// We need to build a template string from the templateFragment.
+	//
+	// If only a single fragment is given we just  append our "###PARM###":
+	//  []string{"prefix"} becomes -> "prefix###PARAM###"
+	//
+	// Otherwise we join the strings:
+	//  []string{"pre","post"} becomes -> "pre###PARAM###post"
+	//
+	// This seems to be the most natural way of doing this.
+	var template string
+	switch len(templateFragment) {
+	case 0:
+		return
+	case 1:
+		template = templateFragment[0] + "###PARAM###"
+	default:
+		template = strings.Join(templateFragment, "###PARAM###")
+	}
+
+	// Expand the spec's parametric snippets, initializing each
+	// part of the map as needed
+	if spec.parametricSnippets == nil {
+		spec.parametricSnippets = make(map[string]map[string]*strutil.OrderedSet)
+	}
+	for _, tag := range spec.securityTags {
+		expansions := spec.parametricSnippets[tag]
+		if expansions == nil {
+			expansions = make(map[string]*strutil.OrderedSet)
+			spec.parametricSnippets[tag] = expansions
+		}
+		values := expansions[template]
+		if values == nil {
+			values = &strutil.OrderedSet{}
+			expansions[template] = values
+		}
+		// Now that everything is initialized, insert value into the
+		// spec.parametricSnippets[<tag>][<template>]'s OrderedSet.
+		values.Put(value)
+	}
+}
+
 // AddUpdateNS adds a new apparmor snippet for the snap-update-ns program.
 func (spec *Specification) AddUpdateNS(snippet string) {
 	spec.updateNS.Put(snippet)
@@ -366,11 +460,10 @@
 
 // Snippets returns a deep copy of all the added application snippets.
 func (spec *Specification) Snippets() map[string][]string {
-	snippets := copySnippets(spec.snippets)
-	for tag, bag := range spec.dedupSnippets {
-		if bag != nil {
-			snippets[tag] = append(snippets[tag], bag.Items()...)
-		}
+	tags := spec.SecurityTags()
+	snippets := make(map[string][]string, len(tags))
+	for _, tag := range tags {
+		snippets[tag] = spec.snippetsForTag(tag)
 	}
 	return snippets
 }
@@ -379,11 +472,7 @@
 // individual snippets joined with the newline character. Empty string is
 // returned for non-existing security tag.
 func (spec *Specification) SnippetForTag(tag string) string {
-	snippets := append([]string(nil), spec.snippets[tag]...)
-	if bag := spec.dedupSnippets[tag]; bag != nil {
-		snippets = append(snippets, bag.Items()...)
-	}
-	return strings.Join(snippets, "\n")
+	return strings.Join(spec.snippetsForTag(tag), "\n")
 }
 
 // SecurityTags returns a list of security tags which have a snippet.
@@ -399,10 +488,47 @@
 			tags = append(tags, t)
 		}
 	}
+	for t := range spec.parametricSnippets {
+		if !seen[t] {
+			tags = append(tags, t)
+		}
+	}
 	sort.Strings(tags)
 	return tags
 }
 
+func (spec *Specification) snippetsForTag(tag string) []string {
+	snippets := append([]string(nil), spec.snippets[tag]...)
+	// First add any deduplicated snippets
+	if bag := spec.dedupSnippets[tag]; bag != nil {
+		snippets = append(snippets, bag.Items()...)
+	}
+	templates := make([]string, 0, len(spec.parametricSnippets[tag]))
+	// Then add any parametric snippets
+	for template := range spec.parametricSnippets[tag] {
+		templates = append(templates, template)
+	}
+	sort.Strings(templates)
+	for _, template := range templates {
+		bag := spec.parametricSnippets[tag][template]
+		if bag != nil {
+			values := bag.Items()
+			switch len(values) {
+			case 0:
+				/* no values, nothing to do */
+			case 1:
+				snippet := strings.Replace(template, "###PARAM###", values[0], -1)
+				snippets = append(snippets, snippet)
+			default:
+				snippet := strings.Replace(template, "###PARAM###",
+					fmt.Sprintf("{%s}", strings.Join(values, ",")), -1)
+				snippets = append(snippets, snippet)
+			}
+		}
+	}
+	return snippets
+}
+
 // UpdateNS returns a deep copy of all the added snap-update-ns snippets.
 func (spec *Specification) UpdateNS() []string {
 	return spec.updateNS.Items()
@@ -418,14 +544,6 @@
 	return fmt.Sprintf("# Layout path: %s\n# (no extra permissions required for symlink)", mountPoint)
 }
 
-func copySnippets(m map[string][]string) map[string][]string {
-	result := make(map[string][]string, len(m))
-	for k, v := range m {
-		result[k] = append([]string(nil), v...)
-	}
-	return result
-}
-
 // Implementation of methods required by interfaces.Specification
 
 // AddConnectedPlug records apparmor-specific side-effects of having a connected plug.
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/spec_test.go snapd-2.48.3+20.04/interfaces/apparmor/spec_test.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/spec_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/spec_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -128,6 +128,7 @@
 		"snap.demo.command": {"snippet 1", "snippet 2"},
 		"snap.demo.service": {"snippet 1", "snippet 2"},
 	})
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string{"snippet 1", "snippet 2"})
 	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "snippet 1\nsnippet 2")
 	c.Assert(s.spec.SecurityTags(), DeepEquals, []string{"snap.demo.command", "snap.demo.service"})
 }
@@ -149,29 +150,92 @@
 		"snap.demo.command": {"dedup snippet 1", "dedup snippet 2"},
 		"snap.demo.service": {"dedup snippet 1", "dedup snippet 2"},
 	})
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string{"dedup snippet 1", "dedup snippet 2"})
 	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "dedup snippet 1\ndedup snippet 2")
 	c.Assert(s.spec.SecurityTags(), DeepEquals, []string{"snap.demo.command", "snap.demo.service"})
 }
 
-// Both AddSnippet and AddDeduplicatedSnippet work correctly together.
-func (s *specSuite) TestAddSnippetAndAddDeduplicatedSnippet(c *C) {
+func (s *specSuite) TestAddParametricSnippet(c *C) {
 	restore := apparmor.SetSpecScope(s.spec, []string{"snap.demo.command", "snap.demo.service"})
 	defer restore()
 
-	// Add two snippets in the context we are in.
+	s.spec.AddParametricSnippet([]string{"prefix ", " postfix"}, "param1")
+	s.spec.AddParametricSnippet([]string{"prefix ", " postfix"}, "param1")
+	s.spec.AddParametricSnippet([]string{"prefix ", " postfix"}, "param2")
+	s.spec.AddParametricSnippet([]string{"prefix ", " postfix"}, "param2")
+	s.spec.AddParametricSnippet([]string{"other "}, "param")
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string{
+		"other param",
+		"prefix {param1,param2} postfix",
+	})
+	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "other param\nprefix {param1,param2} postfix")
+	c.Assert(s.spec.Snippets(), DeepEquals, map[string][]string{
+		"snap.demo.command": {"other param", "prefix {param1,param2} postfix"},
+		"snap.demo.service": {"other param", "prefix {param1,param2} postfix"},
+	})
+}
+
+// All of AddSnippet, AddDeduplicatedSnippet, AddParameticSnippet work correctly together.
+func (s *specSuite) TestAddSnippetAndAddDeduplicatedAndParamSnippet(c *C) {
+	restore := apparmor.SetSpecScope(s.spec, []string{"snap.demo.command", "snap.demo.service"})
+	defer restore()
+
+	// Add three snippets in the context we are in.
 	s.spec.AddSnippet("normal")
 	s.spec.AddDeduplicatedSnippet("dedup")
+	s.spec.AddParametricSnippet([]string{""}, "param")
 
 	// The snippets were recorded correctly.
 	c.Assert(s.spec.UpdateNS(), HasLen, 0)
 	c.Assert(s.spec.Snippets(), DeepEquals, map[string][]string{
-		"snap.demo.command": {"normal", "dedup"},
-		"snap.demo.service": {"normal", "dedup"},
+		"snap.demo.command": {"normal", "dedup", "param"},
+		"snap.demo.service": {"normal", "dedup", "param"},
 	})
-	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "normal\ndedup")
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string{"normal", "dedup", "param"})
+	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "normal\ndedup\nparam")
 	c.Assert(s.spec.SecurityTags(), DeepEquals, []string{"snap.demo.command", "snap.demo.service"})
 }
 
+// Define tags but don't add any snippets.
+func (s *specSuite) TestTagsButNoSnippets(c *C) {
+	restore := apparmor.SetSpecScope(s.spec, []string{"snap.demo.command", "snap.demo.service"})
+	defer restore()
+
+	c.Assert(s.spec.UpdateNS(), HasLen, 0)
+	c.Assert(s.spec.Snippets(), DeepEquals, map[string][]string{})
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string(nil))
+	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "")
+	c.Assert(s.spec.SecurityTags(), DeepEquals, []string(nil))
+}
+
+// Don't define any tags but add snippets.
+func (s *specSuite) TestNoTagsButWithSnippets(c *C) {
+	restore := apparmor.SetSpecScope(s.spec, []string{})
+	defer restore()
+
+	s.spec.AddSnippet("normal")
+	s.spec.AddDeduplicatedSnippet("dedup")
+	s.spec.AddParametricSnippet([]string{""}, "param")
+
+	c.Assert(s.spec.UpdateNS(), HasLen, 0)
+	c.Assert(s.spec.Snippets(), DeepEquals, map[string][]string{})
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string(nil))
+	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "")
+	c.Assert(s.spec.SecurityTags(), DeepEquals, []string(nil))
+}
+
+// Don't define any tags or snippets.
+func (s *specSuite) TestsNoTagsOrSnippets(c *C) {
+	restore := apparmor.SetSpecScope(s.spec, []string{})
+	defer restore()
+
+	c.Assert(s.spec.UpdateNS(), HasLen, 0)
+	c.Assert(s.spec.Snippets(), DeepEquals, map[string][]string{})
+	c.Assert(s.spec.SnippetsForTag("snap.demo.command"), DeepEquals, []string(nil))
+	c.Assert(s.spec.SnippetForTag("snap.demo.command"), Equals, "")
+	c.Assert(s.spec.SecurityTags(), DeepEquals, []string(nil))
+}
+
 // AddUpdateNS adds a snippet for the snap-update-ns profile for a given snap.
 func (s *specSuite) TestAddUpdateNS(c *C) {
 	restore := apparmor.SetSpecScope(s.spec, []string{"snap.demo.command", "snap.demo.service"})
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/template.go snapd-2.48.3+20.04/interfaces/apparmor/template.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/template.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/template.go	2021-02-02 08:21:12.000000000 +0000
@@ -111,6 +111,8 @@
 
   # for perl apps/services
   #include <abstractions/perl>
+  # Missing from perl abstraction
+  /usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr,
 
   # Note: the following dangerous accesses should not be allowed in most
   # policy, but we cannot explicitly deny since other trusted interfaces might
@@ -169,6 +171,7 @@
 
   # For gdb support
   /usr/lib/snapd/snap-gdb-shim ixr,
+  /usr/lib/snapd/snap-gdbserver-shim ixr,
 
   # For in-snap tab completion
   /etc/bash_completion.d/{,*} r,
@@ -228,7 +231,7 @@
   # example, allow access to /dev/std{in,out,err} which are all symlinks to
   # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
   # linkat() temporary file technique, allow all fds. Importantly, access to
-  # another's task's fd via this proc interface is mediated via 'ptrace (read)'
+  # another task's fd via this proc interface is mediated via 'ptrace (read)'
   # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
   # this rule by itself doesn't allow opening another snap's fds via proc.
   owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,
@@ -265,6 +268,7 @@
   @{PROC}/sys/kernel/yama/ptrace_scope r,
   @{PROC}/sys/kernel/shmmax r,
   @{PROC}/sys/fs/file-max r,
+  @{PROC}/sys/fs/file-nr r,
   @{PROC}/sys/fs/inotify/max_* r,
   @{PROC}/sys/kernel/pid_max r,
   @{PROC}/sys/kernel/random/boot_id r,
@@ -274,8 +278,12 @@
   # unprivilged, dedicated user).
   /run/uuidd/request rw,
   /sys/devices/virtual/tty/{console,tty*}/active r,
-  /sys/fs/cgroup/memory/memory.limit_in_bytes r,
+  /sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r,
   /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
+  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r,
+  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r,
+  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r,
+  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r,
   /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
   /sys/module/apparmor/parameters/enabled r,
   /{,usr/}lib/ r,
@@ -306,6 +314,9 @@
   # Read-only of this snap
   /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,
 
+  # Read-only of snapd restart state for snapctl specifically
+  /var/lib/snapd/maintenance.json r,
+
   # Read-only for the install directory
   # bind mount used here (see 'parallel installs', above)
   @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/                   r,
@@ -437,6 +448,11 @@
   # (see 'parallel installs', above)
   /run/snap.@{SNAP_INSTANCE_NAME}/ rw,
   /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
+
+  # Snap-specific lock directory and prerequisite navigation permissions.
+  /run/lock/ r,
+  /run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw,
+  /run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
 `
 
 var templateFooter = `
@@ -1010,6 +1026,9 @@
   /tmp/ r,
   /tmp/.snap/{,**} rw,
 
+  # snapd logger.go checks /proc/cmdline
+  @{PROC}/cmdline r,
+
 ###SNIPPETS###
 }
 `
diff -Nru snapd-2.45.1+20.04.2/interfaces/apparmor/template_vars.go snapd-2.48.3+20.04/interfaces/apparmor/template_vars.go
--- snapd-2.45.1+20.04.2/interfaces/apparmor/template_vars.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/apparmor/template_vars.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,6 +35,7 @@
 	fmt.Fprintf(&buf, "@{SNAP_NAME}=\"%s\"\n", info.SnapName())
 	fmt.Fprintf(&buf, "# This is a snap name with instance key\n")
 	fmt.Fprintf(&buf, "@{SNAP_INSTANCE_NAME}=\"%s\"\n", info.InstanceName())
+	fmt.Fprintf(&buf, "@{SNAP_INSTANCE_DESKTOP}=\"%s\"\n", info.DesktopPrefix())
 	fmt.Fprintf(&buf, "@{SNAP_COMMAND_NAME}=\"%s\"\n", cmdName)
 	fmt.Fprintf(&buf, "@{SNAP_REVISION}=\"%s\"\n", info.Revision)
 	fmt.Fprintf(&buf, "@{PROFILE_DBUS}=\"%s\"\n",
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/all.go snapd-2.48.3+20.04/interfaces/builtin/all.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/all.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/all.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,6 +29,15 @@
 
 func init() {
 	snap.SanitizePlugsSlots = SanitizePlugsSlots
+
+	// setup the ByName function using allInterfaces
+	interfaces.ByName = func(name string) (interfaces.Interface, error) {
+		iface, ok := allInterfaces[name]
+		if !ok {
+			return nil, fmt.Errorf("interface %q not found", name)
+		}
+		return iface, nil
+	}
 }
 
 var (
@@ -114,6 +123,14 @@
 		delete(snapInfo.Slots, slotName)
 		for _, app := range snapInfo.Apps {
 			delete(app.Slots, slotName)
+
+			var activatesOn []*snap.SlotInfo
+			for _, slot := range app.ActivatesOn {
+				if slot.Name != slotName {
+					activatesOn = append(activatesOn, slot)
+				}
+			}
+			app.ActivatesOn = activatesOn
 		}
 		for _, hook := range snapInfo.Hooks {
 			delete(hook.Slots, slotName)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/all_test.go snapd-2.48.3+20.04/interfaces/builtin/all_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/all_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/all_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -280,6 +280,7 @@
 apps:
     app:
         slots: [iface]
+        activates-on: [iface]
 hooks:
     install:
         slots: [iface]
@@ -324,9 +325,14 @@
 }
 
 func (s *AllSuite) TestSanitizeErrorsOnInvalidSlotInterface(c *C) {
-	snapInfo, err := snap.InfoFromSnapYaml([]byte(testInvalidSlotInterfaceYaml))
-	c.Assert(err, IsNil)
+	snapInfo := snaptest.MockInvalidInfo(c, testInvalidSlotInterfaceYaml, nil)
+	c.Check(snapInfo.Apps["app"].Slots, HasLen, 1)
+	c.Check(snapInfo.Apps["app"].ActivatesOn, HasLen, 1)
+	c.Check(snapInfo.Hooks["install"].Slots, HasLen, 1)
+	c.Check(snapInfo.Slots, HasLen, 1)
+	snap.SanitizePlugsSlots(snapInfo)
 	c.Check(snapInfo.Apps["app"].Slots, HasLen, 0)
+	c.Check(snapInfo.Apps["app"].ActivatesOn, HasLen, 0)
 	c.Check(snapInfo.Hooks["install"].Slots, HasLen, 0)
 	c.Assert(snapInfo.BadInterfaces, HasLen, 1)
 	c.Check(snap.BadInterfacesSummary(snapInfo), Matches, `snap "testsnap" has bad plugs or slots: iface \(unknown interface "iface"\)`)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/block_devices.go snapd-2.48.3+20.04/interfaces/builtin/block_devices.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/block_devices.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/block_devices.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,7 +20,9 @@
 package builtin
 
 // Only allow raw disk devices; not loop, ram, CDROM, generic SCSI, network,
-// tape, raid, etc devices or disk partitions
+// tape, raid, etc devices or disk partitions. For some devices, allow controller
+// character devices since they are used to configure the corresponding block
+// device.
 const blockDevicesSummary = `allows access to disk block devices`
 
 const blockDevicesBaseDeclarationPlugs = `
@@ -53,14 +55,32 @@
 /sys/devices/**/block/** r,
 
 # Access to raw devices, not individual partitions
-/dev/hd[a-t] rw,                         # IDE, MFM, RLL
-/dev/sd{,[a-h]}[a-z] rw,                 # SCSI
-/dev/sdi[a-v] rw,                        # SCSI continued
-/dev/i2o/hd{,[a-c]}[a-z] rw,             # I2O hard disk
-/dev/i2o/hdd[a-x] rw,                    # I2O hard disk continued
-/dev/mmcblk[0-9]{,[0-9],[0-9][0-9]} rw,  # MMC (up to 1000 devices)
-/dev/nvme[0-9]{,[0-9]} rw,               # NVMe (up to 100 devices)
-/dev/vd[a-z] rw,                         # virtio
+/dev/hd[a-t] rw,                                          # IDE, MFM, RLL
+/dev/sd{,[a-h]}[a-z] rw,                                  # SCSI
+/dev/sdi[a-v] rw,                                         # SCSI continued
+/dev/i2o/hd{,[a-c]}[a-z] rw,                              # I2O hard disk
+/dev/i2o/hdd[a-x] rw,                                     # I2O hard disk continued
+/dev/mmcblk[0-9]{,[0-9],[0-9][0-9]} rw,                   # MMC (up to 1000 devices)
+/dev/vd[a-z] rw,                                          # virtio
+
+# Allow /dev/nvmeXnY namespace block devices. Please note this grants access to all
+# NVMe namespace block devices and that the numeric suffix on the character device
+# does not necessarily correspond to a namespace block device with the same suffix
+# From 'man nvme-format' : 
+#   Note, the numeric suffix on the character device, for example the 0 in
+#   /dev/nvme0, does NOT indicate this device handle is the parent controller
+#   of any namespaces with the same suffix. The namespace handle's numeral may
+#   be coming from the subsystem identifier, which is independent of the
+#   controller's identifier. Do not assume any particular device relationship
+#   based on their names. If you do, you may irrevocably erase data on an
+#   unintended device.
+/dev/nvme{[0-9],[1-9][0-9]}n{[1-9],[1-5][0-9],6[0-3]} rw, # NVMe (up to 100 devices, with 1-63 namespaces)
+
+# Allow /dev/nvmeX controller character devices. These character devices allow
+# manipulation of the block devices that we also allow above, so grouping this
+# access here makes sense, whereas access to individual partitions is delegated
+# to the raw-volume interface.
+/dev/nvme{[0-9],[1-9][0-9]} rw,                           # NVMe (up to 100 devices)
 
 # SCSI device commands, et al
 capability sys_rawio,
@@ -75,6 +95,10 @@
 
 var blockDevicesConnectedPlugUDev = []string{
 	`SUBSYSTEM=="block"`,
+	// these additional subsystems may not directly be block devices but they
+	// allow for manipulation of the block devices and so are grouped here as
+	// well
+	`SUBSYSTEM=="nvme"`,
 	`KERNEL=="mpt2ctl*"`,
 	`KERNEL=="megaraid_sas_ioctl_node"`,
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/block_devices_test.go snapd-2.48.3+20.04/interfaces/builtin/block_devices_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/block_devices_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/block_devices_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -88,7 +88,7 @@
 func (s *blockDevicesInterfaceSuite) TestUDevSpec(c *C) {
 	spec := &udev.Specification{}
 	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
-	c.Assert(spec.Snippets(), HasLen, 4)
+	c.Assert(spec.Snippets(), HasLen, 5)
 	c.Assert(spec.Snippets()[0], Equals, `# block-devices
 KERNEL=="megaraid_sas_ioctl_node", TAG+="snap_consumer_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/bluez.go snapd-2.48.3+20.04/interfaces/builtin/bluez.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/bluez.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/bluez.go	2021-02-02 08:21:12.000000000 +0000
@@ -183,6 +183,9 @@
     path=/org/bluez{,/**}
     interface=org.freedesktop.DBus.*
     peer=(label=unconfined),
+
+# Allow access to bluetooth audio streams
+network bluetooth,
 `
 
 const bluezPermanentSlotSecComp = `
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/bluez_test.go snapd-2.48.3+20.04/interfaces/builtin/bluez_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/bluez_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/bluez_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -100,6 +100,7 @@
 `
 
 const bluezCoreYaml = `name: core
+type: os
 version: 0
 slots:
   bluez:
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/browser_support.go snapd-2.48.3+20.04/interfaces/builtin/browser_support.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/browser_support.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/browser_support.go	2021-02-02 08:21:12.000000000 +0000
@@ -92,7 +92,7 @@
 
 # webbrowser-app/webapp-container tries to read this file to determine if it is
 # confined or not, so explicitly deny to avoid noise in the logs.
-deny @{PROC}/@{pid}/attr/current r,
+deny @{PROC}/@{pid}/attr/{,apparmor/}current r,
 
 # This is an information leak but disallowing it leads to developer confusion
 # when using the chromium content api file chooser due to a (harmless) glib
@@ -111,19 +111,23 @@
 `
 
 const browserSupportConnectedPlugAppArmorWithSandbox = `
-# Leaks installed applications
 # TODO: should this be somewhere else?
 /etc/mailcap r,
-# Snaps should be using xdg-open from the runtime instead of reading these
-# files directly since the snap is unable to do anything with these files
-# but these accesses have been allowed for a long time and remain so as not
-# to break existing snaps. These could be changed to explicit deny rules,
-# but that provides a worse debugging experience. Combined, the risks
-# outweigh the benefits of closing this information leak for the small
-# number of snaps allowed to use allow-sandbox: true. Reference:
-# https://forum.snapcraft.io/t/cannot-open-pdf-attachment-with-thunderbird/11845
-/usr/share/applications/{,*} r,
-/var/lib/snapd/desktop/applications/{,*} r,
+
+# While /usr/share/applications comes from the base runtime of the snap, it
+# has some things that snaps actually need, so allow access to those and deny
+# access to the others. This is duplicated from desktop for compatibility with
+# existing snaps.
+/usr/share/applications/ r,
+/usr/share/applications/mimeapps.list r,
+/usr/share/applications/xdg-open.desktop r,
+# silence noisy denials from desktop files in core* snaps that aren't usable by
+# snaps
+deny /usr/share/applications/python*.desktop r,
+deny /usr/share/applications/vim.desktop r,
+deny /usr/share/applications/snap-handle-link.desktop r,  # core16
+
+# Chromium content api unfortunately needs these for normal operation
 owner @{PROC}/@{pid}/fd/[0-9]* w,
 
 # Various files in /run/udev/data needed by Chrome Settings. Leaks device
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/common.go snapd-2.48.3+20.04/interfaces/builtin/common.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/common.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/common.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,8 +26,10 @@
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
 	"github.com/snapcore/snapd/interfaces/kmod"
+	"github.com/snapcore/snapd/interfaces/mount"
 	"github.com/snapcore/snapd/interfaces/seccomp"
 	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 )
 
@@ -55,6 +57,9 @@
 	connectedPlugUDev      []string
 	rejectAutoConnectPairs bool
 
+	connectedPlugUpdateNSAppArmor string
+	connectedPlugMount            []osutil.MountEntry
+
 	connectedPlugKModModules []string
 	connectedSlotKModModules []string
 	permanentPlugKModModules []string
@@ -64,6 +69,8 @@
 	suppressPtraceTrace  bool
 	suppressHomeIx       bool
 	controlsDeviceCgroup bool
+
+	serviceSnippets []string
 }
 
 // Name returns the interface name.
@@ -83,6 +90,10 @@
 	}
 }
 
+func (iface *commonInterface) ServicePermanentPlug(plug *snap.PlugInfo) []string {
+	return iface.serviceSnippets
+}
+
 func (iface *commonInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
 	if iface.usesPtraceTrace {
 		spec.SetUsesPtraceTrace()
@@ -92,8 +103,11 @@
 	if iface.suppressHomeIx {
 		spec.SetSuppressHomeIx()
 	}
-	if iface.connectedPlugAppArmor != "" {
-		spec.AddSnippet(iface.connectedPlugAppArmor)
+	if snippet := iface.connectedPlugAppArmor; snippet != "" {
+		spec.AddSnippet(snippet)
+	}
+	if snippet := iface.connectedPlugUpdateNSAppArmor; snippet != "" {
+		spec.AddUpdateNS(snippet)
 	}
 	return nil
 }
@@ -122,6 +136,15 @@
 			return err
 		}
 	}
+	return nil
+}
+
+func (iface *commonInterface) MountConnectedPlug(spec *mount.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	for _, entry := range iface.connectedPlugMount {
+		if err := spec.AddMountEntry(entry); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/cups_control.go snapd-2.48.3+20.04/interfaces/builtin/cups_control.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/cups_control.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/cups_control.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -19,30 +19,159 @@
 
 package builtin
 
+import (
+	"strings"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+)
+
+// On classic systems where the slot is implicitly provided, the interface
+// allows access to the cups control socket.
+//
+// On systems where the slot is provided by an app snap, the cups-control
+// interface is the companion interface to the cups interface. The design of
+// these interfaces is based on the idea that the slot implementation (eg
+// cupsd) is expected to query snapd to determine if the cups-control interface
+// is connected or not for the peer client process and the print service will
+// mediate admin functionality (ie, the rules in these interfaces allow
+// connecting to the print service, but do not implement enforcement rules; it
+// is up to the print service to provide enforcement).
 const cupsControlSummary = `allows access to the CUPS control socket`
 
+// cups-control is implicit on classic but may also be provided by an app snap
+// on core or classic (the current design allows the snap provider to slots
+// both cups-control and cups or just cups-control (like with implicit classic
+// or any slot provider without mediation patches), but not just cups).
 const cupsControlBaseDeclarationSlots = `
   cups-control:
     allow-installation:
       slot-snap-type:
+        - app
         - core
     deny-auto-connection: true
+    deny-connection:
+      on-classic: false
+`
+
+const cupsControlPermanentSlotAppArmor = `
+# Allow daemon access to create the CUPS socket
+/{,var/}run/cups/ rw,
+/{,var/}run/cups/** rwk,
+
+# Allow cups to verify passwords directly
+/etc/shadow r,
+/var/lib/extrausers/shadow r,
+
+# Some versions of CUPS will verify the connecting pid's
+# security label
+@{PROC}/[0-9]*/attr/{,apparmor/}current r,
+
+# Allow daemon access to the color manager on the system
+dbus (receive, send)
+    bus=system
+    path=/org/freedesktop/ColorManager
+    interface=org.freedesktop.ColorManager
+    peer=(name=org.freedesktop.ColorManager),
+
+# Allow daemon to send notifications
+dbus (send)
+    bus=system
+    path=/org/cups/cupsd/Notifier
+    interface=org.cups.cupsd.Notifier
+    peer=(name=org.freedesktop.DBus,label=unconfined),
+
+# Allow daemon to send signals to its snap_daemon processes
+capability kill,
+
+# Allow daemon to manage snap_daemon files and directories
+capability fsetid,
+`
+
+const cupsControlConnectedSlotAppArmor = `
+# Allow daemon to send notifications to connected snaps
+dbus (send)
+    bus=system
+    path=/org/cups/cupsd/Notifier
+    interface=org.cups.cupsd.Notifier
+    peer=(name=org.freedesktop.DBus,label=###PLUG_SECURITY_TAGS###),
 `
 
 const cupsControlConnectedPlugAppArmor = `
-# Description: Can access cups control socket. This is restricted because it provides
-# privileged access to configure printing.
+# Allow communicating with the cups server for printing and configuration.
 
 #include <abstractions/cups-client>
-/run/cups/printcap r,
+/{,var/}run/cups/printcap r,
+
+# Allow receiving all DBus signal notifications from the daemon (see
+# notifier/dbus.c in cups sources)
+dbus (receive)
+    bus=system
+    path=/org/cups/cupsd/Notifier
+    interface=org.cups.cupsd.Notifier
+    peer=(name=org.freedesktop.DBus,label=###SLOT_SECURITY_TAGS###),
 `
 
+type cupsControlInterface struct {
+	commonInterface
+}
+
+func (iface *cupsControlInterface) AppArmorPermanentSlot(spec *apparmor.Specification, slot *snap.SlotInfo) error {
+	// On classic, only apply slot snippet when running as application snap
+	// on classic since the slot side may be from the classic OS or snap.
+	if !implicitSystemPermanentSlot(slot) {
+		spec.AddSnippet(cupsControlPermanentSlotAppArmor)
+	}
+	return nil
+}
+
+func (iface *cupsControlInterface) AppArmorConnectedSlot(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	// On classic, only apply slot snippet when running as application snap
+	// on classic since the slot side may be from the classic OS or snap.
+	if !implicitSystemConnectedSlot(slot) {
+		old := "###PLUG_SECURITY_TAGS###"
+		new := plugAppLabelExpr(plug)
+		snippet := strings.Replace(cupsControlConnectedSlotAppArmor, old, new, -1)
+		spec.AddSnippet(snippet)
+	}
+	return nil
+}
+
+func (iface *cupsControlInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	old := "###SLOT_SECURITY_TAGS###"
+	var new string
+	// If we're running on classic, cups may be installed either as a snap
+	// or as part of the classic OS. If it is part of the classic OS, it
+	// will not have a security label like it would when installed as a
+	// snap.
+	if implicitSystemConnectedSlot(slot) {
+		// cupsd from the OS may be confined or unconfined. Newer
+		// releases may use the 'cupsd' label instead of the old
+		// path-based label.
+		new = "\"{unconfined,/usr/sbin/cupsd,cupsd}\""
+	} else {
+		new = slotAppLabelExpr(slot)
+	}
+
+	// implement 'implicitOnCore: false/implicitOnClassic: true' by only
+	// applying the snippet if the slot is an app or we are on classic
+	if slot.Snap().Type() == snap.TypeApp || release.OnClassic {
+		snippet := strings.Replace(cupsControlConnectedPlugAppArmor, old, new, -1)
+		spec.AddSnippet(snippet)
+	}
+	return nil
+}
+
 func init() {
-	registerIface(&commonInterface{
-		name:                  "cups-control",
-		summary:               cupsControlSummary,
-		implicitOnClassic:     true,
-		baseDeclarationSlots:  cupsControlBaseDeclarationSlots,
-		connectedPlugAppArmor: cupsControlConnectedPlugAppArmor,
+	registerIface(&cupsControlInterface{
+		commonInterface: commonInterface{
+			name:                 "cups-control",
+			summary:              cupsControlSummary,
+			baseDeclarationSlots: cupsControlBaseDeclarationSlots,
+			implicitOnCore:       false,
+			implicitOnClassic:    true,
+		},
 	})
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/cups_control_test.go snapd-2.48.3+20.04/interfaces/builtin/cups_control_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/cups_control_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/cups_control_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,183 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type cupsControlSuite struct {
+	iface            interfaces.Interface
+	coreSlotInfo     *snap.SlotInfo
+	coreSlot         *interfaces.ConnectedSlot
+	plugInfo         *snap.PlugInfo
+	plug             *interfaces.ConnectedPlug
+	providerSlotInfo *snap.SlotInfo
+	providerSlot     *interfaces.ConnectedSlot
+}
+
+var _ = Suite(&cupsControlSuite{iface: builtin.MustInterface("cups-control")})
+
+const cupsControlConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [cups-control]
+`
+
+const cupsControlCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  cups-control:
+`
+
+const cupsControlProviderYaml = `name: provider
+version: 0
+apps:
+ app:
+  slots: [cups-control]
+`
+
+func (s *cupsControlSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, cupsControlConsumerYaml, nil, "cups-control")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, cupsControlCoreYaml, nil, "cups-control")
+	s.providerSlot, s.providerSlotInfo = MockConnectedSlot(c, cupsControlProviderYaml, nil, "cups-control")
+}
+
+func (s *cupsControlSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "cups-control")
+}
+
+func (s *cupsControlSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *cupsControlSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *cupsControlSuite) TestAppArmorSpecCore(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	// core to consumer on core is empty for ConnectedPlug
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), HasLen, 0)
+
+	// core to consumer on core is empty for PermanentSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
+	c.Assert(spec.SecurityTags(), HasLen, 0)
+
+	// core to consumer on core is empty for ConnectedSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), HasLen, 0)
+
+	// consumer to provider on core for ConnectedPlug
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.providerSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Allow communicating with the cups server for printing and configuration.")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "#include <abstractions/cups-client>")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "peer=(name=org.freedesktop.DBus,label=\"snap.provider.app\"")
+	c.Assert(spec.SnippetForTag("snap.provider.app"), Not(testutil.Contains), "# Allow daemon access to create the CUPS socket")
+
+	// provider to consumer on core for PermanentSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddPermanentSlot(s.iface, s.providerSlotInfo), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.provider.app"})
+	c.Assert(spec.SnippetForTag("snap.provider.app"), testutil.Contains, "# Allow daemon access to create the CUPS socket")
+	c.Assert(spec.SnippetForTag("snap.provider.app"), Not(testutil.Contains), "label=\"snap.consumer.app\"")
+
+	// provider to consumer on core for ConnectedSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.providerSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.provider.app"})
+	c.Assert(spec.SnippetForTag("snap.provider.app"), testutil.Contains, "peer=(name=org.freedesktop.DBus,label=\"snap.consumer.app\"")
+}
+
+func (s *cupsControlSuite) TestAppArmorSpecClassic(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	// consumer to core on classic for ConnectedPlug
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Allow communicating with the cups server for printing and configuration.")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "#include <abstractions/cups-client>")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "peer=(name=org.freedesktop.DBus,label=\"{unconfined,/usr/sbin/cupsd,cupsd}\"")
+	c.Assert(spec.SnippetForTag("snap.provider.app"), Not(testutil.Contains), "# Allow daemon access to create the CUPS socket")
+
+	// core to consumer on classic is empty for PermanentSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
+	c.Assert(spec.SecurityTags(), HasLen, 0)
+
+	// core to consumer on classic is empty for ConnectedSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), HasLen, 0)
+
+	// consumer to provider on classic for ConnectedPlug
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.providerSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Allow communicating with the cups server for printing and configuration.")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "#include <abstractions/cups-client>")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "peer=(name=org.freedesktop.DBus,label=\"snap.provider.app\"")
+	c.Assert(spec.SnippetForTag("snap.provider.app"), Not(testutil.Contains), "# Allow daemon access to create the CUPS socket")
+
+	// provider to consumer on classic for PermanentSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddPermanentSlot(s.iface, s.providerSlotInfo), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.provider.app"})
+	c.Assert(spec.SnippetForTag("snap.provider.app"), testutil.Contains, "# Allow daemon access to create the CUPS socket")
+	c.Assert(spec.SnippetForTag("snap.provider.app"), Not(testutil.Contains), "label=\"snap.consumer.app\"")
+
+	// provider to consumer on classic for ConnectedSlot
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.providerSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.provider.app"})
+	c.Assert(spec.SnippetForTag("snap.provider.app"), testutil.Contains, "peer=(name=org.freedesktop.DBus,label=\"snap.consumer.app\"")
+}
+
+func (s *cupsControlSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, false)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to the CUPS control socket`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "cups-control")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *cupsControlSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/cups.go snapd-2.48.3+20.04/interfaces/builtin/cups.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/cups.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/cups.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,62 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+// On systems where the slot is provided by an app snap, the cups interface is
+// the companion interface to the cups-control interface. The design of these
+// interfaces is based on the idea that the slot implementation (eg cupsd) is
+// expected to query snapd to determine if the cups-control interface is
+// connected or not for the peer client process and the print service will
+// mediate admin functionality (ie, the rules in these interfaces allow
+// connecting to the print service, but do not implement enforcement rules; it
+// is up to the print service to provide enforcement).
+const cupsSummary = `allows access to the CUPS socket for printing`
+
+// cups is currently only available via a providing app snap and this interface
+// assumes that the providing app snap also slots 'cups-control' (the current
+// design allows the snap provider to slots both cups-control and cups or just
+// cups-control (like with implicit classic or any slot provider without
+// mediation patches), but not just cups).
+const cupsBaseDeclarationSlots = `
+  cups:
+    allow-installation:
+      slot-snap-type:
+        - app
+    deny-connection: true
+    deny-auto-connection: true
+`
+
+const cupsConnectedPlugAppArmor = `
+# Allow communicating with the cups server
+
+#include <abstractions/cups-client>
+/{,var/}run/cups/printcap r,
+`
+
+func init() {
+	registerIface(&commonInterface{
+		name:                  "cups",
+		summary:               cupsSummary,
+		implicitOnCore:        false,
+		implicitOnClassic:     false,
+		baseDeclarationSlots:  cupsBaseDeclarationSlots,
+		connectedPlugAppArmor: cupsConnectedPlugAppArmor,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/cups_test.go snapd-2.48.3+20.04/interfaces/builtin/cups_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/cups_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/cups_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,101 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type cupsSuite struct {
+	iface            interfaces.Interface
+	plugInfo         *snap.PlugInfo
+	plug             *interfaces.ConnectedPlug
+	providerSlotInfo *snap.SlotInfo
+	providerSlot     *interfaces.ConnectedSlot
+}
+
+var _ = Suite(&cupsSuite{iface: builtin.MustInterface("cups")})
+
+const cupsConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [cups]
+`
+
+const cupsProviderYaml = `name: provider
+version: 0
+apps:
+ app:
+  slots: [cups]
+`
+
+func (s *cupsSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, cupsConsumerYaml, nil, "cups")
+	s.providerSlot, s.providerSlotInfo = MockConnectedSlot(c, cupsProviderYaml, nil, "cups")
+}
+
+func (s *cupsSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "cups")
+}
+
+func (s *cupsSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.providerSlotInfo), IsNil)
+}
+
+func (s *cupsSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *cupsSuite) TestAppArmorSpec(c *C) {
+	for _, onClassic := range []bool{true, false} {
+		restore := release.MockOnClassic(onClassic)
+		defer restore()
+
+		// consumer to provider on core for ConnectedPlug
+		spec := &apparmor.Specification{}
+		c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.providerSlot), IsNil)
+		c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+		c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Allow communicating with the cups server")
+		c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "#include <abstractions/cups-client>")
+		restore()
+	}
+}
+
+func (s *cupsSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, false)
+	c.Assert(si.ImplicitOnClassic, Equals, false)
+	c.Assert(si.Summary, Equals, `allows access to the CUPS socket for printing`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "cups")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-connection: true")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *cupsSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/desktop.go snapd-2.48.3+20.04/interfaces/builtin/desktop.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/desktop.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/desktop.go	2021-02-02 08:21:12.000000000 +0000
@@ -158,7 +158,18 @@
 
 # Allow use of snapd's internal 'xdg-open'
 /usr/bin/xdg-open ixr,
-/usr/share/applications/{,*} r,
+# While /usr/share/applications comes from the base runtime of the snap, it
+# has some things that snaps actually need, so allow access to those and deny
+# access to the others
+/usr/share/applications/ r,
+/usr/share/applications/mimeapps.list r,
+/usr/share/applications/xdg-open.desktop r,
+# silence noisy denials from desktop files in core* snaps that aren't usable by
+# snaps
+deny /usr/share/applications/python*.desktop r,
+deny /usr/share/applications/vim.desktop r,
+deny /usr/share/applications/snap-handle-link.desktop r,  # core16
+
 dbus (send)
     bus=session
     path=/
@@ -203,7 +214,7 @@
     bus=session
     path=/io/snapcraft/Settings
     interface=io.snapcraft.Settings
-    member={Check,Get,Set}
+    member={Check,CheckSub,Get,GetSub,Set,SetSub}
     peer=(label=unconfined),
 
 # Allow access to xdg-document-portal file system.  Access control is
@@ -253,6 +264,20 @@
 # we have better XDG_DATA_DIRS handling, silence these noisy denials.
 # https://github.com/snapcrafters/discord/issues/23#issuecomment-637607843
 deny @{HOME}/.local/share/flatpak/exports/share/** r,
+
+# Allow access to the IBus portal (IBUS_USE_PORTAL=1)
+dbus (send)
+      bus=session
+      path=/org/freedesktop/IBus
+      interface=org.freedesktop.IBus.Portal
+      member=CreateInputContext
+      peer=(name=org.freedesktop.portal.IBus),
+
+dbus (send, receive)
+      bus=session
+      path=/org/freedesktop/IBus/InputContext_[0-9]*
+      interface=org.freedesktop.IBus.InputContext
+      peer=(label=unconfined),
 `
 
 type desktopInterface struct {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/desktop_legacy.go snapd-2.48.3+20.04/interfaces/builtin/desktop_legacy.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/desktop_legacy.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/desktop_legacy.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,6 +19,13 @@
 
 package builtin
 
+import (
+	"strings"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+)
+
 const desktopLegacySummary = `allows privileged access to desktop legacy methods`
 
 // While this gives privileged access to legacy methods we should auto-connect
@@ -234,13 +241,108 @@
     interface=org.gtk.vfs.MountTracker
     member=LookupMount,
 
-# This leaks the names of snaps with desktop files
-/var/lib/snapd/desktop/applications/ r,
-/var/lib/snapd/desktop/applications/mimeinfo.cache r,
-# Support BAMF_DESKTOP_FILE_HINT by allowing reading our desktop files
-# parallel-installs: this leaks read access to desktop files owned by keyed
-# instances of @{SNAP_NAME} to @{SNAP_NAME} snap
-/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_NAME}_*.desktop r,
+###SNAP_DESKTOP_FILE_RULES###
+# Snaps are unable to use the data in mimeinfo.cache (since they can't execute
+# the returned desktop file themselves). unity messaging menu doesn't require
+# mimeinfo.cache and xdg-mime will fallback to reading the desktop files
+# directly to look for MimeType. Since reading the snap's own desktop files is
+# allowed, we can safely deny access to this file (and xdg-mime will either
+# return one of the snap's mimetypes, or none).
+deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,
+
+# glib-networking's GLib proxy (different than the portal's proxy service
+# org.freedesktop.portal.ProxyResolver). The Lookup API allows specifying
+# various URLs (eg, file://, http:// and https://) which will be given to the
+# unconfined glib-pacrunner.
+dbus (send)
+    bus=session
+    path=/org/gtk/GLib/PACRunner
+    interface=org.gtk.GLib.PACRunner
+    member=Lookup
+    peer=(label=unconfined),
+
+# app-indicators
+dbus (send)
+    bus=session
+    path=/StatusNotifierWatcher
+    interface=org.freedesktop.DBus.Introspectable
+    member=Introspect
+    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
+
+dbus (send)
+    bus=session
+    path=/org/freedesktop/DBus
+    interface=org.freedesktop.DBus
+    member="{GetConnectionUnixProcessID,RequestName,ReleaseName}"
+    peer=(name=org.freedesktop.DBus, label=unconfined),
+
+dbus (bind)
+    bus=session
+    name=org.kde.StatusNotifierItem-[0-9]*,
+
+dbus (send)
+    bus=session
+    path=/StatusNotifierWatcher
+    interface=org.freedesktop.DBus.Properties
+    member=Get
+    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
+
+dbus (send)
+    bus=session
+    path=/{StatusNotifierWatcher,org/ayatana/NotificationItem/*}
+    interface=org.kde.StatusNotifierWatcher
+    member=RegisterStatusNotifierItem
+    peer=(label=unconfined),
+
+dbus (send)
+    bus=session
+    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
+    interface=org.kde.StatusNotifierItem
+    member="New{AttentionIcon,Icon,IconThemePath,OverlayIcon,Status,Title,ToolTip}"
+    peer=(name=org.freedesktop.DBus, label=unconfined),
+
+dbus (receive)
+    bus=session
+    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
+    interface=org.kde.StatusNotifierItem
+    member={Activate,ContextMenu,Scroll,SecondaryActivate,XAyatanaSecondaryActivate}
+    peer=(label=unconfined),
+
+dbus (send)
+    bus=session
+    path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu}
+    interface=com.canonical.dbusmenu
+    member="{LayoutUpdated,ItemsPropertiesUpdated}"
+    peer=(name=org.freedesktop.DBus, label=unconfined),
+
+dbus (receive)
+    bus=session
+    path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**}
+    interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu}
+    member={Get*,AboutTo*,Event*}
+    peer=(label=unconfined),
+
+# notifications
+dbus (send)
+    bus=session
+    path=/org/freedesktop/Notifications
+    interface=org.freedesktop.Notifications
+    member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
+    peer=(label=unconfined),
+
+dbus (receive)
+    bus=session
+    path=/org/freedesktop/Notifications
+    interface=org.freedesktop.Notifications
+    member={ActionInvoked,NotificationClosed,NotificationReplied}
+    peer=(label=unconfined),
+
+dbus (send)
+    bus=session
+    path=/org/ayatana/NotificationItem/*
+    interface=org.kde.StatusNotifierItem
+    member=XAyatanaNew*
+    peer=(name=org.freedesktop.DBus, label=unconfined),
 `
 
 const desktopLegacyConnectedPlugSecComp = `
@@ -252,13 +354,25 @@
 accept4
 `
 
+type desktopLegacyInterface struct {
+	commonInterface
+}
+
+func (iface *desktopLegacyInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	snippet := strings.Join(getDesktopFileRules(plug.Snap().DesktopPrefix()), "\n")
+	spec.AddSnippet(strings.Replace(desktopLegacyConnectedPlugAppArmor, "###SNAP_DESKTOP_FILE_RULES###", snippet+"\n", -1))
+
+	return nil
+}
+
 func init() {
-	registerIface(&commonInterface{
-		name:                  "desktop-legacy",
-		summary:               desktopLegacySummary,
-		implicitOnClassic:     true,
-		baseDeclarationSlots:  desktopLegacyBaseDeclarationSlots,
-		connectedPlugAppArmor: desktopLegacyConnectedPlugAppArmor,
-		connectedPlugSecComp:  desktopLegacyConnectedPlugSecComp,
+	registerIface(&desktopLegacyInterface{
+		commonInterface: commonInterface{
+			name:                 "desktop-legacy",
+			summary:              desktopLegacySummary,
+			implicitOnClassic:    true,
+			baseDeclarationSlots: desktopLegacyBaseDeclarationSlots,
+			connectedPlugSecComp: desktopLegacyConnectedPlugSecComp,
+		},
 	})
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/desktop_legacy_test.go snapd-2.48.3+20.04/interfaces/builtin/desktop_legacy_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/desktop_legacy_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/desktop_legacy_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -80,6 +80,15 @@
 	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: Can access common desktop legacy methods")
 	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "#include <abstractions/dbus-accessibility-strict>")
 	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `peer=(addr="@/tmp/ibus/dbus-*"),`)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,`)
+
+	// getDesktopFileRules() rules
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `# This leaks the names of snaps with desktop files`)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `/var/lib/snapd/desktop/applications/ r,`)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,`)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,`)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/[^c]* r,`)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/consume[^r]* r,`)
 
 	// connected plug to core slot
 	spec = &apparmor.Specification{}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/docker_support.go snapd-2.48.3+20.04/interfaces/builtin/docker_support.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/docker_support.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/docker_support.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,8 +24,8 @@
 
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/kmod"
 	"github.com/snapcore/snapd/interfaces/seccomp"
-	"github.com/snapcore/snapd/interfaces/udev"
 	"github.com/snapcore/snapd/release"
 	apparmor_sandbox "github.com/snapcore/snapd/sandbox/apparmor"
 	"github.com/snapcore/snapd/snap"
@@ -73,10 +73,11 @@
 /{,var/}run/runc/**     mrwklix,
 
 # Allow sockets/etc for containerd
-/{,var/}run/containerd/{,runc/,runc/k8s.io/,runc/k8s.io/*/} rw,
+/{,var/}run/containerd/{,s/,runc/,runc/k8s.io/,runc/k8s.io/*/} rw,
 /{,var/}run/containerd/runc/k8s.io/*/** rwk,
 /{,var/}run/containerd/{io.containerd*/,io.containerd*/k8s.io/,io.containerd*/k8s.io/*/} rw,
 /{,var/}run/containerd/io.containerd*/*/** rwk,
+/{,var/}run/containerd/s/** rwk,
 
 # Limit ipam-state to k8s
 /run/ipam-state/k8s-** rw,
@@ -90,7 +91,7 @@
 # Wide read access to /proc, but somewhat limited writes for now
 @{PROC}/ r,
 @{PROC}/** r,
-@{PROC}/[0-9]*/attr/exec w,
+@{PROC}/[0-9]*/attr/{,apparmor/}exec w,
 @{PROC}/[0-9]*/oom_score_adj w,
 
 # Limited read access to specific bits of /sys
@@ -108,6 +109,15 @@
 /sys/fs/cgroup/*/kubepods/ rw,
 /sys/fs/cgroup/*/kubepods/** rw,
 
+# containerd can also be configured to use the systemd cgroup driver via
+# plugins.cri.systemd_cgroup = true which moves container processes into
+# systemd-managed cgroups. This is now the recommended configuration since it
+# provides a single cgroup manager (systemd) in an effort to achieve consistent
+# views of resources.
+/sys/fs/cgroup/*/systemd/{,system.slice/} rw,          # create missing dirs
+/sys/fs/cgroup/*/systemd/system.slice/** r,
+/sys/fs/cgroup/*/systemd/system.slice/cgroup.procs w,
+
 # Allow tracing ourself (especially the "runc" process we create)
 ptrace (trace) peer=@{profile_name},
 
@@ -613,9 +623,9 @@
 /dev/** mrwkl,
 @{PROC}/** mrwkl,
 
-# When kubernetes drives docker, it creates files in the container at arbitrary
-# locations.
-/** wl,
+# When kubernetes drives docker/containerd, it creates and runs files in the
+# container at arbitrary locations (eg, via pivot_root).
+/** rwlix,
 `
 
 const dockerSupportPrivilegedSecComp = `
@@ -628,29 +638,21 @@
 @unrestricted
 `
 
-type dockerSupportInterface struct{}
-
-func (iface *dockerSupportInterface) Name() string {
-	return "docker-support"
-}
+const dockerSupportServiceSnippet = `Delegate=true`
 
-func (iface *dockerSupportInterface) StaticInfo() interfaces.StaticInfo {
-	return interfaces.StaticInfo{
-		Summary:              dockerSupportSummary,
-		ImplicitOnCore:       true,
-		ImplicitOnClassic:    true,
-		BaseDeclarationPlugs: dockerSupportBaseDeclarationPlugs,
-		BaseDeclarationSlots: dockerSupportBaseDeclarationSlots,
-	}
+type dockerSupportInterface struct {
+	commonInterface
 }
 
 var (
 	parserFeatures = apparmor_sandbox.ParserFeatures
 )
 
-func (iface *dockerSupportInterface) UDevConnectedPlug(spec *udev.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
-	spec.SetControlsDeviceCgroup()
-
+func (iface *dockerSupportInterface) KModConnectedPlug(spec *kmod.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	// https://kubernetes.io/docs/setup/production-environment/container-runtimes/
+	if err := spec.AddModule("overlay"); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -698,5 +700,16 @@
 }
 
 func init() {
-	registerIface(&dockerSupportInterface{})
+	registerIface(&dockerSupportInterface{commonInterface{
+		name:                 "docker-support",
+		summary:              dockerSupportSummary,
+		implicitOnCore:       true,
+		implicitOnClassic:    true,
+		baseDeclarationPlugs: dockerSupportBaseDeclarationPlugs,
+		baseDeclarationSlots: dockerSupportBaseDeclarationSlots,
+		controlsDeviceCgroup: true,
+		serviceSnippets:      []string{dockerSupportServiceSnippet},
+		// docker-support also uses ptrace(trace), but it already declares this in
+		// the AppArmorConnectedPlug method
+	}})
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/docker_support_test.go snapd-2.48.3+20.04/interfaces/builtin/docker_support_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/docker_support_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/docker_support_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -25,6 +25,7 @@
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
 	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/kmod"
 	"github.com/snapcore/snapd/interfaces/seccomp"
 	"github.com/snapcore/snapd/interfaces/udev"
 	"github.com/snapcore/snapd/release"
@@ -47,6 +48,8 @@
 	privContainersPlug       *interfaces.ConnectedPlug
 	noPrivContainersPlugInfo *snap.PlugInfo
 	noPrivContainersPlug     *interfaces.ConnectedPlug
+	malformedPlugInfo        *snap.PlugInfo
+	malformedPlug            *interfaces.ConnectedPlug
 }
 
 const coreDockerSlotYaml = `name: core
@@ -67,6 +70,19 @@
    - network-control
 `
 
+const dockerSupportPrivilegedContainersMalformedMockPlugSnapInfoYaml = `name: docker
+version: 1.0
+plugs:
+ privileged:
+  interface: docker-support
+  privileged-containers: foobar
+apps:
+ app:
+  command: foo
+  plugs:
+  - privileged
+`
+
 const dockerSupportPrivilegedContainersFalseMockPlugSnapInfoYaml = `name: docker
 version: 1.0
 plugs:
@@ -104,6 +120,7 @@
 	s.networkCtrlSlot, s.networkCtrlSlotInfo = MockConnectedSlot(c, coreDockerSlotYaml, nil, "network-control")
 	s.privContainersPlug, s.privContainersPlugInfo = MockConnectedPlug(c, dockerSupportPrivilegedContainersTrueMockPlugSnapInfoYaml, nil, "privileged")
 	s.noPrivContainersPlug, s.noPrivContainersPlugInfo = MockConnectedPlug(c, dockerSupportPrivilegedContainersFalseMockPlugSnapInfoYaml, nil, "privileged")
+	s.malformedPlug, s.malformedPlugInfo = MockConnectedPlug(c, dockerSupportPrivilegedContainersMalformedMockPlugSnapInfoYaml, nil, "privileged")
 }
 
 func (s *DockerSupportInterfaceSuite) TestName(c *C) {
@@ -186,6 +203,14 @@
 	c.Check(spec.SnippetForTag("snap.docker.app"), testutil.Contains, "# Calls the Docker daemon itself requires\n")
 }
 
+func (s *DockerSupportInterfaceSuite) TestKModSpec(c *C) {
+	spec := &kmod.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.Modules(), DeepEquals, map[string]bool{
+		"overlay": true,
+	})
+}
+
 func (s *DockerSupportInterfaceSuite) TestPermanentSlotAppArmorSessionNative(c *C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -234,3 +259,15 @@
 	c.Assert(spec.AddConnectedPlug(builtin.MustInterface("network-control"), s.networkCtrlPlug, s.networkCtrlSlot), IsNil)
 	c.Assert(spec.Snippets(), HasLen, 0)
 }
+
+func (s *DockerSupportInterfaceSuite) TestServicePermanentPlugSnippets(c *C) {
+	snips, err := interfaces.PermanentPlugServiceSnippets(s.iface, s.plugInfo)
+	c.Assert(err, IsNil)
+	c.Check(snips, DeepEquals, []string{"Delegate=true"})
+
+	// check that a malformed plug with bad attribute returns non-nil error
+	// from PermanentPlugServiceSnippets, thereby ensuring that function
+	// sanitizes plugs
+	_, err = interfaces.PermanentPlugServiceSnippets(s.iface, s.malformedPlugInfo)
+	c.Assert(err, ErrorMatches, "docker-support plug requires bool with 'privileged-containers'")
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/export_test.go snapd-2.48.3+20.04/interfaces/builtin/export_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,6 +37,8 @@
 	LabelExpr                   = labelExpr
 	PlugAppLabelExpr            = plugAppLabelExpr
 	SlotAppLabelExpr            = slotAppLabelExpr
+	AareExclusivePatterns       = aareExclusivePatterns
+	GetDesktopFileRules         = getDesktopFileRules
 )
 
 func MprisGetName(iface interfaces.Interface, attribs map[string]interface{}) (string, error) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/fwupd.go snapd-2.48.3+20.04/interfaces/builtin/fwupd.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/fwupd.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/fwupd.go	2021-02-02 08:21:12.000000000 +0000
@@ -71,6 +71,12 @@
   /sys/firmware/efi/efivars/** rw,
 
   # Allow write access for efi firmware updater
+  /boot/efi/{,**/} r,
+  # allow access to fwupd* and fw/ under boot/ for core systems
+  /boot/efi/EFI/boot/fwupd*.efi* rw,
+  /boot/efi/EFI/boot/fw/** rw,
+  # allow access to fwupd* and fw/ under ubuntu/ for classic systems
+  /boot/efi/EFI/ubuntu/fwupd*.efi* rw,
   /boot/efi/EFI/ubuntu/fw/** rw,
 
   # Allow access from efivar library
@@ -129,11 +135,11 @@
   #   https://www.freedesktop.org/software/systemd/man/nss-resolve.html
   #
   dbus send
-       bus=system
-       path="/org/freedesktop/resolve1"
-       interface="org.freedesktop.resolve1.Manager"
-       member="Resolve{Address,Hostname,Record,Service}"
-       peer=(name="org.freedesktop.resolve1"),
+      bus=system
+      path="/org/freedesktop/resolve1"
+      interface="org.freedesktop.resolve1.Manager"
+      member="Resolve{Address,Hostname,Record,Service}"
+      peer=(name="org.freedesktop.resolve1"),
 
   # Allow access to fwupd service
   dbus (receive, send)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/gconf.go snapd-2.48.3+20.04/interfaces/builtin/gconf.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/gconf.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/gconf.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,74 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+const gconfSummary = `allows access to any item from the legacy gconf configuration system for the current user`
+
+// Manually connected since gconf is a global database for GNOME desktop and
+// application settings and offers no application isolation. Modern
+// applications should use dconf/gsettings instead and this interface is
+// provided for old codebases that cannot be migrated.
+const gconfBaseDeclarationSlots = `
+  gconf:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const gconfConnectedPlugAppArmor = `
+# Description: Can access gconf databases from the user's session.
+
+#include <abstractions/dbus-session-strict>
+
+# gconf_client_get_default() is used by all applications and will autostart
+# gconfd-2, but don't require label=unconfined since AssumedAppArmorLabel may
+# not be set. Once started, gconfd-2 remains running so the other APIs can use
+# label=unconfined. See gconf/gconf-dbus-utils.h
+dbus (send)
+    bus=session
+    path=/org/gnome/GConf/Server
+    member=Get{,Default}Database
+    peer=(name=org.gnome.GConf),
+
+# receive notifications and server messages
+dbus (receive)
+    bus=session
+    path=/org/gnome/GConf/{Client,Server}
+    interface=org.gnome.GConf.{Client,Server}
+    peer=(label=unconfined),
+
+# allow all operations on the database
+dbus (send)
+    bus=session
+    path=/org/gnome/GConf/Database/*
+    interface=org.gnome.GConf.Database
+    peer=(label=unconfined),
+`
+
+func init() {
+	registerIface(&commonInterface{
+		name:                  "gconf",
+		summary:               gconfSummary,
+		implicitOnClassic:     true,
+		connectedPlugAppArmor: gconfConnectedPlugAppArmor,
+		baseDeclarationSlots:  gconfBaseDeclarationSlots,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/gconf_test.go snapd-2.48.3+20.04/interfaces/builtin/gconf_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/gconf_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/gconf_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,103 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type gconfInterfaceSuite struct {
+	iface        interfaces.Interface
+	coreSlotInfo *snap.SlotInfo
+	coreSlot     *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&gconfInterfaceSuite{
+	iface: builtin.MustInterface("gconf"),
+})
+
+const gconfConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [gconf]
+`
+
+const gconfCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  gconf:
+`
+
+func (s *gconfInterfaceSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, gconfConsumerYaml, nil, "gconf")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, gconfCoreYaml, nil, "gconf")
+}
+
+func (s *gconfInterfaceSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("/")
+}
+
+func (s *gconfInterfaceSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "gconf")
+}
+
+func (s *gconfInterfaceSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *gconfInterfaceSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *gconfInterfaceSuite) TestAppArmorSpec(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: Can access gconf databases from the user's session.")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "interface=org.gnome.GConf.Database")
+}
+
+func (s *gconfInterfaceSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, false)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to any item from the legacy gconf configuration system for the current user`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "gconf")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *gconfInterfaceSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/greengrass_support.go snapd-2.48.3+20.04/interfaces/builtin/greengrass_support.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/greengrass_support.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/greengrass_support.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,7 +22,10 @@
 import (
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/seccomp"
+	"github.com/snapcore/snapd/interfaces/udev"
 	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
 )
 
 const greengrassSupportSummary = `allows operating as the Greengrass service`
@@ -51,7 +54,18 @@
 /system-data/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/*/ggc-writable/{,**} rw,
 `
 
-const greengrassSupportConnectedPlugAppArmor = `
+const greengrassSupportProcessModeConnectedPlugAppArmor = `
+# Description: can manage greengrass 'things' and their sandboxes. This policy
+# is meant currently only to enable Greengrass to run _only_ process-mode or 
+# "no container" lambdas.
+# needed by older versions of cloneBinary.ensureSelfCloned() to avoid 
+# CVE-2019-5736
+/ ix,
+# newer versions of runC have this denial instead of "/ ix" above
+/bin/runc rix,
+`
+
+const greengrassSupportFullContainerConnectedPlugAppArmor = `
 # Description: can manage greengrass 'things' and their sandboxes. This
 # policy is intentionally not restrictive and is here to help guard against
 # programming errors and not for security confinement. The greengrassd
@@ -379,14 +393,68 @@
 mknodat - - |S_IFCHR -
 `
 
+func (iface *greengrassSupportInterface) ServicePermanentPlug(plug *snap.PlugInfo) []string {
+	var flavor string
+	_ = plug.Attr("flavor", &flavor)
+
+	// only no-container flavor does not get Delegate=true, all other flavors
+	// (including no flavor, which is the same as legacy-container flavor)
+	// are usable to manage control groups of processes/containers, and thus
+	// need Delegate=true
+	if flavor == "no-container" {
+		return nil
+	}
+
+	return []string{"Delegate=true"}
+}
+
 func (iface *greengrassSupportInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
-	if release.OnClassic {
-		spec.AddSnippet(greengrassSupportConnectedPlugAppArmor)
-	} else {
-		spec.AddSnippet(greengrassSupportConnectedPlugAppArmor + greengrassSupportConnectedPlugAppArmorCore)
+	// check the flavor
+	var flavor string
+	_ = plug.Attr("flavor", &flavor)
+	switch flavor {
+	case "", "legacy-container":
+		// default, legacy version of the interface
+		if release.OnClassic {
+			spec.AddSnippet(greengrassSupportFullContainerConnectedPlugAppArmor)
+		} else {
+			spec.AddSnippet(greengrassSupportFullContainerConnectedPlugAppArmor + greengrassSupportConnectedPlugAppArmorCore)
+		}
+		// greengrass needs to use ptrace for controlling it's containers
+		spec.SetUsesPtraceTrace()
+	case "no-container":
+		// this is the no-container version, it does not use as much privilege
+		// as the default "legacy-container" flavor
+		spec.AddSnippet(greengrassSupportProcessModeConnectedPlugAppArmor)
+	}
+
+	return nil
+}
+
+func (iface *greengrassSupportInterface) SecCompConnectedPlug(spec *seccomp.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	// check the flavor
+	var flavor string
+	_ = plug.Attr("flavor", &flavor)
+	switch flavor {
+	case "", "legacy-container":
+		spec.AddSnippet(greengrassSupportConnectedPlugSeccomp)
+	case "no-container":
+		// no-container has no additional seccomp available to it
+	}
+
+	return nil
+}
+
+func (iface *greengrassSupportInterface) UDevConnectedPlug(spec *udev.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	var flavor string
+	_ = plug.Attr("flavor", &flavor)
+	switch flavor {
+	case "", "legacy-container":
+		// default containerization controls the device cgroup
+		spec.SetControlsDeviceCgroup()
+	case "no-container":
+		// no-container does not control the device cgroup
 	}
-	// greengrass needs to use ptrace
-	spec.SetUsesPtraceTrace()
 
 	return nil
 }
@@ -404,7 +472,5 @@
 		implicitOnClassic:    true,
 		baseDeclarationSlots: greengrassSupportBaseDeclarationSlots,
 		baseDeclarationPlugs: greengrassSupportBaseDeclarationPlugs,
-		connectedPlugSecComp: greengrassSupportConnectedPlugSeccomp,
-		controlsDeviceCgroup: true,
 	}})
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/greengrass_support_test.go snapd-2.48.3+20.04/interfaces/builtin/greengrass_support_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/greengrass_support_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/greengrass_support_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,6 +42,14 @@
 	extraSlot     *interfaces.ConnectedSlot
 	extraPlugInfo *snap.PlugInfo
 	extraPlug     *interfaces.ConnectedPlug
+
+	// for the process flavor
+	processModePlugInfo *snap.PlugInfo
+	processModePlug     *interfaces.ConnectedPlug
+
+	// for the container flavor
+	containerModePlugInfo *snap.PlugInfo
+	containerModePlug     *interfaces.ConnectedPlug
 }
 
 const coreSlotYaml = `name: core
@@ -53,10 +61,26 @@
 `
 const ggMockPlugSnapInfoYaml = `name: other
 version: 1.0
+plugs:
+ greengrass-support-legacy-container:
+  interface: greengrass-support
+  flavor: legacy-container
+apps:
+ app2:
+  command: foo
+  plugs: [greengrass-support-legacy-container, greengrass-support, network-control]
+`
+
+const ggProcessModeMockPlugSnapInfoYaml = `name: other
+version: 1.0
+plugs:
+ greengrass-support-no-container:
+  interface: greengrass-support
+  flavor: no-container
 apps:
  app2:
   command: foo
-  plugs: [greengrass-support, network-control]
+  plugs: [greengrass-support-no-container, network-control]
 `
 
 var _ = Suite(&GreengrassSupportInterfaceSuite{
@@ -69,6 +93,10 @@
 	s.extraPlug, s.extraPlugInfo = MockConnectedPlug(c, ggMockPlugSnapInfoYaml, nil, "network-control")
 	s.extraSlot, s.extraSlotInfo = MockConnectedSlot(c, coreSlotYaml, nil, "network-control")
 
+	s.processModePlug, s.processModePlugInfo = MockConnectedPlug(c, ggProcessModeMockPlugSnapInfoYaml, nil, "greengrass-support-no-container")
+
+	s.containerModePlug, s.containerModePlugInfo = MockConnectedPlug(c, ggMockPlugSnapInfoYaml, nil, "greengrass-support-legacy-container")
+
 }
 
 func (s *GreengrassSupportInterfaceSuite) TestName(c *C) {
@@ -84,39 +112,86 @@
 }
 
 func (s *GreengrassSupportInterfaceSuite) TestAppArmorSpec(c *C) {
+
+	for _, plug := range []*interfaces.ConnectedPlug{
+		s.plug,
+		s.containerModePlug,
+	} {
+		spec := &apparmor.Specification{}
+		c.Assert(spec.AddConnectedPlug(s.iface, plug, s.slot), IsNil)
+		c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
+		c.Check(spec.SnippetForTag("snap.other.app2"), testutil.Contains, "mount options=(rw, bind) /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** ,\n")
+		c.Check(spec.UsesPtraceTrace(), Equals, true)
+	}
+}
+
+func (s *GreengrassSupportInterfaceSuite) TestProcessModeAppArmorSpec(c *C) {
 	spec := &apparmor.Specification{}
-	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.AddConnectedPlug(s.iface, s.processModePlug, s.slot), IsNil)
 	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
-	c.Check(spec.SnippetForTag("snap.other.app2"), testutil.Contains, "mount options=(rw, bind) /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** ,\n")
-	c.Check(spec.UsesPtraceTrace(), Equals, true)
+	c.Check(spec.SnippetForTag("snap.other.app2"), testutil.Contains, "/ ix,\n")
+	c.Check(spec.SnippetForTag("snap.other.app2"), Not(testutil.Contains), "mount options=(rw, bind) /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** ,\n")
+	c.Check(spec.UsesPtraceTrace(), Equals, false)
 }
 
 func (s *GreengrassSupportInterfaceSuite) TestSecCompSpec(c *C) {
+	for _, plug := range []*interfaces.ConnectedPlug{
+		s.plug,
+		s.containerModePlug,
+	} {
+		spec := &seccomp.Specification{}
+		c.Assert(spec.AddConnectedPlug(s.iface, plug, s.slot), IsNil)
+		c.Check(spec.SnippetForTag("snap.other.app2"), testutil.Contains, "# for overlayfs and various bind mounts\nmount\numount2\npivot_root\n")
+	}
+}
+
+func (s *GreengrassSupportInterfaceSuite) TestProcessModeSecCompSpec(c *C) {
 	spec := &seccomp.Specification{}
-	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
-	c.Check(spec.SnippetForTag("snap.other.app2"), testutil.Contains, "# for overlayfs and various bind mounts\nmount\numount2\npivot_root\n")
+	c.Assert(spec.AddConnectedPlug(s.iface, s.processModePlug, s.slot), IsNil)
+	c.Check(spec.SnippetForTag("snap.other.app2"), Not(testutil.Contains), "# for overlayfs and various bind mounts\nmount\numount2\npivot_root\n")
 }
 
 func (s *GreengrassSupportInterfaceSuite) TestUdevTaggingDisablingRemoveLast(c *C) {
-	// make a spec with network-control that has udev tagging
-	spec := &udev.Specification{}
-	c.Assert(spec.AddConnectedPlug(builtin.MustInterface("network-control"), s.extraPlug, s.extraSlot), IsNil)
-	c.Assert(spec.Snippets(), HasLen, 3)
-
-	// connect the greengrass-support interface and ensure the spec is now nil
-	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
-	c.Check(spec.Snippets(), HasLen, 0)
+	for _, plug := range []*interfaces.ConnectedPlug{
+		s.plug,
+		s.containerModePlug,
+	} {
+		// make a spec with network-control that has udev tagging
+		spec := &udev.Specification{}
+		c.Assert(spec.AddConnectedPlug(builtin.MustInterface("network-control"), s.extraPlug, s.extraSlot), IsNil)
+		c.Assert(spec.Snippets(), HasLen, 3)
+
+		// connect the greengrass-support interface and ensure the spec is now nil
+		c.Assert(spec.AddConnectedPlug(s.iface, plug, s.slot), IsNil)
+		c.Check(spec.Snippets(), HasLen, 0)
+	}
 }
 
-func (s *GreengrassSupportInterfaceSuite) TestUdevTaggingDisablingRemoveFirst(c *C) {
+func (s *GreengrassSupportInterfaceSuite) TestProcessModeUdevTaggingWorks(c *C) {
 	spec := &udev.Specification{}
 	// connect the greengrass-support interface and ensure the spec is nil
-	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.AddConnectedPlug(s.iface, s.processModePlug, s.slot), IsNil)
 	c.Check(spec.Snippets(), HasLen, 0)
 
-	// add network-control and ensure the spec is still nil
+	// add network-control and now the spec is not nil
 	c.Assert(spec.AddConnectedPlug(builtin.MustInterface("network-control"), s.extraPlug, s.extraSlot), IsNil)
-	c.Assert(spec.Snippets(), HasLen, 0)
+	c.Assert(spec.Snippets(), Not(HasLen), 0)
+}
+
+func (s *GreengrassSupportInterfaceSuite) TestUdevTaggingDisablingRemoveFirst(c *C) {
+	for _, plug := range []*interfaces.ConnectedPlug{
+		s.plug,
+		s.containerModePlug,
+	} {
+		spec := &udev.Specification{}
+		// connect the greengrass-support interface and ensure the spec is nil
+		c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+		c.Check(spec.Snippets(), HasLen, 0)
+
+		// add network-control and ensure the spec is still nil
+		c.Assert(spec.AddConnectedPlug(builtin.MustInterface("network-control"), plug, s.extraSlot), IsNil)
+		c.Assert(spec.Snippets(), HasLen, 0)
+	}
 }
 
 func (s *GreengrassSupportInterfaceSuite) TestInterfaces(c *C) {
@@ -127,24 +202,50 @@
 	restore := release.MockOnClassic(false)
 	defer restore()
 
-	apparmorSpec := &apparmor.Specification{}
-	err := apparmorSpec.AddConnectedPlug(s.iface, s.plug, s.slot)
-	c.Assert(err, IsNil)
-	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
-
-	// verify core rule present
-	c.Check(apparmorSpec.SnippetForTag("snap.other.app2"), testutil.Contains, "# /system-data/var/snap/greengrass/x1/ggc-writable/packages/1.7.0/var/worker/overlays/$UUID/upper/\n")
+	for _, plug := range []*interfaces.ConnectedPlug{
+		s.plug,
+		s.containerModePlug,
+	} {
+		apparmorSpec := &apparmor.Specification{}
+		err := apparmorSpec.AddConnectedPlug(s.iface, plug, s.slot)
+		c.Assert(err, IsNil)
+		c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
+
+		// verify core rule present
+		c.Check(apparmorSpec.SnippetForTag("snap.other.app2"), testutil.Contains, "# /system-data/var/snap/greengrass/x1/ggc-writable/packages/1.7.0/var/worker/overlays/$UUID/upper/\n")
+	}
 }
 
 func (s *GreengrassSupportInterfaceSuite) TestPermanentSlotAppArmorSessionClassic(c *C) {
 	restore := release.MockOnClassic(true)
 	defer restore()
 
-	apparmorSpec := &apparmor.Specification{}
-	err := apparmorSpec.AddConnectedPlug(s.iface, s.plug, s.slot)
-	c.Assert(err, IsNil)
-	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
-
-	// verify core rule not present
-	c.Check(apparmorSpec.SnippetForTag("snap.other.app2"), Not(testutil.Contains), "# /system-data/var/snap/greengrass/x1/ggc-writable/packages/1.7.0/var/worker/overlays/$UUID/upper/\n")
+	for _, plug := range []*interfaces.ConnectedPlug{
+		s.plug,
+		s.containerModePlug,
+	} {
+		apparmorSpec := &apparmor.Specification{}
+		err := apparmorSpec.AddConnectedPlug(s.iface, plug, s.slot)
+		c.Assert(err, IsNil)
+		c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
+
+		// verify core rule not present
+		c.Check(apparmorSpec.SnippetForTag("snap.other.app2"), Not(testutil.Contains), "# /system-data/var/snap/greengrass/x1/ggc-writable/packages/1.7.0/var/worker/overlays/$UUID/upper/\n")
+	}
+}
+
+func (s *GreengrassSupportInterfaceSuite) TestPermanentPlugServiceSnippets(c *C) {
+	for _, t := range []struct {
+		plug *snap.PlugInfo
+		exp  []string
+	}{
+		{s.plugInfo, []string{"Delegate=true"}},
+		{s.containerModePlugInfo, []string{"Delegate=true"}},
+		// the process-mode or no-container plug doesn't get Delegate=true
+		{s.processModePlugInfo, nil},
+	} {
+		snips, err := interfaces.PermanentPlugServiceSnippets(s.iface, t.plug)
+		c.Assert(err, IsNil)
+		c.Check(snips, DeepEquals, t.exp)
+	}
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/hugepages_control.go snapd-2.48.3+20.04/interfaces/builtin/hugepages_control.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/hugepages_control.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/hugepages_control.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,76 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+// https://www.kernel.org/doc/Documentation/vm/hugetlbpage.txt
+// https://www.kernel.org/doc/Documentation/vm/transhuge.txt
+// This interface assumes that huge pages are mounted at either:
+// - /dev/hugepages (Debian, Ubuntu)
+// - /run/hugepages (various documentation)
+const hugepagesControlSummary = `allows controlling hugepages`
+
+const hugepagesControlBaseDeclarationSlots = `
+  hugepages-control:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const hugepagesControlConnectedPlugAppArmor = `
+# Allow configuring huge pages via /sys or /proc
+/sys/kernel/mm/hugepages/{,hugepages-[0-9]*}/* r,
+/sys/kernel/mm/hugepages/{,hugepages-[0-9]*}/nr_{hugepages,hugepages_mempolicy,overcommit_hugepages} w,
+/sys/devices/system/node/node[0-9]*/hugepages/{,hugepages-[0-9]*}/* r,
+/sys/devices/system/node/node[0-9]*/hugepages/{,hugepages-[0-9]*}/nr_hugepages w,
+@{PROC}/sys/vm/nr_{hugepages,hugepages_mempolicy,overcommit_hugepages} rw,
+
+# Observe which group can create shm segments using hugetlb pages
+@{PROC}/sys/vm/hugetlb_shm_group r,
+
+# Observe allocated huge pages by node (@{PROC}/meminfo already in base abstraction)
+/sys/devices/system/node/node[0-9]*/meminfo r,
+
+# hugepages may be controlled via chown/chgrp/chmod. Enforce this with
+# owner match
+/{dev,run}/hugepages/ r,
+owner /{dev,run}/hugepages/{,**} rwk,
+
+# Allow configuring transparent huge pages
+/sys/kernel/mm/transparent_hugepage/{,**} r,
+/sys/kernel/mm/transparent_hugepage/defrag w,
+/sys/kernel/mm/transparent_hugepage/{,shmem_}enabled w,
+/sys/kernel/mm/transparent_hugepage/use_zero_page w,
+/sys/kernel/mm/transparent_hugepage/khugepaged/{alloc,scan}_sleep_millisecs w,
+/sys/kernel/mm/transparent_hugepage/khugepaged/defrag w,
+/sys/kernel/mm/transparent_hugepage/khugepaged/max_ptes_{none,swap} w,
+/sys/kernel/mm/transparent_hugepage/khugepaged/pages_to_scan w,
+`
+
+func init() {
+	registerIface(&commonInterface{
+		name:                  "hugepages-control",
+		summary:               hugepagesControlSummary,
+		implicitOnCore:        true,
+		implicitOnClassic:     true,
+		baseDeclarationSlots:  hugepagesControlBaseDeclarationSlots,
+		connectedPlugAppArmor: hugepagesControlConnectedPlugAppArmor,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/hugepages_control_test.go snapd-2.48.3+20.04/interfaces/builtin/hugepages_control_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/hugepages_control_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/hugepages_control_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,104 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type HugepagesControlSuite struct {
+	iface    interfaces.Interface
+	slotInfo *snap.SlotInfo
+	slot     *interfaces.ConnectedSlot
+	plugInfo *snap.PlugInfo
+	plug     *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&HugepagesControlSuite{
+	iface: builtin.MustInterface("hugepages-control"),
+})
+
+func (s *HugepagesControlSuite) SetUpTest(c *C) {
+	const producerYaml = `name: core
+version: 0
+type: os
+slots:
+  hugepages-control:
+`
+	info := snaptest.MockInfo(c, producerYaml, nil)
+	s.slotInfo = info.Slots["hugepages-control"]
+	s.slot = interfaces.NewConnectedSlot(s.slotInfo, nil, nil)
+
+	const consumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [hugepages-control]
+`
+	info = snaptest.MockInfo(c, consumerYaml, nil)
+	s.plugInfo = info.Plugs["hugepages-control"]
+	s.plug = interfaces.NewConnectedPlug(s.plugInfo, nil, nil)
+}
+
+func (s *HugepagesControlSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "hugepages-control")
+}
+
+func (s *HugepagesControlSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.slotInfo), IsNil)
+}
+
+func (s *HugepagesControlSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *HugepagesControlSuite) TestAppArmorSpec(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains,
+		"/sys/kernel/mm/hugepages/{,hugepages-[0-9]*}/* r,")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains,
+		"/sys/kernel/mm/hugepages/{,hugepages-[0-9]*}/nr_{hugepages,hugepages_mempolicy,overcommit_hugepages} w,")
+}
+
+func (s *HugepagesControlSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, true)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, "allows controlling hugepages")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "hugepages-control")
+}
+
+func (s *HugepagesControlSuite) TestAutoConnect(c *C) {
+	// FIXME: fix AutoConnect methods to use ConnectedPlug/Slot
+	c.Assert(s.iface.AutoConnect(s.plugInfo, s.slotInfo), Equals, true)
+}
+
+func (s *HugepagesControlSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/i2c.go snapd-2.48.3+20.04/interfaces/builtin/i2c.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/i2c.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/i2c.go	2021-02-02 08:21:12.000000000 +0000
@@ -46,7 +46,6 @@
 # Description: Can access I2C controller
 
 %s rw,
-/sys/devices/platform/{*,**.i2c}/%s/** rw,
 `
 
 const i2cConnectedPlugAppArmorSysfsName = `
@@ -129,7 +128,11 @@
 	}
 
 	cleanedPath := filepath.Clean(path)
-	spec.AddSnippet(fmt.Sprintf(i2cConnectedPlugAppArmorPath, cleanedPath, strings.TrimPrefix(path, "/dev/")))
+	spec.AddSnippet(fmt.Sprintf(i2cConnectedPlugAppArmorPath, cleanedPath))
+	// Use parametric snippets to avoid no-expr-simplify side-effects.
+	spec.AddParametricSnippet([]string{
+		"/sys/devices/platform/{*,**.i2c}/i2c-" /* ###PARAM### */, "/** rw,  # Add any condensed parametric rules",
+	}, strings.TrimPrefix(path, "/dev/i2c-"))
 	return nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/i2c_test.go snapd-2.48.3+20.04/interfaces/builtin/i2c_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/i2c_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/i2c_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -110,7 +110,7 @@
     path: /dev/i2c-1
   test-udev-2:
     interface: i2c
-    path: /dev/i2c-11
+    path: /dev/i2c-2
   test-udev-3:
     interface: i2c
     path: /dev/i2c-0
@@ -246,7 +246,18 @@
 	c.Assert(spec.AddConnectedPlug(s.iface, s.testPlugPort1, s.testUDev1), IsNil)
 	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.client-snap.app-accessing-1-port"})
 	c.Assert(spec.SnippetForTag("snap.client-snap.app-accessing-1-port"), testutil.Contains, `/dev/i2c-1 rw,`)
-	c.Assert(spec.SnippetForTag("snap.client-snap.app-accessing-1-port"), testutil.Contains, `/sys/devices/platform/{*,**.i2c}/i2c-1/** rw,`)
+	c.Assert(spec.SnippetForTag("snap.client-snap.app-accessing-1-port"), testutil.Contains, `/sys/devices/platform/{*,**.i2c}/i2c-1/** rw,  # Add any condensed parametric rules`)
+}
+
+func (s *I2cInterfaceSuite) TestAppArmorSpecPathMany(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.testPlugPort1, s.testUDev1), IsNil)
+	c.Assert(spec.AddConnectedPlug(s.iface, s.testPlugPort1, s.testUDev2), IsNil)
+	// NOTE: the snap name is misleading.
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.client-snap.app-accessing-1-port"})
+	c.Assert(spec.SnippetForTag("snap.client-snap.app-accessing-1-port"), testutil.Contains, `/dev/i2c-1 rw,`)
+	c.Assert(spec.SnippetForTag("snap.client-snap.app-accessing-1-port"), testutil.Contains, `/dev/i2c-2 rw,`)
+	c.Assert(spec.SnippetForTag("snap.client-snap.app-accessing-1-port"), testutil.Contains, `/sys/devices/platform/{*,**.i2c}/i2c-{1,2}/** rw,  # Add any condensed parametric rules`)
 }
 
 func (s *I2cInterfaceSuite) TestAppArmorSpecSysfsName(c *C) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/iio.go snapd-2.48.3+20.04/interfaces/builtin/iio.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/iio.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/iio.go	2021-02-02 08:21:12.000000000 +0000
@@ -48,8 +48,6 @@
 ###IIO_DEVICE_PATH### rw,
 /sys/bus/iio/devices/###IIO_DEVICE_NAME###/ r,
 /sys/bus/iio/devices/###IIO_DEVICE_NAME###/** rwk,
-/sys/devices/**/###IIO_DEVICE_NAME###/ r,
-/sys/devices/**/###IIO_DEVICE_NAME###/** rwk,
 `
 
 // The type for iio interface
@@ -113,7 +111,24 @@
 	deviceName := strings.TrimPrefix(path, "/dev/")
 	snippet = strings.Replace(snippet, "###IIO_DEVICE_NAME###", deviceName, -1)
 
+	// Add a snippet for various device specific rules, except for sysfs write
+	// access that are specialized below.
 	spec.AddSnippet(snippet)
+
+	// Because all deviceName values have the prefix of "iio:device" enforced
+	// by the sanitization logic above, we can trim that prefix and provide a
+	// shorter expansion expression.
+	deviceNum := strings.TrimPrefix(deviceName, "iio:device")
+
+	// Use parametric snippets to avoid no-expr-simplify side-effects.
+	spec.AddParametricSnippet([]string{
+		"/sys/devices/**/iio:device" /* ###PARAM### */, "/** rwk,  # Add any condensed parametric rules",
+	}, deviceNum)
+	// For consistency, not an efficiency problem.
+	spec.AddParametricSnippet([]string{
+		"/sys/devices/**/iio:device" /* ###PARAM### */, "/ r,  # Add any condensed parametric rules",
+	}, deviceNum)
+
 	return nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/iio_test.go snapd-2.48.3+20.04/interfaces/builtin/iio_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/iio_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/iio_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,8 +36,8 @@
 	iface interfaces.Interface
 
 	// OS Snap
-	testSlot1           *interfaces.ConnectedSlot
 	testSlot1Info       *snap.SlotInfo
+	testSlot2Info       *snap.SlotInfo
 	testSlotCleaned     *interfaces.ConnectedSlot
 	testSlotCleanedInfo *snap.SlotInfo
 
@@ -205,22 +205,51 @@
 	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_client-snap_app-accessing-1-port", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_client-snap_app-accessing-1-port $devpath $major:$minor"`)
 }
 
-func (s *IioInterfaceSuite) TestConnectedPlugAppArmorSnippets(c *C) {
-	expectedSnippet1 := `
+func (s *IioInterfaceSuite) TestConnectedPlugAppArmorSingleSnippet(c *C) {
+	expectedSnippet := `
 # Description: Give access to a specific IIO device on the system.
 
 /dev/iio:device1 rw,
 /sys/bus/iio/devices/iio:device1/ r,
 /sys/bus/iio/devices/iio:device1/** rwk,
-/sys/devices/**/iio:device1/ r,
-/sys/devices/**/iio:device1/** rwk,
-`
+
+/sys/devices/**/iio:device1/ r,  # Add any condensed parametric rules
+/sys/devices/**/iio:device1/** rwk,  # Add any condensed parametric rules`
 	apparmorSpec := &apparmor.Specification{}
 	err := apparmorSpec.AddConnectedPlug(s.iface, s.testPlugPort1, s.testUDev1)
 	c.Assert(err, IsNil)
 	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.client-snap.app-accessing-1-port"})
 	snippet := apparmorSpec.SnippetForTag("snap.client-snap.app-accessing-1-port")
-	c.Assert(snippet, Equals, expectedSnippet1)
+	c.Assert(snippet, Equals, expectedSnippet)
+}
+
+func (s *IioInterfaceSuite) TestConnectedPlugAppArmorSnippetsMultipleOptimized(c *C) {
+	expectedSnippet := `
+# Description: Give access to a specific IIO device on the system.
+
+/dev/iio:device1 rw,
+/sys/bus/iio/devices/iio:device1/ r,
+/sys/bus/iio/devices/iio:device1/** rwk,
+
+
+# Description: Give access to a specific IIO device on the system.
+
+/dev/iio:device2 rw,
+/sys/bus/iio/devices/iio:device2/ r,
+/sys/bus/iio/devices/iio:device2/** rwk,
+
+/sys/devices/**/iio:device{1,2}/ r,  # Add any condensed parametric rules
+/sys/devices/**/iio:device{1,2}/** rwk,  # Add any condensed parametric rules`
+	apparmorSpec := &apparmor.Specification{}
+	err := apparmorSpec.AddConnectedPlug(s.iface, s.testPlugPort1, s.testUDev1)
+	c.Assert(err, IsNil)
+	err = apparmorSpec.AddConnectedPlug(s.iface, s.testPlugPort1, s.testUDev2)
+	c.Assert(err, IsNil)
+	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.client-snap.app-accessing-1-port"})
+	// XXX: the tag snap.client-snap.app-accessing-1-port is
+	// misleading when you are testing for '1' and '2' ports
+	snippet := apparmorSpec.SnippetForTag("snap.client-snap.app-accessing-1-port")
+	c.Assert(snippet, Equals, expectedSnippet)
 }
 
 func (s *IioInterfaceSuite) TestAutoConnect(c *C) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/kernel_crypto_api.go snapd-2.48.3+20.04/interfaces/builtin/kernel_crypto_api.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/kernel_crypto_api.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/kernel_crypto_api.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,66 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+// https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
+// https://www.kernel.org/doc/html/latest/crypto/intro.html
+const kernelCryptoAPISummary = `allows access to the Linux kernel crypto API`
+
+// The kernel crypto API is designed to be used by any process (ie, using it
+// requires no special privileges). Since it provides a kernel surface and
+// has a CVE history, manually connect for now.
+const kernelCryptoAPIBaseDeclarationSlots = `
+  kernel-crypto-api:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const kernelCryptoAPIConnectedPlugAppArmor = `
+# Description: Can access the Linux kernel crypto API
+@{PROC}/crypto r,
+
+# socket(AF_ALG, SOCK_SEQPACKET, ...)
+network alg seqpacket,
+
+# socket(AF_NETLINK, SOCK_{DGRAM,RAW}, NETLINK_CRYPTO)
+network netlink dgram,
+network netlink raw,
+`
+
+const kernelCryptoAPIConnectedPlugSeccomp = `
+# Description: Can access the Linux kernel crypto API
+socket AF_NETLINK - NETLINK_CRYPTO
+bind
+accept
+`
+
+func init() {
+	registerIface(&commonInterface{
+		name:                  "kernel-crypto-api",
+		summary:               kernelCryptoAPISummary,
+		implicitOnCore:        true,
+		implicitOnClassic:     true,
+		connectedPlugAppArmor: kernelCryptoAPIConnectedPlugAppArmor,
+		connectedPlugSecComp:  kernelCryptoAPIConnectedPlugSeccomp,
+		baseDeclarationSlots:  kernelCryptoAPIBaseDeclarationSlots,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/kernel_crypto_api_test.go snapd-2.48.3+20.04/interfaces/builtin/kernel_crypto_api_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/kernel_crypto_api_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/kernel_crypto_api_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,103 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/seccomp"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type kernelCryptoAPIInterfaceSuite struct {
+	iface        interfaces.Interface
+	coreSlotInfo *snap.SlotInfo
+	coreSlot     *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&kernelCryptoAPIInterfaceSuite{
+	iface: builtin.MustInterface("kernel-crypto-api"),
+})
+
+const kernelCryptoAPIConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [kernel-crypto-api]
+`
+
+const kernelCryptoAPICoreYaml = `name: core
+version: 0
+type: os
+slots:
+  kernel-crypto-api:
+`
+
+func (s *kernelCryptoAPIInterfaceSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, kernelCryptoAPIConsumerYaml, nil, "kernel-crypto-api")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, kernelCryptoAPICoreYaml, nil, "kernel-crypto-api")
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "kernel-crypto-api")
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestAppArmorSpec(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: Can access the Linux kernel crypto API")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "network alg seqpacket,")
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestSeccompSpec(c *C) {
+	spec := &seccomp.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: Can access the Linux kernel crypto API")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "socket AF_NETLINK - NETLINK_CRYPTO")
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, true)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to the Linux kernel crypto API`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "kernel-crypto-api")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *kernelCryptoAPIInterfaceSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/kubernetes_support.go snapd-2.48.3+20.04/interfaces/builtin/kubernetes_support.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/kubernetes_support.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/kubernetes_support.go	2021-02-02 08:21:12.000000000 +0000
@@ -63,7 +63,7 @@
 
 capability dac_override,
 
-/usr/bin/systemd-run Cxr -> systemd_run,
+/{,usr/}bin/systemd-run Cxr -> systemd_run,
 /run/systemd/private r,
 profile systemd_run (attach_disconnected,mediate_deleted) {
   # Common rules for kubernetes use of systemd_run
@@ -72,20 +72,38 @@
   /{,usr/}bin/systemd-run rm,
   owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/environ r,
-  @{PROC}/cmdline r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/1/sched r,
+  @{PROC}/cmdline r,  # proc_cmdline()
 
   # setsockopt()
   capability net_admin,
 
-  # ptrace 'trace' is coarse and not required for using the systemd private
-  # socket, and while the child profile omits 'capability sys_ptrace', skip
-  # for now since it isn't strictly required.
-  ptrace read peer=unconfined,
-  deny ptrace trace peer=unconfined,
+  # systemd-run's detect_container() looks at several files to determine if it
+  # is running in a container.
+  @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/1/sched r,
+  /run/systemd/container r,
+
+  # kubelet calls 'systemd-run --scope true' to determine if systemd is
+  # available and usable for calling certain mount commands under transient
+  # units as part of its lifecycle management. This requires ptrace 'read' on
+  # unconfined since systemd-run will call its detect_container() which will
+  # try to read /proc/1/environ. This is mediated via PTRACE_MODE_READ when
+  # run within kubelet's namespace.
+  ptrace (read) peer=unconfined,
   /run/systemd/private rw,
 
+  # kubelet calling 'systemd-run --scope true' triggers this when kubelet is
+  # run in a nested container (eg, under lxd).
+  @{PROC}/1/cmdline r,
+
+  # Ubuntu's ptrace patchset before (at least) 20.04 did not correctly evaluate
+  # PTRACE_MODE_READ and policy required 'trace' instead of 'read'.
+  # (LP: #1890848). This child profile doesn't have 'capability sys_ptrace', so
+  # continue to allow this historic 'trace' rule on unconfined (which systemd
+  # runs as) since systemd-run won't be able to ptrace this snap's processes.
+  # This can be dropped once LP: #1890848 is fixed.
+  ptrace (trace) peer=unconfined,
+
   /{,usr/}bin/true ixr,
   @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/{,usr/}bin/true ixr,
 ###KUBERNETES_SUPPORT_SYSTEMD_RUN###
@@ -107,6 +125,14 @@
 # allow managing pods' cgroups
 /sys/fs/cgroup/*/kubepods/{,**} rw,
 
+# kubelet can be configured to use the systemd cgroup driver which moves
+# container processes into systemd-managed cgroups. This is now the recommended
+# configuration since it provides a single cgroup manager (systemd) in an
+# effort to achieve consistent views of resources.
+/sys/fs/cgroup/*/systemd/{,system.slice/} rw,          # create missing dirs
+/sys/fs/cgroup/*/systemd/system.slice/** r,
+/sys/fs/cgroup/*/systemd/system.slice/cgroup.procs w,
+
 # Allow tracing our own processes. Note, this allows seccomp sandbox escape on
 # kernels < 4.8
 capability sys_ptrace,
@@ -142,8 +168,13 @@
 
 /{,usr/}bin/mount ixr,
 /{,usr/}bin/umount ixr,
-deny /run/mount/utab rw,
+deny /run/mount/utab{,.lock} rw,
 umount /var/snap/@{SNAP_INSTANCE_NAME}/common/**,
+
+# When fsGroup is set, the pod's volume will be recursively chowned with the
+# setgid bit set on directories so new files will be owned by the fsGroup. See
+# kubernetes pkg/volume/volume_linux.go:changeFilePermission()
+capability fsetid,
 `
 
 const kubernetesSupportConnectedPlugAppArmorKubeletSystemdRun = `
@@ -151,7 +182,7 @@
   capability sys_admin,
   /{,usr/}bin/mount ixr,
   mount fstype="tmpfs" tmpfs -> /var/snap/@{SNAP_INSTANCE_NAME}/common/**,
-  deny /run/mount/utab rw,
+  deny /run/mount/utab{,.lock} rw,
 
   # For mounting volume subPaths
   mount /var/snap/@{SNAP_INSTANCE_NAME}/common/{,**} -> /var/snap/@{SNAP_INSTANCE_NAME}/common/{,**},
@@ -163,11 +194,20 @@
   # virtio vda-vdz, 1-63 partitions
   mount /dev/vd[a-z]{[1-9],[1-5][0-9],6[0-3]} -> /var/snap/@{SNAP_INSTANCE_NAME}/common/**,
   umount /var/snap/@{SNAP_INSTANCE_NAME}/common/**,
+
   # When mounting a volume subPath, kubelet binds mounts on an open fd (eg,
-  # /proc/.../fd/N) which triggers a ptrace 'trace' denial on the parent
-  # kubelet peer process from this child profile. Note, this child profile
-  # doesn't have 'capability sys_ptrace', so systemd-run is still not able to
-  # ptrace this snap's processes.
+  # /proc/.../fd/N) which triggers a ptrace 'read' denial on the parent
+  # kubelet peer process from this child profile due to PTRACE_MODE_READ (man
+  # ptrace) checks.
+  ptrace (read) peer=snap.@{SNAP_INSTANCE_NAME}.@{SNAP_COMMAND_NAME},
+
+  # Ubuntu's ptrace patchset before (at least) 20.04 did not correctly evaluate
+  # PTRACE_MODE_READ and policy required 'trace' instead of 'read'.
+  # (LP: #1890848). This child profile doesn't have 'capability sys_ptrace', so
+  # continue to allow this historic 'trace' rule on kubelet (our parent peer)
+  # since systemd-run won't be able to ptrace this snap's processes (kubelet
+  # would also need a corresponding tracedby rule). This can be dropped once
+  # LP: #1890848 is fixed.
   ptrace (trace) peer=snap.@{SNAP_INSTANCE_NAME}.@{SNAP_COMMAND_NAME},
 `
 
@@ -197,6 +237,11 @@
 
 unshare
 setns - CLONE_NEWNET
+
+# When fsGroup is set, the pod's volume will be recursively chowned with the
+# setgid bit set on directories so new files will be owned by the fsGroup. See
+# kubernetes pkg/volume/volume_linux.go:changeFilePermission()
+fchownat
 `
 
 var kubernetesSupportConnectedPlugUDevKubelet = []string{
@@ -232,7 +277,19 @@
 	commonInterface
 }
 
-func k8sFlavor(plug *interfaces.ConnectedPlug) string {
+func (iface *kubernetesSupportInterface) ServicePermanentPlug(plug *snap.PlugInfo) []string {
+	// only autobind-unix flavor does not get Delegate=true, all other flavors
+	// are usable to manage control groups of processes/containers, and thus
+	// need Delegate=true
+	flavor := k8sFlavor(plug)
+	if flavor == "autobind-unix" {
+		return nil
+	}
+
+	return []string{"Delegate=true"}
+}
+
+func k8sFlavor(plug interfaces.Attrer) string {
 	var flavor string
 	_ = plug.Attr("flavor", &flavor)
 	return flavor
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/kubernetes_support_test.go snapd-2.48.3+20.04/interfaces/builtin/kubernetes_support_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/kubernetes_support_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/kubernetes_support_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -272,3 +272,20 @@
 func (s *KubernetesSupportInterfaceSuite) TestInterfaces(c *C) {
 	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
 }
+
+func (s *KubernetesSupportInterfaceSuite) TestPermanentPlugServiceSnippets(c *C) {
+	for _, t := range []struct {
+		plug *snap.PlugInfo
+		exp  []string
+	}{
+		{s.plugInfo, []string{"Delegate=true"}},
+		{s.plugKubeletInfo, []string{"Delegate=true"}},
+		{s.plugKubeproxyInfo, []string{"Delegate=true"}},
+		// only autobind-unix flavor does not get Delegate=true
+		{s.plugKubeAutobindInfo, nil},
+	} {
+		snips, err := interfaces.PermanentPlugServiceSnippets(s.iface, t.plug)
+		c.Assert(err, IsNil)
+		c.Check(snips, DeepEquals, t.exp)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/kvm_test.go snapd-2.48.3+20.04/interfaces/builtin/kvm_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/kvm_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/kvm_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package builtin_test
 
 import (
+	"fmt"
 	"io/ioutil"
 	"path/filepath"
 
@@ -117,7 +118,7 @@
 	c.Assert(spec.Snippets(), HasLen, 2)
 	c.Assert(spec.Snippets()[0], Equals, `# kvm
 KERNEL=="kvm", TAG+="snap_consumer_app"`)
-	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
+	c.Assert(spec.Snippets(), testutil.Contains, fmt.Sprintf(`TAG=="snap_consumer_app", RUN+="%s/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`, dirs.DistroLibExecDir))
 }
 
 func (s *kvmInterfaceSuite) TestStaticInfo(c *C) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/lxd_support.go snapd-2.48.3+20.04/interfaces/builtin/lxd_support.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/lxd_support.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/lxd_support.go	2021-02-02 08:21:12.000000000 +0000
@@ -39,7 +39,7 @@
 # Description: Can change to any apparmor profile (including unconfined) thus
 # giving access to all resources of the system so LXD may manage what to give
 # to its containers. This gives device ownership to connected snaps.
-@{PROC}/**/attr/current r,
+@{PROC}/**/attr/{,apparmor/}current r,
 /{,usr/}{,s}bin/aa-exec ux,
 
 # Allow discovering the os-release of the host
@@ -52,6 +52,8 @@
 @unrestricted
 `
 
+const lxdSupportServiceSnippet = `Delegate=true`
+
 func init() {
 	registerIface(&commonInterface{
 		name:                  "lxd-support",
@@ -62,5 +64,6 @@
 		baseDeclarationPlugs:  lxdSupportBaseDeclarationPlugs,
 		connectedPlugAppArmor: lxdSupportConnectedPlugAppArmor,
 		connectedPlugSecComp:  lxdSupportConnectedPlugSecComp,
+		serviceSnippets:       []string{lxdSupportServiceSnippet},
 	})
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/lxd_support_test.go snapd-2.48.3+20.04/interfaces/builtin/lxd_support_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/lxd_support_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/lxd_support_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -103,3 +103,9 @@
 func (s *LxdSupportInterfaceSuite) TestInterfaces(c *C) {
 	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
 }
+
+func (s *LxdSupportInterfaceSuite) TestServicePermanentPlugSnippets(c *C) {
+	snips, err := interfaces.PermanentPlugServiceSnippets(s.iface, s.plugInfo)
+	c.Assert(err, IsNil)
+	c.Check(snips, DeepEquals, []string{"Delegate=true"})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/media_hub.go snapd-2.48.3+20.04/interfaces/builtin/media_hub.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/media_hub.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/media_hub.go	2021-02-02 08:21:12.000000000 +0000
@@ -41,7 +41,7 @@
 `
 
 const mediaHubPermanentSlotAppArmor = `
-# Description: Allow operating as the the media-hub service.
+# Description: Allow operating as the media-hub service.
 
 # DBus accesses
 #include <abstractions/dbus-session-strict>
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/multipass_support.go snapd-2.48.3+20.04/interfaces/builtin/multipass_support.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/multipass_support.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/multipass_support.go	2021-02-02 08:21:12.000000000 +0000
@@ -55,7 +55,7 @@
 
 const multipassSupportConnectedPlugAppArmor = `
 # Description: this policy intentionally allows the Multipass daemon to configure AppArmor
-# as Multipass generates AppArmor profiles for the utility processes it spawns.
+# as Multipass generates AppArmor profiles for the utility processes it spawns.
 /sbin/apparmor_parser ixr,
 /etc/apparmor{,.d}/{,**} r,
 /sys/kernel/security/apparmor/{,**} r,
@@ -90,7 +90,7 @@
 # (qemu, qemu-img, dnsmasq, sshfs_server)
 
 # Note that this profile necessarily contains the union of all the syscalls each of the
-# utilities requires. We rely on Multipass to generate specific AppArmor profiles
+# utilities requires. We rely on Multipass to generate specific AppArmor profiles
 # for each child process, to further restrict their abilities.
 
 # dnsmasq fails unless it can drop supplementary groups
@@ -101,10 +101,10 @@
 # user-specified directory on the host into the VM. Here we permit typical filesytem
 # syscalls with the knowledge that Multipass will generate a specific AppArmor
 # profile for sshfs_server, restricting any filesystem access to just the
-# user-specified directory.
+# user-specified directory.
 
 # More filesystem syscalls sshfs_server will need, as it allows user to change
-# file owner/group arbitrarily.
+# file owner/group arbitrarily.
 chown
 chown32
 fchown
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/network_control.go snapd-2.48.3+20.04/interfaces/builtin/network_control.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/network_control.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/network_control.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,6 +19,10 @@
 
 package builtin
 
+import (
+	"github.com/snapcore/snapd/osutil"
+)
+
 const networkControlSummary = `allows configuring networking and network namespaces`
 
 const networkControlBaseDeclarationSlots = `
@@ -280,6 +284,53 @@
 	`KERNEL=="tun"`,
 }
 
+var networkControlConnectedPlugMount = []osutil.MountEntry{{
+	Name:    "/var/lib/snapd/hostfs/var/lib/dhcp",
+	Dir:     "/var/lib/dhcp",
+	Options: []string{"bind", "rw", osutil.XSnapdIgnoreMissing()},
+}}
+
+// TODO: Add a layer that derives this sort of data from mount entry, like the
+// one above, into a set of apparmor rules for snap-update-ns, like the ones
+// below.
+//
+// When setting up a mount entry, we also need corresponding
+// snap-updates-ns rules. Eg, if have:
+// []osutil.MountEntry{{
+//	Name:    "/foo/bar",
+//	Dir:     "/bar",
+//	Options: []string{"rw", "bind"},
+// }}
+// Then you can expect to need:
+// /foo/ r,
+// /foo/bar/ r,
+// mount options=(rw bind) /foo/bar/ -> /bar/,
+// umount /bar/,
+// ...
+// You'll need 'r' rules for all the directories that need to be traversed,
+// starting from the root directory all the way down to the directory being
+// mounted. This is required by the safe bind mounting trick employed by
+// snap-update-ns.
+//
+// You'll need 'rw' rules to support cases when snap-update-ns is expected to
+// create the missing directory, before performing the bind mount. Note that
+// there are two sides, one side is the host visible through
+// /var/lib/snapd/hostfs and the other side is everything else. To support
+// writes to the host side you need to coordinate with the trespassing rules
+// implemented in snap-update-ns/system.go.
+var networkControlConnectedPlugUpdateNSAppArmor = `
+/var/ r,
+/var/lib/ r,
+/var/lib/snapd/ r,
+/var/lib/snapd/hostfs/ r,
+/var/lib/snapd/hostfs/var/ r,
+/var/lib/snapd/hostfs/var/lib/ r,
+/var/lib/snapd/hostfs/var/lib/dhcp/ r,
+/var/lib/dhcp/ r,
+mount options=(rw bind) /var/lib/snapd/hostfs/var/lib/dhcp/ -> /var/lib/dhcp/,
+umount /var/lib/dhcp/,
+`
+
 func init() {
 	registerIface(&commonInterface{
 		name:                  "network-control",
@@ -290,7 +341,11 @@
 		connectedPlugAppArmor: networkControlConnectedPlugAppArmor,
 		connectedPlugSecComp:  networkControlConnectedPlugSecComp,
 		connectedPlugUDev:     networkControlConnectedPlugUDev,
-		suppressPtraceTrace:   true,
+
+		connectedPlugMount:            networkControlConnectedPlugMount,
+		connectedPlugUpdateNSAppArmor: networkControlConnectedPlugUpdateNSAppArmor,
+
+		suppressPtraceTrace: true,
 	})
 
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/network_control_test.go snapd-2.48.3+20.04/interfaces/builtin/network_control_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/network_control_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/network_control_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,8 +25,10 @@
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
 	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/mount"
 	"github.com/snapcore/snapd/interfaces/seccomp"
 	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/testutil"
 )
@@ -79,6 +81,18 @@
 	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
 	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
 	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "/run/netns/* rw,\n")
+	c.Assert(spec.UpdateNS(), DeepEquals, []string{`
+/var/ r,
+/var/lib/ r,
+/var/lib/snapd/ r,
+/var/lib/snapd/hostfs/ r,
+/var/lib/snapd/hostfs/var/ r,
+/var/lib/snapd/hostfs/var/lib/ r,
+/var/lib/snapd/hostfs/var/lib/dhcp/ r,
+/var/lib/dhcp/ r,
+mount options=(rw bind) /var/lib/snapd/hostfs/var/lib/dhcp/ -> /var/lib/dhcp/,
+umount /var/lib/dhcp/,
+`})
 }
 
 func (s *NetworkControlInterfaceSuite) TestSecCompSpec(c *C) {
@@ -97,6 +111,17 @@
 	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
 }
 
+func (s *NetworkControlInterfaceSuite) TestMountSpec(c *C) {
+	spec := &mount.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.MountEntries(), HasLen, 1)
+	c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{
+		Name:    "/var/lib/snapd/hostfs/var/lib/dhcp",
+		Dir:     "/var/lib/dhcp",
+		Options: []string{"bind", "rw", "x-snapd.ignore-missing"},
+	}})
+}
+
 func (s *NetworkControlInterfaceSuite) TestStaticInfo(c *C) {
 	si := interfaces.StaticInfoOf(s.iface)
 	c.Assert(si.ImplicitOnCore, Equals, true)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/network_manager.go snapd-2.48.3+20.04/interfaces/builtin/network_manager.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/network_manager.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/network_manager.go	2021-02-02 08:21:12.000000000 +0000
@@ -186,6 +186,13 @@
     interface=org.freedesktop.DBus.*
     peer=(label=unconfined),
 
+# Allow ObjectManager methods from and signals to unconfined clients.
+dbus (receive, send)
+    bus=system
+    path=/org/freedesktop
+    interface=org.freedesktop.DBus.ObjectManager
+    peer=(label=unconfined),
+
 # Allow access to hostname system service
 dbus (receive, send)
     bus=system
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/network_manager_observe.go snapd-2.48.3+20.04/interfaces/builtin/network_manager_observe.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/network_manager_observe.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/network_manager_observe.go	2021-02-02 08:21:12.000000000 +0000
@@ -137,6 +137,12 @@
     peer=(label=###SLOT_SECURITY_TAGS###),
 dbus (receive)
     bus=system
+    path=/org/freedesktop/NetworkManager
+    interface=org.freedesktop.NetworkManager
+    member=PropertiesChanged
+    peer=(label=###SLOT_SECURITY_TAGS###),
+dbus (receive)
+    bus=system
     path="/org/freedesktop/NetworkManager{,/{ActiveConnection,Devices}/*}"
     interface="org.freedesktop.NetworkManger{,.*}"
     member=StateChanged
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/network_manager_observe_test.go snapd-2.48.3+20.04/interfaces/builtin/network_manager_observe_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/network_manager_observe_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/network_manager_observe_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -59,6 +59,7 @@
 `
 
 const networkManagerObserveCoreYaml = `name: core
+type: os
 version: 0
 slots:
   network-manager-observe:
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/opengl.go snapd-2.48.3+20.04/interfaces/builtin/opengl.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/opengl.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/opengl.go	2021-02-02 08:21:12.000000000 +0000
@@ -58,8 +58,12 @@
 # Main bi-arch GL libraries
 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}{,nvidia*/}lib{GL,GLU,GLESv1_CM,GLESv2,EGL,GLX}.so{,.*} rm,
 
+# Allow access to all cards since a) this is common on hybrid systems, b) ARM
+# devices commonly have two devices (such as on the Raspberry Pi 4, one for KMS
+# and another that does not) and c) there is nothing saying that /dev/dri/card0
+# is the default card or the application is currently using.
 /dev/dri/ r,
-/dev/dri/card0 rw,
+/dev/dri/card[0-9]* rw,
 
 # nvidia
 /etc/vdpau_wrapper.cfg r,
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/process_control.go snapd-2.48.3+20.04/interfaces/builtin/process_control.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/process_control.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/process_control.go	2021-02-02 08:21:12.000000000 +0000
@@ -58,6 +58,7 @@
 nice
 setpriority
 sched_setaffinity
+sched_setattr
 sched_setparam
 sched_setscheduler
 `
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/ptp.go snapd-2.48.3+20.04/interfaces/builtin/ptp.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/ptp.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/ptp.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,55 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+const ptpSummary = `allows access to the PTP Hardware Clock subsystem`
+
+const ptpBaseDeclarationSlots = `
+  ptp:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const ptpConnectedPlugAppArmor = `
+# Description: Can access PTP Hardware Clock subsystem.
+# Devices
+/dev/ptp[0-9]* rw,
+# /sys/class/ptp specified by the kernel docs
+/sys/class/ptp/ptp[0-9]*/{extts_enable,period,pps_enable} w,
+/sys/class/ptp/ptp[0-9]*/* r,
+`
+
+var ptpConnectedPlugUDev = []string{
+	`SUBSYSTEM=="ptp", KERNEL=="ptp[0-9]*"`,
+}
+
+func init() {
+	registerIface(&commonInterface{
+		name:                  "ptp",
+		summary:               ptpSummary,
+		implicitOnCore:        true,
+		implicitOnClassic:     true,
+		baseDeclarationSlots:  ptpBaseDeclarationSlots,
+		connectedPlugAppArmor: ptpConnectedPlugAppArmor,
+		connectedPlugUDev:     ptpConnectedPlugUDev,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/ptp_test.go snapd-2.48.3+20.04/interfaces/builtin/ptp_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/ptp_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/ptp_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,106 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/testutil"
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/snap"
+)
+
+type PTPInterfaceSuite struct {
+	iface    interfaces.Interface
+	slotInfo *snap.SlotInfo
+	slot     *interfaces.ConnectedSlot
+	plugInfo *snap.PlugInfo
+	plug     *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&PTPInterfaceSuite{
+	iface: builtin.MustInterface("ptp"),
+})
+
+const ptpConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [ptp]
+`
+
+const ptpCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  ptp:
+`
+
+func (s *PTPInterfaceSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, ptpConsumerYaml, nil, "ptp")
+	s.slot, s.slotInfo = MockConnectedSlot(c, ptpCoreYaml, nil, "ptp")
+}
+
+func (s *PTPInterfaceSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "ptp")
+}
+
+func (s *PTPInterfaceSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.slotInfo), IsNil)
+}
+
+func (s *PTPInterfaceSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *PTPInterfaceSuite) TestAppArmorSpec(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "/dev/ptp[0-9]*")
+}
+
+func (s *PTPInterfaceSuite) TestUDevSpec(c *C) {
+	spec := &udev.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Assert(spec.Snippets(), HasLen, 2)
+	c.Assert(spec.Snippets(), testutil.Contains, `# ptp
+SUBSYSTEM=="ptp", KERNEL=="ptp[0-9]*", TAG+="snap_consumer_app"`)
+	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
+}
+
+func (s *PTPInterfaceSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, true)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to the PTP Hardware Clock subsystem`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "ptp")
+}
+
+func (s *PTPInterfaceSuite) TestAutoConnect(c *C) {
+	c.Assert(s.iface.AutoConnect(s.plugInfo, s.slotInfo), Equals, true)
+}
+
+func (s *PTPInterfaceSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/raw_usb.go snapd-2.48.3+20.04/interfaces/builtin/raw_usb.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/raw_usb.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/raw_usb.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,6 +36,7 @@
 
 # Allow access to all ttyUSB devices too
 /dev/tty{USB,ACM}[0-9]* rwk,
+@{PROC}/tty/drivers r,
 
 # Allow raw access to USB printers (i.e. for receipt printers in POS systems).
 /dev/usb/lp[0-9]* rwk,
@@ -43,7 +44,7 @@
 # Allow detection of usb devices. Leaks plugged in USB device info
 /sys/bus/usb/devices/ r,
 /sys/devices/pci**/usb[0-9]** r,
-/sys/devices/platform/soc/*.usb/usb[0-9]** r,
+/sys/devices/platform/{sbc,soc}/*.usb/usb[0-9]** r,
 
 /run/udev/data/c16[67]:[0-9] r, # ACM USB modems
 /run/udev/data/b180:*    r, # various USB block devices
@@ -61,6 +62,7 @@
 
 var rawusbConnectedPlugUDev = []string{
 	`SUBSYSTEM=="usb"`,
+	`SUBSYSTEM=="usbmisc"`,
 	`SUBSYSTEM=="tty", ENV{ID_BUS}=="usb"`,
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/raw_usb_test.go snapd-2.48.3+20.04/interfaces/builtin/raw_usb_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/raw_usb_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/raw_usb_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -91,10 +91,12 @@
 func (s *RawUsbInterfaceSuite) TestUDevSpec(c *C) {
 	spec := &udev.Specification{}
 	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
-	c.Assert(spec.Snippets(), HasLen, 3)
+	c.Assert(spec.Snippets(), HasLen, 4)
 	c.Assert(spec.Snippets(), testutil.Contains, `# raw-usb
 SUBSYSTEM=="usb", TAG+="snap_consumer_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `# raw-usb
+SUBSYSTEM=="usbmisc", TAG+="snap_consumer_app"`)
+	c.Assert(spec.Snippets(), testutil.Contains, `# raw-usb
 SUBSYSTEM=="tty", ENV{ID_BUS}=="usb", TAG+="snap_consumer_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/spi.go snapd-2.48.3+20.04/interfaces/builtin/spi.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/spi.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/spi.go	2021-02-02 08:21:12.000000000 +0000
@@ -84,7 +84,10 @@
 		return nil
 	}
 	spec.AddSnippet(fmt.Sprintf("%s rw,", path))
-	spec.AddSnippet(fmt.Sprintf("/sys/devices/platform/**/**.spi/**/%s/** rw,", strings.TrimPrefix(path, "/dev/")))
+	// Use parametric snippets to avoid no-expr-simplify side-effects.
+	spec.AddParametricSnippet([]string{
+		"/sys/devices/platform/**/**.spi/**/spidev" /* ###PARAM### */, "/** rw,  # Add any condensed parametric rules",
+	}, strings.TrimPrefix(path, "/dev/spidev"))
 	return nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/spi_test.go snapd-2.48.3+20.04/interfaces/builtin/spi_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/spi_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/spi_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -222,7 +222,12 @@
 	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
 	c.Assert(spec.SnippetForTag("snap.consumer.app"), Equals, ""+
 		"/dev/spidev0.0 rw,\n"+
-		"/sys/devices/platform/**/**.spi/**/spidev0.0/** rw,")
+		"/sys/devices/platform/**/**.spi/**/spidev0.0/** rw,  # Add any condensed parametric rules")
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug1, s.slotGadget2), IsNil)
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), Equals, ""+
+		"/dev/spidev0.0 rw,\n"+
+		"/dev/spidev0.1 rw,\n"+
+		"/sys/devices/platform/**/**.spi/**/spidev{0.0,0.1}/** rw,  # Add any condensed parametric rules")
 }
 
 func (s *spiInterfaceSuite) TestStaticInfo(c *C) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/system_observe.go snapd-2.48.3+20.04/interfaces/builtin/system_observe.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/system_observe.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/system_observe.go	2021-02-02 08:21:12.000000000 +0000
@@ -117,6 +117,13 @@
     interface=org.freedesktop.DBus.Peer
     member=GetMachineId
     peer=(label=unconfined),
+
+# Allow reading if protected hardlinks are enabled, but don't allow enabling or
+# disabling them
+@{PROC}/sys/fs/protected_hardlinks r,
+@{PROC}/sys/fs/protected_symlinks r,
+@{PROC}/sys/fs/protected_fifos r,
+@{PROC}/sys/fs/protected_regular r,
 `
 
 const systemObserveConnectedPlugSecComp = `
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/system_packages_doc.go snapd-2.48.3+20.04/interfaces/builtin/system_packages_doc.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/system_packages_doc.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/system_packages_doc.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,76 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+import (
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/mount"
+	"github.com/snapcore/snapd/osutil"
+)
+
+const systemPackagesDocSummary = `allows access to documentation of system packages`
+
+const systemPackagesDocBaseDeclarationSlots = `
+  system-packages-doc:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const systemPackagesDocConnectedPlugAppArmor = `
+# Description: can access documentation of system packages.
+
+/usr/share/doc/{,**} r,
+`
+
+type systemPackagesDocInterface struct {
+	commonInterface
+}
+
+func (iface *systemPackagesDocInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	spec.AddSnippet(systemPackagesDocConnectedPlugAppArmor)
+	emit := spec.AddUpdateNSf
+	emit("  # Mount documentation of system packages\n")
+	emit("  mount options=(bind) /var/lib/snapd/hostfs/usr/share/doc/ -> /usr/share/doc/,\n")
+	emit("  remount options=(bind, ro) /usr/share/doc/,\n")
+	emit("  umount /usr/share/doc/,\n")
+	return nil
+}
+
+func (iface *systemPackagesDocInterface) MountConnectedPlug(spec *mount.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	return spec.AddMountEntry(osutil.MountEntry{
+		Name:    "/var/lib/snapd/hostfs/usr/share/doc",
+		Dir:     "/usr/share/doc",
+		Options: []string{"bind", "ro"},
+	})
+}
+
+func init() {
+	registerIface(&systemPackagesDocInterface{
+		commonInterface: commonInterface{
+			name:                 "system-packages-doc",
+			summary:              systemPackagesDocSummary,
+			implicitOnClassic:    true,
+			baseDeclarationSlots: systemPackagesDocBaseDeclarationSlots,
+		},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/system_packages_doc_test.go snapd-2.48.3+20.04/interfaces/builtin/system_packages_doc_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/system_packages_doc_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/system_packages_doc_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,125 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/mount"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type systemPackagesDocSuite struct {
+	iface        interfaces.Interface
+	coreSlotInfo *snap.SlotInfo
+	coreSlot     *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&systemPackagesDocSuite{iface: builtin.MustInterface("system-packages-doc")})
+
+const systemPackagesDocConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [system-packages-doc]
+`
+
+const systemPackagesDocCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  system-packages-doc:
+`
+
+func (s *systemPackagesDocSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, systemPackagesDocConsumerYaml, nil, "system-packages-doc")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, systemPackagesDocCoreYaml, nil, "system-packages-doc")
+}
+
+func (s *systemPackagesDocSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("/")
+}
+
+func (s *systemPackagesDocSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "system-packages-doc")
+}
+
+func (s *systemPackagesDocSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *systemPackagesDocSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *systemPackagesDocSuite) TestAppArmorSpec(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: can access documentation of system packages.")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "/usr/share/doc/{,**} r,")
+
+	updateNS := spec.UpdateNS()
+	c.Check(updateNS, testutil.Contains, "  # Mount documentation of system packages\n")
+	c.Check(updateNS, testutil.Contains, "  mount options=(bind) /var/lib/snapd/hostfs/usr/share/doc/ -> /usr/share/doc/,\n")
+	c.Check(updateNS, testutil.Contains, "  remount options=(bind, ro) /usr/share/doc/,\n")
+	c.Check(updateNS, testutil.Contains, "  umount /usr/share/doc/,\n")
+}
+
+func (s *systemPackagesDocSuite) TestMountSpec(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	spec := &mount.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+
+	entries := spec.MountEntries()
+	c.Assert(entries, HasLen, 1)
+	c.Check(entries[0].Name, Equals, "/var/lib/snapd/hostfs/usr/share/doc")
+	c.Check(entries[0].Dir, Equals, "/usr/share/doc")
+	c.Check(entries[0].Options, DeepEquals, []string{"bind", "ro"})
+
+	entries = spec.UserMountEntries()
+	c.Assert(entries, HasLen, 0)
+}
+
+func (s *systemPackagesDocSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, false)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to documentation of system packages`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "system-packages-doc")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *systemPackagesDocSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/system_source_code.go snapd-2.48.3+20.04/interfaces/builtin/system_source_code.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/system_source_code.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/system_source_code.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,56 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+// https://refspecs.linuxfoundation.org/FHS_3.0/fhs-3.0.html#usrsrcSourceCode
+const systemSourceCodeSummary = `allows read-only access to /usr/src on the system`
+
+// Manually connected since this reveals kernel config, patches, etc of the
+// running system which may or may not correspond to public distro packages
+// as mapped from 'uname -r'
+const systemSourceCodeBaseDeclarationSlots = `
+  system-source-code:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const systemSourceCodeConnectedPlugAppArmor = `
+# Description: can access /usr/src for kernel headers, etc
+/usr/src/{,**} r,
+`
+
+type systemSourceCodeInterface struct {
+	commonInterface
+}
+
+func init() {
+	registerIface(&systemSourceCodeInterface{
+		commonInterface: commonInterface{
+			name:                  "system-source-code",
+			summary:               systemSourceCodeSummary,
+			implicitOnCore:        true,
+			implicitOnClassic:     true,
+			baseDeclarationSlots:  systemSourceCodeBaseDeclarationSlots,
+			connectedPlugAppArmor: systemSourceCodeConnectedPlugAppArmor,
+		},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/system_source_code_test.go snapd-2.48.3+20.04/interfaces/builtin/system_source_code_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/system_source_code_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/system_source_code_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,97 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type systemSourceCodeSuite struct {
+	iface        interfaces.Interface
+	coreSlotInfo *snap.SlotInfo
+	coreSlot     *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&systemSourceCodeSuite{iface: builtin.MustInterface("system-source-code")})
+
+const systemSourceCodeConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [system-source-code]
+`
+
+const systemSourceCodeCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  system-source-code:
+`
+
+func (s *systemSourceCodeSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, systemSourceCodeConsumerYaml, nil, "system-source-code")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, systemSourceCodeCoreYaml, nil, "system-source-code")
+}
+
+func (s *systemSourceCodeSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("/")
+}
+
+func (s *systemSourceCodeSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "system-source-code")
+}
+
+func (s *systemSourceCodeSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *systemSourceCodeSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *systemSourceCodeSuite) TestAppArmorSpec(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: can access /usr/src for kernel headers, etc")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "/usr/src/{,**} r,")
+}
+
+func (s *systemSourceCodeSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, true)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows read-only access to /usr/src on the system`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "system-source-code")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *systemSourceCodeSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/time_control.go snapd-2.48.3+20.04/interfaces/builtin/time_control.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/time_control.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/time_control.go	2021-02-02 08:21:12.000000000 +0000
@@ -110,6 +110,11 @@
 
 settimeofday
 adjtimex
+# direct manipulation through POSIX clock time API
+clock_adjtime
+clock_adjtime64
+clock_settime
+clock_settime64
 
 # util-linux built with libaudit tries to write to the audit subsystem. We
 # allow the socket call here to avoid seccomp kill, but omit the AppArmor
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/time_control_test.go snapd-2.48.3+20.04/interfaces/builtin/time_control_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/time_control_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/time_control_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -85,9 +85,19 @@
 	spec := &seccomp.Specification{}
 	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
 	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
-	c.Check(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "settimeofday")
-	c.Check(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "adjtimex")
-	c.Check(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "socket AF_NETLINK - NETLINK_AUDIT")
+
+	snippet := spec.SnippetForTag("snap.consumer.app")
+	for _, needle := range []string{
+		"settimeofday",
+		"adjtimex",
+		"socket AF_NETLINK - NETLINK_AUDIT",
+		"clock_adjtime",
+		"clock_adjtime64",
+		"clock_settime",
+		"clock_settime64",
+	} {
+		c.Check(snippet, testutil.Contains, needle)
+	}
 }
 
 func (s *TimeControlInterfaceSuite) TestUDevSpec(c *C) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/u2f_devices.go snapd-2.48.3+20.04/interfaces/builtin/u2f_devices.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/u2f_devices.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/u2f_devices.go	2021-02-02 08:21:12.000000000 +0000
@@ -116,6 +116,11 @@
 		VendorIDPattern:  "1d50",
 		ProductIDPattern: "60fc",
 	},
+	{
+		Name:             "MIRKey",
+		VendorIDPattern:  "0483",
+		ProductIDPattern: "a2ac",
+	},
 }
 
 const u2fDevicesConnectedPlugAppArmor = `
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/u2f_devices_test.go snapd-2.48.3+20.04/interfaces/builtin/u2f_devices_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/u2f_devices_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/u2f_devices_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -86,7 +86,7 @@
 func (s *u2fDevicesInterfaceSuite) TestUDevSpec(c *C) {
 	spec := &udev.Specification{}
 	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
-	c.Assert(spec.Snippets(), HasLen, 16)
+	c.Assert(spec.Snippets(), HasLen, 17)
 	c.Assert(spec.Snippets(), testutil.Contains, `# u2f-devices
 # Yubico YubiKey
 SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0113|0114|0115|0116|0120|0121|0200|0402|0403|0406|0407|0410", TAG+="snap_consumer_app"`)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/uinput.go snapd-2.48.3+20.04/interfaces/builtin/uinput.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/uinput.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/uinput.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,81 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+// https://www.kernel.org/doc/html/latest/input/uinput.html. Manually connect
+// because this interface allows for arbitrary input injection.
+const uinputSummary = `allows access to the uinput device`
+
+// While this interface grants precisely what it says it does, there is known
+// popular software that uses the uinput device and recommends modifying the
+// permissions to be 0666 (see below). Require an installation constraint to
+// require vetting of snap publishers in an effort to protect existing systems
+// with lax permissions and to protect users from arbitrary publishers who
+// document to both manually connect and to change the permissions on the
+// device.
+const uinputBaseDeclarationPlugs = `
+  uinput:
+    allow-installation: false
+    deny-auto-connection: true
+`
+
+const uinputBaseDeclarationSlots = `
+  uinput:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const uinputConnectedPlugAppArmor = `
+# Description: Allow write access to the uinput device for emulating
+# input devices from userspace for sending input events.
+
+/dev/uinput rw,
+/dev/input/uinput rw,
+`
+
+// The uinput device allows for injecting arbitrary input, so its default
+// permissions are correctly root:root 0660. Some 3rd party software (eg,
+// the steam controller installer) installs udev rules that change the
+// device to world-writable permissions (0666) as a shortcut, but this is
+// unsafe since it would allow any unconfined user (or any snap with this
+// interface connected) to inject input events into the kernel. In general
+// snapd should not be adjusting the permissions on the device, at least not
+// until snapd implements 'device access' for fine-grained control. See:
+// https://forum.snapcraft.io/t/multiple-users-and-groups-in-snaps/1461.
+var uinputConnectedPlugUDev = []string{`KERNEL=="uinput"`}
+
+type uinputInterface struct {
+	commonInterface
+}
+
+func init() {
+	registerIface(&uinputInterface{commonInterface{
+		name:                  "uinput",
+		summary:               uinputSummary,
+		implicitOnCore:        true,
+		implicitOnClassic:     true,
+		baseDeclarationPlugs:  uinputBaseDeclarationPlugs,
+		baseDeclarationSlots:  uinputBaseDeclarationSlots,
+		connectedPlugAppArmor: uinputConnectedPlugAppArmor,
+		connectedPlugUDev:     uinputConnectedPlugUDev,
+	}})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/uinput_test.go snapd-2.48.3+20.04/interfaces/builtin/uinput_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/uinput_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/uinput_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,110 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type uinputInterfaceSuite struct {
+	iface        interfaces.Interface
+	coreSlotInfo *snap.SlotInfo
+	coreSlot     *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&uinputInterfaceSuite{
+	iface: builtin.MustInterface("uinput"),
+})
+
+const uinputConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [uinput]
+`
+
+const uinputCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  uinput:
+`
+
+func (s *uinputInterfaceSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, uinputConsumerYaml, nil, "uinput")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, uinputCoreYaml, nil, "uinput")
+}
+
+func (s *uinputInterfaceSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("/")
+}
+
+func (s *uinputInterfaceSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "uinput")
+}
+
+func (s *uinputInterfaceSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *uinputInterfaceSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *uinputInterfaceSuite) TestAppArmorSpec(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "# Description: Allow write access to the uinput device for emulating")
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "/dev/uinput rw,")
+}
+
+func (s *uinputInterfaceSuite) TestUDevSpec(c *C) {
+	spec := &udev.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.Snippets(), HasLen, 2)
+	c.Assert(spec.Snippets()[0], Equals, `# uinput
+KERNEL=="uinput", TAG+="snap_consumer_app"`)
+	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
+}
+
+func (s *uinputInterfaceSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, true)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to the uinput device`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "uinput")
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+	c.Assert(si.BaseDeclarationPlugs, testutil.Contains, "allow-installation: false")
+}
+
+func (s *uinputInterfaceSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/unity7.go snapd-2.48.3+20.04/interfaces/builtin/unity7.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/unity7.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/unity7.go	2021-02-02 08:21:12.000000000 +0000
@@ -62,8 +62,6 @@
 
 # subset of gnome abstraction
 /etc/gnome/defaults.list r,
-/usr/share/gnome/applications/             r,
-/usr/share/applications/mimeinfo.cache     r,
 
 /etc/gtk-*/*                               r,
 /usr/lib{,32,64}/gtk-*/**                  mr,
@@ -80,22 +78,29 @@
 /usr/share/icons/*/index.theme             rk,
 /usr/share/pixmaps/                        r,
 /usr/share/pixmaps/**                      r,
-/usr/share/unity/icons/**                  r,
-/usr/share/thumbnailer/icons/**            r,
-/usr/share/themes/**                       r,
 
 # The snapcraft desktop part may look for schema files in various locations, so
 # allow reading system installed schemas.
 /usr/share/glib*/schemas/{,*}              r,
-/usr/share/gnome/glib*/schemas/{,*}        r,
-/usr/share/ubuntu/glib*/schemas/{,*}       r,
 
 # Snappy's 'xdg-open' talks to the snapd-xdg-open service which currently works
 # only in environments supporting dbus-send (eg, X11). In the future once
 # snappy's xdg-open supports all snaps images, this access may move to another
-# interface.
+# interface. This is duplicated from desktop for compatibility with existing
+# snaps.
 /usr/bin/xdg-open ixr,
-/usr/share/applications/{,*} r,
+# While /usr/share/applications comes from the base runtime of the snap, it
+# has some things that snaps actually need, so allow access to those and deny
+# access to the others. This is duplicated from desktop for compatibility with
+# existing snaps.
+/usr/share/applications/ r,
+/usr/share/applications/mimeapps.list r,
+/usr/share/applications/xdg-open.desktop r,
+# silence noisy denials from desktop files in core* snaps that aren't usable by
+# snaps
+deny /usr/share/applications/python*.desktop r,
+deny /usr/share/applications/vim.desktop r,
+deny /usr/share/applications/snap-handle-link.desktop r,  # core16
 
 # This allow access to the first version of the snapd-xdg-open
 # version which was shipped outside of snapd
@@ -120,7 +125,7 @@
     bus=session
     path=/io/snapcraft/Settings
     interface=io.snapcraft.Settings
-    member={Check,Get,Set}
+    member={Check,CheckSub,Get,GetSub,Set,SetSub}
     peer=(label=unconfined),
 
 # input methods (ibus)
@@ -492,16 +497,14 @@
     member=Get*
     peer=(label=unconfined),
 
-# unity messaging menu
-# first, allow finding the desktop file
-/usr/share/applications/ r,
-# this leaks the names of snaps with desktop files
-/var/lib/snapd/desktop/applications/ r,
-/var/lib/snapd/desktop/applications/mimeinfo.cache r,
-# Support BAMF_DESKTOP_FILE_HINT by allowing reading our desktop files
-# parallel-installs: when @{SNAP_INSTANCE_NAME} == @{SNAP_NAME},
-# this leaks read access to desktop files of parallel installs of the snap
-/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_NAME}_*.desktop r,
+###SNAP_DESKTOP_FILE_RULES###
+# Snaps are unable to use the data in mimeinfo.cache (since they can't execute
+# the returned desktop file themselves). unity messaging menu doesn't require
+# mimeinfo.cache and xdg-mime will fallback to reading the desktop files
+# directly to look for MimeType. Since reading the snap's own desktop files is
+# allowed, we can safely deny access to this file (and xdg-mime will either
+# return one of the snap's mimetypes, or none).
+deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,
 
 # then allow talking to Unity DBus service
 dbus (send)
@@ -658,17 +661,23 @@
 }
 
 func (iface *unity7Interface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
-	// Unity7 will take the desktop filename and convert all '-' (and '.',
-	// but we don't care about that here because the rule above already
-	// does that) to '_'. Since we know that the desktop filename starts
-	// with the snap name, perform this conversion on the snap name.
+	// Unity7 will take the desktop filename and convert all '-' and '+'
+	// (and '.', but we don't care about that here because the rule above
+	// already does that) to '_'. Since we know that the desktop filename
+	// starts with the snap name, perform this conversion on the snap name.
 	//
 	// parallel-installs: UNITY_SNAP_NAME is used in the context of dbus
 	// mediation, this unintentionally opens access to dbus paths of keyed
 	// instances of @{SNAP_NAME} to @{SNAP_NAME} snap
-	new := strings.Replace(plug.Snap().InstanceName(), "-", "_", -1)
+	new := strings.Replace(plug.Snap().DesktopPrefix(), "-", "_", -1)
+	new = strings.Replace(new, "+", "_", -1)
 	old := "###UNITY_SNAP_NAME###"
 	snippet := strings.Replace(unity7ConnectedPlugAppArmor, old, new, -1)
+
+	old = "###SNAP_DESKTOP_FILE_RULES###"
+	new = strings.Join(getDesktopFileRules(plug.Snap().DesktopPrefix()), "\n")
+	snippet = strings.Replace(snippet, old, new+"\n", -1)
+
 	spec.AddSnippet(snippet)
 	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/unity7_test.go snapd-2.48.3+20.04/interfaces/builtin/unity7_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/unity7_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/unity7_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,11 +32,13 @@
 )
 
 type Unity7InterfaceSuite struct {
-	iface    interfaces.Interface
-	slotInfo *snap.SlotInfo
-	slot     *interfaces.ConnectedSlot
-	plugInfo *snap.PlugInfo
-	plug     *interfaces.ConnectedPlug
+	iface        interfaces.Interface
+	slotInfo     *snap.SlotInfo
+	slot         *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+	plugInstInfo *snap.PlugInfo
+	plugInst     *interfaces.ConnectedPlug
 }
 
 var _ = Suite(&Unity7InterfaceSuite{
@@ -61,6 +63,11 @@
 	plugSnap := snaptest.MockInfo(c, unity7mockPlugSnapInfoYaml, nil)
 	s.plugInfo = plugSnap.Plugs["unity7"]
 	s.plug = interfaces.NewConnectedPlug(s.plugInfo, nil, nil)
+
+	plugSnapInst := snaptest.MockInfo(c, unity7mockPlugSnapInfoYaml, nil)
+	plugSnapInst.InstanceKey = "instance"
+	s.plugInstInfo = plugSnapInst.Plugs["unity7"]
+	s.plugInst = interfaces.NewConnectedPlug(s.plugInstInfo, nil, nil)
 }
 
 func (s *Unity7InterfaceSuite) TestName(c *C) {
@@ -83,6 +90,31 @@
 	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other-snap.app2"})
 	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `/usr/share/pixmaps`)
 	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `path=/com/canonical/indicator/messages/other_snap_*_desktop`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,`)
+
+	// getDesktopFileRules() rules
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `# This leaks the names of snaps with desktop files`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `/var/lib/snapd/desktop/applications/ r,`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/[^o]* r,`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap.app2"), testutil.Contains, `deny /var/lib/snapd/desktop/applications/other-sna[^p]* r,`)
+
+	// connected plugs for instance name have a non-nil security snippet for apparmor
+	apparmorSpec = &apparmor.Specification{}
+	err = apparmorSpec.AddConnectedPlug(s.iface, s.plugInst, s.slot)
+	c.Assert(err, IsNil)
+	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other-snap_instance.app2"})
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap_instance.app2"), testutil.Contains, `/usr/share/pixmaps`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap_instance.app2"), testutil.Contains, `path=/com/canonical/indicator/messages/other_snap_instance_*_desktop`)
+
+	// connected plugs for instance name have a non-nil security snippet for apparmor
+	apparmorSpec = &apparmor.Specification{}
+	err = apparmorSpec.AddConnectedPlug(s.iface, s.plugInst, s.slot)
+	c.Assert(err, IsNil)
+	c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other-snap_instance.app2"})
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap_instance.app2"), testutil.Contains, `/usr/share/pixmaps`)
+	c.Assert(apparmorSpec.SnippetForTag("snap.other-snap_instance.app2"), testutil.Contains, `path=/com/canonical/indicator/messages/other_snap_instance_*_desktop`)
 
 	// connected plugs have a non-nil security snippet for seccomp
 	seccompSpec := &seccomp.Specification{}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/upower_observe.go snapd-2.48.3+20.04/interfaces/builtin/upower_observe.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/upower_observe.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/upower_observe.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,8 +36,8 @@
   upower-observe:
     allow-installation:
       slot-snap-type:
-        - core
         - app
+        - core
     deny-connection:
       on-classic: false
 `
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/utils.go snapd-2.48.3+20.04/interfaces/builtin/utils.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/utils.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/utils.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,7 @@
 	"regexp"
 	"sort"
 
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
@@ -89,7 +90,7 @@
 // - slot owned by an application snap typically requires rules updates
 func implicitSystemPermanentSlot(slot *snap.SlotInfo) bool {
 	if release.OnClassic &&
-		(slot.Snap.GetType() == snap.TypeOS || slot.Snap.GetType() == snap.TypeSnapd) {
+		(slot.Snap.Type() == snap.TypeOS || slot.Snap.Type() == snap.TypeSnapd) {
 		return true
 	}
 	return false
@@ -100,7 +101,7 @@
 // application.
 func implicitSystemConnectedSlot(slot *interfaces.ConnectedSlot) bool {
 	if release.OnClassic &&
-		(slot.Snap().GetType() == snap.TypeOS || slot.Snap().GetType() == snap.TypeSnapd) {
+		(slot.Snap().Type() == snap.TypeOS || slot.Snap().Type() == snap.TypeSnapd) {
 		return true
 	}
 	return false
@@ -125,3 +126,58 @@
 	}
 	return cleanPath, nil
 }
+
+// aareExclusivePatterns takes a string and generates deny alternations. Eg,
+// aareExclusivePatterns("foo") returns:
+// []string{
+//   "[^f]*",
+//   "f[^o]*",
+//   "fo[^o]*",
+// }
+func aareExclusivePatterns(orig string) []string {
+	// This function currently is only intended to be used with desktop
+	// prefixes as calculated by info.DesktopPrefix (the snap name and
+	// instance name, if present). To avoid having to worry about aare
+	// special characters, etc, perform ValidateDesktopPrefix() and return
+	// an empty list if invalid. If this function is modified for other
+	// input, aare/quoting/etc will have to be considered.
+	if !snap.ValidateDesktopPrefix(orig) {
+		return nil
+	}
+
+	s := make([]string, len(orig))
+
+	prefix := ""
+	for i, letter := range orig {
+		prefix = orig[:i]
+		s[i] = fmt.Sprintf("%s[^%c]*", prefix, letter)
+	}
+	return s
+}
+
+// getDesktopFileRules(<snap instance name>) generates snippet rules for
+// allowing access to the specified snap's desktop files in
+// dirs.SnapDesktopFilesDir, but explicitly denies access to all other snaps'
+// desktop files since xdg libraries may try to read all the desktop files
+// in the dir, causing excessive noise. (LP: #1868051)
+func getDesktopFileRules(snapInstanceName string) []string {
+	baseDir := dirs.SnapDesktopFilesDir
+
+	rules := []string{
+		"# Support applications which use the unity messaging menu, xdg-mime, etc",
+		"# This leaks the names of snaps with desktop files",
+		fmt.Sprintf("%s/ r,", baseDir),
+		"# Allowing reading only our desktop files (required by (at least) the unity",
+		"# messaging menu).",
+		"# parallel-installs: this leaks read access to desktop files owned by keyed",
+		"# instances of @{SNAP_NAME} to @{SNAP_NAME} snap",
+		fmt.Sprintf("%s/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,", baseDir),
+		"# Explicitly deny access to other snap's desktop files",
+		fmt.Sprintf("deny %s/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,", baseDir),
+	}
+	for _, t := range aareExclusivePatterns(snapInstanceName) {
+		rules = append(rules, fmt.Sprintf("deny %s/%s r,", baseDir, t))
+	}
+
+	return rules
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/utils_test.go snapd-2.48.3+20.04/interfaces/builtin/utils_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/utils_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/utils_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -142,6 +142,135 @@
 	c.Check(label, Equals, `"snap.test-snap.*"`)
 }
 
+func (s *utilsSuite) TestAareExclusivePatterns(c *C) {
+	res := builtin.AareExclusivePatterns("foo-bar")
+	c.Check(res, DeepEquals, []string{
+		"[^f]*",
+		"f[^o]*",
+		"fo[^o]*",
+		"foo[^-]*",
+		"foo-[^b]*",
+		"foo-b[^a]*",
+		"foo-ba[^r]*",
+	})
+}
+
+func (s *utilsSuite) TestAareExclusivePatternsInstance(c *C) {
+	res := builtin.AareExclusivePatterns("foo-bar+baz")
+	c.Check(res, DeepEquals, []string{
+		"[^f]*",
+		"f[^o]*",
+		"fo[^o]*",
+		"foo[^-]*",
+		"foo-[^b]*",
+		"foo-b[^a]*",
+		"foo-ba[^r]*",
+		"foo-bar[^+]*",
+		"foo-bar+[^b]*",
+		"foo-bar+b[^a]*",
+		"foo-bar+ba[^z]*",
+	})
+}
+
+func (s *utilsSuite) TestAareExclusivePatternsInvalid(c *C) {
+	bad := []string{
+		// AARE in name (man apparmor.d: AARE = ?*[]{}^)
+		"bad{",
+		"ba}d",
+		"b[ad",
+		"]bad",
+		"b^d",
+		"b*d",
+		"b?d",
+		"bad{+good",
+		"ba}d+good",
+		"b[ad+good",
+		"]bad+good",
+		"b^d+good",
+		"b*d+good",
+		"b?d+good",
+		// AARE in instance (man apparmor.d: AARE = ?*[]{}^)
+		"good+bad{",
+		"good+ba}d",
+		"good+b[ad",
+		"good+]bad",
+		"good+b^d",
+		"good+b*d",
+		"good+b?d",
+		// various other unexpected in name
+		"+good",
+		"/bad",
+		"bad,",
+		".bad.",
+		"ba'd",
+		"b\"ad",
+		"=bad",
+		"b\\0d",
+		"b\ad",
+		"(bad",
+		"bad)",
+		"b<ad",
+		"b>ad",
+		"bad!",
+		"b#d",
+		":bad",
+		"b@d",
+		"@{BAD}",
+		"b**d",
+		"bad -> evil",
+		"b a d",
+		// various other unexpected in instance
+		"good+",
+		"good+/bad",
+		"good+bad,",
+		"good+.bad.",
+		"good+ba'd",
+		"good+b\"ad",
+		"good+=bad",
+		"good+b\\0d",
+		"good+b\ad",
+		"good+(bad",
+		"good+bad)",
+		"good+b<ad",
+		"good+b>ad",
+		"good+bad!",
+		"good+b#d",
+		"good+:bad",
+		"good+b@d",
+		"good+@{BAD}",
+		"good+b**d",
+		"good+bad -> evil",
+	}
+
+	for _, s := range bad {
+		res := builtin.AareExclusivePatterns(s)
+		c.Check(res, IsNil)
+	}
+}
+
+func (s *utilsSuite) TestGetDesktopFileRules(c *C) {
+	res := builtin.GetDesktopFileRules("foo-bar")
+	c.Check(res, DeepEquals, []string{
+		"# Support applications which use the unity messaging menu, xdg-mime, etc",
+		"# This leaks the names of snaps with desktop files",
+		"/var/lib/snapd/desktop/applications/ r,",
+		"# Allowing reading only our desktop files (required by (at least) the unity",
+		"# messaging menu).",
+		"# parallel-installs: this leaks read access to desktop files owned by keyed",
+		"# instances of @{SNAP_NAME} to @{SNAP_NAME} snap",
+		"/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,",
+		"# Explicitly deny access to other snap's desktop files",
+		"deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,",
+		"deny /var/lib/snapd/desktop/applications/[^f]* r,",
+		"deny /var/lib/snapd/desktop/applications/f[^o]* r,",
+		"deny /var/lib/snapd/desktop/applications/fo[^o]* r,",
+		"deny /var/lib/snapd/desktop/applications/foo[^-]* r,",
+		"deny /var/lib/snapd/desktop/applications/foo-[^b]* r,",
+		"deny /var/lib/snapd/desktop/applications/foo-b[^a]* r,",
+		"deny /var/lib/snapd/desktop/applications/foo-ba[^r]* r,",
+	})
+}
+
 func MockPlug(c *C, yaml string, si *snap.SideInfo, plugName string) *snap.PlugInfo {
 	return builtin.MockPlug(c, yaml, si, plugName)
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/vcio.go snapd-2.48.3+20.04/interfaces/builtin/vcio.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/vcio.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/vcio.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,65 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin
+
+// https://docs.broadcom.com/doc/12358545
+// https://github.com/raspberrypi/linux/tree/rpi-5.4.y/drivers/char/broadcom
+const vcioSummary = `allows access to VideoCore I/O`
+
+// The raspberry pi allows programming its GPU from userspace via the /dev/vcio
+// device. These operations should be considered privileged since the driver
+// assumes trusted input, therefore require manual connection.
+const vcioBaseDeclarationSlots = `
+  vcio:
+    allow-installation:
+      slot-snap-type:
+        - core
+    deny-auto-connection: true
+`
+
+const vcioConnectedPlugAppArmor = `
+# Description: Can access to vcio.
+
+# vcio v1 access to ARM VideoCore (BCM_VCIO) for userspace GPU programming
+/dev/vcio rw,
+/sys/devices/virtual/bcm2708_vcio/vcio/** r,
+# the vcio driver uses dynamic allocation for its major number and
+# https://www.kernel.org/doc/Documentation/admin-guide/devices.txt lists
+# 234-254 char as "RESERVED FOR DYNAMIC ASSIGNMENT".
+/run/udev/data/c23[4-9]:[0-9]* r,
+/run/udev/data/c24[0-9]:[0-9]* r,
+/run/udev/data/c25[0-4]:[0-9]* r,
+`
+
+var vcioConnectedPlugUDev = []string{
+	`SUBSYSTEM=="bcm2708_vcio", KERNEL=="vcio"`,
+}
+
+func init() {
+	registerIface(&commonInterface{
+		name:                  "vcio",
+		summary:               vcioSummary,
+		implicitOnCore:        true,
+		implicitOnClassic:     true,
+		baseDeclarationSlots:  vcioBaseDeclarationSlots,
+		connectedPlugAppArmor: vcioConnectedPlugAppArmor,
+		connectedPlugUDev:     vcioConnectedPlugUDev,
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/vcio_test.go snapd-2.48.3+20.04/interfaces/builtin/vcio_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/vcio_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/vcio_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,102 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package builtin_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type VcioInterfaceSuite struct {
+	iface        interfaces.Interface
+	coreSlotInfo *snap.SlotInfo
+	coreSlot     *interfaces.ConnectedSlot
+	plugInfo     *snap.PlugInfo
+	plug         *interfaces.ConnectedPlug
+}
+
+var _ = Suite(&VcioInterfaceSuite{
+	iface: builtin.MustInterface("vcio"),
+})
+
+const vcioConsumerYaml = `name: consumer
+version: 0
+apps:
+ app:
+  plugs: [vcio]
+`
+
+const vcioCoreYaml = `name: core
+version: 0
+type: os
+slots:
+  vcio:
+`
+
+func (s *VcioInterfaceSuite) SetUpTest(c *C) {
+	s.plug, s.plugInfo = MockConnectedPlug(c, vcioConsumerYaml, nil, "vcio")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, vcioCoreYaml, nil, "vcio")
+}
+
+func (s *VcioInterfaceSuite) TestName(c *C) {
+	c.Assert(s.iface.Name(), Equals, "vcio")
+}
+
+func (s *VcioInterfaceSuite) TestSanitizeSlot(c *C) {
+	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
+}
+
+func (s *VcioInterfaceSuite) TestSanitizePlug(c *C) {
+	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
+}
+
+func (s *VcioInterfaceSuite) TestAppArmorSpec(c *C) {
+	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `/dev/vcio rw,`)
+}
+
+func (s *VcioInterfaceSuite) TestUDevSpec(c *C) {
+	spec := &udev.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.Snippets(), HasLen, 2)
+	c.Assert(spec.Snippets(), testutil.Contains, `# vcio
+SUBSYSTEM=="bcm2708_vcio", KERNEL=="vcio", TAG+="snap_consumer_app"`)
+	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_consumer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_consumer_app $devpath $major:$minor"`)
+}
+
+func (s *VcioInterfaceSuite) TestStaticInfo(c *C) {
+	si := interfaces.StaticInfoOf(s.iface)
+	c.Assert(si.ImplicitOnCore, Equals, true)
+	c.Assert(si.ImplicitOnClassic, Equals, true)
+	c.Assert(si.Summary, Equals, `allows access to VideoCore I/O`)
+	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "deny-auto-connection: true")
+}
+
+func (s *VcioInterfaceSuite) TestInterfaces(c *C) {
+	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/x11.go snapd-2.48.3+20.04/interfaces/builtin/x11.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/x11.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/x11.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,13 +20,15 @@
 package builtin
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/interfaces/mount"
 	"github.com/snapcore/snapd/interfaces/seccomp"
 	"github.com/snapcore/snapd/interfaces/udev"
-	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 )
 
@@ -102,6 +104,7 @@
     type=stream
     addr="@/tmp/.X11-unix/X[0-9]*"
     peer=(label=###PLUG_SECURITY_TAGS###),
+# TODO: deprecate and remove this if it doesn't break X11 server snaps.
 unix (connect, receive, send, accept)
     type=stream
     addr="@/tmp/.ICE-unix/[0-9]*"
@@ -138,6 +141,14 @@
 network netlink raw,
 /run/udev/data/c13:[0-9]* r,
 /run/udev/data/+input:* r,
+
+# Deny access to ICE granted by abstractions/X
+# See: https://bugs.launchpad.net/snapd/+bug/1901489
+deny owner @{HOME}/.ICEauthority r,
+deny owner /run/user/*/ICEauthority r,
+deny unix (connect, receive, send)
+    type=stream
+    peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
 `
 
 const x11ConnectedPlugSecComp = `
@@ -153,8 +164,67 @@
 	commonInterface
 }
 
+func (iface *x11Interface) MountConnectedPlug(spec *mount.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	if implicitSystemConnectedSlot(slot) {
+		// X11 slot is provided by the host system. Bring the host's
+		// /tmp/.X11-unix/ directory over to the snap mount namespace.
+		return spec.AddMountEntry(osutil.MountEntry{
+			Name:    "/var/lib/snapd/hostfs/tmp/.X11-unix",
+			Dir:     "/tmp/.X11-unix",
+			Options: []string{"bind", "ro"},
+		})
+	}
+
+	// X11 slot is provided by another snap on the system. Bring that snap's
+	// /tmp/.X11-unix/ directory over to the snap mount namespace. Here we
+	// rely on the predictable naming of the private /tmp directory of the
+	// slot-side snap which is currently provided by snap-confine.
+
+	// But if the same snap is providing both the plug and the slot, this is
+	// not necessary.
+	if plug.Snap().InstanceName() == slot.Snap().InstanceName() {
+		return nil
+	}
+	slotSnapName := slot.Snap().InstanceName()
+	return spec.AddMountEntry(osutil.MountEntry{
+		Name:    fmt.Sprintf("/var/lib/snapd/hostfs/tmp/snap.%s/tmp/.X11-unix", slotSnapName),
+		Dir:     "/tmp/.X11-unix",
+		Options: []string{"bind", "ro"},
+	})
+}
+
+func (iface *x11Interface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	if err := iface.commonInterface.AppArmorConnectedPlug(spec, plug, slot); err != nil {
+		return err
+	}
+	// Consult the comments in MountConnectedPlug for the rationale of the control flow.
+	if implicitSystemConnectedSlot(slot) {
+		spec.AddUpdateNS(`
+		/{,var/lib/snapd/hostfs/}tmp/.X11-unix/ rw,
+		mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/.X11-unix/ -> /tmp/.X11-unix/,
+		mount options=(ro, remount, bind) -> /tmp/.X11-unix/,
+		mount options=(rslave) -> /tmp/.X11-unix/,
+		umount /tmp/.X11-unix/,
+		`)
+		return nil
+	}
+	if plug.Snap().InstanceName() == slot.Snap().InstanceName() {
+		return nil
+	}
+	slotSnapName := slot.Snap().InstanceName()
+	spec.AddUpdateNS(fmt.Sprintf(`
+	/tmp/.X11-unix/ rw,
+	/var/lib/snapd/hostfs/tmp/snap.%s/tmp/.X11-unix/ rw,
+	mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/snap.%s/tmp/.X11-unix/ -> /tmp/.X11-unix/,
+	mount options=(ro, remount, bind) -> /tmp/.X11-unix/,
+	mount options=(rslave) -> /tmp/.X11-unix/,
+	umount /tmp/.X11-unix/,
+	`, slotSnapName, slotSnapName))
+	return nil
+}
+
 func (iface *x11Interface) AppArmorConnectedSlot(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
-	if !release.OnClassic {
+	if !implicitSystemConnectedSlot(slot) {
 		old := "###PLUG_SECURITY_TAGS###"
 		new := plugAppLabelExpr(plug)
 		snippet := strings.Replace(x11ConnectedSlotAppArmor, old, new, -1)
@@ -164,21 +234,21 @@
 }
 
 func (iface *x11Interface) SecCompPermanentSlot(spec *seccomp.Specification, slot *snap.SlotInfo) error {
-	if !release.OnClassic {
+	if !implicitSystemPermanentSlot(slot) {
 		spec.AddSnippet(x11PermanentSlotSecComp)
 	}
 	return nil
 }
 
 func (iface *x11Interface) AppArmorPermanentSlot(spec *apparmor.Specification, slot *snap.SlotInfo) error {
-	if !release.OnClassic {
+	if !implicitSystemPermanentSlot(slot) {
 		spec.AddSnippet(x11PermanentSlotAppArmor)
 	}
 	return nil
 }
 
 func (iface *x11Interface) UDevPermanentSlot(spec *udev.Specification, slot *snap.SlotInfo) error {
-	if !release.OnClassic {
+	if !implicitSystemPermanentSlot(slot) {
 		spec.TriggerSubsystem("input")
 		spec.TagDevice(`KERNEL=="tty[0-9]*"`)
 		spec.TagDevice(`KERNEL=="mice"`)
diff -Nru snapd-2.45.1+20.04.2/interfaces/builtin/x11_test.go snapd-2.48.3+20.04/interfaces/builtin/x11_test.go
--- snapd-2.45.1+20.04.2/interfaces/builtin/x11_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/builtin/x11_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,8 +25,10 @@
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
 	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/interfaces/mount"
 	"github.com/snapcore/snapd/interfaces/seccomp"
 	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/testutil"
@@ -36,6 +38,8 @@
 	iface           interfaces.Interface
 	coreSlotInfo    *snap.SlotInfo
 	coreSlot        *interfaces.ConnectedSlot
+	corePlugInfo    *snap.PlugInfo
+	corePlug        *interfaces.ConnectedPlug
 	classicSlotInfo *snap.SlotInfo
 	classicSlot     *interfaces.ConnectedSlot
 	plugInfo        *snap.PlugInfo
@@ -57,8 +61,15 @@
 const x11CoreYaml = `name: x11
 version: 0
 apps:
- app1:
-  slots: [x11]
+ app:
+  slots: [x11-provider]
+  plugs: [x11-consumer]
+plugs:
+  x11-consumer:
+    interface: x11
+slots:
+  x11-provider:
+    interface: x11
 `
 
 // an x11 slot on the core snap (as automatically added on classic)
@@ -72,7 +83,8 @@
 
 func (s *X11InterfaceSuite) SetUpTest(c *C) {
 	s.plug, s.plugInfo = MockConnectedPlug(c, x11MockPlugSnapInfoYaml, nil, "x11")
-	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, x11CoreYaml, nil, "x11")
+	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, x11CoreYaml, nil, "x11-provider")
+	s.corePlug, s.corePlugInfo = MockConnectedPlug(c, x11CoreYaml, nil, "x11-consumer")
 	s.classicSlot, s.classicSlotInfo = MockConnectedSlot(c, x11ClassicYaml, nil, "x11")
 }
 
@@ -89,28 +101,80 @@
 	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
 }
 
+func (s *X11InterfaceSuite) TestMountSpec(c *C) {
+	// case A: x11 slot is provided by the system
+	spec := &mount.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil)
+	c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{
+		Name:    "/var/lib/snapd/hostfs/tmp/.X11-unix",
+		Dir:     "/tmp/.X11-unix",
+		Options: []string{"bind", "ro"},
+	}})
+	c.Assert(spec.UserMountEntries(), HasLen, 0)
+
+	// case B: x11 slot is provided by another snap on the system
+	spec = &mount.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
+	c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{
+		Name:    "/var/lib/snapd/hostfs/tmp/snap.x11/tmp/.X11-unix",
+		Dir:     "/tmp/.X11-unix",
+		Options: []string{"bind", "ro"},
+	}})
+	c.Assert(spec.UserMountEntries(), HasLen, 0)
+
+	// case C: x11 slot is both provided and consumed by a snap on the system.
+	spec = &mount.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.corePlug, s.coreSlot), IsNil)
+	c.Assert(spec.MountEntries(), HasLen, 0)
+	c.Assert(spec.UserMountEntries(), HasLen, 0)
+}
+
 func (s *X11InterfaceSuite) TestAppArmorSpec(c *C) {
-	// on a core system with x11 slot coming from a regular app snap.
-	restore := release.MockOnClassic(false)
+	// case A: x11 slot is provided by the classic system
+	restore := release.MockOnClassic(true)
 	defer restore()
 
-	// connected plug to core slot
+	// Plug side connection permissions
 	spec := &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
+	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "fontconfig")
+	c.Assert(spec.UpdateNS(), HasLen, 1)
+	c.Assert(spec.UpdateNS()[0], testutil.Contains, `mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/.X11-unix/ -> /tmp/.X11-unix/,`)
+
+	// case B: x11 slot is provided by another snap on the system
+	restore = release.MockOnClassic(false)
+	defer restore()
+
+	// Plug side connection permissions
+	spec = &apparmor.Specification{}
 	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
 	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
 	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "fontconfig")
+	c.Assert(spec.UpdateNS(), HasLen, 1)
+	c.Assert(spec.UpdateNS()[0], testutil.Contains, `mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/snap.x11/tmp/.X11-unix/ -> /tmp/.X11-unix/,`)
 
-	// connected core slot to plug
+	// Slot side connection permissions
 	spec = &apparmor.Specification{}
 	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.coreSlot), IsNil)
-	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app1"})
-	c.Assert(spec.SnippetForTag("snap.x11.app1"), testutil.Contains, `peer=(label="snap.consumer.app"),`)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"})
+	c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, `peer=(label="snap.consumer.app"),`)
+	c.Assert(spec.UpdateNS(), HasLen, 0)
 
-	// permanent core slot
+	// Slot side permantent permissions
 	spec = &apparmor.Specification{}
 	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
-	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app1"})
-	c.Assert(spec.SnippetForTag("snap.x11.app1"), testutil.Contains, "capability sys_tty_config,")
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"})
+	c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, "capability sys_tty_config,")
+	c.Assert(spec.UpdateNS(), HasLen, 0)
+
+	// case C: x11 slot is both provided and consumed by a snap on the system.
+	spec = &apparmor.Specification{}
+	c.Assert(spec.AddConnectedPlug(s.iface, s.corePlug, s.coreSlot), IsNil)
+	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"})
+	c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, "fontconfig")
+	// Self-connection does not need bind mounts, so no additional permissions are provided to snap-update-ns.
+	c.Assert(spec.UpdateNS(), HasLen, 0)
 }
 
 func (s *X11InterfaceSuite) TestAppArmorSpecOnClassic(c *C) {
@@ -163,8 +227,8 @@
 	c.Assert(err, IsNil)
 
 	// both app and x11 have secomp rules set
-	c.Assert(seccompSpec.SecurityTags(), DeepEquals, []string{"snap.consumer.app", "snap.x11.app1"})
-	c.Assert(seccompSpec.SnippetForTag("snap.x11.app1"), testutil.Contains, "listen\n")
+	c.Assert(seccompSpec.SecurityTags(), DeepEquals, []string{"snap.consumer.app", "snap.x11.app"})
+	c.Assert(seccompSpec.SnippetForTag("snap.x11.app"), testutil.Contains, "listen\n")
 	c.Assert(seccompSpec.SnippetForTag("snap.consumer.app"), testutil.Contains, "bind\n")
 }
 
@@ -177,16 +241,16 @@
 	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
 	c.Assert(spec.Snippets(), HasLen, 6)
 	c.Assert(spec.Snippets(), testutil.Contains, `# x11
-KERNEL=="event[0-9]*", TAG+="snap_x11_app1"`)
+KERNEL=="event[0-9]*", TAG+="snap_x11_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `# x11
-KERNEL=="mice", TAG+="snap_x11_app1"`)
+KERNEL=="mice", TAG+="snap_x11_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `# x11
-KERNEL=="mouse[0-9]*", TAG+="snap_x11_app1"`)
+KERNEL=="mouse[0-9]*", TAG+="snap_x11_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `# x11
-KERNEL=="ts[0-9]*", TAG+="snap_x11_app1"`)
+KERNEL=="ts[0-9]*", TAG+="snap_x11_app"`)
 	c.Assert(spec.Snippets(), testutil.Contains, `# x11
-KERNEL=="tty[0-9]*", TAG+="snap_x11_app1"`)
-	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_x11_app1", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_x11_app1 $devpath $major:$minor"`)
+KERNEL=="tty[0-9]*", TAG+="snap_x11_app"`)
+	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_x11_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_x11_app $devpath $major:$minor"`)
 	c.Assert(spec.TriggeredSubsystems(), DeepEquals, []string{"input"})
 
 	// on a classic system with x11 slot coming from the core snap.
@@ -194,7 +258,7 @@
 	defer restore()
 
 	spec = &udev.Specification{}
-	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
+	c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil)
 	c.Assert(spec.Snippets(), HasLen, 0)
 	c.Assert(spec.TriggeredSubsystems(), IsNil)
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/core.go snapd-2.48.3+20.04/interfaces/core.go
--- snapd-2.45.1+20.04.2/interfaces/core.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/core.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,7 +27,7 @@
 	"github.com/snapcore/snapd/snap"
 )
 
-// Sanitize plug with a given snapd interface.
+// BeforePreparePlug sanitizes a plug with a given snapd interface.
 func BeforePreparePlug(iface Interface, plugInfo *snap.PlugInfo) error {
 	if iface.Name() != plugInfo.Interface {
 		return fmt.Errorf("cannot sanitize plug %q (interface %q) using interface %q",
@@ -40,6 +40,13 @@
 	return err
 }
 
+// ByName returns an Interface for the given interface name. Note that in order for
+// this to work properly, the package "interfaces/builtin" must also eventually be
+// imported to populate the full list of interfaces.
+var ByName = func(name string) (iface Interface, err error) {
+	panic("ByName is unset, import interfaces/builtin to initialize this")
+}
+
 // PlugRef is a reference to a plug.
 type PlugRef struct {
 	Snap string `json:"snap"`
@@ -197,6 +204,27 @@
 	BaseDeclarationSlots string
 }
 
+// PermanentPlugServiceSnippets will return the set of snippets for the systemd
+// service unit that should be generated for a snap with the specified plug.
+// The list returned is not unique, callers must de-duplicate themselves.
+// The plug is provided because the snippet may depend on plug attributes for
+// example. The plug is sanitized before the snippets are returned.
+func PermanentPlugServiceSnippets(iface Interface, plug *snap.PlugInfo) (snips []string, err error) {
+	// sanitize the plug first
+	err = BeforePreparePlug(iface, plug)
+	if err != nil {
+		return nil, err
+	}
+
+	type serviceSnippetPlugger interface {
+		ServicePermanentPlug(plug *snap.PlugInfo) []string
+	}
+	if iface, ok := iface.(serviceSnippetPlugger); ok {
+		snips = iface.ServicePermanentPlug(plug)
+	}
+	return snips, nil
+}
+
 // StaticInfoOf returns the static-info of the given interface.
 func StaticInfoOf(iface Interface) (si StaticInfo) {
 	type metaDataProvider interface {
diff -Nru snapd-2.45.1+20.04.2/interfaces/core_test.go snapd-2.48.3+20.04/interfaces/core_test.go
--- snapd-2.45.1+20.04.2/interfaces/core_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/core_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,7 +25,10 @@
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/interfaces"
+	// TODO: eliminate this import and just use interfaces import directly
 	. "github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/builtin"
 	"github.com/snapcore/snapd/interfaces/ifacetest"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
@@ -145,6 +148,98 @@
 	c.Assert(err, ErrorMatches, `malformed connection identifier: ".*"`)
 }
 
+type simpleIface struct {
+	name string
+}
+
+func (si simpleIface) Name() string                                              { return si.name }
+func (si simpleIface) AutoConnect(plug *snap.PlugInfo, slot *snap.SlotInfo) bool { return false }
+
+func (s *CoreSuite) TestByName(c *C) {
+	// setup a mock interface using builtin - this will also trigger init() in
+	// builtin package which set ByName to a real implementation
+	r := builtin.MockInterface(simpleIface{name: "mock-network"})
+	defer r()
+
+	_, err := interfaces.ByName("no-such-interface")
+	c.Assert(err, ErrorMatches, "interface \"no-such-interface\" not found")
+
+	iface, err := interfaces.ByName("mock-network")
+	c.Assert(err, IsNil)
+	c.Assert(iface.Name(), Equals, "mock-network")
+}
+
+type serviceSnippetIface struct {
+	simpleIface
+
+	sanitizerErr error
+
+	snips []string
+}
+
+func (ssi serviceSnippetIface) BeforePreparePlug(plug *snap.PlugInfo) error {
+	return ssi.sanitizerErr
+}
+
+func (ssi serviceSnippetIface) ServicePermanentPlug(plug *snap.PlugInfo) []string {
+	return ssi.snips
+}
+
+func (s *CoreSuite) TestPermanentPlugServiceSnippets(c *C) {
+	// setup a mock interface using builtin - this will also trigger init() in
+	// builtin package which set ByName to a real implementation
+	ssi := serviceSnippetIface{
+		simpleIface: simpleIface{name: "mock-service-snippets"},
+		snips:       []string{"foo1", "foo2"},
+	}
+	r := builtin.MockInterface(ssi)
+	defer r()
+
+	iface, err := interfaces.ByName("mock-service-snippets")
+	c.Assert(err, IsNil)
+	c.Assert(iface.Name(), Equals, "mock-service-snippets")
+
+	info := snaptest.MockInfo(c, `
+name: snap
+version: 0
+plugs:
+  plug:
+    interface: mock-service-snippets
+`, nil)
+	plug := info.Plugs["plug"]
+
+	snips, err := interfaces.PermanentPlugServiceSnippets(iface, plug)
+	c.Assert(err, IsNil)
+	c.Assert(snips, DeepEquals, []string{"foo1", "foo2"})
+}
+
+func (s *CoreSuite) TestPermanentPlugServiceSnippetsSanitizesPlugs(c *C) {
+	// setup a mock interface using builtin - this will also trigger init() in
+	// builtin package which set ByName to a real implementation
+	ssi := serviceSnippetIface{
+		simpleIface:  simpleIface{name: "unclean-service-snippets"},
+		sanitizerErr: fmt.Errorf("cannot sanitize: foo"),
+	}
+	r := builtin.MockInterface(ssi)
+	defer r()
+
+	info := snaptest.MockInfo(c, `
+name: snap
+version: 0
+plugs:
+  plug:
+    interface: unclean-service-snippets
+`, nil)
+	plug := info.Plugs["plug"]
+
+	iface, err := interfaces.ByName("unclean-service-snippets")
+	c.Assert(err, IsNil)
+	c.Assert(iface.Name(), Equals, "unclean-service-snippets")
+
+	_, err = interfaces.PermanentPlugServiceSnippets(iface, plug)
+	c.Assert(err, ErrorMatches, "cannot sanitize: foo")
+}
+
 func (s *CoreSuite) TestSanitizePlug(c *C) {
 	info := snaptest.MockInfo(c, `
 name: snap
diff -Nru snapd-2.45.1+20.04.2/interfaces/dbus/backend.go snapd-2.48.3+20.04/interfaces/dbus/backend.go
--- snapd-2.45.1+20.04.2/interfaces/dbus/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/dbus/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -39,7 +39,9 @@
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/timings"
+	"github.com/snapcore/snapd/wrappers"
 )
 
 // Backend is responsible for maintaining DBus policy files.
@@ -55,21 +57,36 @@
 	return "dbus"
 }
 
+func shouldCopyConfigFiles(snapInfo *snap.Info) bool {
+	// Only copy config files on classic distros
+	if !release.OnClassic {
+		return false
+	}
+	// Only copy config files if we have been reexecuted
+	if reexecd, _ := snapdtool.IsReexecd(); !reexecd {
+		return false
+	}
+	switch snapInfo.Type() {
+	case snap.TypeOS:
+		// XXX: ugly but we need to make sure that the content
+		// of the "snapd" snap wins
+		//
+		// TODO: this is also racy but the content of the
+		// files in core and snapd is identical.  Cleanup
+		// after link-snap and setup-profiles are unified
+		return !osutil.FileExists(filepath.Join(snapInfo.MountDir(), "../..", "snapd/current"))
+	case snap.TypeSnapd:
+		return true
+	default:
+		return false
+	}
+}
+
 // setupDbusServiceForUserd will setup the service file for the new
 // `snap userd` instance on re-exec
 func setupDbusServiceForUserd(snapInfo *snap.Info) error {
 	coreOrSnapdRoot := snapInfo.MountDir()
 
-	// fugly - but we need to make sure that the content of the
-	// "snapd" snap wins
-	//
-	// TODO: this is also racy but the content of the files in core and
-	// snapd is identical cleanup after link-snap and
-	// setup-profiles are unified
-	if snapInfo.InstanceName() == "core" && osutil.FileExists(filepath.Join(coreOrSnapdRoot, "../..", "snapd/current")) {
-		return nil
-	}
-
 	for _, srv := range []string{
 		"io.snapcraft.Launcher.service",
 		"io.snapcraft.Settings.service",
@@ -88,6 +105,35 @@
 	return nil
 }
 
+func setupHostDBusConf(snapInfo *snap.Info) error {
+	sessionContent, systemContent, err := wrappers.DeriveSnapdDBusConfig(snapInfo)
+	if err != nil {
+		return err
+	}
+
+	// We don't use `dirs.SnapDBusSessionPolicyDir because we want
+	// to match the path the package on the host system uses.
+	dest := filepath.Join(dirs.GlobalRootDir, "/usr/share/dbus-1/session.d")
+	if err = os.MkdirAll(dest, 0755); err != nil {
+		return err
+	}
+	_, _, err = osutil.EnsureDirState(dest, "snapd.*.conf", sessionContent)
+	if err != nil {
+		return err
+	}
+
+	dest = filepath.Join(dirs.GlobalRootDir, "/usr/share/dbus-1/system.d")
+	if err = os.MkdirAll(dest, 0755); err != nil {
+		return err
+	}
+	_, _, err = osutil.EnsureDirState(dest, "snapd.*.conf", systemContent)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // Setup creates dbus configuration files specific to a given snap.
 //
 // DBus has no concept of a complain mode so confinment type is ignored.
@@ -99,11 +145,16 @@
 		return fmt.Errorf("cannot obtain dbus specification for snap %q: %s", snapName, err)
 	}
 
-	// core/snapd on classic are special
-	if (snapInfo.GetType() == snap.TypeOS || snapInfo.GetType() == snap.TypeSnapd) && release.OnClassic {
+	// copy some config files when installing core/snapd if we reexec
+	if shouldCopyConfigFiles(snapInfo) {
 		if err := setupDbusServiceForUserd(snapInfo); err != nil {
 			logger.Noticef("cannot create host `snap userd` dbus service file: %s", err)
 		}
+		// TODO: Make this conditional on the dbus-activation
+		// feature flag.
+		if err := setupHostDBusConf(snapInfo); err != nil {
+			logger.Noticef("cannot create host dbus config: %s", err)
+		}
 	}
 
 	// Get the files that this snap should have
@@ -112,7 +163,7 @@
 		return fmt.Errorf("cannot obtain expected DBus configuration files for snap %q: %s", snapName, err)
 	}
 	glob := fmt.Sprintf("%s.conf", interfaces.SecurityTagGlob(snapName))
-	dir := dirs.SnapBusPolicyDir
+	dir := dirs.SnapDBusSystemPolicyDir
 	if err := os.MkdirAll(dir, 0755); err != nil {
 		return fmt.Errorf("cannot create directory for DBus configuration files %q: %s", dir, err)
 	}
@@ -128,7 +179,7 @@
 // This method should be called after removing a snap.
 func (b *Backend) Remove(snapName string) error {
 	glob := fmt.Sprintf("%s.conf", interfaces.SecurityTagGlob(snapName))
-	_, _, err := osutil.EnsureDirState(dirs.SnapBusPolicyDir, glob, nil)
+	_, _, err := osutil.EnsureDirState(dirs.SnapDBusSystemPolicyDir, glob, nil)
 	if err != nil {
 		return fmt.Errorf("cannot synchronize DBus configuration files for snap %q: %s", snapName, err)
 	}
diff -Nru snapd-2.45.1+20.04.2/interfaces/dbus/backend_test.go snapd-2.48.3+20.04/interfaces/dbus/backend_test.go
--- snapd-2.45.1+20.04.2/interfaces/dbus/backend_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/dbus/backend_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -33,6 +33,7 @@
 	"github.com/snapcore/snapd/interfaces/ifacetest"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -56,7 +57,7 @@
 
 	// Prepare a directory for DBus configuration files.
 	// NOTE: Normally this is a part of the OS snap.
-	err := os.MkdirAll(dirs.SnapBusPolicyDir, 0700)
+	err := os.MkdirAll(dirs.SnapDBusSystemPolicyDir, 0700)
 	c.Assert(err, IsNil)
 }
 
@@ -77,7 +78,7 @@
 	}
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.smbd.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.smbd.conf")
 		// file called "snap.sambda.smbd.conf" was created
 		_, err := os.Stat(profile)
 		c.Check(err, IsNil)
@@ -97,7 +98,7 @@
 	}
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.HookYaml, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.foo.hook.configure.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.foo.hook.configure.conf")
 
 		// Verify that "snap.foo.hook.configure.conf" was created
 		_, err := os.Stat(profile)
@@ -115,7 +116,7 @@
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 0)
 		s.RemoveSnap(c, snapInfo)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.smbd.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.smbd.conf")
 		// file called "snap.sambda.smbd.conf" was removed
 		_, err := os.Stat(profile)
 		c.Check(os.IsNotExist(err), Equals, true)
@@ -135,7 +136,7 @@
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.HookYaml, 0)
 		s.RemoveSnap(c, snapInfo)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.foo.hook.configure.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.foo.hook.configure.conf")
 
 		// Verify that "snap.foo.hook.configure.conf" was removed
 		_, err := os.Stat(profile)
@@ -152,7 +153,7 @@
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 0)
 		snapInfo = s.UpdateSnap(c, snapInfo, opts, ifacetest.SambaYamlV1WithNmbd, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.nmbd.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.nmbd.conf")
 		// file called "snap.sambda.nmbd.conf" was created
 		_, err := os.Stat(profile)
 		c.Check(err, IsNil)
@@ -173,7 +174,7 @@
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 0)
 		snapInfo = s.UpdateSnap(c, snapInfo, opts, ifacetest.SambaYamlWithHook, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.hook.configure.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.hook.configure.conf")
 
 		// Verify that "snap.samba.hook.configure.conf" was created
 		_, err := os.Stat(profile)
@@ -191,7 +192,7 @@
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1WithNmbd, 0)
 		snapInfo = s.UpdateSnap(c, snapInfo, opts, ifacetest.SambaYamlV1, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.nmbd.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.nmbd.conf")
 		// file called "snap.sambda.nmbd.conf" was removed
 		_, err := os.Stat(profile)
 		c.Check(os.IsNotExist(err), Equals, true)
@@ -212,7 +213,7 @@
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlWithHook, 0)
 		snapInfo = s.UpdateSnap(c, snapInfo, opts, ifacetest.SambaYamlV1, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.hook.configure.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.hook.configure.conf")
 
 		// Verify that "snap.samba.hook.configure.conf" was removed
 		_, err := os.Stat(profile)
@@ -231,7 +232,7 @@
 	}
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.smbd.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.smbd.conf")
 		c.Check(profile, testutil.FileEquals, "<?xml>\n<policy>...</policy>\n</xml>")
 		stat, err := os.Stat(profile)
 		c.Assert(err, IsNil)
@@ -243,7 +244,7 @@
 func (s *backendSuite) TestCombineSnippetsWithoutAnySnippets(c *C) {
 	for _, opts := range testedConfinementOpts {
 		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 0)
-		profile := filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.smbd.conf")
+		profile := filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.smbd.conf")
 		_, err := os.Stat(profile)
 		// Without any snippets, there the .conf file is not created.
 		c.Check(os.IsNotExist(err), Equals, true)
@@ -272,9 +273,9 @@
 	snapInfo := s.InstallSnap(c, interfaces.ConfinementOptions{}, "", sambaYamlWithIfaceBoundToNmbd, 0)
 	defer s.RemoveSnap(c, snapInfo)
 	// Check that only one of the .conf files is actually created
-	_, err := os.Stat(filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.smbd.conf"))
+	_, err := os.Stat(filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.smbd.conf"))
 	c.Check(os.IsNotExist(err), Equals, true)
-	_, err = os.Stat(filepath.Join(dirs.SnapBusPolicyDir, "snap.samba.nmbd.conf"))
+	_, err = os.Stat(filepath.Join(dirs.SnapDBusSystemPolicyDir, "snap.samba.nmbd.conf"))
 	c.Check(err, IsNil)
 }
 
@@ -282,8 +283,20 @@
 	c.Assert(s.Backend.SandboxFeatures(), DeepEquals, []string{"mediated-bus-access"})
 }
 
-func makeFakeDbusUserdServiceFiles(c *C, coreOrSnapdSnap *snap.Info) {
-	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/usr/share/dbus-1/services"), 0755)
+func makeFakeDbusConfigAndUserdServiceFiles(c *C, coreOrSnapdSnap *snap.Info) {
+	err := os.MkdirAll(filepath.Join(coreOrSnapdSnap.MountDir(), "/usr/share/dbus-1/session.d"), 0755)
+	c.Assert(err, IsNil)
+	content := fmt.Sprintf("content of snapd.session-services.conf for snap %s", coreOrSnapdSnap.InstanceName())
+	err = ioutil.WriteFile(filepath.Join(coreOrSnapdSnap.MountDir(), "/usr/share/dbus-1/session.d/snapd.session-services.conf"), []byte(content), 0644)
+	c.Assert(err, IsNil)
+
+	err = os.MkdirAll(filepath.Join(coreOrSnapdSnap.MountDir(), "/usr/share/dbus-1/system.d"), 0755)
+	c.Assert(err, IsNil)
+	content = fmt.Sprintf("content of snapd.system-services.conf for snap %s", coreOrSnapdSnap.InstanceName())
+	err = ioutil.WriteFile(filepath.Join(coreOrSnapdSnap.MountDir(), "/usr/share/dbus-1/system.d/snapd.system-services.conf"), []byte(content), 0644)
+	c.Assert(err, IsNil)
+
+	err = os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/usr/share/dbus-1/services"), 0755)
 	c.Assert(err, IsNil)
 
 	servicesPath := filepath.Join(coreOrSnapdSnap.MountDir(), "/usr/share/dbus-1/services")
@@ -300,18 +313,36 @@
 	}
 }
 
-func (s *backendSuite) testSetupWritesUsedFilesForCoreOrSnapd(c *C, coreOrSnapdYaml string) {
+var expectedDBusConfigFiles = []string{
+	"/usr/share/dbus-1/services/io.snapcraft.Launcher.service",
+	"/usr/share/dbus-1/services/io.snapcraft.Settings.service",
+	"/usr/share/dbus-1/session.d/snapd.session-services.conf",
+	"/usr/share/dbus-1/system.d/snapd.system-services.conf",
+}
+
+func (s *backendSuite) testSetupWritesDbusFilesForCoreOrSnapd(c *C, coreOrSnapdYaml string) {
 	coreOrSnapdInfo := snaptest.MockInfo(c, coreOrSnapdYaml, &snap.SideInfo{Revision: snap.R(2)})
-	makeFakeDbusUserdServiceFiles(c, coreOrSnapdInfo)
+	makeFakeDbusConfigAndUserdServiceFiles(c, coreOrSnapdInfo)
 
+	// Config files are not copied if we haven't reexecuted
 	err := s.Backend.Setup(coreOrSnapdInfo, interfaces.ConfinementOptions{}, s.Repo, nil)
 	c.Assert(err, IsNil)
 
-	for _, fn := range []string{
-		"io.snapcraft.Launcher.service",
-		"io.snapcraft.Settings.service",
-	} {
-		c.Assert(filepath.Join(dirs.GlobalRootDir, "/usr/share/dbus-1/services/"+fn), testutil.FilePresent)
+	for _, fn := range expectedDBusConfigFiles {
+		c.Check(filepath.Join(dirs.GlobalRootDir, fn), testutil.FileAbsent)
+	}
+
+	// Now make it look like snapd was reexecuted
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(coreOrSnapdInfo.MountDir(), "/usr/lib/snapd/snapd"), nil
+	})
+	defer restore()
+
+	err = s.Backend.Setup(coreOrSnapdInfo, interfaces.ConfinementOptions{}, s.Repo, nil)
+	c.Assert(err, IsNil)
+
+	for _, fn := range expectedDBusConfigFiles {
+		c.Check(filepath.Join(dirs.GlobalRootDir, fn), testutil.FilePresent)
 	}
 }
 
@@ -320,22 +351,27 @@
 	snapdYaml string = "name: snapd\nversion: 1\ntype: snapd"
 )
 
-func (s *backendSuite) TestSetupWritesUsedFilesForCore(c *C) {
-	s.testSetupWritesUsedFilesForCoreOrSnapd(c, coreYaml)
+func (s *backendSuite) TestSetupWritesDbusFilesForCore(c *C) {
+	s.testSetupWritesDbusFilesForCoreOrSnapd(c, coreYaml)
 }
 
-func (s *backendSuite) TestSetupWritesUsedFilesForSnapd(c *C) {
-	s.testSetupWritesUsedFilesForCoreOrSnapd(c, snapdYaml)
+func (s *backendSuite) TestSetupWritesDbusFilesForSnapd(c *C) {
+	s.testSetupWritesDbusFilesForCoreOrSnapd(c, snapdYaml)
 }
 
-func (s *backendSuite) TestSetupWritesUsedFilesBothSnapdAndCoreInstalled(c *C) {
+func (s *backendSuite) TestSetupWritesDbusFilesBothSnapdAndCoreInstalled(c *C) {
 	err := os.MkdirAll(filepath.Join(dirs.SnapMountDir, "snapd/current"), 0755)
 	c.Assert(err, IsNil)
 
 	coreInfo := snaptest.MockInfo(c, coreYaml, &snap.SideInfo{Revision: snap.R(2)})
-	makeFakeDbusUserdServiceFiles(c, coreInfo)
+	makeFakeDbusConfigAndUserdServiceFiles(c, coreInfo)
 	snapdInfo := snaptest.MockInfo(c, snapdYaml, &snap.SideInfo{Revision: snap.R(3)})
-	makeFakeDbusUserdServiceFiles(c, snapdInfo)
+	makeFakeDbusConfigAndUserdServiceFiles(c, snapdInfo)
+
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(snapdInfo.MountDir(), "/usr/lib/snapd/snapd"), nil
+	})
+	defer restore()
 
 	// first setup snapd which writes the files
 	err = s.Backend.Setup(snapdInfo, interfaces.ConfinementOptions{}, s.Repo, nil)
@@ -345,10 +381,7 @@
 	err = s.Backend.Setup(coreInfo, interfaces.ConfinementOptions{}, s.Repo, nil)
 	c.Assert(err, IsNil)
 
-	for _, fn := range []string{
-		"io.snapcraft.Launcher.service",
-		"io.snapcraft.Settings.service",
-	} {
-		c.Assert(filepath.Join(dirs.GlobalRootDir, "/usr/share/dbus-1/services/"+fn), testutil.FileEquals, fmt.Sprintf("content of %s for snap snapd", fn))
+	for _, fn := range expectedDBusConfigFiles {
+		c.Check(filepath.Join(dirs.GlobalRootDir, fn), testutil.FileEquals, fmt.Sprintf("content of %s for snap snapd", filepath.Base(fn)))
 	}
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/kmod/backend.go snapd-2.48.3+20.04/interfaces/kmod/backend.go
--- snapd-2.45.1+20.04.2/interfaces/kmod/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/kmod/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -50,10 +50,15 @@
 )
 
 // Backend is responsible for maintaining kernel modules
-type Backend struct{}
+type Backend struct {
+	preseed bool
+}
 
 // Initialize does nothing.
-func (b *Backend) Initialize(*interfaces.SecurityBackendOptions) error {
+func (b *Backend) Initialize(opts *interfaces.SecurityBackendOptions) error {
+	if opts != nil && opts.Preseed {
+		b.preseed = true
+	}
 	return nil
 }
 
@@ -89,7 +94,7 @@
 	}
 
 	if len(changed) > 0 {
-		loadModules(modules)
+		b.loadModules(modules)
 	}
 	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/kmod/export_test.go snapd-2.48.3+20.04/interfaces/kmod/export_test.go
--- snapd-2.45.1+20.04.2/interfaces/kmod/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/kmod/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,6 +19,6 @@
 
 package kmod
 
-var (
-	LoadModules = loadModules
-)
+func (b *Backend) LoadModules(modules []string) {
+	b.loadModules(modules)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/kmod/kmod.go snapd-2.48.3+20.04/interfaces/kmod/kmod.go
--- snapd-2.45.1+20.04.2/interfaces/kmod/kmod.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/kmod/kmod.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,7 +28,10 @@
 // error from modprobe as non-fatal and subsequent module loads are attempted
 // (otherwise failure to load a module means failure to connect the interface
 // and the other security backends)
-func loadModules(modules []string) {
+func (b *Backend) loadModules(modules []string) {
+	if b.preseed {
+		return
+	}
 	for _, mod := range modules {
 		// ignore errors which are logged by loadModule() via syslog
 		_ = exec.Command("modprobe", "--syslog", mod).Run()
diff -Nru snapd-2.45.1+20.04.2/interfaces/kmod/kmod_test.go snapd-2.48.3+20.04/interfaces/kmod/kmod_test.go
--- snapd-2.45.1+20.04.2/interfaces/kmod/kmod_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/kmod/kmod_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package kmod_test
 
 import (
+	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/ifacetest"
 	"github.com/snapcore/snapd/interfaces/kmod"
 	"github.com/snapcore/snapd/testutil"
@@ -45,7 +46,9 @@
 	cmd := testutil.MockCommand(c, "modprobe", "")
 	defer cmd.Restore()
 
-	kmod.LoadModules([]string{
+	b, ok := s.Backend.(*kmod.Backend)
+	c.Assert(ok, Equals, true)
+	b.LoadModules([]string{
 		"module1",
 		"module2",
 	})
@@ -54,3 +57,17 @@
 		{"modprobe", "--syslog", "module2"},
 	})
 }
+
+func (s *kmodSuite) TestNoModprobeCallWhenPreseeding(c *C) {
+	cmd := testutil.MockCommand(c, "modprobe", "")
+	defer cmd.Restore()
+
+	b := kmod.Backend{}
+	opts := &interfaces.SecurityBackendOptions{
+		Preseed: true,
+	}
+	c.Assert(b.Initialize(opts), IsNil)
+
+	b.LoadModules([]string{"module1"})
+	c.Assert(cmd.Calls(), HasLen, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/mount/ns.go snapd-2.48.3+20.04/interfaces/mount/ns.go
--- snapd-2.45.1+20.04.2/interfaces/mount/ns.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/mount/ns.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,9 +24,9 @@
 	"os/exec"
 	"path/filepath"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 // mountNsPath returns path of the mount namespace file of a given snap
@@ -39,7 +39,7 @@
 func runNamespaceTool(toolName, snapName string) ([]byte, error) {
 	mntFile := mountNsPath(snapName)
 	if osutil.FileExists(mntFile) {
-		toolPath, err := cmd.InternalToolPath(toolName)
+		toolPath, err := snapdtool.InternalToolPath(toolName)
 		if err != nil {
 			return nil, err
 		}
diff -Nru snapd-2.45.1+20.04.2/interfaces/mount/spec_test.go snapd-2.48.3+20.04/interfaces/mount/spec_test.go
--- snapd-2.45.1+20.04.2/interfaces/mount/spec_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/mount/spec_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -143,10 +143,10 @@
 layout:
   /usr:
     bind: $SNAP/usr
-  /mytmp:
+  /lib/mytmp:
     type: tmpfs
     mode: 1777
-  /mylink:
+  /lib/mylink:
     symlink: $SNAP/link/target
   /etc/foo.conf:
     bind-file: $SNAP/foo.conf
@@ -158,8 +158,8 @@
 	c.Assert(s.spec.MountEntries(), DeepEquals, []osutil.MountEntry{
 		// Layout result is sorted by mount path.
 		{Dir: "/etc/foo.conf", Name: "/snap/vanguard/42/foo.conf", Options: []string{"bind", "rw", "x-snapd.kind=file", "x-snapd.origin=layout"}},
-		{Dir: "/mylink", Options: []string{"x-snapd.kind=symlink", "x-snapd.symlink=/snap/vanguard/42/link/target", "x-snapd.origin=layout"}},
-		{Dir: "/mytmp", Name: "tmpfs", Type: "tmpfs", Options: []string{"x-snapd.mode=01777", "x-snapd.origin=layout"}},
+		{Dir: "/lib/mylink", Options: []string{"x-snapd.kind=symlink", "x-snapd.symlink=/snap/vanguard/42/link/target", "x-snapd.origin=layout"}},
+		{Dir: "/lib/mytmp", Name: "tmpfs", Type: "tmpfs", Options: []string{"x-snapd.mode=01777", "x-snapd.origin=layout"}},
 		{Dir: "/usr", Name: "/snap/vanguard/42/usr", Options: []string{"rbind", "rw", "x-snapd.origin=layout"}},
 	})
 }
@@ -175,34 +175,34 @@
 		{Dir: "/var/snap/vanguard", Name: "/var/snap/vanguard_instance", Options: []string{"rbind", "x-snapd.origin=overname"}},
 		// Layout result is sorted by mount path.
 		{Dir: "/etc/foo.conf", Name: "/snap/vanguard/42/foo.conf", Options: []string{"bind", "rw", "x-snapd.kind=file", "x-snapd.origin=layout"}},
-		{Dir: "/mylink", Options: []string{"x-snapd.kind=symlink", "x-snapd.symlink=/snap/vanguard/42/link/target", "x-snapd.origin=layout"}},
-		{Dir: "/mytmp", Name: "tmpfs", Type: "tmpfs", Options: []string{"x-snapd.mode=01777", "x-snapd.origin=layout"}},
+		{Dir: "/lib/mylink", Options: []string{"x-snapd.kind=symlink", "x-snapd.symlink=/snap/vanguard/42/link/target", "x-snapd.origin=layout"}},
+		{Dir: "/lib/mytmp", Name: "tmpfs", Type: "tmpfs", Options: []string{"x-snapd.mode=01777", "x-snapd.origin=layout"}},
 		{Dir: "/usr", Name: "/snap/vanguard/42/usr", Options: []string{"rbind", "rw", "x-snapd.origin=layout"}},
 	})
 }
 
 func (s *specSuite) TestSpecificationUberclash(c *C) {
-	// When everything clashes for access to /foo, what happens?
+	// When everything clashes for access to /usr/foo, what happens?
 	const uberclashYaml = `name: uberclash
 version: 0
 layout:
-  /foo:
+  /usr/foo:
     type: tmpfs
 `
 	snapInfo := snaptest.MockInfo(c, uberclashYaml, &snap.SideInfo{Revision: snap.R(42)})
-	entry := osutil.MountEntry{Dir: "/foo", Type: "tmpfs", Name: "tmpfs"}
+	entry := osutil.MountEntry{Dir: "/usr/foo", Type: "tmpfs", Name: "tmpfs"}
 	s.spec.AddMountEntry(entry)
 	s.spec.AddUserMountEntry(entry)
 	s.spec.AddLayout(snapInfo)
 	c.Assert(s.spec.MountEntries(), DeepEquals, []osutil.MountEntry{
-		{Dir: "/foo", Type: "tmpfs", Name: "tmpfs", Options: []string{"x-snapd.origin=layout"}},
+		{Dir: "/usr/foo", Type: "tmpfs", Name: "tmpfs", Options: []string{"x-snapd.origin=layout"}},
 		// This is the non-layout entry, it was renamed to "foo-2"
-		{Dir: "/foo-2", Type: "tmpfs", Name: "tmpfs"},
+		{Dir: "/usr/foo-2", Type: "tmpfs", Name: "tmpfs"},
 	})
 	c.Assert(s.spec.UserMountEntries(), DeepEquals, []osutil.MountEntry{
 		// This is the user entry, it was _not_ renamed and it would clash with
 		// /foo but there is no way to request things like that for now.
-		{Dir: "/foo", Type: "tmpfs", Name: "tmpfs"},
+		{Dir: "/usr/foo", Type: "tmpfs", Name: "tmpfs"},
 	})
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/policy/basedeclaration_test.go snapd-2.48.3+20.04/interfaces/policy/basedeclaration_test.go
--- snapd-2.45.1+20.04.2/interfaces/policy/basedeclaration_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/policy/basedeclaration_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -595,6 +595,8 @@
 		"browser-support":         {"core"},
 		"content":                 {"app", "gadget"},
 		"core-support":            {"core"},
+		"cups":                    {"app"},
+		"cups-control":            {"app", "core"},
 		"dbus":                    {"app"},
 		"docker-support":          {"core"},
 		"dummy":                   {"app"},
@@ -711,6 +713,7 @@
 		"personal-files":        true,
 		"snapd-control":         true,
 		"system-files":          true,
+		"uinput":                true,
 		"unity8":                true,
 	}
 
@@ -751,6 +754,7 @@
 	// case-by-case basis
 	noconnect := map[string]bool{
 		"content":          true,
+		"cups":             true,
 		"docker":           true,
 		"fwupd":            true,
 		"location-control": true,
@@ -822,6 +826,103 @@
 	}
 }
 
+func (s *baseDeclSuite) TestConnectionImplicitOnClassicOrAppSnap(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	all := builtin.Interfaces()
+
+	// These interfaces represent when the interface might be implicit on
+	// classic or when the interface is provided via an app snap. As such,
+	// they all share the following:
+	//
+	// - implicitOnCore: false
+	// - implicitOnClassis: true
+	// - base declaration uses:
+	//     allow-installation:
+	//       slot-snap-type:
+	//         - app
+	//         - core
+	//     deny-connection:
+	//       on-classic: false
+	//     deny-auto-connection: true|false|unspecified
+	//
+	// connecting with these interfaces needs to be allowed on
+	// case-by-case basis when not on classic
+	ifaces := map[string]bool{
+		"audio-playback":  true,
+		"audio-record":    true,
+		"cups-control":    true,
+		"modem-manager":   true,
+		"network-manager": true,
+		"ofono":           true,
+		"pulseaudio":      true,
+		"upower-observe":  true,
+	}
+
+	for _, iface := range all {
+		if !ifaces[iface.Name()] {
+			continue
+		}
+		comm := Commentf(iface.Name())
+
+		// verify the interface is setup as expected wrt
+		// implicitOnCore, implicitOnClassic, no plugs and has
+		// expected slots (ignoring AutoConnection)
+		si := interfaces.StaticInfoOf(iface)
+		c.Assert(si.ImplicitOnCore, Equals, false)
+		c.Assert(si.ImplicitOnClassic, Equals, true)
+
+		c.Assert(s.baseDecl.PlugRule(iface.Name()), IsNil)
+
+		sr := s.baseDecl.SlotRule(iface.Name())
+		c.Assert(sr, Not(IsNil))
+		c.Assert(sr.AllowInstallation, HasLen, 1)
+		c.Check(sr.AllowInstallation[0].SlotSnapTypes, DeepEquals, []string{"app", "core"}, comm)
+		c.Assert(sr.DenyConnection, HasLen, 1)
+		c.Check(sr.DenyConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: false}, comm)
+
+		for _, onClassic := range []bool{true, false} {
+			release.OnClassic = onClassic
+
+			for _, implicit := range []bool{true, false} {
+				// When implicitOnCore is false, there is
+				// nothing to test on Core
+				if implicit && !onClassic {
+					continue
+				}
+
+				snapType := "app"
+				if implicit {
+					snapType = "os"
+				}
+				slotYaml := fmt.Sprintf(`name: slot-snap
+version: 0
+type: %s
+slots:
+  %s:
+`, snapType, iface.Name())
+
+				// XXX: eventually 'onClassic && !implicit' but
+				// the current declaration allows connection on
+				// Core when 'type: app'. See:
+				// https://github.com/snapcore/snapd/pull/8920/files#r471678529
+				expected := onClassic
+
+				// check base declaration
+				cand := s.connectCand(c, iface.Name(), slotYaml, "")
+				err := cand.Check()
+
+				if expected {
+					c.Check(err, IsNil, comm)
+				} else {
+					c.Check(err, NotNil, comm)
+				}
+			}
+		}
+	}
+}
+
 func (s *baseDeclSuite) TestSanity(c *C) {
 	all := builtin.Interfaces()
 
@@ -845,6 +946,7 @@
 		"snapd-control":         true,
 		"system-files":          true,
 		"udisks2":               true,
+		"uinput":                true,
 		"unity8":                true,
 		"wayland":               true,
 	}
diff -Nru snapd-2.45.1+20.04.2/interfaces/policy/helpers.go snapd-2.48.3+20.04/interfaces/policy/helpers.go
--- snapd-2.45.1+20.04.2/interfaces/policy/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/policy/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,7 @@
 	if len(types) == 0 {
 		return nil
 	}
-	snapType := snapInfo.GetType()
+	snapType := snapInfo.Type()
 	s := string(snapType)
 	if snapType == snap.TypeOS || snapType == snap.TypeSnapd {
 		// we use "core" in the assertions and we need also to
diff -Nru snapd-2.45.1+20.04.2/interfaces/seccomp/backend.go snapd-2.48.3+20.04/interfaces/seccomp/backend.go
--- snapd-2.45.1+20.04.2/interfaces/seccomp/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/seccomp/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -41,7 +41,6 @@
 	"strings"
 
 	"github.com/snapcore/snapd/arch"
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/osutil"
@@ -49,6 +48,7 @@
 	"github.com/snapcore/snapd/sandbox/apparmor"
 	"github.com/snapcore/snapd/sandbox/seccomp"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/strutil"
 	"github.com/snapcore/snapd/timings"
 )
@@ -61,7 +61,7 @@
 	requiresSocketcall     = requiresSocketcallImpl
 
 	snapSeccompVersionInfo = snapSeccompVersionInfoImpl
-	seccompCompilerLookup  = cmd.InternalToolPath
+	seccompCompilerLookup  = snapdtool.InternalToolPath
 )
 
 func snapSeccompVersionInfoImpl(c Compiler) (seccomp.VersionInfo, error) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/seccomp/backend_test.go snapd-2.48.3+20.04/interfaces/seccomp/backend_test.go
--- snapd-2.45.1+20.04.2/interfaces/seccomp/backend_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/seccomp/backend_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,7 +32,6 @@
 
 	. "gopkg.in/check.v1"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/ifacetest"
@@ -42,6 +41,7 @@
 	seccomp_sandbox "github.com/snapcore/snapd/sandbox/seccomp"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/strutil"
 	"github.com/snapcore/snapd/testutil"
 	"github.com/snapcore/snapd/timings"
@@ -76,7 +76,7 @@
 	err := os.MkdirAll(dirs.SnapSeccompDir, 0700)
 	c.Assert(err, IsNil)
 
-	s.restoreReadlink = cmd.MockOsReadlink(func(string) (string, error) {
+	s.restoreReadlink = snapdtool.MockOsReadlink(func(string) (string, error) {
 		// pretend that snapd is run from distro libexecdir
 		return filepath.Join(dirs.DistroLibExecDir, "snapd"), nil
 	})
@@ -149,7 +149,7 @@
 }
 
 func (s *backendSuite) TestInstallingSnapWritesProfilesWithReexec(c *C) {
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
 		// simulate that we run snapd from core
 		return filepath.Join(dirs.SnapMountDir, "core/42/usr/lib/snapd/snapd"), nil
 	})
@@ -700,7 +700,7 @@
 	// during bootstrap, before seeding, snapd/core snap is mounted at some
 	// random location under /tmp
 	tmpDir := c.MkDir()
-	restore := cmd.MockOsReadlink(func(string) (string, error) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
 		return filepath.Join(tmpDir, "usr/lib/snapd/snapd"), nil
 	})
 	defer restore()
diff -Nru snapd-2.45.1+20.04.2/interfaces/seccomp/template.go snapd-2.48.3+20.04/interfaces/seccomp/template.go
--- snapd-2.45.1+20.04.2/interfaces/seccomp/template.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/seccomp/template.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,6 +42,7 @@
 
 access
 faccessat
+faccessat2
 
 alarm
 brk
@@ -186,7 +187,12 @@
 inotify_init1
 inotify_rm_watch
 
-# TIOCSTI allows for faking input (man tty_ioctl)
+# ioctl() mediation currently primarily relies on Linux capabilities as well as
+# the initial syscall for the fd to pass to ioctl(). See 'man capabilities'
+# and 'man ioctl_list'. TIOCSTI requires CAP_SYS_ADMIN but allows for faking
+# input (man tty_ioctl), so we disallow it to prevent snaps plugging interfaces
+# with 'capability sys_admin' from interfering with other snaps or the
+# unconfined user's terminal.
 # TODO: this should be scaled back even more
 ioctl - !TIOCSTI
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/systemd/backend.go snapd-2.48.3+20.04/interfaces/systemd/backend.go
--- snapd-2.45.1+20.04.2/interfaces/systemd/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/systemd/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,10 +37,15 @@
 )
 
 // Backend is responsible for maintaining apparmor profiles for ubuntu-core-launcher.
-type Backend struct{}
+type Backend struct {
+	preseed bool
+}
 
 // Initialize does nothing.
-func (b *Backend) Initialize(*interfaces.SecurityBackendOptions) error {
+func (b *Backend) Initialize(opts *interfaces.SecurityBackendOptions) error {
+	if opts != nil && opts.Preseed {
+		b.preseed = true
+	}
 	return nil
 }
 
@@ -69,16 +74,22 @@
 	}
 	glob := interfaces.InterfaceServiceName(snapName, "*")
 
-	systemd := sysd.New(dirs.GlobalRootDir, sysd.SystemMode, &dummyReporter{})
+	var systemd sysd.Systemd
+	if b.preseed {
+		systemd = sysd.NewEmulationMode(dirs.GlobalRootDir)
+	} else {
+		systemd = sysd.New(sysd.SystemMode, &dummyReporter{})
+	}
+
 	// We need to be carefully here and stop all removed service units before
 	// we remove their files as otherwise systemd is not able to disable/stop
 	// them anymore.
-	if err := disableRemovedServices(systemd, dir, glob, content); err != nil {
+	if err := b.disableRemovedServices(systemd, dir, glob, content); err != nil {
 		logger.Noticef("cannot stop removed services: %s", err)
 	}
 	changed, removed, errEnsure := osutil.EnsureDirState(dir, glob, content)
 	// Reload systemd whenever something is added or removed
-	if len(changed) > 0 || len(removed) > 0 {
+	if !b.preseed && (len(changed) > 0 || len(removed) > 0) {
 		err := systemd.DaemonReload()
 		if err != nil {
 			logger.Noticef("cannot reload systemd state: %s", err)
@@ -89,10 +100,12 @@
 		if err := systemd.Enable(service); err != nil {
 			logger.Noticef("cannot enable service %q: %s", service, err)
 		}
-		// If we have a new service here which isn't started yet the restart
-		// operation will start it.
-		if err := systemd.Restart(service, 10*time.Second); err != nil {
-			logger.Noticef("cannot restart service %q: %s", service, err)
+		if !b.preseed {
+			// If we have a new service here which isn't started yet the restart
+			// operation will start it.
+			if err := systemd.Restart(service, 10*time.Second); err != nil {
+				logger.Noticef("cannot restart service %q: %s", service, err)
+			}
 		}
 	}
 	return errEnsure
@@ -100,7 +113,14 @@
 
 // Remove disables, stops and removes systemd services of a given snap.
 func (b *Backend) Remove(snapName string) error {
-	systemd := sysd.New(dirs.GlobalRootDir, sysd.SystemMode, &dummyReporter{})
+	var systemd sysd.Systemd
+	if b.preseed {
+		// removing while preseeding is not a viable scenario, but implemented
+		// for completness.
+		systemd = sysd.NewEmulationMode(dirs.GlobalRootDir)
+	} else {
+		systemd = sysd.New(sysd.SystemMode, &dummyReporter{})
+	}
 	// Remove all the files matching snap glob
 	glob := interfaces.InterfaceServiceName(snapName, "*")
 	_, removed, errEnsure := osutil.EnsureDirState(dirs.SnapServicesDir, glob, nil)
@@ -108,12 +128,14 @@
 		if err := systemd.Disable(service); err != nil {
 			logger.Noticef("cannot disable service %q: %s", service, err)
 		}
-		if err := systemd.Stop(service, 5*time.Second); err != nil {
-			logger.Noticef("cannot stop service %q: %s", service, err)
+		if !b.preseed {
+			if err := systemd.Stop(service, 5*time.Second); err != nil {
+				logger.Noticef("cannot stop service %q: %s", service, err)
+			}
 		}
 	}
 	// Reload systemd whenever something is removed
-	if len(removed) > 0 {
+	if !b.preseed && len(removed) > 0 {
 		err := systemd.DaemonReload()
 		if err != nil {
 			logger.Noticef("cannot reload systemd state: %s", err)
@@ -148,7 +170,7 @@
 	return content
 }
 
-func disableRemovedServices(systemd sysd.Systemd, dir, glob string, content map[string]osutil.FileState) error {
+func (b *Backend) disableRemovedServices(systemd sysd.Systemd, dir, glob string, content map[string]osutil.FileState) error {
 	paths, err := filepath.Glob(filepath.Join(dir, glob))
 	if err != nil {
 		return err
@@ -159,8 +181,10 @@
 			if err := systemd.Disable(service); err != nil {
 				logger.Noticef("cannot disable service %q: %s", service, err)
 			}
-			if err := systemd.Stop(service, 5*time.Second); err != nil {
-				logger.Noticef("cannot stop service %q: %s", service, err)
+			if !b.preseed {
+				if err := systemd.Stop(service, 5*time.Second); err != nil {
+					logger.Noticef("cannot stop service %q: %s", service, err)
+				}
 			}
 		}
 	}
diff -Nru snapd-2.45.1+20.04.2/interfaces/systemd/backend_test.go snapd-2.48.3+20.04/interfaces/systemd/backend_test.go
--- snapd-2.45.1+20.04.2/interfaces/systemd/backend_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/systemd/backend_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -92,7 +92,7 @@
 	// the service was also started (whee)
 	c.Check(sysdLog, DeepEquals, [][]string{
 		{"daemon-reload"},
-		{"--root", dirs.GlobalRootDir, "enable", "snap.samba.interface.foo.service"},
+		{"enable", "snap.samba.interface.foo.service"},
 		{"stop", "snap.samba.interface.foo.service"},
 		{"show", "--property=ActiveState", "snap.samba.interface.foo.service"},
 		{"start", "snap.samba.interface.foo.service"},
@@ -113,7 +113,7 @@
 		c.Check(os.IsNotExist(err), Equals, true)
 		// the service was stopped
 		c.Check(s.systemctlArgs, DeepEquals, [][]string{
-			{"systemctl", "--root", dirs.GlobalRootDir, "disable", "snap.samba.interface.foo.service"},
+			{"systemctl", "disable", "snap.samba.interface.foo.service"},
 			{"systemctl", "stop", "snap.samba.interface.foo.service"},
 			{"systemctl", "show", "--property=ActiveState", "snap.samba.interface.foo.service"},
 			{"systemctl", "daemon-reload"},
@@ -147,7 +147,7 @@
 	s.UpdateSnap(c, snapInfo, interfaces.ConfinementOptions{}, ifacetest.SambaYamlV1, 0)
 	// The bar service should have been stopped
 	c.Check(s.systemctlArgs, DeepEquals, [][]string{
-		{"systemctl", "--root", dirs.GlobalRootDir, "disable", "snap.samba.interface.bar.service"},
+		{"systemctl", "disable", "snap.samba.interface.bar.service"},
 		{"systemctl", "stop", "snap.samba.interface.bar.service"},
 		{"systemctl", "show", "--property=ActiveState", "snap.samba.interface.bar.service"},
 		{"systemctl", "daemon-reload"},
@@ -157,3 +157,53 @@
 func (s *backendSuite) TestSandboxFeatures(c *C) {
 	c.Assert(s.Backend.SandboxFeatures(), IsNil)
 }
+
+func (s *backendSuite) TestInstallingSnapWhenPreseeding(c *C) {
+	s.Backend = &systemd.Backend{}
+	opts := &interfaces.SecurityBackendOptions{Preseed: true}
+	s.Backend.Initialize(opts)
+
+	var sysdLog [][]string
+	r := sysd.MockSystemctl(func(cmd ...string) ([]byte, error) {
+		sysdLog = append(sysdLog, cmd)
+		return []byte{}, nil
+	})
+	defer r()
+
+	s.Iface.SystemdPermanentSlotCallback = func(spec *systemd.Specification, slot *snap.SlotInfo) error {
+		return spec.AddService("snap.samba.interface.foo.service", &systemd.Service{ExecStart: "/bin/true"})
+	}
+	s.InstallSnap(c, interfaces.ConfinementOptions{}, "", ifacetest.SambaYamlV1, 1)
+	service := filepath.Join(dirs.SnapServicesDir, "snap.samba.interface.foo.service")
+	// the service file was created
+	_, err := os.Stat(service)
+	c.Check(err, IsNil)
+	// the service was enabled but not started
+	c.Check(sysdLog, DeepEquals, [][]string{
+		{"--root", dirs.GlobalRootDir, "enable", "snap.samba.interface.foo.service"},
+	})
+}
+
+// not a viable scenario, but tested for completness
+func (s *backendSuite) TestRemovingSnapWhenPreseeding(c *C) {
+	s.Backend = &systemd.Backend{}
+	opts := &interfaces.SecurityBackendOptions{Preseed: true}
+	s.Backend.Initialize(opts)
+
+	s.Iface.SystemdPermanentSlotCallback = func(spec *systemd.Specification, slot *snap.SlotInfo) error {
+		return spec.AddService("snap.samba.interface.foo.service", &systemd.Service{ExecStart: "/bin/true"})
+	}
+	for _, opts := range testedConfinementOpts {
+		snapInfo := s.InstallSnap(c, opts, "", ifacetest.SambaYamlV1, 1)
+		s.systemctlArgs = nil
+		s.RemoveSnap(c, snapInfo)
+		service := filepath.Join(dirs.SnapServicesDir, "snap.samba.interface.foo.service")
+		// the service file was removed
+		_, err := os.Stat(service)
+		c.Check(os.IsNotExist(err), Equals, true)
+		// the service was disabled (but no other systemctl calls)
+		c.Check(s.systemctlArgs, DeepEquals, [][]string{
+			{"systemctl", "--root", dirs.GlobalRootDir, "disable", "snap.samba.interface.foo.service"},
+		})
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/systemd/spec.go snapd-2.48.3+20.04/interfaces/systemd/spec.go
--- snapd-2.45.1+20.04.2/interfaces/systemd/spec.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/systemd/spec.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,8 +37,8 @@
 
 // AddService adds a new systemd service unit.
 func (spec *Specification) AddService(name string, s *Service) error {
-	if old, ok := spec.services[name]; ok && old != s {
-		return fmt.Errorf("interface requires conflicting system needs")
+	if old, ok := spec.services[name]; ok && old != nil && s != nil && *old != *s {
+		return fmt.Errorf("interface requires conflicting system needs: service %q used to be defined as %#v, now re-defined as %#v", name, *old, *s)
 	}
 	if spec.services == nil {
 		spec.services = make(map[string]*Service)
diff -Nru snapd-2.45.1+20.04.2/interfaces/systemd/spec_test.go snapd-2.48.3+20.04/interfaces/systemd/spec_test.go
--- snapd-2.45.1+20.04.2/interfaces/systemd/spec_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/systemd/spec_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -51,5 +51,15 @@
 	err := spec.AddService("foo.service", svc1)
 	c.Assert(err, IsNil)
 	err = spec.AddService("foo.service", svc2)
-	c.Assert(err, ErrorMatches, "interface requires conflicting system needs")
+	c.Assert(err, ErrorMatches, `interface requires conflicting system needs: service "foo.service" used to be defined as .*, now re-defined as .*`)
+}
+
+func (s *specSuite) TestDifferentObjectsNotClashing(c *C) {
+	svc1 := &systemd.Service{ExecStart: "one and the same"}
+	svc2 := &systemd.Service{ExecStart: "one and the same"}
+	spec := systemd.Specification{}
+	err := spec.AddService("foo.service", svc1)
+	c.Assert(err, IsNil)
+	err = spec.AddService("foo.service", svc2)
+	c.Assert(err, IsNil)
 }
diff -Nru snapd-2.45.1+20.04.2/interfaces/system_key.go snapd-2.48.3+20.04/interfaces/system_key.go
--- snapd-2.45.1+20.04.2/interfaces/system_key.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/system_key.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,8 @@
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
+	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -29,13 +31,13 @@
 	"strconv"
 	"strings"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/sandbox/apparmor"
 	"github.com/snapcore/snapd/sandbox/cgroup"
 	"github.com/snapcore/snapd/sandbox/seccomp"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 // ErrSystemKeyIncomparableVersions indicates that the system-key
@@ -102,7 +104,7 @@
 	sk := &systemKey{
 		Version: systemKeyVersion,
 	}
-	snapdPath, err := cmd.InternalToolPath("snapd")
+	snapdPath, err := snapdtool.InternalToolPath("snapd")
 	if err != nil {
 		return nil, err
 	}
@@ -157,6 +159,17 @@
 	return sk, nil
 }
 
+// UnmarshalJSONSystemKey unmarshalls the data from the reader as JSON into a
+// system key usable with SystemKeysMatch.
+func UnmarshalJSONSystemKey(r io.Reader) (interface{}, error) {
+	sk := &systemKey{}
+	err := json.NewDecoder(r).Decode(sk)
+	if err != nil {
+		return nil, err
+	}
+	return sk, nil
+}
+
 // WriteSystemKey will write the current system-key to disk
 func WriteSystemKey() error {
 	sk, err := generateSystemKey()
@@ -164,10 +177,15 @@
 		return err
 	}
 
-	// We only want to calculate this when the mtime of the parser changes.
-	// Since we calculate the mtime() as part of generateSystemKey, we can
-	// simply unconditionally write this out here.
-	sk.AppArmorParserFeatures, _ = apparmor.ParserFeatures()
+	// only fix AppArmorParserFeatures if we didn't already mock a system-key
+	// if we mocked a system-key we are running a test and don't want to use
+	// the real host system's parser features
+	if mockedSystemKey == nil {
+		// We only want to calculate this when the mtime of the parser changes.
+		// Since we calculate the mtime() as part of generateSystemKey, we can
+		// simply unconditionally write this out here.
+		sk.AppArmorParserFeatures, _ = apparmor.ParserFeatures()
+	}
 
 	sks, err := json.Marshal(sk)
 	if err != nil {
@@ -213,17 +231,11 @@
 		return false, err
 	}
 
-	raw, err := ioutil.ReadFile(dirs.SnapSystemKeyFile)
-	if err != nil && os.IsNotExist(err) {
-		return false, ErrSystemKeyMissing
-	}
+	diskSystemKey, err := readSystemKey()
 	if err != nil {
 		return false, err
 	}
-	var diskSystemKey systemKey
-	if err := json.Unmarshal(raw, &diskSystemKey); err != nil {
-		return false, err
-	}
+
 	// deal with the race that "snap run" may start, then snapd
 	// is upgraded and generates a new system-key with different
 	// inputs than the "snap run" in memory. In this case we
@@ -251,8 +263,51 @@
 	diskSystemKey.AppArmorParserFeatures = nil
 	mySystemKey.AppArmorParserFeatures = nil
 
+	ok, err := SystemKeysMatch(mySystemKey, diskSystemKey)
+	return !ok, err
+}
+
+func readSystemKey() (*systemKey, error) {
+	raw, err := ioutil.ReadFile(dirs.SnapSystemKeyFile)
+	if err != nil && os.IsNotExist(err) {
+		return nil, ErrSystemKeyMissing
+	}
+	if err != nil {
+		return nil, err
+	}
+	var diskSystemKey systemKey
+	if err := json.Unmarshal(raw, &diskSystemKey); err != nil {
+		return nil, err
+	}
+	return &diskSystemKey, nil
+}
+
+// RecordedSystemKey returns the system key read from the disk as opaque interface{}.
+func RecordedSystemKey() (interface{}, error) {
+	diskSystemKey, err := readSystemKey()
+	if err != nil {
+		return nil, err
+	}
+	return diskSystemKey, nil
+}
+
+// CurrentSystemKey calculates and returns the current system key as opaque interface{}.
+func CurrentSystemKey() (interface{}, error) {
+	currentSystemKey, err := generateSystemKey()
+	return currentSystemKey, err
+}
+
+// SystemKeysMatch returns whether the given system keys match.
+func SystemKeysMatch(systemKey1, systemKey2 interface{}) (bool, error) {
+	// sanity check
+	_, ok1 := systemKey1.(*systemKey)
+	_, ok2 := systemKey2.(*systemKey)
+	if !(ok1 && ok2) {
+		return false, fmt.Errorf("SystemKeysMatch: arguments are not system keys")
+	}
+
 	// TODO: write custom struct compare
-	return !reflect.DeepEqual(mySystemKey, &diskSystemKey), nil
+	return reflect.DeepEqual(systemKey1, systemKey2), nil
 }
 
 func MockSystemKey(s string) func() {
diff -Nru snapd-2.45.1+20.04.2/interfaces/system_key_test.go snapd-2.48.3+20.04/interfaces/system_key_test.go
--- snapd-2.45.1+20.04.2/interfaces/system_key_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/system_key_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package interfaces_test
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -282,3 +283,132 @@
 		"CgroupVersion:",
 	}, " ")+"}")
 }
+
+func (s *systemKeySuite) TestRecordedSystemKey(c *C) {
+	_, err := interfaces.RecordedSystemKey()
+	c.Check(err, Equals, interfaces.ErrSystemKeyMissing)
+
+	restore := interfaces.MockSystemKey(`
+{
+"build-id": "7a94e9736c091b3984bd63f5aebfc883c4d859e0",
+"apparmor-features": ["caps"]
+}
+`)
+	defer restore()
+
+	c.Assert(interfaces.WriteSystemKey(), IsNil)
+
+	// just to ensure we really re-read it from the disk with RecordedSystemKey
+	interfaces.MockSystemKey(`{"build-id":"foo"}`)
+
+	key, err := interfaces.RecordedSystemKey()
+	c.Assert(err, IsNil)
+
+	sysKey, ok := key.(*interfaces.SystemKey)
+	c.Assert(ok, Equals, true)
+	c.Check(sysKey.BuildID, Equals, "7a94e9736c091b3984bd63f5aebfc883c4d859e0")
+}
+
+func (s *systemKeySuite) TestCurrentSystemKey(c *C) {
+	restore := interfaces.MockSystemKey(`{"build-id": "7a94e9736c091b3984bd63f5aebfc883c4d859e0"}`)
+	defer restore()
+
+	key, err := interfaces.CurrentSystemKey()
+	c.Assert(err, IsNil)
+	sysKey, ok := key.(*interfaces.SystemKey)
+	c.Assert(ok, Equals, true)
+	c.Check(sysKey.BuildID, Equals, "7a94e9736c091b3984bd63f5aebfc883c4d859e0")
+}
+
+func (s *systemKeySuite) TestSystemKeysMatch(c *C) {
+	_, err := interfaces.SystemKeysMatch(nil, nil)
+	c.Check(err, ErrorMatches, `SystemKeysMatch: arguments are not system keys`)
+
+	restore := interfaces.MockSystemKey(`{"build-id": "7a94e9736c091b3984bd63f5aebfc883c4d859e0"}`)
+	defer restore()
+
+	key1, err := interfaces.CurrentSystemKey()
+	c.Assert(err, IsNil)
+
+	_, err = interfaces.SystemKeysMatch(key1, nil)
+	c.Check(err, ErrorMatches, `SystemKeysMatch: arguments are not system keys`)
+
+	_, err = interfaces.SystemKeysMatch(nil, key1)
+	c.Check(err, ErrorMatches, `SystemKeysMatch: arguments are not system keys`)
+
+	interfaces.MockSystemKey(`{"build-id": "8888e9736c091b3984bd63f5aebfc883c4d85988"}`)
+	key2, err := interfaces.CurrentSystemKey()
+	c.Assert(err, IsNil)
+
+	ok, err := interfaces.SystemKeysMatch(key1, key2)
+	c.Assert(err, IsNil)
+	c.Check(ok, Equals, false)
+
+	key3, err := interfaces.CurrentSystemKey()
+	c.Assert(err, IsNil)
+
+	ok, err = interfaces.SystemKeysMatch(key2, key3)
+	c.Assert(err, IsNil)
+	c.Check(ok, Equals, true)
+}
+
+func (s *systemKeySuite) TestSystemKeysUnmarshalSame(c *C) {
+	// whitespace here simulates the serialization across HTTP, etc. that should
+	// not trigger any differences
+	// use a full system-key to fully test serialization, etc.
+	systemKeyJSON := `
+	{
+		"apparmor-features": [
+			"caps",
+			"dbus",
+			"domain",
+			"file",
+			"mount",
+			"namespaces",
+			"network",
+			"network_v8",
+			"policy",
+			"ptrace",
+			"query",
+			"rlimit",
+			"signal"
+		],
+		"apparmor-parser-features": [],
+		"apparmor-parser-mtime": 1589907589,
+		"build-id": "cb94e5eeee4cf7ecda53f8308a984cb155b55732",
+		"cgroup-version": "1",
+		"nfs-home": false,
+		"overlay-root": "",
+		"seccomp-compiler-version": "e6e309ad8aee052e5aa695dfaa040328ae1559c5 2.4.3 9b218ef9a4e508dd8a7f848095cb8875d10a4bf28428ad81fdc3f8dac89108f7 bpf-actlog",
+		"seccomp-features": [
+			"allow",
+			"errno",
+			"kill_process",
+			"kill_thread",
+			"log",
+			"trace",
+			"trap",
+			"user_notif"
+		],
+		"version": 10
+	}`
+
+	// write the mocked system key to disk
+	restore := interfaces.MockSystemKey(systemKeyJSON)
+	defer restore()
+	err := interfaces.WriteSystemKey()
+	c.Assert(err, IsNil)
+
+	// now unmarshal the specific json to a system key object
+	key1, err := interfaces.UnmarshalJSONSystemKey(bytes.NewBuffer([]byte(systemKeyJSON)))
+	c.Assert(err, IsNil)
+
+	// now read the system key from disk
+	key2, err := interfaces.RecordedSystemKey()
+	c.Assert(err, IsNil)
+
+	// the two system-keys should be the same
+	ok, err := interfaces.SystemKeysMatch(key1, key2)
+	c.Assert(err, IsNil)
+	c.Check(ok, Equals, true, Commentf("key1:%#v key2:%#v", key1, key2))
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/udev/backend.go snapd-2.48.3+20.04/interfaces/udev/backend.go
--- snapd-2.45.1+20.04.2/interfaces/udev/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/udev/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -40,10 +40,15 @@
 )
 
 // Backend is responsible for maintaining udev rules.
-type Backend struct{}
+type Backend struct {
+	preseed bool
+}
 
 // Initialize does nothing.
-func (b *Backend) Initialize(*interfaces.SecurityBackendOptions) error {
+func (b *Backend) Initialize(opts *interfaces.SecurityBackendOptions) error {
+	if opts != nil && opts.Preseed {
+		b.preseed = true
+	}
 	return nil
 }
 
@@ -61,7 +66,7 @@
 // Setup creates udev rules specific to a given snap.
 // If any of the rules are changed or removed then udev database is reloaded.
 //
-// UDev has no concept of a complain mode so confinment options are ignored.
+// UDev has no concept of a complain mode so confinement options are ignored.
 //
 // If the method fails it should be re-tried (with a sensible strategy) by the caller.
 func (b *Backend) Setup(snapInfo *snap.Info, opts interfaces.ConfinementOptions, repo *interfaces.Repository, tm timings.Measurer) error {
@@ -90,7 +95,7 @@
 			// FIXME: somehow detect the interfaces that were
 			// disconnected and set subsystemTriggers appropriately.
 			// ATM, it is always going to be empty on disconnect.
-			return ReloadRules(subsystemTriggers)
+			return b.reloadRules(subsystemTriggers)
 		}
 		return nil
 	}
@@ -127,7 +132,7 @@
 	// FIXME: somehow detect the interfaces that were disconnected and set
 	// subsystemTriggers appropriately. ATM, it is always going to be empty
 	// on disconnect.
-	return ReloadRules(subsystemTriggers)
+	return b.reloadRules(subsystemTriggers)
 }
 
 // Remove removes udev rules specific to a given snap.
@@ -149,7 +154,7 @@
 	// FIXME: somehow detect the interfaces that were disconnected and set
 	// subsystemTriggers appropriately. ATM, it is always going to be empty
 	// on disconnect.
-	return ReloadRules(nil)
+	return b.reloadRules(nil)
 }
 
 func (b *Backend) deriveContent(spec *Specification, snapInfo *snap.Info) (content []string) {
diff -Nru snapd-2.45.1+20.04.2/interfaces/udev/export_test.go snapd-2.48.3+20.04/interfaces/udev/export_test.go
--- snapd-2.45.1+20.04.2/interfaces/udev/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/udev/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,24 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package udev
+
+func (b *Backend) ReloadRules(subsystemTriggers []string) error {
+	return b.reloadRules(subsystemTriggers)
+}
diff -Nru snapd-2.45.1+20.04.2/interfaces/udev/spec.go snapd-2.48.3+20.04/interfaces/udev/spec.go
--- snapd-2.45.1+20.04.2/interfaces/udev/spec.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/udev/spec.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 	"sort"
 	"strings"
 
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/strutil"
@@ -91,7 +92,8 @@
 	for _, securityTag := range spec.securityTags {
 		tag := udevTag(securityTag)
 		spec.addEntry(fmt.Sprintf("# %s\n%s, TAG+=\"%s\"", spec.iface, snippet, tag), tag)
-		spec.addEntry(fmt.Sprintf("TAG==\"%s\", RUN+=\"/usr/lib/snapd/snap-device-helper $env{ACTION} %s $devpath $major:$minor\"", tag, tag), tag)
+		spec.addEntry(fmt.Sprintf("TAG==\"%s\", RUN+=\"%s/snap-device-helper $env{ACTION} %s $devpath $major:$minor\"",
+			tag, dirs.DistroLibExecDir, tag), tag)
 	}
 }
 
diff -Nru snapd-2.45.1+20.04.2/interfaces/udev/spec_test.go snapd-2.48.3+20.04/interfaces/udev/spec_test.go
--- snapd-2.45.1+20.04.2/interfaces/udev/spec_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/udev/spec_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,11 +20,15 @@
 package udev_test
 
 import (
+	"fmt"
+
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/ifacetest"
 	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
 )
@@ -93,7 +97,7 @@
 	c.Assert(s.spec.Snippets(), DeepEquals, []string{"foo"})
 }
 
-func (s *specSuite) TestTagDevice(c *C) {
+func (s *specSuite) testTagDevice(c *C, helperDir string) {
 	// TagDevice acts in the scope of the plug/slot (as appropriate) and
 	// affects all of the apps and hooks related to the given plug or slot
 	// (with the exception that slots cannot have hooks).
@@ -120,15 +124,33 @@
 kernel="voodoo", TAG+="snap_snap1_foo"`,
 		`# iface-2
 kernel="hoodoo", TAG+="snap_snap1_foo"`,
-		`TAG=="snap_snap1_foo", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_snap1_foo $devpath $major:$minor"`,
+		fmt.Sprintf(`TAG=="snap_snap1_foo", RUN+="%s/snap-device-helper $env{ACTION} snap_snap1_foo $devpath $major:$minor"`, helperDir),
 		`# iface-1
 kernel="voodoo", TAG+="snap_snap1_hook_configure"`,
 		`# iface-2
 kernel="hoodoo", TAG+="snap_snap1_hook_configure"`,
-		`TAG=="snap_snap1_hook_configure", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_snap1_hook_configure $devpath $major:$minor"`,
+		fmt.Sprintf(`TAG=="snap_snap1_hook_configure", RUN+="%[1]s/snap-device-helper $env{ACTION} snap_snap1_hook_configure $devpath $major:$minor"`, helperDir),
 	})
 }
 
+func (s *specSuite) TestTagDevice(c *C) {
+	defer func() { dirs.SetRootDir("") }()
+	restore := release.MockReleaseInfo(&release.OS{ID: "ubuntu"})
+	defer restore()
+	dirs.SetRootDir("")
+	s.testTagDevice(c, "/usr/lib/snapd")
+}
+
+func (s *specSuite) TestTagDeviceAltLibexecdir(c *C) {
+	defer func() { dirs.SetRootDir("") }()
+	restore := release.MockReleaseInfo(&release.OS{ID: "fedora"})
+	defer restore()
+	dirs.SetRootDir("")
+	// sanity
+	c.Check(dirs.DistroLibExecDir, Equals, "/usr/libexec/snapd")
+	s.testTagDevice(c, "/usr/libexec/snapd")
+}
+
 // The spec.Specification can be used through the interfaces.Specification interface
 func (s *specSuite) TestSpecificationIface(c *C) {
 	var r interfaces.Specification = s.spec
diff -Nru snapd-2.45.1+20.04.2/interfaces/udev/udev.go snapd-2.48.3+20.04/interfaces/udev/udev.go
--- snapd-2.45.1+20.04.2/interfaces/udev/udev.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/udev/udev.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,7 +24,7 @@
 	"os/exec"
 )
 
-// ReloadRules runs three commands that reload udev rule database.
+// reloadRules runs three commands that reload udev rule database.
 //
 // The commands are: udevadm control --reload-rules
 //                   udevadm trigger --subsystem-nomatch=input
@@ -32,7 +32,11 @@
 // and optionally trigger other subsystems as defined in the interfaces. Eg:
 //                   udevadm trigger --subsystem-match=input
 //                   udevadm trigger --property-match=ID_INPUT_JOYSTICK=1
-func ReloadRules(subsystemTriggers []string) error {
+func (b *Backend) reloadRules(subsystemTriggers []string) error {
+	if b.preseed {
+		return nil
+	}
+
 	output, err := exec.Command("udevadm", "control", "--reload-rules").CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("cannot reload udev rules: %s\nudev output:\n%s", err, string(output))
diff -Nru snapd-2.45.1+20.04.2/interfaces/udev/udev_test.go snapd-2.48.3+20.04/interfaces/udev/udev_test.go
--- snapd-2.45.1+20.04.2/interfaces/udev/udev_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/interfaces/udev/udev_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/udev"
 	"github.com/snapcore/snapd/testutil"
 )
@@ -32,16 +33,23 @@
 	TestingT(t)
 }
 
-type uDevSuite struct{}
+type uDevSuite struct {
+	backend *udev.Backend
+}
 
 var _ = Suite(&uDevSuite{})
 
 // Tests for ReloadRules()
 
+func (s *uDevSuite) SetUpTest(c *C) {
+	s.backend = &udev.Backend{}
+	c.Assert(s.backend.Initialize(nil), IsNil)
+}
+
 func (s *uDevSuite) TestReloadUDevRulesRunsUDevAdm(c *C) {
 	cmd := testutil.MockCommand(c, "udevadm", "")
 	defer cmd.Restore()
-	err := udev.ReloadRules(nil)
+	err := s.backend.ReloadRules(nil)
 	c.Assert(err, IsNil)
 	c.Assert(cmd.Calls(), DeepEquals, [][]string{
 		{"udevadm", "control", "--reload-rules"},
@@ -61,7 +69,7 @@
 fi
 	`)
 	defer cmd.Restore()
-	err := udev.ReloadRules(nil)
+	err := s.backend.ReloadRules(nil)
 	c.Assert(err.Error(), Equals, ""+
 		"cannot reload udev rules: exit status 1\n"+
 		"udev output:\n"+
@@ -79,7 +87,7 @@
 fi
 	`)
 	defer cmd.Restore()
-	err := udev.ReloadRules(nil)
+	err := s.backend.ReloadRules(nil)
 	c.Assert(err.Error(), Equals, ""+
 		"cannot run udev triggers: exit status 2\n"+
 		"udev output:\n"+
@@ -93,7 +101,7 @@
 func (s *uDevSuite) TestReloadUDevRulesRunsUDevAdmWithSubsystem(c *C) {
 	cmd := testutil.MockCommand(c, "udevadm", "")
 	defer cmd.Restore()
-	err := udev.ReloadRules([]string{"input"})
+	err := s.backend.ReloadRules([]string{"input"})
 	c.Assert(err, IsNil)
 	c.Assert(cmd.Calls(), DeepEquals, [][]string{
 		{"udevadm", "control", "--reload-rules"},
@@ -111,7 +119,7 @@
 fi
 	`)
 	defer cmd.Restore()
-	err := udev.ReloadRules([]string{"input"})
+	err := s.backend.ReloadRules([]string{"input"})
 	c.Assert(err.Error(), Equals, ""+
 		"cannot run udev triggers for input subsystem: exit status 2\n"+
 		"udev output:\n"+
@@ -126,7 +134,7 @@
 func (s *uDevSuite) TestReloadUDevRulesRunsUDevAdmWithJoystick(c *C) {
 	cmd := testutil.MockCommand(c, "udevadm", "")
 	defer cmd.Restore()
-	err := udev.ReloadRules([]string{"input/joystick"})
+	err := s.backend.ReloadRules([]string{"input/joystick"})
 	c.Assert(err, IsNil)
 	c.Assert(cmd.Calls(), DeepEquals, [][]string{
 		{"udevadm", "control", "--reload-rules"},
@@ -144,7 +152,7 @@
 fi
 	`)
 	defer cmd.Restore()
-	err := udev.ReloadRules([]string{"input/joystick"})
+	err := s.backend.ReloadRules([]string{"input/joystick"})
 	c.Assert(err.Error(), Equals, ""+
 		"cannot run udev triggers for joysticks: exit status 2\n"+
 		"udev output:\n"+
@@ -159,7 +167,7 @@
 func (s *uDevSuite) TestReloadUDevRulesRunsUDevAdmWithTwoSubsystems(c *C) {
 	cmd := testutil.MockCommand(c, "udevadm", "")
 	defer cmd.Restore()
-	err := udev.ReloadRules([]string{"input", "tty"})
+	err := s.backend.ReloadRules([]string{"input", "tty"})
 	c.Assert(err, IsNil)
 	c.Assert(cmd.Calls(), DeepEquals, [][]string{
 		{"udevadm", "control", "--reload-rules"},
@@ -169,3 +177,16 @@
 		{"udevadm", "settle", "--timeout=10"},
 	})
 }
+
+func (s *uDevSuite) TestNoReloadWhenPreseeding(c *C) {
+	cmd := testutil.MockCommand(c, "udevadm", "")
+	defer cmd.Restore()
+
+	b := udev.Backend{}
+	opts := &interfaces.SecurityBackendOptions{
+		Preseed: true,
+	}
+	c.Assert(b.Initialize(opts), IsNil)
+	c.Assert(b.ReloadRules(nil), IsNil)
+	c.Assert(cmd.Calls(), HasLen, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/kernel/kernel.go snapd-2.48.3+20.04/kernel/kernel.go
--- snapd-2.45.1+20.04.2/kernel/kernel.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/kernel/kernel.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,79 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package kernel
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"regexp"
+
+	"gopkg.in/yaml.v2"
+)
+
+type Asset struct {
+	// TODO: we may make this an (optional) map at some point in
+	//       the future to select what things should be updated.
+	//
+	// Update set to true indicates that assets shall be updated.
+	Update  bool     `yaml:"update,omitempty"`
+	Content []string `yaml:"content,omitempty"`
+}
+
+type Info struct {
+	Assets map[string]*Asset `yaml:"assets,omitempty"`
+}
+
+// XXX: should we be more liberal? start conservative
+var validAssetName = regexp.MustCompile("^[a-zA-Z0-9]+$")
+
+// InfoFromKernelYaml reads the provided kernel metadata.
+func InfoFromKernelYaml(kernelYaml []byte) (*Info, error) {
+	var ki Info
+
+	if err := yaml.Unmarshal(kernelYaml, &ki); err != nil {
+		return nil, fmt.Errorf("cannot parse kernel metadata: %v", err)
+	}
+
+	for name := range ki.Assets {
+		if !validAssetName.MatchString(name) {
+			return nil, fmt.Errorf("invalid asset name %q, please use only alphanumeric characters", name)
+		}
+	}
+
+	return &ki, nil
+}
+
+// ReadInfo reads the kernel specific metadata from meta/kernel.yaml
+// in the snap root directory if the file exists.
+func ReadInfo(kernelSnapRootDir string) (*Info, error) {
+	p := filepath.Join(kernelSnapRootDir, "meta", "kernel.yaml")
+	content, err := ioutil.ReadFile(p)
+	// meta/kernel.yaml is optional so we should not error here if
+	// it is missing
+	if os.IsNotExist(err) {
+		return &Info{}, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("cannot read kernel info: %v", err)
+	}
+	return InfoFromKernelYaml(content)
+}
diff -Nru snapd-2.45.1+20.04.2/kernel/kernel_test.go snapd-2.48.3+20.04/kernel/kernel_test.go
--- snapd-2.45.1+20.04.2/kernel/kernel_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/kernel/kernel_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,139 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package kernel_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/kernel"
+)
+
+func makeMockKernel(c *C, kernelYaml string, filesWithContent map[string]string) string {
+	kernelRootDir := c.MkDir()
+	err := os.MkdirAll(filepath.Join(kernelRootDir, "meta"), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(kernelRootDir, "meta/kernel.yaml"), []byte(kernelYaml), 0644)
+	c.Assert(err, IsNil)
+
+	for fname, content := range filesWithContent {
+		p := filepath.Join(kernelRootDir, fname)
+		err = os.MkdirAll(filepath.Dir(p), 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(p, []byte(content), 0644)
+		c.Assert(err, IsNil)
+	}
+
+	return kernelRootDir
+}
+
+type kernelYamlTestSuite struct{}
+
+var _ = Suite(&kernelYamlTestSuite{})
+
+func TestCommand(t *testing.T) { TestingT(t) }
+
+var mockKernelYaml = []byte(`
+assets:
+  dtbs:
+    update: true
+    content:
+      - dtbs/bcm2711-rpi-4-b.dtb
+      - dtbs/bcm2836-rpi-2-b.dtb
+`)
+
+var mockInvalidKernelYaml = []byte(`
+assets:
+  non-alphanumeric:
+`)
+
+func (s *kernelYamlTestSuite) TestInfoFromKernelYamlSad(c *C) {
+	ki, err := kernel.InfoFromKernelYaml([]byte("foo"))
+	c.Check(err, ErrorMatches, "(?m)cannot parse kernel metadata: .*")
+	c.Check(ki, IsNil)
+}
+
+func (s *kernelYamlTestSuite) TestInfoFromKernelYamlBadName(c *C) {
+	ki, err := kernel.InfoFromKernelYaml(mockInvalidKernelYaml)
+	c.Check(err, ErrorMatches, `invalid asset name "non-alphanumeric", please use only alphanumeric characters`)
+	c.Check(ki, IsNil)
+}
+
+func (s *kernelYamlTestSuite) TestInfoFromKernelYamlHappy(c *C) {
+	ki, err := kernel.InfoFromKernelYaml(mockKernelYaml)
+	c.Check(err, IsNil)
+	c.Check(ki, DeepEquals, &kernel.Info{
+		Assets: map[string]*kernel.Asset{
+			"dtbs": {
+				Update: true,
+				Content: []string{
+					"dtbs/bcm2711-rpi-4-b.dtb",
+					"dtbs/bcm2836-rpi-2-b.dtb",
+				},
+			},
+		},
+	})
+}
+
+func (s *kernelYamlTestSuite) TestReadKernelYamlOptional(c *C) {
+	ki, err := kernel.ReadInfo("this-path-does-not-exist")
+	c.Check(err, IsNil)
+	c.Check(ki, DeepEquals, &kernel.Info{})
+}
+
+func (s *kernelYamlTestSuite) TestReadKernelYamlSad(c *C) {
+	mockKernelSnapRoot := c.MkDir()
+	kernelYamlPath := filepath.Join(mockKernelSnapRoot, "meta/kernel.yaml")
+	err := os.MkdirAll(filepath.Dir(kernelYamlPath), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(kernelYamlPath, []byte(`invalid-kernel-yaml`), 0644)
+	c.Assert(err, IsNil)
+
+	ki, err := kernel.ReadInfo(mockKernelSnapRoot)
+	c.Check(err, ErrorMatches, `(?m)cannot parse kernel metadata: yaml: unmarshal errors:.*`)
+	c.Check(ki, IsNil)
+}
+
+func (s *kernelYamlTestSuite) TestReadKernelYamlHappy(c *C) {
+	mockKernelSnapRoot := c.MkDir()
+	kernelYamlPath := filepath.Join(mockKernelSnapRoot, "meta/kernel.yaml")
+	err := os.MkdirAll(filepath.Dir(kernelYamlPath), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(kernelYamlPath, mockKernelYaml, 0644)
+	c.Assert(err, IsNil)
+
+	ki, err := kernel.ReadInfo(mockKernelSnapRoot)
+	c.Assert(err, IsNil)
+	c.Check(ki, DeepEquals, &kernel.Info{
+		Assets: map[string]*kernel.Asset{
+			"dtbs": {
+				Update: true,
+				Content: []string{
+					"dtbs/bcm2711-rpi-4-b.dtb",
+					"dtbs/bcm2836-rpi-2-b.dtb",
+				},
+			},
+		},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/kernel/validate.go snapd-2.48.3+20.04/kernel/validate.go
--- snapd-2.45.1+20.04.2/kernel/validate.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/kernel/validate.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,63 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package kernel
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+func validateAssetsContent(kernelRoot string, info *Info) error {
+	// bare structure content is checked to exist during layout
+	// make sure that filesystem content source paths exist as well
+	for name, as := range info.Assets {
+		for _, c := range as.Content {
+			realSource := filepath.Join(kernelRoot, c)
+			if !osutil.FileExists(realSource) {
+				return fmt.Errorf("asset %q: content %q source path does not exist", name, c)
+			}
+			if strings.HasSuffix(c, "/") {
+				// expecting a directory
+				if !osutil.IsDirectory(realSource + "/") {
+					return fmt.Errorf("asset %q: content %q is not a directory", name, c)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// Validate checks whether the given directory contains valid kernel snap
+// metadata and a matching content.
+func Validate(kernelRoot string) error {
+	info, err := ReadInfo(kernelRoot)
+	if err != nil {
+		return fmt.Errorf("invalid kernel metadata: %v", err)
+	}
+
+	if err := validateAssetsContent(kernelRoot, info); err != nil {
+		return err
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/kernel/validate_test.go snapd-2.48.3+20.04/kernel/validate_test.go
--- snapd-2.45.1+20.04.2/kernel/validate_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/kernel/validate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,92 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package kernel_test
+
+import (
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/kernel"
+)
+
+type validateKernelSuite struct {
+	dir string
+}
+
+var _ = Suite(&validateKernelSuite{})
+
+func (s *validateKernelSuite) SetUpTest(c *C) {
+	s.dir = c.MkDir()
+}
+
+func (s *validateKernelSuite) TestValidateMissingContentFile(c *C) {
+	var kernelYaml = `
+assets:
+  dtbs:
+    edition: 1
+    content:
+      - foo
+`
+	mockKernelRoot := makeMockKernel(c, kernelYaml, nil)
+
+	err := kernel.Validate(mockKernelRoot)
+	c.Assert(err, ErrorMatches, `asset "dtbs": content "foo" source path does not exist`)
+}
+
+func (s *validateKernelSuite) TestValidateMissingContentDir(c *C) {
+	var kernelYaml = `
+assets:
+  dtbs:
+    edition: 1
+    content:
+      - dir/
+`
+	mockKernelRoot := makeMockKernel(c, kernelYaml, map[string]string{"dir": ""})
+
+	err := kernel.Validate(mockKernelRoot)
+	c.Assert(err, ErrorMatches, `asset "dtbs": content "dir/" is not a directory`)
+}
+
+func (s *validateKernelSuite) TestValidateHappy(c *C) {
+	var kernelYaml = `
+assets:
+  dtbs:
+    edition: 1
+    content:
+      - foo
+      - dir/
+`
+	mockKernelRoot := makeMockKernel(c, kernelYaml, map[string]string{
+		"foo": "",
+	})
+	err := os.MkdirAll(filepath.Join(mockKernelRoot, "dir"), 0755)
+	c.Assert(err, IsNil)
+
+	err = kernel.Validate(mockKernelRoot)
+	c.Assert(err, IsNil)
+}
+
+func (s *validateKernelSuite) TestValidateHappyNoKernelYaml(c *C) {
+	emptyDir := c.MkDir()
+	err := kernel.Validate(emptyDir)
+	c.Assert(err, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/logger/export_test.go snapd-2.48.3+20.04/logger/export_test.go
--- snapd-2.45.1+20.04.2/logger/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/logger/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,10 +27,18 @@
 }
 
 func GetLoggerFlags() int {
-	log, ok := GetLogger().(Log)
+	log, ok := GetLogger().(*Log)
 	if !ok {
 		return -1
 	}
 
 	return log.log.Flags()
 }
+
+func ProcCmdlineMustMock(new bool) (restore func()) {
+	old := procCmdlineUseDefaultMockInTests
+	procCmdlineUseDefaultMockInTests = new
+	return func() {
+		procCmdlineUseDefaultMockInTests = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/logger/logger.go snapd-2.48.3+20.04/logger/logger.go
--- snapd-2.45.1+20.04.2/logger/logger.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/logger/logger.go	2021-02-02 08:21:12.000000000 +0000
@@ -121,23 +121,29 @@
 
 type Log struct {
 	log *log.Logger
+
+	debug bool
 }
 
 // Debug only prints if SNAPD_DEBUG is set
-func (l Log) Debug(msg string) {
-	if osutil.GetenvBool("SNAPD_DEBUG") {
+func (l *Log) Debug(msg string) {
+	if l.debug || osutil.GetenvBool("SNAPD_DEBUG") {
 		l.log.Output(3, "DEBUG: "+msg)
 	}
 }
 
 // Notice alerts the user about something, as well as putting it syslog
-func (l Log) Notice(msg string) {
+func (l *Log) Notice(msg string) {
 	l.log.Output(3, msg)
 }
 
 // New creates a log.Logger using the given io.Writer and flag.
 func New(w io.Writer, flag int) (Logger, error) {
-	return Log{log: log.New(w, "", flag)}, nil
+	logger := &Log{
+		log:   log.New(w, "", flag),
+		debug: debugEnabledOnKernelCmdline(),
+	}
+	return logger, nil
 }
 
 // SimpleSetup creates the default (console) logger
@@ -153,3 +159,18 @@
 	}
 	return err
 }
+
+// used to force testing of the kernel command line parsing
+var procCmdlineUseDefaultMockInTests = true
+
+// TODO: consider generalizing this to snapdenv and having it used by
+// other places that consider SNAPD_DEBUG
+func debugEnabledOnKernelCmdline() bool {
+	// if this is called during tests, always ignore it so we don't have to mock
+	// the /proc/cmdline for every test that ends up using a logger
+	if osutil.IsTestBinary() && procCmdlineUseDefaultMockInTests {
+		return false
+	}
+	m, _ := osutil.KernelCommandLineKeyValues("snapd.debug")
+	return m["snapd.debug"] == "1"
+}
diff -Nru snapd-2.45.1+20.04.2/logger/logger_test.go snapd-2.48.3+20.04/logger/logger_test.go
--- snapd-2.45.1+20.04.2/logger/logger_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/logger/logger_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,14 +21,17 @@
 
 import (
 	"bytes"
+	"io/ioutil"
 	"log"
 	"os"
+	"path/filepath"
 	"runtime"
 	"testing"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -122,3 +125,24 @@
 	})
 	c.Check(called, Equals, true)
 }
+
+func (s *LogSuite) TestIntegrationDebugFromKernelCmdline(c *C) {
+	// must enable actually checking the command line, because by default the
+	// logger package will skip checking for the kernel command line parameter
+	// if it detects it is in a test because otherwise we would have to mock the
+	// cmdline in many many many more tests that end up using a logger
+	restore := logger.ProcCmdlineMustMock(false)
+	defer restore()
+
+	mockProcCmdline := filepath.Join(c.MkDir(), "proc-cmdline")
+	err := ioutil.WriteFile(mockProcCmdline, []byte("console=tty panic=-1 snapd.debug=1\n"), 0644)
+	c.Assert(err, IsNil)
+	restore = osutil.MockProcCmdline(mockProcCmdline)
+	defer restore()
+
+	var buf bytes.Buffer
+	l, err := logger.New(&buf, logger.DefaultFlags)
+	c.Assert(err, IsNil)
+	l.Debug("xyzzy")
+	c.Check(buf.String(), testutil.Contains, `DEBUG: xyzzy`)
+}
diff -Nru snapd-2.45.1+20.04.2/mkversion.sh snapd-2.48.3+20.04/mkversion.sh
--- snapd-2.45.1+20.04.2/mkversion.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/mkversion.sh	2021-02-02 08:21:12.000000000 +0000
@@ -22,7 +22,7 @@
 GO_GENERATE_BUILDDIR="$(pwd)"
 
 # run from "go generate" adjust path
-if [ "$GOPACKAGE" = "cmd" ]; then
+if [ "$GOPACKAGE" = "snapdtool" ]; then
     GO_GENERATE_BUILDDIR="$(pwd)/.."
 fi
 
@@ -37,11 +37,24 @@
     version_from_user="$1"
 fi
 
+DIRTY=false
+
 # Let's try to derive the version from git..
 if command -v git >/dev/null; then
-    # not using "--dirty" here until the following bug is fixed:
-    # https://bugs.launchpad.net/snapcraft/+bug/1662388
+    # don't include --dirty here as we independently track whether the tree is
+    # dirty and append that last, including it here will make dirty trees 
+    # directly on top of tags show up with version_from_git as 2.46-dirty which
+    # will not match 2.46 from the changelog and then result in a final version
+    # like 2.46+git2.46.2.46 which is silly and unhelpful
+    # tracking the dirty independently like this will produce instead 2.46-dirty
+    # for a dirty tree on top of a tag, and 2.46+git83.g1671726-dirty for a 
+    # commit not directly on top of a tag
     version_from_git="$(git describe --always | sed -e 's/-/+git/;y/-/./' )"
+
+    # check if we are using a dirty tree
+    if git describe --always --dirty | grep -q dirty; then
+        DIRTY=true
+    fi
 fi
 
 # at this point we maybe in _build/src/github etc where we have no
@@ -67,20 +80,32 @@
     exit 1
 fi
 
-# if we don't have a user provided versions and if the version is not
+# if we don't have a user provided version and if the version is not
 # a release (i.e. the git tag does not match the debian changelog
 # version) then we need to construct the version similar to how we do
 # it in a packaging recipe. We take the debian version from the changelog
 # and append the git revno and commit hash. A simpler approach would be
 # to git tag all pre/rc releases.
 if [ -z "$version_from_user" ] && [ "$version_from_git" != "" ] && [ "$version_from_git" != "$version_from_changelog" ]; then
-    revno=$(git describe --always --abbrev=7|cut -d- -f2)
-    commit=$(git describe --always --abbrev=7|cut -d- -f3)
-    v="${version_from_changelog}+git${revno}.${commit}"
-    o="changelog+git"
+    # if the changelog version has "git" in it and we also have a git version
+    # directly, that is a bad changelog version, so fail, otherwise the below
+    # code will produce a duplicated git info
+    if echo "$version_from_changelog" | grep -q git; then
+        echo "Cannot generate version, there is a version from git and the changelog has a git version"
+        exit 1
+    else
+        revno=$(git describe --always --abbrev=7|cut -d- -f2)
+        commit=$(git describe --always --abbrev=7|cut -d- -f3)
+        v="${version_from_changelog}+git${revno}.${commit}"
+        o="changelog+git"
+    fi
+fi
+
+# append dirty at the end if we had a dirty tree
+if [ "$DIRTY" = "true" ]; then
+    v="$v-dirty"
 fi
 
-
 if [ "$OUTPUT_ONLY" = true ]; then
     echo "$v"
     exit 0
@@ -88,8 +113,8 @@
 
 echo "*** Setting version to '$v' from $o." >&2
 
-cat <<EOF > "$GO_GENERATE_BUILDDIR/cmd/version_generated.go"
-package cmd
+cat <<EOF > "$GO_GENERATE_BUILDDIR/snapdtool/version_generated.go"
+package snapdtool
 
 // generated by mkversion.sh; do not edit
 
diff -Nru snapd-2.45.1+20.04.2/osutil/chattr_64.go snapd-2.48.3+20.04/osutil/chattr_64.go
--- snapd-2.45.1+20.04.2/osutil/chattr_64.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/chattr_64.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,5 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
-// +build arm64 amd64 ppc64le s390x
+// +build amd64 arm64 ppc64le riscv64 s390x
 
 /*
  * Copyright (C) 2016 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/osutil/cp.go snapd-2.48.3+20.04/osutil/cp.go
--- snapd-2.45.1+20.04.2/osutil/cp.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/cp.go	2021-02-02 08:21:12.000000000 +0000
@@ -117,6 +117,47 @@
 	return nil
 }
 
+// AtomicWriteFileCopy writes to dst a copy of src using AtomicFile
+// internally to create the destination.
+// The destination path is always overwritten. The destination and
+// the owning directory are synced after copy completes. Pass additional flags
+// for AtomicFile wrapping the destination.
+func AtomicWriteFileCopy(dst, src string, flags AtomicWriteFlags) (err error) {
+	fin, err := openfile(src, os.O_RDONLY, 0)
+	if err != nil {
+		return fmt.Errorf("unable to open source file %s: %v", src, err)
+	}
+	defer func() {
+		if cerr := fin.Close(); cerr != nil && err == nil {
+			err = fmt.Errorf("when closing %s: %v", src, cerr)
+		}
+	}()
+
+	fi, err := fin.Stat()
+	if err != nil {
+		return fmt.Errorf("unable to stat %s: %v", src, err)
+	}
+
+	fout, err := NewAtomicFile(dst, fi.Mode(), flags, NoChown, NoChown)
+	if err != nil {
+		return fmt.Errorf("cannot create atomic file: %v", err)
+	}
+	defer func() {
+		if cerr := fout.Cancel(); cerr != ErrCannotCancel && err == nil {
+			err = fmt.Errorf("cannot cancel temporary file copy %s: %v", fout.Name(), cerr)
+		}
+	}()
+
+	if err := copyfile(fin, fout, fi); err != nil {
+		return fmt.Errorf("unable to copy %s to %s: %v", src, fout.Name(), err)
+	}
+
+	if err := fout.Commit(); err != nil {
+		return fmt.Errorf("cannot commit atomic file copy: %v", err)
+	}
+	return nil
+}
+
 func runCmd(cmd *exec.Cmd, errdesc string) error {
 	if output, err := cmd.CombinedOutput(); err != nil {
 		output = bytes.TrimSpace(output)
diff -Nru snapd-2.45.1+20.04.2/osutil/cp_test.go snapd-2.48.3+20.04/osutil/cp_test.go
--- snapd-2.45.1+20.04.2/osutil/cp_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/cp_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2015 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -300,3 +300,74 @@
 		{"sync"},
 	})
 }
+
+func (s *cpSuite) TestAtomicWriteFileCopySimple(c *C) {
+	err := AtomicWriteFileCopy(s.f2, s.f1, 0)
+	c.Assert(err, IsNil)
+	c.Assert(s.f2, testutil.FileEquals, s.data)
+
+}
+
+func (s *cpSuite) TestAtomicWriteFileCopyOverwrites(c *C) {
+	err := ioutil.WriteFile(s.f2, []byte("this is f2 content"), 0644)
+	c.Assert(err, IsNil)
+
+	err = AtomicWriteFileCopy(s.f2, s.f1, 0)
+	c.Assert(err, IsNil)
+	c.Assert(s.f2, testutil.FileEquals, s.data)
+}
+
+func (s *cpSuite) TestAtomicWriteFileCopySymlinks(c *C) {
+	f2Symlink := filepath.Join(s.dir, "f2-symlink")
+	err := os.Symlink(s.f2, f2Symlink)
+	c.Assert(err, IsNil)
+
+	f2SymlinkNoFollow := filepath.Join(s.dir, "f2-symlink-no-follow")
+	err = os.Symlink(s.f2, f2SymlinkNoFollow)
+	c.Assert(err, IsNil)
+
+	// follows symlink, dst is f2
+	err = AtomicWriteFileCopy(f2Symlink, s.f1, AtomicWriteFollow)
+	c.Assert(err, IsNil)
+	c.Check(IsSymlink(f2Symlink), Equals, true, Commentf("%q is not a symlink", f2Symlink))
+	c.Check(s.f2, testutil.FileEquals, s.data)
+	c.Check(f2SymlinkNoFollow, testutil.FileEquals, s.data)
+
+	// when not following, copy overwrites the symlink
+	err = AtomicWriteFileCopy(f2SymlinkNoFollow, s.f1, 0)
+	c.Assert(err, IsNil)
+	c.Check(IsSymlink(f2SymlinkNoFollow), Equals, false, Commentf("%q is not a file", f2SymlinkNoFollow))
+	c.Check(f2SymlinkNoFollow, testutil.FileEquals, s.data)
+}
+
+func (s *cpSuite) TestAtomicWriteFileCopyErrReal(c *C) {
+	err := AtomicWriteFileCopy(s.f2, filepath.Join(s.dir, "random-file"), 0)
+	c.Assert(err, ErrorMatches, "unable to open source file .*/random-file: open .* no such file or directory")
+
+	dir := c.MkDir()
+
+	err = AtomicWriteFileCopy(filepath.Join(dir, "random-dir", "f3"), s.f1, 0)
+	c.Assert(err, ErrorMatches, `cannot create atomic file: open .*/random-dir/f3\.[a-zA-Z0-9]+~: no such file or directory`)
+
+	err = os.MkdirAll(filepath.Join(dir, "read-only"), 0000)
+	c.Assert(err, IsNil)
+	err = AtomicWriteFileCopy(filepath.Join(dir, "read-only", "f3"), s.f1, 0)
+	c.Assert(err, ErrorMatches, `cannot create atomic file: open .*/read-only/f3\.[a-zA-Z0-9]+~: permission denied`)
+}
+
+func (s *cpSuite) TestAtomicWriteFileCopyErrMockedCopy(c *C) {
+	s.mock()
+	s.errs = []error{
+		nil, // openFile
+		nil, // src.Stat()
+		errors.New("copy fail"),
+	}
+
+	err := AtomicWriteFileCopy(s.f2, s.f1, 0)
+	c.Assert(err, ErrorMatches, `unable to copy .*/f1 to .*/f2\.[a-zA-Z0-9]+~: copy fail`)
+	entries, err := filepath.Glob(filepath.Join(s.dir, "*"))
+	c.Assert(err, IsNil)
+	c.Assert(entries, DeepEquals, []string{
+		filepath.Join(s.dir, "f1"),
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disk.go snapd-2.48.3+20.04/osutil/disk.go
--- snapd-2.45.1+20.04.2/osutil/disk.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disk.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,61 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil
+
+import (
+	"fmt"
+	"syscall"
+
+	"github.com/snapcore/snapd/strutil"
+)
+
+var syscallStatfs = syscall.Statfs
+
+type NotEnoughDiskSpaceError struct {
+	Path  string
+	Delta int64
+}
+
+func (e *NotEnoughDiskSpaceError) Error() string {
+	return fmt.Sprintf("insufficient space in %q, at least %s more is required", e.Path, strutil.SizeToStr(e.Delta))
+}
+
+// diskFree returns free disk space for the given path
+func diskFree(path string) (uint64, error) {
+	var st syscall.Statfs_t
+	if err := syscallStatfs(path, &st); err != nil {
+		return 0, err
+	}
+	// available blocks * block size
+	return st.Bavail * uint64(st.Bsize), nil
+}
+
+// CheckFreeSpace checks if there is enough disk space for the given path
+func CheckFreeSpace(path string, minSize uint64) error {
+	free, err := diskFree(path)
+	if err != nil {
+		return err
+	}
+	if free < minSize {
+		delta := int64(minSize - free)
+		return &NotEnoughDiskSpaceError{Path: path, Delta: delta}
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/disks.go snapd-2.48.3+20.04/osutil/disks/disks.go
--- snapd-2.45.1+20.04.2/osutil/disks/disks.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/disks.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,457 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+)
+
+var (
+	// this regexp is for the DM_UUID udev property, or equivalently the dm/uuid
+	// sysfs entry for a luks2 device mapper volume dynamically created by
+	// systemd-cryptsetup when unlocking
+	// the actual value that is returned also has "-some-name" appended to this
+	// pattern, but we delete that from the string before matching with this
+	// regexp to prevent issues like a mapper volume name that has CRYPT-LUKS2-
+	// in the name and thus we might accidentally match it
+	// see also the comments in DiskFromMountPoint about this value
+	luksUUIDPatternRe = regexp.MustCompile(`^CRYPT-LUKS2-([0-9a-f]{32})$`)
+)
+
+// diskFromMountPoint is exposed for mocking from other tests via
+// MockMountPointDisksToPartitionMapping, but we can't just assign
+// diskFromMountPointImpl to diskFromMountPoint due to signature differences,
+// the former returns a *disk, the latter returns a Disk, and as such they can't
+// be assigned to each other
+var diskFromMountPoint = func(mountpoint string, opts *Options) (Disk, error) {
+	return diskFromMountPointImpl(mountpoint, opts)
+}
+
+// Options is a set of options used when querying information about
+// partition and disk devices.
+type Options struct {
+	// IsDecryptedDevice indicates that the mountpoint is referring to a
+	// decrypted device.
+	IsDecryptedDevice bool
+}
+
+// Disk is a single physical disk device that contains partitions.
+// TODO:UC20: add function to get some properties like an associated /dev node
+//            for a disk for better user error reporting, i.e. /dev/vda3 is much
+//            more helpful than 252:3
+type Disk interface {
+	// FindMatchingPartitionUUID finds the partition uuid for a partition
+	// matching the specified filesystem label on the disk. Note that for
+	// non-ascii labels like "Some label", the label will be encoded using
+	// \x<hex> for potentially non-safe characters like in "Some\x20Label".
+	// If the filesystem label was not found on the disk, and no other errors
+	// were encountered, a FilesystemLabelNotFoundError will be returned.
+	FindMatchingPartitionUUID(string) (string, error)
+
+	// MountPointIsFromDisk returns whether the specified mountpoint corresponds
+	// to a partition on the disk. Note that this only considers partitions
+	// and mountpoints found when the disk was identified with
+	// DiskFromMountPoint.
+	// TODO:UC20: make this function return what a Disk of where the mount point
+	//            is actually from if it is not from the same disk for better
+	//            error reporting
+	MountPointIsFromDisk(string, *Options) (bool, error)
+
+	// Dev returns the string "major:minor" number for the disk device.
+	Dev() string
+
+	// HasPartitions returns whether the disk has partitions or not. A physical
+	// disk will have partitions, but a mapper device will just be a volume that
+	// does not have partitions for example.
+	HasPartitions() bool
+}
+
+func parseDeviceMajorMinor(s string) (int, int, error) {
+	errMsg := fmt.Errorf("invalid device number format: (expected <int>:<int>)")
+	devNums := strings.SplitN(s, ":", 2)
+	if len(devNums) != 2 {
+		return 0, 0, errMsg
+	}
+	maj, err := strconv.Atoi(devNums[0])
+	if err != nil {
+		return 0, 0, errMsg
+	}
+	min, err := strconv.Atoi(devNums[1])
+	if err != nil {
+		return 0, 0, errMsg
+	}
+	return maj, min, nil
+}
+
+var udevadmProperties = func(device string) ([]byte, error) {
+	// TODO: maybe combine with gadget interfaces hotplug code where the udev
+	// db is parsed?
+	cmd := exec.Command("udevadm", "info", "--query", "property", "--name", device)
+	return cmd.CombinedOutput()
+}
+
+func udevProperties(device string) (map[string]string, error) {
+	out, err := udevadmProperties(device)
+	if err != nil {
+		return nil, osutil.OutputErr(out, err)
+	}
+	r := bytes.NewBuffer(out)
+
+	return parseUdevProperties(r)
+}
+
+func parseUdevProperties(r io.Reader) (map[string]string, error) {
+	m := make(map[string]string)
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		strs := strings.SplitN(scanner.Text(), "=", 2)
+		if len(strs) != 2 {
+			// bad udev output?
+			continue
+		}
+		m[strs[0]] = strs[1]
+	}
+
+	return m, scanner.Err()
+}
+
+// DiskFromMountPoint finds a matching Disk for the specified mount point.
+func DiskFromMountPoint(mountpoint string, opts *Options) (Disk, error) {
+	// call the unexported version that may be mocked by tests
+	return diskFromMountPoint(mountpoint, opts)
+}
+
+type disk struct {
+	major int
+	minor int
+	// fsLabelToPartUUID is a map of filesystem label -> partition uuid for now
+	// eventually this may be expanded to be more generally useful
+	fsLabelToPartUUID map[string]string
+
+	// whether the disk device has partitions, and thus is of type "disk", or
+	// whether the disk device is a volume that is not a physical disk
+	hasPartitions bool
+}
+
+// diskFromMountPointImpl returns a Disk for the underlying mount source of the
+// specified mount point. For mount points which have sources that are not
+// partitions, and thus are a part of a disk, the returned Disk refers to the
+// volume/disk of the mount point itself.
+func diskFromMountPointImpl(mountpoint string, opts *Options) (*disk, error) {
+	// first get the mount entry for the mountpoint
+	mounts, err := osutil.LoadMountInfo()
+	if err != nil {
+		return nil, err
+	}
+	var d *disk
+	var partMountPointSource string
+	// loop over the mount entries in reverse order to prevent shadowing of a
+	// particular mount on top of another one
+	for i := len(mounts) - 1; i >= 0; i-- {
+		if mounts[i].MountDir == mountpoint {
+			d = &disk{
+				major: mounts[i].DevMajor,
+				minor: mounts[i].DevMinor,
+			}
+			partMountPointSource = mounts[i].MountSource
+			break
+		}
+	}
+	if d == nil {
+		return nil, fmt.Errorf("cannot find mountpoint %q", mountpoint)
+	}
+
+	// now we have the partition for this mountpoint, we need to tie that back
+	// to a disk with a major minor, so query udev with the mount source path
+	// of the mountpoint for properties
+	props, err := udevProperties(partMountPointSource)
+	if err != nil && props == nil {
+		// only fail here if props is nil, if it's available we validate it
+		// below
+		return nil, fmt.Errorf("cannot find disk for partition %s: %v", partMountPointSource, err)
+	}
+
+	if opts != nil && opts.IsDecryptedDevice {
+		// verify that the mount point is indeed a mapper device, it should:
+		// 1. have DEVTYPE == disk from udev
+		// 2. have dm files in the sysfs entry for the maj:min of the device
+		if props["DEVTYPE"] != "disk" {
+			// not a decrypted device
+			return nil, fmt.Errorf("mountpoint source %s is not a decrypted device: devtype is not disk (is %s)", partMountPointSource, props["DEVTYPE"])
+		}
+
+		// TODO:UC20: currently, we effectively parse the DM_UUID env variable
+		//            that is set for the mapper device volume, but doing so is
+		//            actually wrong, since the value of DM_UUID is an
+		//            implementation detail that depends on the subsystem
+		//            "owner" of the device such that the prefix is considered
+		//            the owner and the suffix is private data owned by the
+		//            subsystem. In our case, in UC20 initramfs, we have the
+		//            device "owned" by systemd-cryptsetup, so we should ideally
+		//            parse that the first part of DM_UUID matches CRYPT- and
+		//            then use `cryptsetup status` (since CRYPT indicates it is
+		//            "owned" by cryptsetup) to get more information on the
+		//            device sufficient for our purposes to find the encrypted
+		//            device/partition underneath the mapper.
+		//            However we don't currently have cryptsetup in the initrd,
+		//            so we can't do that yet :-(
+
+		// TODO:UC20: these files are also likely readable through udev env
+		//            properties, but it's unclear if reading there is reliable
+		//            or not, given that these variables have been observed to
+		//            be missing from the initrd previously, and are not
+		//            available at all during userspace on UC20 for some reason
+		errFmt := "mountpoint source %s is not a decrypted device: could not read device mapper metadata: %v"
+
+		dmDir := filepath.Join(dirs.SysfsDir, "dev", "block", d.Dev(), "dm")
+		dmUUID, err := ioutil.ReadFile(filepath.Join(dmDir, "uuid"))
+		if err != nil {
+			return nil, fmt.Errorf(errFmt, partMountPointSource, err)
+		}
+
+		dmName, err := ioutil.ReadFile(filepath.Join(dmDir, "name"))
+		if err != nil {
+			return nil, fmt.Errorf(errFmt, partMountPointSource, err)
+		}
+
+		// trim the suffix of the dm name from the dm uuid to safely match the
+		// regex - the dm uuid contains the dm name, and the dm name is user
+		// controlled, so we want to remove that and just use the luks pattern
+		// to match the device uuid
+		// we are extra safe here since the dm name could be hypothetically user
+		// controlled via an external USB disk with LVM partition names, etc.
+		dmUUIDSafe := bytes.TrimSuffix(
+			bytes.TrimSpace(dmUUID),
+			append([]byte("-"), bytes.TrimSpace(dmName)...),
+		)
+		matches := luksUUIDPatternRe.FindSubmatch(dmUUIDSafe)
+		if len(matches) != 2 {
+			// the format of the uuid is different - different luks version
+			// maybe?
+			return nil, fmt.Errorf("cannot verify disk: partition %s does not have a valid luks uuid format: %s", d.Dev(), dmUUIDSafe)
+		}
+
+		// the uuid is the first and only submatch, but it is not in the same
+		// format exactly as we want to use, namely it is missing all of the "-"
+		// characters in a typical uuid, i.e. it is of the form:
+		// ae6e79de00a9406f80ee64ba7c1966bb but we want it to be like:
+		// ae6e79de-00a9-406f-80ee-64ba7c1966bb so we need to add in 4 "-"
+		// characters
+		compactUUID := string(matches[1])
+		canonicalUUID := fmt.Sprintf(
+			"%s-%s-%s-%s-%s",
+			compactUUID[0:8],
+			compactUUID[8:12],
+			compactUUID[12:16],
+			compactUUID[16:20],
+			compactUUID[20:],
+		)
+
+		// now finally, we need to use this uuid, which is the device uuid of
+		// the actual physical encrypted partition to get the path, which will
+		// be something like /dev/vda4, etc.
+		byUUIDPath := filepath.Join("/dev/disk/by-uuid", canonicalUUID)
+		props, err = udevProperties(byUUIDPath)
+		if err != nil {
+			return nil, fmt.Errorf("cannot get udev properties for encrypted partition %s: %v", byUUIDPath, err)
+		}
+	}
+
+	// ID_PART_ENTRY_DISK will give us the major and minor of the disk that this
+	// partition originated from
+	if majorMinor, ok := props["ID_PART_ENTRY_DISK"]; ok {
+		maj, min, err := parseDeviceMajorMinor(majorMinor)
+		if err != nil {
+			// bad udev output?
+			return nil, fmt.Errorf("cannot find disk for partition %s, bad udev output: %v", partMountPointSource, err)
+		}
+		d.major = maj
+		d.minor = min
+
+		// since the mountpoint device has a disk, the mountpoint source itself
+		// must be a partition from a disk, thus the disk has partitions
+		d.hasPartitions = true
+		return d, nil
+	}
+
+	// if we don't have ID_PART_ENTRY_DISK, the partition is probably a volume
+	// or other non-physical disk, so confirm that DEVTYPE == disk and return
+	// the maj/min for it
+	if devType, ok := props["DEVTYPE"]; ok {
+		if devType == "disk" {
+			return d, nil
+		}
+		// unclear what other DEVTYPE's we should support for this function
+		return nil, fmt.Errorf("unsupported DEVTYPE %q for mount point source %s", devType, partMountPointSource)
+	}
+
+	return nil, fmt.Errorf("cannot find disk for partition %s, incomplete udev output", partMountPointSource)
+}
+
+// FilesystemLabelNotFoundError is an error where the specified label was not
+// found on the disk.
+type FilesystemLabelNotFoundError struct {
+	Label string
+}
+
+var (
+	_ = error(FilesystemLabelNotFoundError{})
+)
+
+func (e FilesystemLabelNotFoundError) Error() string {
+	return fmt.Sprintf("filesystem label %q not found", e.Label)
+}
+
+func (d *disk) FindMatchingPartitionUUID(label string) (string, error) {
+	encodedLabel := BlkIDEncodeLabel(label)
+	// if we haven't found the partitions for this disk yet, do that now
+	if d.fsLabelToPartUUID == nil {
+		d.fsLabelToPartUUID = make(map[string]string)
+
+		// step 1. find the devpath for the disk, then glob for matching
+		//         devices using the devname in that sysfs directory
+		// step 2. iterate over all those devices and save all the ones that are
+		//         partitions using the partition sysfs file
+		// step 3. for all partition devices found, query udev to get the fs
+		//         label and partition uuid
+
+		udevProps, err := udevProperties(filepath.Join("/dev/block", d.Dev()))
+		if err != nil {
+			return "", err
+		}
+
+		// get the base device name
+		devName := udevProps["DEVNAME"]
+		if devName == "" {
+			return "", fmt.Errorf("cannot get udev properties for device %s, missing udev property \"DEVNAME\"", d.Dev())
+		}
+		// the DEVNAME as returned by udev includes the /dev/mmcblk0 path, we
+		// just want mmcblk0 for example
+		devName = filepath.Base(devName)
+
+		// get the device path in sysfs
+		devPath := udevProps["DEVPATH"]
+		if devPath == "" {
+			return "", fmt.Errorf("cannot get udev properties for device %s, missing udev property \"DEVPATH\"", d.Dev())
+		}
+
+		// glob for /sys/${devPath}/${devName}*
+		paths, err := filepath.Glob(filepath.Join(dirs.SysfsDir, devPath, devName+"*"))
+		if err != nil {
+			return "", fmt.Errorf("internal error getting udev properties for device %s: %v", err, d.Dev())
+		}
+
+		// Glob does not sort, so sort manually to have consistent tests
+		sort.Strings(paths)
+
+		for _, path := range paths {
+			// check if this device is a partition - note that the mere
+			// existence of this file is sufficient to indicate that it is a
+			// partition, the file is the partition number of the device, it
+			// will be absent for pseudo sub-devices, such as the
+			// /dev/mmcblk0boot0 disk device on the dragonboard which exists
+			// under the /dev/mmcblk0 disk, but is not a partition and is
+			// instead a proper disk
+			_, err := ioutil.ReadFile(filepath.Join(path, "partition"))
+			if err != nil {
+				continue
+			}
+
+			// then the device is a partition, get the udev props for it
+			partDev := filepath.Base(path)
+			udevProps, err := udevProperties(partDev)
+			if err != nil {
+				continue
+			}
+
+			partUUID := udevProps["ID_PART_ENTRY_UUID"]
+			if partUUID == "" {
+				return "", fmt.Errorf("cannot get udev properties for device %s (a partition of %s), missing udev property \"ID_PART_ENTRY_UUID\"", partDev, d.Dev())
+			}
+
+			fsLabelEnc := udevProps["ID_FS_LABEL_ENC"]
+			if fsLabelEnc == "" {
+				// it is valid for there to be a partition without a fs
+				// label - such as the bios-boot partition on amd64 pc
+				// gadget systems
+				// in this case just skip this, since we are only matching
+				// by filesystem labels, obviously we cannot ever match to
+				// a partition which does not have a filesystem
+				continue
+			}
+
+			// TODO: maybe save ID_PART_ENTRY_NAME here too, which is the name
+			//       of the partition. this may be useful if this function gets
+			//       used in the gadget update code
+
+			// we always overwrite the fsLabelEnc with the last one, this
+			// has the result that the last partition with a given
+			// filesystem label will be set/found
+			// this matches what udev does with the symlinks in /dev
+			d.fsLabelToPartUUID[fsLabelEnc] = partUUID
+		}
+	}
+
+	// if we didn't find any partitions from above then return an error
+	if len(d.fsLabelToPartUUID) == 0 {
+		return "", fmt.Errorf("no partitions found for disk %s", d.Dev())
+	}
+
+	if partuuid, ok := d.fsLabelToPartUUID[encodedLabel]; ok {
+		return partuuid, nil
+	}
+
+	return "", FilesystemLabelNotFoundError{Label: label}
+}
+
+func (d *disk) MountPointIsFromDisk(mountpoint string, opts *Options) (bool, error) {
+	d2, err := diskFromMountPointImpl(mountpoint, opts)
+	if err != nil {
+		return false, err
+	}
+
+	// compare if the major/minor devices are the same and if both devices have
+	// partitions
+	return d.major == d2.major &&
+			d.minor == d2.minor &&
+			d.hasPartitions == d2.hasPartitions,
+		nil
+}
+
+func (d *disk) Dev() string {
+	return fmt.Sprintf("%d:%d", d.major, d.minor)
+}
+
+func (d *disk) HasPartitions() bool {
+	return d.hasPartitions
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/disks_test.go snapd-2.48.3+20.04/osutil/disks/disks_test.go
--- snapd-2.45.1+20.04.2/osutil/disks/disks_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/disks_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,656 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"golang.org/x/xerrors"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/disks"
+	"github.com/snapcore/snapd/testutil"
+)
+
+var (
+	virtioDiskDevPath = "/devices/pci0000:00/0000:00:03.0/virtio1/block/vda/"
+
+	// typical real-world values for tests
+	diskUdevPropMap = map[string]string{
+		"ID_PART_ENTRY_DISK": "42:0",
+		"DEVNAME":            "/dev/vda",
+		"DEVPATH":            virtioDiskDevPath,
+	}
+
+	// the udev prop for bios-boot has no fs label, which is typical of the
+	// real bios-boot partition on a amd64 pc gadget system, and so we should
+	// safely just ignore and skip this partition in the implementation
+	biotBootUdevPropMap = map[string]string{
+		"ID_PART_ENTRY_UUID": "bios-boot-partuuid",
+	}
+
+	// all the ubuntu- partitions have fs labels
+	ubuntuSeedUdevPropMap = map[string]string{
+		"ID_PART_ENTRY_UUID": "ubuntu-seed-partuuid",
+		"ID_FS_LABEL_ENC":    "ubuntu-seed",
+	}
+	ubuntuBootUdevPropMap = map[string]string{
+		"ID_PART_ENTRY_UUID": "ubuntu-boot-partuuid",
+		"ID_FS_LABEL_ENC":    "ubuntu-boot",
+	}
+	ubuntuDataUdevPropMap = map[string]string{
+		"ID_PART_ENTRY_UUID": "ubuntu-data-partuuid",
+		"ID_FS_LABEL_ENC":    "ubuntu-data",
+	}
+)
+
+func createVirtioDevicesInSysfs(c *C, devsToPartition map[string]bool) {
+	diskDir := filepath.Join(dirs.SysfsDir, virtioDiskDevPath)
+	for dev, isPartition := range devsToPartition {
+		err := os.MkdirAll(filepath.Join(diskDir, dev), 0755)
+		c.Assert(err, IsNil)
+		if isPartition {
+			err = ioutil.WriteFile(filepath.Join(diskDir, dev, "partition"), []byte("1"), 0644)
+			c.Assert(err, IsNil)
+		}
+	}
+}
+
+type diskSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&diskSuite{})
+
+func (s *diskSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+}
+
+func (s *diskSuite) TestDiskFromMountPointUnhappyMissingMountpoint(c *C) {
+	// no mount points
+	restore := osutil.MockMountInfo(``)
+	defer restore()
+
+	_, err := disks.DiskFromMountPoint("/run/mnt/blah", nil)
+	c.Assert(err, ErrorMatches, "cannot find mountpoint \"/run/mnt/blah\"")
+}
+
+func (s *diskSuite) TestDiskFromMountPointUnhappyMissingUdevProps(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/vda4 rw
+`)
+	defer restore()
+
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		c.Assert(dev, Equals, "/dev/vda4")
+		return map[string]string{
+			"prop": "hello",
+		}, nil
+	})
+	defer restore()
+
+	_, err := disks.DiskFromMountPoint("/run/mnt/point", nil)
+	c.Assert(err, ErrorMatches, "cannot find disk for partition /dev/vda4, incomplete udev output")
+}
+
+func (s *diskSuite) TestDiskFromMountPointUnhappyBadUdevPropsMountpointPartition(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/vda4 rw
+`)
+	defer restore()
+
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		c.Assert(dev, Equals, "/dev/vda4")
+		return map[string]string{
+			"ID_PART_ENTRY_DISK": "not-a-number",
+		}, nil
+	})
+	defer restore()
+
+	_, err := disks.DiskFromMountPoint("/run/mnt/point", nil)
+	c.Assert(err, ErrorMatches, `cannot find disk for partition /dev/vda4, bad udev output: invalid device number format: \(expected <int>:<int>\)`)
+}
+
+func (s *diskSuite) TestDiskFromMountPointUnhappyIsDecryptedDeviceNotDiskDevice(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/vda4 rw
+`)
+	defer restore()
+
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		switch dev {
+		case "/dev/vda4":
+			return map[string]string{
+				"ID_PART_ENTRY_DISK": "42:0",
+				// DEVTYPE == partition is unexpected for this, so this makes
+				// DiskFromMountPoint fail, as decrypted devices should not be
+				// direct partitions, they should be mapper device volumes/disks
+				"DEVTYPE": "partition",
+			}, nil
+		default:
+			c.Errorf("unexpected udev device properties requested: %s", dev)
+			return nil, fmt.Errorf("unexpected udev device: %s", dev)
+		}
+	})
+	defer restore()
+
+	opts := &disks.Options{IsDecryptedDevice: true}
+	_, err := disks.DiskFromMountPoint("/run/mnt/point", opts)
+	c.Assert(err, ErrorMatches, `mountpoint source /dev/vda4 is not a decrypted device: devtype is not disk \(is partition\)`)
+}
+
+func (s *diskSuite) TestDiskFromMountPointUnhappyIsDecryptedDeviceNoSysfs(c *C) {
+	restore := osutil.MockMountInfo(`130 30 252:0 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/mapper/something rw
+`)
+	defer restore()
+
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		switch dev {
+		case "/dev/mapper/something":
+			return map[string]string{
+				"DEVTYPE": "disk",
+			}, nil
+		default:
+			c.Errorf("unexpected udev device properties requested: %s", dev)
+			return nil, fmt.Errorf("unexpected udev device: %s", dev)
+		}
+	})
+	defer restore()
+
+	// no sysfs files mocking
+
+	opts := &disks.Options{IsDecryptedDevice: true}
+	_, err := disks.DiskFromMountPoint("/run/mnt/point", opts)
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`mountpoint source /dev/mapper/something is not a decrypted device: could not read device mapper metadata: open %s/dev/block/252:0/dm/uuid: no such file or directory`, dirs.SysfsDir))
+}
+
+func (s *diskSuite) TestDiskFromMountPointHappySinglePartitionIgnoresNonPartitionsInSysfs(c *C) {
+	restore := osutil.MockMountInfo(`130 30 47:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/vda4 rw
+`)
+	defer restore()
+
+	// mock just the single partition and the disk itself in udev
+	n := 0
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		n++
+		switch n {
+		case 1, 4:
+			c.Assert(dev, Equals, "/dev/vda4")
+			// this is the partition that was mounted that we initially inspect
+			// to get the disk
+			// this is also called again when we call MountPointIsFromDisk to
+			// verify that the /run/mnt/point is from the same disk
+			return map[string]string{
+				"ID_PART_ENTRY_DISK": "42:0",
+			}, nil
+		case 2:
+			c.Assert(dev, Equals, "/dev/block/42:0")
+			// this is the disk itself, from ID_PART_ENTRY_DISK above
+			// note that the major/minor for the disk is not adjacent/related to
+			// the partition itself
+			return map[string]string{
+				"DEVNAME": "/dev/vda",
+				"DEVPATH": virtioDiskDevPath,
+			}, nil
+		case 3:
+			c.Assert(dev, Equals, "vda4")
+			// this is the sysfs entry for the partition of the disk previously
+			// found under the DEVPATH for /dev/block/42:0
+			// this is essentially the same as /dev/block/42:1 in actuality, but
+			// we search for it differently
+			return map[string]string{
+				"ID_FS_LABEL_ENC":    "some-label",
+				"ID_PART_ENTRY_UUID": "some-uuid",
+			}, nil
+		default:
+			c.Errorf("unexpected udev device properties requested: %s", dev)
+			return nil, fmt.Errorf("unexpected udev device: %s", dev)
+		}
+	})
+	defer restore()
+
+	// create just the single valid partition in sysfs, and an invalid
+	// non-partition device that we should ignore
+	createVirtioDevicesInSysfs(c, map[string]bool{
+		"vda4": true,
+		"vda5": false,
+	})
+
+	disk, err := disks.DiskFromMountPoint("/run/mnt/point", nil)
+	c.Assert(err, IsNil)
+	c.Assert(disk.Dev(), Equals, "42:0")
+	c.Assert(disk.HasPartitions(), Equals, true)
+	// searching for the single label we have for this partition will succeed
+	label, err := disk.FindMatchingPartitionUUID("some-label")
+	c.Assert(err, IsNil)
+	c.Assert(label, Equals, "some-uuid")
+
+	matches, err := disk.MountPointIsFromDisk("/run/mnt/point", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+
+	// trying to search for any other labels though will fail
+	_, err = disk.FindMatchingPartitionUUID("ubuntu-boot")
+	c.Assert(err, ErrorMatches, "filesystem label \"ubuntu-boot\" not found")
+	c.Assert(err, FitsTypeOf, disks.FilesystemLabelNotFoundError{})
+	labelNotFoundErr := err.(disks.FilesystemLabelNotFoundError)
+	c.Assert(labelNotFoundErr.Label, Equals, "ubuntu-boot")
+}
+
+func (s *diskSuite) TestDiskFromMountPointHappyRealUdevadm(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/vda1 rw
+`)
+	defer restore()
+
+	udevadmCmd := testutil.MockCommand(c, "udevadm", `
+if [ "$*" = "info --query property --name /dev/vda1" ]; then
+	echo "ID_PART_ENTRY_DISK=42:0"
+else
+	echo "unexpected arguments"
+	exit 1
+fi
+`)
+
+	d, err := disks.DiskFromMountPoint("/run/mnt/point", nil)
+	c.Assert(err, IsNil)
+	c.Assert(d.Dev(), Equals, "42:0")
+	c.Assert(d.HasPartitions(), Equals, true)
+
+	c.Assert(udevadmCmd.Calls(), DeepEquals, [][]string{
+		{"udevadm", "info", "--query", "property", "--name", "/dev/vda1"},
+	})
+}
+
+func (s *diskSuite) TestDiskFromMountPointVolumeHappy(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/mapper/something rw
+`)
+	defer restore()
+
+	udevadmCmd := testutil.MockCommand(c, "udevadm", `
+if [ "$*" = "info --query property --name /dev/mapper/something" ]; then
+	# not a partition, so no ID_PART_ENTRY_DISK, but we will have DEVTYPE=disk
+	echo "DEVTYPE=disk"
+else
+	echo "unexpected arguments"
+	exit 1
+fi
+`)
+
+	d, err := disks.DiskFromMountPoint("/run/mnt/point", nil)
+	c.Assert(err, IsNil)
+	c.Assert(d.Dev(), Equals, "42:1")
+	c.Assert(d.HasPartitions(), Equals, false)
+
+	c.Assert(udevadmCmd.Calls(), DeepEquals, [][]string{
+		{"udevadm", "info", "--query", "property", "--name", "/dev/mapper/something"},
+	})
+}
+
+func (s *diskSuite) TestDiskFromMountPointIsDecryptedDeviceVolumeHappy(c *C) {
+	restore := osutil.MockMountInfo(`130 30 242:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/mapper/something rw
+`)
+	defer restore()
+
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		switch dev {
+		case "/dev/mapper/something":
+			return map[string]string{
+				"DEVTYPE": "disk",
+			}, nil
+		case "/dev/disk/by-uuid/5a522809-c87e-4dfa-81a8-8dc5667d1304":
+			return map[string]string{
+				"DEVTYPE": "disk",
+			}, nil
+		default:
+			c.Errorf("unexpected udev device properties requested: %s", dev)
+			return nil, fmt.Errorf("unexpected udev device: %s", dev)
+		}
+	})
+	defer restore()
+
+	// mock the sysfs dm uuid and name files
+	dmDir := filepath.Join(filepath.Join(dirs.SysfsDir, "dev", "block"), "242:1", "dm")
+	err := os.MkdirAll(dmDir, 0755)
+	c.Assert(err, IsNil)
+
+	b := []byte("something")
+	err = ioutil.WriteFile(filepath.Join(dmDir, "name"), b, 0644)
+	c.Assert(err, IsNil)
+
+	b = []byte("CRYPT-LUKS2-5a522809c87e4dfa81a88dc5667d1304-something")
+	err = ioutil.WriteFile(filepath.Join(dmDir, "uuid"), b, 0644)
+	c.Assert(err, IsNil)
+
+	opts := &disks.Options{IsDecryptedDevice: true}
+	d, err := disks.DiskFromMountPoint("/run/mnt/point", opts)
+	c.Assert(err, IsNil)
+	c.Assert(d.Dev(), Equals, "242:1")
+	c.Assert(d.HasPartitions(), Equals, false)
+}
+
+func (s *diskSuite) TestDiskFromMountPointNotDiskUnsupported(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:1 / /run/mnt/point rw,relatime shared:54 - ext4 /dev/not-a-disk rw
+`)
+	defer restore()
+
+	udevadmCmd := testutil.MockCommand(c, "udevadm", `
+if [ "$*" = "info --query property --name /dev/not-a-disk" ]; then
+	echo "DEVTYPE=not-a-disk"
+else
+	echo "unexpected arguments"
+	exit 1
+fi
+`)
+
+	_, err := disks.DiskFromMountPoint("/run/mnt/point", nil)
+	c.Assert(err, ErrorMatches, "unsupported DEVTYPE \"not-a-disk\" for mount point source /dev/not-a-disk")
+
+	c.Assert(udevadmCmd.Calls(), DeepEquals, [][]string{
+		{"udevadm", "info", "--query", "property", "--name", "/dev/not-a-disk"},
+	})
+}
+
+func (s *diskSuite) TestDiskFromMountPointPartitionsHappy(c *C) {
+	restore := osutil.MockMountInfo(`130 30 42:4 / /run/mnt/data rw,relatime shared:54 - ext4 /dev/vda4 rw
+ 130 30 42:4 / /run/mnt/ubuntu-boot rw,relatime shared:54 - ext4 /dev/vda3 rw
+`)
+	defer restore()
+
+	n := 0
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		n++
+		switch n {
+		case 1:
+			// first request is to the mount point source
+			c.Assert(dev, Equals, "/dev/vda4")
+			return diskUdevPropMap, nil
+		case 2:
+			// next request is for the disk itself
+			c.Assert(dev, Equals, "/dev/block/42:0")
+			return diskUdevPropMap, nil
+		case 3:
+			c.Assert(dev, Equals, "vda1")
+			// this is the sysfs entry for the first partition of the disk
+			// previously found under the DEVPATH for /dev/block/42:0
+			return biotBootUdevPropMap, nil
+		case 4:
+			c.Assert(dev, Equals, "vda2")
+			// the second partition of the disk from sysfs has a fs label
+			return ubuntuSeedUdevPropMap, nil
+		case 5:
+			c.Assert(dev, Equals, "vda3")
+			// same for the third partition
+			return ubuntuBootUdevPropMap, nil
+		case 6:
+			c.Assert(dev, Equals, "vda4")
+			// same for the fourth partition
+			return ubuntuDataUdevPropMap, nil
+		case 7:
+			// next request is for the MountPointIsFromDisk for ubuntu-boot in
+			// this test
+			c.Assert(dev, Equals, "/dev/vda3")
+			return diskUdevPropMap, nil
+		case 8:
+			// next request is for the another DiskFromMountPoint build set of methods we
+			// call in this test
+			c.Assert(dev, Equals, "/dev/vda3")
+			return diskUdevPropMap, nil
+		case 9:
+			// same as for case 2, the disk itself using the major/minor
+			c.Assert(dev, Equals, "/dev/block/42:0")
+			return diskUdevPropMap, nil
+		case 10:
+			c.Assert(dev, Equals, "vda1")
+			// this is the sysfs entry for the first partition of the disk
+			// previously found under the DEVPATH for /dev/block/42:0
+			return biotBootUdevPropMap, nil
+		case 11:
+			c.Assert(dev, Equals, "vda2")
+			// the second partition of the disk from sysfs has a fs label
+			return ubuntuSeedUdevPropMap, nil
+		case 12:
+			c.Assert(dev, Equals, "vda3")
+			// same for the third partition
+			return ubuntuBootUdevPropMap, nil
+		case 13:
+			c.Assert(dev, Equals, "vda4")
+			// same for the fourth partition
+			return ubuntuDataUdevPropMap, nil
+		case 14:
+			// next request is for the MountPointIsFromDisk for ubuntu-data
+			c.Assert(dev, Equals, "/dev/vda4")
+			return diskUdevPropMap, nil
+		default:
+			c.Errorf("unexpected udev device properties requested (request %d): %s", n, dev)
+			return nil, fmt.Errorf("unexpected udev device (request %d): %s", n, dev)
+		}
+	})
+	defer restore()
+
+	// create all 4 partitions as device nodes in sysfs
+	createVirtioDevicesInSysfs(c, map[string]bool{
+		"vda1": true,
+		"vda2": true,
+		"vda3": true,
+		"vda4": true,
+	})
+
+	ubuntuDataDisk, err := disks.DiskFromMountPoint("/run/mnt/data", nil)
+	c.Assert(err, IsNil)
+	c.Assert(ubuntuDataDisk, Not(IsNil))
+	c.Assert(ubuntuDataDisk.Dev(), Equals, "42:0")
+
+	// we have the ubuntu-seed, ubuntu-boot, and ubuntu-data partition labels
+	for _, label := range []string{"ubuntu-seed", "ubuntu-boot", "ubuntu-data"} {
+		id, err := ubuntuDataDisk.FindMatchingPartitionUUID(label)
+		c.Assert(err, IsNil)
+		c.Assert(id, Equals, label+"-partuuid")
+	}
+
+	// and the mountpoint for ubuntu-boot at /run/mnt/ubuntu-boot matches the
+	// same disk
+	matches, err := ubuntuDataDisk.MountPointIsFromDisk("/run/mnt/ubuntu-boot", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+
+	// and we can find the partition for ubuntu-boot first and then match
+	// that with ubuntu-data too
+	ubuntuBootDisk, err := disks.DiskFromMountPoint("/run/mnt/ubuntu-boot", nil)
+	c.Assert(err, IsNil)
+	c.Assert(ubuntuBootDisk, Not(IsNil))
+	c.Assert(ubuntuBootDisk.Dev(), Equals, "42:0")
+
+	// we have the ubuntu-seed, ubuntu-boot, and ubuntu-data partition labels
+	for _, label := range []string{"ubuntu-seed", "ubuntu-boot", "ubuntu-data"} {
+		id, err := ubuntuBootDisk.FindMatchingPartitionUUID(label)
+		c.Assert(err, IsNil)
+		c.Assert(id, Equals, label+"-partuuid")
+	}
+
+	// and the mountpoint for ubuntu-boot at /run/mnt/ubuntu-boot matches the
+	// same disk
+	matches, err = ubuntuBootDisk.MountPointIsFromDisk("/run/mnt/data", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+
+	// finally we can't find the bios-boot partition because it has no label
+	_, err = ubuntuBootDisk.FindMatchingPartitionUUID("bios-boot")
+	c.Assert(err, ErrorMatches, "filesystem label \"bios-boot\" not found")
+	var notFoundErr disks.FilesystemLabelNotFoundError
+	c.Assert(xerrors.As(err, &notFoundErr), Equals, true)
+
+	_, err = ubuntuDataDisk.FindMatchingPartitionUUID("bios-boot")
+	c.Assert(err, ErrorMatches, "filesystem label \"bios-boot\" not found")
+	c.Assert(xerrors.As(err, &notFoundErr), Equals, true)
+}
+
+func (s *diskSuite) TestDiskFromMountPointDecryptedDevicePartitionsHappy(c *C) {
+	restore := osutil.MockMountInfo(`130 30 252:0 / /run/mnt/data rw,relatime shared:54 - ext4 /dev/mapper/ubuntu-data-3776bab4-8bcc-46b7-9da2-6a84ce7f93b4 rw
+ 130 30 42:4 / /run/mnt/ubuntu-boot rw,relatime shared:54 - ext4 /dev/vda3 rw
+`)
+	defer restore()
+
+	n := 0
+	restore = disks.MockUdevPropertiesForDevice(func(dev string) (map[string]string, error) {
+		n++
+		switch n {
+		case 1:
+			// first request is to find the disk based on the mapper mount point
+			c.Assert(dev, Equals, "/dev/mapper/ubuntu-data-3776bab4-8bcc-46b7-9da2-6a84ce7f93b4")
+			// the mapper device is a disk/volume
+			return map[string]string{
+				"DEVTYPE": "disk",
+			}, nil
+		case 2:
+			// next we find the physical disk by the dm uuid
+			c.Assert(dev, Equals, "/dev/disk/by-uuid/5a522809-c87e-4dfa-81a8-8dc5667d1304")
+			return diskUdevPropMap, nil
+		case 3:
+			// then re-find the disk based on it's dev major / minor
+			c.Assert(dev, Equals, "/dev/block/42:0")
+			return diskUdevPropMap, nil
+		case 4:
+			// next find each partition in turn
+			c.Assert(dev, Equals, "vda1")
+			return biotBootUdevPropMap, nil
+		case 5:
+			c.Assert(dev, Equals, "vda2")
+			return ubuntuSeedUdevPropMap, nil
+		case 6:
+			c.Assert(dev, Equals, "vda3")
+			return ubuntuBootUdevPropMap, nil
+		case 7:
+			c.Assert(dev, Equals, "vda4")
+			return map[string]string{
+				"ID_FS_LABEL_ENC":    "ubuntu-data-enc",
+				"ID_PART_ENTRY_UUID": "ubuntu-data-enc-partuuid",
+			}, nil
+		case 8:
+			// next we will find the disk for a different mount point via
+			// MountPointIsFromDisk for ubuntu-boot
+			c.Assert(dev, Equals, "/dev/vda3")
+			return diskUdevPropMap, nil
+		case 9:
+			// next we will build up a disk from the ubuntu-boot mount point
+			c.Assert(dev, Equals, "/dev/vda3")
+			return diskUdevPropMap, nil
+		case 10:
+			// same as step 3
+			c.Assert(dev, Equals, "/dev/block/42:0")
+			return diskUdevPropMap, nil
+		case 11:
+			// next find each partition in turn again, same as steps 4-7
+			c.Assert(dev, Equals, "vda1")
+			return biotBootUdevPropMap, nil
+		case 12:
+			c.Assert(dev, Equals, "vda2")
+			return ubuntuSeedUdevPropMap, nil
+		case 13:
+			c.Assert(dev, Equals, "vda3")
+			return ubuntuBootUdevPropMap, nil
+		case 14:
+			c.Assert(dev, Equals, "vda4")
+			return map[string]string{
+				"ID_FS_LABEL_ENC":    "ubuntu-data-enc",
+				"ID_PART_ENTRY_UUID": "ubuntu-data-enc-partuuid",
+			}, nil
+		case 15:
+			// then we will find the disk for ubuntu-data mapper volume to
+			// verify it comes from the same disk as the second disk we just
+			// finished finding
+			c.Assert(dev, Equals, "/dev/mapper/ubuntu-data-3776bab4-8bcc-46b7-9da2-6a84ce7f93b4")
+			// the mapper device is a disk/volume
+			return map[string]string{
+				"DEVTYPE": "disk",
+			}, nil
+		case 16:
+			// then we find the physical disk by the dm uuid
+			c.Assert(dev, Equals, "/dev/disk/by-uuid/5a522809-c87e-4dfa-81a8-8dc5667d1304")
+			return diskUdevPropMap, nil
+		default:
+			c.Errorf("unexpected udev device properties requested (request %d): %s", n, dev)
+			return nil, fmt.Errorf("unexpected udev device (request %d): %s", n, dev)
+		}
+	})
+	defer restore()
+
+	// mock the sysfs dm uuid and name files
+	dmDir := filepath.Join(filepath.Join(dirs.SysfsDir, "dev", "block"), "252:0", "dm")
+	err := os.MkdirAll(dmDir, 0755)
+	c.Assert(err, IsNil)
+
+	b := []byte("ubuntu-data-3776bab4-8bcc-46b7-9da2-6a84ce7f93b4")
+	err = ioutil.WriteFile(filepath.Join(dmDir, "name"), b, 0644)
+	c.Assert(err, IsNil)
+
+	b = []byte("CRYPT-LUKS2-5a522809c87e4dfa81a88dc5667d1304-ubuntu-data-3776bab4-8bcc-46b7-9da2-6a84ce7f93b4")
+	err = ioutil.WriteFile(filepath.Join(dmDir, "uuid"), b, 0644)
+	c.Assert(err, IsNil)
+
+	// mock the dev nodes in sysfs for the partitions
+	createVirtioDevicesInSysfs(c, map[string]bool{
+		"vda1": true,
+		"vda2": true,
+		"vda3": true,
+		"vda4": true,
+	})
+
+	opts := &disks.Options{IsDecryptedDevice: true}
+	ubuntuDataDisk, err := disks.DiskFromMountPoint("/run/mnt/data", opts)
+	c.Assert(err, IsNil)
+	c.Assert(ubuntuDataDisk, Not(IsNil))
+	c.Assert(ubuntuDataDisk.Dev(), Equals, "42:0")
+
+	// we have the ubuntu-seed, ubuntu-boot, and ubuntu-data partition labels
+	for _, label := range []string{"ubuntu-seed", "ubuntu-boot", "ubuntu-data-enc"} {
+		id, err := ubuntuDataDisk.FindMatchingPartitionUUID(label)
+		c.Assert(err, IsNil)
+		c.Assert(id, Equals, label+"-partuuid")
+	}
+
+	// and the mountpoint for ubuntu-boot at /run/mnt/ubuntu-boot matches the
+	// same disk
+	matches, err := ubuntuDataDisk.MountPointIsFromDisk("/run/mnt/ubuntu-boot", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+
+	// and we can find the partition for ubuntu-boot first and then match
+	// that with ubuntu-data too
+	ubuntuBootDisk, err := disks.DiskFromMountPoint("/run/mnt/ubuntu-boot", nil)
+	c.Assert(err, IsNil)
+	c.Assert(ubuntuBootDisk, Not(IsNil))
+	c.Assert(ubuntuBootDisk.Dev(), Equals, "42:0")
+
+	// we have the ubuntu-seed, ubuntu-boot, and ubuntu-data partition labels
+	for _, label := range []string{"ubuntu-seed", "ubuntu-boot", "ubuntu-data-enc"} {
+		id, err := ubuntuBootDisk.FindMatchingPartitionUUID(label)
+		c.Assert(err, IsNil)
+		c.Assert(id, Equals, label+"-partuuid")
+	}
+
+	// and the mountpoint for ubuntu-boot at /run/mnt/ubuntu-boot matches the
+	// same disk
+	matches, err = ubuntuBootDisk.MountPointIsFromDisk("/run/mnt/data", opts)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/export_test.go snapd-2.48.3+20.04/osutil/disks/export_test.go
--- snapd-2.45.1+20.04.2/osutil/disks/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,43 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks
+
+import "fmt"
+
+func MockUdevPropertiesForDevice(new func(string) (map[string]string, error)) (restore func()) {
+	old := udevadmProperties
+	// for better testing we mock the udevadm command output so that we still
+	// test the parsing
+	udevadmProperties = func(dev string) ([]byte, error) {
+		props, err := new(dev)
+		if err != nil {
+			return []byte(err.Error()), err
+		}
+		// put it into udevadm format output, i.e. "KEY=VALUE\n"
+		output := ""
+		for k, v := range props {
+			output += fmt.Sprintf("%s=%s\n", k, v)
+		}
+		return []byte(output), nil
+	}
+	return func() {
+		udevadmProperties = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/labels.go snapd-2.48.3+20.04/osutil/disks/labels.go
--- snapd-2.45.1+20.04.2/osutil/disks/labels.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/labels.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,48 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"unicode/utf8"
+)
+
+// BlkIDEncodeLabel encodes a name for use as a partition or filesystem
+// label symlink by udev. The result matches the output of blkid_encode_string()
+// from libblkid.
+func BlkIDEncodeLabel(in string) string {
+	const allowed = `#+-.:=@_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789`
+
+	buf := &bytes.Buffer{}
+
+	for _, r := range in {
+		switch {
+		case utf8.RuneLen(r) > 1:
+			buf.WriteRune(r)
+		case !strings.ContainsRune(allowed, r):
+			fmt.Fprintf(buf, `\x%x`, r)
+		default:
+			buf.WriteRune(r)
+		}
+	}
+	return buf.String()
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/labels_test.go snapd-2.48.3+20.04/osutil/disks/labels_test.go
--- snapd-2.45.1+20.04.2/osutil/disks/labels_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/labels_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,89 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks_test
+
+import (
+	"testing"
+
+	"github.com/snapcore/snapd/osutil/disks"
+	"gopkg.in/check.v1"
+	. "gopkg.in/check.v1"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type diskLabelSuite struct{}
+
+var _ = Suite(&diskLabelSuite{})
+
+func (ts *diskLabelSuite) TestEncodeHexBlkIDFormat(c *C) {
+	// Test output obtained with the following program:
+	//
+	// #include <string.h>
+	// #include <stdio.h>
+	// #include <blkid/blkid.h>
+	// int main(int argc, char *argv[]) {
+	//   char out[2048] = {0};
+	//   if (blkid_encode_string(argv[1], out, sizeof(out)) != 0) {
+	//     fprintf(stderr, "failed to encode string\n");
+	//     return 1;
+	//   }
+	//   fprintf(stdout, out);
+	//   return 0;
+	// }
+
+	tt := []struct {
+		in  string
+		out string
+	}{
+		// no changes
+		{"foo", "foo"},
+		{"plain", "plain"},
+		{"plain-ol-data", "plain-ol-data"},
+		{"foo:#.@bar", `foo:#.@bar`},
+		{"foo..bar", `foo..bar`},
+		{"3005", "3005"},
+		{"#1-the_BEST@colons:+easter.eggs=something", "#1-the_BEST@colons:+easter.eggs=something"},
+		{"", ""},
+		{"befs_test", "befs_test"},
+		{"P01_S16A", "P01_S16A"},
+
+		// these are single length utf-8 runes, so they are not encoded
+		{"héllo", "héllo"},
+		{"he🐧lo", "he🐧lo"},
+		{"Новый_том", "Новый_том"},
+
+		// these are "unsafe" chars, so they get encoded
+		{"ubuntu data", `ubuntu\x20data`},
+		{"ubuntu\ttab", `ubuntu\x9tab`},
+		{"ubuntu\nnewline", `ubuntu\xanewline`},
+		{"foo bar", `foo\x20bar`},
+		{"foo/bar", `foo\x2fbar`},
+		{"foo/../bar", `foo\x2f..\x2fbar`},
+		{"foo\\bar", `foo\x5cbar`},
+		{"pinkié pie", `pinkié\x20pie`},
+		{"(EFI Boot)", `\x28EFI\x20Boot\x29`},
+		{"[System Boot]", `\x5bSystem\x20Boot\x5d`},
+	}
+	for _, t := range tt {
+		c.Logf("tc: %v %q", t.in, t.out)
+		c.Assert(disks.BlkIDEncodeLabel(t.in), check.Equals, t.out)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/mockdisk.go snapd-2.48.3+20.04/osutil/disks/mockdisk.go
--- snapd-2.45.1+20.04.2/osutil/disks/mockdisk.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/mockdisk.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,145 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+// MockDiskMapping is an implementation of Disk for mocking purposes, it is
+// exported so that other packages can easily mock a specific disk layout
+// without needing to mock the mount setup, sysfs, or udev commands just to test
+// high level logic.
+// DevNum must be a unique string per unique mocked disk, if only one disk is
+// being mocked it can be left empty.
+type MockDiskMapping struct {
+	FilesystemLabelToPartUUID map[string]string
+	DiskHasPartitions         bool
+	DevNum                    string
+}
+
+// FindMatchingPartitionUUID returns a matching PartitionUUID for the specified
+// label if it exists. Part of the Disk interface.
+func (d *MockDiskMapping) FindMatchingPartitionUUID(label string) (string, error) {
+	osutil.MustBeTestBinary("mock disks only to be used in tests")
+	if partuuid, ok := d.FilesystemLabelToPartUUID[label]; ok {
+		return partuuid, nil
+	}
+	return "", FilesystemLabelNotFoundError{Label: label}
+}
+
+// HasPartitions returns if the mock disk has partitions or not. Part of the
+// Disk interface.
+func (d *MockDiskMapping) HasPartitions() bool {
+	return d.DiskHasPartitions
+}
+
+// MountPointIsFromDisk returns if the disk that the specified mount point comes
+// from is the same disk as the object. Part of the Disk interface.
+func (d *MockDiskMapping) MountPointIsFromDisk(mountpoint string, opts *Options) (bool, error) {
+	osutil.MustBeTestBinary("mock disks only to be used in tests")
+
+	// this is relying on the fact that DiskFromMountPoint should have been
+	// mocked for us to be using this mockDisk method anyways
+	otherDisk, err := DiskFromMountPoint(mountpoint, opts)
+	if err != nil {
+		return false, err
+	}
+
+	if otherDisk.Dev() == d.Dev() && otherDisk.HasPartitions() == d.HasPartitions() {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+// Dev returns a unique representation of the mock disk that is suitable for
+// comparing two mock disks to see if they are the same. Part of the Disk
+// interface.
+func (d *MockDiskMapping) Dev() string {
+	return d.DevNum
+}
+
+// Mountpoint is a combination of a mountpoint location and whether that
+// mountpoint is a decrypted device. It is only used in identifying mount points
+// with MountPointIsFromDisk and DiskFromMountPoint with
+// MockMountPointDisksToPartitionMapping.
+type Mountpoint struct {
+	Mountpoint        string
+	IsDecryptedDevice bool
+}
+
+// MockMountPointDisksToPartitionMapping will mock DiskFromMountPoint such that
+// the specified mapping is returned/used. Specifically, keys in the provided
+// map are mountpoints, and the values for those keys are the disks that will
+// be returned from DiskFromMountPoint or used internally in
+// MountPointIsFromDisk.
+func MockMountPointDisksToPartitionMapping(mockedMountPoints map[Mountpoint]*MockDiskMapping) (restore func()) {
+	osutil.MustBeTestBinary("mock disks only to be used in tests")
+
+	// verify that all unique MockDiskMapping's have unique DevNum's and that
+	// the srcMntPt's are all consistent
+	// we can't have the same mountpoint exist both as a decrypted device and
+	// not as a decrypted device, this is an impossible mapping, but we need to
+	// expose functionality to mock the same mountpoint as a decrypted device
+	// and as an unencrypyted device for different tests, but never at the same
+	// time with the same mapping
+	alreadySeen := make(map[string]*MockDiskMapping, len(mockedMountPoints))
+	seenSrcMntPts := make(map[string]bool, len(mockedMountPoints))
+	for srcMntPt, mockDisk := range mockedMountPoints {
+		if decryptedVal, ok := seenSrcMntPts[srcMntPt.Mountpoint]; ok {
+			if decryptedVal != srcMntPt.IsDecryptedDevice {
+				msg := fmt.Sprintf("mocked source mountpoint %s is duplicated with different options - previous option for IsDecryptedDevice was %t, current option is %t", srcMntPt.Mountpoint, decryptedVal, srcMntPt.IsDecryptedDevice)
+				panic(msg)
+			}
+		}
+		seenSrcMntPts[srcMntPt.Mountpoint] = srcMntPt.IsDecryptedDevice
+		if old, ok := alreadySeen[mockDisk.DevNum]; ok {
+			if mockDisk != old {
+				// we already saw a disk with this DevNum as a different pointer
+				// so just assume it's different
+				msg := fmt.Sprintf("mocked disks %+v and %+v have the same DevNum (%s) but are not the same object", old, mockDisk, mockDisk.DevNum)
+				panic(msg)
+			}
+			// otherwise same ptr, no point in comparing them
+		} else {
+			// didn't see it before, save it now
+			alreadySeen[mockDisk.DevNum] = mockDisk
+		}
+	}
+
+	old := diskFromMountPoint
+
+	diskFromMountPoint = func(mountpoint string, opts *Options) (Disk, error) {
+		if opts == nil {
+			opts = &Options{}
+		}
+		m := Mountpoint{mountpoint, opts.IsDecryptedDevice}
+		if mockedDisk, ok := mockedMountPoints[m]; ok {
+			return mockedDisk, nil
+		}
+		return nil, fmt.Errorf("mountpoint %s not mocked", mountpoint)
+	}
+	return func() {
+		diskFromMountPoint = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disks/mockdisk_test.go snapd-2.48.3+20.04/osutil/disks/mockdisk_test.go
--- snapd-2.45.1+20.04.2/osutil/disks/mockdisk_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disks/mockdisk_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,233 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package disks_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"golang.org/x/xerrors"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil/disks"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type mockDiskSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&mockDiskSuite{})
+
+func (s *mockDiskSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+}
+
+func (s *mockDiskSuite) TestMockMountPointDisksToPartitionMappingVerifiesUniqueness(c *C) {
+	// two different disks with different DevNum's
+	d1 := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"label1": "part1",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "d1",
+	}
+
+	d2 := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"label1": "part1",
+		},
+		DiskHasPartitions: false,
+		DevNum:            "d2",
+	}
+
+	// the pointers are different, and they are not the same
+	c.Assert(d1, Not(Equals), d2)
+	c.Assert(d1, Not(DeepEquals), d2)
+
+	m := map[disks.Mountpoint]*disks.MockDiskMapping{
+		{Mountpoint: "mount1"}: d1,
+		{Mountpoint: "mount2"}: d1,
+		{Mountpoint: "mount3"}: d2,
+	}
+
+	// mocking works
+	r := disks.MockMountPointDisksToPartitionMapping(m)
+	defer r()
+
+	// changing so they have the same DevNum doesn't work though
+	d2.DevNum = "d1"
+	c.Assert(
+		func() { disks.MockMountPointDisksToPartitionMapping(m) },
+		PanicMatches,
+		`mocked disks .* and .* have the same DevNum \(d1\) but are not the same object`,
+	)
+
+	// mocking with just one disk at multiple mount points works too
+	m2 := map[disks.Mountpoint]*disks.MockDiskMapping{
+		{Mountpoint: "mount1"}: d1,
+		{Mountpoint: "mount2"}: d1,
+	}
+	r = disks.MockMountPointDisksToPartitionMapping(m2)
+	defer r()
+}
+
+func (s *mockDiskSuite) TestMockMountPointDisksToPartitionMappingVerifiesConsistency(c *C) {
+	d1 := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"label1": "part1",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "d1",
+	}
+
+	// a mountpoint mapping where the same mountpoint has different options for
+	// the source mountpoint
+	m := map[disks.Mountpoint]*disks.MockDiskMapping{
+		{Mountpoint: "mount1", IsDecryptedDevice: false}: d1,
+		{Mountpoint: "mount1", IsDecryptedDevice: true}:  d1,
+	}
+
+	// mocking shouldn't work
+	c.Assert(
+		func() { disks.MockMountPointDisksToPartitionMapping(m) },
+		PanicMatches,
+		// use .* for true/false since iterating over map order is not defined
+		`mocked source mountpoint mount1 is duplicated with different options - previous option for IsDecryptedDevice was .*, current option is .*`,
+	)
+}
+
+func (s *mockDiskSuite) TestMockMountPointDisksToPartitionMapping(c *C) {
+	d1 := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"label1": "part1",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "d1",
+	}
+
+	d2 := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"label2": "part2",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "d2",
+	}
+
+	r := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: "mount1"}: d1,
+			{Mountpoint: "mount2"}: d1,
+			{Mountpoint: "mount3"}: d2,
+		},
+	)
+	defer r()
+
+	// we can find the mock disk
+	foundDisk, err := disks.DiskFromMountPoint("mount1", nil)
+	c.Assert(err, IsNil)
+
+	// and it has labels
+	label, err := foundDisk.FindMatchingPartitionUUID("label1")
+	c.Assert(err, IsNil)
+	c.Assert(label, Equals, "part1")
+
+	// the same mount point is always from the same disk
+	matches, err := foundDisk.MountPointIsFromDisk("mount1", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+
+	// mount2 goes to the same disk, as per the mapping above
+	matches, err = foundDisk.MountPointIsFromDisk("mount2", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+
+	// mount3 does not however
+	matches, err = foundDisk.MountPointIsFromDisk("mount3", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, false)
+
+	// a disk from mount3 is also able to be found
+	foundDisk2, err := disks.DiskFromMountPoint("mount3", nil)
+	c.Assert(err, IsNil)
+
+	// we can find label2 from mount3's disk
+	label, err = foundDisk2.FindMatchingPartitionUUID("label2")
+	c.Assert(err, IsNil)
+	c.Assert(label, Equals, "part2")
+
+	// we can't find label1 from mount1's or mount2's disk
+	_, err = foundDisk2.FindMatchingPartitionUUID("label1")
+	c.Assert(err, ErrorMatches, "filesystem label \"label1\" not found")
+	var errNotFound disks.FilesystemLabelNotFoundError
+	c.Assert(xerrors.As(err, &errNotFound), Equals, true)
+
+	// mount1 and mount2 do not match mount3 disk
+	matches, err = foundDisk2.MountPointIsFromDisk("mount1", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, false)
+	matches, err = foundDisk2.MountPointIsFromDisk("mount2", nil)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, false)
+}
+
+func (s *mockDiskSuite) TestMockMountPointDisksToPartitionMappingDecryptedDevices(c *C) {
+	d1 := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-seed":     "ubuntu-seed-part",
+			"ubuntu-boot":     "ubuntu-boot-part",
+			"ubuntu-data-enc": "ubuntu-data-enc-part",
+		},
+		DiskHasPartitions: true,
+		DevNum:            "d1",
+	}
+
+	r := disks.MockMountPointDisksToPartitionMapping(
+		map[disks.Mountpoint]*disks.MockDiskMapping{
+			{Mountpoint: "/run/mnt/ubuntu-boot"}: d1,
+			{Mountpoint: "/run/mnt/ubuntu-seed"}: d1,
+			{
+				Mountpoint:        "/run/mnt/ubuntu-data",
+				IsDecryptedDevice: true,
+			}: d1,
+		},
+	)
+	defer r()
+
+	// first we get ubuntu-boot (which is not a decrypted device)
+	d, err := disks.DiskFromMountPoint("/run/mnt/ubuntu-boot", nil)
+	c.Assert(err, IsNil)
+
+	// next we find ubuntu-seed (also not decrypted)
+	label, err := d.FindMatchingPartitionUUID("ubuntu-seed")
+	c.Assert(err, IsNil)
+	c.Assert(label, Equals, "ubuntu-seed-part")
+
+	// then we find ubuntu-data-enc, which is not a decrypted device
+	label, err = d.FindMatchingPartitionUUID("ubuntu-data-enc")
+	c.Assert(err, IsNil)
+	c.Assert(label, Equals, "ubuntu-data-enc-part")
+
+	// and then finally ubuntu-data enc is from the same disk as ubuntu-boot
+	// with IsDecryptedDevice = true
+	opts := &disks.Options{IsDecryptedDevice: true}
+	matches, err := d.MountPointIsFromDisk("/run/mnt/ubuntu-data", opts)
+	c.Assert(err, IsNil)
+	c.Assert(matches, Equals, true)
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/disk_test.go snapd-2.48.3+20.04/osutil/disk_test.go
--- snapd-2.45.1+20.04.2/osutil/disk_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/disk_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,70 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil_test
+
+import (
+	"os"
+	"syscall"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+type diskSuite struct{}
+
+var _ = Suite(&diskSuite{})
+
+func (s *diskSuite) TestCheckFreeSpaceHappy(c *C) {
+	var called bool
+	restore := osutil.MockSyscallStatfs(func(path string, st *syscall.Statfs_t) error {
+		c.Assert(path, Equals, "/path")
+		st.Bsize = 4096
+		st.Bavail = 2
+		called = true
+		return nil
+	})
+	defer restore()
+
+	c.Assert(osutil.CheckFreeSpace("/path", 8191), IsNil)
+	c.Assert(called, Equals, true)
+}
+
+func (s *diskSuite) TestCheckFreeSpaceUnhappy(c *C) {
+	restore := osutil.MockSyscallStatfs(func(path string, st *syscall.Statfs_t) error {
+		c.Assert(path, Equals, "/path")
+		st.Bsize = 4096
+		st.Bavail = 2
+		return nil
+	})
+	defer restore()
+
+	err := osutil.CheckFreeSpace("/path", 8193)
+	c.Assert(err, ErrorMatches, `insufficient space in "/path", at least 1B more is required`)
+	diskSpaceErr, ok := err.(*osutil.NotEnoughDiskSpaceError)
+	c.Assert(ok, Equals, true)
+	c.Check(diskSpaceErr.Path, Equals, "/path")
+	c.Check(diskSpaceErr.Delta, Equals, int64(1))
+}
+
+func (s *diskSuite) TestCheckFreeSpacePathError(c *C) {
+	err := osutil.CheckFreeSpace("/does/not/exist/path", 8193)
+	c.Assert(os.IsNotExist(err), Equals, true)
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/doc.go snapd-2.48.3+20.04/osutil/doc.go
--- snapd-2.45.1+20.04.2/osutil/doc.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/doc.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,23 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Package osutil offers utilities related to the operating system or
+// i/o, mainly for files, filesystems and mounts, and also users and
+// processes.
+package osutil
diff -Nru snapd-2.45.1+20.04.2/osutil/export_test.go snapd-2.48.3+20.04/osutil/export_test.go
--- snapd-2.45.1+20.04.2/osutil/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -68,6 +68,14 @@
 	}
 }
 
+func MockSyscallStatfs(f func(string, *syscall.Statfs_t) error) func() {
+	oldSyscallStatfs := syscallStatfs
+	syscallStatfs = f
+	return func() {
+		syscallStatfs = oldSyscallStatfs
+	}
+}
+
 func MockSyscallGetpgid(f func(int) (int, error)) func() {
 	oldSyscallGetpgid := syscallGetpgid
 	syscallGetpgid = f
@@ -171,18 +179,6 @@
 	return func() { findGidNoGetentFallback = old }
 }
 
-func MockFindUid(mock func(name string) (uint64, error)) (restore func()) {
-	old := findUid
-	findUid = mock
-	return func() { findUid = old }
-}
-
-func MockFindGid(mock func(name string) (uint64, error)) (restore func()) {
-	old := findGid
-	findGid = mock
-	return func() { findGid = old }
-}
-
 const MaxSymlinkTries = maxSymlinkTries
 
 var ParseRawEnvironment = parseRawEnvironment
@@ -206,11 +202,11 @@
 // this is weird to use in a test, but it is so that we can test the actual
 // implementation of LoadMountInfo, which normally panics during tests if not
 // properly mocked
-func MockIsSnapdTest(new bool) (restore func()) {
-	old := isSnapdTest
-	isSnapdTest = new
+func MountInfoMustMock(new bool) (restore func()) {
+	old := mountInfoMustMockInTests
+	mountInfoMustMockInTests = new
 	return func() {
-		isSnapdTest = old
+		mountInfoMustMockInTests = old
 	}
 }
 
diff -Nru snapd-2.45.1+20.04.2/osutil/flock.go snapd-2.48.3+20.04/osutil/flock.go
--- snapd-2.45.1+20.04.2/osutil/flock.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/flock.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,10 +32,22 @@
 
 var ErrAlreadyLocked = errors.New("cannot acquire lock, already locked")
 
-// NewFileLock creates and opens the lock file given by "path"
-func NewFileLock(path string) (*FileLock, error) {
-	mode := syscall.O_RDWR | syscall.O_CREAT | syscall.O_NOFOLLOW | syscall.O_CLOEXEC
-	file, err := os.OpenFile(path, mode, os.FileMode(0600))
+// OpenExistingLockForReading opens an existing lock file given by "path".
+// The lock is opened in read-only mode.
+func OpenExistingLockForReading(path string) (*FileLock, error) {
+	flag := syscall.O_RDONLY | syscall.O_NOFOLLOW | syscall.O_CLOEXEC
+	file, err := os.OpenFile(path, flag, 0)
+	if err != nil {
+		return nil, err
+	}
+	l := &FileLock{file: file}
+	return l, nil
+}
+
+// NewFileLockWithMode creates and opens the lock file given by "path" with the given mode.
+func NewFileLockWithMode(path string, mode os.FileMode) (*FileLock, error) {
+	flag := syscall.O_RDWR | syscall.O_CREAT | syscall.O_NOFOLLOW | syscall.O_CLOEXEC
+	file, err := os.OpenFile(path, flag, mode)
 	if err != nil {
 		return nil, err
 	}
@@ -43,21 +55,42 @@
 	return l, nil
 }
 
+// NewFileLock creates and opens the lock file given by "path" with mode 0600.
+func NewFileLock(path string) (*FileLock, error) {
+	return NewFileLockWithMode(path, 0600)
+}
+
 // Path returns the path of the lock file.
 func (l *FileLock) Path() string {
 	return l.file.Name()
 }
 
+// File returns the underlying file.
+func (l *FileLock) File() *os.File {
+	return l.file
+}
+
 // Close closes the lock, unlocking it automatically if needed.
 func (l *FileLock) Close() error {
 	return l.file.Close()
 }
 
 // Lock acquires an exclusive lock and blocks until the lock is free.
+//
+// Only one process can acquire an exclusive lock at a given time, preventing
+// shared or exclusive locks from being acquired.
 func (l *FileLock) Lock() error {
 	return syscall.Flock(int(l.file.Fd()), syscall.LOCK_EX)
 }
 
+// Lock acquires an shared lock and blocks until the lock is free.
+//
+// Multiple processes can acquire a shared lock at the same time, unless an
+// exclusive lock is held.
+func (l *FileLock) ReadLock() error {
+	return syscall.Flock(int(l.file.Fd()), syscall.LOCK_SH)
+}
+
 // TryLock acquires an exclusive lock and errors if the lock cannot be acquired.
 func (l *FileLock) TryLock() error {
 	err := syscall.Flock(int(l.file.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
diff -Nru snapd-2.45.1+20.04.2/osutil/flock_test.go snapd-2.48.3+20.04/osutil/flock_test.go
--- snapd-2.45.1+20.04.2/osutil/flock_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/flock_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,14 +36,63 @@
 
 var _ = Suite(&flockSuite{})
 
+// Test that an existing lock file can be opened.
+func (s *flockSuite) TestOpenExistingLockForReading(c *C) {
+	fname := filepath.Join(c.MkDir(), "name")
+	lock, err := osutil.OpenExistingLockForReading(fname)
+	c.Assert(err, ErrorMatches, ".* no such file or directory")
+	c.Assert(lock, IsNil)
+
+	lock, err = osutil.NewFileLockWithMode(fname, 0644)
+	c.Assert(err, IsNil)
+	lock.Close()
+
+	// Having created the lock above, we can now open it correctly.
+	lock, err = osutil.OpenExistingLockForReading(fname)
+	c.Assert(err, IsNil)
+	defer lock.Close()
+
+	// The lock file is read-only though.
+	file := lock.File()
+	defer file.Close()
+	n, err := file.Write([]byte{1, 2, 3})
+	// write(2) returns EBADF if the file descriptor is read only.
+	c.Assert(err, ErrorMatches, ".* bad file descriptor")
+	c.Assert(n, Equals, 0)
+}
+
+// Test that opening and closing a lock works as expected, and that the mode is right.
+func (s *flockSuite) TestNewFileLockWithMode(c *C) {
+	lock, err := osutil.NewFileLockWithMode(filepath.Join(c.MkDir(), "name"), 0644)
+	c.Assert(err, IsNil)
+	defer lock.Close()
+
+	fi, err := os.Stat(lock.Path())
+	c.Assert(err, IsNil)
+	c.Assert(fi.Mode().Perm(), Equals, os.FileMode(0644))
+}
+
 // Test that opening and closing a lock works as expected.
 func (s *flockSuite) TestNewFileLock(c *C) {
 	lock, err := osutil.NewFileLock(filepath.Join(c.MkDir(), "name"))
 	c.Assert(err, IsNil)
 	defer lock.Close()
 
-	_, err = os.Stat(lock.Path())
+	fi, err := os.Stat(lock.Path())
 	c.Assert(err, IsNil)
+	c.Assert(fi.Mode().Perm(), Equals, os.FileMode(0600))
+}
+
+// Test that we can access the underlying open file.
+func (s *flockSuite) TestFile(c *C) {
+	fname := filepath.Join(c.MkDir(), "name")
+	lock, err := osutil.NewFileLock(fname)
+	c.Assert(err, IsNil)
+	defer lock.Close()
+
+	f := lock.File()
+	c.Assert(f, NotNil)
+	c.Check(f.Name(), Equals, fname)
 }
 
 func flockSupportsConflictExitCodeSwitch(c *C) bool {
@@ -82,6 +131,50 @@
 
 	// Unlock the lock.
 	c.Assert(lock.Unlock(), IsNil)
+
+	// Run a flock command in another process, it should succeed because it can
+	// grab the lock again now.
+	cmd = exec.Command("flock", "--exclusive", "--nonblock", lock.Path(), "true")
+	c.Assert(cmd.Run(), IsNil)
+}
+
+// Test that ReadLock and Unlock work as expected.
+func (s *flockSuite) TestReadLockUnlockWorks(c *C) {
+	if os.Getenv("TRAVIS_BUILD_NUMBER") != "" {
+		c.Skip("Cannot use this under travis")
+		return
+	}
+	if !flockSupportsConflictExitCodeSwitch(c) {
+		c.Skip("flock too old for this test")
+	}
+
+	lock, err := osutil.NewFileLock(filepath.Join(c.MkDir(), "name"))
+	c.Assert(err, IsNil)
+	defer lock.Close()
+
+	// Run a flock command in another process, it should succeed because it can
+	// lock the lock as we didn't do it yet.
+	cmd := exec.Command("flock", "--exclusive", "--nonblock", lock.Path(), "true")
+	c.Assert(cmd.Run(), IsNil)
+
+	// Grab a shared lock.
+	c.Assert(lock.ReadLock(), IsNil)
+
+	// Run a flock command in another process, it should fail with the distinct
+	// error code because we hold a shared lock already and we asked it not to block.
+	cmd = exec.Command("flock", "--exclusive", "--nonblock",
+		"--conflict-exit-code", "2", lock.Path(), "true")
+	c.Assert(cmd.Run(), ErrorMatches, "exit status 2")
+
+	// Run a flock command in another process, it should succeed because we
+	// hold a shared lock and those do not prevent others from acquiring a
+	// shared lock.
+	cmd = exec.Command("flock", "--shared", "--nonblock",
+		"--conflict-exit-code", "2", lock.Path(), "true")
+	c.Assert(cmd.Run(), IsNil)
+
+	// Unlock the lock.
+	c.Assert(lock.Unlock(), IsNil)
 
 	// Run a flock command in another process, it should succeed because it can
 	// grab the lock again now.
diff -Nru snapd-2.45.1+20.04.2/osutil/fshelpers_test.go snapd-2.48.3+20.04/osutil/fshelpers_test.go
--- snapd-2.45.1+20.04.2/osutil/fshelpers_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/fshelpers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -40,7 +40,7 @@
 	gid, err := FindGidOwning(name)
 	c.Check(err, IsNil)
 
-	self, err := RealUser()
+	self, err := UserMaybeSudoUser()
 	c.Assert(err, IsNil)
 	c.Check(strconv.FormatUint(gid, 10), Equals, self.Gid)
 }
diff -Nru snapd-2.45.1+20.04.2/osutil/group.go snapd-2.48.3+20.04/osutil/group.go
--- snapd-2.45.1+20.04.2/osutil/group.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/group.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,15 +29,11 @@
 
 // FindUid returns the identifier of the given UNIX user name. It will
 // automatically fallback to use "getent" if needed.
-func FindUid(username string) (uint64, error) {
-	return findUid(username)
-}
+var FindUid = findUid
 
 // FindGid returns the identifier of the given UNIX group name. It will
 // automatically fallback to use "getent" if needed.
-func FindGid(groupname string) (uint64, error) {
-	return findGid(groupname)
-}
+var FindGid = findGid
 
 // getent returns the identifier of the given UNIX user or group name as
 // determined by the specified database
@@ -76,10 +72,43 @@
 	return strconv.ParseUint(string(parts[2]), 10, 64)
 }
 
+// TODO: both findUidNoGetentFallback and findGidNoGetentFallback should return
+//       a more qualified default value than uint64, because currently the
+//       default return value for findUid is "0" as per Go conventions, which is
+//       unfortunately also the uid of root, so if a caller ignored the error
+//       from this function and used that to perform access authorization, then
+//       the caller would accidentally provide the same access level as root in
+//       the error case. This is excaberated by the fact that the error case is
+//       very difficult to positively identify correctly as "not found", see the
+//       comments inside the functions for more details.
+// Note: there is a similar implementation in overlord/snapshotstate which
+//       should be similarly adjusted when resolving the above TODO.
+
 var findUidNoGetentFallback = func(username string) (uint64, error) {
 	myuser, err := user.Lookup(username)
 	if err != nil {
-		return 0, err
+		// Treat all non-nil errors as user.Unknown{User,Group}Error's, as
+		// currently Go's handling of returned errno from get{pw,gr}nam_r
+		// in the cgo implementation of user.Lookup is lacking, and thus
+		// user.Unknown{User,Group}Error is returned only when errno is 0
+		// and the list of users/groups is empty, but as per the man page
+		// for get{pw,gr}nam_r, there are many other errno's that typical
+		// systems could return to indicate that the user/group wasn't
+		// found, however unfortunately the POSIX standard does not actually
+		// dictate what errno should be used to indicate "user/group not
+		// found", and so even if Go is more robust, it may not ever be
+		// fully robust. See from the man page:
+		//
+		// > It [POSIX.1-2001] does not call "not found" an error, hence
+		// > does not specify what value errno might have in this situation.
+		// > But that makes it impossible to recognize errors.
+		//
+		// See upstream Go issue: https://github.com/golang/go/issues/40334
+
+		// if there is a real problem finding the user/group then presumably
+		// other things will fail upon trying to create the user, etc. which
+		// will give more useful and specific errors
+		return 0, user.UnknownUserError(username)
 	}
 
 	return strconv.ParseUint(myuser.Uid, 10, 64)
@@ -88,7 +117,28 @@
 var findGidNoGetentFallback = func(groupname string) (uint64, error) {
 	group, err := user.LookupGroup(groupname)
 	if err != nil {
-		return 0, err
+		// Treat all non-nil errors as user.Unknown{User,Group}Error's, as
+		// currently Go's handling of returned errno from get{pw,gr}nam_r
+		// in the cgo implementation of user.Lookup is lacking, and thus
+		// user.Unknown{User,Group}Error is returned only when errno is 0
+		// and the list of users/groups is empty, but as per the man page
+		// for get{pw,gr}nam_r, there are many other errno's that typical
+		// systems could return to indicate that the user/group wasn't
+		// found, however unfortunately the POSIX standard does not actually
+		// dictate what errno should be used to indicate "user/group not
+		// found", and so even if Go is more robust, it may not ever be
+		// fully robust. See from the man page:
+		//
+		// > It [POSIX.1-2001] does not call "not found" an error, hence
+		// > does not specify what value errno might have in this situation.
+		// > But that makes it impossible to recognize errors.
+		//
+		// See upstream Go issue: https://github.com/golang/go/issues/40334
+
+		// if there is a real problem finding the user/group then presumably
+		// other things will fail upon trying to create the user, etc. which
+		// will give more useful and specific errors
+		return 0, user.UnknownGroupError(groupname)
 	}
 
 	return strconv.ParseUint(group.Gid, 10, 64)
diff -Nru snapd-2.45.1+20.04.2/osutil/io.go snapd-2.48.3+20.04/osutil/io.go
--- snapd-2.45.1+20.04.2/osutil/io.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/io.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2015 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -22,10 +22,10 @@
 import (
 	"bytes"
 	"errors"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 	"syscall"
 
 	"github.com/snapcore/snapd/osutil/sys"
@@ -43,7 +43,7 @@
 // Allow disabling sync for testing. This brings massive improvements on
 // certain filesystems (like btrfs) and very much noticeable improvements in
 // all unit tests in genreal.
-var snapdUnsafeIO bool = len(os.Args) > 0 && strings.HasSuffix(os.Args[0], ".test") && GetenvBool("SNAPD_UNSAFE_IO", true)
+var snapdUnsafeIO bool = IsTestBinary() && GetenvBool("SNAPD_UNSAFE_IO", true)
 
 // An AtomicFile is similar to an os.File but it has an additional
 // Commit() method that does whatever needs to be done so the
@@ -145,12 +145,7 @@
 
 const NoChown = sys.FlagID
 
-// Commit the modification; make it permanent.
-//
-// If Commit succeeds, the writer is closed and further attempts to
-// write will fail. If Commit fails, the writer _might_ be closed;
-// Cancel() needs to be called to clean up.
-func (aw *AtomicFile) Commit() error {
+func (aw *AtomicFile) commit() error {
 	if aw.uid != NoChown || aw.gid != NoChown {
 		if err := chown(aw.File, aw.uid, aw.gid); err != nil {
 			return err
@@ -188,6 +183,31 @@
 	return nil
 }
 
+// Commit the modification; make it permanent.
+//
+// If Commit succeeds, the writer is closed and further attempts to
+// write will fail. If Commit fails, the writer _might_ be closed;
+// Cancel() needs to be called to clean up.
+func (aw *AtomicFile) Commit() error {
+	return aw.commit()
+}
+
+// CommitAs commits the file under a new target name, following the same rules
+// as Commit. The new target name must be located in the same directory as the
+// original filename provided when creating AtomicFile.
+//
+// The call is useful when the target name is not known until the end (eg. it
+// may depend on data being written to the file), in which case one can create
+// AtomicFile using a temporary name and later override the actual name by
+// calling CommitAs.
+func (aw *AtomicFile) CommitAs(filename string) error {
+	if dir := filepath.Dir(filename); dir != filepath.Dir(aw.target) {
+		return fmt.Errorf("cannot commit as %q to a different directory %q", filepath.Base(filename), dir)
+	}
+	aw.target = filename
+	return aw.commit()
+}
+
 // The AtomicWrite* family of functions work like ioutil.WriteFile(), but the
 // file created is an AtomicWriter, which is Committed before returning.
 //
diff -Nru snapd-2.45.1+20.04.2/osutil/io_test.go snapd-2.48.3+20.04/osutil/io_test.go
--- snapd-2.45.1+20.04.2/osutil/io_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/io_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,6 +25,7 @@
 	"math/rand"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/sys"
@@ -235,6 +236,65 @@
 	c.Check(osutil.FileExists(fn), Equals, false)
 }
 
+func (ts *AtomicWriteTestSuite) TestAtomicFileCommitAs(c *C) {
+	d := c.MkDir()
+	initialTarget := filepath.Join(d, "foo")
+	actualTarget := filepath.Join(d, "bar")
+
+	aw, err := osutil.NewAtomicFile(initialTarget, 0644, 0, osutil.NoChown, osutil.NoChown)
+	c.Assert(err, IsNil)
+	defer aw.Cancel()
+	fn := aw.File.Name()
+	c.Check(osutil.FileExists(fn), Equals, true)
+	c.Check(strings.HasPrefix(fn, initialTarget), Equals, true, Commentf("unexpected temporary file name prefix: %q", fn))
+	_, err = aw.WriteString("this is test data")
+	c.Assert(err, IsNil)
+
+	err = aw.CommitAs(actualTarget)
+	c.Assert(err, IsNil)
+	c.Check(fn, testutil.FileAbsent)
+	c.Check(actualTarget, testutil.FileEquals, "this is test data")
+	c.Check(initialTarget, testutil.FileAbsent)
+
+	// not confused when CommitAs uses the same name as initially
+	sameNameTarget := filepath.Join(d, "baz")
+	aw, err = osutil.NewAtomicFile(sameNameTarget, 0644, 0, osutil.NoChown, osutil.NoChown)
+	c.Assert(err, IsNil)
+	defer aw.Cancel()
+	_, err = aw.WriteString("this is baz")
+	c.Assert(err, IsNil)
+	err = aw.CommitAs(sameNameTarget)
+	c.Assert(err, IsNil)
+	c.Check(sameNameTarget, testutil.FileEquals, "this is baz")
+
+	// overwrites any existing file on CommitAs (same as Commit)
+	overwrittenTarget := filepath.Join(d, "will-overwrite")
+	err = ioutil.WriteFile(overwrittenTarget, []byte("overwritten"), 0644)
+	c.Assert(err, IsNil)
+	aw, err = osutil.NewAtomicFile(filepath.Join(d, "temp-name"), 0644, 0, osutil.NoChown, osutil.NoChown)
+	c.Assert(err, IsNil)
+	defer aw.Cancel()
+	_, err = aw.WriteString("this will overwrite existing file")
+	c.Assert(err, IsNil)
+	err = aw.CommitAs(overwrittenTarget)
+	c.Assert(err, IsNil)
+	c.Check(overwrittenTarget, testutil.FileEquals, "this will overwrite existing file")
+}
+
+func (ts *AtomicWriteTestSuite) TestAtomicFileCommitAsDifferentDirErr(c *C) {
+	d := c.MkDir()
+	initialTarget := filepath.Join(d, "foo")
+	differentDirTarget := filepath.Join(c.MkDir(), "bar")
+
+	aw, err := osutil.NewAtomicFile(initialTarget, 0644, 0, osutil.NoChown, osutil.NoChown)
+	c.Assert(err, IsNil)
+	_, err = aw.WriteString("this is test data")
+	c.Assert(err, IsNil)
+
+	err = aw.CommitAs(differentDirTarget)
+	c.Assert(err, ErrorMatches, `cannot commit as "bar" to a different directory .*`)
+}
+
 type AtomicSymlinkTestSuite struct{}
 
 var _ = Suite(&AtomicSymlinkTestSuite{})
@@ -270,17 +330,19 @@
 	c.Assert(err, ErrorMatches, `symlink target /.*/nested/bar\..*~: no such file or directory`)
 	checkLeftoverFiles(nestedBarSymlink, nil)
 
-	// create a dir without write permission
-	err = os.MkdirAll(nested, 0644)
-	c.Assert(err, IsNil)
+	if os.Geteuid() != 0 {
+		// create a dir without write permission
+		err = os.MkdirAll(nested, 0644)
+		c.Assert(err, IsNil)
 
-	// no permission to write in dir
-	err = osutil.AtomicSymlink("target", nestedBarSymlink)
-	c.Assert(err, ErrorMatches, `symlink target /.*/nested/bar\..*~: permission denied`)
-	checkLeftoverFiles(nestedBarSymlink, nil)
+		// no permission to write in dir
+		err = osutil.AtomicSymlink("target", nestedBarSymlink)
+		c.Assert(err, ErrorMatches, `symlink target /.*/nested/bar\..*~: permission denied`)
+		checkLeftoverFiles(nestedBarSymlink, nil)
 
-	err = os.Chmod(nested, 0755)
-	c.Assert(err, IsNil)
+		err = os.Chmod(nested, 0755)
+		c.Assert(err, IsNil)
+	}
 
 	err = osutil.AtomicSymlink("target", nestedBarSymlink)
 	c.Assert(err, IsNil)
@@ -359,16 +421,18 @@
 		c.Assert(err, ErrorMatches, "rename /.*/bar /.*/nested/bar: no such file or directory")
 	}
 
-	// create a dir without write permission
-	err = os.MkdirAll(nested, 0644)
-	c.Assert(err, IsNil)
+	if os.Geteuid() != 0 {
+		// create a dir without write permission
+		err = os.MkdirAll(nested, 0644)
+		c.Assert(err, IsNil)
 
-	// no permission to write in dir
-	err = osutil.AtomicRename(filepath.Join(d, "bar"), filepath.Join(nested, "bar"))
-	c.Assert(err, ErrorMatches, "rename /.*/bar /.*/nested/bar: permission denied")
+		// no permission to write in dir
+		err = osutil.AtomicRename(filepath.Join(d, "bar"), filepath.Join(nested, "bar"))
+		c.Assert(err, ErrorMatches, "rename /.*/bar /.*/nested/bar: permission denied")
 
-	err = os.Chmod(nested, 0755)
-	c.Assert(err, IsNil)
+		err = os.Chmod(nested, 0755)
+		c.Assert(err, IsNil)
+	}
 
 	// all good now
 	err = osutil.AtomicRename(filepath.Join(d, "bar"), filepath.Join(nested, "bar"))
diff -Nru snapd-2.45.1+20.04.2/osutil/kcmdline.go snapd-2.48.3+20.04/osutil/kcmdline.go
--- snapd-2.45.1+20.04.2/osutil/kcmdline.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/kcmdline.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,205 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"strings"
+)
+
+var (
+	procCmdline = "/proc/cmdline"
+)
+
+// MockProcCmdline overrides the path to /proc/cmdline. For use in tests.
+func MockProcCmdline(newPath string) (restore func()) {
+	MustBeTestBinary("mocking can only be done from tests")
+	oldProcCmdline := procCmdline
+	procCmdline = newPath
+	return func() {
+		procCmdline = oldProcCmdline
+	}
+}
+
+// KernelCommandLineSplit tries to split the string comprising full or a part
+// of a kernel command line into a list of individual arguments. Returns an
+// error when the input string is incorrectly formatted.
+//
+// See https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html for details.
+func KernelCommandLineSplit(s string) (out []string, err error) {
+	const (
+		argNone            int = iota // initial state
+		argName                       // looking at argument name
+		argAssign                     // looking at =
+		argValue                      // looking at unquoted value
+		argValueQuoteStart            // looking at start of quoted value
+		argValueQuoted                // looking at quoted value
+		argValueQuoteEnd              // looking at end of quoted value
+	)
+	var b bytes.Buffer
+	var rs = []rune(s)
+	var last = len(rs) - 1
+	var errUnexpectedQuote = fmt.Errorf("unexpected quoting")
+	var errUnbalancedQUote = fmt.Errorf("unbalanced quoting")
+	var errUnexpectedArgument = fmt.Errorf("unexpected argument")
+	var errUnexpectedAssignment = fmt.Errorf("unexpected assignment")
+	// arguments are:
+	// - arg
+	// - arg=value, where value can be any string, spaces are preserve when quoting ".."
+	var state = argNone
+	for idx, r := range rs {
+		maybeSplit := false
+		switch state {
+		case argNone:
+			switch r {
+			case '"':
+				return nil, errUnexpectedQuote
+			case '=':
+				return nil, errUnexpectedAssignment
+			case ' ':
+				maybeSplit = true
+			default:
+				state = argName
+				b.WriteRune(r)
+			}
+		case argName:
+			switch r {
+			case '"':
+				return nil, errUnexpectedQuote
+			case ' ':
+				maybeSplit = true
+				state = argNone
+			case '=':
+				state = argAssign
+				fallthrough
+			default:
+				b.WriteRune(r)
+			}
+		case argAssign:
+			switch r {
+			case '=':
+				return nil, errUnexpectedAssignment
+			case ' ':
+				// no value: arg=
+				maybeSplit = true
+				state = argNone
+			case '"':
+				// arg="..
+				state = argValueQuoteStart
+				b.WriteRune(r)
+			default:
+				// arg=v..
+				state = argValue
+				b.WriteRune(r)
+			}
+		case argValue:
+			switch r {
+			case '"':
+				// arg=foo"
+				return nil, errUnexpectedQuote
+			case ' ':
+				state = argNone
+				maybeSplit = true
+			default:
+				// arg=value...
+				b.WriteRune(r)
+			}
+		case argValueQuoteStart:
+			switch r {
+			case '"':
+				// closing quote: arg=""
+				state = argValueQuoteEnd
+				b.WriteRune(r)
+			default:
+				state = argValueQuoted
+				b.WriteRune(r)
+			}
+		case argValueQuoted:
+			switch r {
+			case '"':
+				// closing quote: arg="foo"
+				state = argValueQuoteEnd
+				fallthrough
+			default:
+				b.WriteRune(r)
+			}
+		case argValueQuoteEnd:
+			switch r {
+			case ' ':
+				maybeSplit = true
+				state = argNone
+			case '"':
+				// arg="foo""
+				return nil, errUnexpectedQuote
+			case '=':
+				// arg="foo"=
+				return nil, errUnexpectedAssignment
+			default:
+				// arg="foo"bar
+				return nil, errUnexpectedArgument
+			}
+		}
+		if maybeSplit || idx == last {
+			// split now
+			if b.Len() != 0 {
+				out = append(out, b.String())
+				b.Reset()
+			}
+		}
+	}
+	switch state {
+	case argValueQuoteStart, argValueQuoted:
+		// ended at arg=" or arg="foo
+		return nil, errUnbalancedQUote
+	}
+	return out, nil
+}
+
+// KernelCommandLineKeyValues returns a map of the specified keys to the values
+// set for them in the kernel command line (eg. panic=-1). If the value is
+// missing from the kernel command line or it has no value (eg. quiet), the key
+// is omitted from the returned map.
+func KernelCommandLineKeyValues(keys ...string) (map[string]string, error) {
+	buf, err := ioutil.ReadFile(procCmdline)
+	if err != nil {
+		return nil, err
+	}
+	params, err := KernelCommandLineSplit(strings.TrimSpace(string(buf)))
+	if err != nil {
+		return nil, err
+	}
+
+	m := make(map[string]string, len(keys))
+
+	for _, param := range params {
+		for _, key := range keys {
+			if strings.HasPrefix(param, fmt.Sprintf("%s=", key)) {
+				res := strings.SplitN(param, "=", 2)
+				// we have confirmed key= prefix, thus len(res)
+				// is always 2
+				m[key] = res[1]
+				break
+			}
+		}
+	}
+	return m, nil
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/kcmdline_test.go snapd-2.48.3+20.04/osutil/kcmdline_test.go
--- snapd-2.45.1+20.04.2/osutil/kcmdline_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/kcmdline_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,193 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2015 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil_test
+
+import (
+	"io/ioutil"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+type kcmdlineTestSuite struct{}
+
+var _ = Suite(&kcmdlineTestSuite{})
+
+func (s *kcmdlineTestSuite) TestSplitKernelCommandLine(c *C) {
+	for idx, tc := range []struct {
+		cmd    string
+		exp    []string
+		errStr string
+	}{
+		{cmd: ``, exp: nil},
+		{cmd: `foo bar baz`, exp: []string{"foo", "bar", "baz"}},
+		{cmd: `foo=" many   spaces  " bar`, exp: []string{`foo=" many   spaces  "`, "bar"}},
+		{cmd: `foo="1$2"`, exp: []string{`foo="1$2"`}},
+		{cmd: `foo=1$2`, exp: []string{`foo=1$2`}},
+		{cmd: `foo= bar`, exp: []string{"foo=", "bar"}},
+		{cmd: `foo=""`, exp: []string{`foo=""`}},
+		{cmd: `   cpu=1,2,3   mem=0x2000;0x4000:$2  `, exp: []string{"cpu=1,2,3", "mem=0x2000;0x4000:$2"}},
+		{cmd: "isolcpus=1,2,10-20,100-2000:2/25", exp: []string{"isolcpus=1,2,10-20,100-2000:2/25"}},
+		// something more realistic
+		{
+			cmd: `BOOT_IMAGE=/vmlinuz-linux root=/dev/mapper/linux-root rw quiet loglevel=3 rd.udev.log_priority=3 vt.global_cursor_default=0 rd.luks.uuid=1a273f76-3118-434b-8597-a3b12a59e017 rd.luks.uuid=775e4582-33c1-423b-ac19-f734e0d5e21c rd.luks.options=discard,timeout=0 root=/dev/mapper/linux-root apparmor=1 security=apparmor`,
+			exp: []string{
+				"BOOT_IMAGE=/vmlinuz-linux",
+				"root=/dev/mapper/linux-root",
+				"rw", "quiet",
+				"loglevel=3",
+				"rd.udev.log_priority=3",
+				"vt.global_cursor_default=0",
+				"rd.luks.uuid=1a273f76-3118-434b-8597-a3b12a59e017",
+				"rd.luks.uuid=775e4582-33c1-423b-ac19-f734e0d5e21c",
+				"rd.luks.options=discard,timeout=0",
+				"root=/dev/mapper/linux-root",
+				"apparmor=1",
+				"security=apparmor",
+			},
+		},
+		// this is actually ok, eg. rd.luks.options=discard,timeout=0
+		{cmd: `a=b=`, exp: []string{"a=b="}},
+		// bad quoting, or otherwise malformed command line
+		{cmd: `foo="1$2`, errStr: "unbalanced quoting"},
+		{cmd: `"foo"`, errStr: "unexpected quoting"},
+		{cmd: `foo"foo"`, errStr: "unexpected quoting"},
+		{cmd: `foo=foo"`, errStr: "unexpected quoting"},
+		{cmd: `foo="a""b"`, errStr: "unexpected quoting"},
+		{cmd: `foo="a foo="b`, errStr: "unexpected argument"},
+		{cmd: `foo="a"="b"`, errStr: "unexpected assignment"},
+		{cmd: `=`, errStr: "unexpected assignment"},
+		{cmd: `a =`, errStr: "unexpected assignment"},
+		{cmd: `="foo"`, errStr: "unexpected assignment"},
+		{cmd: `a==`, errStr: "unexpected assignment"},
+		{cmd: `foo ==a`, errStr: "unexpected assignment"},
+	} {
+		c.Logf("%v: cmd: %q", idx, tc.cmd)
+		out, err := osutil.KernelCommandLineSplit(tc.cmd)
+		if tc.errStr != "" {
+			c.Assert(err, ErrorMatches, tc.errStr)
+			c.Check(out, IsNil)
+		} else {
+			c.Assert(err, IsNil)
+			c.Check(out, DeepEquals, tc.exp)
+		}
+	}
+}
+
+func (s *kcmdlineTestSuite) TestGetKernelCommandLineKeyValue(c *C) {
+	for _, t := range []struct {
+		cmdline string
+		keys    []string
+		exp     map[string]string
+		err     string
+		comment string
+	}{
+		{
+			cmdline: "",
+			comment: "empty cmdline",
+			keys:    []string{"foo"},
+		},
+		{
+			cmdline: "foo",
+			comment: "cmdline non-key-value",
+			keys:    []string{"foo"},
+		},
+		{
+			cmdline: "foo=1",
+			comment: "key-value pair",
+			keys:    []string{"foo"},
+			exp: map[string]string{
+				"foo": "1",
+			},
+		},
+		{
+			cmdline: "foo=1 otherfoo=2",
+			comment: "multiple key-value pairs",
+			keys:    []string{"foo", "otherfoo"},
+			exp: map[string]string{
+				"foo":      "1",
+				"otherfoo": "2",
+			},
+		},
+		{
+			cmdline: "foo=",
+			comment: "empty value in key-value pair",
+			keys:    []string{"foo"},
+			exp: map[string]string{
+				"foo": "",
+			},
+		},
+		{
+			cmdline: "foo=1 foo=2",
+			comment: "duplicated key-value pair uses last one",
+			keys:    []string{"foo"},
+			exp: map[string]string{
+				"foo": "2",
+			},
+		},
+		{
+			cmdline: "foo=1 foo foo2=other",
+			comment: "cmdline key-value pair and non-key-value",
+			keys:    []string{"foo"},
+			exp: map[string]string{
+				"foo": "1",
+			},
+		},
+		{
+			cmdline: "foo=a=1",
+			comment: "key-value pair with = in value",
+			keys:    []string{"foo"},
+			exp: map[string]string{
+				"foo": "a=1",
+			},
+		},
+		{
+			cmdline: "=foo",
+			comment: "missing key",
+			keys:    []string{"foo"},
+			err:     "unexpected assignment",
+		},
+		{
+			cmdline: `"foo`,
+			comment: "invalid kernel cmdline",
+			keys:    []string{"foo"},
+			err:     "unexpected quoting",
+		},
+	} {
+		cmdlineFile := filepath.Join(c.MkDir(), "cmdline")
+		err := ioutil.WriteFile(cmdlineFile, []byte(t.cmdline), 0644)
+		c.Assert(err, IsNil)
+		r := osutil.MockProcCmdline(cmdlineFile)
+		defer r()
+		res, err := osutil.KernelCommandLineKeyValues(t.keys...)
+		if t.err != "" {
+			c.Assert(err, ErrorMatches, t.err, Commentf(t.comment))
+		} else {
+			c.Assert(err, IsNil)
+			exp := t.exp
+			if t.exp == nil {
+				exp = map[string]string{}
+			}
+			c.Assert(res, DeepEquals, exp, Commentf(t.comment))
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/mockable.go snapd-2.48.3+20.04/osutil/mockable.go
--- snapd-2.45.1+20.04.2/osutil/mockable.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/mockable.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,6 +34,22 @@
 	}
 }
 
+func MockFindUid(f func(string) (uint64, error)) (restore func()) {
+	old := FindUid
+	FindUid = f
+	return func() {
+		FindUid = old
+	}
+}
+
+func MockFindGid(f func(string) (uint64, error)) (restore func()) {
+	old := FindGid
+	FindGid = f
+	return func() {
+		FindGid = old
+	}
+}
+
 var (
 	mockedMountInfo *string
 
diff -Nru snapd-2.45.1+20.04.2/osutil/mountinfo_linux.go snapd-2.48.3+20.04/osutil/mountinfo_linux.go
--- snapd-2.45.1+20.04.2/osutil/mountinfo_linux.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/mountinfo_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -48,8 +48,6 @@
 	SuperOptions   map[string]string
 }
 
-var isSnapdTest = len(os.Args) > 0 && strings.HasSuffix(os.Args[0], ".test")
-
 func flattenMap(m map[string]string) string {
 	keys := make([]string, 0, len(m))
 	for key := range m {
@@ -93,6 +91,8 @@
 		flattenMap(mi.SuperOptions))
 }
 
+var mountInfoMustMockInTests = true
+
 // LoadMountInfo loads list of mounted entries from /proc/self/mountinfo. This
 // can be mocked by using osutil.MockMountInfo to hard-code a specific mountinfo
 // file content to be loaded by this function
@@ -100,11 +100,12 @@
 	if mockedMountInfo != nil {
 		return ReadMountInfo(bytes.NewBufferString(*mockedMountInfo))
 	}
-	// if we are in testing and we didn't mock a mountinfo panic, since the
-	// mountinfo is used in many places and really should be mocked for tests
-	if isSnapdTest {
+	if IsTestBinary() && mountInfoMustMockInTests {
+		// if we are in testing and we didn't mock a mountinfo panic, since the
+		// mountinfo is used in many places and really should be mocked for tests
 		panic("/proc/self/mountinfo must be mocked in tests")
 	}
+
 	f, err := os.Open(procSelfMountInfo)
 	if err != nil {
 		return nil, err
diff -Nru snapd-2.45.1+20.04.2/osutil/mountinfo_linux_test.go snapd-2.48.3+20.04/osutil/mountinfo_linux_test.go
--- snapd-2.45.1+20.04.2/osutil/mountinfo_linux_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/mountinfo_linux_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -166,7 +166,7 @@
 	fname := filepath.Join(c.MkDir(), "mountinfo")
 	err := ioutil.WriteFile(fname, []byte(mountInfoSample), 0644)
 	c.Assert(err, IsNil)
-	restore := osutil.MockIsSnapdTest(false)
+	restore := osutil.MountInfoMustMock(false)
 	defer restore()
 	restore = osutil.MockProcSelfMountInfoLocation(fname)
 	defer restore()
@@ -178,7 +178,7 @@
 // Test that loading mountinfo from a missing file reports an error.
 func (s *mountinfoSuite) TestLoadMountInfo2(c *C) {
 	fname := filepath.Join(c.MkDir(), "mountinfo")
-	restore := osutil.MockIsSnapdTest(false)
+	restore := osutil.MountInfoMustMock(false)
 	defer restore()
 	restore = osutil.MockProcSelfMountInfoLocation(fname)
 	defer restore()
@@ -193,7 +193,7 @@
 	c.Assert(err, IsNil)
 	err = os.Chmod(fname, 0000)
 	c.Assert(err, IsNil)
-	restore := osutil.MockIsSnapdTest(false)
+	restore := osutil.MountInfoMustMock(false)
 	defer restore()
 	restore = osutil.MockProcSelfMountInfoLocation(fname)
 	defer restore()
diff -Nru snapd-2.45.1+20.04.2/osutil/nfs_linux.go snapd-2.48.3+20.04/osutil/nfs_linux.go
--- snapd-2.45.1+20.04.2/osutil/nfs_linux.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/nfs_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,7 @@
 		return false, fmt.Errorf("cannot parse mountinfo: %s", err)
 	}
 	for _, entry := range mountinfo {
-		if (entry.FsType == "nfs4" || entry.FsType == "nfs") && (strings.HasPrefix(entry.MountDir, "/home/") || entry.MountDir == "/home") {
+		if (entry.FsType == "nfs4" || entry.FsType == "nfs" || entry.FsType == "autofs") && (strings.HasPrefix(entry.MountDir, "/home/") || entry.MountDir == "/home") {
 			return true, nil
 		}
 	}
diff -Nru snapd-2.45.1+20.04.2/osutil/nfs_linux_test.go snapd-2.48.3+20.04/osutil/nfs_linux_test.go
--- snapd-2.45.1+20.04.2/osutil/nfs_linux_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/nfs_linux_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -76,6 +76,10 @@
 	}, {
 		// NFS that may be mounted at /mnt/nfs is ignored (not in $HOME).
 		fstab: "localhost:/srv/nfs /mnt/nfs nfs defaults 0 0",
+	}, {
+		// autofs that is mounted at /home.
+		mountinfo: "137 29 0:50 / /home rw,relatime shared:87 - autofs /etc/auto.master.d/home rw,fd=7,pgrp=22588,timeout=300,minproto=5,maxproto=5,indirect,pipe_ino=173399",
+		nfs:       true,
 	}}
 	for _, tc := range cases {
 		restore := osutil.MockMountInfo(tc.mountinfo)
diff -Nru snapd-2.45.1+20.04.2/osutil/sizer.go snapd-2.48.3+20.04/osutil/sizer.go
--- snapd-2.45.1+20.04.2/osutil/sizer.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/sizer.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,38 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil
+
+type Sizer struct {
+	size int64
+}
+
+func (sz *Sizer) Write(data []byte) (n int, err error) {
+	n = len(data)
+	sz.size += int64(n)
+	return
+}
+
+func (sz *Sizer) Reset() {
+	sz.size = 0
+}
+
+func (sz *Sizer) Size() int64 {
+	return sz.size
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/sizer_test.go snapd-2.48.3+20.04/osutil/sizer_test.go
--- snapd-2.45.1+20.04.2/osutil/sizer_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/sizer_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,47 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil_test
+
+import (
+	"io"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+type sizerTestSuite struct{}
+
+var _ = Suite(&sizerTestSuite{})
+
+func (s *sizerTestSuite) TestSizer(c *C) {
+	sz := &osutil.Sizer{}
+	c.Check(sz.Size(), Equals, int64(0))
+
+	io.WriteString(sz, "12345")
+	c.Check(sz.Size(), Equals, int64(5))
+	io.WriteString(sz, "12345")
+	c.Check(sz.Size(), Equals, int64(10))
+
+	sz.Reset()
+	c.Check(sz.Size(), Equals, int64(0))
+	io.WriteString(sz, "12345")
+	c.Check(sz.Size(), Equals, int64(5))
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/squashfs/fstype.go snapd-2.48.3+20.04/osutil/squashfs/fstype.go
--- snapd-2.45.1+20.04.2/osutil/squashfs/fstype.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/squashfs/fstype.go	2021-02-02 08:21:12.000000000 +0000
@@ -62,11 +62,16 @@
 	return needsFuseImpl()
 }
 
+// StandardOptions returns base squashfs options.
+func StandardOptions() []string {
+	return []string{"ro", "x-gdu.hide"}
+}
+
 // FsType returns what fstype to use for squashfs mounts and what
 // mount options
-func FsType() (fstype string, options []string, err error) {
+func FsType() (fstype string, options []string) {
 	fstype = "squashfs"
-	options = []string{"ro", "x-gdu.hide"}
+	options = StandardOptions()
 
 	if NeedsFuse() {
 		options = append(options, "allow_other")
@@ -80,5 +85,5 @@
 		}
 	}
 
-	return fstype, options, nil
+	return fstype, options
 }
diff -Nru snapd-2.45.1+20.04.2/osutil/sys/sysnum_32_linux.go snapd-2.48.3+20.04/osutil/sys/sysnum_32_linux.go
--- snapd-2.45.1+20.04.2/osutil/sys/sysnum_32_linux.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/sys/sysnum_32_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,5 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
-// +build arm64 amd64 ppc64le s390x ppc
+// +build amd64 arm64 ppc ppc64le riscv64 s390x
 
 /*
  * Copyright (C) 2017 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/osutil/testhelper.go snapd-2.48.3+20.04/osutil/testhelper.go
--- snapd-2.45.1+20.04.2/osutil/testhelper.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/testhelper.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,40 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil
+
+import (
+	"os"
+	"regexp"
+)
+
+var goTestExeRe = regexp.MustCompile(`^.*/.*go-build.*/.*\.test$`)
+
+// IsTestBinary checks whether the current process is a go test binary.
+func IsTestBinary() bool {
+	return len(os.Args) > 0 && goTestExeRe.MatchString(os.Args[0])
+}
+
+// MustBeTestBinary checks whether the executing process is a go test binary,
+// panics otherwise.
+func MustBeTestBinary(panicMsg string) {
+	if !IsTestBinary() {
+		panic(panicMsg)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/testhelper_test.go snapd-2.48.3+20.04/osutil/testhelper_test.go
--- snapd-2.45.1+20.04.2/osutil/testhelper_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/testhelper_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,66 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2015 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package osutil_test
+
+import (
+	"os"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+type testhelperSuite struct{}
+
+var _ = Suite(&testhelperSuite{})
+
+func mockOsArgs(args []string) (restore func()) {
+	old := os.Args
+	os.Args = args
+	return func() {
+		os.Args = old
+	}
+}
+
+func (s *testhelperSuite) TestIsTestBinary(c *C) {
+	// obvious case
+	c.Assert(osutil.IsTestBinary(), Equals, true)
+
+	defer mockOsArgs([]string{"foo", "bar", "baz"})()
+	c.Assert(osutil.IsTestBinary(), Equals, false)
+}
+
+func (s *testhelperSuite) TestMustBeTestBinary(c *C) {
+	// obvious case
+	osutil.MustBeTestBinary("unexpected panic")
+
+	defer mockOsArgs([]string{"foo", "bar", "baz"})()
+	c.Assert(func() { osutil.MustBeTestBinary("panic message") }, PanicMatches, "panic message")
+}
+
+func (s *testhelperSuite) TestBinaryNoRegressionWithValidApp(c *C) {
+	// a snap app named 'test' is valid, we must not be confused here
+	defer mockOsArgs([]string{"/snap/bin/some-snap.test", "bar", "baz"})()
+	// must not be considered a test binary
+	c.Assert(osutil.IsTestBinary(), Equals, false)
+	// must panic since binary is a non-test one
+	c.Assert(func() { osutil.MustBeTestBinary("non test binary, expecting a panic") },
+		PanicMatches, "non test binary, expecting a panic")
+}
diff -Nru snapd-2.45.1+20.04.2/osutil/user.go snapd-2.48.3+20.04/osutil/user.go
--- snapd-2.45.1+20.04.2/osutil/user.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/user.go	2021-02-02 08:21:12.000000000 +0000
@@ -282,12 +282,12 @@
 	return nil
 }
 
-// RealUser finds the user behind a sudo invocation when root, if applicable
-// and possible.
+// UserMaybeSudoUser finds the user behind a sudo invocation when root, if
+// applicable and possible. Otherwise the current user is returned.
 //
 // Don't check SUDO_USER when not root and simply return the current uid
 // to properly support sudo'ing from root to a non-root user
-func RealUser() (*user.User, error) {
+func UserMaybeSudoUser() (*user.User, error) {
 	cur, err := userCurrent()
 	if err != nil {
 		return nil, err
@@ -305,7 +305,14 @@
 	}
 
 	real, err := user.Lookup(realName)
-	// can happen when sudo is used to enter a chroot (e.g. pbuilder)
+
+	// Note: comparing err here with UnknownUserError is inherently flawed and
+	// may end up missing some legitimate unknown user errors, see the comment
+	// on findGidNoGetentFallback in group.go for more details.
+	// however in this case the effect is not worrisome, because if we fail to
+	// identify the error as unknown user, we will just fail here and won't
+	// inadvertently raise or lower permissions, as the current user is already
+	// root in this codepath
 	if _, ok := err.(user.UnknownUserError); ok {
 		return cur, nil
 	}
diff -Nru snapd-2.45.1+20.04.2/osutil/user_test.go snapd-2.48.3+20.04/osutil/user_test.go
--- snapd-2.45.1+20.04.2/osutil/user_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/osutil/user_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -191,7 +191,7 @@
 	c.Assert(err, check.ErrorMatches, `cannot force password change when no password is provided`)
 }
 
-func (s *createUserSuite) TestRealUser(c *check.C) {
+func (s *createUserSuite) TestUserMaybeSudoUser(c *check.C) {
 	oldUser := os.Getenv("SUDO_USER")
 	defer func() { os.Setenv("SUDO_USER", oldUser) }()
 
@@ -217,7 +217,7 @@
 		defer restore()
 
 		os.Setenv("SUDO_USER", t.SudoUsername)
-		cur, err := osutil.RealUser()
+		cur, err := osutil.UserMaybeSudoUser()
 		c.Assert(err, check.IsNil)
 		c.Check(cur.Username, check.Equals, t.CurrentUsername)
 	}
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/assertstate.go snapd-2.48.3+20.04/overlord/assertstate/assertstate.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/assertstate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/assertstate.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,6 +29,7 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/snapasserts"
 	"github.com/snapcore/snapd/httputil"
+	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/release"
@@ -60,26 +61,37 @@
 	if err != nil {
 		return err
 	}
-	modelAs := deviceCtx.Model()
 
 	snapStates, err := snapstate.All(s)
 	if err != nil {
 		return nil
 	}
+
+	err = bulkRefreshSnapDeclarations(s, snapStates, userID, deviceCtx)
+	if err == nil {
+		// done
+		return nil
+	}
+	if _, ok := err.(*bulkAssertionFallbackError); !ok {
+		// not an error that indicates the server rejecting/failing
+		// the bulk request itself
+		return err
+	}
+	logger.Noticef("bulk refresh of snap-declarations failed, falling back to one-by-one assertion fetching: %v", err)
+
+	modelAs := deviceCtx.Model()
+
 	fetching := func(f asserts.Fetcher) error {
-		for _, snapst := range snapStates {
-			info, err := snapst.CurrentInfo()
-			if err != nil {
-				return err
-			}
-			if info.SnapID == "" {
+		for instanceName, snapst := range snapStates {
+			sideInfo := snapst.CurrentSideInfo()
+			if sideInfo.SnapID == "" {
 				continue
 			}
-			if err := snapasserts.FetchSnapDeclaration(f, info.SnapID); err != nil {
-				if notRetried, ok := err.(*httputil.PerstistentNetworkError); ok {
+			if err := snapasserts.FetchSnapDeclaration(f, sideInfo.SnapID); err != nil {
+				if notRetried, ok := err.(*httputil.PersistentNetworkError); ok {
 					return notRetried
 				}
-				return fmt.Errorf("cannot refresh snap-declaration for %q: %v", info.InstanceName(), err)
+				return fmt.Errorf("cannot refresh snap-declaration for %q: %v", instanceName, err)
 			}
 		}
 
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/assertstate_test.go snapd-2.48.3+20.04/overlord/assertstate/assertstate_test.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/assertstate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/assertstate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016-2019 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -21,10 +21,14 @@
 
 import (
 	"bytes"
+	"context"
 	"crypto"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
+	"sort"
+	"strings"
 	"testing"
 	"time"
 
@@ -36,6 +40,7 @@
 	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/asserts/sysdb"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/httputil"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord"
 	"github.com/snapcore/snapd/overlord/assertstate"
@@ -45,6 +50,7 @@
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/store"
 	"github.com/snapcore/snapd/store/storetest"
 	"github.com/snapcore/snapd/testutil"
 )
@@ -74,6 +80,11 @@
 	state                  *state.State
 	db                     asserts.RODatabase
 	maxDeclSupportedFormat int
+
+	requestedTypes [][]string
+
+	snapActionErr         error
+	downloadAssertionsErr error
 }
 
 func (sto *fakeStore) pokeStateLock() {
@@ -93,6 +104,97 @@
 	return ref.Resolve(sto.db.Find)
 }
 
+func (sto *fakeStore) SnapAction(_ context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	sto.pokeStateLock()
+
+	if len(currentSnaps) != 0 || len(actions) != 0 {
+		panic("only assertion query supported")
+	}
+
+	toResolve, err := assertQuery.ToResolve()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if sto.snapActionErr != nil {
+		return nil, nil, sto.snapActionErr
+	}
+
+	restore := asserts.MockMaxSupportedFormat(asserts.SnapDeclarationType, sto.maxDeclSupportedFormat)
+	defer restore()
+
+	reqTypes := make(map[string]bool)
+	ares := make([]store.AssertionResult, 0, len(toResolve))
+	for g, ats := range toResolve {
+		urls := make([]string, 0, len(ats))
+		for _, at := range ats {
+			reqTypes[at.Ref.Type.Name] = true
+			a, err := at.Ref.Resolve(sto.db.Find)
+			if err != nil {
+				assertQuery.AddError(err, &at.Ref)
+				continue
+			}
+			if a.Revision() > at.Revision {
+				urls = append(urls, fmt.Sprintf("/assertions/%s", at.Unique()))
+			}
+		}
+		ares = append(ares, store.AssertionResult{
+			Grouping:   asserts.Grouping(g),
+			StreamURLs: urls,
+		})
+	}
+	// behave like the actual SnapAction if there are no results
+	if len(ares) == 0 {
+		return nil, ares, &store.SnapActionError{
+			NoResults: true,
+		}
+	}
+
+	typeNames := make([]string, 0, len(reqTypes))
+	for k := range reqTypes {
+		typeNames = append(typeNames, k)
+	}
+	sort.Strings(typeNames)
+	sto.requestedTypes = append(sto.requestedTypes, typeNames)
+
+	return nil, ares, nil
+}
+
+func (sto *fakeStore) DownloadAssertions(urls []string, b *asserts.Batch, user *auth.UserState) error {
+	sto.pokeStateLock()
+
+	if sto.downloadAssertionsErr != nil {
+		return sto.downloadAssertionsErr
+	}
+
+	resolve := func(ref *asserts.Ref) (asserts.Assertion, error) {
+		restore := asserts.MockMaxSupportedFormat(asserts.SnapDeclarationType, sto.maxDeclSupportedFormat)
+		defer restore()
+		return ref.Resolve(sto.db.Find)
+	}
+
+	for _, u := range urls {
+		comps := strings.Split(u, "/")
+
+		if len(comps) < 4 {
+			return fmt.Errorf("cannot use URL: %s", u)
+		}
+
+		assertType := asserts.Type(comps[2])
+		key := comps[3:]
+		ref := &asserts.Ref{Type: assertType, PrimaryKey: key}
+		a, err := resolve(ref)
+		if err != nil {
+			return err
+		}
+		if err := b.Add(a); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 var (
 	dev1PrivKey, _ = assertstest.GenerateKey(752)
 )
@@ -788,6 +890,16 @@
 	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
 }
 
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsNop(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.setModel(sysdb.GenericClassicModel())
+
+	err := assertstate.RefreshSnapDeclarations(s.state, 0)
+	c.Assert(err, IsNil)
+}
+
 func (s *assertMgrSuite) TestRefreshSnapDeclarationsNoStore(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -861,7 +973,7 @@
 	c.Check(a.(*asserts.Account).DisplayName(), Equals, "Dev 1 edited display-name")
 
 	// change snap decl to something that has a too new format
-
+	s.fakeStore.(*fakeStore).maxDeclSupportedFormat = 999
 	(func() {
 		restore := asserts.MockMaxSupportedFormat(asserts.SnapDeclarationType, 999)
 		defer restore()
@@ -895,6 +1007,68 @@
 	c.Check(a.(*asserts.SnapDeclaration).Revision(), Equals, 1)
 }
 
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsChangingKey(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.setModel(sysdb.GenericClassicModel())
+
+	snapDeclFoo := s.snapDecl(c, "foo", nil)
+
+	s.stateFromDecl(c, snapDeclFoo, "", snap.R(7))
+
+	// previous state
+	err := assertstate.Add(s.state, s.storeSigning.StoreAccountKey(""))
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, s.dev1Acct)
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, snapDeclFoo)
+	c.Assert(err, IsNil)
+
+	storePrivKey2, _ := assertstest.GenerateKey(752)
+	err = s.storeSigning.ImportKey(storePrivKey2)
+	c.Assert(err, IsNil)
+	storeKey2 := assertstest.NewAccountKey(s.storeSigning.RootSigning, s.storeSigning.TrustedAccount, map[string]interface{}{
+		"name": "store2",
+	}, storePrivKey2.PublicKey(), "")
+	err = s.storeSigning.Add(storeKey2)
+	c.Assert(err, IsNil)
+
+	// one changed assertion signed with different key
+	headers := map[string]interface{}{
+		"series":       "16",
+		"snap-id":      "foo-id",
+		"snap-name":    "foo",
+		"publisher-id": s.dev1Acct.AccountID(),
+		"timestamp":    time.Now().Format(time.RFC3339),
+		"revision":     "1",
+	}
+	storeKey2ID := storePrivKey2.PublicKey().ID()
+	snapDeclFoo1, err := s.storeSigning.Sign(asserts.SnapDeclarationType, headers, nil, storeKey2ID)
+	c.Assert(err, IsNil)
+	c.Check(snapDeclFoo1.SignKeyID(), Not(Equals), snapDeclFoo.SignKeyID())
+	err = s.storeSigning.Add(snapDeclFoo1)
+	c.Assert(err, IsNil)
+
+	_, err = storeKey2.Ref().Resolve(assertstate.DB(s.state).Find)
+	c.Check(asserts.IsNotFound(err), Equals, true)
+
+	err = assertstate.RefreshSnapDeclarations(s.state, 0)
+	c.Assert(err, IsNil)
+
+	a, err := assertstate.DB(s.state).Find(asserts.SnapDeclarationType, map[string]string{
+		"series":  "16",
+		"snap-id": "foo-id",
+	})
+	c.Assert(err, IsNil)
+	c.Check(a.Revision(), Equals, 1)
+	c.Check(a.SignKeyID(), Equals, storeKey2ID)
+
+	// key was fetched as well
+	_, err = storeKey2.Ref().Resolve(assertstate.DB(s.state).Find)
+	c.Check(err, IsNil)
+}
+
 func (s *assertMgrSuite) TestRefreshSnapDeclarationsWithStore(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -994,6 +1168,326 @@
 	c.Check(a.(*asserts.Store).Location(), Equals, "the-cloud")
 }
 
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsDownloadError(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.setModel(sysdb.GenericClassicModel())
+
+	snapDeclFoo := s.snapDecl(c, "foo", nil)
+
+	s.stateFromDecl(c, snapDeclFoo, "", snap.R(7))
+
+	// previous state
+	err := assertstate.Add(s.state, s.storeSigning.StoreAccountKey(""))
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, s.dev1Acct)
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, snapDeclFoo)
+	c.Assert(err, IsNil)
+
+	// one changed assertion
+	headers := map[string]interface{}{
+		"series":       "16",
+		"snap-id":      "foo-id",
+		"snap-name":    "fo-o",
+		"publisher-id": s.dev1Acct.AccountID(),
+		"timestamp":    time.Now().Format(time.RFC3339),
+		"revision":     "1",
+	}
+	snapDeclFoo1, err := s.storeSigning.Sign(asserts.SnapDeclarationType, headers, nil, "")
+	c.Assert(err, IsNil)
+	err = s.storeSigning.Add(snapDeclFoo1)
+	c.Assert(err, IsNil)
+
+	s.fakeStore.(*fakeStore).downloadAssertionsErr = errors.New("download error")
+
+	err = assertstate.RefreshSnapDeclarations(s.state, 0)
+	c.Assert(err, ErrorMatches, `cannot refresh snap-declarations for snaps:
+ - foo: download error`)
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsPersistentNetworkError(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.setModel(sysdb.GenericClassicModel())
+
+	snapDeclFoo := s.snapDecl(c, "foo", nil)
+
+	s.stateFromDecl(c, snapDeclFoo, "", snap.R(7))
+
+	// previous state
+	err := assertstate.Add(s.state, s.storeSigning.StoreAccountKey(""))
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, s.dev1Acct)
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, snapDeclFoo)
+	c.Assert(err, IsNil)
+
+	// one changed assertion
+	headers := map[string]interface{}{
+		"series":       "16",
+		"snap-id":      "foo-id",
+		"snap-name":    "fo-o",
+		"publisher-id": s.dev1Acct.AccountID(),
+		"timestamp":    time.Now().Format(time.RFC3339),
+		"revision":     "1",
+	}
+	snapDeclFoo1, err := s.storeSigning.Sign(asserts.SnapDeclarationType, headers, nil, "")
+	c.Assert(err, IsNil)
+	err = s.storeSigning.Add(snapDeclFoo1)
+	c.Assert(err, IsNil)
+
+	pne := new(httputil.PersistentNetworkError)
+	s.fakeStore.(*fakeStore).snapActionErr = pne
+
+	err = assertstate.RefreshSnapDeclarations(s.state, 0)
+	c.Assert(err, Equals, pne)
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsNoStoreFallback(c *C) {
+	// test that if we get a 4xx or 500 error from the store trying bulk
+	// assertion refresh we fall back to the old logic
+	s.fakeStore.(*fakeStore).snapActionErr = &store.UnexpectedHTTPStatusError{StatusCode: 400}
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	s.TestRefreshSnapDeclarationsNoStore(c)
+
+	c.Check(logbuf.String(), Matches, "(?m).*bulk refresh of snap-declarations failed, falling back to one-by-one assertion fetching:.*HTTP status code 400.*")
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsNoStoreFallbackUnexpectedSnapActionError(c *C) {
+	// test that if we get an unexpected SnapAction error from the
+	// store trying bulk assertion refresh we fall back to the old
+	// logic
+	s.fakeStore.(*fakeStore).snapActionErr = &store.SnapActionError{
+		NoResults: true,
+		Other:     []error{errors.New("unexpected error")},
+	}
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	s.TestRefreshSnapDeclarationsNoStore(c)
+
+	c.Check(logbuf.String(), Matches, "(?m).*bulk refresh of snap-declarations failed, falling back to one-by-one assertion fetching:.*unexpected error.*")
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsWithStoreFallback(c *C) {
+	// test that if we get a 4xx or 500 error from the store trying bulk
+	// assertion refresh we fall back to the old logic
+	s.fakeStore.(*fakeStore).snapActionErr = &store.UnexpectedHTTPStatusError{StatusCode: 500}
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	s.TestRefreshSnapDeclarationsWithStore(c)
+
+	c.Check(logbuf.String(), Matches, "(?m).*bulk refresh of snap-declarations failed, falling back to one-by-one assertion fetching:.*HTTP status code 500.*")
+}
+
+// the following tests cover what happens when refreshing snap-declarations
+// need to support overflowing the chosen asserts.Pool maximum groups
+
+func (s *assertMgrSuite) testRefreshSnapDeclarationsMany(c *C, n int) error {
+	// reduce maxGroups to test and stress the logic that deals
+	// with overflowing it
+	s.AddCleanup(assertstate.MockMaxGroups(16))
+
+	// previous state
+	err := assertstate.Add(s.state, s.storeSigning.StoreAccountKey(""))
+	c.Assert(err, IsNil)
+	err = assertstate.Add(s.state, s.dev1Acct)
+	c.Assert(err, IsNil)
+
+	for i := 1; i <= n; i++ {
+		name := fmt.Sprintf("foo%d", i)
+		snapDeclFooX := s.snapDecl(c, name, nil)
+
+		s.stateFromDecl(c, snapDeclFooX, "", snap.R(7+i))
+
+		// previous state
+		err = assertstate.Add(s.state, snapDeclFooX)
+		c.Assert(err, IsNil)
+
+		// make an update on top
+		headers := map[string]interface{}{
+			"series":       "16",
+			"snap-id":      name + "-id",
+			"snap-name":    fmt.Sprintf("fo-o-%d", i),
+			"publisher-id": s.dev1Acct.AccountID(),
+			"timestamp":    time.Now().Format(time.RFC3339),
+			"revision":     "1",
+		}
+		snapDeclFooX1, err := s.storeSigning.Sign(asserts.SnapDeclarationType, headers, nil, "")
+		c.Assert(err, IsNil)
+		err = s.storeSigning.Add(snapDeclFooX1)
+		c.Assert(err, IsNil)
+	}
+
+	err = assertstate.RefreshSnapDeclarations(s.state, 0)
+	if err != nil {
+		// fot the caller to check
+		return err
+	}
+
+	// check we got the updates
+	for i := 1; i <= n; i++ {
+		name := fmt.Sprintf("foo%d", i)
+		a, err := assertstate.DB(s.state).Find(asserts.SnapDeclarationType, map[string]string{
+			"series":  "16",
+			"snap-id": name + "-id",
+		})
+		c.Assert(err, IsNil)
+		c.Check(a.(*asserts.SnapDeclaration).SnapName(), Equals, fmt.Sprintf("fo-o-%d", i))
+	}
+
+	return nil
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany14NoStore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	s.setModel(sysdb.GenericClassicModel())
+
+	err := s.testRefreshSnapDeclarationsMany(c, 14)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		{"account", "account-key", "snap-declaration"},
+	})
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany16NoStore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	s.setModel(sysdb.GenericClassicModel())
+
+	err := s.testRefreshSnapDeclarationsMany(c, 16)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		{"account", "account-key", "snap-declaration"},
+	})
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany16WithStore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	// have a model and the store assertion available
+	storeAs := s.setupModelAndStore(c)
+	err := s.storeSigning.Add(storeAs)
+	c.Assert(err, IsNil)
+
+	err = s.testRefreshSnapDeclarationsMany(c, 16)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		// first 16 groups request
+		{"account", "account-key", "snap-declaration"},
+		// final separate request covering store only
+		{"store"},
+	})
+
+	// store assertion was also fetched
+	_, err = assertstate.DB(s.state).Find(asserts.StoreType, map[string]string{
+		"store": "my-brand-store",
+	})
+	c.Assert(err, IsNil)
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany17NoStore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	s.setModel(sysdb.GenericClassicModel())
+
+	err := s.testRefreshSnapDeclarationsMany(c, 17)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		// first 16 groups request
+		{"account", "account-key", "snap-declaration"},
+		// final separate request for the rest
+		{"snap-declaration"},
+	})
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany17NoStoreMergeErrors(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	s.setModel(sysdb.GenericClassicModel())
+
+	s.fakeStore.(*fakeStore).downloadAssertionsErr = errors.New("download error")
+
+	err := s.testRefreshSnapDeclarationsMany(c, 17)
+	c.Check(err, ErrorMatches, `(?s)cannot refresh snap-declarations for snaps:
+ - foo1: download error.* - foo9: download error`)
+	// all foo* snaps accounted for
+	c.Check(strings.Count(err.Error(), "foo"), Equals, 17)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		// first 16 groups request
+		{"account", "account-key", "snap-declaration"},
+		// final separate request for the rest
+		{"snap-declaration"},
+	})
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany31WithStore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	// have a model and the store assertion available
+	storeAs := s.setupModelAndStore(c)
+	err := s.storeSigning.Add(storeAs)
+	c.Assert(err, IsNil)
+
+	err = s.testRefreshSnapDeclarationsMany(c, 31)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		// first 16 groups request
+		{"account", "account-key", "snap-declaration"},
+		// final separate request for the rest and store
+		{"snap-declaration", "store"},
+	})
+
+	// store assertion was also fetched
+	_, err = assertstate.DB(s.state).Find(asserts.StoreType, map[string]string{
+		"store": "my-brand-store",
+	})
+	c.Assert(err, IsNil)
+}
+
+func (s *assertMgrSuite) TestRefreshSnapDeclarationsMany32WithStore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	// have a model and the store assertion available
+	storeAs := s.setupModelAndStore(c)
+	err := s.storeSigning.Add(storeAs)
+	c.Assert(err, IsNil)
+
+	err = s.testRefreshSnapDeclarationsMany(c, 32)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeStore.(*fakeStore).requestedTypes, DeepEquals, [][]string{
+		// first 16 groups request
+		{"account", "account-key", "snap-declaration"},
+		// 2nd round request
+		{"snap-declaration"},
+		// final separate request covering store
+		{"store"},
+	})
+
+	// store assertion was also fetched
+	_, err = assertstate.DB(s.state).Find(asserts.StoreType, map[string]string{
+		"store": "my-brand-store",
+	})
+	c.Assert(err, IsNil)
+}
+
 func (s *assertMgrSuite) TestValidateRefreshesNothing(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/bulk.go snapd-2.48.3+20.04/overlord/assertstate/bulk.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/bulk.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/bulk.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,248 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assertstate
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/store"
+)
+
+const storeGroup = "store assertion"
+
+// maxGroups is the maximum number of assertion groups we set with the
+// asserts.Pool used to refresh snap assertions, it corresponds
+// roughly to for how many snaps we will request assertions in
+// in one /v2/snaps/refresh request.
+// Given that requesting assertions for ~500 snaps together with no
+// updates can take around 900ms-1s, conservatively set it to half of
+// that. Most systems should be done in one request anyway.
+var maxGroups = 256
+
+func bulkRefreshSnapDeclarations(s *state.State, snapStates map[string]*snapstate.SnapState, userID int, deviceCtx snapstate.DeviceContext) error {
+	db := cachedDB(s)
+
+	pool := asserts.NewPool(db, maxGroups)
+
+	var mergedRPErr *resolvePoolError
+	tryResolvePool := func() error {
+		err := resolvePool(s, pool, userID, deviceCtx)
+		if rpe, ok := err.(*resolvePoolError); ok {
+			if mergedRPErr == nil {
+				mergedRPErr = rpe
+			} else {
+				mergedRPErr.merge(rpe)
+			}
+			return nil
+		}
+		return err
+	}
+
+	c := 0
+	for instanceName, snapst := range snapStates {
+		sideInfo := snapst.CurrentSideInfo()
+		if sideInfo.SnapID == "" {
+			continue
+		}
+
+		declRef := &asserts.Ref{
+			Type:       asserts.SnapDeclarationType,
+			PrimaryKey: []string{release.Series, sideInfo.SnapID},
+		}
+		// update snap-declaration (and prereqs) for the snap,
+		// they were originally added at install time
+		if err := pool.AddToUpdate(declRef, instanceName); err != nil {
+			return fmt.Errorf("cannot prepare snap-declaration refresh for snap %q: %v", instanceName, err)
+		}
+
+		c++
+		if c%maxGroups == 0 {
+			// we have exhausted max groups, resolve
+			// what we setup so far and then clear groups
+			// to reuse the pool
+			if err := tryResolvePool(); err != nil {
+				return err
+			}
+			if err := pool.ClearGroups(); err != nil {
+				// this shouldn't happen but if it
+				// does fallback
+				return &bulkAssertionFallbackError{err}
+			}
+		}
+	}
+
+	modelAs := deviceCtx.Model()
+
+	// fetch store assertion if available
+	if modelAs.Store() != "" {
+		storeRef := asserts.Ref{
+			Type:       asserts.StoreType,
+			PrimaryKey: []string{modelAs.Store()},
+		}
+		if err := pool.AddToUpdate(&storeRef, storeGroup); err != nil {
+			if !asserts.IsNotFound(err) {
+				return fmt.Errorf("cannot prepare store assertion refresh: %v", err)
+			}
+			// assertion is not present in the db yet,
+			// we'll try to resolve it (fetch it) first
+			storeAt := &asserts.AtRevision{
+				Ref:      storeRef,
+				Revision: asserts.RevisionNotKnown,
+			}
+			err := pool.AddUnresolved(storeAt, storeGroup)
+			if err != nil {
+				return fmt.Errorf("cannot prepare store assertion fetching: %v", err)
+			}
+		}
+	}
+
+	if err := tryResolvePool(); err != nil {
+		return err
+	}
+
+	if mergedRPErr != nil {
+		if e := mergedRPErr.errors[storeGroup]; asserts.IsNotFound(e) || e == asserts.ErrUnresolved {
+			// ignore
+			delete(mergedRPErr.errors, storeGroup)
+		}
+		if len(mergedRPErr.errors) == 0 {
+			return nil
+		}
+		mergedRPErr.message = "cannot refresh snap-declarations for snaps"
+		return mergedRPErr
+	}
+
+	return nil
+}
+
+// marker error to request falling back to the old implemention for assertion
+// refreshes
+type bulkAssertionFallbackError struct {
+	err error
+}
+
+func (e *bulkAssertionFallbackError) Error() string {
+	return fmt.Sprintf("unsuccessful bulk assertion refresh, fallback: %v", e.err)
+}
+
+type resolvePoolError struct {
+	message string
+	// errors maps groups to errors
+	errors map[string]error
+}
+
+func (rpe *resolvePoolError) merge(rpe1 *resolvePoolError) {
+	// we expect usually rpe and rpe1 errors to be disjunct, but is also
+	// ok for rpe1 errors to win
+	for k, e := range rpe1.errors {
+		rpe.errors[k] = e
+	}
+}
+
+func (rpe *resolvePoolError) Error() string {
+	message := rpe.message
+	if message == "" {
+		message = "cannot fetch and resolve assertions"
+	}
+	s := make([]string, 0, 1+len(rpe.errors))
+	s = append(s, fmt.Sprintf("%s:", message))
+	groups := make([]string, 0, len(rpe.errors))
+	for g := range rpe.errors {
+		groups = append(groups, g)
+	}
+	sort.Strings(groups)
+	for _, g := range groups {
+		s = append(s, fmt.Sprintf(" - %s: %v", g, rpe.errors[g]))
+	}
+	return strings.Join(s, "\n")
+}
+
+func resolvePool(s *state.State, pool *asserts.Pool, userID int, deviceCtx snapstate.DeviceContext) error {
+	user, err := userFromUserID(s, userID)
+	if err != nil {
+		return err
+	}
+	sto := snapstate.Store(s, deviceCtx)
+	db := cachedDB(s)
+	unsupported := handleUnsupported(db)
+
+	for {
+		// TODO: pass refresh options?
+		s.Unlock()
+		_, aresults, err := sto.SnapAction(context.TODO(), nil, nil, pool, user, nil)
+		s.Lock()
+		if err != nil {
+			// request fallback on
+			//  * unexpected SnapActionErrors or
+			//  * unexpected HTTP status of 4xx or 500
+			ignore := false
+			switch stoErr := err.(type) {
+			case *store.SnapActionError:
+				if !stoErr.NoResults || len(stoErr.Other) != 0 {
+					return &bulkAssertionFallbackError{stoErr}
+				}
+				// simply no results error, we are likely done
+				ignore = true
+			case *store.UnexpectedHTTPStatusError:
+				if stoErr.StatusCode >= 400 && stoErr.StatusCode <= 500 {
+					return &bulkAssertionFallbackError{stoErr}
+				}
+			}
+			if !ignore {
+				return err
+			}
+		}
+		if len(aresults) == 0 {
+			// everything resolved if no errors
+			break
+		}
+
+		for _, ares := range aresults {
+			b := asserts.NewBatch(unsupported)
+			s.Unlock()
+			err := sto.DownloadAssertions(ares.StreamURLs, b, user)
+			s.Lock()
+			if err != nil {
+				pool.AddGroupingError(err, ares.Grouping)
+				continue
+			}
+			_, err = pool.AddBatch(b, ares.Grouping)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	pool.CommitTo(db)
+
+	errors := pool.Errors()
+	if len(errors) != 0 {
+		return &resolvePoolError{errors: errors}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/export_test.go snapd-2.48.3+20.04/overlord/assertstate/export_test.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -23,3 +23,11 @@
 var (
 	DoFetch = doFetch
 )
+
+func MockMaxGroups(n int) (restore func()) {
+	oldMaxGroups := maxGroups
+	maxGroups = n
+	return func() {
+		maxGroups = oldMaxGroups
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/helpers.go snapd-2.48.3+20.04/overlord/assertstate/helpers.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,14 +35,10 @@
 	return auth.User(st, userID)
 }
 
-func doFetch(s *state.State, userID int, deviceCtx snapstate.DeviceContext, fetching func(asserts.Fetcher) error) error {
-	// TODO: once we have a bulk assertion retrieval endpoint this approach will change
-
-	db := cachedDB(s)
-
-	// this is a fallback in case of bugs, we ask the store
-	// to filter unsupported formats!
-	unsupported := func(ref *asserts.Ref, unsupportedErr error) error {
+// handleUnsupported behaves as a fallback in case of bugs, we do ask
+// the store to filter unsupported formats!
+func handleUnsupported(db asserts.RODatabase) func(ref *asserts.Ref, unsupportedErr error) error {
+	return func(ref *asserts.Ref, unsupportedErr error) error {
 		if _, err := ref.Resolve(db.Find); err != nil {
 			// nothing there yet or any other error
 			return unsupportedErr
@@ -51,8 +47,14 @@
 		logger.Noticef("Cannot update assertion %v: %v", ref, unsupportedErr)
 		return nil
 	}
+}
+
+func doFetch(s *state.State, userID int, deviceCtx snapstate.DeviceContext, fetching func(asserts.Fetcher) error) error {
+	// TODO: once we have a bulk assertion retrieval endpoint this approach will change
+
+	db := cachedDB(s)
 
-	b := asserts.NewBatch(unsupported)
+	b := asserts.NewBatch(handleUnsupported(db))
 
 	user, err := userFromUserID(s, userID)
 	if err != nil {
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/validation_set_tracking.go snapd-2.48.3+20.04/overlord/assertstate/validation_set_tracking.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/validation_set_tracking.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/validation_set_tracking.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,127 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assertstate
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/snapcore/snapd/overlord/state"
+)
+
+// ValidationSetMode reflects the mode of respective validation set, which is
+// either monitoring or enforcing.
+type ValidationSetMode int
+
+const (
+	Monitor ValidationSetMode = iota
+	Enforce
+)
+
+// ValidationSetTracking holds tracking parameters for associated validation set.
+type ValidationSetTracking struct {
+	AccountID string            `json:"account-id"`
+	Name      string            `json:"name"`
+	Mode      ValidationSetMode `json:"mode"`
+
+	// PinnedAt is an optional pinned sequence point, or 0 if not pinned.
+	PinnedAt int `json:"pinned-at,omitempty"`
+
+	// Current is the current sequence point.
+	Current int `json:"current,omitempty"`
+}
+
+// ValidationSetKey formats the given account id and name into a validation set key.
+func ValidationSetKey(accountID, name string) string {
+	return fmt.Sprintf("%s/%s", accountID, name)
+}
+
+// UpdateValidationSet updates ValidationSetTracking.
+// The method assumes valid tr fields.
+func UpdateValidationSet(st *state.State, tr *ValidationSetTracking) {
+	var vsmap map[string]*json.RawMessage
+	err := st.Get("validation-sets", &vsmap)
+	if err != nil && err != state.ErrNoState {
+		panic("internal error: cannot unmarshal validation set tracking state: " + err.Error())
+	}
+	if vsmap == nil {
+		vsmap = make(map[string]*json.RawMessage)
+	}
+	data, err := json.Marshal(tr)
+	if err != nil {
+		panic("internal error: cannot marshal validation set tracking state: " + err.Error())
+	}
+	raw := json.RawMessage(data)
+	key := ValidationSetKey(tr.AccountID, tr.Name)
+	vsmap[key] = &raw
+	st.Set("validation-sets", vsmap)
+}
+
+// DeleteValidationSet deletes a validation set for the given accoundID and name.
+// It is not an error to delete a non-existing one.
+func DeleteValidationSet(st *state.State, accountID, name string) {
+	var vsmap map[string]*json.RawMessage
+	err := st.Get("validation-sets", &vsmap)
+	if err != nil && err != state.ErrNoState {
+		panic("internal error: cannot unmarshal validation set tracking state: " + err.Error())
+	}
+	if len(vsmap) == 0 {
+		return
+	}
+	delete(vsmap, ValidationSetKey(accountID, name))
+	st.Set("validation-sets", vsmap)
+	return
+}
+
+// GetValidationSet retrieves the ValidationSetTracking for the given account and name.
+func GetValidationSet(st *state.State, accountID, name string, tr *ValidationSetTracking) error {
+	if tr == nil {
+		return fmt.Errorf("internal error: tr is nil")
+	}
+
+	*tr = ValidationSetTracking{}
+
+	var vset map[string]*json.RawMessage
+	err := st.Get("validation-sets", &vset)
+	if err != nil {
+		return err
+	}
+	key := ValidationSetKey(accountID, name)
+	raw, ok := vset[key]
+	if !ok {
+		return state.ErrNoState
+	}
+	// XXX: &tr pointer isn't needed here but it is likely historical (a bug in
+	// old JSON marshaling probably) and carried over from snapstate.Get.
+	err = json.Unmarshal([]byte(*raw), &tr)
+	if err != nil {
+		return fmt.Errorf("cannot unmarshal validation set tracking state: %v", err)
+	}
+	return nil
+}
+
+// ValidationSets retrieves all ValidationSetTracking data.
+func ValidationSets(st *state.State) (map[string]*ValidationSetTracking, error) {
+	var vsmap map[string]*ValidationSetTracking
+	if err := st.Get("validation-sets", &vsmap); err != nil && err != state.ErrNoState {
+		return nil, err
+	}
+	return vsmap, nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/assertstate/validation_set_tracking_test.go snapd-2.48.3+20.04/overlord/assertstate/validation_set_tracking_test.go
--- snapd-2.45.1+20.04.2/overlord/assertstate/validation_set_tracking_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/assertstate/validation_set_tracking_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,159 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package assertstate_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/overlord/assertstate"
+	"github.com/snapcore/snapd/overlord/state"
+)
+
+type validationSetTrackingSuite struct {
+	st *state.State
+}
+
+var _ = Suite(&validationSetTrackingSuite{})
+
+func (s *validationSetTrackingSuite) SetUpTest(c *C) {
+	s.st = state.New(nil)
+}
+
+func (s *validationSetTrackingSuite) TestUpdate(c *C) {
+	s.st.Lock()
+	defer s.st.Unlock()
+
+	all, err := assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 0)
+
+	tr := assertstate.ValidationSetTracking{
+		AccountID: "foo",
+		Name:      "bar",
+		Mode:      assertstate.Enforce,
+		PinnedAt:  1,
+		Current:   2,
+	}
+	assertstate.UpdateValidationSet(s.st, &tr)
+
+	all, err = assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 1)
+	for k, v := range all {
+		c.Check(k, Equals, "foo/bar")
+		c.Check(v, DeepEquals, &assertstate.ValidationSetTracking{AccountID: "foo", Name: "bar", Mode: assertstate.Enforce, PinnedAt: 1, Current: 2})
+	}
+
+	tr = assertstate.ValidationSetTracking{
+		AccountID: "foo",
+		Name:      "bar",
+		Mode:      assertstate.Monitor,
+		PinnedAt:  2,
+		Current:   3,
+	}
+	assertstate.UpdateValidationSet(s.st, &tr)
+
+	all, err = assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 1)
+	for k, v := range all {
+		c.Check(k, Equals, "foo/bar")
+		c.Check(v, DeepEquals, &assertstate.ValidationSetTracking{AccountID: "foo", Name: "bar", Mode: assertstate.Monitor, PinnedAt: 2, Current: 3})
+	}
+
+	tr = assertstate.ValidationSetTracking{
+		AccountID: "foo",
+		Name:      "baz",
+		Mode:      assertstate.Enforce,
+		Current:   3,
+	}
+	assertstate.UpdateValidationSet(s.st, &tr)
+
+	all, err = assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 2)
+
+	var gotFirst, gotSecond bool
+	for k, v := range all {
+		if k == "foo/bar" {
+			gotFirst = true
+			c.Check(v, DeepEquals, &assertstate.ValidationSetTracking{AccountID: "foo", Name: "bar", Mode: assertstate.Monitor, PinnedAt: 2, Current: 3})
+		} else {
+			gotSecond = true
+			c.Check(k, Equals, "foo/baz")
+			c.Check(v, DeepEquals, &assertstate.ValidationSetTracking{AccountID: "foo", Name: "baz", Mode: assertstate.Enforce, PinnedAt: 0, Current: 3})
+		}
+	}
+	c.Check(gotFirst, Equals, true)
+	c.Check(gotSecond, Equals, true)
+}
+
+func (s *validationSetTrackingSuite) TestDelete(c *C) {
+	s.st.Lock()
+	defer s.st.Unlock()
+
+	// delete non-existing one is fine
+	assertstate.DeleteValidationSet(s.st, "foo", "bar")
+	all, err := assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 0)
+
+	tr := assertstate.ValidationSetTracking{
+		AccountID: "foo",
+		Name:      "bar",
+		Mode:      assertstate.Monitor,
+	}
+	assertstate.UpdateValidationSet(s.st, &tr)
+
+	all, err = assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 1)
+
+	// deletes existing one
+	assertstate.DeleteValidationSet(s.st, "foo", "bar")
+	all, err = assertstate.ValidationSets(s.st)
+	c.Assert(err, IsNil)
+	c.Assert(all, HasLen, 0)
+}
+
+func (s *validationSetTrackingSuite) TestGet(c *C) {
+	s.st.Lock()
+	defer s.st.Unlock()
+
+	err := assertstate.GetValidationSet(s.st, "foo", "bar", nil)
+	c.Assert(err, ErrorMatches, `internal error: tr is nil`)
+
+	tr := assertstate.ValidationSetTracking{
+		AccountID: "foo",
+		Name:      "bar",
+		Mode:      assertstate.Enforce,
+		Current:   3,
+	}
+	assertstate.UpdateValidationSet(s.st, &tr)
+
+	var res assertstate.ValidationSetTracking
+	err = assertstate.GetValidationSet(s.st, "foo", "bar", &res)
+	c.Assert(err, IsNil)
+	c.Check(res, DeepEquals, tr)
+
+	// non-existing
+	err = assertstate.GetValidationSet(s.st, "foo", "baz", &res)
+	c.Assert(err, Equals, state.ErrNoState)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/cmdstate/cmdmgr.go snapd-2.48.3+20.04/overlord/cmdstate/cmdmgr.go
--- snapd-2.45.1+20.04.2/overlord/cmdstate/cmdmgr.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/cmdstate/cmdmgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -46,28 +46,43 @@
 var defaultExecTimeout = 5 * time.Second
 
 func doExec(t *state.Task, tomb *tomb.Tomb) error {
-	var argv []string
-	var tout time.Duration
-
 	st := t.State()
 	st.Lock()
-	err1 := t.Get("argv", &argv)
-	err2 := t.Get("timeout", &tout)
-	st.Unlock()
-	if err1 != nil {
-		return err1
+	defer st.Unlock()
+
+	var ignore bool
+	if err := t.Get("ignore", &ignore); err != nil && err != state.ErrNoState {
+		return err
 	}
-	if err2 != nil && err2 != state.ErrNoState {
-		return err2
+	if ignore {
+		t.Logf("task ignored")
+		return nil
 	}
-	if err2 == state.ErrNoState {
+
+	var argv []string
+	var tout time.Duration
+	if err := t.Get("argv", &argv); err != nil {
+		return err
+	}
+
+	err := t.Get("timeout", &tout)
+	// timeout is optional and might not be set
+	if err != nil && err != state.ErrNoState {
+		return err
+	}
+	if err == state.ErrNoState {
 		tout = defaultExecTimeout
 	}
 
-	if buf, err := osutil.RunAndWait(argv, nil, tout, tomb); err != nil {
-		st.Lock()
+	// the command needs to be run with unlocked state, but after that
+	// we need to restore the lock (for Errorf, and for deferred unlocking
+	// above).
+	st.Unlock()
+	buf, err := osutil.RunAndWait(argv, nil, tout, tomb)
+	st.Lock()
+
+	if err != nil {
 		t.Errorf("# %s\n%s", strings.Join(argv, " "), buf)
-		st.Unlock()
 		return err
 	}
 
diff -Nru snapd-2.45.1+20.04.2/overlord/cmdstate/cmdstate_test.go snapd-2.48.3+20.04/overlord/cmdstate/cmdstate_test.go
--- snapd-2.45.1+20.04.2/overlord/cmdstate/cmdstate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/cmdstate/cmdstate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -112,6 +112,28 @@
 	c.Check(chg.Status(), check.Equals, state.DoneStatus)
 }
 
+func (s *cmdSuite) TestExecIgnore(c *check.C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	fn := filepath.Join(s.rootdir, "flag")
+	ts := cmdstate.ExecWithTimeout(s.state, "Doing the thing", []string{"touch", fn}, time.Second/10)
+	c.Assert(ts.Tasks(), check.HasLen, 1)
+	ignore := true
+	ts.Tasks()[0].Set("ignore", ignore)
+
+	chg := s.state.NewChange("do-the-thing", "Doing the thing")
+	chg.AddAll(ts)
+
+	s.waitfor(chg)
+
+	// file not created
+	c.Check(osutil.FileExists(fn), check.Equals, false)
+	c.Check(chg.Status(), check.Equals, state.DoneStatus)
+
+	c.Check(strings.Join(ts.Tasks()[0].Log(), ""), check.Matches, `.*task ignored`)
+}
+
 func (s *cmdSuite) TestExecSad(c *check.C) {
 	s.state.Lock()
 	defer s.state.Unlock()
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/backlight.go snapd-2.48.3+20.04/overlord/configstate/configcore/backlight.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/backlight.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/backlight.go	2021-02-02 08:21:12.000000000 +0000
@@ -51,7 +51,7 @@
 	if opts != nil {
 		sysd = systemd.NewEmulationMode(opts.RootDir)
 	} else {
-		sysd = systemd.New(dirs.GlobalRootDir, systemd.SystemMode, &backlightSysdLogger{})
+		sysd = systemd.NewUnderRoot(dirs.GlobalRootDir, systemd.SystemMode, &backlightSysdLogger{})
 	}
 	output, err := coreCfg(tr, "system.disable-backlight-service")
 	if err != nil {
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/backlight_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/backlight_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/backlight_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/backlight_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -39,17 +39,10 @@
 func (s *backlightSuite) SetUpTest(c *C) {
 	s.configcoreSuite.SetUpTest(c)
 
-	s.systemctlArgs = nil
-
-	dirs.SetRootDir(c.MkDir())
 	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/etc/"), 0755)
 	c.Assert(err, IsNil)
 }
 
-func (s *backlightSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *backlightSuite) TestConfigureBacklightServiceMaskIntegration(c *C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -85,14 +78,11 @@
 }
 
 func (s *backlightSuite) TestFilesystemOnlyApply(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"system.disable-backlight-service": "true",
 	})
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 
 	c.Check(s.systemctlArgs, DeepEquals, [][]string{
 		{"--root", tmpDir, "mask", "systemd-backlight@.service"},
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/certs.go snapd-2.48.3+20.04/overlord/configstate/configcore/certs.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/certs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/certs.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
 
 /*
  * Copyright (C) 2020 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/certs_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/certs_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/certs_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/certs_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,16 +35,6 @@
 
 var _ = Suite(&certsSuite{})
 
-func (s *certsSuite) SetUpTest(c *C) {
-	s.configcoreSuite.SetUpTest(c)
-
-	dirs.SetRootDir(c.MkDir())
-}
-
-func (s *certsSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *certsSuite) TestConfigureCertsUnhappyName(c *C) {
 	err := configcore.Run(&mockConf{
 		state: s.state,
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/cloud.go snapd-2.48.3+20.04/overlord/configstate/configcore/cloud.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/cloud.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/cloud.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
 
 /*
  * Copyright (C) 2018 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/cloud_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/cloud_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/cloud_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/cloud_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,15 +37,6 @@
 
 var _ = Suite(&cloudSuite{})
 
-func (s *cloudSuite) SetUpTest(c *C) {
-	s.configcoreSuite.SetUpTest(c)
-	dirs.SetRootDir(c.MkDir())
-}
-
-func (s *cloudSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *cloudSuite) TestHandleCloud(c *C) {
 	tests := []struct {
 		instData         string
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/corecfg.go snapd-2.48.3+20.04/overlord/configstate/configcore/corecfg.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/corecfg.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/corecfg.go	2021-02-02 08:21:12.000000000 +0000
@@ -67,12 +67,12 @@
 	return nil
 }
 
-// PlainCoreConfig carries a read-only copy of core config and implements
+// plainCoreConfig carries a read-only copy of core config and implements
 // config.ConfGetter interface.
-type PlainCoreConfig map[string]interface{}
+type plainCoreConfig map[string]interface{}
 
 // Get implements config.ConfGetter interface.
-func (cfg PlainCoreConfig) Get(snapName, key string, result interface{}) error {
+func (cfg plainCoreConfig) Get(snapName, key string, result interface{}) error {
 	if snapName != "core" {
 		return fmt.Errorf("internal error: expected core snap in Get(), %q was requested", snapName)
 	}
@@ -88,7 +88,7 @@
 }
 
 // GetMaybe implements config.ConfGetter interface.
-func (cfg PlainCoreConfig) GetMaybe(instanceName, key string, result interface{}) error {
+func (cfg plainCoreConfig) GetMaybe(instanceName, key string, result interface{}) error {
 	err := cfg.Get(instanceName, key, result)
 	if err != nil && !config.IsNoOption(err) {
 		return err
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/corecfg_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/corecfg_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/corecfg_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/corecfg_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,7 +30,9 @@
 	"github.com/snapcore/snapd/overlord/configstate/config"
 	"github.com/snapcore/snapd/overlord/configstate/configcore"
 	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/systemd"
+	"github.com/snapcore/snapd/testutil"
 )
 
 func Test(t *testing.T) { TestingT(t) }
@@ -116,33 +118,38 @@
 
 // configcoreSuite is the base for all the configcore tests
 type configcoreSuite struct {
+	testutil.BaseTest
+
 	state *state.State
 
 	systemctlArgs     [][]string
-	systemctlRestorer func()
+	systemdSysctlArgs [][]string
 }
 
 var _ = Suite(&configcoreSuite{})
 
-func (s *configcoreSuite) SetUpSuite(c *C) {
-	s.systemctlRestorer = systemd.MockSystemctl(func(args ...string) ([]byte, error) {
+func (s *configcoreSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("") })
+
+	s.AddCleanup(systemd.MockSystemctl(func(args ...string) ([]byte, error) {
 		s.systemctlArgs = append(s.systemctlArgs, args[:])
 		output := []byte("ActiveState=inactive")
 		return output, nil
-	})
-}
+	}))
+	s.systemctlArgs = nil
+	s.AddCleanup(systemd.MockSystemdSysctl(func(args ...string) error {
+		s.systemdSysctlArgs = append(s.systemdSysctlArgs, args[:])
+		return nil
+	}))
+	s.systemdSysctlArgs = nil
 
-func (s *configcoreSuite) TearDownSuite(c *C) {
-	s.systemctlRestorer()
-}
-
-func (s *configcoreSuite) SetUpTest(c *C) {
-	dirs.SetRootDir(c.MkDir())
 	s.state = state.New(nil)
-}
 
-func (s *configcoreSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("")
+	restore := snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {})
+	s.AddCleanup(restore)
 }
 
 // runCfgSuite tests configcore.Run()
@@ -181,13 +188,13 @@
 }
 
 func (s *applyCfgSuite) TestEmptyRootDir(c *C) {
-	err := configcore.FilesystemOnlyApply("", nil)
+	err := configcore.FilesystemOnlyApply("", nil, nil)
 	c.Check(err, ErrorMatches, `internal error: root directory for configcore.FilesystemOnlyApply\(\) not set`)
 }
 
 func (s *applyCfgSuite) TestSmoke(c *C) {
 	conf := &mockConf{}
-	c.Assert(configcore.FilesystemOnlyApply(s.tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(s.tmpDir, conf, nil), IsNil)
 }
 
 func (s *applyCfgSuite) TestPlainCoreConfigGetErrorIfNotCore(c *C) {
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/experimental_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/experimental_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/experimental_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/experimental_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -85,7 +85,7 @@
 		"experimental.refresh-app-awareness": "true",
 	})
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 	c.Check(osutil.FileExists(filepath.Join(tmpDir, "/var/lib/snapd/features/refresh-app-awareness")), Equals, true)
 }
 
@@ -94,5 +94,5 @@
 		"experimental.refresh-app-awareness": 1,
 	})
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), ErrorMatches, `experimental.refresh-app-awareness can only be set to 'true' or 'false'`)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), ErrorMatches, `experimental.refresh-app-awareness can only be set to 'true' or 'false'`)
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/export_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/export_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,8 +28,11 @@
 	UpdateKeyValueStream = updateKeyValueStream
 	AddFSOnlyHandler     = addFSOnlyHandler
 	AddWithStateHandler  = addWithStateHandler
+	FilesystemOnlyApply  = filesystemOnlyApply
 )
 
+type PlainCoreConfig = plainCoreConfig
+
 func MockFindGid(f func(string) (uint64, error)) func() {
 	old := osutilFindGid
 	osutilFindGid = f
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/handlers.go snapd-2.48.3+20.04/overlord/configstate/configcore/handlers.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/handlers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/handlers.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,7 +23,7 @@
 	"fmt"
 
 	"github.com/snapcore/snapd/overlord/configstate/config"
-	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/sysconfig"
 )
 
 type configHandler interface {
@@ -79,8 +79,18 @@
 	// system.disable-backlight-service
 	addFSOnlyHandler(validateBacklightServiceSettings, handleBacklightServiceConfiguration, coreOnly)
 
+	// system.kernel.printk.console-loglevel
+	addFSOnlyHandler(validateSysctlOptions, handleSysctlConfiguration, coreOnly)
+
 	// journal.persistent
 	addFSOnlyHandler(validateJournalSettings, handleJournalConfiguration, coreOnly)
+
+	// system.timezone
+	addFSOnlyHandler(validateTimezoneSettings, handleTimezoneConfiguration, coreOnly)
+
+	sysconfig.ApplyFilesystemOnlyDefaultsImpl = func(rootDir string, defaults map[string]interface{}, options *sysconfig.FilesystemOnlyApplyOptions) error {
+		return filesystemOnlyApply(rootDir, plainCoreConfig(defaults), options)
+	}
 }
 
 // addFSOnlyHandler registers functions to validate and handle a subset of
@@ -120,16 +130,17 @@
 	return h.handleFunc(cfg, opts)
 }
 
-// FilesystemOnlyApply applies filesystem modifications under rootDir, according to the
+// filesystemOnlyApply applies filesystem modifications under rootDir, according to the
 // cfg configuration. This is a subset of core config options that is important
 // early during boot, before all the configuration is applied as part of
 // normal execution of configure hook.
-func FilesystemOnlyApply(rootDir string, cfg config.ConfGetter) error {
+// Exposed for use via sysconfig.ApplyFilesystemOnlyDefaults.
+func filesystemOnlyApply(rootDir string, cfg config.ConfGetter, opts *sysconfig.FilesystemOnlyApplyOptions) error {
 	if rootDir == "" {
 		return fmt.Errorf("internal error: root directory for configcore.FilesystemOnlyApply() not set")
 	}
 
-	opts := &fsOnlyContext{RootDir: rootDir}
+	ctx := &fsOnlyContext{RootDir: rootDir}
 	for _, h := range handlers {
 		if h.needsState() {
 			continue
@@ -143,10 +154,10 @@
 		if h.needsState() {
 			continue
 		}
-		if h.flags().coreOnlyConfig && release.OnClassic {
+		if h.flags().coreOnlyConfig && opts != nil && opts.Classic {
 			continue
 		}
-		if err := h.handle(cfg, opts); err != nil {
+		if err := h.handle(cfg, ctx); err != nil {
 			return err
 		}
 	}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/journal.go snapd-2.48.3+20.04/overlord/configstate/configcore/journal.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/journal.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/journal.go	2021-02-02 08:21:12.000000000 +0000
@@ -110,7 +110,7 @@
 		// upstream bug: https://bugs.freedesktop.org/show_bug.cgi?id=84923,
 		// therefore only tell journald to reload if it's new enough.
 		if ver >= 236 {
-			sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, nil)
+			sysd := systemd.NewUnderRoot(dirs.GlobalRootDir, systemd.SystemMode, nil)
 			if err := sysd.Kill("systemd-journald", "USR1", ""); err != nil {
 				return err
 			}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/journal_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/journal_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/journal_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/journal_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,55 +30,44 @@
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/sys"
 	"github.com/snapcore/snapd/overlord/configstate/configcore"
-	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/systemd"
 )
 
 type journalSuite struct {
-	state *state.State
-
-	systemdVersion    string
-	systemctlArgs     [][]string
-	systemctlRestorer func()
-
-	findGidRestore   func()
-	chownPathRestore func()
+	configcoreSuite
+	systemdVersion string
 }
 
 var _ = Suite(&journalSuite{})
 
 func (s *journalSuite) SetUpTest(c *C) {
-	s.state = state.New(nil)
+	s.configcoreSuite.SetUpTest(c)
+
 	s.systemdVersion = "236"
-	s.systemctlRestorer = systemd.MockSystemctl(func(args ...string) ([]byte, error) {
+	// this overrides systemctl mock from the base configcoreSuite.
+	s.AddCleanup(systemd.MockSystemctl(func(args ...string) ([]byte, error) {
 		s.systemctlArgs = append(s.systemctlArgs, args[:])
 		output := []byte("systemd " + s.systemdVersion + "\n+XYZ")
 		return output, nil
-	})
+	}))
 	s.systemctlArgs = nil
-	dirs.SetRootDir(c.MkDir())
 
 	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/etc/"), 0755)
 	c.Assert(err, IsNil)
 
-	s.findGidRestore = configcore.MockFindGid(func(group string) (uint64, error) {
+	findGidRestore := configcore.MockFindGid(func(group string) (uint64, error) {
 		c.Assert(group, Equals, "systemd-journal")
 		return 1234, nil
 	})
+	s.AddCleanup(findGidRestore)
 
-	s.chownPathRestore = configcore.MockChownPath(func(path string, uid sys.UserID, gid sys.GroupID) error {
+	chownPathRestore := configcore.MockChownPath(func(path string, uid sys.UserID, gid sys.GroupID) error {
 		c.Check(uid, Equals, sys.UserID(0))
 		c.Check(gid, Equals, sys.GroupID(1234))
 		return nil
 	})
-}
-
-func (s *journalSuite) TearDownTest(c *C) {
-	s.systemctlRestorer()
-	dirs.SetRootDir("/")
-	s.findGidRestore()
-	s.chownPathRestore()
+	s.AddCleanup(chownPathRestore)
 }
 
 func (s *journalSuite) TestConfigurePersistentJournalInvalid(c *C) {
@@ -203,7 +192,7 @@
 		"journal.persistent": "true",
 	})
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 	c.Check(s.systemctlArgs, HasLen, 0)
 
 	exists, _, err := osutil.DirExists(filepath.Join(tmpDir, "/var/log/journal"))
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/network_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/network_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/network_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/network_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,7 +36,6 @@
 	configcoreSuite
 
 	mockNetworkSysctlPath string
-	restores              []func()
 	mockSysctl            *testutil.MockCmd
 }
 
@@ -44,23 +43,15 @@
 
 func (s *networkSuite) SetUpTest(c *C) {
 	s.configcoreSuite.SetUpTest(c)
-	dirs.SetRootDir(c.MkDir())
-	s.restores = append(s.restores, release.MockOnClassic(false))
+	s.AddCleanup(release.MockOnClassic(false))
 
 	s.mockSysctl = testutil.MockCommand(c, "sysctl", "")
-	s.restores = append(s.restores, func() { s.mockSysctl.Restore() })
+	s.AddCleanup(s.mockSysctl.Restore)
 
 	s.mockNetworkSysctlPath = filepath.Join(dirs.GlobalRootDir, "/etc/sysctl.d/10-snapd-network.conf")
 	c.Assert(os.MkdirAll(filepath.Dir(s.mockNetworkSysctlPath), 0755), IsNil)
 }
 
-func (s *networkSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-	for _, f := range s.restores {
-		f()
-	}
-}
-
 func (s *networkSuite) TestConfigureNetworkIntegrationIPv6(c *C) {
 	// disable ipv6
 	err := configcore.Run(&mockConf{
@@ -117,16 +108,13 @@
 }
 
 func (s *networkSuite) TestFilesystemOnlyApply(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"network.disable-ipv6": true,
 	})
 
 	tmpDir := c.MkDir()
 	c.Assert(os.MkdirAll(filepath.Join(tmpDir, "/etc/sysctl.d/"), 0755), IsNil)
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 
 	networkSysctlPath := filepath.Join(tmpDir, "/etc/sysctl.d/10-snapd-network.conf")
 	c.Check(networkSysctlPath, testutil.FileEquals, "net.ipv6.conf.all.disable_ipv6=1\n")
@@ -136,13 +124,10 @@
 }
 
 func (s *networkSuite) TestFilesystemOnlyApplyValidationFails(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"network.disable-ipv6": "0",
 	})
 
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), ErrorMatches, `network.disable-ipv6 can only be set to 'true' or 'false'`)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), ErrorMatches, `network.disable-ipv6 can only be set to 'true' or 'false'`)
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/picfg_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/picfg_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/picfg_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/picfg_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -54,7 +54,6 @@
 
 func (s *piCfgSuite) SetUpTest(c *C) {
 	s.configcoreSuite.SetUpTest(c)
-	dirs.SetRootDir(c.MkDir())
 	c.Assert(os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "etc"), 0755), IsNil)
 
 	s.mockConfigPath = filepath.Join(dirs.GlobalRootDir, "/boot/uboot/config.txt")
@@ -63,10 +62,6 @@
 	s.mockConfig(c, mockConfigTxt)
 }
 
-func (s *piCfgSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *piCfgSuite) mockConfig(c *C, txt string) {
 	err := ioutil.WriteFile(s.mockConfigPath, []byte(txt), 0644)
 	c.Assert(err, IsNil)
@@ -172,9 +167,6 @@
 }
 
 func (s *piCfgSuite) TestFilesystemOnlyApply(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"pi-config.gpu-mem-512": true,
 	})
@@ -186,7 +178,7 @@
 	piCfg := filepath.Join(tmpDir, "/boot/uboot/config.txt")
 	c.Assert(ioutil.WriteFile(piCfg, []byte(mockConfigTxt), 0644), IsNil)
 
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 
 	expected := strings.Replace(mockConfigTxt, "#gpu_mem_512=true", "gpu_mem_512=true", -1)
 	c.Check(piCfg, testutil.FileEquals, expected)
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/powerbtn_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/powerbtn_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/powerbtn_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/powerbtn_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,16 +42,11 @@
 
 func (s *powerbtnSuite) SetUpTest(c *C) {
 	s.configcoreSuite.SetUpTest(c)
-	dirs.SetRootDir(c.MkDir())
 	c.Assert(os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "etc"), 0755), IsNil)
 
 	s.mockPowerBtnCfg = filepath.Join(dirs.GlobalRootDir, "/etc/systemd/logind.conf.d/00-snap-core.conf")
 }
 
-func (s *powerbtnSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *powerbtnSuite) TestConfigurePowerButtonInvalid(c *C) {
 	err := configcore.SwitchHandlePowerKey("invalid-action", nil)
 	c.Check(err, ErrorMatches, `invalid action "invalid-action" supplied for system.power-key-action option`)
@@ -79,14 +74,11 @@
 }
 
 func (s *powerbtnSuite) TestFilesystemOnlyApply(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"system.power-key-action": "reboot",
 	})
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 
 	powerBtnCfg := filepath.Join(tmpDir, "/etc/systemd/logind.conf.d/00-snap-core.conf")
 	c.Check(powerBtnCfg, testutil.FileEquals, "[Login]\nHandlePowerKey=reboot\n")
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/proxy.go snapd-2.48.3+20.04/overlord/configstate/configcore/proxy.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/proxy.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/proxy.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
 
 /*
  * Copyright (C) 2017 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/proxy_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/proxy_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/proxy_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/proxy_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -51,7 +51,6 @@
 func (s *proxySuite) SetUpTest(c *C) {
 	s.configcoreSuite.SetUpTest(c)
 
-	dirs.SetRootDir(c.MkDir())
 	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/etc/"), 0755)
 	c.Assert(err, IsNil)
 	s.mockEtcEnvironment = filepath.Join(dirs.GlobalRootDir, "/etc/environment")
@@ -73,10 +72,6 @@
 	c.Assert(err, IsNil)
 }
 
-func (s *proxySuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *proxySuite) makeMockEtcEnvironment(c *C) {
 	err := ioutil.WriteFile(s.mockEtcEnvironment, []byte(`
 PATH="/usr/bin"
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/refresh.go snapd-2.48.3+20.04/overlord/configstate/configcore/refresh.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/refresh.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/refresh.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
 
 /*
  * Copyright (C) 2017-2018 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/runwithstate.go snapd-2.48.3+20.04/overlord/configstate/configcore/runwithstate.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/runwithstate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/runwithstate.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
 
 /*
  * Copyright (C) 2020 Canonical Ltd
@@ -40,6 +41,9 @@
 	// proxy.{http,https,ftp}
 	addWithStateHandler(validateProxyStore, handleProxyConfiguration, coreOnly)
 
+	// resilience.vitality-hint
+	addWithStateHandler(validateVitalitySettings, handleVitalityConfiguration, nil)
+
 	// XXX: this should become a FSOnlyHandler. We need to
 	// add/implement Changes() to the ConfGetter interface
 	// store-certs.*
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/services.go snapd-2.48.3+20.04/overlord/configstate/configcore/services.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/services.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/services.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,7 +26,9 @@
 	"path/filepath"
 	"time"
 
+	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/configstate/config"
 	"github.com/snapcore/snapd/systemd"
 )
@@ -34,6 +36,7 @@
 var services = []struct{ configName, systemdName string }{
 	{"ssh", "ssh.service"},
 	{"rsyslog", "rsyslog.service"},
+	{"console-conf", "console-conf@*"},
 }
 
 func init() {
@@ -51,23 +54,25 @@
 
 // switchDisableSSHService handles the special case of disabling/enabling ssh
 // service on core devices.
-func switchDisableSSHService(sysd systemd.Systemd, serviceName, value string, opts *fsOnlyContext) error {
+func switchDisableSSHService(sysd systemd.Systemd, serviceName string, disabled bool, opts *fsOnlyContext) error {
 	rootDir := dirs.GlobalRootDir
 	if opts != nil {
 		rootDir = opts.RootDir
+		if err := os.MkdirAll(filepath.Join(rootDir, "/etc/ssh"), 0755); err != nil {
+			return err
+		}
 	}
+
 	sshCanary := filepath.Join(rootDir, "/etc/ssh/sshd_not_to_be_run")
 
-	switch value {
-	case "true":
+	if disabled {
 		if err := ioutil.WriteFile(sshCanary, []byte("SSH has been disabled by snapd system configuration\n"), 0644); err != nil {
 			return err
 		}
 		if opts == nil {
 			return sysd.Stop(serviceName, 5*time.Minute)
 		}
-		return nil
-	case "false":
+	} else {
 		err := os.Remove(sshCanary)
 		if err != nil && !os.IsNotExist(err) {
 			return err
@@ -80,30 +85,81 @@
 		if opts == nil {
 			return sysd.Start(serviceName)
 		}
+	}
+	return nil
+}
+
+// switchDisableConsoleConfService handles the special case of
+// disabling/enabling console-conf on core devices.
+//
+// Note that this option can only be changed via gadget defaults.
+// It is not possible to tune this at runtime
+func switchDisableConsoleConfService(sysd systemd.Systemd, serviceName string, disabled bool, opts *fsOnlyContext) error {
+	consoleConfDisabled := "/var/lib/console-conf/complete"
+
+	// at runtime we can not change this setting
+	if opts == nil {
+
+		// Special case: during install mode the
+		// gadget-defaults will also be set as part of the
+		// system install change. However during install mode
+		// console-conf has no "complete" file, it just never runs
+		// in install mode. So we need to detect this and do nothing
+		// or the install mode will fail.
+		// XXX: instead of this hack we should look at the config
+		//      defaults and compare with the setting and exit if
+		//      they are the same but that requires some more changes.
+		mode, _, _ := boot.ModeAndRecoverySystemFromKernelCommandLine()
+		if mode == boot.ModeInstall {
+			return nil
+		}
+
+		hasDisabledFile := osutil.FileExists(filepath.Join(dirs.GlobalRootDir, consoleConfDisabled))
+		if disabled != hasDisabledFile {
+			return fmt.Errorf("cannot toggle console-conf at runtime, but only initially via gadget defaults")
+		}
+		return nil
+	}
+
+	if !disabled {
 		return nil
-	default:
-		return fmt.Errorf("option %q has invalid value %q", serviceName, value)
 	}
+
+	// disable console-conf at the gadget-defaults time
+	consoleConfDisabled = filepath.Join(opts.RootDir, consoleConfDisabled)
+	if err := os.MkdirAll(filepath.Dir(consoleConfDisabled), 0755); err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(consoleConfDisabled, []byte("console-conf has been disabled by the snapd system configuration\n"), 0644); err != nil {
+		return err
+	}
+
+	return nil
 }
 
 // switchDisableTypicalService switches a service in/out of disabled state
 // where "true" means disabled and "false" means enabled.
-func switchDisableService(serviceName, value string, opts *fsOnlyContext) error {
+func switchDisableService(serviceName string, disabled bool, opts *fsOnlyContext) error {
 	var sysd systemd.Systemd
 	if opts != nil {
 		sysd = systemd.NewEmulationMode(opts.RootDir)
 	} else {
-		sysd = systemd.New(dirs.GlobalRootDir, systemd.SystemMode, &sysdLogger{})
+		sysd = systemd.NewUnderRoot(dirs.GlobalRootDir, systemd.SystemMode, &sysdLogger{})
 	}
 
-	if serviceName == "ssh.service" {
-		return switchDisableSSHService(sysd, serviceName, value, opts)
+	// some services are special
+	switch serviceName {
+	case "ssh.service":
+		return switchDisableSSHService(sysd, serviceName, disabled, opts)
+	case "console-conf@*":
+		return switchDisableConsoleConfService(sysd, serviceName, disabled, opts)
 	}
 
-	switch value {
-	case "true":
-		if err := sysd.Disable(serviceName); err != nil {
-			return err
+	if disabled {
+		if opts == nil {
+			if err := sysd.Disable(serviceName); err != nil {
+				return err
+			}
 		}
 		if err := sysd.Mask(serviceName); err != nil {
 			return err
@@ -111,32 +167,42 @@
 		if opts == nil {
 			return sysd.Stop(serviceName, 5*time.Minute)
 		}
-		return nil
-	case "false":
+	} else {
 		if err := sysd.Unmask(serviceName); err != nil {
 			return err
 		}
-		if err := sysd.Enable(serviceName); err != nil {
-			return err
+		if opts == nil {
+			if err := sysd.Enable(serviceName); err != nil {
+				return err
+			}
 		}
 		if opts == nil {
 			return sysd.Start(serviceName)
 		}
-		return nil
-	default:
-		return fmt.Errorf("option %q has invalid value %q", serviceName, value)
 	}
+	return nil
 }
 
 // services that can be disabled
 func handleServiceDisableConfiguration(tr config.ConfGetter, opts *fsOnlyContext) error {
 	for _, service := range services {
-		output, err := coreCfg(tr, fmt.Sprintf("service.%s.disable", service.configName))
+		optionName := fmt.Sprintf("service.%s.disable", service.configName)
+		outputStr, err := coreCfg(tr, optionName)
 		if err != nil {
 			return err
 		}
-		if output != "" {
-			if err := switchDisableService(service.systemdName, output, opts); err != nil {
+		if outputStr != "" {
+			var disabled bool
+			switch outputStr {
+			case "true":
+				disabled = true
+			case "false":
+				disabled = false
+			default:
+				return fmt.Errorf("option %q has invalid value %q", optionName, outputStr)
+			}
+
+			if err := switchDisableService(service.systemdName, disabled, opts); err != nil {
 				return err
 			}
 		}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/services_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/services_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/services_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/services_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,12 +21,14 @@
 
 import (
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/configstate/configcore"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
@@ -35,32 +37,36 @@
 
 type servicesSuite struct {
 	configcoreSuite
-	testutil.BaseTest
 }
 
 var _ = Suite(&servicesSuite{})
 
 func (s *servicesSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
 	s.configcoreSuite.SetUpTest(c)
-	dirs.SetRootDir(c.MkDir())
 	c.Assert(os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "etc"), 0755), IsNil)
 	s.systemctlArgs = nil
 	s.BaseTest.AddCleanup(snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {}))
-}
 
-func (s *servicesSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-	s.BaseTest.TearDownTest(c)
+	// mock an empty cmdline since we check the cmdline to check whether we are
+	// in install mode or not and we don't want to use the host's proc/cmdline
+	s.AddCleanup(osutil.MockProcCmdline(filepath.Join(c.MkDir(), "proc/cmdline")))
 }
 
 func (s *servicesSuite) TestConfigureServiceInvalidValue(c *C) {
-	err := configcore.SwitchDisableService("ssh.service", "xxx", nil)
-	c.Check(err, ErrorMatches, `option "ssh.service" has invalid value "xxx"`)
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"service.ssh.disable": "xxx",
+		},
+	})
+	c.Check(err, ErrorMatches, `option "service.ssh.disable" has invalid value "xxx"`)
 }
 
 func (s *servicesSuite) TestConfigureServiceNotDisabled(c *C) {
-	err := configcore.SwitchDisableService("sshd.service", "false", nil)
+	err := configcore.SwitchDisableService("sshd.service", false, nil)
 	c.Assert(err, IsNil)
 	c.Check(s.systemctlArgs, DeepEquals, [][]string{
 		{"--root", dirs.GlobalRootDir, "unmask", "sshd.service"},
@@ -70,7 +76,7 @@
 }
 
 func (s *servicesSuite) TestConfigureServiceDisabled(c *C) {
-	err := configcore.SwitchDisableService("sshd.service", "true", nil)
+	err := configcore.SwitchDisableService("sshd.service", true, nil)
 	c.Assert(err, IsNil)
 	c.Check(s.systemctlArgs, DeepEquals, [][]string{
 		{"--root", dirs.GlobalRootDir, "disable", "sshd.service"},
@@ -104,8 +110,8 @@
 		})
 		c.Assert(err, IsNil)
 		srv := service.systemdName
-		if service.cfgName == "ssh" {
-			// SSH is special cased
+		switch service.cfgName {
+		case "ssh":
 			sshCanary := filepath.Join(dirs.GlobalRootDir, "/etc/ssh/sshd_not_to_be_run")
 			_, err := os.Stat(sshCanary)
 			c.Assert(err, IsNil)
@@ -113,7 +119,7 @@
 				{"stop", srv},
 				{"show", "--property=ActiveState", srv},
 			})
-		} else {
+		default:
 			c.Check(s.systemctlArgs, DeepEquals, [][]string{
 				{"--root", dirs.GlobalRootDir, "disable", srv},
 				{"--root", dirs.GlobalRootDir, "mask", srv},
@@ -124,6 +130,130 @@
 	}
 }
 
+func (s *servicesSuite) TestConfigureConsoleConfDisableFSOnly(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	conf := configcore.PlainCoreConfig(map[string]interface{}{
+		"service.console-conf.disable": true,
+	})
+
+	tmpDir := c.MkDir()
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
+
+	consoleConfDisabled := filepath.Join(tmpDir, "/var/lib/console-conf/complete")
+	c.Check(consoleConfDisabled, testutil.FileEquals, "console-conf has been disabled by the snapd system configuration\n")
+}
+
+func (s *servicesSuite) TestConfigureConsoleConfEnabledFSOnly(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	conf := configcore.PlainCoreConfig(map[string]interface{}{
+		"service.console-conf.disable": false,
+	})
+
+	tmpDir := c.MkDir()
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
+
+	consoleConfDisabled := filepath.Join(tmpDir, "/var/lib/console-conf/complete")
+	c.Check(consoleConfDisabled, testutil.FileAbsent)
+}
+
+func (s *servicesSuite) TestConfigureConsoleConfEnableNotAtRuntime(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	// pretend that console-conf is disabled
+	canary := filepath.Join(dirs.GlobalRootDir, "/var/lib/console-conf/complete")
+	err := os.MkdirAll(filepath.Dir(canary), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(canary, nil, 0644)
+	c.Assert(err, IsNil)
+
+	// now enable it
+	err = configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"service.console-conf.disable": false,
+		},
+	})
+	c.Assert(err, ErrorMatches, "cannot toggle console-conf at runtime, but only initially via gadget defaults")
+}
+
+func (s *servicesSuite) TestConfigureConsoleConfDisableNotAtRuntime(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	// console-conf is not disabled, i.e. there is no
+	// "/var/lib/console-conf/complete" file
+
+	// now try to enable it
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"service.console-conf.disable": true,
+		},
+	})
+	c.Assert(err, ErrorMatches, "cannot toggle console-conf at runtime, but only initially via gadget defaults")
+}
+
+func (s *servicesSuite) TestConfigureConsoleConfEnableAlreadyEnabledIsFine(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	// Note that we have no
+	//        /var/lib/console-conf/complete
+	// file. So console-conf is already enabled
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"service.console-conf.disable": false,
+		},
+	})
+	c.Assert(err, IsNil)
+}
+
+func (s *servicesSuite) TestConfigureConsoleConfDisableAlreadyDisabledIsFine(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	// pretend that console-conf is disabled
+	canary := filepath.Join(dirs.GlobalRootDir, "/var/lib/console-conf/complete")
+	err := os.MkdirAll(filepath.Dir(canary), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(canary, nil, 0644)
+	c.Assert(err, IsNil)
+
+	err = configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"service.console-conf.disable": true,
+		},
+	})
+	c.Assert(err, IsNil)
+}
+
+func (s *servicesSuite) TestConfigureConsoleConfEnableDuringInstallMode(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	mockProcCmdline := filepath.Join(c.MkDir(), "cmdline")
+	err := ioutil.WriteFile(mockProcCmdline, []byte("snapd_recovery_mode=install snapd_recovery_system=20201212\n"), 0644)
+	c.Assert(err, IsNil)
+	restore = osutil.MockProcCmdline(mockProcCmdline)
+	defer restore()
+
+	err = configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"service.console-conf.disable": true,
+		},
+	})
+	// no error because we are in install mode
+	c.Assert(err, IsNil)
+}
+
 func (s *servicesSuite) TestConfigureServiceEnableIntegration(c *C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -148,8 +278,8 @@
 
 		c.Assert(err, IsNil)
 		srv := service.systemdName
-		if service.cfgName == "ssh" {
-			// SSH is special cased
+		switch service.cfgName {
+		case "ssh":
 			c.Check(s.systemctlArgs, DeepEquals, [][]string{
 				{"--root", dirs.GlobalRootDir, "unmask", "sshd.service"},
 				{"--root", dirs.GlobalRootDir, "unmask", "ssh.service"},
@@ -158,7 +288,7 @@
 			sshCanary := filepath.Join(dirs.GlobalRootDir, "/etc/ssh/sshd_not_to_be_run")
 			_, err := os.Stat(sshCanary)
 			c.Assert(err, ErrorMatches, ".* no such file or directory")
-		} else {
+		default:
 			c.Check(s.systemctlArgs, DeepEquals, [][]string{
 				{"--root", dirs.GlobalRootDir, "unmask", srv},
 				{"--root", dirs.GlobalRootDir, "enable", srv},
@@ -186,9 +316,6 @@
 }
 
 func (s *servicesSuite) TestFilesystemOnlyApply(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	tmpDir := c.MkDir()
 	c.Assert(os.MkdirAll(filepath.Join(tmpDir, "etc", "ssh"), 0755), IsNil)
 
@@ -196,9 +323,8 @@
 		"service.ssh.disable":     "true",
 		"service.rsyslog.disable": "true",
 	})
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 	c.Check(s.systemctlArgs, DeepEquals, [][]string{
-		{"--root", tmpDir, "disable", "rsyslog.service"},
 		{"--root", tmpDir, "mask", "rsyslog.service"},
 	})
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/snapshots.go snapd-2.48.3+20.04/overlord/configstate/configcore/snapshots.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/snapshots.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/snapshots.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,5 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
 
 /*
  * Copyright (C) 2019 Canonical Ltd
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/sysctl.go snapd-2.48.3+20.04/overlord/configstate/configcore/sysctl.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/sysctl.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/sysctl.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,118 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package configcore
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/systemd"
+)
+
+// see https://www.kernel.org/doc/Documentation/sysctl/kernel.txt
+// The idea is that options of the form system.kernel. should
+// match the (/proc/)sys/kernel hierarchy etc.
+
+func init() {
+	// add supported configuration of this module
+	supportedConfigurations["core.system.kernel.printk.console-loglevel"] = true
+}
+
+const (
+	sysctlConfsDir  = "/etc/sysctl.d"
+	snapdSysctlConf = "99-snapd.conf"
+)
+
+// these are the sysctl parameters prefixes we handle
+var sysctlPrefixes = []string{"kernel.printk"}
+
+func validateSysctlOptions(tr config.ConfGetter) error {
+	consoleLoglevelStr, err := coreCfg(tr, "system.kernel.printk.console-loglevel")
+	if err != nil {
+		return err
+	}
+	if consoleLoglevelStr != "" {
+		if n, err := strconv.ParseUint(consoleLoglevelStr, 10, 8); err != nil || (n < 0 || n > 7) {
+			return fmt.Errorf("console-loglevel must be a number between 0 and 7, not: %s", consoleLoglevelStr)
+		}
+	}
+	return nil
+}
+
+func handleSysctlConfiguration(tr config.ConfGetter, opts *fsOnlyContext) error {
+	root := dirs.GlobalRootDir
+	if opts != nil {
+		root = opts.RootDir
+	}
+
+	consoleLoglevelStr, err := coreCfg(tr, "system.kernel.printk.console-loglevel")
+	if err != nil {
+		return nil
+	}
+
+	content := bytes.NewBuffer(nil)
+	if consoleLoglevelStr != "" {
+		content.WriteString(fmt.Sprintf("kernel.printk = %s 4 1 7\n", consoleLoglevelStr))
+	} else {
+		// Don't write values to content so that the config
+		// file gets removed and console-loglevel gets reset
+		// to default value from 10-console-messages.conf
+
+		// TODO: this logic will need more non-obvious work to support
+		// kernel parameters that don't have already on-disk defaults.
+	}
+	dirContent := map[string]osutil.FileState{}
+	if content.Len() > 0 {
+		dirContent[snapdSysctlConf] = &osutil.MemoryFileState{
+			Content: content.Bytes(),
+			Mode:    0644,
+		}
+	}
+
+	dir := filepath.Join(root, sysctlConfsDir)
+	if opts != nil {
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			return err
+		}
+	}
+
+	// write the new config
+	glob := snapdSysctlConf
+	changed, removed, err := osutil.EnsureDirState(dir, glob, dirContent)
+	if err != nil {
+		return err
+	}
+
+	if opts == nil {
+		if len(changed) > 0 || len(removed) > 0 {
+			// apply our configuration or default configuration
+			// via systemd-sysctl for the relevant prefixes
+			return systemd.Sysctl(sysctlPrefixes)
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/sysctl_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/sysctl_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/sysctl_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/sysctl_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,140 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package configcore_test
+
+import (
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/configstate/configcore"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type sysctlSuite struct {
+	configcoreSuite
+
+	mockSysctlConfPath string
+}
+
+var _ = Suite(&sysctlSuite{})
+
+func (s *sysctlSuite) SetUpTest(c *C) {
+	s.configcoreSuite.SetUpTest(c)
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(release.MockOnClassic(false))
+
+	s.mockSysctlConfPath = filepath.Join(dirs.GlobalRootDir, "/etc/sysctl.d/99-snapd.conf")
+	c.Assert(os.MkdirAll(filepath.Dir(s.mockSysctlConfPath), 0755), IsNil)
+}
+
+func (s *sysctlSuite) TearDownTest(c *C) {
+	s.configcoreSuite.TearDownTest(c)
+	dirs.SetRootDir("/")
+}
+
+func (s *sysctlSuite) TestConfigureSysctlIntegration(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"system.kernel.printk.console-loglevel": "2",
+		},
+	})
+	c.Assert(err, IsNil)
+	c.Check(s.mockSysctlConfPath, testutil.FileEquals, "kernel.printk = 2 4 1 7\n")
+	c.Check(s.systemdSysctlArgs, DeepEquals, [][]string{
+		{"--prefix", "kernel.printk"},
+	})
+	s.systemdSysctlArgs = nil
+
+	// Unset console-loglevel and restore default vaule
+	err = configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"system.kernel.printk.console-loglevel": "",
+		},
+	})
+	c.Assert(err, IsNil)
+	c.Check(osutil.FileExists(s.mockSysctlConfPath), Equals, false)
+	c.Check(s.systemdSysctlArgs, DeepEquals, [][]string{
+		{"--prefix", "kernel.printk"},
+	})
+}
+
+func (s *sysctlSuite) TestConfigureLoglevelUnderRange(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"system.kernel.printk.console-loglevel": "-1",
+		},
+	})
+	c.Check(osutil.FileExists(s.mockSysctlConfPath), Equals, false)
+	c.Assert(err, ErrorMatches, `console-loglevel must be a number between 0 and 7, not: -1`)
+}
+
+func (s *sysctlSuite) TestConfigureLoglevelOverRange(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"system.kernel.printk.console-loglevel": "8",
+		},
+	})
+	c.Check(osutil.FileExists(s.mockSysctlConfPath), Equals, false)
+	c.Assert(err, ErrorMatches, `console-loglevel must be a number between 0 and 7, not: 8`)
+}
+
+func (s *sysctlSuite) TestConfigureLevelRejected(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"system.kernel.printk.console-loglevel": "invalid",
+		},
+	})
+	c.Check(osutil.FileExists(s.mockSysctlConfPath), Equals, false)
+	c.Assert(err, ErrorMatches, `console-loglevel must be a number between 0 and 7, not: invalid`)
+}
+
+func (s *sysctlSuite) TestConfigureSysctlIntegrationNoSetting(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf:  map[string]interface{}{},
+	})
+	c.Assert(err, IsNil)
+	c.Check(osutil.FileExists(s.mockSysctlConfPath), Equals, false)
+}
+
+func (s *sysctlSuite) TestFilesystemOnlyApply(c *C) {
+	conf := configcore.PlainCoreConfig(map[string]interface{}{
+		"system.kernel.printk.console-loglevel": "4",
+	})
+
+	tmpDir := c.MkDir()
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
+
+	networkSysctlPath := filepath.Join(tmpDir, "/etc/sysctl.d/99-snapd.conf")
+	c.Check(networkSysctlPath, testutil.FileEquals, "kernel.printk = 4 4 1 7\n")
+
+	// systemd-sysctl was not executed
+	c.Check(s.systemdSysctlArgs, HasLen, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/timezone.go snapd-2.48.3+20.04/overlord/configstate/configcore/timezone.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/timezone.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/timezone.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,96 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package configcore
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/configstate/config"
+)
+
+func init() {
+	// add supported configuration of this module
+	supportedConfigurations["core.system.timezone"] = true
+}
+
+var validTimezone = regexp.MustCompile(`^[a-zA-Z0-9+_-]+(/[a-zA-Z0-9+_-]+)?(/[a-zA-Z0-9+_-]+)?$`).MatchString
+
+func validateTimezoneSettings(tr config.ConfGetter) error {
+	timezone, err := coreCfg(tr, "system.timezone")
+	if err != nil {
+		return err
+	}
+	if timezone == "" {
+		return nil
+	}
+	if !validTimezone(timezone) {
+		return fmt.Errorf("cannot set timezone %q: name not valid", timezone)
+	}
+
+	return nil
+}
+
+func handleTimezoneConfiguration(tr config.ConfGetter, opts *fsOnlyContext) error {
+	// TODO: convert to "virtual" configuration nodes once we have support
+	// for this. The current code is not ideal because if one calls
+	// `snap get system system.hostname` the answer can be ""
+	// when not set via snap set.
+	//
+	// It will also override any hostname on the next `snap set` run
+	// that was written not using `snap set system system.hostname`.
+	timezone, err := coreCfg(tr, "system.timezone")
+	if err != nil {
+		return nil
+	}
+	// nothing to do
+	if timezone == "" {
+		return nil
+	}
+	// runtime system
+	if opts == nil {
+		output, err := exec.Command("timedatectl", "set-timezone", timezone).CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("cannot set timezone: %v", osutil.OutputErr(output, err))
+		}
+	} else {
+		// On the UC16/UC18/UC20 images the file /etc/hostname is a
+		// symlink to /etc/writable/hostname. The /etc/hostname is
+		// not part of the "writable-path" so we must set the file
+		// in /etc/writable here for this to work.
+		localtimePath := filepath.Join(opts.RootDir, "/etc/writable/localtime")
+		if err := os.MkdirAll(filepath.Dir(localtimePath), 0755); err != nil {
+			return err
+		}
+		if err := os.Symlink(filepath.Join("/usr/share/zoneinfo", timezone), localtimePath); err != nil {
+			return err
+		}
+		timezonePath := filepath.Join(opts.RootDir, "/etc/writable/timezone")
+		if err := osutil.AtomicWriteFile(timezonePath, []byte(timezone+"\n"), 0644, 0); err != nil {
+			return fmt.Errorf("cannot write timezone: %v", err)
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/timezone_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/timezone_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/timezone_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/timezone_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,102 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package configcore_test
+
+import (
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord/configstate/configcore"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type timezoneSuite struct {
+	configcoreSuite
+}
+
+var _ = Suite(&timezoneSuite{})
+
+func (s *timezoneSuite) SetUpTest(c *C) {
+	s.configcoreSuite.SetUpTest(c)
+
+	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/etc/"), 0755)
+	c.Assert(err, IsNil)
+}
+
+func (s *timezoneSuite) TestConfigureTimezoneInvalid(c *C) {
+	invalidTimezones := []string{
+		"no-#", "no-ä", "no/triple/slash/",
+	}
+
+	for _, tz := range invalidTimezones {
+		err := configcore.Run(&mockConf{
+			state: s.state,
+			conf: map[string]interface{}{
+				"system.timezone": tz,
+			},
+		})
+		c.Assert(err, ErrorMatches, `cannot set timezone.*`)
+	}
+}
+
+func (s *timezoneSuite) TestConfigureTimezoneIntegration(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	mockedTimedatectl := testutil.MockCommand(c, "timedatectl", "")
+	defer mockedTimedatectl.Restore()
+
+	validTimezones := []string{
+		"UTC", "Europe/Malta", "US/Indiana-Starke", "Africa/Sao_Tome",
+		"America/Argentina/Cordoba", "America/Argentina/La_Rioja",
+		"Etc/GMT+1", "CST6CDT", "GMT0", "GMT-0", "PST8PDT",
+	}
+
+	for _, tz := range validTimezones {
+		err := configcore.Run(&mockConf{
+			state: s.state,
+			conf: map[string]interface{}{
+				"system.timezone": tz,
+			},
+		})
+		c.Assert(err, IsNil)
+		c.Check(mockedTimedatectl.Calls(), DeepEquals, [][]string{
+			{"timedatectl", "set-timezone", tz},
+		})
+		mockedTimedatectl.ForgetCalls()
+	}
+}
+
+func (s *timezoneSuite) TestFilesystemOnlyApply(c *C) {
+	conf := configcore.PlainCoreConfig(map[string]interface{}{
+		"system.timezone": "Europe/Berlin",
+	})
+	tmpDir := c.MkDir()
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
+
+	c.Check(filepath.Join(tmpDir, "/etc/writable/timezone"), testutil.FileEquals, "Europe/Berlin\n")
+	p, err := os.Readlink(filepath.Join(tmpDir, "/etc/writable/localtime"))
+	c.Assert(err, IsNil)
+	c.Check(p, Equals, "/usr/share/zoneinfo/Europe/Berlin")
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/vitality.go snapd-2.48.3+20.04/overlord/configstate/configcore/vitality.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/vitality.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/vitality.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,155 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nomanagers
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package configcore
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/progress"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/naming"
+	"github.com/snapcore/snapd/timings"
+	"github.com/snapcore/snapd/wrappers"
+)
+
+const vitalityOpt = "resilience.vitality-hint"
+
+func init() {
+	// add supported configuration of this module
+	supportedConfigurations["core."+vitalityOpt] = true
+}
+
+func handleVitalityConfiguration(tr config.Conf, opts *fsOnlyContext) error {
+	var pristineVitalityStr, newVitalityStr string
+
+	if err := tr.GetPristine("core", vitalityOpt, &pristineVitalityStr); err != nil && !config.IsNoOption(err) {
+		return err
+	}
+	if err := tr.Get("core", vitalityOpt, &newVitalityStr); err != nil && !config.IsNoOption(err) {
+		return err
+	}
+	if pristineVitalityStr == newVitalityStr {
+		return nil
+	}
+
+	st := tr.State()
+	st.Lock()
+	defer st.Unlock()
+
+	oldVitalityMap := map[string]int{}
+	newVitalityMap := map[string]int{}
+	// assign "0" (delete) rank to all old entries
+	for i, instanceName := range strings.Split(pristineVitalityStr, ",") {
+		oldVitalityMap[instanceName] = i + 1
+		newVitalityMap[instanceName] = 0
+	}
+	// build rank of the new entries
+	for i, instanceName := range strings.Split(newVitalityStr, ",") {
+		newVitalityMap[instanceName] = i + 1
+	}
+
+	for instanceName, rank := range newVitalityMap {
+		var snapst snapstate.SnapState
+		err := snapstate.Get(st, instanceName, &snapst)
+		// not installed, vitality-score will applied when the snap
+		// gets installed
+		if err == state.ErrNoState {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		// not active, vitality-score will applied when the snap
+		// becomes active
+		if !snapst.Active {
+			continue
+		}
+		info, err := snapst.CurrentInfo()
+		if err != nil {
+			return err
+		}
+
+		// nothing to do if rank is unchanged
+		if oldVitalityMap[instanceName] == newVitalityMap[instanceName] {
+			continue
+		}
+
+		// TODO: this should become some kind of Ensure*
+		// method in wrappers
+		disabledSvcs, err := wrappers.QueryDisabledServices(info, progress.Null)
+		if err != nil {
+			return err
+		}
+
+		// rank changed, rewrite/restart services
+		for _, app := range info.Apps {
+			if !app.IsService() {
+				continue
+			}
+
+			opts := &wrappers.AddSnapServicesOptions{VitalityRank: rank}
+			if err := wrappers.AddSnapServices(info, disabledSvcs, opts, progress.Null); err != nil {
+				return err
+			}
+		}
+		// XXX: copied from handlers.go:startSnapServices()
+		svcs := info.Services()
+		startupOrdered, err := snap.SortServices(svcs)
+		if err != nil {
+			return err
+		}
+		tm := timings.New(nil)
+		if err = wrappers.StartServices(startupOrdered, nil, nil, progress.Null, tm); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func validateVitalitySettings(tr config.Conf) error {
+	option, err := coreCfg(tr, vitalityOpt)
+	if err != nil {
+		return err
+	}
+	if option == "" {
+		return nil
+	}
+	vitalityHints := strings.Split(option, ",")
+	if len(vitalityHints) > 100 {
+		return fmt.Errorf("cannot set more than 100 snaps in %q: got %v", vitalityOpt, len(vitalityHints))
+	}
+	for _, instanceName := range vitalityHints {
+		if err := naming.ValidateInstance(instanceName); err != nil {
+			return fmt.Errorf("cannot set %q: %v", vitalityOpt, err)
+		}
+		// The "snapd" snap is always at OOMScoreAdjust=-900.
+		if instanceName == "snapd" {
+			return fmt.Errorf("cannot set %q: snapd snap vitality cannot be changed", vitalityOpt)
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/vitality_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/vitality_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/vitality_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/vitality_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,273 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package configcore_test
+
+import (
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord/configstate/configcore"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type vitalitySuite struct {
+	configcoreSuite
+}
+
+var _ = Suite(&vitalitySuite{})
+
+func (s *vitalitySuite) TestConfigureVitalityUnhappyName(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "-invalid-snap-name!yf",
+		},
+	})
+	c.Assert(err, ErrorMatches, `cannot set "resilience.vitality-hint": invalid snap name: ".*"`)
+}
+
+func (s *vitalitySuite) TestConfigureVitalityNoSnapd(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "snapd",
+		},
+	})
+	c.Assert(err, ErrorMatches, `cannot set "resilience.vitality-hint": snapd snap vitality cannot be changed`)
+}
+
+func (s *vitalitySuite) TestConfigureVitalityhappyName(c *C) {
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "valid-snapname",
+		},
+	})
+	c.Assert(err, IsNil)
+	// no snap named "valid-snapname" is installed, so no systemd action
+	c.Check(s.systemctlArgs, HasLen, 0)
+}
+
+var mockSnapWithService = `name: test-snap
+version: 1.0
+apps:
+ foo:
+  daemon: simple
+`
+
+func (s *vitalitySuite) TestConfigureVitalityWithValidSnap(c *C) {
+	si := &snap.SideInfo{RealName: "test-snap", Revision: snap.R(1)}
+	snaptest.MockSnap(c, mockSnapWithService, si)
+	s.state.Lock()
+	snapstate.Set(s.state, "test-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{si},
+		Current:  snap.R(1),
+		Active:   true,
+		SnapType: "app",
+	})
+	s.state.Unlock()
+
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "unrelated,test-snap",
+		},
+	})
+	c.Assert(err, IsNil)
+	svcName := "snap.test-snap.foo.service"
+	c.Check(s.systemctlArgs, DeepEquals, [][]string{
+		{"is-enabled", "snap.test-snap.foo.service"},
+		{"enable", "snap.test-snap.foo.service"},
+		{"daemon-reload"},
+		{"is-enabled", "snap.test-snap.foo.service"},
+		{"start", "snap.test-snap.foo.service"},
+	})
+	svcPath := filepath.Join(dirs.SnapServicesDir, svcName)
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-898\n")
+}
+
+func (s *vitalitySuite) TestConfigureVitalityHintTooMany(c *C) {
+	l := make([]string, 101)
+	for i := range l {
+		l[i] = strconv.Itoa(i)
+	}
+	manyStr := strings.Join(l, ",")
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": manyStr,
+		},
+	})
+	c.Assert(err, ErrorMatches, `cannot set more than 100 snaps in "resilience.vitality-hint": got 101`)
+}
+
+func (s *vitalitySuite) TestConfigureVitalityManySnaps(c *C) {
+	for _, snapName := range []string{"snap1", "snap2", "snap3"} {
+		si := &snap.SideInfo{RealName: snapName, Revision: snap.R(1)}
+		snaptest.MockSnap(c, mockSnapWithService, si)
+		s.state.Lock()
+		snapstate.Set(s.state, snapName, &snapstate.SnapState{
+			Sequence: []*snap.SideInfo{si},
+			Current:  snap.R(1),
+			Active:   true,
+			SnapType: "app",
+		})
+		s.state.Unlock()
+	}
+
+	// snap1,snap2,snap3
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "snap1,snap2,snap3",
+		},
+	})
+	c.Assert(err, IsNil)
+	// test
+	svcPath := filepath.Join(dirs.SnapServicesDir, "snap.snap1.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-899\n")
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap2.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-898\n")
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap3.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-897\n")
+}
+
+func (s *vitalitySuite) TestConfigureVitalityManySnapsDelta(c *C) {
+	for _, snapName := range []string{"snap1", "snap2", "snap3"} {
+		si := &snap.SideInfo{RealName: snapName, Revision: snap.R(1)}
+		snaptest.MockSnap(c, mockSnapWithService, si)
+		s.state.Lock()
+		snapstate.Set(s.state, snapName, &snapstate.SnapState{
+			Sequence: []*snap.SideInfo{si},
+			Current:  snap.R(1),
+			Active:   true,
+			SnapType: "app",
+		})
+		s.state.Unlock()
+	}
+
+	// snap1,snap2,snap3 switch to snap3,snap1
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"resilience.vitality-hint": "snap1,snap2,snap3",
+		},
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "snap3,snap1",
+		},
+	})
+	c.Assert(err, IsNil)
+	// test that snap1,snap3 got the new rank
+	svcPath := filepath.Join(dirs.SnapServicesDir, "snap.snap1.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-898")
+	// and that snap2 no longer has a OOMScoreAdjust setting
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap2.foo.service")
+	c.Check(svcPath, Not(testutil.FileContains), "\nOOMScoreAdjust=")
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap3.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-899\n")
+}
+
+func (s *vitalitySuite) TestConfigureVitalityManySnapsOneRemovedOneUnchanged(c *C) {
+	for _, snapName := range []string{"snap1", "snap2", "snap3"} {
+		si := &snap.SideInfo{RealName: snapName, Revision: snap.R(1)}
+		snaptest.MockSnap(c, mockSnapWithService, si)
+		s.state.Lock()
+		snapstate.Set(s.state, snapName, &snapstate.SnapState{
+			Sequence: []*snap.SideInfo{si},
+			Current:  snap.R(1),
+			Active:   true,
+			SnapType: "app",
+		})
+		s.state.Unlock()
+	}
+
+	// first run generates the snap1,snap2 configs
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "snap1,snap2",
+		},
+	})
+	c.Assert(err, IsNil)
+	svcPath := filepath.Join(dirs.SnapServicesDir, "snap.snap1.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-899")
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap2.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-898\n")
+	c.Check(s.systemctlArgs, testutil.DeepContains, []string{"start", "snap.snap1.foo.service"})
+	c.Check(s.systemctlArgs, testutil.DeepContains, []string{"start", "snap.snap2.foo.service"})
+	s.systemctlArgs = nil
+
+	// now we change the configuration and set snap1,snap3
+	err = configcore.Run(&mockConf{
+		state: s.state,
+		conf: map[string]interface{}{
+			"resilience.vitality-hint": "snap1,snap2",
+		},
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "snap1,snap3",
+		},
+	})
+	c.Assert(err, IsNil)
+	// test that snap1 is unchanged
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap1.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-899")
+	// and that snap2 no longer has a OOMScoreAdjust setting
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap2.foo.service")
+	c.Check(svcPath, Not(testutil.FileContains), "\nOOMScoreAdjust=")
+	// snap3 got added
+	svcPath = filepath.Join(dirs.SnapServicesDir, "snap.snap3.foo.service")
+	c.Check(svcPath, testutil.FileContains, "\nOOMScoreAdjust=-898\n")
+
+	// ensure that snap1 did not get started again (it is unchanged)
+	c.Check(s.systemctlArgs, Not(testutil.DeepContains), []string{"start", "snap.snap1.foo.service"})
+	// snap2 changed (no OOMScoreAdjust anymore) so needs restart
+	c.Check(s.systemctlArgs, testutil.DeepContains, []string{"start", "snap.snap2.foo.service"})
+	// snap3 changed so needs restart
+	c.Check(s.systemctlArgs, testutil.DeepContains, []string{"start", "snap.snap3.foo.service"})
+}
+
+func (s *vitalitySuite) TestConfigureVitalityNotActiveSnap(c *C) {
+	si := &snap.SideInfo{RealName: "test-snap", Revision: snap.R(1)}
+	snaptest.MockSnap(c, mockSnapWithService, si)
+	s.state.Lock()
+	snapstate.Set(s.state, "test-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{si},
+		Current:  snap.R(1),
+		Active:   false,
+		SnapType: "app",
+	})
+	s.state.Unlock()
+
+	err := configcore.Run(&mockConf{
+		state: s.state,
+		changes: map[string]interface{}{
+			"resilience.vitality-hint": "unrelated,test-snap",
+		},
+	})
+	c.Assert(err, IsNil)
+	c.Check(s.systemctlArgs, HasLen, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/watchdog.go snapd-2.48.3+20.04/overlord/configstate/configcore/watchdog.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/watchdog.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/watchdog.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,6 +29,7 @@
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/systemd"
 )
 
 func init() {
@@ -38,10 +39,15 @@
 }
 
 func updateWatchdogConfig(config map[string]uint, opts *fsOnlyContext) error {
+	var sysd systemd.Systemd
+
 	dir := dirs.SnapSystemdConfDir
 	if opts != nil {
 		dir = dirs.SnapSystemdConfDirUnder(opts.RootDir)
+	} else {
+		sysd = systemd.NewUnderRoot(dirs.GlobalRootDir, systemd.SystemMode, &sysdLogger{})
 	}
+
 	name := "10-snapd-watchdog.conf"
 	dirContent := make(map[string]osutil.FileState, 1)
 
@@ -66,8 +72,17 @@
 	}
 
 	glob := name
-	_, _, err := osutil.EnsureDirState(dir, glob, dirContent)
-	return err
+	changed, removed, err := osutil.EnsureDirState(dir, glob, dirContent)
+	if err != nil {
+		return err
+	}
+
+	// something was changed, reexec systemd manager
+	if sysd != nil && (len(changed) > 0 || len(removed) > 0) {
+		return sysd.DaemonReexec()
+	}
+
+	return nil
 }
 
 func handleWatchdogConfiguration(tr config.ConfGetter, opts *fsOnlyContext) error {
diff -Nru snapd-2.45.1+20.04.2/overlord/configstate/configcore/watchdog_test.go snapd-2.48.3+20.04/overlord/configstate/configcore/watchdog_test.go
--- snapd-2.45.1+20.04.2/overlord/configstate/configcore/watchdog_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/configstate/configcore/watchdog_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -46,14 +46,9 @@
 func (s *watchdogSuite) SetUpTest(c *C) {
 	s.configcoreSuite.SetUpTest(c)
 
-	dirs.SetRootDir(c.MkDir())
 	s.mockEtcEnvironment = filepath.Join(dirs.SnapSystemdConfDir, "10-snapd-watchdog.conf")
 }
 
-func (s *watchdogSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("/")
-}
-
 func (s *watchdogSuite) TestConfigureWatchdog(c *C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -78,6 +73,11 @@
 		c.Check(s.mockEtcEnvironment, testutil.FileEquals,
 			fmt.Sprintf("[Manager]\n%s=%s\n", systemdOption, val))
 	}
+
+	c.Check(s.systemctlArgs, DeepEquals, [][]string{
+		{"daemon-reexec"},
+		{"daemon-reexec"},
+	})
 }
 
 func (s *watchdogSuite) TestConfigureWatchdogUnits(c *C) {
@@ -121,6 +121,10 @@
 	c.Check(s.mockEtcEnvironment, testutil.FileEquals, "[Manager]\n"+
 		fmt.Sprintf("RuntimeWatchdogSec=%d\n", times[0])+
 		fmt.Sprintf("ShutdownWatchdogSec=%d\n", times[1]))
+
+	c.Check(s.systemctlArgs, DeepEquals, [][]string{
+		{"daemon-reexec"},
+	})
 }
 
 func (s *watchdogSuite) TestConfigureWatchdogAllConfDirExistsAlready(c *C) {
@@ -143,6 +147,10 @@
 	c.Check(s.mockEtcEnvironment, testutil.FileEquals, "[Manager]\n"+
 		fmt.Sprintf("RuntimeWatchdogSec=%d\n", times[0])+
 		fmt.Sprintf("ShutdownWatchdogSec=%d\n", times[1]))
+
+	c.Check(s.systemctlArgs, DeepEquals, [][]string{
+		{"daemon-reexec"},
+	})
 }
 
 func (s *watchdogSuite) TestConfigureWatchdogBadFormat(c *C) {
@@ -164,6 +172,8 @@
 		})
 		c.Assert(err, ErrorMatches, badVal.err)
 	}
+
+	c.Check(s.systemctlArgs, HasLen, 0)
 }
 
 func (s *watchdogSuite) TestConfigureWatchdogNoFileUpdate(c *C) {
@@ -200,6 +210,8 @@
 	info, err = os.Stat(s.mockEtcEnvironment)
 	c.Assert(err, IsNil)
 	c.Assert(info.ModTime(), Equals, fileModTime)
+
+	c.Check(s.systemctlArgs, HasLen, 0)
 }
 
 func (s *watchdogSuite) TestConfigureWatchdogRemovesIfEmpty(c *C) {
@@ -233,31 +245,30 @@
 	c.Check(osutil.FileExists(s.mockEtcEnvironment), Equals, false)
 	// but the canary is still here
 	c.Check(osutil.FileExists(canary), Equals, true)
+
+	// apply defaults
+	c.Check(s.systemctlArgs, DeepEquals, [][]string{
+		{"daemon-reexec"},
+	})
 }
 
 func (s *watchdogSuite) TestFilesystemOnlyApply(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"watchdog.runtime-timeout": "4s",
 	})
 
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), IsNil)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), IsNil)
 
 	watchdogCfg := filepath.Join(tmpDir, "/etc/systemd/system.conf.d/10-snapd-watchdog.conf")
 	c.Check(watchdogCfg, testutil.FileEquals, "[Manager]\nRuntimeWatchdogSec=4\n")
 }
 
 func (s *watchdogSuite) TestFilesystemOnlyApplyValidationFails(c *C) {
-	restorer := release.MockOnClassic(false)
-	defer restorer()
-
 	conf := configcore.PlainCoreConfig(map[string]interface{}{
 		"watchdog.runtime-timeout": "foo",
 	})
 
 	tmpDir := c.MkDir()
-	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf), ErrorMatches, `cannot parse "foo": time: invalid duration \"?foo\"?`)
+	c.Assert(configcore.FilesystemOnlyApply(tmpDir, conf, nil), ErrorMatches, `cannot parse "foo": time: invalid duration \"?foo\"?`)
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicemgr.go snapd-2.48.3+20.04/overlord/devicestate/devicemgr.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicemgr.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicemgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,8 @@
 package devicestate
 
 import (
+	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -34,27 +36,45 @@
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/assertstate"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/devicestate/fde"
 	"github.com/snapcore/snapd/overlord/devicestate/internal"
 	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/overlord/storecontext"
+	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/release"
-	"github.com/snapcore/snapd/seed"
+	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snapdenv"
+	"github.com/snapcore/snapd/sysconfig"
+	"github.com/snapcore/snapd/systemd"
 	"github.com/snapcore/snapd/timings"
 )
 
+var (
+	cloudInitStatus   = sysconfig.CloudInitStatus
+	restrictCloudInit = sysconfig.RestrictCloudInit
+)
+
 // DeviceManager is responsible for managing the device identity and device
 // policies.
 type DeviceManager struct {
 	systemMode string
+	// saveAvailable keeps track whether /var/lib/snapd/save
+	// is available, i.e. exists and is mounted from ubuntu-save
+	// if the latter exists.
+	// TODO: evolve this to state to track things if we start mounting
+	// save as rw vs ro, or mount/umount it fully on demand
+	saveAvailable bool
 
-	state      *state.State
-	keypairMgr asserts.KeypairManager
+	state   *state.State
+	hookMgr *hookstate.HookManager
+
+	cachedKeypairMgr asserts.KeypairManager
 
 	// newStore can make new stores for remodeling
 	newStore func(storecontext.DeviceBackend) snapstate.StoreService
@@ -66,6 +86,10 @@
 
 	ensureInstalledRan bool
 
+	cloudInitAlreadyRestricted           bool
+	cloudInitErrorAttemptStart           *time.Time
+	cloudInitEnabledInactiveAttemptStart *time.Time
+
 	lastBecomeOperationalAttempt time.Time
 	becomeOperationalBackoff     time.Duration
 	registered                   bool
@@ -78,20 +102,15 @@
 func Manager(s *state.State, hookManager *hookstate.HookManager, runner *state.TaskRunner, newStore func(storecontext.DeviceBackend) snapstate.StoreService) (*DeviceManager, error) {
 	delayedCrossMgrInit()
 
-	keypairMgr, err := asserts.OpenFSKeypairManager(dirs.SnapDeviceDir)
-	if err != nil {
-		return nil, err
-	}
-
 	m := &DeviceManager{
-		state:      s,
-		keypairMgr: keypairMgr,
-		newStore:   newStore,
-		reg:        make(chan struct{}),
-		preseed:    snapdenv.Preseeding(),
+		state:    s,
+		hookMgr:  hookManager,
+		newStore: newStore,
+		reg:      make(chan struct{}),
+		preseed:  snapdenv.Preseeding(),
 	}
 
-	modeEnv, err := m.maybeReadModeenv()
+	modeEnv, err := maybeReadModeenv()
 	if err != nil {
 		return nil, err
 	}
@@ -129,10 +148,15 @@
 
 	runner.AddBlocked(gadgetUpdateBlocked)
 
+	// wire FDE kernel hook support into boot
+	boot.HasFDESetupHook = m.hasFDESetupHook
+	boot.RunFDESetupHook = m.runFDESetupHook
+	hookManager.Register(regexp.MustCompile("^fde-setup$"), newFdeSetupHandler)
+
 	return m, nil
 }
 
-func (m *DeviceManager) maybeReadModeenv() (*boot.Modeenv, error) {
+func maybeReadModeenv() (*boot.Modeenv, error) {
 	modeEnv, err := boot.ReadModeenv("")
 	if err != nil && !os.IsNotExist(err) {
 		return nil, fmt.Errorf("cannot read modeenv: %v", err)
@@ -140,6 +164,55 @@
 	return modeEnv, nil
 }
 
+// StartUp implements StateStarterUp.Startup.
+func (m *DeviceManager) StartUp() error {
+	// system mode is explicitly set on UC20
+	// TODO:UC20: ubuntu-save needs to be mounted for recover too
+	if !release.OnClassic && m.systemMode == "run" {
+		if err := m.maybeSetupUbuntuSave(); err != nil {
+			return fmt.Errorf("cannot set up ubuntu-save: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func (m *DeviceManager) maybeSetupUbuntuSave() error {
+	// only called for UC20
+
+	saveMounted, err := osutil.IsMounted(dirs.SnapSaveDir)
+	if err != nil {
+		return err
+	}
+	if saveMounted {
+		logger.Noticef("save already mounted under %v", dirs.SnapSaveDir)
+		m.saveAvailable = true
+		return nil
+	}
+
+	runMntSaveMounted, err := osutil.IsMounted(boot.InitramfsUbuntuSaveDir)
+	if err != nil {
+		return err
+	}
+	if !runMntSaveMounted {
+		// we don't have ubuntu-save, save will be used directly
+		logger.Noticef("no ubuntu-save mount")
+		m.saveAvailable = true
+		return nil
+	}
+
+	logger.Noticef("bind-mounting ubuntu-save under %v", dirs.SnapSaveDir)
+
+	err = systemd.New(systemd.SystemMode, progress.Null).Mount(boot.InitramfsUbuntuSaveDir,
+		dirs.SnapSaveDir, "-o", "bind")
+	if err != nil {
+		logger.Noticef("bind-mounting ubuntu-save failed %v", err)
+		return fmt.Errorf("cannot bind mount %v under %v: %v", boot.InitramfsUbuntuSaveDir, dirs.SnapSaveDir, err)
+	}
+	m.saveAvailable = true
+	return nil
+}
+
 type deviceMgrKey struct{}
 
 func deviceMgr(st *state.State) *DeviceManager {
@@ -426,6 +499,26 @@
 	return nil
 }
 
+var startTime time.Time
+
+func init() {
+	startTime = time.Now()
+}
+
+func (m *DeviceManager) setTimeOnce(name string, t time.Time) error {
+	var prev time.Time
+	err := m.state.Get(name, &prev)
+	if err != nil && err != state.ErrNoState {
+		return err
+	}
+	if !prev.IsZero() {
+		// already set
+		return nil
+	}
+	m.state.Set(name, t)
+	return nil
+}
+
 var populateStateFromSeed = populateStateFromSeedImpl
 
 // ensureSeeded makes sure that the snaps from seed.yaml get installed
@@ -449,11 +542,24 @@
 		return nil
 	}
 
+	var recordedStart string
+	var start time.Time
+	if m.preseed {
+		recordedStart = "preseed-start-time"
+		start = timeNow()
+	} else {
+		recordedStart = "seed-start-time"
+		start = startTime
+	}
+	if err := m.setTimeOnce(recordedStart, start); err != nil {
+		return err
+	}
+
 	var opts *populateStateFromSeedOptions
 	if m.preseed {
 		opts = &populateStateFromSeedOptions{Preseed: true}
 	} else {
-		modeEnv, err := m.maybeReadModeenv()
+		modeEnv, err := maybeReadModeenv()
 		if err != nil {
 			return err
 		}
@@ -529,6 +635,162 @@
 	return nil
 }
 
+func (m *DeviceManager) ensureCloudInitRestricted() error {
+	m.state.Lock()
+	defer m.state.Unlock()
+
+	if m.cloudInitAlreadyRestricted {
+		return nil
+	}
+
+	var seeded bool
+	err := m.state.Get("seeded", &seeded)
+	if err != nil && err != state.ErrNoState {
+		return err
+	}
+
+	// On Ubuntu Core devices that have been seeded, we want to restrict
+	// cloud-init so that its more dangerous (for an IoT device at least)
+	// features are not exploitable after a device has been seeded. This allows
+	// device administrators and other tools (such as multipass) to still
+	// configure an Ubuntu Core device on first boot, and also allows cloud
+	// vendors to run cloud-init with only a specific data-source on subsequent
+	// boots but disallows arbitrary cloud-init {user,meta,vendor}-data to be
+	// attached to a device via a USB drive and inject code onto the device.
+
+	if seeded && !release.OnClassic {
+		opts := &sysconfig.CloudInitRestrictOptions{}
+
+		// check the current state of cloud-init, if it is disabled or already
+		// restricted then we have nothing to do
+		cloudInitStatus, err := cloudInitStatus()
+		if err != nil {
+			return err
+		}
+		statusMsg := ""
+
+		switch cloudInitStatus {
+		case sysconfig.CloudInitDisabledPermanently, sysconfig.CloudInitRestrictedBySnapd:
+			// already been permanently disabled, nothing to do
+			m.cloudInitAlreadyRestricted = true
+			return nil
+		case sysconfig.CloudInitUntriggered:
+			// hasn't been used
+			statusMsg = "reported to be in disabled state"
+		case sysconfig.CloudInitDone:
+			// is done being used
+			statusMsg = "reported to be done"
+		case sysconfig.CloudInitErrored:
+			// cloud-init errored, so we give the device admin / developer a few
+			// minutes to reboot the machine to re-run cloud-init and try again,
+			// otherwise we will disable cloud-init permanently
+
+			// initialize the time we first saw cloud-init in error state
+			if m.cloudInitErrorAttemptStart == nil {
+				// save the time we started the attempt to restrict
+				now := timeNow()
+				m.cloudInitErrorAttemptStart = &now
+				logger.Noticef("System initialized, cloud-init reported to be in error state, will disable in 3 minutes")
+			}
+
+			// check if 3 minutes have elapsed since we first saw cloud-init in
+			// error state
+			timeSinceFirstAttempt := timeNow().Sub(*m.cloudInitErrorAttemptStart)
+			if timeSinceFirstAttempt <= 3*time.Minute {
+				// we need to keep waiting for cloud-init, up to 3 minutes
+				nextCheck := 3*time.Minute - timeSinceFirstAttempt
+				m.state.EnsureBefore(nextCheck)
+				return nil
+			}
+			// otherwise, we timed out waiting for cloud-init to be fixed or
+			// rebooted and should restrict cloud-init
+			// we will restrict cloud-init below, but we need to force the
+			// disable, as by default RestrictCloudInit will error on state
+			// CloudInitErrored
+			opts.ForceDisable = true
+			statusMsg = "reported to be in error state after 3 minutes"
+		default:
+			// in unknown states we are conservative and let the device run for
+			// a while to see if it transitions to a known state, but eventually
+			// will disable anyways
+			fallthrough
+		case sysconfig.CloudInitEnabled:
+			// we will give cloud-init up to 5 minutes to try and run, if it
+			// still has not transitioned to some other known state, then we
+			// will give up waiting for it and disable it anyways
+
+			// initialize the first time we saw cloud-init in enabled state
+			if m.cloudInitEnabledInactiveAttemptStart == nil {
+				// save the time we started the attempt to restrict
+				now := timeNow()
+				m.cloudInitEnabledInactiveAttemptStart = &now
+			}
+
+			// keep re-scheduling again in 10 seconds until we hit 5 minutes
+			timeSinceFirstAttempt := timeNow().Sub(*m.cloudInitEnabledInactiveAttemptStart)
+			if timeSinceFirstAttempt <= 5*time.Minute {
+				// TODO: should we log a message here about waiting for cloud-init
+				//       to be in a "known state"?
+				m.state.EnsureBefore(10 * time.Second)
+				return nil
+			}
+
+			// otherwise, we gave cloud-init 5 minutes to run, if it's still not
+			// done disable it anyways
+			// note we we need to force the disable, as by default
+			// RestrictCloudInit will error on state CloudInitEnabled
+			opts.ForceDisable = true
+			statusMsg = "failed to transition to done or error state after 5 minutes"
+		}
+
+		// we should always have a model if we are seeded and are not on classic
+		model, err := m.Model()
+		if err != nil {
+			return err
+		}
+
+		// For UC20, we want to always disable cloud-init after it has run on
+		// first boot unless we are in a "real cloud", i.e. not using NoCloud,
+		// or if we installed cloud-init configuration from the gadget
+		if model.Grade() != asserts.ModelGradeUnset {
+			// always disable NoCloud/local datasources after first boot on
+			// uc20, this is because even if the gadget has a cloud.conf
+			// configuring NoCloud, the config installed by cloud-init should
+			// not work differently for later boots, so it's sufficient that
+			// NoCloud runs on first-boot and never again
+			opts.DisableAfterLocalDatasourcesRun = true
+		}
+
+		// now restrict/disable cloud-init
+		res, err := restrictCloudInit(cloudInitStatus, opts)
+		if err != nil {
+			return err
+		}
+
+		// log a message about what we did
+		actionMsg := ""
+		switch res.Action {
+		case "disable":
+			actionMsg = "disabled permanently"
+		case "restrict":
+			// log different messages depending on what datasource was used
+			if res.DataSource == "NoCloud" {
+				actionMsg = "set datasource_list to [ NoCloud ] and disabled auto-import by filesystem label"
+			} else {
+				// all other datasources just log that we limited it to that datasource
+				actionMsg = fmt.Sprintf("set datasource_list to [ %s ]", res.DataSource)
+			}
+		default:
+			return fmt.Errorf("internal error: unexpected action %s taken while restricting cloud-init", res.Action)
+		}
+		logger.Noticef("System initialized, cloud-init %s, %s", statusMsg, actionMsg)
+
+		m.cloudInitAlreadyRestricted = true
+	}
+
+	return nil
+}
+
 func (m *DeviceManager) ensureInstalled() error {
 	m.state.Lock()
 	defer m.state.Unlock()
@@ -679,6 +941,10 @@
 	}
 
 	if !m.preseed {
+		if err := m.ensureCloudInitRestricted(); err != nil {
+			errs = append(errs, err)
+		}
+
 		if err := m.ensureOperational(); err != nil {
 			errs = append(errs, err)
 		}
@@ -703,6 +969,93 @@
 	return nil
 }
 
+var errNoSaveSupport = errors.New("no save directory before UC20")
+
+// withSaveDir invokes a function making sure save dir is available.
+// Under UC16/18 it returns errNoSaveSupport
+// For UC20 it also checks that ubuntu-save is available/mounted.
+func (m *DeviceManager) withSaveDir(f func() error) error {
+	// we use the model to check whether this is a UC20 device
+	model, err := m.Model()
+	if err == state.ErrNoState {
+		return fmt.Errorf("internal error: cannot access save dir before a model is set")
+	}
+	if err != nil {
+		return err
+	}
+	if model.Grade() == asserts.ModelGradeUnset {
+		return errNoSaveSupport
+	}
+	// at this point we need save available
+	if !m.saveAvailable {
+		return fmt.Errorf("internal error: save dir is unavailable")
+	}
+
+	return f()
+}
+
+// withSaveAssertDB invokes a function making the save device assertion
+// backup database available to it.
+// Under UC16/18 it returns errNoSaveSupport
+// For UC20 it also checks that ubuntu-save is available/mounted.
+func (m *DeviceManager) withSaveAssertDB(f func(*asserts.Database) error) error {
+	return m.withSaveDir(func() error {
+		// open an ancillary backup assertion database in save/device
+		assertDB, err := sysdb.OpenAt(dirs.SnapDeviceSaveDir)
+		if err != nil {
+			return err
+		}
+		return f(assertDB)
+	})
+}
+
+// withKeypairMgr invokes a function making the device KeypairManager
+// available to it.
+// It uses the right location for the manager depending on UC16/18 vs 20,
+// the latter uses ubuntu-save.
+// For UC20 it also checks that ubuntu-save is available/mounted.
+func (m *DeviceManager) withKeypairMgr(f func(asserts.KeypairManager) error) error {
+	// we use the model to check whether this is a UC20 device
+	// TODO: during a theoretical UC18->20 remodel the location of
+	// keypair manager keys would move, we will need dedicated code
+	// to deal with that, this code typically will return the old location
+	// until a restart
+	model, err := m.Model()
+	if err == state.ErrNoState {
+		return fmt.Errorf("internal error: cannot access device keypair manager before a model is set")
+	}
+	if err != nil {
+		return err
+	}
+	underSave := false
+	if model.Grade() != asserts.ModelGradeUnset {
+		// on UC20 the keys are kept under the save dir
+		underSave = true
+	}
+	where := dirs.SnapDeviceDir
+	if underSave {
+		// at this point we need save available
+		if !m.saveAvailable {
+			return fmt.Errorf("internal error: cannot access device keypair manager if ubuntu-save is unavailable")
+		}
+		where = dirs.SnapDeviceSaveDir
+	}
+	keypairMgr := m.cachedKeypairMgr
+	if keypairMgr == nil {
+		var err error
+		keypairMgr, err = asserts.OpenFSKeypairManager(where)
+		if err != nil {
+			return err
+		}
+		m.cachedKeypairMgr = keypairMgr
+	}
+	return f(keypairMgr)
+}
+
+// TODO:UC20: we need proper encapsulated support to read
+// tpm-policy-auth-key from save if the latter can get unmounted on
+// demand
+
 func (m *DeviceManager) keyPair() (asserts.PrivateKey, error) {
 	device, err := m.device()
 	if err != nil {
@@ -713,9 +1066,16 @@
 		return nil, state.ErrNoState
 	}
 
-	privKey, err := m.keypairMgr.Get(device.KeyID)
+	var privKey asserts.PrivateKey
+	err = m.withKeypairMgr(func(keypairMgr asserts.KeypairManager) (err error) {
+		privKey, err = keypairMgr.Get(device.KeyID)
+		if err != nil {
+			return fmt.Errorf("cannot read device key pair: %v", err)
+		}
+		return nil
+	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot read device key pair: %v", err)
+		return nil, err
 	}
 	return privKey, nil
 }
@@ -772,66 +1132,19 @@
 	{Title: "Recover", Mode: "recover"},
 	{Title: "Run normally", Mode: "run"},
 }
-
-func systemFromSeed(label string, current *seededSystem) (*System, error) {
-	s, err := seed.Open(dirs.SnapSeedDir, label)
-	if err != nil {
-		return nil, fmt.Errorf("cannot open: %v", err)
-	}
-	if err := s.LoadAssertions(nil, nil); err != nil {
-		return nil, fmt.Errorf("cannot load assertions: %v", err)
-	}
-	// get the model
-	model, err := s.Model()
-	if err != nil {
-		return nil, fmt.Errorf("cannot obtain model: %v", err)
-	}
-	brand, err := s.Brand()
-	if err != nil {
-		return nil, fmt.Errorf("cannot obtain brand: %v", err)
-	}
-	system := System{
-		Current: false,
-		Label:   label,
-		Model:   model,
-		Brand:   brand,
-		Actions: defaultSystemActions,
-	}
-	if current != nil && isCurrentSystem(current, &system) {
-		system.Current = true
-		system.Actions = currentSystemActions
-	}
-	return &system, nil
+var recoverSystemActions = []SystemAction{
+	{Title: "Reinstall", Mode: "install"},
+	{Title: "Run normally", Mode: "run"},
 }
 
 var ErrNoSystems = errors.New("no systems seeds")
 
-func currentSeedSystem(st *state.State) (*seededSystem, error) {
-	st.Lock()
-	defer st.Unlock()
-
-	var whatseeded []seededSystem
-	if err := st.Get("seeded-systems", &whatseeded); err != nil {
-		return nil, err
-	}
-	if len(whatseeded) == 0 {
-		// unexpected
-		return nil, state.ErrNoState
-	}
-	return &whatseeded[0], nil
-}
-
-func isCurrentSystem(current *seededSystem, other *System) bool {
-	return current.System == other.Label &&
-		current.Model == other.Model.Model() &&
-		current.BrandID == other.Brand.AccountID()
-}
-
 // Systems list the available recovery/seeding systems. Returns the list of
 // systems, ErrNoSystems when no systems seeds were found or other error.
 func (m *DeviceManager) Systems() ([]*System, error) {
 	// it's tough luck when we cannot determine the current system seed
-	currentSys, _ := currentSeedSystem(m.state)
+	systemMode := m.SystemMode()
+	currentSys, _ := currentSystemForMode(m.state, systemMode)
 
 	systemLabels, err := filepath.Glob(filepath.Join(dirs.SnapSeedDir, "systems", "*"))
 	if err != nil && !os.IsNotExist(err) {
@@ -859,14 +1172,88 @@
 
 var ErrUnsupportedAction = errors.New("unsupported action")
 
-// RequestSystemAction request provided system to be run in a given mode. A
-// system reboot will be requested when the request can be successfully carried
-// out.
+// Reboot triggers a reboot into the given systemLabel and mode.
+//
+// When called without a systemLabel and without a mode it will just
+// trigger a regular reboot.
+//
+// When called without a systemLabel but with a mode it will use
+// the current system to enter the given mode.
+//
+// Note that "recover" and "run" modes are only available for the
+// current system.
+func (m *DeviceManager) Reboot(systemLabel, mode string) error {
+	rebootCurrent := func() {
+		logger.Noticef("rebooting system")
+		m.state.RequestRestart(state.RestartSystemNow)
+	}
+
+	// most simple case: just reboot
+	if systemLabel == "" && mode == "" {
+		m.state.Lock()
+		defer m.state.Unlock()
+
+		rebootCurrent()
+		return nil
+	}
+
+	// no systemLabel means "current" so get the current system label
+	if systemLabel == "" {
+		systemMode := m.SystemMode()
+		currentSys, err := currentSystemForMode(m.state, systemMode)
+		if err != nil {
+			return fmt.Errorf("cannot get current system: %v", err)
+		}
+		systemLabel = currentSys.System
+	}
+
+	switched := func(systemLabel string, sysAction *SystemAction) {
+		logger.Noticef("rebooting into system %q in %q mode", systemLabel, sysAction.Mode)
+		m.state.RequestRestart(state.RestartSystemNow)
+	}
+	// even if we are already in the right mode we restart here by
+	// passing rebootCurrent as this is what the user requested
+	return m.switchToSystemAndMode(systemLabel, mode, rebootCurrent, switched)
+}
+
+// RequestSystemAction requests the provided system to be run in a
+// given mode as specified by action.
+// A system reboot will be requested when the request can be
+// successfully carried out.
 func (m *DeviceManager) RequestSystemAction(systemLabel string, action SystemAction) error {
-	currentSys, _ := currentSeedSystem(m.state)
+	if systemLabel == "" {
+		return fmt.Errorf("internal error: system label is unset")
+	}
+
+	nop := func() {}
+	switched := func(systemLabel string, sysAction *SystemAction) {
+		logger.Noticef("restarting into system %q for action %q", systemLabel, sysAction.Title)
+		m.state.RequestRestart(state.RestartSystemNow)
+	}
+	// we do nothing (nop) if the mode and system are the same
+	return m.switchToSystemAndMode(systemLabel, action.Mode, nop, switched)
+}
+
+// switchToSystemAndMode switches to given systemLabel and mode.
+// If the systemLabel and mode are the same as current, it calls
+// sameSystemAndMode. If successful otherwise it calls switched. Both
+// are called with the state lock held.
+func (m *DeviceManager) switchToSystemAndMode(systemLabel, mode string, sameSystemAndMode func(), switched func(systemLabel string, sysAction *SystemAction)) error {
+	if err := checkSystemRequestConflict(m.state, systemLabel); err != nil {
+		return err
+	}
+
+	systemMode := m.SystemMode()
+	// ignore the error to be robust in scenarios that
+	// dont' stricly require currentSys to be carried through.
+	// make sure that currentSys == nil does not break
+	// the code below!
+	// TODO: should we log the error?
+	currentSys, _ := currentSystemForMode(m.state, systemMode)
 
 	systemSeedDir := filepath.Join(dirs.SnapSeedDir, "systems", systemLabel)
 	if _, err := os.Stat(systemSeedDir); err != nil {
+		// XXX: should we wrap this instead return a naked stat error?
 		return err
 	}
 	system, err := systemFromSeed(systemLabel, currentSys)
@@ -876,23 +1263,27 @@
 
 	var sysAction *SystemAction
 	for _, act := range system.Actions {
-		if action.Mode == act.Mode {
+		if mode == act.Mode {
 			sysAction = &act
 			break
 		}
 	}
 	if sysAction == nil {
+		// XXX: provide more context here like what mode was requested?
 		return ErrUnsupportedAction
 	}
 
 	// XXX: requested mode is valid; only current system has 'run' and
 	// recover 'actions'
 
-	switch m.systemMode {
+	switch systemMode {
 	case "recover", "run":
 		// if going from recover to recover or from run to run and the systems
 		// are the same do nothing
-		if m.systemMode == sysAction.Mode && systemLabel == currentSys.System {
+		if systemMode == sysAction.Mode && currentSys != nil && systemLabel == currentSys.System {
+			m.state.Lock()
+			defer m.state.Unlock()
+			sameSystemAndMode()
 			return nil
 		}
 	case "install":
@@ -904,7 +1295,7 @@
 	default:
 		// probably test device manager mocking problem, or also potentially
 		// missing modeenv
-		return fmt.Errorf("internal error: unexpected manager system mode %q", m.systemMode)
+		return fmt.Errorf("internal error: unexpected manager system mode %q", systemMode)
 	}
 
 	m.state.Lock()
@@ -914,14 +1305,11 @@
 	if err != nil {
 		return err
 	}
-
-	if err := boot.SetRecoveryBootSystemAndMode(deviceCtx, systemLabel, action.Mode); err != nil {
-		return fmt.Errorf("cannot set device to boot into system %q in mode %q: %v",
-			systemLabel, action.Mode, err)
+	if err := boot.SetRecoveryBootSystemAndMode(deviceCtx, systemLabel, mode); err != nil {
+		return fmt.Errorf("cannot set device to boot into system %q in mode %q: %v", systemLabel, mode, err)
 	}
 
-	logger.Noticef("restarting into system %q for action %q", systemLabel, sysAction.Title)
-	m.state.RequestRestart(state.RestartSystemNow)
+	switched(systemLabel, sysAction)
 	return nil
 }
 
@@ -976,3 +1364,129 @@
 func (m *DeviceManager) StoreContextBackend() storecontext.Backend {
 	return storeContextBackend{m}
 }
+
+func (m *DeviceManager) hasFDESetupHook() (bool, error) {
+	// state must be locked
+	st := m.state
+
+	deviceCtx, err := DeviceCtx(st, nil, nil)
+	if err != nil {
+		return false, fmt.Errorf("cannot get device context: %v", err)
+	}
+
+	kernelInfo, err := snapstate.KernelInfo(st, deviceCtx)
+	if err != nil {
+		return false, fmt.Errorf("cannot get kernel info: %v", err)
+	}
+	return hasFDESetupHookInKernel(kernelInfo), nil
+}
+
+func (m *DeviceManager) runFDESetupHook(op string, params *boot.FDESetupHookParams) ([]byte, error) {
+	// TODO:UC20: when this runs on refresh we need to be very careful
+	// that we never run this when the kernel is not fully configured
+	// i.e. when there are no security profiles for the hook
+
+	// state must be locked
+	st := m.state
+
+	deviceCtx, err := DeviceCtx(st, nil, nil)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get device context to run fde-setup hook: %v", err)
+	}
+	kernelInfo, err := snapstate.KernelInfo(st, deviceCtx)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get kernel info to run fde-setup hook: %v", err)
+	}
+	hooksup := &hookstate.HookSetup{
+		Snap:     kernelInfo.InstanceName(),
+		Revision: kernelInfo.Revision,
+		Hook:     "fde-setup",
+		// XXX: should this be configurable somehow?
+		Timeout: 5 * time.Minute,
+	}
+	req := &fde.SetupRequest{
+		Op:      op,
+		Key:     &params.Key,
+		KeyName: params.KeyName,
+		// TODO: include boot chains
+	}
+	for _, model := range params.Models {
+		req.Models = append(req.Models, map[string]string{
+			"series":     model.Series(),
+			"brand-id":   model.BrandID(),
+			"model":      model.Model(),
+			"grade":      string(model.Grade()),
+			"signkey-id": model.SignKeyID(),
+		})
+	}
+	contextData := map[string]interface{}{
+		"fde-setup-request": req,
+	}
+	st.Unlock()
+	defer st.Lock()
+	context, err := m.hookMgr.EphemeralRunHook(context.Background(), hooksup, contextData)
+	if err != nil {
+		return nil, fmt.Errorf("cannot run hook for %q: %v", op, err)
+	}
+	// the hook is expected to call "snapctl fde-setup-result" which
+	// wil set the "fde-setup-result" value on the task
+	var hookResult []byte
+	context.Lock()
+	err = context.Get("fde-setup-result", &hookResult)
+	context.Unlock()
+	if err != nil {
+		return nil, fmt.Errorf("cannot get result from fde-setup hook %q: %v", op, err)
+	}
+
+	return hookResult, nil
+}
+
+func (m *DeviceManager) checkFDEFeatures(st *state.State) error {
+	// Run fde-setup hook with "op":"features". If the hook
+	// returns any {"features":[...]} reply we consider the
+	// hardware supported. If the hook errors or if it returns
+	// {"error":"hardware-unsupported"} we don't.
+	output, err := m.runFDESetupHook("features", &boot.FDESetupHookParams{})
+	if err != nil {
+		return err
+	}
+	var res struct {
+		Features []string `json:"features"`
+		Error    string   `json:"error"`
+	}
+	if err := json.Unmarshal(output, &res); err != nil {
+		return fmt.Errorf("cannot parse hook output %q: %v", output, err)
+	}
+	if res.Features == nil && res.Error == "" {
+		return fmt.Errorf(`cannot use hook: neither "features" nor "error" returned`)
+	}
+	if res.Error != "" {
+		return fmt.Errorf("cannot use hook: it returned error: %v", res.Error)
+	}
+	return nil
+}
+
+func hasFDESetupHookInKernel(kernelInfo *snap.Info) bool {
+	_, ok := kernelInfo.Hooks["fde-setup"]
+	return ok
+}
+
+type fdeSetupHandler struct {
+	context *hookstate.Context
+}
+
+func newFdeSetupHandler(ctx *hookstate.Context) hookstate.Handler {
+	return fdeSetupHandler{context: ctx}
+}
+
+func (h fdeSetupHandler) Before() error {
+	return nil
+}
+
+func (h fdeSetupHandler) Done() error {
+	return nil
+}
+
+func (h fdeSetupHandler) Error(err error) error {
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_cloudinit_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_cloudinit_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_cloudinit_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_cloudinit_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1139 @@
+package devicestate_test
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/overlord/auth"
+	"github.com/snapcore/snapd/overlord/devicestate"
+	"github.com/snapcore/snapd/overlord/devicestate/devicestatetest"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/sysconfig"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type cloudInitBaseSuite struct {
+	deviceMgrBaseSuite
+	logbuf *bytes.Buffer
+}
+
+type cloudInitSuite struct {
+	cloudInitBaseSuite
+}
+
+var _ = Suite(&cloudInitSuite{})
+
+func (s *cloudInitBaseSuite) SetUpTest(c *C) {
+	s.deviceMgrBaseSuite.SetUpTest(c)
+
+	// undo the cloud-init mocking from deviceMgrBaseSuite, since here we
+	// actually want the default function used to be the real one
+	s.restoreCloudInitStatusRestore()
+
+	r := release.MockOnClassic(false)
+	defer r()
+
+	st := s.o.State()
+	st.Lock()
+	st.Set("seeded", true)
+	st.Unlock()
+
+	logbuf, r := logger.MockLogger()
+	s.logbuf = logbuf
+	s.AddCleanup(r)
+
+	// mock /etc/cloud on writable
+	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "etc", "cloud"), 0755)
+	c.Assert(err, IsNil)
+}
+
+type cloudInitUC20Suite struct {
+	cloudInitBaseSuite
+}
+
+var _ = Suite(&cloudInitUC20Suite{})
+
+func (s *cloudInitUC20Suite) SetUpTest(c *C) {
+	s.cloudInitBaseSuite.SetUpTest(c)
+
+	// make a uc20 style dangerous model assertion for the device
+	// note that actually the devicemgr ensure only cares about having a grade
+	// for uc20, it doesn't use the grade for anything right now, the install
+	// handler code however does care about the grade, so here we just default
+	// to signed
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.makeModelAssertionInState(c, "canonical", "pc20-model", map[string]interface{}{
+		"display-name": "UC20 pc model",
+		"architecture": "amd64",
+		"base":         "core20",
+		"grade":        "signed",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":            "pc-kernel",
+				"id":              "pckernelidididididididididididid",
+				"type":            "kernel",
+				"default-channel": "20",
+			},
+			map[string]interface{}{
+				"name":            "pc",
+				"id":              "pcididididididididididididididid",
+				"type":            "gadget",
+				"default-channel": "20",
+			}},
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand:  "canonical",
+		Model:  "pc20-model",
+		Serial: "serial",
+	})
+
+	// create the gadget snap's mount dir
+	gadgetDir := filepath.Join(dirs.SnapMountDir, "pc", "1")
+	c.Assert(os.MkdirAll(gadgetDir, 0755), IsNil)
+}
+
+func (s *cloudInitUC20Suite) TestCloudInitUC20CloudGadgetNoDisable(c *C) {
+	// create a cloud.conf file in the gadget snap's mount dir
+	c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapMountDir, "pc", "1", "cloud.conf"), nil, 0644), IsNil)
+
+	// pretend that cloud-init finished running
+	statusCalls := 0
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		statusCalls++
+		return sysconfig.CloudInitDone, nil
+	})
+	defer r()
+
+	restrictCalls := 0
+	r = devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitDone)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			DisableAfterLocalDatasourcesRun: true,
+		})
+		// in this case, pretend it was a real cloud, so it just got restricted
+		return sysconfig.CloudInitRestrictionResult{
+			Action:     "restrict",
+			DataSource: "GCE",
+		}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+	c.Assert(statusCalls, Equals, 1)
+	c.Assert(restrictCalls, Equals, 1)
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be done, set datasource_list to \[ GCE \].*`)
+}
+
+func (s *cloudInitUC20Suite) TestCloudInitUC20NoCloudGadgetDisables(c *C) {
+	// pretend that cloud-init never ran
+	statusCalls := 0
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		statusCalls++
+		return sysconfig.CloudInitUntriggered, nil
+	})
+	defer r()
+
+	restrictCalls := 0
+	r = devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitUntriggered)
+		// no gadget cloud.conf, so we should be asked to disable if it was
+		// NoCloud
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			DisableAfterLocalDatasourcesRun: true,
+		})
+		// cloud-init never ran, so no datasource
+		return sysconfig.CloudInitRestrictionResult{
+			Action: "disable",
+		}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+	c.Assert(statusCalls, Equals, 1)
+	c.Assert(restrictCalls, Equals, 1)
+
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in disabled state, disabled permanently.*`)
+}
+
+func (s *cloudInitUC20Suite) TestCloudInitDoneNoCloudDisables(c *C) {
+	// pretend that cloud-init ran, and mock the actual cloud-init command to
+	// use the real sysconfig logic
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: done"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitDone)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			DisableAfterLocalDatasourcesRun: true,
+		})
+		// we would have disabled it as per the opts
+		return sysconfig.CloudInitRestrictionResult{
+			// pretend it was NoCloud
+			DataSource: "NoCloud",
+			Action:     "disable",
+		}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about cloud-init done and being restricted
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be done, disabled permanently.*`)
+
+	// and 1 call to restrict
+	c.Assert(restrictCalls, Equals, 1)
+}
+
+func (s *cloudInitSuite) SetUpTest(c *C) {
+	s.cloudInitBaseSuite.SetUpTest(c)
+
+	// make a uc16/uc18 style model assertion for the device
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.makeModelAssertionInState(c, "canonical", "pc-model", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+		"base":         "core18",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand:  "canonical",
+		Model:  "pc-model",
+		Serial: "serial",
+	})
+}
+
+func (s *cloudInitSuite) TestClassicCloudInitDoesNothing(c *C) {
+	r := release.MockOnClassic(true)
+	defer r()
+
+	r = devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		c.Error("EnsureCloudInitRestricted should not have checked cloud-init status when on classic")
+		return 0, fmt.Errorf("broken")
+	})
+	defer r()
+
+	r = devicestate.MockRestrictCloudInit(func(sysconfig.CloudInitState, *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		c.Error("EnsureCloudInitRestricted should not have restricted cloud-init when on classic")
+		return sysconfig.CloudInitRestrictionResult{}, fmt.Errorf("broken")
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+}
+
+func (s *cloudInitSuite) TestCloudInitEnsureBeforeSeededDoesNothing(c *C) {
+	st := s.o.State()
+	st.Lock()
+	st.Set("seeded", false)
+	st.Unlock()
+
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		c.Error("EnsureCloudInitRestricted should not have checked cloud-init status when not seeded")
+		return 0, fmt.Errorf("broken")
+	})
+	defer r()
+
+	r = devicestate.MockRestrictCloudInit(func(sysconfig.CloudInitState, *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		c.Error("EnsureCloudInitRestricted should not have restricted cloud-init when not seeded")
+		return sysconfig.CloudInitRestrictionResult{}, fmt.Errorf("broken")
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+}
+
+func (s *cloudInitSuite) TestCloudInitAlreadyEnsuredRestrictedDoesNothing(c *C) {
+	n := 0
+
+	// mock that it was restricted so that we set the internal bool to say it
+	// already ran
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		n++
+		switch n {
+		case 1:
+			return sysconfig.CloudInitRestrictedBySnapd, nil
+		default:
+			c.Error("EnsureCloudInitRestricted should not have checked cloud-init status again")
+			return sysconfig.CloudInitRestrictedBySnapd, fmt.Errorf("test broken")
+		}
+	})
+	defer r()
+
+	// run it once to set the internal bool
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(n, Equals, 1)
+
+	// it should run again without checking anything
+	err = devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(n, Equals, 1)
+}
+
+func (s *cloudInitSuite) TestCloudInitDeviceManagerEnsureRestrictsCloudInit(c *C) {
+	n := 0
+
+	// mock that it was restricted so that we set the internal bool to say it
+	// already ran
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		n++
+		switch n {
+		case 1:
+			return sysconfig.CloudInitRestrictedBySnapd, nil
+		default:
+			c.Error("EnsureCloudInitRestricted should not have checked cloud-init status again")
+			return sysconfig.CloudInitRestrictedBySnapd, fmt.Errorf("test broken")
+		}
+	})
+	defer r()
+
+	// run it once to set the internal bool
+	err := s.mgr.Ensure()
+	c.Assert(err, IsNil)
+	c.Assert(n, Equals, 1)
+
+	// running again is still okay and won't call CloudInitStatus again
+	err = s.mgr.Ensure()
+	c.Assert(err, IsNil)
+	c.Assert(n, Equals, 1)
+}
+
+func (s *cloudInitSuite) TestCloudInitAlreadyRestrictedDoesNothing(c *C) {
+	statusCalls := 0
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		statusCalls++
+		return sysconfig.CloudInitRestrictedBySnapd, nil
+	})
+	defer r()
+
+	r = devicestate.MockRestrictCloudInit(func(sysconfig.CloudInitState, *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		c.Error("EnsureCloudInitRestricted should not have restricted cloud-init when already restricted")
+		return sysconfig.CloudInitRestrictionResult{}, fmt.Errorf("broken")
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+	c.Assert(statusCalls, Equals, 1)
+}
+
+func (s *cloudInitSuite) TestCloudInitAlreadyRestrictedFileDoesNothing(c *C) {
+	// write a cloud-init restriction file
+	disableFile := filepath.Join(dirs.GlobalRootDir, "/etc/cloud/cloud.cfg.d/zzzz_snapd.cfg")
+	err := os.MkdirAll(filepath.Dir(disableFile), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(disableFile, nil, 0644)
+	c.Assert(err, IsNil)
+
+	// mock cloud-init command, but make it always fail, it shouldn't be called
+	// as cloud-init.disabled should tell sysconfig to never consult cloud-init
+	// directly
+	cmd := testutil.MockCommand(c, "cloud-init", `
+echo "unexpected call to cloud-init with args $*"
+exit 1`)
+	defer cmd.Restore()
+
+	r := devicestate.MockRestrictCloudInit(func(sysconfig.CloudInitState, *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		c.Error("EnsureCloudInitRestricted should not have restricted cloud-init when already disabled")
+		return sysconfig.CloudInitRestrictionResult{}, fmt.Errorf("broken")
+	})
+	defer r()
+
+	err = devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(s.logbuf.String(), Equals, "")
+
+	c.Assert(cmd.Calls(), HasLen, 0)
+}
+
+func (s *cloudInitSuite) TestCloudInitAlreadyDisabledDoesNothing(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// write a cloud-init disabled file
+	disableFile := filepath.Join(dirs.GlobalRootDir, "/etc/cloud/cloud-init.disabled")
+	err := os.MkdirAll(filepath.Dir(disableFile), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(disableFile, nil, 0644)
+	c.Assert(err, IsNil)
+
+	// mock cloud-init command, but make it always fail, it shouldn't be called
+	// as cloud-init.disabled should tell sysconfig to never consult cloud-init
+	// directly
+	cmd := testutil.MockCommand(c, "cloud-init", `
+echo "unexpected call to cloud-init with args $*"
+exit 1`)
+	defer cmd.Restore()
+
+	r := devicestate.MockRestrictCloudInit(func(sysconfig.CloudInitState, *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		c.Error("EnsureCloudInitRestricted should not have restricted cloud-init when already disabled")
+		return sysconfig.CloudInitRestrictionResult{}, fmt.Errorf("broken")
+	})
+	defer r()
+
+	err = devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(s.logbuf.String(), Equals, "")
+
+	c.Assert(cmd.Calls(), HasLen, 0)
+}
+
+func (s *cloudInitSuite) TestCloudInitUntriggeredDisables(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: disabled"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitUntriggered)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: false,
+		})
+		// we would have disabled it
+		return sysconfig.CloudInitRestrictionResult{Action: "disable"}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about cloud-init done and being restricted
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in disabled state, disabled permanently.*`)
+
+	c.Assert(restrictCalls, Equals, 1)
+}
+
+func (s *cloudInitSuite) TestCloudInitDoneRestricts(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: done"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitDone)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: false,
+		})
+		// we would have restricted it since it ran
+		return sysconfig.CloudInitRestrictionResult{
+			// pretend it was NoCloud
+			DataSource: "NoCloud",
+			Action:     "restrict",
+		}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about cloud-init done and being restricted
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be done, set datasource_list to \[ NoCloud \] and disabled auto-import by filesystem label.*`)
+
+	// and 1 call to restrict
+	c.Assert(restrictCalls, Equals, 1)
+}
+
+func (s *cloudInitSuite) TestCloudInitDoneProperCloudRestricts(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: done"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitDone)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: false,
+		})
+		// we would have restricted it since it ran
+		return sysconfig.CloudInitRestrictionResult{
+			// pretend it was GCE
+			DataSource: "GCE",
+			Action:     "restrict",
+		}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about cloud-init done and being restricted
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be done, set datasource_list to \[ GCE \].*`)
+
+	// only called restrict once
+	c.Assert(restrictCalls, Equals, 1)
+}
+
+func (s *cloudInitSuite) TestCloudInitRunningEnsuresUntilNotRunning(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	// we use a file to make the mocked cloud-init act differently depending on
+	// how many times it is called
+	// this is because we want to test settle()/EnsureBefore() automatically
+	// re-triggering the EnsureCloudInitRestricted() w/o changing the script
+	// mid-way through the test while settle() is running
+	cloudInitScriptStateFile := filepath.Join(c.MkDir(), "cloud-init-state")
+
+	cmd := testutil.MockCommand(c, "cloud-init", fmt.Sprintf(`
+# the first time the script is called the file shouldn't exist, so return 
+# running
+# next time when the file exists, return done
+if [ -f %[1]s ]; then
+	status="done"
+else
+	status="running"
+	touch %[1]s
+fi
+if [ "$1" = "status" ]; then
+	echo "status: $status"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`, cloudInitScriptStateFile))
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitDone)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: false,
+		})
+		// we would have restricted it
+		return sysconfig.CloudInitRestrictionResult{
+			// pretend it was NoCloud
+			DataSource: "NoCloud",
+			Action:     "restrict",
+		}, nil
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	// no log messages while we wait for the transition
+	c.Assert(s.logbuf.String(), Equals, "")
+
+	// should not have called to restrict
+	c.Assert(restrictCalls, Equals, 0)
+
+	// only one call to cloud-init status
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// we should have had a call to EnsureBefore, so if we now settle, we will
+	// see an additional call to cloud-init status, which now returns done and
+	// progresses
+	s.settle(c)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+		{"cloud-init", "status"},
+	})
+
+	// now restrict should have been called
+	c.Assert(restrictCalls, Equals, 1)
+
+	// now a message that it was disabled
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be done, set datasource_list to \[ NoCloud \] and disabled auto-import by filesystem label.*`)
+}
+
+func (s *cloudInitSuite) TestCloudInitSteadyErrorDisables(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: error"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitErrored)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: true,
+		})
+		// we would have disabled it
+		return sysconfig.CloudInitRestrictionResult{
+			Action: "disable",
+		}, nil
+	})
+	defer r()
+
+	timeCalls := 0
+	testStart := time.Now()
+
+	r = devicestate.MockTimeNow(func() time.Time {
+		// we will only call time.Now() three times, first to initialize/set the
+		// that we saw cloud-init in error, and another immediately after to
+		// check if the 3 minute timeout has elapsed, and then finally after the
+		// ensure() call happened 3 minutes later
+		timeCalls++
+		switch timeCalls {
+		case 1, 2:
+			// we have 2 calls that happen at first, the first one initializes
+			// the time we checked it at, and for code simplicity, another one
+			// right after to check if the time elapsed
+			// both of these should have the same time for the first call to
+			// EnsureCloudInitRestricted
+			return testStart
+		case 3:
+			return testStart.Add(3*time.Minute + 1*time.Second)
+		default:
+			c.Errorf("unexpected additional call (number %d) to time.Now()", timeCalls)
+			return time.Time{}
+		}
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	// should not have called restrict
+	c.Assert(restrictCalls, Equals, 0)
+
+	// only one call to cloud-init status
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about error state for the operator to try to fix
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in error state, will disable in 3 minutes.*`)
+	s.logbuf.Reset()
+
+	// make sure the time accounting is correct
+	c.Assert(timeCalls, Equals, 2)
+
+	// we should have had a call to EnsureBefore, so if we now settle, we will
+	// see an additional call to cloud-init status, which continues to return
+	// error and then disables cloud-init
+	s.settle(c)
+
+	// make sure the time accounting is correct after the ensure - one more
+	// check which was simulated to be 3 minutes later
+	c.Assert(timeCalls, Equals, 3)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+		{"cloud-init", "status"},
+	})
+
+	// now restrict should have been called
+	c.Assert(restrictCalls, Equals, 1)
+
+	// and a new message about being disabled permanently
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in error state after 3 minutes, disabled permanently.*`)
+}
+
+func (s *cloudInitSuite) TestCloudInitSteadyErrorDisablesFasterEnsure(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: error"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitErrored)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: true,
+		})
+		// we would have disabled it
+		return sysconfig.CloudInitRestrictionResult{
+			Action: "disable",
+		}, nil
+	})
+	defer r()
+
+	timeCalls := 0
+	testStart := time.Now()
+
+	r = devicestate.MockTimeNow(func() time.Time {
+		// we will only call time.Now() three times, first to initialize/set the
+		// that we saw cloud-init in error, and another immediately after to
+		// check if the 3 minute timeout has elapsed, and then a few odd times
+		// before hitting the timeout to ensure we don't print the log message
+		// unnecessarily and that the timeout logic works
+		timeCalls++
+		switch timeCalls {
+		case 1, 2:
+			// we have 2 calls that happen at first, the first one initializes
+			// the time we checked it at, and for code simplicity, another one
+			// right after to check if the time elapsed
+			// both of these should have the same time for the first call to
+			// EnsureCloudInitRestricted
+			return testStart
+		case 3:
+			// only 1 minute elapsed
+			return testStart.Add(1 * time.Minute)
+		case 4:
+			// only 1 minute elapsed
+			return testStart.Add(1*time.Minute + 30*time.Second)
+		case 5:
+			// now we hit the timeout
+			return testStart.Add(3*time.Minute + 1*time.Second)
+		default:
+			c.Errorf("unexpected additional call (number %d) to time.Now()", timeCalls)
+			return time.Time{}
+		}
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	// should not have called restrict
+	c.Assert(restrictCalls, Equals, 0)
+
+	// only one call to cloud-init status
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about error state for the operator to try to fix
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in error state, will disable in 3 minutes.*`)
+	s.logbuf.Reset()
+
+	// make sure the time accounting is correct
+	c.Assert(timeCalls, Equals, 2)
+
+	// we should have had a call to EnsureBefore, so if we now settle, we will
+	// see an additional call to cloud-init status, which continues to return
+	// error and then disables cloud-init
+	s.settle(c)
+
+	// make sure the time accounting is correct after the ensure - one more
+	// check which was simulated to be 3 minutes later
+	c.Assert(timeCalls, Equals, 5)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+		{"cloud-init", "status"},
+		{"cloud-init", "status"},
+		{"cloud-init", "status"},
+	})
+
+	// now restrict should have been called
+	c.Assert(restrictCalls, Equals, 1)
+
+	// and a new message about being disabled permanently
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in error state after 3 minutes, disabled permanently.*`)
+}
+
+func (s *cloudInitSuite) TestCloudInitTakingTooLongDisables(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: running"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitEnabled)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: true,
+		})
+		// we would have disabled it
+		return sysconfig.CloudInitRestrictionResult{
+			Action: "disable",
+		}, nil
+	})
+	defer r()
+
+	timeCalls := 0
+	testStart := time.Now()
+
+	r = devicestate.MockTimeNow(func() time.Time {
+		timeCalls++
+		switch {
+		case timeCalls == 1 || timeCalls == 2:
+			// we have 2 calls that happen at first, the first one initializes
+			// the time we checked it at, and for code simplicity, another one
+			// right after to check if the time elapsed
+			// both of these should have the same time for the first call to
+			// EnsureCloudInitRestricted
+			return testStart
+		case timeCalls > 2 && timeCalls <= 31:
+			// 31 here because we should do 30 checks plus one initially
+			return testStart.Add(time.Duration(timeCalls*10) * time.Second)
+		default:
+			c.Errorf("unexpected additional call (number %d) to time.Now()", timeCalls)
+			return time.Time{}
+		}
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	// should not have called to disable
+	c.Assert(restrictCalls, Equals, 0)
+
+	// only one call to cloud-init status
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// make sure our time accounting is still correct
+	c.Assert(timeCalls, Equals, 2)
+
+	// no messages while it waits until the timeout
+	c.Assert(s.logbuf.String(), Equals, ``)
+
+	// we should have had a call to EnsureBefore, so if we now settle, we will
+	// see additional calls to cloud-init status, which continues to always
+	// return an error and so we eventually give up and disable it anyways
+	s.settle(c)
+
+	// make sure our time accounting is still correct
+	c.Assert(timeCalls, Equals, 31)
+
+	// should have called cloud-init status 30 times
+	calls := make([][]string, 30)
+	for i := 0; i < 30; i++ {
+		calls[i] = []string{"cloud-init", "status"}
+	}
+
+	c.Assert(cmd.Calls(), DeepEquals, calls)
+
+	// now disable should have been called
+	c.Assert(restrictCalls, Equals, 1)
+
+	// now a message after we timeout waiting for the transition
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init failed to transition to done or error state after 5 minutes, disabled permanently.*`)
+}
+
+func (s *cloudInitSuite) TestCloudInitTakingTooLongDisablesFasterEnsures(c *C) {
+	// same test as TestCloudInitTakingTooLongDisables, but with a faster
+	// re-ensure cycle to ensure that if we get scheduled to run Ensure() sooner
+	// than expected everything still works
+
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	cmd := testutil.MockCommand(c, "cloud-init", `
+if [ "$1" = "status" ]; then
+	echo "status: running"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`)
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitEnabled)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: true,
+		})
+		// we would have disabled it
+		return sysconfig.CloudInitRestrictionResult{
+			Action: "disable",
+		}, nil
+	})
+	defer r()
+
+	timeCalls := 0
+	testStart := time.Now()
+
+	r = devicestate.MockTimeNow(func() time.Time {
+		timeCalls++
+		switch {
+		case timeCalls == 1 || timeCalls == 2:
+			// we have 2 calls that happen at first, the first one initializes
+			// the time we checked it at, and for code simplicity, another one
+			// right after to check if the time elapsed
+			// both of these should have the same time for the first call to
+			// EnsureCloudInitRestricted
+			return testStart
+		case timeCalls > 2 && timeCalls <= 61:
+			// 31 here because we should do 60 checks plus one initially
+			return testStart.Add(time.Duration(timeCalls*5) * time.Second)
+		default:
+			c.Errorf("unexpected additional call (number %d) to time.Now()", timeCalls)
+			return time.Time{}
+		}
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	// should not have called to disable
+	c.Assert(restrictCalls, Equals, 0)
+
+	// only one call to cloud-init status
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// make sure our time accounting is still correct
+	c.Assert(timeCalls, Equals, 2)
+
+	// no messages while it waits until the timeout
+	c.Assert(s.logbuf.String(), Equals, ``)
+
+	// we should have had a call to EnsureBefore, so if we now settle, we will
+	// see additional calls to cloud-init status, which continues to always
+	// return an error and so we eventually give up and disable it anyways
+	s.settle(c)
+
+	// make sure our time accounting is still correct
+	c.Assert(timeCalls, Equals, 61)
+
+	// should have called cloud-init status 60 times
+	calls := make([][]string, 60)
+	for i := 0; i < 60; i++ {
+		calls[i] = []string{"cloud-init", "status"}
+	}
+
+	c.Assert(cmd.Calls(), DeepEquals, calls)
+
+	// now disable should have been called
+	c.Assert(restrictCalls, Equals, 1)
+
+	// now a message after we timeout waiting for the transition
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init failed to transition to done or error state after 5 minutes, disabled permanently.*`)
+}
+
+func (s *cloudInitSuite) TestCloudInitErrorOnceAllowsFixing(c *C) {
+	// the absence of a zzzz_snapd.cfg file will indicate that it has not been
+	// restricted yet and thus it should then check to see if it was manually
+	// disabled
+
+	// the absence of a cloud-init.disabled file indicates that cloud-init is
+	// "untriggered", i.e. not active/running but could still be triggered
+
+	// we use a file to make the mocked cloud-init act differently depending on
+	// how many times it is called
+	// this is because we want to test settle()/EnsureBefore() automatically
+	// re-triggering the EnsureCloudInitRestricted() w/o changing the script
+	// mid-way through the test while settle() is running
+	cloudInitScriptStateFile := filepath.Join(c.MkDir(), "cloud-init-state")
+
+	cmd := testutil.MockCommand(c, "cloud-init", fmt.Sprintf(`
+# the first time the script is called the file shouldn't exist, so return error
+# next time when the file exists, return done
+if [ -f %[1]s ]; then
+	status="done"
+else
+	status="error"
+	touch %[1]s
+fi
+if [ "$1" = "status" ]; then
+	echo "status: $status"
+else
+	echo "unexpected args $*"
+	exit 1
+fi`, cloudInitScriptStateFile))
+	defer cmd.Restore()
+
+	restrictCalls := 0
+
+	r := devicestate.MockRestrictCloudInit(func(state sysconfig.CloudInitState, opts *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error) {
+		restrictCalls++
+		c.Assert(state, Equals, sysconfig.CloudInitDone)
+		c.Assert(opts, DeepEquals, &sysconfig.CloudInitRestrictOptions{
+			ForceDisable: false,
+		})
+		// we would have restricted it
+		return sysconfig.CloudInitRestrictionResult{
+			Action: "restrict",
+			// pretend it was NoCloud
+			DataSource: "NoCloud",
+		}, nil
+	})
+	defer r()
+
+	timeCalls := 0
+	testStart := time.Now()
+	r = devicestate.MockTimeNow(func() time.Time {
+		// we should only call time.Now() twice, first to initialize/set the
+		// that we saw cloud-init in error, and another immediately after to
+		// check if the 3 minute timeout has elapsed
+		timeCalls++
+		switch timeCalls {
+		case 1, 2:
+			return testStart
+		default:
+			c.Errorf("unexpected additional call (number %d) to time.Now()", timeCalls)
+			return time.Time{}
+		}
+	})
+	defer r()
+
+	err := devicestate.EnsureCloudInitRestricted(s.mgr)
+	c.Assert(err, IsNil)
+
+	// should not have called to restrict
+	c.Assert(restrictCalls, Equals, 0)
+
+	// make sure our time accounting is still correct
+	c.Assert(timeCalls, Equals, 2)
+
+	// only one call to cloud-init status
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+
+	// a message about being in error
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be in error state, will disable in 3 minutes`)
+	s.logbuf.Reset()
+
+	// we should have had a call to EnsureBefore, so if we now settle, we will
+	// see an additional call to cloud-init status, which now returns done and
+	// progresses
+	s.settle(c)
+
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+		{"cloud-init", "status"},
+	})
+
+	// make sure our time accounting is still correct
+	c.Assert(timeCalls, Equals, 2)
+
+	// now restrict should have been called
+	c.Assert(restrictCalls, Equals, 1)
+
+	// we now have a message about restricting
+	c.Assert(strings.TrimSpace(s.logbuf.String()), Matches, `.*System initialized, cloud-init reported to be done, set datasource_list to \[ NoCloud \] and disabled auto-import by filesystem label`)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_gadget_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_gadget_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_gadget_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_gadget_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016-2019 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -28,6 +28,9 @@
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget"
 	"github.com/snapcore/snapd/osutil"
@@ -60,6 +63,32 @@
     bootloader: grub
 `
 
+var uc20gadgetYaml = `
+volumes:
+  pc:
+    bootloader: grub
+    structure:
+      - name: ubuntu-seed
+        role: system-seed
+        type: 21686148-6449-6E6F-744E-656564454649
+        size: 20M
+      - name: ubuntu-boot
+        role: system-boot
+        type: 21686148-6449-6E6F-744E-656564454649
+        size: 10M
+      - name: ubuntu-data
+        role: system-data
+        type: 21686148-6449-6E6F-744E-656564454649
+        size: 50M
+`
+
+var uc20gadgetYamlWithSave = uc20gadgetYaml + `
+      - name: ubuntu-save
+        role: system-save
+        type: 21686148-6449-6E6F-744E-656564454649
+        size: 50M
+`
+
 func (s *deviceMgrGadgetSuite) setupModelWithGadget(c *C, gadget string) {
 	s.makeModelAssertionInState(c, "canonical", "pc-model", map[string]interface{}{
 		"architecture": "amd64",
@@ -74,7 +103,35 @@
 	})
 }
 
-func (s *deviceMgrGadgetSuite) setupGadgetUpdate(c *C) (chg *state.Change, tsk *state.Task) {
+func (s *deviceMgrGadgetSuite) setupUC20ModelWithGadget(c *C, gadget string) {
+	s.makeModelAssertionInState(c, "canonical", "pc20-model", map[string]interface{}{
+		"display-name": "UC20 pc model",
+		"architecture": "amd64",
+		"base":         "core20",
+		// enough to have a grade set
+		"grade": "dangerous",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":            "pc-kernel",
+				"id":              "pckernelidididididididididididid",
+				"type":            "kernel",
+				"default-channel": "20",
+			},
+			map[string]interface{}{
+				"name":            gadget,
+				"id":              "pcididididididididididididididid",
+				"type":            "gadget",
+				"default-channel": "20",
+			}},
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand:  "canonical",
+		Model:  "pc20-model",
+		Serial: "serial",
+	})
+}
+
+func (s *deviceMgrGadgetSuite) setupGadgetUpdate(c *C, modelGrade string) (chg *state.Change, tsk *state.Task) {
 	siCurrent := &snap.SideInfo{
 		RealName: "foo-gadget",
 		Revision: snap.R(33),
@@ -85,17 +142,30 @@
 		Revision: snap.R(34),
 		SnapID:   "foo-id",
 	}
+	gadgetYamlContent := gadgetYaml
+	if modelGrade != "" {
+		gadgetYamlContent = uc20gadgetYaml
+	}
 	snaptest.MockSnapWithFiles(c, snapYaml, siCurrent, [][]string{
-		{"meta/gadget.yaml", gadgetYaml},
+		{"meta/gadget.yaml", gadgetYamlContent},
+		{"managed-asset", "managed asset rev 33"},
+		{"trusted-asset", "trusted asset rev 33"},
 	})
 	snaptest.MockSnapWithFiles(c, snapYaml, si, [][]string{
-		{"meta/gadget.yaml", gadgetYaml},
+		{"meta/gadget.yaml", gadgetYamlContent},
+		{"managed-asset", "managed asset rev 34"},
+		// SHA3-384: 88478d8afe6925b348b9cd00085f3535959fde7029a64d7841b031acc39415c690796757afab1852a9e09da913a0151b
+		{"trusted-asset", "trusted asset rev 34"},
 	})
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	s.setupModelWithGadget(c, "foo-gadget")
+	if modelGrade == "" {
+		s.setupModelWithGadget(c, "foo-gadget")
+	} else {
+		s.setupUC20ModelWithGadget(c, "foo-gadget")
+	}
 
 	snapstate.Set(s.state, "foo-gadget", &snapstate.SnapState{
 		SnapType: "gadget",
@@ -115,10 +185,20 @@
 	return chg, tsk
 }
 
-func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreSimple(c *C) {
+func (s *deviceMgrGadgetSuite) testUpdateGadgetOnCoreSimple(c *C, grade string, encryption bool) {
 	var updateCalled bool
 	var passedRollbackDir string
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+
+	if grade != "" {
+		bootDir := c.MkDir()
+		tbl := bootloadertest.Mock("trusted", bootDir).WithTrustedAssets()
+		tbl.TrustedAssetsList = []string{"trusted-asset"}
+		tbl.ManagedAssetsList = []string{"managed-asset"}
+		bootloader.Force(tbl)
+		defer func() { bootloader.Force(nil) }()
+	}
+
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, observer gadget.ContentUpdateObserver) error {
 		updateCalled = true
 		passedRollbackDir = path
 		st, err := os.Stat(path)
@@ -126,11 +206,71 @@
 		m := st.Mode()
 		c.Assert(m.IsDir(), Equals, true)
 		c.Check(m.Perm(), Equals, os.FileMode(0750))
+		if grade == "" {
+			// non UC20 model
+			c.Check(observer, IsNil)
+		} else {
+			c.Check(observer, NotNil)
+			// expecting a very specific observer
+			trustedUpdateObserver, ok := observer.(*boot.TrustedAssetsUpdateObserver)
+			c.Assert(ok, Equals, true, Commentf("unexpected type: %T", observer))
+			c.Assert(trustedUpdateObserver, NotNil)
+
+			// check that observer is behaving correctly with
+			// respect to trusted and managed assets
+			targetDir := c.MkDir()
+			sourceStruct := &gadget.LaidOutStructure{
+				VolumeStructure: &gadget.VolumeStructure{
+					Role: gadget.SystemSeed,
+				},
+			}
+			act, err := observer.Observe(gadget.ContentUpdate, sourceStruct, targetDir, "managed-asset",
+				&gadget.ContentChange{After: filepath.Join(update.RootDir, "managed-asset")})
+			c.Assert(err, IsNil)
+			c.Check(act, Equals, gadget.ChangeIgnore)
+			act, err = observer.Observe(gadget.ContentUpdate, sourceStruct, targetDir, "trusted-asset",
+				&gadget.ContentChange{After: filepath.Join(update.RootDir, "trusted-asset")})
+			c.Assert(err, IsNil)
+			c.Check(act, Equals, gadget.ChangeApply)
+			// check that the behavior is correct
+			m, err := boot.ReadModeenv("")
+			c.Assert(err, IsNil)
+			if encryption {
+				// with encryption enabled, trusted asset would
+				// have been picked up by the the observer and
+				// added to modenv
+				c.Assert(m.CurrentTrustedRecoveryBootAssets, NotNil)
+				c.Check(m.CurrentTrustedRecoveryBootAssets["trusted-asset"], DeepEquals,
+					[]string{"88478d8afe6925b348b9cd00085f3535959fde7029a64d7841b031acc39415c690796757afab1852a9e09da913a0151b"})
+			} else {
+				c.Check(m.CurrentTrustedRecoveryBootAssets, HasLen, 0)
+			}
+		}
 		return nil
 	})
 	defer restore()
 
-	chg, t := s.setupGadgetUpdate(c)
+	chg, t := s.setupGadgetUpdate(c, grade)
+
+	// procure modeenv and stamp that we sealed keys
+	if grade != "" {
+		// state after mark-seeded ran
+		modeenv := boot.Modeenv{
+			Mode:           "run",
+			RecoverySystem: "",
+		}
+		err := modeenv.WriteTo("")
+		c.Assert(err, IsNil)
+
+		if encryption {
+			// sealed keys stamp
+			stamp := filepath.Join(dirs.SnapFDEDir, "sealed-keys")
+			c.Assert(os.MkdirAll(filepath.Dir(stamp), 0755), IsNil)
+			err = ioutil.WriteFile(stamp, nil, 0644)
+			c.Assert(err, IsNil)
+		}
+	}
+	devicestate.SetBootOkRan(s.mgr, true)
 
 	s.state.Lock()
 	s.state.Set("seeded", true)
@@ -151,15 +291,31 @@
 	c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystem})
 }
 
+func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreSimple(c *C) {
+	// unset grade
+	encryption := false
+	s.testUpdateGadgetOnCoreSimple(c, "", encryption)
+}
+
+func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnUC20CoreSimpleWithEncryption(c *C) {
+	encryption := true
+	s.testUpdateGadgetOnCoreSimple(c, "dangerous", encryption)
+}
+
+func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnUC20CoreSimpleNoEncryption(c *C) {
+	encryption := false
+	s.testUpdateGadgetOnCoreSimple(c, "dangerous", encryption)
+}
+
 func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreNoUpdateNeeded(c *C) {
 	var called bool
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		called = true
 		return gadget.ErrNoUpdate
 	})
 	defer restore()
 
-	chg, t := s.setupGadgetUpdate(c)
+	chg, t := s.setupGadgetUpdate(c, "")
 
 	s.se.Ensure()
 	s.se.Wait()
@@ -180,12 +336,12 @@
 		c.Skip("this test cannot run as root (permissions are not honored)")
 	}
 
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("unexpected call")
 	})
 	defer restore()
 
-	chg, t := s.setupGadgetUpdate(c)
+	chg, t := s.setupGadgetUpdate(c, "")
 
 	rollbackDir := filepath.Join(dirs.SnapRollbackDir, "foo-gadget_34")
 	err := os.MkdirAll(dirs.SnapRollbackDir, 0000)
@@ -207,11 +363,11 @@
 }
 
 func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreUpdateFailed(c *C) {
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("gadget exploded")
 	})
 	defer restore()
-	chg, t := s.setupGadgetUpdate(c)
+	chg, t := s.setupGadgetUpdate(c, "")
 
 	s.state.Lock()
 	s.state.Set("seeded", true)
@@ -231,7 +387,7 @@
 }
 
 func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreNotDuringFirstboot(c *C) {
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("unexpected call")
 	})
 	defer restore()
@@ -275,7 +431,7 @@
 }
 
 func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreBadGadgetYaml(c *C) {
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("unexpected call")
 	})
 	defer restore()
@@ -332,7 +488,7 @@
 }
 
 func (s *deviceMgrGadgetSuite) TestUpdateGadgetOnCoreParanoidChecks(c *C) {
-	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore := devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("unexpected call")
 	})
 	defer restore()
@@ -384,7 +540,7 @@
 	restore := release.MockOnClassic(true)
 	defer restore()
 
-	restore = devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore = devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("unexpected call")
 	})
 	defer restore()
@@ -462,7 +618,7 @@
 
 	expectedRollbackDir := filepath.Join(dirs.SnapRollbackDir, "foo-gadget_34")
 	updaterForStructureCalls := 0
-	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, rootDir, rollbackDir string) (gadget.Updater, error) {
+	restore := gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, rootDir, rollbackDir string, _ gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		updaterForStructureCalls++
 
 		c.Assert(ps.Name, Equals, "foo")
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate.go snapd-2.48.3+20.04/overlord/devicestate/devicestate.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate.go	2021-02-02 08:21:12.000000000 +0000
@@ -144,7 +144,7 @@
 	kind := ""
 	var snapType snap.Type
 	var getName func(*asserts.Model) string
-	switch snapInfo.GetType() {
+	switch snapInfo.Type() {
 	case snap.TypeGadget:
 		kind = "gadget"
 		snapType = snap.TypeGadget
@@ -204,7 +204,7 @@
 }
 
 func checkGadgetValid(st *state.State, snapInfo, _ *snap.Info, snapf snap.Container, flags snapstate.Flags, deviceCtx snapstate.DeviceContext) error {
-	if snapInfo.GetType() != snap.TypeGadget {
+	if snapInfo.Type() != snap.TypeGadget {
 		// not a gadget, nothing to do
 		return nil
 	}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_install_mode_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_install_mode_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_install_mode_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_install_mode_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,18 +27,25 @@
 	"path/filepath"
 
 	. "gopkg.in/check.v1"
+	"gopkg.in/tomb.v2"
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
+	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/devicestate"
 	"github.com/snapcore/snapd/overlord/devicestate/devicestatetest"
+	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/snapstate/snapstatetest"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/secboot"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
 	"github.com/snapcore/snapd/sysconfig"
@@ -48,8 +55,8 @@
 type deviceMgrInstallModeSuite struct {
 	deviceMgrBaseSuite
 
-	configureRunSystemOptsPassed []*sysconfig.Options
-	configureRunSystemErr        error
+	ConfigureTargetSystemOptsPassed []*sysconfig.Options
+	ConfigureTargetSystemErr        error
 }
 
 var _ = Suite(&deviceMgrInstallModeSuite{})
@@ -66,11 +73,11 @@
 func (s *deviceMgrInstallModeSuite) SetUpTest(c *C) {
 	s.deviceMgrBaseSuite.SetUpTest(c)
 
-	s.configureRunSystemOptsPassed = nil
-	s.configureRunSystemErr = nil
-	restore := devicestate.MockSysconfigConfigureRunSystem(func(opts *sysconfig.Options) error {
-		s.configureRunSystemOptsPassed = append(s.configureRunSystemOptsPassed, opts)
-		return s.configureRunSystemErr
+	s.ConfigureTargetSystemOptsPassed = nil
+	s.ConfigureTargetSystemErr = nil
+	restore := devicestate.MockSysconfigConfigureTargetSystem(func(opts *sysconfig.Options) error {
+		s.ConfigureTargetSystemOptsPassed = append(s.ConfigureTargetSystemOptsPassed, opts)
+		return s.ConfigureTargetSystemErr
 	})
 	s.AddCleanup(restore)
 
@@ -84,12 +91,13 @@
 	s.state.Set("seeded", true)
 }
 
-func (s *deviceMgrInstallModeSuite) makeMockInstalledPcGadget(c *C, grade string) *asserts.Model {
-	const (
-		pcSnapID       = "pcididididididididididididididid"
-		pcKernelSnapID = "pckernelidididididididididididid"
-		core20SnapID   = "core20ididididididididididididid"
-	)
+const (
+	pcSnapID       = "pcididididididididididididididid"
+	pcKernelSnapID = "pckernelidididididididididididid"
+	core20SnapID   = "core20ididididididididididididid"
+)
+
+func (s *deviceMgrInstallModeSuite) makeMockInstalledPcGadget(c *C, grade, gadgetDefaultsYaml string) *asserts.Model {
 	si := &snap.SideInfo{
 		RealName: "pc-kernel",
 		Revision: snap.R(1),
@@ -118,7 +126,7 @@
 		Active:   true,
 	})
 	snaptest.MockSnapWithFiles(c, "name: pc\ntype: gadget", si, [][]string{
-		{"meta/gadget.yaml", gadgetYaml},
+		{"meta/gadget.yaml", uc20gadgetYamlWithSave + gadgetDefaultsYaml},
 	})
 
 	si = &snap.SideInfo{
@@ -163,19 +171,30 @@
 }
 
 type encTestCase struct {
-	tpm     bool
-	bypass  bool
-	encrypt bool
+	tpm               bool
+	bypass            bool
+	encrypt           bool
+	trustedBootloader bool
 }
 
+var (
+	dataEncryptionKey = secboot.EncryptionKey{'d', 'a', 't', 'a', 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
+	dataRecoveryKey   = secboot.RecoveryKey{'r', 'e', 'c', 'o', 'v', 'e', 'r', 'y', 10, 11, 12, 13, 14, 15, 16, 17}
+
+	saveKey      = secboot.EncryptionKey{'s', 'a', 'v', 'e', 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
+	reinstallKey = secboot.RecoveryKey{'r', 'e', 'i', 'n', 's', 't', 'a', 'l', 'l', 11, 12, 13, 14, 15, 16, 17}
+)
+
 func (s *deviceMgrInstallModeSuite) doRunChangeTestWithEncryption(c *C, grade string, tc encTestCase) error {
 	restore := release.MockOnClassic(false)
 	defer restore()
+	bootloaderRootdir := c.MkDir()
 
 	var brGadgetRoot, brDevice string
-	var brOpts bootstrap.Options
-	var bootstrapRunCalled int
-	restore = devicestate.MockBootstrapRun(func(gadgetRoot, device string, options bootstrap.Options) error {
+	var brOpts install.Options
+	var installRunCalled int
+	var installSealingObserver gadget.ContentObserver
+	restore = devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, obs gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
 		// ensure we can grab the lock here, i.e. that it's not taken
 		s.state.Lock()
 		s.state.Unlock()
@@ -183,8 +202,24 @@
 		brGadgetRoot = gadgetRoot
 		brDevice = device
 		brOpts = options
-		bootstrapRunCalled++
-		return nil
+		installSealingObserver = obs
+		installRunCalled++
+		var keysForRoles map[string]*install.EncryptionKeySet
+		if tc.encrypt {
+			keysForRoles = map[string]*install.EncryptionKeySet{
+				gadget.SystemData: {
+					Key:         dataEncryptionKey,
+					RecoveryKey: dataRecoveryKey,
+				},
+				gadget.SystemSave: {
+					Key:         saveKey,
+					RecoveryKey: reinstallKey,
+				},
+			}
+		}
+		return &install.InstalledSystemSideData{
+			KeysForRoles: keysForRoles,
+		}, nil
 	})
 	defer restore()
 
@@ -197,8 +232,20 @@
 	})
 	defer restore()
 
+	if tc.trustedBootloader {
+		tab := bootloadertest.Mock("trusted", bootloaderRootdir).WithTrustedAssets()
+		tab.TrustedAssetsList = []string{"trusted-asset"}
+		bootloader.Force(tab)
+		s.AddCleanup(func() { bootloader.Force(nil) })
+
+		err := os.MkdirAll(boot.InitramfsUbuntuSeedDir, 0755)
+		c.Assert(err, IsNil)
+		err = ioutil.WriteFile(filepath.Join(boot.InitramfsUbuntuSeedDir, "trusted-asset"), nil, 0644)
+		c.Assert(err, IsNil)
+	}
+
 	s.state.Lock()
-	mockModel := s.makeMockInstalledPcGadget(c, grade)
+	mockModel := s.makeMockInstalledPcGadget(c, grade, "")
 	s.state.Unlock()
 
 	bypassEncryptionPath := filepath.Join(boot.InitramfsUbuntuSeedDir, ".force-unencrypted")
@@ -213,12 +260,18 @@
 	}
 
 	bootMakeBootableCalled := 0
-	restore = devicestate.MockBootMakeBootable(func(model *asserts.Model, rootdir string, bootWith *boot.BootableSet) error {
+	restore = devicestate.MockBootMakeBootable(func(model *asserts.Model, rootdir string, bootWith *boot.BootableSet, seal *boot.TrustedAssetsInstallObserver) error {
 		c.Check(model, DeepEquals, mockModel)
 		c.Check(rootdir, Equals, dirs.GlobalRootDir)
 		c.Check(bootWith.KernelPath, Matches, ".*/var/lib/snapd/snaps/pc-kernel_1.snap")
 		c.Check(bootWith.BasePath, Matches, ".*/var/lib/snapd/snaps/core20_2.snap")
 		c.Check(bootWith.RecoverySystemDir, Matches, "/systems/20191218")
+		c.Check(bootWith.UnpackedGadgetDir, Equals, filepath.Join(dirs.SnapMountDir, "pc/1"))
+		if tc.encrypt {
+			c.Check(seal, NotNil)
+		} else {
+			c.Check(seal, IsNil)
+		}
 		bootMakeBootableCalled++
 		return nil
 	})
@@ -252,32 +305,30 @@
 	c.Assert(installSystem.Status(), Equals, state.DoneStatus)
 
 	// in the right way
+	c.Assert(brGadgetRoot, Equals, filepath.Join(dirs.SnapMountDir, "/pc/1"))
+	c.Assert(brDevice, Equals, "")
 	if tc.encrypt {
-		c.Assert(brGadgetRoot, Equals, filepath.Join(dirs.SnapMountDir, "/pc/1"))
-		c.Assert(brDevice, Equals, "")
-		c.Assert(brOpts, DeepEquals, bootstrap.Options{
-			Mount:                true,
-			Encrypt:              true,
-			KeyFile:              filepath.Join(boot.InitramfsEncryptionKeyDir, "ubuntu-data.sealed-key"),
-			RecoveryKeyFile:      filepath.Join(boot.InstallHostWritableDir, "var/lib/snapd/device/fde/recovery.key"),
-			TPMLockoutAuthFile:   filepath.Join(boot.InstallHostWritableDir, "var/lib/snapd/device/fde/tpm-lockout-auth"),
-			PolicyUpdateDataFile: filepath.Join(boot.InstallHostWritableDir, "var/lib/snapd/device/fde/policy-update-data"),
-			KernelPath:           filepath.Join(dirs.SnapMountDir, "pc-kernel/1/kernel.efi"),
-			Model:                mockModel,
-			SystemLabel:          "20191218",
+		c.Assert(brOpts, DeepEquals, install.Options{
+			Mount:   true,
+			Encrypt: true,
 		})
-
-		// directories were ensured
-		c.Assert(osutil.IsDirectory(boot.InitramfsEncryptionKeyDir), Equals, true)
-		c.Assert(osutil.IsDirectory(filepath.Join(boot.InstallHostWritableDir, "var/lib/snapd/device/fde")), Equals, true)
 	} else {
-		c.Assert(brGadgetRoot, Equals, filepath.Join(dirs.SnapMountDir, "/pc/1"))
-		c.Assert(brDevice, Equals, "")
-		c.Assert(brOpts, DeepEquals, bootstrap.Options{
+		c.Assert(brOpts, DeepEquals, install.Options{
 			Mount: true,
 		})
 	}
-	c.Assert(bootstrapRunCalled, Equals, 1)
+	if tc.encrypt {
+		// inteface is not nil
+		c.Assert(installSealingObserver, NotNil)
+		// we expect a very specific type
+		trustedInstallObserver, ok := installSealingObserver.(*boot.TrustedAssetsInstallObserver)
+		c.Assert(ok, Equals, true, Commentf("unexpected type: %T", installSealingObserver))
+		c.Assert(trustedInstallObserver, NotNil)
+	} else {
+		c.Assert(installSealingObserver, IsNil)
+	}
+
+	c.Assert(installRunCalled, Equals, 1)
 	c.Assert(bootMakeBootableCalled, Equals, 1)
 	c.Assert(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
 
@@ -288,16 +339,17 @@
 	restore := release.MockOnClassic(false)
 	defer restore()
 
-	restore = devicestate.MockBootstrapRun(func(gadgetRoot, device string, options bootstrap.Options) error {
-		return fmt.Errorf("The horror, The horror")
+	restore = devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, _ gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
+		return nil, fmt.Errorf("The horror, The horror")
 	})
 	defer restore()
 
-	err := ioutil.WriteFile(filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd/modeenv"), nil, 0644)
+	err := ioutil.WriteFile(filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd/modeenv"),
+		[]byte("mode=install\n"), 0644)
 	c.Assert(err, IsNil)
 
 	s.state.Lock()
-	s.makeMockInstalledPcGadget(c, "dangerous")
+	s.makeMockInstalledPcGadget(c, "dangerous", "")
 	devicestate.SetSystemMode(s.mgr, "install")
 	s.state.Unlock()
 
@@ -308,7 +360,7 @@
 
 	installSystem := s.findInstallSystem()
 	c.Check(installSystem.Err(), ErrorMatches, `(?ms)cannot perform the following tasks:
-- Setup system for run mode \(cannot create partitions: The horror, The horror\)`)
+- Setup system for run mode \(cannot install system: The horror, The horror\)`)
 	// no restart request on failure
 	c.Check(s.restartRequests, HasLen, 0)
 }
@@ -355,8 +407,11 @@
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallDangerousWithTPM(c *C) {
-	err := s.doRunChangeTestWithEncryption(c, "dangerous", encTestCase{tpm: true, bypass: false, encrypt: true})
+	err := s.doRunChangeTestWithEncryption(c, "dangerous", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: true,
+	})
 	c.Assert(err, IsNil)
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "recovery.key"), testutil.FileEquals, dataRecoveryKey[:])
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallDangerousBypassEncryption(c *C) {
@@ -375,8 +430,11 @@
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallSignedWithTPM(c *C) {
-	err := s.doRunChangeTestWithEncryption(c, "signed", encTestCase{tpm: true, bypass: false, encrypt: true})
+	err := s.doRunChangeTestWithEncryption(c, "signed", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: true,
+	})
 	c.Assert(err, IsNil)
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "recovery.key"), testutil.FileEquals, dataRecoveryKey[:])
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallSignedBypassEncryption(c *C) {
@@ -386,34 +444,118 @@
 
 func (s *deviceMgrInstallModeSuite) TestInstallSecured(c *C) {
 	err := s.doRunChangeTestWithEncryption(c, "secured", encTestCase{tpm: false, bypass: false, encrypt: false})
-	c.Assert(err, ErrorMatches, "(?s).*cannot encrypt secured device: TPM not available.*")
+	c.Assert(err, ErrorMatches, "(?s).*cannot encrypt device storage as mandated by model grade secured:.*TPM not available.*")
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallSecuredWithTPM(c *C) {
-	err := s.doRunChangeTestWithEncryption(c, "secured", encTestCase{tpm: true, bypass: false, encrypt: true})
+	err := s.doRunChangeTestWithEncryption(c, "secured", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: true,
+	})
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "recovery.key"), testutil.FileEquals, dataRecoveryKey[:])
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallDangerousEncryptionWithTPMNoTrustedAssets(c *C) {
+	err := s.doRunChangeTestWithEncryption(c, "dangerous", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: false,
+	})
 	c.Assert(err, IsNil)
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "recovery.key"), testutil.FileEquals, dataRecoveryKey[:])
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallDangerousNoEncryptionWithTrustedAssets(c *C) {
+	err := s.doRunChangeTestWithEncryption(c, "dangerous", encTestCase{
+		tpm: false, bypass: false, encrypt: false, trustedBootloader: true,
+	})
+	c.Assert(err, IsNil)
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallSecuredWithTPMAndSave(c *C) {
+	err := s.doRunChangeTestWithEncryption(c, "secured", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: true,
+	})
+	c.Assert(err, IsNil)
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "recovery.key"), testutil.FileEquals, dataRecoveryKey[:])
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "ubuntu-save.key"), testutil.FileEquals, saveKey[:])
+	c.Check(filepath.Join(boot.InstallHostFDEDataDir, "reinstall.key"), testutil.FileEquals, reinstallKey[:])
+	marker, err := ioutil.ReadFile(filepath.Join(boot.InstallHostFDEDataDir, "marker"))
+	c.Assert(err, IsNil)
+	c.Check(marker, HasLen, 32)
+	c.Check(filepath.Join(boot.InstallHostFDESaveDir, "marker"), testutil.FileEquals, marker)
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallSecuredBypassEncryption(c *C) {
 	err := s.doRunChangeTestWithEncryption(c, "secured", encTestCase{tpm: false, bypass: true, encrypt: false})
-	c.Assert(err, ErrorMatches, "(?s).*cannot encrypt secured device: TPM not available.*")
+	c.Assert(err, ErrorMatches, "(?s).*cannot encrypt device storage as mandated by model grade secured:.*TPM not available.*")
 }
 
-func (s *deviceMgrInstallModeSuite) mockInstallModeChange(c *C, modelGrade string) *asserts.Model {
+func (s *deviceMgrInstallModeSuite) testInstallEncryptionSanityChecks(c *C, errMatch string) {
 	restore := release.MockOnClassic(false)
 	defer restore()
 
-	restore = devicestate.MockBootstrapRun(func(gadgetRoot, device string, options bootstrap.Options) error {
-		return nil
+	restore = devicestate.MockSecbootCheckKeySealingSupported(func() error { return nil })
+	defer restore()
+
+	err := ioutil.WriteFile(filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd/modeenv"),
+		[]byte("mode=install\n"), 0644)
+	c.Assert(err, IsNil)
+
+	s.state.Lock()
+	s.makeMockInstalledPcGadget(c, "dangerous", "")
+	devicestate.SetSystemMode(s.mgr, "install")
+	s.state.Unlock()
+
+	s.settle(c)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	installSystem := s.findInstallSystem()
+	c.Check(installSystem.Err(), ErrorMatches, errMatch)
+	// no restart request on failure
+	c.Check(s.restartRequests, HasLen, 0)
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallEncryptionSanityChecksNoKeys(c *C) {
+	restore := devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, _ gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
+		c.Check(options.Encrypt, Equals, true)
+		// no keys set
+		return &install.InstalledSystemSideData{}, nil
+	})
+	defer restore()
+	s.testInstallEncryptionSanityChecks(c, `(?ms)cannot perform the following tasks:
+- Setup system for run mode \(internal error: system encryption keys are unset\)`)
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallEncryptionSanityChecksNoSystemDataKey(c *C) {
+	restore := devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, _ gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
+		c.Check(options.Encrypt, Equals, true)
+		// no keys set
+		return &install.InstalledSystemSideData{
+			// empty map
+			KeysForRoles: map[string]*install.EncryptionKeySet{},
+		}, nil
+	})
+	defer restore()
+	s.testInstallEncryptionSanityChecks(c, `(?ms)cannot perform the following tasks:
+- Setup system for run mode \(internal error: system encryption keys are unset\)`)
+}
+
+func (s *deviceMgrInstallModeSuite) mockInstallModeChange(c *C, modelGrade, gadgetDefaultsYaml string) *asserts.Model {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	restore = devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, _ gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
+		return nil, nil
 	})
 	defer restore()
 
 	s.state.Lock()
-	mockModel := s.makeMockInstalledPcGadget(c, modelGrade)
+	mockModel := s.makeMockInstalledPcGadget(c, modelGrade, gadgetDefaultsYaml)
 	s.state.Unlock()
 	c.Check(mockModel.Grade(), Equals, asserts.ModelGrade(modelGrade))
 
-	restore = devicestate.MockBootMakeBootable(func(model *asserts.Model, rootdir string, bootWith *boot.BootableSet) error {
+	restore = devicestate.MockBootMakeBootable(func(model *asserts.Model, rootdir string, bootWith *boot.BootableSet, seal *boot.TrustedAssetsInstallObserver) error {
 		return nil
 	})
 	defer restore()
@@ -435,7 +577,7 @@
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallModeRunSysconfig(c *C) {
-	s.mockInstallModeChange(c, "dangerous")
+	s.mockInstallModeChange(c, "dangerous", "")
 
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -448,15 +590,19 @@
 	c.Check(installSystem.Err(), IsNil)
 	c.Check(installSystem.Status(), Equals, state.DoneStatus)
 
-	// and sysconfig.ConfigureRunSystem was run exactly once
-	c.Assert(s.configureRunSystemOptsPassed, DeepEquals, []*sysconfig.Options{
-		{TargetRootDir: boot.InstallHostWritableDir},
+	// and sysconfig.ConfigureTargetSystem was run exactly once
+	c.Assert(s.ConfigureTargetSystemOptsPassed, DeepEquals, []*sysconfig.Options{
+		{
+			AllowCloudInit: true,
+			TargetRootDir:  boot.InstallHostWritableDir,
+			GadgetDir:      filepath.Join(dirs.SnapMountDir, "pc/1/"),
+		},
 	})
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallModeRunSysconfigErr(c *C) {
-	s.configureRunSystemErr = fmt.Errorf("error from sysconfig.ConfigureRunSystem")
-	s.mockInstallModeChange(c, "dangerous")
+	s.ConfigureTargetSystemErr = fmt.Errorf("error from sysconfig.ConfigureTargetSystem")
+	s.mockInstallModeChange(c, "dangerous", "")
 
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -464,10 +610,14 @@
 	// the install-system was run but errorred as specified in the above mock
 	installSystem := s.findInstallSystem()
 	c.Check(installSystem.Err(), ErrorMatches, `(?ms)cannot perform the following tasks:
-- Setup system for run mode \(error from sysconfig.ConfigureRunSystem\)`)
-	// and sysconfig.ConfigureRunSystem was run exactly once
-	c.Assert(s.configureRunSystemOptsPassed, DeepEquals, []*sysconfig.Options{
-		{TargetRootDir: boot.InstallHostWritableDir},
+- Setup system for run mode \(error from sysconfig.ConfigureTargetSystem\)`)
+	// and sysconfig.ConfigureTargetSystem was run exactly once
+	c.Assert(s.ConfigureTargetSystemOptsPassed, DeepEquals, []*sysconfig.Options{
+		{
+			AllowCloudInit: true,
+			TargetRootDir:  boot.InstallHostWritableDir,
+			GadgetDir:      filepath.Join(dirs.SnapMountDir, "pc/1/"),
+		},
 	})
 }
 
@@ -481,18 +631,20 @@
 		c.Assert(err, IsNil)
 	}
 
-	s.mockInstallModeChange(c, "dangerous")
+	s.mockInstallModeChange(c, "dangerous", "")
 
 	// and did tell sysconfig about the cloud-init files
-	c.Assert(s.configureRunSystemOptsPassed, DeepEquals, []*sysconfig.Options{
+	c.Assert(s.ConfigureTargetSystemOptsPassed, DeepEquals, []*sysconfig.Options{
 		{
+			AllowCloudInit:  true,
 			CloudInitSrcDir: filepath.Join(boot.InitramfsUbuntuSeedDir, "data/etc/cloud/cloud.cfg.d"),
 			TargetRootDir:   boot.InstallHostWritableDir,
+			GadgetDir:       filepath.Join(dirs.SnapMountDir, "pc/1/"),
 		},
 	})
 }
 
-func (s *deviceMgrInstallModeSuite) TestInstallModeNoCloudInitForSigned(c *C) {
+func (s *deviceMgrInstallModeSuite) TestInstallModeSignedNoUbuntuSeedCloudInit(c *C) {
 	// pretend we have a cloud-init config on the seed partition
 	cloudCfg := filepath.Join(boot.InitramfsUbuntuSeedDir, "data/etc/cloud/cloud.cfg.d")
 	err := os.MkdirAll(cloudCfg, 0755)
@@ -502,24 +654,44 @@
 		c.Assert(err, IsNil)
 	}
 
-	// but it is signed
-	s.mockInstallModeChange(c, "signed")
+	s.mockInstallModeChange(c, "signed", "")
 
-	// so no cloud-init src dir is passed
-	c.Assert(s.configureRunSystemOptsPassed, DeepEquals, []*sysconfig.Options{
-		{TargetRootDir: boot.InstallHostWritableDir},
+	// and did NOT tell sysconfig about the cloud-init file, but also did not
+	// explicitly disable cloud init
+	c.Assert(s.ConfigureTargetSystemOptsPassed, DeepEquals, []*sysconfig.Options{
+		{
+			AllowCloudInit: true,
+			TargetRootDir:  boot.InstallHostWritableDir,
+			GadgetDir:      filepath.Join(dirs.SnapMountDir, "pc/1/"),
+		},
 	})
 }
 
-// TODO: convert test to "cloud.conf" support
-func (s *deviceMgrInstallModeSuite) TestInstallModeSupportsCloudInitFromGadgetNotSupported(c *C) {
-	// XXX: this is slightly magic - in mockInstallModeChange() we create
-	//      a mock pc gadget snap with revno 1. This is why we can set
-	//      set gadget dir here
+func (s *deviceMgrInstallModeSuite) TestInstallModeSecuredGadgetCloudConfCloudInit(c *C) {
+	// pretend we have a cloud.conf from the gadget
 	gadgetDir := filepath.Join(dirs.SnapMountDir, "pc/1/")
+	err := os.MkdirAll(gadgetDir, 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(gadgetDir, "cloud.conf"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	err = s.doRunChangeTestWithEncryption(c, "secured", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: true,
+	})
+	c.Assert(err, IsNil)
+
+	c.Assert(s.ConfigureTargetSystemOptsPassed, DeepEquals, []*sysconfig.Options{
+		{
+			AllowCloudInit: true,
+			TargetRootDir:  boot.InstallHostWritableDir,
+			GadgetDir:      filepath.Join(dirs.SnapMountDir, "pc/1/"),
+		},
+	})
+}
 
-	// pretend we have a cloud-init config in our gadget
-	cloudCfg := filepath.Join(gadgetDir, "cloud.cfg.d")
+func (s *deviceMgrInstallModeSuite) TestInstallModeSecuredNoUbuntuSeedCloudInit(c *C) {
+	// pretend we have a cloud-init config on the seed partition
+	cloudCfg := filepath.Join(boot.InitramfsUbuntuSeedDir, "data/etc/cloud/cloud.cfg.d")
 	err := os.MkdirAll(cloudCfg, 0755)
 	c.Assert(err, IsNil)
 	for _, mockCfg := range []string{"foo.cfg", "bar.cfg"} {
@@ -527,22 +699,25 @@
 		c.Assert(err, IsNil)
 	}
 
-	// cloud init config from gadget works for signed models too
-	s.mockInstallModeChange(c, "signed")
+	err = s.doRunChangeTestWithEncryption(c, "secured", encTestCase{
+		tpm: true, bypass: false, encrypt: true, trustedBootloader: true,
+	})
+	c.Assert(err, IsNil)
 
-	// nothing about cloud-init got passed to sysconf, we don't
-	// support cloud.cfg.d anymore
-	c.Assert(s.configureRunSystemOptsPassed, HasLen, 1)
-	c.Assert(s.configureRunSystemOptsPassed[0], DeepEquals, &sysconfig.Options{
-		TargetRootDir: boot.InstallHostWritableDir,
-		// not set
-		CloudInitSrcDir: "",
+	// and did NOT tell sysconfig about the cloud-init files, instead it was
+	// disabled because only gadget cloud-init is allowed
+	c.Assert(s.ConfigureTargetSystemOptsPassed, DeepEquals, []*sysconfig.Options{
+		{
+			AllowCloudInit: false,
+			TargetRootDir:  boot.InstallHostWritableDir,
+			GadgetDir:      filepath.Join(dirs.SnapMountDir, "pc/1/"),
+		},
 	})
 }
 
 func (s *deviceMgrInstallModeSuite) TestInstallModeWritesModel(c *C) {
 	// pretend we have a cloud-init config on the seed partition
-	model := s.mockInstallModeChange(c, "dangerous")
+	model := s.mockInstallModeChange(c, "dangerous", "")
 
 	var buf bytes.Buffer
 	err := asserts.NewEncoder(&buf).Encode(model)
@@ -558,5 +733,347 @@
 	c.Check(installSystem.Err(), IsNil)
 	c.Check(installSystem.Status(), Equals, state.DoneStatus)
 
-	c.Check(filepath.Join(boot.InitramfsUbuntuBootDir, "model"), testutil.FileEquals, buf.String())
+	c.Check(filepath.Join(boot.InitramfsUbuntuBootDir, "device/model"), testutil.FileEquals, buf.String())
+}
+
+func (s *deviceMgrInstallModeSuite) testInstallGadgetNoSave(c *C) {
+	err := ioutil.WriteFile(filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd/modeenv"),
+		[]byte("mode=install\n"), 0644)
+	c.Assert(err, IsNil)
+
+	s.state.Lock()
+	s.makeMockInstalledPcGadget(c, "dangerous", "")
+	info, err := snapstate.CurrentInfo(s.state, "pc")
+	c.Assert(err, IsNil)
+	// replace gadget yaml with one that has no ubuntu-save
+	c.Assert(uc20gadgetYaml, Not(testutil.Contains), "ubuntu-save")
+	err = ioutil.WriteFile(filepath.Join(info.MountDir(), "meta/gadget.yaml"), []byte(uc20gadgetYaml), 0644)
+	c.Assert(err, IsNil)
+	devicestate.SetSystemMode(s.mgr, "install")
+	s.state.Unlock()
+
+	s.settle(c)
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallWithEncryptionValidatesGadgetErr(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	restore = devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, _ gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
+		return nil, fmt.Errorf("unexpected call")
+	})
+	defer restore()
+
+	// pretend we have a TPM
+	restore = devicestate.MockSecbootCheckKeySealingSupported(func() error { return nil })
+	defer restore()
+
+	s.testInstallGadgetNoSave(c)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	installSystem := s.findInstallSystem()
+	c.Check(installSystem.Err(), ErrorMatches, `(?ms)cannot perform the following tasks:
+- Setup system for run mode \(cannot use gadget: gadget does not support encrypted data: volume "pc" has no structure with system-save role\)`)
+	// no restart request on failure
+	c.Check(s.restartRequests, HasLen, 0)
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallWithoutEncryptionValidatesGadgetWithoutSaveHappy(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	restore = devicestate.MockInstallRun(func(gadgetRoot, device string, options install.Options, _ gadget.ContentObserver) (*install.InstalledSystemSideData, error) {
+		return nil, nil
+	})
+	defer restore()
+
+	// pretend we have a TPM
+	restore = devicestate.MockSecbootCheckKeySealingSupported(func() error { return fmt.Errorf("TPM2 not available") })
+	defer restore()
+
+	s.testInstallGadgetNoSave(c)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	installSystem := s.findInstallSystem()
+	c.Check(installSystem.Err(), IsNil)
+	c.Check(s.restartRequests, HasLen, 1)
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallCheckEncrypted(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	mockModel := s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+	deviceCtx := &snapstatetest.TrivialDeviceContext{DeviceModel: mockModel}
+
+	for _, tc := range []struct {
+		hasFDESetupHook bool
+		hasTPM          bool
+		encrypt         bool
+	}{
+		// unhappy: no tpm, no hook
+		{false, false, false},
+		// happy: either tpm or hook or both
+		{false, true, true},
+		{true, false, true},
+		{true, true, true},
+	} {
+		hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+			ctx.Lock()
+			defer ctx.Unlock()
+			ctx.Set("fde-setup-result", []byte(`{"features":[]}`))
+			return nil, nil
+		}
+		rhk := hookstate.MockRunHook(hookInvoke)
+		defer rhk()
+
+		if tc.hasFDESetupHook {
+			makeInstalledMockKernelSnap(c, st, kernelYamlWithFdeSetup)
+		} else {
+			makeInstalledMockKernelSnap(c, st, kernelYamlNoFdeSetup)
+		}
+		restore := devicestate.MockSecbootCheckKeySealingSupported(func() error {
+			if tc.hasTPM {
+				return nil
+			}
+			return fmt.Errorf("tpm says no")
+		})
+		defer restore()
+
+		encrypt, err := devicestate.DeviceManagerCheckEncryption(s.mgr, st, deviceCtx)
+		c.Assert(err, IsNil)
+		c.Check(encrypt, Equals, tc.encrypt, Commentf("%v", tc))
+	}
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallCheckEncryptedStorageSafety(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	restore := devicestate.MockSecbootCheckKeySealingSupported(func() error { return nil })
+	defer restore()
+
+	var testCases = []struct {
+		grade, storageSafety string
+
+		expectedEncryption bool
+	}{
+		// we don't test unset here because the assertion assembly
+		// will ensure it has a default
+		{"dangerous", "prefer-unencrypted", false},
+		{"dangerous", "prefer-encrypted", true},
+		{"dangerous", "encrypted", true},
+		{"signed", "prefer-unencrypted", false},
+		{"signed", "prefer-encrypted", true},
+		{"signed", "encrypted", true},
+		// secured+prefer-{,un}encrypted is an error at the
+		// assertion level already so cannot be tested here
+		{"secured", "encrypted", true},
+	}
+	for _, tc := range testCases {
+		mockModel := s.makeModelAssertionInState(c, "my-brand", "my-model", map[string]interface{}{
+			"display-name":   "my model",
+			"architecture":   "amd64",
+			"base":           "core20",
+			"grade":          tc.grade,
+			"storage-safety": tc.storageSafety,
+			"snaps": []interface{}{
+				map[string]interface{}{
+					"name":            "pc-kernel",
+					"id":              pcKernelSnapID,
+					"type":            "kernel",
+					"default-channel": "20",
+				},
+				map[string]interface{}{
+					"name":            "pc",
+					"id":              pcSnapID,
+					"type":            "gadget",
+					"default-channel": "20",
+				}},
+		})
+		deviceCtx := &snapstatetest.TrivialDeviceContext{DeviceModel: mockModel}
+
+		encrypt, err := devicestate.DeviceManagerCheckEncryption(s.mgr, s.state, deviceCtx)
+		c.Assert(err, IsNil)
+		c.Check(encrypt, Equals, tc.expectedEncryption)
+	}
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallCheckEncryptedErrors(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	restore := devicestate.MockSecbootCheckKeySealingSupported(func() error { return fmt.Errorf("tpm says no") })
+	defer restore()
+
+	var testCases = []struct {
+		grade, storageSafety string
+
+		expectedErr string
+	}{
+		// we don't test unset here because the assertion assembly
+		// will ensure it has a default
+		{
+			"dangerous", "encrypted",
+			"cannot encrypt device storage as mandated by encrypted storage-safety model option: tpm says no",
+		}, {
+			"signed", "encrypted",
+			"cannot encrypt device storage as mandated by encrypted storage-safety model option: tpm says no",
+		}, {
+			"secured", "",
+			"cannot encrypt device storage as mandated by model grade secured: tpm says no",
+		}, {
+			"secured", "encrypted",
+			"cannot encrypt device storage as mandated by model grade secured: tpm says no",
+		},
+	}
+	for _, tc := range testCases {
+		mockModel := s.makeModelAssertionInState(c, "my-brand", "my-model", map[string]interface{}{
+			"display-name":   "my model",
+			"architecture":   "amd64",
+			"base":           "core20",
+			"grade":          tc.grade,
+			"storage-safety": tc.storageSafety,
+			"snaps": []interface{}{
+				map[string]interface{}{
+					"name":            "pc-kernel",
+					"id":              pcKernelSnapID,
+					"type":            "kernel",
+					"default-channel": "20",
+				},
+				map[string]interface{}{
+					"name":            "pc",
+					"id":              pcSnapID,
+					"type":            "gadget",
+					"default-channel": "20",
+				}},
+		})
+		deviceCtx := &snapstatetest.TrivialDeviceContext{DeviceModel: mockModel}
+		_, err := devicestate.DeviceManagerCheckEncryption(s.mgr, s.state, deviceCtx)
+		c.Check(err, ErrorMatches, tc.expectedErr, Commentf("%s %s", tc.grade, tc.storageSafety))
+	}
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallCheckEncryptedFDEHook(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+	makeInstalledMockKernelSnap(c, st, kernelYamlWithFdeSetup)
+
+	for _, tc := range []struct {
+		hookOutput  string
+		expectedErr string
+	}{
+		// invalid json
+		{"xxx", `cannot parse hook output "xxx": invalid character 'x' looking for beginning of value`},
+		// no output is invalid
+		{"", `cannot parse hook output "": unexpected end of JSON input`},
+		// specific error
+		{`{"error":"failed"}`, `cannot use hook: it returned error: failed`},
+		{`{}`, `cannot use hook: neither "features" nor "error" returned`},
+		// valid
+		{`{"features":[]}`, ""},
+		{`{"features":["a"]}`, ""},
+		{`{"features":["a","b"]}`, ""},
+		// features must be list of strings
+		{`{"features":[1]}`, `cannot parse hook output ".*": json: cannot unmarshal number into Go struct.*`},
+		{`{"features":1}`, `cannot parse hook output ".*": json: cannot unmarshal number into Go struct.*`},
+		{`{"features":"1"}`, `cannot parse hook output ".*": json: cannot unmarshal string into Go struct.*`},
+	} {
+		hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+			ctx.Lock()
+			defer ctx.Unlock()
+			ctx.Set("fde-setup-result", []byte(tc.hookOutput))
+			return nil, nil
+		}
+		rhk := hookstate.MockRunHook(hookInvoke)
+		defer rhk()
+
+		err := devicestate.DeviceManagerCheckFDEFeatures(s.mgr, st)
+		if tc.expectedErr != "" {
+			c.Check(err, ErrorMatches, tc.expectedErr, Commentf("%v", tc))
+		} else {
+			c.Check(err, IsNil, Commentf("%v", tc))
+		}
+	}
+}
+
+var checkEncryptionModelHeaders = map[string]interface{}{
+	"display-name": "my model",
+	"architecture": "amd64",
+	"base":         "core20",
+	"grade":        "dangerous",
+	"snaps": []interface{}{
+		map[string]interface{}{
+			"name":            "pc-kernel",
+			"id":              pcKernelSnapID,
+			"type":            "kernel",
+			"default-channel": "20",
+		},
+		map[string]interface{}{
+			"name":            "pc",
+			"id":              pcSnapID,
+			"type":            "gadget",
+			"default-channel": "20",
+		}},
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallCheckEncryptedErrorsLogsTPM(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	restore := devicestate.MockSecbootCheckKeySealingSupported(func() error {
+		return fmt.Errorf("tpm says no")
+	})
+	defer restore()
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	mockModel := s.makeModelAssertionInState(c, "my-brand", "my-model", checkEncryptionModelHeaders)
+	deviceCtx := &snapstatetest.TrivialDeviceContext{DeviceModel: mockModel}
+	_, err := devicestate.DeviceManagerCheckEncryption(s.mgr, s.state, deviceCtx)
+	c.Check(err, IsNil)
+	c.Check(logbuf.String(), Matches, "(?s).*: not encrypting device storage as checking TPM gave: tpm says no\n")
+}
+
+func (s *deviceMgrInstallModeSuite) TestInstallCheckEncryptedErrorsLogsHook(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	mockModel := s.makeModelAssertionInState(c, "my-brand", "my-model", checkEncryptionModelHeaders)
+	// mock kernel installed but no hook or handle so checkEncryption
+	// will fail
+	makeInstalledMockKernelSnap(c, s.state, kernelYamlWithFdeSetup)
+
+	deviceCtx := &snapstatetest.TrivialDeviceContext{DeviceModel: mockModel}
+	_, err := devicestate.DeviceManagerCheckEncryption(s.mgr, s.state, deviceCtx)
+	c.Check(err, IsNil)
+	c.Check(logbuf.String(), Matches, "(?s).*: not encrypting device storage as querying kernel fde-setup hook did not succeed:.*\n")
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_remodel_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_remodel_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_remodel_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_remodel_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -33,6 +33,7 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/quantity"
 	"github.com/snapcore/snapd/overlord/assertstate"
 	"github.com/snapcore/snapd/overlord/assertstate/assertstatetest"
 	"github.com/snapcore/snapd/overlord/auth"
@@ -1339,7 +1340,7 @@
 	defer restore()
 
 	gadgetUpdateCalled := false
-	restore = devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore = devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		gadgetUpdateCalled = true
 		c.Check(policy, NotNil)
 		c.Check(reflect.ValueOf(policy).Pointer(), Equals, reflect.ValueOf(gadget.RemodelUpdatePolicy).Pointer())
@@ -1351,7 +1352,7 @@
 						Structure: []gadget.VolumeStructure{{
 							Name:       "foo",
 							Type:       "00000000-0000-0000-0000-0000deadcafe",
-							Size:       10 * gadget.SizeMiB,
+							Size:       10 * quantity.SizeMiB,
 							Filesystem: "ext4",
 							Content: []gadget.VolumeContent{
 								{Source: "foo-content", Target: "/"},
@@ -1359,7 +1360,7 @@
 						}, {
 							Name: "bare-one",
 							Type: "bare",
-							Size: gadget.SizeMiB,
+							Size: quantity.SizeMiB,
 							Content: []gadget.VolumeContent{
 								{Image: "bare.img"},
 							},
@@ -1377,7 +1378,7 @@
 						Structure: []gadget.VolumeStructure{{
 							Name:       "foo",
 							Type:       "00000000-0000-0000-0000-0000deadcafe",
-							Size:       10 * gadget.SizeMiB,
+							Size:       10 * quantity.SizeMiB,
 							Filesystem: "ext4",
 							Content: []gadget.VolumeContent{
 								{Source: "new-foo-content", Target: "/"},
@@ -1385,7 +1386,7 @@
 						}, {
 							Name: "bare-one",
 							Type: "bare",
-							Size: gadget.SizeMiB,
+							Size: quantity.SizeMiB,
 							Content: []gadget.VolumeContent{
 								{Image: "new-bare-content.img"},
 							},
@@ -1485,7 +1486,7 @@
 	defer restore()
 
 	gadgetUpdateCalled := false
-	restore = devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error {
+	restore = devicestate.MockGadgetUpdate(func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, _ gadget.ContentUpdateObserver) error {
 		return errors.New("unexpected call")
 	})
 	defer restore()
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_serial_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_serial_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_serial_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_serial_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,7 @@
 	"net/http/httptest"
 	"net/url"
 	"os"
+	"path/filepath"
 	"syscall"
 	"time"
 
@@ -34,8 +35,11 @@
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
+	"github.com/snapcore/snapd/asserts/sysdb"
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/httputil"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/assertstate"
 	"github.com/snapcore/snapd/overlord/assertstate/assertstatetest"
 	"github.com/snapcore/snapd/overlord/auth"
@@ -47,8 +51,10 @@
 	"github.com/snapcore/snapd/overlord/storecontext"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
 	"github.com/snapcore/snapd/snapdenv"
 	"github.com/snapcore/snapd/strutil"
+	"github.com/snapcore/snapd/testutil"
 )
 
 var testKeyLength = 1024
@@ -67,7 +73,7 @@
 	var signing assertstest.SignerDB = s.storeSigning
 
 	switch model {
-	case "pc", "pc2":
+	case "pc", "pc2", "pc-20":
 		fallthrough
 	case "classic-alt-store":
 		c.Check(brandID, Equals, "canonical")
@@ -189,6 +195,9 @@
 	c.Check(privKey, NotNil)
 
 	c.Check(device.KeyID, Equals, privKey.PublicKey().ID())
+
+	// check that keypair manager is under device
+	c.Check(osutil.IsDirectory(filepath.Join(dirs.SnapDeviceDir, "private-keys-v1")), Equals, true)
 }
 
 func (s *deviceMgrSerialSuite) TestFullDeviceRegistrationHappyWithProxy(c *C) {
@@ -698,6 +707,12 @@
 	s.state.Lock()
 	defer s.state.Unlock()
 
+	s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+
 	devicestatetest.MockGadget(c, s.state, "gadget", snap.R(2), nil)
 
 	devicestatetest.SetDevice(s.state, &auth.DeviceState{
@@ -1468,6 +1483,17 @@
 	s.state.Lock()
 	defer s.state.Unlock()
 
+	// set model as seeding would
+	s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+
 	scb := s.mgr.StoreContextBackend()
 
 	// nothing there
@@ -1867,3 +1893,123 @@
 	becomeOperational := s.findBecomeOperationalChange()
 	c.Assert(becomeOperational, IsNil)
 }
+
+func (s *deviceMgrSerialSuite) TestFullDeviceRegistrationUC20Happy(c *C) {
+	defer sysdb.InjectTrusted([]asserts.Assertion{s.storeSigning.TrustedKey})()
+
+	r1 := devicestate.MockKeyLength(testKeyLength)
+	defer r1()
+
+	mockServer := s.mockServer(c, "REQID-1", nil)
+	defer mockServer.Close()
+
+	r2 := devicestate.MockBaseStoreURL(mockServer.URL)
+	defer r2()
+
+	// setup state as will be done by first-boot
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.makeModelAssertionInState(c, "canonical", "pc-20", map[string]interface{}{
+		"architecture": "amd64",
+		// UC20
+		"base": "core20",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":            "pc-kernel",
+				"id":              snaptest.AssertedSnapID("oc-kernel"),
+				"type":            "kernel",
+				"default-channel": "20",
+			},
+			map[string]interface{}{
+				"name":            "pc",
+				"id":              snaptest.AssertedSnapID("pc"),
+				"type":            "gadget",
+				"default-channel": "20",
+			},
+		},
+	})
+
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc-20",
+	})
+
+	// save is available
+	devicestate.SetSaveAvailable(s.mgr, true)
+
+	// avoid full seeding
+	s.seeding()
+
+	becomeOperational := s.findBecomeOperationalChange()
+	c.Check(becomeOperational, IsNil)
+
+	devicestatetest.MockGadget(c, s.state, "pc", snap.R(2), nil)
+	// mark it as seeded
+	s.state.Set("seeded", true)
+	// skip boot ok logic
+	devicestate.SetBootOkRan(s.mgr, true)
+
+	// runs the whole device registration process
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	becomeOperational = s.findBecomeOperationalChange()
+	c.Assert(becomeOperational, NotNil)
+
+	c.Check(becomeOperational.Status().Ready(), Equals, true)
+	c.Check(becomeOperational.Err(), IsNil)
+
+	device, err := devicestatetest.Device(s.state)
+	c.Assert(err, IsNil)
+	c.Check(device.Brand, Equals, "canonical")
+	c.Check(device.Model, Equals, "pc-20")
+	c.Check(device.Serial, Equals, "9999")
+
+	ok := false
+	select {
+	case <-s.mgr.Registered():
+		ok = true
+	case <-time.After(5 * time.Second):
+		c.Fatal("should have been marked registered")
+	}
+	c.Check(ok, Equals, true)
+
+	a, err := s.db.Find(asserts.SerialType, map[string]string{
+		"brand-id": "canonical",
+		"model":    "pc-20",
+		"serial":   "9999",
+	})
+	c.Assert(err, IsNil)
+	serial := a.(*asserts.Serial)
+
+	privKey, err := devicestate.KeypairManager(s.mgr).Get(serial.DeviceKey().ID())
+	c.Assert(err, IsNil)
+	c.Check(privKey, NotNil)
+
+	c.Check(device.KeyID, Equals, privKey.PublicKey().ID())
+
+	// check that keypair manager is under save
+	c.Check(osutil.IsDirectory(filepath.Join(dirs.SnapDeviceSaveDir, "private-keys-v1")), Equals, true)
+	c.Check(filepath.Join(dirs.SnapDeviceDir, "private-keys-v1"), testutil.FileAbsent)
+
+	// check that the serial was saved to the device save assertion db
+	// as well
+	savedb, err := sysdb.OpenAt(dirs.SnapDeviceSaveDir)
+	c.Assert(err, IsNil)
+	// a copy of model was saved there
+	_, err = savedb.Find(asserts.ModelType, map[string]string{
+		"series":   "16",
+		"brand-id": "canonical",
+		"model":    "pc-20",
+	})
+	c.Assert(err, IsNil)
+	// a copy of serial was backed up there
+	_, err = savedb.Find(asserts.SerialType, map[string]string{
+		"brand-id": "canonical",
+		"model":    "pc-20",
+		"serial":   "9999",
+	})
+	c.Assert(err, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_systems_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_systems_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_systems_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_systems_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,7 +20,9 @@
 package devicestate_test
 
 import (
+	"bytes"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 
@@ -28,7 +30,9 @@
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/assertstest"
+	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/devicestate"
 	"github.com/snapcore/snapd/overlord/devicestate/devicestatetest"
@@ -49,6 +53,7 @@
 type deviceMgrSystemsSuite struct {
 	deviceMgrBaseSuite
 
+	logbuf            *bytes.Buffer
 	mockedSystemSeeds []mockedSystemSeed
 }
 
@@ -184,6 +189,20 @@
 	// all tests should be in run mode by default, if they need to be in
 	// different modes they should set that individually
 	devicestate.SetSystemMode(s.mgr, "run")
+
+	// state after mark-seeded ran
+	modeenv := boot.Modeenv{
+		Mode:           "run",
+		RecoverySystem: "",
+	}
+	err := modeenv.WriteTo("")
+	s.state.Set("seeded", true)
+
+	c.Assert(err, IsNil)
+
+	logbuf, restore := logger.MockLogger()
+	s.logbuf = logbuf
+	s.AddCleanup(restore)
 }
 
 func (s *deviceMgrSystemsSuite) TestListNoSystems(c *C) {
@@ -311,7 +330,7 @@
 
 func (s *deviceMgrSystemsSuite) TestRequestModeInstallHappyForAny(c *C) {
 	// no current system
-	err := s.mgr.RequestSystemAction("20191119", devicestate.SystemAction{Mode: "install"})
+	err := s.mgr.RequestSystemAction("20191119", devicestate.SystemAction{Mode: "install", Title: "Install"})
 	c.Assert(err, IsNil)
 
 	m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
@@ -321,6 +340,7 @@
 		"snapd_recovery_mode":   "install",
 	})
 	c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
+	c.Check(s.logbuf.String(), Matches, `.*: restarting into system "20191119" for action "Install"\n`)
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestSameModeSameSystem(c *C) {
@@ -336,12 +356,25 @@
 
 	label := s.mockedSystemSeeds[0].label
 
-	happyModes := []string{"run", "recover"}
-	sadModes := []string{"install"}
+	happyModes := []string{"run"}
+	sadModes := []string{"install", "recover"}
 
 	for _, mode := range append(happyModes, sadModes...) {
+		s.logbuf.Reset()
+
+		c.Logf("checking mode: %q", mode)
+		// non run modes use modeenv
+		modeenv := boot.Modeenv{
+			Mode: mode,
+		}
+		if mode != "run" {
+			modeenv.RecoverySystem = s.mockedSystemSeeds[0].label
+		}
+		err := modeenv.WriteTo("")
+		c.Assert(err, IsNil)
+
 		devicestate.SetSystemMode(s.mgr, mode)
-		err := s.bootloader.SetBootVars(map[string]string{
+		err = s.bootloader.SetBootVars(map[string]string{
 			"snapd_recovery_mode":   mode,
 			"snapd_recovery_system": label,
 		})
@@ -361,55 +394,110 @@
 		})
 		// should never restart
 		c.Check(s.restartRequests, HasLen, 0)
+		// no log output
+		c.Check(s.logbuf.String(), Equals, "")
 	}
 }
 
-func (s *deviceMgrSystemsSuite) TestRequestNotYetSeeded(c *C) {
-	// seeded-systems is unset
+func (s *deviceMgrSystemsSuite) TestRequestSeedingSameConflict(c *C) {
 	label := s.mockedSystemSeeds[0].label
 
+	devicestate.SetSystemMode(s.mgr, "run")
+
+	s.state.Lock()
+	s.state.Set("seeded", nil)
+	s.state.Unlock()
+
 	for _, mode := range []string{"run", "install", "recover"} {
-		devicestate.SetSystemMode(s.mgr, mode)
-		err := s.bootloader.SetBootVars(map[string]string{
-			"snapd_recovery_mode":   mode,
+		s.logbuf.Reset()
+
+		c.Logf("checking mode: %q", mode)
+		modeenv := boot.Modeenv{
+			Mode:           mode,
+			RecoverySystem: s.mockedSystemSeeds[0].label,
+		}
+		err := modeenv.WriteTo("")
+		c.Assert(err, IsNil)
+
+		err = s.bootloader.SetBootVars(map[string]string{
+			"snapd_recovery_mode":   "",
 			"snapd_recovery_system": label,
 		})
 		c.Assert(err, IsNil)
 		err = s.mgr.RequestSystemAction(label, devicestate.SystemAction{Mode: mode})
-		c.Assert(err, Equals, devicestate.ErrUnsupportedAction)
+		c.Assert(err, ErrorMatches, "cannot request system action, system is seeding")
+		// no log output
+		c.Check(s.logbuf.String(), Equals, "")
 	}
 }
 
-func (s *deviceMgrSystemsSuite) TestRequestModeRunInstallForRecover(c *C) {
-	// we are in recover mode here
-	devicestate.SetSystemMode(s.mgr, "recover")
+func (s *deviceMgrSystemsSuite) TestRequestSeedingDifferentNoConflict(c *C) {
+	label := s.mockedSystemSeeds[0].label
+	otherLabel := s.mockedSystemSeeds[1].label
+
+	devicestate.SetSystemMode(s.mgr, "run")
+
+	modeenv := boot.Modeenv{
+		Mode:           "run",
+		RecoverySystem: label,
+	}
+	err := modeenv.WriteTo("")
+	c.Assert(err, IsNil)
+
 	s.state.Lock()
-	s.state.Set("seeded-systems", []devicestate.SeededSystem{
-		{
-			System:  s.mockedSystemSeeds[0].label,
-			Model:   s.mockedSystemSeeds[0].model.Model(),
-			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
-		},
-	})
+	s.state.Set("seeded", nil)
 	s.state.Unlock()
 
-	for _, mode := range []string{"install", "run"} {
-		err := s.mgr.RequestSystemAction(s.mockedSystemSeeds[0].label,
-			devicestate.SystemAction{Mode: mode})
+	// we can only go to install mode of other system when one is currently
+	// being seeded
+	err = s.bootloader.SetBootVars(map[string]string{
+		"snapd_recovery_mode":   "",
+		"snapd_recovery_system": label,
+	})
+	c.Assert(err, IsNil)
+	err = s.mgr.RequestSystemAction(otherLabel, devicestate.SystemAction{Mode: "install"})
+	c.Assert(err, IsNil)
+	m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	c.Check(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": otherLabel,
+		"snapd_recovery_mode":   "install",
+	})
+	c.Check(s.logbuf.String(), Matches, fmt.Sprintf(`.*: restarting into system "%s" for action "Install"\n`, otherLabel))
+}
+
+func (s *deviceMgrSystemsSuite) testRequestModeWithRestart(c *C, toModes []string, label string) {
+	for _, mode := range toModes {
+		c.Logf("checking mode: %q", mode)
+		err := s.mgr.RequestSystemAction(label, devicestate.SystemAction{Mode: mode})
 		c.Assert(err, IsNil)
 		m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
 		c.Assert(err, IsNil)
 		c.Check(m, DeepEquals, map[string]string{
-			"snapd_recovery_system": s.mockedSystemSeeds[0].label,
+			"snapd_recovery_system": label,
 			"snapd_recovery_mode":   mode,
 		})
 		c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
 		s.restartRequests = nil
 		s.bootloader.BootVars = map[string]string{}
+
+		// TODO: also test correct action string logging
+		c.Check(s.logbuf.String(), Matches, fmt.Sprintf(`.*: restarting into system "%s" for action ".*"\n`, label))
+		s.logbuf.Reset()
 	}
 }
 
-func (s *deviceMgrSystemsSuite) TestRequestModeInstallRecoverForCurrent(c *C) {
+func (s *deviceMgrSystemsSuite) TestRequestModeRunInstallForRecover(c *C) {
+	// we are in recover mode here
+	devicestate.SetSystemMode(s.mgr, "recover")
+	// non run modes use modeenv
+	modeenv := boot.Modeenv{
+		Mode:           "recover",
+		RecoverySystem: s.mockedSystemSeeds[0].label,
+	}
+	err := modeenv.WriteTo("")
+	c.Assert(err, IsNil)
+
 	s.state.Lock()
 	s.state.Set("seeded-systems", []devicestate.SeededSystem{
 		{
@@ -420,20 +508,29 @@
 	})
 	s.state.Unlock()
 
-	for _, mode := range []string{"install", "recover"} {
-		err := s.mgr.RequestSystemAction(s.mockedSystemSeeds[0].label,
-			devicestate.SystemAction{Mode: mode})
-		c.Assert(err, IsNil)
-		m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
-		c.Assert(err, IsNil)
-		c.Check(m, DeepEquals, map[string]string{
-			"snapd_recovery_system": s.mockedSystemSeeds[0].label,
-			"snapd_recovery_mode":   mode,
-		})
-		c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
-		s.restartRequests = nil
-		s.bootloader.BootVars = map[string]string{}
+	s.testRequestModeWithRestart(c, []string{"install", "run"}, s.mockedSystemSeeds[0].label)
+}
+
+func (s *deviceMgrSystemsSuite) TestRequestModeInstallRecoverForCurrent(c *C) {
+	devicestate.SetSystemMode(s.mgr, "run")
+	// non run modes use modeenv
+	modeenv := boot.Modeenv{
+		Mode: "run",
 	}
+	err := modeenv.WriteTo("")
+	c.Assert(err, IsNil)
+
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+
+	s.testRequestModeWithRestart(c, []string{"install", "recover"}, s.mockedSystemSeeds[0].label)
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestModeErrInBoot(c *C) {
@@ -441,6 +538,7 @@
 	err := s.mgr.RequestSystemAction("20191119", devicestate.SystemAction{Mode: "install"})
 	c.Assert(err, ErrorMatches, `cannot set device to boot into system "20191119" in mode "install": no can do`)
 	c.Check(s.restartRequests, HasLen, 0)
+	c.Check(s.logbuf.String(), Equals, "")
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestModeNotFound(c *C) {
@@ -448,12 +546,14 @@
 	c.Assert(err, NotNil)
 	c.Assert(os.IsNotExist(err), Equals, true)
 	c.Check(s.restartRequests, HasLen, 0)
+	c.Check(s.logbuf.String(), Equals, "")
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestModeBadMode(c *C) {
 	err := s.mgr.RequestSystemAction("20191119", devicestate.SystemAction{Mode: "unknown-mode"})
 	c.Assert(err, Equals, devicestate.ErrUnsupportedAction)
 	c.Check(s.restartRequests, HasLen, 0)
+	c.Check(s.logbuf.String(), Equals, "")
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestModeBroken(c *C) {
@@ -464,6 +564,7 @@
 	err = s.mgr.RequestSystemAction("20191119", devicestate.SystemAction{Mode: "install"})
 	c.Assert(err, ErrorMatches, "cannot load seed system: cannot load assertions: .*")
 	c.Check(s.restartRequests, HasLen, 0)
+	c.Check(s.logbuf.String(), Equals, "")
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestModeNonUC20(c *C) {
@@ -471,6 +572,13 @@
 	err := s.mgr.RequestSystemAction("20191119", devicestate.SystemAction{Mode: "install"})
 	c.Assert(err, ErrorMatches, `cannot set device to boot into system "20191119" in mode "install": system mode is unsupported`)
 	c.Check(s.restartRequests, HasLen, 0)
+	c.Check(s.logbuf.String(), Equals, "")
+}
+
+func (s *deviceMgrSystemsSuite) TestRequestActionNoLabel(c *C) {
+	err := s.mgr.RequestSystemAction("", devicestate.SystemAction{Mode: "install"})
+	c.Assert(err, ErrorMatches, "internal error: system label is unset")
+	c.Check(s.logbuf.String(), Equals, "")
 }
 
 func (s *deviceMgrSystemsSuite) TestRequestModeForNonCurrent(c *C) {
@@ -491,4 +599,231 @@
 	err = s.mgr.RequestSystemAction(s.mockedSystemSeeds[1].label, devicestate.SystemAction{Mode: "recover"})
 	c.Assert(err, Equals, devicestate.ErrUnsupportedAction)
 	c.Check(s.restartRequests, HasLen, 0)
+	c.Check(s.logbuf.String(), Equals, "")
+}
+
+func (s *deviceMgrSystemsSuite) TestRequestInstallForOther(c *C) {
+	devicestate.SetSystemMode(s.mgr, "run")
+	// non run modes use modeenv
+	modeenv := boot.Modeenv{
+		Mode: "run",
+	}
+	err := modeenv.WriteTo("")
+	c.Assert(err, IsNil)
+
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+	// reinstall from different system seed is ok
+	s.testRequestModeWithRestart(c, []string{"install"}, s.mockedSystemSeeds[1].label)
+}
+
+func (s *deviceMgrSystemsSuite) TestRequestAction1618(c *C) {
+	s.setPCModelInState(c)
+	// system mode is unset in 16/18
+	devicestate.SetSystemMode(s.mgr, "")
+	// no modeenv either
+	err := os.Remove(dirs.SnapModeenvFileUnder(dirs.GlobalRootDir))
+	c.Assert(err, IsNil)
+
+	s.state.Lock()
+	s.state.Set("seeded-systems", nil)
+	s.state.Set("seeded", nil)
+	s.state.Unlock()
+	// a label exists
+	err = s.mgr.RequestSystemAction(s.mockedSystemSeeds[0].label, devicestate.SystemAction{Mode: "install"})
+	c.Assert(err, ErrorMatches, "cannot set device to boot .*: system mode is unsupported")
+
+	s.state.Lock()
+	s.state.Set("seeded", true)
+	s.state.Unlock()
+
+	// even with system mode explicitly set, the action is not executed
+	devicestate.SetSystemMode(s.mgr, "run")
+
+	err = s.mgr.RequestSystemAction(s.mockedSystemSeeds[0].label, devicestate.SystemAction{Mode: "install"})
+	c.Assert(err, ErrorMatches, "cannot set device to boot .*: system mode is unsupported")
+
+	devicestate.SetSystemMode(s.mgr, "")
+	// also no UC20 style system seeds
+	for _, m := range s.mockedSystemSeeds {
+		os.RemoveAll(filepath.Join(dirs.SnapSeedDir, "systems", m.label))
+	}
+
+	err = s.mgr.RequestSystemAction(s.mockedSystemSeeds[0].label, devicestate.SystemAction{Mode: "install"})
+	c.Assert(err, ErrorMatches, ".*/seed/systems/20191119: no such file or directory")
+	c.Check(s.logbuf.String(), Equals, "")
+}
+
+func (s *deviceMgrSystemsSuite) TestRebootNoLabelNoModeHappy(c *C) {
+	err := s.mgr.Reboot("", "")
+	c.Assert(err, IsNil)
+
+	m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	// requested restart
+	c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
+	// but no bootloader changes
+	c.Check(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "",
+		"snapd_recovery_mode":   "",
+	})
+	c.Check(s.logbuf.String(), Matches, `.*: rebooting system\n`)
+}
+
+func (s *deviceMgrSystemsSuite) TestRebootLabelAndModeHappy(c *C) {
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+
+	err := s.mgr.Reboot("20191119", "install")
+	c.Assert(err, IsNil)
+
+	m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	c.Check(m, DeepEquals, map[string]string{
+		"snapd_recovery_system": "20191119",
+		"snapd_recovery_mode":   "install",
+	})
+	c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
+	c.Check(s.logbuf.String(), Matches, `.*: rebooting into system "20191119" in "install" mode\n`)
+}
+
+func (s *deviceMgrSystemsSuite) TestRebootModeOnlyHappy(c *C) {
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+
+	for _, mode := range []string{"recover", "install"} {
+		s.restartRequests = nil
+		s.bootloader.BootVars = make(map[string]string)
+		s.logbuf.Reset()
+
+		err := s.mgr.Reboot("", mode)
+		c.Assert(err, IsNil)
+
+		m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+		c.Assert(err, IsNil)
+		c.Check(m, DeepEquals, map[string]string{
+			"snapd_recovery_system": s.mockedSystemSeeds[0].label,
+			"snapd_recovery_mode":   mode,
+		})
+		c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
+		c.Check(s.logbuf.String(), Matches, fmt.Sprintf(`.*: rebooting into system "20191119" in "%s" mode\n`, mode))
+	}
+}
+
+func (s *deviceMgrSystemsSuite) TestRebootFromRecoverToRun(c *C) {
+	modeenv := boot.Modeenv{
+		Mode:           "recover",
+		RecoverySystem: s.mockedSystemSeeds[0].label,
+	}
+	err := modeenv.WriteTo("")
+	c.Assert(err, IsNil)
+
+	devicestate.SetSystemMode(s.mgr, "recover")
+	err = s.bootloader.SetBootVars(map[string]string{
+		"snapd_recovery_mode":   "recover",
+		"snapd_recovery_system": s.mockedSystemSeeds[0].label,
+	})
+	c.Assert(err, IsNil)
+
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+
+	err = s.mgr.Reboot("", "run")
+	c.Assert(err, IsNil)
+
+	m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	c.Check(m, DeepEquals, map[string]string{
+		"snapd_recovery_mode":   "run",
+		"snapd_recovery_system": s.mockedSystemSeeds[0].label,
+	})
+	c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
+	c.Check(s.logbuf.String(), Matches, fmt.Sprintf(`.*: rebooting into system "%s" in "run" mode\n`, s.mockedSystemSeeds[0].label))
+}
+
+func (s *deviceMgrSystemsSuite) TestRebootAlreadyInRunMode(c *C) {
+	devicestate.SetSystemMode(s.mgr, "run")
+
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+
+	// we are already in "run" mode so this should just reboot
+	err := s.mgr.Reboot("", "run")
+	c.Assert(err, IsNil)
+
+	m, err := s.bootloader.GetBootVars("snapd_recovery_mode", "snapd_recovery_system")
+	c.Assert(err, IsNil)
+	c.Check(m, DeepEquals, map[string]string{
+		"snapd_recovery_mode":   "",
+		"snapd_recovery_system": "",
+	})
+	c.Check(s.restartRequests, DeepEquals, []state.RestartType{state.RestartSystemNow})
+	c.Check(s.logbuf.String(), Matches, `.*: rebooting system\n`)
+}
+
+func (s *deviceMgrSystemsSuite) TestRebootUnhappy(c *C) {
+	s.state.Lock()
+	s.state.Set("seeded-systems", []devicestate.SeededSystem{
+		{
+			System:  s.mockedSystemSeeds[0].label,
+			Model:   s.mockedSystemSeeds[0].model.Model(),
+			BrandID: s.mockedSystemSeeds[0].brand.AccountID(),
+		},
+	})
+	s.state.Unlock()
+
+	errUnsupportedActionStr := devicestate.ErrUnsupportedAction.Error()
+	for _, tc := range []struct {
+		systemLabel, mode string
+		expectedErr       string
+	}{
+		{"", "unknown-mode", errUnsupportedActionStr},
+		{"unknown-system", "run", `stat /.*: no such file or directory`},
+		{"unknown-system", "unknown-mode", `stat /.*: no such file or directory`},
+	} {
+		s.restartRequests = nil
+		s.bootloader.BootVars = make(map[string]string)
+
+		err := s.mgr.Reboot(tc.systemLabel, tc.mode)
+		c.Assert(err, ErrorMatches, tc.expectedErr)
+
+		c.Check(s.restartRequests, HasLen, 0)
+		c.Check(s.logbuf.String(), Equals, "")
+	}
+	c.Check(s.logbuf.String(), Equals, "")
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_test.go snapd-2.48.3+20.04/overlord/devicestate/devicestate_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/devicestate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/devicestate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -38,6 +38,7 @@
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/builtin"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord"
 	"github.com/snapcore/snapd/overlord/assertstate"
 	"github.com/snapcore/snapd/overlord/assertstate/assertstatetest"
@@ -45,6 +46,7 @@
 	"github.com/snapcore/snapd/overlord/configstate/config"
 	"github.com/snapcore/snapd/overlord/devicestate"
 	"github.com/snapcore/snapd/overlord/devicestate/devicestatetest"
+	"github.com/snapcore/snapd/overlord/devicestate/fde"
 	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/ifacestate/ifacerepo"
 	"github.com/snapcore/snapd/overlord/snapstate"
@@ -52,14 +54,20 @@
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/overlord/storecontext"
 	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/secboot"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
 	"github.com/snapcore/snapd/snapdenv"
 	"github.com/snapcore/snapd/store/storetest"
+	"github.com/snapcore/snapd/sysconfig"
 	"github.com/snapcore/snapd/testutil"
 	"github.com/snapcore/snapd/timings"
 )
 
+var (
+	settleTimeout = testutil.HostScaledTimeout(15 * time.Second)
+)
+
 func TestDeviceManager(t *testing.T) { TestingT(t) }
 
 type deviceMgrBaseSuite struct {
@@ -81,11 +89,12 @@
 
 	restartRequests []state.RestartType
 
-	restoreOnClassic         func()
-	restoreGenericClassicMod func()
-	restoreSanitize          func()
-
 	newFakeStore func(storecontext.DeviceBackend) snapstate.StoreService
+
+	// saved so that if a derived suite wants to undo the cloud-init mocking to
+	// test the actual functions, it can just call this in it's SetUpTest, see
+	// devicestate_cloudinit_test.go for details
+	restoreCloudInitStatusRestore func()
 }
 
 type deviceMgrSuite struct {
@@ -124,16 +133,24 @@
 	s.BaseTest.SetUpTest(c)
 
 	dirs.SetRootDir(c.MkDir())
-	os.MkdirAll(dirs.SnapRunDir, 0755)
+	s.AddCleanup(func() { dirs.SetRootDir("") })
+
+	err := os.MkdirAll(dirs.SnapRunDir, 0755)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(dirs.SnapdStateDir(dirs.GlobalRootDir), 0755)
+	c.Assert(err, IsNil)
+
+	s.AddCleanup(osutil.MockMountInfo(``))
 
 	s.restartRequests = nil
 
-	s.restoreSanitize = snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {})
+	s.AddCleanup(snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {}))
 
 	s.bootloader = bootloadertest.Mock("mock", c.MkDir())
 	bootloader.Force(s.bootloader)
+	s.AddCleanup(func() { bootloader.Force(nil) })
 
-	s.restoreOnClassic = release.MockOnClassic(false)
+	s.AddCleanup(release.MockOnClassic(false))
 
 	s.storeSigning = assertstest.NewStoreStack("canonical", nil)
 	s.o = overlord.MockWithStateAndRestartHandler(nil, func(req state.RestartType) {
@@ -145,7 +162,7 @@
 	s.state.Unlock()
 	s.se = s.o.StateEngine()
 
-	s.restoreGenericClassicMod = sysdb.MockGenericClassicModel(s.storeSigning.GenericClassicModel)
+	s.AddCleanup(sysdb.MockGenericClassicModel(s.storeSigning.GenericClassicModel))
 
 	s.brands = assertstest.NewSigningAccounts(s.storeSigning)
 	s.brands.Register("my-brand", brandPrivKey, map[string]interface{}{
@@ -164,6 +181,11 @@
 	s.state.Lock()
 	assertstate.ReplaceDB(s.state, db)
 	s.state.Unlock()
+	s.AddCleanup(func() {
+		s.state.Lock()
+		assertstate.ReplaceDB(s.state, nil)
+		s.state.Unlock()
+	})
 
 	err = db.Add(s.storeSigning.StoreAccountKey(""))
 	c.Assert(err, IsNil)
@@ -194,26 +216,19 @@
 		db:    s.storeSigning,
 	})
 	s.state.Unlock()
+
+	s.restoreCloudInitStatusRestore = devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		return sysconfig.CloudInitRestrictedBySnapd, nil
+	})
+	s.AddCleanup(s.restoreCloudInitStatusRestore)
+
+	s.AddCleanup(func() { s.ancillary = nil })
 }
 
 func (s *deviceMgrBaseSuite) newStore(devBE storecontext.DeviceBackend) snapstate.StoreService {
 	return s.newFakeStore(devBE)
 }
 
-func (s *deviceMgrBaseSuite) TearDownTest(c *C) {
-	s.ancillary = nil
-	s.state.Lock()
-	assertstate.ReplaceDB(s.state, nil)
-	s.state.Unlock()
-	bootloader.Force(nil)
-	dirs.SetRootDir("")
-	s.restoreGenericClassicMod()
-	s.restoreOnClassic()
-	s.restoreSanitize()
-}
-
-var settleTimeout = 15 * time.Second
-
 func (s *deviceMgrBaseSuite) settle(c *C) {
 	err := s.o.Settle(settleTimeout)
 	c.Assert(err, IsNil)
@@ -225,6 +240,26 @@
 	chg.SetStatus(state.DoingStatus)
 }
 
+func (s *deviceMgrSuite) TestDeviceManagerSetTimeOnce(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// set first time
+	now := time.Now()
+	err := devicestate.SetTimeOnce(s.mgr, "key-name", now)
+	c.Assert(err, IsNil)
+
+	later := now.Add(1 * time.Minute)
+	// setting again doesn't change value
+	err = devicestate.SetTimeOnce(s.mgr, "key-name", later)
+	c.Assert(err, IsNil)
+
+	var t time.Time
+	s.state.Get("key-name", &t)
+
+	c.Assert(t.Equal(now), Equals, true)
+}
+
 func (s *deviceMgrSuite) TestDeviceManagerEnsureSeededAlreadySeeded(c *C) {
 	s.state.Lock()
 	s.state.Set("seeded", true)
@@ -292,6 +327,10 @@
 	defer s.state.Unlock()
 
 	c.Check(s.state.Changes(), HasLen, 1)
+
+	var seedStartTime time.Time
+	c.Assert(s.state.Get("seed-start-time", &seedStartTime), IsNil)
+	c.Check(seedStartTime.Equal(devicestate.StartTime()), Equals, true)
 }
 
 func (s *deviceMgrSuite) TestDeviceManagerEnsureBootOkSkippedOnClassic(c *C) {
@@ -912,6 +951,19 @@
 	return info11
 }
 
+func makeInstalledMockKernelSnap(c *C, st *state.State, yml string) *snap.Info {
+	sideInfo11 := &snap.SideInfo{RealName: "pc-kernel", Revision: snap.R(11), SnapID: "pc-kernel-id"}
+	snapstate.Set(st, "pc-kernel", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{sideInfo11},
+		Current:  sideInfo11.Revision,
+		SnapType: "kernel",
+	})
+	info11 := snaptest.MockSnap(c, yml, sideInfo11)
+
+	return info11
+}
+
 func makeMockRepoWithConnectedSnaps(c *C, st *state.State, info11, core11 *snap.Info, ifname string) {
 	repo := interfaces.NewRepository()
 	for _, iface := range builtin.Interfaces() {
@@ -1102,6 +1154,317 @@
 	c.Check(s.mgr.SystemMode(), Equals, "run")
 }
 
+const (
+	mountRunMntUbuntuSaveFmt = `26 27 8:3 / %s/run/mnt/ubuntu-save rw,relatime shared:7 - ext4 /dev/fakedevice0p1 rw,data=ordered`
+	mountSnapSaveFmt         = `26 27 8:3 / %s/var/lib/snapd/save rw,relatime shared:7 - ext4 /dev/fakedevice0p1 rw,data=ordered`
+)
+
+func (s *deviceMgrSuite) TestDeviceManagerStartupUC20UbuntuSaveFullHappy(c *C) {
+	modeEnv := &boot.Modeenv{Mode: "run"}
+	err := modeEnv.WriteTo("")
+	c.Assert(err, IsNil)
+	// create a new manager so that the modeenv we mocked in read
+	mgr, err := devicestate.Manager(s.state, s.hookMgr, s.o.TaskRunner(), s.newStore)
+	c.Assert(err, IsNil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "")
+	defer cmd.Restore()
+
+	// ubuntu-save not mounted
+	err = mgr.StartUp()
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), HasLen, 0)
+
+	restore := osutil.MockMountInfo(fmt.Sprintf(mountRunMntUbuntuSaveFmt, dirs.GlobalRootDir))
+	defer restore()
+
+	err = mgr.StartUp()
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "-o", "bind", boot.InitramfsUbuntuSaveDir, dirs.SnapSaveDir},
+	})
+
+	// known as available
+	c.Check(devicestate.SaveAvailable(mgr), Equals, true)
+}
+
+func (s *deviceMgrSuite) TestDeviceManagerStartupUC20UbuntuSaveAlreadyMounted(c *C) {
+	modeEnv := &boot.Modeenv{Mode: "run"}
+	err := modeEnv.WriteTo("")
+	c.Assert(err, IsNil)
+	// create a new manager so that the modeenv we mocked in read
+	mgr, err := devicestate.Manager(s.state, s.hookMgr, s.o.TaskRunner(), s.newStore)
+	c.Assert(err, IsNil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "")
+	defer cmd.Restore()
+
+	// already mounted
+	restore := osutil.MockMountInfo(fmt.Sprintf(mountRunMntUbuntuSaveFmt, dirs.GlobalRootDir) + "\n" +
+		fmt.Sprintf(mountSnapSaveFmt, dirs.GlobalRootDir))
+	defer restore()
+
+	err = mgr.StartUp()
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), HasLen, 0)
+
+	// known as available
+	c.Check(devicestate.SaveAvailable(mgr), Equals, true)
+}
+
+func (s *deviceMgrSuite) TestDeviceManagerStartupUC20NoUbuntuSave(c *C) {
+	modeEnv := &boot.Modeenv{Mode: "run"}
+	err := modeEnv.WriteTo("")
+	c.Assert(err, IsNil)
+	// create a new manager so that the modeenv we mocked in read
+	mgr, err := devicestate.Manager(s.state, s.hookMgr, s.o.TaskRunner(), s.newStore)
+	c.Assert(err, IsNil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "")
+	defer cmd.Restore()
+
+	// ubuntu-save not mounted
+	err = mgr.StartUp()
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), HasLen, 0)
+
+	// known as available
+	c.Check(devicestate.SaveAvailable(mgr), Equals, true)
+}
+
+func (s *deviceMgrSuite) TestDeviceManagerStartupUC20UbuntuSaveErr(c *C) {
+	modeEnv := &boot.Modeenv{Mode: "run"}
+	err := modeEnv.WriteTo("")
+	c.Assert(err, IsNil)
+	// create a new manager so that the modeenv we mocked in read
+	mgr, err := devicestate.Manager(s.state, s.hookMgr, s.o.TaskRunner(), s.newStore)
+	c.Assert(err, IsNil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "echo failed; exit 1")
+	defer cmd.Restore()
+
+	restore := osutil.MockMountInfo(fmt.Sprintf(mountRunMntUbuntuSaveFmt, dirs.GlobalRootDir))
+	defer restore()
+
+	err = mgr.StartUp()
+	c.Assert(err, ErrorMatches, "cannot set up ubuntu-save: cannot bind mount .*/run/mnt/ubuntu-save under .*/var/lib/snapd/save: failed")
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "-o", "bind", boot.InitramfsUbuntuSaveDir, dirs.SnapSaveDir},
+	})
+
+	// known as not available
+	c.Check(devicestate.SaveAvailable(mgr), Equals, false)
+}
+
+func (s *deviceMgrSuite) TestDeviceManagerStartupNonUC20NoUbuntuSave(c *C) {
+	err := os.RemoveAll(dirs.SnapModeenvFileUnder(dirs.GlobalRootDir))
+	c.Assert(err, IsNil)
+	// create a new manager so that we know it does not see the modeenv
+	mgr, err := devicestate.Manager(s.state, s.hookMgr, s.o.TaskRunner(), s.newStore)
+	c.Assert(err, IsNil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "")
+	defer cmd.Restore()
+
+	// ubuntu-save not mounted
+	err = mgr.StartUp()
+	c.Assert(err, IsNil)
+	c.Check(cmd.Calls(), HasLen, 0)
+
+	// known as not available
+	c.Check(devicestate.SaveAvailable(mgr), Equals, false)
+}
+
+var kernelYamlNoFdeSetup = `name: pc-kernel
+version: 1.0
+type: kernel
+`
+
+var kernelYamlWithFdeSetup = `name: pc-kernel
+version: 1.0
+type: kernel
+hooks:
+ fde-setup:
+`
+
+func (s *deviceMgrSuite) TestHasFdeSetupHook(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+
+	for _, tc := range []struct {
+		kernelYaml      string
+		hasFdeSetupHook bool
+	}{
+		{kernelYamlNoFdeSetup, false},
+		{kernelYamlWithFdeSetup, true},
+	} {
+		makeInstalledMockKernelSnap(c, st, tc.kernelYaml)
+
+		hasHook, err := devicestate.DeviceManagerHasFDESetupHook(s.mgr)
+		c.Assert(err, IsNil)
+		c.Check(hasHook, Equals, tc.hasFdeSetupHook)
+	}
+}
+
+func (s *deviceMgrSuite) TestRunFdeSetupHookOpInitialSetup(c *C) {
+	st := s.state
+
+	st.Lock()
+	makeInstalledMockKernelSnap(c, st, kernelYamlWithFdeSetup)
+	mockModel := s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+	st.Unlock()
+
+	mockKey := secboot.EncryptionKey{1, 2, 3, 4}
+
+	var hookCalled []string
+	hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+		ctx.Lock()
+		defer ctx.Unlock()
+
+		// check that the context has the right data
+		c.Check(ctx.HookName(), Equals, "fde-setup")
+		var fdeSetup fde.SetupRequest
+		ctx.Get("fde-setup-request", &fdeSetup)
+		c.Check(fdeSetup, DeepEquals, fde.SetupRequest{
+			Op:      "initial-setup",
+			Key:     &mockKey,
+			KeyName: "some-key-name",
+			Models: []map[string]string{
+				{
+					"series":     "16",
+					"brand-id":   "canonical",
+					"model":      "pc",
+					"grade":      "unset",
+					"signkey-id": mockModel.SignKeyID(),
+				},
+			},
+		})
+
+		// the snapctl fde-setup-result will set the data
+		ctx.Set("fde-setup-result", []byte("sealed-key"))
+		hookCalled = append(hookCalled, ctx.InstanceName())
+		return nil, nil
+	}
+
+	rhk := hookstate.MockRunHook(hookInvoke)
+	defer rhk()
+
+	s.o.Loop()
+	defer s.o.Stop()
+
+	params := &boot.FDESetupHookParams{
+		Key:     mockKey,
+		KeyName: "some-key-name",
+		Models:  []*asserts.Model{mockModel},
+	}
+	st.Lock()
+	data, err := devicestate.DeviceManagerRunFDESetupHook(s.mgr, "initial-setup", params)
+	st.Unlock()
+	c.Assert(err, IsNil)
+	c.Check(string(data), Equals, "sealed-key")
+	c.Check(hookCalled, DeepEquals, []string{"pc-kernel"})
+}
+
+func (s *deviceMgrSuite) TestRunFdeSetupHookOpInitialSetupErrors(c *C) {
+	st := s.state
+
+	st.Lock()
+	makeInstalledMockKernelSnap(c, st, kernelYamlWithFdeSetup)
+	mockModel := s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+	st.Unlock()
+
+	hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+		return nil, fmt.Errorf("hook failed")
+	}
+
+	rhk := hookstate.MockRunHook(hookInvoke)
+	defer rhk()
+
+	s.o.Loop()
+	defer s.o.Stop()
+
+	params := &boot.FDESetupHookParams{
+		Key:     secboot.EncryptionKey{1, 2, 3, 4},
+		KeyName: "some-key-name",
+		Models:  []*asserts.Model{mockModel},
+	}
+	st.Lock()
+	_, err := devicestate.DeviceManagerRunFDESetupHook(s.mgr, "initial-setup", params)
+	st.Unlock()
+	c.Assert(err, ErrorMatches, `cannot run hook for "initial-setup": run hook "fde-setup": hook failed`)
+}
+
+func (s *deviceMgrSuite) TestRunFdeSetupHookOpInitialSetupErrorResult(c *C) {
+	st := s.state
+
+	st.Lock()
+	makeInstalledMockKernelSnap(c, st, kernelYamlWithFdeSetup)
+	mockModel := s.makeModelAssertionInState(c, "canonical", "pc", map[string]interface{}{
+		"architecture": "amd64",
+		"kernel":       "pc-kernel",
+		"gadget":       "pc",
+	})
+	devicestatetest.SetDevice(s.state, &auth.DeviceState{
+		Brand: "canonical",
+		Model: "pc",
+	})
+	st.Unlock()
+
+	hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+		// Simulate an incorrect type for fde-setup-result here to
+		// test error string from runFDESetupHook.
+		// This should never happen in practice, "snapctl fde-setup"
+		// will always set this to []byte
+		ctx.Lock()
+		ctx.Set("fde-setup-result", "not-bytes")
+		ctx.Unlock()
+		return nil, nil
+	}
+
+	rhk := hookstate.MockRunHook(hookInvoke)
+	defer rhk()
+
+	s.o.Loop()
+	defer s.o.Stop()
+
+	params := &boot.FDESetupHookParams{
+		Key:     secboot.EncryptionKey{1, 2, 3, 4},
+		KeyName: "some-key-name",
+		Models:  []*asserts.Model{mockModel},
+	}
+	st.Lock()
+	_, err := devicestate.DeviceManagerRunFDESetupHook(s.mgr, "initial-setup", params)
+	st.Unlock()
+	c.Assert(err, ErrorMatches, `cannot get result from fde-setup hook "initial-setup": cannot unmarshal context value for "fde-setup-result": illegal base64 data at input byte 3`)
+}
+
 type startOfOperationTimeSuite struct {
 	state  *state.State
 	mgr    *devicestate.DeviceManager
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/export_test.go snapd-2.48.3+20.04/overlord/devicestate/export_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,8 +26,8 @@
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
 	"github.com/snapcore/snapd/httputil"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
@@ -80,8 +80,24 @@
 	}
 }
 
-func KeypairManager(m *DeviceManager) asserts.KeypairManager {
-	return m.keypairMgr
+func KeypairManager(m *DeviceManager) (keypairMgr asserts.KeypairManager) {
+	// XXX expose the with... method at some point
+	err := m.withKeypairMgr(func(km asserts.KeypairManager) error {
+		keypairMgr = km
+		return nil
+	})
+	if err != nil {
+		panic(err)
+	}
+	return keypairMgr
+}
+
+func SaveAvailable(m *DeviceManager) bool {
+	return m.saveAvailable
+}
+
+func SetSaveAvailable(m *DeviceManager, avail bool) {
+	m.saveAvailable = avail
 }
 
 func EnsureOperationalShouldBackoff(m *DeviceManager, now time.Time) bool {
@@ -100,6 +116,10 @@
 	m.systemMode = mode
 }
 
+func SetTimeOnce(m *DeviceManager, name string, t time.Time) error {
+	return m.setTimeOnce(name, t)
+}
+
 func MockRepeatRequestSerial(label string) (restore func()) {
 	old := repeatRequestSerial
 	repeatRequestSerial = label
@@ -128,6 +148,10 @@
 	return m.ensureSeeded()
 }
 
+func EnsureCloudInitRestricted(m *DeviceManager) error {
+	return m.ensureCloudInitRestricted()
+}
+
 var PopulateStateFromSeedImpl = populateStateFromSeedImpl
 
 type PopulateStateFromSeedOptions = populateStateFromSeedOptions
@@ -148,6 +172,10 @@
 	m.bootOkRan = b
 }
 
+func StartTime() time.Time {
+	return startTime
+}
+
 type (
 	RegistrationContext = registrationContext
 	RemodelContext      = remodelContext
@@ -188,7 +216,7 @@
 	CriticalTaskEdges = criticalTaskEdges
 )
 
-func MockGadgetUpdate(mock func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc) error) (restore func()) {
+func MockGadgetUpdate(mock func(current, update gadget.GadgetData, path string, policy gadget.UpdatePolicyFunc, observer gadget.ContentUpdateObserver) error) (restore func()) {
 	old := gadgetUpdate
 	gadgetUpdate = mock
 	return func() {
@@ -204,7 +232,7 @@
 	}
 }
 
-func MockBootMakeBootable(f func(model *asserts.Model, rootdir string, bootWith *boot.BootableSet) error) (restore func()) {
+func MockBootMakeBootable(f func(model *asserts.Model, rootdir string, bootWith *boot.BootableSet, seal *boot.TrustedAssetsInstallObserver) error) (restore func()) {
 	old := bootMakeBootable
 	bootMakeBootable = f
 	return func() {
@@ -228,18 +256,50 @@
 	}
 }
 
-func MockSysconfigConfigureRunSystem(f func(opts *sysconfig.Options) error) (restore func()) {
-	old := sysconfigConfigureRunSystem
-	sysconfigConfigureRunSystem = f
+func MockSysconfigConfigureTargetSystem(f func(opts *sysconfig.Options) error) (restore func()) {
+	old := sysconfigConfigureTargetSystem
+	sysconfigConfigureTargetSystem = f
 	return func() {
-		sysconfigConfigureRunSystem = old
+		sysconfigConfigureTargetSystem = old
 	}
 }
 
-func MockBootstrapRun(f func(gadgetRoot, device string, options bootstrap.Options) error) (restore func()) {
-	old := bootstrapRun
-	bootstrapRun = f
+func MockInstallRun(f func(gadgetRoot, device string, options install.Options, observer gadget.ContentObserver) (*install.InstalledSystemSideData, error)) (restore func()) {
+	old := installRun
+	installRun = f
 	return func() {
-		bootstrapRun = old
+		installRun = old
 	}
 }
+
+func MockCloudInitStatus(f func() (sysconfig.CloudInitState, error)) (restore func()) {
+	old := cloudInitStatus
+	cloudInitStatus = f
+	return func() {
+		cloudInitStatus = old
+	}
+}
+
+func MockRestrictCloudInit(f func(sysconfig.CloudInitState, *sysconfig.CloudInitRestrictOptions) (sysconfig.CloudInitRestrictionResult, error)) (restore func()) {
+	old := restrictCloudInit
+	restrictCloudInit = f
+	return func() {
+		restrictCloudInit = old
+	}
+}
+
+func DeviceManagerHasFDESetupHook(mgr *DeviceManager) (bool, error) {
+	return mgr.hasFDESetupHook()
+}
+
+func DeviceManagerRunFDESetupHook(mgr *DeviceManager, op string, params *boot.FDESetupHookParams) ([]byte, error) {
+	return mgr.runFDESetupHook(op, params)
+}
+
+func DeviceManagerCheckEncryption(mgr *DeviceManager, st *state.State, deviceCtx snapstate.DeviceContext) (bool, error) {
+	return mgr.checkEncryption(st, deviceCtx)
+}
+
+func DeviceManagerCheckFDEFeatures(mgr *DeviceManager, st *state.State) error {
+	return mgr.checkFDEFeatures(st)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/fde/fde.go snapd-2.48.3+20.04/overlord/devicestate/fde/fde.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/fde/fde.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/fde/fde.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,64 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020  Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// package fde implements helper used by low level parts like secboot
+// in snap-bootstrap and high level parts like DeviceManager in snapd.
+//
+// Note that it must never import anything overlord related itself
+// to avoid increasing the size of snap-bootstrap.
+package fde
+
+import (
+	"os/exec"
+
+	"github.com/snapcore/snapd/secboot"
+)
+
+func init() {
+	secboot.FDEHasRevealKey = HasRevealKey
+}
+
+// HasRevealKey return true if the current system has a "fde-reveal-key"
+// binary (usually used in the initrd).
+//
+// This will be setup by devicestate to support device-specific full
+// disk encryption implementations.
+func HasRevealKey() bool {
+	// XXX: should we record during initial sealing that the fde-setup
+	//      was used and only use fde-reveal-key in that case?
+	_, err := exec.LookPath("fde-reveal-key")
+	return err == nil
+}
+
+// SetupRequest carries the operation and parameters for the fde-setup hooks
+// made available to them via the snapctl fde-setup-request command.
+type SetupRequest struct {
+	// XXX: make "op" a type: "features", "initial-setup", "update" ?
+	Op string `json:"op"`
+
+	Key     *secboot.EncryptionKey `json:"key,omitempty"`
+	KeyName string                 `json:"key-name,omitempty"`
+
+	// List of models with their related fields, this will be set
+	// to follow the secboot:SnapModel interface.
+	Models []map[string]string `json:"models,omitempty"`
+
+	// TODO: provide LoadChains, KernelCmdline etc to support full
+	//       tpm sealing
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/fde/fde_test.go snapd-2.48.3+20.04/overlord/devicestate/fde/fde_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/fde/fde_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/fde/fde_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,59 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package fde_test
+
+import (
+	"io/ioutil"
+	"os"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/overlord/devicestate/fde"
+)
+
+func TestFde(t *testing.T) { TestingT(t) }
+
+type fdeSuite struct{}
+
+var _ = Suite(&fdeSuite{})
+
+func (s *fdeSuite) TestHasRevealKey(c *C) {
+	oldPath := os.Getenv("PATH")
+	defer func() { os.Setenv("PATH", oldPath) }()
+
+	mockRoot := c.MkDir()
+	os.Setenv("PATH", mockRoot+"/bin")
+	mockBin := mockRoot + "/bin/"
+	err := os.Mkdir(mockBin, 0755)
+	c.Assert(err, IsNil)
+
+	// no fde-reveal-key binary
+	c.Check(fde.HasRevealKey(), Equals, false)
+
+	// fde-reveal-key without +x
+	err = ioutil.WriteFile(mockBin+"fde-reveal-key", nil, 0644)
+	c.Assert(err, IsNil)
+	c.Check(fde.HasRevealKey(), Equals, false)
+
+	// correct fde-reveal-key, no logging
+	err = os.Chmod(mockBin+"fde-reveal-key", 0755)
+	c.Assert(err, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/firstboot20_test.go snapd-2.48.3+20.04/overlord/devicestate/firstboot20_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/firstboot20_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/firstboot20_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -119,12 +119,8 @@
 	}, nil)
 }
 
-func (s *firstBoot20Suite) TestPopulateFromSeedCore20Happy(c *C) {
-	m := boot.Modeenv{
-		Mode:           "run",
-		RecoverySystem: "20191018",
-		Base:           "core20_1.snap",
-	}
+func (s *firstBoot20Suite) testPopulateFromSeedCore20Happy(c *C, m *boot.Modeenv) {
+	c.Assert(m, NotNil, Commentf("missing modeenv test data"))
 	err := m.WriteTo("")
 	c.Assert(err, IsNil)
 
@@ -139,7 +135,7 @@
 	})
 	defer systemctlRestorer()
 
-	sysLabel := "20191018"
+	sysLabel := m.RecoverySystem
 	model := s.setupCore20Seed(c, sysLabel)
 
 	bloader := bootloadertest.Mock("mock", c.MkDir()).WithExtractedRunKernelImage()
@@ -151,12 +147,12 @@
 	// bootloader, so set the current kernel there
 	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
 	c.Assert(err, IsNil)
-	r := bloader.SetRunKernelImageEnabledKernel(kernel)
+	r := bloader.SetEnabledKernel(kernel)
 	defer r()
 
 	opts := devicestate.PopulateStateFromSeedOptions{
 		Label: sysLabel,
-		Mode:  "run",
+		Mode:  m.Mode,
 	}
 
 	// run the firstboot stuff
@@ -206,7 +202,7 @@
 
 	state.Lock()
 	defer state.Unlock()
-	// check snapd, core18, kernel, gadget
+	// check snapd, core20, kernel, gadget
 	_, err = snapstate.CurrentInfo(state, "snapd")
 	c.Check(err, IsNil)
 	_, err = snapstate.CurrentInfo(state, "core20")
@@ -251,7 +247,13 @@
 	// check that we removed recovery_system from modeenv
 	m2, err := boot.ReadModeenv("")
 	c.Assert(err, IsNil)
-	c.Assert(m2.RecoverySystem, Equals, "")
+	if m.Mode == "run" {
+		// recovery system is cleared in run mode
+		c.Assert(m2.RecoverySystem, Equals, "")
+	} else {
+		// but kept intact in other modes
+		c.Assert(m2.RecoverySystem, Equals, m.RecoverySystem)
+	}
 	c.Assert(m2.Base, Equals, m.Base)
 	c.Assert(m2.Mode, Equals, m.Mode)
 	// Note that we don't check CurrentKernels in the modeenv, even though in a
@@ -268,14 +270,17 @@
 	// already booted from, we should only have checked what the current kernel
 	// is
 
-	// the 3 calls here are :
-	// * 1 from MarkBootSuccessful() from ensureBootOk() before we restart
-	// * 1 from boot.SetNextBoot() from LinkSnap() from doInstall() from InstallPath() from
-	//     installSeedSnap() after restart
-	// * 1 from boot.GetCurrentBoot() from WaitRestart after restart
-	_, numKernelCalls := bloader.GetRunKernelImageFunctionSnapCalls("Kernel")
-	c.Assert(numKernelCalls, Equals, 3)
+	if m.Mode == "run" {
+		// only relevant in run mode
 
+		// the 3 calls here are :
+		// * 1 from MarkBootSuccessful() from ensureBootOk() before we restart
+		// * 1 from boot.SetNextBoot() from LinkSnap() from doInstall() from InstallPath() from
+		//     installSeedSnap() after restart
+		// * 1 from boot.GetCurrentBoot() from FinishRestart after restart
+		_, numKernelCalls := bloader.GetRunKernelImageFunctionSnapCalls("Kernel")
+		c.Assert(numKernelCalls, Equals, 3)
+	}
 	actual, _ := bloader.GetRunKernelImageFunctionSnapCalls("EnableKernel")
 	c.Assert(actual, HasLen, 0)
 	actual, _ = bloader.GetRunKernelImageFunctionSnapCalls("DisableTryKernel")
@@ -285,13 +290,44 @@
 
 	var whatseeded []devicestate.SeededSystem
 	err = state.Get("seeded-systems", &whatseeded)
-	c.Assert(err, IsNil)
-	c.Assert(whatseeded, DeepEquals, []devicestate.SeededSystem{{
-		System:    "20191018",
-		Model:     "my-model",
-		BrandID:   "my-brand",
-		Revision:  model.Revision(),
-		Timestamp: model.Timestamp(),
-		SeedTime:  seedTime,
-	}})
+	if m.Mode == "run" {
+		c.Assert(err, IsNil)
+		c.Assert(whatseeded, DeepEquals, []devicestate.SeededSystem{{
+			System:    m.RecoverySystem,
+			Model:     "my-model",
+			BrandID:   "my-brand",
+			Revision:  model.Revision(),
+			Timestamp: model.Timestamp(),
+			SeedTime:  seedTime,
+		}})
+	} else {
+		c.Assert(err, NotNil)
+	}
+}
+
+func (s *firstBoot20Suite) TestPopulateFromSeedCore20RunMode(c *C) {
+	m := boot.Modeenv{
+		Mode:           "run",
+		RecoverySystem: "20191018",
+		Base:           "core20_1.snap",
+	}
+	s.testPopulateFromSeedCore20Happy(c, &m)
+}
+
+func (s *firstBoot20Suite) TestPopulateFromSeedCore20InstallMode(c *C) {
+	m := boot.Modeenv{
+		Mode:           "install",
+		RecoverySystem: "20191019",
+		Base:           "core20_1.snap",
+	}
+	s.testPopulateFromSeedCore20Happy(c, &m)
+}
+
+func (s *firstBoot20Suite) TestPopulateFromSeedCore20RecoverMode(c *C) {
+	m := boot.Modeenv{
+		Mode:           "recover",
+		RecoverySystem: "20191020",
+		Base:           "core20_1.snap",
+	}
+	s.testPopulateFromSeedCore20Happy(c, &m)
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/firstboot.go snapd-2.48.3+20.04/overlord/devicestate/firstboot.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/firstboot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/firstboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2019 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -170,6 +170,10 @@
 		if beginTask != nil {
 			// hooks must wait for mark-preseeded
 			hooksTask.WaitFor(preseedDoneTask)
+			if n := len(all); n > 0 {
+				// the first hook of the snap waits for all tasks of previous snap
+				hooksTask.WaitAll(all[n-1])
+			}
 			if lastBeforeHooksTask != nil {
 				beginTask.WaitFor(lastBeforeHooksTask)
 			}
@@ -223,7 +227,7 @@
 		if err != nil {
 			return nil, err
 		}
-		if info.GetType() == snap.TypeKernel || info.GetType() == snap.TypeGadget {
+		if info.Type() == snap.TypeKernel || info.Type() == snap.TypeGadget {
 			configTs := snapstate.ConfigureSnap(st, info.SnapName(), snapstate.UseConfigDefaults)
 			// wait for the previous configTss
 			configTss = chainTs(configTss, configTs)
@@ -273,6 +277,7 @@
 		return nil, fmt.Errorf("cannot proceed, no snaps to seed")
 	}
 
+	// ts is the taskset of the last snap
 	ts := tsAll[len(tsAll)-1]
 	endTs := state.NewTaskSet()
 
@@ -290,6 +295,7 @@
 	}
 	markSeeded.Set("seed-system", whatSeeds)
 
+	// mark-seeded waits for the taskset of last snap
 	markSeeded.WaitAll(ts)
 	endTs.AddTask(markSeeded)
 	tsAll = append(tsAll, endTs)
@@ -323,11 +329,7 @@
 	if err != nil {
 		return nil, err
 	}
-
-	modelAssertion, err := deviceSeed.Model()
-	if err != nil {
-		return nil, err
-	}
+	modelAssertion := deviceSeed.Model()
 
 	classicModel := modelAssertion.Classic()
 	if release.OnClassic != classicModel {
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/firstboot_preseed_test.go snapd-2.48.3+20.04/overlord/devicestate/firstboot_preseed_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/firstboot_preseed_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/firstboot_preseed_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -31,6 +31,7 @@
 	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/overlord/devicestate"
 	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/snapstate"
@@ -178,10 +179,6 @@
 			continue
 		}
 
-		snapsup, err := snapstate.TaskSnapSetup(task0)
-		c.Assert(err, IsNil, Commentf("%#v", task0))
-		c.Check(snapsup.InstanceName(), Equals, snaps[matched])
-		matched++
 		if i == 0 {
 			c.Check(waitTasks, HasLen, 0)
 		} else {
@@ -190,6 +187,51 @@
 			c.Check(waitTasks[0], Equals, prevTask)
 		}
 
+		// make sure that install-hooks wait for the previous snap, and for
+		// mark-preseeded.
+		hookEdgeTask, err := ts.Edge(snapstate.HooksEdge)
+		c.Assert(err, IsNil)
+		c.Assert(hookEdgeTask.Kind(), Equals, "run-hook")
+		var hsup hookstate.HookSetup
+		c.Assert(hookEdgeTask.Get("hook-setup", &hsup), IsNil)
+		c.Check(hsup.Hook, Equals, "install")
+		switch hsup.Snap {
+		case "core", "core18", "snapd":
+			// ignore
+		default:
+			// snaps other than core/core18/snapd
+			var waitsForMarkPreseeded, waitsForPreviousSnapHook, waitsForPreviousSnap bool
+			for _, wt := range hookEdgeTask.WaitTasks() {
+				switch wt.Kind() {
+				case "setup-aliases":
+					continue
+				case "run-hook":
+					var wtsup hookstate.HookSetup
+					c.Assert(wt.Get("hook-setup", &wtsup), IsNil)
+					c.Check(wtsup.Snap, Equals, snaps[matched-1])
+					waitsForPreviousSnapHook = true
+				case "mark-preseeded":
+					waitsForMarkPreseeded = true
+				case "prerequisites":
+				default:
+					snapsup, err := snapstate.TaskSnapSetup(wt)
+					c.Assert(err, IsNil, Commentf("%#v", wt))
+					c.Check(snapsup.SnapName(), Equals, snaps[matched-1], Commentf("%s: %#v", hsup.Snap, wt))
+					waitsForPreviousSnap = true
+				}
+			}
+			c.Assert(waitsForMarkPreseeded, Equals, true)
+			c.Assert(waitsForPreviousSnapHook, Equals, true)
+			if snaps[matched-1] != "core" && snaps[matched-1] != "core18" && snaps[matched-1] != "pc" {
+				c.Check(waitsForPreviousSnap, Equals, true, Commentf("%s", snaps[matched-1]))
+			}
+		}
+
+		snapsup, err := snapstate.TaskSnapSetup(task0)
+		c.Assert(err, IsNil, Commentf("%#v", task0))
+		c.Check(snapsup.InstanceName(), Equals, snaps[matched])
+		matched++
+
 		// find setup-aliases task in current taskset; its position
 		// is not fixed due to e.g. optional update-gadget-assets task.
 		var aliasesTask *state.Task
@@ -214,6 +256,9 @@
 
 	err := os.MkdirAll(filepath.Join(dirs.SnapSeedDir, "assertions"), 0755)
 	c.Assert(err, IsNil)
+
+	s.AddCleanup(interfaces.MockSystemKey(`{"core": "123"}`))
+	c.Assert(interfaces.WriteSystemKey(), IsNil)
 }
 
 func (s *firstbootPreseed16Suite) TestPreseedHappy(c *C) {
@@ -269,6 +314,13 @@
 	fooFname, fooDecl, fooRev := s.MakeAssertedSnap(c, snapYaml, nil, snap.R(128), "developerid")
 	s.WriteAssertions("foo.asserts", s.devAcct, fooRev, fooDecl)
 
+	// put a firstboot snap into the SnapBlobDir
+	snapYaml2 := `name: bar
+version: 1.0
+`
+	barFname, barDecl, barRev := s.MakeAssertedSnap(c, snapYaml2, nil, snap.R(33), "developerid")
+	s.WriteAssertions("bar.asserts", s.devAcct, barRev, barDecl)
+
 	// add a model assertion and its chain
 	assertsChain := s.makeModelAssertionChain(c, "my-model-classic", nil)
 	s.WriteAssertions("model.asserts", assertsChain...)
@@ -278,9 +330,11 @@
 snaps:
  - name: foo
    file: %s
+ - name: bar
+   file: %s
  - name: core
    file: %s
-`, fooFname, coreFname))
+`, fooFname, barFname, coreFname))
 	err := ioutil.WriteFile(filepath.Join(dirs.SnapSeedDir, "seed.yaml"), content, 0644)
 	c.Assert(err, IsNil)
 
@@ -300,7 +354,7 @@
 	}
 	c.Assert(st.Changes(), HasLen, 1)
 
-	checkPreseedOrder(c, tsAll, "core", "foo")
+	checkPreseedOrder(c, tsAll, "core", "foo", "bar")
 
 	st.Unlock()
 	err = s.overlord.Settle(settleTimeout)
@@ -326,6 +380,8 @@
 	c.Check(err, IsNil)
 	_, err = snapstate.CurrentInfo(diskState, "foo")
 	c.Check(err, IsNil)
+	_, err = snapstate.CurrentInfo(diskState, "bar")
+	c.Check(err, IsNil)
 
 	// but we're not considered seeded
 	var seeded bool
@@ -385,8 +441,6 @@
 	tsAll, err := devicestate.PopulateStateFromSeedImpl(st, opts, s.perfTimings)
 	c.Assert(err, IsNil)
 
-	checkPreseedOrder(c, tsAll, "snapd", "core18", "foo")
-
 	// now run the change and check the result
 	chg := st.NewChange("seed", "run the populate from seed changes")
 	for _, ts := range tsAll {
@@ -395,6 +449,8 @@
 	c.Assert(st.Changes(), HasLen, 1)
 	c.Assert(chg.Err(), IsNil)
 
+	checkPreseedOrder(c, tsAll, "snapd", "core18", "foo")
+
 	st.Unlock()
 	err = s.overlord.Settle(settleTimeout)
 	st.Lock()
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/firstboot_test.go snapd-2.48.3+20.04/overlord/devicestate/firstboot_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/firstboot_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/firstboot_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -55,6 +55,7 @@
 	"github.com/snapcore/snapd/seed/seedtest"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/sysconfig"
 	"github.com/snapcore/snapd/systemd"
 	"github.com/snapcore/snapd/testutil"
 	"github.com/snapcore/snapd/timings"
@@ -108,6 +109,11 @@
 	t.AddCleanup(ifacestate.MockSecurityBackends(nil))
 
 	t.perfTimings = timings.New(nil)
+
+	r := devicestate.MockCloudInitStatus(func() (sysconfig.CloudInitState, error) {
+		return sysconfig.CloudInitRestrictedBySnapd, nil
+	})
+	t.AddCleanup(r)
 }
 
 // startOverlord will setup and create a new overlord, note that it will not
@@ -508,10 +514,6 @@
 	tsAll, err := devicestate.PopulateStateFromSeedImpl(st, opts, s.perfTimings)
 	c.Assert(err, IsNil)
 
-	checkOrder(c, tsAll, "core", "pc-kernel", "pc", "foo", "local")
-
-	checkTasks(c, tsAll)
-
 	// now run the change and check the result
 	// use the expected kind otherwise settle with start another one
 	chg := st.NewChange("seed", "run the populate from seed changes")
@@ -520,6 +522,9 @@
 	}
 	c.Assert(st.Changes(), HasLen, 1)
 
+	checkOrder(c, tsAll, "core", "pc-kernel", "pc", "foo", "local")
+	checkTasks(c, tsAll)
+
 	// avoid device reg
 	chg1 := st.NewChange("become-operational", "init device")
 	chg1.SetStatus(state.DoingStatus)
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/handlers_gadget.go snapd-2.48.3+20.04/overlord/devicestate/handlers_gadget.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/handlers_gadget.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/handlers_gadget.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,6 +25,7 @@
 
 	"gopkg.in/tomb.v2"
 
+	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget"
 	"github.com/snapcore/snapd/logger"
@@ -99,11 +100,12 @@
 	isRemodel := remodelCtx.ForRemodeling()
 	groundDeviceCtx := remodelCtx.GroundContext()
 
-	// be extra paranoid when checking we are installing the right gadget
-	expectedGadgetSnap := groundDeviceCtx.Model().Gadget()
+	model := groundDeviceCtx.Model()
 	if isRemodel {
-		expectedGadgetSnap = remodelCtx.Model().Gadget()
+		model = remodelCtx.Model()
 	}
+	// be extra paranoid when checking we are installing the right gadget
+	expectedGadgetSnap := model.Gadget()
 	if snapsup.InstanceName() != expectedGadgetSnap {
 		return fmt.Errorf("cannot apply gadget assets update from non-model gadget snap %q, expected %q snap",
 			snapsup.InstanceName(), expectedGadgetSnap)
@@ -136,9 +138,19 @@
 		updatePolicy = gadget.RemodelUpdatePolicy
 	}
 
-	st.Unlock()
-	err = gadgetUpdate(*currentData, *updateData, snapRollbackDir, updatePolicy)
-	st.Lock()
+	var updateObserver gadget.ContentUpdateObserver
+	observeTrustedBootAssets, err := boot.TrustedAssetsUpdateObserverForModel(model, updateData.RootDir)
+	if err != nil && err != boot.ErrObserverNotApplicable {
+		return fmt.Errorf("cannot setup asset update observer: %v", err)
+	}
+	if err == nil {
+		updateObserver = observeTrustedBootAssets
+	}
+	// do not release the state lock, the update observer may attempt to
+	// modify modeenv inside, which implicitly is guarded by the state lock;
+	// on top of that we do not expect the update to be moving large amounts
+	// of data
+	err = gadgetUpdate(*currentData, *updateData, snapRollbackDir, updatePolicy, updateObserver)
 	if err != nil {
 		if err == gadget.ErrNoUpdate {
 			// no update needed
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/handlers.go snapd-2.48.3+20.04/overlord/devicestate/handlers.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/handlers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/handlers.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,6 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 /*
- * Copyright (C) 2016-2017 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -25,6 +25,7 @@
 
 	"gopkg.in/tomb.v2"
 
+	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
@@ -42,11 +43,18 @@
 		return err
 	}
 
+	systemKey, err := interfaces.RecordedSystemKey()
+	if err != nil {
+		return fmt.Errorf("cannot get recorded system key: %v", err)
+	}
+
 	if m.preseed {
 		var preseeded bool
 		// the "preseeded" flag on this task is set to allow skipping the logic
 		// below in case this handler is retried in preseeding mode due to an
 		// EnsureBefore(0) done somewhere else.
+		// XXX: we should probably drop the flag from the task now that we have
+		// one on the state.
 		if err := t.Get("preseeded", &preseeded); err != nil && err != state.ErrNoState {
 			return err
 		}
@@ -66,6 +74,10 @@
 				}
 			}
 
+			st.Set("preseeded", preseeded)
+			st.Set("preseed-system-key", systemKey)
+			st.Set("preseed-time", timeNow())
+
 			// do not mark this task done as this makes it racy against taskrunner tear down (the next task
 			// could start). Let this task finish after snapd restart when preseed mode is off.
 			st.RequestRestart(state.StopDaemon)
@@ -76,6 +88,11 @@
 
 	// normal snapd run after snapd restart (not in preseed mode anymore)
 
+	st.Set("seed-restart-system-key", systemKey)
+	if err := m.setTimeOnce("seed-restart-time", startTime); err != nil {
+		return err
+	}
+
 	// enable all services generated as part of preseeding, but not enabled
 	// XXX: this should go away once the problem of install & services is fixed.
 	for _, snapSt := range snaps {
@@ -131,7 +148,7 @@
 	}
 
 	if deviceCtx.HasModeenv() && deviceCtx.RunMode() {
-		modeEnv, err := m.maybeReadModeenv()
+		modeEnv, err := maybeReadModeenv()
 		if err != nil {
 			return err
 		}
@@ -151,7 +168,9 @@
 	if err := t.Get("seed-system", &whatSeeded); err != nil && err != state.ErrNoState {
 		return err
 	}
-	if whatSeeded != nil {
+	if whatSeeded != nil && deviceCtx.RunMode() {
+		// record what seeded in the state only when in run mode
+
 		whatSeeded.SeedTime = now
 		// TODO:UC20 what about remodels?
 		if err := m.recordSeededSystem(st, whatSeeded); err != nil {
@@ -160,6 +179,8 @@
 	}
 	st.Set("seed-time", now)
 	st.Set("seeded", true)
+	// avoid possibly recording the same system multiple times etc.
+	t.SetStatus(state.DoneStatus)
 	// make sure we setup a fallback model/consider the next phase
 	// (registration) timely
 	st.EnsureBefore(0)
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/handlers_install.go snapd-2.48.3+20.04/overlord/devicestate/handlers_install.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/handlers_install.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/handlers_install.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,42 +26,58 @@
 
 	"gopkg.in/tomb.v2"
 
-	// TODO:UC20 look into merging
-	// snap-bootstrap/bootstrap|partition into gadget or
-	// subpackages there cleanly
-	"github.com/snapcore/snapd/cmd/snap-bootstrap/bootstrap"
-
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/randutil"
 	"github.com/snapcore/snapd/secboot"
 	"github.com/snapcore/snapd/sysconfig"
 )
 
 var (
-	bootMakeBootable            = boot.MakeBootable
-	sysconfigConfigureRunSystem = sysconfig.ConfigureRunSystem
-	bootstrapRun                = bootstrap.Run
+	bootMakeBootable = boot.MakeBootable
+	installRun       = install.Run
+
+	sysconfigConfigureTargetSystem = sysconfig.ConfigureTargetSystem
 )
 
 func setSysconfigCloudOptions(opts *sysconfig.Options, gadgetDir string, model *asserts.Model) {
-	// TODO: add support for a single cloud-init `cloud.conf` file
-	//       that is then passed to sysconfig
+	ubuntuSeedCloudCfg := filepath.Join(boot.InitramfsUbuntuSeedDir, "data/etc/cloud/cloud.cfg.d")
 
-	// check cloud.cfg.d on the ubuntu-seed partition
-	//
-	// Support custom cloud.cfg.d/*.cfg files on the ubuntu-seed partition
-	// during install when in grade "dangerous".
-	//
-	// XXX: maybe move policy decision into configureRunSystem later?
-	cloudCfg := filepath.Join(boot.InitramfsUbuntuSeedDir, "data/etc/cloud/cloud.cfg.d")
-	if osutil.IsDirectory(cloudCfg) && model.Grade() == asserts.ModelDangerous {
-		opts.CloudInitSrcDir = cloudCfg
-		return
+	switch {
+	// if the gadget has a cloud.conf file, always use that regardless of grade
+	case sysconfig.HasGadgetCloudConf(gadgetDir):
+		// this is implicitly handled by ConfigureTargetSystem when it configures
+		// cloud-init if none of the other options are set, so just break here
+		opts.AllowCloudInit = true
+
+	// next thing is if are in secured grade and didn't have gadget config, we
+	// disable cloud-init always, clouds should have their own config via
+	// gadgets for grade secured
+	case model.Grade() == asserts.ModelSecured:
+		opts.AllowCloudInit = false
+
+	// TODO:UC20: on grade signed, allow files from ubuntu-seed, but do
+	//            filtering on the resultant cloud config
+
+	// next if we are grade dangerous, then we also install cloud configuration
+	// from ubuntu-seed if it exists
+	case model.Grade() == asserts.ModelDangerous && osutil.IsDirectory(ubuntuSeedCloudCfg):
+		opts.AllowCloudInit = true
+		opts.CloudInitSrcDir = ubuntuSeedCloudCfg
+
+	// note that if none of the conditions were true, it means we are on grade
+	// dangerous or signed, and cloud-init is still allowed to run without
+	// additional configuration on first-boot, so that NoCloud CIDATA can be
+	// provided for example
+	default:
+		opts.AllowCloudInit = true
 	}
 }
 
@@ -97,9 +113,8 @@
 	if err != nil {
 		return fmt.Errorf("cannot get kernel info: %v", err)
 	}
-	kernelDir := kernelInfo.MountDir()
 
-	modeEnv, err := m.maybeReadModeenv()
+	modeEnv, err := maybeReadModeenv()
 	if err != nil {
 		return err
 	}
@@ -108,54 +123,90 @@
 	}
 
 	// bootstrap
-	bopts := bootstrap.Options{
+	bopts := install.Options{
 		Mount: true,
 	}
-	useEncryption, err := checkEncryption(deviceCtx.Model())
+	useEncryption, err := m.checkEncryption(st, deviceCtx)
 	if err != nil {
 		return err
 	}
-	if useEncryption {
-		fdeDir := "var/lib/snapd/device/fde"
-		// ensure directories
-		for _, p := range []string{boot.InitramfsEncryptionKeyDir, filepath.Join(boot.InstallHostWritableDir, fdeDir)} {
-			if err := os.MkdirAll(p, 0755); err != nil {
-				return err
-			}
-		}
-
-		bopts.Encrypt = true
-		bopts.KeyFile = filepath.Join(boot.InitramfsEncryptionKeyDir, "ubuntu-data.sealed-key")
-		bopts.RecoveryKeyFile = filepath.Join(boot.InstallHostWritableDir, fdeDir, "recovery.key")
-		bopts.TPMLockoutAuthFile = filepath.Join(boot.InstallHostWritableDir, fdeDir, "tpm-lockout-auth")
-		bopts.PolicyUpdateDataFile = filepath.Join(boot.InstallHostWritableDir, fdeDir, "policy-update-data")
-		bopts.KernelPath = filepath.Join(kernelDir, "kernel.efi")
-		bopts.Model = deviceCtx.Model()
-		bopts.SystemLabel = modeEnv.RecoverySystem
+	bopts.Encrypt = useEncryption
+
+	// make sure that gadget is usable for the set up we want to use it in
+	gadgetContaints := gadget.ValidationConstraints{
+		EncryptedData: useEncryption,
+	}
+	if err := gadget.Validate(gadgetDir, deviceCtx.Model(), &gadgetContaints); err != nil {
+		return fmt.Errorf("cannot use gadget: %v", err)
+	}
+
+	var trustedInstallObserver *boot.TrustedAssetsInstallObserver
+	// get a nice nil interface by default
+	var installObserver gadget.ContentObserver
+	trustedInstallObserver, err = boot.TrustedAssetsInstallObserverForModel(deviceCtx.Model(), gadgetDir, useEncryption)
+	if err != nil && err != boot.ErrObserverNotApplicable {
+		return fmt.Errorf("cannot setup asset install observer: %v", err)
+	}
+	if err == nil {
+		installObserver = trustedInstallObserver
+		if !useEncryption {
+			// there will be no key sealing, so past the
+			// installation pass no other methods need to be called
+			trustedInstallObserver = nil
+		}
 	}
 
+	var installedSystem *install.InstalledSystemSideData
 	// run the create partition code
 	logger.Noticef("create and deploy partitions")
 	func() {
 		st.Unlock()
 		defer st.Lock()
-		err = bootstrapRun(gadgetDir, "", bopts)
+		installedSystem, err = installRun(gadgetDir, "", bopts, installObserver)
 	}()
 	if err != nil {
-		return fmt.Errorf("cannot create partitions: %v", err)
+		return fmt.Errorf("cannot install system: %v", err)
+	}
+
+	if trustedInstallObserver != nil {
+		// sanity check
+		if installedSystem.KeysForRoles == nil || installedSystem.KeysForRoles[gadget.SystemData] == nil || installedSystem.KeysForRoles[gadget.SystemSave] == nil {
+			return fmt.Errorf("internal error: system encryption keys are unset")
+		}
+		dataKeySet := installedSystem.KeysForRoles[gadget.SystemData]
+		saveKeySet := installedSystem.KeysForRoles[gadget.SystemSave]
+
+		// make note of the encryption keys
+		trustedInstallObserver.ChosenEncryptionKeys(dataKeySet.Key, saveKeySet.Key)
+
+		// keep track of recovery assets
+		if err := trustedInstallObserver.ObserveExistingTrustedRecoveryAssets(boot.InitramfsUbuntuSeedDir); err != nil {
+			return fmt.Errorf("cannot observe existing trusted recovery assets: err")
+		}
+		if err := saveKeys(installedSystem.KeysForRoles); err != nil {
+			return err
+		}
+		// write markers containing a secret to pair data and save
+		if err := writeMarkers(); err != nil {
+			return err
+		}
 	}
 
 	// keep track of the model we installed
-	err = writeModel(deviceCtx.Model(), filepath.Join(boot.InitramfsUbuntuBootDir, "model"))
+	err = os.MkdirAll(filepath.Join(boot.InitramfsUbuntuBootDir, "device"), 0755)
+	if err != nil {
+		return fmt.Errorf("cannot store the model: %v", err)
+	}
+	err = writeModel(deviceCtx.Model(), filepath.Join(boot.InitramfsUbuntuBootDir, "device/model"))
 	if err != nil {
 		return fmt.Errorf("cannot store the model: %v", err)
 	}
 
 	// configure the run system
-	opts := &sysconfig.Options{TargetRootDir: boot.InstallHostWritableDir}
+	opts := &sysconfig.Options{TargetRootDir: boot.InstallHostWritableDir, GadgetDir: gadgetDir}
 	// configure cloud init
 	setSysconfigCloudOptions(opts, gadgetDir, deviceCtx.Model())
-	if err := sysconfigConfigureRunSystem(opts); err != nil {
+	if err := sysconfigConfigureTargetSystem(opts); err != nil {
 		return err
 	}
 
@@ -172,9 +223,10 @@
 		Kernel:            kernelInfo,
 		KernelPath:        kernelInfo.MountFile(),
 		RecoverySystemDir: recoverySystemDir,
+		UnpackedGadgetDir: gadgetDir,
 	}
 	rootdir := dirs.GlobalRootDir
-	if err := bootMakeBootable(deviceCtx.Model(), rootdir, bootWith); err != nil {
+	if err := bootMakeBootable(deviceCtx.Model(), rootdir, bootWith, trustedInstallObserver); err != nil {
 		return fmt.Errorf("cannot make run system bootable: %v", err)
 	}
 
@@ -185,13 +237,77 @@
 	return nil
 }
 
+// writeMarkers writes markers containing the same secret to pair data and save.
+func writeMarkers() error {
+	// ensure directory for markers exists
+	if err := os.MkdirAll(boot.InstallHostFDEDataDir, 0755); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(boot.InstallHostFDESaveDir, 0755); err != nil {
+		return err
+	}
+
+	// generate a secret random marker
+	markerSecret, err := randutil.CryptoTokenBytes(32)
+	if err != nil {
+		return fmt.Errorf("cannot create ubuntu-data/save marker secret: %v", err)
+	}
+
+	dataMarker := filepath.Join(boot.InstallHostFDEDataDir, "marker")
+	if err := osutil.AtomicWriteFile(dataMarker, markerSecret, 0600, 0); err != nil {
+		return err
+	}
+
+	saveMarker := filepath.Join(boot.InstallHostFDESaveDir, "marker")
+	if err := osutil.AtomicWriteFile(saveMarker, markerSecret, 0600, 0); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func saveKeys(keysForRoles map[string]*install.EncryptionKeySet) error {
+	dataKeySet := keysForRoles[gadget.SystemData]
+
+	// ensure directory for keys exists
+	if err := os.MkdirAll(boot.InstallHostFDEDataDir, 0755); err != nil {
+		return err
+	}
+
+	// Write the recovery key
+	recoveryKeyFile := filepath.Join(boot.InstallHostFDEDataDir, "recovery.key")
+	if err := dataKeySet.RecoveryKey.Save(recoveryKeyFile); err != nil {
+		return fmt.Errorf("cannot store recovery key: %v", err)
+	}
+
+	saveKeySet := keysForRoles[gadget.SystemSave]
+	if saveKeySet == nil {
+		// no system-save support
+		return nil
+	}
+
+	saveKey := filepath.Join(boot.InstallHostFDEDataDir, "ubuntu-save.key")
+	reinstallSaveKey := filepath.Join(boot.InstallHostFDEDataDir, "reinstall.key")
+
+	if err := saveKeySet.Key.Save(saveKey); err != nil {
+		return fmt.Errorf("cannot store system save key: %v", err)
+	}
+	if err := saveKeySet.RecoveryKey.Save(reinstallSaveKey); err != nil {
+		return fmt.Errorf("cannot store reinstall key: %v", err)
+	}
+	return nil
+}
+
 var secbootCheckKeySealingSupported = secboot.CheckKeySealingSupported
 
 // checkEncryption verifies whether encryption should be used based on the
-// model grade and the availability of a TPM device.
-func checkEncryption(model *asserts.Model) (res bool, err error) {
+// model grade and the availability of a TPM device or a fde-setup hook
+// in the kernel.
+func (m *DeviceManager) checkEncryption(st *state.State, deviceCtx snapstate.DeviceContext) (res bool, err error) {
+	model := deviceCtx.Model()
 	secured := model.Grade() == asserts.ModelSecured
 	dangerous := model.Grade() == asserts.ModelDangerous
+	encrypted := model.StorageSafety() == asserts.StorageSafetyEncrypted
 
 	// check if we should disable encryption non-secured devices
 	// TODO:UC20: this is not the final mechanism to bypass encryption
@@ -199,13 +315,49 @@
 		return false, nil
 	}
 
-	// encryption is required in secured devices and optional in other grades
-	if err := secbootCheckKeySealingSupported(); err != nil {
+	// check if the model prefers to be unencrypted
+	// TODO: provide way to select via install chooser menu
+	//       if the install is unencrypted or encrypted
+	if model.StorageSafety() == asserts.StorageSafetyPreferUnencrypted {
+		logger.Noticef(`installing system unencrypted to comply with prefer-unencrypted storage-safety model option`)
+		return false, nil
+	}
+
+	// check if encryption is available
+	var (
+		hasFDESetupHook    bool
+		checkEncryptionErr error
+	)
+	if kernelInfo, err := snapstate.KernelInfo(st, deviceCtx); err == nil {
+		if hasFDESetupHook = hasFDESetupHookInKernel(kernelInfo); hasFDESetupHook {
+			checkEncryptionErr = m.checkFDEFeatures(st)
+		}
+	}
+	// Note that having a fde-setup hook will disable the build-in
+	// secboot encryption
+	if !hasFDESetupHook {
+		checkEncryptionErr = secbootCheckKeySealingSupported()
+	}
+
+	// check if encryption is required
+	if checkEncryptionErr != nil {
 		if secured {
-			return false, fmt.Errorf("cannot encrypt secured device: %v", err)
+			return false, fmt.Errorf("cannot encrypt device storage as mandated by model grade secured: %v", checkEncryptionErr)
+		}
+		if encrypted {
+			return false, fmt.Errorf("cannot encrypt device storage as mandated by encrypted storage-safety model option: %v", checkEncryptionErr)
 		}
+
+		if hasFDESetupHook {
+			logger.Noticef("not encrypting device storage as querying kernel fde-setup hook did not succeed: %v", checkEncryptionErr)
+		} else {
+			logger.Noticef("not encrypting device storage as checking TPM gave: %v", checkEncryptionErr)
+		}
+
+		// not required, go without
 		return false, nil
 	}
 
+	// encrypt
 	return true, nil
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/handlers_remodel.go snapd-2.48.3+20.04/overlord/devicestate/handlers_remodel.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/handlers_remodel.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/handlers_remodel.go	2021-02-02 08:21:12.000000000 +0000
@@ -181,7 +181,7 @@
 	if release.OnClassic {
 		return nil
 	}
-	if snapInfo.GetType() != snap.TypeGadget {
+	if snapInfo.Type() != snap.TypeGadget {
 		// We are only interested in gadget snaps.
 		return nil
 	}
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/handlers_serial.go snapd-2.48.3+20.04/overlord/devicestate/handlers_serial.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/handlers_serial.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/handlers_serial.go	2021-02-02 08:21:12.000000000 +0000
@@ -106,7 +106,9 @@
 	}
 
 	privKey := asserts.RSAPrivateKey(keyPair)
-	err = m.keypairMgr.Put(privKey)
+	err = m.withKeypairMgr(func(keypairMgr asserts.KeypairManager) error {
+		return keypairMgr.Put(privKey)
+	})
 	if err != nil {
 		return fmt.Errorf("cannot store device key pair: %v", err)
 	}
@@ -683,7 +685,33 @@
 	}
 
 	finish := func(serial *asserts.Serial) error {
-		if regCtx.FinishRegistration(serial); err != nil {
+		// save serial if appropriate into the device save
+		// assertion database
+		err := m.withSaveAssertDB(func(savedb *asserts.Database) error {
+			db := assertstate.DB(st)
+			retrieve := func(ref *asserts.Ref) (asserts.Assertion, error) {
+				return ref.Resolve(db.Find)
+			}
+			b := asserts.NewBatch(nil)
+			err := b.Fetch(savedb, retrieve, func(f asserts.Fetcher) error {
+				// save the associated model as well
+				// as it might be required for cross-checks
+				// of the serial
+				if err := f.Save(regCtx.Model()); err != nil {
+					return err
+				}
+				return f.Save(serial)
+			})
+			if err != nil {
+				return err
+			}
+			return b.CommitTo(savedb, nil)
+		})
+		if err != nil && err != errNoSaveSupport {
+			return fmt.Errorf("cannot save serial to device save assertion database: %v", err)
+		}
+
+		if err := regCtx.FinishRegistration(serial); err != nil {
 			return err
 		}
 		t.SetStatus(state.DoneStatus)
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/handlers_test.go snapd-2.48.3+20.04/overlord/devicestate/handlers_test.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/handlers_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/handlers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -23,11 +23,13 @@
 	"context"
 	"fmt"
 	"path/filepath"
+	"time"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/overlord/assertstate"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/devicestate"
@@ -434,24 +436,29 @@
 type preseedBaseSuite struct {
 	deviceMgrBaseSuite
 
-	// TODO: use this in deviceMgrBaseSuite itself
-	testutil.BaseTest
-
 	cmdUmount    *testutil.MockCmd
 	cmdSystemctl *testutil.MockCmd
 }
 
 func (s *preseedBaseSuite) SetUpTest(c *C, preseed bool) {
-	s.BaseTest.SetUpTest(c)
-
-	s.AddCleanup(snapdenv.MockPreseeding(preseed))
+	r := snapdenv.MockPreseeding(preseed)
 
 	// preseed mode helper needs to be mocked before setting up
 	// deviceMgrBaseSuite due to device Manager init.
 	s.deviceMgrBaseSuite.SetUpTest(c)
 
+	// can use cleanup only after having called base SetUpTest
+	s.AddCleanup(r)
+
+	s.AddCleanup(interfaces.MockSystemKey(`{"build-id":"abcde"}`))
+	c.Assert(interfaces.WriteSystemKey(), IsNil)
+
 	s.cmdUmount = testutil.MockCommand(c, "umount", "")
 	s.cmdSystemctl = testutil.MockCommand(c, "systemctl", "")
+	s.AddCleanup(func() {
+		s.cmdUmount.Restore()
+		s.cmdSystemctl.Restore()
+	})
 
 	st := s.state
 	st.Lock()
@@ -474,12 +481,6 @@
 	})
 }
 
-func (s *preseedBaseSuite) TearDownTest(c *C) {
-	s.deviceMgrBaseSuite.TearDownTest(c)
-	s.cmdUmount.Restore()
-	s.cmdSystemctl.Restore()
-}
-
 // TODO: rename preesed mode to just preseeding as much as possible,
 // preseed mode souns like a UC20 system mode but is just a snapd mode
 // but preseed snapd mode is a mouthful
@@ -498,6 +499,12 @@
 }
 
 func (s *preseedModeSuite) TestDoMarkPreseeded(c *C) {
+	now := time.Now()
+	restore := devicestate.MockTimeNow(func() time.Time {
+		return now
+	})
+	defer restore()
+
 	st := s.state
 	st.Lock()
 	defer st.Unlock()
@@ -519,6 +526,18 @@
 	c.Check(t.Get("preseeded", &preseeded), IsNil)
 	c.Check(preseeded, Equals, true)
 
+	c.Assert(st.Get("preseeded", &preseeded), IsNil)
+	c.Check(preseeded, Equals, true)
+
+	var systemKey map[string]interface{}
+	c.Assert(st.Get("seed-restart-system-key", &systemKey), Equals, state.ErrNoState)
+	c.Assert(st.Get("preseed-system-key", &systemKey), IsNil)
+	c.Check(systemKey["build-id"], Equals, "abcde")
+
+	var preseededTime time.Time
+	c.Assert(st.Get("preseed-time", &preseededTime), IsNil)
+	c.Check(preseededTime.Equal(now), Equals, true)
+
 	// core snap was "manually" unmounted
 	c.Check(s.cmdUmount.Calls(), DeepEquals, [][]string{
 		{"umount", "-d", "-l", filepath.Join(dirs.SnapMountDir, "test-snap/3")},
@@ -540,6 +559,12 @@
 }
 
 func (s *preseedModeSuite) TestEnsureSeededPreseedFlag(c *C) {
+	now := time.Now()
+	restoreTimeNow := devicestate.MockTimeNow(func() time.Time {
+		return now
+	})
+	defer restoreTimeNow()
+
 	called := false
 	restore := devicestate.MockPopulateStateFromSeed(func(st *state.State, opts *devicestate.PopulateStateFromSeedOptions, tm timings.Measurer) ([]*state.TaskSet, error) {
 		called = true
@@ -551,6 +576,13 @@
 	err := devicestate.EnsureSeeded(s.mgr)
 	c.Assert(err, IsNil)
 	c.Check(called, Equals, true)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	var preseedStartTime time.Time
+	c.Assert(s.state.Get("preseed-start-time", &preseedStartTime), IsNil)
+	c.Check(preseedStartTime.Equal(now), Equals, true)
 }
 
 type preseedDoneSuite struct {
@@ -587,7 +619,20 @@
 	c.Check(s.cmdUmount.Calls(), HasLen, 0)
 	c.Check(s.restartRequests, HasLen, 0)
 
+	var systemKey map[string]interface{}
+	// in real world preseed-system-key would be present at this point because
+	// mark-preseeded would be run twice (before & after preseeding); this is
+	// not the case in this test.
+	c.Assert(st.Get("preseed-system-key", &systemKey), Equals, state.ErrNoState)
+	c.Assert(st.Get("seed-restart-system-key", &systemKey), IsNil)
+	c.Check(systemKey["build-id"], Equals, "abcde")
+
+	var seedRestartTime time.Time
+	c.Assert(st.Get("seed-restart-time", &seedRestartTime), IsNil)
+	c.Check(seedRestartTime.Equal(devicestate.StartTime()), Equals, true)
+
+	// this runs on first boot
 	c.Check(s.cmdSystemctl.Calls(), DeepEquals, [][]string{
-		{"systemctl", "--root", dirs.GlobalRootDir, "enable", "snap.test-snap.srv.service"},
+		{"systemctl", "enable", "snap.test-snap.srv.service"},
 	})
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/devicestate/systems.go snapd-2.48.3+20.04/overlord/devicestate/systems.go
--- snapd-2.45.1+20.04.2/overlord/devicestate/systems.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/devicestate/systems.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,178 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package devicestate
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/seed"
+)
+
+func checkSystemRequestConflict(st *state.State, systemLabel string) error {
+	st.Lock()
+	defer st.Unlock()
+
+	var seeded bool
+	if err := st.Get("seeded", &seeded); err != nil && err != state.ErrNoState {
+		return err
+	}
+	if seeded {
+		// the system is fully seeded already
+		return nil
+	}
+
+	// inspect the current system which is stored in modeenv, note we are
+	// holding the state lock so there is no race against mark-seeded
+	// clearing recovery system; recovery system is not cleared when seeding
+	// fails
+	modeEnv, err := maybeReadModeenv()
+	if err != nil {
+		return err
+	}
+	if modeEnv == nil {
+		// non UC20 systems do not support actions, no conflict can
+		// happen
+		return nil
+	}
+
+	// not yet fully seeded, hold off requests for the system that is being
+	// seeded, but allow requests for other systems
+	if modeEnv.RecoverySystem == systemLabel {
+		return &snapstate.ChangeConflictError{
+			ChangeKind: "seed",
+			Message:    "cannot request system action, system is seeding",
+		}
+	}
+	return nil
+}
+
+func systemFromSeed(label string, current *currentSystem) (*System, error) {
+	s, err := seed.Open(dirs.SnapSeedDir, label)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open: %v", err)
+	}
+	if err := s.LoadAssertions(nil, nil); err != nil {
+		return nil, fmt.Errorf("cannot load assertions: %v", err)
+	}
+	// get the model
+	model := s.Model()
+	brand, err := s.Brand()
+	if err != nil {
+		return nil, fmt.Errorf("cannot obtain brand: %v", err)
+	}
+	system := &System{
+		Current: false,
+		Label:   label,
+		Model:   model,
+		Brand:   brand,
+		Actions: defaultSystemActions,
+	}
+	if current.sameAs(system) {
+		system.Current = true
+		system.Actions = current.actions
+	}
+	return system, nil
+}
+
+type currentSystem struct {
+	*seededSystem
+	actions []SystemAction
+}
+
+func (c *currentSystem) sameAs(other *System) bool {
+	return c != nil &&
+		c.System == other.Label &&
+		c.Model == other.Model.Model() &&
+		c.BrandID == other.Brand.AccountID()
+}
+
+func currentSystemForMode(st *state.State, mode string) (*currentSystem, error) {
+	var system *seededSystem
+	var actions []SystemAction
+	var err error
+
+	switch mode {
+	case "run":
+		actions = currentSystemActions
+		system, err = currentSeededSystem(st)
+	case "install":
+		// there is no current system for install mode
+		return nil, nil
+	case "recover":
+		actions = recoverSystemActions
+		// recover mode uses modeenv for reference
+		system, err = seededSystemFromModeenv()
+	default:
+		return nil, fmt.Errorf("internal error: cannot identify current system for unsupported mode %q", mode)
+	}
+	if err != nil {
+		return nil, err
+	}
+	currentSys := &currentSystem{
+		seededSystem: system,
+		actions:      actions,
+	}
+	return currentSys, nil
+}
+
+func currentSeededSystem(st *state.State) (*seededSystem, error) {
+	st.Lock()
+	defer st.Unlock()
+
+	var whatseeded []seededSystem
+	if err := st.Get("seeded-systems", &whatseeded); err != nil {
+		return nil, err
+	}
+	if len(whatseeded) == 0 {
+		// unexpected
+		return nil, state.ErrNoState
+	}
+	return &whatseeded[0], nil
+}
+
+func seededSystemFromModeenv() (*seededSystem, error) {
+	modeEnv, err := maybeReadModeenv()
+	if err != nil {
+		return nil, err
+	}
+	if modeEnv == nil {
+		return nil, fmt.Errorf("internal error: modeenv does not exist")
+	}
+	if modeEnv.RecoverySystem == "" {
+		return nil, fmt.Errorf("internal error: recovery system is unset")
+	}
+
+	system, err := systemFromSeed(modeEnv.RecoverySystem, nil)
+	if err != nil {
+		return nil, err
+	}
+	seededSys := &seededSystem{
+		System:    modeEnv.RecoverySystem,
+		Model:     system.Model.Model(),
+		BrandID:   system.Model.BrandID(),
+		Revision:  system.Model.Revision(),
+		Timestamp: system.Model.Timestamp(),
+		// SeedTime is intentionally left unset
+	}
+	return seededSys, nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/context.go snapd-2.48.3+20.04/overlord/hookstate/context.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/context.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/context.go	2021-02-02 08:21:12.000000000 +0000
@@ -137,6 +137,28 @@
 	}
 }
 
+func (c *Context) initForRun(handler Handler, contextData map[string]interface{}) error {
+	c.handler = handler
+	if contextData == nil {
+		return nil
+	}
+
+	if !c.IsEphemeral() {
+		return fmt.Errorf("internal error: cannot pass contextData to initForRun for %v", c)
+	}
+
+	serialized, err := json.Marshal(contextData)
+	if err != nil {
+		return err
+	}
+	var data map[string]*json.RawMessage
+	if err := json.Unmarshal(serialized, &data); err != nil {
+		return err
+	}
+	c.cache["ephemeral-context"] = data
+	return nil
+}
+
 // Set associates value with key. The provided value must properly marshal and
 // unmarshal with encoding/json. Note that the context needs to be locked and
 // unlocked by the caller.
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/fde_setup.go snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/fde_setup.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/fde_setup.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/fde_setup.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,139 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package ctlcmd
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/snapcore/snapd/i18n"
+	"github.com/snapcore/snapd/overlord/devicestate/fde"
+)
+
+type fdeSetupRequestCommand struct {
+	baseCommand
+}
+
+var shortFdeSetupRequestHelp = i18n.G("Obtain full disk encryption setup request")
+
+var longFdeSetupRequestHelp = i18n.G(`
+The fde-setup-request command is used inside the fde-setup hook. It will
+return information about what operation for full-disk encryption is
+requested and auxiliary data to complete this operation.
+
+The fde-setup hook should do what is requested and then call
+"snapctl fde-setup-result" and pass the result data to stdin.
+
+Here is an example for how the fde-setup hook is called initially:
+$ snapctl fde-setup-request
+{"op":"features"}
+$ echo '[]' | snapctl fde-setup-result
+
+Alternatively the hook could reply with:
+$ echo '{"error":"hardware-unsupported"}' | snapctl fde-setup-result
+
+And then it is called again with a request to do the initial key setup:
+$ snapctl fde-setup-request
+{"op":"initial-setup", "key": "key-to-seal", "key-name":"key-for-ubuntu-data"}
+$ echo "$sealed_key" | snapctl fde-setup-result
+`)
+
+func init() {
+	addCommand("fde-setup-request", shortFdeSetupRequestHelp, longFdeSetupRequestHelp, func() command { return &fdeSetupRequestCommand{} })
+}
+
+func (c *fdeSetupRequestCommand) Execute(args []string) error {
+	context := c.context()
+	if context == nil {
+		return fmt.Errorf("cannot run fde-setup-request without a context")
+	}
+	context.Lock()
+	defer context.Unlock()
+
+	if context.HookName() != "fde-setup" {
+		return fmt.Errorf("cannot use fde-setup-request outside of the fde-setup hook")
+	}
+
+	var fdeSetup fde.SetupRequest
+	if err := context.Get("fde-setup-request", &fdeSetup); err != nil {
+		return fmt.Errorf("cannot get fde-setup-op from context: %v", err)
+	}
+	// Op is either "initial-setup" or "features"
+	switch fdeSetup.Op {
+	case "features", "initial-setup":
+		// fine
+	default:
+		return fmt.Errorf("unknown fde-setup-request op %q", fdeSetup.Op)
+
+	}
+
+	bytes, err := json.Marshal(fdeSetup)
+	if err != nil {
+		return fmt.Errorf("cannot json print fde key: %v", err)
+	}
+	c.printf("%s\n", string(bytes))
+
+	return nil
+}
+
+type fdeSetupResultCommand struct {
+	baseCommand
+}
+
+var shortFdeSetupResultHelp = i18n.G("Set result for full disk encryption")
+var longFdeSetupResultHelp = i18n.G(`
+The fde-setup-result command sets the result data for a fde-setup hook
+reading it from stdin.
+
+For example:
+When the fde-setup hook is called with "op":"features:
+$ echo "[]" | snapctl fde-setup-result
+
+When the fde-setup hook is called with "op":"initial-setup":
+$ echo "sealed-key" | snapctl fde-setup-result
+`)
+
+func init() {
+	addCommand("fde-setup-result", shortFdeSetupResultHelp, longFdeSetupResultHelp, func() command { return &fdeSetupResultCommand{} })
+}
+
+func (c *fdeSetupResultCommand) Execute(args []string) error {
+	context := c.context()
+	if context == nil {
+		return fmt.Errorf("cannot run fde-setup-result without a context")
+	}
+	context.Lock()
+	defer context.Unlock()
+
+	if context.HookName() != "fde-setup" {
+		return fmt.Errorf("cannot use fde-setup-result outside of the fde-setup hook")
+	}
+
+	var fdeSetupResult []byte
+	if err := context.Get("stdin", &fdeSetupResult); err != nil {
+		return fmt.Errorf("internal error: cannot get result from stdin: %v", err)
+	}
+	if fdeSetupResult == nil {
+		return fmt.Errorf("no result data found from stdin")
+	}
+	context.Set("fde-setup-result", fdeSetupResult)
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/fde_setup_test.go snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/fde_setup_test.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/fde_setup_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/fde_setup_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,174 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package ctlcmd_test
+
+import (
+	"fmt"
+	"strings"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord/devicestate/fde"
+	"github.com/snapcore/snapd/overlord/hookstate"
+	"github.com/snapcore/snapd/overlord/hookstate/ctlcmd"
+	"github.com/snapcore/snapd/overlord/hookstate/hooktest"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type fdeSetupSuite struct {
+	testutil.BaseTest
+
+	st          *state.State
+	mockHandler *hooktest.MockHandler
+	mockTask    *state.Task
+	mockContext *hookstate.Context
+}
+
+var _ = Suite(&fdeSetupSuite{})
+
+var mockFdeSetupKernelYaml = `name: pc-kernel
+version: 1.0
+type: kernel
+hooks:
+ fde-setup:
+`
+
+func (s *fdeSetupSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
+
+	s.st = state.New(nil)
+	s.mockHandler = hooktest.NewMockHandler()
+	s.st.Lock()
+	defer s.st.Unlock()
+
+	mockInstalledSnap(c, s.st, mockFdeSetupKernelYaml)
+	s.mockTask = s.st.NewTask("test-task", "my test task")
+	hooksup := &hookstate.HookSetup{
+		Snap:     "pc-kernel",
+		Revision: snap.R(1),
+		Hook:     "fde-setup",
+	}
+	context, err := hookstate.NewContext(s.mockTask, s.st, hooksup, s.mockHandler, "")
+	c.Assert(err, IsNil)
+	s.mockContext = context
+}
+
+func (s *fdeSetupSuite) TestFdeSetupRequestOpInvalid(c *C) {
+	fdeSetup := &fde.SetupRequest{
+		Op: "invalid-and-unknown",
+	}
+	s.mockContext.Lock()
+	s.mockContext.Set("fde-setup-request", fdeSetup)
+	s.mockContext.Unlock()
+
+	stdout, stderr, err := ctlcmd.Run(s.mockContext, []string{"fde-setup-request"}, 0)
+	c.Check(err, ErrorMatches, `unknown fde-setup-request op "invalid-and-unknown"`)
+	c.Check(string(stdout), Equals, "")
+	c.Check(string(stderr), Equals, "")
+}
+
+func (s *fdeSetupSuite) TestFdeSetupRequestNoFdeSetupOpData(c *C) {
+	hooksup := &hookstate.HookSetup{
+		Snap:     "pc-kernel",
+		Revision: snap.R(1),
+		Hook:     "other-hook",
+	}
+	context, err := hookstate.NewContext(nil, s.st, hooksup, s.mockHandler, "")
+	c.Assert(err, IsNil)
+
+	// check "fde-setup-request" error
+	stdout, stderr, err := ctlcmd.Run(context, []string{"fde-setup-request"}, 0)
+	c.Check(err, ErrorMatches, `cannot use fde-setup-request outside of the fde-setup hook`)
+	c.Check(string(stdout), Equals, "")
+	c.Check(string(stderr), Equals, "")
+
+	// check "fde-setup-result" error
+	stdout, stderr, err = ctlcmd.Run(context, []string{"fde-setup-result"}, 0)
+	c.Check(err, ErrorMatches, `cannot use fde-setup-result outside of the fde-setup hook`)
+	c.Check(string(stdout), Equals, "")
+	c.Check(string(stderr), Equals, "")
+}
+
+func (s *fdeSetupSuite) TestFdeSetupRequestOpFeatures(c *C) {
+	fdeSetup := &fde.SetupRequest{
+		Op: "features",
+	}
+	s.mockContext.Lock()
+	s.mockContext.Set("fde-setup-request", fdeSetup)
+	s.mockContext.Unlock()
+
+	stdout, stderr, err := ctlcmd.Run(s.mockContext, []string{"fde-setup-request"}, 0)
+	c.Assert(err, IsNil)
+	c.Check(string(stdout), Equals, `{"op":"features"}`+"\n")
+	c.Check(string(stderr), Equals, "")
+}
+
+func (s *fdeSetupSuite) TestFdeSetupRequestOpInitialSetup(c *C) {
+	fdeSetup := &fde.SetupRequest{
+		Op:      "initial-setup",
+		Key:     &secboot.EncryptionKey{1, 2, 3, 4},
+		KeyName: "the-key-name",
+		Models: []map[string]string{
+			{
+				"series":     "16",
+				"brand-id":   "my-brand",
+				"model":      "my-model",
+				"grade":      "secured",
+				"signkey-id": "the-signkey-id",
+			},
+		},
+	}
+	s.mockContext.Lock()
+	s.mockContext.Set("fde-setup-request", fdeSetup)
+	s.mockContext.Unlock()
+
+	stdout, stderr, err := ctlcmd.Run(s.mockContext, []string{"fde-setup-request"}, 0)
+	c.Assert(err, IsNil)
+
+	jsonEncodedEncryptionKey := `[1,2,3,4,` + strings.Repeat("0,", len(secboot.EncryptionKey{})-5) + `0]`
+	c.Check(string(stdout), Equals, fmt.Sprintf(`{"op":"initial-setup","key":%s,"key-name":"the-key-name","models":[{"brand-id":"my-brand","grade":"secured","model":"my-model","series":"16","signkey-id":"the-signkey-id"}]}`+"\n", jsonEncodedEncryptionKey))
+	c.Check(string(stderr), Equals, "")
+}
+
+func (s *fdeSetupSuite) TestFdeSetupResult(c *C) {
+	mockStdin := []byte("sealed-key-data-from-stdin-as-set-by-daemon:runSnapctl")
+
+	s.mockContext.Lock()
+	s.mockContext.Set("stdin", mockStdin)
+	s.mockContext.Unlock()
+
+	stdout, stderr, err := ctlcmd.Run(s.mockContext, []string{"fde-setup-result"}, 0)
+	c.Assert(err, IsNil)
+	c.Check(string(stdout), Equals, "")
+	c.Check(string(stderr), Equals, "")
+
+	// check that the task got the key that was passed via stdin
+	var fdeSetupResult []byte
+	s.mockContext.Lock()
+	s.mockContext.Get("fde-setup-result", &fdeSetupResult)
+	s.mockContext.Unlock()
+	c.Check(fdeSetupResult, DeepEquals, mockStdin)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/is_connected.go snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/is_connected.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/is_connected.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/is_connected.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,6 +25,7 @@
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/overlord/ifacestate"
+	"github.com/snapcore/snapd/overlord/snapstate"
 )
 
 type isConnectedCommand struct {
@@ -68,14 +69,24 @@
 	st.Lock()
 	defer st.Unlock()
 
+	info, err := snapstate.CurrentInfo(st, snapName)
+	if err != nil {
+		return fmt.Errorf("internal error: cannot get snap info: %s", err)
+	}
+
+	// XXX: This will fail for implicit slots.  In practice, this
+	// would only affect calls that used the "core" snap as
+	// context.  That snap does not have any hooks using
+	// is-connected, so the limitation is probably moot.
+	if info.Plugs[plugOrSlot] == nil && info.Slots[plugOrSlot] == nil {
+		return fmt.Errorf("snap %q has no plug or slot named %q", snapName, plugOrSlot)
+	}
+
 	conns, err := ifacestate.ConnectionStates(st)
 	if err != nil {
 		return fmt.Errorf("internal error: cannot get connections: %s", err)
 	}
 
-	// XXX should we check if plug/slot exists? We don't differentiate between
-	// non-connected/not-existing at the moment.
-
 	// snapName is the name of the snap executing snapctl command, it's
 	// obtained from the context (ephemeral if run by apps, or full if run by
 	// hooks). plug and slot names are unique within a snap, so there is no
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/is_connected_test.go snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/is_connected_test.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/is_connected_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/is_connected_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,16 +20,21 @@
 package ctlcmd_test
 
 import (
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/hookstate/ctlcmd"
 	"github.com/snapcore/snapd/overlord/hookstate/hooktest"
+	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/testutil"
 
 	. "gopkg.in/check.v1"
 )
 
 type isConnectedSuite struct {
+	testutil.BaseTest
 	st          *state.State
 	mockHandler *hooktest.MockHandler
 }
@@ -37,6 +42,9 @@
 var _ = Suite(&isConnectedSuite{})
 
 func (s *isConnectedSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("/") })
 	s.st = state.New(nil)
 	s.mockHandler = hooktest.NewMockHandler()
 }
@@ -61,14 +69,41 @@
 	args:     []string{"is-connected", "plug3"},
 	exitCode: 1,
 }, {
-	args:     []string{"is-connected", "slot2"},
-	exitCode: 1,
+	args: []string{"is-connected", "slot2"},
+	err:  `snap "snap1" has no plug or slot named "slot2"`,
 }, {
-	args:     []string{"is-connected", "foo"},
-	exitCode: 1,
+	args: []string{"is-connected", "foo"},
+	err:  `snap "snap1" has no plug or slot named "foo"`,
 }}
 
+func mockInstalledSnap(c *C, st *state.State, snapYaml string) {
+	info := snaptest.MockSnapCurrent(c, snapYaml, &snap.SideInfo{Revision: snap.R(1)})
+	snapstate.Set(st, info.InstanceName(), &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{
+				RealName: info.SnapName(),
+				Revision: info.Revision,
+				SnapID:   info.InstanceName() + "-id",
+			},
+		},
+		Current: info.Revision,
+	})
+}
+
 func (s *isConnectedSuite) testIsConnected(c *C, context *hookstate.Context) {
+	mockInstalledSnap(c, s.st, `name: snap1
+plugs:
+  plug1:
+    interface: x11
+  plug2:
+    interface: x11
+  plug3:
+    interface: x11
+slots:
+  slot1:
+    interface: x11`)
+
 	s.st.Set("conns", map[string]interface{}{
 		"snap1:plug1 snap2:slot2": map[string]interface{}{},
 		"snap1:plug2 snap3:slot3": map[string]interface{}{"undesired": true},
@@ -81,20 +116,19 @@
 
 	for _, test := range isConnectedTests {
 		stdout, stderr, err := ctlcmd.Run(context, test.args, 0)
+		comment := Commentf("%s", test.args)
 		if test.exitCode > 0 {
-			unsuccessfulErr, ok := err.(*ctlcmd.UnsuccessfulError)
-			c.Assert(ok, Equals, true)
-			c.Check(unsuccessfulErr.ExitCode, Equals, test.exitCode)
+			c.Check(err, DeepEquals, &ctlcmd.UnsuccessfulError{ExitCode: test.exitCode}, comment)
 		} else {
 			if test.err == "" {
-				c.Check(err, IsNil)
+				c.Check(err, IsNil, comment)
 			} else {
-				c.Check(err, ErrorMatches, test.err)
+				c.Check(err, ErrorMatches, test.err, comment)
 			}
 		}
 
-		c.Check(string(stdout), Equals, test.stdout, Commentf("%s\n", test.args))
-		c.Check(string(stderr), Equals, "")
+		c.Check(string(stdout), Equals, test.stdout, comment)
+		c.Check(string(stderr), Equals, "", comment)
 	}
 }
 
@@ -136,6 +170,11 @@
 func (s *isConnectedSuite) TestGetRegularUser(c *C) {
 	s.st.Lock()
 
+	mockInstalledSnap(c, s.st, `name: snap1
+plugs:
+  plug1:
+    interface: x11`)
+
 	s.st.Set("conns", map[string]interface{}{
 		"snap1:plug1 snap2:slot2": map[string]interface{}{},
 	})
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/services.go snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/services.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/services.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/services.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,8 +25,10 @@
 	"sort"
 	"text/tabwriter"
 
-	"github.com/snapcore/snapd/cmd"
+	"github.com/snapcore/snapd/client/clientutil"
 	"github.com/snapcore/snapd/i18n"
+	"github.com/snapcore/snapd/overlord/servicestate"
+	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/snap"
 )
 
@@ -71,7 +73,9 @@
 	}
 	sort.Sort(byApp(svcInfos))
 
-	services, err := cmd.ClientAppInfosFromSnapAppInfos(svcInfos)
+	sd := servicestate.NewStatusDecorator(progress.Null)
+
+	services, err := clientutil.ClientAppInfosFromSnapAppInfos(svcInfos, sd)
 	if err != nil || len(services) == 0 {
 		return err
 	}
@@ -90,7 +94,7 @@
 		if svc.Active {
 			current = i18n.G("active")
 		}
-		fmt.Fprintf(w, "%s.%s\t%s\t%s\t%s\n", svc.Snap, svc.Name, startup, current, cmd.ClientAppInfoNotes(&svc))
+		fmt.Fprintf(w, "%s.%s\t%s\t%s\t%s\n", svc.Snap, svc.Name, startup, current, clientutil.ClientAppInfoNotes(&svc))
 	}
 
 	return nil
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/services_test.go snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/services_test.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/ctlcmd/services_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/ctlcmd/services_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -48,7 +48,10 @@
 	storetest.Store
 }
 
-func (f *fakeStore) SnapAction(_ context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (f *fakeStore) SnapAction(_ context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
 	if actions[0].Action == "install" {
 		installs := make([]store.SnapActionResult, 0, len(actions))
 		for _, a := range actions {
@@ -58,6 +61,9 @@
 			}
 
 			installs = append(installs, store.SnapActionResult{Info: &snap.Info{
+				DownloadInfo: snap.DownloadInfo{
+					Size: 1,
+				},
 				SideInfo: snap.SideInfo{
 					RealName: snapName,
 					Revision: snap.R(2),
@@ -66,7 +72,7 @@
 			}})
 		}
 
-		return installs, nil
+		return installs, nil, nil
 	}
 
 	snaps := []store.SnapActionResult{{Info: &snap.Info{
@@ -84,7 +90,7 @@
 		},
 		Architectures: []string{"all"},
 	}}}
-	return snaps, nil
+	return snaps, nil, nil
 }
 
 type servicectlSuite struct {
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/hookmgr.go snapd-2.48.3+20.04/overlord/hookstate/hookmgr.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/hookmgr.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/hookmgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package hookstate
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -260,7 +261,7 @@
 		return fmt.Errorf("cannot extract hook setup from task: %s", err)
 	}
 
-	return m.runHook(task, tomb, snapst, hooksup)
+	return m.runHookForTask(task, tomb, snapst, hooksup)
 }
 
 // undoRunHook runs the undo-hook that was requested.
@@ -279,34 +280,52 @@
 		return fmt.Errorf("cannot extract undo hook setup from task: %s", err)
 	}
 
-	return m.runHook(task, tomb, snapst, hooksup)
+	return m.runHookForTask(task, tomb, snapst, hooksup)
 }
 
-func (m *HookManager) runHook(task *state.Task, tomb *tomb.Tomb, snapst *snapstate.SnapState, hooksup *HookSetup) error {
+func (m *HookManager) EphemeralRunHook(ctx context.Context, hooksup *HookSetup, contextData map[string]interface{}) (*Context, error) {
+	var snapst snapstate.SnapState
+	m.state.Lock()
+	err := snapstate.Get(m.state, hooksup.Snap, &snapst)
+	m.state.Unlock()
+	if err != nil {
+		return nil, fmt.Errorf("cannot run ephemeral hook %q for snap %q: %v", hooksup.Hook, hooksup.Snap, err)
+	}
+
+	tomb, _ := tomb.WithContext(ctx)
+	return m.runHookCommon(nil, tomb, &snapst, hooksup, contextData)
+}
+
+func (m *HookManager) runHookForTask(task *state.Task, tomb *tomb.Tomb, snapst *snapstate.SnapState, hooksup *HookSetup) error {
+	_, err := m.runHookCommon(task, tomb, snapst, hooksup, nil)
+	return err
+}
+
+func (m *HookManager) runHookCommon(task *state.Task, tomb *tomb.Tomb, snapst *snapstate.SnapState, hooksup *HookSetup, contextData map[string]interface{}) (*Context, error) {
 	mustHijack := m.hijacked(hooksup.Hook, hooksup.Snap) != nil
 	hookExists := false
 	if !mustHijack {
 		// not hijacked, snap must be installed
 		if !snapst.IsInstalled() {
-			return fmt.Errorf("cannot find %q snap", hooksup.Snap)
+			return nil, fmt.Errorf("cannot find %q snap", hooksup.Snap)
 		}
 
 		info, err := snapst.CurrentInfo()
 		if err != nil {
-			return fmt.Errorf("cannot read %q snap details: %v", hooksup.Snap, err)
+			return nil, fmt.Errorf("cannot read %q snap details: %v", hooksup.Snap, err)
 		}
 
 		hookExists = info.Hooks[hooksup.Hook] != nil
 		if !hookExists && !hooksup.Optional {
-			return fmt.Errorf("snap %q has no %q hook", hooksup.Snap, hooksup.Hook)
+			return nil, fmt.Errorf("snap %q has no %q hook", hooksup.Snap, hooksup.Hook)
 		}
 	}
 
 	if hookExists || mustHijack {
 		// we will run something, not a noop
-		if ok, _ := task.State().Restarting(); ok {
+		if ok, _ := m.state.Restarting(); ok {
 			// don't start running a hook if we are restarting
-			return &state.Retry{}
+			return nil, &state.Retry{}
 		}
 
 		// keep count of running hooks
@@ -314,12 +333,12 @@
 		defer atomic.AddInt32(&m.runningHooks, -1)
 	} else if !hooksup.Always {
 		// a noop with no 'always' flag: bail
-		return nil
+		return nil, nil
 	}
 
-	context, err := NewContext(task, task.State(), hooksup, nil, "")
+	context, err := NewContext(task, m.state, hooksup, nil, "")
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	// Obtain a handler for this hook. The repository returns a list since it's
@@ -332,14 +351,16 @@
 		// This is to avoid issues when downgrading to an old core snap that doesn't know about
 		// particular hook type and a task for it exists (e.g. "post-refresh" hook).
 		if hooksup.Optional {
-			return nil
+			return nil, nil
 		}
-		return fmt.Errorf("internal error: no registered handlers for hook %q", hooksup.Hook)
+		return nil, fmt.Errorf("internal error: no registered handlers for hook %q", hooksup.Hook)
 	}
 	if handlersCount > 1 {
-		return fmt.Errorf("internal error: %d handlers registered for hook %q, expected 1", handlersCount, hooksup.Hook)
+		return nil, fmt.Errorf("internal error: %d handlers registered for hook %q, expected 1", handlersCount, hooksup.Hook)
+	}
+	if err := context.initForRun(handlers[0], contextData); err != nil {
+		return nil, err
 	}
-	context.handler = handlers[0]
 
 	contextID := context.ID()
 	m.contextsMutex.Lock()
@@ -353,7 +374,7 @@
 	}()
 
 	if err = context.Handler().Before(); err != nil {
-		return err
+		return nil, err
 	}
 
 	// some hooks get hijacked, e.g. the core configuration
@@ -369,29 +390,31 @@
 		}
 		err = osutil.OutputErr(output, err)
 		if hooksup.IgnoreError {
-			task.State().Lock()
-			task.Errorf("ignoring failure in hook %q: %v", hooksup.Hook, err)
-			task.State().Unlock()
+			if task != nil {
+				task.State().Lock()
+				task.Errorf("ignoring failure in hook %q: %v", hooksup.Hook, err)
+				task.State().Unlock()
+			}
 		} else {
 			if handlerErr := context.Handler().Error(err); handlerErr != nil {
-				return handlerErr
+				return nil, handlerErr
 			}
 
-			return fmt.Errorf("run hook %q: %v", hooksup.Hook, err)
+			return nil, fmt.Errorf("run hook %q: %v", hooksup.Hook, err)
 		}
 	}
 
 	if err = context.Handler().Done(); err != nil {
-		return err
+		return nil, err
 	}
 
 	context.Lock()
 	defer context.Unlock()
 	if err = context.Done(); err != nil {
-		return err
+		return nil, err
 	}
 
-	return nil
+	return context, nil
 }
 
 func runHookImpl(c *Context, tomb *tomb.Tomb) ([]byte, error) {
diff -Nru snapd-2.45.1+20.04.2/overlord/hookstate/hookstate_test.go snapd-2.48.3+20.04/overlord/hookstate/hookstate_test.go
--- snapd-2.45.1+20.04.2/overlord/hookstate/hookstate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/hookstate/hookstate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package hookstate_test
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"path/filepath"
@@ -29,6 +30,7 @@
 	"time"
 
 	. "gopkg.in/check.v1"
+	"gopkg.in/tomb.v2"
 
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/overlord"
@@ -1173,6 +1175,110 @@
 	c.Assert(err, IsNil)
 }
 
+func (s *hookManagerSuite) TestEphemeralRunHook(c *C) {
+	contextData := map[string]interface{}{
+		"key":  "value",
+		"key2": "value2",
+	}
+	s.testEphemeralRunHook(c, contextData)
+}
+
+func (s *hookManagerSuite) TestEphemeralRunHookNoContextData(c *C) {
+	var contextData map[string]interface{} = nil
+	s.testEphemeralRunHook(c, contextData)
+}
+
+func (s *hookManagerSuite) testEphemeralRunHook(c *C, contextData map[string]interface{}) {
+	var hookInvokeCalled []string
+	hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+		c.Check(ctx.HookName(), Equals, "configure")
+		hookInvokeCalled = append(hookInvokeCalled, ctx.HookName())
+
+		// check that context data was set correctly
+		var s string
+		ctx.Lock()
+		defer ctx.Unlock()
+		for k, v := range contextData {
+			ctx.Get(k, &s)
+			c.Check(s, Equals, v)
+		}
+		ctx.Set("key-set-from-hook", "value-set-from-hook")
+
+		return []byte("some output"), nil
+	}
+	restore := hookstate.MockRunHook(hookInvoke)
+	defer restore()
+
+	hooksup := &hookstate.HookSetup{
+		Snap:     "test-snap",
+		Revision: snap.R(1),
+		Hook:     "configure",
+	}
+	context, err := s.manager.EphemeralRunHook(context.Background(), hooksup, contextData)
+	c.Assert(err, IsNil)
+	c.Check(hookInvokeCalled, DeepEquals, []string{"configure"})
+
+	var value string
+	context.Lock()
+	context.Get("key-set-from-hook", &value)
+	context.Unlock()
+	c.Check(value, Equals, "value-set-from-hook")
+}
+
+func (s *hookManagerSuite) TestEphemeralRunHookNoSnap(c *C) {
+	hookInvoke := func(ctx *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+		c.Fatalf("hook should not be invoked in this test")
+		return nil, nil
+	}
+	restore := hookstate.MockRunHook(hookInvoke)
+	defer restore()
+
+	hooksup := &hookstate.HookSetup{
+		Snap:     "not-installed-snap",
+		Revision: snap.R(1),
+		Hook:     "configure",
+	}
+	contextData := map[string]interface{}{
+		"key": "value",
+	}
+	_, err := s.manager.EphemeralRunHook(context.Background(), hooksup, contextData)
+	c.Assert(err, ErrorMatches, `cannot run ephemeral hook "configure" for snap "not-installed-snap": no state entry for key`)
+}
+
+func (s *hookManagerSuite) TestEphemeralRunHookContextCanCancel(c *C) {
+	tombDying := 0
+	hookRunning := make(chan struct{})
+
+	hookInvoke := func(_ *hookstate.Context, tomb *tomb.Tomb) ([]byte, error) {
+		close(hookRunning)
+
+		select {
+		case <-tomb.Dying():
+			tombDying++
+		case <-time.After(10 * time.Second):
+			c.Fatalf("hook not canceled after 10s")
+		}
+		return nil, nil
+	}
+	restore := hookstate.MockRunHook(hookInvoke)
+	defer restore()
+
+	hooksup := &hookstate.HookSetup{
+		Snap:     "test-snap",
+		Revision: snap.R(1),
+		Hook:     "configure",
+	}
+
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	go func() {
+		<-hookRunning
+		cancelFunc()
+	}()
+	_, err := s.manager.EphemeralRunHook(ctx, hooksup, nil)
+	c.Assert(err, IsNil)
+	c.Check(tombDying, Equals, 1)
+}
+
 type parallelInstancesHookManagerSuite struct {
 	baseHookManagerSuite
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/ifacestate/export_test.go snapd-2.48.3+20.04/overlord/ifacestate/export_test.go
--- snapd-2.45.1+20.04.2/overlord/ifacestate/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/ifacestate/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -58,7 +58,8 @@
 	AddHotplugSeqWaitTask        = addHotplugSeqWaitTask
 	AddHotplugSlot               = addHotplugSlot
 
-	BatchConnectTasks = batchConnectTasks
+	BatchConnectTasks                = batchConnectTasks
+	FirstTaskAfterBootWhenPreseeding = firstTaskAfterBootWhenPreseeding
 )
 
 type ConnectOpts = connectOpts
diff -Nru snapd-2.45.1+20.04.2/overlord/ifacestate/handlers.go snapd-2.48.3+20.04/overlord/ifacestate/handlers.go
--- snapd-2.45.1+20.04.2/overlord/ifacestate/handlers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/ifacestate/handlers.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,6 +32,7 @@
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/hotplug"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
@@ -501,6 +502,15 @@
 		logger.Debugf("Connect handler: skipping setupSnapSecurity for snaps %q and %q", plug.Snap.InstanceName(), slot.Snap.InstanceName())
 	}
 
+	// For undo handler. We need to remember old state of the connection only
+	// if undesired flag is set because that means there was a remembered
+	// inactive connection already and we should restore its properties
+	// in case of undo. Otherwise we don't have to keep old-conn because undo
+	// can simply delete any trace of the connection.
+	if old, ok := conns[connRef.ID()]; ok && old.Undesired {
+		task.Set("old-conn", old)
+	}
+
 	conns[connRef.ID()] = &connState{
 		Interface:        conn.Interface(),
 		StaticPlugAttrs:  conn.Plug.StaticAttrs(),
@@ -711,6 +721,9 @@
 	st.Lock()
 	defer st.Unlock()
 
+	perfTimings := state.TimingsForTask(task)
+	defer perfTimings.Save(st)
+
 	plugRef, slotRef, err := getPlugAndSlotRefs(task)
 	if err != nil {
 		return err
@@ -720,8 +733,66 @@
 	if err != nil {
 		return err
 	}
-	delete(conns, connRef.ID())
+
+	var old connState
+	err = task.Get("old-conn", &old)
+	if err != nil && err != state.ErrNoState {
+		return err
+	}
+	if err == nil {
+		conns[connRef.ID()] = &old
+	} else {
+		delete(conns, connRef.ID())
+	}
 	setConns(st, conns)
+
+	if err := m.repo.Disconnect(connRef.PlugRef.Snap, connRef.PlugRef.Name, connRef.SlotRef.Snap, connRef.SlotRef.Name); err != nil {
+		return err
+	}
+
+	var delayedSetupProfiles bool
+	if err := task.Get("delayed-setup-profiles", &delayedSetupProfiles); err != nil && err != state.ErrNoState {
+		return err
+	}
+	if delayedSetupProfiles {
+		logger.Debugf("Connect undo handler: skipping setupSnapSecurity for snaps %q and %q", connRef.PlugRef.Snap, connRef.SlotRef.Snap)
+		return nil
+	}
+
+	plug := m.repo.Plug(connRef.PlugRef.Snap, connRef.PlugRef.Name)
+	if plug == nil {
+		return fmt.Errorf("internal error: snap %q has no %q plug", connRef.PlugRef.Snap, connRef.PlugRef.Name)
+	}
+	slot := m.repo.Slot(connRef.SlotRef.Snap, connRef.SlotRef.Name)
+	if slot == nil {
+		return fmt.Errorf("internal error: snap %q has no %q slot", connRef.SlotRef.Snap, connRef.SlotRef.Name)
+	}
+
+	var plugSnapst snapstate.SnapState
+	err = snapstate.Get(st, plugRef.Snap, &plugSnapst)
+	if err == state.ErrNoState {
+		return fmt.Errorf("internal error: snap %q is no longer available", plugRef.Snap)
+	}
+	if err != nil {
+		return err
+	}
+	var slotSnapst snapstate.SnapState
+	err = snapstate.Get(st, slotRef.Snap, &slotSnapst)
+	if err == state.ErrNoState {
+		return fmt.Errorf("internal error: snap %q is no longer available", slotRef.Snap)
+	}
+	if err != nil {
+		return err
+	}
+	slotOpts := confinementOptions(slotSnapst.Flags)
+	if err := m.setupSnapSecurity(task, slot.Snap, slotOpts, perfTimings); err != nil {
+		return err
+	}
+	plugOpts := confinementOptions(plugSnapst.Flags)
+	if err := m.setupSnapSecurity(task, plug.Snap, plugOpts, perfTimings); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -933,11 +1004,11 @@
 // The "delayed-setup-profiles" flag is set on the connect tasks to
 // indicate that doConnect handler should not set security backends up
 // because this will be done later by the setup-profiles task.
-func batchConnectTasks(st *state.State, snapsup *snapstate.SnapSetup, conns map[string]*interfaces.ConnRef, connOpts map[string]*connectOpts) (*state.TaskSet, error) {
+func batchConnectTasks(st *state.State, snapsup *snapstate.SnapSetup, conns map[string]*interfaces.ConnRef, connOpts map[string]*connectOpts) (ts *state.TaskSet, hasInterfaceHooks bool, err error) {
 	setupProfiles := st.NewTask("setup-profiles", fmt.Sprintf(i18n.G("Setup snap %q (%s) security profiles for auto-connections"), snapsup.InstanceName(), snapsup.Revision()))
 	setupProfiles.Set("snap-setup", snapsup)
 
-	ts := state.NewTaskSet()
+	ts = state.NewTaskSet()
 	for connID, conn := range conns {
 		var opts connectOpts
 		if providedOpts := connOpts[connID]; providedOpts != nil {
@@ -949,13 +1020,17 @@
 		opts.DelayedSetupProfiles = true
 		connectTs, err := connect(st, conn.PlugRef.Snap, conn.PlugRef.Name, conn.SlotRef.Snap, conn.SlotRef.Name, opts)
 		if err != nil {
-			return nil, fmt.Errorf("internal error: auto-connect of %q failed: %s", conn, err)
+			return nil, false, fmt.Errorf("internal error: auto-connect of %q failed: %s", conn, err)
+		}
+
+		if len(connectTs.Tasks()) > 1 {
+			hasInterfaceHooks = true
 		}
 
 		// setup-profiles needs to wait for the main "connect" task
 		connectTask, _ := connectTs.Edge(ConnectTaskEdge)
 		if connectTask == nil {
-			return nil, fmt.Errorf("internal error: no 'connect' task found for %q", conn)
+			return nil, false, fmt.Errorf("internal error: no 'connect' task found for %q", conn)
 		}
 		setupProfiles.WaitFor(connectTask)
 
@@ -969,7 +1044,28 @@
 	if len(ts.Tasks()) > 0 {
 		ts.AddTask(setupProfiles)
 	}
-	return ts, nil
+	return ts, hasInterfaceHooks, nil
+}
+
+// firstTaskAfterBootWhenPreseeding finds the first task to be run for thisSnap
+// on first boot after mark-preseeded task, this is always the install hook.
+// It is an internal error if install hook for thisSnap cannot be found.
+func firstTaskAfterBootWhenPreseeding(thisSnap string, markPreseeded *state.Task) (*state.Task, error) {
+	if markPreseeded.Change() == nil {
+		return nil, fmt.Errorf("internal error: %s task not in change", markPreseeded.Kind())
+	}
+	for _, ht := range markPreseeded.HaltTasks() {
+		if ht.Kind() == "run-hook" {
+			var hs hookstate.HookSetup
+			if err := ht.Get("hook-setup", &hs); err != nil {
+				return nil, fmt.Errorf("internal error: cannot get hook setup: %v", err)
+			}
+			if hs.Hook == "install" && hs.Snap == thisSnap {
+				return ht, nil
+			}
+		}
+	}
+	return nil, fmt.Errorf("internal error: cannot find install hook for snap %q", thisSnap)
 }
 
 func filterForSlot(slot *snap.SlotInfo) func(candSlots []*snap.SlotInfo) []*snap.SlotInfo {
@@ -1005,10 +1101,10 @@
 	}
 
 	// The previous task (link-snap) may have triggered a restart,
-	// if this is the case we can only procceed once the restart
+	// if this is the case we can only proceed once the restart
 	// has happened or we may not have all the interfaces of the
 	// new core/base snap.
-	if err := snapstate.WaitRestart(task, snapsup); err != nil {
+	if err := snapstate.FinishRestart(task, snapsup); err != nil {
 		return err
 	}
 
@@ -1103,18 +1199,45 @@
 		}
 	}
 
-	autots, err := batchConnectTasks(st, snapsup, newconns, connOpts)
+	autots, hasInterfaceHooks, err := batchConnectTasks(st, snapsup, newconns, connOpts)
 	if err != nil {
 		return err
 	}
 
-	if m.preseed && len(autots.Tasks()) > 2 { // connect task and setup-profiles tasks are 2 tasks, other tasks are hooks
-		// TODO: in preseed mode make interface hooks wait for mark-preseeded task.
-		for _, t := range autots.Tasks() {
-			if t.Kind() == "run-hook" {
-				return fmt.Errorf("interface hooks are not yet supported in preseed mode")
+	// If interface hooks are not present then connects can be executed during
+	// preseeding.
+	// Otherwise we will run all connects, their hooks and setup-profiles after
+	// preseeding (on first boot). Note, we may be facing multiple connections
+	// here where only some have hooks; however there is no point in running
+	// those without hooks before mark-preseeded, because only setup-profiles is
+	// performance-critical and it still needs to run after those with hooks.
+	if m.preseed && hasInterfaceHooks {
+		for _, t := range st.Tasks() {
+			if t.Kind() == "mark-preseeded" {
+				markPreseeded := t
+				// consistency check
+				if markPreseeded.Status() != state.DoStatus {
+					return fmt.Errorf("internal error: unexpected state of mark-preseeded task: %s", markPreseeded.Status())
+				}
+
+				firstTaskAfterBoot, err := firstTaskAfterBootWhenPreseeding(snapsup.InstanceName(), markPreseeded)
+				if err != nil {
+					return err
+				}
+				// first task of the snap that normally runs on first boot
+				// needs to wait on connects & interface hooks.
+				firstTaskAfterBoot.WaitAll(autots)
+
+				// connect tasks and interface hooks need to wait for end of preseeding
+				// (they need to run on first boot, not during preseeding).
+				autots.WaitFor(markPreseeded)
+				t.Change().AddAll(autots)
+				task.SetStatus(state.DoneStatus)
+				st.EnsureBefore(0)
+				return nil
 			}
 		}
+		return fmt.Errorf("internal error: mark-preseeded task not found in preseeding mode")
 	}
 
 	if len(autots.Tasks()) > 0 {
diff -Nru snapd-2.45.1+20.04.2/overlord/ifacestate/helpers.go snapd-2.48.3+20.04/overlord/ifacestate/helpers.go
--- snapd-2.45.1+20.04.2/overlord/ifacestate/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/ifacestate/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -45,7 +45,7 @@
 
 func (m *InterfaceManager) selectInterfaceMapper(snaps []*snap.Info) {
 	for _, snapInfo := range snaps {
-		if snapInfo.GetType() == snap.TypeSnapd {
+		if snapInfo.Type() == snap.TypeSnapd {
 			mapper = &CoreSnapdSystemMapper{}
 			break
 		}
@@ -941,7 +941,7 @@
 		doneProfiles := false
 		for _, t1 := range t.WaitTasks() {
 			if t1.Kind() == "setup-profiles" && t1.Status() == state.DoneStatus {
-				snapsup1, err := snapstate.TaskSnapSetup(t)
+				snapsup1, err := snapstate.TaskSnapSetup(t1)
 				if err != nil {
 					return nil, err
 				}
diff -Nru snapd-2.45.1+20.04.2/overlord/ifacestate/helpers_test.go snapd-2.48.3+20.04/overlord/ifacestate/helpers_test.go
--- snapd-2.45.1+20.04.2/overlord/ifacestate/helpers_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/ifacestate/helpers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -304,7 +304,7 @@
 		Active:      true,
 		Sequence:    []*snap.SideInfo{sideInfo},
 		Current:     sideInfo.Revision,
-		SnapType:    string(snapInfo.GetType()),
+		SnapType:    string(snapInfo.Type()),
 		InstanceKey: snapInfo.InstanceKey,
 	})
 	s.st.Unlock()
@@ -334,7 +334,7 @@
 		Active:      true,
 		Sequence:    []*snap.SideInfo{sideInfo},
 		Current:     sideInfo.Revision,
-		SnapType:    string(snapInfo.GetType()),
+		SnapType:    string(snapInfo.Type()),
 		InstanceKey: snapInfo.InstanceKey,
 	})
 
diff -Nru snapd-2.45.1+20.04.2/overlord/ifacestate/ifacestate_test.go snapd-2.48.3+20.04/overlord/ifacestate/ifacestate_test.go
--- snapd-2.45.1+20.04.2/overlord/ifacestate/ifacestate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/ifacestate/ifacestate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -248,6 +248,7 @@
 	// just load the test backend here and this is nicely integrated with
 	// extraBackends above.
 	s.BaseTest.AddCleanup(ifacestate.MockSecurityBackends([]interfaces.SecurityBackend{s.secBackend}))
+	s.secBackend.SetupCalls = nil
 
 	buf, restore := logger.MockLogger()
 	s.BaseTest.AddCleanup(restore)
@@ -470,9 +471,10 @@
 	connOpts := make(map[string]*ifacestate.ConnectOpts)
 
 	// no connections
-	ts, err := ifacestate.BatchConnectTasks(s.state, snapsup, conns, connOpts)
+	ts, hasInterfaceHooks, err := ifacestate.BatchConnectTasks(s.state, snapsup, conns, connOpts)
 	c.Assert(err, IsNil)
 	c.Check(ts.Tasks(), HasLen, 0)
+	c.Check(hasInterfaceHooks, Equals, false)
 
 	// two connections
 	cref1 := interfaces.ConnRef{PlugRef: interfaces.PlugRef{Snap: "consumer", Name: "plug"}, SlotRef: interfaces.SlotRef{Snap: "producer", Name: "slot"}}
@@ -482,9 +484,10 @@
 	// connOpts for cref1 will default to AutoConnect: true
 	connOpts[cref2.ID()] = &ifacestate.ConnectOpts{AutoConnect: true, ByGadget: true}
 
-	ts, err = ifacestate.BatchConnectTasks(s.state, snapsup, conns, connOpts)
+	ts, hasInterfaceHooks, err = ifacestate.BatchConnectTasks(s.state, snapsup, conns, connOpts)
 	c.Assert(err, IsNil)
 	c.Check(ts.Tasks(), HasLen, 9)
+	c.Check(hasInterfaceHooks, Equals, true)
 
 	// "setup-profiles" task waits for "connect" tasks of both connections
 	setupProfiles := ts.Tasks()[len(ts.Tasks())-1]
@@ -522,6 +525,31 @@
 	}
 }
 
+func (s *interfaceManagerSuite) TestBatchConnectTasksNoHooks(c *C) {
+	s.mockIfaces(c, &ifacetest.TestInterface{InterfaceName: "test"}, &ifacetest.TestInterface{InterfaceName: "test2"})
+	s.mockSnap(c, consumer2Yaml)
+	s.mockSnap(c, producer2Yaml)
+	_ = s.manager(c)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapsup := &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "snap"}}
+	conns := make(map[string]*interfaces.ConnRef)
+	connOpts := make(map[string]*ifacestate.ConnectOpts)
+
+	// a connection
+	cref := interfaces.ConnRef{PlugRef: interfaces.PlugRef{Snap: "consumer2", Name: "plug"}, SlotRef: interfaces.SlotRef{Snap: "producer2", Name: "slot"}}
+	conns[cref.ID()] = &cref
+
+	ts, hasInterfaceHooks, err := ifacestate.BatchConnectTasks(s.state, snapsup, conns, connOpts)
+	c.Assert(err, IsNil)
+	c.Assert(ts.Tasks(), HasLen, 2)
+	c.Check(ts.Tasks()[0].Kind(), Equals, "connect")
+	c.Check(ts.Tasks()[1].Kind(), Equals, "setup-profiles")
+	c.Check(hasInterfaceHooks, Equals, false)
+}
+
 type interfaceHooksTestData struct {
 	consumer  []string
 	producer  []string
@@ -2019,7 +2047,7 @@
 		Active:      true,
 		Sequence:    []*snap.SideInfo{sideInfo},
 		Current:     sideInfo.Revision,
-		SnapType:    string(snapInfo.GetType()),
+		SnapType:    string(snapInfo.Type()),
 		InstanceKey: snapInfo.InstanceKey,
 	})
 	return snapInfo
@@ -2893,7 +2921,7 @@
 plugs:
  plug:
   interface: content
-  content: foo 
+  content: foo
   attr: new-plug-attr
 `
 	const producerYaml = `
@@ -2902,7 +2930,7 @@
 slots:
  slot:
   interface: content
-  content: foo 
+  content: foo
   attr: new-slot-attr
 `
 	s.mockSnap(c, producerYaml)
@@ -4982,7 +5010,7 @@
 		SlotRef: interfaces.SlotRef{Snap: "core", Name: "network"}}})
 }
 
-func makeAutoConnectChange(st *state.State, plugSnap, plug, slotSnap, slot string) *state.Change {
+func makeAutoConnectChange(st *state.State, plugSnap, plug, slotSnap, slot string, delayedSetupProfiles bool) *state.Change {
 	chg := st.NewChange("connect...", "...")
 
 	t := st.NewTask("connect", "other connect task")
@@ -4992,6 +5020,7 @@
 	t.Set("plug-dynamic", plugAttrs)
 	t.Set("slot-dynamic", slotAttrs)
 	t.Set("auto", true)
+	t.Set("delayed-setup-profiles", delayedSetupProfiles)
 
 	// two fake tasks for connect-plug-/slot- hooks
 	hs1 := hookstate.HookSetup{
@@ -5016,7 +5045,7 @@
 	return chg
 }
 
-func (s *interfaceManagerSuite) TestUndoConnect(c *C) {
+func (s *interfaceManagerSuite) mockConnectForUndo(c *C, conns map[string]interface{}, delayedSetupProfiles bool) *state.Change {
 	s.MockModel(c, nil)
 
 	s.mockIfaces(c, &ifacetest.TestInterface{InterfaceName: "test"})
@@ -5039,36 +5068,142 @@
 	c.Assert(err, IsNil)
 
 	s.state.Lock()
+	s.state.Set("conns", conns)
 
-	// "consumer:plug producer:slot" wouldn't normally be present in conns when connecting because
-	// ifacestate.Connect() checks for existing connection; it's used here to test removal on undo.
-	s.state.Set("conns", map[string]interface{}{
-		"snap1:plug snap2:slot":       map[string]interface{}{},
-		"consumer:plug producer:slot": map[string]interface{}{},
-	})
-
-	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot")
+	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot", delayedSetupProfiles)
 	terr := s.state.NewTask("error-trigger", "provoking undo")
 	connTasks := chg.Tasks()
 	terr.WaitAll(state.NewTaskSet(connTasks...))
 	chg.AddTask(terr)
 
+	return chg
+}
+
+func (s *interfaceManagerSuite) TestUndoConnect(c *C) {
+	// "consumer:plug producer:slot" wouldn't normally be present in conns when connecting because
+	// ifacestate.Connect() checks for existing connection; it's used here to test removal on undo.
+	conns := map[string]interface{}{
+		"snap1:plug snap2:slot":       map[string]interface{}{},
+		"consumer:plug producer:slot": map[string]interface{}{},
+	}
+	chg := s.mockConnectForUndo(c, conns, false)
+
 	s.state.Unlock()
 	s.settle(c)
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	c.Assert(chg.Status().Ready(), Equals, true)
-	for _, t := range connTasks {
-		c.Assert(t.Status(), Equals, state.UndoneStatus)
+	for _, t := range chg.Tasks() {
+		if t.Kind() != "error-trigger" {
+			c.Assert(t.Status(), Equals, state.UndoneStatus)
+			var old interface{}
+			c.Assert(t.Get("old-conn", &old), NotNil)
+		}
 	}
 
 	// connection is removed from conns, other connection is left intact
-	var conns map[string]interface{}
-	c.Assert(s.state.Get("conns", &conns), IsNil)
-	c.Check(conns, DeepEquals, map[string]interface{}{
+	var realConns map[string]interface{}
+	c.Assert(s.state.Get("conns", &realConns), IsNil)
+	c.Check(realConns, DeepEquals, map[string]interface{}{
 		"snap1:plug snap2:slot": map[string]interface{}{},
 	})
+
+	cref := &interfaces.ConnRef{
+		PlugRef: interfaces.PlugRef{Snap: "consumer", Name: "plug"},
+		SlotRef: interfaces.SlotRef{Snap: "producer", Name: "slot"},
+	}
+	// and it's not in the repo
+	_, err := s.manager(c).Repository().Connection(cref)
+	notConnected, _ := err.(*interfaces.NotConnectedError)
+	c.Check(notConnected, NotNil)
+
+	c.Assert(s.secBackend.SetupCalls, HasLen, 4)
+	c.Check(s.secBackend.SetupCalls[0].SnapInfo.InstanceName(), Equals, "producer")
+	c.Check(s.secBackend.SetupCalls[1].SnapInfo.InstanceName(), Equals, "consumer")
+	c.Check(s.secBackend.SetupCalls[0].Options, Equals, interfaces.ConfinementOptions{})
+	c.Check(s.secBackend.SetupCalls[1].Options, Equals, interfaces.ConfinementOptions{})
+
+	// by undo
+	c.Check(s.secBackend.SetupCalls[2].SnapInfo.InstanceName(), Equals, "producer")
+	c.Check(s.secBackend.SetupCalls[3].SnapInfo.InstanceName(), Equals, "consumer")
+	c.Check(s.secBackend.SetupCalls[2].Options, Equals, interfaces.ConfinementOptions{})
+	c.Check(s.secBackend.SetupCalls[3].Options, Equals, interfaces.ConfinementOptions{})
+}
+
+func (s *interfaceManagerSuite) TestUndoConnectUndesired(c *C) {
+	// "consumer:plug producer:slot" wouldn't normally be present in conns when connecting because
+	// ifacestate.Connect() checks for existing connection; it's used here to test removal on undo.
+	conns := map[string]interface{}{
+		"snap1:plug snap2:slot":       map[string]interface{}{},
+		"consumer:plug producer:slot": map[string]interface{}{"undesired": true},
+	}
+	chg := s.mockConnectForUndo(c, conns, false)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	c.Assert(chg.Status().Ready(), Equals, true)
+	for _, t := range chg.Tasks() {
+		if t.Kind() != "error-trigger" {
+			c.Assert(t.Status(), Equals, state.UndoneStatus)
+			if t.Kind() == "connect" {
+				var old interface{}
+				c.Assert(t.Get("old-conn", &old), IsNil)
+				c.Check(old, DeepEquals, map[string]interface{}{"undesired": true})
+			}
+		}
+	}
+
+	// connection is left in conns because of undesired flag
+	var realConns map[string]interface{}
+	c.Assert(s.state.Get("conns", &realConns), IsNil)
+	c.Check(realConns, DeepEquals, map[string]interface{}{
+		"snap1:plug snap2:slot":       map[string]interface{}{},
+		"consumer:plug producer:slot": map[string]interface{}{"undesired": true},
+	})
+
+	// but it's not in the repo
+	cref := &interfaces.ConnRef{
+		PlugRef: interfaces.PlugRef{Snap: "consumer", Name: "plug"},
+		SlotRef: interfaces.SlotRef{Snap: "producer", Name: "slot"},
+	}
+	_, err := s.manager(c).Repository().Connection(cref)
+	notConnected, _ := err.(*interfaces.NotConnectedError)
+	c.Check(notConnected, NotNil)
+}
+
+func (s *interfaceManagerSuite) TestUndoConnectNoSetupProfilesWithDelayedSetupProfiles(c *C) {
+	conns := map[string]interface{}{"consumer:plug producer:slot": map[string]interface{}{}}
+
+	delayedSetupProfiles := true
+	chg := s.mockConnectForUndo(c, conns, delayedSetupProfiles)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	c.Assert(chg.Status().Ready(), Equals, true)
+
+	// connection is removed from conns
+	var realConns map[string]interface{}
+	c.Assert(s.state.Get("conns", &realConns), IsNil)
+	c.Check(realConns, HasLen, 0)
+
+	cref := &interfaces.ConnRef{
+		PlugRef: interfaces.PlugRef{Snap: "consumer", Name: "plug"},
+		SlotRef: interfaces.SlotRef{Snap: "producer", Name: "slot"},
+	}
+	// and it's not in the repo
+	_, err := s.manager(c).Repository().Connection(cref)
+	notConnected, _ := err.(*interfaces.NotConnectedError)
+	c.Check(notConnected, NotNil)
+
+	// no backend calls because of delayed-setup-profiles flag
+	c.Assert(s.secBackend.SetupCalls, HasLen, 0)
 }
 
 func (s *interfaceManagerSuite) TestConnectErrorMissingSlotSnapOnAutoConnect(c *C) {
@@ -5080,7 +5215,7 @@
 
 	s.state.Lock()
 
-	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot")
+	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot", false)
 	// remove producer snap from the state, doConnect should complain
 	snapstate.Set(s.state, "producer", nil)
 
@@ -5106,7 +5241,7 @@
 	s.mockSnap(c, consumerYaml)
 
 	s.state.Lock()
-	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot")
+	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot", false)
 	// remove consumer snap from the state, doConnect should complain
 	snapstate.Set(s.state, "consumer", nil)
 
@@ -5143,7 +5278,7 @@
 
 	s.state.Lock()
 
-	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot")
+	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot", false)
 	s.state.Unlock()
 
 	s.settle(c)
@@ -5178,7 +5313,7 @@
 
 	s.state.Lock()
 
-	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot")
+	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot", false)
 	s.state.Unlock()
 
 	s.settle(c)
@@ -5218,7 +5353,7 @@
 
 	s.state.Lock()
 
-	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot")
+	chg := makeAutoConnectChange(s.state, "consumer", "plug", "producer", "slot", false)
 	s.state.Unlock()
 
 	s.settle(c)
@@ -5594,6 +5729,78 @@
 	})
 }
 
+func (s *interfaceManagerSuite) TestSnapsWithSecurityProfilesMiddleOfFirstBoot(c *C) {
+	// make sure snapsWithSecurityProfiles does the right thing
+	// if invoked after a restart in the middle of first boot
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	si0 := &snap.SideInfo{
+		RealName: "snap0",
+		Revision: snap.R(10),
+	}
+	snaptest.MockSnap(c, `name: snap0`, si0)
+	snapstate.Set(s.state, "snap0", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si0},
+		Current:  si0.Revision,
+	})
+
+	si1 := &snap.SideInfo{
+		RealName: "snap1",
+		Revision: snap.R(11),
+	}
+	snaptest.MockSnap(c, `name: snap1`, si1)
+	snapstate.Set(s.state, "snap1", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{si1},
+		Current:  si1.Revision,
+	})
+
+	chg := s.state.NewChange("linking", "linking")
+
+	snaps := []struct {
+		name        string
+		setupStatus state.Status
+		linkStatus  state.Status
+		si          *snap.SideInfo
+	}{
+		{"snap0", state.DoneStatus, state.DoneStatus, si0},
+		{"snap1", state.DoStatus, state.DoStatus, si1},
+	}
+
+	var tsPrev *state.TaskSet
+	for i, snp := range snaps {
+		t1 := s.state.NewTask("setup-profiles", fmt.Sprintf("setup profiles %d", i))
+		t1.Set("snap-setup", &snapstate.SnapSetup{
+			SideInfo: snp.si,
+		})
+		t1.SetStatus(snp.setupStatus)
+		t2 := s.state.NewTask("link-snap", fmt.Sprintf("link snap %d", i))
+		t2.Set("snap-setup", &snapstate.SnapSetup{
+			SideInfo: snp.si,
+		})
+		t2.WaitFor(t1)
+		t2.SetStatus(snp.linkStatus)
+		chg.AddTask(t1)
+		chg.AddTask(t2)
+
+		// this is the kind of wait chain used by first boot
+		ts := state.NewTaskSet(t1, t2)
+		if tsPrev != nil {
+			ts.WaitAll(tsPrev)
+		}
+		tsPrev = ts
+	}
+
+	infos, err := ifacestate.SnapsWithSecurityProfiles(s.state)
+	c.Assert(err, IsNil)
+	// snap1 link-snap waiting on snap0 setup-profiles didn't confuse
+	// snapsWithSecurityProfiles
+	c.Check(infos, HasLen, 1)
+	c.Check(infos[0].InstanceName(), Equals, "snap0")
+}
+
 func (s *interfaceManagerSuite) TestDisconnectInterfaces(c *C) {
 	s.mockIfaces(c, &ifacetest.TestInterface{InterfaceName: "test"})
 	_ = s.manager(c)
@@ -8010,10 +8217,7 @@
 	c.Check(repo.Interfaces().Connections, HasLen, 1)
 }
 
-func (s *interfaceManagerSuite) TestPreseedAutoConnectErrorWithInterfaceHooks(c *C) {
-	restore := snapdenv.MockPreseeding(true)
-	defer restore()
-
+func (s *interfaceManagerSuite) autoconnectChangeForPreseeding(c *C, skipMarkPreseeded bool) (autoconnectTask, markPreseededTask *state.Task) {
 	s.MockModel(c, nil)
 	s.mockIfaces(c, &ifacetest.TestInterface{InterfaceName: "test"}, &ifacetest.TestInterface{InterfaceName: "test2"})
 
@@ -8023,21 +8227,177 @@
 	// Initialize the manager. This registers the OS snap.
 	_ = s.manager(c)
 
-	// Run the setup-snap-security task and let it finish.
-	change := s.addSetupSnapSecurityChange(c, &snapstate.SnapSetup{
+	snapsup := &snapstate.SnapSetup{
 		SideInfo: &snap.SideInfo{
 			RealName: snapInfo.SnapName(),
 			Revision: snapInfo.Revision,
 		},
-	})
+	}
+
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	change := s.state.NewChange("test", "")
+	autoconnectTask = s.state.NewTask("auto-connect", "")
+	autoconnectTask.Set("snap-setup", snapsup)
+	change.AddTask(autoconnectTask)
+	if !skipMarkPreseeded {
+		markPreseededTask = s.state.NewTask("mark-preseeded", "")
+		markPreseededTask.WaitFor(autoconnectTask)
+		change.AddTask(markPreseededTask)
+	}
+	installHook := s.state.NewTask("run-hook", "")
+	hsup := &hookstate.HookSetup{
+		Snap: snapInfo.InstanceName(),
+		Hook: "install",
+	}
+	installHook.Set("hook-setup", &hsup)
+	if markPreseededTask != nil {
+		installHook.WaitFor(markPreseededTask)
+	} else {
+		installHook.WaitFor(autoconnectTask)
+	}
+	change.AddTask(installHook)
+	return autoconnectTask, markPreseededTask
+}
+
+func (s *interfaceManagerSuite) TestPreseedAutoConnectWithInterfaceHooks(c *C) {
+	restore := snapdenv.MockPreseeding(true)
+	defer restore()
+
+	autoConnectTask, markPreseededTask := s.autoconnectChangeForPreseeding(c, false)
+
+	st := s.state
 	s.settle(c)
+	st.Lock()
+	defer st.Unlock()
 
+	change := markPreseededTask.Change()
+	c.Check(change.Status(), Equals, state.DoStatus)
+	c.Check(autoConnectTask.Status(), Equals, state.DoneStatus)
+	c.Check(markPreseededTask.Status(), Equals, state.DoStatus)
+
+	checkWaitsForMarkPreseeded := func(t *state.Task) {
+		var foundMarkPreseeded bool
+		for _, wt := range t.WaitTasks() {
+			if wt.Kind() == "mark-preseeded" {
+				foundMarkPreseeded = true
+				break
+			}
+		}
+		c.Check(foundMarkPreseeded, Equals, true)
+	}
+
+	var setupProfilesCount, connectCount, hookCount, installHook int
+	for _, t := range change.Tasks() {
+		switch t.Kind() {
+		case "setup-profiles":
+			c.Check(ifacestate.InSameChangeWaitChain(markPreseededTask, t), Equals, true)
+			checkWaitsForMarkPreseeded(t)
+			setupProfilesCount++
+		case "connect":
+			c.Check(ifacestate.InSameChangeWaitChain(markPreseededTask, t), Equals, true)
+			checkWaitsForMarkPreseeded(t)
+			connectCount++
+		case "run-hook":
+			c.Check(ifacestate.InSameChangeWaitChain(markPreseededTask, t), Equals, true)
+			var hsup hookstate.HookSetup
+			c.Assert(t.Get("hook-setup", &hsup), IsNil)
+			if hsup.Hook == "install" {
+				installHook++
+				checkWaitsForMarkPreseeded(t)
+			}
+			hookCount++
+		case "auto-connect":
+		case "mark-preseeded":
+		default:
+			c.Fatalf("unexpected task: %s", t.Kind())
+		}
+	}
+
+	c.Check(setupProfilesCount, Equals, 1)
+	c.Check(hookCount, Equals, 5)
+	c.Check(connectCount, Equals, 1)
+	c.Check(installHook, Equals, 1)
+}
+
+func (s *interfaceManagerSuite) TestPreseedAutoConnectInternalErrorOnMarkPreseededState(c *C) {
+	restore := snapdenv.MockPreseeding(true)
+	defer restore()
+
+	autoConnectTask, markPreseededTask := s.autoconnectChangeForPreseeding(c, false)
+
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	markPreseededTask.SetStatus(state.DoingStatus)
+	st.Unlock()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	// Ensure that the task succeeded.
-	c.Check(change.Status(), Equals, state.ErrorStatus)
-	c.Check(change.Err(), ErrorMatches, `cannot perform the following tasks:\n.*interface hooks are not yet supported in preseed mode.*`)
+	c.Check(strings.Join(autoConnectTask.Log(), ""), Matches, `.* internal error: unexpected state of mark-preseeded task: Doing`)
+}
+
+func (s *interfaceManagerSuite) TestPreseedAutoConnectInternalErrorMarkPreseededMissing(c *C) {
+	restore := snapdenv.MockPreseeding(true)
+	defer restore()
+
+	skipMarkPreseeded := true
+	autoConnectTask, markPreseededTask := s.autoconnectChangeForPreseeding(c, skipMarkPreseeded)
+	c.Assert(markPreseededTask, IsNil)
+
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	st.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(strings.Join(autoConnectTask.Log(), ""), Matches, `.* internal error: mark-preseeded task not found in preseeding mode`)
+}
+
+func (s *interfaceManagerSuite) TestFirstTaskAfterBootWhenPreseeding(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	chg := st.NewChange("change", "")
+
+	setupTask := st.NewTask("some-task", "")
+	setupTask.Set("snap-setup", &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "test-snap"}})
+	chg.AddTask(setupTask)
+
+	markPreseeded := st.NewTask("fake-mark-preseeded", "")
+	markPreseeded.WaitFor(setupTask)
+	_, err := ifacestate.FirstTaskAfterBootWhenPreseeding("test-snap", markPreseeded)
+	c.Check(err, ErrorMatches, `internal error: fake-mark-preseeded task not in change`)
+
+	chg.AddTask(markPreseeded)
+
+	_, err = ifacestate.FirstTaskAfterBootWhenPreseeding("test-snap", markPreseeded)
+	c.Check(err, ErrorMatches, `internal error: cannot find install hook for snap "test-snap"`)
+
+	// install hook of another snap
+	task1 := st.NewTask("run-hook", "")
+	hsup := hookstate.HookSetup{Hook: "install", Snap: "other-snap"}
+	task1.Set("hook-setup", &hsup)
+	task1.WaitFor(markPreseeded)
+	chg.AddTask(task1)
+	_, err = ifacestate.FirstTaskAfterBootWhenPreseeding("test-snap", markPreseeded)
+	c.Check(err, ErrorMatches, `internal error: cannot find install hook for snap "test-snap"`)
+
+	// add install hook for the correct snap
+	task2 := st.NewTask("run-hook", "")
+	hsup = hookstate.HookSetup{Hook: "install", Snap: "test-snap"}
+	task2.Set("hook-setup", &hsup)
+	task2.WaitFor(markPreseeded)
+	chg.AddTask(task2)
+	hooktask, err := ifacestate.FirstTaskAfterBootWhenPreseeding("test-snap", markPreseeded)
+	c.Assert(err, IsNil)
+	c.Check(hooktask.ID(), Equals, task2.ID())
 }
 
 // Tests for ResolveDisconnect()
diff -Nru snapd-2.45.1+20.04.2/overlord/ifacestate/implicit.go snapd-2.48.3+20.04/overlord/ifacestate/implicit.go
--- snapd-2.45.1+20.04.2/overlord/ifacestate/implicit.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/ifacestate/implicit.go	2021-02-02 08:21:12.000000000 +0000
@@ -44,13 +44,13 @@
 	// Implicit slots can be added to the special "snapd" snap or to snaps with
 	// type "os". Currently there are no other snaps that gain implicit
 	// interfaces.
-	if snapInfo.GetType() != snap.TypeOS && snapInfo.GetType() != snap.TypeSnapd {
+	if snapInfo.Type() != snap.TypeOS && snapInfo.Type() != snap.TypeSnapd {
 		return nil
 	}
 
 	// If the manager has chosen to put implicit slots on the "snapd" snap
 	// then stop adding them to any other core snaps.
-	if shouldSnapdHostImplicitSlots(mapper) && snapInfo.GetType() != snap.TypeSnapd {
+	if shouldSnapdHostImplicitSlots(mapper) && snapInfo.Type() != snap.TypeSnapd {
 		return nil
 	}
 
diff -Nru snapd-2.45.1+20.04.2/overlord/managers_test.go snapd-2.48.3+20.04/overlord/managers_test.go
--- snapd-2.45.1+20.04.2/overlord/managers_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/managers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -77,6 +77,12 @@
 	"github.com/snapcore/snapd/testutil"
 )
 
+var (
+	settleTimeout           = testutil.HostScaledTimeout(45 * time.Second)
+	aggressiveSettleTimeout = testutil.HostScaledTimeout(50 * time.Millisecond)
+	connectRetryTimeout     = testutil.HostScaledTimeout(70 * time.Millisecond)
+)
+
 type automaticSnapshotCall struct {
 	InstanceName string
 	SnapConfig   map[string]interface{}
@@ -127,11 +133,6 @@
 	deviceKey, _ = assertstest.GenerateKey(752)
 )
 
-const (
-	aggressiveSettleTimeout = 50 * time.Millisecond
-	connectRetryTimeout     = 70 * time.Millisecond
-)
-
 func verifyLastTasksetIsRerefresh(c *C, tts []*state.TaskSet) {
 	ts := tts[len(tts)-1]
 	c.Assert(ts.Tasks(), HasLen, 1)
@@ -154,6 +155,9 @@
 	// needed by hooks
 	s.AddCleanup(testutil.MockCommand(c, "snap", "").Restore)
 
+	restoreCheckFreeSpace := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return nil })
+	s.AddCleanup(restoreCheckFreeSpace)
+
 	oldSetupInstallHook := snapstate.SetupInstallHook
 	oldSetupRemoveHook := snapstate.SetupRemoveHook
 	snapstate.SetupRemoveHook = hookstate.SetupRemoveHook
@@ -350,14 +354,20 @@
 		return errors.New("error out")
 	}
 	s.o.TaskRunner().AddHandler("error-trigger", erroringHandler, nil)
+
+	// setup cloud-init as restricted so that tests by default don't run the
+	// full EnsureCloudInitRestricted logic in the devicestate mgr
+	snapdCloudInitRestrictedFile := filepath.Join(dirs.GlobalRootDir, "etc/cloud/cloud.cfg.d/zzzz_snapd.cfg")
+	err = os.MkdirAll(filepath.Dir(snapdCloudInitRestrictedFile), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(snapdCloudInitRestrictedFile, nil, 0644)
+	c.Assert(err, IsNil)
 }
 
 type mgrsSuite struct {
 	baseMgrsSuite
 }
 
-var settleTimeout = 45 * time.Second
-
 func makeTestSnapWithFiles(c *C, snapYamlContent string, files [][]string) string {
 	info, err := snap.InfoFromSnapYaml([]byte(snapYamlContent))
 	c.Assert(err, IsNil)
@@ -514,6 +524,14 @@
 }
 
 func (s *mgrsSuite) TestHappyRemove(c *C) {
+	oldEstimateSnapshotSize := snapstate.EstimateSnapshotSize
+	snapstate.EstimateSnapshotSize = func(st *state.State, instanceName string, users []string) (uint64, error) {
+		return 0, nil
+	}
+	defer func() {
+		snapstate.EstimateSnapshotSize = oldEstimateSnapshotSize
+	}()
+
 	st := s.o.State()
 	st.Lock()
 	defer st.Unlock()
@@ -570,7 +588,8 @@
 	    "all"
 	],
         "download": {
-            "url": "@URL@"
+			"url": "@URL@",
+			"size": 123
         },
         "epoch": @EPOCH@,
         "type": "@TYPE@",
@@ -701,7 +720,7 @@
 		hit = strings.Replace(hit, "@ICON@", baseURL.String()+"/icon", -1)
 		hit = strings.Replace(hit, "@VERSION@", info.Version, -1)
 		hit = strings.Replace(hit, "@REVISION@", revno, -1)
-		hit = strings.Replace(hit, `@TYPE@`, string(info.GetType()), -1)
+		hit = strings.Replace(hit, `@TYPE@`, string(info.Type()), -1)
 		hit = strings.Replace(hit, `@EPOCH@`, string(epochBuf), -1)
 		return hit
 	}
@@ -796,6 +815,13 @@
 					Name        string     `json:"name"`
 					InstanceKey string     `json:"instance-key"`
 					Epoch       snap.Epoch `json:"epoch"`
+					// assertions
+					Key        string `json:"key"`
+					Assertions []struct {
+						Type        string   `json:"type"`
+						PrimaryKey  []string `json:"primary-key"`
+						IfNewerThan *int     `json:"if-newer-than"`
+					}
 				} `json:"actions"`
 				Context []struct {
 					SnapID string     `json:"snap-id"`
@@ -815,9 +841,33 @@
 				Name        string          `json:"name"`
 				Snap        json.RawMessage `json:"snap"`
 				InstanceKey string          `json:"instance-key"`
+				// For assertions
+				Key           string   `json:"key"`
+				AssertionURLs []string `json:"assertion-stream-urls"`
 			}
 			var results []resultJSON
 			for _, a := range input.Actions {
+				if a.Action == "fetch-assertions" {
+					urls := []string{}
+					for _, ar := range a.Assertions {
+						ref := &asserts.Ref{
+							Type:       asserts.Type(ar.Type),
+							PrimaryKey: ar.PrimaryKey,
+						}
+						_, err := ref.Resolve(s.storeSigning.Find)
+						if err != nil {
+							panic("missing assertions not supported")
+						}
+						urls = append(urls, fmt.Sprintf("%s/api/v1/snaps/assertions/%s", baseURL.String(), ref.Unique()))
+
+					}
+					results = append(results, resultJSON{
+						Result:        "fetch-assertions",
+						Key:           a.Key,
+						AssertionURLs: urls,
+					})
+					continue
+				}
 				name := s.serveIDtoName[a.SnapID]
 				epoch := id2epoch[a.SnapID]
 				if a.Action == "install" {
@@ -1714,9 +1764,10 @@
 
 	// this is already set
 	c.Assert(bloader.BootVars, DeepEquals, map[string]string{
-		"snap_core":     "core_99.snap",
-		"snap_try_core": "core_x1.snap",
-		"snap_mode":     boot.TryStatus,
+		"snap_core":       "core_99.snap",
+		"snap_try_core":   "core_x1.snap",
+		"snap_try_kernel": "",
+		"snap_mode":       boot.TryStatus,
 	})
 
 	// simulate successful restart happened
@@ -1843,6 +1894,7 @@
 
 	c.Assert(bloader.BootVars, DeepEquals, map[string]string{
 		"snap_core":       "core18_2.snap",
+		"snap_try_core":   "",
 		"snap_kernel":     "pc-kernel_123.snap",
 		"snap_try_kernel": "pc-kernel_x1.snap",
 		"snap_mode":       boot.TryStatus,
@@ -1938,6 +1990,7 @@
 		"snap_kernel":     "pc-kernel_123.snap",
 		"snap_try_kernel": "pc-kernel_x1.snap",
 		"snap_mode":       boot.TryStatus,
+		"snap_try_core":   "",
 	})
 
 	// we are in restarting state and the change is not done yet
@@ -1974,7 +2027,7 @@
 	// we have revision 1 installed
 	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
 	c.Assert(err, IsNil)
-	restore := bloader.SetRunKernelImageEnabledKernel(kernel)
+	restore := bloader.SetEnabledKernel(kernel)
 	defer restore()
 
 	restore = release.MockOnClassic(false)
@@ -2141,7 +2194,7 @@
 	// we have revision 1 installed
 	kernel, err := snap.ParsePlaceInfoFromSnapFileName("pc-kernel_1.snap")
 	c.Assert(err, IsNil)
-	restore := bloader.SetRunKernelImageEnabledKernel(kernel)
+	restore := bloader.SetEnabledKernel(kernel)
 	defer restore()
 
 	restore = release.MockOnClassic(false)
@@ -2348,7 +2401,7 @@
 func (s *mgrsSuite) removeSnap(c *C, name string) {
 	st := s.o.State()
 
-	ts, err := snapstate.Remove(st, name, snap.R(0), nil)
+	ts, err := snapstate.Remove(st, name, snap.R(0), &snapstate.RemoveFlags{Purge: true})
 	c.Assert(err, IsNil)
 	chg := st.NewChange("remove-snap", "...")
 	chg.AddAll(ts)
@@ -3310,7 +3363,7 @@
 
 	_ = s.installLocalTestSnap(c, snapYamlContent1+"version: 1.0")
 
-	ts, err := snapstate.Remove(st, "snap1", snap.R(0), nil)
+	ts, err := snapstate.Remove(st, "snap1", snap.R(0), &snapstate.RemoveFlags{Purge: true})
 	c.Assert(err, IsNil)
 	chg := st.NewChange("remove-snap", "...")
 	chg.AddAll(ts)
@@ -3607,7 +3660,7 @@
 	chg.AddAll(ts)
 
 	// remove other-snap
-	ts2, err := snapstate.Remove(st, removeSnapName, snap.R(0), nil)
+	ts2, err := snapstate.Remove(st, removeSnapName, snap.R(0), &snapstate.RemoveFlags{Purge: true})
 	c.Assert(err, IsNil)
 	chg2 := st.NewChange("remove-snap", "...")
 	chg2.AddAll(ts2)
@@ -3722,13 +3775,14 @@
 		SlotRef: interfaces.SlotRef{Snap: "some-snap", Name: "media-hub"},
 	}, nil, nil, nil, nil, nil)
 
-	ts, err := snapstate.Remove(st, "some-snap", snap.R(0), nil)
+	flags := &snapstate.RemoveFlags{Purge: true}
+	ts, err := snapstate.Remove(st, "some-snap", snap.R(0), flags)
 	c.Assert(err, IsNil)
 	chg := st.NewChange("uninstall", "...")
 	chg.AddAll(ts)
 
 	// remove other-snap
-	ts2, err := snapstate.Remove(st, "other-snap", snap.R(0), nil)
+	ts2, err := snapstate.Remove(st, "other-snap", snap.R(0), flags)
 	c.Assert(err, IsNil)
 	chg2 := st.NewChange("uninstall", "...")
 	chg2.AddAll(ts2)
@@ -3810,7 +3864,7 @@
 		SlotRef: interfaces.SlotRef{Snap: "some-snap", Name: "media-hub"},
 	}, nil, nil, nil, nil, nil)
 
-	ts, err := snapstate.Remove(st, "some-snap", snap.R(0), nil)
+	ts, err := snapstate.Remove(st, "some-snap", snap.R(0), &snapstate.RemoveFlags{Purge: true})
 	c.Assert(err, IsNil)
 	chg := st.NewChange("uninstall", "...")
 	chg.AddAll(ts)
@@ -4396,10 +4450,11 @@
 
 	// check that the boot vars got updated as expected
 	c.Assert(bloader.BootVars, DeepEquals, map[string]string{
-		"snap_mode":     boot.TryStatus,
-		"snap_core":     "core18_1.snap",
-		"snap_try_core": "core20_2.snap",
-		"snap_kernel":   "pc-kernel_1.snap",
+		"snap_mode":       boot.TryStatus,
+		"snap_core":       "core18_1.snap",
+		"snap_try_core":   "core20_2.snap",
+		"snap_kernel":     "pc-kernel_1.snap",
+		"snap_try_kernel": "",
 	})
 	// simulate successful restart happened
 	ms.mockSuccessfulReboot(c, bloader, []snap.Type{snap.TypeBase})
@@ -4535,10 +4590,11 @@
 
 	// check that the boot vars got updated as expected
 	c.Assert(bloader.BootVars, DeepEquals, map[string]string{
-		"snap_mode":     boot.TryStatus,
-		"snap_core":     "core18_1.snap",
-		"snap_try_core": "core20_2.snap",
-		"snap_kernel":   "pc-kernel_1.snap",
+		"snap_mode":       boot.TryStatus,
+		"snap_core":       "core18_1.snap",
+		"snap_try_core":   "core20_2.snap",
+		"snap_kernel":     "pc-kernel_1.snap",
+		"snap_try_kernel": "",
 	})
 	// simulate successful restart happened
 	ms.mockRollbackAcrossReboot(c, bloader, []snap.Type{snap.TypeBase})
@@ -4745,6 +4801,7 @@
 		"snap_kernel":     "pc-kernel_1.snap",
 		"snap_try_kernel": "brand-kernel_2.snap",
 		"snap_mode":       boot.TryStatus,
+		"snap_try_core":   "",
 	})
 	// simulate successful system-restart bootenv updates (those
 	// vars will be cleared by snapd on a restart)
@@ -5175,7 +5232,7 @@
 	s.serveSnap(snapPath, "2")
 
 	updaterForStructureCalls := 0
-	restore = gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, rootDir, rollbackDir string) (gadget.Updater, error) {
+	restore = gadget.MockUpdaterForStructure(func(ps *gadget.LaidOutStructure, rootDir, rollbackDir string, observer gadget.ContentUpdateObserver) (gadget.Updater, error) {
 		updaterForStructureCalls++
 		c.Assert(ps.Name, Equals, "foo")
 		return &mockUpdater{}, nil
@@ -5654,7 +5711,7 @@
 	chg.AddAll(ts)
 
 	// remove other-snap
-	ts2, err := snapstate.Remove(st, "other-snap", snap.R(0), nil)
+	ts2, err := snapstate.Remove(st, "other-snap", snap.R(0), &snapstate.RemoveFlags{Purge: true})
 	c.Assert(err, IsNil)
 	chg2 := st.NewChange("remove-snap", "...")
 	chg2.AddAll(ts2)
@@ -5758,6 +5815,7 @@
 
 	c.Assert(bloader.BootVars, DeepEquals, map[string]string{
 		"snap_core":       "core18_2.snap",
+		"snap_try_core":   "",
 		"snap_kernel":     "pc-kernel_123.snap",
 		"snap_try_kernel": "pc-kernel_x1.snap",
 		"snap_mode":       boot.TryStatus,
diff -Nru snapd-2.45.1+20.04.2/overlord/overlord_test.go snapd-2.48.3+20.04/overlord/overlord_test.go
--- snapd-2.45.1+20.04.2/overlord/overlord_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/overlord_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -33,7 +33,6 @@
 	. "gopkg.in/check.v1"
 	"gopkg.in/tomb.v2"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord"
@@ -46,8 +45,10 @@
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snapdenv"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/store"
 	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/timings"
 )
 
 func TestOverlord(t *testing.T) { TestingT(t) }
@@ -151,7 +152,13 @@
 }
 
 func (ovs *overlordSuite) TestNewWithGoodState(c *C) {
-	fakeState := []byte(fmt.Sprintf(`{"data":{"patch-level":%d,"patch-sublevel":%d,"patch-sublevel-last-version":%q,"some":"data","refresh-privacy-key":"0123456789ABCDEF"},"changes":null,"tasks":null,"last-change-id":0,"last-task-id":0,"last-lane-id":0}`, patch.Level, patch.Sublevel, cmd.Version))
+	// ensure we don't write state load timing in the state on really
+	// slow architectures (e.g. risc-v)
+	oldDurationThreshold := timings.DurationThreshold
+	timings.DurationThreshold = time.Second * 30
+	defer func() { timings.DurationThreshold = oldDurationThreshold }()
+
+	fakeState := []byte(fmt.Sprintf(`{"data":{"patch-level":%d,"patch-sublevel":%d,"patch-sublevel-last-version":%q,"some":"data","refresh-privacy-key":"0123456789ABCDEF"},"changes":null,"tasks":null,"last-change-id":0,"last-task-id":0,"last-lane-id":0}`, patch.Level, patch.Sublevel, snapdtool.Version))
 	err := ioutil.WriteFile(dirs.SnapStateFile, fakeState, 0600)
 	c.Assert(err, IsNil)
 
diff -Nru snapd-2.45.1+20.04.2/overlord/patch/patch1.go snapd-2.48.3+20.04/overlord/patch/patch1.go
--- snapd-2.45.1+20.04.2/overlord/patch/patch1.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/patch/patch1.go	2021-02-02 08:21:12.000000000 +0000
@@ -56,7 +56,7 @@
 		return snap.TypeApp, err
 	}
 
-	return info.GetType(), nil
+	return info.Type(), nil
 }
 
 type patch1Flags int
diff -Nru snapd-2.45.1+20.04.2/overlord/patch/patch5.go snapd-2.48.3+20.04/overlord/patch/patch5.go
--- snapd-2.45.1+20.04.2/overlord/patch/patch5.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/patch/patch5.go	2021-02-02 08:21:12.000000000 +0000
@@ -66,7 +66,7 @@
 			continue
 		}
 
-		err = wrappers.StopServices(svcs, snap.StopReasonRefresh, log, tm)
+		err = wrappers.StopServices(svcs, nil, snap.StopReasonRefresh, log, tm)
 		if err != nil {
 			return err
 		}
@@ -76,7 +76,7 @@
 			return err
 		}
 
-		err = wrappers.StartServices(svcs, log, tm)
+		err = wrappers.StartServices(svcs, nil, nil, log, tm)
 		if err != nil {
 			return err
 		}
diff -Nru snapd-2.45.1+20.04.2/overlord/patch/patch.go snapd-2.48.3+20.04/overlord/patch/patch.go
--- snapd-2.45.1+20.04.2/overlord/patch/patch.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/patch/patch.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,10 +22,10 @@
 import (
 	"fmt"
 
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 // Level is the current implemented patch level of the state format and content.
@@ -103,7 +103,7 @@
 	if err != nil && err != state.ErrNoState {
 		return err
 	}
-	if err == state.ErrNoState || lastVersion != cmd.Version {
+	if err == state.ErrNoState || lastVersion != snapdtool.Version {
 		*sublevel = 0
 		s.Set("patch-sublevel", *sublevel)
 		// unset old reset key in case of revert into old version.
@@ -176,7 +176,7 @@
 
 	s.Lock()
 	// store last snapd version last in case system is restarted before patches are applied
-	s.Set("patch-sublevel-last-version", cmd.Version)
+	s.Set("patch-sublevel-last-version", snapdtool.Version)
 	s.Unlock()
 
 	return nil
diff -Nru snapd-2.45.1+20.04.2/overlord/patch/patch_test.go snapd-2.48.3+20.04/overlord/patch/patch_test.go
--- snapd-2.45.1+20.04.2/overlord/patch/patch_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/patch/patch_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,12 +24,12 @@
 	"sort"
 	"testing"
 
-	"github.com/snapcore/snapd/cmd"
+	. "gopkg.in/check.v1"
+
 	"github.com/snapcore/snapd/overlord/patch"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
-
-	. "gopkg.in/check.v1"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 func Test(t *testing.T) { TestingT(t) }
@@ -322,7 +322,7 @@
 func (s *patchSuite) testMaybeResetPatchLevel6(c *C, snapdVersion, lastVersion string, expectedPatches []int) {
 	var sequence []int
 
-	cmd.MockVersion(snapdVersion)
+	snapdtool.MockVersion(snapdVersion)
 
 	p60 := generatePatchFunc(60, &sequence)
 	p61 := generatePatchFunc(61, &sequence)
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/export_test.go snapd-2.48.3+20.04/overlord/servicestate/export_test.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,24 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package servicestate
+
+var (
+	UpdateSnapstateServices = updateSnapstateServices
+)
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/helpers.go snapd-2.48.3+20.04/overlord/servicestate/helpers.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/helpers.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,99 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package servicestate
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/snap"
+)
+
+// updateSnapstateServices uses ServicesEnabledByHooks and ServicesDisabledByHooks in
+// snapstate and the provided enabled or disabled list to update the state of services in snapstate.
+// It is meant for doServiceControl to help track enabling and disabling of services.
+func updateSnapstateServices(snapst *snapstate.SnapState, enable, disable []*snap.AppInfo) (bool, error) {
+	if len(enable) > 0 && len(disable) > 0 {
+		// We do one op at a time for given service-control task; we could in
+		// theory support both at the same time here, but service-control
+		// ops are run sequentially so we always either enable or disable at
+		// any given time. Not having to worry about that simplifies the
+		// problem of ordering of enable vs disable.
+		return false, fmt.Errorf("internal error: cannot handle enabled and disabled services at the same time")
+	}
+
+	// populate helper lookups of already enabled/disabled services from
+	// snapst.
+	alreadyEnabled := map[string]bool{}
+	alreadyDisabled := map[string]bool{}
+	for _, serviceName := range snapst.ServicesEnabledByHooks {
+		alreadyEnabled[serviceName] = true
+	}
+	for _, serviceName := range snapst.ServicesDisabledByHooks {
+		alreadyDisabled[serviceName] = true
+	}
+
+	toggleServices := func(services []*snap.AppInfo, fromState map[string]bool, toState map[string]bool) (changed bool) {
+		// migrate given services from one map to another, if they do
+		// not exist in the target map
+		for _, service := range services {
+			if !toState[service.Name] {
+				toState[service.Name] = true
+				if fromState[service.Name] {
+					delete(fromState, service.Name)
+				}
+				changed = true
+			}
+		}
+		return changed
+	}
+
+	// we are not disabling and enabling the services at the same time as
+	// checked in the function entry, only one path is possible
+	fromState, toState := alreadyDisabled, alreadyEnabled
+	which := enable
+	if len(disable) > 0 {
+		fromState, toState = alreadyEnabled, alreadyDisabled
+		which = disable
+	}
+	if changed := toggleServices(which, fromState, toState); !changed {
+		// nothing changed
+		return false, nil
+	}
+	// reset and recreate the state
+	snapst.ServicesEnabledByHooks = nil
+	snapst.ServicesDisabledByHooks = nil
+	if len(alreadyEnabled) != 0 {
+		snapst.ServicesEnabledByHooks = make([]string, 0, len(alreadyEnabled))
+		for srv := range alreadyEnabled {
+			snapst.ServicesEnabledByHooks = append(snapst.ServicesEnabledByHooks, srv)
+		}
+		sort.Strings(snapst.ServicesEnabledByHooks)
+	}
+	if len(alreadyDisabled) != 0 {
+		snapst.ServicesDisabledByHooks = make([]string, 0, len(alreadyDisabled))
+		for srv := range alreadyDisabled {
+			snapst.ServicesDisabledByHooks = append(snapst.ServicesDisabledByHooks, srv)
+		}
+		sort.Strings(snapst.ServicesDisabledByHooks)
+	}
+	return true, nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/service_control.go snapd-2.48.3+20.04/overlord/servicestate/service_control.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/service_control.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/service_control.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,120 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package servicestate
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/wrappers"
+
+	tomb "gopkg.in/tomb.v2"
+)
+
+// ServiceAction encapsulates a single service-related action (such as starting,
+// stopping or restarting) run against services of a given snap. The action is
+// run for services listed in services attribute, or for all services of the
+// snap if services list is empty.
+// The names of services are app names (as defined in snap yaml).
+type ServiceAction struct {
+	SnapName       string   `json:"snap-name"`
+	Action         string   `json:"action"`
+	ActionModifier string   `json:"action-modifier,omitempty"`
+	Services       []string `json:"services,omitempty"`
+}
+
+func (m *ServiceManager) doServiceControl(t *state.Task, _ *tomb.Tomb) error {
+	st := t.State()
+	st.Lock()
+	defer st.Unlock()
+
+	perfTimings := state.TimingsForTask(t)
+	defer perfTimings.Save(st)
+
+	var sc ServiceAction
+	err := t.Get("service-action", &sc)
+	if err != nil {
+		return fmt.Errorf("internal error: cannot get service-action: %v", err)
+	}
+
+	var snapst snapstate.SnapState
+	if err := snapstate.Get(st, sc.SnapName, &snapst); err != nil {
+		return err
+	}
+	info, err := snapst.CurrentInfo()
+	if err != nil {
+		return err
+	}
+
+	svcs := info.Services()
+	if len(svcs) == 0 {
+		return nil
+	}
+
+	var services []*snap.AppInfo
+	if len(sc.Services) == 0 {
+		// no services specified, take all services of the snap
+		services = info.Services()
+	} else {
+		for _, svc := range sc.Services {
+			app := info.Apps[svc]
+			if app == nil {
+				return fmt.Errorf("no such service: %s", svc)
+			}
+			if !app.IsService() {
+				return fmt.Errorf("%s is not a service", svc)
+			}
+			services = append(services, app)
+		}
+	}
+
+	meter := snapstate.NewTaskProgressAdapterLocked(t)
+
+	switch sc.Action {
+	case "stop":
+		flags := &wrappers.StopServicesFlags{
+			Disable: sc.ActionModifier == "disable",
+		}
+		if err := wrappers.StopServices(services, flags, snap.StopReasonOther, meter, perfTimings); err != nil {
+			return err
+		}
+	case "start":
+		startupOrdered, err := snap.SortServices(services)
+		if err != nil {
+			return err
+		}
+		flags := &wrappers.StartServicesFlags{
+			Enable: sc.ActionModifier == "enable",
+		}
+		if err := wrappers.StartServices(startupOrdered, nil, flags, meter, perfTimings); err != nil {
+			return err
+		}
+	case "restart":
+		return wrappers.RestartServices(services, nil, meter, perfTimings)
+	case "reload-or-restart":
+		flags := &wrappers.RestartServicesFlags{Reload: true}
+		return wrappers.RestartServices(services, flags, meter, perfTimings)
+	default:
+		return fmt.Errorf("unhandled service action: %q", sc.Action)
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/service_control_test.go snapd-2.48.3+20.04/overlord/servicestate/service_control_test.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/service_control_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/service_control_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,767 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package servicestate_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord"
+	"github.com/snapcore/snapd/overlord/servicestate"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/systemd"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func TestServiceControl(t *testing.T) { TestingT(t) }
+
+type serviceControlSuite struct {
+	testutil.BaseTest
+	state      *state.State
+	o          *overlord.Overlord
+	se         *overlord.StateEngine
+	serviceMgr *servicestate.ServiceManager
+	sysctlArgs [][]string
+}
+
+var _ = Suite(&serviceControlSuite{})
+
+const servicesSnapYaml1 = `name: test-snap
+version: 1.0
+apps:
+  someapp:
+    command: cmd
+  foo:
+    daemon: simple
+  bar:
+    daemon: simple
+    after: [foo]
+`
+
+func (s *serviceControlSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("") })
+
+	s.o = overlord.Mock()
+	s.state = s.o.State()
+
+	s.sysctlArgs = nil
+	systemctlRestorer := systemd.MockSystemctl(func(cmd ...string) (buf []byte, err error) {
+		s.sysctlArgs = append(s.sysctlArgs, cmd)
+		if cmd[0] == "show" {
+			return []byte("ActiveState=inactive\n"), nil
+		}
+		return nil, nil
+	})
+	s.AddCleanup(systemctlRestorer)
+
+	s.serviceMgr = servicestate.Manager(s.state, s.o.TaskRunner())
+	s.o.AddManager(s.serviceMgr)
+	s.o.AddManager(s.o.TaskRunner())
+	s.se = s.o.StateEngine()
+	c.Assert(s.o.StartUp(), IsNil)
+}
+
+func (s *serviceControlSuite) mockTestSnap(c *C) *snap.Info {
+	si := snap.SideInfo{
+		RealName: "test-snap",
+		Revision: snap.R(7),
+	}
+	info := snaptest.MockSnap(c, servicesSnapYaml1, &si)
+	snapstate.Set(s.state, "test-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	// mock systemd service units, this is required when testing "stop"
+	err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "etc/systemd/system/"), 0775)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(dirs.GlobalRootDir, "etc/systemd/system/snap.test-snap.foo.service"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	return info
+}
+
+func verifyControlTasks(c *C, tasks []*state.Task, expectedAction, supportAction string, expectedServices ...string) {
+	// sanity, ensures test checks below are hit
+	c.Assert(len(tasks) > 0, Equals, true)
+	var i int
+	for i < len(tasks) {
+		var argv []string
+		if tasks[i].Kind() == "exec-command" {
+			switch expectedAction {
+			case "start":
+				if supportAction != "" {
+					c.Assert(tasks[i].Get("argv", &argv), IsNil)
+					c.Check(argv, DeepEquals, append([]string{"systemctl", supportAction}, expectedServices...))
+					i++
+					wt := tasks[i].WaitTasks()
+					c.Assert(wt, HasLen, 1)
+					c.Assert(wt[0].ID(), Equals, tasks[i-1].ID())
+				}
+				c.Assert(tasks[i].Get("argv", &argv), IsNil)
+				c.Check(argv, DeepEquals, append([]string{"systemctl", "start"}, expectedServices...))
+			case "stop":
+				if supportAction != "" {
+					c.Assert(tasks[i].Get("argv", &argv), IsNil)
+					c.Check(argv, DeepEquals, append([]string{"systemctl", supportAction}, expectedServices...))
+					i++
+					wt := tasks[i].WaitTasks()
+					c.Assert(wt, HasLen, 1)
+					c.Assert(wt[0].ID(), Equals, tasks[i-1].ID())
+				}
+				c.Assert(tasks[i].Get("argv", &argv), IsNil)
+				c.Check(argv, DeepEquals, append([]string{"systemctl", "stop"}, expectedServices...))
+			case "restart":
+				if supportAction != "" {
+					c.Assert(tasks[i].Get("argv", &argv), IsNil)
+					c.Check(argv, DeepEquals, append([]string{"systemctl", "reload-or-restart"}, expectedServices...))
+				} else {
+					c.Assert(tasks[i].Get("argv", &argv), IsNil)
+					c.Check(argv, DeepEquals, append([]string{"systemctl", "restart"}, expectedServices...))
+				}
+			default:
+				c.Fatalf("unhandled action %s", expectedAction)
+			}
+		} else {
+			c.Fatalf("unexpected task: %s", tasks[i].Kind())
+		}
+		i++
+	}
+}
+
+func makeControlChange(c *C, st *state.State, inst *servicestate.Instruction, info *snap.Info) *state.Change {
+	apps := []*snap.AppInfo{}
+	for _, name := range inst.Names {
+		c.Assert(info.Apps[name], NotNil)
+		apps = append(apps, info.Apps[name])
+	}
+	st.Unlock()
+	tss, err := servicestate.Control(st, apps, inst, nil)
+	st.Lock()
+	c.Assert(err, IsNil)
+
+	chg := st.NewChange("service-control", "...")
+	for _, ts := range tss {
+		chg.AddAll(ts)
+	}
+	return chg
+}
+
+func (s *serviceControlSuite) TestControlConflict(c *C) {
+	st := s.state
+	st.Lock()
+
+	inf := s.mockTestSnap(c)
+
+	// create conflicting change
+	t := st.NewTask("link-snap", "...")
+	snapsup := &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "test-snap"}}
+	t.Set("snap-setup", snapsup)
+	chg := st.NewChange("manip", "...")
+	chg.AddTask(t)
+	st.Unlock()
+
+	inst := &servicestate.Instruction{Action: "start", Names: []string{"foo"}}
+	_, err := servicestate.Control(st, []*snap.AppInfo{inf.Apps["foo"]}, inst, nil)
+	c.Check(err, ErrorMatches, `snap "test-snap" has "manip" change in progress`)
+}
+
+func (s *serviceControlSuite) TestControlStartInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action: "start",
+		Names:  []string{"foo"},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "start", "", "snap.test-snap.foo.service")
+}
+
+func (s *serviceControlSuite) TestControlStartEnableMultipleInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action:       "start",
+		Names:        []string{"foo", "bar"},
+		StartOptions: client.StartOptions{Enable: true},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "start", "enable", "snap.test-snap.foo.service", "snap.test-snap.bar.service")
+}
+
+func (s *serviceControlSuite) TestControlStopInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action: "stop",
+		Names:  []string{"foo"},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "stop", "", "snap.test-snap.foo.service")
+}
+
+func (s *serviceControlSuite) TestControlStopDisableInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action:      "stop",
+		Names:       []string{"bar"},
+		StopOptions: client.StopOptions{Disable: true},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "stop", "disable", "snap.test-snap.bar.service")
+}
+
+func (s *serviceControlSuite) TestControlRestartInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action: "restart",
+		Names:  []string{"bar"},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "restart", "", "snap.test-snap.bar.service")
+}
+
+func (s *serviceControlSuite) TestControlRestartReloadMultipleInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action:         "restart",
+		Names:          []string{"foo", "bar"},
+		RestartOptions: client.RestartOptions{Reload: true},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "restart", "reload", "snap.test-snap.foo.service", "snap.test-snap.bar.service")
+}
+
+func (s *serviceControlSuite) TestControlUnknownInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inst := &servicestate.Instruction{
+		Action:         "boo",
+		Names:          []string{"foo"},
+		RestartOptions: client.RestartOptions{Reload: true},
+	}
+
+	_, err := servicestate.Control(st, []*snap.AppInfo{}, inst, nil)
+	c.Assert(err, ErrorMatches, `unknown action "boo"`)
+}
+
+func (s *serviceControlSuite) TestControlStopDisableMultipleInstruction(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	inf := s.mockTestSnap(c)
+
+	inst := &servicestate.Instruction{
+		Action:      "stop",
+		Names:       []string{"foo", "bar"},
+		StopOptions: client.StopOptions{Disable: true},
+	}
+
+	chg := makeControlChange(c, st, inst, inf)
+	verifyControlTasks(c, chg.Tasks(), "stop", "disable", "snap.test-snap.foo.service", "snap.test-snap.bar.service")
+}
+
+func (s *serviceControlSuite) TestNoServiceCommandError(c *C) {
+	st := s.state
+	st.Lock()
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.ErrorStatus)
+	c.Check(chg.Err(), ErrorMatches, `cannot perform the following tasks:\n.*internal error: cannot get service-action: no state entry for key.*`)
+}
+
+func (s *serviceControlSuite) TestNoopWhenNoServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	si := snap.SideInfo{RealName: "test-snap", Revision: snap.R(7)}
+	snaptest.MockSnap(c, `name: test-snap`, &si)
+	snapstate.Set(st, "test-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{SnapName: "test-snap"}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Check(t.Status(), Equals, state.DoneStatus)
+}
+
+func (s *serviceControlSuite) TestUnhandledServiceAction(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{SnapName: "test-snap", Action: "foo"}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.ErrorStatus)
+	c.Check(chg.Err(), ErrorMatches, `cannot perform the following tasks:\n.*unhandled service action: "foo".*`)
+}
+
+func (s *serviceControlSuite) TestUnknownService(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "start",
+		Services: []string{"baz"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.ErrorStatus)
+	c.Check(chg.Err(), ErrorMatches, `cannot perform the following tasks:\n.*no such service: baz.*`)
+}
+
+func (s *serviceControlSuite) TestNotAService(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "start",
+		Services: []string{"someapp"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.ErrorStatus)
+	c.Check(chg.Err(), ErrorMatches, `cannot perform the following tasks:\n.*someapp is not a service.*`)
+}
+
+func (s *serviceControlSuite) TestStartAllServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "start",
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"is-enabled", "snap.test-snap.foo.service"},
+		{"is-enabled", "snap.test-snap.bar.service"},
+		{"start", "snap.test-snap.foo.service"},
+		{"start", "snap.test-snap.bar.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestStartListedServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "start",
+		Services: []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"is-enabled", "snap.test-snap.foo.service"},
+		{"start", "snap.test-snap.foo.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestStartEnableServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName:       "test-snap",
+		Action:         "start",
+		ActionModifier: "enable",
+		Services:       []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"is-enabled", "snap.test-snap.foo.service"},
+		{"start", "snap.test-snap.foo.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestStartEnableMultipleServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName:       "test-snap",
+		Action:         "start",
+		ActionModifier: "enable",
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"is-enabled", "snap.test-snap.foo.service"},
+		{"is-enabled", "snap.test-snap.bar.service"},
+		{"start", "snap.test-snap.foo.service"},
+		{"start", "snap.test-snap.bar.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestStopServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "stop",
+		Services: []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"stop", "snap.test-snap.foo.service"},
+		{"show", "--property=ActiveState", "snap.test-snap.foo.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestStopDisableServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName:       "test-snap",
+		Action:         "stop",
+		ActionModifier: "disable",
+		Services:       []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"stop", "snap.test-snap.foo.service"},
+		{"show", "--property=ActiveState", "snap.test-snap.foo.service"},
+		{"disable", "snap.test-snap.foo.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestRestartServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "restart",
+		Services: []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"stop", "snap.test-snap.foo.service"},
+		{"show", "--property=ActiveState", "snap.test-snap.foo.service"},
+		{"start", "snap.test-snap.foo.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestReloadServices(c *C) {
+	st := s.state
+	st.Lock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "reload-or-restart",
+		Services: []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	st.Unlock()
+	defer s.se.Stop()
+	c.Assert(s.o.Settle(5*time.Second), IsNil)
+	st.Lock()
+
+	c.Assert(t.Status(), Equals, state.DoneStatus)
+	c.Check(s.sysctlArgs, DeepEquals, [][]string{
+		{"reload-or-restart", "snap.test-snap.foo.service"},
+	})
+}
+
+func (s *serviceControlSuite) TestConflict(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	s.mockTestSnap(c)
+
+	chg := st.NewChange("service-control", "...")
+	t := st.NewTask("service-control", "...")
+	cmd := &servicestate.ServiceAction{
+		SnapName: "test-snap",
+		Action:   "reload-or-restart",
+		Services: []string{"foo"},
+	}
+	t.Set("service-action", cmd)
+	chg.AddTask(t)
+
+	_, err := snapstate.Remove(st, "test-snap", snap.Revision{}, nil)
+	c.Assert(err, ErrorMatches, `snap "test-snap" has "service-control" change in progress`)
+}
+
+func (s *serviceControlSuite) TestUpdateSnapstateServices(c *C) {
+	var tests = []struct {
+		enable                    []string
+		disable                   []string
+		expectedSnapstateEnabled  []string
+		expectedSnapstateDisabled []string
+		changed                   bool
+	}{
+		// These test scenarios share a single SnapState instance and accumulate
+		// changes to ServicesEnabledByHooks and ServicesDisabledByHooks.
+		{
+			changed: false,
+		},
+		{
+			enable: []string{"a"},
+			expectedSnapstateEnabled: []string{"a"},
+			changed:                  true,
+		},
+		// enable again does nothing
+		{
+			enable: []string{"a"},
+			expectedSnapstateEnabled: []string{"a"},
+			changed:                  false,
+		},
+		{
+			disable:                   []string{"a"},
+			expectedSnapstateDisabled: []string{"a"},
+			changed:                   true,
+		},
+		{
+			enable: []string{"a", "c"},
+			expectedSnapstateEnabled: []string{"a", "c"},
+			changed:                  true,
+		},
+		{
+			disable:                   []string{"b"},
+			expectedSnapstateEnabled:  []string{"a", "c"},
+			expectedSnapstateDisabled: []string{"b"},
+			changed:                   true,
+		},
+		{
+			disable:                   []string{"b", "c"},
+			expectedSnapstateEnabled:  []string{"a"},
+			expectedSnapstateDisabled: []string{"b", "c"},
+			changed:                   true,
+		},
+	}
+
+	snapst := snapstate.SnapState{}
+
+	for _, tst := range tests {
+		var enable, disable []*snap.AppInfo
+		for _, srv := range tst.enable {
+			enable = append(enable, &snap.AppInfo{Name: srv})
+		}
+		for _, srv := range tst.disable {
+			disable = append(disable, &snap.AppInfo{Name: srv})
+		}
+		result, err := servicestate.UpdateSnapstateServices(&snapst, enable, disable)
+		c.Assert(err, IsNil)
+		c.Check(result, Equals, tst.changed)
+		c.Check(snapst.ServicesEnabledByHooks, DeepEquals, tst.expectedSnapstateEnabled)
+		c.Check(snapst.ServicesDisabledByHooks, DeepEquals, tst.expectedSnapstateDisabled)
+	}
+
+	services := []*snap.AppInfo{{Name: "foo"}}
+	_, err := servicestate.UpdateSnapstateServices(nil, services, services)
+	c.Assert(err, ErrorMatches, `internal error: cannot handle enabled and disabled services at the same time`)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/servicemgr.go snapd-2.48.3+20.04/overlord/servicestate/servicemgr.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/servicemgr.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/servicemgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,61 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package servicestate
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+)
+
+// ServiceManager is responsible for starting and stopping snap services.
+type ServiceManager struct {
+	state *state.State
+}
+
+// Manager returns a new service manager.
+func Manager(st *state.State, runner *state.TaskRunner) *ServiceManager {
+	delayedCrossMgrInit()
+	m := &ServiceManager{
+		state: st,
+	}
+	// TODO: undo handler
+	runner.AddHandler("service-control", m.doServiceControl, nil)
+	return m
+}
+
+// Ensure implements StateManager.Ensure.
+func (m *ServiceManager) Ensure() error {
+	return nil
+}
+
+func delayedCrossMgrInit() {
+	// hook into conflict checks mechanisms
+	snapstate.AddAffectedSnapsByAttr("service-action", serviceControlAffectedSnaps)
+}
+
+func serviceControlAffectedSnaps(t *state.Task) ([]string, error) {
+	var serviceAction ServiceAction
+	if err := t.Get("service-action", &serviceAction); err != nil {
+		return nil, fmt.Errorf("internal error: cannot obtain service action from task: %s", t.Summary())
+	}
+	return []string{serviceAction.SnapName}, nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/servicestate.go snapd-2.48.3+20.04/overlord/servicestate/servicestate.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/servicestate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/servicestate.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015-2016 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -21,6 +21,7 @@
 
 import (
 	"fmt"
+	"path/filepath"
 	"time"
 
 	"github.com/snapcore/snapd/client"
@@ -29,6 +30,7 @@
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/systemd"
 )
 
 type Instruction struct {
@@ -119,3 +121,82 @@
 
 	return tts, nil
 }
+
+// StatusDecorator supports decorating client.AppInfos with service status.
+type StatusDecorator struct {
+	sysd systemd.Systemd
+}
+
+// NewStatusDecorator returns a new StatusDecorator.
+func NewStatusDecorator(rep interface {
+	Notify(string)
+}) *StatusDecorator {
+	return &StatusDecorator{
+		sysd: systemd.New(systemd.SystemMode, rep),
+	}
+}
+
+// DecorateWithStatus adds service status information to the given
+// client.AppInfo associated with the given snap.AppInfo.
+// If the snap is inactive or the app is not service it does nothing.
+func (sd *StatusDecorator) DecorateWithStatus(appInfo *client.AppInfo, snapApp *snap.AppInfo) error {
+	if appInfo.Snap != snapApp.Snap.InstanceName() || appInfo.Name != snapApp.Name {
+		return fmt.Errorf("internal error: misassociated app info %v and client app info %s.%s", snapApp, appInfo.Snap, appInfo.Name)
+	}
+	if !snapApp.Snap.IsActive() || !snapApp.IsService() {
+		// nothing to do
+		return nil
+	}
+
+	// collect all services for a single call to systemctl
+	extra := len(snapApp.Sockets)
+	if snapApp.Timer != nil {
+		extra++
+	}
+	serviceNames := make([]string, 0, 1+extra)
+	serviceNames = append(serviceNames, snapApp.ServiceName())
+
+	sockSvcFileToName := make(map[string]string, len(snapApp.Sockets))
+	for _, sock := range snapApp.Sockets {
+		sockUnit := filepath.Base(sock.File())
+		sockSvcFileToName[sockUnit] = sock.Name
+		serviceNames = append(serviceNames, sockUnit)
+	}
+	if snapApp.Timer != nil {
+		timerUnit := filepath.Base(snapApp.Timer.File())
+		serviceNames = append(serviceNames, timerUnit)
+	}
+
+	// sysd.Status() makes sure that we get only the units we asked
+	// for and raises an error otherwise
+	sts, err := sd.sysd.Status(serviceNames...)
+	if err != nil {
+		return fmt.Errorf("cannot get status of services of app %q: %v", appInfo.Name, err)
+	}
+	if len(sts) != len(serviceNames) {
+		return fmt.Errorf("cannot get status of services of app %q: expected %d results, got %d", appInfo.Name, len(serviceNames), len(sts))
+	}
+	for _, st := range sts {
+		switch filepath.Ext(st.UnitName) {
+		case ".service":
+			appInfo.Enabled = st.Enabled
+			appInfo.Active = st.Active
+		case ".timer":
+			appInfo.Activators = append(appInfo.Activators, client.AppActivator{
+				Name:    snapApp.Name,
+				Enabled: st.Enabled,
+				Active:  st.Active,
+				Type:    "timer",
+			})
+		case ".socket":
+			appInfo.Activators = append(appInfo.Activators, client.AppActivator{
+				Name:    sockSvcFileToName[st.UnitName],
+				Enabled: st.Enabled,
+				Active:  st.Active,
+				Type:    "socket",
+			})
+		}
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/servicestate/servicestate_test.go snapd-2.48.3+20.04/overlord/servicestate/servicestate_test.go
--- snapd-2.45.1+20.04.2/overlord/servicestate/servicestate_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/servicestate/servicestate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,165 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2015-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package servicestate_test
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/overlord/servicestate"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/systemd"
+)
+
+type statusDecoratorSuite struct{}
+
+var _ = Suite(&statusDecoratorSuite{})
+
+func (s *statusDecoratorSuite) TestDecorateWithStatus(c *C) {
+	dirs.SetRootDir(c.MkDir())
+	defer dirs.SetRootDir("")
+	snp := &snap.Info{
+		SideInfo: snap.SideInfo{
+			RealName: "foo",
+			Revision: snap.R(1),
+		},
+	}
+	err := os.MkdirAll(snp.MountDir(), 0755)
+	c.Assert(err, IsNil)
+	err = os.Symlink(snp.Revision.String(), filepath.Join(filepath.Dir(snp.MountDir()), "current"))
+	c.Assert(err, IsNil)
+
+	disabled := false
+	r := systemd.MockSystemctl(func(args ...string) (buf []byte, err error) {
+		c.Assert(args[0], Equals, "show")
+		unit := args[2]
+		activeState, unitState := "active", "enabled"
+		if disabled {
+			activeState = "inactive"
+			unitState = "disabled"
+		}
+		if strings.HasSuffix(unit, ".timer") || strings.HasSuffix(unit, ".socket") {
+			return []byte(fmt.Sprintf(`Id=%s
+ActiveState=%s
+UnitFileState=%s
+`, args[2], activeState, unitState)), nil
+		} else {
+			return []byte(fmt.Sprintf(`Id=%s
+Type=simple
+ActiveState=%s
+UnitFileState=%s
+`, args[2], activeState, unitState)), nil
+		}
+	})
+	defer r()
+
+	sd := servicestate.NewStatusDecorator(nil)
+
+	// not a service
+	app := &client.AppInfo{
+		Snap: "foo",
+		Name: "app",
+	}
+	snapApp := &snap.AppInfo{Snap: snp, Name: "app"}
+
+	err = sd.DecorateWithStatus(app, snapApp)
+	c.Assert(err, IsNil)
+
+	for _, enabled := range []bool{true, false} {
+		disabled = !enabled
+
+		// service only
+		app = &client.AppInfo{
+			Snap:   snp.InstanceName(),
+			Name:   "svc",
+			Daemon: "simple",
+		}
+		snapApp = &snap.AppInfo{
+			Snap:   snp,
+			Name:   "svc",
+			Daemon: "simple",
+		}
+
+		err = sd.DecorateWithStatus(app, snapApp)
+		c.Assert(err, IsNil)
+		c.Check(app.Active, Equals, enabled)
+		c.Check(app.Enabled, Equals, enabled)
+
+		// service  + timer
+		app = &client.AppInfo{
+			Snap:   snp.InstanceName(),
+			Name:   "svc",
+			Daemon: "simple",
+		}
+		snapApp = &snap.AppInfo{
+			Snap:        snp,
+			Name:        "svc",
+			Daemon:      "simple",
+			DaemonScope: snap.SystemDaemon,
+		}
+		snapApp.Timer = &snap.TimerInfo{
+			App:   snapApp,
+			Timer: "10:00",
+		}
+
+		err = sd.DecorateWithStatus(app, snapApp)
+		c.Assert(err, IsNil)
+		c.Check(app.Active, Equals, enabled)
+		c.Check(app.Enabled, Equals, enabled)
+		c.Check(app.Activators, DeepEquals, []client.AppActivator{
+			{Name: "svc", Type: "timer", Active: enabled, Enabled: enabled},
+		})
+
+		// service with socket
+		app = &client.AppInfo{
+			Snap:   snp.InstanceName(),
+			Name:   "svc",
+			Daemon: "simple",
+		}
+		snapApp = &snap.AppInfo{
+			Snap:        snp,
+			Name:        "svc",
+			Daemon:      "simple",
+			DaemonScope: snap.SystemDaemon,
+		}
+		snapApp.Sockets = map[string]*snap.SocketInfo{
+			"socket1": {
+				App:          snapApp,
+				Name:         "socket1",
+				ListenStream: "a.socket",
+			},
+		}
+
+		err = sd.DecorateWithStatus(app, snapApp)
+		c.Assert(err, IsNil)
+		c.Check(app.Active, Equals, enabled)
+		c.Check(app.Enabled, Equals, enabled)
+		c.Check(app.Activators, DeepEquals, []client.AppActivator{
+			{Name: "socket1", Type: "socket", Active: enabled, Enabled: enabled},
+		})
+
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/backend.go snapd-2.48.3+20.04/overlord/snapshotstate/backend/backend.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/backend/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,16 +20,24 @@
 package backend
 
 import (
+	"archive/tar"
 	"archive/zip"
+	"bytes"
 	"context"
 	"crypto"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
+	"path"
 	"path/filepath"
+	"runtime"
 	"sort"
+	"strconv"
+	"strings"
+	"syscall"
 	"time"
 
 	"github.com/snapcore/snapd/client"
@@ -57,6 +65,9 @@
 	osOpen      = os.Open
 	dirNames    = (*os.File).Readdirnames
 	backendOpen = Open
+	timeNow     = time.Now
+
+	usersForUsernames = usersForUsernamesImpl
 )
 
 // Flags encompasses extra flags for snapshots backend Save.
@@ -64,6 +75,40 @@
 	Auto bool
 }
 
+// LastSnapshotSetID returns the highest set id number for the snapshots stored
+// in snapshots directory; set ids are inferred from the filenames.
+func LastSnapshotSetID() (uint64, error) {
+	dir, err := osOpen(dirs.SnapshotsDir)
+	if err != nil {
+		if osutil.IsDirNotExist(err) {
+			// no snapshots
+			return 0, nil
+		}
+		return 0, fmt.Errorf("cannot open snapshots directory: %v", err)
+	}
+	defer dir.Close()
+
+	var maxSetID uint64
+
+	var readErr error
+	for readErr == nil {
+		var names []string
+		// note os.Readdirnames can return a non-empty names and a non-nil err
+		names, readErr = dirNames(dir, 100)
+		for _, name := range names {
+			if ok, setID := isSnapshotFilename(name); ok {
+				if setID > maxSetID {
+					maxSetID = setID
+				}
+			}
+		}
+	}
+	if readErr != nil && readErr != io.EOF {
+		return 0, readErr
+	}
+	return maxSetID, nil
+}
+
 // Iter loops over all snapshots in the snapshots directory, applying the given
 // function to each. The snapshot will be closed after the function returns. If
 // the function returns an error, iteration is stopped (and if the error isn't
@@ -83,6 +128,7 @@
 	}
 	defer dir.Close()
 
+	importsInProgress := map[uint64]bool{}
 	var names []string
 	var readErr error
 	for readErr == nil && err == nil {
@@ -93,8 +139,36 @@
 				break
 			}
 
+			// filter out non-snapshot directory entries
+			ok, setID := isSnapshotFilename(name)
+			if !ok {
+				continue
+			}
+			// keep track of in-progress in a map as well
+			// to avoid races. E.g.:
+			// 1. The dirNnames() are read
+			// 2. 99_some-snap_1.0_x1.zip is returned
+			// 3. the code checks if 99_importing is there,
+			//    it is so 99_some-snap is skipped
+			// 4. other snapshots are examined
+			// 5. in-parallel 99_importing finishes
+			// 7. 99_other-snap_1.0_x1.zip is now examined
+			// 8. code checks if 99_importing is there, but it
+			//    is no longer there because import
+			//    finished in the meantime. We still
+			//    want to not call the callback with
+			//    99_other-snap or the callback would get
+			//    an incomplete view about 99_snapshot.
+			if importsInProgress[setID] {
+				continue
+			}
+			if importInProgressFor(setID) {
+				importsInProgress[setID] = true
+				continue
+			}
+
 			filename := filepath.Join(dirs.SnapshotsDir, name)
-			reader, openError := backendOpen(filename)
+			reader, openError := backendOpen(filename, setID)
 			// reader can be non-nil even when openError is not nil (in
 			// which case reader.Broken will have a reason). f can
 			// check and either ignore or return an error when
@@ -157,6 +231,80 @@
 	return filepath.Join(dirs.SnapshotsDir, fmt.Sprintf("%d_%s_%s_%s.zip", snapshot.SetID, snapshot.Snap, snapshot.Version, snapshot.Revision))
 }
 
+// isSnapshotFilename checks if the given filePath is a snapshot file name, i.e.
+// if it starts with a numeric set id and ends with .zip extension;
+// filePath can be just a file name, or a full path.
+func isSnapshotFilename(filePath string) (ok bool, setID uint64) {
+	fname := filepath.Base(filePath)
+	// XXX: we could use a regexp here to match very precisely all the elements
+	// of the filename following Filename() above, but perhaps it's better no to
+	// go overboard with it in case the format evolves in the future. Only check
+	// if the name starts with a set-id and ends with .zip.
+	//
+	// Filename is "<sid>_<snapName>_version_revision.zip", e.g. "16_snapcraft_4.2_5407.zip"
+	ext := filepath.Ext(fname)
+	if ext != ".zip" {
+		return false, 0
+	}
+	parts := strings.SplitN(fname, "_", 2)
+	if len(parts) != 2 {
+		return false, 0
+	}
+	// invalid: no parts following <sid>_
+	if parts[1] == ext {
+		return false, 0
+	}
+	id, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return false, 0
+	}
+	return true, uint64(id)
+}
+
+// EstimateSnapshotSize calculates estimated size of the snapshot.
+func EstimateSnapshotSize(si *snap.Info, usernames []string) (uint64, error) {
+	var total uint64
+	calculateSize := func(path string, finfo os.FileInfo, err error) error {
+		if finfo.Mode().IsRegular() {
+			total += uint64(finfo.Size())
+		}
+		return err
+	}
+
+	visitDir := func(dir string) error {
+		exists, isDir, err := osutil.DirExists(dir)
+		if err != nil {
+			return err
+		}
+		if !(exists && isDir) {
+			return nil
+		}
+		return filepath.Walk(dir, calculateSize)
+	}
+
+	for _, dir := range []string{si.DataDir(), si.CommonDataDir()} {
+		if err := visitDir(dir); err != nil {
+			return 0, err
+		}
+	}
+
+	users, err := usersForUsernames(usernames)
+	if err != nil {
+		return 0, err
+	}
+	for _, usr := range users {
+		if err := visitDir(si.UserDataDir(usr.HomeDir)); err != nil {
+			return 0, err
+		}
+		if err := visitDir(si.UserCommonDataDir(usr.HomeDir)); err != nil {
+			return 0, err
+		}
+	}
+
+	// XXX: we could use a typical compression factor here
+	return total, nil
+}
+
 // Save a snapshot
 func Save(ctx context.Context, id uint64, si *snap.Info, cfg map[string]interface{}, usernames []string, flags *Flags) (*client.Snapshot, error) {
 	if err := os.MkdirAll(dirs.SnapshotsDir, 0700); err != nil {
@@ -175,7 +323,7 @@
 		Revision: si.Revision,
 		Version:  si.Version,
 		Epoch:    si.Epoch,
-		Time:     time.Now(),
+		Time:     timeNow(),
 		SHA3_384: make(map[string]string),
 		Size:     0,
 		Conf:     cfg,
@@ -256,6 +404,7 @@
 	tarArgs := []string{
 		"--create",
 		"--sparse", "--gzip",
+		"--format", "gnu",
 		"--directory", parent,
 	}
 
@@ -299,7 +448,7 @@
 		return err
 	}
 
-	var sz sizer
+	var sz osutil.Sizer
 	hasher := crypto.SHA3_384.New()
 
 	cmd := tarAsUser(username, tarArgs...)
@@ -319,7 +468,346 @@
 	}
 
 	snapshot.SHA3_384[entry] = fmt.Sprintf("%x", hasher.Sum(nil))
-	snapshot.Size += sz.size
+	snapshot.Size += sz.Size()
+
+	return nil
+}
+
+var ErrCannotCancel = errors.New("cannot cancel: import already finished")
+
+// importTransaction keeps track of the given snapshot ID import and
+// ensures it can be committed/cancelled in an atomic way.
+//
+// Start() must be called before the first data is imported. When the
+// import is successful Commit() should be called.
+//
+// Cancel() will cancel the given import and cleanup. It's always safe
+// to defer a Cancel() it will just return a "ErrCannotCancel" after
+// a commit.
+type importTransaction struct {
+	id        uint64
+	committed bool
+}
+
+func newImportTransaction(setID uint64) *importTransaction {
+	return &importTransaction{id: setID}
+}
+
+func (t *importTransaction) importInProgressFilesGlob() string {
+	return filepath.Join(dirs.SnapshotsDir, fmt.Sprintf("%d_*.zip", t.id))
+}
+
+// Start marks the start of a snapshot import
+func (t *importTransaction) Start() error {
+	return ioutil.WriteFile(importInProgressFilepath(t.id), nil, 0644)
+}
+
+// InProgress returns true if there is an import for this transactions
+// snapshot ID already.
+func (t *importTransaction) InProgress() bool {
+	return osutil.FileExists(importInProgressFilepath(t.id))
+}
+
+func importInProgressFilepath(setID uint64) string {
+	return filepath.Join(dirs.SnapshotsDir, fmt.Sprintf("%d_importing", setID))
+}
+
+func importInProgressFor(setID uint64) bool {
+	return osutil.FileExists(importInProgressFilepath(setID))
+}
+
+// Cancel cancels a snapshot import and cleanups any files on disk belonging
+// to this snapshot ID.
+func (t *importTransaction) Cancel() error {
+	if t.committed {
+		return ErrCannotCancel
+	}
+	inProgressImports, err := filepath.Glob(t.importInProgressFilesGlob())
+	if err != nil {
+		return err
+	}
+	var errs []error
+	for _, p := range inProgressImports {
+		if err := os.Remove(p); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	if len(errs) > 0 {
+		buf := bytes.NewBuffer(nil)
+		for _, err := range errs {
+			fmt.Fprintf(buf, " - %v\n", err)
+		}
+		return fmt.Errorf("cannot cancel import for set id %d:\n%s", t.id, buf.String())
+	}
+	return nil
+}
+
+// Commit will commit a given transaction
+func (t *importTransaction) Commit() error {
+	if err := os.Remove(importInProgressFilepath(t.id)); err != nil {
+		return err
+	}
+	t.committed = true
+	return nil
+}
+
+// Import a snapshot from the export file format
+func Import(ctx context.Context, id uint64, r io.Reader) (snapNames []string, err error) {
+	errPrefix := fmt.Sprintf("cannot import snapshot %d", id)
+
+	tr := newImportTransaction(id)
+	if tr.InProgress() {
+		return nil, fmt.Errorf("%s: already in progress for this set id", errPrefix)
+	}
+	if err := tr.Start(); err != nil {
+		return nil, err
+	}
+	// Cancel once Committed is a NOP
+	defer tr.Cancel()
+
+	// Unpack and validate the streamed data
+	snapNames, err = unpackVerifySnapshotImport(r, id)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %v", errPrefix, err)
+	}
+	if err := tr.Commit(); err != nil {
+		return nil, err
+	}
+
+	return snapNames, nil
+}
+
+func writeOneSnapshotFile(targetPath string, tr io.Reader) error {
+	t, err := os.OpenFile(targetPath, os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return fmt.Errorf("cannot create snapshot file %q: %v", targetPath, err)
+	}
+	defer t.Close()
+
+	if _, err := io.Copy(t, tr); err != nil {
+		return fmt.Errorf("cannot write snapshot file %q: %v", targetPath, err)
+	}
+	return nil
+}
+
+func unpackVerifySnapshotImport(r io.Reader, realSetID uint64) (snapNames []string, err error) {
+	var exportFound bool
+
+	tr := tar.NewReader(r)
+	var tarErr error
+	var header *tar.Header
+
+	for tarErr == nil {
+		header, tarErr = tr.Next()
+		if tarErr == io.EOF {
+			break
+		}
+		switch {
+		case tarErr != nil:
+			return nil, fmt.Errorf("cannot read snapshot import: %v", tarErr)
+		case header == nil:
+			// should not happen
+			return nil, fmt.Errorf("tar header not found")
+		case header.Typeflag == tar.TypeDir:
+			return nil, errors.New("unexpected directory in import file")
+		}
+
+		if header.Name == "export.json" {
+			// XXX: read into memory and validate once we
+			// hashes in export.json
+			exportFound = true
+			continue
+		}
+
+		// Format of the snapshot import is:
+		//     $setID_.....
+		// But because the setID is local this will not be correct
+		// for our system and we need to discard this setID.
+		//
+		// So chop off the incorrect (old) setID and just use
+		// the rest that is still valid.
+		l := strings.SplitN(header.Name, "_", 2)
+		if len(l) != 2 {
+			return nil, fmt.Errorf("unexpected filename in import stream: %v", header.Name)
+		}
+		targetPath := path.Join(dirs.SnapshotsDir, fmt.Sprintf("%d_%s", realSetID, l[1]))
+		if err := writeOneSnapshotFile(targetPath, tr); err != nil {
+			return snapNames, err
+		}
+
+		r, err := backendOpen(targetPath, realSetID)
+		if err != nil {
+			return snapNames, fmt.Errorf("cannot open snapshot: %v", err)
+		}
+		err = r.Check(context.TODO(), nil)
+		r.Close()
+		snapNames = append(snapNames, r.Snap)
+		if err != nil {
+			return snapNames, fmt.Errorf("validation failed for %q: %v", targetPath, err)
+		}
+	}
+
+	if !exportFound {
+		return nil, fmt.Errorf("no export.json file in uploaded data")
+	}
+	// XXX: validate using the unmarshalled export.json hashes here
+
+	return snapNames, nil
+}
+
+type exportMetadata struct {
+	Format int       `json:"format"`
+	Date   time.Time `json:"date"`
+	Files  []string  `json:"files"`
+}
+
+type SnapshotExport struct {
+	// open snapshot files
+	snapshotFiles []*os.File
+
+	// remember setID mostly for nicer errors
+	setID uint64
+
+	// cached size, needs to be calculated with CalculateSize
+	size int64
+}
+
+// NewSnapshotExport will return a SnapshotExport structure. It must be
+// Close()ed after use to avoid leaking file descriptors.
+func NewSnapshotExport(ctx context.Context, setID uint64) (se *SnapshotExport, err error) {
+	var snapshotFiles []*os.File
+
+	defer func() {
+		// cleanup any open FDs if anything goes wrong
+		if err != nil {
+			for _, f := range snapshotFiles {
+				f.Close()
+			}
+		}
+	}()
+
+	// Open all files first and keep the file descriptors
+	// open. The caller should have locked the state so that no
+	// delete/change snapshot operations can happen while the
+	// files are getting opened.
+	err = Iter(ctx, func(reader *Reader) error {
+		if reader.SetID == setID {
+			// Duplicate the file descriptor of the reader we were handed as
+			// Iter() closes those as soon as this unnamed returns. We
+			// re-package the file descriptor into snapshotFiles below.
+			fd, err := syscall.Dup(int(reader.Fd()))
+			if err != nil {
+				return fmt.Errorf("cannot duplicate descriptor: %v", err)
+			}
+			f := os.NewFile(uintptr(fd), reader.Name())
+			if f == nil {
+				return fmt.Errorf("cannot open file from descriptor %d", fd)
+			}
+			snapshotFiles = append(snapshotFiles, f)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot export snapshot %v: %v", setID, err)
+	}
+	if len(snapshotFiles) == 0 {
+		return nil, fmt.Errorf("no snapshot data found for %v", setID)
+	}
+
+	se = &SnapshotExport{snapshotFiles: snapshotFiles, setID: setID}
+
+	// ensure we never leak FDs even if the user does not call close
+	runtime.SetFinalizer(se, (*SnapshotExport).Close)
+
+	return se, nil
+}
+
+// Init will calculate the snapshot size. This can take some time
+// so it should be called without any locks. The SnapshotExport
+// keeps the FDs open so even files moved/deleted will be found.
+func (se *SnapshotExport) Init() error {
+	// Export once into a dummy writer so that we can set the size
+	// of the export. This is then used to set the Content-Length
+	// in the response correctly.
+	//
+	// Note that the size of the generated tar could change if the
+	// time switches between this export and the export we stream
+	// to the client to a time after the year 2242. This is unlikely
+	// but a known issue with this approach here.
+	var sz osutil.Sizer
+	if err := se.StreamTo(&sz); err != nil {
+		return fmt.Errorf("cannot calculcate the size for %v: %s", se.setID, err)
+	}
+	se.size = sz.Size()
+	return nil
+}
+
+func (se *SnapshotExport) Size() int64 {
+	return se.size
+}
+
+func (se *SnapshotExport) Close() {
+	for _, f := range se.snapshotFiles {
+		f.Close()
+	}
+	se.snapshotFiles = nil
+}
+
+func (se *SnapshotExport) StreamTo(w io.Writer) error {
+	// write out a tar
+	var files []string
+	tw := tar.NewWriter(w)
+	defer tw.Close()
+	for _, snapshotFile := range se.snapshotFiles {
+		stat, err := snapshotFile.Stat()
+		if err != nil {
+			return err
+		}
+		if !stat.Mode().IsRegular() {
+			// should never happen
+			return fmt.Errorf("unexported special file %q in snapshot: %s", stat.Name(), stat.Mode())
+		}
+		if _, err := snapshotFile.Seek(0, 0); err != nil {
+			return fmt.Errorf("cannot seek on %v: %v", stat.Name(), err)
+		}
+		hdr, err := tar.FileInfoHeader(stat, "")
+		if err != nil {
+			return fmt.Errorf("symlink: %v", stat.Name())
+		}
+		if err = tw.WriteHeader(hdr); err != nil {
+			return fmt.Errorf("cannot write header for %v: %v", stat.Name(), err)
+		}
+		if _, err := io.Copy(tw, snapshotFile); err != nil {
+			return fmt.Errorf("cannot write data for %v: %v", stat.Name(), err)
+		}
+
+		files = append(files, path.Base(snapshotFile.Name()))
+	}
+
+	// write the metadata last, then the client can use that to
+	// validate the archive is complete
+	meta := exportMetadata{
+		Format: 1,
+		Date:   timeNow(),
+		Files:  files,
+	}
+	metaDataBuf, err := json.Marshal(&meta)
+	if err != nil {
+		return fmt.Errorf("cannot marshal meta-data: %v", err)
+	}
+	hdr := &tar.Header{
+		Typeflag: tar.TypeReg,
+		Name:     "export.json",
+		Size:     int64(len(metaDataBuf)),
+		Mode:     0640,
+		ModTime:  timeNow(),
+	}
+	if err := tw.WriteHeader(hdr); err != nil {
+		return err
+	}
+	if _, err := tw.Write(metaDataBuf); err != nil {
+		return err
+	}
 
 	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/backend_test.go snapd-2.48.3+20.04/overlord/snapshotstate/backend/backend_test.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/backend_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/backend/backend_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,9 +20,12 @@
 package backend_test
 
 import (
+	"archive/tar"
 	"archive/zip"
 	"bytes"
 	"context"
+	"crypto"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -30,16 +33,19 @@
 	"os"
 	"os/exec"
 	"os/user"
+	"path"
 	"path/filepath"
 	"sort"
 	"strings"
 	"testing"
+	"time"
 
 	"gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/sys"
 	"github.com/snapcore/snapd/overlord/snapshotstate/backend"
 	"github.com/snapcore/snapd/snap"
@@ -137,6 +143,59 @@
 	return keys
 }
 
+func (s *snapshotSuite) TestLastSnapshotID(c *check.C) {
+	// LastSnapshotSetID is happy without any snapshots
+	setID, err := backend.LastSnapshotSetID()
+	c.Assert(err, check.IsNil)
+	c.Check(setID, check.Equals, uint64(0))
+
+	// create snapshots dir and dummy snapshots
+	os.MkdirAll(dirs.SnapshotsDir, os.ModePerm)
+	for _, name := range []string{
+		"9_some-snap-1.zip", "1234_not-a-snapshot", "12_other-snap.zip", "3_foo.zip",
+	} {
+		c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapshotsDir, name), []byte{}, 0644), check.IsNil)
+	}
+	setID, err = backend.LastSnapshotSetID()
+	c.Assert(err, check.IsNil)
+	c.Check(setID, check.Equals, uint64(12))
+}
+
+func (s *snapshotSuite) TestLastSnapshotIDErrorOnDirNames(c *check.C) {
+	// we need snapshots dir, otherwise LastSnapshotSetID exits early.
+	c.Assert(os.MkdirAll(dirs.SnapshotsDir, os.ModePerm), check.IsNil)
+
+	defer backend.MockDirNames(func(*os.File, int) ([]string, error) {
+		return nil, fmt.Errorf("fail")
+	})()
+	setID, err := backend.LastSnapshotSetID()
+	c.Assert(err, check.ErrorMatches, "fail")
+	c.Check(setID, check.Equals, uint64(0))
+}
+
+func (s *snapshotSuite) TestIsSnapshotFilename(c *check.C) {
+	tests := []struct {
+		name  string
+		valid bool
+		setID uint64
+	}{
+		{"1_foo.zip", true, 1},
+		{"14_hello-world_6.4_29.zip", true, 14},
+		{"1_.zip", false, 0},
+		{"1_foo.zip.bak", false, 0},
+		{"foo_1_foo.zip", false, 0},
+		{"foo_bar_baz.zip", false, 0},
+		{"", false, 0},
+		{"1_", false, 0},
+	}
+
+	for _, t := range tests {
+		ok, setID := backend.IsSnapshotFilename(t.name)
+		c.Check(ok, check.Equals, t.valid, check.Commentf("fail: %s", t.name))
+		c.Check(setID, check.Equals, t.setID, check.Commentf("fail: %s", t.name))
+	}
+}
+
 func (s *snapshotSuite) TestIterBailsIfContextDone(c *check.C) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
@@ -165,7 +224,7 @@
 		return []string{"hello"}, nil
 	})()
 	triedToOpenSnapshot := false
-	defer backend.MockOpen(func(string) (*backend.Reader, error) {
+	defer backend.MockOpen(func(string, uint64) (*backend.Reader, error) {
 		triedToOpenSnapshot = true
 		return nil, nil
 	})()
@@ -216,10 +275,10 @@
 		if readNames > 1 {
 			return nil, io.EOF
 		}
-		return []string{"hello"}, nil
+		return []string{"1_hello.zip"}, nil
 	})()
 	triedToOpenSnapshot := false
-	defer backend.MockOpen(func(string) (*backend.Reader, error) {
+	defer backend.MockOpen(func(string, uint64) (*backend.Reader, error) {
 		triedToOpenSnapshot = true
 		return nil, os.ErrInvalid
 	})()
@@ -236,7 +295,7 @@
 	c.Check(triedToOpenDir, check.Equals, true)
 	c.Check(readNames, check.Equals, 2)
 	c.Check(triedToOpenSnapshot, check.Equals, true)
-	c.Check(logbuf.String(), check.Matches, `(?m).* Cannot open snapshot "hello": invalid argument.`)
+	c.Check(logbuf.String(), check.Matches, `(?m).* Cannot open snapshot "1_hello.zip": invalid argument.`)
 	c.Check(calledF, check.Equals, false)
 }
 
@@ -254,13 +313,14 @@
 		if readNames > 1 {
 			return nil, io.EOF
 		}
-		return []string{"hello"}, nil
+		return []string{"1_hello.zip"}, nil
 	})()
 	triedToOpenSnapshot := false
-	defer backend.MockOpen(func(string) (*backend.Reader, error) {
+	defer backend.MockOpen(func(string, uint64) (*backend.Reader, error) {
 		triedToOpenSnapshot = true
 		// NOTE non-nil reader, and error, returned
 		r := backend.Reader{}
+		r.SetID = 1
 		r.Broken = "xyzzy"
 		return &r, os.ErrInvalid
 	})()
@@ -296,10 +356,10 @@
 		if readNames > 1 {
 			return nil, io.EOF
 		}
-		return []string{"hello"}, nil
+		return []string{"42_hello.zip"}, nil
 	})()
 	triedToOpenSnapshot := false
-	defer backend.MockOpen(func(string) (*backend.Reader, error) {
+	defer backend.MockOpen(func(string, uint64) (*backend.Reader, error) {
 		triedToOpenSnapshot = true
 		r := backend.Reader{}
 		r.SetID = 42
@@ -323,10 +383,98 @@
 	c.Check(calledF, check.Equals, true)
 }
 
+func readerForFilename(fname string, c *check.C) *backend.Reader {
+	var snapname string
+	var id uint64
+	fn := strings.TrimSuffix(filepath.Base(fname), ".zip")
+	_, err := fmt.Sscanf(fn, "%d_%s", &id, &snapname)
+	c.Assert(err, check.IsNil, check.Commentf(fn))
+	f, err := os.Open(os.DevNull)
+	c.Assert(err, check.IsNil, check.Commentf(fn))
+	return &backend.Reader{
+		File: f,
+		Snapshot: client.Snapshot{
+			SetID: id,
+			Snap:  snapname,
+		},
+	}
+}
+
+func (s *snapshotSuite) TestIterIgnoresSnapshotsWithInvalidNames(c *check.C) {
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	defer backend.MockOsOpen(func(string) (*os.File, error) {
+		return new(os.File), nil
+	})()
+	readNames := 0
+	defer backend.MockDirNames(func(*os.File, int) ([]string, error) {
+		readNames++
+		if readNames > 1 {
+			return nil, io.EOF
+		}
+		return []string{
+			"_foo.zip",
+			"43_bar.zip",
+			"foo_bar.zip",
+			"bar.",
+		}, nil
+	})()
+	defer backend.MockOpen(func(fname string, setID uint64) (*backend.Reader, error) {
+		return readerForFilename(fname, c), nil
+	})()
+
+	var calledF int
+	f := func(snapshot *backend.Reader) error {
+		calledF++
+		c.Check(snapshot.SetID, check.Equals, uint64(43))
+		return nil
+	}
+
+	err := backend.Iter(context.Background(), f)
+	c.Check(err, check.IsNil)
+	c.Check(logbuf.String(), check.Equals, "")
+	c.Check(calledF, check.Equals, 1)
+}
+
+func (s *snapshotSuite) TestIterSetIDoverride(c *check.C) {
+	if os.Geteuid() == 0 {
+		c.Skip("this test cannot run as root (runuser will fail)")
+	}
+	logger.SimpleSetup()
+
+	epoch := snap.E("42*")
+	info := &snap.Info{SideInfo: snap.SideInfo{RealName: "hello-snap", Revision: snap.R(42), SnapID: "hello-id"}, Version: "v1.33", Epoch: epoch}
+	cfg := map[string]interface{}{"some-setting": false}
+
+	shw, err := backend.Save(context.TODO(), 12, info, cfg, []string{"snapuser"}, &backend.Flags{})
+	c.Assert(err, check.IsNil)
+	c.Check(shw.SetID, check.Equals, uint64(12))
+
+	snapshotPath := filepath.Join(dirs.SnapshotsDir, "12_hello-snap_v1.33_42.zip")
+	c.Check(backend.Filename(shw), check.Equals, snapshotPath)
+	c.Check(hashkeys(shw), check.DeepEquals, []string{"archive.tgz", "user/snapuser.tgz"})
+
+	// rename the snapshot, verify that set id from the filename is used by the reader.
+	c.Assert(os.Rename(snapshotPath, filepath.Join(dirs.SnapshotsDir, "33_hello.zip")), check.IsNil)
+
+	var calledF int
+	f := func(snapshot *backend.Reader) error {
+		calledF++
+		c.Check(snapshot.SetID, check.Equals, uint64(uint(33)))
+		c.Check(snapshot.Snap, check.Equals, "hello-snap")
+		return nil
+	}
+
+	c.Assert(backend.Iter(context.Background(), f), check.IsNil)
+	c.Check(calledF, check.Equals, 1)
+}
+
 func (s *snapshotSuite) TestList(c *check.C) {
 	logbuf, restore := logger.MockLogger()
 	defer restore()
 	defer backend.MockOsOpen(func(string) (*os.File, error) { return new(os.File), nil })()
+
 	readNames := 0
 	defer backend.MockDirNames(func(*os.File, int) ([]string, error) {
 		readNames++
@@ -334,15 +482,16 @@
 			return nil, io.EOF
 		}
 		return []string{
-			fmt.Sprintf("%d_foo", readNames),
-			fmt.Sprintf("%d_bar", readNames),
-			fmt.Sprintf("%d_baz", readNames),
+			fmt.Sprintf("%d_foo.zip", readNames),
+			fmt.Sprintf("%d_bar.zip", readNames),
+			fmt.Sprintf("%d_baz.zip", readNames),
 		}, nil
 	})()
-	defer backend.MockOpen(func(fn string) (*backend.Reader, error) {
+	defer backend.MockOpen(func(fn string, setID uint64) (*backend.Reader, error) {
 		var id uint64
 		var snapname string
-		fn = filepath.Base(fn)
+		c.Assert(strings.HasSuffix(fn, ".zip"), check.Equals, true)
+		fn = strings.TrimSuffix(filepath.Base(fn), ".zip")
 		_, err := fmt.Sscanf(fn, "%d_%s", &id, &snapname)
 		c.Assert(err, check.IsNil, check.Commentf(fn))
 		f, err := os.Open(os.DevNull)
@@ -508,7 +657,7 @@
 	c.Assert(shs, check.HasLen, 1)
 	c.Assert(shs[0].Snapshots, check.HasLen, 1)
 
-	shr, err := backend.Open(backend.Filename(shw))
+	shr, err := backend.Open(backend.Filename(shw), backend.ExtractFnameSetID)
 	c.Assert(err, check.IsNil)
 	defer shr.Close()
 
@@ -554,6 +703,30 @@
 	}
 }
 
+func (s *snapshotSuite) TestOpenSetIDoverride(c *check.C) {
+	if os.Geteuid() == 0 {
+		c.Skip("this test cannot run as root (runuser will fail)")
+	}
+	logger.SimpleSetup()
+
+	epoch := snap.E("42*")
+	info := &snap.Info{SideInfo: snap.SideInfo{RealName: "hello-snap", Revision: snap.R(42), SnapID: "hello-id"}, Version: "v1.33", Epoch: epoch}
+	cfg := map[string]interface{}{"some-setting": false}
+
+	shw, err := backend.Save(context.TODO(), 12, info, cfg, []string{"snapuser"}, &backend.Flags{})
+	c.Assert(err, check.IsNil)
+	c.Check(shw.SetID, check.Equals, uint64(12))
+
+	c.Check(backend.Filename(shw), check.Equals, filepath.Join(dirs.SnapshotsDir, "12_hello-snap_v1.33_42.zip"))
+	c.Check(hashkeys(shw), check.DeepEquals, []string{"archive.tgz", "user/snapuser.tgz"})
+
+	shr, err := backend.Open(backend.Filename(shw), 99)
+	c.Assert(err, check.IsNil)
+	defer shr.Close()
+
+	c.Check(shr.SetID, check.Equals, uint64(99))
+}
+
 func (s *snapshotSuite) TestRestoreRoundtripDifferentRevision(c *check.C) {
 	if os.Geteuid() == 0 {
 		c.Skip("this test cannot run as root (runuser will fail)")
@@ -568,7 +741,7 @@
 	c.Assert(err, check.IsNil)
 	c.Check(shw.Revision, check.Equals, info.Revision)
 
-	shr, err := backend.Open(backend.Filename(shw))
+	shr, err := backend.Open(backend.Filename(shw), backend.ExtractFnameSetID)
 	c.Assert(err, check.IsNil)
 	defer shr.Close()
 
@@ -718,3 +891,464 @@
 	})
 	c.Check(strings.TrimSpace(logbuf.String()), check.Matches, ".* No user wrapper found.*")
 }
+
+func (s *snapshotSuite) TestImport(c *check.C) {
+	tempdir := c.MkDir()
+
+	// create snapshot export file
+	tarFile1 := path.Join(tempdir, "exported1.snapshot")
+	err := createTestExportFile(tarFile1, &createTestExportFlags{exportJSON: true})
+	c.Check(err, check.IsNil)
+
+	// create an exported snapshot with missing export.json
+	tarFile2 := path.Join(tempdir, "exported2.snapshot")
+	err = createTestExportFile(tarFile2, &createTestExportFlags{})
+	c.Check(err, check.IsNil)
+
+	// create invalid exported file
+	tarFile3 := path.Join(tempdir, "exported3.snapshot")
+	err = ioutil.WriteFile(tarFile3, []byte("invalid"), 0755)
+	c.Check(err, check.IsNil)
+
+	// create an exported snapshot with a directory
+	tarFile4 := path.Join(tempdir, "exported4.snapshot")
+	flags := &createTestExportFlags{
+		exportJSON: true,
+		withDir:    true,
+	}
+	err = createTestExportFile(tarFile4, flags)
+	c.Check(err, check.IsNil)
+
+	type tableT struct {
+		setID      uint64
+		filename   string
+		inProgress bool
+		error      string
+	}
+
+	table := []tableT{
+		{14, tarFile1, false, ""},
+		{14, tarFile2, false, "cannot import snapshot 14: no export.json file in uploaded data"},
+		{14, tarFile3, false, "cannot import snapshot 14: cannot read snapshot import: unexpected EOF"},
+		{14, tarFile4, false, "cannot import snapshot 14: unexpected directory in import file"},
+		{14, tarFile1, true, "cannot import snapshot 14: already in progress for this set id"},
+	}
+
+	for i, t := range table {
+		comm := check.Commentf("%d: %d %s", i, t.setID, t.filename)
+
+		// reset
+		err = os.RemoveAll(dirs.SnapshotsDir)
+		c.Assert(err, check.IsNil, comm)
+		err := os.MkdirAll(dirs.SnapshotsDir, 0700)
+		c.Assert(err, check.IsNil, comm)
+		importingFile := filepath.Join(dirs.SnapshotsDir, fmt.Sprintf("%d_importing", t.setID))
+		if t.inProgress {
+			err = ioutil.WriteFile(importingFile, nil, 0644)
+			c.Assert(err, check.IsNil, comm)
+		} else {
+			err = os.RemoveAll(importingFile)
+			c.Assert(err, check.IsNil, comm)
+		}
+
+		f, err := os.Open(t.filename)
+		c.Assert(err, check.IsNil, comm)
+		defer f.Close()
+
+		snapNames, err := backend.Import(context.Background(), t.setID, f)
+		if t.error != "" {
+			c.Check(err, check.ErrorMatches, t.error, comm)
+			continue
+		}
+		c.Check(err, check.IsNil, comm)
+		sort.Strings(snapNames)
+		c.Check(snapNames, check.DeepEquals, []string{"bar", "baz", "foo"})
+
+		dir, err := os.Open(dirs.SnapshotsDir)
+		c.Assert(err, check.IsNil, comm)
+		defer dir.Close()
+		names, err := dir.Readdirnames(100)
+		c.Assert(err, check.IsNil, comm)
+		c.Check(len(names), check.Equals, 3, comm)
+	}
+}
+
+func (s *snapshotSuite) TestImportCheckErorr(c *check.C) {
+	err := os.MkdirAll(dirs.SnapshotsDir, 0755)
+	c.Assert(err, check.IsNil)
+
+	// create snapshot export file
+	tarFile1 := path.Join(c.MkDir(), "exported1.snapshot")
+	flags := &createTestExportFlags{
+		exportJSON:      true,
+		corruptChecksum: true,
+	}
+	err = createTestExportFile(tarFile1, flags)
+	c.Assert(err, check.IsNil)
+
+	f, err := os.Open(tarFile1)
+	c.Assert(err, check.IsNil)
+	_, err = backend.Import(context.Background(), 14, f)
+	c.Assert(err, check.ErrorMatches, `cannot import snapshot 14: validation failed for .+/14_foo_1.0_199.zip": snapshot entry "archive.tgz" expected hash \(d5ef563…\) does not match actual \(6655519…\)`)
+}
+
+func (s *snapshotSuite) TestImportExportRoundtrip(c *check.C) {
+	err := os.MkdirAll(dirs.SnapshotsDir, 0755)
+	c.Assert(err, check.IsNil)
+
+	ctx := context.TODO()
+
+	epoch := snap.E("42*")
+	info := &snap.Info{SideInfo: snap.SideInfo{RealName: "hello-snap", Revision: snap.R(42), SnapID: "hello-id"}, Version: "v1.33", Epoch: epoch}
+	cfg := map[string]interface{}{"some-setting": false}
+	shID := uint64(12)
+
+	shw, err := backend.Save(ctx, shID, info, cfg, []string{"snapuser"}, &backend.Flags{})
+	c.Assert(err, check.IsNil)
+	c.Check(shw.SetID, check.Equals, shID)
+
+	c.Check(backend.Filename(shw), check.Equals, filepath.Join(dirs.SnapshotsDir, "12_hello-snap_v1.33_42.zip"))
+	c.Check(hashkeys(shw), check.DeepEquals, []string{"archive.tgz", "user/snapuser.tgz"})
+
+	export, err := backend.NewSnapshotExport(ctx, shw.SetID)
+	c.Assert(err, check.IsNil)
+	c.Assert(export.Init(), check.IsNil)
+
+	buf := bytes.NewBuffer(nil)
+	c.Assert(export.StreamTo(buf), check.IsNil)
+	c.Check(buf.Len(), check.Equals, int(export.Size()))
+
+	// now import it
+	c.Assert(os.Remove(filepath.Join(dirs.SnapshotsDir, "12_hello-snap_v1.33_42.zip")), check.IsNil)
+
+	names, err := backend.Import(ctx, 123, buf)
+	c.Assert(err, check.IsNil)
+	c.Check(names, check.DeepEquals, []string{"hello-snap"})
+
+	sets, err := backend.List(ctx, 0, nil)
+	c.Assert(err, check.IsNil)
+	c.Assert(sets, check.HasLen, 1)
+	c.Check(sets[0].ID, check.Equals, uint64(123))
+
+	rdr, err := backend.Open(filepath.Join(dirs.SnapshotsDir, "123_hello-snap_v1.33_42.zip"), backend.ExtractFnameSetID)
+	defer rdr.Close()
+	c.Check(err, check.IsNil)
+	c.Check(rdr.SetID, check.Equals, uint64(123))
+	c.Check(rdr.Snap, check.Equals, "hello-snap")
+	c.Check(rdr.IsValid(), check.Equals, true)
+}
+
+func (s *snapshotSuite) TestEstimateSnapshotSize(c *check.C) {
+	restore := backend.MockUsersForUsernames(func(usernames []string) ([]*user.User, error) {
+		return []*user.User{{HomeDir: filepath.Join(s.root, "home/user1")}}, nil
+	})
+	defer restore()
+
+	var info = &snap.Info{
+		SuggestedName: "foo",
+		SideInfo: snap.SideInfo{
+			Revision: snap.R(7),
+		},
+	}
+
+	snapData := []string{
+		"/var/snap/foo/7/somedatadir",
+		"/var/snap/foo/7/otherdata",
+		"/var/snap/foo/7",
+		"/var/snap/foo/common",
+		"/var/snap/foo/common/a",
+		"/home/user1/snap/foo/7/somedata",
+		"/home/user1/snap/foo/common",
+	}
+	var data []byte
+	var expected int
+	for _, d := range snapData {
+		data = append(data, 0)
+		expected += len(data)
+		c.Assert(os.MkdirAll(filepath.Join(s.root, d), 0755), check.IsNil)
+		c.Assert(ioutil.WriteFile(filepath.Join(s.root, d, "somfile"), data, 0644), check.IsNil)
+	}
+
+	sz, err := backend.EstimateSnapshotSize(info, nil)
+	c.Assert(err, check.IsNil)
+	c.Check(sz, check.Equals, uint64(expected))
+}
+
+func (s *snapshotSuite) TestEstimateSnapshotSizeEmpty(c *check.C) {
+	restore := backend.MockUsersForUsernames(func(usernames []string) ([]*user.User, error) {
+		return []*user.User{{HomeDir: filepath.Join(s.root, "home/user1")}}, nil
+	})
+	defer restore()
+
+	var info = &snap.Info{
+		SuggestedName: "foo",
+		SideInfo: snap.SideInfo{
+			Revision: snap.R(7),
+		},
+	}
+
+	snapData := []string{
+		"/var/snap/foo/common",
+		"/var/snap/foo/7",
+		"/home/user1/snap/foo/7",
+		"/home/user1/snap/foo/common",
+	}
+	for _, d := range snapData {
+		c.Assert(os.MkdirAll(filepath.Join(s.root, d), 0755), check.IsNil)
+	}
+
+	sz, err := backend.EstimateSnapshotSize(info, nil)
+	c.Assert(err, check.IsNil)
+	c.Check(sz, check.Equals, uint64(0))
+}
+
+func (s *snapshotSuite) TestEstimateSnapshotPassesUsernames(c *check.C) {
+	var gotUsernames []string
+	restore := backend.MockUsersForUsernames(func(usernames []string) ([]*user.User, error) {
+		gotUsernames = usernames
+		return nil, nil
+	})
+	defer restore()
+
+	var info = &snap.Info{
+		SuggestedName: "foo",
+		SideInfo: snap.SideInfo{
+			Revision: snap.R(7),
+		},
+	}
+
+	_, err := backend.EstimateSnapshotSize(info, []string{"user1", "user2"})
+	c.Assert(err, check.IsNil)
+	c.Check(gotUsernames, check.DeepEquals, []string{"user1", "user2"})
+}
+
+func (s *snapshotSuite) TestEstimateSnapshotSizeNotDataDirs(c *check.C) {
+	restore := backend.MockUsersForUsernames(func(usernames []string) ([]*user.User, error) {
+		return []*user.User{{HomeDir: filepath.Join(s.root, "home/user1")}}, nil
+	})
+	defer restore()
+
+	var info = &snap.Info{
+		SuggestedName: "foo",
+		SideInfo:      snap.SideInfo{Revision: snap.R(7)},
+	}
+
+	sz, err := backend.EstimateSnapshotSize(info, nil)
+	c.Assert(err, check.IsNil)
+	c.Check(sz, check.Equals, uint64(0))
+}
+func (s *snapshotSuite) TestExportTwice(c *check.C) {
+	// use mocking done in snapshotSuite.SetUpTest
+	info := &snap.Info{
+		SideInfo: snap.SideInfo{
+			RealName: "hello-snap",
+			Revision: snap.R(42),
+			SnapID:   "hello-id",
+		},
+		Version: "v1.33",
+	}
+	// create a snapshot
+	shID := uint64(12)
+	_, err := backend.Save(context.TODO(), shID, info, nil, []string{"snapuser"}, &backend.Flags{})
+	c.Check(err, check.IsNil)
+
+	// num_files + export.json + footer
+	expectedSize := int64(4*512 + 1024 + 2*512)
+	// do on export at the start of the epoch
+	restore := backend.MockTimeNow(func() time.Time { return time.Time{} })
+	defer restore()
+	// export once
+	buf := bytes.NewBuffer(nil)
+	ctx := context.Background()
+	se, err := backend.NewSnapshotExport(ctx, shID)
+	c.Check(err, check.IsNil)
+	err = se.Init()
+	c.Assert(err, check.IsNil)
+	c.Check(se.Size(), check.Equals, expectedSize)
+	// and we can stream the data
+	err = se.StreamTo(buf)
+	c.Assert(err, check.IsNil)
+	c.Check(buf.Len(), check.Equals, int(expectedSize))
+
+	// and again to ensure size does not change when exported again
+	//
+	// Note that moving beyond year 2242 will change the tar format
+	// used by the go internal tar and that will make the size actually
+	// change.
+	restore = backend.MockTimeNow(func() time.Time { return time.Date(2242, 1, 1, 12, 0, 0, 0, time.UTC) })
+	defer restore()
+	se2, err := backend.NewSnapshotExport(ctx, shID)
+	c.Check(err, check.IsNil)
+	err = se2.Init()
+	c.Assert(err, check.IsNil)
+	c.Check(se2.Size(), check.Equals, expectedSize)
+	// and we can stream the data
+	buf.Reset()
+	err = se2.StreamTo(buf)
+	c.Assert(err, check.IsNil)
+	c.Check(buf.Len(), check.Equals, int(expectedSize))
+}
+
+func (s *snapshotSuite) TestExportUnhappy(c *check.C) {
+	se, err := backend.NewSnapshotExport(context.Background(), 5)
+	c.Assert(err, check.ErrorMatches, "no snapshot data found for 5")
+	c.Assert(se, check.IsNil)
+}
+
+type createTestExportFlags struct {
+	exportJSON      bool
+	withDir         bool
+	corruptChecksum bool
+}
+
+func createTestExportFile(filename string, flags *createTestExportFlags) error {
+	tf, err := os.Create(filename)
+	if err != nil {
+		return err
+	}
+	defer tf.Close()
+	tw := tar.NewWriter(tf)
+	defer tw.Close()
+
+	for _, s := range []string{"foo", "bar", "baz"} {
+		fname := fmt.Sprintf("5_%s_1.0_199.zip", s)
+
+		buf := bytes.NewBuffer(nil)
+		zipW := zip.NewWriter(buf)
+		defer zipW.Close()
+
+		sha := map[string]string{}
+
+		// create dummy archive.tgz
+		archiveWriter, err := zipW.CreateHeader(&zip.FileHeader{Name: "archive.tgz"})
+		if err != nil {
+			return err
+		}
+		var sz osutil.Sizer
+		hasher := crypto.SHA3_384.New()
+		out := io.MultiWriter(archiveWriter, hasher, &sz)
+		if _, err := out.Write([]byte(s)); err != nil {
+			return err
+		}
+
+		if flags.corruptChecksum {
+			hasher.Write([]byte{0})
+		}
+		sha["archive.tgz"] = fmt.Sprintf("%x", hasher.Sum(nil))
+
+		snapshot := backend.MockSnapshot(5, s, snap.Revision{N: 199}, sz.Size(), sha)
+
+		// create meta.json
+		metaWriter, err := zipW.Create("meta.json")
+		if err != nil {
+			return err
+		}
+		hasher = crypto.SHA3_384.New()
+		enc := json.NewEncoder(io.MultiWriter(metaWriter, hasher))
+		if err := enc.Encode(snapshot); err != nil {
+			return err
+		}
+
+		// write meta.sha3_384
+		metaSha3Writer, err := zipW.Create("meta.sha3_384")
+		if err != nil {
+			return err
+		}
+		fmt.Fprintf(metaSha3Writer, "%x\n", hasher.Sum(nil))
+		zipW.Close()
+
+		hdr := &tar.Header{
+			Name: fname,
+			Mode: 0644,
+			Size: int64(buf.Len()),
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if _, err := tw.Write(buf.Bytes()); err != nil {
+			return err
+		}
+	}
+
+	if flags.withDir {
+		hdr := &tar.Header{
+			Name:     dirs.SnapshotsDir,
+			Mode:     0700,
+			Size:     int64(0),
+			Typeflag: tar.TypeDir,
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if _, err = tw.Write([]byte("")); err != nil {
+			return nil
+		}
+	}
+
+	if flags.exportJSON {
+		exp := fmt.Sprintf(`{"format":1, "date":"%s"}`, time.Now().Format(time.RFC3339))
+		hdr := &tar.Header{
+			Name: "export.json",
+			Mode: 0644,
+			Size: int64(len(exp)),
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if _, err = tw.Write([]byte(exp)); err != nil {
+			return nil
+		}
+	}
+
+	return nil
+}
+
+func makeMockSnapshotZipContent(c *check.C) []byte {
+	buf := bytes.NewBuffer(nil)
+	zipW := zip.NewWriter(buf)
+
+	// create dummy archive.tgz
+	archiveWriter, err := zipW.CreateHeader(&zip.FileHeader{Name: "archive.tgz"})
+	c.Assert(err, check.IsNil)
+	_, err = archiveWriter.Write([]byte("mock archive.tgz content"))
+	c.Assert(err, check.IsNil)
+
+	// create dummy meta.json
+	archiveWriter, err = zipW.CreateHeader(&zip.FileHeader{Name: "meta.json"})
+	c.Assert(err, check.IsNil)
+	_, err = archiveWriter.Write([]byte("{}"))
+	c.Assert(err, check.IsNil)
+
+	zipW.Close()
+	return buf.Bytes()
+}
+
+func (s *snapshotSuite) TestIterWithMockedSnapshotFiles(c *check.C) {
+	err := os.MkdirAll(dirs.SnapshotsDir, 0755)
+	c.Assert(err, check.IsNil)
+
+	fn := "1_hello_1.0_x1.zip"
+	err = ioutil.WriteFile(filepath.Join(dirs.SnapshotsDir, fn), makeMockSnapshotZipContent(c), 0644)
+	c.Assert(err, check.IsNil)
+
+	callbackCalled := 0
+	f := func(snapshot *backend.Reader) error {
+		callbackCalled++
+		return nil
+	}
+
+	err = backend.Iter(context.Background(), f)
+	c.Check(err, check.IsNil)
+	c.Check(callbackCalled, check.Equals, 1)
+
+	// now pretend we are importing snapshot id 1
+	callbackCalled = 0
+	fn = "1_importing"
+	err = ioutil.WriteFile(filepath.Join(dirs.SnapshotsDir, fn), nil, 0644)
+	c.Assert(err, check.IsNil)
+
+	// and while importing Iter() does not call the callback
+	err = backend.Iter(context.Background(), f)
+	c.Check(err, check.IsNil)
+	c.Check(callbackCalled, check.Equals, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/export_test.go snapd-2.48.3+20.04/overlord/snapshotstate/backend/export_test.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/backend/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,14 +22,19 @@
 import (
 	"os"
 	"os/user"
+	"time"
 
+	"github.com/snapcore/snapd/client"
 	"github.com/snapcore/snapd/osutil/sys"
+	"github.com/snapcore/snapd/snap"
 )
 
 var (
 	AddDirToZip     = addDirToZip
 	TarAsUser       = tarAsUser
 	PickUserWrapper = pickUserWrapper
+
+	IsSnapshotFilename = isSnapshotFilename
 )
 
 func MockIsTesting(newIsTesting bool) func() {
@@ -64,7 +69,7 @@
 	}
 }
 
-func MockOpen(newOpen func(string) (*Reader, error)) func() {
+func MockOpen(newOpen func(string, uint64) (*Reader, error)) func() {
 	oldOpen := backendOpen
 	backendOpen = newOpen
 	return func() {
@@ -95,3 +100,33 @@
 		userWrapper = oldUserWrapper
 	}
 }
+
+func MockUsersForUsernames(f func(usernames []string) ([]*user.User, error)) (restore func()) {
+	old := usersForUsernames
+	usersForUsernames = f
+	return func() {
+		usersForUsernames = old
+	}
+}
+
+func MockTimeNow(f func() time.Time) (restore func()) {
+	oldTimeNow := timeNow
+	timeNow = f
+	return func() {
+		timeNow = oldTimeNow
+	}
+}
+
+func MockSnapshot(setID uint64, snapName string, revision snap.Revision, size int64, shaSums map[string]string) *client.Snapshot {
+	return &client.Snapshot{
+		SetID:    setID,
+		Snap:     snapName,
+		SnapID:   "id",
+		Revision: revision,
+		Version:  "1.0",
+		Epoch:    snap.Epoch{},
+		Time:     timeNow(),
+		SHA3_384: shaSums,
+		Size:     size,
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/helpers.go snapd-2.48.3+20.04/overlord/snapshotstate/backend/helpers.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/backend/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -103,7 +103,7 @@
 	}
 }
 
-func usersForUsernames(usernames []string) ([]*user.User, error) {
+func usersForUsernamesImpl(usernames []string) ([]*user.User, error) {
 	if len(usernames) == 0 {
 		return allUsers()
 	}
@@ -111,9 +111,23 @@
 	for _, username := range usernames {
 		usr, err := userLookup(username)
 		if err != nil {
-			if !isUnknownUser(err) {
-				return nil, err
-			}
+			// Treat all non-nil errors as user.Unknown{User,Group}Error's, as
+			// currently Go's handling of returned errno from get{pw,gr}nam_r
+			// in the cgo implementation of user.Lookup is lacking, and thus
+			// user.Unknown{User,Group}Error is returned only when errno is 0
+			// and the list of users/groups is empty, but as per the man page
+			// for get{pw,gr}nam_r, there are many other errno's that typical
+			// systems could return to indicate that the user/group wasn't
+			// found, however unfortunately the POSIX standard does not actually
+			// dictate what errno should be used to indicate "user/group not
+			// found", and so even if Go is more robust, it may not ever be
+			// fully robust. See from the man page:
+			//
+			// > It [POSIX.1-2001] does not call "not found" an error, hence
+			// > does not specify what value errno might have in this situation.
+			// > But that makes it impossible to recognize errors.
+			//
+			// See upstream Go issue: https://github.com/golang/go/issues/40334
 			u, e := userLookupId(username)
 			if e != nil {
 				// return first error, as it's usually clearer
@@ -154,9 +168,24 @@
 		seen[st.Uid] = true
 		usr, err := userLookupId(strconv.FormatUint(uint64(st.Uid), 10))
 		if err != nil {
-			if !isUnknownUser(err) {
-				return nil, err
-			}
+			// Treat all non-nil errors as user.Unknown{User,Group}Error's, as
+			// currently Go's handling of returned errno from get{pw,gr}nam_r
+			// in the cgo implementation of user.Lookup is lacking, and thus
+			// user.Unknown{User,Group}Error is returned only when errno is 0
+			// and the list of users/groups is empty, but as per the man page
+			// for get{pw,gr}nam_r, there are many other errno's that typical
+			// systems could return to indicate that the user/group wasn't
+			// found, however unfortunately the POSIX standard does not actually
+			// dictate what errno should be used to indicate "user/group not
+			// found", and so even if Go is more robust, it may not ever be
+			// fully robust. See from the man page:
+			//
+			// > It [POSIX.1-2001] does not call "not found" an error, hence
+			// > does not specify what value errno might have in this situation.
+			// > But that makes it impossible to recognize errors.
+			//
+			// See upstream Go issue: https://github.com/golang/go/issues/40334
+			continue
 		} else {
 			users = append(users, usr)
 		}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/reader.go snapd-2.48.3+20.04/overlord/snapshotstate/backend/reader.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/reader.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/backend/reader.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,6 +42,10 @@
 	"github.com/snapcore/snapd/strutil"
 )
 
+// ExtractFnameSetID can be passed to Open() to have set ID inferred from
+// snapshot filename.
+const ExtractFnameSetID = 0
+
 // A Reader is a snapshot that's been opened for reading.
 type Reader struct {
 	*os.File
@@ -50,13 +54,17 @@
 
 // Open a Snapshot given its full filename.
 //
+// The returned reader will have its setID set to the value of the argument,
+// or inferred from the snapshot filename if ExtractFnameSetID constant is
+// passed.
+//
 // If the returned error is nil, the caller must close the reader (or
 // its file) when done with it.
 //
 // If the returned error is non-nil, the returned Reader will be nil,
 // *or* have a non-empty Broken; in the latter case its file will be
 // closed.
-func Open(fn string) (reader *Reader, e error) {
+func Open(fn string, setID uint64) (reader *Reader, e error) {
 	f, err := os.Open(fn)
 	if err != nil {
 		return nil, err
@@ -72,7 +80,7 @@
 	}
 
 	// first try to load the metadata itself
-	var sz sizer
+	var sz osutil.Sizer
 	hasher := crypto.SHA3_384.New()
 	metaReader, metaSize, err := zipMember(f, metadataName)
 	if err != nil {
@@ -84,6 +92,18 @@
 		return nil, err
 	}
 
+	if setID == ExtractFnameSetID {
+		// set id from the filename has the authority and overrides the one from
+		// meta file.
+		var ok bool
+		ok, setID = isSnapshotFilename(fn)
+		if !ok {
+			return nil, fmt.Errorf("not a snapshot filename: %q", fn)
+		}
+	}
+
+	reader.SetID = setID
+
 	// OK, from here on we have a Snapshot
 
 	if !reader.IsValid() {
@@ -91,8 +111,8 @@
 		return reader, errors.New(reader.Broken)
 	}
 
-	if sz.size != metaSize {
-		reader.Broken = fmt.Sprintf("declared metadata size (%d) does not match actual (%d)", metaSize, sz.size)
+	if sz.Size() != metaSize {
+		reader.Broken = fmt.Sprintf("declared metadata size (%d) does not match actual (%d)", metaSize, sz.Size())
 		return reader, errors.New(reader.Broken)
 	}
 
@@ -110,8 +130,8 @@
 		reader.Broken = err.Error()
 		return reader, err
 	}
-	if sz.size != metaHashSize {
-		reader.Broken = fmt.Sprintf("declared hash size (%d) does not match actual (%d)", metaHashSize, sz.size)
+	if sz.Size() != metaHashSize {
+		reader.Broken = fmt.Sprintf("declared hash size (%d) does not match actual (%d)", metaHashSize, sz.Size())
 		return reader, errors.New(reader.Broken)
 	}
 	if expectedMetaHash := string(bytes.TrimSpace(metaHashBuf)); actualMetaHash != expectedMetaHash {
@@ -190,7 +210,7 @@
 	isRoot := sys.Geteuid() == 0
 	si := snap.MinimalPlaceInfo(r.Snap, r.Revision)
 	hasher := crypto.SHA3_384.New()
-	var sz sizer
+	var sz osutil.Sizer
 
 	var curdir string
 	if !current.Unset() {
@@ -324,9 +344,9 @@
 			return rs, fmt.Errorf("tar failed: %v", err)
 		}
 
-		if sz.size != expectedSize {
+		if sz.Size() != expectedSize {
 			return rs, fmt.Errorf("snapshot %q entry %q expected size (%d) does not match actual (%d)",
-				r.Name(), entry, expectedSize, sz.size)
+				r.Name(), entry, expectedSize, sz.Size())
 		}
 
 		if actualHash := fmt.Sprintf("%x", hasher.Sum(nil)); actualHash != expectedHash {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/sizer.go snapd-2.48.3+20.04/overlord/snapshotstate/backend/sizer.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/backend/sizer.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/backend/sizer.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,34 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package backend
-
-type sizer struct {
-	size int64
-}
-
-func (sz *sizer) Write(data []byte) (n int, err error) {
-	n = len(data)
-	sz.size += int64(n)
-	return
-}
-
-func (sz *sizer) Reset() {
-	sz.size = 0
-}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/export_test.go snapd-2.48.3+20.04/overlord/snapshotstate/export_test.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,7 @@
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"time"
 
 	"github.com/snapcore/snapd/overlord/snapshotstate/backend"
@@ -102,7 +103,7 @@
 	}
 }
 
-func MockBackendOpen(f func(string) (*backend.Reader, error)) (restore func()) {
+func MockBackendOpen(f func(string, uint64) (*backend.Reader, error)) (restore func()) {
 	old := backendOpen
 	backendOpen = f
 	return func() {
@@ -142,6 +143,22 @@
 	}
 }
 
+func MockBackendImport(f func(context.Context, uint64, io.Reader) ([]string, error)) (restore func()) {
+	old := backendImport
+	backendImport = f
+	return func() {
+		backendImport = old
+	}
+}
+
+func MockBackendEstimateSnapshotSize(f func(*snap.Info, []string) (uint64, error)) (restore func()) {
+	old := backendEstimateSnapshotSize
+	backendEstimateSnapshotSize = f
+	return func() {
+		backendEstimateSnapshotSize = old
+	}
+}
+
 func MockConfigGetSnapConfig(f func(*state.State, string) (*json.RawMessage, error)) (restore func()) {
 	old := configGetSnapConfig
 	configGetSnapConfig = f
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotmgr.go snapd-2.48.3+20.04/overlord/snapshotstate/snapshotmgr.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotmgr.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/snapshotmgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -44,6 +44,7 @@
 	configSetSnapConfig  = config.SetSnapConfig
 	backendOpen          = backend.Open
 	backendSave          = backend.Save
+	backendImport        = backend.Import
 	backendRestore       = (*backend.Reader).Restore // TODO: look into using an interface instead
 	backendCheck         = (*backend.Reader).Check
 	backendRevert        = (*backend.RestoreState).Revert // ditto
@@ -246,7 +247,7 @@
 		}
 	}
 
-	reader, err = backendOpen(snapshot.Filename)
+	reader, err = backendOpen(snapshot.Filename, backend.ExtractFnameSetID)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("cannot open snapshot: %v", err)
 	}
@@ -361,7 +362,7 @@
 		return taskGetErrMsg(task, err, "snapshot")
 	}
 
-	reader, err := backendOpen(snapshot.Filename)
+	reader, err := backendOpen(snapshot.Filename, backend.ExtractFnameSetID)
 	if err != nil {
 		return fmt.Errorf("cannot open snapshot: %v", err)
 	}
@@ -399,6 +400,7 @@
 	// hook automatic snapshots into snapstate logic
 	snapstate.AutomaticSnapshot = AutomaticSnapshot
 	snapstate.AutomaticSnapshotExpiration = AutomaticSnapshotExpiration
+	snapstate.EstimateSnapshotSize = EstimateSnapshotSize
 }
 
 func MockBackendSave(f func(context.Context, uint64, *snap.Info, map[string]interface{}, []string, *backend.Flags) (*client.Snapshot, error)) (restore func()) {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotmgr_test.go snapd-2.48.3+20.04/overlord/snapshotstate/snapshotmgr_test.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotmgr_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/snapshotmgr_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -478,7 +478,7 @@
 	rs.task.Set("snapshot-setup", map[string]interface{}{
 		// interestingly restore doesn't use the set-id
 		"snap":     "a-snap",
-		"filename": "/some/file.zip",
+		"filename": "/some/1_file.zip",
 		"users":    []string{"a-user", "b-user"},
 	})
 	st.Unlock()
@@ -497,7 +497,7 @@
 			rs.calls = append(rs.calls, "set config")
 			return nil
 		}),
-		snapshotstate.MockBackendOpen(func(string) (*backend.Reader, error) {
+		snapshotstate.MockBackendOpen(func(string, uint64) (*backend.Reader, error) {
 			rs.calls = append(rs.calls, "open")
 			return &backend.Reader{}, nil
 		}),
@@ -531,9 +531,11 @@
 		buf := json.RawMessage(`{"old": "conf"}`)
 		return &buf, nil
 	})()
-	defer snapshotstate.MockBackendOpen(func(filename string) (*backend.Reader, error) {
+	defer snapshotstate.MockBackendOpen(func(filename string, setID uint64) (*backend.Reader, error) {
 		rs.calls = append(rs.calls, "open")
-		c.Check(filename, check.Equals, "/some/file.zip")
+		// set id 0 tells backend.Open to use set id from the filename
+		c.Check(setID, check.Equals, uint64(0))
+		c.Check(filename, check.Equals, "/some/1_file.zip")
 		return &backend.Reader{
 			Snapshot: client.Snapshot{Conf: map[string]interface{}{"hello": "there"}},
 		}, nil
@@ -597,7 +599,7 @@
 }
 
 func (rs *readerSuite) TestDoRestoreFailsOpenError(c *check.C) {
-	defer snapshotstate.MockBackendOpen(func(string) (*backend.Reader, error) {
+	defer snapshotstate.MockBackendOpen(func(string, uint64) (*backend.Reader, error) {
 		rs.calls = append(rs.calls, "open")
 		return nil, errors.New("bzzt")
 	})()
@@ -608,7 +610,7 @@
 }
 
 func (rs *readerSuite) TestDoRestoreFailsUnserialisableSnapshotConfigError(c *check.C) {
-	defer snapshotstate.MockBackendOpen(func(string) (*backend.Reader, error) {
+	defer snapshotstate.MockBackendOpen(func(string, uint64) (*backend.Reader, error) {
 		rs.calls = append(rs.calls, "open")
 		return &backend.Reader{
 			Snapshot: client.Snapshot{Conf: map[string]interface{}{"hello": func() {}}},
@@ -675,9 +677,11 @@
 }
 
 func (rs *readerSuite) TestDoCheck(c *check.C) {
-	defer snapshotstate.MockBackendOpen(func(filename string) (*backend.Reader, error) {
+	defer snapshotstate.MockBackendOpen(func(filename string, setID uint64) (*backend.Reader, error) {
 		rs.calls = append(rs.calls, "open")
-		c.Check(filename, check.Equals, "/some/file.zip")
+		c.Check(filename, check.Equals, "/some/1_file.zip")
+		// set id 0 tells backend.Open to use set id from the filename
+		c.Check(setID, check.Equals, uint64(0))
 		return &backend.Reader{
 			Snapshot: client.Snapshot{Conf: map[string]interface{}{"hello": "there"}},
 		}, nil
@@ -691,12 +695,11 @@
 	err := snapshotstate.DoCheck(rs.task, &tomb.Tomb{})
 	c.Assert(err, check.IsNil)
 	c.Check(rs.calls, check.DeepEquals, []string{"open", "check"})
-
 }
 
 func (rs *readerSuite) TestDoRemove(c *check.C) {
 	defer snapshotstate.MockOsRemove(func(filename string) error {
-		c.Check(filename, check.Equals, "/some/file.zip")
+		c.Check(filename, check.Equals, "/some/1_file.zip")
 		rs.calls = append(rs.calls, "remove")
 		return nil
 	})()
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotstate.go snapd-2.48.3+20.04/overlord/snapshotstate/snapshotstate.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotstate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/snapshotstate.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,7 @@
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"sort"
 	"time"
 
@@ -41,6 +42,7 @@
 	snapstateAll                     = snapstate.All
 	snapstateCheckChangeConflictMany = snapstate.CheckChangeConflictMany
 	backendIter                      = backend.Iter
+	backendEstimateSnapshotSize      = backend.EstimateSnapshotSize
 
 	// Default expiration time for automatic snapshots, if not set by the user
 	defaultAutomaticSnapshotExpiration = time.Hour * 24 * 31
@@ -51,13 +53,28 @@
 }
 
 func newSnapshotSetID(st *state.State) (uint64, error) {
-	var lastSetID uint64
+	var lastDiskSetID, lastStateSetID uint64
 
-	err := st.Get("last-snapshot-set-id", &lastSetID)
+	// get last set id from state
+	err := st.Get("last-snapshot-set-id", &lastStateSetID)
 	if err != nil && err != state.ErrNoState {
 		return 0, err
 	}
 
+	// get highest set id from the snapshots/ directory
+	lastDiskSetID, err = backend.LastSnapshotSetID()
+	if err != nil {
+		return 0, fmt.Errorf("cannot determine last snapshot set id: %v", err)
+	}
+
+	// take the larger of the two numbers and store it back in the state.
+	// the value in state acts as an allocation of IDs for scheduled snapshots,
+	// they allocate set id early before any file gets created, so we cannot
+	// rely on disk only.
+	lastSetID := lastDiskSetID
+	if lastStateSetID > lastSetID {
+		lastSetID = lastStateSetID
+	}
 	lastSetID++
 	st.Set("last-snapshot-set-id", lastSetID)
 
@@ -81,6 +98,25 @@
 	return names, nil
 }
 
+func EstimateSnapshotSize(st *state.State, instanceName string, users []string) (uint64, error) {
+	cur, err := snapstateCurrentInfo(st, instanceName)
+	if err != nil {
+		return 0, err
+	}
+	rawCfg, err := configGetSnapConfig(st, instanceName)
+	if err != nil {
+		return 0, err
+	}
+	sz, err := backendEstimateSnapshotSize(cur, users)
+	if err != nil {
+		return 0, err
+	}
+	if rawCfg != nil {
+		sz += uint64(len([]byte(*rawCfg)))
+	}
+	return sz, nil
+}
+
 func AutomaticSnapshotExpiration(st *state.State) (time.Duration, error) {
 	var expirationStr string
 	tr := config.NewTransaction(st)
@@ -256,6 +292,27 @@
 // Note that the state must be locked by the caller.
 var List = backend.List
 
+// XXX: Something needs to cleanup incomplete imports. This is conceptually
+//      very simple: on startup, do:
+//      for setID in *_importing:
+//          newImportTransaction(setID).Cancel()
+//      But it needs to happen early *before* anything can start new imports
+
+// Import a given snapshot ID from an exported snapshot
+func Import(ctx context.Context, st *state.State, r io.Reader) (setID uint64, snapNames []string, err error) {
+	st.Lock()
+	setID, err = newSnapshotSetID(st)
+	st.Unlock()
+	if err != nil {
+		return 0, nil, err
+	}
+	snapNames, err = backendImport(ctx, setID, r)
+	if err != nil {
+		return 0, nil, err
+	}
+	return setID, snapNames, nil
+}
+
 // Save creates a taskset for taking snapshots of snaps' data.
 // Note that the state must be locked by the caller.
 func Save(st *state.State, instanceNames []string, users []string) (setID uint64, snapsSaved []string, ts *state.TaskSet, err error) {
@@ -451,3 +508,10 @@
 
 	return summaries.snapNames(), ts, nil
 }
+
+// Export exports a given snapshot ID
+// Note that the state much be locked by the caller.
+var Export = backend.NewSnapshotExport
+
+// SnapshotExport provides a snapshot export that can be streamed out
+type SnapshotExport = backend.SnapshotExport
diff -Nru snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotstate_test.go snapd-2.48.3+20.04/overlord/snapshotstate/snapshotstate_test.go
--- snapd-2.45.1+20.04.2/overlord/snapshotstate/snapshotstate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapshotstate/snapshotstate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,9 +20,13 @@
 package snapshotstate_test
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"os/user"
@@ -59,6 +63,7 @@
 
 func (snapshotSuite) SetUpTest(c *check.C) {
 	dirs.SetRootDir(c.MkDir())
+	os.MkdirAll(dirs.SnapshotsDir, os.ModePerm)
 }
 
 func (snapshotSuite) TearDownTest(c *check.C) {
@@ -69,13 +74,43 @@
 	st := state.New(nil)
 	st.Lock()
 	defer st.Unlock()
+
+	// Disk last set id unset, state set id unset, use 1
 	sid, err := snapshotstate.NewSnapshotSetID(st)
 	c.Assert(err, check.IsNil)
 	c.Check(sid, check.Equals, uint64(1))
 
+	var stateSetID uint64
+	c.Assert(st.Get("last-snapshot-set-id", &stateSetID), check.IsNil)
+	c.Check(stateSetID, check.Equals, uint64(1))
+
+	c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapshotsDir, "9_some-snap-1.zip"), []byte{}, 0644), check.IsNil)
+
+	// Disk last set id 9 > state set id 1, use 9++ = 10
+	sid, err = snapshotstate.NewSnapshotSetID(st)
+	c.Assert(err, check.IsNil)
+	c.Check(sid, check.Equals, uint64(10))
+
+	c.Assert(st.Get("last-snapshot-set-id", &stateSetID), check.IsNil)
+	c.Check(stateSetID, check.Equals, uint64(10))
+
+	// Disk last set id 9 < state set id 10, use 10++ = 11
+	sid, err = snapshotstate.NewSnapshotSetID(st)
+	c.Assert(err, check.IsNil)
+	c.Check(sid, check.Equals, uint64(11))
+
+	c.Assert(st.Get("last-snapshot-set-id", &stateSetID), check.IsNil)
+	c.Check(stateSetID, check.Equals, uint64(11))
+
+	c.Assert(ioutil.WriteFile(filepath.Join(dirs.SnapshotsDir, "88_some-snap-1.zip"), []byte{}, 0644), check.IsNil)
+
+	// Disk last set id 88 > state set id 11, use 88++ = 89
 	sid, err = snapshotstate.NewSnapshotSetID(st)
 	c.Assert(err, check.IsNil)
-	c.Check(sid, check.Equals, uint64(2))
+	c.Check(sid, check.Equals, uint64(89))
+
+	c.Assert(st.Get("last-snapshot-set-id", &stateSetID), check.IsNil)
+	c.Check(stateSetID, check.Equals, uint64(89))
 }
 
 func (snapshotSuite) TestAllActiveSnapNames(c *check.C) {
@@ -1003,7 +1038,6 @@
 	o.AddManager(o.TaskRunner())
 
 	st.Lock()
-	defer st.Unlock()
 
 	for i, name := range []string{"one-snap", "too-snap", "tri-snap"} {
 		sideInfo := &snap.SideInfo{RealName: name, Revision: snap.R(i + 1)}
@@ -1041,6 +1075,7 @@
 	c.Assert(o.Settle(5*time.Second), check.IsNil)
 	st.Lock()
 	c.Check(change.Err(), check.IsNil)
+	defer st.Unlock()
 
 	// the three restores warn about the missing home (but no errors, no panics)
 	for _, task := range change.Tasks() {
@@ -1082,7 +1117,6 @@
 	o.AddManager(o.TaskRunner())
 
 	st.Lock()
-	defer st.Unlock()
 
 	for i, name := range []string{"one-snap", "too-snap", "tri-snap"} {
 		sideInfo := &snap.SideInfo{RealName: name, Revision: snap.R(i + 1)}
@@ -1119,6 +1153,7 @@
 	c.Assert(o.Settle(5*time.Second), check.IsNil)
 	st.Lock()
 	c.Check(change.Err(), check.NotNil)
+	defer st.Unlock()
 
 	tasks := change.Tasks()
 	c.Check(tasks, check.HasLen, 3)
@@ -1478,3 +1513,130 @@
 	c.Assert(err, check.IsNil)
 	c.Assert(du, check.Equals, time.Duration(0))
 }
+
+func (snapshotSuite) TestImportSnapshotHappy(c *check.C) {
+	st := state.New(nil)
+
+	fakeSnapNames := []string{"baz", "bar", "foo"}
+	fakeSnapshotData := "fake-import-data"
+
+	buf := bytes.NewBufferString(fakeSnapshotData)
+	restore := snapshotstate.MockBackendImport(func(ctx context.Context, id uint64, r io.Reader) ([]string, error) {
+		d, err := ioutil.ReadAll(r)
+		c.Assert(err, check.IsNil)
+		c.Check(fakeSnapshotData, check.Equals, string(d))
+		return fakeSnapNames, nil
+	})
+	defer restore()
+
+	sid, names, err := snapshotstate.Import(context.TODO(), st, buf)
+	c.Assert(err, check.IsNil)
+	c.Check(sid, check.Equals, uint64(1))
+	c.Check(names, check.DeepEquals, fakeSnapNames)
+}
+
+func (snapshotSuite) TestImportSnapshotImportError(c *check.C) {
+	st := state.New(nil)
+
+	restore := snapshotstate.MockBackendImport(func(ctx context.Context, id uint64, r io.Reader) ([]string, error) {
+		return nil, errors.New("some-error")
+	})
+	defer restore()
+
+	r := bytes.NewBufferString("faked-import-data")
+	sid, _, err := snapshotstate.Import(context.TODO(), st, r)
+	c.Assert(err, check.NotNil)
+	c.Assert(err.Error(), check.Equals, "some-error")
+	c.Check(sid, check.Equals, uint64(0))
+}
+func (snapshotSuite) TestEstimateSnapshotSize(c *check.C) {
+	st := state.New(nil)
+	st.Lock()
+	defer st.Unlock()
+
+	sideInfo := &snap.SideInfo{RealName: "some-snap", Revision: snap.R(2)}
+	snapstate.Set(st, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{sideInfo},
+		Current:  sideInfo.Revision,
+	})
+
+	defer snapshotstate.MockBackendEstimateSnapshotSize(func(info *snap.Info, users []string) (uint64, error) {
+		return 123, nil
+	})()
+
+	sz, err := snapshotstate.EstimateSnapshotSize(st, "some-snap", nil)
+	c.Assert(err, check.IsNil)
+	c.Check(sz, check.Equals, uint64(123))
+}
+
+func (snapshotSuite) TestEstimateSnapshotSizeWithConfig(c *check.C) {
+	st := state.New(nil)
+	st.Lock()
+	defer st.Unlock()
+
+	sideInfo := &snap.SideInfo{RealName: "some-snap", Revision: snap.R(2)}
+	snapstate.Set(st, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{sideInfo},
+		Current:  sideInfo.Revision,
+	})
+
+	defer snapshotstate.MockBackendEstimateSnapshotSize(func(info *snap.Info, users []string) (uint64, error) {
+		return 100, nil
+	})()
+
+	defer snapshotstate.MockConfigGetSnapConfig(func(_ *state.State, snapname string) (*json.RawMessage, error) {
+		c.Check(snapname, check.Equals, "some-snap")
+		buf := json.RawMessage(`{"hello": "there"}`)
+		return &buf, nil
+	})()
+
+	sz, err := snapshotstate.EstimateSnapshotSize(st, "some-snap", nil)
+	c.Assert(err, check.IsNil)
+	// size is 100 + 18
+	c.Check(sz, check.Equals, uint64(118))
+}
+
+func (snapshotSuite) TestEstimateSnapshotSizeError(c *check.C) {
+	st := state.New(nil)
+	st.Lock()
+	defer st.Unlock()
+
+	sideInfo := &snap.SideInfo{RealName: "some-snap", Revision: snap.R(2)}
+	snapstate.Set(st, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{sideInfo},
+		Current:  sideInfo.Revision,
+	})
+
+	defer snapshotstate.MockBackendEstimateSnapshotSize(func(info *snap.Info, users []string) (uint64, error) {
+		return 0, fmt.Errorf("an error")
+	})()
+
+	_, err := snapshotstate.EstimateSnapshotSize(st, "some-snap", nil)
+	c.Assert(err, check.ErrorMatches, `an error`)
+}
+
+func (snapshotSuite) TestEstimateSnapshotSizeWithUsers(c *check.C) {
+	st := state.New(nil)
+	st.Lock()
+	defer st.Unlock()
+
+	sideInfo := &snap.SideInfo{RealName: "some-snap", Revision: snap.R(2)}
+	snapstate.Set(st, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{sideInfo},
+		Current:  sideInfo.Revision,
+	})
+
+	var gotUsers []string
+	defer snapshotstate.MockBackendEstimateSnapshotSize(func(info *snap.Info, users []string) (uint64, error) {
+		gotUsers = users
+		return 0, nil
+	})()
+
+	_, err := snapshotstate.EstimateSnapshotSize(st, "some-snap", []string{"user1", "user2"})
+	c.Assert(err, check.IsNil)
+	c.Check(gotUsers, check.DeepEquals, []string{"user1", "user2"})
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/autorefresh.go snapd-2.48.3+20.04/overlord/snapstate/autorefresh.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/autorefresh.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/autorefresh.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,6 +20,7 @@
 package snapstate
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"time"
@@ -35,6 +36,7 @@
 	"github.com/snapcore/snapd/strutil"
 	"github.com/snapcore/snapd/timeutil"
 	"github.com/snapcore/snapd/timings"
+	userclient "github.com/snapcore/snapd/usersession/client"
 )
 
 // the default refresh pattern
@@ -44,7 +46,7 @@
 const maxPostponement = 60 * 24 * time.Hour
 
 // cannot inhibit refreshes for more than maxInhibition
-const maxInhibition = 7 * 24 * time.Hour
+const maxInhibition = 14 * 24 * time.Hour
 
 // hooks setup by devicestate
 var (
@@ -64,6 +66,7 @@
 	lastRefreshSchedule string
 	nextRefresh         time.Time
 	lastRefreshAttempt  time.Time
+	managedDeniedLogged bool
 }
 
 func newAutoRefresh(st *state.State) *autoRefresh {
@@ -127,6 +130,31 @@
 	return holdTime, nil
 }
 
+func (m *autoRefresh) ensureRefreshHoldAtLeast(duration time.Duration) error {
+	now := time.Now()
+
+	// get the effective refresh hold and check if it is sooner than the
+	// specified duration in the future
+	effective, err := m.EffectiveRefreshHold()
+	if err != nil {
+		return err
+	}
+
+	if effective.IsZero() || effective.Sub(now) < duration {
+		// the effective refresh hold is sooner than the desired delay, so
+		// move it out to the specified duration
+		holdTime := now.Add(duration)
+		tr := config.NewTransaction(m.state)
+		err := tr.Set("core", "refresh.hold", &holdTime)
+		if err != nil && !config.IsNoOption(err) {
+			return err
+		}
+		tr.Commit()
+	}
+
+	return nil
+}
+
 // clearRefreshHold clears refresh.hold configuration.
 func (m *autoRefresh) clearRefreshHold() {
 	tr := config.NewTransaction(m.state)
@@ -253,52 +281,72 @@
 		logger.Debugf("Next refresh scheduled for %s.", m.nextRefresh.Format(time.RFC3339))
 	}
 
-	// should we hold back refreshes?
-	holdTime, err := m.EffectiveRefreshHold()
+	held, holdTime, err := m.isRefreshHeld(refreshSchedule)
 	if err != nil {
 		return err
 	}
-	if holdTime.After(now) {
-		return nil
-	}
-	if !holdTime.IsZero() {
-		// expired hold case
-		m.clearRefreshHold()
-		if m.nextRefresh.Before(holdTime) {
-			// next refresh is obsolete, compute the next one
-			delta := timeutil.Next(refreshSchedule, holdTime, maxPostponement)
-			now = time.Now()
-			m.nextRefresh = now.Add(delta)
-		}
-	}
 
 	// do refresh attempt (if needed)
-	if !m.nextRefresh.After(now) {
-		var can bool
-		can, err = m.canRefreshRespectingMetered(now, lastRefresh)
-		if err != nil {
-			return err
-		}
-		if !can {
-			// clear nextRefresh so that another refresh time is calculated
-			m.nextRefresh = time.Time{}
-			return nil
+	if !held {
+		if !holdTime.IsZero() {
+			// expired hold case
+			m.clearRefreshHold()
+			if m.nextRefresh.Before(holdTime) {
+				// next refresh is obsolete, compute the next one
+				delta := timeutil.Next(refreshSchedule, holdTime, maxPostponement)
+				now = time.Now()
+				m.nextRefresh = now.Add(delta)
+			}
+		}
+
+		// refresh is also "held" if the next time is in the future
+		// note that the two times here could be exactly equal, so we use
+		// !After() because that is true in the case that the next refresh is
+		// before now, and the next refresh is equal to now without requiring an
+		// or operation
+		if !m.nextRefresh.After(now) {
+			var can bool
+			can, err = m.canRefreshRespectingMetered(now, lastRefresh)
+			if err != nil {
+				return err
+			}
+			if !can {
+				// clear nextRefresh so that another refresh time is calculated
+				m.nextRefresh = time.Time{}
+				return nil
+			}
+
+			// Check that we have reasonable delays between attempts.
+			// If the store is under stress we need to make sure we do not
+			// hammer it too often
+			if !m.lastRefreshAttempt.IsZero() && m.lastRefreshAttempt.Add(refreshRetryDelay).After(time.Now()) {
+				return nil
+			}
+
+			err = m.launchAutoRefresh(refreshSchedule)
+			if _, ok := err.(*httputil.PersistentNetworkError); !ok {
+				m.nextRefresh = time.Time{}
+			} // else - refresh will be retried after refreshRetryDelay
 		}
+	}
 
-		// Check that we have reasonable delays between attempts.
-		// If the store is under stress we need to make sure we do not
-		// hammer it too often
-		if !m.lastRefreshAttempt.IsZero() && m.lastRefreshAttempt.Add(refreshRetryDelay).After(time.Now()) {
-			return nil
-		}
+	return err
+}
 
-		err = m.launchAutoRefresh()
-		if _, ok := err.(*httputil.PerstistentNetworkError); !ok {
-			m.nextRefresh = time.Time{}
-		} // else - refresh will be retried after refreshRetryDelay
+// isRefreshHeld returns whether an auto-refresh is currently held back or not,
+// as indicated by m.EffectiveRefreshHold().
+func (m *autoRefresh) isRefreshHeld(refreshSchedule []*timeutil.Schedule) (bool, time.Time, error) {
+	now := time.Now()
+	// should we hold back refreshes?
+	holdTime, err := m.EffectiveRefreshHold()
+	if err != nil {
+		return false, time.Time{}, err
+	}
+	if holdTime.After(now) {
+		return true, holdTime, nil
 	}
 
-	return err
+	return false, holdTime, nil
 }
 
 func (m *autoRefresh) ensureLastRefreshAnchor() {
@@ -329,12 +377,24 @@
 // TODO: we can remove the refreshSchedule reset because we have validation
 //       of the schedule now.
 func (m *autoRefresh) refreshScheduleWithDefaultsFallback() (ts []*timeutil.Schedule, scheduleAsStr string, legacy bool, err error) {
-	if managed, legacy := refreshScheduleManaged(m.state); managed {
+	managed, requested, legacy := refreshScheduleManaged(m.state)
+	if managed {
 		if m.lastRefreshSchedule != "managed" {
 			logger.Noticef("refresh is managed via the snapd-control interface")
 			m.lastRefreshSchedule = "managed"
 		}
+		m.managedDeniedLogged = false
 		return nil, "managed", legacy, nil
+	} else if requested {
+		// managed refresh schedule was denied
+		if !m.managedDeniedLogged {
+			logger.Noticef("managed refresh schedule denied, no properly configured snapd-control")
+			m.managedDeniedLogged = true
+		}
+		// fallback to default schedule
+		return refreshScheduleDefault()
+	} else {
+		m.managedDeniedLogged = false
 	}
 
 	tr := config.NewTransaction(m.state)
@@ -371,7 +431,7 @@
 }
 
 // launchAutoRefresh creates the auto-refresh taskset and a change for it.
-func (m *autoRefresh) launchAutoRefresh() error {
+func (m *autoRefresh) launchAutoRefresh(refreshSchedule []*timeutil.Schedule) error {
 	perfTimings := timings.New(map[string]string{"ensure": "auto-refresh"})
 	tm := perfTimings.StartSpan("auto-refresh", "query store and setup auto-refresh change")
 	defer func() {
@@ -380,8 +440,30 @@
 	}()
 
 	m.lastRefreshAttempt = time.Now()
+
+	// NOTE: this will unlock and re-lock state for network ops
 	updated, tasksets, err := AutoRefresh(auth.EnsureContextTODO(), m.state)
-	if _, ok := err.(*httputil.PerstistentNetworkError); ok {
+
+	// TODO: we should have some way to lock just creating and starting changes,
+	//       as that would alleviate this race condition we are guarding against
+	//       with this check and probably would eliminate other similar race
+	//       conditions elsewhere
+
+	// re-check if the refresh is held because it could have been re-held and
+	// pushed back, in which case we need to abort the auto-refresh and wait
+	held, _, holdErr := m.isRefreshHeld(refreshSchedule)
+	if holdErr != nil {
+		return holdErr
+	}
+
+	if held {
+		// then a request came in that pushed the refresh out, so we will need
+		// to try again later
+		logger.Noticef("Auto-refresh was delayed mid-way through launching, aborting to try again later")
+		return nil
+	}
+
+	if _, ok := err.(*httputil.PersistentNetworkError); ok {
 		logger.Noticef("Cannot prepare auto-refresh change due to a permanent network error: %s", err)
 		return err
 	}
@@ -437,32 +519,33 @@
 
 // refreshScheduleManaged returns true if the refresh schedule of the
 // device is managed by an external snap
-func refreshScheduleManaged(st *state.State) (managed bool, legacy bool) {
+func refreshScheduleManaged(st *state.State) (managed, requested, legacy bool) {
 	var confStr string
 
 	// this will only be "nil" if running in tests
 	if CanManageRefreshes == nil {
-		return false, legacy
+		return false, false, legacy
 	}
 
 	// check new style timer first
 	tr := config.NewTransaction(st)
 	err := tr.Get("core", "refresh.timer", &confStr)
 	if err != nil && !config.IsNoOption(err) {
-		return false, legacy
+		return false, false, legacy
 	}
 	// if not set, fallback to refresh.schedule
 	if confStr == "" {
 		if err := tr.Get("core", "refresh.schedule", &confStr); err != nil {
-			return false, legacy
+			return false, false, legacy
 		}
 		legacy = true
 	}
 
 	if confStr != "managed" {
-		return false, legacy
+		return false, false, legacy
 	}
-	return CanManageRefreshes(st), legacy
+
+	return CanManageRefreshes(st), true, legacy
 }
 
 // getTime retrieves a time from a state value.
@@ -475,27 +558,66 @@
 	return t1, nil
 }
 
+// asyncPendingRefreshNotification broadcasts desktop notification in a goroutine.
+//
+// This allows the, possibly slow, communication with each snapd session agent,
+// to be performed without holding the snap state lock.
+var asyncPendingRefreshNotification = func(context context.Context, client *userclient.Client, refreshInfo *userclient.PendingSnapRefreshInfo) {
+	go func() {
+		if err := client.PendingRefreshNotification(context, refreshInfo); err != nil {
+			logger.Noticef("Cannot send notification about pending refresh: %v", err)
+		}
+	}()
+}
+
 // inhibitRefresh returns an error if refresh is inhibited by running apps.
 //
 // Internally the snap state is updated to remember when the inhibition first
 // took place. Apps can inhibit refreshes for up to "maxInhibition", beyond
 // that period the refresh will go ahead despite application activity.
 func inhibitRefresh(st *state.State, snapst *SnapState, info *snap.Info, checker func(*snap.Info) error) error {
-	if err := checker(info); err != nil {
-		now := time.Now()
-		if snapst.RefreshInhibitedTime == nil {
-			// Store the instant when the snap was first inhibited.
-			// This is reset to nil on successful refresh.
-			snapst.RefreshInhibitedTime = &now
-			Set(st, info.InstanceName(), snapst)
-			return err
-		}
+	checkerErr := checker(info)
+	if checkerErr == nil {
+		return nil
+	}
 
-		if now.Sub(*snapst.RefreshInhibitedTime) < maxInhibition {
-			// If we are still in the allowed window then just return
-			// the error but don't change the snap state again.
-			return err
+	// Get pending refresh information from compatible errors or synthesize a new one.
+	var refreshInfo *userclient.PendingSnapRefreshInfo
+	if err, ok := checkerErr.(*BusySnapError); ok {
+		refreshInfo = err.PendingSnapRefreshInfo()
+	} else {
+		refreshInfo = &userclient.PendingSnapRefreshInfo{
+			InstanceName: info.InstanceName(),
 		}
 	}
-	return nil
+
+	// Decide on what to do depending on the state of the snap and the remaining
+	// inhibition time.
+	now := time.Now()
+	switch {
+	case snapst.RefreshInhibitedTime == nil:
+		// If the snap did not have inhibited refresh yet then commence a new
+		// window, during which refreshes are postponed, by storing the current
+		// time in the snap state's RefreshInhibitedTime field. This field is
+		// reset to nil on successful refresh.
+		snapst.RefreshInhibitedTime = &now
+		refreshInfo.TimeRemaining = (maxInhibition - now.Sub(*snapst.RefreshInhibitedTime)).Truncate(time.Second)
+		Set(st, info.InstanceName(), snapst)
+	case now.Sub(*snapst.RefreshInhibitedTime) < maxInhibition:
+		// If we are still in the allowed window then just return the error but
+		// don't change the snap state again.
+		// TODO: as time left shrinks, send additional notifications with
+		// increasing frequency, allowing the user to understand the urgency.
+		refreshInfo.TimeRemaining = (maxInhibition - now.Sub(*snapst.RefreshInhibitedTime)).Truncate(time.Second)
+	default:
+		// If we run out of time then consume the error that would normally
+		// inhibit refresh and notify the user that the snap is refreshing right
+		// now, by not setting the TimeRemaining field of the refresh
+		// notification message.
+		checkerErr = nil
+	}
+
+	// Send the notification asynchronously to avoid holding the state lock.
+	asyncPendingRefreshNotification(context.TODO(), userclient.New(), refreshInfo)
+	return checkerErr
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/autorefresh_test.go snapd-2.48.3+20.04/overlord/snapstate/autorefresh_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/autorefresh_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/autorefresh_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,12 +24,14 @@
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/httputil"
+	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/configstate/config"
 	"github.com/snapcore/snapd/overlord/snapstate"
@@ -39,7 +41,9 @@
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/store"
 	"github.com/snapcore/snapd/store/storetest"
+	"github.com/snapcore/snapd/testutil"
 	"github.com/snapcore/snapd/timeutil"
+	userclient "github.com/snapcore/snapd/usersession/client"
 )
 
 type autoRefreshStore struct {
@@ -48,9 +52,22 @@
 	ops []string
 
 	err error
+
+	snapActionOpsFunc func()
 }
 
-func (r *autoRefreshStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (r *autoRefreshStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	// this is a bit of a hack to simulate race conditions where while the store
+	// has unlocked the global state lock something else could come in and
+	// change the auto-refresh hold
+	if r.snapActionOpsFunc != nil {
+		r.snapActionOpsFunc()
+		return nil, nil, r.err
+	}
+
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
 	if !opts.IsAutoRefresh {
 		panic("AutoRefresh snap action did not set IsAutoRefresh flag")
 	}
@@ -66,11 +83,14 @@
 			panic("expected refresh actions")
 		}
 	}
+
 	r.ops = append(r.ops, "list-refresh")
-	return nil, r.err
+
+	return nil, nil, r.err
 }
 
 type autoRefreshTestSuite struct {
+	testutil.BaseTest
 	state *state.State
 
 	store *autoRefreshStore
@@ -82,11 +102,14 @@
 
 func (s *autoRefreshTestSuite) SetUpTest(c *C) {
 	dirs.SetRootDir(c.MkDir())
+	s.AddCleanup(func() { dirs.SetRootDir("") })
 
 	s.state = state.New(nil)
 
 	s.store = &autoRefreshStore{}
 
+	s.AddCleanup(func() { s.store.snapActionOpsFunc = nil })
+
 	s.state.Lock()
 	defer s.state.Unlock()
 	snapstate.ReplaceStore(s.state, s.store)
@@ -102,22 +125,17 @@
 	})
 
 	snapstate.CanAutoRefresh = func(*state.State) (bool, error) { return true, nil }
+	s.AddCleanup(func() { snapstate.CanAutoRefresh = nil })
 	snapstate.AutoAliases = func(*state.State, *snap.Info) (map[string]string, error) {
 		return nil, nil
 	}
+	s.AddCleanup(func() { snapstate.AutoAliases = nil })
 	snapstate.IsOnMeteredConnection = func() (bool, error) { return false, nil }
 
 	s.state.Set("seeded", true)
 	s.state.Set("seed-time", time.Now())
 	s.state.Set("refresh-privacy-key", "privacy-key")
-	s.restore = snapstatetest.MockDeviceModel(DefaultModel())
-}
-
-func (s *autoRefreshTestSuite) TearDownTest(c *C) {
-	snapstate.CanAutoRefresh = nil
-	snapstate.AutoAliases = nil
-	s.restore()
-	dirs.SetRootDir("")
+	s.AddCleanup(snapstatetest.MockDeviceModel(DefaultModel()))
 }
 
 func (s *autoRefreshTestSuite) TestLastRefresh(c *C) {
@@ -141,6 +159,9 @@
 	}
 	defer func() { snapstate.CanManageRefreshes = nil }()
 
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
 	s.state.Lock()
 	defer s.state.Unlock()
 
@@ -169,8 +190,13 @@
 
 		c.Check(af.NextRefresh(), DeepEquals, time.Time{})
 
+		count := strings.Count(logbuf.String(),
+			": refresh is managed via the snapd-control interface\n")
+		c.Check(count, Equals, 1, Commentf("too many occurrences:\n%s", logbuf.String()))
+
 		// ensure clean config for the next run
 		s.state.Set("config", nil)
+		logbuf.Reset()
 	}
 }
 
@@ -203,6 +229,53 @@
 	c.Check(err, IsNil)
 }
 
+func (s *autoRefreshTestSuite) TestRefreshManagedDenied(c *C) {
+	canManageCalled := false
+	snapstate.CanManageRefreshes = func(st *state.State) bool {
+		canManageCalled = true
+		// always deny
+		return false
+	}
+	defer func() { snapstate.CanManageRefreshes = nil }()
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	for _, conf := range []string{"refresh.timer", "refresh.schedule"} {
+		tr := config.NewTransaction(s.state)
+		tr.Set("core", conf, "managed")
+		tr.Commit()
+
+		af := snapstate.NewAutoRefresh(s.state)
+		for i := 0; i < 2; i++ {
+			c.Logf("ensure iteration: %v", i)
+			s.state.Unlock()
+			err := af.Ensure()
+			s.state.Lock()
+			c.Check(err, IsNil)
+			c.Check(s.store.ops, DeepEquals, []string{"list-refresh"})
+
+			refreshScheduleStr, _, err := af.RefreshSchedule()
+			c.Check(refreshScheduleStr, Equals, snapstate.DefaultRefreshSchedule)
+			c.Check(err, IsNil)
+			c.Check(canManageCalled, Equals, true)
+			count := strings.Count(logbuf.String(),
+				": managed refresh schedule denied, no properly configured snapd-control\n")
+			c.Check(count, Equals, 1, Commentf("too many occurrences:\n%s", logbuf.String()))
+
+			canManageCalled = false
+		}
+
+		// ensure clean config for the next run
+		s.state.Set("config", nil)
+		logbuf.Reset()
+		canManageCalled = false
+	}
+}
+
 func (s *autoRefreshTestSuite) TestLastRefreshNoRefreshNeeded(c *C) {
 	s.state.Lock()
 	s.state.Set("last-refresh", time.Now())
@@ -282,7 +355,7 @@
 	s.state.Set("last-refresh", initialLastRefresh)
 	s.state.Unlock()
 
-	s.store.err = &httputil.PerstistentNetworkError{Err: fmt.Errorf("error")}
+	s.store.err = &httputil.PersistentNetworkError{Err: fmt.Errorf("error")}
 	af := snapstate.NewAutoRefresh(s.state)
 	err := af.Ensure()
 	c.Check(err, ErrorMatches, "persistent network error: error")
@@ -379,6 +452,84 @@
 	c.Assert(config.IsNoOption(err), Equals, true)
 }
 
+func (s *autoRefreshTestSuite) TestLastRefreshRefreshHoldExpiredButResetWhileLockUnlocked(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	t0 := time.Now()
+	twelveHoursAgo := t0.Add(-12 * time.Hour)
+	fiveMinutesAgo := t0.Add(-5 * time.Minute)
+	oneHourInFuture := t0.Add(time.Hour)
+	s.state.Set("last-refresh", twelveHoursAgo)
+
+	holdTime := fiveMinutesAgo
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "refresh.hold", holdTime)
+	tr.Commit()
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	sent := false
+	ch := make(chan struct{})
+	// make the store snap action function trigger a background go routine to
+	// change the held-time underneath the auto-refresh
+	go func() {
+		// wait to be triggered by the snap action ops func
+		<-ch
+		s.state.Lock()
+		defer s.state.Unlock()
+
+		// now change the refresh.hold time to be an hour in the future
+		tr := config.NewTransaction(s.state)
+		tr.Set("core", "refresh.hold", oneHourInFuture)
+		tr.Commit()
+
+		// trigger the snap action ops func to proceed
+		ch <- struct{}{}
+	}()
+
+	s.store.snapActionOpsFunc = func() {
+		// only need to send once, this will be invoked multiple times for
+		// multiple snaps
+		if !sent {
+			ch <- struct{}{}
+			sent = true
+			// wait for a response to ensure that we block waiting for the new
+			// refresh time to be committed in time for us to read it after
+			// returning in this go routine
+			<-ch
+		}
+	}
+
+	af := snapstate.NewAutoRefresh(s.state)
+	s.state.Unlock()
+	err := af.Ensure()
+	s.state.Lock()
+	c.Check(err, IsNil)
+
+	var lastRefresh time.Time
+	s.state.Get("last-refresh", &lastRefresh)
+	c.Check(lastRefresh.Year(), Equals, time.Now().Year())
+
+	// hold was reset mid-way to a new value one hour into the future
+	tr = config.NewTransaction(s.state)
+	var t1 time.Time
+	err = tr.Get("core", "refresh.hold", &t1)
+	c.Assert(err, IsNil)
+
+	// when traversing json through the core config transaction, there will be
+	// different wall/monotonic clock times, we remove this ambiguity by
+	// formatting as rfc3339 which will strip this negligible difference in time
+	c.Assert(t1.Format(time.RFC3339), Equals, oneHourInFuture.Format(time.RFC3339))
+
+	// we shouldn't have had a message about "all snaps are up to date", we
+	// should have a message about being aborted mid way
+
+	c.Assert(logbuf.String(), testutil.Contains, "Auto-refresh was delayed mid-way through launching, aborting to try again later")
+	c.Assert(logbuf.String(), Not(testutil.Contains), "auto-refresh: all snaps are up-to-date")
+}
+
 func (s *autoRefreshTestSuite) TestLastRefreshRefreshHoldExpiredReschedule(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -418,6 +569,98 @@
 	c.Check(nextRefresh1.Before(nextRefresh), Equals, false)
 }
 
+func (s *autoRefreshTestSuite) TestEnsureRefreshHoldAtLeastZeroTimes(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// setup hold-time as time.Time{} and next-refresh as now to simulate real
+	// console-conf-start situations
+	t0 := time.Now()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "refresh.hold", time.Time{})
+	tr.Commit()
+
+	af := snapstate.NewAutoRefresh(s.state)
+	snapstate.MockNextRefresh(af, t0)
+
+	err := af.EnsureRefreshHoldAtLeast(time.Hour)
+	c.Assert(err, IsNil)
+
+	s.state.Unlock()
+	err = af.Ensure()
+	s.state.Lock()
+	c.Check(err, IsNil)
+
+	// refresh did not happen
+	c.Check(s.store.ops, HasLen, 0)
+
+	// hold is now more than an hour later than when the test started
+	tr = config.NewTransaction(s.state)
+	var t1 time.Time
+	err = tr.Get("core", "refresh.hold", &t1)
+	c.Assert(err, IsNil)
+
+	// use After() == false here in case somehow the t0 + 1hr is exactly t1,
+	// Before() and After() are false for the same time instants
+	c.Assert(t0.Add(time.Hour).After(t1), Equals, false)
+}
+
+func (s *autoRefreshTestSuite) TestEnsureRefreshHoldAtLeast(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// setup last-refresh as happening a long time ago, and refresh-hold as
+	// having been expired
+	t0 := time.Now()
+	s.state.Set("last-refresh", t0.Add(-12*time.Hour))
+
+	holdTime := t0.Add(-1 * time.Minute)
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "refresh.hold", holdTime)
+
+	tr.Commit()
+
+	af := snapstate.NewAutoRefresh(s.state)
+	snapstate.MockNextRefresh(af, holdTime.Add(-2*time.Minute))
+
+	err := af.EnsureRefreshHoldAtLeast(time.Hour)
+	c.Assert(err, IsNil)
+
+	s.state.Unlock()
+	err = af.Ensure()
+	s.state.Lock()
+	c.Check(err, IsNil)
+
+	// refresh did not happen
+	c.Check(s.store.ops, HasLen, 0)
+
+	// hold is now more than an hour later than when the test started
+	tr = config.NewTransaction(s.state)
+	var t1 time.Time
+	err = tr.Get("core", "refresh.hold", &t1)
+	c.Assert(err, IsNil)
+
+	// use After() == false here in case somehow the t0 + 1hr is exactly t1,
+	// Before() and After() are false for the same time instants
+	c.Assert(t0.Add(time.Hour).After(t1), Equals, false)
+
+	// setting it to a shorter time will not change it
+	err = af.EnsureRefreshHoldAtLeast(30 * time.Minute)
+	c.Assert(err, IsNil)
+
+	// time is still equal to t1
+	tr = config.NewTransaction(s.state)
+	var t2 time.Time
+	err = tr.Get("core", "refresh.hold", &t2)
+	c.Assert(err, IsNil)
+
+	// when traversing json through the core config transaction, there will be
+	// different wall/monotonic clock times, we remove this ambiguity by
+	// formatting as rfc3339 which will strip this negligible difference in time
+	c.Assert(t1.Format(time.RFC3339), Equals, t2.Format(time.RFC3339))
+}
+
 func (s *autoRefreshTestSuite) TestEffectiveRefreshHold(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -649,3 +892,89 @@
 	c.Check(err, IsNil)
 	c.Check(s.store.ops, DeepEquals, []string{"list-refresh"})
 }
+
+func (s *autoRefreshTestSuite) TestInitialInhibitRefreshWithinInhibitWindow(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	notificationCount := 0
+	restore := snapstate.MockAsyncPendingRefreshNotification(func(ctx context.Context, client *userclient.Client, refreshInfo *userclient.PendingSnapRefreshInfo) {
+		notificationCount++
+		c.Check(refreshInfo.InstanceName, Equals, "pkg")
+		c.Check(refreshInfo.TimeRemaining, Equals, time.Hour*14*24)
+	})
+	defer restore()
+
+	si := &snap.SideInfo{RealName: "pkg", Revision: snap.R(1)}
+	info := &snap.Info{SideInfo: *si}
+	snapst := &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+	}
+	err := snapstate.InhibitRefresh(s.state, snapst, info, func(si *snap.Info) error {
+		return &snapstate.BusySnapError{SnapInfo: si}
+	})
+	c.Assert(err, ErrorMatches, `snap "pkg" has running apps or hooks`)
+	c.Check(notificationCount, Equals, 1)
+}
+
+func (s *autoRefreshTestSuite) TestSubsequentInhibitRefreshWithinInhibitWindow(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	notificationCount := 0
+	restore := snapstate.MockAsyncPendingRefreshNotification(func(ctx context.Context, client *userclient.Client, refreshInfo *userclient.PendingSnapRefreshInfo) {
+		notificationCount++
+		c.Check(refreshInfo.InstanceName, Equals, "pkg")
+		// XXX: This test measures real time, with second granularity.
+		// It takes non-zero (hence the subtracted second) to execute the test.
+		c.Check(refreshInfo.TimeRemaining, Equals, time.Hour*14*24/2-time.Second)
+	})
+	defer restore()
+
+	instant := time.Now()
+	pastInstant := instant.Add(-snapstate.MaxInhibition / 2) // In the middle of the allowed window
+
+	si := &snap.SideInfo{RealName: "pkg", Revision: snap.R(1)}
+	info := &snap.Info{SideInfo: *si}
+	snapst := &snapstate.SnapState{
+		Sequence:             []*snap.SideInfo{si},
+		Current:              si.Revision,
+		RefreshInhibitedTime: &pastInstant,
+	}
+
+	err := snapstate.InhibitRefresh(s.state, snapst, info, func(si *snap.Info) error {
+		return &snapstate.BusySnapError{SnapInfo: si}
+	})
+	c.Assert(err, ErrorMatches, `snap "pkg" has running apps or hooks`)
+	c.Check(notificationCount, Equals, 1)
+}
+
+func (s *autoRefreshTestSuite) TestInhibitRefreshRefreshesWhenOverdue(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	notificationCount := 0
+	restore := snapstate.MockAsyncPendingRefreshNotification(func(ctx context.Context, client *userclient.Client, refreshInfo *userclient.PendingSnapRefreshInfo) {
+		notificationCount++
+		c.Check(refreshInfo.InstanceName, Equals, "pkg")
+		c.Check(refreshInfo.TimeRemaining, Equals, time.Duration(0))
+	})
+	defer restore()
+
+	instant := time.Now()
+	pastInstant := instant.Add(-snapstate.MaxInhibition * 2)
+
+	si := &snap.SideInfo{RealName: "pkg", Revision: snap.R(1)}
+	info := &snap.Info{SideInfo: *si}
+	snapst := &snapstate.SnapState{
+		Sequence:             []*snap.SideInfo{si},
+		Current:              si.Revision,
+		RefreshInhibitedTime: &pastInstant,
+	}
+	err := snapstate.InhibitRefresh(s.state, snapst, info, func(si *snap.Info) error {
+		return &snapstate.BusySnapError{SnapInfo: si}
+	})
+	c.Assert(err, IsNil)
+	c.Check(notificationCount, Equals, 1)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/fontconfig.go snapd-2.48.3+20.04/overlord/snapstate/backend/fontconfig.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/fontconfig.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/fontconfig.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,12 +22,12 @@
 import (
 	"fmt"
 
-	"github.com/snapcore/snapd/cmd/cmdutil"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 var updateFontconfigCaches = updateFontconfigCachesImpl
-var commandFromSystemSnap = cmdutil.CommandFromSystemSnap
+var commandFromSystemSnap = snapdtool.CommandFromSystemSnap
 
 // updateFontconfigCaches always update the fontconfig caches
 func updateFontconfigCachesImpl() error {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/link.go snapd-2.48.3+20.04/overlord/snapstate/backend/link.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/link.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/link.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,6 +25,7 @@
 	"path/filepath"
 
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/snap"
@@ -41,6 +42,14 @@
 	// PrevDisabledServices is a list snap services that were manually
 	// disable in the previous revisions of this snap
 	PrevDisabledServices []string
+
+	// VitalityRank is used to hint how much the services should be
+	// protected from the OOM killer
+	VitalityRank int
+
+	// RunInhibitHint is used only in Unlink snap, and can be used to
+	// establish run inhibition lock for refresh operations.
+	RunInhibitHint runinhibit.Hint
 }
 
 func updateCurrentSymlinks(info *snap.Info) (e error) {
@@ -81,7 +90,7 @@
 }
 
 func hasFontConfigCache(info *snap.Info) bool {
-	if info.GetType() == snap.TypeOS || info.GetType() == snap.TypeSnapd {
+	if info.Type() == snap.TypeOS || info.Type() == snap.TypeSnapd {
 		return true
 	}
 	return false
@@ -95,7 +104,7 @@
 
 	var err error
 	timings.Run(tm, "generate-wrappers", fmt.Sprintf("generate wrappers for snap %s", info.InstanceName()), func(timings.Measurer) {
-		err = b.generateWrappers(info, linkCtx.PrevDisabledServices)
+		err = b.generateWrappers(info, linkCtx)
 	})
 	if err != nil {
 		return false, err
@@ -122,7 +131,7 @@
 		})
 	}
 
-	reboot, err := boot.Participant(info, info.GetType(), dev).SetNextBoot()
+	reboot, err := boot.Participant(info, info.Type(), dev).SetNextBoot()
 	if err != nil {
 		return false, err
 	}
@@ -143,18 +152,23 @@
 		})
 	}
 
+	// Stop inhibiting application startup by removing the inhibitor file.
+	if err := runinhibit.Unlock(info.InstanceName()); err != nil {
+		return false, err
+	}
+
 	return reboot, nil
 }
 
 func (b Backend) StartServices(apps []*snap.AppInfo, meter progress.Meter, tm timings.Measurer) error {
-	return wrappers.StartServices(apps, meter, tm)
+	return wrappers.StartServices(apps, nil, nil, meter, tm)
 }
 
 func (b Backend) StopServices(apps []*snap.AppInfo, reason snap.ServiceStopReason, meter progress.Meter, tm timings.Measurer) error {
-	return wrappers.StopServices(apps, reason, meter, tm)
+	return wrappers.StopServices(apps, nil, reason, meter, tm)
 }
 
-func (b Backend) generateWrappers(s *snap.Info, disabledSvcs []string) error {
+func (b Backend) generateWrappers(s *snap.Info, linkCtx LinkContext) error {
 	var err error
 	var cleanupFuncs []func(*snap.Info) error
 	defer func() {
@@ -165,9 +179,10 @@
 		}
 	}()
 
-	if s.GetType() == snap.TypeSnapd {
+	disabledSvcs := linkCtx.PrevDisabledServices
+	if s.Type() == snap.TypeSnapd {
 		// snapd services are handled separately
-		return generateSnapdWrappers(s)
+		return GenerateSnapdWrappers(s)
 	}
 
 	// add the CLI apps from the snap.yaml
@@ -177,7 +192,10 @@
 	cleanupFuncs = append(cleanupFuncs, wrappers.RemoveSnapBinaries)
 
 	// add the daemons from the snap.yaml
-	opts := &wrappers.AddSnapServicesOptions{Preseeding: b.preseed}
+	opts := &wrappers.AddSnapServicesOptions{
+		Preseeding:   b.preseed,
+		VitalityRank: linkCtx.VitalityRank,
+	}
 	if err = wrappers.AddSnapServices(s, disabledSvcs, opts, progress.Null); err != nil {
 		return err
 	}
@@ -201,7 +219,7 @@
 }
 
 func removeGeneratedWrappers(s *snap.Info, firstInstallUndo bool, meter progress.Meter) error {
-	if s.GetType() == snap.TypeSnapd {
+	if s.Type() == snap.TypeSnapd {
 		return removeGeneratedSnapdWrappers(s, firstInstallUndo, progress.Null)
 	}
 
@@ -228,7 +246,7 @@
 	return firstErr(err1, err2, err3, err4)
 }
 
-func generateSnapdWrappers(s *snap.Info) error {
+func GenerateSnapdWrappers(s *snap.Info) error {
 	// snapd services are handled separately via an explicit helper
 	return wrappers.AddSnapdSnapServices(s, progress.Null)
 }
@@ -247,6 +265,12 @@
 // symlinks. The firstInstallUndo is true when undoing the first installation of
 // the snap.
 func (b Backend) UnlinkSnap(info *snap.Info, linkCtx LinkContext, meter progress.Meter) error {
+	var err0 error
+	if hint := linkCtx.RunInhibitHint; hint != runinhibit.HintNotInhibited {
+		// inhibit startup of new programs
+		err0 = runinhibit.LockWithHint(info.InstanceName(), hint)
+	}
+
 	// remove generated services, binaries etc
 	err1 := removeGeneratedWrappers(info, linkCtx.FirstInstall, meter)
 
@@ -254,7 +278,7 @@
 	err2 := removeCurrentSymlinks(info)
 
 	// FIXME: aggregate errors instead
-	return firstErr(err1, err2)
+	return firstErr(err0, err1, err2)
 }
 
 // ServicesEnableState returns the current enabled/disabled states of a snap's
@@ -263,6 +287,10 @@
 	return wrappers.ServicesEnableState(info, meter)
 }
 
+func (b Backend) QueryDisabledServices(info *snap.Info, pb progress.Meter) ([]string, error) {
+	return wrappers.QueryDisabledServices(info, pb)
+}
+
 func removeCurrentSymlinks(info snap.PlaceInfo) error {
 	var err1, err2 error
 
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/link_test.go snapd-2.48.3+20.04/overlord/snapstate/backend/link_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/link_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/link_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,6 +34,7 @@
 	"github.com/snapcore/snapd/boot/boottest"
 	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/progress"
@@ -240,6 +241,8 @@
 	currentDataDir, err := filepath.EvalSymlinks(currentDataSymlink)
 	c.Assert(err, IsNil)
 	c.Assert(currentDataDir, Equals, dataDir)
+
+	c.Check(filepath.Join(runinhibit.InhibitDir, "hello.lock"), testutil.FileAbsent)
 }
 
 func (s *linkSuite) TestLinkUndoIdempotent(c *C) {
@@ -278,6 +281,9 @@
 	currentDataSymlink := filepath.Join(info.DataDir(), "..", "current")
 	c.Check(osutil.FileExists(currentActiveSymlink), Equals, false)
 	c.Check(osutil.FileExists(currentDataSymlink), Equals, false)
+
+	// no inhibition lock
+	c.Check(filepath.Join(runinhibit.InhibitDir, "hello.lock"), testutil.FileAbsent)
 }
 
 func (s *linkSuite) TestLinkFailsForUnsetRevision(c *C) {
@@ -578,6 +584,7 @@
 	c.Check(filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.service"), checker)
 	c.Check(filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.socket"), checker)
 	c.Check(filepath.Join(dirs.SnapServicesDir, "usr-lib-snapd.mount"), checker)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "snapd.lock"), testutil.FileAbsent)
 }
 
 func (s *linkCleanupSuite) TestLinkCleanupFailedSnapdSnapFirstInstallOnCore(c *C) {
@@ -638,9 +645,12 @@
 	for _, entry := range generatedSnapdUnits {
 		c.Check(toEtcUnitPath(entry[0]), testutil.FilePresent)
 	}
+	// linked snaps do not have a run inhibition lock
+	c.Check(filepath.Join(runinhibit.InhibitDir, "snapd.lock"), testutil.FileAbsent)
 
 	linkCtx := backend.LinkContext{
-		FirstInstall: true,
+		FirstInstall:   true,
+		RunInhibitHint: runinhibit.HintInhibitedForRefresh,
 	}
 	err = s.be.UnlinkSnap(info, linkCtx, nil)
 	c.Assert(err, IsNil)
@@ -649,10 +659,13 @@
 	for _, entry := range generatedSnapdUnits {
 		c.Check(toEtcUnitPath(entry[0]), testutil.FileAbsent)
 	}
+	// unlinked snaps have a run inhibition lock
+	c.Check(filepath.Join(runinhibit.InhibitDir, "snapd.lock"), testutil.FilePresent)
 
 	// unlink is idempotent
 	err = s.be.UnlinkSnap(info, linkCtx, nil)
 	c.Assert(err, IsNil)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "snapd.lock"), testutil.FilePresent)
 }
 
 func (s *snapdOnCoreUnlinkSuite) TestUnlinkNonFirstSnapdOnCoreDoesNothing(c *C) {
@@ -676,9 +689,17 @@
 	}
 	// content list uses absolute paths already
 	snaptest.PopulateDir("/", units)
-	err = s.be.UnlinkSnap(info, backend.LinkContext{FirstInstall: false}, nil)
+	linkCtx := backend.LinkContext{
+		FirstInstall:   false,
+		RunInhibitHint: runinhibit.HintInhibitedForRefresh,
+	}
+	err = s.be.UnlinkSnap(info, linkCtx, nil)
 	c.Assert(err, IsNil)
 	for _, unit := range units {
 		c.Check(unit[0], testutil.FileEquals, "precious")
 	}
+
+	// unlinked snaps have a run inhibition lock. XXX: the specific inhibition hint can change.
+	c.Check(filepath.Join(runinhibit.InhibitDir, "snapd.lock"), testutil.FilePresent)
+	c.Check(filepath.Join(runinhibit.InhibitDir, "snapd.lock"), testutil.FileEquals, "refresh")
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/locking.go snapd-2.48.3+20.04/overlord/snapstate/backend/locking.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/locking.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/locking.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,93 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+package backend
+
+import (
+	"github.com/snapcore/snapd/cmd/snaplock"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snap"
+)
+
+func (b Backend) RunInhibitSnapForUnlink(info *snap.Info, hint runinhibit.Hint, decision func() error) (lock *osutil.FileLock, err error) {
+	// A process may be created after the soft refresh done upon
+	// the request to refresh a snap. If such process is alive by
+	// the time this code is reached the refresh process is stopped.
+
+	// Grab per-snap lock to prevent new processes from starting. This is
+	// sufficient to perform the check, even though individual processes
+	// may fork or exit, we will have per-security-tag information about
+	// what is running.
+	lock, err = snaplock.OpenLock(info.InstanceName())
+	if err != nil {
+		return nil, err
+	}
+	// Keep a copy of lock, so that we can close it in the function below.
+	// The regular lock variable is assigned to by return, due to the named
+	// return values.
+	lockToClose := lock
+	defer func() {
+		// If we have a lock but we are returning an error then unlock the lock
+		// by closing it.
+		if lockToClose != nil && err != nil {
+			lockToClose.Close()
+		}
+	}()
+	if err := lock.Lock(); err != nil {
+		return nil, err
+	}
+	//
+	if err := decision(); err != nil {
+		return nil, err
+	}
+	// Decision function did not fail so we can, while we still hold the snap
+	// lock, install the snap run inhibition hint, returning the snap lock to
+	// the caller.
+	//
+	// XXX: should we move this logic to the place that calls the "soft"
+	// check instead? Doing so would somewhat change the semantic of soft
+	// and hard checks, as it would effectively make hard check a no-op,
+	// but it might provide a nicer user experience.
+	if err := runinhibit.LockWithHint(info.InstanceName(), hint); err != nil {
+		return nil, err
+	}
+	return lock, nil
+}
+
+// WithSnapLock executes given action with the snap lock held.
+//
+// The lock is also used by snap-confine during pre-snap mount namespace
+// initialization. Holding it allows to ensure mutual exclusion during the
+// process of preparing a new snap app or hook processes. It does not prevent
+// existing application or hook processes from forking.
+//
+// Note that this is not a method of the Backend type, so that it can be
+// invoked from doInstall, which does not have access to a backend object.
+func WithSnapLock(info *snap.Info, action func() error) error {
+	lock, err := snaplock.OpenLock(info.InstanceName())
+	if err != nil {
+		return err
+	}
+	// Closing the lock also unlocks it, if locked.
+	defer lock.Close()
+	if err := lock.Lock(); err != nil {
+		return err
+	}
+	return action()
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/locking_test.go snapd-2.48.3+20.04/overlord/snapstate/backend/locking_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/locking_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/locking_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,99 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package backend_test
+
+import (
+	"errors"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/cmd/snaplock"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/snapstate/backend"
+	"github.com/snapcore/snapd/snap/snaptest"
+)
+
+type lockingSuite struct {
+	be backend.Backend
+}
+
+var _ = Suite(&lockingSuite{})
+
+func (s *lockingSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+}
+
+func (s *lockingSuite) TestRunInhibitSnapForUnlinkPositiveDescision(c *C) {
+	const yaml = `name: snap-name
+version: 1
+`
+	info := snaptest.MockInfo(c, yaml, nil)
+	lock, err := s.be.RunInhibitSnapForUnlink(info, "hint", func() error {
+		// This decision function returns nil so the lock is established and
+		// the inhibition hint is set.
+		return nil
+	})
+	c.Assert(err, IsNil)
+	c.Assert(lock, NotNil)
+	lock.Close()
+	hint, err := runinhibit.IsLocked(info.InstanceName())
+	c.Assert(err, IsNil)
+	c.Check(string(hint), Equals, "hint")
+}
+
+func (s *lockingSuite) TestRunInhibitSnapForUnlinkNegativeDecision(c *C) {
+	const yaml = `name: snap-name
+version: 1
+`
+	info := snaptest.MockInfo(c, yaml, nil)
+	lock, err := s.be.RunInhibitSnapForUnlink(info, "hint", func() error {
+		// This decision function returns an error so the lock is not
+		// established and the inhibition hint is not set.
+		return errors.New("propagated")
+	})
+	c.Assert(err, ErrorMatches, "propagated")
+	c.Assert(lock, IsNil)
+	hint, err := runinhibit.IsLocked(info.InstanceName())
+	c.Assert(err, IsNil)
+	c.Check(string(hint), Equals, "")
+}
+
+func (s *lockingSuite) TestWithSnapLock(c *C) {
+	const yaml = `name: snap-name
+version: 1
+`
+	info := snaptest.MockInfo(c, yaml, nil)
+
+	lock, err := snaplock.OpenLock(info.InstanceName())
+	c.Assert(err, IsNil)
+	defer lock.Close()
+	c.Assert(lock.TryLock(), IsNil) // Lock is not held
+	lock.Unlock()
+
+	err = backend.WithSnapLock(info, func() error {
+		c.Assert(lock.TryLock(), Equals, osutil.ErrAlreadyLocked) // Lock is held
+		return errors.New("error-is-propagated")
+	})
+	c.Check(err, ErrorMatches, "error-is-propagated")
+
+	c.Assert(lock.TryLock(), IsNil) // Lock is not held
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/mountunit.go snapd-2.48.3+20.04/overlord/snapstate/backend/mountunit.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/mountunit.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/mountunit.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,13 +34,13 @@
 	if preseed {
 		sysd = systemd.NewEmulationMode(dirs.GlobalRootDir)
 	} else {
-		sysd = systemd.New(dirs.GlobalRootDir, systemd.SystemMode, meter)
+		sysd = systemd.New(systemd.SystemMode, meter)
 	}
 	_, err := sysd.AddMountUnitFile(s.InstanceName(), s.Revision.String(), squashfsPath, whereDir, "squashfs")
 	return err
 }
 
 func removeMountUnit(mountDir string, meter progress.Meter) error {
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, meter)
+	sysd := systemd.New(systemd.SystemMode, meter)
 	return sysd.RemoveMountUnitFile(mountDir)
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend/setup.go snapd-2.48.3+20.04/overlord/snapstate/backend/setup.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend/setup.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend/setup.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,6 +25,7 @@
 	"path/filepath"
 
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/snap"
@@ -58,7 +59,7 @@
 		}
 
 		// this may remove the snap from /var/lib/snapd/snaps depending on installRecord
-		if e := b.RemoveSnapFiles(s, s.GetType(), installRecord, dev, meter); e != nil {
+		if e := b.RemoveSnapFiles(s, s.Type(), installRecord, dev, meter); e != nil {
 			meter.Notify(fmt.Sprintf("while trying to clean up due to previous failure: %v", e))
 		}
 	}()
@@ -90,7 +91,7 @@
 		return snapType, nil, err
 	}
 
-	t := s.GetType()
+	t := s.Type()
 	if err := boot.Kernel(s, t, dev).ExtractKernelAssets(snapf); err != nil {
 		return snapType, nil, fmt.Errorf("cannot install kernel: %s", err)
 	}
@@ -155,3 +156,8 @@
 func (b Backend) UndoSetupSnap(s snap.PlaceInfo, typ snap.Type, installRecord *InstallRecord, dev boot.Device, meter progress.Meter) error {
 	return b.RemoveSnapFiles(s, typ, installRecord, dev, meter)
 }
+
+// RemoveSnapInhibitLock removes the file controlling inhibition of "snap run".
+func (b Backend) RemoveSnapInhibitLock(instanceName string) error {
+	return runinhibit.RemoveLockFile(instanceName)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend.go snapd-2.48.3+20.04/overlord/snapstate/backend.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,8 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/snapstate/backend"
 	"github.com/snapcore/snapd/progress"
@@ -41,7 +43,7 @@
 	SnapInfo(ctx context.Context, spec store.SnapSpec, user *auth.UserState) (*snap.Info, error)
 	Find(ctx context.Context, search *store.Search, user *auth.UserState) ([]*snap.Info, error)
 
-	SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error)
+	SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error)
 
 	Sections(ctx context.Context, user *auth.UserState) ([]string, error)
 	WriteCatalogs(ctx context.Context, names io.Writer, adder store.SnapAdder) error
@@ -50,6 +52,7 @@
 	DownloadStream(context.Context, string, *snap.DownloadInfo, int64, *auth.UserState) (r io.ReadCloser, status int, err error)
 
 	Assertion(assertType *asserts.AssertionType, primaryKey []string, user *auth.UserState) (asserts.Assertion, error)
+	DownloadAssertions([]string, *asserts.Batch, *auth.UserState) error
 
 	SuggestedCurrency() string
 	Buy(options *client.BuyOptions, user *auth.UserState) (*client.BuyResult, error)
@@ -69,6 +72,7 @@
 	StartServices(svcs []*snap.AppInfo, meter progress.Meter, tm timings.Measurer) error
 	StopServices(svcs []*snap.AppInfo, reason snap.ServiceStopReason, meter progress.Meter, tm timings.Measurer) error
 	ServicesEnableState(info *snap.Info, meter progress.Meter) (map[string]bool, error)
+	QueryDisabledServices(info *snap.Info, pb progress.Meter) ([]string, error)
 
 	// the undoers for install
 	UndoSetupSnap(s snap.PlaceInfo, typ snap.Type, installRecord *backend.InstallRecord, dev boot.Device, meter progress.Meter) error
@@ -84,6 +88,7 @@
 	RemoveSnapCommonData(info *snap.Info) error
 	RemoveSnapDataDir(info *snap.Info, hasOtherInstances bool) error
 	DiscardSnapNamespace(snapName string) error
+	RemoveSnapInhibitLock(snapName string) error
 
 	// alias related
 	UpdateAliases(add []*backend.Alias, remove []*backend.Alias) error
@@ -92,4 +97,9 @@
 	// testing helpers
 	CurrentInfo(cur *snap.Info)
 	Candidate(sideInfo *snap.SideInfo)
+
+	// refresh related
+	RunInhibitSnapForUnlink(info *snap.Info, hint runinhibit.Hint, decision func() error) (*osutil.FileLock, error)
+	// (not a backend method because doInstall cannot access the backend)
+	// WithSnapLock(info *snap.Info, action func() error) error
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/backend_test.go snapd-2.48.3+20.04/overlord/snapstate/backend_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/backend_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/backend_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,12 +24,16 @@
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"path/filepath"
 	"sort"
 	"strings"
 	"sync"
 
+	. "gopkg.in/check.v1"
+
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/snapstate"
@@ -69,10 +73,25 @@
 
 	services         []string
 	disabledServices []string
+
+	vitalityRank int
+
+	inhibitHint runinhibit.Hint
 }
 
 type fakeOps []fakeOp
 
+func (ops fakeOps) MustFindOp(c *C, opName string) *fakeOp {
+	for _, op := range ops {
+		if op.op == opName {
+			return &op
+		}
+	}
+	c.Errorf("cannot find operation with op: %q, all ops: %v", opName, ops.Ops())
+	c.FailNow()
+	return nil
+}
+
 func (ops fakeOps) Ops() []string {
 	opsOps := make([]string, len(ops))
 	for i, op := range ops {
@@ -198,7 +217,7 @@
 	switch spec.Name {
 	case "core", "core16", "ubuntu-core", "some-core":
 		typ = snap.TypeOS
-	case "some-base", "core18":
+	case "some-base", "other-base", "some-other-base", "yet-another-base", "core18":
 		typ = snap.TypeBase
 	case "some-kernel":
 		typ = snap.TypeKernel
@@ -229,6 +248,7 @@
 		Version: spec.Name,
 		DownloadInfo: snap.DownloadInfo{
 			DownloadURL: "https://some-server.com/some/path.snap",
+			Size:        5,
 		},
 		Confinement: confinement,
 		SnapType:    typ,
@@ -254,6 +274,39 @@
 				Symlink: "$SNAP/usr",
 			},
 		}
+	case "channel-for-user-daemon":
+		info.Apps = map[string]*snap.AppInfo{
+			"user-daemon": {
+				Snap:        info,
+				Name:        "user-daemon",
+				Daemon:      "simple",
+				DaemonScope: "user",
+			},
+		}
+	case "channel-for-dbus-activation":
+		slot := &snap.SlotInfo{
+			Snap:      info,
+			Name:      "dbus-slot",
+			Interface: "dbus",
+			Attrs: map[string]interface{}{
+				"bus":  "system",
+				"name": "org.example.Foo",
+			},
+			Apps: make(map[string]*snap.AppInfo),
+		}
+		info.Apps = map[string]*snap.AppInfo{
+			"dbus-daemon": {
+				Snap:        info,
+				Name:        "dbus-daemon",
+				Daemon:      "simple",
+				DaemonScope: snap.SystemDaemon,
+				ActivatesOn: []*snap.SlotInfo{slot},
+				Slots: map[string]*snap.SlotInfo{
+					slot.Name: slot,
+				},
+			},
+		}
+		slot.Apps["dbus-daemon"] = info.Apps["dbus-daemon"]
 	}
 
 	return info, nil
@@ -388,14 +441,17 @@
 	return nil, store.ErrNoUpdateAvailable
 }
 
-func (f *fakeStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (f *fakeStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
 	if ctx == nil {
 		panic("context required")
 	}
 	f.pokeStateLock()
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
 
 	if len(currentSnaps) == 0 && len(actions) == 0 {
-		return nil, nil
+		return nil, nil, nil
 	}
 	if len(actions) > 4 {
 		panic("fake SnapAction unexpectedly called with more than 3 actions")
@@ -405,7 +461,7 @@
 	curSnaps := make(byName, len(currentSnaps))
 	for i, cur := range currentSnaps {
 		if cur.InstanceName == "" || cur.SnapID == "" || cur.Revision.Unset() {
-			return nil, fmt.Errorf("internal error: incomplete current snap info")
+			return nil, nil, fmt.Errorf("internal error: incomplete current snap info")
 		}
 		curByInstanceName[cur.InstanceName] = cur
 		curSnaps[i] = *cur
@@ -445,7 +501,7 @@
 			panic("not supported")
 		}
 		if a.InstanceName == "" {
-			return nil, fmt.Errorf("internal error: action without instance name")
+			return nil, nil, fmt.Errorf("internal error: action without instance name")
 		}
 
 		snapName, instanceKey := snap.SplitInstanceName(a.InstanceName)
@@ -484,7 +540,7 @@
 
 		cur := curByInstanceName[a.InstanceName]
 		if cur == nil {
-			return nil, fmt.Errorf("internal error: no matching current snap for %q", a.InstanceName)
+			return nil, nil, fmt.Errorf("internal error: no matching current snap for %q", a.InstanceName)
 		}
 		channel := a.Channel
 		if channel == "" {
@@ -522,7 +578,7 @@
 			continue
 		}
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		if !a.Revision.Unset() {
 			info.Channel = ""
@@ -538,14 +594,14 @@
 		if len(installErrors) == 0 {
 			installErrors = nil
 		}
-		return res, &store.SnapActionError{
+		return res, nil, &store.SnapActionError{
 			NoResults: len(refreshErrors)+len(installErrors)+len(res) == 0,
 			Refresh:   refreshErrors,
 			Install:   installErrors,
 		}
 	}
 
-	return res, nil
+	return res, nil, nil
 }
 
 func (f *fakeStore) SuggestedCurrency() string {
@@ -621,6 +677,8 @@
 	emptyContainer          snap.Container
 
 	servicesCurrentlyDisabled []string
+
+	lockDir string
 }
 
 func (f *fakeSnappyBackend) OpenSnapFile(snapFilePath string, si *snap.SideInfo) (*snap.Info, snap.Container, error) {
@@ -831,6 +889,7 @@
 	if len(linkCtx.PrevDisabledServices) != 0 {
 		op.disabledServices = linkCtx.PrevDisabledServices
 	}
+	op.vitalityRank = linkCtx.VitalityRank
 
 	if info.MountDir() == f.linkSnapFailTrigger {
 		op.op = "link-snap.failed"
@@ -894,6 +953,24 @@
 	return m, nil
 }
 
+func (f *fakeSnappyBackend) QueryDisabledServices(info *snap.Info, meter progress.Meter) ([]string, error) {
+	var l []string
+
+	m, err := f.ServicesEnableState(info, meter)
+	if err != nil {
+		return nil, err
+	}
+	for name, enabled := range m {
+		if !enabled {
+			l = append(l, name)
+		}
+	}
+
+	// XXX: add a fakeOp here?
+
+	return l, nil
+}
+
 func (f *fakeSnappyBackend) UndoSetupSnap(s snap.PlaceInfo, typ snap.Type, installRecord *backend.InstallRecord, dev boot.Device, p progress.Meter) error {
 	p.Notify("setup-snap")
 	f.appendOp(&fakeOp{
@@ -987,6 +1064,14 @@
 	return nil
 }
 
+func (f *fakeSnappyBackend) RemoveSnapInhibitLock(snapName string) error {
+	f.appendOp(&fakeOp{
+		op:   "remove-inhibit-lock",
+		name: snapName,
+	})
+	return nil
+}
+
 func (f *fakeSnappyBackend) Candidate(sideInfo *snap.SideInfo) {
 	var sinfo snap.SideInfo
 	if sideInfo != nil {
@@ -1050,6 +1135,22 @@
 	return nil
 }
 
+func (f *fakeSnappyBackend) RunInhibitSnapForUnlink(info *snap.Info, hint runinhibit.Hint, decision func() error) (lock *osutil.FileLock, err error) {
+	f.appendOp(&fakeOp{
+		op:          "run-inhibit-snap-for-unlink",
+		name:        info.InstanceName(),
+		inhibitHint: hint,
+	})
+	if err := decision(); err != nil {
+		return nil, err
+	}
+	if f.lockDir == "" {
+		f.lockDir = os.TempDir()
+	}
+	// XXX: returning a real lock is somewhat annoying
+	return osutil.NewFileLock(filepath.Join(f.lockDir, info.InstanceName()+".lock"))
+}
+
 func (f *fakeSnappyBackend) appendOp(op *fakeOp) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/booted_test.go snapd-2.48.3+20.04/overlord/snapstate/booted_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/booted_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/booted_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -283,7 +283,7 @@
 	c.Assert(chg.Err(), ErrorMatches, `(?ms).*Make snap "core" \(1\) available to the system \(fail\).*`)
 }
 
-func (bs *bootedSuite) TestWaitRestartCore(c *C) {
+func (bs *bootedSuite) TestFinishRestartCore(c *C) {
 	st := bs.state
 	st.Lock()
 	defer st.Unlock()
@@ -293,7 +293,7 @@
 	// not core snap
 	si := &snap.SideInfo{RealName: "some-app"}
 	snaptest.MockSnap(c, "name: some-app\nversion: 1", si)
-	err := snapstate.WaitRestart(task, &snapstate.SnapSetup{SideInfo: si})
+	err := snapstate.FinishRestart(task, &snapstate.SnapSetup{SideInfo: si})
 	c.Check(err, IsNil)
 
 	si = &snap.SideInfo{RealName: "core"}
@@ -302,13 +302,13 @@
 	// core snap, restarting ... wait
 	state.MockRestarting(st, state.RestartSystem)
 	snaptest.MockSnap(c, "name: core\ntype: os\nversion: 1", si)
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, FitsTypeOf, &state.Retry{})
 
 	// core snap, restarted, waiting for current core revision
 	state.MockRestarting(st, state.RestartUnset)
 	bs.bootloader.BootVars["snap_mode"] = boot.TryingStatus
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, DeepEquals, &state.Retry{After: 5 * time.Second})
 
 	// core snap updated
@@ -317,16 +317,16 @@
 
 	// core snap, restarted, right core revision, no rollback
 	bs.bootloader.BootVars["snap_mode"] = ""
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, IsNil)
 
 	// core snap, restarted, wrong core revision, rollback!
 	bs.bootloader.SetBootBase("core_1.snap")
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, ErrorMatches, `cannot finish core installation, there was a rollback across reboot`)
 }
 
-func (bs *bootedSuite) TestWaitRestartBootableBase(c *C) {
+func (bs *bootedSuite) TestFinishRestartBootableBase(c *C) {
 	r := snapstatetest.MockDeviceModel(ModelWithBase("core18"))
 	defer r()
 
@@ -339,13 +339,13 @@
 	// not core snap
 	si := &snap.SideInfo{RealName: "some-app", Revision: snap.R(1)}
 	snaptest.MockSnap(c, "name: some-app\nversion: 1", si)
-	err := snapstate.WaitRestart(task, &snapstate.SnapSetup{SideInfo: si})
+	err := snapstate.FinishRestart(task, &snapstate.SnapSetup{SideInfo: si})
 	c.Check(err, IsNil)
 
 	// core snap but we are on a model with a different base
 	si = &snap.SideInfo{RealName: "core"}
 	snaptest.MockSnap(c, "name: core\ntype: os\nversion: 1", si)
-	err = snapstate.WaitRestart(task, &snapstate.SnapSetup{SideInfo: si, Type: snap.TypeOS})
+	err = snapstate.FinishRestart(task, &snapstate.SnapSetup{SideInfo: si, Type: snap.TypeOS})
 	c.Check(err, IsNil)
 
 	si = &snap.SideInfo{RealName: "core18"}
@@ -353,13 +353,13 @@
 	snaptest.MockSnap(c, "name: core18\ntype: base\nversion: 1", si)
 	// core snap, restarting ... wait
 	state.MockRestarting(st, state.RestartSystem)
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, FitsTypeOf, &state.Retry{})
 
 	// core snap, restarted, waiting for current core revision
 	state.MockRestarting(st, state.RestartUnset)
 	bs.bootloader.BootVars["snap_mode"] = boot.TryingStatus
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, DeepEquals, &state.Retry{After: 5 * time.Second})
 
 	// core18 snap updated
@@ -369,16 +369,16 @@
 	// core snap, restarted, right core revision, no rollback
 	bs.bootloader.BootVars["snap_mode"] = ""
 	bs.bootloader.SetBootBase("core18_2.snap")
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, IsNil)
 
 	// core snap, restarted, wrong core revision, rollback!
 	bs.bootloader.SetBootBase("core18_1.snap")
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, ErrorMatches, `cannot finish core18 installation, there was a rollback across reboot`)
 }
 
-func (bs *bootedSuite) TestWaitRestartKernel(c *C) {
+func (bs *bootedSuite) TestFinishRestartKernel(c *C) {
 	r := snapstatetest.MockDeviceModel(DefaultModel())
 	defer r()
 
@@ -391,13 +391,13 @@
 	// not kernel snap
 	si := &snap.SideInfo{RealName: "some-app", Revision: snap.R(1)}
 	snaptest.MockSnap(c, "name: some-app\nversion: 1", si)
-	err := snapstate.WaitRestart(task, &snapstate.SnapSetup{SideInfo: si})
+	err := snapstate.FinishRestart(task, &snapstate.SnapSetup{SideInfo: si})
 	c.Check(err, IsNil)
 
 	// different kernel (may happen with remodel)
 	si = &snap.SideInfo{RealName: "other-kernel"}
 	snaptest.MockSnap(c, "name: other-kernel\ntype: kernel\nversion: 1", si)
-	err = snapstate.WaitRestart(task, &snapstate.SnapSetup{SideInfo: si, Type: snap.TypeKernel})
+	err = snapstate.FinishRestart(task, &snapstate.SnapSetup{SideInfo: si, Type: snap.TypeKernel})
 	c.Check(err, IsNil)
 
 	si = &snap.SideInfo{RealName: "kernel"}
@@ -405,13 +405,13 @@
 	snaptest.MockSnap(c, "name: kernel\ntype: kernel\nversion: 1", si)
 	// kernel snap, restarting ... wait
 	state.MockRestarting(st, state.RestartSystem)
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, FitsTypeOf, &state.Retry{})
 
 	// kernel snap, restarted, waiting for current core revision
 	state.MockRestarting(st, state.RestartUnset)
 	bs.bootloader.BootVars["snap_mode"] = boot.TryingStatus
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, DeepEquals, &state.Retry{After: 5 * time.Second})
 
 	// kernel snap updated
@@ -421,16 +421,16 @@
 	// kernel snap, restarted, right kernel revision, no rollback
 	bs.bootloader.BootVars["snap_mode"] = ""
 	bs.bootloader.SetBootKernel("kernel_2.snap")
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, IsNil)
 
 	// kernel snap, restarted, wrong core revision, rollback!
 	bs.bootloader.SetBootKernel("kernel_1.snap")
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, ErrorMatches, `cannot finish kernel installation, there was a rollback across reboot`)
 }
 
-func (bs *bootedSuite) TestWaitRestartEphemeralModeSkipsRollbackDetection(c *C) {
+func (bs *bootedSuite) TestFinishRestartEphemeralModeSkipsRollbackDetection(c *C) {
 	r := snapstatetest.MockDeviceModel(DefaultModel())
 	defer r()
 
@@ -445,13 +445,13 @@
 	snaptest.MockSnap(c, "name: kernel\ntype: kernel\nversion: 1", si)
 	// kernel snap, restarted, wrong core revision, rollback detected!
 	bs.bootloader.SetBootKernel("kernel_1.snap")
-	err := snapstate.WaitRestart(task, snapsup)
+	err := snapstate.FinishRestart(task, snapsup)
 	c.Check(err, ErrorMatches, `cannot finish kernel installation, there was a rollback across reboot`)
 
 	// but *not* in an ephemeral mode like "recover" - we skip the rollback
 	// detection here
 	r = snapstatetest.MockDeviceModelAndMode(DefaultModel(), "install")
 	defer r()
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, IsNil)
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/catalogrefresh.go snapd-2.48.3+20.04/overlord/snapstate/catalogrefresh.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/catalogrefresh.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/catalogrefresh.go	2021-02-02 08:21:12.000000000 +0000
@@ -73,6 +73,19 @@
 		return nil
 	}
 
+	// similar to the not yet seeded case, on uc20 install mode it doesn't make
+	// sense to refresh the catalog for an ephemeral system
+	deviceCtx, err := DeviceCtx(r.state, nil, nil)
+	if err != nil {
+		// if we are seeded we should have a device context
+		return err
+	}
+
+	if deviceCtx.SystemMode() == "install" {
+		// skip the refresh
+		return nil
+	}
+
 	now := time.Now()
 	delay := catalogRefreshDelayBase
 	if r.nextCatalogRefresh.IsZero() {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/catalogrefresh_test.go snapd-2.48.3+20.04/overlord/snapstate/catalogrefresh_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/catalogrefresh_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/catalogrefresh_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,6 +34,7 @@
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/snapstate/snapstatetest"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/store"
 	"github.com/snapcore/snapd/store/storetest"
@@ -77,6 +78,8 @@
 
 	store  *catalogStore
 	tmpdir string
+
+	testutil.BaseTest
 }
 
 var _ = Suite(&catalogRefreshTestSuite{})
@@ -92,11 +95,11 @@
 	// mark system as seeded
 	s.state.Set("seeded", true)
 
-	snapstate.CanAutoRefresh = func(*state.State) (bool, error) { return true, nil }
-}
+	// setup a simple deviceCtx since we check that for install mode
+	s.AddCleanup(snapstatetest.MockDeviceModel(DefaultModel()))
 
-func (s *catalogRefreshTestSuite) TearDownTest(c *C) {
-	snapstate.CanAutoRefresh = nil
+	snapstate.CanAutoRefresh = func(*state.State) (bool, error) { return true, nil }
+	s.AddCleanup(func() { snapstate.CanAutoRefresh = nil })
 }
 
 func (s *catalogRefreshTestSuite) TestCatalogRefresh(c *C) {
@@ -210,6 +213,31 @@
 
 	cr7 := snapstate.NewCatalogRefresh(s.state)
 	// next is initially zero
+	c.Check(snapstate.NextCatalogRefresh(cr7).IsZero(), Equals, true)
+
+	err := cr7.Ensure()
+	c.Assert(err, IsNil)
+
+	// next should be still zero as we skipped refresh on unseeded system
+	c.Check(snapstate.NextCatalogRefresh(cr7).IsZero(), Equals, true)
+	// nothing got created
+	c.Check(osutil.FileExists(dirs.SnapSectionsFile), Equals, false)
+	c.Check(osutil.FileExists(dirs.SnapNamesFile), Equals, false)
+	c.Check(osutil.FileExists(dirs.SnapCommandsDB), Equals, false)
+}
+
+func (s *catalogRefreshTestSuite) TestCatalogRefreshUC20InstallMode(c *C) {
+	// mark system as being in install mode
+	trivialInstallDevice := &snapstatetest.TrivialDeviceContext{
+		DeviceModel: DefaultModel(),
+		SysMode:     "install",
+	}
+
+	r := snapstatetest.MockDeviceContext(trivialInstallDevice)
+	defer r()
+
+	cr7 := snapstate.NewCatalogRefresh(s.state)
+	// next is initially zero
 	c.Check(snapstate.NextCatalogRefresh(cr7).IsZero(), Equals, true)
 
 	err := cr7.Ensure()
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/check_snap.go snapd-2.48.3+20.04/overlord/snapstate/check_snap.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/check_snap.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/check_snap.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,7 +27,6 @@
 
 	"github.com/snapcore/snapd/arch"
 	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/snapstate/backend"
@@ -35,6 +34,7 @@
 	"github.com/snapcore/snapd/release"
 	seccomp_compiler "github.com/snapcore/snapd/sandbox/seccomp"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 // featureSet contains the flag values that can be listed in assumes entries
@@ -205,7 +205,7 @@
 		return false
 	}
 
-	if cmd.Version == "unknown" {
+	if snapdtool.Version == "unknown" {
 		return true // Development tree.
 	}
 
@@ -213,7 +213,7 @@
 	// this code (see PR#7344). However this would change current
 	// behavior, i.e. "2.41~pre1" would *not* match [snapd2.41] anymore
 	// (which the code below does).
-	cur := versionExp.FindStringSubmatch(cmd.Version)
+	cur := versionExp.FindStringSubmatch(snapdtool.Version)
 	if cur == nil {
 		return false
 	}
@@ -405,7 +405,7 @@
 }
 
 func checkSnapdName(st *state.State, snapInfo, curInfo *snap.Info, _ snap.Container, flags Flags, deviceCtx DeviceContext) error {
-	if snapInfo.GetType() != snap.TypeSnapd {
+	if snapInfo.Type() != snap.TypeSnapd {
 		// not a relevant check
 		return nil
 	}
@@ -417,7 +417,7 @@
 }
 
 func checkCoreName(st *state.State, snapInfo, curInfo *snap.Info, _ snap.Container, flags Flags, deviceCtx DeviceContext) error {
-	if snapInfo.GetType() != snap.TypeOS {
+	if snapInfo.Type() != snap.TypeOS {
 		// not a relevant check
 		return nil
 	}
@@ -453,7 +453,7 @@
 }
 
 func checkGadgetOrKernel(st *state.State, snapInfo, curInfo *snap.Info, snapf snap.Container, flags Flags, deviceCtx DeviceContext) error {
-	typ := snapInfo.GetType()
+	typ := snapInfo.Type()
 	kind := ""
 	var whichName func(*asserts.Model) string
 	switch typ {
@@ -513,7 +513,7 @@
 
 func checkBases(st *state.State, snapInfo, curInfo *snap.Info, _ snap.Container, flags Flags, deviceCtx DeviceContext) error {
 	// check if this is relevant
-	if snapInfo.GetType() != snap.TypeApp && snapInfo.GetType() != snap.TypeGadget {
+	if snapInfo.Type() != snap.TypeApp && snapInfo.Type() != snap.TypeGadget {
 		return nil
 	}
 	if snapInfo.Base == "" {
@@ -608,7 +608,7 @@
 	}
 
 	// Run /.../snap-seccomp version-info
-	vi, err := seccomp_compiler.CompilerVersionInfo(cmd.InternalToolPath)
+	vi, err := seccomp_compiler.CompilerVersionInfo(snapdtool.InternalToolPath)
 	if err != nil {
 		return fmt.Errorf("cannot obtain seccomp compiler information: %v", err)
 	}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/check_snap_test.go snapd-2.48.3+20.04/overlord/snapstate/check_snap_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/check_snap_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/check_snap_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,11 +22,11 @@
 import (
 	"errors"
 	"fmt"
+	"os/user"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/arch"
-	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/state"
@@ -34,6 +34,7 @@
 	seccomp_compiler "github.com/snapcore/snapd/sandbox/seccomp"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/testutil"
 
 	"github.com/snapcore/snapd/overlord/snapstate"
@@ -160,16 +161,16 @@
 }}
 
 func (s *checkSnapSuite) TestCheckSnapAssumes(c *C) {
-	restore := cmd.MockVersion("2.15")
+	restore := snapdtool.MockVersion("2.15")
 	defer restore()
 
 	restore = release.MockOnClassic(false)
 	defer restore()
 
 	for _, test := range assumesTests {
-		cmd.Version = test.version
-		if cmd.Version == "" {
-			cmd.Version = "2.15"
+		snapdtool.Version = test.version
+		if snapdtool.Version == "" {
+			snapdtool.Version = "2.15"
 		}
 		release.OnClassic = test.classic
 
@@ -1132,7 +1133,23 @@
 	}
 }
 
-func (s *checkSnapSuite) TestCheckSnapSystemUsernamesCalls(c *C) {
+func (s *checkSnapSuite) TestCheckSnapSystemUsernamesCallsSnapDaemon(c *C) {
+	r := osutil.MockFindGid(func(groupname string) (uint64, error) {
+		if groupname == "snap_daemon" || groupname == "snapd-range-524288-root" {
+			return 0, user.UnknownGroupError(groupname)
+		}
+		return 0, fmt.Errorf("unexpected call to FindGid for %s", groupname)
+	})
+	defer r()
+
+	r = osutil.MockFindUid(func(username string) (uint64, error) {
+		if username == "snap_daemon" || username == "snapd-range-524288-root" {
+			return 0, user.UnknownUserError(username)
+		}
+		return 0, fmt.Errorf("unexpected call to FindUid for %s", username)
+	})
+	defer r()
+
 	falsePath := osutil.LookPathDefault("false", "/bin/false")
 	for _, classic := range []bool{false, true} {
 		restore := release.MockOnClassic(classic)
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/dbus.go snapd-2.48.3+20.04/overlord/snapstate/dbus.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/dbus.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/dbus.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,86 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate
+
+import (
+	"fmt"
+
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
+)
+
+func getActivatableDBusServices(info *snap.Info) (session, system map[string]bool) {
+	session = make(map[string]bool)
+	system = make(map[string]bool)
+	for _, app := range info.Apps {
+		for _, slot := range app.ActivatesOn {
+			busName, ok := slot.Attrs["name"].(string)
+			// Should not fail for info that has passed
+			// validation
+			if !ok {
+				continue
+			}
+			switch app.DaemonScope {
+			case snap.SystemDaemon:
+				system[busName] = true
+			case snap.UserDaemon:
+				session[busName] = true
+			}
+		}
+	}
+	return session, system
+}
+
+func checkDBusServiceConflicts(st *state.State, info *snap.Info) error {
+	sessionServices, systemServices := getActivatableDBusServices(info)
+
+	// If there are no activatable services, we're done
+	if len(sessionServices) == 0 && len(systemServices) == 0 {
+		return nil
+	}
+
+	stateMap, err := All(st)
+	if err != nil {
+		return err
+	}
+	for instanceName, snapst := range stateMap {
+		if instanceName == info.InstanceName() {
+			continue
+		}
+
+		otherInfo, err := snapst.CurrentInfo()
+		if err != nil {
+			return err
+		}
+
+		otherSessionServices, otherSystemServices := getActivatableDBusServices(otherInfo)
+		for svc := range sessionServices {
+			if otherSessionServices[svc] {
+				return fmt.Errorf("snap %q requesting to activate on session bus name %q conflicts with snap %q use", info.InstanceName(), svc, instanceName)
+			}
+		}
+		for svc := range systemServices {
+			if otherSystemServices[svc] {
+				return fmt.Errorf("snap %q requesting to activate on system bus name %q conflicts with snap %q use", info.InstanceName(), svc, instanceName)
+			}
+		}
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/dbus_test.go snapd-2.48.3+20.04/overlord/snapstate/dbus_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/dbus_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/dbus_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,297 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate_test
+
+import (
+	"context"
+	"fmt"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/snap"
+)
+
+const (
+	dbusSessionYamlTemplate = `name: %s
+slots:
+  dbus-slot:
+    interface: dbus
+    bus: session
+    name: org.example.Foo
+apps:
+  daemon:
+    daemon: simple
+    daemon-scope: user
+    activates-on: [dbus-slot]
+`
+	dbusSystemYamlTemplate = `name: %s
+slots:
+  dbus-slot:
+    interface: dbus
+    bus: system
+    name: org.example.Foo
+apps:
+  daemon:
+    daemon: simple
+    activates-on: [dbus-slot]
+`
+)
+
+func (s *snapmgrTestSuite) TestCheckDBusServiceConflictsSystem(c *C) {
+	someSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "some-snap")))
+	c.Assert(err, IsNil)
+	otherSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "other-snap")))
+	c.Assert(err, IsNil)
+
+	restore := snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		switch name {
+		case "some-snap":
+			return someSnap, nil
+		case "other-snap":
+			return otherSnap, nil
+		default:
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+	si := &snap.SideInfo{
+		RealName: "other-snap",
+		Revision: snap.R(-42),
+	}
+	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	err = snapstate.CheckDBusServiceConflicts(s.state, someSnap)
+	c.Assert(err, ErrorMatches, `snap "some-snap" requesting to activate on system bus name "org.example.Foo" conflicts with snap "other-snap" use`)
+}
+
+func (s *snapmgrTestSuite) TestCheckDBusServiceConflictsSession(c *C) {
+	someSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSessionYamlTemplate, "some-snap")))
+	c.Assert(err, IsNil)
+	otherSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSessionYamlTemplate, "other-snap")))
+	c.Assert(err, IsNil)
+
+	restore := snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		switch name {
+		case "some-snap":
+			return someSnap, nil
+		case "other-snap":
+			return otherSnap, nil
+		default:
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+	si := &snap.SideInfo{
+		RealName: "other-snap",
+		Revision: snap.R(-42),
+	}
+	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	err = snapstate.CheckDBusServiceConflicts(s.state, someSnap)
+	c.Assert(err, ErrorMatches, `snap "some-snap" requesting to activate on session bus name "org.example.Foo" conflicts with snap "other-snap" use`)
+}
+
+func (s *snapmgrTestSuite) TestCheckDBusServiceConflictsDifferentBuses(c *C) {
+	sessionSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSessionYamlTemplate, "session-snap")))
+	c.Assert(err, IsNil)
+	systemSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "system-snap")))
+	c.Assert(err, IsNil)
+
+	restore := snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		switch name {
+		case "session-snap":
+			return sessionSnap, nil
+		case "system-snap":
+			return systemSnap, nil
+		default:
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// A snap claiming a name on the system bus does not conflict
+	// with a snap providing the same name on the session bus.
+	si := &snap.SideInfo{
+		RealName: "system-snap",
+		Revision: snap.R(-42),
+	}
+	snapstate.Set(s.state, "system-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+	err = snapstate.CheckDBusServiceConflicts(s.state, sessionSnap)
+	c.Check(err, IsNil)
+
+	// ... and the reverse
+	snapstate.Set(s.state, "system-snap", nil)
+	si = &snap.SideInfo{
+		RealName: "session-snap",
+		Revision: snap.R(-42),
+	}
+	snapstate.Set(s.state, "session-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+	err = snapstate.CheckDBusServiceConflicts(s.state, systemSnap)
+	c.Check(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestCheckDBusServiceConflictsNoConflictWithSelf(c *C) {
+	info, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSessionYamlTemplate, "some-snap")))
+	c.Assert(err, IsNil)
+	restore := snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		switch name {
+		case "some-snap":
+			return info, nil
+		default:
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// No conflicts on first installation
+	err = snapstate.CheckDBusServiceConflicts(s.state, info)
+	c.Assert(err, IsNil)
+
+	// Snap does not conflict against itself
+	si := &snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(-42),
+	}
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+	err = snapstate.CheckDBusServiceConflicts(s.state, info)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallDBusActivationConflicts(c *C) {
+	someSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "some-snap")))
+	c.Assert(err, IsNil)
+	otherSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "other-snap")))
+	c.Assert(err, IsNil)
+
+	restore := snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		switch name {
+		case "some-snap":
+			return someSnap, nil
+		case "other-snap":
+			return otherSnap, nil
+		default:
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	si := &snap.SideInfo{
+		RealName: "other-snap",
+		Revision: snap.R(-42),
+	}
+	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.dbus-activation", true)
+	tr.Commit()
+
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-dbus-activation"}
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `snap "some-snap" requesting to activate on system bus name "org.example.Foo" conflicts with snap "other-snap" use`)
+}
+
+func (s *snapmgrTestSuite) TestInstallManyDBusActivationConflicts(c *C) {
+	someSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "some-snap")))
+	c.Assert(err, IsNil)
+	otherSnap, err := snap.InfoFromSnapYaml([]byte(fmt.Sprintf(dbusSystemYamlTemplate, "other-snap")))
+	c.Assert(err, IsNil)
+
+	restore := snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		switch name {
+		case "some-snap":
+			return someSnap, nil
+		case "other-snap":
+			return otherSnap, nil
+		default:
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.dbus-activation", true)
+	tr.Commit()
+
+	snapNames := []string{"some-snap", "other-snap"}
+	_, tss, err := snapstate.InstallMany(s.state, snapNames, s.user.ID)
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install two snaps")
+	for _, ts := range tss {
+		chg.AddAll(ts)
+	}
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	// The order of installation is indeterminant, but one will fail
+	c.Check(chg.Err(), ErrorMatches, `cannot perform the following tasks:\n- Make snap "(some|other)-snap" \(11\) available to the system \(snap "(some|other)-snap" requesting to activate on system bus name "org.example.Foo" conflicts with snap "(some|other)-snap" use\)`)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/devicectx.go snapd-2.48.3+20.04/overlord/snapstate/devicectx.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/devicectx.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/devicectx.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,9 +28,6 @@
 // A DeviceContext provides for operating as a given device and with
 // its brand store either for normal operation or over a remodeling.
 type DeviceContext interface {
-	// Model returns the governing device model assertion for the context.
-	Model() *asserts.Model
-
 	// GroundContext returns a context corresponding to the
 	// original model of the device for a remodel, or a context
 	// equivalent to this one otherwise, except in both cases
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/export_test.go snapd-2.48.3+20.04/overlord/snapstate/export_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,6 +25,8 @@
 
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/store"
+	userclient "github.com/snapcore/snapd/usersession/client"
 )
 
 type ManagerBackend managerBackend
@@ -90,15 +92,22 @@
 	ValidateFeatureFlags   = validateFeatureFlags
 	ResolveChannel         = resolveChannel
 
+	CurrentSnaps = currentSnaps
+
 	DefaultContentPlugProviders = defaultContentPlugProviders
 
 	HasOtherInstances = hasOtherInstances
+
+	SafetyMarginDiskSpace = safetyMarginDiskSpace
 )
 
 func PreviousSideInfo(snapst *SnapState) *snap.SideInfo {
 	return snapst.previousSideInfo()
 }
 
+// helpers
+var InstallSize = installSize
+
 // aliases v2
 var (
 	ApplyAliasesChange    = applyAliasesChange
@@ -109,6 +118,11 @@
 	SwitchSummary         = switchSummary
 )
 
+// dbus
+var (
+	CheckDBusServiceConflicts = checkDBusServiceConflicts
+)
+
 // readme files
 var (
 	WriteSnapReadme = writeSnapReadme
@@ -124,6 +138,9 @@
 	NewCatalogRefresh            = newCatalogRefresh
 	CatalogRefreshDelayBase      = catalogRefreshDelayBase
 	CatalogRefreshDelayWithDelta = catalogRefreshDelayWithDelta
+
+	SoftCheckNothingRunningForRefresh     = softCheckNothingRunningForRefresh
+	HardEnsureNothingRunningDuringRefresh = hardEnsureNothingRunningDuringRefresh
 )
 
 func MockNextRefresh(ar *autoRefresh, when time.Time) {
@@ -174,6 +191,14 @@
 	}
 }
 
+func MockAsyncPendingRefreshNotification(fn func(context.Context, *userclient.Client, *userclient.PendingSnapRefreshInfo)) (restore func()) {
+	old := asyncPendingRefreshNotification
+	asyncPendingRefreshNotification = fn
+	return func() {
+		asyncPendingRefreshNotification = old
+	}
+}
+
 // re-refresh related
 var (
 	RefreshedSnaps  = refreshedSnaps
@@ -208,14 +233,6 @@
 
 type AuxStoreInfo = auxStoreInfo
 
-func MockPidsCgroupDir(dir string) (restore func()) {
-	old := pidsCgroupDir
-	pidsCgroupDir = dir
-	return func() {
-		pidsCgroupDir = old
-	}
-}
-
 // link, misc handlers
 var (
 	MissingDisabledServices = missingDisabledServices
@@ -224,3 +241,64 @@
 func (m *SnapManager) MaybeUndoRemodelBootChanges(t *state.Task) error {
 	return m.maybeUndoRemodelBootChanges(t)
 }
+
+func MockPidsOfSnap(f func(instanceName string) (map[string][]int, error)) func() {
+	old := pidsOfSnap
+	pidsOfSnap = f
+	return func() {
+		pidsOfSnap = old
+	}
+}
+
+func MockCurrentSnaps(f func(st *state.State) ([]*store.CurrentSnap, error)) func() {
+	old := currentSnaps
+	currentSnaps = f
+	return func() {
+		currentSnaps = old
+	}
+}
+
+func MockInstallSize(f func(st *state.State, snaps []*snap.Info, userID int) (uint64, error)) func() {
+	old := installSize
+	installSize = f
+	return func() {
+		installSize = old
+	}
+}
+
+func MockGenerateSnapdWrappers(f func(snapInfo *snap.Info) error) func() {
+	old := generateSnapdWrappers
+	generateSnapdWrappers = f
+	return func() {
+		generateSnapdWrappers = old
+	}
+}
+
+var (
+	NotifyLinkParticipants = notifyLinkParticipants
+)
+
+// autorefresh
+var (
+	InhibitRefresh = inhibitRefresh
+	MaxInhibition  = maxInhibition
+)
+
+func NewBusySnapError(info *snap.Info, pids []int, busyAppNames, busyHookNames []string) *BusySnapError {
+	return &BusySnapError{
+		SnapInfo:      info,
+		pids:          pids,
+		busyAppNames:  busyAppNames,
+		busyHookNames: busyHookNames,
+	}
+}
+
+func MockGenericRefreshCheck(fn func(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error) (restore func()) {
+	old := genericRefreshCheck
+	genericRefreshCheck = fn
+	return func() { genericRefreshCheck = old }
+}
+
+func (m *autoRefresh) EnsureRefreshHoldAtLeast(d time.Duration) error {
+	return m.ensureRefreshHoldAtLeast(d)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/flags.go snapd-2.48.3+20.04/overlord/snapstate/flags.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/flags.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/flags.go	2021-02-02 08:21:12.000000000 +0000
@@ -42,6 +42,9 @@
 	// to ignore refresh control validation.
 	IgnoreValidation bool `json:"ignore-validation,omitempty"`
 
+	// IgnoreRunning is set to indicate that running apps or hooks should be ignored.
+	IgnoreRunning bool `json:"ignore-running,omitempty"`
+
 	// Required is set to mark that a snap is required
 	// and cannot be removed
 	Required bool `json:"required,omitempty"`
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/handlers.go snapd-2.48.3+20.04/overlord/snapstate/handlers.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/handlers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/handlers.go	2021-02-02 08:21:12.000000000 +0000
@@ -33,6 +33,7 @@
 	"gopkg.in/tomb.v2"
 
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/features"
 	"github.com/snapcore/snapd/i18n"
@@ -792,31 +793,13 @@
 	return m.backend.RemoveSnapDir(snapsup.placeInfo(), otherInstances)
 }
 
-// queryDisabledServices returns a list of all currently disabled snap services
-// in the snap.
+// queryDisabledServices uses wrappers.QueryDisabledServices()
+//
 // Note this function takes a snap info rather than snapst because there are
 // situations where we want to call this on non-current snap infos, i.e. in the
 // undo handlers, see undoLinkSnap for an example.
 func (m *SnapManager) queryDisabledServices(info *snap.Info, pb progress.Meter) ([]string, error) {
-	// save the list of services that are in the disabled state before unlinking
-	// and thus removing the snap services
-	snapSvcStates, err := m.backend.ServicesEnableState(info, pb)
-	if err != nil {
-		return nil, err
-	}
-
-	disabledSnapSvcs := []string{}
-	// add all disabled services to the list
-	for svc, isEnabled := range snapSvcStates {
-		if !isEnabled {
-			disabledSnapSvcs = append(disabledSnapSvcs, svc)
-		}
-	}
-
-	// sort for easier testing
-	sort.Strings(disabledSnapSvcs)
-
-	return disabledSnapSvcs, nil
+	return m.backend.QueryDisabledServices(info, pb)
 }
 
 func (m *SnapManager) doUnlinkCurrentSnap(t *state.Task, _ *tomb.Tomb) error {
@@ -851,17 +834,15 @@
 		return err
 	}
 
-	if experimentalRefreshAppAwareness {
-		// A process may be created after the soft refresh done upon
-		// the request to refresh a snap. If such process is alive by
-		// the time this code is reached the refresh process is stopped.
-		// In case of failure the snap state is modified to indicate
-		// when the refresh was first inhibited. If the first
-		// inhibition is outside of a grace period then refresh
-		// proceeds regardless of the existing processes.
-		if err := inhibitRefresh(st, snapst, oldInfo, HardNothingRunningRefreshCheck); err != nil {
+	if experimentalRefreshAppAwareness && !snapsup.Flags.IgnoreRunning {
+		// Invoke the hard refresh flow. Upon success the returned lock will be
+		// held to prevent snap-run from advancing until UnlinkSnap, executed
+		// below, completes.
+		lock, err := hardEnsureNothingRunningDuringRefresh(m.backend, st, snapst, oldInfo)
+		if err != nil {
 			return err
 		}
+		defer lock.Close()
 	}
 
 	snapst.Active = false
@@ -869,6 +850,9 @@
 	// do the final unlink
 	linkCtx := backend.LinkContext{
 		FirstInstall: false,
+		// This task is only used for unlinking a snap during refreshes so we
+		// can safely hard-code this condition here.
+		RunInhibitHint: runinhibit.HintInhibitedForRefresh,
 	}
 	err = m.backend.UnlinkSnap(oldInfo, linkCtx, NewTaskProgressAdapterLocked(t))
 	if err != nil {
@@ -877,6 +861,9 @@
 
 	// mark as inactive
 	Set(st, snapsup.InstanceName(), snapst)
+
+	// Notify link snap participants about link changes.
+	notifyLinkParticipants(t, snapsup.InstanceName())
 	return nil
 }
 
@@ -913,9 +900,14 @@
 	}
 
 	snapst.Active = true
+	vitalityRank, err := vitalityRank(st, snapsup.InstanceName())
+	if err != nil {
+		return err
+	}
 	linkCtx := backend.LinkContext{
 		PrevDisabledServices: svcsToDisable,
 		FirstInstall:         false,
+		VitalityRank:         vitalityRank,
 	}
 	reboot, err := m.backend.LinkSnap(oldInfo, deviceCtx, linkCtx, perfTimings)
 	if err != nil {
@@ -930,10 +922,12 @@
 	// mark as active again
 	Set(st, snapsup.InstanceName(), snapst)
 
+	// Notify link snap participants about link changes.
+	notifyLinkParticipants(t, snapsup.InstanceName())
+
 	// if we just put back a previous a core snap, request a restart
 	// so that we switch executing its snapd
 	m.maybeRestart(t, oldInfo, reboot, deviceCtx)
-
 	return nil
 }
 
@@ -1103,6 +1097,63 @@
 	return missingSvcs, foundSvcs, nil
 }
 
+func vitalityRank(st *state.State, instanceName string) (rank int, err error) {
+	tr := config.NewTransaction(st)
+
+	var vitalityStr string
+	err = tr.GetMaybe("core", "resilience.vitality-hint", &vitalityStr)
+	if err != nil {
+		return 0, err
+	}
+	for i, s := range strings.Split(vitalityStr, ",") {
+		if s == instanceName {
+			return i + 1, nil
+		}
+	}
+	return 0, nil
+}
+
+// LinkSnapParticipant is an interface for interacting with snap link/unlink
+// operations.
+//
+// Unlike the interface for a task handler, only one notification method is
+// used. The method notifies a participant that linkage of a snap has changed.
+// This method is invoked in link-snap, unlink-snap, the undo path of those
+// methods and the undo handler for link-snap.
+//
+// In all cases it is invoked after all other operations are completed but
+// before the task completes.
+type LinkSnapParticipant interface {
+	// SnapLinkageChanged is called when a snap is linked or unlinked.
+	// The error is only logged and does not stop the task it is used from.
+	SnapLinkageChanged(st *state.State, instanceName string) error
+}
+
+var linkSnapParticipants []LinkSnapParticipant
+
+// AddLinkSnapParticipant adds a participant in the link/unlink operations.
+func AddLinkSnapParticipant(p LinkSnapParticipant) {
+	linkSnapParticipants = append(linkSnapParticipants, p)
+}
+
+// MockLinkSnapParticipants replaces the list of link snap participants for testing.
+func MockLinkSnapParticipants(ps []LinkSnapParticipant) (restore func()) {
+	old := linkSnapParticipants
+	linkSnapParticipants = ps
+	return func() {
+		linkSnapParticipants = old
+	}
+}
+
+func notifyLinkParticipants(t *state.Task, instanceName string) {
+	st := t.State()
+	for _, p := range linkSnapParticipants {
+		if err := p.SnapLinkageChanged(st, instanceName); err != nil {
+			t.Errorf("%v", err)
+		}
+	}
+}
+
 func (m *SnapManager) doLinkSnap(t *state.Task, _ *tomb.Tomb) (err error) {
 	st := t.State()
 	st.Lock()
@@ -1189,10 +1240,16 @@
 	}
 
 	// record type
-	snapst.SetType(newInfo.GetType())
+	snapst.SetType(newInfo.Type())
 
 	pb := NewTaskProgressAdapterLocked(t)
 
+	// Check for D-Bus service conflicts a second time to detect
+	// conflicts within a transaction.
+	if err := checkDBusServiceConflicts(st, newInfo); err != nil {
+		return err
+	}
+
 	// get the services which LinkSnap should disable when generating wrappers,
 	// as well as the services which are not present in this revision, but were
 	// present and disabled in a previous one and as such should be kept inside
@@ -1202,9 +1259,14 @@
 		return err
 	}
 
+	vitalityRank, err := vitalityRank(st, snapsup.InstanceName())
+	if err != nil {
+		return err
+	}
 	linkCtx := backend.LinkContext{
 		FirstInstall:         oldCurrent.Unset(),
 		PrevDisabledServices: svcsToDisable,
+		VitalityRank:         vitalityRank,
 	}
 	reboot, err := m.backend.LinkSnap(newInfo, deviceCtx, linkCtx, perfTimings)
 	// defer a cleanup helper which will unlink the snap if anything fails after
@@ -1220,6 +1282,7 @@
 		if unlinkErr != nil {
 			t.Errorf("cannot cleanup failed attempt at making snap %q available to the system: %v", snapsup.InstanceName(), unlinkErr)
 		}
+		notifyLinkParticipants(t, snapsup.InstanceName())
 	}()
 	if err != nil {
 		return err
@@ -1267,9 +1330,6 @@
 	// Record the fact that the snap was refreshed successfully.
 	snapst.RefreshInhibitedTime = nil
 
-	// Do at the end so we only preserve the new state if it worked.
-	Set(st, snapsup.InstanceName(), snapst)
-
 	if cand.SnapID != "" {
 		// write the auxiliary store info
 		aux := &auxStoreInfo{
@@ -1297,7 +1357,7 @@
 
 	// Compatibility with old snapd: check if we have auto-connect task and
 	// if not, inject it after self (link-snap) for snaps that are not core
-	if newInfo.GetType() != snap.TypeOS {
+	if newInfo.Type() != snap.TypeOS {
 		var hasAutoConnect, hasSetupProfiles bool
 		for _, other := range t.Change().Tasks() {
 			// Check if this is auto-connect task for same snap and we it's part of the change with setup-profiles task
@@ -1320,6 +1380,12 @@
 		}
 	}
 
+	// Do at the end so we only preserve the new state if it worked.
+	Set(st, snapsup.InstanceName(), snapst)
+
+	// Notify link snap participants about link changes.
+	notifyLinkParticipants(t, snapsup.InstanceName())
+
 	// Make sure if state commits and snapst is mutated we won't be rerun
 	t.SetStatus(state.DoneStatus)
 
@@ -1347,7 +1413,7 @@
 		return
 	}
 
-	typ := info.GetType()
+	typ := info.Type()
 
 	// if bp is non-trivial then either we're not on classic, or the snap is
 	// snapd. So daemonRestartReason will always return "" which is what we
@@ -1439,7 +1505,7 @@
 	if err != nil && err != ErrNoCurrent {
 		return err
 	}
-	bp := boot.Participant(info, info.GetType(), groundDeviceCtx)
+	bp := boot.Participant(info, info.Type(), groundDeviceCtx)
 	reboot, err := bp.SetNextBoot()
 	if err != nil {
 		return err
@@ -1626,7 +1692,7 @@
 	// the cleanup is performed by snapd from core;
 	// when reverting a subsequent snapd revision, the restart happens in
 	// undoLinkCurrentSnap() instead
-	if linkCtx.FirstInstall && newInfo.GetType() == snap.TypeSnapd {
+	if linkCtx.FirstInstall && newInfo.Type() == snap.TypeSnapd {
 		// only way to get
 		deviceCtx, err := DeviceCtx(st, t, nil)
 		if err != nil {
@@ -1636,12 +1702,16 @@
 		m.maybeRestart(t, newInfo, rebootRequired, deviceCtx)
 	}
 
-	// mark as inactive
-	Set(st, snapsup.InstanceName(), snapst)
 	// write sequence file for failover helpers
 	if err := writeSeqFile(snapsup.InstanceName(), snapst); err != nil {
 		return err
 	}
+	// mark as inactive
+	Set(st, snapsup.InstanceName(), snapst)
+
+	// Notify link snap participants about link changes.
+	notifyLinkParticipants(t, snapsup.InstanceName())
+
 	// Make sure if state commits and snapst is mutated we won't be rerun
 	t.SetStatus(state.UndoneStatus)
 
@@ -1650,7 +1720,7 @@
 	// snap. We need to undo that restart here. Instead of in
 	// doUnlinkCurrentSnap() like we usually do when going from
 	// core snap -> next core snap
-	if release.OnClassic && newInfo.GetType() == snap.TypeOS && oldCurrent.Unset() {
+	if release.OnClassic && newInfo.Type() == snap.TypeOS && oldCurrent.Unset() {
 		t.Logf("Requested daemon restart (undo classic initial core install)")
 		st.RequestRestart(state.RestartDaemon)
 	}
@@ -1858,9 +1928,81 @@
 	snapst.Active = false
 	Set(st, snapsup.InstanceName(), snapst)
 
+	// Notify link snap participants about link changes.
+	notifyLinkParticipants(t, snapsup.InstanceName())
+
 	return err
 }
 
+func (m *SnapManager) undoUnlinkSnap(t *state.Task, _ *tomb.Tomb) error {
+	st := t.State()
+	st.Lock()
+	defer st.Unlock()
+
+	perfTimings := state.TimingsForTask(t)
+	defer perfTimings.Save(st)
+
+	snapsup, snapst, err := snapSetupAndState(t)
+	if err != nil {
+		return err
+	}
+
+	isInstalled := snapst.IsInstalled()
+	if !isInstalled {
+		return fmt.Errorf("internal error: snap %q not installed anymore", snapsup.InstanceName())
+	}
+
+	info, err := snapst.CurrentInfo()
+	if err != nil {
+		return err
+	}
+
+	deviceCtx, err := DeviceCtx(st, t, nil)
+	if err != nil {
+		return err
+	}
+
+	// undo here may be part of failed snap remove change, in which case a later
+	// "clear-snap" task could have been executed and some or all of the
+	// data of this snap could be lost. If that's the case, then we should not
+	// enable the snap back.
+	// XXX: should make an exception for snapd/core?
+	place := snapsup.placeInfo()
+	for _, dir := range []string{place.DataDir(), place.CommonDataDir()} {
+		if exists, _, _ := osutil.DirExists(dir); !exists {
+			t.Logf("cannot link snap %q back, some of its data has already been removed", snapsup.InstanceName())
+			// TODO: mark the snap broken at the SnapState level when we have
+			// such concept.
+			return nil
+		}
+	}
+
+	snapst.Active = true
+	Set(st, snapsup.InstanceName(), snapst)
+
+	vitalityRank, err := vitalityRank(st, snapsup.InstanceName())
+	if err != nil {
+		return err
+	}
+	linkCtx := backend.LinkContext{
+		FirstInstall: false,
+		VitalityRank: vitalityRank,
+	}
+	reboot, err := m.backend.LinkSnap(info, deviceCtx, linkCtx, perfTimings)
+	if err != nil {
+		return err
+	}
+
+	// Notify link snap participants about link changes.
+	notifyLinkParticipants(t, snapsup.InstanceName())
+
+	// if we just linked back a core snap, request a restart
+	// so that we switch executing its snapd.
+	m.maybeRestart(t, info, reboot, deviceCtx)
+
+	return nil
+}
+
 func (m *SnapManager) doClearSnapData(t *state.Task, _ *tomb.Tomb) error {
 	st := t.State()
 	st.Lock()
@@ -1961,6 +2103,10 @@
 			t.Errorf("cannot discard snap namespace %q, will retry in 3 mins: %s", snapsup.InstanceName(), err)
 			return &state.Retry{After: 3 * time.Minute}
 		}
+		err = m.backend.RemoveSnapInhibitLock(snapsup.InstanceName())
+		if err != nil {
+			return err
+		}
 		if err := m.removeSnapCookie(st, snapsup.InstanceName()); err != nil {
 			return fmt.Errorf("cannot remove snap cookie: %v", err)
 		}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/handlers_link_test.go snapd-2.48.3+20.04/overlord/snapstate/handlers_link_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/handlers_link_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/handlers_link_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -92,6 +92,10 @@
 	// we start without the auxiliary store info
 	c.Check(snapstate.AuxStoreInfoFilename("foo-id"), testutil.FileAbsent)
 
+	lp := &testLinkParticipant{}
+	restore := snapstate.MockLinkSnapParticipants([]snapstate.LinkSnapParticipant{lp})
+	defer restore()
+
 	s.state.Lock()
 	t := s.state.NewTask("link-snap", "test")
 	t.Set("snap-setup", &snapstate.SnapSetup{
@@ -133,6 +137,9 @@
 
 	// we end with the auxiliary store info
 	c.Check(snapstate.AuxStoreInfoFilename("foo-id"), testutil.FilePresent)
+
+	// link snap participant was invoked
+	c.Check(lp.instanceNames, DeepEquals, []string{"foo"})
 }
 
 func (s *linkSnapSuite) TestDoLinkSnapSuccessWithCohort(c *C) {
@@ -328,6 +335,28 @@
 func (s *linkSnapSuite) TestDoUndoLinkSnap(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
+
+	linkChangeCount := 0
+	lp := &testLinkParticipant{
+		linkageChanged: func(st *state.State, instanceName string) error {
+			var snapst snapstate.SnapState
+			err := snapstate.Get(st, instanceName, &snapst)
+			linkChangeCount++
+			switch linkChangeCount {
+			case 1:
+				// Initially the snap gets linked.
+				c.Check(err, IsNil)
+				c.Check(snapst.Active, Equals, true)
+			case 2:
+				// Then link-snap is undone and the snap gets unlinked.
+				c.Check(err, Equals, state.ErrNoState)
+			}
+			return nil
+		},
+	}
+	restore := snapstate.MockLinkSnapParticipants([]snapstate.LinkSnapParticipant{lp})
+	defer restore()
+
 	// a hook might have set some config
 	cfg := json.RawMessage(`{"c":true}`)
 	err := config.SetSnapConfig(s.state, "foo", &cfg)
@@ -374,11 +403,184 @@
 	c.Check(config, HasLen, 1)
 	_, ok := config["core"]
 	c.Check(ok, Equals, true)
+
+	// link snap participant was invoked, once for do, once for undo.
+	c.Check(lp.instanceNames, DeepEquals, []string{"foo", "foo"})
+}
+
+func (s *linkSnapSuite) TestDoUnlinkCurrentSnapWithIgnoreRunning(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// With refresh-app-awareness enabled
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.refresh-app-awareness", true)
+	tr.Commit()
+
+	// With a snap "pkg" at revision 42
+	si := &snap.SideInfo{RealName: "pkg", Revision: snap.R(42)}
+	snapstate.Set(s.state, "pkg", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{si},
+		Current:  si.Revision,
+		Active:   true,
+	})
+
+	// With an app belonging to the snap that is apparently running.
+	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		c.Assert(name, Equals, "pkg")
+		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
+		info.Apps = map[string]*snap.AppInfo{
+			"app": {Snap: info, Name: "app"},
+		}
+		return info, nil
+	})
+	restore := snapstate.MockPidsOfSnap(func(instanceName string) (map[string][]int, error) {
+		c.Assert(instanceName, Equals, "pkg")
+		return map[string][]int{"snap.pkg.app": {1234}}, nil
+	})
+	defer restore()
+
+	// We can unlink the current revision of that snap, by setting IgnoreRunning flag.
+	task := s.state.NewTask("unlink-current-snap", "")
+	task.Set("snap-setup", &snapstate.SnapSetup{
+		SideInfo: si,
+		Flags:    snapstate.Flags{IgnoreRunning: true},
+	})
+	chg := s.state.NewChange("dummy", "...")
+	chg.AddTask(task)
+
+	// Run the task we created
+	s.state.Unlock()
+	s.se.Ensure()
+	s.se.Wait()
+	s.state.Lock()
+
+	// And observe the results.
+	var snapst snapstate.SnapState
+	err := snapstate.Get(s.state, "pkg", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Active, Equals, false)
+	c.Check(snapst.Sequence, HasLen, 1)
+	c.Check(snapst.Current, Equals, snap.R(42))
+	c.Check(task.Status(), Equals, state.DoneStatus)
+	expected := fakeOps{{
+		op:   "unlink-snap",
+		path: filepath.Join(dirs.SnapMountDir, "pkg/42"),
+	}}
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+}
+
+func (s *linkSnapSuite) TestDoUndoUnlinkCurrentSnapWithVitalityScore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	// foo has a vitality-hint
+	cfg := json.RawMessage(`{"resilience":{"vitality-hint":"bar,foo,baz"}}`)
+	err := config.SetSnapConfig(s.state, "core", &cfg)
+	c.Assert(err, IsNil)
+
+	si1 := &snap.SideInfo{
+		RealName: "foo",
+		Revision: snap.R(11),
+	}
+	si2 := &snap.SideInfo{
+		RealName: "foo",
+		Revision: snap.R(33),
+	}
+	snapstate.Set(s.state, "foo", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{si1},
+		Current:  si1.Revision,
+		Active:   true,
+	})
+	t := s.state.NewTask("unlink-current-snap", "test")
+	t.Set("snap-setup", &snapstate.SnapSetup{
+		SideInfo: si2,
+	})
+	chg := s.state.NewChange("dummy", "...")
+	chg.AddTask(t)
+
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(t)
+	chg.AddTask(terr)
+
+	s.state.Unlock()
+
+	for i := 0; i < 3; i++ {
+		s.se.Ensure()
+		s.se.Wait()
+	}
+
+	s.state.Lock()
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "foo", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Active, Equals, true)
+	c.Check(snapst.Sequence, HasLen, 1)
+	c.Check(snapst.Current, Equals, snap.R(11))
+	c.Check(t.Status(), Equals, state.UndoneStatus)
+
+	expected := fakeOps{
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "foo/11"),
+		},
+		{
+			op:           "link-snap",
+			path:         filepath.Join(dirs.SnapMountDir, "foo/11"),
+			vitalityRank: 2,
+		},
+	}
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+}
+
+func (s *linkSnapSuite) TestDoLinkSnapWithVitalityScore(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	// a hook might have set some config
+	cfg := json.RawMessage(`{"resilience":{"vitality-hint":"bar,foo,baz"}}`)
+	err := config.SetSnapConfig(s.state, "core", &cfg)
+	c.Assert(err, IsNil)
+
+	si := &snap.SideInfo{
+		RealName: "foo",
+		Revision: snap.R(33),
+	}
+	t := s.state.NewTask("link-snap", "test")
+	t.Set("snap-setup", &snapstate.SnapSetup{
+		SideInfo: si,
+	})
+	chg := s.state.NewChange("dummy", "...")
+	chg.AddTask(t)
+
+	s.state.Unlock()
+
+	for i := 0; i < 6; i++ {
+		s.se.Ensure()
+		s.se.Wait()
+	}
+
+	s.state.Lock()
+	expected := fakeOps{
+		{
+			op:    "candidate",
+			sinfo: *si,
+		},
+		{
+			op:           "link-snap",
+			path:         filepath.Join(dirs.SnapMountDir, "foo/33"),
+			vitalityRank: 2,
+		},
+	}
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
 }
 
 func (s *linkSnapSuite) TestDoLinkSnapTryToCleanupOnError(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
+
+	lp := &testLinkParticipant{}
+	restore := snapstate.MockLinkSnapParticipants([]snapstate.LinkSnapParticipant{lp})
+	defer restore()
+
 	si := &snap.SideInfo{
 		RealName: "foo",
 		Revision: snap.R(35),
@@ -424,6 +626,9 @@
 	// start with an easier-to-read error if this fails:
 	c.Check(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
 	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	// link snap participant was invoked
+	c.Check(lp.instanceNames, DeepEquals, []string{"foo"})
 }
 
 func (s *linkSnapSuite) TestDoLinkSnapSuccessCoreRestarts(c *C) {
@@ -720,6 +925,28 @@
 	restore := release.MockOnClassic(true)
 	defer restore()
 
+	linkChangeCount := 0
+	lp := &testLinkParticipant{
+		linkageChanged: func(st *state.State, instanceName string) error {
+			var snapst snapstate.SnapState
+			err := snapstate.Get(st, instanceName, &snapst)
+			linkChangeCount++
+			switch linkChangeCount {
+			case 1:
+				// Initially the snap gets unlinked.
+				c.Check(err, IsNil)
+				c.Check(snapst.Active, Equals, false)
+			case 2:
+				// Then the undo handler re-links it.
+				c.Check(err, IsNil)
+				c.Check(snapst.Active, Equals, true)
+			}
+			return nil
+		},
+	}
+	restore = snapstate.MockLinkSnapParticipants([]snapstate.LinkSnapParticipant{lp})
+	defer restore()
+
 	s.state.Lock()
 	defer s.state.Unlock()
 	si1 := &snap.SideInfo{
@@ -764,6 +991,7 @@
 	c.Check(t.Status(), Equals, state.UndoneStatus)
 
 	c.Check(s.stateBackend.restartRequested, DeepEquals, []state.RestartType{state.RestartDaemon})
+	c.Check(lp.instanceNames, DeepEquals, []string{"core", "core"})
 }
 
 func (s *linkSnapSuite) TestDoUndoUnlinkCurrentSnapCoreBase(c *C) {
@@ -1197,7 +1425,7 @@
 	c.Check(t.Log()[1], Matches, `.*INFO unlink`)
 }
 
-func (s *linkSnapSuite) TestDoUnlinkSnapRefreshAwarenessHardCheck(c *C) {
+func (s *linkSnapSuite) TestDoUnlinkSnapRefreshAwarenessHardCheckOn(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
@@ -1214,6 +1442,10 @@
 	s.state.Lock()
 	defer s.state.Unlock()
 
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.refresh-app-awareness", false)
+	tr.Commit()
+
 	chg := s.testDoUnlinkSnapRefreshAwareness(c)
 
 	c.Check(chg.Err(), IsNil)
@@ -1222,12 +1454,10 @@
 func (s *linkSnapSuite) testDoUnlinkSnapRefreshAwareness(c *C) *state.Change {
 	restore := release.MockOnClassic(true)
 	defer restore()
-	mockPidsCgroupDir := c.MkDir()
-	restore = snapstate.MockPidsCgroupDir(mockPidsCgroupDir)
-	defer restore()
 
-	// mock that "some-snap" has an app and that this app has pids running
-	writePids(c, filepath.Join(mockPidsCgroupDir, "snap.some-snap.some-app"), []int{1234})
+	dirs.SetRootDir(c.MkDir())
+	defer dirs.SetRootDir("/")
+
 	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
 		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
 		info.Apps = map[string]*snap.AppInfo{
@@ -1235,6 +1465,14 @@
 		}
 		return info, nil
 	})
+	// mock that "some-snap" has an app and that this app has pids running
+	restore = snapstate.MockPidsOfSnap(func(instanceName string) (map[string][]int, error) {
+		c.Assert(instanceName, Equals, "some-snap")
+		return map[string][]int{
+			"snap.some-snap.some-app": {1234},
+		}, nil
+	})
+	defer restore()
 
 	si1 := &snap.SideInfo{
 		RealName: "some-snap",
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/handlers_prepare_test.go snapd-2.48.3+20.04/overlord/snapstate/handlers_prepare_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/handlers_prepare_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/handlers_prepare_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -73,6 +73,9 @@
 	s.AddCleanup(reset1)
 	s.AddCleanup(reset2)
 	s.AddCleanup(snapstatetest.MockDeviceModel(nil))
+
+	restoreCheckFreeSpace := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return nil })
+	s.AddCleanup(restoreCheckFreeSpace)
 }
 
 func (s *baseHandlerSuite) SetUpTest(c *C) {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/handlers_prereq_test.go snapd-2.48.3+20.04/overlord/snapstate/handlers_prereq_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/handlers_prereq_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/handlers_prereq_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -57,6 +57,14 @@
 	s.state.Set("seeded", true)
 	s.state.Set("refresh-privacy-key", "privacy-key")
 	s.AddCleanup(snapstatetest.MockDeviceModel(DefaultModel()))
+
+	restoreCheckFreeSpace := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return nil })
+	s.AddCleanup(restoreCheckFreeSpace)
+
+	restoreInstallSize := snapstate.MockInstallSize(func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+		return 0, nil
+	})
+	s.AddCleanup(restoreInstallSize)
 }
 
 func (s *prereqSuite) TestDoPrereqNothingToDo(c *C) {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/handlers_test.go snapd-2.48.3+20.04/overlord/snapstate/handlers_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/handlers_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/handlers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,11 +20,15 @@
 package snapstate_test
 
 import (
+	"fmt"
+
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/snapstate/snapstatetest"
+	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
 )
 
 type handlersSuite struct {
@@ -217,3 +221,65 @@
 		c.Assert(err, Equals, tt.err, Commentf(tt.comment))
 	}
 }
+
+type testLinkParticipant struct {
+	callCount      int
+	instanceNames  []string
+	linkageChanged func(st *state.State, instanceName string) error
+}
+
+func (lp *testLinkParticipant) SnapLinkageChanged(st *state.State, instanceName string) error {
+	lp.callCount++
+	lp.instanceNames = append(lp.instanceNames, instanceName)
+	if lp.linkageChanged != nil {
+		return lp.linkageChanged(st, instanceName)
+	}
+	return nil
+}
+
+func (s *handlersSuite) TestAddLinkParticipant(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// Mock link snap participants. This ensures we can add a participant
+	// without affecting the other tests, as the original list will be
+	// restored.
+	restore := snapstate.MockLinkSnapParticipants(nil)
+	defer restore()
+
+	lp := &testLinkParticipant{
+		linkageChanged: func(st *state.State, instanceName string) error {
+			c.Assert(st, NotNil)
+			c.Check(instanceName, Equals, "snap-name")
+			return nil
+		},
+	}
+	snapstate.AddLinkSnapParticipant(lp)
+
+	t := s.state.NewTask("link-snap", "test")
+	snapstate.NotifyLinkParticipants(t, "snap-name")
+	c.Assert(lp.callCount, Equals, 1)
+}
+
+func (s *handlersSuite) TestNotifyLinkParticipantsErrorHandling(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// See comment in TestAddLinkParticipant for details.
+	restore := snapstate.MockLinkSnapParticipants(nil)
+	defer restore()
+
+	lp := &testLinkParticipant{
+		linkageChanged: func(st *state.State, instanceName string) error {
+			return fmt.Errorf("something failed")
+		},
+	}
+	snapstate.AddLinkSnapParticipant(lp)
+
+	t := s.state.NewTask("link-snap", "test")
+	snapstate.NotifyLinkParticipants(t, "snap-name")
+	c.Assert(lp.callCount, Equals, 1)
+	logs := t.Log()
+	c.Assert(logs, HasLen, 1)
+	c.Check(logs[0], testutil.Contains, "ERROR something failed")
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/policy/base.go snapd-2.48.3+20.04/overlord/snapstate/policy/base.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/policy/base.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/policy/base.go	2021-02-02 08:21:12.000000000 +0000
@@ -102,7 +102,7 @@
 		for _, si := range snapst.Sequence {
 			snapInfo, err := snap.ReadInfo(name, si)
 			if err == nil {
-				if typ := snapInfo.GetType(); typ != snap.TypeApp && typ != snap.TypeGadget {
+				if typ := snapInfo.Type(); typ != snap.TypeApp && typ != snap.TypeGadget {
 					continue
 				}
 				if !(baseName == snapInfo.Base || (alsoCore16 && snapInfo.Base == "core16")) {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/refresh.go snapd-2.48.3+20.04/overlord/snapstate/refresh.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/refresh.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/refresh.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,33 +21,29 @@
 
 import (
 	"fmt"
+	"path/filepath"
 	"sort"
 	"strings"
 
-	"github.com/snapcore/snapd/cmd/snaplock"
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/snapstate/backend"
+	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/sandbox/cgroup"
 	"github.com/snapcore/snapd/snap"
+	userclient "github.com/snapcore/snapd/usersession/client"
 )
 
-var (
-	pidsCgroupDir = cgroup.ControllerPathV1("pids")
-)
+// pidsOfSnap is a mockable version of PidsOfSnap
+var pidsOfSnap = cgroup.PidsOfSnap
 
-func genericRefreshCheck(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error {
-	// Grab per-snap lock to prevent new processes from starting. This is
-	// sufficient to perform the check, even though individual processes
-	// may fork or exit, we will have per-security-tag information about
-	// what is running.
-	lock, err := snaplock.OpenLock(info.SnapName())
+var genericRefreshCheck = func(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error {
+	knownPids, err := pidsOfSnap(info.InstanceName())
 	if err != nil {
 		return err
 	}
-	// Closing the lock also unlocks it, if locked.
-	defer lock.Close()
-	if err := lock.Lock(); err != nil {
-		return err
-	}
 
+	// Due to specific of the interaction with locking, all locking is performed by the caller.
 	var busyAppNames []string
 	var busyHookNames []string
 	var busyPIDs []int
@@ -63,11 +59,7 @@
 		if canAppRunDuringRefresh(app) {
 			continue
 		}
-		PIDs, err := cgroup.PidsInGroup(pidsCgroupDir, app.SecurityTag())
-		if err != nil {
-			return err
-		}
-		if len(PIDs) > 0 {
+		if PIDs := knownPids[app.SecurityTag()]; len(PIDs) > 0 {
 			busyAppNames = append(busyAppNames, name)
 			busyPIDs = append(busyPIDs, PIDs...)
 		}
@@ -77,11 +69,7 @@
 		if canHookRunDuringRefresh(hook) {
 			continue
 		}
-		PIDs, err := cgroup.PidsInGroup(pidsCgroupDir, hook.SecurityTag())
-		if err != nil {
-			return err
-		}
-		if len(PIDs) > 0 {
+		if PIDs := knownPids[hook.SecurityTag()]; len(PIDs) > 0 {
 			busyHookNames = append(busyHookNames, name)
 			busyPIDs = append(busyPIDs, PIDs...)
 		}
@@ -93,7 +81,7 @@
 	sort.Strings(busyHookNames)
 	sort.Ints(busyPIDs)
 	return &BusySnapError{
-		snapName:      info.SnapName(),
+		SnapInfo:      info,
 		busyAppNames:  busyAppNames,
 		busyHookNames: busyHookNames,
 		pids:          busyPIDs,
@@ -137,26 +125,49 @@
 
 // BusySnapError indicates that snap has apps or hooks running and cannot refresh.
 type BusySnapError struct {
-	snapName      string
+	SnapInfo      *snap.Info
 	pids          []int
 	busyAppNames  []string
 	busyHookNames []string
 }
 
+// PendingSnapRefreshInfo computes information necessary to perform user notification
+// of postponed refresh of a snap, based on the information about snap "business".
+//
+// The returned value contains the instance name of the snap as well as, if possible,
+// information relevant for desktop notification services, such as application name
+// and the snapd-generated desktop file name.
+func (err *BusySnapError) PendingSnapRefreshInfo() *userclient.PendingSnapRefreshInfo {
+	refreshInfo := &userclient.PendingSnapRefreshInfo{
+		InstanceName: err.SnapInfo.InstanceName(),
+	}
+	for _, appName := range err.busyAppNames {
+		if app, ok := err.SnapInfo.Apps[appName]; ok {
+			path := app.DesktopFile()
+			if osutil.FileExists(path) {
+				refreshInfo.BusyAppName = appName
+				refreshInfo.BusyAppDesktopEntry = strings.SplitN(filepath.Base(path), ".", 2)[0]
+				break
+			}
+		}
+	}
+	return refreshInfo
+}
+
 // Error formats an error string describing what is running.
 func (err *BusySnapError) Error() string {
 	switch {
 	case len(err.busyAppNames) > 0 && len(err.busyHookNames) > 0:
 		return fmt.Sprintf("snap %q has running apps (%s) and hooks (%s)",
-			err.snapName, strings.Join(err.busyAppNames, ", "), strings.Join(err.busyHookNames, ", "))
+			err.SnapInfo.InstanceName(), strings.Join(err.busyAppNames, ", "), strings.Join(err.busyHookNames, ", "))
 	case len(err.busyAppNames) > 0:
 		return fmt.Sprintf("snap %q has running apps (%s)",
-			err.snapName, strings.Join(err.busyAppNames, ", "))
+			err.SnapInfo.InstanceName(), strings.Join(err.busyAppNames, ", "))
 	case len(err.busyHookNames) > 0:
 		return fmt.Sprintf("snap %q has running hooks (%s)",
-			err.snapName, strings.Join(err.busyHookNames, ", "))
+			err.SnapInfo.InstanceName(), strings.Join(err.busyHookNames, ", "))
 	default:
-		return fmt.Sprintf("snap %q has running apps or hooks", err.snapName)
+		return fmt.Sprintf("snap %q has running apps or hooks", err.SnapInfo.InstanceName())
 	}
 }
 
@@ -171,3 +182,50 @@
 func (err BusySnapError) Pids() []int {
 	return err.pids
 }
+
+// hardEnsureNothingRunningDuringRefresh performs the complete hard refresh interaction.
+//
+// This check uses HardNothingRunningRefreshCheck along with interaction with
+// two locks - the snap lock, shared by snap-confine and snapd and the snap run
+// inhibition lock, shared by snapd and snap run.
+//
+// On success this function returns a locked snap lock, allowing the caller to
+// atomically, with regards to "snap-confine", finish any action that required
+// the apps and hooks not to be running. In addition, the persistent run
+// inhibition lock is established, forcing snap-run to pause and postpone
+// startup of applications from the given snap.
+//
+// In practice, we either inhibit app startup and refresh the snap _or_ inhibit
+// the refresh change and continue running existing app processes.
+func hardEnsureNothingRunningDuringRefresh(backend managerBackend, st *state.State, snapst *SnapState, info *snap.Info) (*osutil.FileLock, error) {
+	return backend.RunInhibitSnapForUnlink(info, runinhibit.HintInhibitedForRefresh, func() error {
+		// In case of successful refresh inhibition the snap state is modified
+		// to indicate when the refresh was first inhibited. If the first
+		// refresh inhibition is outside of a grace period then refresh
+		// proceeds regardless of the existing processes.
+		return inhibitRefresh(st, snapst, info, HardNothingRunningRefreshCheck)
+	})
+}
+
+// softCheckNothingRunningForRefresh checks if non-service apps are off for a snap refresh.
+//
+// The details of the check are explained by SoftNothingRunningRefreshCheck.
+// The check is performed while holding the snap lock, which ensures that we
+// are not racing with snap-confine, which is starting a new process in the
+// context of the given snap.
+//
+// In the case that the check fails, the state is modified to reflect when the
+// refresh was first postponed. Eventually the check does not fail, even if
+// non-service apps are running, because this mechanism only allows postponing
+// refreshes for a bounded amount of time.
+func softCheckNothingRunningForRefresh(st *state.State, snapst *SnapState, info *snap.Info) error {
+	// Grab per-snap lock to prevent new processes from starting. This is
+	// sufficient to perform the check, even though individual processes may
+	// fork or exit, we will have per-security-tag information about what is
+	// running.
+	return backend.WithSnapLock(info, func() error {
+		// Perform the soft refresh viability check, possibly writing to the state
+		// on failure.
+		return inhibitRefresh(st, snapst, info, SoftNothingRunningRefreshCheck)
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/refreshhints.go snapd-2.48.3+20.04/overlord/snapstate/refreshhints.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/refreshhints.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/refreshhints.go	2021-02-02 08:21:12.000000000 +0000
@@ -65,7 +65,7 @@
 
 func (r *refreshHints) refresh() error {
 	var refreshManaged bool
-	refreshManaged, _ = refreshScheduleManaged(r.state)
+	refreshManaged, _, _ = refreshScheduleManaged(r.state)
 
 	var err error
 	perfTimings := timings.New(map[string]string{"ensure": "refresh-hints"})
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/refreshhints_test.go snapd-2.48.3+20.04/overlord/snapstate/refreshhints_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/refreshhints_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/refreshhints_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -40,7 +40,10 @@
 	ops []string
 }
 
-func (r *recordingStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (r *recordingStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
 	if ctx == nil || !auth.IsEnsureContext(ctx) {
 		panic("Ensure marked context required")
 	}
@@ -53,7 +56,7 @@
 		}
 	}
 	r.ops = append(r.ops, "list-refresh")
-	return nil, nil
+	return nil, nil, nil
 }
 
 type refreshHintsTestSuite struct {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/refresh_test.go snapd-2.48.3+20.04/overlord/snapstate/refresh_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/refresh_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/refresh_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,14 +20,13 @@
 package snapstate_test
 
 import (
-	"bytes"
-	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/cmd/snaplock/runinhibit"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/overlord/snapstate"
 	"github.com/snapcore/snapd/overlord/state"
@@ -40,24 +39,15 @@
 	testutil.BaseTest
 	state *state.State
 	info  *snap.Info
-
-	// paths of the PID cgroup of each app or hook.
-	daemonPath string
-	appPath    string
-	hookPath   string
+	pids  map[string][]int
 }
 
 var _ = Suite(&refreshSuite{})
 
 func (s *refreshSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
-
 	dirs.SetRootDir(c.MkDir())
-	mockPidsCgroupDir := c.MkDir()
-	s.AddCleanup(snapstate.MockPidsCgroupDir(mockPidsCgroupDir))
-
 	yamlText := `
-name: foo
+name: pkg
 version: 1
 apps:
   daemon:
@@ -69,80 +59,67 @@
   configure:
 `
 	s.info = snaptest.MockInfo(c, yamlText, nil)
-	s.daemonPath = filepath.Join(mockPidsCgroupDir, s.info.Apps["daemon"].SecurityTag())
-	s.appPath = filepath.Join(mockPidsCgroupDir, s.info.Apps["app"].SecurityTag())
-	s.hookPath = filepath.Join(mockPidsCgroupDir, s.info.Hooks["configure"].SecurityTag())
-}
-
-func (s *refreshSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("")
-	s.BaseTest.TearDownTest(c)
-}
-
-func writePids(c *C, dir string, pids []int) {
-	err := os.MkdirAll(dir, 0755)
-	c.Assert(err, IsNil)
-	var buf bytes.Buffer
-	for _, pid := range pids {
-		fmt.Fprintf(&buf, "%d\n", pid)
-	}
-	err = ioutil.WriteFile(filepath.Join(dir, "cgroup.procs"), buf.Bytes(), 0644)
-	c.Assert(err, IsNil)
+	s.pids = nil
+	restore := snapstate.MockPidsOfSnap(func(instanceName string) (map[string][]int, error) {
+		c.Assert(instanceName, Equals, s.info.InstanceName())
+		return s.pids, nil
+	})
+	s.AddCleanup(restore)
+	s.AddCleanup(func() { dirs.SetRootDir("") })
+	s.state = state.New(nil)
 }
 
 func (s *refreshSuite) TestSoftNothingRunningRefreshCheck(c *C) {
-	// There are no errors when PID cgroup is absent.
-	err := snapstate.SoftNothingRunningRefreshCheck(s.info)
-	c.Check(err, IsNil)
-
 	// Services are not blocking soft refresh check,
 	// they will be stopped before refresh.
-	writePids(c, s.daemonPath, []int{100})
-	err = snapstate.SoftNothingRunningRefreshCheck(s.info)
+	s.pids = map[string][]int{
+		"snap.pkg.daemon": {100},
+	}
+	err := snapstate.SoftNothingRunningRefreshCheck(s.info)
 	c.Check(err, IsNil)
 
 	// Apps are blocking soft refresh check. They are not stopped by
 	// snapd, unless the app is running for longer than the maximum
 	// duration allowed for postponing refreshes.
-	writePids(c, s.daemonPath, []int{100})
-	writePids(c, s.appPath, []int{101})
+	s.pids = map[string][]int{
+		"snap.pkg.daemon": {100},
+		"snap.pkg.app":    {101},
+	}
 	err = snapstate.SoftNothingRunningRefreshCheck(s.info)
 	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `snap "foo" has running apps (app)`)
+	c.Check(err.Error(), Equals, `snap "pkg" has running apps (app)`)
 	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{101})
 
 	// Hooks behave just like apps. IDEA: perhaps hooks should not be
 	// killed this way? They have their own life-cycle management.
-	writePids(c, s.daemonPath, []int{})
-	writePids(c, s.appPath, []int{})
-	writePids(c, s.hookPath, []int{105})
+	s.pids = map[string][]int{
+		"snap.pkg.hook.configure": {105},
+	}
 	err = snapstate.SoftNothingRunningRefreshCheck(s.info)
 	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `snap "foo" has running hooks (configure)`)
+	c.Check(err.Error(), Equals, `snap "pkg" has running hooks (configure)`)
 	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{105})
 
 	// Both apps and hooks can be running.
-	writePids(c, s.daemonPath, []int{100})
-	writePids(c, s.appPath, []int{101})
-	writePids(c, s.hookPath, []int{105})
+	s.pids = map[string][]int{
+		"snap.pkg.hook.configure": {105},
+		"snap.pkg.app":            {106},
+	}
 	err = snapstate.SoftNothingRunningRefreshCheck(s.info)
 	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `snap "foo" has running apps (app) and hooks (configure)`)
-	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{101, 105})
+	c.Check(err.Error(), Equals, `snap "pkg" has running apps (app) and hooks (configure)`)
+	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{105, 106})
 }
 
 func (s *refreshSuite) TestHardNothingRunningRefreshCheck(c *C) {
-	// There are no errors when PID cgroup is absent.
-	err := snapstate.HardNothingRunningRefreshCheck(s.info)
-	c.Check(err, IsNil)
-
 	// Regular services are blocking hard refresh check.
 	// We were expecting them to be gone by now.
-	writePids(c, s.daemonPath, []int{100})
-	writePids(c, s.appPath, []int{})
-	err = snapstate.HardNothingRunningRefreshCheck(s.info)
+	s.pids = map[string][]int{
+		"snap.pkg.daemon": {100},
+	}
+	err := snapstate.HardNothingRunningRefreshCheck(s.info)
 	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `snap "foo" has running apps (daemon)`)
+	c.Check(err.Error(), Equals, `snap "pkg" has running apps (daemon)`)
 	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{100})
 
 	// When the service is supposed to endure refreshes it will not be
@@ -153,19 +130,155 @@
 	s.info.Apps["daemon"].RefreshMode = ""
 
 	// Applications are also blocking hard refresh check.
-	writePids(c, s.daemonPath, []int{})
-	writePids(c, s.appPath, []int{101})
+	s.pids = map[string][]int{
+		"snap.pkg.app": {101},
+	}
 	err = snapstate.HardNothingRunningRefreshCheck(s.info)
 	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `snap "foo" has running apps (app)`)
+	c.Check(err.Error(), Equals, `snap "pkg" has running apps (app)`)
+	c.Assert(err, FitsTypeOf, &snapstate.BusySnapError{})
 	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{101})
 
 	// Hooks are equally blocking hard refresh check.
-	writePids(c, s.daemonPath, []int{})
-	writePids(c, s.appPath, []int{})
-	writePids(c, s.hookPath, []int{105})
+	s.pids = map[string][]int{
+		"snap.pkg.hook.configure": {105},
+	}
 	err = snapstate.HardNothingRunningRefreshCheck(s.info)
 	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `snap "foo" has running hooks (configure)`)
+	c.Check(err.Error(), Equals, `snap "pkg" has running hooks (configure)`)
 	c.Check(err.(*snapstate.BusySnapError).Pids(), DeepEquals, []int{105})
 }
+
+func (s *refreshSuite) TestPendingSnapRefreshInfo(c *C) {
+	err := snapstate.NewBusySnapError(s.info, nil, nil, nil)
+	refreshInfo := err.PendingSnapRefreshInfo()
+	c.Check(refreshInfo.InstanceName, Equals, s.info.InstanceName())
+	// The information about a busy app is not populated because
+	// the original error did not have the corresponding information.
+	c.Check(refreshInfo.BusyAppName, Equals, "")
+	c.Check(refreshInfo.BusyAppDesktopEntry, Equals, "")
+
+	// If we create a matching desktop entry then relevant meta-data is added.
+	err = snapstate.NewBusySnapError(s.info, nil, []string{"app"}, nil)
+	desktopFile := s.info.Apps["app"].DesktopFile()
+	c.Assert(os.MkdirAll(filepath.Dir(desktopFile), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(desktopFile, nil, 0644), IsNil)
+	refreshInfo = err.PendingSnapRefreshInfo()
+	c.Check(refreshInfo.InstanceName, Equals, s.info.InstanceName())
+	c.Check(refreshInfo.BusyAppName, Equals, "app")
+	c.Check(refreshInfo.BusyAppDesktopEntry, Equals, "pkg_app")
+}
+
+func (s *refreshSuite) addInstalledSnap(snapst *snapstate.SnapState) (*snapstate.SnapState, *snap.Info) {
+	snapName := snapst.Sequence[0].RealName
+	snapstate.Set(s.state, snapName, snapst)
+	info := &snap.Info{SideInfo: snap.SideInfo{RealName: snapName, Revision: snapst.Current}}
+	return snapst, info
+}
+
+func (s *refreshSuite) addDummyInstalledSnap() (*snapstate.SnapState, *snap.Info) {
+	return s.addInstalledSnap(&snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "pkg", Revision: snap.R(5), SnapID: "pkg-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+}
+
+func (s *refreshSuite) TestDoSoftRefreshCheckAllowed(c *C) {
+	// Pretend we have a snap
+	s.state.Lock()
+	defer s.state.Unlock()
+	snapst, info := s.addDummyInstalledSnap()
+
+	// Pretend that snaps can refresh normally.
+	restore := snapstate.MockGenericRefreshCheck(func(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error {
+		return nil
+	})
+	defer restore()
+
+	// Soft refresh should not fail.
+	err := snapstate.SoftCheckNothingRunningForRefresh(s.state, snapst, info)
+	c.Assert(err, IsNil)
+
+	// In addition, the inhibition lock is not set.
+	hint, err := runinhibit.IsLocked(info.InstanceName())
+	c.Assert(err, IsNil)
+	c.Check(hint, Equals, runinhibit.HintNotInhibited)
+}
+
+func (s *refreshSuite) TestDoSoftRefreshCheckDisallowed(c *C) {
+	// Pretend we have a snap
+	s.state.Lock()
+	defer s.state.Unlock()
+	snapst, info := s.addDummyInstalledSnap()
+
+	// Pretend that snaps cannot refresh.
+	restore := snapstate.MockGenericRefreshCheck(func(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error {
+		return &snapstate.BusySnapError{SnapInfo: info}
+	})
+	defer restore()
+
+	// Soft refresh should fail with a proper error.
+	err := snapstate.SoftCheckNothingRunningForRefresh(s.state, snapst, info)
+	c.Assert(err, ErrorMatches, `snap "pkg" has running apps or hooks`)
+
+	// Sanity check: the inhibition lock was not set.
+	hint, err := runinhibit.IsLocked(info.InstanceName())
+	c.Assert(err, IsNil)
+	c.Check(hint, Equals, runinhibit.HintNotInhibited)
+}
+
+func (s *refreshSuite) TestDoHardRefreshFlowRefreshAllowed(c *C) {
+	backend := &fakeSnappyBackend{}
+	// Pretend we have a snap
+	s.state.Lock()
+	defer s.state.Unlock()
+	snapst, info := s.addDummyInstalledSnap()
+
+	// Pretend that snaps can refresh normally.
+	restore := snapstate.MockGenericRefreshCheck(func(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error {
+		return nil
+	})
+	defer restore()
+
+	// Hard refresh should not fail and return a valid lock.
+	lock, err := snapstate.HardEnsureNothingRunningDuringRefresh(backend, s.state, snapst, info)
+	c.Assert(err, IsNil)
+	c.Assert(lock, NotNil)
+	defer lock.Close()
+
+	// We should be able to unlock the lock without an error because
+	// it was acquired in the same process by the tested logic.
+	c.Assert(lock.Unlock(), IsNil)
+
+	// In addition, the fake backend recorded that a lock was established.
+	op := backend.ops.MustFindOp(c, "run-inhibit-snap-for-unlink")
+	c.Check(op.inhibitHint, Equals, runinhibit.Hint("refresh"))
+}
+
+func (s *refreshSuite) TestDoHardRefreshFlowRefreshDisallowed(c *C) {
+	backend := &fakeSnappyBackend{}
+	// Pretend we have a snap
+	s.state.Lock()
+	defer s.state.Unlock()
+	snapst, info := s.addDummyInstalledSnap()
+
+	// Pretend that snaps cannot refresh.
+	restore := snapstate.MockGenericRefreshCheck(func(info *snap.Info, canAppRunDuringRefresh func(app *snap.AppInfo) bool) error {
+		return &snapstate.BusySnapError{SnapInfo: info}
+	})
+	defer restore()
+
+	// Hard refresh should fail and not return a lock.
+	lock, err := snapstate.HardEnsureNothingRunningDuringRefresh(backend, s.state, snapst, info)
+	c.Assert(err, ErrorMatches, `snap "pkg" has running apps or hooks`)
+	c.Assert(lock, IsNil)
+
+	// Sanity check: the inhibition lock was not set.
+	op := backend.ops.MustFindOp(c, "run-inhibit-snap-for-unlink")
+	c.Check(op.inhibitHint, Equals, runinhibit.Hint("refresh"))
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapmgr.go snapd-2.48.3+20.04/overlord/snapstate/snapmgr.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapmgr.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapmgr.go	2021-02-02 08:21:12.000000000 +0000
@@ -152,6 +152,10 @@
 	// or otherwise removed from the snap in a future refresh.
 	LastActiveDisabledServices []string `json:"last-active-disabled-services,omitempty"`
 
+	// tracking services enabled and disabled by hooks
+	ServicesEnabledByHooks  []string `json:"services-enabled-by-hooks,omitempty"`
+	ServicesDisabledByHooks []string `json:"services-disabled-by-hooks,omitempty"`
+
 	// Current indicates the current active revision if Active is
 	// true or the last active revision if Active is false
 	// (usually while a snap is being operated on or disabled)
@@ -288,6 +292,7 @@
 // AutomaticSnapshot allows to hook snapshot manager's AutomaticSnapshot.
 var AutomaticSnapshot func(st *state.State, instanceName string) (ts *state.TaskSet, err error)
 var AutomaticSnapshotExpiration func(st *state.State) (time.Duration, error)
+var EstimateSnapshotSize func(st *state.State, instanceName string, users []string) (uint64, error)
 
 func readInfo(name string, si *snap.SideInfo, flags int) (*snap.Info, error) {
 	info, err := snapReadInfo(name, si)
@@ -443,7 +448,7 @@
 
 	// remove related
 	runner.AddHandler("stop-snap-services", m.stopSnapServices, m.startSnapServices)
-	runner.AddHandler("unlink-snap", m.doUnlinkSnap, nil)
+	runner.AddHandler("unlink-snap", m.doUnlinkSnap, m.undoUnlinkSnap)
 	runner.AddHandler("clear-snap", m.doClearSnapData, nil)
 	runner.AddHandler("discard-snap", m.doDiscardSnap, nil)
 
@@ -551,6 +556,29 @@
 	return m.autoRefresh.RefreshSchedule()
 }
 
+// EnsureAutoRefreshesAreDelayed will delay refreshes for the specified amount
+// of time, as well as return any active auto-refresh changes that are currently
+// not ready so that the client can wait for those.
+func (m *SnapManager) EnsureAutoRefreshesAreDelayed(delay time.Duration) ([]*state.Change, error) {
+	// always delay for at least the specified time, this ensures that even if
+	// there are active refreshes right now, there won't be more auto-refreshes
+	// that happen after the current set finish
+	err := m.autoRefresh.ensureRefreshHoldAtLeast(delay)
+	if err != nil {
+		return nil, err
+	}
+
+	// look for auto refresh changes in progress
+	autoRefreshChgsInFlight := []*state.Change{}
+	for _, chg := range m.state.Changes() {
+		if chg.Kind() == "auto-refresh" && !chg.Status().Ready() {
+			autoRefreshChgsInFlight = append(autoRefreshChgsInFlight, chg)
+		}
+	}
+
+	return autoRefreshChgsInFlight, nil
+}
+
 // ensureForceDevmodeDropsDevmodeFromState undoes the forced devmode
 // in snapstate for forced devmode distros.
 func (m *SnapManager) ensureForceDevmodeDropsDevmodeFromState() error {
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapstate.go snapd-2.48.3+20.04/overlord/snapstate/snapstate.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapstate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapstate.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,6 +27,7 @@
 	"fmt"
 	"os"
 	"sort"
+	"strings"
 	"time"
 
 	"github.com/snapcore/snapd/asserts"
@@ -37,6 +38,7 @@
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/configstate/config"
 	"github.com/snapcore/snapd/overlord/ifacestate/ifacerepo"
@@ -70,6 +72,37 @@
 
 var ErrNothingToDo = errors.New("nothing to do")
 
+var osutilCheckFreeSpace = osutil.CheckFreeSpace
+
+// InsufficientSpaceError represents an error where there is not enough disk
+// space to perform an operation.
+type InsufficientSpaceError struct {
+	// Path is the filesystem path checked for available disk space
+	Path string
+	// Snaps affected by the failing operation
+	Snaps []string
+	// Kind of the change that failed
+	ChangeKind string
+	// Message is optional, otherwise one is composed from the other information
+	Message string
+}
+
+func (e *InsufficientSpaceError) Error() string {
+	if e.Message != "" {
+		return e.Message
+	}
+	if len(e.Snaps) > 0 {
+		snaps := strings.Join(e.Snaps, ", ")
+		return fmt.Sprintf("insufficient space in %q to perform %q change for the following snaps: %s", e.Path, e.ChangeKind, snaps)
+	}
+	return fmt.Sprintf("insufficient space in %q", e.Path)
+}
+
+// safetyMarginDiskSpace returns size plus a safety margin (5Mb)
+func safetyMarginDiskSpace(size uint64) uint64 {
+	return size + 5*1024*1024
+}
+
 func isParallelInstallable(snapsup *SnapSetup) error {
 	if snapsup.InstanceKey == "" {
 		return nil
@@ -141,10 +174,11 @@
 		}
 		snapsup.PlugsOnly = snapsup.PlugsOnly && (len(info.Slots) == 0)
 
-		if experimentalRefreshAppAwareness {
-			// Note that because we are modifying the snap state this block
-			// must be located after the conflict check done above.
-			if err := inhibitRefresh(st, snapst, info, SoftNothingRunningRefreshCheck); err != nil {
+		if experimentalRefreshAppAwareness && !snapsup.Flags.IgnoreRunning {
+			// Note that because we are modifying the snap state inside
+			// softCheckNothingRunningForRefresh, this block must be located
+			// after the conflict check done above.
+			if err := softCheckNothingRunningForRefresh(st, snapst, info); err != nil {
 				return nil, err
 			}
 		}
@@ -423,20 +457,43 @@
 	panic("internal error: snapstate.CheckHealthHook is unset")
 }
 
-// WaitRestart will return a Retry error if there is a pending restart
+var generateSnapdWrappers = backend.GenerateSnapdWrappers
+
+// FinishRestart will return a Retry error if there is a pending restart
 // and a real error if anything went wrong (like a rollback across
-// restarts)
-func WaitRestart(task *state.Task, snapsup *SnapSetup) (err error) {
+// restarts).
+// For snapd snap updates this will also rerun wrappers generation to fully
+// catch up with any change.
+func FinishRestart(task *state.Task, snapsup *SnapSetup) (err error) {
 	if ok, _ := task.State().Restarting(); ok {
 		// don't continue until we are in the restarted snapd
 		task.Logf("Waiting for automatic snapd restart...")
 		return &state.Retry{}
 	}
 
-	if snapsup.Type == snap.TypeSnapd && os.Getenv("SNAPD_REVERT_TO_REV") != "" {
-		return fmt.Errorf("there was a snapd rollback across the restart")
+	if snapsup.Type == snap.TypeSnapd {
+		if os.Getenv("SNAPD_REVERT_TO_REV") != "" {
+			return fmt.Errorf("there was a snapd rollback across the restart")
+		}
+
+		// if we have restarted and snapd was refreshed, then we need to generate
+		// snapd wrappers again with current snapd, as the logic of generating
+		// wrappers may have changed between previous and new snapd code.
+		if !release.OnClassic {
+			snapdInfo, err := snap.ReadCurrentInfo(snapsup.SnapName())
+			if err != nil {
+				return fmt.Errorf("cannot get current snapd snap info: %v", err)
+			}
+			// TODO: if future changes to wrappers need one more snapd restart,
+			// then it should be handled here as well.
+			if err := generateSnapdWrappers(snapdInfo); err != nil {
+				return err
+			}
+		}
 	}
 
+	// consider kernel and base
+
 	deviceCtx, err := DeviceCtx(task.State(), task, nil)
 	if err != nil {
 		return err
@@ -564,17 +621,58 @@
 		}
 	}
 
+	var hasUserService, usesDbusActivation bool
+	for _, app := range info.Apps {
+		if app.IsService() && app.DaemonScope == snap.UserDaemon {
+			hasUserService = true
+		}
+		if len(app.ActivatesOn) != 0 {
+			usesDbusActivation = true
+		}
+	}
+
+	if hasUserService {
+		flag, err := features.Flag(tr, features.UserDaemons)
+		if err != nil {
+			return err
+		}
+		if !flag {
+			return fmt.Errorf("experimental feature disabled - test it by setting 'experimental.user-daemons' to true")
+		}
+		if !release.SystemctlSupportsUserUnits() {
+			return fmt.Errorf("user session daemons are not supported on this release")
+		}
+	}
+
+	if usesDbusActivation {
+		flag, err := features.Flag(tr, features.DbusActivation)
+		if err != nil {
+			return err
+		}
+		if !flag {
+			return fmt.Errorf("experimental feature disabled - test it by setting 'experimental.dbus-activation' to true")
+		}
+	}
+
 	return nil
 }
 
-func checkInstallPreconditions(st *state.State, info *snap.Info, flags Flags, snapst *SnapState, deviceCtx DeviceContext) error {
+func ensureInstallPreconditions(st *state.State, info *snap.Info, flags Flags, snapst *SnapState, deviceCtx DeviceContext) (Flags, error) {
+	if flags.Classic && !info.NeedsClassic() {
+		// snap does not require classic confinement, silently drop the flag
+		flags.Classic = false
+	}
+
 	if err := validateInfoAndFlags(info, snapst, flags); err != nil {
-		return err
+		return flags, err
 	}
 	if err := validateFeatureFlags(st, info); err != nil {
-		return err
+		return flags, err
 	}
-	return nil
+	if err := checkDBusServiceConflicts(st, info); err != nil {
+		return flags, err
+	}
+	return flags, nil
 }
 
 // InstallPath returns a set of tasks for installing a snap from a file path
@@ -642,12 +740,8 @@
 	}
 	info.InstanceKey = instanceKey
 
-	if flags.Classic && !info.NeedsClassic() {
-		// snap does not require classic confinement, silently drop the flag
-		flags.Classic = false
-	}
-	// TODO: integrate classic override with the helper
-	if err := checkInstallPreconditions(st, info, flags, &snapst, deviceCtx); err != nil {
+	flags, err = ensureInstallPreconditions(st, info, flags, &snapst, deviceCtx)
+	if err != nil {
 		return nil, nil, err
 	}
 	// this might be a refresh; check the epoch before proceeding
@@ -662,7 +756,7 @@
 		SnapPath:    path,
 		Channel:     channel,
 		Flags:       flags.ForSnapSetup(),
-		Type:        info.GetType(),
+		Type:        info.Type(),
 		PlugsOnly:   len(info.Slots) == 0,
 		InstanceKey: info.InstanceKey,
 	}
@@ -729,18 +823,40 @@
 	}
 	info := sar.Info
 
-	if flags.RequireTypeBase && info.GetType() != snap.TypeBase && info.GetType() != snap.TypeOS {
-		return nil, fmt.Errorf("unexpected snap type %q, instead of 'base'", info.GetType())
+	if flags.RequireTypeBase && info.Type() != snap.TypeBase && info.Type() != snap.TypeOS {
+		return nil, fmt.Errorf("unexpected snap type %q, instead of 'base'", info.Type())
 	}
 
-	if flags.Classic && !info.NeedsClassic() {
-		// snap does not require classic confinement, silently drop the flag
-		flags.Classic = false
+	flags, err = ensureInstallPreconditions(st, info, flags, &snapst, deviceCtx)
+	if err != nil {
+		return nil, err
 	}
-	// TODO: integrate classic override with the helper
-	if err := checkInstallPreconditions(st, info, flags, &snapst, deviceCtx); err != nil {
+
+	tr := config.NewTransaction(st)
+	checkDiskSpaceInstall, err := features.Flag(tr, features.CheckDiskSpaceInstall)
+	if err != nil && !config.IsNoOption(err) {
 		return nil, err
 	}
+	if checkDiskSpaceInstall {
+		// check if there is enough disk space for requested snap and its
+		// prerequisites.
+		totalSize, err := installSize(st, []*snap.Info{info}, userID)
+		if err != nil {
+			return nil, err
+		}
+		requiredSpace := safetyMarginDiskSpace(totalSize)
+		path := dirs.SnapdStateDir(dirs.GlobalRootDir)
+		if err := osutilCheckFreeSpace(path, requiredSpace); err != nil {
+			if _, ok := err.(*osutil.NotEnoughDiskSpaceError); ok {
+				return nil, &InsufficientSpaceError{
+					Path:       path,
+					Snaps:      []string{info.InstanceName()},
+					ChangeKind: "install",
+				}
+			}
+			return nil, err
+		}
+	}
 
 	snapsup := &SnapSetup{
 		Channel:      opts.Channel,
@@ -750,7 +866,7 @@
 		Flags:        flags.ForSnapSetup(),
 		DownloadInfo: &info.DownloadInfo,
 		SideInfo:     &info.SideInfo,
-		Type:         info.GetType(),
+		Type:         info.Type(),
 		PlugsOnly:    len(info.Slots) == 0,
 		InstanceKey:  info.InstanceKey,
 		auxStoreInfo: auxStoreInfo{
@@ -804,13 +920,45 @@
 		return nil, nil, err
 	}
 
+	tr := config.NewTransaction(st)
+	checkDiskSpaceInstall, err := features.Flag(tr, features.CheckDiskSpaceInstall)
+	if err != nil && !config.IsNoOption(err) {
+		return nil, nil, err
+	}
+	if checkDiskSpaceInstall {
+		// check if there is enough disk space for requested snaps and their
+		// prerequisites.
+		snapInfos := make([]*snap.Info, len(installs))
+		for i, sar := range installs {
+			snapInfos[i] = sar.Info
+		}
+		totalSize, err := installSize(st, snapInfos, userID)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		requiredSpace := safetyMarginDiskSpace(totalSize)
+		path := dirs.SnapdStateDir(dirs.GlobalRootDir)
+		if err := osutilCheckFreeSpace(path, requiredSpace); err != nil {
+			if _, ok := err.(*osutil.NotEnoughDiskSpaceError); ok {
+				return nil, nil, &InsufficientSpaceError{
+					Path:       path,
+					Snaps:      toInstall,
+					ChangeKind: "install",
+				}
+			}
+			return nil, nil, err
+		}
+	}
+
 	tasksets := make([]*state.TaskSet, 0, len(installs))
 	for _, sar := range installs {
 		info := sar.Info
 		var snapst SnapState
 		var flags Flags
 
-		if err := checkInstallPreconditions(st, info, flags, &snapst, deviceCtx); err != nil {
+		flags, err := ensureInstallPreconditions(st, info, flags, &snapst, deviceCtx)
+		if err != nil {
 			return nil, nil, err
 		}
 
@@ -827,7 +975,7 @@
 			Flags:        flags.ForSnapSetup(),
 			DownloadInfo: &info.DownloadInfo,
 			SideInfo:     &info.SideInfo,
-			Type:         info.GetType(),
+			Type:         info.Type(),
 			PlugsOnly:    len(info.Slots) == 0,
 			InstanceKey:  info.InstanceKey,
 		}
@@ -913,11 +1061,6 @@
 
 	params := func(update *snap.Info) (*RevisionOptions, Flags, *SnapState) {
 		snapst := stateByInstanceName[update.InstanceName()]
-		updateFlags := snapst.Flags
-		if !update.NeedsClassic() && updateFlags.Classic {
-			// allow updating from classic to strict
-			updateFlags.Classic = false
-		}
 		// setting options to what's in state as multi-refresh doesn't let you change these
 		opts := &RevisionOptions{
 			Channel:   snapst.TrackingChannel,
@@ -927,6 +1070,36 @@
 
 	}
 
+	tr := config.NewTransaction(st)
+	checkDiskSpaceRefresh, err := features.Flag(tr, features.CheckDiskSpaceRefresh)
+	if err != nil && !config.IsNoOption(err) {
+		return nil, nil, err
+	}
+	if checkDiskSpaceRefresh {
+		// check if there is enough disk space for requested snap and its
+		// prerequisites.
+		totalSize, err := installSize(st, updates, userID)
+		if err != nil {
+			return nil, nil, err
+		}
+		requiredSpace := safetyMarginDiskSpace(totalSize)
+		path := dirs.SnapdStateDir(dirs.GlobalRootDir)
+		if err := osutilCheckFreeSpace(path, requiredSpace); err != nil {
+			snaps := make([]string, len(updates))
+			for i, up := range updates {
+				snaps[i] = up.InstanceName()
+			}
+			if _, ok := err.(*osutil.NotEnoughDiskSpaceError); ok {
+				return nil, nil, &InsufficientSpaceError{
+					Path:       path,
+					Snaps:      snaps,
+					ChangeKind: "refresh",
+				}
+			}
+			return nil, nil, err
+		}
+	}
+
 	updated, tasksets, err := doUpdate(ctx, st, names, updates, params, userID, flags, deviceCtx, fromChange)
 	if err != nil {
 		return nil, nil, err
@@ -996,7 +1169,8 @@
 		revnoOpts, flags, snapst := params(update)
 		flags.IsAutoRefresh = globalFlags.IsAutoRefresh
 
-		if err := checkInstallPreconditions(st, update, flags, snapst, deviceCtx); err != nil {
+		flags, err := ensureInstallPreconditions(st, update, flags, snapst, deviceCtx)
+		if err != nil {
 			if refreshAll {
 				logger.Noticef("cannot update %q: %v", update.InstanceName(), err)
 				continue
@@ -1026,7 +1200,7 @@
 			Flags:        flags.ForSnapSetup(),
 			DownloadInfo: &update.DownloadInfo,
 			SideInfo:     &update.SideInfo,
-			Type:         update.GetType(),
+			Type:         update.Type(),
 			PlugsOnly:    len(update.Slots) == 0,
 			InstanceKey:  update.InstanceKey,
 			auxStoreInfo: auxStoreInfo{
@@ -1049,7 +1223,7 @@
 		// because of the sorting of updates we fill prereqs
 		// first (if branch) and only then use it to setup
 		// waits (else branch)
-		if t := update.GetType(); t == snap.TypeOS || t == snap.TypeBase || t == snap.TypeSnapd {
+		if t := update.Type(); t == snap.TypeOS || t == snap.TypeBase || t == snap.TypeSnapd {
 			// prereq types come first in updates, we
 			// also assume bases don't have hooks, otherwise
 			// they would need to wait on core or snapd
@@ -1455,13 +1629,38 @@
 		return nil, infoErr
 	}
 
-	params := func(update *snap.Info) (*RevisionOptions, Flags, *SnapState) {
-		updateFlags := flags
-		if !update.NeedsClassic() && updateFlags.Classic {
-			// allow updating from classic to strict
-			updateFlags.Classic = false
+	tr := config.NewTransaction(st)
+	checkDiskSpaceRefresh, err := features.Flag(tr, features.CheckDiskSpaceRefresh)
+	if err != nil && !config.IsNoOption(err) {
+		return nil, err
+	}
+	if checkDiskSpaceRefresh {
+		// check if there is enough disk space for requested snap and its
+		// prerequisites.
+		totalSize, err := installSize(st, updates, userID)
+		if err != nil {
+			return nil, err
+		}
+		requiredSpace := safetyMarginDiskSpace(totalSize)
+		path := dirs.SnapdStateDir(dirs.GlobalRootDir)
+		if err := osutilCheckFreeSpace(path, requiredSpace); err != nil {
+			snaps := make([]string, len(updates))
+			for i, up := range updates {
+				snaps[i] = up.InstanceName()
+			}
+			if _, ok := err.(*osutil.NotEnoughDiskSpaceError); ok {
+				return nil, &InsufficientSpaceError{
+					Path:       path,
+					Snaps:      snaps,
+					ChangeKind: "refresh",
+				}
+			}
+			return nil, err
 		}
-		return opts, updateFlags, &snapst
+	}
+
+	params := func(update *snap.Info) (*RevisionOptions, Flags, *SnapState) {
+		return opts, flags, &snapst
 	}
 
 	_, tts, err := doUpdate(context.TODO(), st, []string{name}, updates, params, userID, &flags, deviceCtx, fromChange)
@@ -1606,18 +1805,18 @@
 		return nil, err
 	}
 
-	switch info.GetType() {
+	switch info.Type() {
 	case snap.TypeOS, snap.TypeBase, snap.TypeKernel:
 		// good
 	default:
 		// bad
-		return nil, fmt.Errorf("cannot link type %v", info.GetType())
+		return nil, fmt.Errorf("cannot link type %v", info.Type())
 	}
 
 	snapsup := &SnapSetup{
 		SideInfo:    snapst.CurrentSideInfo(),
 		Flags:       snapst.Flags.ForSnapSetup(),
-		Type:        info.GetType(),
+		Type:        info.Type(),
 		PlugsOnly:   len(info.Slots) == 0,
 		InstanceKey: snapst.InstanceKey,
 	}
@@ -1662,7 +1861,7 @@
 	snapsup := &SnapSetup{
 		SideInfo:    snapst.CurrentSideInfo(),
 		Flags:       snapst.Flags.ForSnapSetup(),
-		Type:        info.GetType(),
+		Type:        info.Type(),
 		PlugsOnly:   len(info.Slots) == 0,
 		InstanceKey: snapst.InstanceKey,
 	}
@@ -1721,7 +1920,7 @@
 			RealName: snap.InstanceSnap(name),
 			Revision: snapst.Current,
 		},
-		Type:        info.GetType(),
+		Type:        info.Type(),
 		PlugsOnly:   len(info.Slots) == 0,
 		InstanceKey: snapst.InstanceKey,
 	}
@@ -1748,7 +1947,7 @@
 // canDisable verifies that a snap can be deactivated.
 func canDisable(si *snap.Info) bool {
 	for _, importantSnapType := range []snap.Type{snap.TypeGadget, snap.TypeKernel, snap.TypeOS} {
-		if importantSnapType == si.GetType() {
+		if importantSnapType == si.Type() {
 			return false
 		}
 	}
@@ -1763,7 +1962,7 @@
 		rev = si.Revision
 	}
 
-	return PolicyFor(si.GetType(), deviceCtx.Model()).CanRemove(st, snapst, rev, deviceCtx)
+	return PolicyFor(si.Type(), deviceCtx.Model()).CanRemove(st, snapst, rev, deviceCtx)
 }
 
 // RemoveFlags are used to pass additional flags to the Remove operation.
@@ -1775,23 +1974,46 @@
 // Remove returns a set of tasks for removing snap.
 // Note that the state must be locked by the caller.
 func Remove(st *state.State, name string, revision snap.Revision, flags *RemoveFlags) (*state.TaskSet, error) {
+	ts, snapshotSize, err := removeTasks(st, name, revision, flags)
+	// removeTasks() checks check-disk-space-remove feature flag, so snapshotSize
+	// will only be greater than 0 if the feature is enabled.
+	if snapshotSize > 0 {
+		requiredSpace := safetyMarginDiskSpace(snapshotSize)
+		path := dirs.SnapdStateDir(dirs.GlobalRootDir)
+		if err := osutilCheckFreeSpace(path, requiredSpace); err != nil {
+			if _, ok := err.(*osutil.NotEnoughDiskSpaceError); ok {
+				return nil, &InsufficientSpaceError{
+					Path:       path,
+					Snaps:      []string{name},
+					ChangeKind: "remove",
+					Message:    fmt.Sprintf("cannot create automatic snapshot when removing last revision of the snap: %v", err)}
+			}
+			return nil, err
+		}
+	}
+	return ts, err
+}
+
+// removeTasks provides the task set to remove snap name after taking a snapshot
+// if flags.Purge is not true, it also computes an estimate of the latter size.
+func removeTasks(st *state.State, name string, revision snap.Revision, flags *RemoveFlags) (removeTs *state.TaskSet, snapshotSize uint64, err error) {
 	var snapst SnapState
-	err := Get(st, name, &snapst)
+	err = Get(st, name, &snapst)
 	if err != nil && err != state.ErrNoState {
-		return nil, err
+		return nil, 0, err
 	}
 
 	if !snapst.IsInstalled() {
-		return nil, &snap.NotInstalledError{Snap: name, Rev: snap.R(0)}
+		return nil, 0, &snap.NotInstalledError{Snap: name, Rev: snap.R(0)}
 	}
 
 	if err := CheckChangeConflict(st, name, nil); err != nil {
-		return nil, err
+		return nil, 0, err
 	}
 
 	deviceCtx, err := DeviceCtxFromState(st, nil)
 	if err != nil {
-		return nil, err
+		return nil, 0, err
 	}
 
 	active := snapst.Active
@@ -1806,13 +2028,13 @@
 				if len(snapst.Sequence) > 1 {
 					msg += " (revert first?)"
 				}
-				return nil, fmt.Errorf(msg, revision, name)
+				return nil, 0, fmt.Errorf(msg, revision, name)
 			}
 			active = false
 		}
 
 		if !revisionInSequence(&snapst, revision) {
-			return nil, &snap.NotInstalledError{Snap: name, Rev: revision}
+			return nil, 0, &snap.NotInstalledError{Snap: name, Rev: revision}
 		}
 
 		removeAll = len(snapst.Sequence) == 1
@@ -1820,12 +2042,12 @@
 
 	info, err := Info(st, name, revision)
 	if err != nil {
-		return nil, err
+		return nil, 0, err
 	}
 
 	// check if this is something that can be removed
 	if err := canRemove(st, info, &snapst, removeAll, deviceCtx); err != nil {
-		return nil, fmt.Errorf("snap %q is not removable: %v", name, err)
+		return nil, 0, fmt.Errorf("snap %q is not removable: %v", name, err)
 	}
 
 	// main/current SnapSetup
@@ -1835,21 +2057,21 @@
 			RealName: snap.InstanceSnap(name),
 			Revision: revision,
 		},
-		Type:        info.GetType(),
+		Type:        info.Type(),
 		PlugsOnly:   len(info.Slots) == 0,
 		InstanceKey: snapst.InstanceKey,
 	}
 
 	// trigger remove
 
-	full := state.NewTaskSet()
+	removeTs = state.NewTaskSet()
 	var chain *state.TaskSet
 
 	addNext := func(ts *state.TaskSet) {
 		if chain != nil {
 			ts.WaitAll(chain)
 		}
-		full.AddAll(ts)
+		removeTs.AddAll(ts)
 		chain = ts
 	}
 
@@ -1884,10 +2106,21 @@
 		if tp, _ := snapst.Type(); tp == snap.TypeApp && removeAll {
 			ts, err := AutomaticSnapshot(st, name)
 			if err == nil {
+				tr := config.NewTransaction(st)
+				checkDiskSpaceRemove, err := features.Flag(tr, features.CheckDiskSpaceRemove)
+				if err != nil && !config.IsNoOption(err) {
+					return nil, 0, err
+				}
+				if checkDiskSpaceRemove {
+					snapshotSize, err = EstimateSnapshotSize(st, name, nil)
+					if err != nil {
+						return nil, 0, err
+					}
+				}
 				addNext(ts)
 			} else {
 				if err != ErrNothingToDo {
-					return nil, err
+					return nil, 0, err
 				}
 			}
 		}
@@ -1914,15 +2147,23 @@
 
 	if removeAll {
 		seq := snapst.Sequence
+		currentIndex := snapst.LastIndex(snapst.Current)
 		for i := len(seq) - 1; i >= 0; i-- {
-			si := seq[i]
-			addNext(removeInactiveRevision(st, name, info.SnapID, si.Revision))
+			if i != currentIndex {
+				si := seq[i]
+				addNext(removeInactiveRevision(st, name, info.SnapID, si.Revision))
+			}
+		}
+		// add tasks for removing the current revision last,
+		// this is then also when common data will be removed
+		if currentIndex >= 0 {
+			addNext(removeInactiveRevision(st, name, info.SnapID, seq[currentIndex].Revision))
 		}
 	} else {
 		addNext(removeInactiveRevision(st, name, info.SnapID, revision))
 	}
 
-	return full, nil
+	return removeTs, snapshotSize, nil
 }
 
 func removeInactiveRevision(st *state.State, name, snapID string, revision snap.Revision) *state.TaskSet {
@@ -1951,8 +2192,12 @@
 func RemoveMany(st *state.State, names []string) ([]string, []*state.TaskSet, error) {
 	removed := make([]string, 0, len(names))
 	tasksets := make([]*state.TaskSet, 0, len(names))
+
+	var totalSnapshotsSize uint64
+	path := dirs.SnapdStateDir(dirs.GlobalRootDir)
+
 	for _, name := range names {
-		ts, err := Remove(st, name, snap.R(0), nil)
+		ts, snapshotSize, err := removeTasks(st, name, snap.R(0), nil)
 		// FIXME: is this expected behavior?
 		if _, ok := err.(*snap.NotInstalledError); ok {
 			continue
@@ -1960,11 +2205,28 @@
 		if err != nil {
 			return nil, nil, err
 		}
+		totalSnapshotsSize += snapshotSize
 		removed = append(removed, name)
 		ts.JoinLane(st.NewLane())
 		tasksets = append(tasksets, ts)
 	}
 
+	// removeTasks() checks check-disk-space-remove feature flag, so totalSnapshotsSize
+	// will only be greater than 0 if the feature is enabled.
+	if totalSnapshotsSize > 0 {
+		requiredSpace := safetyMarginDiskSpace(totalSnapshotsSize)
+		if err := osutilCheckFreeSpace(path, requiredSpace); err != nil {
+			if _, ok := err.(*osutil.NotEnoughDiskSpaceError); ok {
+				return nil, nil, &InsufficientSpaceError{
+					Path:       path,
+					Snaps:      names,
+					ChangeKind: "remove",
+				}
+			}
+			return nil, nil, err
+		}
+	}
+
 	return removed, tasksets, nil
 }
 
@@ -2028,7 +2290,7 @@
 		Base:        info.Base,
 		SideInfo:    snapst.Sequence[i],
 		Flags:       flags.ForSnapSetup(),
-		Type:        info.GetType(),
+		Type:        info.Type(),
 		PlugsOnly:   len(info.Slots) == 0,
 		InstanceKey: snapst.InstanceKey,
 	}
@@ -2072,7 +2334,7 @@
 			Channel:      oldSnapst.TrackingChannel,
 			DownloadInfo: &newInfo.DownloadInfo,
 			SideInfo:     &newInfo.SideInfo,
-			Type:         newInfo.GetType(),
+			Type:         newInfo.Type(),
 		}, 0, "", nil)
 		if err != nil {
 			return nil, err
@@ -2179,6 +2441,9 @@
 	if !ok {
 		return state.ErrNoState
 	}
+
+	// XXX: &snapst pointer isn't needed here but it is likely historical
+	// (a bug in old JSON marshaling probably).
 	err = json.Unmarshal([]byte(*raw), &snapst)
 	if err != nil {
 		return fmt.Errorf("cannot unmarshal snap state: %v", err)
@@ -2211,6 +2476,8 @@
 }
 
 // Set sets the SnapState of the given snap, overwriting any earlier state.
+// Note that a SnapState with an empty Sequence will be treated as if snapst was
+// nil and name will be deleted from the state.
 func Set(st *state.State, name string, snapst *SnapState) {
 	var snaps map[string]*json.RawMessage
 	err := st.Get("snaps", &snaps)
@@ -2448,3 +2715,9 @@
 
 	return gadgetInfo.Connections, nil
 }
+
+func MockOsutilCheckFreeSpace(mock func(path string, minSize uint64) error) (restore func()) {
+	old := osutilCheckFreeSpace
+	osutilCheckFreeSpace = mock
+	return func() { osutilCheckFreeSpace = old }
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_install_test.go snapd-2.48.3+20.04/overlord/snapstate/snapstate_install_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_install_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapstate_install_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3605 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate_test
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/auth"
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/hookstate"
+	"github.com/snapcore/snapd/overlord/ifacestate/ifacerepo"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/snapstate/backend"
+	"github.com/snapcore/snapd/overlord/snapstate/snapstatetest"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/store"
+	"github.com/snapcore/snapd/testutil"
+
+	// So it registers Configure.
+	_ "github.com/snapcore/snapd/overlord/configstate"
+)
+
+func verifyInstallTasks(c *C, opts, discards int, ts *state.TaskSet, st *state.State) {
+	kinds := taskKinds(ts.Tasks())
+
+	expected := []string{
+		"prerequisites",
+		"download-snap",
+		"validate-snap",
+		"mount-snap",
+	}
+	if opts&unlinkBefore != 0 {
+		expected = append(expected,
+			"stop-snap-services",
+			"remove-aliases",
+			"unlink-current-snap",
+		)
+	}
+	if opts&updatesGadget != 0 {
+		expected = append(expected, "update-gadget-assets")
+	}
+	expected = append(expected,
+		"copy-snap-data",
+		"setup-profiles",
+		"link-snap",
+	)
+	expected = append(expected,
+		"auto-connect",
+		"set-auto-aliases",
+		"setup-aliases",
+		"run-hook[install]",
+		"start-snap-services")
+	for i := 0; i < discards; i++ {
+		expected = append(expected,
+			"clear-snap",
+			"discard-snap",
+		)
+	}
+	if opts&cleanupAfter != 0 {
+		expected = append(expected,
+			"cleanup",
+		)
+	}
+	if opts&noConfigure == 0 {
+		expected = append(expected,
+			"run-hook[configure]",
+		)
+	}
+	expected = append(expected,
+		"run-hook[check-health]",
+	)
+
+	c.Assert(kinds, DeepEquals, expected)
+}
+
+func (s *snapmgrTestSuite) TestInstallDevModeConfinementFiltering(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// if a snap is devmode, you can't install it without --devmode
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-devmode"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `.* requires devmode or confinement override`)
+
+	// if a snap is devmode, you *can* install it with --devmode
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{DevMode: true})
+	c.Assert(err, IsNil)
+
+	// if a snap is *not* devmode, you can still install it with --devmode
+	opts.Channel = "channel-for-strict"
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{DevMode: true})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallClassicConfinementFiltering(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// if a snap is classic, you can't install it without --classic
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-classic"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `.* requires classic confinement`)
+
+	// if a snap is classic, you *can* install it with --classic
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+
+	// if a snap is *not* classic, but can install it with --classic which gets ignored
+	opts.Channel = "channel-for-strict"
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallTasks(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	verifyInstallTasks(c, 0, 0, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+}
+
+func (s *snapmgrTestSuite) TestInstallTaskEdgesForPreseeding(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+`)
+
+	for _, skipConfig := range []bool{false, true} {
+		ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{SkipConfigure: skipConfig})
+		c.Assert(err, IsNil)
+
+		te, err := ts.Edge(snapstate.BeginEdge)
+		c.Assert(err, IsNil)
+		c.Check(te.Kind(), Equals, "prerequisites")
+
+		te, err = ts.Edge(snapstate.BeforeHooksEdge)
+		c.Assert(err, IsNil)
+		c.Check(te.Kind(), Equals, "setup-aliases")
+
+		te, err = ts.Edge(snapstate.HooksEdge)
+		c.Assert(err, IsNil)
+		c.Assert(te.Kind(), Equals, "run-hook")
+
+		var hsup *hookstate.HookSetup
+		c.Assert(te.Get("hook-setup", &hsup), IsNil)
+		c.Check(hsup.Hook, Equals, "install")
+		c.Check(hsup.Snap, Equals, "some-snap")
+	}
+}
+
+func (s *snapmgrTestSuite) TestInstallSnapdSnapType(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "snapd", opts, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	verifyInstallTasks(c, noConfigure, 0, ts, s.state)
+
+	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Type, Equals, snap.TypeSnapd)
+}
+
+func (s *snapmgrTestSuite) TestInstallCohortTasks(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", CohortKey: "what"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.CohortKey, Equals, "what")
+
+	verifyInstallTasks(c, 0, 0, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+}
+
+func (s *snapmgrTestSuite) TestInstallWithDeviceContext(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// unset the global store, it will need to come via the device context
+	snapstate.ReplaceStore(s.state, nil)
+
+	deviceCtx := &snapstatetest.TrivialDeviceContext{CtxStore: s.fakeStore}
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.InstallWithDeviceContext(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{}, deviceCtx, "")
+	c.Assert(err, IsNil)
+
+	verifyInstallTasks(c, 0, 0, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+}
+
+func (s *snapmgrTestSuite) TestInstallHookNotRunForInstalledSnap(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(7)},
+		},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+epoch: 1*
+`)
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	runHooks := tasksWithKind(ts, "run-hook")
+	// no install hook task
+	c.Assert(taskKinds(runHooks), DeepEquals, []string{
+		"run-hook[pre-refresh]",
+		"run-hook[post-refresh]",
+		"run-hook[configure]",
+		"run-hook[check-health]",
+	})
+}
+
+func (s *snapmgrTestSuite) TestInstallFailsOnDisabledSnap(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapst := &snapstate.SnapState{
+		Active:          false,
+		TrackingChannel: "channel/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)}},
+		Current:         snap.R(2),
+		SnapType:        "app",
+	}
+	snapsup := &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}}
+	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", nil)
+	c.Assert(err, NotNil)
+	c.Assert(err, ErrorMatches, `cannot update disabled snap "some-snap"`)
+}
+
+func dummyInUseCheck(snap.Type) (boot.InUseFunc, error) {
+	return func(string, snap.Revision) bool {
+		return false
+	}, nil
+}
+
+func (s *snapmgrTestSuite) TestInstallFailsOnBusySnap(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// With the refresh-app-awareness feature enabled.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.refresh-app-awareness", true)
+	tr.Commit()
+
+	// With a snap state indicating a snap is already installed.
+	snapst := &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	}
+	snapstate.Set(s.state, "some-snap", snapst)
+
+	// With a snap info indicating it has an application called "app"
+	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		if name != "some-snap" {
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
+		info.Apps = map[string]*snap.AppInfo{
+			"app": {Snap: info, Name: "app"},
+		}
+		return info, nil
+	})
+
+	// mock that "some-snap" has an app and that this app has pids running
+	restore := snapstate.MockPidsOfSnap(func(instanceName string) (map[string][]int, error) {
+		c.Assert(instanceName, Equals, "some-snap")
+		return map[string][]int{
+			"snap.some-snap.app": {1234},
+		}, nil
+	})
+	defer restore()
+
+	// Attempt to install revision 2 of the snap.
+	snapsup := &snapstate.SnapSetup{
+		SideInfo: &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+	}
+
+	// And observe that we cannot refresh because the snap is busy.
+	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", dummyInUseCheck)
+	c.Assert(err, ErrorMatches, `snap "some-snap" has running apps \(app\)`)
+
+	// The state records the time of the failed refresh operation.
+	err = snapstate.Get(s.state, "some-snap", snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.RefreshInhibitedTime, NotNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallWithIgnoreValidationProceedsOnBusySnap(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// With the refresh-app-awareness feature enabled.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.refresh-app-awareness", true)
+	tr.Commit()
+
+	// With a snap state indicating a snap is already installed.
+	snapst := &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "pkg", SnapID: "pkg-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	}
+	snapstate.Set(s.state, "pkg", snapst)
+
+	// With a snap info indicating it has an application called "app"
+	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		if name != "pkg" {
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
+		info.Apps = map[string]*snap.AppInfo{
+			"app": {Snap: info, Name: "app"},
+		}
+		return info, nil
+	})
+
+	// With an app belonging to the snap that is apparently running.
+	restore := snapstate.MockPidsOfSnap(func(instanceName string) (map[string][]int, error) {
+		c.Assert(instanceName, Equals, "pkg")
+		return map[string][]int{
+			"snap.pkg.app": {1234},
+		}, nil
+	})
+	defer restore()
+
+	// Attempt to install revision 2 of the snap, with the IgnoreRunning flag set.
+	snapsup := &snapstate.SnapSetup{
+		SideInfo: &snap.SideInfo{RealName: "pkg", SnapID: "pkg-id", Revision: snap.R(2)},
+		Flags:    snapstate.Flags{IgnoreRunning: true},
+	}
+
+	// And observe that we do so despite the running app.
+	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", dummyInUseCheck)
+	c.Assert(err, IsNil)
+
+	// The state confirms that the refresh operation was not postponed.
+	err = snapstate.Get(s.state, "pkg", snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.RefreshInhibitedTime, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallDespiteBusySnap(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// With the refresh-app-awareness feature enabled.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.refresh-app-awareness", true)
+	tr.Commit()
+
+	// With a snap state indicating a snap is already installed and it failed
+	// to refresh over a week ago. Use UTC and Round to have predictable
+	// behaviour across time-zones and with enough precision loss to be
+	// compatible with the serialization format.
+	var longAgo = time.Now().UTC().Round(time.Second).Add(-time.Hour * 24 * 8)
+	snapst := &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:              snap.R(1),
+		SnapType:             "app",
+		RefreshInhibitedTime: &longAgo,
+	}
+	snapstate.Set(s.state, "some-snap", snapst)
+
+	// With a snap info indicating it has an application called "app"
+	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		if name != "some-snap" {
+			return s.fakeBackend.ReadInfo(name, si)
+		}
+		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
+		info.Apps = map[string]*snap.AppInfo{
+			"app": {Snap: info, Name: "app"},
+		}
+		return info, nil
+	})
+	// And with cgroup information indicating the app has a process with pid 1234.
+	restore := snapstate.MockPidsOfSnap(func(instanceName string) (map[string][]int, error) {
+		c.Assert(instanceName, Equals, "some-snap")
+		return map[string][]int{
+			"snap.some-snap.some-app": {1234},
+		}, nil
+	})
+	defer restore()
+
+	// Attempt to install revision 2 of the snap.
+	snapsup := &snapstate.SnapSetup{
+		SideInfo: &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+	}
+
+	// And observe that refresh occurred regardless of the running process.
+	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", dummyInUseCheck)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallFailsOnSystem(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapsup := &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "system", SnapID: "some-snap-id", Revision: snap.R(1)}}
+	_, err := snapstate.DoInstall(s.state, nil, snapsup, 0, "", nil)
+	c.Assert(err, NotNil)
+	c.Assert(err, ErrorMatches, `cannot install reserved snap name 'system'`)
+}
+
+func (s *snapmgrTestSuite) TestDoInstallChannelDefault(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+
+	c.Check(snapsup.Channel, Equals, "stable")
+}
+
+func (s *snapmgrTestSuite) TestInstallRevision(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	opts := &snapstate.RevisionOptions{Revision: snap.R(7)}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+
+	c.Check(snapsup.Revision(), Equals, snap.R(7))
+}
+
+func (s *snapmgrTestSuite) TestInstallTooEarly(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.state.Set("seeded", nil)
+
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
+}
+
+func (s *snapmgrTestSuite) TestInstallConflict(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	// need a change to make the tasks visible
+	s.state.NewChange("install", "...").AddAll(ts)
+
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `snap "some-snap" has "install" change in progress`)
+}
+
+func (s *snapmgrTestSuite) TestInstallAliasConflict(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "otherfoosnap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "otherfoosnap", Revision: snap.R(30)},
+		},
+		Current: snap.R(30),
+		Active:  true,
+		Aliases: map[string]*snapstate.AliasTarget{
+			"foo.bar": {Manual: "bar"},
+		},
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Install(context.Background(), s.state, "foo", nil, 0, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `snap "foo" command namespace conflicts with alias "foo\.bar" for "otherfoosnap" snap`)
+}
+
+func (s *snapmgrTestSuite) TestInstallStrictIgnoresClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-strict"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is *not* classic
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.TrackingChannel, Equals, "channel-for-strict/stable")
+	c.Check(snapst.Classic, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestInstallSnapWithDefaultTrack(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	opts := &snapstate.RevisionOptions{Channel: "candidate"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap-with-default-track", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is in the 2.0 track
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap-with-default-track", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.TrackingChannel, Equals, "2.0/candidate")
+}
+
+func (s *snapmgrTestSuite) TestInstallManySnapOneWithDefaultTrack(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapNames := []string{"some-snap", "some-snap-with-default-track"}
+	installed, tss, err := snapstate.InstallMany(s.state, snapNames, s.user.ID)
+	c.Assert(err, IsNil)
+	c.Assert(installed, DeepEquals, snapNames)
+
+	chg := s.state.NewChange("install", "install two snaps")
+	for _, ts := range tss {
+		chg.AddAll(ts)
+	}
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is in the 2.0 track
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap-with-default-track", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.TrackingChannel, Equals, "2.0/stable")
+
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.TrackingChannel, Equals, "latest/stable")
+}
+
+// A sneakyStore changes the state when called
+type sneakyStore struct {
+	*fakeStore
+	state *state.State
+}
+
+func (s sneakyStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	s.state.Lock()
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}},
+		Current:         snap.R(1),
+		SnapType:        "app",
+	})
+	s.state.Unlock()
+	return s.fakeStore.SnapAction(ctx, currentSnaps, actions, assertQuery, user, opts)
+}
+
+func (s *snapmgrTestSuite) TestInstallStateConflict(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, sneakyStore{fakeStore: s.fakeStore, state: s.state})
+
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `snap "some-snap" has changes in progress`)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathTooEarly(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	r := snapstatetest.MockDeviceModel(nil)
+	defer r()
+
+	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `too early for operation, device model not yet acknowledged`)
+
+}
+
+func (s *snapmgrTestSuite) TestInstallPathConflict(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	// need a change to make the tasks visible
+	s.state.NewChange("install", "...").AddAll(ts)
+
+	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+	_, _, err = snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `snap "some-snap" has "install" change in progress`)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathMissingName(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`internal error: snap name to install %q not provided`, mockSnap))
+}
+
+func (s *snapmgrTestSuite) TestInstallPathSnapIDRevisionUnset(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "snapididid"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, fmt.Sprintf(`internal error: snap id set to install %q but revision is unset`, mockSnap))
+}
+
+func (s *snapmgrTestSuite) TestInstallPathValidateFlags(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+confinement: devmode
+`)
+	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `.* requires devmode or confinement override`)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathStrictIgnoresClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+confinement: strict
+`)
+
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is *not* classic
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Classic, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathAsRefresh(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Flags:  snapstate.Flags{DevMode: true},
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:         snap.R(1),
+		SnapType:        "app",
+		TrackingChannel: "wibbly/stable",
+	})
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+epoch: 1
+`)
+
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "edge", snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is *not* classic
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.TrackingChannel, Equals, "wibbly/edge")
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceInstallNotAllowed(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, sneakyStore{fakeStore: s.fakeStore, state: s.state})
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	_, err := snapstate.Install(context.Background(), s.state, "core_foo", nil, 0, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `cannot install snap of type os as "core_foo"`)
+
+	_, err = snapstate.Install(context.Background(), s.state, "some-base_foo", nil, 0, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `cannot install snap of type base as "some-base_foo"`)
+
+	_, err = snapstate.Install(context.Background(), s.state, "some-gadget_foo", nil, 0, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `cannot install snap of type gadget as "some-gadget_foo"`)
+
+	_, err = snapstate.Install(context.Background(), s.state, "some-kernel_foo", nil, 0, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `cannot install snap of type kernel as "some-kernel_foo"`)
+
+	_, err = snapstate.Install(context.Background(), s.state, "some-snapd_foo", nil, 0, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `cannot install snap of type snapd as "some-snapd_foo"`)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathFailsEarlyOnEpochMismatch(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// have epoch 1* installed
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+	})
+
+	// try to install epoch 42
+	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0\nepoch: 42\n")
+	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `cannot refresh "some-snap" to local snap with epoch 42, because it can't read the current epoch of 1\*`)
+}
+
+func (s *snapmgrTestSuite) TestInstallRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// we start without the auxiliary store info
+	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FileAbsent)
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	c.Check(snapstate.Installing(s.state), Equals, false)
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+	}})
+	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
+	expected := fakeOps{
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap",
+				Channel:      "some-channel",
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// check progress
+	ta := ts.Tasks()
+	task := ta[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+	c.Check(task.Summary(), Equals, `Download snap "some-snap" (11) from channel "some-channel"`)
+
+	// check install-record present
+	mountTask := ta[len(ta)-11]
+	c.Check(mountTask.Kind(), Equals, "mount-snap")
+	var installRecord backend.InstallRecord
+	c.Assert(mountTask.Get("install-record", &installRecord), IsNil)
+	c.Check(installRecord.TargetSnapExisted, Equals, false)
+
+	// check link/start snap summary
+	linkTask := ta[len(ta)-8]
+	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap" (11) available to the system`)
+	startTask := ta[len(ta)-3]
+	c.Check(startTask.Summary(), Equals, `Start snap "some-snap" (11) services`)
+
+	// verify snap-setup in the task state
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel:  "some-channel",
+		UserID:   s.user.ID,
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+			Size:        5,
+		},
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "some-channel",
+		Revision: snap.R(11),
+		SnapID:   "some-snap-id",
+	})
+
+	// verify snaps in the system state
+	var snaps map[string]*snapstate.SnapState
+	err = s.state.Get("snaps", &snaps)
+	c.Assert(err, IsNil)
+
+	snapst := snaps["some-snap"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "some-channel",
+		Revision: snap.R(11),
+	})
+	c.Assert(snapst.Required, Equals, false)
+
+	// we end with the auxiliary store info
+	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FilePresent)
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceInstallRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap_instance", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	c.Check(snapstate.Installing(s.state), Equals, false)
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
+	}})
+	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
+	expected := fakeOps{
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap_instance",
+				Channel:      "some-channel",
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap_instance",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/11"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap_instance",
+			revno: snap.R(11),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// check progress
+	ta := ts.Tasks()
+	task := ta[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+	c.Check(task.Summary(), Equals, `Download snap "some-snap_instance" (11) from channel "some-channel"`)
+
+	// check link/start snap summary
+	linkTask := ta[len(ta)-8]
+	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap_instance" (11) available to the system`)
+	startTask := ta[len(ta)-3]
+	c.Check(startTask.Summary(), Equals, `Start snap "some-snap_instance" (11) services`)
+
+	// verify snap-setup in the task state
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel:  "some-channel",
+		UserID:   s.user.ID,
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+			Size:        5,
+		},
+		SideInfo:    snapsup.SideInfo,
+		Type:        snap.TypeApp,
+		PlugsOnly:   true,
+		InstanceKey: "instance",
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "some-channel",
+		Revision: snap.R(11),
+		SnapID:   "some-snap-id",
+	})
+
+	// verify snaps in the system state
+	var snaps map[string]*snapstate.SnapState
+	err = s.state.Get("snaps", &snaps)
+	c.Assert(err, IsNil)
+
+	snapst := snaps["some-snap_instance"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "some-channel",
+		Revision: snap.R(11),
+	})
+	c.Assert(snapst.Required, Equals, false)
+	c.Assert(snapst.InstanceKey, Equals, "instance")
+
+	runHooks := tasksWithKind(ts, "run-hook")
+	c.Assert(taskKinds(runHooks), DeepEquals, []string{"run-hook[install]", "run-hook[configure]", "run-hook[check-health]"})
+	for _, hookTask := range runHooks {
+		c.Assert(hookTask.Kind(), Equals, "run-hook")
+		var hooksup hookstate.HookSetup
+		err = hookTask.Get("hook-setup", &hooksup)
+		c.Assert(err, IsNil)
+		c.Assert(hooksup.Snap, Equals, "some-snap_instance")
+	}
+}
+
+func (s *snapmgrTestSuite) TestInstallUndoRunThroughJustOneSnap(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	tasks := ts.Tasks()
+	last := tasks[len(tasks)-1]
+	// sanity
+	c.Assert(last.Lanes(), HasLen, 1)
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(last)
+	terr.JoinLane(last.Lanes()[0])
+	chg.AddTask(terr)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	mountTask := tasks[len(tasks)-11]
+	c.Assert(mountTask.Kind(), Equals, "mount-snap")
+	var installRecord backend.InstallRecord
+	c.Assert(mountTask.Get("install-record", &installRecord), IsNil)
+	c.Check(installRecord.TargetSnapExisted, Equals, false)
+
+	// ensure all our tasks ran
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+	}})
+	expected := fakeOps{
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap",
+				Channel:      "some-channel",
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "discard-namespace",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+
+			unlinkFirstInstallUndo: true,
+		},
+		{
+			op:    "setup-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:   "undo-copy-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  "<no-old>",
+		},
+		{
+			op:   "remove-snap-data-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
+		},
+		{
+			op:    "undo-setup-snap",
+			name:  "some-snap",
+			stype: "app",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+}
+
+func (s *snapmgrTestSuite) TestInstallWithCohortRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", CohortKey: "scurries"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	c.Check(snapstate.Installing(s.state), Equals, false)
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
+	}})
+	expected := fakeOps{
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap",
+				CohortKey:    "scurries",
+				Channel:      "some-channel",
+			},
+			revno:  snap.R(666),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(666),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Revision: snap.R(666),
+				Channel:  "some-channel",
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
+			revno: snap.R(666),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/666"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(666),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Revision: snap.R(666),
+				Channel:  "some-channel",
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/666"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(666),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap",
+			revno: snap.R(666),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// check progress
+	ta := ts.Tasks()
+	task := ta[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+	c.Check(task.Summary(), Equals, `Download snap "some-snap" (666) from channel "some-channel"`)
+
+	// check link/start snap summary
+	linkTask := ta[len(ta)-8]
+	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap" (666) available to the system`)
+	startTask := ta[len(ta)-3]
+	c.Check(startTask.Summary(), Equals, `Start snap "some-snap" (666) services`)
+
+	// verify snap-setup in the task state
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel:  "some-channel",
+		UserID:   s.user.ID,
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+			Size:        5,
+		},
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+		CohortKey: "scurries",
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(666),
+		SnapID:   "some-snap-id",
+		Channel:  "some-channel",
+	})
+
+	// verify snaps in the system state
+	var snaps map[string]*snapstate.SnapState
+	err = s.state.Get("snaps", &snaps)
+	c.Assert(err, IsNil)
+
+	snapst := snaps["some-snap"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
+	c.Assert(snapst.CohortKey, Equals, "scurries")
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(666),
+		Channel:  "some-channel",
+	})
+	c.Assert(snapst.Required, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestInstallWithRevisionRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	c.Check(snapstate.Installing(s.state), Equals, false)
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+	}})
+	expected := fakeOps{
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap",
+				Revision:     snap.R(42),
+			},
+			revno:  snap.R(42),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Revision: snap.R(42),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+			revno: snap.R(42),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Revision: snap.R(42),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// check progress
+	ta := ts.Tasks()
+	task := ta[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+	c.Check(task.Summary(), Equals, `Download snap "some-snap" (42) from channel "some-channel"`)
+
+	// check link/start snap summary
+	linkTask := ta[len(ta)-8]
+	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap" (42) available to the system`)
+	startTask := ta[len(ta)-3]
+	c.Check(startTask.Summary(), Equals, `Start snap "some-snap" (42) services`)
+
+	// verify snap-setup in the task state
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel:  "some-channel",
+		UserID:   s.user.ID,
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+			Size:        5,
+		},
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(42),
+		SnapID:   "some-snap-id",
+	})
+
+	// verify snaps in the system state
+	var snaps map[string]*snapstate.SnapState
+	err = s.state.Get("snaps", &snaps)
+	c.Assert(err, IsNil)
+
+	snapst := snaps["some-snap"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
+	c.Assert(snapst.CohortKey, Equals, "")
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(42),
+	})
+	c.Assert(snapst.Required, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestInstallStartOrder(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "services-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	c.Check(snapstate.Installing(s.state), Equals, false)
+	op := s.fakeBackend.ops.First("start-snap-services")
+	c.Assert(op, NotNil)
+	c.Assert(op, DeepEquals, &fakeOp{
+		op:   "start-snap-services",
+		path: filepath.Join(dirs.SnapMountDir, "services-snap/11"),
+		// ordered to preserve after/before relation
+		services: []string{"svc1", "svc3", "svc2"},
+	})
+}
+
+func (s *snapmgrTestSuite) TestInstalling(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	c.Check(snapstate.Installing(s.state), Equals, false)
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	c.Check(snapstate.Installing(s.state), Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestInstallFirstLocalRunThrough(c *C) {
+	// use the real thing for this one
+	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
+
+	restoreInstallSize := snapstate.MockInstallSize(func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+		c.Fatalf("installSize shouldn't be hit with local install")
+		return 0, nil
+	})
+	defer restoreInstallSize()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, `name: mock
+version: 1.0`)
+	chg := s.state.NewChange("install", "install a local snap")
+	ts, info, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "mock"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	// ensure the returned info is correct
+	c.Check(info.SideInfo.RealName, Equals, "mock")
+	c.Check(info.Version, Equals, "1.0")
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			// only local install was run, i.e. first actions are pseudo-action current
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			// and setup-snap
+			op:    "setup-snap",
+			name:  "mock",
+			path:  mockSnap,
+			revno: snap.R("x1"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "mock",
+			revno: snap.R("x1"),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "mock",
+				Revision: snap.R("x1"),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "mock",
+			revno: snap.R("x1"),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "mock",
+			revno: snap.R("x1"),
+		},
+	}
+
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	task := ts.Tasks()[1]
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		SnapPath:  mockSnap,
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "mock",
+		Revision: snap.R(-1),
+	})
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "mock", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "mock",
+		Channel:  "",
+		Revision: snap.R(-1),
+	})
+	c.Assert(snapst.LocalRevision(), Equals, snap.R(-1))
+}
+
+func (s *snapmgrTestSuite) TestInstallSubsequentLocalRunThrough(c *C) {
+	// use the real thing for this one
+	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "mock", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "mock", Revision: snap.R(-2)},
+		},
+		Current:  snap.R(-2),
+		SnapType: "app",
+	})
+
+	mockSnap := makeTestSnap(c, `name: mock
+version: 1.0
+epoch: 1*
+`)
+	chg := s.state.NewChange("install", "install a local snap")
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "mock"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op:  "current",
+			old: filepath.Join(dirs.SnapMountDir, "mock/x2"),
+		},
+		{
+			op:    "setup-snap",
+			name:  "mock",
+			path:  mockSnap,
+			revno: snap.R("x3"),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "mock",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x2"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x3"),
+			old:  filepath.Join(dirs.SnapMountDir, "mock/x2"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "mock",
+			revno: snap.R(-3),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "mock",
+				Revision: snap.R(-3),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x3"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "mock",
+			revno: snap.R("x3"),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "mock",
+			revno: snap.R("x3"),
+		},
+	}
+
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	task := ts.Tasks()[1]
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		SnapPath:  mockSnap,
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "mock",
+		Revision: snap.R(-3),
+	})
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "mock", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.CurrentSideInfo(), DeepEquals, &snap.SideInfo{
+		RealName: "mock",
+		Channel:  "",
+		Revision: snap.R(-3),
+	})
+	c.Assert(snapst.LocalRevision(), Equals, snap.R(-3))
+}
+
+func (s *snapmgrTestSuite) TestInstallOldSubsequentLocalRunThrough(c *C) {
+	// use the real thing for this one
+	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "mock", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "mock", Revision: snap.R(100001)},
+		},
+		Current:  snap.R(100001),
+		SnapType: "app",
+	})
+
+	mockSnap := makeTestSnap(c, `name: mock
+version: 1.0
+epoch: 1*
+`)
+	chg := s.state.NewChange("install", "install a local snap")
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "mock"}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			// ensure only local install was run, i.e. first action is pseudo-action current
+			op:  "current",
+			old: filepath.Join(dirs.SnapMountDir, "mock/100001"),
+		},
+		{
+			// and setup-snap
+			op:    "setup-snap",
+			name:  "mock",
+			path:  mockSnap,
+			revno: snap.R("x1"),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "mock",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "mock/100001"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
+			old:  filepath.Join(dirs.SnapMountDir, "mock/100001"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "mock",
+			revno: snap.R("x1"),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "mock",
+				Revision: snap.R("x1"),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "mock",
+			revno: snap.R("x1"),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			// and cleanup
+			op:    "cleanup-trash",
+			name:  "mock",
+			revno: snap.R("x1"),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "mock", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.CurrentSideInfo(), DeepEquals, &snap.SideInfo{
+		RealName: "mock",
+		Channel:  "",
+		Revision: snap.R(-1),
+	})
+	c.Assert(snapst.LocalRevision(), Equals, snap.R(-1))
+}
+
+func (s *snapmgrTestSuite) TestInstallPathWithMetadataRunThrough(c *C) {
+	// use the real thing for this one
+	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	someSnap := makeTestSnap(c, `name: orig-name
+version: 1.0`)
+	chg := s.state.NewChange("install", "install a local snap")
+
+	si := &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(42),
+	}
+	ts, _, err := snapstate.InstallPath(s.state, si, someSnap, "", "", snapstate.Flags{Required: true})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure only local install was run, i.e. first actions are pseudo-action current
+	c.Assert(s.fakeBackend.ops.Ops(), HasLen, 9)
+	c.Check(s.fakeBackend.ops[0].op, Equals, "current")
+	c.Check(s.fakeBackend.ops[0].old, Equals, "<no-current>")
+	// and setup-snap
+	c.Check(s.fakeBackend.ops[1].op, Equals, "setup-snap")
+	c.Check(s.fakeBackend.ops[1].name, Equals, "some-snap")
+	c.Check(s.fakeBackend.ops[1].path, Matches, `.*/orig-name_1.0_all.snap`)
+	c.Check(s.fakeBackend.ops[1].revno, Equals, snap.R(42))
+
+	c.Check(s.fakeBackend.ops[4].op, Equals, "candidate")
+	c.Check(s.fakeBackend.ops[4].sinfo, DeepEquals, *si)
+	c.Check(s.fakeBackend.ops[5].op, Equals, "link-snap")
+	c.Check(s.fakeBackend.ops[5].path, Equals, filepath.Join(dirs.SnapMountDir, "some-snap/42"))
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	task := ts.Tasks()[0]
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		SnapPath: someSnap,
+		SideInfo: snapsup.SideInfo,
+		Flags: snapstate.Flags{
+			Required: true,
+		},
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, si)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "")
+	c.Assert(snapst.Sequence[0], DeepEquals, si)
+	c.Assert(snapst.LocalRevision().Unset(), Equals, true)
+	c.Assert(snapst.Required, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathSkipConfigure(c *C) {
+	r := release.MockOnClassic(false)
+	defer r()
+
+	makeInstalledMockCoreSnap(c)
+
+	// using MockSnap, we want to read the bits on disk
+	snapstate.MockSnapReadInfo(snap.ReadInfo)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.prepareGadget(c)
+
+	snapPath := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}, snapPath, "", "edge", snapstate.Flags{SkipConfigure: true})
+	c.Assert(err, IsNil)
+
+	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	// SkipConfigure is consumed and consulted when creating the taskset
+	// but is not copied into SnapSetup
+	c.Check(snapsup.Flags.SkipConfigure, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestInstallWithoutCoreRunThrough1(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// pretend we don't have core
+	snapstate.Set(s.state, "core", nil)
+
+	chg := s.state.NewChange("install", "install a snap on a system without core")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
+		{
+			macaroon: s.user.StoreMacaroon,
+			name:     "core",
+			target:   filepath.Join(dirs.SnapBlobDir, "core_11.snap"),
+		},
+		{
+			macaroon: s.user.StoreMacaroon,
+			name:     "some-snap",
+			target:   filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+		}})
+	expected := fakeOps{
+		// we check the snap
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap",
+				Revision:     snap.R(42),
+			},
+			revno:  snap.R(42),
+			userID: 1,
+		},
+		// then we check core because its not installed already
+		// and continue with that
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "core",
+				Channel:      "stable",
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "core",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "core",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "core_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "core",
+				Channel:  "stable",
+				SnapID:   "core-id",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "core",
+			path:  filepath.Join(dirs.SnapBlobDir, "core_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "core/11"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "core",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "core",
+				Channel:  "stable",
+				SnapID:   "core-id",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "core/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "core",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		// after core is in place continue with the snap
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Revision: snap.R(42),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
+			revno: snap.R(42),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
+			old:  "<no-old>",
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Revision: snap.R(42),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+		{
+			op: "update-aliases",
+		},
+		// cleanups order is random
+		{
+			op:    "cleanup-trash",
+			name:  "core",
+			revno: snap.R(42),
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap",
+			revno: snap.R(42),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	// compare the details without the cleanup tasks, the order is random
+	// as they run in parallel
+	opsLenWithoutCleanups := len(s.fakeBackend.ops) - 2
+	c.Assert(s.fakeBackend.ops[:opsLenWithoutCleanups], DeepEquals, expected[:opsLenWithoutCleanups])
+
+	// verify core in the system state
+	var snaps map[string]*snapstate.SnapState
+	err = s.state.Get("snaps", &snaps)
+	c.Assert(err, IsNil)
+
+	snapst := snaps["core"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "latest/stable")
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "core",
+		Channel:  "stable",
+		SnapID:   "core-id",
+		Revision: snap.R(11),
+	})
+}
+
+func (s *snapmgrTestSuite) TestInstallWithoutCoreTwoSnapsRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	restore := snapstate.MockPrerequisitesRetryTimeout(10 * time.Millisecond)
+	defer restore()
+
+	// pretend we don't have core
+	snapstate.Set(s.state, "core", nil)
+
+	chg1 := s.state.NewChange("install", "install snap 1")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+	ts1, err := snapstate.Install(context.Background(), s.state, "snap1", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg1.AddAll(ts1)
+
+	chg2 := s.state.NewChange("install", "install snap 2")
+	opts = &snapstate.RevisionOptions{Channel: "some-other-channel", Revision: snap.R(21)}
+	ts2, err := snapstate.Install(context.Background(), s.state, "snap2", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg2.AddAll(ts2)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran and core was only installed once
+	c.Assert(chg1.Err(), IsNil)
+	c.Assert(chg2.Err(), IsNil)
+
+	c.Assert(chg1.IsReady(), Equals, true)
+	c.Assert(chg2.IsReady(), Equals, true)
+
+	// order in which the changes run is random
+	if len(chg1.Tasks()) < len(chg2.Tasks()) {
+		chg1, chg2 = chg2, chg1
+	}
+	c.Assert(taskKinds(chg1.Tasks()), HasLen, 28)
+	c.Assert(taskKinds(chg2.Tasks()), HasLen, 14)
+
+	// FIXME: add helpers and do a DeepEquals here for the operations
+}
+
+func (s *snapmgrTestSuite) TestInstallWithoutCoreTwoSnapsWithFailureRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// slightly longer retry timeout to avoid deadlock when we
+	// trigger a retry quickly that the link snap for core does
+	// not have a chance to run
+	restore := snapstate.MockPrerequisitesRetryTimeout(40 * time.Millisecond)
+	defer restore()
+
+	defer s.se.Stop()
+	// Two changes are created, the first will fails, the second will
+	// be fine. The order of what change runs first is random, the
+	// first change will also install core in its own lane. This test
+	// ensures that core gets installed and there are no conflicts
+	// even if core already got installed from the first change.
+	//
+	// It runs multiple times so that both possible cases get a chance
+	// to run
+	for i := 0; i < 5; i++ {
+		// start clean
+		snapstate.Set(s.state, "core", nil)
+		snapstate.Set(s.state, "snap2", nil)
+
+		// chg1 has an error
+		chg1 := s.state.NewChange("install", "install snap 1")
+		opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+		ts1, err := snapstate.Install(context.Background(), s.state, "snap1", opts, s.user.ID, snapstate.Flags{})
+		c.Assert(err, IsNil)
+		chg1.AddAll(ts1)
+
+		tasks := ts1.Tasks()
+		last := tasks[len(tasks)-1]
+		terr := s.state.NewTask("error-trigger", "provoking total undo")
+		terr.WaitFor(last)
+		chg1.AddTask(terr)
+
+		// chg2 is good
+		chg2 := s.state.NewChange("install", "install snap 2")
+		opts = &snapstate.RevisionOptions{Channel: "some-other-channel", Revision: snap.R(21)}
+		ts2, err := snapstate.Install(context.Background(), s.state, "snap2", opts, s.user.ID, snapstate.Flags{})
+		c.Assert(err, IsNil)
+		chg2.AddAll(ts2)
+
+		// we use our own settle as we need a bigger timeout
+		s.state.Unlock()
+		err = s.o.Settle(testutil.HostScaledTimeout(15 * time.Second))
+		s.state.Lock()
+		c.Assert(err, IsNil)
+
+		// ensure expected change states
+		c.Check(chg1.Status(), Equals, state.ErrorStatus)
+		c.Check(chg2.Status(), Equals, state.DoneStatus)
+
+		// ensure we have both core and snap2
+		var snapst snapstate.SnapState
+		err = snapstate.Get(s.state, "core", &snapst)
+		c.Assert(err, IsNil)
+		c.Assert(snapst.Active, Equals, true)
+		c.Assert(snapst.Sequence, HasLen, 1)
+		c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+			RealName: "core",
+			SnapID:   "core-id",
+			Channel:  "stable",
+			Revision: snap.R(11),
+		})
+
+		var snapst2 snapstate.SnapState
+		err = snapstate.Get(s.state, "snap2", &snapst2)
+		c.Assert(err, IsNil)
+		c.Assert(snapst2.Active, Equals, true)
+		c.Assert(snapst2.Sequence, HasLen, 1)
+		c.Assert(snapst2.Sequence[0], DeepEquals, &snap.SideInfo{
+			RealName: "snap2",
+			SnapID:   "snap2-id",
+			Channel:  "",
+			Revision: snap.R(21),
+		})
+
+	}
+}
+
+type behindYourBackStore struct {
+	*fakeStore
+	state *state.State
+
+	coreInstallRequested bool
+	coreInstalled        bool
+	chg                  *state.Change
+}
+
+func (s behindYourBackStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
+
+	if len(actions) == 1 && actions[0].Action == "install" && actions[0].InstanceName == "core" {
+		s.state.Lock()
+		if !s.coreInstallRequested {
+			s.coreInstallRequested = true
+			snapsup := &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "core",
+				},
+			}
+			t := s.state.NewTask("prepare", "prepare core")
+			t.Set("snap-setup", snapsup)
+			s.chg = s.state.NewChange("install", "install core")
+			s.chg.AddAll(state.NewTaskSet(t))
+		}
+		if s.chg != nil && !s.coreInstalled {
+			// marks change ready but also
+			// tasks need to also be marked cleaned
+			for _, t := range s.chg.Tasks() {
+				t.SetStatus(state.DoneStatus)
+				t.SetClean()
+			}
+			snapstate.Set(s.state, "core", &snapstate.SnapState{
+				Active: true,
+				Sequence: []*snap.SideInfo{
+					{RealName: "core", Revision: snap.R(1)},
+				},
+				Current:  snap.R(1),
+				SnapType: "os",
+			})
+			s.coreInstalled = true
+		}
+		s.state.Unlock()
+	}
+
+	return s.fakeStore.SnapAction(ctx, currentSnaps, actions, nil, user, opts)
+}
+
+// this test the scenario that some-snap gets installed and during the
+// install (when unlocking for the store info call for core) an
+// explicit "snap install core" happens. In this case the snapstate
+// will return a change conflict. we handle this via a retry, ensure
+// this is actually what happens.
+func (s *snapmgrTestSuite) TestInstallWithoutCoreConflictingInstall(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	restore := snapstate.MockPrerequisitesRetryTimeout(10 * time.Millisecond)
+	defer restore()
+
+	snapstate.ReplaceStore(s.state, behindYourBackStore{fakeStore: s.fakeStore, state: s.state})
+
+	// pretend we don't have core
+	snapstate.Set(s.state, "core", nil)
+
+	// now install a snap that will pull in core
+	chg := s.state.NewChange("install", "install a snap on a system without core")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	prereq := ts.Tasks()[0]
+	c.Assert(prereq.Kind(), Equals, "prerequisites")
+	c.Check(prereq.AtTime().IsZero(), Equals, true)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+
+	// start running the change, this will trigger the
+	// prerequisites task, which will trigger the install of core
+	// and also call our mock store which will generate a parallel
+	// change
+	s.se.Ensure()
+	s.se.Wait()
+
+	// change is not ready yet, because the prerequists triggered
+	// a state.Retry{} because of the conflicting change
+	c.Assert(chg.IsReady(), Equals, false)
+	s.state.Lock()
+	// marked for retry
+	c.Check(prereq.AtTime().IsZero(), Equals, false)
+	c.Check(prereq.Status().Ready(), Equals, false)
+	s.state.Unlock()
+
+	// retry interval is 10ms so 20ms should be plenty of time
+	time.Sleep(20 * time.Millisecond)
+	s.settle(c)
+	// chg got retried, core is now installed, things are good
+	c.Assert(chg.IsReady(), Equals, true)
+
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify core in the system state
+	var snaps map[string]*snapstate.SnapState
+	err = s.state.Get("snaps", &snaps)
+	c.Assert(err, IsNil)
+
+	snapst := snaps["core"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "core",
+		Revision: snap.R(1),
+	})
+
+	snapst = snaps["some-snap"]
+	c.Assert(snapst, NotNil)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "some-channel",
+		Revision: snap.R(11),
+	})
+}
+
+func (s *snapmgrTestSuite) TestInstallDefaultProviderRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
+
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(s.state, repo)
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "stable", Revision: snap.R(42)}
+	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-plug", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	expected := fakeOps{{
+		op:     "storesvc-snap-action",
+		userID: 1,
+	}, {
+		op: "storesvc-snap-action:action",
+		action: store.SnapAction{
+			Action:       "install",
+			InstanceName: "snap-content-plug",
+			Revision:     snap.R(42),
+		},
+		revno:  snap.R(42),
+		userID: 1,
+	}, {
+		op:     "storesvc-snap-action",
+		userID: 1,
+	}, {
+		op: "storesvc-snap-action:action",
+		action: store.SnapAction{
+			Action:       "install",
+			InstanceName: "snap-content-slot",
+			Channel:      "stable",
+		},
+		revno:  snap.R(11),
+		userID: 1,
+	}, {
+		op:   "storesvc-download",
+		name: "snap-content-slot",
+	}, {
+		op:    "validate-snap:Doing",
+		name:  "snap-content-slot",
+		revno: snap.R(11),
+	}, {
+		op:  "current",
+		old: "<no-current>",
+	}, {
+		op:   "open-snap-file",
+		path: filepath.Join(dirs.SnapBlobDir, "snap-content-slot_11.snap"),
+		sinfo: snap.SideInfo{
+			RealName: "snap-content-slot",
+			Channel:  "stable",
+			SnapID:   "snap-content-slot-id",
+			Revision: snap.R(11),
+		},
+	}, {
+		op:    "setup-snap",
+		name:  "snap-content-slot",
+		path:  filepath.Join(dirs.SnapBlobDir, "snap-content-slot_11.snap"),
+		revno: snap.R(11),
+	}, {
+		op:   "copy-data",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-slot/11"),
+		old:  "<no-old>",
+	}, {
+		op:    "setup-profiles:Doing",
+		name:  "snap-content-slot",
+		revno: snap.R(11),
+	}, {
+		op: "candidate",
+		sinfo: snap.SideInfo{
+			RealName: "snap-content-slot",
+			Channel:  "stable",
+			SnapID:   "snap-content-slot-id",
+			Revision: snap.R(11),
+		},
+	}, {
+		op:   "link-snap",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-slot/11"),
+	}, {
+		op:    "auto-connect:Doing",
+		name:  "snap-content-slot",
+		revno: snap.R(11),
+	}, {
+		op: "update-aliases",
+	}, {
+		op:   "storesvc-download",
+		name: "snap-content-plug",
+	}, {
+		op:    "validate-snap:Doing",
+		name:  "snap-content-plug",
+		revno: snap.R(42),
+	}, {
+		op:  "current",
+		old: "<no-current>",
+	}, {
+		op:   "open-snap-file",
+		path: filepath.Join(dirs.SnapBlobDir, "snap-content-plug_42.snap"),
+		sinfo: snap.SideInfo{
+			RealName: "snap-content-plug",
+			SnapID:   "snap-content-plug-id",
+			Revision: snap.R(42),
+		},
+	}, {
+		op:    "setup-snap",
+		name:  "snap-content-plug",
+		path:  filepath.Join(dirs.SnapBlobDir, "snap-content-plug_42.snap"),
+		revno: snap.R(42),
+	}, {
+		op:   "copy-data",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-plug/42"),
+		old:  "<no-old>",
+	}, {
+		op:    "setup-profiles:Doing",
+		name:  "snap-content-plug",
+		revno: snap.R(42),
+	}, {
+		op: "candidate",
+		sinfo: snap.SideInfo{
+			RealName: "snap-content-plug",
+			SnapID:   "snap-content-plug-id",
+			Revision: snap.R(42),
+		},
+	}, {
+		op:   "link-snap",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-plug/42"),
+	}, {
+		op:    "auto-connect:Doing",
+		name:  "snap-content-plug",
+		revno: snap.R(42),
+	}, {
+		op: "update-aliases",
+	}, {
+		op:    "cleanup-trash",
+		name:  "snap-content-plug",
+		revno: snap.R(42),
+	}, {
+		op:    "cleanup-trash",
+		name:  "snap-content-slot",
+		revno: snap.R(11),
+	},
+	}
+	// snap and default provider are installed in parallel so we can't
+	// do a simple c.Check(ops, DeepEquals, fakeOps{...})
+	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
+	for _, op := range expected {
+		c.Assert(s.fakeBackend.ops, testutil.DeepContains, op)
+	}
+	for _, op := range s.fakeBackend.ops {
+		c.Assert(expected, testutil.DeepContains, op)
+	}
+}
+
+func (s *snapmgrTestSuite) TestInstallDefaultProviderCompat(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
+
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(s.state, repo)
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-plug-compat", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	// and both circular snaps got linked
+	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
+		op:   "link-snap",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-plug-compat/42"),
+	})
+	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
+		op:   "link-snap",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-slot/11"),
+	})
+}
+
+func (s *snapmgrTestSuite) TestInstallDiskSpaceError(c *C) {
+	restore := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return &osutil.NotEnoughDiskSpaceError{} })
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-install", true)
+	tr.Commit()
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	diskSpaceErr := err.(*snapstate.InsufficientSpaceError)
+	c.Assert(diskSpaceErr, ErrorMatches, `insufficient space in .* to perform "install" change for the following snaps: some-snap`)
+	c.Check(diskSpaceErr.Path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+	c.Check(diskSpaceErr.Snaps, DeepEquals, []string{"some-snap"})
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeError(c *C) {
+	restore := snapstate.MockInstallSize(func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+		return 0, fmt.Errorf("boom")
+	})
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-install", true)
+	tr.Commit()
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `boom`)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathWithLayoutsChecksFeatureFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// When layouts are disabled we cannot install a local snap depending on the feature.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", false)
+	tr.Commit()
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+layout:
+ /usr:
+  bind: $SNAP/usr
+`)
+	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
+
+	// When layouts are enabled we can install a local snap depending on the feature.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", true)
+	tr.Commit()
+
+	_, _, err = snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathWithMetadataChannelSwitchKernel(c *C) {
+	// use the real thing for this one
+	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// snapd cannot be installed unless the model uses a base snap
+	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "kernel", Revision: snap.R(11)},
+		},
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
+		Active:          true,
+	})
+
+	someSnap := makeTestSnap(c, `name: kernel
+version: 1.0`)
+	si := &snap.SideInfo{
+		RealName: "kernel",
+		SnapID:   "kernel-id",
+		Revision: snap.R(42),
+		Channel:  "some-channel",
+	}
+	_, _, err := snapstate.InstallPath(s.state, si, someSnap, "", "some-channel", snapstate.Flags{Required: true})
+	c.Assert(err, ErrorMatches, `cannot switch from kernel track "18" as specified for the \(device\) model to "some-channel"`)
+}
+
+func (s *snapmgrTestSuite) TestInstallPathWithMetadataChannelSwitchGadget(c *C) {
+	// use the real thing for this one
+	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// snapd cannot be installed unless the model uses a base snap
+	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "brand-gadget", Revision: snap.R(11)},
+		},
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
+		Active:          true,
+	})
+
+	someSnap := makeTestSnap(c, `name: brand-gadget
+version: 1.0`)
+	si := &snap.SideInfo{
+		RealName: "brand-gadget",
+		SnapID:   "brand-gadget-id",
+		Revision: snap.R(42),
+		Channel:  "some-channel",
+	}
+	_, _, err := snapstate.InstallPath(s.state, si, someSnap, "", "some-channel", snapstate.Flags{Required: true})
+	c.Assert(err, ErrorMatches, `cannot switch from gadget track "18" as specified for the \(device\) model to "some-channel"`)
+}
+
+func (s *snapmgrTestSuite) TestInstallLayoutsChecksFeatureFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// Layouts are now enabled by default.
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-layout"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// Layouts can be explicitly disabled.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", false)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
+
+	// Layouts can be explicitly enabled.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", true)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// The default empty value now means "enabled".
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", "")
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// Layouts are enabled when the controlling flag is reset to nil.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", nil)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallUserDaemonsChecksFeatureFlag(c *C) {
+	if release.ReleaseInfo.ID == "ubuntu" && release.ReleaseInfo.VersionID == "14.04" {
+		c.Skip("Ubuntu 14.04 does not support user daemons")
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// User daemons are disabled by default.
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-user-daemon"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.user-daemons' to true")
+
+	// User daemons can be explicitly enabled.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.user-daemons", true)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// User daemons can be explicitly disabled.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.user-daemons", false)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.user-daemons' to true")
+
+	// The default empty value means "disabled"".
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.user-daemons", "")
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.user-daemons' to true")
+
+	// User daemons are disabled when the controlling flag is reset to nil.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.user-daemons", nil)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.user-daemons' to true")
+}
+
+func (s *snapmgrTestSuite) TestInstallUserDaemonsUsupportedOnTrusty(c *C) {
+	restore := release.MockReleaseInfo(&release.OS{ID: "ubuntu", VersionID: "14.04"})
+	defer restore()
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.user-daemons", true)
+	tr.Commit()
+
+	// Even with the experimental.user-daemons flag set, user
+	// daemons are not supported on Trusty
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-user-daemon"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "user session daemons are not supported on this release")
+}
+
+func (s *snapmgrTestSuite) TestInstallDbusActivationChecksFeatureFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// D-Bus activation is disabled by default.
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-dbus-activation"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.dbus-activation' to true")
+
+	// D-Bus activation can be explicitly enabled.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.dbus-activation", true)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// D-Bus activation can be explicitly disabled.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.dbus-activation", false)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.dbus-activation' to true")
+
+	// The default empty value means "disabled"
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.dbus-activation", "")
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.dbus-activation' to true")
+
+	// D-Bus activation is disabled when the controlling flag is reset to nil.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.dbus-activation", nil)
+	tr.Commit()
+	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.dbus-activation' to true")
+}
+
+func (s *snapmgrTestSuite) TestInstallValidatesInstanceNames(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	_, err := snapstate.Install(context.Background(), s.state, "foo--invalid", nil, 0, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `invalid instance name: invalid snap name: "foo--invalid"`)
+
+	_, err = snapstate.Install(context.Background(), s.state, "foo_123_456", nil, 0, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `invalid instance name: invalid instance key: "123_456"`)
+
+	_, _, err = snapstate.InstallMany(s.state, []string{"foo--invalid"}, 0)
+	c.Assert(err, ErrorMatches, `invalid instance name: invalid snap name: "foo--invalid"`)
+
+	_, _, err = snapstate.InstallMany(s.state, []string{"foo_123_456"}, 0)
+	c.Assert(err, ErrorMatches, `invalid instance name: invalid instance key: "123_456"`)
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+epoch: 1*
+`)
+	si := snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}
+	_, _, err = snapstate.InstallPath(s.state, &si, mockSnap, "some-snap_123_456", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `invalid instance name: invalid instance key: "123_456"`)
+}
+
+func (s *snapmgrTestSuite) TestInstallFailsWhenClassicSnapsAreNotSupported(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	reset := release.MockReleaseInfo(&release.OS{
+		ID: "fedora",
+	})
+	defer reset()
+
+	// this needs doing because dirs depends on the release info
+	dirs.SetRootDir(dirs.GlobalRootDir)
+
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-classic"}
+	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, ErrorMatches, "classic confinement requires snaps under /snap or symlink from /snap to "+dirs.SnapMountDir)
+}
+
+func (s *snapmgrTestSuite) TestInstallUndoRunThroughUndoContextOptional(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap-no-install-record", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	tasks := ts.Tasks()
+	last := tasks[len(tasks)-1]
+	// sanity
+	c.Assert(last.Lanes(), HasLen, 1)
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(last)
+	terr.JoinLane(last.Lanes()[0])
+	chg.AddTask(terr)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	mountTask := tasks[len(tasks)-11]
+	c.Assert(mountTask.Kind(), Equals, "mount-snap")
+	var installRecord backend.InstallRecord
+	c.Assert(mountTask.Get("install-record", &installRecord), Equals, state.ErrNoState)
+}
+
+func (s *snapmgrTestSuite) TestInstallDefaultProviderCircular(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
+
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(s.state, repo)
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
+	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-circular1", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+	// and both circular snaps got linked
+	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
+		op:   "link-snap",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-circular1/42"),
+	})
+	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
+		op:   "link-snap",
+		path: filepath.Join(dirs.SnapMountDir, "snap-content-circular2/11"),
+	})
+}
+
+func (s *snapmgrTestSuite) TestParallelInstallInstallPathExperimentalSwitch(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	mockSnap := makeTestSnap(c, `name: some-snap
+version: 1.0
+`)
+	si := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}
+	_, _, err := snapstate.InstallPath(s.state, si, mockSnap, "some-snap_foo", "", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.parallel-instances' to true")
+
+	// enable parallel instances
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	_, _, err = snapstate.InstallPath(s.state, si, mockSnap, "some-snap_foo", "", snapstate.Flags{})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallMany(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	installed, tts, err := snapstate.InstallMany(s.state, []string{"one", "two"}, 0)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 2)
+	c.Check(installed, DeepEquals, []string{"one", "two"})
+
+	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true)
+
+	for i, ts := range tts {
+		verifyInstallTasks(c, 0, 0, ts, s.state)
+		// check that tasksets are in separate lanes
+		for _, t := range ts.Tasks() {
+			c.Assert(t.Lanes(), DeepEquals, []int{i + 1})
+		}
+	}
+}
+
+func (s *snapmgrTestSuite) TestInstallManyDiskSpaceError(c *C) {
+	restore := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return &osutil.NotEnoughDiskSpaceError{} })
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-install", true)
+	tr.Commit()
+
+	_, _, err := snapstate.InstallMany(s.state, []string{"one", "two"}, 0)
+	diskSpaceErr := err.(*snapstate.InsufficientSpaceError)
+	c.Assert(diskSpaceErr, ErrorMatches, `insufficient space in .* to perform "install" change for the following snaps: one, two`)
+	c.Check(diskSpaceErr.Path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+	c.Check(diskSpaceErr.Snaps, DeepEquals, []string{"one", "two"})
+	c.Check(diskSpaceErr.ChangeKind, Equals, "install")
+}
+
+func (s *snapmgrTestSuite) TestInstallManyDiskCheckDisabled(c *C) {
+	restore := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return &osutil.NotEnoughDiskSpaceError{} })
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-install", false)
+	tr.Commit()
+
+	_, _, err := snapstate.InstallMany(s.state, []string{"one", "two"}, 0)
+	c.Check(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestInstallManyTooEarly(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.state.Set("seeded", nil)
+
+	_, _, err := snapstate.InstallMany(s.state, []string{"one", "two"}, 0)
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
+}
+
+func (s *snapmgrTestSuite) TestInstallManyChecksPreconditions(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	_, _, err := snapstate.InstallMany(s.state, []string{"some-snap-now-classic"}, 0)
+	c.Assert(err, NotNil)
+	c.Check(err, DeepEquals, &snapstate.SnapNeedsClassicError{Snap: "some-snap-now-classic"})
+
+	_, _, err = snapstate.InstallMany(s.state, []string{"some-snap_foo"}, 0)
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.parallel-instances' to true")
+}
+
+func verifyStopReason(c *C, ts *state.TaskSet, reason string) {
+	tl := tasksWithKind(ts, "stop-snap-services")
+	c.Check(tl, HasLen, 1)
+
+	var stopReason string
+	err := tl[0].Get("stop-reason", &stopReason)
+	c.Assert(err, IsNil)
+	c.Check(stopReason, Equals, reason)
+
+}
+
+func (s *snapmgrTestSuite) TestUndoMountSnapFailsInCopyData(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	chg := s.state.NewChange("install", "install a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.fakeBackend.copySnapDataFailTrigger = filepath.Join(dirs.SnapMountDir, "some-snap/11")
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op:     "storesvc-snap-action",
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "install",
+				InstanceName: "some-snap",
+				Channel:      "some-channel",
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: "<no-current>",
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "copy-data.failed",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  "<no-old>",
+		},
+		{
+			op:   "remove-snap-data-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
+		},
+		{
+			op:    "undo-setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+}
+
+func (s *snapmgrTestSuite) TestSideInfoPaid(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-paid"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install paid snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snap has paid sideinfo
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.CurrentSideInfo().Paid, Equals, true)
+	c.Check(snapst.CurrentSideInfo().Private, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestSideInfoPrivate(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	opts := &snapstate.RevisionOptions{Channel: "channel-for-private"}
+	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("install", "install private snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snap has private sideinfo
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.CurrentSideInfo().Private, Equals, true)
+	c.Check(snapst.CurrentSideInfo().Paid, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestGadgetDefaultsInstalled(c *C) {
+	makeInstalledMockCoreSnap(c)
+
+	// using MockSnap, we want to read the bits on disk
+	snapstate.MockSnapReadInfo(snap.ReadInfo)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.prepareGadget(c)
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	snapPath := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)}, snapPath, "", "edge", snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var m map[string]interface{}
+	runHooks := tasksWithKind(ts, "run-hook")
+
+	c.Assert(runHooks[0].Kind(), Equals, "run-hook")
+	err = runHooks[0].Get("hook-context", &m)
+	c.Assert(err, Equals, state.ErrNoState)
+}
+
+func makeInstalledMockCoreSnap(c *C) {
+	coreSnapYaml := `name: core
+version: 1.0
+type: os
+`
+	snaptest.MockSnap(c, coreSnapYaml, &snap.SideInfo{
+		RealName: "core",
+		Revision: snap.R(1),
+	})
+}
+
+func (s *snapmgrTestSuite) TestGadgetDefaults(c *C) {
+	r := release.MockOnClassic(false)
+	defer r()
+
+	makeInstalledMockCoreSnap(c)
+
+	// using MockSnap, we want to read the bits on disk
+	snapstate.MockSnapReadInfo(snap.ReadInfo)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.prepareGadget(c)
+
+	snapPath := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}, snapPath, "", "edge", snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var m map[string]interface{}
+	runHooks := tasksWithKind(ts, "run-hook")
+
+	c.Assert(taskKinds(runHooks), DeepEquals, []string{
+		"run-hook[install]",
+		"run-hook[configure]",
+		"run-hook[check-health]",
+	})
+	err = runHooks[1].Get("hook-context", &m)
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, map[string]interface{}{"use-defaults": true})
+}
+
+func (s *snapmgrTestSuite) TestGadgetDefaultsNotForOS(c *C) {
+	r := release.MockOnClassic(false)
+	defer r()
+
+	// using MockSnap, we want to read the bits on disk
+	snapstate.MockSnapReadInfo(snap.ReadInfo)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core", nil)
+
+	s.prepareGadget(c)
+
+	const coreSnapYaml = `
+name: core
+type: os
+version: 1.0
+`
+	snapPath := makeTestSnap(c, coreSnapYaml)
+
+	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "core", SnapID: "core-id", Revision: snap.R(1)}, snapPath, "", "edge", snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var m map[string]interface{}
+	runHooks := tasksWithKind(ts, "run-hook")
+
+	c.Assert(taskKinds(runHooks), DeepEquals, []string{
+		"run-hook[install]",
+		"run-hook[configure]",
+		"run-hook[check-health]",
+	})
+	// use-defaults flag is part of hook-context which isn't set
+	err = runHooks[1].Get("hook-context", &m)
+	c.Assert(err, Equals, state.ErrNoState)
+}
+
+func (s *snapmgrTestSuite) TestGadgetDefaultsAreNormalizedForConfigHook(c *C) {
+	var mockGadgetSnapYaml = `
+name: canonical-pc
+type: gadget
+`
+	var mockGadgetYaml = []byte(`
+defaults:
+  otheridididididididididididididi:
+    foo:
+      bar: baz
+      num: 1.305
+
+volumes:
+    volume-id:
+        bootloader: grub
+`)
+
+	info := snaptest.MockSnap(c, mockGadgetSnapYaml, &snap.SideInfo{Revision: snap.R(2)})
+	err := ioutil.WriteFile(filepath.Join(info.MountDir(), "meta", "gadget.yaml"), mockGadgetYaml, 0644)
+	c.Assert(err, IsNil)
+
+	gi, err := gadget.ReadInfo(info.MountDir(), nil)
+	c.Assert(err, IsNil)
+	c.Assert(gi, NotNil)
+
+	snapName := "some-snap"
+	hooksup := &hookstate.HookSetup{
+		Snap:        snapName,
+		Hook:        "configure",
+		Optional:    true,
+		IgnoreError: false,
+		TrackError:  false,
+	}
+
+	var contextData map[string]interface{}
+	contextData = map[string]interface{}{"patch": gi.Defaults}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+	c.Assert(hookstate.HookTask(s.state, "", hooksup, contextData), NotNil)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_remove_test.go snapd-2.48.3+20.04/overlord/snapstate/snapstate_remove_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_remove_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapstate_remove_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1587 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate_test
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func (s *snapmgrTestSuite) TestRemoveTasks(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "foo", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "foo", Revision: snap.R(11)},
+		},
+		Current:  snap.R(11),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Remove(s.state, "foo", snap.R(0), nil)
+	c.Assert(err, IsNil)
+
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	verifyRemoveTasks(c, ts)
+}
+
+func (s *snapmgrTestSuite) TestRemoveTasksAutoSnapshotDisabled(c *C) {
+	snapstate.AutomaticSnapshot = func(st *state.State, instanceName string) (ts *state.TaskSet, err error) {
+		return nil, snapstate.ErrNothingToDo
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "foo", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "foo", Revision: snap.R(11)},
+		},
+		Current:  snap.R(11),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Remove(s.state, "foo", snap.R(0), nil)
+	c.Assert(err, IsNil)
+
+	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
+		"stop-snap-services",
+		"run-hook[remove]",
+		"auto-disconnect",
+		"remove-aliases",
+		"unlink-snap",
+		"remove-profiles",
+		"clear-snap",
+		"discard-snap",
+	})
+}
+
+func (s *snapmgrTestSuite) TestRemoveTasksAutoSnapshotDisabledByPurgeFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "foo", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "foo", Revision: snap.R(11)},
+		},
+		Current:  snap.R(11),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Remove(s.state, "foo", snap.R(0), &snapstate.RemoveFlags{Purge: true})
+	c.Assert(err, IsNil)
+
+	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
+		"stop-snap-services",
+		"run-hook[remove]",
+		"auto-disconnect",
+		"remove-aliases",
+		"unlink-snap",
+		"remove-profiles",
+		"clear-snap",
+		"discard-snap",
+	})
+}
+
+func (s *snapmgrTestSuite) TestRemoveHookNotExecutedIfNotLastRevison(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "foo", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "foo", Revision: snap.R(11)},
+			{RealName: "foo", Revision: snap.R(12)},
+		},
+		Current: snap.R(12),
+	})
+
+	ts, err := snapstate.Remove(s.state, "foo", snap.R(11), nil)
+	c.Assert(err, IsNil)
+
+	runHooks := tasksWithKind(ts, "run-hook")
+	// no 'remove' hook task
+	c.Assert(runHooks, HasLen, 0)
+}
+
+func (s *snapmgrTestSuite) TestRemoveConflict(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap", Revision: snap.R(11)}},
+		Current:  snap.R(11),
+	})
+
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	// need a change to make the tasks visible
+	s.state.NewChange("remove", "...").AddAll(ts)
+
+	_, err = snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, ErrorMatches, `snap "some-snap" has "remove" change in progress`)
+}
+
+func (s *snapmgrTestSuite) testRemoveDiskSpaceCheck(c *C, featureFlag, automaticSnapshot bool) error {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	restore := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error {
+		// osutil.CheckFreeSpace shouldn't be hit if either featureFlag
+		// or automaticSnapshot is false. If both are true then we return disk
+		// space error which should result in snapstate.InsufficientSpaceError
+		// on remove().
+		return &osutil.NotEnoughDiskSpaceError{}
+	})
+	defer restore()
+
+	var automaticSnapshotCalled bool
+	snapstate.AutomaticSnapshot = func(st *state.State, instanceName string) (ts *state.TaskSet, err error) {
+		automaticSnapshotCalled = true
+		if automaticSnapshot {
+			t := s.state.NewTask("foo", "")
+			ts = state.NewTaskSet(t)
+			return ts, nil
+		}
+		// ErrNothingToDo is returned if automatic snapshots are disabled
+		return nil, snapstate.ErrNothingToDo
+	}
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-remove", featureFlag)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap", Revision: snap.R(11)}},
+		Current:  snap.R(11),
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(automaticSnapshotCalled, Equals, true)
+	return err
+}
+
+func (s *snapmgrTestSuite) TestRemoveDiskSpaceCheckDoesNothingWhenNoSnapshot(c *C) {
+	featureFlag := true
+	snapshot := false
+	err := s.testRemoveDiskSpaceCheck(c, featureFlag, snapshot)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestRemoveDiskSpaceCheckDisabledByFeatureFlag(c *C) {
+	featureFlag := false
+	snapshot := true
+	err := s.testRemoveDiskSpaceCheck(c, featureFlag, snapshot)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestRemoveDiskSpaceForSnapshotError(c *C) {
+	featureFlag := true
+	snapshot := true
+	// both the snapshot and disk check feature are enabled, so we should hit
+	// the disk check (which fails).
+	err := s.testRemoveDiskSpaceCheck(c, featureFlag, snapshot)
+	c.Assert(err, NotNil)
+
+	diskSpaceErr := err.(*snapstate.InsufficientSpaceError)
+	c.Assert(diskSpaceErr, ErrorMatches, `cannot create automatic snapshot when removing last revision of the snap: insufficient space.*`)
+	c.Check(diskSpaceErr.Path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+	c.Check(diskSpaceErr.Snaps, DeepEquals, []string{"some-snap"})
+	c.Check(diskSpaceErr.ChangeKind, Equals, "remove")
+}
+
+func (s *snapmgrTestSuite) TestRemoveRunThrough(c *C) {
+	c.Assert(snapstate.KeepAuxStoreInfo("some-snap-id", nil), IsNil)
+	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FilePresent)
+	si := snap.SideInfo{
+		SnapID:   "some-snap-id",
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "remove-snap-common-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "remove-snap-data-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+			stype: "app",
+		},
+		{
+			op:   "discard-namespace",
+			name: "some-snap",
+		},
+		{
+			op:   "remove-inhibit-lock",
+			name: "some-snap",
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	tasks := ts.Tasks()
+	for _, t := range tasks {
+		if t.Kind() == "run-hook" {
+			continue
+		}
+		if t.Kind() == "save-snapshot" {
+			continue
+		}
+		snapsup, err := snapstate.TaskSnapSetup(t)
+		c.Assert(err, IsNil)
+
+		var expSnapSetup *snapstate.SnapSetup
+		switch t.Kind() {
+		case "discard-conns":
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "some-snap",
+				},
+			}
+		case "clear-snap", "discard-snap":
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "some-snap",
+					SnapID:   "some-snap-id",
+					Revision: snap.R(7),
+				},
+			}
+		default:
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "some-snap",
+					SnapID:   "some-snap-id",
+					Revision: snap.R(7),
+				},
+				Type:      snap.TypeApp,
+				PlugsOnly: true,
+			}
+
+		}
+
+		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
+	}
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, Equals, state.ErrNoState)
+	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FileAbsent)
+
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceRemoveRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// pretend we have both a regular snap and a parallel instance
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Active:      true,
+		Sequence:    []*snap.SideInfo{&si},
+		Current:     si.Revision,
+		SnapType:    "app",
+		InstanceKey: "instance",
+	})
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap_instance", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap_instance",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:   "remove-snap-common-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:             "remove-snap-data-dir",
+			name:           "some-snap_instance",
+			path:           filepath.Join(dirs.SnapDataDir, "some-snap"),
+			otherInstances: true,
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+			stype: "app",
+		},
+		{
+			op:   "discard-namespace",
+			name: "some-snap_instance",
+		},
+		{
+			op:   "remove-inhibit-lock",
+			name: "some-snap_instance",
+		},
+		{
+			op:             "remove-snap-dir",
+			name:           "some-snap_instance",
+			path:           filepath.Join(dirs.SnapMountDir, "some-snap"),
+			otherInstances: true,
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	tasks := ts.Tasks()
+	for _, t := range tasks {
+		if t.Kind() == "run-hook" {
+			continue
+		}
+		if t.Kind() == "save-snapshot" {
+			continue
+		}
+		snapsup, err := snapstate.TaskSnapSetup(t)
+		c.Assert(err, IsNil)
+
+		var expSnapSetup *snapstate.SnapSetup
+		switch t.Kind() {
+		case "discard-conns":
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "some-snap",
+				},
+				InstanceKey: "instance",
+			}
+		case "clear-snap", "discard-snap":
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "some-snap",
+					Revision: snap.R(7),
+				},
+				InstanceKey: "instance",
+			}
+		default:
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					RealName: "some-snap",
+					Revision: snap.R(7),
+				},
+				Type:        snap.TypeApp,
+				PlugsOnly:   true,
+				InstanceKey: "instance",
+			}
+
+		}
+
+		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
+	}
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
+	c.Assert(err, Equals, state.ErrNoState)
+
+	// the non-instance snap is still there
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceRemoveRunThroughOtherInstances(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// pretend we have both a regular snap and a parallel instance
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Active:      true,
+		Sequence:    []*snap.SideInfo{&si},
+		Current:     si.Revision,
+		SnapType:    "app",
+		InstanceKey: "instance",
+	})
+	snapstate.Set(s.state, "some-snap_other", &snapstate.SnapState{
+		Active:      true,
+		Sequence:    []*snap.SideInfo{&si},
+		Current:     si.Revision,
+		SnapType:    "app",
+		InstanceKey: "other",
+	})
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap_instance", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap_instance",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:   "remove-snap-common-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:             "remove-snap-data-dir",
+			name:           "some-snap_instance",
+			path:           filepath.Join(dirs.SnapDataDir, "some-snap"),
+			otherInstances: true,
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+			stype: "app",
+		},
+		{
+			op:   "discard-namespace",
+			name: "some-snap_instance",
+		},
+		{
+			op:   "remove-inhibit-lock",
+			name: "some-snap_instance",
+		},
+		{
+			op:             "remove-snap-dir",
+			name:           "some-snap_instance",
+			path:           filepath.Join(dirs.SnapMountDir, "some-snap"),
+			otherInstances: true,
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
+	c.Assert(err, Equals, state.ErrNoState)
+
+	// the other instance is still there
+	err = snapstate.Get(s.state, "some-snap_other", &snapst)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestRemoveWithManyRevisionsRunThrough(c *C) {
+	si3 := snap.SideInfo{
+		SnapID:   "some-snap-id",
+		RealName: "some-snap",
+		Revision: snap.R(3),
+	}
+
+	si5 := snap.SideInfo{
+		SnapID:   "some-snap-id",
+		RealName: "some-snap",
+		Revision: snap.R(5),
+	}
+
+	si7 := snap.SideInfo{
+		SnapID:   "some-snap-id",
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si5, &si3, &si7},
+		Current:  si7.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/3"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/3"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/5"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/5"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "remove-snap-common-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "remove-snap-data-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+			stype: "app",
+		},
+		{
+			op:   "discard-namespace",
+			name: "some-snap",
+		},
+		{
+			op:   "remove-inhibit-lock",
+			name: "some-snap",
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	tasks := ts.Tasks()
+	revnos := []snap.Revision{{N: 3}, {N: 5}, {N: 7}}
+	whichRevno := 0
+	for _, t := range tasks {
+		if t.Kind() == "run-hook" {
+			continue
+		}
+		if t.Kind() == "save-snapshot" {
+			continue
+		}
+		snapsup, err := snapstate.TaskSnapSetup(t)
+		c.Assert(err, IsNil)
+
+		var expSnapSetup *snapstate.SnapSetup
+		switch t.Kind() {
+		case "discard-conns":
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					SnapID:   "some-snap-id",
+					RealName: "some-snap",
+				},
+			}
+		case "clear-snap", "discard-snap":
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					SnapID:   "some-snap-id",
+					RealName: "some-snap",
+					Revision: revnos[whichRevno],
+				},
+			}
+		default:
+			expSnapSetup = &snapstate.SnapSetup{
+				SideInfo: &snap.SideInfo{
+					SnapID:   "some-snap-id",
+					RealName: "some-snap",
+					Revision: snap.R(7),
+				},
+				Type:      snap.TypeApp,
+				PlugsOnly: true,
+			}
+
+		}
+
+		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
+
+		if t.Kind() == "discard-snap" {
+			whichRevno++
+		}
+	}
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, Equals, state.ErrNoState)
+}
+
+func (s *snapmgrTestSuite) TestRemoveOneRevisionRunThrough(c *C) {
+	si3 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(3),
+	}
+
+	si5 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(5),
+	}
+
+	si7 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si5, &si3, &si7},
+		Current:  si7.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(3), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(len(s.fakeBackend.ops), Equals, 2)
+	expected := fakeOps{
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/3"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/3"),
+			stype: "app",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	tasks := ts.Tasks()
+	for _, t := range tasks {
+		if t.Kind() == "save-snapshot" {
+			continue
+		}
+		snapsup, err := snapstate.TaskSnapSetup(t)
+		c.Assert(err, IsNil)
+
+		expSnapSetup := &snapstate.SnapSetup{
+			SideInfo: &snap.SideInfo{
+				RealName: "some-snap",
+				Revision: snap.R(3),
+			},
+		}
+
+		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
+	}
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Sequence, HasLen, 2)
+}
+
+func (s *snapmgrTestSuite) TestRemoveLastRevisionRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   false,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(2), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(len(s.fakeBackend.ops), Equals, 8)
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap",
+			revno: snap.R(2),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:   "remove-snap-common-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:   "remove-snap-data-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+			stype: "app",
+		},
+		{
+			op:   "discard-namespace",
+			name: "some-snap",
+		},
+		{
+			op:   "remove-inhibit-lock",
+			name: "some-snap",
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	tasks := ts.Tasks()
+	for _, t := range tasks {
+		if t.Kind() == "run-hook" {
+			continue
+		}
+		if t.Kind() == "save-snapshot" {
+			continue
+		}
+		snapsup, err := snapstate.TaskSnapSetup(t)
+		c.Assert(err, IsNil)
+
+		expSnapSetup := &snapstate.SnapSetup{
+			SideInfo: &snap.SideInfo{
+				RealName: "some-snap",
+			},
+		}
+		if t.Kind() != "discard-conns" {
+			expSnapSetup.SideInfo.Revision = snap.R(2)
+		}
+		if t.Kind() == "auto-disconnect" {
+			expSnapSetup.PlugsOnly = true
+			expSnapSetup.Type = "app"
+		}
+
+		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
+	}
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, Equals, state.ErrNoState)
+}
+
+func (s *snapmgrTestSuite) TestRemoveCurrentActiveRevisionRefused(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Remove(s.state, "some-snap", snap.R(2), nil)
+
+	c.Check(err, ErrorMatches, `cannot remove active revision 2 of snap "some-snap"`)
+}
+
+func (s *snapmgrTestSuite) TestRemoveCurrentRevisionOfSeveralRefused(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si, &si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Remove(s.state, "some-snap", snap.R(2), nil)
+	c.Assert(err, NotNil)
+	c.Check(err.Error(), Equals, `cannot remove active revision 2 of snap "some-snap" (revert first?)`)
+}
+
+func (s *snapmgrTestSuite) TestRemoveMissingRevisionRefused(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Remove(s.state, "some-snap", snap.R(1), nil)
+
+	c.Check(err, ErrorMatches, `revision 1 of snap "some-snap" is not installed`)
+}
+
+func (s *snapmgrTestSuite) TestRemoveRefused(c *C) {
+	si := snap.SideInfo{
+		RealName: "brand-gadget",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "gadget",
+	})
+
+	_, err := snapstate.Remove(s.state, "brand-gadget", snap.R(0), nil)
+
+	c.Check(err, ErrorMatches, `snap "brand-gadget" is not removable: snap is used by the model`)
+}
+
+func (s *snapmgrTestSuite) TestRemoveRefusedLastRevision(c *C) {
+	si := snap.SideInfo{
+		RealName: "brand-gadget",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Active:   false,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "gadget",
+	})
+
+	_, err := snapstate.Remove(s.state, "brand-gadget", snap.R(7), nil)
+
+	c.Check(err, ErrorMatches, `snap "brand-gadget" is not removable: snap is used by the model`)
+}
+
+func (s *snapmgrTestSuite) TestRemoveDeletesConfigOnLastRevision(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	snapstate.Set(s.state, "another-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "bar")
+	tr.Commit()
+
+	// a config for some other snap to verify its not accidentally destroyed
+	tr = config.NewTransaction(s.state)
+	tr.Set("another-snap", "bar", "baz")
+	tr.Commit()
+
+	var res string
+	tr = config.NewTransaction(s.state)
+	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
+	c.Assert(tr.Get("another-snap", "bar", &res), IsNil)
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, Equals, state.ErrNoState)
+
+	tr = config.NewTransaction(s.state)
+	err = tr.Get("some-snap", "foo", &res)
+	c.Assert(err, NotNil)
+	c.Assert(err, ErrorMatches, `snap "some-snap" has no "foo" configuration option`)
+
+	// and another snap has its config intact
+	c.Assert(tr.Get("another-snap", "bar", &res), IsNil)
+	c.Assert(res, Equals, "baz")
+}
+
+func (s *snapmgrTestSuite) TestRemoveDoesntDeleteConfigIfNotLastRevision(c *C) {
+	si1 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+	si2 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(8),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si1, &si2},
+		Current:  si2.Revision,
+		SnapType: "app",
+	})
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "bar")
+	tr.Commit()
+
+	var res string
+	tr = config.NewTransaction(s.state)
+	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", si1.Revision, nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	tr = config.NewTransaction(s.state)
+	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
+	c.Assert(res, Equals, "bar")
+}
+
+func (s *snapmgrTestSuite) TestRemoveMany(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "one", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "one", SnapID: "one-id", Revision: snap.R(1)},
+		},
+		Current: snap.R(1),
+	})
+	snapstate.Set(s.state, "two", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "two", SnapID: "two-id", Revision: snap.R(1)},
+		},
+		Current: snap.R(1),
+	})
+
+	removed, tts, err := snapstate.RemoveMany(s.state, []string{"one", "two"})
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 2)
+	c.Check(removed, DeepEquals, []string{"one", "two"})
+
+	c.Assert(s.state.TaskCount(), Equals, 8*2)
+	for i, ts := range tts {
+		c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
+			"stop-snap-services",
+			"run-hook[remove]",
+			"auto-disconnect",
+			"remove-aliases",
+			"unlink-snap",
+			"remove-profiles",
+			"clear-snap",
+			"discard-snap",
+		})
+		verifyStopReason(c, ts, "remove")
+		// check that tasksets are in separate lanes
+		for _, t := range ts.Tasks() {
+			c.Assert(t.Lanes(), DeepEquals, []int{i + 1})
+		}
+
+	}
+}
+
+func (s *snapmgrTestSuite) testRemoveManyDiskSpaceCheck(c *C, featureFlag, automaticSnapshot, freeSpaceCheckFail bool) error {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	var checkFreeSpaceCall, snapshotSizeCall int
+
+	// restored by TearDownTest
+	snapstate.EstimateSnapshotSize = func(st *state.State, instanceName string, users []string) (uint64, error) {
+		snapshotSizeCall++
+		// expect two snapshot size estimations
+		switch instanceName {
+		case "one":
+			return 10, nil
+		case "two":
+			return 20, nil
+		default:
+			c.Fatalf("unexpected snap: %s", instanceName)
+		}
+		return 1, nil
+	}
+
+	restore := snapstate.MockOsutilCheckFreeSpace(func(path string, required uint64) error {
+		checkFreeSpaceCall++
+		// required size is the sum of snapshot sizes of test snaps
+		c.Check(required, Equals, snapstate.SafetyMarginDiskSpace(30))
+		if freeSpaceCheckFail {
+			return &osutil.NotEnoughDiskSpaceError{}
+		}
+		return nil
+	})
+	defer restore()
+
+	var automaticSnapshotCalled bool
+	snapstate.AutomaticSnapshot = func(st *state.State, instanceName string) (ts *state.TaskSet, err error) {
+		automaticSnapshotCalled = true
+		if automaticSnapshot {
+			t := s.state.NewTask("foo", "")
+			ts = state.NewTaskSet(t)
+			return ts, nil
+		}
+		// ErrNothingToDo is returned if automatic snapshots are disabled
+		return nil, snapstate.ErrNothingToDo
+	}
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-remove", featureFlag)
+	tr.Commit()
+
+	snapstate.Set(s.state, "one", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{
+			{RealName: "one", SnapID: "one-id", Revision: snap.R(1)},
+		},
+		Current: snap.R(1),
+	})
+	snapstate.Set(s.state, "two", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{
+			{RealName: "two", SnapID: "two-id", Revision: snap.R(1)},
+		},
+		Current: snap.R(1),
+	})
+
+	_, _, err := snapstate.RemoveMany(s.state, []string{"one", "two"})
+	if featureFlag && automaticSnapshot {
+		c.Check(snapshotSizeCall, Equals, 2)
+		c.Check(checkFreeSpaceCall, Equals, 1)
+	} else {
+		c.Check(checkFreeSpaceCall, Equals, 0)
+		c.Check(snapshotSizeCall, Equals, 0)
+	}
+	c.Check(automaticSnapshotCalled, Equals, true)
+
+	return err
+}
+
+func (s *snapmgrTestSuite) TestRemoveManyDiskSpaceError(c *C) {
+	featureFlag := true
+	automaticSnapshot := true
+	freeSpaceCheckFail := true
+	err := s.testRemoveManyDiskSpaceCheck(c, featureFlag, automaticSnapshot, freeSpaceCheckFail)
+
+	diskSpaceErr := err.(*snapstate.InsufficientSpaceError)
+	c.Check(diskSpaceErr.Path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+	c.Check(diskSpaceErr.Snaps, DeepEquals, []string{"one", "two"})
+	c.Check(diskSpaceErr.ChangeKind, Equals, "remove")
+}
+
+func (s *snapmgrTestSuite) TestRemoveManyDiskSpaceCheckDisabled(c *C) {
+	featureFlag := false
+	automaticSnapshot := true
+	freeSpaceCheckFail := true
+	err := s.testRemoveManyDiskSpaceCheck(c, featureFlag, automaticSnapshot, freeSpaceCheckFail)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestRemoveManyDiskSpaceSnapshotDisabled(c *C) {
+	featureFlag := true
+	automaticSnapshot := false
+	freeSpaceCheckFail := true
+	err := s.testRemoveManyDiskSpaceCheck(c, featureFlag, automaticSnapshot, freeSpaceCheckFail)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestRemoveManyDiskSpaceCheckPasses(c *C) {
+	featureFlag := true
+	automaticSnapshot := true
+	freeSpaceCheckFail := false
+	err := s.testRemoveManyDiskSpaceCheck(c, featureFlag, automaticSnapshot, freeSpaceCheckFail)
+	c.Check(err, IsNil)
+}
+
+type snapdBackend struct {
+	fakeSnappyBackend
+}
+
+func (f *snapdBackend) RemoveSnapData(info *snap.Info) error {
+	dir := snap.DataDir(info.SnapName(), info.Revision)
+	if err := os.Remove(dir); err != nil {
+		return fmt.Errorf("unexpected error: %v", err)
+	}
+	return f.fakeSnappyBackend.RemoveSnapData(info)
+}
+
+func (f *snapdBackend) RemoveSnapCommonData(info *snap.Info) error {
+	dir := snap.CommonDataDir(info.SnapName())
+	if err := os.Remove(dir); err != nil {
+		return fmt.Errorf("unexpected error: %v", err)
+	}
+	return f.fakeSnappyBackend.RemoveSnapCommonData(info)
+}
+
+func isUndone(c *C, tasks []*state.Task, kind string, numExpected int) {
+	var count int
+	for _, t := range tasks {
+		if t.Kind() == kind {
+			c.Assert(t.Status(), Equals, state.UndoneStatus)
+			count++
+		}
+	}
+	c.Assert(count, Equals, numExpected)
+}
+
+func injectError(c *C, chg *state.Change, beforeTaskKind string, snapRev snap.Revision) {
+	var found bool
+	for _, t := range chg.Tasks() {
+		if t.Kind() != beforeTaskKind {
+			continue
+		}
+		sup, err := snapstate.TaskSnapSetup(t)
+		c.Assert(err, IsNil)
+		if sup.Revision() != snapRev {
+			continue
+		}
+		prev := t.WaitTasks()[0]
+		terr := chg.State().NewTask("error-trigger", "provoking undo")
+		t.WaitFor(terr)
+		terr.WaitFor(prev)
+		chg.AddTask(terr)
+		found = true
+		break
+	}
+	c.Assert(found, Equals, true)
+}
+
+func makeTestSnaps(c *C, st *state.State) {
+	si1 := snap.SideInfo{
+		SnapID:   "some-snap-id",
+		RealName: "some-snap",
+		Revision: snap.R(1),
+	}
+
+	si2 := snap.SideInfo{
+		SnapID:   "some-snap-id",
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
+
+	snapstate.Set(st, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si1, &si2},
+		Current:  si1.Revision,
+		SnapType: "app",
+	})
+
+	c.Assert(os.MkdirAll(snap.DataDir("some-snap", si1.Revision), 0755), IsNil)
+	c.Assert(os.MkdirAll(snap.DataDir("some-snap", si2.Revision), 0755), IsNil)
+	c.Assert(os.MkdirAll(snap.CommonDataDir("some-snap"), 0755), IsNil)
+}
+
+func (s *snapmgrTestSuite) TestRemoveManyUndoRestoresCurrent(c *C) {
+	b := &snapdBackend{}
+	snapstate.SetSnapManagerBackend(s.snapmgr, b)
+	AddForeignTaskHandlers(s.o.TaskRunner(), b)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+	makeTestSnaps(c, s.state)
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	// inject an error before clear-snap of revision 1 (current), after
+	// discard-snap for revision 2, that means data and snap rev 1
+	// are still present.
+	injectError(c, chg, "clear-snap", snap.Revision{N: 1})
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.ErrorStatus)
+	isUndone(c, chg.Tasks(), "unlink-snap", 1)
+
+	var snapst snapstate.SnapState
+	c.Assert(snapstate.Get(s.state, "some-snap", &snapst), IsNil)
+	c.Check(snapst.Active, Equals, true)
+	c.Check(snapst.Current, Equals, snap.Revision{N: 1})
+	c.Assert(snapst.Sequence, HasLen, 1)
+	c.Check(snapst.Sequence[0].Revision, Equals, snap.Revision{N: 1})
+
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+			stype: "app",
+		},
+		{
+			op:    "remove-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Check(len(b.ops), Equals, len(expected))
+	c.Assert(b.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(b.ops, DeepEquals, expected)
+}
+
+func (s *snapmgrTestSuite) TestRemoveManyUndoLeavesInactiveSnapAfterDataIsLost(c *C) {
+	b := &snapdBackend{}
+	snapstate.SetSnapManagerBackend(s.snapmgr, b)
+	AddForeignTaskHandlers(s.o.TaskRunner(), b)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+	makeTestSnaps(c, s.state)
+
+	chg := s.state.NewChange("remove", "remove a snap")
+	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	// inject an error after removing data of both revisions (which includes
+	// current rev 1), before discarding the snap completely.
+	injectError(c, chg, "discard-snap", snap.Revision{N: 1})
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.ErrorStatus)
+	isUndone(c, chg.Tasks(), "unlink-snap", 1)
+
+	var snapst snapstate.SnapState
+	c.Assert(snapstate.Get(s.state, "some-snap", &snapst), IsNil)
+
+	// revision 1 is still present but not active, since the error happened
+	// after its data was removed.
+	c.Check(snapst.Active, Equals, false)
+	c.Check(snapst.Current, Equals, snap.Revision{N: 1})
+	c.Assert(snapst.Sequence, HasLen, 1)
+	c.Check(snapst.Sequence[0].Revision, Equals, snap.Revision{N: 1})
+
+	expected := fakeOps{
+		{
+			op:    "auto-disconnect:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:   "remove-snap-common-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:   "remove-snap-data-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
+		},
+		{
+			op:    "remove-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+
+	// start with an easier-to-read error if this fails:
+	c.Check(len(b.ops), Equals, len(expected))
+	c.Assert(b.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(b.ops, DeepEquals, expected)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_test.go snapd-2.48.3+20.04/overlord/snapstate/snapstate_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapstate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,7 +20,6 @@
 package snapstate_test
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -37,7 +36,6 @@
 	"gopkg.in/tomb.v2"
 
 	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/dirs"
@@ -85,7 +83,7 @@
 }
 
 func (s *snapmgrTestSuite) settle(c *C) {
-	err := s.o.Settle(5 * time.Second)
+	err := s.o.Settle(testutil.HostScaledTimeout(5 * time.Second))
 	c.Assert(err, IsNil)
 }
 
@@ -102,6 +100,9 @@
 
 	s.BaseTest.AddCleanup(snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {}))
 
+	restoreCheckFreeSpace := snapstate.MockOsutilCheckFreeSpace(func(string, uint64) error { return nil })
+	s.AddCleanup(restoreCheckFreeSpace)
+
 	s.fakeBackend = &fakeSnappyBackend{}
 	s.fakeBackend.emptyContainer = emptyContainer(c)
 	s.fakeStore = &fakeStore{
@@ -163,6 +164,15 @@
 		return nil, nil, nil
 	}))
 
+	oldEstimateSnapshotSize := snapstate.EstimateSnapshotSize
+	snapstate.EstimateSnapshotSize = func(st *state.State, instanceName string, users []string) (uint64, error) {
+		return 1, nil
+	}
+	restoreInstallSize := snapstate.MockInstallSize(func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+		return 0, nil
+	})
+	s.AddCleanup(restoreInstallSize)
+
 	oldAutomaticSnapshot := snapstate.AutomaticSnapshot
 	snapstate.AutomaticSnapshot = func(st *state.State, instanceName string) (ts *state.TaskSet, err error) {
 		task := st.NewTask("save-snapshot", "...")
@@ -173,6 +183,7 @@
 	oldAutomaticSnapshotExpiration := snapstate.AutomaticSnapshotExpiration
 	snapstate.AutomaticSnapshotExpiration = func(st *state.State) (time.Duration, error) { return 1, nil }
 	s.BaseTest.AddCleanup(func() {
+		snapstate.EstimateSnapshotSize = oldEstimateSnapshotSize
 		snapstate.AutomaticSnapshot = oldAutomaticSnapshot
 		snapstate.AutomaticSnapshotExpiration = oldAutomaticSnapshotExpiration
 	})
@@ -388,121 +399,6 @@
 	return kinds
 }
 
-func verifyInstallTasks(c *C, opts, discards int, ts *state.TaskSet, st *state.State) {
-	kinds := taskKinds(ts.Tasks())
-
-	expected := []string{
-		"prerequisites",
-		"download-snap",
-		"validate-snap",
-		"mount-snap",
-	}
-	if opts&unlinkBefore != 0 {
-		expected = append(expected,
-			"stop-snap-services",
-			"remove-aliases",
-			"unlink-current-snap",
-		)
-	}
-	if opts&updatesGadget != 0 {
-		expected = append(expected, "update-gadget-assets")
-	}
-	expected = append(expected,
-		"copy-snap-data",
-		"setup-profiles",
-		"link-snap",
-	)
-	expected = append(expected,
-		"auto-connect",
-		"set-auto-aliases",
-		"setup-aliases",
-		"run-hook[install]",
-		"start-snap-services")
-	for i := 0; i < discards; i++ {
-		expected = append(expected,
-			"clear-snap",
-			"discard-snap",
-		)
-	}
-	if opts&cleanupAfter != 0 {
-		expected = append(expected,
-			"cleanup",
-		)
-	}
-	if opts&noConfigure == 0 {
-		expected = append(expected,
-			"run-hook[configure]",
-		)
-	}
-	expected = append(expected,
-		"run-hook[check-health]",
-	)
-
-	c.Assert(kinds, DeepEquals, expected)
-}
-
-func verifyUpdateTasks(c *C, opts, discards int, ts *state.TaskSet, st *state.State) {
-	kinds := taskKinds(ts.Tasks())
-
-	expected := []string{
-		"prerequisites",
-		"download-snap",
-		"validate-snap",
-		"mount-snap",
-	}
-	expected = append(expected, "run-hook[pre-refresh]")
-	if opts&unlinkBefore != 0 {
-		expected = append(expected,
-			"stop-snap-services",
-		)
-	}
-	if opts&unlinkBefore != 0 {
-		expected = append(expected,
-			"remove-aliases",
-			"unlink-current-snap",
-		)
-	}
-	if opts&updatesGadget != 0 {
-		expected = append(expected, "update-gadget-assets")
-	}
-	expected = append(expected,
-		"copy-snap-data",
-		"setup-profiles",
-		"link-snap",
-	)
-	if opts&maybeCore != 0 {
-		expected = append(expected, "setup-profiles")
-	}
-	expected = append(expected,
-		"auto-connect",
-		"set-auto-aliases",
-		"setup-aliases",
-		"run-hook[post-refresh]",
-		"start-snap-services")
-
-	c.Assert(ts.Tasks()[len(expected)-2].Summary(), Matches, `Run post-refresh hook of .*`)
-	for i := 0; i < discards; i++ {
-		expected = append(expected,
-			"clear-snap",
-			"discard-snap",
-		)
-	}
-	if opts&cleanupAfter != 0 {
-		expected = append(expected,
-			"cleanup",
-		)
-	}
-	expected = append(expected,
-		"run-hook[configure]",
-		"run-hook[check-health]",
-	)
-	if opts&doesReRefresh != 0 {
-		expected = append(expected, "check-rerefresh")
-	}
-
-	c.Assert(kinds, DeepEquals, expected)
-}
-
 func verifyLastTasksetIsReRefresh(c *C, tts []*state.TaskSet) {
 	ts := tts[len(tts)-1]
 	c.Assert(ts.Tasks(), HasLen, 1)
@@ -563,25 +459,6 @@
 	c.Check(snapst.LastIndex(snap.R(11)), Equals, 2)
 }
 
-func (s *snapmgrTestSuite) TestInstallDevModeConfinementFiltering(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// if a snap is devmode, you can't install it without --devmode
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-devmode"}
-	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `.* requires devmode or confinement override`)
-
-	// if a snap is devmode, you *can* install it with --devmode
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{DevMode: true})
-	c.Assert(err, IsNil)
-
-	// if a snap is *not* devmode, you can still install it with --devmode
-	opts.Channel = "channel-for-strict"
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{DevMode: true})
-	c.Assert(err, IsNil)
-}
-
 func maybeMockClassicSupport(c *C) (restore func()) {
 	if dirs.SupportsClassicConfinement() {
 		return func() {}
@@ -597,165 +474,6 @@
 	return func() { os.Remove(snapSymlink) }
 }
 
-func (s *snapmgrTestSuite) TestInstallClassicConfinementFiltering(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// if a snap is classic, you can't install it without --classic
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-classic"}
-	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `.* requires classic confinement`)
-
-	// if a snap is classic, you *can* install it with --classic
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
-
-	// if a snap is *not* classic, but can install it with --classic which gets ignored
-	opts.Channel = "channel-for-strict"
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestInstallFailsWhenClassicSnapsAreNotSupported(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	reset := release.MockReleaseInfo(&release.OS{
-		ID: "fedora",
-	})
-	defer reset()
-
-	// this needs doing because dirs depends on the release info
-	dirs.SetRootDir(dirs.GlobalRootDir)
-
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-classic"}
-	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, ErrorMatches, "classic confinement requires snaps under /snap or symlink from /snap to "+dirs.SnapMountDir)
-}
-
-func (s *snapmgrTestSuite) TestInstallTasks(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	verifyInstallTasks(c, 0, 0, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-}
-
-func (s *snapmgrTestSuite) TestInstallTaskEdgesForPreseeding(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-`)
-
-	for _, skipConfig := range []bool{false, true} {
-		ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{SkipConfigure: skipConfig})
-		c.Assert(err, IsNil)
-
-		te, err := ts.Edge(snapstate.BeginEdge)
-		c.Assert(err, IsNil)
-		c.Check(te.Kind(), Equals, "prerequisites")
-
-		te, err = ts.Edge(snapstate.BeforeHooksEdge)
-		c.Assert(err, IsNil)
-		c.Check(te.Kind(), Equals, "setup-aliases")
-
-		te, err = ts.Edge(snapstate.HooksEdge)
-		c.Assert(err, IsNil)
-		c.Assert(te.Kind(), Equals, "run-hook")
-
-		var hsup *hookstate.HookSetup
-		c.Assert(te.Get("hook-setup", &hsup), IsNil)
-		c.Check(hsup.Hook, Equals, "install")
-		c.Check(hsup.Snap, Equals, "some-snap")
-	}
-}
-
-func (s *snapmgrTestSuite) TestInstallSnapdSnapType(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "snapd", opts, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	verifyInstallTasks(c, noConfigure, 0, ts, s.state)
-
-	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Type, Equals, snap.TypeSnapd)
-}
-
-func (s *snapmgrTestSuite) TestInstallCohortTasks(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", CohortKey: "what"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	c.Check(snapsup.CohortKey, Equals, "what")
-
-	verifyInstallTasks(c, 0, 0, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-}
-
-func (s *snapmgrTestSuite) TestInstallWithDeviceContext(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// unset the global store, it will need to come via the device context
-	snapstate.ReplaceStore(s.state, nil)
-
-	deviceCtx := &snapstatetest.TrivialDeviceContext{CtxStore: s.fakeStore}
-
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.InstallWithDeviceContext(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{}, deviceCtx, "")
-	c.Assert(err, IsNil)
-
-	verifyInstallTasks(c, 0, 0, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-}
-
-func (s *snapmgrTestSuite) TestInstallHookNotRunForInstalledSnap(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(7)},
-		},
-		Current:  snap.R(7),
-		SnapType: "app",
-	})
-
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-epoch: 1*
-`)
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	runHooks := tasksWithKind(ts, "run-hook")
-	// no install hook task
-	c.Assert(taskKinds(runHooks), DeepEquals, []string{
-		"run-hook[pre-refresh]",
-		"run-hook[post-refresh]",
-		"run-hook[configure]",
-		"run-hook[check-health]",
-	})
-}
-
 type fullFlags struct{ before, change, after, setup snapstate.Flags }
 
 func (s *snapmgrTestSuite) testRevertTasksFullFlags(flags fullFlags, c *C) {
@@ -872,1169 +590,850 @@
 	s.testRevertTasks(snapstate.Flags{Classic: true}, c)
 }
 
-func (s *snapmgrTestSuite) TestUpdateCreatesGCTasks(c *C) {
-	restore := release.MockOnClassic(false)
-	defer restore()
+func (s *snapmgrTestSuite) TestRevertCreatesNoGCTasks(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
 
-	s.testUpdateCreatesGCTasks(c, 2)
-}
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(1)},
+			{RealName: "some-snap", Revision: snap.R(2)},
+			{RealName: "some-snap", Revision: snap.R(3)},
+			{RealName: "some-snap", Revision: snap.R(4)},
+		},
+		Current: snap.R(2),
+	})
 
-func (s *snapmgrTestSuite) TestUpdateCreatesGCTasksOnClassic(c *C) {
-	restore := release.MockOnClassic(true)
-	defer restore()
+	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R(4), snapstate.Flags{})
+	c.Assert(err, IsNil)
 
-	s.testUpdateCreatesGCTasks(c, 3)
+	// ensure that we do not run any form of garbage-collection
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
+		"prerequisites",
+		"prepare-snap",
+		"stop-snap-services",
+		"remove-aliases",
+		"unlink-current-snap",
+		"setup-profiles",
+		"link-snap",
+		"auto-connect",
+		"set-auto-aliases",
+		"setup-aliases",
+		"start-snap-services",
+		"run-hook[configure]",
+		"run-hook[check-health]",
+	})
 }
 
-func (s *snapmgrTestSuite) testUpdateCreatesGCTasks(c *C, expectedDiscards int) {
+func (s *snapmgrTestSuite) TestEnableTasks(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+			{RealName: "some-snap", Revision: snap.R(11)},
 		},
-		Current:  snap.R(4),
-		SnapType: "app",
+		Current: snap.R(11),
+		Active:  false,
 	})
 
-	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// ensure edges information is still there
-	te, err := ts.Edge(snapstate.DownloadAndChecksDoneEdge)
-	c.Assert(te, NotNil)
+	ts, err := snapstate.Enable(s.state, "some-snap")
 	c.Assert(err, IsNil)
 
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, expectedDiscards, ts, s.state)
 	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
+		"prepare-snap",
+		"setup-profiles",
+		"link-snap",
+		"setup-aliases",
+		"start-snap-services",
+	})
 }
 
-func (s snapmgrTestSuite) TestInstallFailsOnDisabledSnap(c *C) {
+func (s *snapmgrTestSuite) TestSwitchTasks(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapst := &snapstate.SnapState{
-		Active:          false,
-		TrackingChannel: "channel/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)}},
-		Current:         snap.R(2),
-		SnapType:        "app",
-	}
-	snapsup := &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}}
-	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", nil)
-	c.Assert(err, NotNil)
-	c.Assert(err, ErrorMatches, `cannot update disabled snap "some-snap"`)
-}
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(11)},
+		},
+		Current: snap.R(11),
+		Active:  false,
+	})
+
+	ts, err := snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"})
+	c.Assert(err, IsNil)
 
-func dummyInUseCheck(snap.Type) (boot.InUseFunc, error) {
-	return func(string, snap.Revision) bool {
-		return false
-	}, nil
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{"switch-snap"})
 }
 
-func (s snapmgrTestSuite) TestInstallFailsOnBusySnap(c *C) {
+func (s *snapmgrTestSuite) TestSwitchConflict(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	// With the refresh-app-awareness feature enabled.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.refresh-app-awareness", true)
-	tr.Commit()
-
-	// With a snap state indicating a snap is already installed.
-	snapst := &snapstate.SnapState{
-		Active: true,
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", Revision: snap.R(11)},
 		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	}
-	snapstate.Set(s.state, "some-snap", snapst)
-
-	// With a snap info indicating it has an application called "app"
-	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
-		if name != "some-snap" {
-			return s.fakeBackend.ReadInfo(name, si)
-		}
-		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
-		info.Apps = map[string]*snap.AppInfo{
-			"app": {Snap: info, Name: "app"},
-		}
-		return info, nil
+		Current: snap.R(11),
+		Active:  false,
 	})
-	mockPidsCgroupDir := c.MkDir()
-	restore := snapstate.MockPidsCgroupDir(mockPidsCgroupDir)
-	defer restore()
-
-	// And with cgroup v1 information indicating the app has a process with pid 1234.
-	writePids(c, filepath.Join(mockPidsCgroupDir, "snap.some-snap.app"), []int{1234})
-
-	// Attempt to install revision 2 of the snap.
-	snapsup := &snapstate.SnapSetup{
-		SideInfo: &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-	}
-
-	// And observe that we cannot refresh because the snap is busy.
-	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", dummyInUseCheck)
-	c.Assert(err, ErrorMatches, `snap "some-snap" has running apps \(app\)`)
 
-	// The state records the time of the failed refresh operation.
-	err = snapstate.Get(s.state, "some-snap", snapst)
+	ts, err := snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"})
 	c.Assert(err, IsNil)
-	c.Check(snapst.RefreshInhibitedTime, NotNil)
+	// need a change to make the tasks visible
+	s.state.NewChange("switch-snap", "...").AddAll(ts)
+
+	_, err = snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "other-channel"})
+	c.Check(err, ErrorMatches, `snap "some-snap" has "switch-snap" change in progress`)
 }
 
-func (s snapmgrTestSuite) TestInstallDespiteBusySnap(c *C) {
+func (s *snapmgrTestSuite) TestSwitchUnhappy(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	// With the refresh-app-awareness feature enabled.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.refresh-app-awareness", true)
-	tr.Commit()
-
-	// With a snap state indicating a snap is already installed and it failed
-	// to refresh over a week ago. Use UTC and Round to have predictable
-	// behaviour across time-zones and with enough precision loss to be
-	// compatible with the serialization format.
-	var longAgo = time.Now().UTC().Round(time.Second).Add(-time.Hour * 24 * 8)
-	snapst := &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:              snap.R(1),
-		SnapType:             "app",
-		RefreshInhibitedTime: &longAgo,
-	}
-	snapstate.Set(s.state, "some-snap", snapst)
-
-	// With a snap info indicating it has an application called "app"
-	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
-		if name != "some-snap" {
-			return s.fakeBackend.ReadInfo(name, si)
-		}
-		info := &snap.Info{SuggestedName: name, SideInfo: *si, SnapType: snap.TypeApp}
-		info.Apps = map[string]*snap.AppInfo{
-			"app": {Snap: info, Name: "app"},
-		}
-		return info, nil
-	})
-	// And with cgroup v1 information indicating the app has a process with pid 1234.
-	writePids(c, filepath.Join(dirs.PidsCgroupDir, "snap.some-snap.app"), []int{1234})
-
-	// Attempt to install revision 2 of the snap.
-	snapsup := &snapstate.SnapSetup{
-		SideInfo: &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-	}
-
-	// And observe that refresh occurred regardless of the running process.
-	_, err := snapstate.DoInstall(s.state, snapst, snapsup, 0, "", dummyInUseCheck)
-	c.Assert(err, IsNil)
-}
-
-func (s snapmgrTestSuite) TestInstallFailsOnSystem(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapsup := &snapstate.SnapSetup{SideInfo: &snap.SideInfo{RealName: "system", SnapID: "some-snap-id", Revision: snap.R(1)}}
-	_, err := snapstate.DoInstall(s.state, nil, snapsup, 0, "", nil)
-	c.Assert(err, NotNil)
-	c.Assert(err, ErrorMatches, `cannot install reserved snap name 'system'`)
+	_, err := snapstate.Switch(s.state, "non-existing-snap", &snapstate.RevisionOptions{Channel: "some-channel"})
+	c.Assert(err, ErrorMatches, `snap "non-existing-snap" is not installed`)
 }
 
-func (s *snapmgrTestSuite) TestUpdateCreatesDiscardAfterCurrentTasks(c *C) {
+func (s *snapmgrTestSuite) TestSwitchRevision(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+			{RealName: "some-snap", Revision: snap.R(11)},
 		},
-		Current:  snap.R(1),
-		SnapType: "app",
+		Current: snap.R(11),
 	})
 
-	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 3, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	_, err := snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Revision: snap.R(42)})
+	c.Assert(err, ErrorMatches, "cannot switch revision")
 }
 
-func (s *snapmgrTestSuite) TestUpdateManyTooEarly(c *C) {
+func (s *snapmgrTestSuite) TestSwitchKernelTrackForbidden(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	s.state.Set("seeded", nil)
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:  snap.R(7),
-		SnapType: "app",
+	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "kernel", Revision: snap.R(11)},
+		},
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
+		Active:          true,
 	})
 
-	_, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
+	_, err := snapstate.Switch(s.state, "kernel", &snapstate.RevisionOptions{Channel: "new-channel"})
+	c.Assert(err, ErrorMatches, `cannot switch from kernel track "18" as specified for the \(device\) model to "new-channel"`)
 }
 
-func (s *snapmgrTestSuite) TestUpdateMany(c *C) {
+func (s *snapmgrTestSuite) TestSwitchKernelTrackRiskOnlyIsOK(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
+	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+			{RealName: "kernel", Revision: snap.R(11)},
 		},
-		Current:  snap.R(1),
-		SnapType: "app",
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
+		Active:          true,
 	})
 
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 2)
-	verifyLastTasksetIsReRefresh(c, tts)
-	c.Check(updates, DeepEquals, []string{"some-snap"})
-
-	ts := tts[0]
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 3, ts, s.state)
-
-	// check that the tasks are in non-default lane
-	for _, t := range ts.Tasks() {
-		c.Assert(t.Lanes(), DeepEquals, []int{1})
-	}
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks())+1) // 1==rerefresh
-
-	// ensure edges information is still there
-	te, err := ts.Edge(snapstate.DownloadAndChecksDoneEdge)
-	c.Assert(te, NotNil)
+	_, err := snapstate.Switch(s.state, "kernel", &snapstate.RevisionOptions{Channel: "18/beta"})
 	c.Assert(err, IsNil)
-
-	checkIsAutoRefresh(c, ts.Tasks(), false)
 }
 
-func (s *snapmgrTestSuite) TestParallelInstanceUpdateMany(c *C) {
-	restore := release.MockOnClassic(false)
-	defer restore()
-
+func (s *snapmgrTestSuite) TestSwitchKernelTrackRiskOnlyDefaultTrackIsOK(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Active: true,
+	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+			{RealName: "kernel", Revision: snap.R(11)},
 		},
-		Current:     snap.R(3),
-		SnapType:    "app",
-		InstanceKey: "instance",
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
+		Active:          true,
 	})
 
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 3)
-	verifyLastTasksetIsReRefresh(c, tts)
-	// ensure stable ordering of updates list
-	if updates[0] != "some-snap" {
-		updates[1], updates[0] = updates[0], updates[1]
-	}
-
-	c.Check(updates, DeepEquals, []string{"some-snap", "some-snap_instance"})
-
-	var snapsup, snapsupInstance *snapstate.SnapSetup
-
-	// ensure stable ordering of task sets list
-	snapsup, err = snapstate.TaskSnapSetup(tts[0].Tasks()[0])
-	c.Assert(err, IsNil)
-	if snapsup.InstanceName() != "some-snap" {
-		tts[0], tts[1] = tts[1], tts[0]
-		snapsup, err = snapstate.TaskSnapSetup(tts[0].Tasks()[0])
-		c.Assert(err, IsNil)
-	}
-	snapsupInstance, err = snapstate.TaskSnapSetup(tts[1].Tasks()[0])
+	_, err := snapstate.Switch(s.state, "kernel", &snapstate.RevisionOptions{Channel: "beta"})
 	c.Assert(err, IsNil)
-
-	c.Assert(snapsup.InstanceName(), Equals, "some-snap")
-	c.Assert(snapsupInstance.InstanceName(), Equals, "some-snap_instance")
-
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 3, tts[0], s.state)
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 1, tts[1], s.state)
 }
 
-func (s *snapmgrTestSuite) TestUpdateManyDevModeConfinementFiltering(c *C) {
+func (s *snapmgrTestSuite) TestSwitchGadgetTrackForbidden(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "brand-gadget", Revision: snap.R(11)},
+		},
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
 		Active:          true,
-		TrackingChannel: "channel-for-devmode/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
 	})
 
-	// updated snap is devmode, updatemany doesn't update it
-	_, tts, _ := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
-	// FIXME: UpdateMany will not error out in this case (daemon catches this case, with a weird error)
-	c.Assert(tts, HasLen, 0)
+	_, err := snapstate.Switch(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "new-channel"})
+	c.Assert(err, ErrorMatches, `cannot switch from gadget track "18" as specified for the \(device\) model to "new-channel"`)
 }
 
-func (s *snapmgrTestSuite) TestUpdateManyClassicConfinementFiltering(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-
+func (s *snapmgrTestSuite) TestSwitchGadgetTrackRiskOnlyIsOK(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "brand-gadget", Revision: snap.R(11)},
+		},
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
 		Active:          true,
-		TrackingChannel: "channel-for-classic/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
 	})
 
-	// if a snap installed without --classic gets a classic update it isn't installed
-	_, tts, _ := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
-	// FIXME: UpdateMany will not error out in this case (daemon catches this case, with a weird error)
-	c.Assert(tts, HasLen, 0)
+	_, err := snapstate.Switch(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "18/beta"})
+	c.Assert(err, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestUpdateManyClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-
+func (s *snapmgrTestSuite) TestSwitchGadgetTrackRiskOnlyDefaultTrackIsOK(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "brand-gadget", Revision: snap.R(11)},
+		},
+		TrackingChannel: "18/stable",
+		Current:         snap.R(11),
 		Active:          true,
-		TrackingChannel: "channel-for-classic/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
-		Flags:           snapstate.Flags{Classic: true},
 	})
 
-	// snap installed with classic: refresh gets classic
-	_, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	_, err := snapstate.Switch(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "beta"})
 	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 2)
-	verifyLastTasksetIsReRefresh(c, tts)
 }
 
-func (s *snapmgrTestSuite) TestUpdateManyDevMode(c *C) {
+func (s *snapmgrTestSuite) TestDisableTasks(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Flags:  snapstate.Flags{DevMode: true},
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", Revision: snap.R(11)},
 		},
-		Current:  snap.R(1),
-		SnapType: "app",
+		Current: snap.R(11),
+		Active:  true,
 	})
 
-	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, 0, nil)
+	ts, err := snapstate.Disable(s.state, "some-snap")
 	c.Assert(err, IsNil)
-	c.Check(updates, HasLen, 1)
+
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
+		"stop-snap-services",
+		"remove-aliases",
+		"unlink-snap",
+		"remove-profiles",
+	})
+	verifyStopReason(c, ts, "disable")
 }
 
-func (s *snapmgrTestSuite) TestUpdateAllDevMode(c *C) {
+func (s *snapmgrTestSuite) TestEnableConflict(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Flags:  snapstate.Flags{DevMode: true},
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", Revision: snap.R(11)},
 		},
-		Current:  snap.R(1),
-		SnapType: "app",
+		Current: snap.R(11),
+		Active:  false,
 	})
 
-	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	ts, err := snapstate.Enable(s.state, "some-snap")
 	c.Assert(err, IsNil)
-	c.Check(updates, HasLen, 0)
+	// need a change to make the tasks visible
+	s.state.NewChange("enable", "...").AddAll(ts)
+
+	_, err = snapstate.Enable(s.state, "some-snap")
+	c.Assert(err, ErrorMatches, `snap "some-snap" has "enable" change in progress`)
 }
 
-func (s *snapmgrTestSuite) TestUpdateManyWaitForBasesUC16(c *C) {
+func (s *snapmgrTestSuite) TestDisableConflict(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "core", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "core", SnapID: "core-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "os",
-	})
-
-	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-base", SnapID: "some-base-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "base",
-	})
-
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", Revision: snap.R(11)},
 		},
-		Current:         snap.R(1),
-		SnapType:        "app",
-		TrackingChannel: "channel-for-base/stable",
+		Current: snap.R(11),
+		Active:  true,
 	})
 
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "core", "some-base"}, 0, nil)
+	ts, err := snapstate.Disable(s.state, "some-snap")
 	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 4)
-	verifyLastTasksetIsReRefresh(c, tts)
-	c.Check(updates, HasLen, 3)
+	// need a change to make the tasks visible
+	s.state.NewChange("install", "...").AddAll(ts)
 
-	// to make TaskSnapSetup work
-	chg := s.state.NewChange("refresh", "...")
-	for _, ts := range tts {
-		chg.AddAll(ts)
-	}
+	_, err = snapstate.Disable(s.state, "some-snap")
+	c.Assert(err, ErrorMatches, `snap "some-snap" has "install" change in progress`)
+}
 
-	prereqTotal := len(tts[0].Tasks()) + len(tts[1].Tasks())
-	prereqs := map[string]bool{}
-	for i, task := range tts[2].Tasks() {
-		waitTasks := task.WaitTasks()
-		if i == 0 {
-			c.Check(len(waitTasks), Equals, prereqTotal)
-		} else if task.Kind() == "link-snap" {
-			c.Check(len(waitTasks), Equals, prereqTotal+1)
-			for _, pre := range waitTasks {
-				if pre.Kind() == "link-snap" {
-					snapsup, err := snapstate.TaskSnapSetup(pre)
-					c.Assert(err, IsNil)
-					prereqs[snapsup.InstanceName()] = true
-				}
-			}
-		}
-	}
+func (s *snapmgrTestSuite) TestDoInstallWithSlots(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
 
-	c.Check(prereqs, DeepEquals, map[string]bool{
-		"core":      true,
-		"some-base": true,
-	})
-}
+	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
 
-func (s *snapmgrTestSuite) TestUpdateManyWaitForBasesUC18(c *C) {
-	r := snapstatetest.MockDeviceModel(ModelWithBase("core18"))
-	defer r()
+	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-slot", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+
+	c.Check(snapsup.PlugsOnly, Equals, false)
+}
 
+func (s *snapmgrTestSuite) TestDoUpdateHadSlots(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "core18", &snapstate.SnapState{
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
 		Active: true,
 		Sequence: []*snap.SideInfo{
-			{RealName: "core18", SnapID: "core18-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "base",
-	})
-
-	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-base", SnapID: "some-base-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "base",
-	})
-
-	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "snapd", SnapID: "snapd-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
 		},
-		Current:  snap.R(1),
+		Current:  snap.R(4),
 		SnapType: "app",
 	})
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:         snap.R(1),
-		SnapType:        "app",
-		TrackingChannel: "channel-for-base/stable",
-	})
-
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "core18", "some-base", "snapd"}, 0, nil)
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 5)
-	verifyLastTasksetIsReRefresh(c, tts)
-	c.Check(updates, HasLen, 4)
-
-	// to make TaskSnapSetup work
-	chg := s.state.NewChange("refresh", "...")
-	for _, ts := range tts {
-		chg.AddAll(ts)
-	}
-
-	// Note that some-app only waits for snapd+some-base. The core18
-	// base is not special to this snap and not waited for
-	prereqTotal := len(tts[0].Tasks()) + len(tts[1].Tasks())
-	prereqs := map[string]bool{}
-	for i, task := range tts[3].Tasks() {
-		waitTasks := task.WaitTasks()
-		if i == 0 {
-			c.Check(len(waitTasks), Equals, prereqTotal)
-		} else if task.Kind() == "link-snap" {
-			c.Check(len(waitTasks), Equals, prereqTotal+1)
-			for _, pre := range waitTasks {
-				if pre.Kind() == "link-snap" {
-					snapsup, err := snapstate.TaskSnapSetup(pre)
-					c.Assert(err, IsNil)
-					prereqs[snapsup.InstanceName()] = true
-				}
-			}
+	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
+		if name != "some-snap" {
+			return s.fakeBackend.ReadInfo(name, si)
 		}
-	}
 
-	// Note that "core18" is not part of the prereqs for some-app
-	// as it does not use this base.
-	c.Check(prereqs, DeepEquals, map[string]bool{
-		"some-base": true,
-		"snapd":     true,
+		info := &snap.Info{
+			SideInfo: *si,
+			SnapType: snap.TypeApp,
+		}
+		info.Slots = map[string]*snap.SlotInfo{
+			"some-slot": {
+				Snap:      info,
+				Name:      "shared-content",
+				Interface: "content",
+				Attrs: map[string]interface{}{
+					"content": "shared-content",
+				},
+			},
+		}
+		return info, nil
 	})
-}
 
-func (s *snapmgrTestSuite) TestUpdateManyValidateRefreshes(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
+	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
 
-	validateCalled := false
-	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		validateCalled = true
-		c.Check(refreshes, HasLen, 1)
-		c.Check(refreshes[0].InstanceName(), Equals, "some-snap")
-		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
-		c.Check(refreshes[0].Revision, Equals, snap.R(11))
-		c.Check(ignoreValidation, HasLen, 0)
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshes
-
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 2)
-	verifyLastTasksetIsReRefresh(c, tts)
-	c.Check(updates, DeepEquals, []string{"some-snap"})
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 0, tts[0], s.state)
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
 
-	c.Check(validateCalled, Equals, true)
+	c.Check(snapsup.PlugsOnly, Equals, false)
 }
 
-func (s *snapmgrTestSuite) TestParallelInstanceUpdateManyValidateRefreshes(c *C) {
+func (s *snapmgrTestSuite) TestDisableSnapDisabledServicesSaved(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Active: true,
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "services-snap", Revision: snap.R(11)},
 		},
-		Current:     snap.R(1),
-		SnapType:    "app",
-		InstanceKey: "instance",
+		Current: snap.R(11),
+		Active:  true,
 	})
 
-	validateCalled := false
-	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		validateCalled = true
-		c.Check(refreshes, HasLen, 2)
-		instanceIdx := 0
-		someIdx := 1
-		if refreshes[0].InstanceName() != "some-snap_instance" {
-			instanceIdx = 1
-			someIdx = 0
-		}
-		c.Check(refreshes[someIdx].InstanceName(), Equals, "some-snap")
-		c.Check(refreshes[instanceIdx].InstanceName(), Equals, "some-snap_instance")
-		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
-		c.Check(refreshes[0].Revision, Equals, snap.R(11))
-		c.Check(refreshes[1].SnapID, Equals, "some-snap-id")
-		c.Check(refreshes[1].Revision, Equals, snap.R(11))
-		c.Check(ignoreValidation, HasLen, 0)
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshes
-
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 3)
-	verifyLastTasksetIsReRefresh(c, tts)
-	sort.Strings(updates)
-	c.Check(updates, DeepEquals, []string{"some-snap", "some-snap_instance"})
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 0, tts[0], s.state)
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 0, tts[1], s.state)
-
-	c.Check(validateCalled, Equals, true)
-}
+	disableChg := s.state.NewChange("disable", "disable a snap")
+	ts, err := snapstate.Disable(s.state, "services-snap")
+	c.Assert(err, IsNil)
+	disableChg.AddAll(ts)
 
-func (s *snapmgrTestSuite) TestUpdateManyValidateRefreshesUnhappy(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current: snap.R(1),
-	})
+	c.Assert(disableChg.Err(), IsNil)
+	c.Assert(disableChg.IsReady(), Equals, true)
 
-	validateErr := errors.New("refresh control error")
-	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		c.Check(refreshes, HasLen, 1)
-		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
-		c.Check(refreshes[0].Revision, Equals, snap.R(11))
-		c.Check(ignoreValidation, HasLen, 0)
-		return nil, validateErr
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshes
-
-	// refresh all => no error
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	c.Check(tts, HasLen, 0)
-	c.Check(updates, HasLen, 0)
-
-	// refresh some-snap => report error
-	updates, tts, err = snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, 0, nil)
-	c.Assert(err, Equals, validateErr)
-	c.Check(tts, HasLen, 0)
-	c.Check(updates, HasLen, 0)
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
 
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
 }
 
-func (s *snapmgrTestSuite) TestRevertCreatesNoGCTasks(c *C) {
+func (s *snapmgrTestSuite) TestEnableSnapDisabledServicesPassedAroundHappy(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(1)},
-			{RealName: "some-snap", Revision: snap.R(2)},
-			{RealName: "some-snap", Revision: snap.R(3)},
-			{RealName: "some-snap", Revision: snap.R(4)},
+			{RealName: "services-snap", Revision: snap.R(11)},
 		},
-		Current: snap.R(2),
+		Current: snap.R(11),
+		Active:  true,
 	})
 
-	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R(4), snapstate.Flags{})
+	disableChg := s.state.NewChange("disable", "disable a snap")
+	disableTs, err := snapstate.Disable(s.state, "services-snap")
 	c.Assert(err, IsNil)
+	disableChg.AddAll(disableTs)
 
-	// ensure that we do not run any form of garbage-collection
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
-		"prerequisites",
-		"prepare-snap",
-		"stop-snap-services",
-		"remove-aliases",
-		"unlink-current-snap",
-		"setup-profiles",
-		"link-snap",
-		"auto-connect",
-		"set-auto-aliases",
-		"setup-aliases",
-		"start-snap-services",
-		"run-hook[configure]",
-		"run-hook[check-health]",
-	})
-}
-
-func (s *snapmgrTestSuite) TestEnableTasks(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  false,
-	})
+	c.Assert(disableChg.Err(), IsNil)
+	c.Assert(disableChg.IsReady(), Equals, true)
 
-	ts, err := snapstate.Enable(s.state, "some-snap")
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
 	c.Assert(err, IsNil)
 
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
-		"prepare-snap",
-		"setup-profiles",
-		"link-snap",
-		"setup-aliases",
-		"start-snap-services",
-	})
-}
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
 
-func (s *snapmgrTestSuite) TestSwitchTasks(c *C) {
+	enableChg := s.state.NewChange("enable", "disable a snap")
+	enableTs, err := snapstate.Enable(s.state, "services-snap")
+	c.Assert(err, IsNil)
+	enableChg.AddAll(enableTs)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  false,
-	})
+	c.Assert(enableChg.Err(), IsNil)
+	c.Assert(enableChg.IsReady(), Equals, true)
 
-	ts, err := snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"})
-	c.Assert(err, IsNil)
+	// check the ops that will be provided disabledServices
+	svcStateOp := s.fakeBackend.ops.First("current-snap-service-states")
+	c.Assert(svcStateOp, Not(IsNil))
+	c.Assert(svcStateOp.disabledServices, DeepEquals, []string{"svc1", "svc2"})
 
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{"switch-snap"})
+	linkStateOp := s.fakeBackend.ops.First("link-snap")
+	c.Assert(linkStateOp, Not(IsNil))
+	c.Assert(linkStateOp.disabledServices, DeepEquals, []string{"svc1", "svc2"})
 }
 
-func (s *snapmgrTestSuite) TestSwitchConflict(c *C) {
+func (s *snapmgrTestSuite) TestEnableSnapDisabledServicesNotSaved(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
+			{RealName: "services-snap", Revision: snap.R(11)},
 		},
 		Current: snap.R(11),
-		Active:  false,
+		Active:  true,
 	})
 
-	ts, err := snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"})
+	disableChg := s.state.NewChange("disable", "disable a snap")
+	disableTs, err := snapstate.Disable(s.state, "services-snap")
 	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("switch-snap", "...").AddAll(ts)
+	disableChg.AddAll(disableTs)
 
-	_, err = snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "other-channel"})
-	c.Check(err, ErrorMatches, `snap "some-snap" has "switch-snap" change in progress`)
-}
-
-func (s *snapmgrTestSuite) TestSwitchUnhappy(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	_, err := snapstate.Switch(s.state, "non-existing-snap", &snapstate.RevisionOptions{Channel: "some-channel"})
-	c.Assert(err, ErrorMatches, `snap "non-existing-snap" is not installed`)
-}
+	c.Assert(disableChg.Err(), IsNil)
+	c.Assert(disableChg.IsReady(), Equals, true)
 
-func (s *snapmgrTestSuite) TestSwitchRevision(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-	})
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
 
-	_, err := snapstate.Switch(s.state, "some-snap", &snapstate.RevisionOptions{Revision: snap.R(42)})
-	c.Assert(err, ErrorMatches, "cannot switch revision")
-}
+	enableChg := s.state.NewChange("enable", "disable a snap")
+	enableTs, err := snapstate.Enable(s.state, "services-snap")
+	c.Assert(err, IsNil)
+	enableChg.AddAll(enableTs)
 
-func (s *snapmgrTestSuite) TestSwitchKernelTrackForbidden(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "kernel", Revision: snap.R(11)},
-		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
-	})
+	c.Assert(enableChg.Err(), IsNil)
+	c.Assert(enableChg.IsReady(), Equals, true)
 
-	_, err := snapstate.Switch(s.state, "kernel", &snapstate.RevisionOptions{Channel: "new-channel"})
-	c.Assert(err, ErrorMatches, `cannot switch from kernel track "18" as specified for the \(device\) model to "new-channel"`)
+	// get the snap state again
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	// make sure that there is nothing in the last active disabled services list
+	// because we re-enabled the snap and there should be nothing we have to
+	// keep track of in the state anymore
+	c.Assert(snapst.LastActiveDisabledServices, HasLen, 0)
 }
 
-func (s *snapmgrTestSuite) TestSwitchKernelTrackRiskOnlyIsOK(c *C) {
+func (s *snapmgrTestSuite) TestEnableSnapMissingDisabledServicesMergedAndSaved(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "kernel", Revision: snap.R(11)},
+			{RealName: "services-snap", Revision: snap.R(11)},
 		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
+		Current: snap.R(11),
+		Active:  true,
+		// keep this to make gofmt 1.10 happy
+		LastActiveDisabledServices: []string{"missing-svc3"},
 	})
 
-	_, err := snapstate.Switch(s.state, "kernel", &snapstate.RevisionOptions{Channel: "18/beta"})
+	disableChg := s.state.NewChange("disable", "disable a snap")
+	disableTs, err := snapstate.Disable(s.state, "services-snap")
 	c.Assert(err, IsNil)
-}
+	disableChg.AddAll(disableTs)
 
-func (s *snapmgrTestSuite) TestSwitchKernelTrackRiskOnlyDefaultTrackIsOK(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "kernel", Revision: snap.R(11)},
-		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
-	})
+	c.Assert(disableChg.Err(), IsNil)
+	c.Assert(disableChg.IsReady(), Equals, true)
 
-	_, err := snapstate.Switch(s.state, "kernel", &snapstate.RevisionOptions{Channel: "beta"})
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
 	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestSwitchGadgetTrackForbidden(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
 
-	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "brand-gadget", Revision: snap.R(11)},
-		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
-	})
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3", "svc1", "svc2"})
 
-	_, err := snapstate.Switch(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "new-channel"})
-	c.Assert(err, ErrorMatches, `cannot switch from gadget track "18" as specified for the \(device\) model to "new-channel"`)
-}
+	enableChg := s.state.NewChange("enable", "disable a snap")
+	enableTs, err := snapstate.Enable(s.state, "services-snap")
+	c.Assert(err, IsNil)
+	enableChg.AddAll(enableTs)
 
-func (s *snapmgrTestSuite) TestSwitchGadgetTrackRiskOnlyIsOK(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "brand-gadget", Revision: snap.R(11)},
-		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
-	})
+	c.Assert(enableChg.Err(), IsNil)
+	c.Assert(enableChg.IsReady(), Equals, true)
 
-	_, err := snapstate.Switch(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "18/beta"})
+	// get the snap state again
+	err = snapstate.Get(s.state, "services-snap", &snapst)
 	c.Assert(err, IsNil)
+
+	// make sure that there is nothing in the last active disabled services list
+	// because we re-enabled the snap and there should be nothing we have to
+	// keep track of in the state anymore
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
 }
 
-func (s *snapmgrTestSuite) TestSwitchGadgetTrackRiskOnlyDefaultTrackIsOK(c *C) {
+func (s *snapmgrTestSuite) TestEnableSnapMissingDisabledServicesSaved(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
 		Sequence: []*snap.SideInfo{
-			{RealName: "brand-gadget", Revision: snap.R(11)},
+			{RealName: "services-snap", Revision: snap.R(11)},
 		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
+		Current: snap.R(11),
+		Active:  true,
+		// keep this to make gofmt 1.10 happy
+		LastActiveDisabledServices: []string{"missing-svc3"},
 	})
 
-	_, err := snapstate.Switch(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "beta"})
+	disableChg := s.state.NewChange("disable", "disable a snap")
+	disableTs, err := snapstate.Disable(s.state, "services-snap")
 	c.Assert(err, IsNil)
-}
+	disableChg.AddAll(disableTs)
 
-func (s *snapmgrTestSuite) TestDisableTasks(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
+	c.Assert(disableChg.Err(), IsNil)
+	c.Assert(disableChg.IsReady(), Equals, true)
 
-	ts, err := snapstate.Disable(s.state, "some-snap")
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
 	c.Assert(err, IsNil)
 
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
-		"stop-snap-services",
-		"remove-aliases",
-		"unlink-snap",
-		"remove-profiles",
-	})
-	verifyStopReason(c, ts, "disable")
-}
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
 
-func (s *snapmgrTestSuite) TestEnableConflict(c *C) {
+	enableChg := s.state.NewChange("enable", "disable a snap")
+	enableTs, err := snapstate.Enable(s.state, "services-snap")
+	c.Assert(err, IsNil)
+	enableChg.AddAll(enableTs)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  false,
-	})
+	c.Assert(enableChg.Err(), IsNil)
+	c.Assert(enableChg.IsReady(), Equals, true)
 
-	ts, err := snapstate.Enable(s.state, "some-snap")
+	// get the snap state again
+	err = snapstate.Get(s.state, "services-snap", &snapst)
 	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("enable", "...").AddAll(ts)
 
-	_, err = snapstate.Enable(s.state, "some-snap")
-	c.Assert(err, ErrorMatches, `snap "some-snap" has "enable" change in progress`)
+	// make sure that there is nothing in the last active disabled services list
+	// because we re-enabled the snap and there should be nothing we have to
+	// keep track of in the state anymore
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
 }
 
-func (s *snapmgrTestSuite) TestDisableConflict(c *C) {
+func makeTestSnap(c *C, snapYamlContent string) (snapFilePath string) {
+	return snaptest.MakeTestSnapWithFiles(c, snapYamlContent, nil)
+}
+
+func (s *snapmgrTestSuite) TestRevertRestoresConfigSnapshot(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(11)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", Revision: snap.R(2)},
 		},
-		Current: snap.R(11),
-		Active:  true,
+		Current:  snap.R(2),
+		SnapType: "app",
 	})
 
-	ts, err := snapstate.Disable(s.state, "some-snap")
-	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("install", "...").AddAll(ts)
-
-	_, err = snapstate.Disable(s.state, "some-snap")
-	c.Assert(err, ErrorMatches, `snap "some-snap" has "install" change in progress`)
-}
-
-func (s *snapmgrTestSuite) TestDoInstallWithSlots(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	// set configuration for current snap
+	tr := config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "100")
+	tr.Commit()
 
-	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
+	// make config snapshot for rev.1
+	config.SaveRevisionConfig(s.state, "some-snap", snap.R(1))
 
-	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-slot", nil, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
+	// modify for rev. 2
+	tr = config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "200")
+	tr.Commit()
 
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	chg := s.state.NewChange("revert", "revert snap")
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
 	c.Assert(err, IsNil)
+	chg.AddAll(ts)
 
-	c.Check(snapsup.PlugsOnly, Equals, false)
-}
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 
-func (s *snapmgrTestSuite) TestDoUpdateHadSlots(c *C) {
 	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
-		},
-		Current:  snap.R(4),
-		SnapType: "app",
-	})
-
-	snapstate.MockSnapReadInfo(func(name string, si *snap.SideInfo) (*snap.Info, error) {
-		if name != "some-snap" {
-			return s.fakeBackend.ReadInfo(name, si)
-		}
-
-		info := &snap.Info{
-			SideInfo: *si,
-			SnapType: snap.TypeApp,
-		}
-		info.Slots = map[string]*snap.SlotInfo{
-			"some-slot": {
-				Snap:      info,
-				Name:      "shared-content",
-				Interface: "content",
-				Attrs: map[string]interface{}{
-					"content": "shared-content",
-				},
-			},
-		}
-		return info, nil
+	// config snapshot of rev. 2 has been made by 'revert'
+	var cfgs map[string]interface{}
+	c.Assert(s.state.Get("revision-config", &cfgs), IsNil)
+	c.Assert(cfgs["some-snap"], DeepEquals, map[string]interface{}{
+		"1": map[string]interface{}{"foo": "100"},
+		"2": map[string]interface{}{"foo": "200"},
 	})
 
-	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-
-	c.Check(snapsup.PlugsOnly, Equals, false)
+	// current snap configuration has been restored from rev. 1 config snapshot
+	tr = config.NewTransaction(s.state)
+	var res string
+	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
+	c.Assert(res, Equals, "100")
 }
 
-func (s *snapmgrTestSuite) TestDoInstallChannelDefault(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
+func (s *snapmgrTestSuite) TestRevertNoRevertAgain(c *C) {
+	siNew := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(77),
+	}
 
-	c.Check(snapsup.Channel, Equals, "stable")
-}
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
 
-func (s *snapmgrTestSuite) TestInstallRevision(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	opts := &snapstate.RevisionOptions{Revision: snap.R(7)}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si, &siNew},
+		Current:  snap.R(7),
+	})
 
-	c.Check(snapsup.Revision(), Equals, snap.R(7))
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "no revision to revert to")
+	c.Assert(ts, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestInstallTooEarly(c *C) {
+func (s *snapmgrTestSuite) TestRevertNothingToRevertTo(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	s.state.Set("seeded", nil)
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+	})
 
-	_, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "no revision to revert to")
+	c.Assert(ts, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestInstallConflict(c *C) {
+func (s *snapmgrTestSuite) TestRevertToRevisionNoValidVersion(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+	si2 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(77),
+	}
+
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("install", "...").AddAll(ts)
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si, &si2},
+		Current:  snap.R(77),
+	})
 
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `snap "some-snap" has "install" change in progress`)
+	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R("99"), snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `cannot find revision 99 for snap "some-snap"`)
+	c.Assert(ts, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestInstallAliasConflict(c *C) {
+func (s *snapmgrTestSuite) TestRevertToRevisionAlreadyCurrent(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+	si2 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(77),
+	}
+
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "otherfoosnap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "otherfoosnap", Revision: snap.R(30)},
-		},
-		Current: snap.R(30),
-		Active:  true,
-		Aliases: map[string]*snapstate.AliasTarget{
-			"foo.bar": {Manual: "bar"},
-		},
-		SnapType: "app",
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si, &si2},
+		Current:  snap.R(77),
 	})
 
-	_, err := snapstate.Install(context.Background(), s.state, "foo", nil, 0, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `snap "foo" command namespace conflicts with alias "foo\.bar" for "otherfoosnap" snap`)
+	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R("77"), snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `already on requested revision`)
+	c.Assert(ts, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestInstallStrictIgnoresClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
+func (s *snapmgrTestSuite) TestRevertRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+	siOld := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-strict"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{&siOld, &si},
+		Current:  si.Revision,
+	})
 
+	chg := s.state.NewChange("revert", "revert a snap backwards")
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
 	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("install", "install snap")
 	chg.AddAll(ts)
 
 	s.state.Unlock()
@@ -2042,188 +1441,335 @@
 	s.settle(c)
 	s.state.Lock()
 
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(2),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				Revision: snap.R(2),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(2),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 
-	// verify snap is *not* classic
+	// verify that the R(2) version is active now and R(7) is still there
 	var snapst snapstate.SnapState
 	err = snapstate.Get(s.state, "some-snap", &snapst)
 	c.Assert(err, IsNil)
-	c.Check(snapst.TrackingChannel, Equals, "channel-for-strict/stable")
-	c.Check(snapst.Classic, Equals, false)
-}
-
-func (s *snapmgrTestSuite) TestInstallSnapWithDefaultTrack(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	opts := &snapstate.RevisionOptions{Channel: "candidate"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap-with-default-track", opts, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("install", "install snap")
-	chg.AddAll(ts)
 
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// verify snap is in the 2.0 track
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap-with-default-track", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.TrackingChannel, Equals, "2.0/candidate")
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Current, Equals, snap.R(2))
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "",
+		Revision: snap.R(2),
+	})
+	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+	c.Assert(snapst.Block(), DeepEquals, []snap.Revision{snap.R(7)})
 }
 
-func (s *snapmgrTestSuite) TestInstallManySnapOneWithDefaultTrack(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
+func (s *snapmgrTestSuite) TestRevertWithBaseRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap-with-base",
+		Revision: snap.R(7),
+	}
+	siOld := snap.SideInfo{
+		RealName: "some-snap-with-base",
+		Revision: snap.R(2),
+	}
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapNames := []string{"some-snap", "some-snap-with-default-track"}
-	installed, tss, err := snapstate.InstallMany(s.state, snapNames, s.user.ID)
-	c.Assert(err, IsNil)
-	c.Assert(installed, DeepEquals, snapNames)
+	// core18 with snapd, no core snap
+	snapstate.Set(s.state, "core", nil)
+	snapstate.Set(s.state, "core18", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core18", SnapID: "core18-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "snapd", SnapID: "snapd-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
 
-	chg := s.state.NewChange("install", "install two snaps")
-	for _, ts := range tss {
-		chg.AddAll(ts)
-	}
+	// test snap to revert
+	snapstate.Set(s.state, "some-snap-with-base", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{&siOld, &si},
+		Current:  si.Revision,
+	})
+
+	chg := s.state.NewChange("revert", "revert a snap backwards")
+	ts, err := snapstate.Revert(s.state, "some-snap-with-base", snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
 
 	s.state.Unlock()
 	defer s.se.Stop()
 	s.settle(c)
 	s.state.Lock()
 
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap-with-base",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap-with-base/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap-with-base",
+			revno: snap.R(2),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap-with-base",
+				Revision: snap.R(2),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap-with-base/2"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap-with-base",
+			revno: snap.R(2),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 
-	// verify snap is in the 2.0 track
+	// verify that the R(2) version is active now and R(7) is still there
 	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap-with-default-track", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.TrackingChannel, Equals, "2.0/stable")
-
-	err = snapstate.Get(s.state, "some-snap", &snapst)
+	err = snapstate.Get(s.state, "some-snap-with-base", &snapst)
 	c.Assert(err, IsNil)
-	c.Check(snapst.TrackingChannel, Equals, "latest/stable")
-}
 
-// A sneakyStore changes the state when called
-type sneakyStore struct {
-	*fakeStore
-	state *state.State
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Current, Equals, snap.R(2))
 }
 
-func (s sneakyStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
-	s.state.Lock()
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}},
-		Current:         snap.R(1),
-		SnapType:        "app",
-	})
-	s.state.Unlock()
-	return s.fakeStore.SnapAction(ctx, currentSnaps, actions, user, opts)
-}
+func (s *snapmgrTestSuite) TestParallelInstanceRevertRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+	siOld := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
 
-func (s *snapmgrTestSuite) TestInstallStateConflict(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.ReplaceStore(s.state, sneakyStore{fakeStore: s.fakeStore, state: s.state})
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Active:      true,
+		SnapType:    "app",
+		Sequence:    []*snap.SideInfo{&siOld, &si},
+		Current:     si.Revision,
+		InstanceKey: "instance",
+	})
 
-	_, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `snap "some-snap" has changes in progress`)
-}
+	// another snap withouth instance key
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{&siOld, &si},
+		Current:  si.Revision,
+	})
 
-func (s *snapmgrTestSuite) TestInstallPathTooEarly(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	chg := s.state.NewChange("revert", "revert a snap backwards")
+	ts, err := snapstate.Revert(s.state, "some-snap_instance", snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
 
-	r := snapstatetest.MockDeviceModel(nil)
-	defer r()
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
 
-	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
-	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `too early for operation, device model not yet acknowledged`)
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap_instance",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(2),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				Revision: snap.R(2),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/2"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(2),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 
-}
+	// verify that the R(2) version is active now and R(7) is still there
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
+	c.Assert(err, IsNil)
 
-func (s *snapmgrTestSuite) TestInstallPathConflict(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Current, Equals, snap.R(2))
+	c.Assert(snapst.InstanceKey, Equals, "instance")
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "",
+		Revision: snap.R(2),
+	})
+	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+	c.Assert(snapst.Block(), DeepEquals, []snap.Revision{snap.R(7)})
 
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", nil, 0, snapstate.Flags{})
+	// non instance snap is not affected
+	var nonInstanceSnapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &nonInstanceSnapst)
 	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("install", "...").AddAll(ts)
+	c.Assert(nonInstanceSnapst.Current, Equals, snap.R(7))
 
-	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
-	_, _, err = snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `snap "some-snap" has "install" change in progress`)
 }
 
-func (s *snapmgrTestSuite) TestInstallPathMissingName(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
-	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, fmt.Sprintf(`internal error: snap name to install %q not provided`, mockSnap))
-}
+func (s *snapmgrTestSuite) TestRevertWithLocalRevisionRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(-7),
+	}
+	siOld := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(-2),
+	}
 
-func (s *snapmgrTestSuite) TestInstallPathSnapIDRevisionUnset(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0")
-	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "snapididid"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, fmt.Sprintf(`internal error: snap id set to install %q but revision is unset`, mockSnap))
-}
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{&siOld, &si},
+		Current:  si.Revision,
+	})
+
+	chg := s.state.NewChange("revert", "revert a snap backwards")
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
 
-func (s *snapmgrTestSuite) TestInstallPathValidateFlags(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-confinement: devmode
-`)
-	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `.* requires devmode or confinement override`)
+	c.Assert(s.fakeBackend.ops.Ops(), HasLen, 7)
+
+	// verify that LocalRevision is still -7
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.LocalRevision(), Equals, snap.R(-7))
 }
 
-func (s *snapmgrTestSuite) TestInstallPathStrictIgnoresClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
+func (s *snapmgrTestSuite) TestRevertToRevisionNewVersion(c *C) {
+	siNew := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+		SnapID:   "october",
+	}
+
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+		SnapID:   "october",
+	}
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-confinement: strict
-`)
-
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		SnapType:        "app",
+		Sequence:        []*snap.SideInfo{&si, &siNew},
+		Current:         snap.R(2),
+		TrackingChannel: "latest/edge",
+	})
 
+	chg := s.state.NewChange("revert", "revert a snap forward")
+	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R(7), snapstate.Flags{})
 	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("install", "install snap")
 	chg.AddAll(ts)
 
 	s.state.Unlock()
@@ -2231,295 +1777,306 @@
 	s.settle(c)
 	s.state.Lock()
 
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op:    "candidate",
+			sinfo: siNew,
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 
-	// verify snap is *not* classic
+	// verify that the R(7) version is active now
 	var snapst snapstate.SnapState
 	err = snapstate.Get(s.state, "some-snap", &snapst)
 	c.Assert(err, IsNil)
-	c.Check(snapst.Classic, Equals, false)
+
+	c.Check(snapst.Active, Equals, true)
+	c.Check(snapst.Current, Equals, snap.R(7))
+	c.Check(snapst.Sequence, HasLen, 2)
+	c.Check(snapst.TrackingChannel, Equals, "latest/edge")
+	c.Check(snapst.CurrentSideInfo(), DeepEquals, &siNew)
+
+	c.Check(snapst.Block(), HasLen, 0)
 }
 
-func (s *snapmgrTestSuite) TestInstallPathAsRefresh(c *C) {
+func (s *snapmgrTestSuite) TestRevertTotalUndoRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(1),
+	}
+	si2 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
+
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Flags:  snapstate.Flags{DevMode: true},
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:         snap.R(1),
-		SnapType:        "app",
-		TrackingChannel: "wibbly/stable",
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{&si, &si2},
+		Current:  si2.Revision,
 	})
 
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-epoch: 1
-`)
-
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "edge", snapstate.Flags{})
+	chg := s.state.NewChange("revert", "revert a snap")
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
 	c.Assert(err, IsNil)
+	chg.AddAll(ts)
 
-	c.Assert(err, IsNil)
+	tasks := ts.Tasks()
+	last := tasks[len(tasks)-1]
 
-	chg := s.state.NewChange("install", "install snap")
-	chg.AddAll(ts)
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(last)
+	chg.AddTask(terr)
 
 	s.state.Unlock()
 	defer s.se.Stop()
 	s.settle(c)
 	s.state.Lock()
 
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				Revision: snap.R(1),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op: "update-aliases",
+		},
+		// undoing everything from here down...
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op: "current-snap-service-states",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:    "setup-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Check(s.fakeBackend.ops, DeepEquals, expected)
 
-	// verify snap is *not* classic
+	// verify snaps in the system state
 	var snapst snapstate.SnapState
 	err = snapstate.Get(s.state, "some-snap", &snapst)
 	c.Assert(err, IsNil)
-	c.Check(snapst.TrackingChannel, Equals, "wibbly/edge")
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceInstallNotAllowed(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, sneakyStore{fakeStore: s.fakeStore, state: s.state})
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
-
-	_, err := snapstate.Install(context.Background(), s.state, "core_foo", nil, 0, snapstate.Flags{})
-	c.Check(err, ErrorMatches, `cannot install snap of type os as "core_foo"`)
-
-	_, err = snapstate.Install(context.Background(), s.state, "some-base_foo", nil, 0, snapstate.Flags{})
-	c.Check(err, ErrorMatches, `cannot install snap of type base as "some-base_foo"`)
-
-	_, err = snapstate.Install(context.Background(), s.state, "some-gadget_foo", nil, 0, snapstate.Flags{})
-	c.Check(err, ErrorMatches, `cannot install snap of type gadget as "some-gadget_foo"`)
 
-	_, err = snapstate.Install(context.Background(), s.state, "some-kernel_foo", nil, 0, snapstate.Flags{})
-	c.Check(err, ErrorMatches, `cannot install snap of type kernel as "some-kernel_foo"`)
-
-	_, err = snapstate.Install(context.Background(), s.state, "some-snapd_foo", nil, 0, snapstate.Flags{})
-	c.Check(err, ErrorMatches, `cannot install snap of type snapd as "some-snapd_foo"`)
-}
-
-func (s *snapmgrTestSuite) TestInstallPathFailsEarlyOnEpochMismatch(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// have epoch 1* installed
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-	})
-
-	// try to install epoch 42
-	mockSnap := makeTestSnap(c, "name: some-snap\nversion: 1.0\nepoch: 42\n")
-	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `cannot refresh "some-snap" to local snap with epoch 42, because it can't read the current epoch of 1\*`)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Current, Equals, si2.Revision)
 }
 
-func (s *snapmgrTestSuite) TestUpdateTasksPropagatesErrors(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "fakestore-please-error-on-refresh", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `failing as requested`)
-}
+func (s *snapmgrTestSuite) TestRevertUndoRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(1),
+	}
+	si2 := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(2),
+	}
 
-func (s *snapmgrTestSuite) TestUpdateTasks(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
+		Active:   true,
+		SnapType: "app",
+		Sequence: []*snap.SideInfo{&si, &si2},
+		Current:  si2.Revision,
 	})
 
-	validateCalled := false
-	happyValidateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		validateCalled = true
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = happyValidateRefreshes
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-
-	c.Check(validateCalled, Equals, true)
-
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	chg := s.state.NewChange("revert", "install a revert")
+	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
 	c.Assert(err, IsNil)
+	chg.AddAll(ts)
 
-	c.Check(snapsup.Channel, Equals, "some-channel")
-}
+	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "some-snap/1")
 
-func (s *snapmgrTestSuite) TestUpdateWithDeviceContext(c *C) {
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	// unset the global store, it will need to come via the device context
-	snapstate.ReplaceStore(s.state, nil)
-
-	deviceCtx := &snapstatetest.TrivialDeviceContext{
-		DeviceModel: DefaultModel(),
-		CtxStore:    s.fakeStore,
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
-	})
-
-	validateCalled := false
-	happyValidateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx1 snapstate.DeviceContext) ([]*snap.Info, error) {
-		c.Check(deviceCtx1, Equals, deviceCtx)
-		validateCalled = true
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = happyValidateRefreshes
-
-	ts, err := snapstate.UpdateWithDeviceContext(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{}, deviceCtx, "")
-	c.Assert(err, IsNil)
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-
-	c.Check(validateCalled, Equals, true)
-}
-
-func (s *snapmgrTestSuite) TestUpdateWithDeviceContextToRevision(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// unset the global store, it will need to come via the device context
-	snapstate.ReplaceStore(s.state, nil)
-
-	deviceCtx := &snapstatetest.TrivialDeviceContext{
-		DeviceModel: DefaultModel(),
-		CtxStore:    s.fakeStore,
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				Revision: snap.R(1),
+			},
+		},
+		{
+			op:   "link-snap.failed",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		// undo stuff here
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:    "setup-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(1),
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op: "update-aliases",
 		},
-		Current:  snap.R(5),
-		SnapType: "app",
-		UserID:   1,
-	})
-
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(11)}
-	ts, err := snapstate.UpdateWithDeviceContext(s.state, "some-snap", opts, 0, snapstate.Flags{}, deviceCtx, "")
-	c.Assert(err, IsNil)
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-}
-
-func (s *snapmgrTestSuite) TestUpdateTasksCoreSetsIgnoreOnConfigure(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "core", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "core", SnapID: "core-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "os",
-	})
-
-	oldConfigure := snapstate.Configure
-	defer func() { snapstate.Configure = oldConfigure }()
-
-	var configureFlags int
-	snapstate.Configure = func(st *state.State, snapName string, patch map[string]interface{}, flags int) *state.TaskSet {
-		configureFlags = flags
-		return state.NewTaskSet()
 	}
 
-	_, err := snapstate.Update(s.state, "core", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	// ensure all our tasks ran
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
 	c.Assert(err, IsNil)
 
-	// ensure the core snap sets the "ignore-hook-error" flag
-	c.Check(configureFlags&snapstate.IgnoreHookError, Equals, 1)
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Current, Equals, snap.R(2))
 }
 
-func (s *snapmgrTestSuite) TestUpdateDevModeConfinementFiltering(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
+func (s *snapmgrTestSuite) TestEnableDoesNotEnableAgain(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "channel-for-devmode/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
+		Sequence: []*snap.SideInfo{&si},
+		Current:  snap.R(7),
+		Active:   true,
 	})
 
-	// updated snap is devmode, refresh without --devmode, do nothing
-	// TODO: better error message here
-	_, err := snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `.* requires devmode or confinement override`)
-
-	// updated snap is devmode, refresh with --devmode
-	_, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{DevMode: true})
-	c.Assert(err, IsNil)
+	ts, err := snapstate.Enable(s.state, "some-snap")
+	c.Assert(err, ErrorMatches, `snap "some-snap" already enabled`)
+	c.Assert(ts, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestUpdateClassicConfinementFiltering(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
+func (s *snapmgrTestSuite) TestEnableRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+		Channel:  "edge",
+		SnapID:   "foo",
+	}
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "some-snap-now-classic", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{{RealName: "some-snap-now-classic", SnapID: "some-snap-now-classic-id", Revision: snap.R(7)}},
-		Current:  snap.R(7),
-		SnapType: "app",
+	flags := snapstate.Flags{
+		DevMode:  true,
+		JailMode: true,
+		Classic:  true,
+		TryMode:  true,
+		Required: true,
+	}
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Sequence:            []*snap.SideInfo{&si},
+		Current:             si.Revision,
+		Active:              false,
+		TrackingChannel:     "latest/edge",
+		Flags:               flags,
+		AliasesPending:      true,
+		AutoAliasesDisabled: true,
 	})
 
-	// updated snap is classic, refresh without --classic, do nothing
-	// TODO: better error message here
-	_, err := snapstate.Update(s.state, "some-snap-now-classic", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `.* requires classic confinement`)
-
-	// updated snap is classic, refresh with --classic
-	ts, err := snapstate.Update(s.state, "some-snap-now-classic", nil, s.user.ID, snapstate.Flags{Classic: true})
+	chg := s.state.NewChange("enable", "enable a snap")
+	ts, err := snapstate.Enable(s.state, "some-snap")
 	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("refresh", "refresh snap")
 	chg.AddAll(ts)
 
 	s.state.Unlock()
@@ -2527,73 +2084,77 @@
 	s.settle(c)
 	s.state.Lock()
 
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
+	expected := fakeOps{
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op:    "candidate",
+			sinfo: si,
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 
-	// verify snap is in classic
 	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap-now-classic", &snapst)
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Flags, DeepEquals, flags)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.AliasesPending, Equals, false)
+	c.Assert(snapst.AutoAliasesDisabled, Equals, true)
+
+	info, err := snapst.CurrentInfo()
+	c.Assert(err, IsNil)
+	c.Assert(info.Channel, Equals, "edge")
+	c.Assert(info.SnapID, Equals, "foo")
+
+	first := ts.Tasks()[0]
+	snapsup, err := snapstate.TaskSnapSetup(first)
 	c.Assert(err, IsNil)
-	c.Check(snapst.Classic, Equals, true)
+	c.Check(snapsup, DeepEquals, &snapstate.SnapSetup{
+		SideInfo:  &si,
+		Flags:     flags,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
 }
 
-func (s *snapmgrTestSuite) TestUpdateClassicFromClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
+func (s *snapmgrTestSuite) TestDisableRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "channel-for-classic/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
-		Flags:           snapstate.Flags{Classic: true},
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		Active:   true,
+		SnapType: "app",
 	})
 
-	// snap installed with --classic, update needs classic, refresh with --classic works
-	ts, err := snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
-	c.Assert(ts.Tasks(), Not(HasLen), 0)
-	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Flags.Classic, Equals, true)
-
-	// devmode overrides the snapsetup classic flag
-	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{DevMode: true})
-	c.Assert(err, IsNil)
-	c.Assert(ts.Tasks(), Not(HasLen), 0)
-	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Flags.Classic, Equals, false)
-
-	// jailmode overrides it too (you need to provide both)
-	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{JailMode: true})
-	c.Assert(err, IsNil)
-	c.Assert(ts.Tasks(), Not(HasLen), 0)
-	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Flags.Classic, Equals, false)
-
-	// jailmode and classic together gets you both
-	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{JailMode: true, Classic: true})
-	c.Assert(err, IsNil)
-	c.Assert(ts.Tasks(), Not(HasLen), 0)
-	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Flags.Classic, Equals, true)
-
-	// snap installed with --classic, update needs classic, refresh without --classic works
-	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	c.Assert(ts.Tasks(), Not(HasLen), 0)
-	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
+	chg := s.state.NewChange("disable", "disable a snap")
+	ts, err := snapstate.Disable(s.state, "some-snap")
 	c.Assert(err, IsNil)
-	c.Check(snapsup.Flags.Classic, Equals, true)
-
-	chg := s.state.NewChange("refresh", "refresh snap")
 	chg.AddAll(ts)
 
 	s.state.Unlock()
@@ -2601,7444 +2162,185 @@
 	s.settle(c)
 	s.state.Lock()
 
-	// verify snap is in classic
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "remove-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
 	var snapst snapstate.SnapState
 	err = snapstate.Get(s.state, "some-snap", &snapst)
 	c.Assert(err, IsNil)
-	c.Check(snapst.Classic, Equals, true)
-}
-
-func (s *snapmgrTestSuite) TestUpdateStrictFromClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
 
-	s.state.Lock()
-	defer s.state.Unlock()
+	c.Assert(snapst.Active, Equals, false)
+	c.Assert(snapst.AliasesPending, Equals, true)
 
-	snapstate.Set(s.state, "some-snap-was-classic", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "channel/stable",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap-was-classic", SnapID: "some-snap-was-classic-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
-		Flags:           snapstate.Flags{Classic: true},
+	first := ts.Tasks()[0]
+	snapsup, err := snapstate.TaskSnapSetup(first)
+	c.Assert(err, IsNil)
+	c.Check(snapsup, DeepEquals, &snapstate.SnapSetup{
+		SideInfo: &snap.SideInfo{
+			RealName: "some-snap",
+			Revision: snap.R(7),
+		},
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
 	})
+}
 
-	// snap installed with --classic, update does not need classic, refresh works without --classic
-	_, err := snapstate.Update(s.state, "some-snap-was-classic", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// snap installed with --classic, update does not need classic, refresh works with --classic
-	_, err = snapstate.Update(s.state, "some-snap-was-classic", nil, s.user.ID, snapstate.Flags{Classic: true})
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestUpdateChannelFallback(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:         snap.R(7),
-		SnapType:        "app",
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-
-	c.Check(snapsup.Channel, Equals, "latest/edge")
-}
+func (s *snapmgrTestSuite) TestParallelInstanceEnableRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+		Channel:  "edge",
+		SnapID:   "foo",
+	}
 
-func (s *snapmgrTestSuite) TestUpdateTooEarly(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	s.state.Set("seeded", nil)
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:  snap.R(7),
-		SnapType: "app",
+	flags := snapstate.Flags{
+		DevMode:  true,
+		JailMode: true,
+		Classic:  true,
+		TryMode:  true,
+		Required: true,
+	}
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Sequence:            []*snap.SideInfo{&si},
+		Current:             si.Revision,
+		Active:              false,
+		TrackingChannel:     "latest/edge",
+		Flags:               flags,
+		AliasesPending:      true,
+		AutoAliasesDisabled: true,
+		InstanceKey:         "instance",
 	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
-}
-
-func (s *snapmgrTestSuite) TestUpdateConflict(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
-		Current:  snap.R(7),
-		SnapType: "app",
+		Sequence:            []*snap.SideInfo{&si},
+		Current:             si.Revision,
+		Active:              false,
+		TrackingChannel:     "latest/edge",
+		Flags:               flags,
+		AliasesPending:      true,
+		AutoAliasesDisabled: true,
 	})
 
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	chg := s.state.NewChange("enable", "enable a snap")
+	ts, err := snapstate.Enable(s.state, "some-snap_instance")
 	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("refresh", "...").AddAll(ts)
-
-	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `snap "some-snap" has "refresh" change in progress`)
-}
+	chg.AddAll(ts)
 
-func (s *snapmgrTestSuite) TestRemoveTasks(c *C) {
+	s.state.Unlock()
+	s.settle(c)
 	s.state.Lock()
-	defer s.state.Unlock()
 
-	snapstate.Set(s.state, "foo", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "foo", Revision: snap.R(11)},
+	expected := fakeOps{
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
 		},
-		Current:  snap.R(11),
-		SnapType: "app",
-	})
-
-	ts, err := snapstate.Remove(s.state, "foo", snap.R(0), nil)
-	c.Assert(err, IsNil)
-
-	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
-	verifyRemoveTasks(c, ts)
-}
-
-func (s *snapmgrTestSuite) TestRemoveTasksAutoSnapshotDisabled(c *C) {
-	snapstate.AutomaticSnapshot = func(st *state.State, instanceName string) (ts *state.TaskSet, err error) {
-		return nil, snapstate.ErrNothingToDo
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "foo", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "foo", Revision: snap.R(11)},
+		{
+			op:    "candidate",
+			sinfo: si,
 		},
-		Current:  snap.R(11),
-		SnapType: "app",
-	})
-
-	ts, err := snapstate.Remove(s.state, "foo", snap.R(0), nil)
-	c.Assert(err, IsNil)
-
-	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
-		"stop-snap-services",
-		"run-hook[remove]",
-		"auto-disconnect",
-		"remove-aliases",
-		"unlink-snap",
-		"remove-profiles",
-		"clear-snap",
-		"discard-snap",
-	})
-}
-
-func (s *snapmgrTestSuite) TestRemoveTasksAutoSnapshotDisabledByPurgeFlag(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "foo", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "foo", Revision: snap.R(11)},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
 		},
-		Current:  snap.R(11),
-		SnapType: "app",
-	})
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
+		},
+		{
+			op: "update-aliases",
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 
-	ts, err := snapstate.Remove(s.state, "foo", snap.R(0), &snapstate.RemoveFlags{Purge: true})
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
 	c.Assert(err, IsNil)
+	c.Check(snapst.Flags, DeepEquals, flags)
 
-	c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
-		"stop-snap-services",
-		"run-hook[remove]",
-		"auto-disconnect",
-		"remove-aliases",
-		"unlink-snap",
-		"remove-profiles",
-		"clear-snap",
-		"discard-snap",
-	})
-}
-
-func (s *snapmgrTestSuite) TestRemoveHookNotExecutedIfNotLastRevison(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "foo", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "foo", Revision: snap.R(11)},
-			{RealName: "foo", Revision: snap.R(12)},
-		},
-		Current: snap.R(12),
-	})
+	c.Assert(snapst.InstanceKey, Equals, "instance")
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.AliasesPending, Equals, false)
+	c.Assert(snapst.AutoAliasesDisabled, Equals, true)
 
-	ts, err := snapstate.Remove(s.state, "foo", snap.R(11), nil)
+	info, err := snapst.CurrentInfo()
 	c.Assert(err, IsNil)
+	c.Assert(info.Channel, Equals, "edge")
+	c.Assert(info.SnapID, Equals, "foo")
 
-	runHooks := tasksWithKind(ts, "run-hook")
-	// no 'remove' hook task
-	c.Assert(runHooks, HasLen, 0)
+	// the non-parallel instance is still disabled
+	snapst = snapstate.SnapState{}
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Assert(snapst.InstanceKey, Equals, "")
+	c.Assert(snapst.Active, Equals, false)
 }
 
-func (s *snapmgrTestSuite) TestRemoveConflict(c *C) {
+func (s *snapmgrTestSuite) TestParallelInstanceDisableRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
 	s.state.Lock()
 	defer s.state.Unlock()
 
 	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
 		Active:   true,
-		Sequence: []*snap.SideInfo{{RealName: "some-snap", Revision: snap.R(11)}},
-		Current:  snap.R(11),
+	})
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Sequence:    []*snap.SideInfo{&si},
+		Current:     si.Revision,
+		Active:      true,
+		InstanceKey: "instance",
 	})
 
-	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
-	c.Assert(err, IsNil)
-	// need a change to make the tasks visible
-	s.state.NewChange("remove", "...").AddAll(ts)
-
-	_, err = snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
-	c.Assert(err, ErrorMatches, `snap "some-snap" has "remove" change in progress`)
-}
-
-func (s *snapmgrTestSuite) TestInstallRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// we start without the auxiliary store info
-	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FileAbsent)
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	chg := s.state.NewChange("disable", "disable a snap")
+	ts, err := snapstate.Disable(s.state, "some-snap_instance")
 	c.Assert(err, IsNil)
 	chg.AddAll(ts)
 
 	s.state.Unlock()
-	defer s.se.Stop()
 	s.settle(c)
 	s.state.Lock()
 
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	c.Check(snapstate.Installing(s.state), Equals, false)
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-	}})
-	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
 	expected := fakeOps{
 		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap",
-				Channel:      "some-channel",
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
+			op:   "remove-snap-aliases",
+			name: "some-snap_instance",
 		},
 		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			revno: snap.R(11),
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
 		},
 		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// check progress
-	ta := ts.Tasks()
-	task := ta[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-	c.Check(task.Summary(), Equals, `Download snap "some-snap" (11) from channel "some-channel"`)
-
-	// check install-record present
-	mountTask := ta[len(ta)-11]
-	c.Check(mountTask.Kind(), Equals, "mount-snap")
-	var installRecord backend.InstallRecord
-	c.Assert(mountTask.Get("install-record", &installRecord), IsNil)
-	c.Check(installRecord.TargetSnapExisted, Equals, false)
-
-	// check link/start snap summary
-	linkTask := ta[len(ta)-8]
-	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap" (11) available to the system`)
-	startTask := ta[len(ta)-3]
-	c.Check(startTask.Summary(), Equals, `Start snap "some-snap" (11) services`)
-
-	// verify snap-setup in the task state
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel:  "some-channel",
-		UserID:   s.user.ID,
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "some-channel",
-		Revision: snap.R(11),
-		SnapID:   "some-snap-id",
-	})
-
-	// verify snaps in the system state
-	var snaps map[string]*snapstate.SnapState
-	err = s.state.Get("snaps", &snaps)
-	c.Assert(err, IsNil)
-
-	snapst := snaps["some-snap"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "some-channel",
-		Revision: snap.R(11),
-	})
-	c.Assert(snapst.Required, Equals, false)
-
-	// we end with the auxiliary store info
-	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FilePresent)
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceInstallRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap_instance", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	c.Check(snapstate.Installing(s.state), Equals, false)
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
-	}})
-	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
-	expected := fakeOps{
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap_instance",
-				Channel:      "some-channel",
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap_instance",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/11"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "some-snap_instance",
-			revno: snap.R(11),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// check progress
-	ta := ts.Tasks()
-	task := ta[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-	c.Check(task.Summary(), Equals, `Download snap "some-snap_instance" (11) from channel "some-channel"`)
-
-	// check link/start snap summary
-	linkTask := ta[len(ta)-8]
-	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap_instance" (11) available to the system`)
-	startTask := ta[len(ta)-3]
-	c.Check(startTask.Summary(), Equals, `Start snap "some-snap_instance" (11) services`)
-
-	// verify snap-setup in the task state
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel:  "some-channel",
-		UserID:   s.user.ID,
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_instance_11.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:    snapsup.SideInfo,
-		Type:        snap.TypeApp,
-		PlugsOnly:   true,
-		InstanceKey: "instance",
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "some-channel",
-		Revision: snap.R(11),
-		SnapID:   "some-snap-id",
-	})
-
-	// verify snaps in the system state
-	var snaps map[string]*snapstate.SnapState
-	err = s.state.Get("snaps", &snaps)
-	c.Assert(err, IsNil)
-
-	snapst := snaps["some-snap_instance"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "some-channel",
-		Revision: snap.R(11),
-	})
-	c.Assert(snapst.Required, Equals, false)
-	c.Assert(snapst.InstanceKey, Equals, "instance")
-
-	runHooks := tasksWithKind(ts, "run-hook")
-	c.Assert(taskKinds(runHooks), DeepEquals, []string{"run-hook[install]", "run-hook[configure]", "run-hook[check-health]"})
-	for _, hookTask := range runHooks {
-		c.Assert(hookTask.Kind(), Equals, "run-hook")
-		var hooksup hookstate.HookSetup
-		err = hookTask.Get("hook-setup", &hooksup)
-		c.Assert(err, IsNil)
-		c.Assert(hooksup.Snap, Equals, "some-snap_instance")
-	}
-}
-
-func (s *snapmgrTestSuite) TestInstallUndoRunThroughJustOneSnap(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	tasks := ts.Tasks()
-	last := tasks[len(tasks)-1]
-	// sanity
-	c.Assert(last.Lanes(), HasLen, 1)
-	terr := s.state.NewTask("error-trigger", "provoking total undo")
-	terr.WaitFor(last)
-	terr.JoinLane(last.Lanes()[0])
-	chg.AddTask(terr)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	mountTask := tasks[len(tasks)-11]
-	c.Assert(mountTask.Kind(), Equals, "mount-snap")
-	var installRecord backend.InstallRecord
-	c.Assert(mountTask.Get("install-record", &installRecord), IsNil)
-	c.Check(installRecord.TargetSnapExisted, Equals, false)
-
-	// ensure all our tasks ran
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-	}})
-	expected := fakeOps{
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap",
-				Channel:      "some-channel",
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "discard-namespace",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-
-			unlinkFirstInstallUndo: true,
-		},
-		{
-			op:    "setup-profiles:Undoing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:   "undo-copy-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  "<no-old>",
-		},
-		{
-			op:   "remove-snap-data-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
-		},
-		{
-			op:    "undo-setup-snap",
-			name:  "some-snap",
-			stype: "app",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-}
-
-func (s *snapmgrTestSuite) TestInstallUndoRunThroughUndoContextOptional(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap-no-install-record", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	tasks := ts.Tasks()
-	last := tasks[len(tasks)-1]
-	// sanity
-	c.Assert(last.Lanes(), HasLen, 1)
-	terr := s.state.NewTask("error-trigger", "provoking total undo")
-	terr.WaitFor(last)
-	terr.JoinLane(last.Lanes()[0])
-	chg.AddTask(terr)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	mountTask := tasks[len(tasks)-11]
-	c.Assert(mountTask.Kind(), Equals, "mount-snap")
-	var installRecord backend.InstallRecord
-	c.Assert(mountTask.Get("install-record", &installRecord), Equals, state.ErrNoState)
-}
-
-func (s *snapmgrTestSuite) TestInstallWithCohortRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", CohortKey: "scurries"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	c.Check(snapstate.Installing(s.state), Equals, false)
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
-	}})
-	expected := fakeOps{
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap",
-				CohortKey:    "scurries",
-				Channel:      "some-channel",
-			},
-			revno:  snap.R(666),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(666),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Revision: snap.R(666),
-				Channel:  "some-channel",
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
-			revno: snap.R(666),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/666"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(666),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Revision: snap.R(666),
-				Channel:  "some-channel",
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/666"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(666),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "some-snap",
-			revno: snap.R(666),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// check progress
-	ta := ts.Tasks()
-	task := ta[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-	c.Check(task.Summary(), Equals, `Download snap "some-snap" (666) from channel "some-channel"`)
-
-	// check link/start snap summary
-	linkTask := ta[len(ta)-8]
-	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap" (666) available to the system`)
-	startTask := ta[len(ta)-3]
-	c.Check(startTask.Summary(), Equals, `Start snap "some-snap" (666) services`)
-
-	// verify snap-setup in the task state
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel:  "some-channel",
-		UserID:   s.user.ID,
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_666.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-		CohortKey: "scurries",
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(666),
-		SnapID:   "some-snap-id",
-		Channel:  "some-channel",
-	})
-
-	// verify snaps in the system state
-	var snaps map[string]*snapstate.SnapState
-	err = s.state.Get("snaps", &snaps)
-	c.Assert(err, IsNil)
-
-	snapst := snaps["some-snap"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
-	c.Assert(snapst.CohortKey, Equals, "scurries")
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(666),
-		Channel:  "some-channel",
-	})
-	c.Assert(snapst.Required, Equals, false)
-}
-
-func (s *snapmgrTestSuite) TestInstallWithRevisionRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	c.Check(snapstate.Installing(s.state), Equals, false)
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-	}})
-	expected := fakeOps{
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap",
-				Revision:     snap.R(42),
-			},
-			revno:  snap.R(42),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Revision: snap.R(42),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-			revno: snap.R(42),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Revision: snap.R(42),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// check progress
-	ta := ts.Tasks()
-	task := ta[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-	c.Check(task.Summary(), Equals, `Download snap "some-snap" (42) from channel "some-channel"`)
-
-	// check link/start snap summary
-	linkTask := ta[len(ta)-8]
-	c.Check(linkTask.Summary(), Equals, `Make snap "some-snap" (42) available to the system`)
-	startTask := ta[len(ta)-3]
-	c.Check(startTask.Summary(), Equals, `Start snap "some-snap" (42) services`)
-
-	// verify snap-setup in the task state
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel:  "some-channel",
-		UserID:   s.user.ID,
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(42),
-		SnapID:   "some-snap-id",
-	})
-
-	// verify snaps in the system state
-	var snaps map[string]*snapstate.SnapState
-	err = s.state.Get("snaps", &snaps)
-	c.Assert(err, IsNil)
-
-	snapst := snaps["some-snap"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "some-channel/stable")
-	c.Assert(snapst.CohortKey, Equals, "")
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(42),
-	})
-	c.Assert(snapst.Required, Equals, false)
-}
-
-func (s *snapmgrTestSuite) TestUnlinkCurrentSnapLastActiveDisabledServicesSet(c *C) {
-	si := snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(-42),
-	}
-	snaptest.MockSnap(c, `name: services-snap`, &si)
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active:                     true,
-		Sequence:                   []*snap.SideInfo{&si},
-		Current:                    si.Revision,
-		SnapType:                   "app",
-		TrackingChannel:            "stable",
-		LastActiveDisabledServices: []string{},
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
-
-	c.Assert(err, IsNil)
-	// only add up to unlink-current-snap task
-	for _, t := range ts.Tasks() {
-		chg.AddTask(t)
-		if t.Kind() == "unlink-current-snap" {
-			// don't add any more from this point on
-			break
-		}
-	}
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
-}
-
-func (s *snapmgrTestSuite) TestUnlinkCurrentSnapMergedLastActiveDisabledServicesSet(c *C) {
-	si := snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(-42),
-	}
-	snaptest.MockSnap(c, `name: services-snap`, &si)
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active:                     true,
-		Sequence:                   []*snap.SideInfo{&si},
-		Current:                    si.Revision,
-		SnapType:                   "app",
-		TrackingChannel:            "stable",
-		LastActiveDisabledServices: []string{"missing-svc3"},
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
-
-	c.Assert(err, IsNil)
-	// only add up to unlink-current-snap task
-	for _, t := range ts.Tasks() {
-		chg.AddTask(t)
-		if t.Kind() == "unlink-current-snap" {
-			// don't add any more from this point on
-			break
-		}
-	}
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3", "svc1", "svc2"})
-}
-
-func (s *snapmgrTestSuite) TestUnlinkCurrentSnapPassthroughLastActiveDisabledServicesSet(c *C) {
-	si := snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(-42),
-	}
-	snaptest.MockSnap(c, `name: services-snap`, &si)
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active:                     true,
-		Sequence:                   []*snap.SideInfo{&si},
-		Current:                    si.Revision,
-		SnapType:                   "app",
-		TrackingChannel:            "stable",
-		LastActiveDisabledServices: []string{"missing-svc3"},
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
-
-	c.Assert(err, IsNil)
-	// only add up to unlink-current-snap task
-	for _, t := range ts.Tasks() {
-		chg.AddTask(t)
-		if t.Kind() == "unlink-current-snap" {
-			// don't add any more from this point on
-			break
-		}
-	}
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
-}
-
-func (s *snapmgrTestSuite) TestStopSnapServicesSavesSnapSetupLastActiveDisabledServices(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
-
-	snapsup := &snapstate.SnapSetup{
-		SideInfo: &snap.SideInfo{
-			RealName: "services-snap",
-			Revision: snap.R(11),
-			SnapID:   "services-snap-id",
-		},
-	}
-
-	chg := s.state.NewChange("stop-services", "stop the services")
-	t1 := s.state.NewTask("prerequisites", "...")
-	t1.Set("snap-setup", snapsup)
-	t2 := s.state.NewTask("stop-snap-services", "...")
-	t2.Set("stop-reason", snap.StopReasonDisable)
-	t2.Set("snap-setup-task", t1.ID())
-	t2.WaitFor(t1)
-	chg.AddTask(t1)
-	chg.AddTask(t2)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// get the snap setup from the task from state
-	endT := s.state.Task(t1.ID())
-	finalsnapsup := &snapstate.SnapSetup{}
-	endT.Get("snap-setup", finalsnapsup)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(finalsnapsup.LastActiveDisabledServices)
-	c.Assert(finalsnapsup.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
-
-}
-
-func (s *snapmgrTestSuite) TestStopSnapServicesFirstSavesSnapSetupLastActiveDisabledServices(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
-
-	snapsup := &snapstate.SnapSetup{
-		SideInfo: &snap.SideInfo{
-			RealName: "services-snap",
-			Revision: snap.R(11),
-			SnapID:   "services-snap-id",
-		},
-	}
-
-	chg := s.state.NewChange("stop-services", "stop the services")
-	t := s.state.NewTask("stop-snap-services", "...")
-	t.Set("stop-reason", snap.StopReasonDisable)
-	t.Set("snap-setup", snapsup)
-	chg.AddTask(t)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// get the snap setup from the task from state
-	endT := s.state.Task(t.ID())
-	finalsnapsup := &snapstate.SnapSetup{}
-	endT.Get("snap-setup", finalsnapsup)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(finalsnapsup.LastActiveDisabledServices)
-	c.Assert(finalsnapsup.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
-}
-
-func (s *snapmgrTestSuite) TestDisableSnapDisabledServicesSaved(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
-
-	disableChg := s.state.NewChange("disable", "disable a snap")
-	ts, err := snapstate.Disable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	disableChg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(disableChg.Err(), IsNil)
-	c.Assert(disableChg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
-}
-
-func (s *snapmgrTestSuite) TestEnableSnapDisabledServicesPassedAroundHappy(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
-
-	disableChg := s.state.NewChange("disable", "disable a snap")
-	disableTs, err := snapstate.Disable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	disableChg.AddAll(disableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(disableChg.Err(), IsNil)
-	c.Assert(disableChg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
-
-	enableChg := s.state.NewChange("enable", "disable a snap")
-	enableTs, err := snapstate.Enable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	enableChg.AddAll(enableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(enableChg.Err(), IsNil)
-	c.Assert(enableChg.IsReady(), Equals, true)
-
-	// check the ops that will be provided disabledServices
-	svcStateOp := s.fakeBackend.ops.First("current-snap-service-states")
-	c.Assert(svcStateOp, Not(IsNil))
-	c.Assert(svcStateOp.disabledServices, DeepEquals, []string{"svc1", "svc2"})
-
-	linkStateOp := s.fakeBackend.ops.First("link-snap")
-	c.Assert(linkStateOp, Not(IsNil))
-	c.Assert(linkStateOp.disabledServices, DeepEquals, []string{"svc1", "svc2"})
-}
-
-func (s *snapmgrTestSuite) TestEnableSnapDisabledServicesNotSaved(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
-
-	disableChg := s.state.NewChange("disable", "disable a snap")
-	disableTs, err := snapstate.Disable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	disableChg.AddAll(disableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(disableChg.Err(), IsNil)
-	c.Assert(disableChg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
-
-	enableChg := s.state.NewChange("enable", "disable a snap")
-	enableTs, err := snapstate.Enable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	enableChg.AddAll(enableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(enableChg.Err(), IsNil)
-	c.Assert(enableChg.IsReady(), Equals, true)
-
-	// get the snap state again
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that there is nothing in the last active disabled services list
-	// because we re-enabled the snap and there should be nothing we have to
-	// keep track of in the state anymore
-	c.Assert(snapst.LastActiveDisabledServices, HasLen, 0)
-}
-
-func (s *snapmgrTestSuite) TestEnableSnapMissingDisabledServicesMergedAndSaved(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
-	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
-
-	// reset the services to what they were before after the test is done
-	defer func() {
-		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
-	}()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-		// keep this to make gofmt 1.10 happy
-		LastActiveDisabledServices: []string{"missing-svc3"},
-	})
-
-	disableChg := s.state.NewChange("disable", "disable a snap")
-	disableTs, err := snapstate.Disable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	disableChg.AddAll(disableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(disableChg.Err(), IsNil)
-	c.Assert(disableChg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3", "svc1", "svc2"})
-
-	enableChg := s.state.NewChange("enable", "disable a snap")
-	enableTs, err := snapstate.Enable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	enableChg.AddAll(enableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(enableChg.Err(), IsNil)
-	c.Assert(enableChg.IsReady(), Equals, true)
-
-	// get the snap state again
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that there is nothing in the last active disabled services list
-	// because we re-enabled the snap and there should be nothing we have to
-	// keep track of in the state anymore
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
-}
-
-func (s *snapmgrTestSuite) TestEnableSnapMissingDisabledServicesSaved(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-		// keep this to make gofmt 1.10 happy
-		LastActiveDisabledServices: []string{"missing-svc3"},
-	})
-
-	disableChg := s.state.NewChange("disable", "disable a snap")
-	disableTs, err := snapstate.Disable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	disableChg.AddAll(disableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(disableChg.Err(), IsNil)
-	c.Assert(disableChg.IsReady(), Equals, true)
-
-	// get the snap state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that the disabled services in this snap's state is what we
-	// provided
-	sort.Strings(snapst.LastActiveDisabledServices)
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
-
-	enableChg := s.state.NewChange("enable", "disable a snap")
-	enableTs, err := snapstate.Enable(s.state, "services-snap")
-	c.Assert(err, IsNil)
-	enableChg.AddAll(enableTs)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(enableChg.Err(), IsNil)
-	c.Assert(enableChg.IsReady(), Equals, true)
-
-	// get the snap state again
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	// make sure that there is nothing in the last active disabled services list
-	// because we re-enabled the snap and there should be nothing we have to
-	// keep track of in the state anymore
-	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
-}
-
-func (s *snapmgrTestSuite) TestInstallStartOrder(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "services-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	c.Check(snapstate.Installing(s.state), Equals, false)
-	op := s.fakeBackend.ops.First("start-snap-services")
-	c.Assert(op, NotNil)
-	c.Assert(op, DeepEquals, &fakeOp{
-		op:   "start-snap-services",
-		path: filepath.Join(dirs.SnapMountDir, "services-snap/11"),
-		// ordered to preserve after/before relation
-		services: []string{"svc1", "svc3", "svc2"},
-	})
-}
-
-func (s *snapmgrTestSuite) TestInstalling(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	c.Check(snapstate.Installing(s.state), Equals, false)
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	c.Check(snapstate.Installing(s.state), Equals, true)
-}
-
-func (s *snapmgrTestSuite) TestUpdateAmendRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(-42),
-	}
-	snaptest.MockSnap(c, `name: some-snap`, &si)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		Current:         si.Revision,
-		SnapType:        "app",
-		TrackingChannel: "latest/stable",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-	}})
-	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, []string{
-		"storesvc-snap-action",
-		"storesvc-snap-action:action",
-		"storesvc-download",
-		"validate-snap:Doing",
-		"current",
-		"open-snap-file",
-		"setup-snap",
-		"remove-snap-aliases",
-		"unlink-snap",
-		"copy-data",
-		"setup-profiles:Doing",
-		"candidate",
-		"link-snap",
-		"auto-connect:Doing",
-		"update-aliases",
-		"cleanup-trash",
-	})
-	// just check the interesting op
-	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
-		op: "storesvc-snap-action:action",
-		action: store.SnapAction{
-			Action:       "install", // we asked for an Update, but an amend is actually an Install
-			InstanceName: "some-snap",
-			Channel:      "some-channel",
-			Epoch:        snap.E("1*"), // in amend, epoch in the action is not nil!
-			Flags:        store.SnapActionEnforceValidation,
-		},
-		revno:  snap.R(11),
-		userID: 1,
-	})
-
-	task := ts.Tasks()[1]
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel: "some-channel",
-		UserID:  s.user.ID,
-
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-		Flags:     snapstate.Flags{Amend: true},
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(11),
-		Channel:  "some-channel",
-		SnapID:   "some-snap-id",
-	})
-
-	// verify services stop reason
-	verifyStopReason(c, ts, "refresh")
-
-	// check post-refresh hook
-	task = ts.Tasks()[14]
-	c.Assert(task.Kind(), Equals, "run-hook")
-	c.Assert(task.Summary(), Matches, `Run post-refresh hook of "some-snap" snap if present`)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "",
-		Revision: snap.R(-42),
-	})
-	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "some-channel",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(11),
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateRunThrough(c *C) {
-	// we start without the auxiliary store info (or with an older one)
-	c.Check(snapstate.AuxStoreInfoFilename("services-snap-id"), testutil.FileAbsent)
-
-	// use services-snap here to make sure services would be stopped/started appropriately
-	si := snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(7),
-		SnapID:   "services-snap-id",
-	}
-	snaptest.MockSnap(c, `name: services-snap`, &si)
-	fi, err := os.Stat(snap.MountFile("services-snap", si.Revision))
-	c.Assert(err, IsNil)
-	refreshedDate := fi.ModTime()
-	// look at disk
-	r := snapstate.MockRevisionDate(nil)
-	defer r()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		Current:         si.Revision,
-		SnapType:        "app",
-		TrackingChannel: "latest/stable",
-		CohortKey:       "embattled",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{
-		Channel:   "some-channel",
-		CohortKey: "some-cohort",
-	}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op: "storesvc-snap-action",
-			curSnaps: []store.CurrentSnap{{
-				InstanceName:    "services-snap",
-				SnapID:          "services-snap-id",
-				Revision:        snap.R(7),
-				TrackingChannel: "latest/stable",
-				RefreshedDate:   refreshedDate,
-				Epoch:           snap.E("0"),
-				CohortKey:       "embattled",
-			}},
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "refresh",
-				InstanceName: "services-snap",
-				SnapID:       "services-snap-id",
-				Channel:      "some-channel",
-				CohortKey:    "some-cohort",
-				Flags:        store.SnapActionEnforceValidation,
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "services-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "services-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: filepath.Join(dirs.SnapMountDir, "services-snap/7"),
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "services-snap",
-				SnapID:   "services-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "services-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "stop-snap-services:refresh",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap/7"),
-		},
-		{
-			op: "current-snap-service-states",
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "services-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap/7"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap/11"),
-			old:  filepath.Join(dirs.SnapMountDir, "services-snap/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "services-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "services-snap",
-				SnapID:   "services-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "services-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:       "start-snap-services",
-			path:     filepath.Join(dirs.SnapMountDir, "services-snap/11"),
-			services: []string{"svc1", "svc3", "svc2"},
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "services-snap",
-			revno: snap.R(11),
-		},
-	}
-
-	// ensure all our tasks ran
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "services-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
-	}})
-	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// check progress
-	task := ts.Tasks()[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel:   "some-channel",
-		CohortKey: "some-cohort",
-		UserID:    s.user.ID,
-
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(11),
-		Channel:  "some-channel",
-		SnapID:   "services-snap-id",
-	})
-
-	// verify services stop reason
-	verifyStopReason(c, ts, "refresh")
-
-	// check post-refresh hook
-	task = ts.Tasks()[14]
-	c.Assert(task.Kind(), Equals, "run-hook")
-	c.Assert(task.Summary(), Matches, `Run post-refresh hook of "services-snap" snap if present`)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "services-snap",
-		SnapID:   "services-snap-id",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
-		RealName: "services-snap",
-		Channel:  "some-channel",
-		SnapID:   "services-snap-id",
-		Revision: snap.R(11),
-	})
-	c.Check(snapst.CohortKey, Equals, "some-cohort")
-
-	// we end up with the auxiliary store info
-	c.Check(snapstate.AuxStoreInfoFilename("services-snap-id"), testutil.FilePresent)
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceUpdateRunThrough(c *C) {
-	// use services-snap here to make sure services would be stopped/started appropriately
-	si := snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(7),
-		SnapID:   "services-snap-id",
-	}
-	snaptest.MockSnapInstance(c, "services-snap_instance", `name: services-snap`, &si)
-	fi, err := os.Stat(snap.MountFile("services-snap_instance", si.Revision))
-	c.Assert(err, IsNil)
-	refreshedDate := fi.ModTime()
-	// look at disk
-	r := snapstate.MockRevisionDate(nil)
-	defer r()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
-
-	snapstate.Set(s.state, "services-snap_instance", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		Current:         si.Revision,
-		SnapType:        "app",
-		TrackingChannel: "latest/stable",
-		InstanceKey:     "instance",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "services-snap_instance", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op: "storesvc-snap-action",
-			curSnaps: []store.CurrentSnap{{
-				InstanceName:    "services-snap_instance",
-				SnapID:          "services-snap-id",
-				Revision:        snap.R(7),
-				TrackingChannel: "latest/stable",
-				RefreshedDate:   refreshedDate,
-				Epoch:           snap.E("0"),
-			}},
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "refresh",
-				SnapID:       "services-snap-id",
-				InstanceName: "services-snap_instance",
-				Channel:      "some-channel",
-				Flags:        store.SnapActionEnforceValidation,
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "services-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "services-snap_instance",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "services-snap",
-				SnapID:   "services-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "services-snap_instance",
-			path:  filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "stop-snap-services:refresh",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
-		},
-		{
-			op: "current-snap-service-states",
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "services-snap_instance",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/11"),
-			old:  filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "services-snap_instance",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "services-snap",
-				SnapID:   "services-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "services-snap_instance",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:       "start-snap-services",
-			path:     filepath.Join(dirs.SnapMountDir, "services-snap_instance/11"),
-			services: []string{"svc1", "svc3", "svc2"},
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "services-snap_instance",
-			revno: snap.R(11),
-		},
-	}
-
-	// ensure all our tasks ran
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "services-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
-	}})
-	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// check progress
-	task := ts.Tasks()[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel: "some-channel",
-		UserID:  s.user.ID,
-
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:    snapsup.SideInfo,
-		Type:        snap.TypeApp,
-		PlugsOnly:   true,
-		InstanceKey: "instance",
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "services-snap",
-		Revision: snap.R(11),
-		Channel:  "some-channel",
-		SnapID:   "services-snap-id",
-	})
-
-	// verify services stop reason
-	verifyStopReason(c, ts, "refresh")
-
-	// check post-refresh hook
-	task = ts.Tasks()[14]
-	c.Assert(task.Kind(), Equals, "run-hook")
-	c.Assert(task.Summary(), Matches, `Run post-refresh hook of "services-snap_instance" snap if present`)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "services-snap_instance", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.InstanceKey, Equals, "instance")
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "services-snap",
-		SnapID:   "services-snap-id",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
-		RealName: "services-snap",
-		Channel:  "some-channel",
-		SnapID:   "services-snap-id",
-		Revision: snap.R(11),
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateWithNewBase(c *C) {
-	si := &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	snaptest.MockSnap(c, `name: some-snap`, si)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{si},
-		Current:         snap.R(7),
-		SnapType:        "app",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-base/stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
-		{macaroon: s.user.StoreMacaroon, name: "some-base", target: filepath.Join(dirs.SnapBlobDir, "some-base_11.snap")},
-		{macaroon: s.user.StoreMacaroon, name: "some-snap", target: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap")},
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateWithAlreadyInstalledBase(c *C) {
-	si := &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	snaptest.MockSnap(c, `name: some-snap`, si)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{si},
-		Current:         snap.R(7),
-		SnapType:        "app",
-	})
-	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/stable",
-		Sequence: []*snap.SideInfo{{
-			RealName: "some-base",
-			SnapID:   "some-base-id",
-			Revision: snap.R(1),
-		}},
-		Current:  snap.R(1),
-		SnapType: "base",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-base"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
-		{macaroon: s.user.StoreMacaroon, name: "some-snap", target: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap")},
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateWithNewDefaultProvider(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
-	repo := interfaces.NewRepository()
-	ifacerepo.Replace(s.state, repo)
-
-	si := &snap.SideInfo{
-		RealName: "snap-content-plug",
-		SnapID:   "snap-content-plug-id",
-		Revision: snap.R(7),
-	}
-	snaptest.MockSnap(c, `name: snap-content-plug`, si)
-	snapstate.Set(s.state, "snap-content-plug", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{si},
-		Current:         snap.R(7),
-		SnapType:        "app",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "snap-content-plug", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
-		{macaroon: s.user.StoreMacaroon, name: "snap-content-plug", target: filepath.Join(dirs.SnapBlobDir, "snap-content-plug_11.snap")},
-		{macaroon: s.user.StoreMacaroon, name: "snap-content-slot", target: filepath.Join(dirs.SnapBlobDir, "snap-content-slot_11.snap")},
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateWithInstalledDefaultProvider(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
-	repo := interfaces.NewRepository()
-	ifacerepo.Replace(s.state, repo)
-
-	si := &snap.SideInfo{
-		RealName: "snap-content-plug",
-		SnapID:   "snap-content-plug-id",
-		Revision: snap.R(7),
-	}
-	snaptest.MockSnap(c, `name: snap-content-plug`, si)
-	snapstate.Set(s.state, "snap-content-plug", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{si},
-		Current:         snap.R(7),
-		SnapType:        "app",
-	})
-	snapstate.Set(s.state, "snap-content-slot", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/stable",
-		Sequence: []*snap.SideInfo{{
-			RealName: "snap-content-slot",
-			SnapID:   "snap-content-slot-id",
-			Revision: snap.R(1),
-		}},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "snap-content-plug", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
-		{macaroon: s.user.StoreMacaroon, name: "snap-content-plug", target: filepath.Join(dirs.SnapBlobDir, "snap-content-plug_11.snap")},
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateRememberedUserRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
-		},
-		Current:  snap.R(5),
-		SnapType: "app",
-		UserID:   1,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Status(), Equals, state.DoneStatus)
-	c.Assert(chg.Err(), IsNil)
-
-	for _, op := range s.fakeBackend.ops {
-		switch op.op {
-		case "storesvc-snap-action":
-			c.Check(op.userID, Equals, 1)
-		case "storesvc-download":
-			snapName := op.name
-			c.Check(s.fakeStore.downloads[0], DeepEquals, fakeDownload{
-				macaroon: "macaroon",
-				name:     "some-snap",
-				target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			}, Commentf(snapName))
-		}
-	}
-}
-
-func (s *snapmgrTestSuite) TestUpdateToRevisionRememberedUserRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
-		},
-		Current:  snap.R(5),
-		SnapType: "app",
-		UserID:   1,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(11)}, 0, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Status(), Equals, state.DoneStatus)
-	c.Assert(chg.Err(), IsNil)
-
-	for _, op := range s.fakeBackend.ops {
-		switch op.op {
-		case "storesvc-snap-action:action":
-			c.Check(op.userID, Equals, 1)
-		case "storesvc-download":
-			snapName := op.name
-			c.Check(s.fakeStore.downloads[0], DeepEquals, fakeDownload{
-				macaroon: "macaroon",
-				name:     "some-snap",
-				target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			}, Commentf(snapName))
-		}
-	}
-}
-
-func (s *snapmgrTestSuite) TestUpdateModelKernelSwitchTrackRunThrough(c *C) {
-	// use services-snap here to make sure services would be stopped/started appropriately
-	si := snap.SideInfo{
-		RealName: "kernel",
-		Revision: snap.R(7),
-		SnapID:   "kernel-id",
-	}
-	snaptest.MockSnap(c, `name: kernel`, &si)
-	fi, err := os.Stat(snap.MountFile("kernel", si.Revision))
-	c.Assert(err, IsNil)
-	refreshedDate := fi.ModTime()
-	// look at disk
-	r := snapstate.MockRevisionDate(nil)
-	defer r()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	r1 := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
-	defer r1()
-	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		Current:         si.Revision,
-		TrackingChannel: "18/stable",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "edge"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(chg.Status(), Equals, state.DoneStatus)
-
-	c.Assert(len(s.fakeBackend.ops) > 2, Equals, true)
-	c.Assert(s.fakeBackend.ops[:2], DeepEquals, fakeOps{
-		{
-			op: "storesvc-snap-action",
-			curSnaps: []store.CurrentSnap{{
-				InstanceName:    "kernel",
-				SnapID:          "kernel-id",
-				Revision:        snap.R(7),
-				TrackingChannel: "18/stable",
-				RefreshedDate:   refreshedDate,
-				Epoch:           snap.E("1*"),
-			}},
-			userID: 1,
-		}, {
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "refresh",
-				InstanceName: "kernel",
-				SnapID:       "kernel-id",
-				Channel:      "18/edge",
-				Flags:        store.SnapActionEnforceValidation,
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-	})
-
-	// check progress
-	task := ts.Tasks()[1]
-	_, cur, total := task.Progress()
-	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
-	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel: "18/edge",
-		UserID:  s.user.ID,
-
-		SnapPath: filepath.Join(dirs.SnapBlobDir, "kernel_11.snap"),
-		DownloadInfo: &snap.DownloadInfo{
-			DownloadURL: "https://some-server.com/some/path.snap",
-		},
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeKernel,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "kernel",
-		Revision: snap.R(11),
-		Channel:  "18/edge",
-		SnapID:   "kernel-id",
-	})
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "kernel", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "18/edge")
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "kernel",
-		SnapID:   "kernel-id",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
-		RealName: "kernel",
-		Channel:  "18/edge",
-		SnapID:   "kernel-id",
-		Revision: snap.R(11),
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateManyMultipleCredsNoUserRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "core", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "core", Revision: snap.R(1), SnapID: "core-snap-id"},
-		},
-		Current:  snap.R(1),
-		SnapType: "os",
-	})
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
-		},
-		Current:  snap.R(5),
-		SnapType: "app",
-		UserID:   1,
-	})
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(2), SnapID: "services-snap-id"},
-		},
-		Current:  snap.R(2),
-		SnapType: "app",
-		UserID:   2,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh all snaps")
-	// no user is passed to use for UpdateMany
-	updated, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	for _, ts := range tts {
-		chg.AddAll(ts)
-	}
-	c.Check(updated, HasLen, 3)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Status(), Equals, state.DoneStatus)
-	c.Assert(chg.Err(), IsNil)
-
-	macaroonMap := map[string]string{
-		"core":          "",
-		"some-snap":     "macaroon",
-		"services-snap": "macaroon2",
-	}
-
-	seen := make(map[string]int)
-	ir := 0
-	di := 0
-	for _, op := range s.fakeBackend.ops {
-		switch op.op {
-		case "storesvc-snap-action":
-			ir++
-			c.Check(op.curSnaps, DeepEquals, []store.CurrentSnap{
-				{
-					InstanceName:  "core",
-					SnapID:        "core-snap-id",
-					Revision:      snap.R(1),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 1),
-					Epoch:         snap.E("1*"),
-				},
-				{
-					InstanceName:  "services-snap",
-					SnapID:        "services-snap-id",
-					Revision:      snap.R(2),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 2),
-					Epoch:         snap.E("0"),
-				},
-				{
-					InstanceName:  "some-snap",
-					SnapID:        "some-snap-id",
-					Revision:      snap.R(5),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 5),
-					Epoch:         snap.E("1*"),
-				},
-			})
-		case "storesvc-snap-action:action":
-			snapID := op.action.SnapID
-			seen[snapID] = op.userID
-		case "storesvc-download":
-			snapName := op.name
-			fakeDl := s.fakeStore.downloads[di]
-			// check target path separately and clear it
-			c.Check(fakeDl.target, Matches, filepath.Join(dirs.SnapBlobDir, fmt.Sprintf("%s_[0-9]+.snap", snapName)))
-			fakeDl.target = ""
-			c.Check(fakeDl, DeepEquals, fakeDownload{
-				macaroon: macaroonMap[snapName],
-				name:     snapName,
-			}, Commentf(snapName))
-			di++
-		}
-	}
-	c.Check(ir, Equals, 2)
-	// we check all snaps with each user
-	c.Check(seen["some-snap-id"], Equals, 1)
-	c.Check(seen["services-snap-id"], Equals, 2)
-	// coalesced with one of the others
-	c.Check(seen["core-snap-id"] > 0, Equals, true)
-}
-
-func (s *snapmgrTestSuite) TestUpdateManyMultipleCredsUserRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "core", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "core", Revision: snap.R(1), SnapID: "core-snap-id"},
-		},
-		Current:  snap.R(1),
-		SnapType: "os",
-	})
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
-		},
-		Current:  snap.R(5),
-		SnapType: "app",
-		UserID:   1,
-	})
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(2), SnapID: "services-snap-id"},
-		},
-		Current:  snap.R(2),
-		SnapType: "app",
-		UserID:   2,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh all snaps")
-	// do UpdateMany using user 2 as fallback
-	updated, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 2, nil)
-	c.Assert(err, IsNil)
-	for _, ts := range tts {
-		chg.AddAll(ts)
-	}
-	c.Check(updated, HasLen, 3)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Status(), Equals, state.DoneStatus)
-	c.Assert(chg.Err(), IsNil)
-
-	macaroonMap := map[string]string{
-		"core":          "macaroon2",
-		"some-snap":     "macaroon",
-		"services-snap": "macaroon2",
-	}
-
-	type snapIDuserID struct {
-		snapID string
-		userID int
-	}
-	seen := make(map[snapIDuserID]bool)
-	ir := 0
-	di := 0
-	for _, op := range s.fakeBackend.ops {
-		switch op.op {
-		case "storesvc-snap-action":
-			ir++
-			c.Check(op.curSnaps, DeepEquals, []store.CurrentSnap{
-				{
-					InstanceName:  "core",
-					SnapID:        "core-snap-id",
-					Revision:      snap.R(1),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 1),
-					Epoch:         snap.E("1*"),
-				},
-				{
-					InstanceName:  "services-snap",
-					SnapID:        "services-snap-id",
-					Revision:      snap.R(2),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 2),
-					Epoch:         snap.E("0"),
-				},
-				{
-					InstanceName:  "some-snap",
-					SnapID:        "some-snap-id",
-					Revision:      snap.R(5),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 5),
-					Epoch:         snap.E("1*"),
-				},
-			})
-		case "storesvc-snap-action:action":
-			snapID := op.action.SnapID
-			seen[snapIDuserID{snapID: snapID, userID: op.userID}] = true
-		case "storesvc-download":
-			snapName := op.name
-			fakeDl := s.fakeStore.downloads[di]
-			// check target path separately and clear it
-			c.Check(fakeDl.target, Matches, filepath.Join(dirs.SnapBlobDir, fmt.Sprintf("%s_[0-9]+.snap", snapName)))
-			fakeDl.target = ""
-			c.Check(fakeDl, DeepEquals, fakeDownload{
-				macaroon: macaroonMap[snapName],
-				name:     snapName,
-			}, Commentf(snapName))
-			di++
-		}
-	}
-	c.Check(ir, Equals, 2)
-	// we check all snaps with each user
-	c.Check(seen, DeepEquals, map[snapIDuserID]bool{
-		{snapID: "core-snap-id", userID: 2}:     true,
-		{snapID: "some-snap-id", userID: 1}:     true,
-		{snapID: "services-snap-id", userID: 2}: true,
-	})
-
-	var coreState, snapState snapstate.SnapState
-	// user in SnapState was preserved
-	err = snapstate.Get(s.state, "some-snap", &snapState)
-	c.Assert(err, IsNil)
-	c.Check(snapState.UserID, Equals, 1)
-	c.Check(snapState.Current, DeepEquals, snap.R(11))
-
-	// user in SnapState was set
-	err = snapstate.Get(s.state, "core", &coreState)
-	c.Assert(err, IsNil)
-	c.Check(coreState.UserID, Equals, 2)
-	c.Check(coreState.Current, DeepEquals, snap.R(11))
-
-}
-
-func (s *snapmgrTestSuite) TestUpdateManyMultipleCredsUserWithNoStoreAuthRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "core", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "core", Revision: snap.R(1), SnapID: "core-snap-id"},
-		},
-		Current:  snap.R(1),
-		SnapType: "os",
-	})
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
-		},
-		Current:  snap.R(5),
-		SnapType: "app",
-		UserID:   1,
-	})
-	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "services-snap", Revision: snap.R(2), SnapID: "services-snap-id"},
-		},
-		Current:  snap.R(2),
-		SnapType: "app",
-		UserID:   3,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh all snaps")
-	// no user is passed to use for UpdateMany
-	updated, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
-	c.Assert(err, IsNil)
-	for _, ts := range tts {
-		chg.AddAll(ts)
-	}
-	c.Check(updated, HasLen, 3)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Status(), Equals, state.DoneStatus)
-	c.Assert(chg.Err(), IsNil)
-
-	macaroonMap := map[string]string{
-		"core":          "",
-		"some-snap":     "macaroon",
-		"services-snap": "",
-	}
-
-	seen := make(map[string]int)
-	ir := 0
-	di := 0
-	for _, op := range s.fakeBackend.ops {
-		switch op.op {
-		case "storesvc-snap-action":
-			ir++
-			c.Check(op.curSnaps, DeepEquals, []store.CurrentSnap{
-				{
-					InstanceName:  "core",
-					SnapID:        "core-snap-id",
-					Revision:      snap.R(1),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 1),
-					Epoch:         snap.E("1*"),
-				},
-				{
-					InstanceName:  "services-snap",
-					SnapID:        "services-snap-id",
-					Revision:      snap.R(2),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 2),
-					Epoch:         snap.E("0"),
-				},
-				{
-					InstanceName:  "some-snap",
-					SnapID:        "some-snap-id",
-					Revision:      snap.R(5),
-					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 5),
-					Epoch:         snap.E("1*"),
-				},
-			})
-		case "storesvc-snap-action:action":
-			snapID := op.action.SnapID
-			if _, ok := seen[snapID]; !ok {
-				seen[snapID] = op.userID
-			}
-		case "storesvc-download":
-			snapName := op.name
-			fakeDl := s.fakeStore.downloads[di]
-			// check target path separately and clear it
-			c.Check(fakeDl.target, Matches, filepath.Join(dirs.SnapBlobDir, fmt.Sprintf("%s_[0-9]+.snap", snapName)))
-			fakeDl.target = ""
-			c.Check(fakeDl, DeepEquals, fakeDownload{
-				macaroon: macaroonMap[snapName],
-				name:     snapName,
-			}, Commentf(snapName))
-			di++
-		}
-	}
-	c.Check(ir, Equals, 1)
-	// we check all snaps with each user
-	c.Check(seen["some-snap-id"], Equals, 1)
-	// coalesced with request for 1
-	c.Check(seen["services-snap-id"], Equals, 1)
-	c.Check(seen["core-snap-id"], Equals, 1)
-}
-
-func (s *snapmgrTestSuite) TestUpdateUndoRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("install", "install a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "/some-snap/11")
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op: "storesvc-snap-action",
-			curSnaps: []store.CurrentSnap{{
-				InstanceName:  "some-snap",
-				SnapID:        "some-snap-id",
-				Revision:      snap.R(7),
-				RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
-				Epoch:         snap.E("1*"),
-			}},
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "refresh",
-				InstanceName: "some-snap",
-				SnapID:       "some-snap-id",
-				Channel:      "some-channel",
-				Flags:        store.SnapActionEnforceValidation,
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap.failed",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "setup-profiles:Undoing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:   "undo-copy-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "undo-setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			stype: "app",
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-
-	// ensure all our tasks ran
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-	}})
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 1)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-}
-
-func lastWithLane(tasks []*state.Task) *state.Task {
-	for i := len(tasks) - 1; i >= 0; i-- {
-		if lanes := tasks[i].Lanes(); len(lanes) == 1 && lanes[0] != 0 {
-			return tasks[i]
-		}
-	}
-	return nil
-}
-
-func (s *snapmgrTestSuite) TestUpdateUndoRestoresRevisionConfig(c *C) {
-	var errorTaskExecuted bool
-
-	// overwrite error-trigger task handler with custom one for this test
-	erroringHandler := func(task *state.Task, _ *tomb.Tomb) error {
-		st := task.State()
-		st.Lock()
-		defer st.Unlock()
-
-		// modify current config of some-snap
-		tr := config.NewTransaction(st)
-		tr.Set("some-snap", "foo", "canary")
-		tr.Commit()
-
-		errorTaskExecuted = true
-		return errors.New("error out")
-	}
-	s.o.TaskRunner().AddHandler("error-trigger", erroringHandler, nil)
-
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	si2 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(6),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si2, &si},
-		TrackingChannel: "latest/stable",
-		Current:         si.Revision,
-		SnapType:        "app",
-	})
-
-	// set some configuration
-	tr := config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "revision 7 value")
-	tr.Commit()
-	config.SaveRevisionConfig(s.state, "some-snap", snap.R(7))
-
-	chg := s.state.NewChange("install", "install a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	last := lastWithLane(ts.Tasks())
-	c.Assert(last, NotNil)
-
-	terr := s.state.NewTask("error-trigger", "provoking total undo")
-	terr.WaitFor(last)
-	terr.JoinLane(last.Lanes()[0])
-	chg.AddTask(terr)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(chg.Status(), Equals, state.ErrorStatus)
-	c.Check(errorTaskExecuted, Equals, true)
-
-	// after undoing the update some-snap config should be restored to that of rev.7
-	var val string
-	tr = config.NewTransaction(s.state)
-	c.Assert(tr.Get("some-snap", "foo", &val), IsNil)
-	c.Check(val, Equals, "revision 7 value")
-}
-
-func (s *snapmgrTestSuite) TestUpdateTotalUndoRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "latest/stable",
-		Current:         si.Revision,
-		SnapType:        "app",
-	})
-
-	chg := s.state.NewChange("install", "install a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	// We need to make it not be rerefresh, and we could do just
-	// that but instead we do the 'right' thing and attach it to
-	// the last task that's on a lane.
-	last := lastWithLane(ts.Tasks())
-	c.Assert(last, NotNil)
-
-	terr := s.state.NewTask("error-trigger", "provoking total undo")
-	terr.WaitFor(last)
-	terr.JoinLane(last.Lanes()[0])
-	chg.AddTask(terr)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op: "storesvc-snap-action",
-			curSnaps: []store.CurrentSnap{{
-				InstanceName:    "some-snap",
-				SnapID:          "some-snap-id",
-				Revision:        snap.R(7),
-				TrackingChannel: "latest/stable",
-				RefreshedDate:   fakeRevDateEpoch.AddDate(0, 0, 7),
-				Epoch:           snap.E("1*"),
-			}},
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "refresh",
-				InstanceName: "some-snap",
-				SnapID:       "some-snap-id",
-				Channel:      "some-channel",
-				Flags:        store.SnapActionEnforceValidation,
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		// undoing everything from here down...
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op: "current-snap-service-states",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "setup-profiles:Undoing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:   "undo-copy-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "undo-setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			stype: "app",
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-
-	// ensure all our tasks ran
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
-		macaroon: s.user.StoreMacaroon,
-		name:     "some-snap",
-		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-	}})
-	// friendlier failure first
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "latest/stable")
-	c.Assert(snapst.Sequence, HasLen, 1)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevision(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, Equals, store.ErrNoUpdateAvailable)
-}
-
-// A noResultsStore returns no results for install/refresh requests
-type noResultsStore struct {
-	*fakeStore
-}
-
-func (n noResultsStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
-	return nil, &store.SnapActionError{NoResults: true}
-}
-
-func (s *snapmgrTestSuite) TestUpdateNoStoreResults(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, noResultsStore{fakeStore: s.fakeStore})
-
-	// this is an atypical case in which the store didn't return
-	// an error nor a result, we are defensive and return
-	// a reasonable error
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, Equals, snapstate.ErrMissingExpectedResult)
-}
-
-func (s *snapmgrTestSuite) TestUpdateNoStoreResultsWithChannelChange(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, noResultsStore{fakeStore: s.fakeStore})
-
-	// this is an atypical case in which the store didn't return
-	// an error nor a result, we are defensive and return
-	// a reasonable error
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-9/stable",
-		Current:         si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, Equals, snapstate.ErrMissingExpectedResult)
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevisionSwitchesChannel(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "other-chanenl/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	c.Check(ts.Tasks(), HasLen, 1)
-	c.Check(ts.Tasks()[0].Kind(), Equals, "switch-snap-channel")
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevisionSwitchesChannelConflict(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "other-channel/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	// make it visible
-	s.state.NewChange("refresh", "refresh a snap").AddAll(ts)
-
-	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
-	c.Check(err, ErrorMatches, `snap "some-snap" has "refresh" change in progress`)
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevisionSwitchChannelRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "other-channel",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "other-channel/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		// we just expect the "storesvc-snap-action" ops, we
-		// don't have a fakeOp for switchChannel because it has
-		// not a backend method, it just manipulates the state
-		{
-			op: "storesvc-snap-action",
-			curSnaps: []store.CurrentSnap{{
-				InstanceName:    "some-snap",
-				SnapID:          "some-snap-id",
-				Revision:        snap.R(7),
-				TrackingChannel: "other-channel/stable",
-				RefreshedDate:   fakeRevDateEpoch.AddDate(0, 0, 7),
-				Epoch:           snap.E("1*"),
-			}},
-			userID: 1,
-		},
-
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "refresh",
-				InstanceName: "some-snap",
-				SnapID:       "some-snap-id",
-				Channel:      "channel-for-7/stable",
-				Flags:        store.SnapActionEnforceValidation,
-			},
-			userID: 1,
-		},
-	}
-
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	task := ts.Tasks()[0]
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		Channel:  "channel-for-7/stable",
-		SideInfo: snapsup.SideInfo,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-		Channel:  "channel-for-7/stable",
-	})
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 1)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "channel-for-7/stable",
-		Revision: snap.R(7),
-	})
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevisionToggleIgnoreValidation(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
-	c.Assert(err, IsNil)
-	c.Check(ts.Tasks(), HasLen, 1)
-	c.Check(ts.Tasks()[0].Kind(), Equals, "toggle-snap-flags")
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevisionToggleIgnoreValidationConflict(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
-	c.Assert(err, IsNil)
-	// make it visible
-	s.state.NewChange("refresh", "refresh a snap").AddAll(ts)
-
-	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
-	c.Check(err, ErrorMatches, `snap "some-snap" has "refresh" change in progress`)
-
-}
-
-func (s *snapmgrTestSuite) TestUpdateSameRevisionToggleIgnoreValidationRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-		Channel:  "channel-for-7",
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
-	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	task := ts.Tasks()[0]
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Check(snapsup, DeepEquals, snapstate.SnapSetup{
-		SideInfo: snapsup.SideInfo,
-		Flags: snapstate.Flags{
-			IgnoreValidation: true,
-		},
-	})
-	c.Check(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-		Channel:  "channel-for-7",
-	})
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Check(snapst.Active, Equals, true)
-	c.Check(snapst.Sequence, HasLen, 1)
-	c.Check(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "channel-for-7",
-		Revision: snap.R(7),
-	})
-	c.Check(snapst.IgnoreValidation, Equals, true)
-}
-
-func (s *snapmgrTestSuite) TestUpdateValidateRefreshesSaysNo(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-	})
-
-	validateErr := errors.New("refresh control error")
-	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		c.Check(refreshes, HasLen, 1)
-		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
-		c.Check(refreshes[0].Revision, Equals, snap.R(11))
-		c.Check(ignoreValidation, HasLen, 0)
-		return nil, validateErr
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshes
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, Equals, validateErr)
-}
-
-func (s *snapmgrTestSuite) TestUpdateValidateRefreshesSaysNoButIgnoreValidationIsSet(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	validateErr := errors.New("refresh control error")
-	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		return nil, validateErr
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshes
-
-	flags := snapstate.Flags{JailMode: true, IgnoreValidation: true}
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
-	c.Assert(err, IsNil)
-
-	var snapsup snapstate.SnapSetup
-	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Flags, DeepEquals, flags.ForSnapSetup())
-}
-
-func (s *snapmgrTestSuite) TestUpdateIgnoreValidationSticky(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	validateErr := errors.New("refresh control error")
-	validateRefreshesFail := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		c.Check(refreshes, HasLen, 1)
-		if len(ignoreValidation) == 0 {
-			return nil, validateErr
-		}
-		c.Check(ignoreValidation, DeepEquals, map[string]bool{
-			"some-snap": true,
-		})
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshesFail
-
-	flags := snapstate.Flags{IgnoreValidation: true}
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
-	c.Assert(err, IsNil)
-
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:     "some-snap",
-			SnapID:           "some-snap-id",
-			Revision:         snap.R(7),
-			IgnoreValidation: false,
-			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
-			Epoch:            snap.E("1*"),
-		}},
-		userID: 1,
-	})
-	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
-		op:    "storesvc-snap-action:action",
-		revno: snap.R(11),
-		action: store.SnapAction{
-			Action:       "refresh",
-			InstanceName: "some-snap",
-			SnapID:       "some-snap-id",
-			Channel:      "stable",
-			Flags:        store.SnapActionIgnoreValidation,
-		},
-		userID: 1,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snap has IgnoreValidation set
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.IgnoreValidation, Equals, true)
-	c.Check(snapst.Current, Equals, snap.R(11))
-
-	s.fakeBackend.ops = nil
-	s.fakeStore.refreshRevnos = map[string]snap.Revision{
-		"some-snap-id": snap.R(12),
-	}
-	_, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
-	c.Assert(err, IsNil)
-	c.Check(tts, HasLen, 2)
-	verifyLastTasksetIsReRefresh(c, tts)
-
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:     "some-snap",
-			SnapID:           "some-snap-id",
-			Revision:         snap.R(11),
-			TrackingChannel:  "latest/stable",
-			IgnoreValidation: true,
-			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 11),
-			Epoch:            snap.E("1*"),
-		}},
-		userID: 1,
-	})
-	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
-		op:    "storesvc-snap-action:action",
-		revno: snap.R(12),
-		action: store.SnapAction{
-			Action:       "refresh",
-			InstanceName: "some-snap",
-			SnapID:       "some-snap-id",
-			Flags:        0,
-		},
-		userID: 1,
-	})
-
-	chg = s.state.NewChange("refresh", "refresh snaps")
-	chg.AddAll(tts[0])
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	snapst = snapstate.SnapState{}
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.IgnoreValidation, Equals, true)
-	c.Check(snapst.Current, Equals, snap.R(12))
-
-	// reset ignore validation
-	s.fakeBackend.ops = nil
-	s.fakeStore.refreshRevnos = map[string]snap.Revision{
-		"some-snap-id": snap.R(11),
-	}
-	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshes
-	flags = snapstate.Flags{}
-	ts, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
-	c.Assert(err, IsNil)
-
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:     "some-snap",
-			SnapID:           "some-snap-id",
-			Revision:         snap.R(12),
-			TrackingChannel:  "latest/stable",
-			IgnoreValidation: true,
-			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 12),
-			Epoch:            snap.E("1*"),
-		}},
-		userID: 1,
-	})
-	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
-		op:    "storesvc-snap-action:action",
-		revno: snap.R(11),
-		action: store.SnapAction{
-			Action:       "refresh",
-			InstanceName: "some-snap",
-			SnapID:       "some-snap-id",
-			Channel:      "latest/stable",
-			Flags:        store.SnapActionEnforceValidation,
-		},
-		userID: 1,
-	})
-
-	chg = s.state.NewChange("refresh", "refresh snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	snapst = snapstate.SnapState{}
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.IgnoreValidation, Equals, false)
-	c.Check(snapst.Current, Equals, snap.R(11))
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceUpdateIgnoreValidationSticky(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Active:      true,
-		Sequence:    []*snap.SideInfo{&si},
-		Current:     si.Revision,
-		SnapType:    "app",
-		InstanceKey: "instance",
-	})
-
-	validateErr := errors.New("refresh control error")
-	validateRefreshesFail := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
-		c.Check(refreshes, HasLen, 2)
-		if len(ignoreValidation) == 0 {
-			return nil, validateErr
-		}
-		c.Check(ignoreValidation, DeepEquals, map[string]bool{
-			"some-snap_instance": true,
-		})
-		return refreshes, nil
-	}
-	// hook it up
-	snapstate.ValidateRefreshes = validateRefreshesFail
-
-	flags := snapstate.Flags{IgnoreValidation: true}
-	ts, err := snapstate.Update(s.state, "some-snap_instance", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
-	c.Assert(err, IsNil)
-
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:     "some-snap",
-			SnapID:           "some-snap-id",
-			Revision:         snap.R(7),
-			IgnoreValidation: false,
-			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
-			Epoch:            snap.E("1*"),
-		}, {
-			InstanceName:     "some-snap_instance",
-			SnapID:           "some-snap-id",
-			Revision:         snap.R(7),
-			IgnoreValidation: false,
-			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
-			Epoch:            snap.E("1*"),
-		}},
-		userID: 1,
-	})
-	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
-		op:    "storesvc-snap-action:action",
-		revno: snap.R(11),
-		action: store.SnapAction{
-			Action:       "refresh",
-			InstanceName: "some-snap_instance",
-			SnapID:       "some-snap-id",
-			Channel:      "stable",
-			Flags:        store.SnapActionIgnoreValidation,
-		},
-		userID: 1,
-	})
-
-	chg := s.state.NewChange("refresh", "refresh snaps")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// verify snap 'instance' has IgnoreValidation set and the snap was
-	// updated
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.IgnoreValidation, Equals, true)
-	c.Check(snapst.Current, Equals, snap.R(11))
-	// and the other snap does not
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.Current, Equals, snap.R(7))
-	c.Check(snapst.IgnoreValidation, Equals, false)
-
-	s.fakeBackend.ops = nil
-	s.fakeStore.refreshRevnos = map[string]snap.Revision{
-		"some-snap-id": snap.R(12),
-	}
-	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "some-snap_instance"}, s.user.ID, nil)
-	c.Assert(err, IsNil)
-	c.Check(tts, HasLen, 3)
-	verifyLastTasksetIsReRefresh(c, tts)
-	sort.Strings(updates)
-	c.Check(updates, DeepEquals, []string{"some-snap", "some-snap_instance"})
-
-	chg = s.state.NewChange("refresh", "refresh snaps")
-	for _, ts := range tts[:len(tts)-1] {
-		chg.AddAll(ts)
-	}
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.IgnoreValidation, Equals, false)
-	c.Check(snapst.Current, Equals, snap.R(12))
-
-	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.IgnoreValidation, Equals, true)
-	c.Check(snapst.Current, Equals, snap.R(12))
-
-	for i := 0; i < 2; i++ {
-		op := s.fakeBackend.ops[i]
-		switch op.op {
-		case "storesvc-snap-action":
-			c.Check(op, DeepEquals, fakeOp{
-				op: "storesvc-snap-action",
-				curSnaps: []store.CurrentSnap{{
-					InstanceName:     "some-snap",
-					SnapID:           "some-snap-id",
-					Revision:         snap.R(7),
-					IgnoreValidation: false,
-					RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
-					Epoch:            snap.E("1*"),
-				}, {
-					InstanceName:     "some-snap_instance",
-					SnapID:           "some-snap-id",
-					Revision:         snap.R(11),
-					TrackingChannel:  "latest/stable",
-					IgnoreValidation: true,
-					RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 11),
-					Epoch:            snap.E("1*"),
-				}},
-				userID: 1,
-			})
-		case "storesvc-snap-action:action":
-			switch op.action.InstanceName {
-			case "some-snap":
-				c.Check(op, DeepEquals, fakeOp{
-					op:    "storesvc-snap-action:action",
-					revno: snap.R(12),
-					action: store.SnapAction{
-						Action:       "refresh",
-						InstanceName: "some-snap",
-						SnapID:       "some-snap-id",
-						Flags:        0,
-					},
-					userID: 1,
-				})
-			case "some-snap_instance":
-				c.Check(op, DeepEquals, fakeOp{
-					op:    "storesvc-snap-action:action",
-					revno: snap.R(12),
-					action: store.SnapAction{
-						Action:       "refresh",
-						InstanceName: "some-snap_instance",
-						SnapID:       "some-snap-id",
-						Flags:        0,
-					},
-					userID: 1,
-				})
-			default:
-				c.Fatalf("unexpected instance name %q", op.action.InstanceName)
-			}
-		default:
-			c.Fatalf("unexpected action %q", op.op)
-		}
-	}
-
-}
-
-func (s *snapmgrTestSuite) TestUpdateFromLocal(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R("x1"),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, Equals, store.ErrLocalSnap)
-}
-
-func (s *snapmgrTestSuite) TestUpdateAmend(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R("x1"),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "channel-for-7/stable",
-		Current:         si.Revision,
-	})
-
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{Amend: true})
-	c.Assert(err, IsNil)
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
-
-	// ensure we go from local to store revision-7
-	var snapsup snapstate.SnapSetup
-	tasks := ts.Tasks()
-	c.Check(tasks[1].Kind(), Equals, "download-snap")
-	err = tasks[1].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Revision(), Equals, snap.R(7))
-}
-
-func (s *snapmgrTestSuite) TestUpdateAmendSnapNotFound(c *C) {
-	si := snap.SideInfo{
-		RealName: "snap-unknown",
-		Revision: snap.R("x1"),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "snap-unknown", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		TrackingChannel: "latest/stable",
-		Current:         si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "snap-unknown", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{Amend: true})
-	c.Assert(err, Equals, store.ErrSnapNotFound)
-}
-
-func (s *snapmgrTestSuite) TestSingleUpdateBlockedRevision(c *C) {
-	// single updates should *not* set the block list
-	si7 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	si11 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(11),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si7, &si11},
-		Current:  si7.Revision,
-		SnapType: "app",
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	c.Assert(s.fakeBackend.ops, HasLen, 2)
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:  "some-snap",
-			SnapID:        "some-snap-id",
-			Revision:      snap.R(7),
-			RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
-			Epoch:         snap.E("1*"),
-		}},
-		userID: 1,
-	})
-}
-
-func (s *snapmgrTestSuite) TestMultiUpdateBlockedRevision(c *C) {
-	// multi-updates should *not* set the block list
-	si7 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	si11 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(11),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si7, &si11},
-		Current:  si7.Revision,
-		SnapType: "app",
-	})
-
-	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
-	c.Assert(err, IsNil)
-	c.Check(updates, DeepEquals, []string{"some-snap"})
-
-	c.Assert(s.fakeBackend.ops, HasLen, 2)
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:  "some-snap",
-			SnapID:        "some-snap-id",
-			Revision:      snap.R(7),
-			RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
-			Epoch:         snap.E("1*"),
-		}},
-		userID: 1,
-	})
-}
-
-func (s *snapmgrTestSuite) TestAllUpdateBlockedRevision(c *C) {
-	//  update-all *should* set the block list
-	si7 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	si11 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(11),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si7, &si11},
-		Current:  si7.Revision,
-	})
-
-	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, s.user.ID, nil)
-	c.Check(err, IsNil)
-	c.Check(updates, HasLen, 0)
-
-	c.Assert(s.fakeBackend.ops, HasLen, 2)
-	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
-		op: "storesvc-snap-action",
-		curSnaps: []store.CurrentSnap{{
-			InstanceName:  "some-snap",
-			SnapID:        "some-snap-id",
-			Revision:      snap.R(7),
-			RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
-			Block:         []snap.Revision{snap.R(11)},
-			Epoch:         snap.E("1*"),
-		}},
-		userID: 1,
-	})
-}
-
-var orthogonalAutoAliasesScenarios = []struct {
-	aliasesBefore map[string][]string
-	names         []string
-	prune         []string
-	update        bool
-	new           bool
-}{
-	{nil, nil, nil, true, true},
-	{nil, []string{"some-snap"}, nil, true, false},
-	{nil, []string{"other-snap"}, nil, false, true},
-	{map[string][]string{"some-snap": {"aliasA", "aliasC"}}, []string{"some-snap"}, nil, true, false},
-	{map[string][]string{"other-snap": {"aliasB", "aliasC"}}, []string{"other-snap"}, []string{"other-snap"}, false, false},
-	{map[string][]string{"other-snap": {"aliasB", "aliasC"}}, nil, []string{"other-snap"}, true, false},
-	{map[string][]string{"other-snap": {"aliasB", "aliasC"}}, []string{"some-snap"}, nil, true, false},
-	{map[string][]string{"other-snap": {"aliasC"}}, []string{"other-snap"}, []string{"other-snap"}, false, true},
-	{map[string][]string{"other-snap": {"aliasC"}}, nil, []string{"other-snap"}, true, true},
-	{map[string][]string{"other-snap": {"aliasC"}}, []string{"some-snap"}, nil, true, false},
-	{map[string][]string{"some-snap": {"aliasB"}, "other-snap": {"aliasA"}}, []string{"some-snap"}, []string{"other-snap"}, true, false},
-	{map[string][]string{"some-snap": {"aliasB"}, "other-snap": {"aliasA"}}, nil, []string{"other-snap", "some-snap"}, true, true},
-	{map[string][]string{"some-snap": {"aliasB"}, "other-snap": {"aliasA"}}, []string{"other-snap"}, []string{"other-snap", "some-snap"}, false, true},
-	{map[string][]string{"some-snap": {"aliasB"}}, nil, []string{"some-snap"}, true, true},
-	{map[string][]string{"some-snap": {"aliasB"}}, []string{"other-snap"}, []string{"some-snap"}, false, true},
-	{map[string][]string{"some-snap": {"aliasB"}}, []string{"some-snap"}, nil, true, false},
-	{map[string][]string{"other-snap": {"aliasA"}}, nil, []string{"other-snap"}, true, true},
-	{map[string][]string{"other-snap": {"aliasA"}}, []string{"other-snap"}, []string{"other-snap"}, false, true},
-	{map[string][]string{"other-snap": {"aliasA"}}, []string{"some-snap"}, []string{"other-snap"}, true, false},
-}
-
-func (s *snapmgrTestSuite) TestUpdateManyAutoAliasesScenarios(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "other-snap", SnapID: "other-snap-id", Revision: snap.R(2)},
-		},
-		Current:  snap.R(2),
-		SnapType: "app",
-	})
-
-	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
-		switch info.InstanceName() {
-		case "some-snap":
-			return map[string]string{"aliasA": "cmdA"}, nil
-		case "other-snap":
-			return map[string]string{"aliasB": "cmdB"}, nil
-		}
-		return nil, nil
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
-		},
-		Current:  snap.R(4),
-		SnapType: "app",
-	})
-
-	expectedSet := func(aliases []string) map[string]bool {
-		res := make(map[string]bool, len(aliases))
-		for _, alias := range aliases {
-			res[alias] = true
-		}
-		return res
-	}
-
-	for _, scenario := range orthogonalAutoAliasesScenarios {
-		for _, instanceName := range []string{"some-snap", "other-snap"} {
-			var snapst snapstate.SnapState
-			err := snapstate.Get(s.state, instanceName, &snapst)
-			c.Assert(err, IsNil)
-			snapst.Aliases = nil
-			snapst.AutoAliasesDisabled = false
-			if autoAliases := scenario.aliasesBefore[instanceName]; autoAliases != nil {
-				targets := make(map[string]*snapstate.AliasTarget)
-				for _, alias := range autoAliases {
-					targets[alias] = &snapstate.AliasTarget{Auto: "cmd" + alias[len(alias)-1:]}
-				}
-
-				snapst.Aliases = targets
-			}
-			snapstate.Set(s.state, instanceName, &snapst)
-		}
-
-		updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, scenario.names, s.user.ID, nil)
-		c.Check(err, IsNil)
-		if scenario.update {
-			verifyLastTasksetIsReRefresh(c, tts)
-		}
-
-		_, dropped, err := snapstate.AutoAliasesDelta(s.state, []string{"some-snap", "other-snap"})
-		c.Assert(err, IsNil)
-
-		j := 0
-		expectedUpdatesSet := make(map[string]bool)
-		var expectedPruned map[string]map[string]bool
-		var pruneTs *state.TaskSet
-		if len(scenario.prune) != 0 {
-			pruneTs = tts[0]
-			j++
-			taskAliases := make(map[string]map[string]bool)
-			for _, aliasTask := range pruneTs.Tasks() {
-				c.Check(aliasTask.Kind(), Equals, "prune-auto-aliases")
-				var aliases []string
-				err := aliasTask.Get("aliases", &aliases)
-				c.Assert(err, IsNil)
-				snapsup, err := snapstate.TaskSnapSetup(aliasTask)
-				c.Assert(err, IsNil)
-				taskAliases[snapsup.InstanceName()] = expectedSet(aliases)
-			}
-			expectedPruned = make(map[string]map[string]bool)
-			for _, instanceName := range scenario.prune {
-				expectedPruned[instanceName] = expectedSet(dropped[instanceName])
-				if instanceName == "other-snap" && !scenario.new && !scenario.update {
-					expectedUpdatesSet["other-snap"] = true
-				}
-			}
-			c.Check(taskAliases, DeepEquals, expectedPruned)
-		}
-		if scenario.update {
-			updateTs := tts[j]
-			j++
-			expectedUpdatesSet["some-snap"] = true
-			first := updateTs.Tasks()[0]
-			c.Check(first.Kind(), Equals, "prerequisites")
-			wait := false
-			if expectedPruned["other-snap"]["aliasA"] {
-				wait = true
-			} else if expectedPruned["some-snap"] != nil {
-				wait = true
-			}
-			if wait {
-				c.Check(first.WaitTasks(), DeepEquals, pruneTs.Tasks())
-			} else {
-				c.Check(first.WaitTasks(), HasLen, 0)
-			}
-		}
-		if scenario.new {
-			newTs := tts[j]
-			j++
-			expectedUpdatesSet["other-snap"] = true
-			tasks := newTs.Tasks()
-			c.Check(tasks, HasLen, 1)
-			aliasTask := tasks[0]
-			c.Check(aliasTask.Kind(), Equals, "refresh-aliases")
-
-			wait := false
-			if expectedPruned["some-snap"]["aliasB"] {
-				wait = true
-			} else if expectedPruned["other-snap"] != nil {
-				wait = true
-			}
-			if wait {
-				c.Check(aliasTask.WaitTasks(), DeepEquals, pruneTs.Tasks())
-			} else {
-				c.Check(aliasTask.WaitTasks(), HasLen, 0)
-			}
-		}
-		l := len(tts)
-		if scenario.update {
-			l--
-		}
-		c.Assert(j, Equals, l, Commentf("%#v", scenario))
-
-		// check reported updated names
-		c.Check(len(updates) > 0, Equals, true)
-		sort.Strings(updates)
-		expectedUpdates := make([]string, 0, len(expectedUpdatesSet))
-		for x := range expectedUpdatesSet {
-			expectedUpdates = append(expectedUpdates, x)
-		}
-		sort.Strings(expectedUpdates)
-		c.Check(updates, DeepEquals, expectedUpdates)
-	}
-}
-
-func (s *snapmgrTestSuite) TestUpdateOneAutoAliasesScenarios(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "other-snap", SnapID: "other-snap-id", Revision: snap.R(2)},
-		},
-		Current:  snap.R(2),
-		SnapType: "app",
-	})
-
-	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
-		switch info.InstanceName() {
-		case "some-snap":
-			return map[string]string{"aliasA": "cmdA"}, nil
-		case "other-snap":
-			return map[string]string{"aliasB": "cmdB"}, nil
-		}
-		return nil, nil
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
-		},
-		Current:  snap.R(4),
-		SnapType: "app",
-	})
-
-	expectedSet := func(aliases []string) map[string]bool {
-		res := make(map[string]bool, len(aliases))
-		for _, alias := range aliases {
-			res[alias] = true
-		}
-		return res
-	}
-
-	for _, scenario := range orthogonalAutoAliasesScenarios {
-		if len(scenario.names) != 1 {
-			continue
-		}
-
-		for _, instanceName := range []string{"some-snap", "other-snap"} {
-			var snapst snapstate.SnapState
-			err := snapstate.Get(s.state, instanceName, &snapst)
-			c.Assert(err, IsNil)
-			snapst.Aliases = nil
-			snapst.AutoAliasesDisabled = false
-			if autoAliases := scenario.aliasesBefore[instanceName]; autoAliases != nil {
-				targets := make(map[string]*snapstate.AliasTarget)
-				for _, alias := range autoAliases {
-					targets[alias] = &snapstate.AliasTarget{Auto: "cmd" + alias[len(alias)-1:]}
-				}
-
-				snapst.Aliases = targets
-			}
-			snapstate.Set(s.state, instanceName, &snapst)
-		}
-
-		ts, err := snapstate.Update(s.state, scenario.names[0], nil, s.user.ID, snapstate.Flags{})
-		c.Assert(err, IsNil)
-		_, dropped, err := snapstate.AutoAliasesDelta(s.state, []string{"some-snap", "other-snap"})
-		c.Assert(err, IsNil)
-
-		j := 0
-
-		tasks := ts.Tasks()
-		// make sure the last task from Update is the rerefresh
-		if scenario.update {
-			reRefresh := tasks[len(tasks)-1]
-			c.Check(reRefresh.Kind(), Equals, "check-rerefresh")
-			// nothing should wait on it
-			c.Check(reRefresh.NumHaltTasks(), Equals, 0)
-			tasks = tasks[:len(tasks)-1] // and now forget about it
-		}
-
-		var expectedPruned map[string]map[string]bool
-		var pruneTasks []*state.Task
-		if len(scenario.prune) != 0 {
-			nprune := len(scenario.prune)
-			pruneTasks = tasks[:nprune]
-			j += nprune
-			taskAliases := make(map[string]map[string]bool)
-			for _, aliasTask := range pruneTasks {
-				c.Check(aliasTask.Kind(), Equals, "prune-auto-aliases")
-				var aliases []string
-				err := aliasTask.Get("aliases", &aliases)
-				c.Assert(err, IsNil)
-				snapsup, err := snapstate.TaskSnapSetup(aliasTask)
-				c.Assert(err, IsNil)
-				taskAliases[snapsup.InstanceName()] = expectedSet(aliases)
-			}
-			expectedPruned = make(map[string]map[string]bool)
-			for _, instanceName := range scenario.prune {
-				expectedPruned[instanceName] = expectedSet(dropped[instanceName])
-			}
-			c.Check(taskAliases, DeepEquals, expectedPruned)
-		}
-		if scenario.update {
-			first := tasks[j]
-			j += 19
-			c.Check(first.Kind(), Equals, "prerequisites")
-			wait := false
-			if expectedPruned["other-snap"]["aliasA"] {
-				wait = true
-			} else if expectedPruned["some-snap"] != nil {
-				wait = true
-			}
-			if wait {
-				c.Check(first.WaitTasks(), DeepEquals, pruneTasks)
-			} else {
-				c.Check(first.WaitTasks(), HasLen, 0)
-			}
-		}
-		if scenario.new {
-			aliasTask := tasks[j]
-			j++
-			c.Check(aliasTask.Kind(), Equals, "refresh-aliases")
-			wait := false
-			if expectedPruned["some-snap"]["aliasB"] {
-				wait = true
-			} else if expectedPruned["other-snap"] != nil {
-				wait = true
-			}
-			if wait {
-				c.Check(aliasTask.WaitTasks(), DeepEquals, pruneTasks)
-			} else {
-				c.Check(aliasTask.WaitTasks(), HasLen, 0)
-			}
-		}
-		c.Assert(len(tasks), Equals, j, Commentf("%#v", scenario))
-
-		// conflict checks are triggered
-		chg := s.state.NewChange("update", "...")
-		chg.AddAll(ts)
-		err = snapstate.CheckChangeConflict(s.state, scenario.names[0], nil)
-		c.Check(err, ErrorMatches, `.* has "update" change in progress`)
-		chg.SetStatus(state.DoneStatus)
-	}
-}
-
-func (s *snapmgrTestSuite) TestUpdateLocalSnapFails(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, Equals, store.ErrLocalSnap)
-}
-
-func (s *snapmgrTestSuite) TestUpdateDisabledUnsupported(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   false,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `refreshing disabled snap "some-snap" not supported`)
-}
-
-func (s *snapmgrTestSuite) TestUpdateKernelTrackChecksSwitchingTracks(c *C) {
-	si := snap.SideInfo{
-		RealName: "kernel",
-		SnapID:   "kernel-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		Current:         si.Revision,
-		TrackingChannel: "18/stable",
-	})
-
-	// switching tracks is not ok
-	_, err := snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "new-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `cannot switch from kernel track "18" as specified for the \(device\) model to "new-channel"`)
-
-	// no change to the channel is ok
-	_, err = snapstate.Update(s.state, "kernel", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// switching risk level is ok
-	_, err = snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "18/beta"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// switching just risk within the pinned track is ok
-	_, err = snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "beta"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestUpdateGadgetTrackChecksSwitchingTracks(c *C) {
-	si := snap.SideInfo{
-		RealName: "brand-gadget",
-		SnapID:   "brand-gadget-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
-		Active:          true,
-		Sequence:        []*snap.SideInfo{&si},
-		Current:         si.Revision,
-		TrackingChannel: "18/stable",
-	})
-
-	// switching tracks is not ok
-	_, err := snapstate.Update(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "new-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `cannot switch from gadget track "18" as specified for the \(device\) model to "new-channel"`)
-
-	// no change to the channel is ok
-	_, err = snapstate.Update(s.state, "brand-gadget", nil, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// switching risk level is ok
-	_, err = snapstate.Update(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "18/beta"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// switching just risk within the pinned track is ok
-	_, err = snapstate.Update(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "beta"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-}
-
-func makeTestSnap(c *C, snapYamlContent string) (snapFilePath string) {
-	return snaptest.MakeTestSnapWithFiles(c, snapYamlContent, nil)
-}
-
-func (s *snapmgrTestSuite) TestInstallFirstLocalRunThrough(c *C) {
-	// use the real thing for this one
-	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	mockSnap := makeTestSnap(c, `name: mock
-version: 1.0`)
-	chg := s.state.NewChange("install", "install a local snap")
-	ts, info, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "mock"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	// ensure the returned info is correct
-	c.Check(info.SideInfo.RealName, Equals, "mock")
-	c.Check(info.Version, Equals, "1.0")
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			// only local install was run, i.e. first actions are pseudo-action current
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			// and setup-snap
-			op:    "setup-snap",
-			name:  "mock",
-			path:  mockSnap,
-			revno: snap.R("x1"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "mock",
-			revno: snap.R("x1"),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "mock",
-				Revision: snap.R("x1"),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "mock",
-			revno: snap.R("x1"),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "mock",
-			revno: snap.R("x1"),
-		},
-	}
-
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	task := ts.Tasks()[1]
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		SnapPath:  mockSnap,
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "mock",
-		Revision: snap.R(-1),
-	})
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "mock", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "mock",
-		Channel:  "",
-		Revision: snap.R(-1),
-	})
-	c.Assert(snapst.LocalRevision(), Equals, snap.R(-1))
-}
-
-func (s *snapmgrTestSuite) TestInstallSubsequentLocalRunThrough(c *C) {
-	// use the real thing for this one
-	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "mock", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "mock", Revision: snap.R(-2)},
-		},
-		Current:  snap.R(-2),
-		SnapType: "app",
-	})
-
-	mockSnap := makeTestSnap(c, `name: mock
-version: 1.0
-epoch: 1*
-`)
-	chg := s.state.NewChange("install", "install a local snap")
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "mock"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:  "current",
-			old: filepath.Join(dirs.SnapMountDir, "mock/x2"),
-		},
-		{
-			op:    "setup-snap",
-			name:  "mock",
-			path:  mockSnap,
-			revno: snap.R("x3"),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "mock",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x2"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x3"),
-			old:  filepath.Join(dirs.SnapMountDir, "mock/x2"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "mock",
-			revno: snap.R(-3),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "mock",
-				Revision: snap.R(-3),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x3"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "mock",
-			revno: snap.R("x3"),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "mock",
-			revno: snap.R("x3"),
-		},
-	}
-
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	task := ts.Tasks()[1]
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		SnapPath:  mockSnap,
-		SideInfo:  snapsup.SideInfo,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
-		RealName: "mock",
-		Revision: snap.R(-3),
-	})
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "mock", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.CurrentSideInfo(), DeepEquals, &snap.SideInfo{
-		RealName: "mock",
-		Channel:  "",
-		Revision: snap.R(-3),
-	})
-	c.Assert(snapst.LocalRevision(), Equals, snap.R(-3))
-}
-
-func (s *snapmgrTestSuite) TestInstallOldSubsequentLocalRunThrough(c *C) {
-	// use the real thing for this one
-	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "mock", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "mock", Revision: snap.R(100001)},
-		},
-		Current:  snap.R(100001),
-		SnapType: "app",
-	})
-
-	mockSnap := makeTestSnap(c, `name: mock
-version: 1.0
-epoch: 1*
-`)
-	chg := s.state.NewChange("install", "install a local snap")
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "mock"}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			// ensure only local install was run, i.e. first action is pseudo-action current
-			op:  "current",
-			old: filepath.Join(dirs.SnapMountDir, "mock/100001"),
-		},
-		{
-			// and setup-snap
-			op:    "setup-snap",
-			name:  "mock",
-			path:  mockSnap,
-			revno: snap.R("x1"),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "mock",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "mock/100001"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
-			old:  filepath.Join(dirs.SnapMountDir, "mock/100001"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "mock",
-			revno: snap.R("x1"),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "mock",
-				Revision: snap.R("x1"),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "mock/x1"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "mock",
-			revno: snap.R("x1"),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			// and cleanup
-			op:    "cleanup-trash",
-			name:  "mock",
-			revno: snap.R("x1"),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "mock", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.CurrentSideInfo(), DeepEquals, &snap.SideInfo{
-		RealName: "mock",
-		Channel:  "",
-		Revision: snap.R(-1),
-	})
-	c.Assert(snapst.LocalRevision(), Equals, snap.R(-1))
-}
-
-func (s *snapmgrTestSuite) TestInstallPathWithMetadataRunThrough(c *C) {
-	// use the real thing for this one
-	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	someSnap := makeTestSnap(c, `name: orig-name
-version: 1.0`)
-	chg := s.state.NewChange("install", "install a local snap")
-
-	si := &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(42),
-	}
-	ts, _, err := snapstate.InstallPath(s.state, si, someSnap, "", "", snapstate.Flags{Required: true})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure only local install was run, i.e. first actions are pseudo-action current
-	c.Assert(s.fakeBackend.ops.Ops(), HasLen, 9)
-	c.Check(s.fakeBackend.ops[0].op, Equals, "current")
-	c.Check(s.fakeBackend.ops[0].old, Equals, "<no-current>")
-	// and setup-snap
-	c.Check(s.fakeBackend.ops[1].op, Equals, "setup-snap")
-	c.Check(s.fakeBackend.ops[1].name, Equals, "some-snap")
-	c.Check(s.fakeBackend.ops[1].path, Matches, `.*/orig-name_1.0_all.snap`)
-	c.Check(s.fakeBackend.ops[1].revno, Equals, snap.R(42))
-
-	c.Check(s.fakeBackend.ops[4].op, Equals, "candidate")
-	c.Check(s.fakeBackend.ops[4].sinfo, DeepEquals, *si)
-	c.Check(s.fakeBackend.ops[5].op, Equals, "link-snap")
-	c.Check(s.fakeBackend.ops[5].path, Equals, filepath.Join(dirs.SnapMountDir, "some-snap/42"))
-
-	// verify snapSetup info
-	var snapsup snapstate.SnapSetup
-	task := ts.Tasks()[0]
-	err = task.Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
-		SnapPath: someSnap,
-		SideInfo: snapsup.SideInfo,
-		Flags: snapstate.Flags{
-			Required: true,
-		},
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-	c.Assert(snapsup.SideInfo, DeepEquals, si)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "")
-	c.Assert(snapst.Sequence[0], DeepEquals, si)
-	c.Assert(snapst.LocalRevision().Unset(), Equals, true)
-	c.Assert(snapst.Required, Equals, true)
-}
-
-func (s *snapmgrTestSuite) TestRemoveRunThrough(c *C) {
-	c.Assert(snapstate.KeepAuxStoreInfo("some-snap-id", nil), IsNil)
-	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FilePresent)
-	si := snap.SideInfo{
-		SnapID:   "some-snap-id",
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:    "auto-disconnect:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "remove-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "remove-snap-common-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:   "remove-snap-data-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-			stype: "app",
-		},
-		{
-			op:   "discard-namespace",
-			name: "some-snap",
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	tasks := ts.Tasks()
-	for _, t := range tasks {
-		if t.Kind() == "run-hook" {
-			continue
-		}
-		if t.Kind() == "save-snapshot" {
-			continue
-		}
-		snapsup, err := snapstate.TaskSnapSetup(t)
-		c.Assert(err, IsNil)
-
-		var expSnapSetup *snapstate.SnapSetup
-		switch t.Kind() {
-		case "discard-conns":
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "some-snap",
-				},
-			}
-		case "clear-snap", "discard-snap":
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "some-snap",
-					SnapID:   "some-snap-id",
-					Revision: snap.R(7),
-				},
-			}
-		default:
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "some-snap",
-					Revision: snap.R(7),
-					SnapID:   "some-snap-id",
-				},
-				Type:      snap.TypeApp,
-				PlugsOnly: true,
-			}
-
-		}
-
-		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
-	}
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, Equals, state.ErrNoState)
-	c.Check(snapstate.AuxStoreInfoFilename("some-snap-id"), testutil.FileAbsent)
-
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceRemoveRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// pretend we have both a regular snap and a parallel instance
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Active:      true,
-		Sequence:    []*snap.SideInfo{&si},
-		Current:     si.Revision,
-		SnapType:    "app",
-		InstanceKey: "instance",
-	})
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap_instance", snap.R(0), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:    "auto-disconnect:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap_instance",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:    "remove-profiles:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:   "remove-snap-common-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:             "remove-snap-data-dir",
-			name:           "some-snap_instance",
-			path:           filepath.Join(dirs.SnapDataDir, "some-snap"),
-			otherInstances: true,
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-			stype: "app",
-		},
-		{
-			op:   "discard-namespace",
-			name: "some-snap_instance",
-		},
-		{
-			op:             "remove-snap-dir",
-			name:           "some-snap_instance",
-			path:           filepath.Join(dirs.SnapMountDir, "some-snap"),
-			otherInstances: true,
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	tasks := ts.Tasks()
-	for _, t := range tasks {
-		if t.Kind() == "run-hook" {
-			continue
-		}
-		if t.Kind() == "save-snapshot" {
-			continue
-		}
-		snapsup, err := snapstate.TaskSnapSetup(t)
-		c.Assert(err, IsNil)
-
-		var expSnapSetup *snapstate.SnapSetup
-		switch t.Kind() {
-		case "discard-conns":
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "some-snap",
-				},
-				InstanceKey: "instance",
-			}
-		case "clear-snap", "discard-snap":
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "some-snap",
-					Revision: snap.R(7),
-				},
-				InstanceKey: "instance",
-			}
-		default:
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "some-snap",
-					Revision: snap.R(7),
-				},
-				Type:        snap.TypeApp,
-				PlugsOnly:   true,
-				InstanceKey: "instance",
-			}
-
-		}
-
-		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
-	}
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
-	c.Assert(err, Equals, state.ErrNoState)
-
-	// the non-instance snap is still there
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceRemoveRunThroughOtherInstances(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// pretend we have both a regular snap and a parallel instance
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Active:      true,
-		Sequence:    []*snap.SideInfo{&si},
-		Current:     si.Revision,
-		SnapType:    "app",
-		InstanceKey: "instance",
-	})
-	snapstate.Set(s.state, "some-snap_other", &snapstate.SnapState{
-		Active:      true,
-		Sequence:    []*snap.SideInfo{&si},
-		Current:     si.Revision,
-		SnapType:    "app",
-		InstanceKey: "other",
-	})
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap_instance", snap.R(0), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:    "auto-disconnect:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap_instance",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:    "remove-profiles:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:   "remove-snap-common-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:             "remove-snap-data-dir",
-			name:           "some-snap_instance",
-			path:           filepath.Join(dirs.SnapDataDir, "some-snap"),
-			otherInstances: true,
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-			stype: "app",
-		},
-		{
-			op:   "discard-namespace",
-			name: "some-snap_instance",
-		},
-		{
-			op:             "remove-snap-dir",
-			name:           "some-snap_instance",
-			path:           filepath.Join(dirs.SnapMountDir, "some-snap"),
-			otherInstances: true,
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
-	c.Assert(err, Equals, state.ErrNoState)
-
-	// the other instance is still there
-	err = snapstate.Get(s.state, "some-snap_other", &snapst)
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestRemoveWithManyRevisionsRunThrough(c *C) {
-	si3 := snap.SideInfo{
-		SnapID:   "some-snap-id",
-		RealName: "some-snap",
-		Revision: snap.R(3),
-	}
-
-	si5 := snap.SideInfo{
-		SnapID:   "some-snap-id",
-		RealName: "some-snap",
-		Revision: snap.R(5),
-	}
-
-	si7 := snap.SideInfo{
-		SnapID:   "some-snap-id",
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si5, &si3, &si7},
-		Current:  si7.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:    "auto-disconnect:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "remove-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-			stype: "app",
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/3"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/3"),
-			stype: "app",
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/5"),
-		},
-		{
-			op:   "remove-snap-common-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/5"),
-		},
-		{
-			op:   "remove-snap-data-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/5"),
-			stype: "app",
-		},
-		{
-			op:   "discard-namespace",
-			name: "some-snap",
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	tasks := ts.Tasks()
-	revnos := []snap.Revision{{N: 7}, {N: 3}, {N: 5}}
-	whichRevno := 0
-	for _, t := range tasks {
-		if t.Kind() == "run-hook" {
-			continue
-		}
-		if t.Kind() == "save-snapshot" {
-			continue
-		}
-		snapsup, err := snapstate.TaskSnapSetup(t)
-		c.Assert(err, IsNil)
-
-		var expSnapSetup *snapstate.SnapSetup
-		switch t.Kind() {
-		case "discard-conns":
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					SnapID:   "some-snap-id",
-					RealName: "some-snap",
-				},
-			}
-		case "clear-snap", "discard-snap":
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					SnapID:   "some-snap-id",
-					RealName: "some-snap",
-					Revision: revnos[whichRevno],
-				},
-			}
-		default:
-			expSnapSetup = &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					SnapID:   "some-snap-id",
-					RealName: "some-snap",
-					Revision: snap.R(7),
-				},
-				Type:      snap.TypeApp,
-				PlugsOnly: true,
-			}
-
-		}
-
-		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
-
-		if t.Kind() == "discard-snap" {
-			whichRevno++
-		}
-	}
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, Equals, state.ErrNoState)
-}
-
-func (s *snapmgrTestSuite) TestRemoveOneRevisionRunThrough(c *C) {
-	si3 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(3),
-	}
-
-	si5 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(5),
-	}
-
-	si7 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si5, &si3, &si7},
-		Current:  si7.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(3), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(len(s.fakeBackend.ops), Equals, 2)
-	expected := fakeOps{
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/3"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/3"),
-			stype: "app",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	tasks := ts.Tasks()
-	for _, t := range tasks {
-		if t.Kind() == "save-snapshot" {
-			continue
-		}
-		snapsup, err := snapstate.TaskSnapSetup(t)
-		c.Assert(err, IsNil)
-
-		expSnapSetup := &snapstate.SnapSetup{
-			SideInfo: &snap.SideInfo{
-				RealName: "some-snap",
-				Revision: snap.R(3),
-			},
-		}
-
-		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
-	}
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.Sequence, HasLen, 2)
-}
-
-func (s *snapmgrTestSuite) TestRemoveLastRevisionRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   false,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(2), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Check(len(s.fakeBackend.ops), Equals, 7)
-	expected := fakeOps{
-		{
-			op:    "auto-disconnect:Doing",
-			name:  "some-snap",
-			revno: snap.R(2),
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:   "remove-snap-common-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:   "remove-snap-data-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-			stype: "app",
-		},
-		{
-			op:   "discard-namespace",
-			name: "some-snap",
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snapSetup info
-	tasks := ts.Tasks()
-	for _, t := range tasks {
-		if t.Kind() == "run-hook" {
-			continue
-		}
-		if t.Kind() == "save-snapshot" {
-			continue
-		}
-		snapsup, err := snapstate.TaskSnapSetup(t)
-		c.Assert(err, IsNil)
-
-		expSnapSetup := &snapstate.SnapSetup{
-			SideInfo: &snap.SideInfo{
-				RealName: "some-snap",
-			},
-		}
-		if t.Kind() != "discard-conns" {
-			expSnapSetup.SideInfo.Revision = snap.R(2)
-		}
-		if t.Kind() == "auto-disconnect" {
-			expSnapSetup.PlugsOnly = true
-			expSnapSetup.Type = "app"
-		}
-
-		c.Check(snapsup, DeepEquals, expSnapSetup, Commentf(t.Kind()))
-	}
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, Equals, state.ErrNoState)
-}
-
-func (s *snapmgrTestSuite) TestRemoveCurrentActiveRevisionRefused(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	_, err := snapstate.Remove(s.state, "some-snap", snap.R(2), nil)
-
-	c.Check(err, ErrorMatches, `cannot remove active revision 2 of snap "some-snap"`)
-}
-
-func (s *snapmgrTestSuite) TestRemoveCurrentRevisionOfSeveralRefused(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si, &si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	_, err := snapstate.Remove(s.state, "some-snap", snap.R(2), nil)
-	c.Assert(err, NotNil)
-	c.Check(err.Error(), Equals, `cannot remove active revision 2 of snap "some-snap" (revert first?)`)
-}
-
-func (s *snapmgrTestSuite) TestRemoveMissingRevisionRefused(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	_, err := snapstate.Remove(s.state, "some-snap", snap.R(1), nil)
-
-	c.Check(err, ErrorMatches, `revision 1 of snap "some-snap" is not installed`)
-}
-
-func (s *snapmgrTestSuite) TestRemoveRefused(c *C) {
-	si := snap.SideInfo{
-		RealName: "brand-gadget",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "gadget",
-	})
-
-	_, err := snapstate.Remove(s.state, "brand-gadget", snap.R(0), nil)
-
-	c.Check(err, ErrorMatches, `snap "brand-gadget" is not removable: snap is used by the model`)
-}
-
-func (s *snapmgrTestSuite) TestRemoveRefusedLastRevision(c *C) {
-	si := snap.SideInfo{
-		RealName: "brand-gadget",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
-		Active:   false,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "gadget",
-	})
-
-	_, err := snapstate.Remove(s.state, "brand-gadget", snap.R(7), nil)
-
-	c.Check(err, ErrorMatches, `snap "brand-gadget" is not removable: snap is used by the model`)
-}
-
-func (s *snapmgrTestSuite) TestRemoveDeletesConfigOnLastRevision(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	snapstate.Set(s.state, "another-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "bar")
-	tr.Commit()
-
-	// a config for some other snap to verify its not accidentally destroyed
-	tr = config.NewTransaction(s.state)
-	tr.Set("another-snap", "bar", "baz")
-	tr.Commit()
-
-	var res string
-	tr = config.NewTransaction(s.state)
-	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
-	c.Assert(tr.Get("another-snap", "bar", &res), IsNil)
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap", snap.R(0), nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, Equals, state.ErrNoState)
-
-	tr = config.NewTransaction(s.state)
-	err = tr.Get("some-snap", "foo", &res)
-	c.Assert(err, NotNil)
-	c.Assert(err, ErrorMatches, `snap "some-snap" has no "foo" configuration option`)
-
-	// and another snap has its config intact
-	c.Assert(tr.Get("another-snap", "bar", &res), IsNil)
-	c.Assert(res, Equals, "baz")
-}
-
-func (s *snapmgrTestSuite) TestRemoveDoesntDeleteConfigIfNotLastRevision(c *C) {
-	si1 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-	si2 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(8),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si1, &si2},
-		Current:  si2.Revision,
-		SnapType: "app",
-	})
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "bar")
-	tr.Commit()
-
-	var res string
-	tr = config.NewTransaction(s.state)
-	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
-
-	chg := s.state.NewChange("remove", "remove a snap")
-	ts, err := snapstate.Remove(s.state, "some-snap", si1.Revision, nil)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	tr = config.NewTransaction(s.state)
-	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
-	c.Assert(res, Equals, "bar")
-}
-
-func (s *snapmgrTestSuite) TestUpdateMakesConfigSnapshot(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	tr := config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "bar")
-	tr.Commit()
-
-	var cfgs map[string]interface{}
-	// we don't have config snapshots yet
-	c.Assert(s.state.Get("revision-config", &cfgs), Equals, state.ErrNoState)
-
-	chg := s.state.NewChange("update", "update a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(2)}
-	ts, err := snapstate.Update(s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-
-	s.state.Lock()
-	cfgs = nil
-	// config copy of rev. 1 has been made
-	c.Assert(s.state.Get("revision-config", &cfgs), IsNil)
-	c.Assert(cfgs["some-snap"], DeepEquals, map[string]interface{}{
-		"1": map[string]interface{}{
-			"foo": "bar",
-		},
-	})
-}
-
-func (s *snapmgrTestSuite) TestRevertRestoresConfigSnapshot(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", Revision: snap.R(2)},
-		},
-		Current:  snap.R(2),
-		SnapType: "app",
-	})
-
-	// set configuration for current snap
-	tr := config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "100")
-	tr.Commit()
-
-	// make config snapshot for rev.1
-	config.SaveRevisionConfig(s.state, "some-snap", snap.R(1))
-
-	// modify for rev. 2
-	tr = config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "200")
-	tr.Commit()
-
-	chg := s.state.NewChange("revert", "revert snap")
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-
-	s.state.Lock()
-	// config snapshot of rev. 2 has been made by 'revert'
-	var cfgs map[string]interface{}
-	c.Assert(s.state.Get("revision-config", &cfgs), IsNil)
-	c.Assert(cfgs["some-snap"], DeepEquals, map[string]interface{}{
-		"1": map[string]interface{}{"foo": "100"},
-		"2": map[string]interface{}{"foo": "200"},
-	})
-
-	// current snap configuration has been restored from rev. 1 config snapshot
-	tr = config.NewTransaction(s.state)
-	var res string
-	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
-	c.Assert(res, Equals, "100")
-}
-
-func (s *snapmgrTestSuite) TestRefreshDoesntRestoreRevisionConfig(c *C) {
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	// set global configuration (affecting current snap)
-	tr := config.NewTransaction(s.state)
-	tr.Set("some-snap", "foo", "100")
-	tr.Commit()
-
-	// set per-revision config for the upcoming rev. 2, we don't expect it restored though
-	// since only revert restores revision configs.
-	s.state.Set("revision-config", map[string]interface{}{
-		"some-snap": map[string]interface{}{
-			"2": map[string]interface{}{"foo": "200"},
-		},
-	})
-
-	// simulate a refresh to rev. 2
-	chg := s.state.NewChange("update", "update some-snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(2)}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-
-	s.state.Lock()
-	// config of rev. 1 has been stored in per-revision map
-	var cfgs map[string]interface{}
-	c.Assert(s.state.Get("revision-config", &cfgs), IsNil)
-	c.Assert(cfgs["some-snap"], DeepEquals, map[string]interface{}{
-		"1": map[string]interface{}{"foo": "100"},
-		"2": map[string]interface{}{"foo": "200"},
-	})
-
-	// config of rev. 2 hasn't been restored by refresh, old value returned
-	tr = config.NewTransaction(s.state)
-	var res string
-	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
-	c.Assert(res, Equals, "100")
-}
-
-func (s *snapmgrTestSuite) TestUpdateDoesGC(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
-		},
-		Current:  snap.R(4),
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("update", "update a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure garbage collection runs as the last tasks
-	expectedTail := fakeOps{
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/1"),
-			stype: "app",
-		},
-		{
-			op:   "remove-snap-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:    "remove-snap-files",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-			stype: "app",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-	}
-
-	opsTail := s.fakeBackend.ops[len(s.fakeBackend.ops)-len(expectedTail):]
-	c.Assert(opsTail.Ops(), DeepEquals, expectedTail.Ops())
-	c.Check(opsTail, DeepEquals, expectedTail)
-}
-
-func (s *snapmgrTestSuite) TestRevertNoRevertAgain(c *C) {
-	siNew := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(77),
-	}
-
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si, &siNew},
-		Current:  snap.R(7),
-	})
-
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, "no revision to revert to")
-	c.Assert(ts, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestRevertNothingToRevertTo(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-	})
-
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, "no revision to revert to")
-	c.Assert(ts, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestRevertToRevisionNoValidVersion(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-	si2 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(77),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si, &si2},
-		Current:  snap.R(77),
-	})
-
-	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R("99"), snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `cannot find revision 99 for snap "some-snap"`)
-	c.Assert(ts, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestRevertToRevisionAlreadyCurrent(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-	si2 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(77),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si, &si2},
-		Current:  snap.R(77),
-	})
-
-	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R("77"), snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `already on requested revision`)
-	c.Assert(ts, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestRevertRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-	siOld := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
-		Sequence: []*snap.SideInfo{&siOld, &si},
-		Current:  si.Revision,
-	})
-
-	chg := s.state.NewChange("revert", "revert a snap backwards")
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(2),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				Revision: snap.R(2),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(2),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify that the R(2) version is active now and R(7) is still there
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Current, Equals, snap.R(2))
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "",
-		Revision: snap.R(2),
-	})
-	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-	c.Assert(snapst.Block(), DeepEquals, []snap.Revision{snap.R(7)})
-}
-
-func (s *snapmgrTestSuite) TestRevertWithBaseRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap-with-base",
-		Revision: snap.R(7),
-	}
-	siOld := snap.SideInfo{
-		RealName: "some-snap-with-base",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// core18 with snapd, no core snap
-	snapstate.Set(s.state, "core", nil)
-	snapstate.Set(s.state, "core18", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "core18", SnapID: "core18-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "base",
-	})
-	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "snapd", SnapID: "snapd-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	// test snap to revert
-	snapstate.Set(s.state, "some-snap-with-base", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
-		Sequence: []*snap.SideInfo{&siOld, &si},
-		Current:  si.Revision,
-	})
-
-	chg := s.state.NewChange("revert", "revert a snap backwards")
-	ts, err := snapstate.Revert(s.state, "some-snap-with-base", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap-with-base",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap-with-base/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap-with-base",
-			revno: snap.R(2),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap-with-base",
-				Revision: snap.R(2),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap-with-base/2"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap-with-base",
-			revno: snap.R(2),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify that the R(2) version is active now and R(7) is still there
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap-with-base", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Current, Equals, snap.R(2))
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceRevertRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-	siOld := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Active:      true,
-		SnapType:    "app",
-		Sequence:    []*snap.SideInfo{&siOld, &si},
-		Current:     si.Revision,
-		InstanceKey: "instance",
-	})
-
-	// another snap withouth instance key
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
-		Sequence: []*snap.SideInfo{&siOld, &si},
-		Current:  si.Revision,
-	})
-
-	chg := s.state.NewChange("revert", "revert a snap backwards")
-	ts, err := snapstate.Revert(s.state, "some-snap_instance", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap_instance",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(2),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				Revision: snap.R(2),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/2"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(2),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify that the R(2) version is active now and R(7) is still there
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Current, Equals, snap.R(2))
-	c.Assert(snapst.InstanceKey, Equals, "instance")
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "",
-		Revision: snap.R(2),
-	})
-	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		Channel:  "",
-		Revision: snap.R(7),
-	})
-	c.Assert(snapst.Block(), DeepEquals, []snap.Revision{snap.R(7)})
-
-	// non instance snap is not affected
-	var nonInstanceSnapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &nonInstanceSnapst)
-	c.Assert(err, IsNil)
-	c.Assert(nonInstanceSnapst.Current, Equals, snap.R(7))
-
-}
-
-func (s *snapmgrTestSuite) TestRevertWithLocalRevisionRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(-7),
-	}
-	siOld := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(-2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
-		Sequence: []*snap.SideInfo{&siOld, &si},
-		Current:  si.Revision,
-	})
-
-	chg := s.state.NewChange("revert", "revert a snap backwards")
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(s.fakeBackend.ops.Ops(), HasLen, 7)
-
-	// verify that LocalRevision is still -7
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.LocalRevision(), Equals, snap.R(-7))
-}
-
-func (s *snapmgrTestSuite) TestRevertToRevisionNewVersion(c *C) {
-	siNew := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-		SnapID:   "october",
-	}
-
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-		SnapID:   "october",
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		SnapType:        "app",
-		Sequence:        []*snap.SideInfo{&si, &siNew},
-		Current:         snap.R(2),
-		TrackingChannel: "latest/edge",
-	})
-
-	chg := s.state.NewChange("revert", "revert a snap forward")
-	ts, err := snapstate.RevertToRevision(s.state, "some-snap", snap.R(7), snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op:    "candidate",
-			sinfo: siNew,
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify that the R(7) version is active now
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Check(snapst.Active, Equals, true)
-	c.Check(snapst.Current, Equals, snap.R(7))
-	c.Check(snapst.Sequence, HasLen, 2)
-	c.Check(snapst.TrackingChannel, Equals, "latest/edge")
-	c.Check(snapst.CurrentSideInfo(), DeepEquals, &siNew)
-
-	c.Check(snapst.Block(), HasLen, 0)
-}
-
-func (s *snapmgrTestSuite) TestRevertTotalUndoRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(1),
-	}
-	si2 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
-		Sequence: []*snap.SideInfo{&si, &si2},
-		Current:  si2.Revision,
-	})
-
-	chg := s.state.NewChange("revert", "revert a snap")
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	tasks := ts.Tasks()
-	last := tasks[len(tasks)-1]
-
-	terr := s.state.NewTask("error-trigger", "provoking total undo")
-	terr.WaitFor(last)
-	chg.AddTask(terr)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(1),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				Revision: snap.R(1),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(1),
-		},
-		{
-			op: "update-aliases",
-		},
-		// undoing everything from here down...
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op: "current-snap-service-states",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
-		},
-		{
-			op:    "setup-profiles:Undoing",
-			name:  "some-snap",
-			revno: snap.R(1),
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Check(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Current, Equals, si2.Revision)
-}
-
-func (s *snapmgrTestSuite) TestRevertUndoRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(1),
-	}
-	si2 := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(2),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		SnapType: "app",
-		Sequence: []*snap.SideInfo{&si, &si2},
-		Current:  si2.Revision,
-	})
-
-	chg := s.state.NewChange("revert", "install a revert")
-	ts, err := snapstate.Revert(s.state, "some-snap", snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "some-snap/1")
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(1),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				Revision: snap.R(1),
-			},
-		},
-		{
-			op:   "link-snap.failed",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
-		},
-		// undo stuff here
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
-		},
-		{
-			op:    "setup-profiles:Undoing",
-			name:  "some-snap",
-			revno: snap.R(1),
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-
-	// ensure all our tasks ran
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	// verify snaps in the system state
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence, HasLen, 2)
-	c.Assert(snapst.Current, Equals, snap.R(2))
-}
-
-func (s *snapmgrTestSuite) TestEnableDoesNotEnableAgain(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{&si},
-		Current:  snap.R(7),
-		Active:   true,
-	})
-
-	ts, err := snapstate.Enable(s.state, "some-snap")
-	c.Assert(err, ErrorMatches, `snap "some-snap" already enabled`)
-	c.Assert(ts, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestEnableRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-		Channel:  "edge",
-		SnapID:   "foo",
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	flags := snapstate.Flags{
-		DevMode:  true,
-		JailMode: true,
-		Classic:  true,
-		TryMode:  true,
-		Required: true,
-	}
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence:            []*snap.SideInfo{&si},
-		Current:             si.Revision,
-		Active:              false,
-		TrackingChannel:     "latest/edge",
-		Flags:               flags,
-		AliasesPending:      true,
-		AutoAliasesDisabled: true,
-	})
-
-	chg := s.state.NewChange("enable", "enable a snap")
-	ts, err := snapstate.Enable(s.state, "some-snap")
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op:    "candidate",
-			sinfo: si,
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.Flags, DeepEquals, flags)
-
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.AliasesPending, Equals, false)
-	c.Assert(snapst.AutoAliasesDisabled, Equals, true)
-
-	info, err := snapst.CurrentInfo()
-	c.Assert(err, IsNil)
-	c.Assert(info.Channel, Equals, "edge")
-	c.Assert(info.SnapID, Equals, "foo")
-
-	first := ts.Tasks()[0]
-	snapsup, err := snapstate.TaskSnapSetup(first)
-	c.Assert(err, IsNil)
-	c.Check(snapsup, DeepEquals, &snapstate.SnapSetup{
-		SideInfo:  &si,
-		Flags:     flags,
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-}
-
-func (s *snapmgrTestSuite) TestDisableRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		Active:   true,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("disable", "disable a snap")
-	ts, err := snapstate.Disable(s.state, "some-snap")
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "remove-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Assert(snapst.Active, Equals, false)
-	c.Assert(snapst.AliasesPending, Equals, true)
-
-	first := ts.Tasks()[0]
-	snapsup, err := snapstate.TaskSnapSetup(first)
-	c.Assert(err, IsNil)
-	c.Check(snapsup, DeepEquals, &snapstate.SnapSetup{
-		SideInfo: &snap.SideInfo{
-			RealName: "some-snap",
-			Revision: snap.R(7),
-		},
-		Type:      snap.TypeApp,
-		PlugsOnly: true,
-	})
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceEnableRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-		Channel:  "edge",
-		SnapID:   "foo",
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	flags := snapstate.Flags{
-		DevMode:  true,
-		JailMode: true,
-		Classic:  true,
-		TryMode:  true,
-		Required: true,
-	}
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Sequence:            []*snap.SideInfo{&si},
-		Current:             si.Revision,
-		Active:              false,
-		TrackingChannel:     "latest/edge",
-		Flags:               flags,
-		AliasesPending:      true,
-		AutoAliasesDisabled: true,
-		InstanceKey:         "instance",
-	})
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence:            []*snap.SideInfo{&si},
-		Current:             si.Revision,
-		Active:              false,
-		TrackingChannel:     "latest/edge",
-		Flags:               flags,
-		AliasesPending:      true,
-		AutoAliasesDisabled: true,
-	})
-
-	chg := s.state.NewChange("enable", "enable a snap")
-	ts, err := snapstate.Enable(s.state, "some-snap_instance")
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
-		},
-		{
-			op:    "candidate",
-			sinfo: si,
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
-		},
-		{
-			op: "update-aliases",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.Flags, DeepEquals, flags)
-
-	c.Assert(snapst.InstanceKey, Equals, "instance")
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.AliasesPending, Equals, false)
-	c.Assert(snapst.AutoAliasesDisabled, Equals, true)
-
-	info, err := snapst.CurrentInfo()
-	c.Assert(err, IsNil)
-	c.Assert(info.Channel, Equals, "edge")
-	c.Assert(info.SnapID, Equals, "foo")
-
-	// the non-parallel instance is still disabled
-	snapst = snapstate.SnapState{}
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Assert(snapst.InstanceKey, Equals, "")
-	c.Assert(snapst.Active, Equals, false)
-}
-
-func (s *snapmgrTestSuite) TestParallelInstanceDisableRunThrough(c *C) {
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		Active:   true,
-	})
-	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
-		Sequence:    []*snap.SideInfo{&si},
-		Current:     si.Revision,
-		Active:      true,
-		InstanceKey: "instance",
-	})
-
-	chg := s.state.NewChange("disable", "disable a snap")
-	ts, err := snapstate.Disable(s.state, "some-snap_instance")
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap_instance",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap_instance/7"),
-		},
-		{
-			op:    "remove-profiles:Doing",
-			name:  "some-snap_instance",
-			revno: snap.R(7),
+			op:    "remove-profiles:Doing",
+			name:  "some-snap_instance",
+			revno: snap.R(7),
 		},
 	}
 	// start with an easier-to-read error if this fails:
@@ -10231,88 +2533,6 @@
 	c.Assert(info.Channel, Equals, t.chanFrom, comment)
 }
 
-func (s *snapmgrTestSuite) TestUpdateScenarios(c *C) {
-	// TODO: also use channel-for-7 or equiv to check updates that are switches
-	for k, t := range switchScenarios {
-		s.testUpdateScenario(c, k, t)
-	}
-}
-
-func (s *snapmgrTestSuite) testUpdateScenario(c *C, desc string, t switchScenario) {
-	// reset
-	s.fakeBackend.ops = nil
-
-	comment := Commentf("%q (%+v)", desc, t)
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		Revision: snap.R(7),
-		Channel:  t.chanFrom,
-		SnapID:   "some-snap-id",
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence:        []*snap.SideInfo{&si},
-		Active:          true,
-		Current:         si.Revision,
-		TrackingChannel: t.chanFrom,
-		CohortKey:       t.cohFrom,
-	})
-
-	chg := s.state.NewChange("update-snap", t.summary)
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{
-		Channel:     t.chanTo,
-		CohortKey:   t.cohTo,
-		LeaveCohort: t.cohFrom != "" && t.cohTo == "",
-	}, 0, snapstate.Flags{})
-	c.Assert(err, IsNil, comment)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	s.settle(c)
-	s.state.Lock()
-
-	// switch is not really really doing anything backend related
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, []string{
-		"storesvc-snap-action",
-		"storesvc-snap-action:action",
-		"storesvc-download",
-		"validate-snap:Doing",
-		"current",
-		"open-snap-file",
-		"setup-snap",
-		"remove-snap-aliases",
-		"unlink-snap",
-		"copy-data",
-		"setup-profiles:Doing",
-		"candidate",
-		"link-snap",
-		"auto-connect:Doing",
-		"update-aliases",
-		"cleanup-trash",
-	}, comment)
-
-	expectedChanTo := t.chanTo
-	if t.chanTo == "" {
-		expectedChanTo = t.chanFrom
-	}
-	expectedCohTo := t.cohTo
-
-	// ensure the desired channel/cohort has changed
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil, comment)
-	c.Assert(snapst.TrackingChannel, Equals, expectedChanTo, comment)
-	c.Assert(snapst.CohortKey, Equals, expectedCohTo, comment)
-
-	// ensure the current info *has* changed
-	info, err := snapst.CurrentInfo()
-	c.Assert(err, IsNil, comment)
-	c.Assert(info.Channel, Equals, expectedChanTo, comment)
-}
-
 func (s *snapmgrTestSuite) TestParallelInstallSwitchRunThrough(c *C) {
 	si := snap.SideInfo{
 		RealName: "some-snap",
@@ -10361,7 +2581,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(info.Channel, Equals, "edge")
 
-	// Ensure that the non-intance snap is unchanged
+	// Ensure that the non-instance snap is unchanged
 	var nonInstanceSnapst snapstate.SnapState
 	err = snapstate.Get(s.state, "some-snap", &nonInstanceSnapst)
 	c.Assert(err, IsNil)
@@ -10375,208 +2595,17 @@
 	}
 
 	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{&si},
-		Current:  snap.R(7),
-		Active:   false,
-	})
-
-	ts, err := snapstate.Disable(s.state, "some-snap")
-	c.Assert(err, ErrorMatches, `snap "some-snap" already disabled`)
-	c.Assert(ts, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestUndoMountSnapFailsInCopyData(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.fakeBackend.copySnapDataFailTrigger = filepath.Join(dirs.SnapMountDir, "some-snap/11")
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	expected := fakeOps{
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap",
-				Channel:      "some-channel",
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "some-channel",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "copy-data.failed",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			old:  "<no-old>",
-		},
-		{
-			op:   "remove-snap-data-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapDataDir, "some-snap"),
-		},
-		{
-			op:    "undo-setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-			stype: "app",
-		},
-		{
-			op:   "remove-snap-dir",
-			name: "some-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-}
-
-func (s *snapmgrTestSuite) TestRefreshFailureCausesErrorReport(c *C) {
-	var errSnap, errMsg, errSig string
-	var errExtra map[string]string
-	var n int
-	restore := snapstate.MockErrtrackerReport(func(aSnap, aErrMsg, aDupSig string, extra map[string]string) (string, error) {
-		errSnap = aSnap
-		errMsg = aErrMsg
-		errSig = aDupSig
-		errExtra = extra
-		n += 1
-		return "oopsid", nil
-	})
-	defer restore()
-
-	si := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	s.state.Set("ubuntu-core-transition-retry", 7)
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si},
-		Current:  si.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("install", "install a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "some-snap/11")
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
+	defer s.state.Unlock()
 
-	// verify we generated a failure report
-	c.Check(n, Equals, 1)
-	c.Check(errSnap, Equals, "some-snap")
-	c.Check(errExtra, DeepEquals, map[string]string{
-		"UbuntuCoreTransitionCount": "7",
-		"Channel":                   "some-channel",
-		"Revision":                  "11",
-	})
-	c.Check(errMsg, Matches, `(?sm)change "install": "install a snap"
-prerequisites: Undo
- snap-setup: "some-snap" \(11\) "some-channel"
-download-snap: Undoing
-validate-snap: Done
-.*
-link-snap: Error
- INFO unlink
- ERROR fail
-auto-connect: Hold
-set-auto-aliases: Hold
-setup-aliases: Hold
-run-hook: Hold
-start-snap-services: Hold
-cleanup: Hold
-run-hook: Hold`)
-	c.Check(errSig, Matches, `(?sm)snap-install:
-prerequisites: Undo
- snap-setup: "some-snap"
-download-snap: Undoing
-validate-snap: Done
-.*
-link-snap: Error
- INFO unlink
- ERROR fail
-auto-connect: Hold
-set-auto-aliases: Hold
-setup-aliases: Hold
-run-hook: Hold
-start-snap-services: Hold
-cleanup: Hold
-run-hook: Hold`)
-
-	// run again with empty "ubuntu-core-transition-retry"
-	s.state.Set("ubuntu-core-transition-retry", 0)
-	chg = s.state.NewChange("install", "install a snap")
-	ts, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-	// verify that we excluded this field from the bugreport
-	c.Check(n, Equals, 2)
-	c.Check(errExtra, DeepEquals, map[string]string{
-		"Channel":  "some-channel",
-		"Revision": "11",
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{&si},
+		Current:  snap.R(7),
+		Active:   false,
 	})
 
+	ts, err := snapstate.Disable(s.state, "some-snap")
+	c.Assert(err, ErrorMatches, `snap "some-snap" already disabled`)
+	c.Assert(ts, IsNil)
 }
 
 func (s *snapmgrTestSuite) TestAbortCausesNoErrReport(c *C) {
@@ -11199,7 +3228,7 @@
 	c.Assert(l, HasLen, 1)
 }
 
-func (s *snapmgrTestSuite) TestWaitRestartBasics(c *C) {
+func (s *snapmgrTestSuite) TestFinishRestartBasics(c *C) {
 	r := release.MockOnClassic(true)
 	defer r()
 
@@ -11214,15 +3243,77 @@
 	si := &snap.SideInfo{RealName: "some-app"}
 	snaptest.MockSnap(c, "name: some-app\nversion: 1", si)
 	snapsup := &snapstate.SnapSetup{SideInfo: si}
-	err := snapstate.WaitRestart(task, snapsup)
+	err := snapstate.FinishRestart(task, snapsup)
 	c.Check(err, IsNil)
 
 	// restarting ... we always wait
 	state.MockRestarting(st, state.RestartDaemon)
-	err = snapstate.WaitRestart(task, snapsup)
+	err = snapstate.FinishRestart(task, snapsup)
 	c.Check(err, FitsTypeOf, &state.Retry{})
 }
 
+func (s *snapmgrTestSuite) TestFinishRestartGeneratesSnapdWrappersOnCore(c *C) {
+	r := release.MockOnClassic(false)
+	defer r()
+
+	var generateWrappersCalled bool
+	restore := snapstate.MockGenerateSnapdWrappers(func(snapInfo *snap.Info) error {
+		c.Assert(snapInfo.SnapName(), Equals, "snapd")
+		generateWrappersCalled = true
+		return nil
+	})
+	defer restore()
+
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	for i, tc := range []struct {
+		onClassic            bool
+		expectedWrappersCall bool
+		snapName             string
+		snapYaml             string
+	}{
+		{
+			onClassic: false,
+			snapName:  "snapd",
+			snapYaml: `name: snapd
+type: snapd
+`,
+			expectedWrappersCall: true,
+		},
+		{
+			onClassic: true,
+			snapName:  "snapd",
+			snapYaml: `name: snapd
+type: snapd
+`,
+			expectedWrappersCall: false,
+		},
+		{
+			onClassic:            false,
+			snapName:             "some-snap",
+			snapYaml:             `name: some-snap`,
+			expectedWrappersCall: false,
+		},
+	} {
+		generateWrappersCalled = false
+		release.MockOnClassic(tc.onClassic)
+
+		task := st.NewTask("auto-connect", "...")
+		si := &snap.SideInfo{Revision: snap.R("x2"), RealName: tc.snapName}
+		snapInfo := snaptest.MockSnapCurrent(c, string(tc.snapYaml), si)
+		snapsup := &snapstate.SnapSetup{SideInfo: si, Type: snapInfo.SnapType}
+
+		// restarting
+		state.MockRestarting(st, state.RestartUnset)
+		c.Assert(snapstate.FinishRestart(task, snapsup), IsNil)
+		c.Check(generateWrappersCalled, Equals, tc.expectedWrappersCall, Commentf("#%d: %v", i, tc))
+
+		c.Assert(os.RemoveAll(filepath.Join(snap.BaseDir(snapInfo.SnapName()), "current")), IsNil)
+	}
+}
+
 type snapmgrQuerySuite struct {
 	st      *state.State
 	restore func()
@@ -11472,7 +3563,7 @@
 	c.Check(info.InstanceName(), Equals, "gadget")
 	c.Check(info.Revision, Equals, snap.R(2))
 	c.Check(info.Version, Equals, "v1")
-	c.Check(info.GetType(), Equals, snap.TypeGadget)
+	c.Check(info.Type(), Equals, snap.TypeGadget)
 }
 
 func (s *snapmgrQuerySuite) TestKernelInfo(c *C) {
@@ -11517,7 +3608,7 @@
 	c.Check(info.InstanceName(), Equals, "pc-kernel")
 	c.Check(info.Revision, Equals, snap.R(3))
 	c.Check(info.Version, Equals, "v2")
-	c.Check(info.GetType(), Equals, snap.TypeKernel)
+	c.Check(info.Type(), Equals, snap.TypeKernel)
 }
 
 func (s *snapmgrQuerySuite) TestBootBaseInfo(c *C) {
@@ -11574,7 +3665,7 @@
 	c.Check(info.InstanceName(), Equals, "core20")
 	c.Check(info.Revision, Equals, snap.R(4))
 	c.Check(info.Version, Equals, "v20")
-	c.Check(info.GetType(), Equals, snap.TypeBase)
+	c.Check(info.Type(), Equals, snap.TypeBase)
 }
 
 func (s *snapmgrQuerySuite) TestCoreInfoInternal(c *C) {
@@ -11631,7 +3722,7 @@
 		} else {
 			c.Assert(info, NotNil)
 			c.Check(info.InstanceName(), Equals, t.expectedSnap, Commentf("(%d) test %q %v", testNr, t.expectedSnap, t.snapNames))
-			c.Check(info.GetType(), Equals, snap.TypeOS)
+			c.Check(info.Type(), Equals, snap.TypeOS)
 		}
 	}
 }
@@ -11801,139 +3892,6 @@
 	c.Check(n, Equals, 0)
 }
 
-func (s *snapmgrTestSuite) TestTrySetsTryMode(c *C) {
-	s.testTrySetsTryMode(snapstate.Flags{}, c)
-}
-
-func (s *snapmgrTestSuite) TestTrySetsTryModeDevMode(c *C) {
-	s.testTrySetsTryMode(snapstate.Flags{DevMode: true}, c)
-}
-func (s *snapmgrTestSuite) TestTrySetsTryModeJailMode(c *C) {
-	s.testTrySetsTryMode(snapstate.Flags{JailMode: true}, c)
-}
-func (s *snapmgrTestSuite) TestTrySetsTryModeClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-
-	s.testTrySetsTryMode(snapstate.Flags{Classic: true}, c, "confinement: classic\n")
-}
-
-func (s *snapmgrTestSuite) testTrySetsTryMode(flags snapstate.Flags, c *C, extraYaml ...string) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// make mock try dir
-	d := c.MkDir()
-	c.Assert(os.Chmod(d, 0755), IsNil)
-	tryYaml := filepath.Join(d, "meta", "snap.yaml")
-	err := os.MkdirAll(filepath.Dir(tryYaml), 0755)
-	c.Assert(err, IsNil)
-	buf := bytes.Buffer{}
-	buf.WriteString("name: foo\nversion: 1.0\n")
-	if len(extraYaml) > 0 {
-		for _, extra := range extraYaml {
-			buf.WriteString(extra)
-		}
-	}
-	err = ioutil.WriteFile(tryYaml, buf.Bytes(), 0644)
-	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("try", "try snap")
-	ts, err := snapstate.TryPath(s.state, "foo", d, flags)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// verify snap is in TryMode
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "foo", &snapst)
-	c.Assert(err, IsNil)
-
-	flags.TryMode = true
-	c.Check(snapst.Flags, DeepEquals, flags)
-
-	c.Check(s.state.TaskCount(), Equals, len(ts.Tasks()))
-	c.Check(taskKinds(ts.Tasks()), DeepEquals, []string{
-		"prerequisites",
-		"prepare-snap",
-		"mount-snap",
-		"copy-snap-data",
-		"setup-profiles",
-		"link-snap",
-		"auto-connect",
-		"set-auto-aliases",
-		"setup-aliases",
-		"run-hook[install]",
-		"start-snap-services",
-		"run-hook[configure]",
-		"run-hook[check-health]",
-	})
-
-}
-
-func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlag(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-	s.testTrySetsTryMode(snapstate.Flags{}, c)
-}
-
-func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlagLeavesDevMode(c *C) {
-	s.testTrySetsTryMode(snapstate.Flags{DevMode: true}, c)
-}
-func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlagLeavesJailMode(c *C) {
-	s.testTrySetsTryMode(snapstate.Flags{JailMode: true}, c)
-}
-func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlagLeavesClassic(c *C) {
-	restore := maybeMockClassicSupport(c)
-	defer restore()
-	s.testTrySetsTryMode(snapstate.Flags{Classic: true}, c, "confinement: classic\n")
-}
-
-func (s *snapmgrTestSuite) testTryUndoRemovesTryFlag(flags snapstate.Flags, c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// simulate existing state for foo
-	var snapst snapstate.SnapState
-	snapst.Sequence = []*snap.SideInfo{
-		{
-			RealName: "foo",
-			Revision: snap.R(23),
-		},
-	}
-	snapst.Flags = flags
-	snapst.Current = snap.R(23)
-	snapstate.Set(s.state, "foo", &snapst)
-	c.Check(snapst.TryMode, Equals, false)
-
-	chg := s.state.NewChange("try", "try snap")
-	ts, err := snapstate.TryPath(s.state, "foo", c.MkDir(), flags)
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	last := ts.Tasks()[len(ts.Tasks())-1]
-	terr := s.state.NewTask("error-trigger", "provoking total undo")
-	terr.WaitFor(last)
-	chg.AddTask(terr)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snap is not in try mode, the state got undone
-	err = snapstate.Get(s.state, "foo", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.Flags, DeepEquals, flags)
-}
-
 type snapStateSuite struct{}
 
 var _ = Suite(&snapStateSuite{})
@@ -12042,158 +4000,6 @@
 	c.Check(providers, DeepEquals, []string{"common-themes", "some-snap"})
 }
 
-func revs(seq []*snap.SideInfo) []int {
-	revs := make([]int, len(seq))
-	for i, si := range seq {
-		revs[i] = si.Revision.N
-	}
-
-	return revs
-}
-
-type opSeqOpts struct {
-	revert  bool
-	fail    bool
-	before  []int
-	current int
-	via     int
-	after   []int
-}
-
-// build a SnapState with a revision sequence given by `before` and a
-// current revision of `current`. Then refresh --revision via. Then
-// check the revision sequence is as in `after`.
-func (s *snapmgrTestSuite) testOpSequence(c *C, opts *opSeqOpts) (*snapstate.SnapState, *state.TaskSet) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	seq := make([]*snap.SideInfo, len(opts.before))
-	for i, n := range opts.before {
-		seq[i] = &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(n)}
-	}
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        seq,
-		Current:         snap.R(opts.current),
-		SnapType:        "app",
-	})
-
-	var chg *state.Change
-	var ts *state.TaskSet
-	var err error
-	if opts.revert {
-		chg = s.state.NewChange("revert", "revert a snap")
-		ts, err = snapstate.RevertToRevision(s.state, "some-snap", snap.R(opts.via), snapstate.Flags{})
-	} else {
-		chg = s.state.NewChange("refresh", "refresh a snap")
-		ts, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Revision: snap.R(opts.via)}, s.user.ID, snapstate.Flags{})
-	}
-	c.Assert(err, IsNil)
-	if opts.fail {
-		tasks := ts.Tasks()
-		var last *state.Task
-		// don't make a task wait on rerefresh, that's bad
-		for i := len(tasks) - 1; i > 0; i-- {
-			last = tasks[i]
-			if last.Kind() != "check-rerefresh" {
-				break
-			}
-		}
-		terr := s.state.NewTask("error-trigger", "provoking total undo")
-		terr.WaitFor(last)
-		if len(last.Lanes()) > 0 {
-			lanes := last.Lanes()
-			// sanity
-			c.Assert(lanes, HasLen, 1)
-			terr.JoinLane(lanes[0])
-		}
-		chg.AddTask(terr)
-	}
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(revs(snapst.Sequence), DeepEquals, opts.after)
-
-	return &snapst, ts
-}
-
-func (s *snapmgrTestSuite) testUpdateSequence(c *C, opts *opSeqOpts) *state.TaskSet {
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	opts.revert = false
-	snapst, ts := s.testOpSequence(c, opts)
-	// update always ends with current==seq[-1]==via:
-	c.Check(snapst.Current.N, Equals, opts.after[len(opts.after)-1])
-	c.Check(snapst.Current.N, Equals, opts.via)
-
-	c.Check(s.fakeBackend.ops.Count("copy-data"), Equals, 1)
-	c.Check(s.fakeBackend.ops.First("copy-data"), DeepEquals, &fakeOp{
-		op:   "copy-data",
-		path: fmt.Sprintf(filepath.Join(dirs.SnapMountDir, "some-snap/%d"), opts.via),
-		old:  fmt.Sprintf(filepath.Join(dirs.SnapMountDir, "some-snap/%d"), opts.current),
-	})
-
-	return ts
-}
-
-func (s *snapmgrTestSuite) testUpdateFailureSequence(c *C, opts *opSeqOpts) *state.TaskSet {
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	opts.revert = false
-	opts.after = opts.before
-	s.fakeBackend.linkSnapFailTrigger = fmt.Sprintf(filepath.Join(dirs.SnapMountDir, "some-snap/%d"), opts.via)
-	snapst, ts := s.testOpSequence(c, opts)
-	// a failed update will always end with current unchanged
-	c.Check(snapst.Current.N, Equals, opts.current)
-
-	ops := s.fakeBackend.ops
-	c.Check(ops.Count("copy-data"), Equals, 1)
-	do := ops.First("copy-data")
-
-	c.Check(ops.Count("undo-copy-snap-data"), Equals, 1)
-	undo := ops.First("undo-copy-snap-data")
-
-	do.op = undo.op
-	c.Check(do, DeepEquals, undo) // i.e. they only differed in the op
-
-	return ts
-}
-
-// testTotal*Failure fails *after* link-snap
-func (s *snapmgrTestSuite) testTotalUpdateFailureSequence(c *C, opts *opSeqOpts) *state.TaskSet {
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	opts.revert = false
-	opts.fail = true
-	snapst, ts := s.testOpSequence(c, opts)
-	// a failed update will always end with current unchanged
-	c.Check(snapst.Current.N, Equals, opts.current)
-
-	ops := s.fakeBackend.ops
-	c.Check(ops.Count("copy-data"), Equals, 1)
-	do := ops.First("copy-data")
-
-	c.Check(ops.Count("undo-copy-snap-data"), Equals, 1)
-	undo := ops.First("undo-copy-snap-data")
-
-	do.op = undo.op
-	c.Check(do, DeepEquals, undo) // i.e. they only differed in the op
-
-	return ts
-}
-
 func (s *snapmgrTestSuite) testRevertSequence(c *C, opts *opSeqOpts) *state.TaskSet {
 	opts.revert = true
 	opts.after = opts.before
@@ -12364,140 +4170,16 @@
 
 	for i := 2; i <= 10; i++ {
 		// wot, me, hacky?
-		s.TearDownTest(c)
-		s.SetUpTest(c)
-		s.state.Lock()
-		tr := config.NewTransaction(s.state)
-		tr.Set("core", "refresh.retain", i)
-		tr.Commit()
-		s.state.Unlock()
-
-		s.testUpdateSequence(c, &opSeqOpts{before: revseq[:9], current: 9, via: 10, after: revseq[10-i:]})
-	}
-}
-
-func (s *snapmgrTestSuite) TestUpdateTasksWithOldCurrent(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-	restore := release.MockOnClassic(false)
-	defer restore()
-
-	si1 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}
-	si2 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)}
-	si3 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)}
-	si4 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)}
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "latest/edge",
-		Sequence:        []*snap.SideInfo{si1, si2, si3, si4},
-		Current:         snap.R(2),
-		SnapType:        "app",
-	})
-
-	// run the update
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 2, ts, s.state)
-
-	// and ensure that it will remove the revisions after "current"
-	// (si3, si4)
-	var snapsup snapstate.SnapSetup
-	tasks := ts.Tasks()
-
-	i := len(tasks) - 8
-	c.Check(tasks[i].Kind(), Equals, "clear-snap")
-	err = tasks[i].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Revision(), Equals, si3.Revision)
-
-	i = len(tasks) - 6
-	c.Check(tasks[i].Kind(), Equals, "clear-snap")
-	err = tasks[i].Get("snap-setup", &snapsup)
-	c.Assert(err, IsNil)
-	c.Check(snapsup.Revision(), Equals, si4.Revision)
-}
-
-func (s *snapmgrTestSuite) TestUpdateCanDoBackwards(c *C) {
-	si7 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(7),
-	}
-	si11 := snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Revision: snap.R(11),
-	}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{&si7, &si11},
-		Current:  si11.Revision,
-		SnapType: "app",
-	})
-
-	chg := s.state.NewChange("refresh", "refresh a snap")
-	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Revision: snap.R(7)}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
+		s.TearDownTest(c)
+		s.SetUpTest(c)
+		s.state.Lock()
+		tr := config.NewTransaction(s.state)
+		tr.Set("core", "refresh.retain", i)
+		tr.Commit()
+		s.state.Unlock()
 
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "some-snap",
-		},
-		{
-			op:   "unlink-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-			old:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Channel:  "",
-				Revision: snap.R(7),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
-		{
-			op: "update-aliases",
-		},
-		{
-			op:    "cleanup-trash",
-			name:  "some-snap",
-			revno: snap.R(7),
-		},
+		s.testUpdateSequence(c, &opSeqOpts{before: revseq[:9], current: 9, via: 10, after: revseq[10-i:]})
 	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 }
 
 func (s *snapmgrTestSuite) TestSnapStateNoLocalRevision(c *C) {
@@ -12528,105 +4210,6 @@
 	c.Assert(snapst.LocalRevision().Unset(), Equals, true)
 }
 
-func (s *snapmgrTestSuite) TestInstallMany(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	installed, tts, err := snapstate.InstallMany(s.state, []string{"one", "two"}, 0)
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 2)
-	c.Check(installed, DeepEquals, []string{"one", "two"})
-
-	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true)
-
-	for i, ts := range tts {
-		verifyInstallTasks(c, 0, 0, ts, s.state)
-		// check that tasksets are in separate lanes
-		for _, t := range ts.Tasks() {
-			c.Assert(t.Lanes(), DeepEquals, []int{i + 1})
-		}
-	}
-}
-
-func (s *snapmgrTestSuite) TestInstallManyTooEarly(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	s.state.Set("seeded", nil)
-
-	_, _, err := snapstate.InstallMany(s.state, []string{"one", "two"}, 0)
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
-}
-
-func (s *snapmgrTestSuite) TestInstallManyChecksPreconditions(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	_, _, err := snapstate.InstallMany(s.state, []string{"some-snap-now-classic"}, 0)
-	c.Assert(err, NotNil)
-	c.Check(err, DeepEquals, &snapstate.SnapNeedsClassicError{Snap: "some-snap-now-classic"})
-
-	_, _, err = snapstate.InstallMany(s.state, []string{"some-snap_foo"}, 0)
-	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.parallel-instances' to true")
-}
-
-func verifyStopReason(c *C, ts *state.TaskSet, reason string) {
-	tl := tasksWithKind(ts, "stop-snap-services")
-	c.Check(tl, HasLen, 1)
-
-	var stopReason string
-	err := tl[0].Get("stop-reason", &stopReason)
-	c.Assert(err, IsNil)
-	c.Check(stopReason, Equals, reason)
-
-}
-
-func (s *snapmgrTestSuite) TestRemoveMany(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "one", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "one", SnapID: "one-id", Revision: snap.R(1)},
-		},
-		Current: snap.R(1),
-	})
-	snapstate.Set(s.state, "two", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "two", SnapID: "two-id", Revision: snap.R(1)},
-		},
-		Current: snap.R(1),
-	})
-
-	removed, tts, err := snapstate.RemoveMany(s.state, []string{"one", "two"})
-	c.Assert(err, IsNil)
-	c.Assert(tts, HasLen, 2)
-	c.Check(removed, DeepEquals, []string{"one", "two"})
-
-	c.Assert(s.state.TaskCount(), Equals, 8*2)
-	for i, ts := range tts {
-		c.Assert(taskKinds(ts.Tasks()), DeepEquals, []string{
-			"stop-snap-services",
-			"run-hook[remove]",
-			"auto-disconnect",
-			"remove-aliases",
-			"unlink-snap",
-			"remove-profiles",
-			"clear-snap",
-			"discard-snap",
-		})
-		verifyStopReason(c, ts, "remove")
-		// check that tasksets are in separate lanes
-		for _, t := range ts.Tasks() {
-			c.Assert(t.Lanes(), DeepEquals, []int{i + 1})
-		}
-
-	}
-}
-
 func tasksWithKind(ts *state.TaskSet, kind string) []*state.Task {
 	var tasks []*state.Task
 	for _, task := range ts.Tasks() {
@@ -12825,308 +4408,101 @@
 		Sequence: []*snap.SideInfo{
 			{RealName: "some-snap", Revision: snap.R(11), SnapID: "the-core-ididididididididididid"},
 		},
-		Current:  snap.R(11),
-		SnapType: "os",
-	})
-
-	makeInstalledMockCoreSnap(c)
-
-	defls, err := snapstate.ConfigDefaults(s.state, deviceCtx, "core")
-	c.Assert(err, IsNil)
-	c.Assert(defls, DeepEquals, map[string]interface{}{"foo": "bar"})
-}
-
-var snapdSnapYaml = `name: snapd
-version: 1.0
-type: snapd
-`
-
-func (s *snapmgrTestSuite) TestConfigDefaultsSystemWithSnapdNoCore(c *C) {
-	r := release.MockOnClassic(false)
-	defer r()
-
-	// using MockSnapReadInfo, we want to read the bits on disk
-	snapstate.MockSnapReadInfo(snap.ReadInfo)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	s.prepareGadget(c, `
-defaults:
-    system:
-        foo: bar
-`)
-
-	deviceCtx := &snapstatetest.TrivialDeviceContext{
-		DeviceModel: MakeModel(map[string]interface{}{
-			"gadget": "the-gadget",
-			"base":   "the-base",
-		}),
-	}
-
-	snapstate.Set(s.state, "core", nil)
-	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "snapd", SnapID: "the-snapd-snapidididididididididi", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "snapd",
-	})
-
-	snaptest.MockSnap(c, snapdSnapYaml, &snap.SideInfo{
-		RealName: "snapd",
-		Revision: snap.R(1),
-	})
-
-	defls, err := snapstate.ConfigDefaults(s.state, deviceCtx, "core")
-	c.Assert(err, IsNil)
-	c.Assert(defls, DeepEquals, map[string]interface{}{"foo": "bar"})
-}
-
-func (s *snapmgrTestSuite) TestConfigDefaultsSystemConflictsCoreSnapId(c *C) {
-	r := release.MockOnClassic(false)
-	defer r()
-
-	// using MockSnapReadInfo, we want to read the bits on disk
-	snapstate.MockSnapReadInfo(snap.ReadInfo)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	s.prepareGadget(c, `
-defaults:
-    system:
-        foo: bar
-    thecoresnapididididididididididi:
-        foo: other-bar
-        other-key: other-key-default
-`)
-
-	deviceCtx := deviceWithGadgetContext("the-gadget")
-
-	snapstate.Set(s.state, "core", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "core", SnapID: "thecoresnapididididididididididi", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "os",
-	})
-
-	makeInstalledMockCoreSnap(c)
-
-	// 'system' key defaults take precedence over snap-id ones
-	defls, err := snapstate.ConfigDefaults(s.state, deviceCtx, "core")
-	c.Assert(err, IsNil)
-	c.Assert(defls, DeepEquals, map[string]interface{}{"foo": "bar"})
-}
-
-func (s *snapmgrTestSuite) TestGadgetDefaultsAreNormalizedForConfigHook(c *C) {
-	var mockGadgetSnapYaml = `
-name: canonical-pc
-type: gadget
-`
-	var mockGadgetYaml = []byte(`
-defaults:
-  otheridididididididididididididi:
-    foo:
-      bar: baz
-      num: 1.305
-
-volumes:
-    volume-id:
-        bootloader: grub
-`)
-
-	info := snaptest.MockSnap(c, mockGadgetSnapYaml, &snap.SideInfo{Revision: snap.R(2)})
-	err := ioutil.WriteFile(filepath.Join(info.MountDir(), "meta", "gadget.yaml"), mockGadgetYaml, 0644)
-	c.Assert(err, IsNil)
-
-	gi, err := gadget.ReadInfo(info.MountDir(), nil)
-	c.Assert(err, IsNil)
-	c.Assert(gi, NotNil)
-
-	snapName := "some-snap"
-	hooksup := &hookstate.HookSetup{
-		Snap:        snapName,
-		Hook:        "configure",
-		Optional:    true,
-		IgnoreError: false,
-		TrackError:  false,
-	}
-
-	var contextData map[string]interface{}
-	contextData = map[string]interface{}{"patch": gi.Defaults}
-
-	s.state.Lock()
-	defer s.state.Unlock()
-	c.Assert(hookstate.HookTask(s.state, "", hooksup, contextData), NotNil)
-}
-
-func makeInstalledMockCoreSnap(c *C) {
-	coreSnapYaml := `name: core
-version: 1.0
-type: os
-`
-	snaptest.MockSnap(c, coreSnapYaml, &snap.SideInfo{
-		RealName: "core",
-		Revision: snap.R(1),
-	})
-}
-
-func (s *snapmgrTestSuite) TestGadgetDefaults(c *C) {
-	r := release.MockOnClassic(false)
-	defer r()
-
-	makeInstalledMockCoreSnap(c)
-
-	// using MockSnap, we want to read the bits on disk
-	snapstate.MockSnapReadInfo(snap.ReadInfo)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	s.prepareGadget(c)
-
-	snapPath := makeTestSnap(c, "name: some-snap\nversion: 1.0")
-
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}, snapPath, "", "edge", snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	var m map[string]interface{}
-	runHooks := tasksWithKind(ts, "run-hook")
-
-	c.Assert(taskKinds(runHooks), DeepEquals, []string{
-		"run-hook[install]",
-		"run-hook[configure]",
-		"run-hook[check-health]",
-	})
-	err = runHooks[1].Get("hook-context", &m)
-	c.Assert(err, IsNil)
-	c.Assert(m, DeepEquals, map[string]interface{}{"use-defaults": true})
-}
-
-func (s *snapmgrTestSuite) TestGadgetDefaultsNotForOS(c *C) {
-	r := release.MockOnClassic(false)
-	defer r()
-
-	// using MockSnap, we want to read the bits on disk
-	snapstate.MockSnapReadInfo(snap.ReadInfo)
-
-	s.state.Lock()
-	defer s.state.Unlock()
+		Current:  snap.R(11),
+		SnapType: "os",
+	})
 
-	snapstate.Set(s.state, "core", nil)
+	makeInstalledMockCoreSnap(c)
 
-	s.prepareGadget(c)
+	defls, err := snapstate.ConfigDefaults(s.state, deviceCtx, "core")
+	c.Assert(err, IsNil)
+	c.Assert(defls, DeepEquals, map[string]interface{}{"foo": "bar"})
+}
 
-	const coreSnapYaml = `
-name: core
-type: os
+var snapdSnapYaml = `name: snapd
 version: 1.0
+type: snapd
 `
-	snapPath := makeTestSnap(c, coreSnapYaml)
-
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "core", SnapID: "core-id", Revision: snap.R(1)}, snapPath, "", "edge", snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	var m map[string]interface{}
-	runHooks := tasksWithKind(ts, "run-hook")
-
-	c.Assert(taskKinds(runHooks), DeepEquals, []string{
-		"run-hook[install]",
-		"run-hook[configure]",
-		"run-hook[check-health]",
-	})
-	// use-defaults flag is part of hook-context which isn't set
-	err = runHooks[1].Get("hook-context", &m)
-	c.Assert(err, Equals, state.ErrNoState)
-}
 
-func (s *snapmgrTestSuite) TestInstallPathSkipConfigure(c *C) {
+func (s *snapmgrTestSuite) TestConfigDefaultsSystemWithSnapdNoCore(c *C) {
 	r := release.MockOnClassic(false)
 	defer r()
 
-	makeInstalledMockCoreSnap(c)
-
-	// using MockSnap, we want to read the bits on disk
+	// using MockSnapReadInfo, we want to read the bits on disk
 	snapstate.MockSnapReadInfo(snap.ReadInfo)
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	s.prepareGadget(c)
-
-	snapPath := makeTestSnap(c, "name: some-snap\nversion: 1.0")
-
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}, snapPath, "", "edge", snapstate.Flags{SkipConfigure: true})
-	c.Assert(err, IsNil)
-
-	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
-	c.Assert(err, IsNil)
-	// SkipConfigure is consumed and consulted when creating the taskset
-	// but is not copied into SnapSetup
-	c.Check(snapsup.Flags.SkipConfigure, Equals, false)
-}
+	s.prepareGadget(c, `
+defaults:
+    system:
+        foo: bar
+`)
 
-func (s *snapmgrTestSuite) TestNoReRefreshInUpdate(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	deviceCtx := &snapstatetest.TrivialDeviceContext{
+		DeviceModel: MakeModel(map[string]interface{}{
+			"gadget": "the-gadget",
+			"base":   "the-base",
+		}),
+	}
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+	snapstate.Set(s.state, "core", nil)
+	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
 		Active: true,
 		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "snapd", SnapID: "the-snapd-snapidididididididididi", Revision: snap.R(1)},
 		},
 		Current:  snap.R(1),
-		SnapType: "app",
+		SnapType: "snapd",
 	})
 
-	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{NoReRefresh: true})
-	c.Assert(err, IsNil)
-
-	// ensure we have no re-refresh task
-	for _, t := range ts.Tasks() {
-		c.Assert(t.Kind(), Not(Equals), "check-rerefresh")
-	}
+	snaptest.MockSnap(c, snapdSnapYaml, &snap.SideInfo{
+		RealName: "snapd",
+		Revision: snap.R(1),
+	})
 
-	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
+	defls, err := snapstate.ConfigDefaults(s.state, deviceCtx, "core")
 	c.Assert(err, IsNil)
-	// NoReRefresh is consumed and consulted when creating the taskset
-	// but is not copied into SnapSetup
-	c.Check(snapsup.Flags.NoReRefresh, Equals, false)
+	c.Assert(defls, DeepEquals, map[string]interface{}{"foo": "bar"})
 }
 
-func (s *snapmgrTestSuite) TestGadgetDefaultsInstalled(c *C) {
-	makeInstalledMockCoreSnap(c)
+func (s *snapmgrTestSuite) TestConfigDefaultsSystemConflictsCoreSnapId(c *C) {
+	r := release.MockOnClassic(false)
+	defer r()
 
-	// using MockSnap, we want to read the bits on disk
+	// using MockSnapReadInfo, we want to read the bits on disk
 	snapstate.MockSnapReadInfo(snap.ReadInfo)
 
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	s.prepareGadget(c)
+	s.prepareGadget(c, `
+defaults:
+    system:
+        foo: bar
+    thecoresnapididididididididididi:
+        foo: other-bar
+        other-key: other-key-default
+`)
 
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:   true,
-		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}},
+	deviceCtx := deviceWithGadgetContext("the-gadget")
+
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core", SnapID: "thecoresnapididididididididididi", Revision: snap.R(1)},
+		},
 		Current:  snap.R(1),
-		SnapType: "app",
+		SnapType: "os",
 	})
 
-	snapPath := makeTestSnap(c, "name: some-snap\nversion: 1.0")
+	makeInstalledMockCoreSnap(c)
 
-	ts, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)}, snapPath, "", "edge", snapstate.Flags{})
+	// 'system' key defaults take precedence over snap-id ones
+	defls, err := snapstate.ConfigDefaults(s.state, deviceCtx, "core")
 	c.Assert(err, IsNil)
-
-	var m map[string]interface{}
-	runHooks := tasksWithKind(ts, "run-hook")
-
-	c.Assert(runHooks[0].Kind(), Equals, "run-hook")
-	err = runHooks[0].Get("hook-context", &m)
-	c.Assert(err, Equals, state.ErrNoState)
+	c.Assert(defls, DeepEquals, map[string]interface{}{"foo": "bar"})
 }
 
 func (s *snapmgrTestSuite) TestTransitionCoreTasksNoUbuntuCore(c *C) {
@@ -13373,6 +4749,10 @@
 			name: "ubuntu-core",
 		},
 		{
+			op:   "remove-inhibit-lock",
+			name: "ubuntu-core",
+		},
+		{
 			op:   "remove-snap-dir",
 			name: "ubuntu-core",
 			path: filepath.Join(dirs.SnapMountDir, "ubuntu-core"),
@@ -13469,6 +4849,10 @@
 			name: "ubuntu-core",
 		},
 		{
+			op:   "remove-inhibit-lock",
+			name: "ubuntu-core",
+		},
+		{
 			op:   "remove-snap-dir",
 			name: "ubuntu-core",
 			path: filepath.Join(dirs.SnapMountDir, "ubuntu-core"),
@@ -13768,9 +5152,12 @@
 	*fakeStore
 }
 
-func (s unhappyStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (s unhappyStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
 
-	return nil, fmt.Errorf("a grumpy store")
+	return nil, nil, fmt.Errorf("a grumpy store")
 }
 
 func (s *snapmgrTestSuite) TestTransitionSnapdSnapError(c *C) {
@@ -13944,180 +5331,18 @@
 	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
 		switch info.InstanceName() {
 		case "alias-snap":
-			return map[string]string{
-				"alias1": "cmd1",
-				"alias2": "cmd2",
-			}, nil
-		}
-		return nil, nil
-	}
-
-	snapstate.Set(s.state, "core", nil)
-	snapstate.Set(s.state, "alias-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "alias-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  true,
-	})
-
-	s.state.Set("aliases", map[string]map[string]string{
-		"alias-snap": {
-			"alias1": "auto",
-		},
-	})
-
-	s.state.Unlock()
-	err := s.snapmgr.Ensure()
-	s.state.Lock()
-	c.Assert(err, IsNil)
-
-	var gone interface{}
-	err = s.state.Get("aliases", &gone)
-	c.Assert(err, Equals, state.ErrNoState)
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "alias-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Check(snapst.AutoAliasesDisabled, Equals, false)
-	c.Check(snapst.AliasesPending, Equals, false)
-	c.Check(snapst.Aliases, DeepEquals, map[string]*snapstate.AliasTarget{
-		"alias1": {Auto: "cmd1"},
-		"alias2": {Auto: "cmd2"},
-	})
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "alias-snap",
-		},
-		{
-			op: "update-aliases",
-			aliases: []*backend.Alias{
-				{Name: "alias1", Target: "alias-snap.cmd1"},
-				{Name: "alias2", Target: "alias-snap.cmd2"},
-			},
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-}
-
-func (s *snapmgrTestSuite) TestEnsureAliasesV2SnapDisabled(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
-		switch info.InstanceName() {
-		case "alias-snap":
-			return map[string]string{
-				"alias1": "cmd1",
-				"alias2": "cmd2",
-			}, nil
-		}
-		return nil, nil
-	}
-
-	snapstate.Set(s.state, "core", nil)
-	snapstate.Set(s.state, "alias-snap", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "alias-snap", Revision: snap.R(11)},
-		},
-		Current: snap.R(11),
-		Active:  false,
-	})
-
-	s.state.Set("aliases", map[string]map[string]string{
-		"alias-snap": {
-			"alias1": "auto",
-		},
-	})
-
-	s.state.Unlock()
-	err := s.snapmgr.Ensure()
-	s.state.Lock()
-	c.Assert(err, IsNil)
-
-	var gone interface{}
-	err = s.state.Get("aliases", &gone)
-	c.Assert(err, Equals, state.ErrNoState)
-
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "alias-snap", &snapst)
-	c.Assert(err, IsNil)
-
-	c.Check(snapst.AutoAliasesDisabled, Equals, false)
-	c.Check(snapst.AliasesPending, Equals, true)
-	c.Check(snapst.Aliases, DeepEquals, map[string]*snapstate.AliasTarget{
-		"alias1": {Auto: "cmd1"},
-		"alias2": {Auto: "cmd2"},
-	})
-
-	expected := fakeOps{
-		{
-			op:   "remove-snap-aliases",
-			name: "alias-snap",
-		},
-	}
-	// start with an easier-to-read error if this fails:
-	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
-}
-
-func (s *snapmgrTestSuite) TestEnsureAliasesV2MarkAliasTasksInError(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	s.state.Set("aliases", map[string]map[string]string{
-		"alias-snap": {
-			"alias1": "auto",
-		},
-	})
-
-	// pending old alias task
-	t := s.state.NewTask("alias", "...")
-	t.Set("aliases", map[string]string{})
-	chg := s.state.NewChange("alias chg", "...")
-	chg.AddTask(t)
-
-	s.state.Unlock()
-	err := s.snapmgr.Ensure()
-	s.state.Lock()
-	c.Assert(err, IsNil)
-
-	c.Check(chg.Status(), Equals, state.ErrorStatus)
-	c.Check(chg.IsReady(), Equals, true)
-	c.Check(t.Status(), Equals, state.ErrorStatus)
-}
-
-func (s *snapmgrTestSuite) TestEmptyUpdateWithChannelChangeAndAutoAlias(c *C) {
-	// this reproduces the cause behind lp:1860324,
-	// namely an empty refresh with a channel change on a snap
-	// with changed aliases
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	n := 0
-	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
-		if info.InstanceName() == "alias-snap" {
-			if n > 0 {
-				return map[string]string{
-					"alias1": "cmd1",
-					"alias2": "cmd2",
-				}, nil
-			}
-			n++
+			return map[string]string{
+				"alias1": "cmd1",
+				"alias2": "cmd2",
+			}, nil
 		}
 		return nil, nil
 	}
 
+	snapstate.Set(s.state, "core", nil)
 	snapstate.Set(s.state, "alias-snap", &snapstate.SnapState{
-		TrackingChannel: "latest/stable",
 		Sequence: []*snap.SideInfo{
-			{RealName: "alias-snap", Revision: snap.R(11), SnapID: "alias-snap-id"},
+			{RealName: "alias-snap", Revision: snap.R(11)},
 		},
 		Current: snap.R(11),
 		Active:  true,
@@ -14134,547 +5359,177 @@
 	s.state.Lock()
 	c.Assert(err, IsNil)
 
-	ts, err := snapstate.Update(s.state, "alias-snap", &snapstate.RevisionOptions{Channel: "latest/candidate"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("refresh", "refresh snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
+	var gone interface{}
+	err = s.state.Get("aliases", &gone)
+	c.Assert(err, Equals, state.ErrNoState)
 
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-}
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "alias-snap", &snapst)
+	c.Assert(err, IsNil)
 
-func (s *snapmgrTestSuite) TestConflictMany(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	c.Check(snapst.AutoAliasesDisabled, Equals, false)
+	c.Check(snapst.AliasesPending, Equals, false)
+	c.Check(snapst.Aliases, DeepEquals, map[string]*snapstate.AliasTarget{
+		"alias1": {Auto: "cmd1"},
+		"alias2": {Auto: "cmd2"},
+	})
 
-	for _, instanceName := range []string{"a-snap", "b-snap"} {
-		snapstate.Set(s.state, instanceName, &snapstate.SnapState{
-			Sequence: []*snap.SideInfo{
-				{RealName: instanceName, Revision: snap.R(11)},
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "alias-snap",
+		},
+		{
+			op: "update-aliases",
+			aliases: []*backend.Alias{
+				{Name: "alias1", Target: "alias-snap.cmd1"},
+				{Name: "alias2", Target: "alias-snap.cmd2"},
 			},
-			Current: snap.R(11),
-			Active:  false,
-		})
-
-		ts, err := snapstate.Enable(s.state, instanceName)
-		c.Assert(err, IsNil)
-		// need a change to make the tasks visible
-		s.state.NewChange("enable", "...").AddAll(ts)
-	}
-
-	// things that should be ok:
-	for _, m := range [][]string{
-		{}, //nothing
-		{"c-snap"},
-		{"c-snap", "d-snap", "e-snap", "f-snap"},
-	} {
-		c.Check(snapstate.CheckChangeConflictMany(s.state, m, ""), IsNil)
-	}
-
-	// things that should not be ok:
-	for _, m := range [][]string{
-		{"a-snap"},
-		{"a-snap", "b-snap"},
-		{"a-snap", "c-snap"},
-		{"b-snap", "c-snap"},
-	} {
-		err := snapstate.CheckChangeConflictMany(s.state, m, "")
-		c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-		c.Check(err, ErrorMatches, `snap "[^"]*" has "enable" change in progress`)
+		},
 	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 }
 
-func (s *snapmgrTestSuite) TestConflictManyRemodeling(c *C) {
+func (s *snapmgrTestSuite) TestEnsureAliasesV2SnapDisabled(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	chg := s.state.NewChange("remodel", "...")
-	chg.SetStatus(state.DoingStatus)
-
-	err := snapstate.CheckChangeConflictMany(s.state, []string{"a-snap"}, "")
-	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
-	c.Check(err, ErrorMatches, `remodeling in progress, no other changes allowed until this is done`)
-}
-
-func (s *snapmgrTestSuite) TestInstallWithoutCoreRunThrough1(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
+	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
+		switch info.InstanceName() {
+		case "alias-snap":
+			return map[string]string{
+				"alias1": "cmd1",
+				"alias2": "cmd2",
+			}, nil
+		}
+		return nil, nil
+	}
 
-	// pretend we don't have core
 	snapstate.Set(s.state, "core", nil)
+	snapstate.Set(s.state, "alias-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "alias-snap", Revision: snap.R(11)},
+		},
+		Current: snap.R(11),
+		Active:  false,
+	})
 
-	chg := s.state.NewChange("install", "install a snap on a system without core")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
+	s.state.Set("aliases", map[string]map[string]string{
+		"alias-snap": {
+			"alias1": "auto",
+		},
+	})
 
 	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
+	err := s.snapmgr.Ensure()
 	s.state.Lock()
+	c.Assert(err, IsNil)
 
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
-		{
-			macaroon: s.user.StoreMacaroon,
-			name:     "core",
-			target:   filepath.Join(dirs.SnapBlobDir, "core_11.snap"),
-		},
-		{
-			macaroon: s.user.StoreMacaroon,
-			name:     "some-snap",
-			target:   filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-		}})
-	expected := fakeOps{
-		// we check the snap
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "some-snap",
-				Revision:     snap.R(42),
-			},
-			revno:  snap.R(42),
-			userID: 1,
-		},
-		// then we check core because its not installed already
-		// and continue with that
-		{
-			op:     "storesvc-snap-action",
-			userID: 1,
-		},
-		{
-			op: "storesvc-snap-action:action",
-			action: store.SnapAction{
-				Action:       "install",
-				InstanceName: "core",
-				Channel:      "stable",
-			},
-			revno:  snap.R(11),
-			userID: 1,
-		},
-		{
-			op:   "storesvc-download",
-			name: "core",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "core",
-			revno: snap.R(11),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "core_11.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "core",
-				Channel:  "stable",
-				SnapID:   "core-id",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "core",
-			path:  filepath.Join(dirs.SnapBlobDir, "core_11.snap"),
-			revno: snap.R(11),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "core/11"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "core",
-			revno: snap.R(11),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "core",
-				Channel:  "stable",
-				SnapID:   "core-id",
-				Revision: snap.R(11),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "core/11"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "core",
-			revno: snap.R(11),
-		},
-		{
-			op: "update-aliases",
-		},
-		// after core is in place continue with the snap
-		{
-			op:   "storesvc-download",
-			name: "some-snap",
-		},
-		{
-			op:    "validate-snap:Doing",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-		{
-			op:  "current",
-			old: "<no-current>",
-		},
-		{
-			op:   "open-snap-file",
-			path: filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Revision: snap.R(42),
-			},
-		},
-		{
-			op:    "setup-snap",
-			name:  "some-snap",
-			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_42.snap"),
-			revno: snap.R(42),
-		},
-		{
-			op:   "copy-data",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
-			old:  "<no-old>",
-		},
-		{
-			op:    "setup-profiles:Doing",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-		{
-			op: "candidate",
-			sinfo: snap.SideInfo{
-				RealName: "some-snap",
-				SnapID:   "some-snap-id",
-				Revision: snap.R(42),
-			},
-		},
-		{
-			op:   "link-snap",
-			path: filepath.Join(dirs.SnapMountDir, "some-snap/42"),
-		},
-		{
-			op:    "auto-connect:Doing",
-			name:  "some-snap",
-			revno: snap.R(42),
-		},
-		{
-			op: "update-aliases",
-		},
-		// cleanups order is random
-		{
-			op:    "cleanup-trash",
-			name:  "core",
-			revno: snap.R(42),
-		},
+	var gone interface{}
+	err = s.state.Get("aliases", &gone)
+	c.Assert(err, Equals, state.ErrNoState)
+
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "alias-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Check(snapst.AutoAliasesDisabled, Equals, false)
+	c.Check(snapst.AliasesPending, Equals, true)
+	c.Check(snapst.Aliases, DeepEquals, map[string]*snapstate.AliasTarget{
+		"alias1": {Auto: "cmd1"},
+		"alias2": {Auto: "cmd2"},
+	})
+
+	expected := fakeOps{
 		{
-			op:    "cleanup-trash",
-			name:  "some-snap",
-			revno: snap.R(42),
+			op:   "remove-snap-aliases",
+			name: "alias-snap",
 		},
 	}
 	// start with an easier-to-read error if this fails:
 	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
-	// compare the details without the cleanup tasks, the order is random
-	// as they run in parallel
-	opsLenWithoutCleanups := len(s.fakeBackend.ops) - 2
-	c.Assert(s.fakeBackend.ops[:opsLenWithoutCleanups], DeepEquals, expected[:opsLenWithoutCleanups])
-
-	// verify core in the system state
-	var snaps map[string]*snapstate.SnapState
-	err = s.state.Get("snaps", &snaps)
-	c.Assert(err, IsNil)
-
-	snapst := snaps["core"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.TrackingChannel, Equals, "latest/stable")
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "core",
-		Channel:  "stable",
-		SnapID:   "core-id",
-		Revision: snap.R(11),
-	})
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
 }
 
-func (s *snapmgrTestSuite) TestInstallWithoutCoreTwoSnapsRunThrough(c *C) {
+func (s *snapmgrTestSuite) TestEnsureAliasesV2MarkAliasTasksInError(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	restore := snapstate.MockPrerequisitesRetryTimeout(10 * time.Millisecond)
-	defer restore()
-
-	// pretend we don't have core
-	snapstate.Set(s.state, "core", nil)
-
-	chg1 := s.state.NewChange("install", "install snap 1")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-	ts1, err := snapstate.Install(context.Background(), s.state, "snap1", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg1.AddAll(ts1)
+	s.state.Set("aliases", map[string]map[string]string{
+		"alias-snap": {
+			"alias1": "auto",
+		},
+	})
 
-	chg2 := s.state.NewChange("install", "install snap 2")
-	opts = &snapstate.RevisionOptions{Channel: "some-other-channel", Revision: snap.R(21)}
-	ts2, err := snapstate.Install(context.Background(), s.state, "snap2", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg2.AddAll(ts2)
+	// pending old alias task
+	t := s.state.NewTask("alias", "...")
+	t.Set("aliases", map[string]string{})
+	chg := s.state.NewChange("alias chg", "...")
+	chg.AddTask(t)
 
 	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
+	err := s.snapmgr.Ensure()
 	s.state.Lock()
+	c.Assert(err, IsNil)
 
-	// ensure all our tasks ran and core was only installed once
-	c.Assert(chg1.Err(), IsNil)
-	c.Assert(chg2.Err(), IsNil)
-
-	c.Assert(chg1.IsReady(), Equals, true)
-	c.Assert(chg2.IsReady(), Equals, true)
-
-	// order in which the changes run is random
-	if len(chg1.Tasks()) < len(chg2.Tasks()) {
-		chg1, chg2 = chg2, chg1
-	}
-	c.Assert(taskKinds(chg1.Tasks()), HasLen, 28)
-	c.Assert(taskKinds(chg2.Tasks()), HasLen, 14)
-
-	// FIXME: add helpers and do a DeepEquals here for the operations
+	c.Check(chg.Status(), Equals, state.ErrorStatus)
+	c.Check(chg.IsReady(), Equals, true)
+	c.Check(t.Status(), Equals, state.ErrorStatus)
 }
 
-func (s *snapmgrTestSuite) TestInstallWithoutCoreTwoSnapsWithFailureRunThrough(c *C) {
+func (s *snapmgrTestSuite) TestConflictMany(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	// slightly longer retry timeout to avoid deadlock when we
-	// trigger a retry quickly that the link snap for core does
-	// not have a chance to run
-	restore := snapstate.MockPrerequisitesRetryTimeout(40 * time.Millisecond)
-	defer restore()
-
-	defer s.se.Stop()
-	// Two changes are created, the first will fails, the second will
-	// be fine. The order of what change runs first is random, the
-	// first change will also install core in its own lane. This test
-	// ensures that core gets installed and there are no conflicts
-	// even if core already got installed from the first change.
-	//
-	// It runs multiple times so that both possible cases get a chance
-	// to run
-	for i := 0; i < 5; i++ {
-		// start clean
-		snapstate.Set(s.state, "core", nil)
-		snapstate.Set(s.state, "snap2", nil)
-
-		// chg1 has an error
-		chg1 := s.state.NewChange("install", "install snap 1")
-		opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-		ts1, err := snapstate.Install(context.Background(), s.state, "snap1", opts, s.user.ID, snapstate.Flags{})
-		c.Assert(err, IsNil)
-		chg1.AddAll(ts1)
-
-		tasks := ts1.Tasks()
-		last := tasks[len(tasks)-1]
-		terr := s.state.NewTask("error-trigger", "provoking total undo")
-		terr.WaitFor(last)
-		chg1.AddTask(terr)
-
-		// chg2 is good
-		chg2 := s.state.NewChange("install", "install snap 2")
-		opts = &snapstate.RevisionOptions{Channel: "some-other-channel", Revision: snap.R(21)}
-		ts2, err := snapstate.Install(context.Background(), s.state, "snap2", opts, s.user.ID, snapstate.Flags{})
-		c.Assert(err, IsNil)
-		chg2.AddAll(ts2)
-
-		// we use our own settle as we need a bigger timeout
-		s.state.Unlock()
-		err = s.o.Settle(15 * time.Second)
-		s.state.Lock()
-		c.Assert(err, IsNil)
-
-		// ensure expected change states
-		c.Check(chg1.Status(), Equals, state.ErrorStatus)
-		c.Check(chg2.Status(), Equals, state.DoneStatus)
-
-		// ensure we have both core and snap2
-		var snapst snapstate.SnapState
-		err = snapstate.Get(s.state, "core", &snapst)
-		c.Assert(err, IsNil)
-		c.Assert(snapst.Active, Equals, true)
-		c.Assert(snapst.Sequence, HasLen, 1)
-		c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-			RealName: "core",
-			SnapID:   "core-id",
-			Channel:  "stable",
-			Revision: snap.R(11),
+	for _, instanceName := range []string{"a-snap", "b-snap"} {
+		snapstate.Set(s.state, instanceName, &snapstate.SnapState{
+			Sequence: []*snap.SideInfo{
+				{RealName: instanceName, Revision: snap.R(11)},
+			},
+			Current: snap.R(11),
+			Active:  false,
 		})
 
-		var snapst2 snapstate.SnapState
-		err = snapstate.Get(s.state, "snap2", &snapst2)
+		ts, err := snapstate.Enable(s.state, instanceName)
 		c.Assert(err, IsNil)
-		c.Assert(snapst2.Active, Equals, true)
-		c.Assert(snapst2.Sequence, HasLen, 1)
-		c.Assert(snapst2.Sequence[0], DeepEquals, &snap.SideInfo{
-			RealName: "snap2",
-			SnapID:   "snap2-id",
-			Channel:  "",
-			Revision: snap.R(21),
-		})
-
+		// need a change to make the tasks visible
+		s.state.NewChange("enable", "...").AddAll(ts)
 	}
-}
-
-type behindYourBackStore struct {
-	*fakeStore
-	state *state.State
-
-	coreInstallRequested bool
-	coreInstalled        bool
-	chg                  *state.Change
-}
 
-func (s behindYourBackStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
-	if len(actions) == 1 && actions[0].Action == "install" && actions[0].InstanceName == "core" {
-		s.state.Lock()
-		if !s.coreInstallRequested {
-			s.coreInstallRequested = true
-			snapsup := &snapstate.SnapSetup{
-				SideInfo: &snap.SideInfo{
-					RealName: "core",
-				},
-			}
-			t := s.state.NewTask("prepare", "prepare core")
-			t.Set("snap-setup", snapsup)
-			s.chg = s.state.NewChange("install", "install core")
-			s.chg.AddAll(state.NewTaskSet(t))
-		}
-		if s.chg != nil && !s.coreInstalled {
-			// marks change ready but also
-			// tasks need to also be marked cleaned
-			for _, t := range s.chg.Tasks() {
-				t.SetStatus(state.DoneStatus)
-				t.SetClean()
-			}
-			snapstate.Set(s.state, "core", &snapstate.SnapState{
-				Active: true,
-				Sequence: []*snap.SideInfo{
-					{RealName: "core", Revision: snap.R(1)},
-				},
-				Current:  snap.R(1),
-				SnapType: "os",
-			})
-			s.coreInstalled = true
-		}
-		s.state.Unlock()
+	// things that should be ok:
+	for _, m := range [][]string{
+		{}, //nothing
+		{"c-snap"},
+		{"c-snap", "d-snap", "e-snap", "f-snap"},
+	} {
+		c.Check(snapstate.CheckChangeConflictMany(s.state, m, ""), IsNil)
 	}
 
-	return s.fakeStore.SnapAction(ctx, currentSnaps, actions, user, opts)
+	// things that should not be ok:
+	for _, m := range [][]string{
+		{"a-snap"},
+		{"a-snap", "b-snap"},
+		{"a-snap", "c-snap"},
+		{"b-snap", "c-snap"},
+	} {
+		err := snapstate.CheckChangeConflictMany(s.state, m, "")
+		c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+		c.Check(err, ErrorMatches, `snap "[^"]*" has "enable" change in progress`)
+	}
 }
 
-// this test the scenario that some-snap gets installed and during the
-// install (when unlocking for the store info call for core) an
-// explicit "snap install core" happens. In this case the snapstate
-// will return a change conflict. we handle this via a retry, ensure
-// this is actually what happens.
-func (s *snapmgrTestSuite) TestInstallWithoutCoreConflictingInstall(c *C) {
+func (s *snapmgrTestSuite) TestConflictManyRemodeling(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
-	restore := snapstate.MockPrerequisitesRetryTimeout(10 * time.Millisecond)
-	defer restore()
-
-	snapstate.ReplaceStore(s.state, behindYourBackStore{fakeStore: s.fakeStore, state: s.state})
-
-	// pretend we don't have core
-	snapstate.Set(s.state, "core", nil)
-
-	// now install a snap that will pull in core
-	chg := s.state.NewChange("install", "install a snap on a system without core")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	prereq := ts.Tasks()[0]
-	c.Assert(prereq.Kind(), Equals, "prerequisites")
-	c.Check(prereq.AtTime().IsZero(), Equals, true)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-
-	// start running the change, this will trigger the
-	// prerequisites task, which will trigger the install of core
-	// and also call our mock store which will generate a parallel
-	// change
-	s.se.Ensure()
-	s.se.Wait()
-
-	// change is not ready yet, because the prerequists triggered
-	// a state.Retry{} because of the conflicting change
-	c.Assert(chg.IsReady(), Equals, false)
-	s.state.Lock()
-	// marked for retry
-	c.Check(prereq.AtTime().IsZero(), Equals, false)
-	c.Check(prereq.Status().Ready(), Equals, false)
-	s.state.Unlock()
-
-	// retry interval is 10ms so 20ms should be plenty of time
-	time.Sleep(20 * time.Millisecond)
-	s.settle(c)
-	// chg got retried, core is now installed, things are good
-	c.Assert(chg.IsReady(), Equals, true)
-
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-
-	// verify core in the system state
-	var snaps map[string]*snapstate.SnapState
-	err = s.state.Get("snaps", &snaps)
-	c.Assert(err, IsNil)
-
-	snapst := snaps["core"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "core",
-		Revision: snap.R(1),
-	})
+	chg := s.state.NewChange("remodel", "...")
+	chg.SetStatus(state.DoingStatus)
 
-	snapst = snaps["some-snap"]
-	c.Assert(snapst, NotNil)
-	c.Assert(snapst.Active, Equals, true)
-	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
-		RealName: "some-snap",
-		SnapID:   "some-snap-id",
-		Channel:  "some-channel",
-		Revision: snap.R(11),
-	})
+	err := snapstate.CheckChangeConflictMany(s.state, []string{"a-snap"}, "")
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Check(err, ErrorMatches, `remodeling in progress, no other changes allowed until this is done`)
 }
 
 type contentStore struct {
@@ -14682,10 +5537,10 @@
 	state *state.State
 }
 
-func (s contentStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, error) {
-	sars, err := s.fakeStore.SnapAction(ctx, currentSnaps, actions, user, opts)
+func (s contentStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	sars, _, err := s.fakeStore.SnapAction(ctx, currentSnaps, actions, assertQuery, user, opts)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	if len(sars) != 1 {
 		panic("expected to be queried for install of only one snap at a time")
@@ -14745,267 +5600,35 @@
 				Name:      "circular-slot1",
 				Interface: "content",
 				Attrs: map[string]interface{}{
-					"content": "circular1",
-				},
-			},
-		}
-	case "snap-content-circular2":
-		info.Plugs = map[string]*snap.PlugInfo{
-			"circular-plug2": {
-				Snap:      info,
-				Name:      "circular-plug2",
-				Interface: "content",
-				Attrs: map[string]interface{}{
-					"default-provider": "snap-content-circular1",
-					"content":          "circular2",
-				},
-			},
-		}
-		info.Slots = map[string]*snap.SlotInfo{
-			"circular-slot2": {
-				Snap:      info,
-				Name:      "circular-slot2",
-				Interface: "content",
-				Attrs: map[string]interface{}{
-					"content": "circular1",
-				},
-			},
-		}
-	}
-
-	return []store.SnapActionResult{{Info: info}}, err
-}
-
-func (s *snapmgrTestSuite) TestInstallDefaultProviderRunThrough(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
-
-	repo := interfaces.NewRepository()
-	ifacerepo.Replace(s.state, repo)
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "stable", Revision: snap.R(42)}
-	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-plug", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	expected := fakeOps{{
-		op:     "storesvc-snap-action",
-		userID: 1,
-	}, {
-		op: "storesvc-snap-action:action",
-		action: store.SnapAction{
-			Action:       "install",
-			InstanceName: "snap-content-plug",
-			Revision:     snap.R(42),
-		},
-		revno:  snap.R(42),
-		userID: 1,
-	}, {
-		op:     "storesvc-snap-action",
-		userID: 1,
-	}, {
-		op: "storesvc-snap-action:action",
-		action: store.SnapAction{
-			Action:       "install",
-			InstanceName: "snap-content-slot",
-			Channel:      "stable",
-		},
-		revno:  snap.R(11),
-		userID: 1,
-	}, {
-		op:   "storesvc-download",
-		name: "snap-content-slot",
-	}, {
-		op:    "validate-snap:Doing",
-		name:  "snap-content-slot",
-		revno: snap.R(11),
-	}, {
-		op:  "current",
-		old: "<no-current>",
-	}, {
-		op:   "open-snap-file",
-		path: filepath.Join(dirs.SnapBlobDir, "snap-content-slot_11.snap"),
-		sinfo: snap.SideInfo{
-			RealName: "snap-content-slot",
-			Channel:  "stable",
-			SnapID:   "snap-content-slot-id",
-			Revision: snap.R(11),
-		},
-	}, {
-		op:    "setup-snap",
-		name:  "snap-content-slot",
-		path:  filepath.Join(dirs.SnapBlobDir, "snap-content-slot_11.snap"),
-		revno: snap.R(11),
-	}, {
-		op:   "copy-data",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-slot/11"),
-		old:  "<no-old>",
-	}, {
-		op:    "setup-profiles:Doing",
-		name:  "snap-content-slot",
-		revno: snap.R(11),
-	}, {
-		op: "candidate",
-		sinfo: snap.SideInfo{
-			RealName: "snap-content-slot",
-			Channel:  "stable",
-			SnapID:   "snap-content-slot-id",
-			Revision: snap.R(11),
-		},
-	}, {
-		op:   "link-snap",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-slot/11"),
-	}, {
-		op:    "auto-connect:Doing",
-		name:  "snap-content-slot",
-		revno: snap.R(11),
-	}, {
-		op: "update-aliases",
-	}, {
-		op:   "storesvc-download",
-		name: "snap-content-plug",
-	}, {
-		op:    "validate-snap:Doing",
-		name:  "snap-content-plug",
-		revno: snap.R(42),
-	}, {
-		op:  "current",
-		old: "<no-current>",
-	}, {
-		op:   "open-snap-file",
-		path: filepath.Join(dirs.SnapBlobDir, "snap-content-plug_42.snap"),
-		sinfo: snap.SideInfo{
-			RealName: "snap-content-plug",
-			SnapID:   "snap-content-plug-id",
-			Revision: snap.R(42),
-		},
-	}, {
-		op:    "setup-snap",
-		name:  "snap-content-plug",
-		path:  filepath.Join(dirs.SnapBlobDir, "snap-content-plug_42.snap"),
-		revno: snap.R(42),
-	}, {
-		op:   "copy-data",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-plug/42"),
-		old:  "<no-old>",
-	}, {
-		op:    "setup-profiles:Doing",
-		name:  "snap-content-plug",
-		revno: snap.R(42),
-	}, {
-		op: "candidate",
-		sinfo: snap.SideInfo{
-			RealName: "snap-content-plug",
-			SnapID:   "snap-content-plug-id",
-			Revision: snap.R(42),
-		},
-	}, {
-		op:   "link-snap",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-plug/42"),
-	}, {
-		op:    "auto-connect:Doing",
-		name:  "snap-content-plug",
-		revno: snap.R(42),
-	}, {
-		op: "update-aliases",
-	}, {
-		op:    "cleanup-trash",
-		name:  "snap-content-plug",
-		revno: snap.R(42),
-	}, {
-		op:    "cleanup-trash",
-		name:  "snap-content-slot",
-		revno: snap.R(11),
-	},
-	}
-	// snap and default provider are installed in parallel so we can't
-	// do a simple c.Check(ops, DeepEquals, fakeOps{...})
-	c.Check(len(s.fakeBackend.ops), Equals, len(expected))
-	for _, op := range expected {
-		c.Assert(s.fakeBackend.ops, testutil.DeepContains, op)
-	}
-	for _, op := range s.fakeBackend.ops {
-		c.Assert(expected, testutil.DeepContains, op)
-	}
-}
-
-func (s *snapmgrTestSuite) TestInstallDefaultProviderCircular(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
-
-	repo := interfaces.NewRepository()
-	ifacerepo.Replace(s.state, repo)
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-circular1", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	// and both circular snaps got linked
-	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
-		op:   "link-snap",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-circular1/42"),
-	})
-	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
-		op:   "link-snap",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-circular2/11"),
-	})
-}
-
-func (s *snapmgrTestSuite) TestInstallDefaultProviderCompat(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
-
-	repo := interfaces.NewRepository()
-	ifacerepo.Replace(s.state, repo)
-
-	chg := s.state.NewChange("install", "install a snap")
-	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(42)}
-	ts, err := snapstate.Install(context.Background(), s.state, "snap-content-plug-compat", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
+					"content": "circular1",
+				},
+			},
+		}
+	case "snap-content-circular2":
+		info.Plugs = map[string]*snap.PlugInfo{
+			"circular-plug2": {
+				Snap:      info,
+				Name:      "circular-plug2",
+				Interface: "content",
+				Attrs: map[string]interface{}{
+					"default-provider": "snap-content-circular1",
+					"content":          "circular2",
+				},
+			},
+		}
+		info.Slots = map[string]*snap.SlotInfo{
+			"circular-slot2": {
+				Snap:      info,
+				Name:      "circular-slot2",
+				Interface: "content",
+				Attrs: map[string]interface{}{
+					"content": "circular1",
+				},
+			},
+		}
+	}
 
-	// ensure all our tasks ran
-	c.Assert(chg.Err(), IsNil)
-	c.Assert(chg.IsReady(), Equals, true)
-	// and both circular snaps got linked
-	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
-		op:   "link-snap",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-plug-compat/42"),
-	})
-	c.Check(s.fakeBackend.ops, testutil.DeepContains, fakeOp{
-		op:   "link-snap",
-		path: filepath.Join(dirs.SnapMountDir, "snap-content-slot/11"),
-	})
+	return []store.SnapActionResult{{Info: info}}, nil, err
 }
 
 func (s *snapmgrTestSuite) TestSnapManagerLegacyRefreshSchedule(c *C) {
@@ -15064,291 +5687,6 @@
 	}
 }
 
-func (s *snapmgrTestSuite) TestSideInfoPaid(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-paid"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("install", "install paid snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snap has paid sideinfo
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.CurrentSideInfo().Paid, Equals, true)
-	c.Check(snapst.CurrentSideInfo().Private, Equals, false)
-}
-
-func (s *snapmgrTestSuite) TestSideInfoPrivate(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-private"}
-	ts, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	chg := s.state.NewChange("install", "install private snap")
-	chg.AddAll(ts)
-
-	s.state.Unlock()
-	defer s.se.Stop()
-	s.settle(c)
-	s.state.Lock()
-
-	// verify snap has private sideinfo
-	var snapst snapstate.SnapState
-	err = snapstate.Get(s.state, "some-snap", &snapst)
-	c.Assert(err, IsNil)
-	c.Check(snapst.CurrentSideInfo().Private, Equals, true)
-	c.Check(snapst.CurrentSideInfo().Paid, Equals, false)
-}
-
-func (s *snapmgrTestSuite) TestInstallPathWithLayoutsChecksFeatureFlag(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// When layouts are disabled we cannot install a local snap depending on the feature.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", false)
-	tr.Commit()
-
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-layout:
- /usr:
-  bind: $SNAP/usr
-`)
-	_, _, err := snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
-
-	// When layouts are enabled we can install a local snap depending on the feature.
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", true)
-	tr.Commit()
-
-	_, _, err = snapstate.InstallPath(s.state, &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}, mockSnap, "", "", snapstate.Flags{})
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestInstallPathWithMetadataChannelSwitchKernel(c *C) {
-	// use the real thing for this one
-	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// snapd cannot be installed unless the model uses a base snap
-	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "kernel", Revision: snap.R(11)},
-		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
-	})
-
-	someSnap := makeTestSnap(c, `name: kernel
-version: 1.0`)
-	si := &snap.SideInfo{
-		RealName: "kernel",
-		SnapID:   "kernel-id",
-		Revision: snap.R(42),
-		Channel:  "some-channel",
-	}
-	_, _, err := snapstate.InstallPath(s.state, si, someSnap, "", "some-channel", snapstate.Flags{Required: true})
-	c.Assert(err, ErrorMatches, `cannot switch from kernel track "18" as specified for the \(device\) model to "some-channel"`)
-}
-
-func (s *snapmgrTestSuite) TestInstallPathWithMetadataChannelSwitchGadget(c *C) {
-	// use the real thing for this one
-	snapstate.MockOpenSnapFile(backend.OpenSnapFile)
-
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// snapd cannot be installed unless the model uses a base snap
-	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
-	defer r()
-	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
-		Sequence: []*snap.SideInfo{
-			{RealName: "brand-gadget", Revision: snap.R(11)},
-		},
-		TrackingChannel: "18/stable",
-		Current:         snap.R(11),
-		Active:          true,
-	})
-
-	someSnap := makeTestSnap(c, `name: brand-gadget
-version: 1.0`)
-	si := &snap.SideInfo{
-		RealName: "brand-gadget",
-		SnapID:   "brand-gadget-id",
-		Revision: snap.R(42),
-		Channel:  "some-channel",
-	}
-	_, _, err := snapstate.InstallPath(s.state, si, someSnap, "", "some-channel", snapstate.Flags{Required: true})
-	c.Assert(err, ErrorMatches, `cannot switch from gadget track "18" as specified for the \(device\) model to "some-channel"`)
-}
-
-func (s *snapmgrTestSuite) TestInstallLayoutsChecksFeatureFlag(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// Layouts are now enabled by default.
-	opts := &snapstate.RevisionOptions{Channel: "channel-for-layout"}
-	_, err := snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// Layouts can be explicitly disabled.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", false)
-	tr.Commit()
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
-
-	// Layouts can be explicitly enabled.
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", true)
-	tr.Commit()
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// The default empty value now means "enabled".
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", "")
-	tr.Commit()
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-	// Layouts are enabled when the controlling flag is reset to nil.
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", nil)
-	tr.Commit()
-	_, err = snapstate.Install(context.Background(), s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-
-}
-
-func (s *snapmgrTestSuite) TestUpdateLayoutsChecksFeatureFlag(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// When layouts are disabled we cannot refresh to a snap depending on the feature.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", false)
-	tr.Commit()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-layout/stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
-
-	// When layouts are enabled we can refresh to a snap depending on the feature.
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", true)
-	tr.Commit()
-
-	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-layout/stable"}, s.user.ID, snapstate.Flags{})
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestUpdateManyExplicitLayoutsChecksFeatureFlag(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// When layouts are disabled we cannot refresh multiple snaps if one of them depends on the feature.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", false)
-	tr.Commit()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "channel-for-layout/stable",
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	_, _, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
-	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
-
-	// When layouts are enabled we can refresh multiple snaps if one of them depends on the feature.
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", true)
-	tr.Commit()
-
-	_, _, err = snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
-	c.Assert(err, IsNil)
-}
-
-func (s *snapmgrTestSuite) TestUpdateManyLayoutsChecksFeatureFlag(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	// When layouts are disabled we cannot refresh multiple snaps if one of them depends on the feature.
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", false)
-	tr.Commit()
-
-	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
-		Active:          true,
-		TrackingChannel: "channel-for-layout/stable",
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	refreshes, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, s.user.ID, nil)
-	c.Assert(err, IsNil)
-	c.Assert(refreshes, HasLen, 0)
-
-	// When layouts are enabled we can refresh multiple snaps if one of them depends on the feature.
-	tr = config.NewTransaction(s.state)
-	tr.Set("core", "experimental.layouts", true)
-	tr.Commit()
-
-	refreshes, _, err = snapstate.UpdateMany(context.Background(), s.state, nil, s.user.ID, nil)
-	c.Assert(err, IsNil)
-	c.Assert(refreshes, DeepEquals, []string{"some-snap"})
-}
-
-func (s *snapmgrTestSuite) TestUpdateFailsEarlyOnEpochMismatch(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	snapstate.Set(s.state, "some-epoch-snap", &snapstate.SnapState{
-		Active: true,
-		Sequence: []*snap.SideInfo{
-			{RealName: "some-epoch-snap", SnapID: "some-epoch-snap-id", Revision: snap.R(1)},
-		},
-		Current:  snap.R(1),
-		SnapType: "app",
-	})
-
-	_, err := snapstate.Update(s.state, "some-epoch-snap", nil, 0, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `cannot refresh "some-epoch-snap" to new revision 11 with epoch 42, because it can't read the current epoch of 13`)
-}
-
 func (s *snapmgrTestSuite) TestParallelInstallValidateFeatureFlag(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -15398,26 +5736,6 @@
 	c.Assert(err, IsNil)
 }
 
-func (s *snapmgrTestSuite) TestParallelInstallInstallPathExperimentalSwitch(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-`)
-	si := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}
-	_, _, err := snapstate.InstallPath(s.state, si, mockSnap, "some-snap_foo", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.parallel-instances' to true")
-
-	// enable parallel instances
-	tr := config.NewTransaction(s.state)
-	tr.Set("core", "experimental.parallel-instances", true)
-	tr.Commit()
-
-	_, _, err = snapstate.InstallPath(s.state, si, mockSnap, "some-snap_foo", "", snapstate.Flags{})
-	c.Assert(err, IsNil)
-}
-
 func (s *snapmgrTestSuite) TestInjectTasks(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
@@ -15591,7 +5909,7 @@
 
 }
 
-func (s snapmgrTestSuite) TestCanLoadOldSnapSetupWithoutType(c *C) {
+func (s *snapmgrTestSuite) TestCanLoadOldSnapSetupWithoutType(c *C) {
 	// ensure we don't crash when loading a SnapSetup json without
 	// a type set
 	oldSnapSetup := []byte(`{
@@ -15616,7 +5934,7 @@
 	c.Check(snapsup.Type, Equals, snap.Type(""))
 }
 
-func (s snapmgrTestSuite) TestHasOtherInstances(c *C) {
+func (s *snapmgrTestSuite) TestHasOtherInstances(c *C) {
 	s.state.Lock()
 	defer s.state.Unlock()
 
@@ -15928,31 +6246,6 @@
 	}
 }
 
-func (s *snapmgrTestSuite) TestInstallValidatesInstanceNames(c *C) {
-	s.state.Lock()
-	defer s.state.Unlock()
-
-	_, err := snapstate.Install(context.Background(), s.state, "foo--invalid", nil, 0, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `invalid instance name: invalid snap name: "foo--invalid"`)
-
-	_, err = snapstate.Install(context.Background(), s.state, "foo_123_456", nil, 0, snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `invalid instance name: invalid instance key: "123_456"`)
-
-	_, _, err = snapstate.InstallMany(s.state, []string{"foo--invalid"}, 0)
-	c.Assert(err, ErrorMatches, `invalid instance name: invalid snap name: "foo--invalid"`)
-
-	_, _, err = snapstate.InstallMany(s.state, []string{"foo_123_456"}, 0)
-	c.Assert(err, ErrorMatches, `invalid instance name: invalid instance key: "123_456"`)
-
-	mockSnap := makeTestSnap(c, `name: some-snap
-version: 1.0
-epoch: 1*
-`)
-	si := snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(8)}
-	_, _, err = snapstate.InstallPath(s.state, &si, mockSnap, "some-snap_123_456", "", snapstate.Flags{})
-	c.Assert(err, ErrorMatches, `invalid instance name: invalid instance key: "123_456"`)
-}
-
 func (s *snapmgrTestSuite) TestGadgetUpdateTaskAddedOnInstall(c *C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -16030,3 +6323,62 @@
 		RequireTypeBase:  false,
 	})
 }
+
+func (s *snapmgrTestSuite) TestEnsureAutoRefreshesAreDelayed(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	t0 := time.Now()
+	// with no changes in flight still works and we set the auto-refresh time as
+	// at least one minute past the start of the test
+	chgs, err := s.snapmgr.EnsureAutoRefreshesAreDelayed(time.Minute)
+	c.Assert(err, IsNil)
+	c.Assert(chgs, HasLen, 0)
+
+	var holdTime time.Time
+	tr := config.NewTransaction(s.state)
+	err = tr.Get("core", "refresh.hold", &holdTime)
+	c.Assert(err, IsNil)
+	// use After() == false in case holdTime is _exactly_ one minute later than
+	// t0, in which case both After() and Before() will be false
+	c.Assert(t0.Add(time.Minute).After(holdTime), Equals, false)
+
+	// now make some auto-refresh changes to make sure we get those figured out
+	chg0 := s.state.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg0.AddTask(s.state.NewTask("nop", "do nothing"))
+
+	// make it in doing state
+	chg0.SetStatus(state.DoingStatus)
+
+	// this one will be picked up too
+	chg1 := s.state.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg1.AddTask(s.state.NewTask("nop", "do nothing"))
+	chg1.SetStatus(state.DoStatus)
+
+	// this one won't, it's Done
+	chg2 := s.state.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg2.AddTask(s.state.NewTask("nop", "do nothing"))
+	chg2.SetStatus(state.DoneStatus)
+
+	// nor this one, it's Undone
+	chg3 := s.state.NewChange("auto-refresh", "auto-refresh-the-things")
+	chg3.AddTask(s.state.NewTask("nop", "do nothing"))
+	chg3.SetStatus(state.UndoneStatus)
+
+	// now we get our change ID returned when calling EnsureAutoRefreshesAreDelayed
+	chgs, err = s.snapmgr.EnsureAutoRefreshesAreDelayed(time.Minute)
+	c.Assert(err, IsNil)
+	// more helpful error message if we first compare the change ID's
+	expids := []string{chg0.ID(), chg1.ID()}
+	sort.Strings(expids)
+	c.Assert(chgs, HasLen, len(expids))
+	gotids := []string{chgs[0].ID(), chgs[1].ID()}
+	sort.Strings(gotids)
+	c.Assert(expids, DeepEquals, gotids)
+
+	sort.SliceStable(chgs, func(i, j int) bool {
+		return chgs[i].ID() < chgs[j].ID()
+	})
+
+	c.Assert(chgs, DeepEquals, []*state.Change{chg0, chg1})
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_try_test.go snapd-2.48.3+20.04/overlord/snapstate/snapstate_try_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_try_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapstate_try_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,165 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate_test
+
+import (
+	"bytes"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/snap"
+)
+
+func (s *snapmgrTestSuite) TestTrySetsTryMode(c *C) {
+	s.testTrySetsTryMode(snapstate.Flags{}, c)
+}
+
+func (s *snapmgrTestSuite) TestTrySetsTryModeDevMode(c *C) {
+	s.testTrySetsTryMode(snapstate.Flags{DevMode: true}, c)
+}
+func (s *snapmgrTestSuite) TestTrySetsTryModeJailMode(c *C) {
+	s.testTrySetsTryMode(snapstate.Flags{JailMode: true}, c)
+}
+func (s *snapmgrTestSuite) TestTrySetsTryModeClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.testTrySetsTryMode(snapstate.Flags{Classic: true}, c, "confinement: classic\n")
+}
+
+func (s *snapmgrTestSuite) testTrySetsTryMode(flags snapstate.Flags, c *C, extraYaml ...string) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// make mock try dir
+	d := c.MkDir()
+	c.Assert(os.Chmod(d, 0755), IsNil)
+	tryYaml := filepath.Join(d, "meta", "snap.yaml")
+	err := os.MkdirAll(filepath.Dir(tryYaml), 0755)
+	c.Assert(err, IsNil)
+	buf := bytes.Buffer{}
+	buf.WriteString("name: foo\nversion: 1.0\n")
+	if len(extraYaml) > 0 {
+		for _, extra := range extraYaml {
+			buf.WriteString(extra)
+		}
+	}
+	err = ioutil.WriteFile(tryYaml, buf.Bytes(), 0644)
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("try", "try snap")
+	ts, err := snapstate.TryPath(s.state, "foo", d, flags)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is in TryMode
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "foo", &snapst)
+	c.Assert(err, IsNil)
+
+	flags.TryMode = true
+	c.Check(snapst.Flags, DeepEquals, flags)
+
+	c.Check(s.state.TaskCount(), Equals, len(ts.Tasks()))
+	c.Check(taskKinds(ts.Tasks()), DeepEquals, []string{
+		"prerequisites",
+		"prepare-snap",
+		"mount-snap",
+		"copy-snap-data",
+		"setup-profiles",
+		"link-snap",
+		"auto-connect",
+		"set-auto-aliases",
+		"setup-aliases",
+		"run-hook[install]",
+		"start-snap-services",
+		"run-hook[configure]",
+		"run-hook[check-health]",
+	})
+
+}
+
+func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlag(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+	s.testTrySetsTryMode(snapstate.Flags{}, c)
+}
+
+func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlagLeavesDevMode(c *C) {
+	s.testTrySetsTryMode(snapstate.Flags{DevMode: true}, c)
+}
+func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlagLeavesJailMode(c *C) {
+	s.testTrySetsTryMode(snapstate.Flags{JailMode: true}, c)
+}
+func (s *snapmgrTestSuite) TestTryUndoRemovesTryFlagLeavesClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+	s.testTrySetsTryMode(snapstate.Flags{Classic: true}, c, "confinement: classic\n")
+}
+
+func (s *snapmgrTestSuite) testTryUndoRemovesTryFlag(flags snapstate.Flags, c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// simulate existing state for foo
+	var snapst snapstate.SnapState
+	snapst.Sequence = []*snap.SideInfo{
+		{
+			RealName: "foo",
+			Revision: snap.R(23),
+		},
+	}
+	snapst.Flags = flags
+	snapst.Current = snap.R(23)
+	snapstate.Set(s.state, "foo", &snapst)
+	c.Check(snapst.TryMode, Equals, false)
+
+	chg := s.state.NewChange("try", "try snap")
+	ts, err := snapstate.TryPath(s.state, "foo", c.MkDir(), flags)
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	last := ts.Tasks()[len(ts.Tasks())-1]
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(last)
+	chg.AddTask(terr)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snap is not in try mode, the state got undone
+	err = snapstate.Get(s.state, "foo", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Flags, DeepEquals, flags)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_update_test.go snapd-2.48.3+20.04/overlord/snapstate/snapstate_update_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/snapstate_update_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/snapstate_update_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,5622 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+
+	. "gopkg.in/check.v1"
+	"gopkg.in/tomb.v2"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/overlord/auth"
+	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/ifacestate/ifacerepo"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/snapstate/snapstatetest"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/store"
+	"github.com/snapcore/snapd/testutil"
+
+	// So it registers Configure.
+	_ "github.com/snapcore/snapd/overlord/configstate"
+)
+
+func verifyUpdateTasks(c *C, opts, discards int, ts *state.TaskSet, st *state.State) {
+	kinds := taskKinds(ts.Tasks())
+
+	expected := []string{
+		"prerequisites",
+		"download-snap",
+		"validate-snap",
+		"mount-snap",
+	}
+	expected = append(expected, "run-hook[pre-refresh]")
+	if opts&unlinkBefore != 0 {
+		expected = append(expected,
+			"stop-snap-services",
+		)
+	}
+	if opts&unlinkBefore != 0 {
+		expected = append(expected,
+			"remove-aliases",
+			"unlink-current-snap",
+		)
+	}
+	if opts&updatesGadget != 0 {
+		expected = append(expected, "update-gadget-assets")
+	}
+	expected = append(expected,
+		"copy-snap-data",
+		"setup-profiles",
+		"link-snap",
+	)
+	if opts&maybeCore != 0 {
+		expected = append(expected, "setup-profiles")
+	}
+	expected = append(expected,
+		"auto-connect",
+		"set-auto-aliases",
+		"setup-aliases",
+		"run-hook[post-refresh]",
+		"start-snap-services")
+
+	c.Assert(ts.Tasks()[len(expected)-2].Summary(), Matches, `Run post-refresh hook of .*`)
+	for i := 0; i < discards; i++ {
+		expected = append(expected,
+			"clear-snap",
+			"discard-snap",
+		)
+	}
+	if opts&cleanupAfter != 0 {
+		expected = append(expected,
+			"cleanup",
+		)
+	}
+	expected = append(expected,
+		"run-hook[configure]",
+		"run-hook[check-health]",
+	)
+	if opts&doesReRefresh != 0 {
+		expected = append(expected, "check-rerefresh")
+	}
+
+	c.Assert(kinds, DeepEquals, expected)
+}
+
+func (s *snapmgrTestSuite) TestUpdateDoesGC(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(4),
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("update", "update a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure garbage collection runs as the last tasks
+	expectedTail := fakeOps{
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/1"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+		},
+		{
+			op:    "remove-snap-files",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/2"),
+			stype: "app",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+	}
+
+	opsTail := s.fakeBackend.ops[len(s.fakeBackend.ops)-len(expectedTail):]
+	c.Assert(opsTail.Ops(), DeepEquals, expectedTail.Ops())
+	c.Check(opsTail, DeepEquals, expectedTail)
+}
+
+func (s *snapmgrTestSuite) TestUpdateScenarios(c *C) {
+	// TODO: also use channel-for-7 or equiv to check updates that are switches
+	for k, t := range switchScenarios {
+		s.testUpdateScenario(c, k, t)
+	}
+}
+
+func (s *snapmgrTestSuite) testUpdateScenario(c *C, desc string, t switchScenario) {
+	// reset
+	s.fakeBackend.ops = nil
+
+	comment := Commentf("%q (%+v)", desc, t)
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+		Channel:  t.chanFrom,
+		SnapID:   "some-snap-id",
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Sequence:        []*snap.SideInfo{&si},
+		Active:          true,
+		Current:         si.Revision,
+		TrackingChannel: t.chanFrom,
+		CohortKey:       t.cohFrom,
+	})
+
+	chg := s.state.NewChange("update-snap", t.summary)
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{
+		Channel:     t.chanTo,
+		CohortKey:   t.cohTo,
+		LeaveCohort: t.cohFrom != "" && t.cohTo == "",
+	}, 0, snapstate.Flags{})
+	c.Assert(err, IsNil, comment)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	// switch is not really really doing anything backend related
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, []string{
+		"storesvc-snap-action",
+		"storesvc-snap-action:action",
+		"storesvc-download",
+		"validate-snap:Doing",
+		"current",
+		"open-snap-file",
+		"setup-snap",
+		"remove-snap-aliases",
+		"unlink-snap",
+		"copy-data",
+		"setup-profiles:Doing",
+		"candidate",
+		"link-snap",
+		"auto-connect:Doing",
+		"update-aliases",
+		"cleanup-trash",
+	}, comment)
+
+	expectedChanTo := t.chanTo
+	if t.chanTo == "" {
+		expectedChanTo = t.chanFrom
+	}
+	expectedCohTo := t.cohTo
+
+	// ensure the desired channel/cohort has changed
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil, comment)
+	c.Assert(snapst.TrackingChannel, Equals, expectedChanTo, comment)
+	c.Assert(snapst.CohortKey, Equals, expectedCohTo, comment)
+
+	// ensure the current info *has* changed
+	info, err := snapst.CurrentInfo()
+	c.Assert(err, IsNil, comment)
+	c.Assert(info.Channel, Equals, expectedChanTo, comment)
+}
+
+func (s *snapmgrTestSuite) TestUpdateTasksWithOldCurrent(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	si1 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)}
+	si2 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)}
+	si3 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)}
+	si4 := &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)}
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{si1, si2, si3, si4},
+		Current:         snap.R(2),
+		SnapType:        "app",
+	})
+
+	// run the update
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 2, ts, s.state)
+
+	// and ensure that it will remove the revisions after "current"
+	// (si3, si4)
+	var snapsup snapstate.SnapSetup
+	tasks := ts.Tasks()
+
+	i := len(tasks) - 8
+	c.Check(tasks[i].Kind(), Equals, "clear-snap")
+	err = tasks[i].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Revision(), Equals, si3.Revision)
+
+	i = len(tasks) - 6
+	c.Check(tasks[i].Kind(), Equals, "clear-snap")
+	err = tasks[i].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Revision(), Equals, si4.Revision)
+}
+
+func (s *snapmgrTestSuite) TestUpdateCanDoBackwards(c *C) {
+	si7 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	si11 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(11),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si7, &si11},
+		Current:  si11.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Revision: snap.R(7)}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+	expected := fakeOps{
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+			old:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "",
+				Revision: snap.R(7),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "some-snap",
+			revno: snap.R(7),
+		},
+	}
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+}
+
+func revs(seq []*snap.SideInfo) []int {
+	revs := make([]int, len(seq))
+	for i, si := range seq {
+		revs[i] = si.Revision.N
+	}
+
+	return revs
+}
+
+type opSeqOpts struct {
+	revert  bool
+	fail    bool
+	before  []int
+	current int
+	via     int
+	after   []int
+}
+
+// build a SnapState with a revision sequence given by `before` and a
+// current revision of `current`. Then refresh --revision via. Then
+// check the revision sequence is as in `after`.
+func (s *snapmgrTestSuite) testOpSequence(c *C, opts *opSeqOpts) (*snapstate.SnapState, *state.TaskSet) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	seq := make([]*snap.SideInfo, len(opts.before))
+	for i, n := range opts.before {
+		seq[i] = &snap.SideInfo{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(n)}
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        seq,
+		Current:         snap.R(opts.current),
+		SnapType:        "app",
+	})
+
+	var chg *state.Change
+	var ts *state.TaskSet
+	var err error
+	if opts.revert {
+		chg = s.state.NewChange("revert", "revert a snap")
+		ts, err = snapstate.RevertToRevision(s.state, "some-snap", snap.R(opts.via), snapstate.Flags{})
+	} else {
+		chg = s.state.NewChange("refresh", "refresh a snap")
+		ts, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Revision: snap.R(opts.via)}, s.user.ID, snapstate.Flags{})
+	}
+	c.Assert(err, IsNil)
+	if opts.fail {
+		tasks := ts.Tasks()
+		var last *state.Task
+		// don't make a task wait on rerefresh, that's bad
+		for i := len(tasks) - 1; i > 0; i-- {
+			last = tasks[i]
+			if last.Kind() != "check-rerefresh" {
+				break
+			}
+		}
+		terr := s.state.NewTask("error-trigger", "provoking total undo")
+		terr.WaitFor(last)
+		if len(last.Lanes()) > 0 {
+			lanes := last.Lanes()
+			// sanity
+			c.Assert(lanes, HasLen, 1)
+			terr.JoinLane(lanes[0])
+		}
+		chg.AddTask(terr)
+	}
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(revs(snapst.Sequence), DeepEquals, opts.after)
+
+	return &snapst, ts
+}
+
+func (s *snapmgrTestSuite) testUpdateSequence(c *C, opts *opSeqOpts) *state.TaskSet {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	opts.revert = false
+	snapst, ts := s.testOpSequence(c, opts)
+	// update always ends with current==seq[-1]==via:
+	c.Check(snapst.Current.N, Equals, opts.after[len(opts.after)-1])
+	c.Check(snapst.Current.N, Equals, opts.via)
+
+	c.Check(s.fakeBackend.ops.Count("copy-data"), Equals, 1)
+	c.Check(s.fakeBackend.ops.First("copy-data"), DeepEquals, &fakeOp{
+		op:   "copy-data",
+		path: fmt.Sprintf(filepath.Join(dirs.SnapMountDir, "some-snap/%d"), opts.via),
+		old:  fmt.Sprintf(filepath.Join(dirs.SnapMountDir, "some-snap/%d"), opts.current),
+	})
+
+	return ts
+}
+
+func (s *snapmgrTestSuite) testUpdateFailureSequence(c *C, opts *opSeqOpts) *state.TaskSet {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	opts.revert = false
+	opts.after = opts.before
+	s.fakeBackend.linkSnapFailTrigger = fmt.Sprintf(filepath.Join(dirs.SnapMountDir, "some-snap/%d"), opts.via)
+	snapst, ts := s.testOpSequence(c, opts)
+	// a failed update will always end with current unchanged
+	c.Check(snapst.Current.N, Equals, opts.current)
+
+	ops := s.fakeBackend.ops
+	c.Check(ops.Count("copy-data"), Equals, 1)
+	do := ops.First("copy-data")
+
+	c.Check(ops.Count("undo-copy-snap-data"), Equals, 1)
+	undo := ops.First("undo-copy-snap-data")
+
+	do.op = undo.op
+	c.Check(do, DeepEquals, undo) // i.e. they only differed in the op
+
+	return ts
+}
+
+// testTotal*Failure fails *after* link-snap
+func (s *snapmgrTestSuite) testTotalUpdateFailureSequence(c *C, opts *opSeqOpts) *state.TaskSet {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	opts.revert = false
+	opts.fail = true
+	snapst, ts := s.testOpSequence(c, opts)
+	// a failed update will always end with current unchanged
+	c.Check(snapst.Current.N, Equals, opts.current)
+
+	ops := s.fakeBackend.ops
+	c.Check(ops.Count("copy-data"), Equals, 1)
+	do := ops.First("copy-data")
+
+	c.Check(ops.Count("undo-copy-snap-data"), Equals, 1)
+	undo := ops.First("undo-copy-snap-data")
+
+	do.op = undo.op
+	c.Check(do, DeepEquals, undo) // i.e. they only differed in the op
+
+	return ts
+}
+
+func (s *snapmgrTestSuite) TestUpdateLayoutsChecksFeatureFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// When layouts are disabled we cannot refresh to a snap depending on the feature.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", false)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-layout/stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
+
+	// When layouts are enabled we can refresh to a snap depending on the feature.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", true)
+	tr.Commit()
+
+	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-layout/stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyExplicitLayoutsChecksFeatureFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// When layouts are disabled we cannot refresh multiple snaps if one of them depends on the feature.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", false)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-layout/stable",
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	_, _, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	c.Assert(err, ErrorMatches, "experimental feature disabled - test it by setting 'experimental.layouts' to true")
+
+	// When layouts are enabled we can refresh multiple snaps if one of them depends on the feature.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", true)
+	tr.Commit()
+
+	_, _, err = snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyLayoutsChecksFeatureFlag(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// When layouts are disabled we cannot refresh multiple snaps if one of them depends on the feature.
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", false)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-layout/stable",
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	refreshes, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, s.user.ID, nil)
+	c.Assert(err, IsNil)
+	c.Assert(refreshes, HasLen, 0)
+
+	// When layouts are enabled we can refresh multiple snaps if one of them depends on the feature.
+	tr = config.NewTransaction(s.state)
+	tr.Set("core", "experimental.layouts", true)
+	tr.Commit()
+
+	refreshes, _, err = snapstate.UpdateMany(context.Background(), s.state, nil, s.user.ID, nil)
+	c.Assert(err, IsNil)
+	c.Assert(refreshes, DeepEquals, []string{"some-snap"})
+}
+
+func (s *snapmgrTestSuite) TestUpdateFailsEarlyOnEpochMismatch(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-epoch-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-epoch-snap", SnapID: "some-epoch-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Update(s.state, "some-epoch-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `cannot refresh "some-epoch-snap" to new revision 11 with epoch 42, because it can't read the current epoch of 13`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateTasksPropagatesErrors(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "fakestore-please-error-on-refresh", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `failing as requested`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateTasks(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	validateCalled := false
+	happyValidateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		validateCalled = true
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = happyValidateRefreshes
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+
+	c.Check(validateCalled, Equals, true)
+
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+
+	c.Check(snapsup.Channel, Equals, "some-channel")
+}
+
+func (s *snapmgrTestSuite) TestUpdateAmendRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(-42),
+	}
+	snaptest.MockSnap(c, `name: some-snap`, &si)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		Current:         si.Revision,
+		SnapType:        "app",
+		TrackingChannel: "latest/stable",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+	}})
+	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, []string{
+		"storesvc-snap-action",
+		"storesvc-snap-action:action",
+		"storesvc-download",
+		"validate-snap:Doing",
+		"current",
+		"open-snap-file",
+		"setup-snap",
+		"remove-snap-aliases",
+		"unlink-snap",
+		"copy-data",
+		"setup-profiles:Doing",
+		"candidate",
+		"link-snap",
+		"auto-connect:Doing",
+		"update-aliases",
+		"cleanup-trash",
+	})
+	// just check the interesting op
+	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
+		op: "storesvc-snap-action:action",
+		action: store.SnapAction{
+			Action:       "install", // we asked for an Update, but an amend is actually an Install
+			InstanceName: "some-snap",
+			Channel:      "some-channel",
+			Epoch:        snap.E("1*"), // in amend, epoch in the action is not nil!
+			Flags:        store.SnapActionEnforceValidation,
+		},
+		revno:  snap.R(11),
+		userID: 1,
+	})
+
+	task := ts.Tasks()[1]
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel: "some-channel",
+		UserID:  s.user.ID,
+
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+			Size:        5,
+		},
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+		Flags:     snapstate.Flags{Amend: true},
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(11),
+		Channel:  "some-channel",
+		SnapID:   "some-snap-id",
+	})
+
+	// verify services stop reason
+	verifyStopReason(c, ts, "refresh")
+
+	// check post-refresh hook
+	task = ts.Tasks()[14]
+	c.Assert(task.Kind(), Equals, "run-hook")
+	c.Assert(task.Summary(), Matches, `Run post-refresh hook of "some-snap" snap if present`)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "",
+		Revision: snap.R(-42),
+	})
+	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		Channel:  "some-channel",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(11),
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateRunThrough(c *C) {
+	// we start without the auxiliary store info (or with an older one)
+	c.Check(snapstate.AuxStoreInfoFilename("services-snap-id"), testutil.FileAbsent)
+
+	// use services-snap here to make sure services would be stopped/started appropriately
+	si := snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(7),
+		SnapID:   "services-snap-id",
+	}
+	snaptest.MockSnap(c, `name: services-snap`, &si)
+	fi, err := os.Stat(snap.MountFile("services-snap", si.Revision))
+	c.Assert(err, IsNil)
+	refreshedDate := fi.ModTime()
+	// look at disk
+	r := snapstate.MockRevisionDate(nil)
+	defer r()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		Current:         si.Revision,
+		SnapType:        "app",
+		TrackingChannel: "latest/stable",
+		CohortKey:       "embattled",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{
+		Channel:   "some-channel",
+		CohortKey: "some-cohort",
+	}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op: "storesvc-snap-action",
+			curSnaps: []store.CurrentSnap{{
+				InstanceName:    "services-snap",
+				SnapID:          "services-snap-id",
+				Revision:        snap.R(7),
+				TrackingChannel: "latest/stable",
+				RefreshedDate:   refreshedDate,
+				Epoch:           snap.E("0"),
+				CohortKey:       "embattled",
+			}},
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "refresh",
+				InstanceName: "services-snap",
+				SnapID:       "services-snap-id",
+				Channel:      "some-channel",
+				CohortKey:    "some-cohort",
+				Flags:        store.SnapActionEnforceValidation,
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "services-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "services-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: filepath.Join(dirs.SnapMountDir, "services-snap/7"),
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "services-snap",
+				SnapID:   "services-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "services-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "stop-snap-services:refresh",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap/7"),
+		},
+		{
+			op: "current-snap-service-states",
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "services-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap/7"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap/11"),
+			old:  filepath.Join(dirs.SnapMountDir, "services-snap/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "services-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "services-snap",
+				SnapID:   "services-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "services-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:       "start-snap-services",
+			path:     filepath.Join(dirs.SnapMountDir, "services-snap/11"),
+			services: []string{"svc1", "svc3", "svc2"},
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "services-snap",
+			revno: snap.R(11),
+		},
+	}
+
+	// ensure all our tasks ran
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "services-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
+	}})
+	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// check progress
+	task := ts.Tasks()[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel:   "some-channel",
+		CohortKey: "some-cohort",
+		UserID:    s.user.ID,
+
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "services-snap_11.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+		},
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeApp,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(11),
+		Channel:  "some-channel",
+		SnapID:   "services-snap-id",
+	})
+
+	// verify services stop reason
+	verifyStopReason(c, ts, "refresh")
+
+	// check post-refresh hook
+	task = ts.Tasks()[14]
+	c.Assert(task.Kind(), Equals, "run-hook")
+	c.Assert(task.Summary(), Matches, `Run post-refresh hook of "services-snap" snap if present`)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "services-snap",
+		SnapID:   "services-snap-id",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
+		RealName: "services-snap",
+		Channel:  "some-channel",
+		SnapID:   "services-snap-id",
+		Revision: snap.R(11),
+	})
+	c.Check(snapst.CohortKey, Equals, "some-cohort")
+
+	// we end up with the auxiliary store info
+	c.Check(snapstate.AuxStoreInfoFilename("services-snap-id"), testutil.FilePresent)
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceUpdateRunThrough(c *C) {
+	// use services-snap here to make sure services would be stopped/started appropriately
+	si := snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(7),
+		SnapID:   "services-snap-id",
+	}
+	snaptest.MockSnapInstance(c, "services-snap_instance", `name: services-snap`, &si)
+	fi, err := os.Stat(snap.MountFile("services-snap_instance", si.Revision))
+	c.Assert(err, IsNil)
+	refreshedDate := fi.ModTime()
+	// look at disk
+	r := snapstate.MockRevisionDate(nil)
+	defer r()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	snapstate.Set(s.state, "services-snap_instance", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		Current:         si.Revision,
+		SnapType:        "app",
+		TrackingChannel: "latest/stable",
+		InstanceKey:     "instance",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "services-snap_instance", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op: "storesvc-snap-action",
+			curSnaps: []store.CurrentSnap{{
+				InstanceName:    "services-snap_instance",
+				SnapID:          "services-snap-id",
+				Revision:        snap.R(7),
+				TrackingChannel: "latest/stable",
+				RefreshedDate:   refreshedDate,
+				Epoch:           snap.E("0"),
+			}},
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "refresh",
+				SnapID:       "services-snap-id",
+				InstanceName: "services-snap_instance",
+				Channel:      "some-channel",
+				Flags:        store.SnapActionEnforceValidation,
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "services-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "services-snap_instance",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "services-snap",
+				SnapID:   "services-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "services-snap_instance",
+			path:  filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "stop-snap-services:refresh",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
+		},
+		{
+			op: "current-snap-service-states",
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "services-snap_instance",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/11"),
+			old:  filepath.Join(dirs.SnapMountDir, "services-snap_instance/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "services-snap_instance",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "services-snap",
+				SnapID:   "services-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "services-snap_instance/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "services-snap_instance",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:       "start-snap-services",
+			path:     filepath.Join(dirs.SnapMountDir, "services-snap_instance/11"),
+			services: []string{"svc1", "svc3", "svc2"},
+		},
+		{
+			op:    "cleanup-trash",
+			name:  "services-snap_instance",
+			revno: snap.R(11),
+		},
+	}
+
+	// ensure all our tasks ran
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "services-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
+	}})
+	c.Check(s.fakeStore.seenPrivacyKeys["privacy-key"], Equals, true, Commentf("salts seen: %v", s.fakeStore.seenPrivacyKeys))
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// check progress
+	task := ts.Tasks()[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel: "some-channel",
+		UserID:  s.user.ID,
+
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "services-snap_instance_11.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+		},
+		SideInfo:    snapsup.SideInfo,
+		Type:        snap.TypeApp,
+		PlugsOnly:   true,
+		InstanceKey: "instance",
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(11),
+		Channel:  "some-channel",
+		SnapID:   "services-snap-id",
+	})
+
+	// verify services stop reason
+	verifyStopReason(c, ts, "refresh")
+
+	// check post-refresh hook
+	task = ts.Tasks()[14]
+	c.Assert(task.Kind(), Equals, "run-hook")
+	c.Assert(task.Summary(), Matches, `Run post-refresh hook of "services-snap_instance" snap if present`)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap_instance", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.InstanceKey, Equals, "instance")
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "services-snap",
+		SnapID:   "services-snap-id",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
+		RealName: "services-snap",
+		Channel:  "some-channel",
+		SnapID:   "services-snap-id",
+		Revision: snap.R(11),
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateWithNewBase(c *C) {
+	si := &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	snaptest.MockSnap(c, `name: some-snap`, si)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{si},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-base/stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
+		{macaroon: s.user.StoreMacaroon, name: "some-base", target: filepath.Join(dirs.SnapBlobDir, "some-base_11.snap")},
+		{macaroon: s.user.StoreMacaroon, name: "some-snap", target: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap")},
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateWithAlreadyInstalledBase(c *C) {
+	si := &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	snaptest.MockSnap(c, `name: some-snap`, si)
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{si},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/stable",
+		Sequence: []*snap.SideInfo{{
+			RealName: "some-base",
+			SnapID:   "some-base-id",
+			Revision: snap.R(1),
+		}},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-base"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
+		{macaroon: s.user.StoreMacaroon, name: "some-snap", target: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap")},
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateWithNewDefaultProvider(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(s.state, repo)
+
+	si := &snap.SideInfo{
+		RealName: "snap-content-plug",
+		SnapID:   "snap-content-plug-id",
+		Revision: snap.R(7),
+	}
+	snaptest.MockSnap(c, `name: snap-content-plug`, si)
+	snapstate.Set(s.state, "snap-content-plug", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{si},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "snap-content-plug", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
+		{macaroon: s.user.StoreMacaroon, name: "snap-content-plug", target: filepath.Join(dirs.SnapBlobDir, "snap-content-plug_11.snap")},
+		{macaroon: s.user.StoreMacaroon, name: "snap-content-slot", target: filepath.Join(dirs.SnapBlobDir, "snap-content-slot_11.snap")},
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateWithInstalledDefaultProvider(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, contentStore{fakeStore: s.fakeStore, state: s.state})
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(s.state, repo)
+
+	si := &snap.SideInfo{
+		RealName: "snap-content-plug",
+		SnapID:   "snap-content-plug-id",
+		Revision: snap.R(7),
+	}
+	snaptest.MockSnap(c, `name: snap-content-plug`, si)
+	snapstate.Set(s.state, "snap-content-plug", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{si},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+	snapstate.Set(s.state, "snap-content-slot", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/stable",
+		Sequence: []*snap.SideInfo{{
+			RealName: "snap-content-slot",
+			SnapID:   "snap-content-slot-id",
+			Revision: snap.R(1),
+		}},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "snap-content-plug", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{
+		{macaroon: s.user.StoreMacaroon, name: "snap-content-plug", target: filepath.Join(dirs.SnapBlobDir, "snap-content-plug_11.snap")},
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateRememberedUserRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.DoneStatus)
+	c.Assert(chg.Err(), IsNil)
+
+	for _, op := range s.fakeBackend.ops {
+		switch op.op {
+		case "storesvc-snap-action":
+			c.Check(op.userID, Equals, 1)
+		case "storesvc-download":
+			snapName := op.name
+			c.Check(s.fakeStore.downloads[0], DeepEquals, fakeDownload{
+				macaroon: "macaroon",
+				name:     "some-snap",
+				target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			}, Commentf(snapName))
+		}
+	}
+}
+
+func (s *snapmgrTestSuite) TestUpdateModelKernelSwitchTrackRunThrough(c *C) {
+	// use services-snap here to make sure services would be stopped/started appropriately
+	si := snap.SideInfo{
+		RealName: "kernel",
+		Revision: snap.R(7),
+		SnapID:   "kernel-id",
+	}
+	snaptest.MockSnap(c, `name: kernel`, &si)
+	fi, err := os.Stat(snap.MountFile("kernel", si.Revision))
+	c.Assert(err, IsNil)
+	refreshedDate := fi.ModTime()
+	// look at disk
+	r := snapstate.MockRevisionDate(nil)
+	defer r()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	r1 := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
+	defer r1()
+	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		Current:         si.Revision,
+		TrackingChannel: "18/stable",
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "edge"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(chg.Status(), Equals, state.DoneStatus)
+
+	c.Assert(len(s.fakeBackend.ops) > 2, Equals, true)
+	c.Assert(s.fakeBackend.ops[:2], DeepEquals, fakeOps{
+		{
+			op: "storesvc-snap-action",
+			curSnaps: []store.CurrentSnap{{
+				InstanceName:    "kernel",
+				SnapID:          "kernel-id",
+				Revision:        snap.R(7),
+				TrackingChannel: "18/stable",
+				RefreshedDate:   refreshedDate,
+				Epoch:           snap.E("1*"),
+			}},
+			userID: 1,
+		}, {
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "refresh",
+				InstanceName: "kernel",
+				SnapID:       "kernel-id",
+				Channel:      "18/edge",
+				Flags:        store.SnapActionEnforceValidation,
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+	})
+
+	// check progress
+	task := ts.Tasks()[1]
+	_, cur, total := task.Progress()
+	c.Assert(cur, Equals, s.fakeStore.fakeCurrentProgress)
+	c.Assert(total, Equals, s.fakeStore.fakeTotalProgress)
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel: "18/edge",
+		UserID:  s.user.ID,
+
+		SnapPath: filepath.Join(dirs.SnapBlobDir, "kernel_11.snap"),
+		DownloadInfo: &snap.DownloadInfo{
+			DownloadURL: "https://some-server.com/some/path.snap",
+		},
+		SideInfo:  snapsup.SideInfo,
+		Type:      snap.TypeKernel,
+		PlugsOnly: true,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "kernel",
+		Revision: snap.R(11),
+		Channel:  "18/edge",
+		SnapID:   "kernel-id",
+	})
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "kernel", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "18/edge")
+	c.Assert(snapst.Sequence, HasLen, 2)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "kernel",
+		SnapID:   "kernel-id",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+	c.Assert(snapst.Sequence[1], DeepEquals, &snap.SideInfo{
+		RealName: "kernel",
+		Channel:  "18/edge",
+		SnapID:   "kernel-id",
+		Revision: snap.R(11),
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyMultipleCredsNoUserRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core", Revision: snap.R(1), SnapID: "core-snap-id"},
+		},
+		Current:  snap.R(1),
+		SnapType: "os",
+	})
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "services-snap", Revision: snap.R(2), SnapID: "services-snap-id"},
+		},
+		Current:  snap.R(2),
+		SnapType: "app",
+		UserID:   2,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh all snaps")
+	// no user is passed to use for UpdateMany
+	updated, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	for _, ts := range tts {
+		chg.AddAll(ts)
+	}
+	c.Check(updated, HasLen, 3)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.DoneStatus)
+	c.Assert(chg.Err(), IsNil)
+
+	macaroonMap := map[string]string{
+		"core":          "",
+		"some-snap":     "macaroon",
+		"services-snap": "macaroon2",
+	}
+
+	seen := make(map[string]int)
+	ir := 0
+	di := 0
+	for _, op := range s.fakeBackend.ops {
+		switch op.op {
+		case "storesvc-snap-action":
+			ir++
+			c.Check(op.curSnaps, DeepEquals, []store.CurrentSnap{
+				{
+					InstanceName:  "core",
+					SnapID:        "core-snap-id",
+					Revision:      snap.R(1),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 1),
+					Epoch:         snap.E("1*"),
+				},
+				{
+					InstanceName:  "services-snap",
+					SnapID:        "services-snap-id",
+					Revision:      snap.R(2),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 2),
+					Epoch:         snap.E("0"),
+				},
+				{
+					InstanceName:  "some-snap",
+					SnapID:        "some-snap-id",
+					Revision:      snap.R(5),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 5),
+					Epoch:         snap.E("1*"),
+				},
+			})
+		case "storesvc-snap-action:action":
+			snapID := op.action.SnapID
+			seen[snapID] = op.userID
+		case "storesvc-download":
+			snapName := op.name
+			fakeDl := s.fakeStore.downloads[di]
+			// check target path separately and clear it
+			c.Check(fakeDl.target, Matches, filepath.Join(dirs.SnapBlobDir, fmt.Sprintf("%s_[0-9]+.snap", snapName)))
+			fakeDl.target = ""
+			c.Check(fakeDl, DeepEquals, fakeDownload{
+				macaroon: macaroonMap[snapName],
+				name:     snapName,
+			}, Commentf(snapName))
+			di++
+		}
+	}
+	c.Check(ir, Equals, 2)
+	// we check all snaps with each user
+	c.Check(seen["some-snap-id"], Equals, 1)
+	c.Check(seen["services-snap-id"], Equals, 2)
+	// coalesced with one of the others
+	c.Check(seen["core-snap-id"] > 0, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyMultipleCredsUserRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core", Revision: snap.R(1), SnapID: "core-snap-id"},
+		},
+		Current:  snap.R(1),
+		SnapType: "os",
+	})
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "services-snap", Revision: snap.R(2), SnapID: "services-snap-id"},
+		},
+		Current:  snap.R(2),
+		SnapType: "app",
+		UserID:   2,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh all snaps")
+	// do UpdateMany using user 2 as fallback
+	updated, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 2, nil)
+	c.Assert(err, IsNil)
+	for _, ts := range tts {
+		chg.AddAll(ts)
+	}
+	c.Check(updated, HasLen, 3)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.DoneStatus)
+	c.Assert(chg.Err(), IsNil)
+
+	macaroonMap := map[string]string{
+		"core":          "macaroon2",
+		"some-snap":     "macaroon",
+		"services-snap": "macaroon2",
+	}
+
+	type snapIDuserID struct {
+		snapID string
+		userID int
+	}
+	seen := make(map[snapIDuserID]bool)
+	ir := 0
+	di := 0
+	for _, op := range s.fakeBackend.ops {
+		switch op.op {
+		case "storesvc-snap-action":
+			ir++
+			c.Check(op.curSnaps, DeepEquals, []store.CurrentSnap{
+				{
+					InstanceName:  "core",
+					SnapID:        "core-snap-id",
+					Revision:      snap.R(1),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 1),
+					Epoch:         snap.E("1*"),
+				},
+				{
+					InstanceName:  "services-snap",
+					SnapID:        "services-snap-id",
+					Revision:      snap.R(2),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 2),
+					Epoch:         snap.E("0"),
+				},
+				{
+					InstanceName:  "some-snap",
+					SnapID:        "some-snap-id",
+					Revision:      snap.R(5),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 5),
+					Epoch:         snap.E("1*"),
+				},
+			})
+		case "storesvc-snap-action:action":
+			snapID := op.action.SnapID
+			seen[snapIDuserID{snapID: snapID, userID: op.userID}] = true
+		case "storesvc-download":
+			snapName := op.name
+			fakeDl := s.fakeStore.downloads[di]
+			// check target path separately and clear it
+			c.Check(fakeDl.target, Matches, filepath.Join(dirs.SnapBlobDir, fmt.Sprintf("%s_[0-9]+.snap", snapName)))
+			fakeDl.target = ""
+			c.Check(fakeDl, DeepEquals, fakeDownload{
+				macaroon: macaroonMap[snapName],
+				name:     snapName,
+			}, Commentf(snapName))
+			di++
+		}
+	}
+	c.Check(ir, Equals, 2)
+	// we check all snaps with each user
+	c.Check(seen, DeepEquals, map[snapIDuserID]bool{
+		{snapID: "core-snap-id", userID: 2}:     true,
+		{snapID: "some-snap-id", userID: 1}:     true,
+		{snapID: "services-snap-id", userID: 2}: true,
+	})
+
+	var coreState, snapState snapstate.SnapState
+	// user in SnapState was preserved
+	err = snapstate.Get(s.state, "some-snap", &snapState)
+	c.Assert(err, IsNil)
+	c.Check(snapState.UserID, Equals, 1)
+	c.Check(snapState.Current, DeepEquals, snap.R(11))
+
+	// user in SnapState was set
+	err = snapstate.Get(s.state, "core", &coreState)
+	c.Assert(err, IsNil)
+	c.Check(coreState.UserID, Equals, 2)
+	c.Check(coreState.Current, DeepEquals, snap.R(11))
+
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyMultipleCredsUserWithNoStoreAuthRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core", Revision: snap.R(1), SnapID: "core-snap-id"},
+		},
+		Current:  snap.R(1),
+		SnapType: "os",
+	})
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "services-snap", Revision: snap.R(2), SnapID: "services-snap-id"},
+		},
+		Current:  snap.R(2),
+		SnapType: "app",
+		UserID:   3,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh all snaps")
+	// no user is passed to use for UpdateMany
+	updated, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	for _, ts := range tts {
+		chg.AddAll(ts)
+	}
+	c.Check(updated, HasLen, 3)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.DoneStatus)
+	c.Assert(chg.Err(), IsNil)
+
+	macaroonMap := map[string]string{
+		"core":          "",
+		"some-snap":     "macaroon",
+		"services-snap": "",
+	}
+
+	seen := make(map[string]int)
+	ir := 0
+	di := 0
+	for _, op := range s.fakeBackend.ops {
+		switch op.op {
+		case "storesvc-snap-action":
+			ir++
+			c.Check(op.curSnaps, DeepEquals, []store.CurrentSnap{
+				{
+					InstanceName:  "core",
+					SnapID:        "core-snap-id",
+					Revision:      snap.R(1),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 1),
+					Epoch:         snap.E("1*"),
+				},
+				{
+					InstanceName:  "services-snap",
+					SnapID:        "services-snap-id",
+					Revision:      snap.R(2),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 2),
+					Epoch:         snap.E("0"),
+				},
+				{
+					InstanceName:  "some-snap",
+					SnapID:        "some-snap-id",
+					Revision:      snap.R(5),
+					RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 5),
+					Epoch:         snap.E("1*"),
+				},
+			})
+		case "storesvc-snap-action:action":
+			snapID := op.action.SnapID
+			if _, ok := seen[snapID]; !ok {
+				seen[snapID] = op.userID
+			}
+		case "storesvc-download":
+			snapName := op.name
+			fakeDl := s.fakeStore.downloads[di]
+			// check target path separately and clear it
+			c.Check(fakeDl.target, Matches, filepath.Join(dirs.SnapBlobDir, fmt.Sprintf("%s_[0-9]+.snap", snapName)))
+			fakeDl.target = ""
+			c.Check(fakeDl, DeepEquals, fakeDownload{
+				macaroon: macaroonMap[snapName],
+				name:     snapName,
+			}, Commentf(snapName))
+			di++
+		}
+	}
+	c.Check(ir, Equals, 1)
+	// we check all snaps with each user
+	c.Check(seen["some-snap-id"], Equals, 1)
+	// coalesced with request for 1
+	c.Check(seen["services-snap-id"], Equals, 1)
+	c.Check(seen["core-snap-id"], Equals, 1)
+}
+
+func (s *snapmgrTestSuite) TestUpdateUndoRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("install", "install a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "/some-snap/11")
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op: "storesvc-snap-action",
+			curSnaps: []store.CurrentSnap{{
+				InstanceName:  "some-snap",
+				SnapID:        "some-snap-id",
+				Revision:      snap.R(7),
+				RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
+				Epoch:         snap.E("1*"),
+			}},
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "refresh",
+				InstanceName: "some-snap",
+				SnapID:       "some-snap-id",
+				Channel:      "some-channel",
+				Flags:        store.SnapActionEnforceValidation,
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap.failed",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "setup-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:   "undo-copy-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "undo-setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+
+	// ensure all our tasks ran
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+	}})
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 1)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+}
+
+func lastWithLane(tasks []*state.Task) *state.Task {
+	for i := len(tasks) - 1; i >= 0; i-- {
+		if lanes := tasks[i].Lanes(); len(lanes) == 1 && lanes[0] != 0 {
+			return tasks[i]
+		}
+	}
+	return nil
+}
+
+func (s *snapmgrTestSuite) TestUpdateUndoRestoresRevisionConfig(c *C) {
+	var errorTaskExecuted bool
+
+	// overwrite error-trigger task handler with custom one for this test
+	erroringHandler := func(task *state.Task, _ *tomb.Tomb) error {
+		st := task.State()
+		st.Lock()
+		defer st.Unlock()
+
+		// modify current config of some-snap
+		tr := config.NewTransaction(st)
+		tr.Set("some-snap", "foo", "canary")
+		tr.Commit()
+
+		errorTaskExecuted = true
+		return errors.New("error out")
+	}
+	s.o.TaskRunner().AddHandler("error-trigger", erroringHandler, nil)
+
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	si2 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(6),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si2, &si},
+		TrackingChannel: "latest/stable",
+		Current:         si.Revision,
+		SnapType:        "app",
+	})
+
+	// set some configuration
+	tr := config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "revision 7 value")
+	tr.Commit()
+	config.SaveRevisionConfig(s.state, "some-snap", snap.R(7))
+
+	chg := s.state.NewChange("install", "install a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	last := lastWithLane(ts.Tasks())
+	c.Assert(last, NotNil)
+
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(last)
+	terr.JoinLane(last.Lanes()[0])
+	chg.AddTask(terr)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(chg.Status(), Equals, state.ErrorStatus)
+	c.Check(errorTaskExecuted, Equals, true)
+
+	// after undoing the update some-snap config should be restored to that of rev.7
+	var val string
+	tr = config.NewTransaction(s.state)
+	c.Assert(tr.Get("some-snap", "foo", &val), IsNil)
+	c.Check(val, Equals, "revision 7 value")
+}
+
+func (s *snapmgrTestSuite) TestUpdateMakesConfigSnapshot(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "bar")
+	tr.Commit()
+
+	var cfgs map[string]interface{}
+	// we don't have config snapshots yet
+	c.Assert(s.state.Get("revision-config", &cfgs), Equals, state.ErrNoState)
+
+	chg := s.state.NewChange("update", "update a snap")
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(2)}
+	ts, err := snapstate.Update(s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+
+	s.state.Lock()
+	cfgs = nil
+	// config copy of rev. 1 has been made
+	c.Assert(s.state.Get("revision-config", &cfgs), IsNil)
+	c.Assert(cfgs["some-snap"], DeepEquals, map[string]interface{}{
+		"1": map[string]interface{}{
+			"foo": "bar",
+		},
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateTotalUndoRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "latest/stable",
+		Current:         si.Revision,
+		SnapType:        "app",
+	})
+
+	chg := s.state.NewChange("install", "install a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	// We need to make it not be rerefresh, and we could do just
+	// that but instead we do the 'right' thing and attach it to
+	// the last task that's on a lane.
+	last := lastWithLane(ts.Tasks())
+	c.Assert(last, NotNil)
+
+	terr := s.state.NewTask("error-trigger", "provoking total undo")
+	terr.WaitFor(last)
+	terr.JoinLane(last.Lanes()[0])
+	chg.AddTask(terr)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		{
+			op: "storesvc-snap-action",
+			curSnaps: []store.CurrentSnap{{
+				InstanceName:    "some-snap",
+				SnapID:          "some-snap-id",
+				Revision:        snap.R(7),
+				TrackingChannel: "latest/stable",
+				RefreshedDate:   fakeRevDateEpoch.AddDate(0, 0, 7),
+				Epoch:           snap.E("1*"),
+			}},
+			userID: 1,
+		},
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "refresh",
+				InstanceName: "some-snap",
+				SnapID:       "some-snap-id",
+				Channel:      "some-channel",
+				Flags:        store.SnapActionEnforceValidation,
+			},
+			revno:  snap.R(11),
+			userID: 1,
+		},
+		{
+			op:   "storesvc-download",
+			name: "some-snap",
+		},
+		{
+			op:    "validate-snap:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:  "current",
+			old: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "open-snap-file",
+			path: filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:    "setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			revno: snap.R(11),
+		},
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "copy-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:    "setup-profiles:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "candidate",
+			sinfo: snap.SideInfo{
+				RealName: "some-snap",
+				SnapID:   "some-snap-id",
+				Channel:  "some-channel",
+				Revision: snap.R(11),
+			},
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "auto-connect:Doing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op: "update-aliases",
+		},
+		// undoing everything from here down...
+		{
+			op:   "remove-snap-aliases",
+			name: "some-snap",
+		},
+		{
+			op: "current-snap-service-states",
+		},
+		{
+			op:   "unlink-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+		},
+		{
+			op:    "setup-profiles:Undoing",
+			name:  "some-snap",
+			revno: snap.R(11),
+		},
+		{
+			op:   "undo-copy-snap-data",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			old:  filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op:   "link-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap/7"),
+		},
+		{
+			op: "update-aliases",
+		},
+		{
+			op:    "undo-setup-snap",
+			name:  "some-snap",
+			path:  filepath.Join(dirs.SnapMountDir, "some-snap/11"),
+			stype: "app",
+		},
+		{
+			op:   "remove-snap-dir",
+			name: "some-snap",
+			path: filepath.Join(dirs.SnapMountDir, "some-snap"),
+		},
+	}
+
+	// ensure all our tasks ran
+	c.Check(s.fakeStore.downloads, DeepEquals, []fakeDownload{{
+		macaroon: s.user.StoreMacaroon,
+		name:     "some-snap",
+		target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+	}})
+	// friendlier failure first
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.TrackingChannel, Equals, "latest/stable")
+	c.Assert(snapst.Sequence, HasLen, 1)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "",
+		Revision: snap.R(7),
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevision(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, Equals, store.ErrNoUpdateAvailable)
+}
+
+func (s *snapmgrTestSuite) TestUpdateToRevisionRememberedUserRunThrough(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(11)}, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Status(), Equals, state.DoneStatus)
+	c.Assert(chg.Err(), IsNil)
+
+	for _, op := range s.fakeBackend.ops {
+		switch op.op {
+		case "storesvc-snap-action:action":
+			c.Check(op.userID, Equals, 1)
+		case "storesvc-download":
+			snapName := op.name
+			c.Check(s.fakeStore.downloads[0], DeepEquals, fakeDownload{
+				macaroon: "macaroon",
+				name:     "some-snap",
+				target:   filepath.Join(dirs.SnapBlobDir, "some-snap_11.snap"),
+			}, Commentf(snapName))
+		}
+	}
+}
+
+// A noResultsStore returns no results for install/refresh requests
+type noResultsStore struct {
+	*fakeStore
+}
+
+func (n noResultsStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	if assertQuery != nil {
+		panic("no assertion query support")
+	}
+	return nil, nil, &store.SnapActionError{NoResults: true}
+}
+
+func (s *snapmgrTestSuite) TestUpdateNoStoreResults(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, noResultsStore{fakeStore: s.fakeStore})
+
+	// this is an atypical case in which the store didn't return
+	// an error nor a result, we are defensive and return
+	// a reasonable error
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, Equals, snapstate.ErrMissingExpectedResult)
+}
+
+func (s *snapmgrTestSuite) TestUpdateNoStoreResultsWithChannelChange(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.ReplaceStore(s.state, noResultsStore{fakeStore: s.fakeStore})
+
+	// this is an atypical case in which the store didn't return
+	// an error nor a result, we are defensive and return
+	// a reasonable error
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-9/stable",
+		Current:         si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, Equals, snapstate.ErrMissingExpectedResult)
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevisionSwitchesChannel(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "other-chanenl/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	c.Check(ts.Tasks(), HasLen, 1)
+	c.Check(ts.Tasks()[0].Kind(), Equals, "switch-snap-channel")
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevisionSwitchesChannelConflict(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "other-channel/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	// make it visible
+	s.state.NewChange("refresh", "refresh a snap").AddAll(ts)
+
+	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
+	c.Check(err, ErrorMatches, `snap "some-snap" has "refresh" change in progress`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevisionSwitchChannelRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "other-channel",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "other-channel/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	expected := fakeOps{
+		// we just expect the "storesvc-snap-action" ops, we
+		// don't have a fakeOp for switchChannel because it has
+		// not a backend method, it just manipulates the state
+		{
+			op: "storesvc-snap-action",
+			curSnaps: []store.CurrentSnap{{
+				InstanceName:    "some-snap",
+				SnapID:          "some-snap-id",
+				Revision:        snap.R(7),
+				TrackingChannel: "other-channel/stable",
+				RefreshedDate:   fakeRevDateEpoch.AddDate(0, 0, 7),
+				Epoch:           snap.E("1*"),
+			}},
+			userID: 1,
+		},
+
+		{
+			op: "storesvc-snap-action:action",
+			action: store.SnapAction{
+				Action:       "refresh",
+				InstanceName: "some-snap",
+				SnapID:       "some-snap-id",
+				Channel:      "channel-for-7/stable",
+				Flags:        store.SnapActionEnforceValidation,
+			},
+			userID: 1,
+		},
+	}
+
+	// start with an easier-to-read error if this fails:
+	c.Assert(s.fakeBackend.ops.Ops(), DeepEquals, expected.Ops())
+	c.Assert(s.fakeBackend.ops, DeepEquals, expected)
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	task := ts.Tasks()[0]
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Assert(snapsup, DeepEquals, snapstate.SnapSetup{
+		Channel:  "channel-for-7/stable",
+		SideInfo: snapsup.SideInfo,
+	})
+	c.Assert(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+		Channel:  "channel-for-7/stable",
+	})
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Assert(snapst.Active, Equals, true)
+	c.Assert(snapst.Sequence, HasLen, 1)
+	c.Assert(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "channel-for-7/stable",
+		Revision: snap.R(7),
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevisionToggleIgnoreValidation(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
+	c.Assert(err, IsNil)
+	c.Check(ts.Tasks(), HasLen, 1)
+	c.Check(ts.Tasks()[0].Kind(), Equals, "toggle-snap-flags")
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevisionToggleIgnoreValidationConflict(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
+	c.Assert(err, IsNil)
+	// make it visible
+	s.state.NewChange("refresh", "refresh a snap").AddAll(ts)
+
+	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
+	c.Check(err, ErrorMatches, `snap "some-snap" has "refresh" change in progress`)
+
+}
+
+func (s *snapmgrTestSuite) TestUpdateSameRevisionToggleIgnoreValidationRunThrough(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+		Channel:  "channel-for-7",
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7/stable"}, s.user.ID, snapstate.Flags{IgnoreValidation: true})
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snapSetup info
+	var snapsup snapstate.SnapSetup
+	task := ts.Tasks()[0]
+	err = task.Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Check(snapsup, DeepEquals, snapstate.SnapSetup{
+		SideInfo: snapsup.SideInfo,
+		Flags: snapstate.Flags{
+			IgnoreValidation: true,
+		},
+	})
+	c.Check(snapsup.SideInfo, DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+		Channel:  "channel-for-7",
+	})
+
+	// verify snaps in the system state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	c.Check(snapst.Active, Equals, true)
+	c.Check(snapst.Sequence, HasLen, 1)
+	c.Check(snapst.Sequence[0], DeepEquals, &snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Channel:  "channel-for-7",
+		Revision: snap.R(7),
+	})
+	c.Check(snapst.IgnoreValidation, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestUpdateValidateRefreshesSaysNo(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+	})
+
+	validateErr := errors.New("refresh control error")
+	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		c.Check(refreshes, HasLen, 1)
+		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
+		c.Check(refreshes[0].Revision, Equals, snap.R(11))
+		c.Check(ignoreValidation, HasLen, 0)
+		return nil, validateErr
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshes
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, Equals, validateErr)
+}
+
+func (s *snapmgrTestSuite) TestUpdateValidateRefreshesSaysNoButIgnoreValidationIsSet(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	validateErr := errors.New("refresh control error")
+	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		return nil, validateErr
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshes
+
+	flags := snapstate.Flags{JailMode: true, IgnoreValidation: true}
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
+	c.Assert(err, IsNil)
+
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Flags, DeepEquals, flags.ForSnapSetup())
+}
+
+func (s *snapmgrTestSuite) TestUpdateIgnoreValidationSticky(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	validateErr := errors.New("refresh control error")
+	validateRefreshesFail := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		c.Check(refreshes, HasLen, 1)
+		if len(ignoreValidation) == 0 {
+			return nil, validateErr
+		}
+		c.Check(ignoreValidation, DeepEquals, map[string]bool{
+			"some-snap": true,
+		})
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshesFail
+
+	flags := snapstate.Flags{IgnoreValidation: true}
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:     "some-snap",
+			SnapID:           "some-snap-id",
+			Revision:         snap.R(7),
+			IgnoreValidation: false,
+			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
+			Epoch:            snap.E("1*"),
+		}},
+		userID: 1,
+	})
+	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
+		op:    "storesvc-snap-action:action",
+		revno: snap.R(11),
+		action: store.SnapAction{
+			Action:       "refresh",
+			InstanceName: "some-snap",
+			SnapID:       "some-snap-id",
+			Channel:      "stable",
+			Flags:        store.SnapActionIgnoreValidation,
+		},
+		userID: 1,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snap has IgnoreValidation set
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.IgnoreValidation, Equals, true)
+	c.Check(snapst.Current, Equals, snap.R(11))
+
+	s.fakeBackend.ops = nil
+	s.fakeStore.refreshRevnos = map[string]snap.Revision{
+		"some-snap-id": snap.R(12),
+	}
+	_, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	c.Assert(err, IsNil)
+	c.Check(tts, HasLen, 2)
+	verifyLastTasksetIsReRefresh(c, tts)
+
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:     "some-snap",
+			SnapID:           "some-snap-id",
+			Revision:         snap.R(11),
+			TrackingChannel:  "latest/stable",
+			IgnoreValidation: true,
+			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 11),
+			Epoch:            snap.E("1*"),
+		}},
+		userID: 1,
+	})
+	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
+		op:    "storesvc-snap-action:action",
+		revno: snap.R(12),
+		action: store.SnapAction{
+			Action:       "refresh",
+			InstanceName: "some-snap",
+			SnapID:       "some-snap-id",
+			Flags:        0,
+		},
+		userID: 1,
+	})
+
+	chg = s.state.NewChange("refresh", "refresh snaps")
+	chg.AddAll(tts[0])
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	snapst = snapstate.SnapState{}
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.IgnoreValidation, Equals, true)
+	c.Check(snapst.Current, Equals, snap.R(12))
+
+	// reset ignore validation
+	s.fakeBackend.ops = nil
+	s.fakeStore.refreshRevnos = map[string]snap.Revision{
+		"some-snap-id": snap.R(11),
+	}
+	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshes
+	flags = snapstate.Flags{}
+	ts, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:     "some-snap",
+			SnapID:           "some-snap-id",
+			Revision:         snap.R(12),
+			TrackingChannel:  "latest/stable",
+			IgnoreValidation: true,
+			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 12),
+			Epoch:            snap.E("1*"),
+		}},
+		userID: 1,
+	})
+	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
+		op:    "storesvc-snap-action:action",
+		revno: snap.R(11),
+		action: store.SnapAction{
+			Action:       "refresh",
+			InstanceName: "some-snap",
+			SnapID:       "some-snap-id",
+			Channel:      "latest/stable",
+			Flags:        store.SnapActionEnforceValidation,
+		},
+		userID: 1,
+	})
+
+	chg = s.state.NewChange("refresh", "refresh snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	snapst = snapstate.SnapState{}
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.IgnoreValidation, Equals, false)
+	c.Check(snapst.Current, Equals, snap.R(11))
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceUpdateIgnoreValidationSticky(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Active:      true,
+		Sequence:    []*snap.SideInfo{&si},
+		Current:     si.Revision,
+		SnapType:    "app",
+		InstanceKey: "instance",
+	})
+
+	validateErr := errors.New("refresh control error")
+	validateRefreshesFail := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		c.Check(refreshes, HasLen, 2)
+		if len(ignoreValidation) == 0 {
+			return nil, validateErr
+		}
+		c.Check(ignoreValidation, DeepEquals, map[string]bool{
+			"some-snap_instance": true,
+		})
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshesFail
+
+	flags := snapstate.Flags{IgnoreValidation: true}
+	ts, err := snapstate.Update(s.state, "some-snap_instance", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, flags)
+	c.Assert(err, IsNil)
+
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:     "some-snap",
+			SnapID:           "some-snap-id",
+			Revision:         snap.R(7),
+			IgnoreValidation: false,
+			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
+			Epoch:            snap.E("1*"),
+		}, {
+			InstanceName:     "some-snap_instance",
+			SnapID:           "some-snap-id",
+			Revision:         snap.R(7),
+			IgnoreValidation: false,
+			RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
+			Epoch:            snap.E("1*"),
+		}},
+		userID: 1,
+	})
+	c.Check(s.fakeBackend.ops[1], DeepEquals, fakeOp{
+		op:    "storesvc-snap-action:action",
+		revno: snap.R(11),
+		action: store.SnapAction{
+			Action:       "refresh",
+			InstanceName: "some-snap_instance",
+			SnapID:       "some-snap-id",
+			Channel:      "stable",
+			Flags:        store.SnapActionIgnoreValidation,
+		},
+		userID: 1,
+	})
+
+	chg := s.state.NewChange("refresh", "refresh snaps")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap 'instance' has IgnoreValidation set and the snap was
+	// updated
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.IgnoreValidation, Equals, true)
+	c.Check(snapst.Current, Equals, snap.R(11))
+	// and the other snap does not
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Current, Equals, snap.R(7))
+	c.Check(snapst.IgnoreValidation, Equals, false)
+
+	s.fakeBackend.ops = nil
+	s.fakeStore.refreshRevnos = map[string]snap.Revision{
+		"some-snap-id": snap.R(12),
+	}
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "some-snap_instance"}, s.user.ID, nil)
+	c.Assert(err, IsNil)
+	c.Check(tts, HasLen, 3)
+	verifyLastTasksetIsReRefresh(c, tts)
+	sort.Strings(updates)
+	c.Check(updates, DeepEquals, []string{"some-snap", "some-snap_instance"})
+
+	chg = s.state.NewChange("refresh", "refresh snaps")
+	for _, ts := range tts[:len(tts)-1] {
+		chg.AddAll(ts)
+	}
+
+	s.state.Unlock()
+	s.settle(c)
+	s.state.Lock()
+
+	// ensure all our tasks ran
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.IgnoreValidation, Equals, false)
+	c.Check(snapst.Current, Equals, snap.R(12))
+
+	err = snapstate.Get(s.state, "some-snap_instance", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.IgnoreValidation, Equals, true)
+	c.Check(snapst.Current, Equals, snap.R(12))
+
+	for i := 0; i < 2; i++ {
+		op := s.fakeBackend.ops[i]
+		switch op.op {
+		case "storesvc-snap-action":
+			c.Check(op, DeepEquals, fakeOp{
+				op: "storesvc-snap-action",
+				curSnaps: []store.CurrentSnap{{
+					InstanceName:     "some-snap",
+					SnapID:           "some-snap-id",
+					Revision:         snap.R(7),
+					IgnoreValidation: false,
+					RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 7),
+					Epoch:            snap.E("1*"),
+				}, {
+					InstanceName:     "some-snap_instance",
+					SnapID:           "some-snap-id",
+					Revision:         snap.R(11),
+					TrackingChannel:  "latest/stable",
+					IgnoreValidation: true,
+					RefreshedDate:    fakeRevDateEpoch.AddDate(0, 0, 11),
+					Epoch:            snap.E("1*"),
+				}},
+				userID: 1,
+			})
+		case "storesvc-snap-action:action":
+			switch op.action.InstanceName {
+			case "some-snap":
+				c.Check(op, DeepEquals, fakeOp{
+					op:    "storesvc-snap-action:action",
+					revno: snap.R(12),
+					action: store.SnapAction{
+						Action:       "refresh",
+						InstanceName: "some-snap",
+						SnapID:       "some-snap-id",
+						Flags:        0,
+					},
+					userID: 1,
+				})
+			case "some-snap_instance":
+				c.Check(op, DeepEquals, fakeOp{
+					op:    "storesvc-snap-action:action",
+					revno: snap.R(12),
+					action: store.SnapAction{
+						Action:       "refresh",
+						InstanceName: "some-snap_instance",
+						SnapID:       "some-snap-id",
+						Flags:        0,
+					},
+					userID: 1,
+				})
+			default:
+				c.Fatalf("unexpected instance name %q", op.action.InstanceName)
+			}
+		default:
+			c.Fatalf("unexpected action %q", op.op)
+		}
+	}
+
+}
+
+func (s *snapmgrTestSuite) TestUpdateFromLocal(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R("x1"),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, Equals, store.ErrLocalSnap)
+}
+
+func (s *snapmgrTestSuite) TestUpdateAmend(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R("x1"),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "channel-for-7/stable",
+		Current:         si.Revision,
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "channel-for-7"}, s.user.ID, snapstate.Flags{Amend: true})
+	c.Assert(err, IsNil)
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
+
+	// ensure we go from local to store revision-7
+	var snapsup snapstate.SnapSetup
+	tasks := ts.Tasks()
+	c.Check(tasks[1].Kind(), Equals, "download-snap")
+	err = tasks[1].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Revision(), Equals, snap.R(7))
+}
+
+func (s *snapmgrTestSuite) TestUpdateAmendSnapNotFound(c *C) {
+	si := snap.SideInfo{
+		RealName: "snap-unknown",
+		Revision: snap.R("x1"),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "snap-unknown", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		TrackingChannel: "latest/stable",
+		Current:         si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "snap-unknown", &snapstate.RevisionOptions{Channel: "stable"}, s.user.ID, snapstate.Flags{Amend: true})
+	c.Assert(err, Equals, store.ErrSnapNotFound)
+}
+
+func (s *snapmgrTestSuite) TestSingleUpdateBlockedRevision(c *C) {
+	// single updates should *not* set the block list
+	si7 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	si11 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(11),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si7, &si11},
+		Current:  si7.Revision,
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	c.Assert(s.fakeBackend.ops, HasLen, 2)
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:  "some-snap",
+			SnapID:        "some-snap-id",
+			Revision:      snap.R(7),
+			RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
+			Epoch:         snap.E("1*"),
+		}},
+		userID: 1,
+	})
+}
+
+func (s *snapmgrTestSuite) TestMultiUpdateBlockedRevision(c *C) {
+	// multi-updates should *not* set the block list
+	si7 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	si11 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(11),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si7, &si11},
+		Current:  si7.Revision,
+		SnapType: "app",
+	})
+
+	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	c.Assert(err, IsNil)
+	c.Check(updates, DeepEquals, []string{"some-snap"})
+
+	c.Assert(s.fakeBackend.ops, HasLen, 2)
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:  "some-snap",
+			SnapID:        "some-snap-id",
+			Revision:      snap.R(7),
+			RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
+			Epoch:         snap.E("1*"),
+		}},
+		userID: 1,
+	})
+}
+
+func (s *snapmgrTestSuite) TestAllUpdateBlockedRevision(c *C) {
+	//  update-all *should* set the block list
+	si7 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+	si11 := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(11),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si7, &si11},
+		Current:  si7.Revision,
+	})
+
+	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, s.user.ID, nil)
+	c.Check(err, IsNil)
+	c.Check(updates, HasLen, 0)
+
+	c.Assert(s.fakeBackend.ops, HasLen, 2)
+	c.Check(s.fakeBackend.ops[0], DeepEquals, fakeOp{
+		op: "storesvc-snap-action",
+		curSnaps: []store.CurrentSnap{{
+			InstanceName:  "some-snap",
+			SnapID:        "some-snap-id",
+			Revision:      snap.R(7),
+			RefreshedDate: fakeRevDateEpoch.AddDate(0, 0, 7),
+			Block:         []snap.Revision{snap.R(11)},
+			Epoch:         snap.E("1*"),
+		}},
+		userID: 1,
+	})
+}
+
+var orthogonalAutoAliasesScenarios = []struct {
+	aliasesBefore map[string][]string
+	names         []string
+	prune         []string
+	update        bool
+	new           bool
+}{
+	{nil, nil, nil, true, true},
+	{nil, []string{"some-snap"}, nil, true, false},
+	{nil, []string{"other-snap"}, nil, false, true},
+	{map[string][]string{"some-snap": {"aliasA", "aliasC"}}, []string{"some-snap"}, nil, true, false},
+	{map[string][]string{"other-snap": {"aliasB", "aliasC"}}, []string{"other-snap"}, []string{"other-snap"}, false, false},
+	{map[string][]string{"other-snap": {"aliasB", "aliasC"}}, nil, []string{"other-snap"}, true, false},
+	{map[string][]string{"other-snap": {"aliasB", "aliasC"}}, []string{"some-snap"}, nil, true, false},
+	{map[string][]string{"other-snap": {"aliasC"}}, []string{"other-snap"}, []string{"other-snap"}, false, true},
+	{map[string][]string{"other-snap": {"aliasC"}}, nil, []string{"other-snap"}, true, true},
+	{map[string][]string{"other-snap": {"aliasC"}}, []string{"some-snap"}, nil, true, false},
+	{map[string][]string{"some-snap": {"aliasB"}, "other-snap": {"aliasA"}}, []string{"some-snap"}, []string{"other-snap"}, true, false},
+	{map[string][]string{"some-snap": {"aliasB"}, "other-snap": {"aliasA"}}, nil, []string{"other-snap", "some-snap"}, true, true},
+	{map[string][]string{"some-snap": {"aliasB"}, "other-snap": {"aliasA"}}, []string{"other-snap"}, []string{"other-snap", "some-snap"}, false, true},
+	{map[string][]string{"some-snap": {"aliasB"}}, nil, []string{"some-snap"}, true, true},
+	{map[string][]string{"some-snap": {"aliasB"}}, []string{"other-snap"}, []string{"some-snap"}, false, true},
+	{map[string][]string{"some-snap": {"aliasB"}}, []string{"some-snap"}, nil, true, false},
+	{map[string][]string{"other-snap": {"aliasA"}}, nil, []string{"other-snap"}, true, true},
+	{map[string][]string{"other-snap": {"aliasA"}}, []string{"other-snap"}, []string{"other-snap"}, false, true},
+	{map[string][]string{"other-snap": {"aliasA"}}, []string{"some-snap"}, []string{"other-snap"}, true, false},
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyAutoAliasesScenarios(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "other-snap", SnapID: "other-snap-id", Revision: snap.R(2)},
+		},
+		Current:  snap.R(2),
+		SnapType: "app",
+	})
+
+	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
+		switch info.InstanceName() {
+		case "some-snap":
+			return map[string]string{"aliasA": "cmdA"}, nil
+		case "other-snap":
+			return map[string]string{"aliasB": "cmdB"}, nil
+		}
+		return nil, nil
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(4),
+		SnapType: "app",
+	})
+
+	expectedSet := func(aliases []string) map[string]bool {
+		res := make(map[string]bool, len(aliases))
+		for _, alias := range aliases {
+			res[alias] = true
+		}
+		return res
+	}
+
+	for _, scenario := range orthogonalAutoAliasesScenarios {
+		for _, instanceName := range []string{"some-snap", "other-snap"} {
+			var snapst snapstate.SnapState
+			err := snapstate.Get(s.state, instanceName, &snapst)
+			c.Assert(err, IsNil)
+			snapst.Aliases = nil
+			snapst.AutoAliasesDisabled = false
+			if autoAliases := scenario.aliasesBefore[instanceName]; autoAliases != nil {
+				targets := make(map[string]*snapstate.AliasTarget)
+				for _, alias := range autoAliases {
+					targets[alias] = &snapstate.AliasTarget{Auto: "cmd" + alias[len(alias)-1:]}
+				}
+
+				snapst.Aliases = targets
+			}
+			snapstate.Set(s.state, instanceName, &snapst)
+		}
+
+		updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, scenario.names, s.user.ID, nil)
+		c.Check(err, IsNil)
+		if scenario.update {
+			verifyLastTasksetIsReRefresh(c, tts)
+		}
+
+		_, dropped, err := snapstate.AutoAliasesDelta(s.state, []string{"some-snap", "other-snap"})
+		c.Assert(err, IsNil)
+
+		j := 0
+		expectedUpdatesSet := make(map[string]bool)
+		var expectedPruned map[string]map[string]bool
+		var pruneTs *state.TaskSet
+		if len(scenario.prune) != 0 {
+			pruneTs = tts[0]
+			j++
+			taskAliases := make(map[string]map[string]bool)
+			for _, aliasTask := range pruneTs.Tasks() {
+				c.Check(aliasTask.Kind(), Equals, "prune-auto-aliases")
+				var aliases []string
+				err := aliasTask.Get("aliases", &aliases)
+				c.Assert(err, IsNil)
+				snapsup, err := snapstate.TaskSnapSetup(aliasTask)
+				c.Assert(err, IsNil)
+				taskAliases[snapsup.InstanceName()] = expectedSet(aliases)
+			}
+			expectedPruned = make(map[string]map[string]bool)
+			for _, instanceName := range scenario.prune {
+				expectedPruned[instanceName] = expectedSet(dropped[instanceName])
+				if instanceName == "other-snap" && !scenario.new && !scenario.update {
+					expectedUpdatesSet["other-snap"] = true
+				}
+			}
+			c.Check(taskAliases, DeepEquals, expectedPruned)
+		}
+		if scenario.update {
+			updateTs := tts[j]
+			j++
+			expectedUpdatesSet["some-snap"] = true
+			first := updateTs.Tasks()[0]
+			c.Check(first.Kind(), Equals, "prerequisites")
+			wait := false
+			if expectedPruned["other-snap"]["aliasA"] {
+				wait = true
+			} else if expectedPruned["some-snap"] != nil {
+				wait = true
+			}
+			if wait {
+				c.Check(first.WaitTasks(), DeepEquals, pruneTs.Tasks())
+			} else {
+				c.Check(first.WaitTasks(), HasLen, 0)
+			}
+		}
+		if scenario.new {
+			newTs := tts[j]
+			j++
+			expectedUpdatesSet["other-snap"] = true
+			tasks := newTs.Tasks()
+			c.Check(tasks, HasLen, 1)
+			aliasTask := tasks[0]
+			c.Check(aliasTask.Kind(), Equals, "refresh-aliases")
+
+			wait := false
+			if expectedPruned["some-snap"]["aliasB"] {
+				wait = true
+			} else if expectedPruned["other-snap"] != nil {
+				wait = true
+			}
+			if wait {
+				c.Check(aliasTask.WaitTasks(), DeepEquals, pruneTs.Tasks())
+			} else {
+				c.Check(aliasTask.WaitTasks(), HasLen, 0)
+			}
+		}
+		l := len(tts)
+		if scenario.update {
+			l--
+		}
+		c.Assert(j, Equals, l, Commentf("%#v", scenario))
+
+		// check reported updated names
+		c.Check(len(updates) > 0, Equals, true)
+		sort.Strings(updates)
+		expectedUpdates := make([]string, 0, len(expectedUpdatesSet))
+		for x := range expectedUpdatesSet {
+			expectedUpdates = append(expectedUpdates, x)
+		}
+		sort.Strings(expectedUpdates)
+		c.Check(updates, DeepEquals, expectedUpdates)
+	}
+}
+
+func (s *snapmgrTestSuite) TestUpdateOneAutoAliasesScenarios(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "other-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "other-snap", SnapID: "other-snap-id", Revision: snap.R(2)},
+		},
+		Current:  snap.R(2),
+		SnapType: "app",
+	})
+
+	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
+		switch info.InstanceName() {
+		case "some-snap":
+			return map[string]string{"aliasA": "cmdA"}, nil
+		case "other-snap":
+			return map[string]string{"aliasB": "cmdB"}, nil
+		}
+		return nil, nil
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(4),
+		SnapType: "app",
+	})
+
+	expectedSet := func(aliases []string) map[string]bool {
+		res := make(map[string]bool, len(aliases))
+		for _, alias := range aliases {
+			res[alias] = true
+		}
+		return res
+	}
+
+	for _, scenario := range orthogonalAutoAliasesScenarios {
+		if len(scenario.names) != 1 {
+			continue
+		}
+
+		for _, instanceName := range []string{"some-snap", "other-snap"} {
+			var snapst snapstate.SnapState
+			err := snapstate.Get(s.state, instanceName, &snapst)
+			c.Assert(err, IsNil)
+			snapst.Aliases = nil
+			snapst.AutoAliasesDisabled = false
+			if autoAliases := scenario.aliasesBefore[instanceName]; autoAliases != nil {
+				targets := make(map[string]*snapstate.AliasTarget)
+				for _, alias := range autoAliases {
+					targets[alias] = &snapstate.AliasTarget{Auto: "cmd" + alias[len(alias)-1:]}
+				}
+
+				snapst.Aliases = targets
+			}
+			snapstate.Set(s.state, instanceName, &snapst)
+		}
+
+		ts, err := snapstate.Update(s.state, scenario.names[0], nil, s.user.ID, snapstate.Flags{})
+		c.Assert(err, IsNil)
+		_, dropped, err := snapstate.AutoAliasesDelta(s.state, []string{"some-snap", "other-snap"})
+		c.Assert(err, IsNil)
+
+		j := 0
+
+		tasks := ts.Tasks()
+		// make sure the last task from Update is the rerefresh
+		if scenario.update {
+			reRefresh := tasks[len(tasks)-1]
+			c.Check(reRefresh.Kind(), Equals, "check-rerefresh")
+			// nothing should wait on it
+			c.Check(reRefresh.NumHaltTasks(), Equals, 0)
+			tasks = tasks[:len(tasks)-1] // and now forget about it
+		}
+
+		var expectedPruned map[string]map[string]bool
+		var pruneTasks []*state.Task
+		if len(scenario.prune) != 0 {
+			nprune := len(scenario.prune)
+			pruneTasks = tasks[:nprune]
+			j += nprune
+			taskAliases := make(map[string]map[string]bool)
+			for _, aliasTask := range pruneTasks {
+				c.Check(aliasTask.Kind(), Equals, "prune-auto-aliases")
+				var aliases []string
+				err := aliasTask.Get("aliases", &aliases)
+				c.Assert(err, IsNil)
+				snapsup, err := snapstate.TaskSnapSetup(aliasTask)
+				c.Assert(err, IsNil)
+				taskAliases[snapsup.InstanceName()] = expectedSet(aliases)
+			}
+			expectedPruned = make(map[string]map[string]bool)
+			for _, instanceName := range scenario.prune {
+				expectedPruned[instanceName] = expectedSet(dropped[instanceName])
+			}
+			c.Check(taskAliases, DeepEquals, expectedPruned)
+		}
+		if scenario.update {
+			first := tasks[j]
+			j += 19
+			c.Check(first.Kind(), Equals, "prerequisites")
+			wait := false
+			if expectedPruned["other-snap"]["aliasA"] {
+				wait = true
+			} else if expectedPruned["some-snap"] != nil {
+				wait = true
+			}
+			if wait {
+				c.Check(first.WaitTasks(), DeepEquals, pruneTasks)
+			} else {
+				c.Check(first.WaitTasks(), HasLen, 0)
+			}
+		}
+		if scenario.new {
+			aliasTask := tasks[j]
+			j++
+			c.Check(aliasTask.Kind(), Equals, "refresh-aliases")
+			wait := false
+			if expectedPruned["some-snap"]["aliasB"] {
+				wait = true
+			} else if expectedPruned["other-snap"] != nil {
+				wait = true
+			}
+			if wait {
+				c.Check(aliasTask.WaitTasks(), DeepEquals, pruneTasks)
+			} else {
+				c.Check(aliasTask.WaitTasks(), HasLen, 0)
+			}
+		}
+		c.Assert(len(tasks), Equals, j, Commentf("%#v", scenario))
+
+		// conflict checks are triggered
+		chg := s.state.NewChange("update", "...")
+		chg.AddAll(ts)
+		err = snapstate.CheckChangeConflict(s.state, scenario.names[0], nil)
+		c.Check(err, ErrorMatches, `.* has "update" change in progress`)
+		chg.SetStatus(state.DoneStatus)
+	}
+}
+
+func (s *snapmgrTestSuite) TestUpdateLocalSnapFails(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, Equals, store.ErrLocalSnap)
+}
+
+func (s *snapmgrTestSuite) TestUpdateDisabledUnsupported(c *C) {
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   false,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `refreshing disabled snap "some-snap" not supported`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateKernelTrackChecksSwitchingTracks(c *C) {
+	si := snap.SideInfo{
+		RealName: "kernel",
+		SnapID:   "kernel-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	r := snapstatetest.MockDeviceModel(ModelWithKernelTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "kernel", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		Current:         si.Revision,
+		TrackingChannel: "18/stable",
+	})
+
+	// switching tracks is not ok
+	_, err := snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "new-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `cannot switch from kernel track "18" as specified for the \(device\) model to "new-channel"`)
+
+	// no change to the channel is ok
+	_, err = snapstate.Update(s.state, "kernel", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// switching risk level is ok
+	_, err = snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "18/beta"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// switching just risk within the pinned track is ok
+	_, err = snapstate.Update(s.state, "kernel", &snapstate.RevisionOptions{Channel: "beta"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateGadgetTrackChecksSwitchingTracks(c *C) {
+	si := snap.SideInfo{
+		RealName: "brand-gadget",
+		SnapID:   "brand-gadget-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	r := snapstatetest.MockDeviceModel(ModelWithGadgetTrack("18"))
+	defer r()
+	snapstate.Set(s.state, "brand-gadget", &snapstate.SnapState{
+		Active:          true,
+		Sequence:        []*snap.SideInfo{&si},
+		Current:         si.Revision,
+		TrackingChannel: "18/stable",
+	})
+
+	// switching tracks is not ok
+	_, err := snapstate.Update(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "new-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `cannot switch from gadget track "18" as specified for the \(device\) model to "new-channel"`)
+
+	// no change to the channel is ok
+	_, err = snapstate.Update(s.state, "brand-gadget", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// switching risk level is ok
+	_, err = snapstate.Update(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "18/beta"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// switching just risk within the pinned track is ok
+	_, err = snapstate.Update(s.state, "brand-gadget", &snapstate.RevisionOptions{Channel: "beta"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+}
+
+func (s *snapmgrTestSuite) TestUpdateWithDeviceContext(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// unset the global store, it will need to come via the device context
+	snapstate.ReplaceStore(s.state, nil)
+
+	deviceCtx := &snapstatetest.TrivialDeviceContext{
+		DeviceModel: DefaultModel(),
+		CtxStore:    s.fakeStore,
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	validateCalled := false
+	happyValidateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx1 snapstate.DeviceContext) ([]*snap.Info, error) {
+		c.Check(deviceCtx1, Equals, deviceCtx)
+		validateCalled = true
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = happyValidateRefreshes
+
+	ts, err := snapstate.UpdateWithDeviceContext(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{}, deviceCtx, "")
+	c.Assert(err, IsNil)
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+
+	c.Check(validateCalled, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestUpdateWithDeviceContextToRevision(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	// unset the global store, it will need to come via the device context
+	snapstate.ReplaceStore(s.state, nil)
+
+	deviceCtx := &snapstatetest.TrivialDeviceContext{
+		DeviceModel: DefaultModel(),
+		CtxStore:    s.fakeStore,
+	}
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", Revision: snap.R(5), SnapID: "some-snap-id"},
+		},
+		Current:  snap.R(5),
+		SnapType: "app",
+		UserID:   1,
+	})
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(11)}
+	ts, err := snapstate.UpdateWithDeviceContext(s.state, "some-snap", opts, 0, snapstate.Flags{}, deviceCtx, "")
+	c.Assert(err, IsNil)
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 0, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+}
+
+func (s *snapmgrTestSuite) TestUpdateTasksCoreSetsIgnoreOnConfigure(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "core", SnapID: "core-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "os",
+	})
+
+	oldConfigure := snapstate.Configure
+	defer func() { snapstate.Configure = oldConfigure }()
+
+	var configureFlags int
+	snapstate.Configure = func(st *state.State, snapName string, patch map[string]interface{}, flags int) *state.TaskSet {
+		configureFlags = flags
+		return state.NewTaskSet()
+	}
+
+	_, err := snapstate.Update(s.state, "core", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// ensure the core snap sets the "ignore-hook-error" flag
+	c.Check(configureFlags&snapstate.IgnoreHookError, Equals, 1)
+}
+
+func (s *snapmgrTestSuite) TestUpdateDevModeConfinementFiltering(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-devmode/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	// updated snap is devmode, refresh without --devmode, do nothing
+	// TODO: better error message here
+	_, err := snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `.* requires devmode or confinement override`)
+
+	// updated snap is devmode, refresh with --devmode
+	_, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{DevMode: true})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateClassicConfinementFiltering(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap-now-classic", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap-now-classic", SnapID: "some-snap-now-classic-id", Revision: snap.R(7)}},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	// updated snap is classic, refresh without --classic, do nothing
+	// TODO: better error message here
+	_, err := snapstate.Update(s.state, "some-snap-now-classic", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `.* requires classic confinement`)
+
+	// updated snap is classic, refresh with --classic
+	ts, err := snapstate.Update(s.state, "some-snap-now-classic", nil, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("refresh", "refresh snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// verify snap is in classic
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap-now-classic", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Classic, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestUpdateClassicFromClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-classic/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+		Flags:           snapstate.Flags{Classic: true},
+	})
+
+	// snap installed with --classic, update needs classic, refresh with --classic works
+	ts, err := snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+	c.Assert(ts.Tasks(), Not(HasLen), 0)
+	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Flags.Classic, Equals, true)
+
+	// devmode overrides the snapsetup classic flag
+	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{DevMode: true})
+	c.Assert(err, IsNil)
+	c.Assert(ts.Tasks(), Not(HasLen), 0)
+	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Flags.Classic, Equals, false)
+
+	// jailmode overrides it too (you need to provide both)
+	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{JailMode: true})
+	c.Assert(err, IsNil)
+	c.Assert(ts.Tasks(), Not(HasLen), 0)
+	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Flags.Classic, Equals, false)
+
+	// jailmode and classic together gets you both
+	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{JailMode: true, Classic: true})
+	c.Assert(err, IsNil)
+	c.Assert(ts.Tasks(), Not(HasLen), 0)
+	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Flags.Classic, Equals, true)
+
+	// snap installed with --classic, update needs classic, refresh without --classic works
+	ts, err = snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	c.Assert(ts.Tasks(), Not(HasLen), 0)
+	snapsup, err = snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Check(snapsup.Flags.Classic, Equals, true)
+
+	chg := s.state.NewChange("refresh", "refresh snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify snap is in classic
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "some-snap", &snapst)
+	c.Assert(err, IsNil)
+	c.Check(snapst.Classic, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestUpdateStrictFromClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap-was-classic", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap-was-classic", SnapID: "some-snap-was-classic-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+		Flags:           snapstate.Flags{Classic: true},
+	})
+
+	// snap installed with --classic, update does not need classic, refresh works without --classic
+	_, err := snapstate.Update(s.state, "some-snap-was-classic", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// snap installed with --classic, update does not need classic, refresh works with --classic
+	_, err = snapstate.Update(s.state, "some-snap-was-classic", nil, s.user.ID, snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateChannelFallback(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "latest/edge",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", nil, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	var snapsup snapstate.SnapSetup
+	err = ts.Tasks()[0].Get("snap-setup", &snapsup)
+	c.Assert(err, IsNil)
+
+	c.Check(snapsup.Channel, Equals, "latest/edge")
+}
+
+func (s *snapmgrTestSuite) TestUpdateTooEarly(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.state.Set("seeded", nil)
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	_, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateConflict(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	// need a change to make the tasks visible
+	s.state.NewChange("refresh", "...").AddAll(ts)
+
+	_, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, ErrorMatches, `snap "some-snap" has "refresh" change in progress`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateCreatesGCTasks(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	s.testUpdateCreatesGCTasks(c, 2)
+}
+
+func (s *snapmgrTestSuite) TestUpdateCreatesGCTasksOnClassic(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	s.testUpdateCreatesGCTasks(c, 3)
+}
+
+func (s *snapmgrTestSuite) testUpdateCreatesGCTasks(c *C, expectedDiscards int) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(4),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	// ensure edges information is still there
+	te, err := ts.Edge(snapstate.DownloadAndChecksDoneEdge)
+	c.Assert(te, NotNil)
+	c.Assert(err, IsNil)
+
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, expectedDiscards, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+}
+
+func (s *snapmgrTestSuite) TestUpdateCreatesDiscardAfterCurrentTasks(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter|doesReRefresh, 3, ts, s.state)
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks()))
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyTooEarly(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.state.Set("seeded", nil)
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:  snap.R(7),
+		SnapType: "app",
+	})
+
+	_, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Check(err, FitsTypeOf, &snapstate.ChangeConflictError{})
+	c.Assert(err, ErrorMatches, `too early for operation, device not yet seeded or device model not acknowledged`)
+}
+
+func (s *snapmgrTestSuite) TestUpdateMany(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 2)
+	verifyLastTasksetIsReRefresh(c, tts)
+	c.Check(updates, DeepEquals, []string{"some-snap"})
+
+	ts := tts[0]
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 3, ts, s.state)
+
+	// check that the tasks are in non-default lane
+	for _, t := range ts.Tasks() {
+		c.Assert(t.Lanes(), DeepEquals, []int{1})
+	}
+	c.Assert(s.state.TaskCount(), Equals, len(ts.Tasks())+1) // 1==rerefresh
+
+	// ensure edges information is still there
+	te, err := ts.Edge(snapstate.DownloadAndChecksDoneEdge)
+	c.Assert(te, NotNil)
+	c.Assert(err, IsNil)
+
+	checkIsAutoRefresh(c, ts.Tasks(), false)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyFailureDoesntUndoSnapdRefresh(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	r := snapstatetest.MockDeviceModel(ModelWithBase("core18"))
+	defer r()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:         snap.R(1),
+		SnapType:        "app",
+		TrackingChannel: "channel-for-base/stable",
+	})
+
+	snapstate.Set(s.state, "core18", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core18", SnapID: "core18-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+
+	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-base", SnapID: "some-base-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+
+	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "snapd", SnapID: "snapd-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "some-base", "snapd"}, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 4)
+	c.Assert(updates, HasLen, 3)
+
+	chg := s.state.NewChange("refresh", "...")
+	for _, ts := range tts {
+		chg.AddAll(ts)
+	}
+
+	// refresh of some-snap fails on link-snap
+	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "/some-snap/11")
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Check(chg.Err(), ErrorMatches, ".*cannot perform the following tasks:\n- Make snap \"some-snap\" \\(11\\) available to the system.*")
+	c.Check(chg.IsReady(), Equals, true)
+
+	var snapst snapstate.SnapState
+
+	// failed snap remains at the old revision, snapd and some-base are refreshed.
+	c.Assert(snapstate.Get(s.state, "some-snap", &snapst), IsNil)
+	c.Check(snapst.Current, Equals, snap.Revision{N: 1})
+
+	c.Assert(snapstate.Get(s.state, "snapd", &snapst), IsNil)
+	c.Check(snapst.Current, Equals, snap.Revision{N: 11})
+
+	c.Assert(snapstate.Get(s.state, "some-base", &snapst), IsNil)
+	c.Check(snapst.Current, Equals, snap.Revision{N: 11})
+
+	var undoneDownloads, doneDownloads int
+	for _, ts := range tts {
+		for _, t := range ts.Tasks() {
+			if t.Kind() == "download-snap" {
+				sup, err := snapstate.TaskSnapSetup(t)
+				c.Assert(err, IsNil)
+				switch sup.SnapName() {
+				case "some-snap":
+					undoneDownloads++
+					c.Check(t.Status(), Equals, state.UndoneStatus)
+				case "snapd", "some-base":
+					doneDownloads++
+					c.Check(t.Status(), Equals, state.DoneStatus)
+				default:
+					c.Errorf("unexpected snap %s", sup.SnapName())
+				}
+			}
+		}
+	}
+	c.Assert(undoneDownloads, Equals, 1)
+	c.Assert(doneDownloads, Equals, 2)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyDevModeConfinementFiltering(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-devmode/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	// updated snap is devmode, updatemany doesn't update it
+	_, tts, _ := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	// FIXME: UpdateMany will not error out in this case (daemon catches this case, with a weird error)
+	c.Assert(tts, HasLen, 0)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyClassicConfinementFiltering(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-classic/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+	})
+
+	// if a snap installed without --classic gets a classic update it isn't installed
+	_, tts, _ := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	// FIXME: UpdateMany will not error out in this case (daemon catches this case, with a weird error)
+	c.Assert(tts, HasLen, 0)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyClassic(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "channel-for-classic/stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+		Flags:           snapstate.Flags{Classic: true},
+	})
+
+	// snap installed with classic: refresh gets classic
+	_, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 2)
+	verifyLastTasksetIsReRefresh(c, tts)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyClassicToStrict(c *C) {
+	restore := maybeMockClassicSupport(c)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:          true,
+		TrackingChannel: "stable",
+		Sequence:        []*snap.SideInfo{{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(7)}},
+		Current:         snap.R(7),
+		SnapType:        "app",
+		Flags:           snapstate.Flags{Classic: true},
+	})
+
+	// snap installed with classic: refresh gets classic
+	_, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, s.user.ID, &snapstate.Flags{Classic: true})
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 2)
+	// ensure we clear the classic flag
+	snapsup, err := snapstate.TaskSnapSetup(tts[0].Tasks()[0])
+	c.Assert(err, IsNil)
+	c.Assert(snapsup.Flags.Classic, Equals, false)
+
+	verifyLastTasksetIsReRefresh(c, tts)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyDevMode(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Flags:  snapstate.Flags{DevMode: true},
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, 0, nil)
+	c.Assert(err, IsNil)
+	c.Check(updates, HasLen, 1)
+}
+
+func (s *snapmgrTestSuite) TestUpdateAllDevMode(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Flags:  snapstate.Flags{DevMode: true},
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	c.Check(updates, HasLen, 0)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyWaitForBasesUC16(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core", SnapID: "core-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "os",
+	})
+
+	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-base", SnapID: "some-base-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:         snap.R(1),
+		SnapType:        "app",
+		TrackingChannel: "channel-for-base/stable",
+	})
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "core", "some-base"}, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 4)
+	verifyLastTasksetIsReRefresh(c, tts)
+	c.Check(updates, HasLen, 3)
+
+	// to make TaskSnapSetup work
+	chg := s.state.NewChange("refresh", "...")
+	for _, ts := range tts {
+		chg.AddAll(ts)
+	}
+
+	prereqTotal := len(tts[0].Tasks()) + len(tts[1].Tasks())
+	prereqs := map[string]bool{}
+	for i, task := range tts[2].Tasks() {
+		waitTasks := task.WaitTasks()
+		if i == 0 {
+			c.Check(len(waitTasks), Equals, prereqTotal)
+		} else if task.Kind() == "link-snap" {
+			c.Check(len(waitTasks), Equals, prereqTotal+1)
+			for _, pre := range waitTasks {
+				if pre.Kind() == "link-snap" {
+					snapsup, err := snapstate.TaskSnapSetup(pre)
+					c.Assert(err, IsNil)
+					prereqs[snapsup.InstanceName()] = true
+				}
+			}
+		}
+	}
+
+	c.Check(prereqs, DeepEquals, map[string]bool{
+		"core":      true,
+		"some-base": true,
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyWaitForBasesUC18(c *C) {
+	r := snapstatetest.MockDeviceModel(ModelWithBase("core18"))
+	defer r()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "core18", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core18", SnapID: "core18-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+
+	snapstate.Set(s.state, "some-base", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-base", SnapID: "some-base-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "base",
+	})
+
+	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "snapd", SnapID: "snapd-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:         snap.R(1),
+		SnapType:        "app",
+		TrackingChannel: "channel-for-base/stable",
+	})
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap", "core18", "some-base", "snapd"}, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 5)
+	verifyLastTasksetIsReRefresh(c, tts)
+	c.Check(updates, HasLen, 4)
+
+	// to make TaskSnapSetup work
+	chg := s.state.NewChange("refresh", "...")
+	for _, ts := range tts {
+		chg.AddAll(ts)
+	}
+
+	// Note that some-app only waits for snapd+some-base. The core18
+	// base is not special to this snap and not waited for
+	prereqTotal := len(tts[0].Tasks()) + len(tts[1].Tasks())
+	prereqs := map[string]bool{}
+	for i, task := range tts[3].Tasks() {
+		waitTasks := task.WaitTasks()
+		if i == 0 {
+			c.Check(len(waitTasks), Equals, prereqTotal)
+		} else if task.Kind() == "link-snap" {
+			c.Check(len(waitTasks), Equals, prereqTotal+1)
+			for _, pre := range waitTasks {
+				if pre.Kind() == "link-snap" {
+					snapsup, err := snapstate.TaskSnapSetup(pre)
+					c.Assert(err, IsNil)
+					prereqs[snapsup.InstanceName()] = true
+				}
+			}
+		}
+	}
+
+	// Note that "core18" is not part of the prereqs for some-app
+	// as it does not use this base.
+	c.Check(prereqs, DeepEquals, map[string]bool{
+		"some-base": true,
+		"snapd":     true,
+	})
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyValidateRefreshes(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	validateCalled := false
+	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		validateCalled = true
+		c.Check(refreshes, HasLen, 1)
+		c.Check(refreshes[0].InstanceName(), Equals, "some-snap")
+		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
+		c.Check(refreshes[0].Revision, Equals, snap.R(11))
+		c.Check(ignoreValidation, HasLen, 0)
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshes
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 2)
+	verifyLastTasksetIsReRefresh(c, tts)
+	c.Check(updates, DeepEquals, []string{"some-snap"})
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 0, tts[0], s.state)
+
+	c.Check(validateCalled, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceUpdateMany(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(2)},
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(3)},
+		},
+		Current:     snap.R(3),
+		SnapType:    "app",
+		InstanceKey: "instance",
+	})
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 3)
+	verifyLastTasksetIsReRefresh(c, tts)
+	// ensure stable ordering of updates list
+	if updates[0] != "some-snap" {
+		updates[1], updates[0] = updates[0], updates[1]
+	}
+
+	c.Check(updates, DeepEquals, []string{"some-snap", "some-snap_instance"})
+
+	var snapsup, snapsupInstance *snapstate.SnapSetup
+
+	// ensure stable ordering of task sets list
+	snapsup, err = snapstate.TaskSnapSetup(tts[0].Tasks()[0])
+	c.Assert(err, IsNil)
+	if snapsup.InstanceName() != "some-snap" {
+		tts[0], tts[1] = tts[1], tts[0]
+		snapsup, err = snapstate.TaskSnapSetup(tts[0].Tasks()[0])
+		c.Assert(err, IsNil)
+	}
+	snapsupInstance, err = snapstate.TaskSnapSetup(tts[1].Tasks()[0])
+	c.Assert(err, IsNil)
+
+	c.Assert(snapsup.InstanceName(), Equals, "some-snap")
+	c.Assert(snapsupInstance.InstanceName(), Equals, "some-snap_instance")
+
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 3, tts[0], s.state)
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 1, tts[1], s.state)
+}
+
+func (s *snapmgrTestSuite) TestParallelInstanceUpdateManyValidateRefreshes(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.parallel-instances", true)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+	snapstate.Set(s.state, "some-snap_instance", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:     snap.R(1),
+		SnapType:    "app",
+		InstanceKey: "instance",
+	})
+
+	validateCalled := false
+	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		validateCalled = true
+		c.Check(refreshes, HasLen, 2)
+		instanceIdx := 0
+		someIdx := 1
+		if refreshes[0].InstanceName() != "some-snap_instance" {
+			instanceIdx = 1
+			someIdx = 0
+		}
+		c.Check(refreshes[someIdx].InstanceName(), Equals, "some-snap")
+		c.Check(refreshes[instanceIdx].InstanceName(), Equals, "some-snap_instance")
+		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
+		c.Check(refreshes[0].Revision, Equals, snap.R(11))
+		c.Check(refreshes[1].SnapID, Equals, "some-snap-id")
+		c.Check(refreshes[1].Revision, Equals, snap.R(11))
+		c.Check(ignoreValidation, HasLen, 0)
+		return refreshes, nil
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshes
+
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	c.Assert(tts, HasLen, 3)
+	verifyLastTasksetIsReRefresh(c, tts)
+	sort.Strings(updates)
+	c.Check(updates, DeepEquals, []string{"some-snap", "some-snap_instance"})
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 0, tts[0], s.state)
+	verifyUpdateTasks(c, unlinkBefore|cleanupAfter, 0, tts[1], s.state)
+
+	c.Check(validateCalled, Equals, true)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyValidateRefreshesUnhappy(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current: snap.R(1),
+	})
+
+	validateErr := errors.New("refresh control error")
+	validateRefreshes := func(st *state.State, refreshes []*snap.Info, ignoreValidation map[string]bool, userID int, deviceCtx snapstate.DeviceContext) ([]*snap.Info, error) {
+		c.Check(refreshes, HasLen, 1)
+		c.Check(refreshes[0].SnapID, Equals, "some-snap-id")
+		c.Check(refreshes[0].Revision, Equals, snap.R(11))
+		c.Check(ignoreValidation, HasLen, 0)
+		return nil, validateErr
+	}
+	// hook it up
+	snapstate.ValidateRefreshes = validateRefreshes
+
+	// refresh all => no error
+	updates, tts, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	c.Assert(err, IsNil)
+	c.Check(tts, HasLen, 0)
+	c.Check(updates, HasLen, 0)
+
+	// refresh some-snap => report error
+	updates, tts, err = snapstate.UpdateMany(context.Background(), s.state, []string{"some-snap"}, 0, nil)
+	c.Assert(err, Equals, validateErr)
+	c.Check(tts, HasLen, 0)
+	c.Check(updates, HasLen, 0)
+
+}
+
+func (s *snapmgrTestSuite) testUpdateManyDiskSpaceCheck(c *C, featureFlag, failDiskCheck, failInstallSize bool) error {
+	var diskCheckCalled, installSizeCalled bool
+	restore := snapstate.MockOsutilCheckFreeSpace(func(path string, sz uint64) error {
+		diskCheckCalled = true
+		c.Check(path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+		c.Check(sz, Equals, snapstate.SafetyMarginDiskSpace(123))
+		if failDiskCheck {
+			return &osutil.NotEnoughDiskSpaceError{}
+		}
+		return nil
+	})
+	defer restore()
+
+	restoreInstallSize := snapstate.MockInstallSize(func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+		installSizeCalled = true
+		if failInstallSize {
+			return 0, fmt.Errorf("boom")
+		}
+		c.Assert(snaps, HasLen, 2)
+		c.Check(snaps[0].InstanceName(), Equals, "snapd")
+		c.Check(snaps[1].InstanceName(), Equals, "some-snap")
+		return 123, nil
+	})
+	defer restoreInstallSize()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-refresh", featureFlag)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	snapstate.Set(s.state, "snapd", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "snapd", SnapID: "snapd-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	updates, _, err := snapstate.UpdateMany(context.Background(), s.state, nil, 0, nil)
+	if featureFlag {
+		c.Check(installSizeCalled, Equals, true)
+		if failInstallSize {
+			c.Check(diskCheckCalled, Equals, false)
+		} else {
+			c.Check(diskCheckCalled, Equals, true)
+			if failDiskCheck {
+				c.Check(updates, HasLen, 0)
+			} else {
+				c.Check(updates, HasLen, 2)
+			}
+		}
+	} else {
+		c.Check(installSizeCalled, Equals, false)
+		c.Check(diskCheckCalled, Equals, false)
+	}
+
+	return err
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyDiskSpaceCheckError(c *C) {
+	featureFlag := true
+	failDiskCheck := true
+	failInstallSize := false
+	err := s.testUpdateManyDiskSpaceCheck(c, featureFlag, failDiskCheck, failInstallSize)
+	diskSpaceErr := err.(*snapstate.InsufficientSpaceError)
+	c.Assert(diskSpaceErr, ErrorMatches, `insufficient space in .* to perform "refresh" change for the following snaps: snapd, some-snap`)
+	c.Check(diskSpaceErr.Path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+	c.Check(diskSpaceErr.Snaps, DeepEquals, []string{"snapd", "some-snap"})
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyDiskSpaceSkippedIfFeatureDisabled(c *C) {
+	featureFlag := false
+	failDiskCheck := true
+	failInstallSize := false
+	err := s.testUpdateManyDiskSpaceCheck(c, featureFlag, failDiskCheck, failInstallSize)
+	c.Assert(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateManyDiskSpaceFailInstallSize(c *C) {
+	featureFlag := true
+	failDiskCheck := false
+	failInstallSize := true
+	err := s.testUpdateManyDiskSpaceCheck(c, featureFlag, failDiskCheck, failInstallSize)
+	c.Assert(err, ErrorMatches, "boom")
+}
+
+func (s *snapmgrTestSuite) TestUnlinkCurrentSnapLastActiveDisabledServicesSet(c *C) {
+	si := snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(-42),
+	}
+	snaptest.MockSnap(c, `name: services-snap`, &si)
+
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active:                     true,
+		Sequence:                   []*snap.SideInfo{&si},
+		Current:                    si.Revision,
+		SnapType:                   "app",
+		TrackingChannel:            "stable",
+		LastActiveDisabledServices: []string{},
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
+
+	c.Assert(err, IsNil)
+	// only add up to unlink-current-snap task
+	for _, t := range ts.Tasks() {
+		chg.AddTask(t)
+		if t.Kind() == "unlink-current-snap" {
+			// don't add any more from this point on
+			break
+		}
+	}
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
+}
+
+func (s *snapmgrTestSuite) TestUnlinkCurrentSnapMergedLastActiveDisabledServicesSet(c *C) {
+	si := snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(-42),
+	}
+	snaptest.MockSnap(c, `name: services-snap`, &si)
+
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active:                     true,
+		Sequence:                   []*snap.SideInfo{&si},
+		Current:                    si.Revision,
+		SnapType:                   "app",
+		TrackingChannel:            "stable",
+		LastActiveDisabledServices: []string{"missing-svc3"},
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
+
+	c.Assert(err, IsNil)
+	// only add up to unlink-current-snap task
+	for _, t := range ts.Tasks() {
+		chg.AddTask(t)
+		if t.Kind() == "unlink-current-snap" {
+			// don't add any more from this point on
+			break
+		}
+	}
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3", "svc1", "svc2"})
+}
+
+func (s *snapmgrTestSuite) TestUnlinkCurrentSnapPassthroughLastActiveDisabledServicesSet(c *C) {
+	si := snap.SideInfo{
+		RealName: "services-snap",
+		Revision: snap.R(-42),
+	}
+	snaptest.MockSnap(c, `name: services-snap`, &si)
+
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Active:                     true,
+		Sequence:                   []*snap.SideInfo{&si},
+		Current:                    si.Revision,
+		SnapType:                   "app",
+		TrackingChannel:            "stable",
+		LastActiveDisabledServices: []string{"missing-svc3"},
+	})
+
+	chg := s.state.NewChange("refresh", "refresh a snap")
+	ts, err := snapstate.Update(s.state, "services-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{Amend: true})
+
+	c.Assert(err, IsNil)
+	// only add up to unlink-current-snap task
+	for _, t := range ts.Tasks() {
+		chg.AddTask(t)
+		if t.Kind() == "unlink-current-snap" {
+			// don't add any more from this point on
+			break
+		}
+	}
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// get the snap state
+	var snapst snapstate.SnapState
+	err = snapstate.Get(s.state, "services-snap", &snapst)
+	c.Assert(err, IsNil)
+
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(snapst.LastActiveDisabledServices)
+	c.Assert(snapst.LastActiveDisabledServices, DeepEquals, []string{"missing-svc3"})
+}
+
+func (s *snapmgrTestSuite) TestStopSnapServicesSavesSnapSetupLastActiveDisabledServices(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "services-snap", Revision: snap.R(11)},
+		},
+		Current: snap.R(11),
+		Active:  true,
+	})
+
+	snapsup := &snapstate.SnapSetup{
+		SideInfo: &snap.SideInfo{
+			RealName: "services-snap",
+			Revision: snap.R(11),
+			SnapID:   "services-snap-id",
+		},
+	}
+
+	chg := s.state.NewChange("stop-services", "stop the services")
+	t1 := s.state.NewTask("prerequisites", "...")
+	t1.Set("snap-setup", snapsup)
+	t2 := s.state.NewTask("stop-snap-services", "...")
+	t2.Set("stop-reason", snap.StopReasonDisable)
+	t2.Set("snap-setup-task", t1.ID())
+	t2.WaitFor(t1)
+	chg.AddTask(t1)
+	chg.AddTask(t2)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// get the snap setup from the task from state
+	endT := s.state.Task(t1.ID())
+	finalsnapsup := &snapstate.SnapSetup{}
+	endT.Get("snap-setup", finalsnapsup)
+
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(finalsnapsup.LastActiveDisabledServices)
+	c.Assert(finalsnapsup.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
+
+}
+
+func (s *snapmgrTestSuite) TestStopSnapServicesFirstSavesSnapSetupLastActiveDisabledServices(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	prevCurrentlyDisabled := s.fakeBackend.servicesCurrentlyDisabled
+	s.fakeBackend.servicesCurrentlyDisabled = []string{"svc1", "svc2"}
+
+	// reset the services to what they were before after the test is done
+	defer func() {
+		s.fakeBackend.servicesCurrentlyDisabled = prevCurrentlyDisabled
+	}()
+
+	snapstate.Set(s.state, "services-snap", &snapstate.SnapState{
+		Sequence: []*snap.SideInfo{
+			{RealName: "services-snap", Revision: snap.R(11)},
+		},
+		Current: snap.R(11),
+		Active:  true,
+	})
+
+	snapsup := &snapstate.SnapSetup{
+		SideInfo: &snap.SideInfo{
+			RealName: "services-snap",
+			Revision: snap.R(11),
+			SnapID:   "services-snap-id",
+		},
+	}
+
+	chg := s.state.NewChange("stop-services", "stop the services")
+	t := s.state.NewTask("stop-snap-services", "...")
+	t.Set("stop-reason", snap.StopReasonDisable)
+	t.Set("snap-setup", snapsup)
+	chg.AddTask(t)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+
+	// get the snap setup from the task from state
+	endT := s.state.Task(t.ID())
+	finalsnapsup := &snapstate.SnapSetup{}
+	endT.Get("snap-setup", finalsnapsup)
+
+	// make sure that the disabled services in this snap's state is what we
+	// provided
+	sort.Strings(finalsnapsup.LastActiveDisabledServices)
+	c.Assert(finalsnapsup.LastActiveDisabledServices, DeepEquals, []string{"svc1", "svc2"})
+}
+
+func (s *snapmgrTestSuite) TestRefreshDoesntRestoreRevisionConfig(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	// set global configuration (affecting current snap)
+	tr := config.NewTransaction(s.state)
+	tr.Set("some-snap", "foo", "100")
+	tr.Commit()
+
+	// set per-revision config for the upcoming rev. 2, we don't expect it restored though
+	// since only revert restores revision configs.
+	s.state.Set("revision-config", map[string]interface{}{
+		"some-snap": map[string]interface{}{
+			"2": map[string]interface{}{"foo": "200"},
+		},
+	})
+
+	// simulate a refresh to rev. 2
+	chg := s.state.NewChange("update", "update some-snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel", Revision: snap.R(2)}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+
+	s.state.Lock()
+	// config of rev. 1 has been stored in per-revision map
+	var cfgs map[string]interface{}
+	c.Assert(s.state.Get("revision-config", &cfgs), IsNil)
+	c.Assert(cfgs["some-snap"], DeepEquals, map[string]interface{}{
+		"1": map[string]interface{}{"foo": "100"},
+		"2": map[string]interface{}{"foo": "200"},
+	})
+
+	// config of rev. 2 hasn't been restored by refresh, old value returned
+	tr = config.NewTransaction(s.state)
+	var res string
+	c.Assert(tr.Get("some-snap", "foo", &res), IsNil)
+	c.Assert(res, Equals, "100")
+}
+
+func (s *snapmgrTestSuite) TestRefreshFailureCausesErrorReport(c *C) {
+	var errSnap, errMsg, errSig string
+	var errExtra map[string]string
+	var n int
+	restore := snapstate.MockErrtrackerReport(func(aSnap, aErrMsg, aDupSig string, extra map[string]string) (string, error) {
+		errSnap = aSnap
+		errMsg = aErrMsg
+		errSig = aDupSig
+		errExtra = extra
+		n += 1
+		return "oopsid", nil
+	})
+	defer restore()
+
+	si := snap.SideInfo{
+		RealName: "some-snap",
+		SnapID:   "some-snap-id",
+		Revision: snap.R(7),
+	}
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	s.state.Set("ubuntu-core-transition-retry", 7)
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active:   true,
+		Sequence: []*snap.SideInfo{&si},
+		Current:  si.Revision,
+		SnapType: "app",
+	})
+
+	chg := s.state.NewChange("install", "install a snap")
+	ts, err := snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+
+	s.fakeBackend.linkSnapFailTrigger = filepath.Join(dirs.SnapMountDir, "some-snap/11")
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	// verify we generated a failure report
+	c.Check(n, Equals, 1)
+	c.Check(errSnap, Equals, "some-snap")
+	c.Check(errExtra, DeepEquals, map[string]string{
+		"UbuntuCoreTransitionCount": "7",
+		"Channel":                   "some-channel",
+		"Revision":                  "11",
+	})
+	c.Check(errMsg, Matches, `(?sm)change "install": "install a snap"
+prerequisites: Undo
+ snap-setup: "some-snap" \(11\) "some-channel"
+download-snap: Undoing
+validate-snap: Done
+.*
+link-snap: Error
+ INFO unlink
+ ERROR fail
+auto-connect: Hold
+set-auto-aliases: Hold
+setup-aliases: Hold
+run-hook: Hold
+start-snap-services: Hold
+cleanup: Hold
+run-hook: Hold`)
+	c.Check(errSig, Matches, `(?sm)snap-install:
+prerequisites: Undo
+ snap-setup: "some-snap"
+download-snap: Undoing
+validate-snap: Done
+.*
+link-snap: Error
+ INFO unlink
+ ERROR fail
+auto-connect: Hold
+set-auto-aliases: Hold
+setup-aliases: Hold
+run-hook: Hold
+start-snap-services: Hold
+cleanup: Hold
+run-hook: Hold`)
+
+	// run again with empty "ubuntu-core-transition-retry"
+	s.state.Set("ubuntu-core-transition-retry", 0)
+	chg = s.state.NewChange("install", "install a snap")
+	ts, err = snapstate.Update(s.state, "some-snap", &snapstate.RevisionOptions{Channel: "some-channel"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+	chg.AddAll(ts)
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+	// verify that we excluded this field from the bugreport
+	c.Check(n, Equals, 2)
+	c.Check(errExtra, DeepEquals, map[string]string{
+		"Channel":  "some-channel",
+		"Revision": "11",
+	})
+}
+
+func (s *snapmgrTestSuite) TestNoReRefreshInUpdate(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "app",
+	})
+
+	ts, err := snapstate.Update(s.state, "some-snap", nil, 0, snapstate.Flags{NoReRefresh: true})
+	c.Assert(err, IsNil)
+
+	// ensure we have no re-refresh task
+	for _, t := range ts.Tasks() {
+		c.Assert(t.Kind(), Not(Equals), "check-rerefresh")
+	}
+
+	snapsup, err := snapstate.TaskSnapSetup(ts.Tasks()[0])
+	c.Assert(err, IsNil)
+	// NoReRefresh is consumed and consulted when creating the taskset
+	// but is not copied into SnapSetup
+	c.Check(snapsup.Flags.NoReRefresh, Equals, false)
+}
+
+func (s *snapmgrTestSuite) TestEmptyUpdateWithChannelChangeAndAutoAlias(c *C) {
+	// this reproduces the cause behind lp:1860324,
+	// namely an empty refresh with a channel change on a snap
+	// with changed aliases
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	n := 0
+	snapstate.AutoAliases = func(st *state.State, info *snap.Info) (map[string]string, error) {
+		if info.InstanceName() == "alias-snap" {
+			if n > 0 {
+				return map[string]string{
+					"alias1": "cmd1",
+					"alias2": "cmd2",
+				}, nil
+			}
+			n++
+		}
+		return nil, nil
+	}
+
+	snapstate.Set(s.state, "alias-snap", &snapstate.SnapState{
+		TrackingChannel: "latest/stable",
+		Sequence: []*snap.SideInfo{
+			{RealName: "alias-snap", Revision: snap.R(11), SnapID: "alias-snap-id"},
+		},
+		Current: snap.R(11),
+		Active:  true,
+	})
+
+	s.state.Set("aliases", map[string]map[string]string{
+		"alias-snap": {
+			"alias1": "auto",
+		},
+	})
+
+	s.state.Unlock()
+	err := s.snapmgr.Ensure()
+	s.state.Lock()
+	c.Assert(err, IsNil)
+
+	ts, err := snapstate.Update(s.state, "alias-snap", &snapstate.RevisionOptions{Channel: "latest/candidate"}, s.user.ID, snapstate.Flags{})
+	c.Assert(err, IsNil)
+
+	chg := s.state.NewChange("refresh", "refresh snap")
+	chg.AddAll(ts)
+
+	s.state.Unlock()
+	defer s.se.Stop()
+	s.settle(c)
+	s.state.Lock()
+
+	c.Assert(chg.Err(), IsNil)
+	c.Assert(chg.IsReady(), Equals, true)
+}
+
+func (s *snapmgrTestSuite) testUpdateDiskSpaceCheck(c *C, featureFlag, failInstallSize, failDiskCheck bool) error {
+	restore := snapstate.MockOsutilCheckFreeSpace(func(path string, sz uint64) error {
+		c.Check(sz, Equals, snapstate.SafetyMarginDiskSpace(123))
+		if failDiskCheck {
+			return &osutil.NotEnoughDiskSpaceError{}
+		}
+		return nil
+	})
+	defer restore()
+
+	var installSizeCalled bool
+
+	restoreInstallSize := snapstate.MockInstallSize(func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+		installSizeCalled = true
+		if failInstallSize {
+			return 0, fmt.Errorf("boom")
+		}
+		c.Assert(snaps, HasLen, 1)
+		c.Check(snaps[0].InstanceName(), Equals, "some-snap")
+		return 123, nil
+	})
+	defer restoreInstallSize()
+
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	tr := config.NewTransaction(s.state)
+	tr.Set("core", "experimental.check-disk-space-refresh", featureFlag)
+	tr.Commit()
+
+	snapstate.Set(s.state, "some-snap", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "some-snap", SnapID: "some-snap-id", Revision: snap.R(4)},
+		},
+		Current:  snap.R(4),
+		SnapType: "app",
+	})
+
+	opts := &snapstate.RevisionOptions{Channel: "some-channel"}
+	_, err := snapstate.Update(s.state, "some-snap", opts, s.user.ID, snapstate.Flags{})
+
+	if featureFlag {
+		c.Check(installSizeCalled, Equals, true)
+	} else {
+		c.Check(installSizeCalled, Equals, false)
+	}
+
+	return err
+}
+
+func (s *snapmgrTestSuite) TestUpdateDiskSpaceError(c *C) {
+	featureFlag := true
+	failInstallSize := false
+	failDiskCheck := true
+	err := s.testUpdateDiskSpaceCheck(c, featureFlag, failInstallSize, failDiskCheck)
+	diskSpaceErr := err.(*snapstate.InsufficientSpaceError)
+	c.Assert(diskSpaceErr, ErrorMatches, `insufficient space in .* to perform "refresh" change for the following snaps: some-snap`)
+	c.Check(diskSpaceErr.Path, Equals, filepath.Join(dirs.GlobalRootDir, "/var/lib/snapd"))
+	c.Check(diskSpaceErr.Snaps, DeepEquals, []string{"some-snap"})
+}
+
+func (s *snapmgrTestSuite) TestUpdateDiskCheckSkippedIfDisabled(c *C) {
+	featureFlag := false
+	failInstallSize := false
+	failDiskCheck := true
+	err := s.testUpdateDiskSpaceCheck(c, featureFlag, failInstallSize, failDiskCheck)
+	c.Check(err, IsNil)
+}
+
+func (s *snapmgrTestSuite) TestUpdateDiskCheckInstallSizeError(c *C) {
+	featureFlag := true
+	failInstallSize := true
+	failDiskCheck := false
+	err := s.testUpdateDiskSpaceCheck(c, featureFlag, failInstallSize, failDiskCheck)
+	c.Check(err, ErrorMatches, "boom")
+}
+
+func (s *snapmgrTestSuite) TestUpdateDiskCheckHappy(c *C) {
+	featureFlag := true
+	failInstallSize := false
+	failDiskCheck := false
+	err := s.testUpdateDiskSpaceCheck(c, featureFlag, failInstallSize, failDiskCheck)
+	c.Check(err, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/storehelpers.go snapd-2.48.3+20.04/overlord/snapstate/storehelpers.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/storehelpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/storehelpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,6 +32,8 @@
 	"github.com/snapcore/snapd/strutil"
 )
 
+var currentSnaps = currentSnapsImpl
+
 func userIDForSnap(st *state.State, snapst *SnapState, fallbackUserID int) (int, error) {
 	userID := snapst.UserID
 	_, err := auth.User(st, userID)
@@ -82,6 +84,117 @@
 	return &opts, nil
 }
 
+// installSize returns total download size of snaps and their prerequisites
+// (bases and default content providers), querying the store as neccessarry,
+// potentially more than once. It assumes the initial list of snaps already has
+// download infos set.
+// The state must be locked by the caller.
+var installSize = func(st *state.State, snaps []*snap.Info, userID int) (uint64, error) {
+	curSnaps, err := currentSnaps(st)
+	if err != nil {
+		return 0, err
+	}
+
+	user, err := userFromUserID(st, userID)
+	if err != nil {
+		return 0, err
+	}
+
+	accountedSnaps := map[string]bool{}
+	for _, snap := range curSnaps {
+		accountedSnaps[snap.InstanceName] = true
+	}
+
+	var prereqs []string
+
+	resolveBaseAndContentProviders := func(snapInfo *snap.Info) {
+		if snapInfo.SnapType != snap.TypeApp {
+			return
+		}
+		if snapInfo.Base != "none" {
+			base := defaultCoreSnapName
+			if snapInfo.Base != "" {
+				base = snapInfo.Base
+			}
+			if !accountedSnaps[base] {
+				prereqs = append(prereqs, base)
+				accountedSnaps[base] = true
+			}
+		}
+		for _, snapName := range defaultContentPlugProviders(st, snapInfo) {
+			if !accountedSnaps[snapName] {
+				prereqs = append(prereqs, snapName)
+				accountedSnaps[snapName] = true
+			}
+		}
+	}
+
+	snapSizes := map[string]uint64{}
+	for _, snapInfo := range snaps {
+		if snapInfo.DownloadInfo.Size == 0 {
+			return 0, fmt.Errorf("internal error: download info missing for %q", snapInfo.InstanceName())
+		}
+		snapSizes[snapInfo.InstanceName()] = uint64(snapInfo.Size)
+		resolveBaseAndContentProviders(snapInfo)
+	}
+
+	opts, err := refreshOptions(st, nil)
+	if err != nil {
+		return 0, err
+	}
+
+	theStore := Store(st, nil)
+	channel := defaultPrereqSnapsChannel()
+
+	// this can potentially be executed multiple times if we (recursively)
+	// find new prerequisites or bases.
+	for len(prereqs) > 0 {
+		actions := []*store.SnapAction{}
+		for _, prereq := range prereqs {
+			action := &store.SnapAction{
+				Action:       "install",
+				InstanceName: prereq,
+				Channel:      channel,
+			}
+			actions = append(actions, action)
+		}
+
+		// calls to the store should be done without holding the state lock
+		st.Unlock()
+		results, _, err := theStore.SnapAction(context.TODO(), curSnaps, actions, nil, user, opts)
+		st.Lock()
+		if err != nil {
+			return 0, err
+		}
+		prereqs = []string{}
+		for _, res := range results {
+			snapSizes[res.InstanceName()] = uint64(res.Size)
+			// results may have new base or content providers
+			resolveBaseAndContentProviders(res.Info)
+		}
+	}
+
+	// state is locked at this point
+
+	// since we unlock state above when querying store, other changes may affect
+	// same snaps, therefore obtain current snaps again and only compute total
+	// size of snaps that would actually need to be installed.
+	curSnaps, err = currentSnaps(st)
+	if err != nil {
+		return 0, err
+	}
+	for _, snap := range curSnaps {
+		delete(snapSizes, snap.InstanceName)
+	}
+
+	var total uint64
+	for _, sz := range snapSizes {
+		total += sz
+	}
+
+	return total, nil
+}
+
 func installInfo(ctx context.Context, st *state.State, name string, revOpts *RevisionOptions, userID int, deviceCtx DeviceContext) (store.SnapActionResult, error) {
 	// TODO: support ignore-validation?
 
@@ -118,7 +231,7 @@
 
 	theStore := Store(st, deviceCtx)
 	st.Unlock() // calls to the store should be done without holding the state lock
-	res, err := theStore.SnapAction(ctx, curSnaps, []*store.SnapAction{action}, user, opts)
+	res, _, err := theStore.SnapAction(ctx, curSnaps, []*store.SnapAction{action}, nil, user, opts)
 	st.Lock()
 
 	return singleActionResult(name, action.Action, res, err)
@@ -164,7 +277,7 @@
 
 	theStore := Store(st, deviceCtx)
 	st.Unlock() // calls to the store should be done without holding the state lock
-	res, err := theStore.SnapAction(context.TODO(), curSnaps, []*store.SnapAction{action}, user, refreshOpts)
+	res, _, err := theStore.SnapAction(context.TODO(), curSnaps, []*store.SnapAction{action}, nil, user, refreshOpts)
 	st.Lock()
 
 	sar, err := singleActionResult(curInfo.InstanceName(), action.Action, res, err)
@@ -255,14 +368,14 @@
 
 	theStore := Store(st, deviceCtx)
 	st.Unlock() // calls to the store should be done without holding the state lock
-	res, err := theStore.SnapAction(context.TODO(), curSnaps, []*store.SnapAction{action}, user, opts)
+	res, _, err := theStore.SnapAction(context.TODO(), curSnaps, []*store.SnapAction{action}, nil, user, opts)
 	st.Lock()
 
 	sar, err := singleActionResult(curInfo.InstanceName(), action.Action, res, err)
 	return sar.Info, err
 }
 
-func currentSnaps(st *state.State) ([]*store.CurrentSnap, error) {
+func currentSnapsImpl(st *state.State) ([]*store.CurrentSnap, error) {
 	snapStates, err := All(st)
 	if err != nil {
 		return nil, err
@@ -427,7 +540,7 @@
 	updates := make([]*snap.Info, 0, nCands)
 	for u, actions := range actionsForUser {
 		st.Unlock()
-		sarsForUser, err := theStore.SnapAction(ctx, curSnaps, actions, u, opts)
+		sarsForUser, _, err := theStore.SnapAction(ctx, curSnaps, actions, nil, u, opts)
 		st.Lock()
 		if err != nil {
 			saErr, ok := err.(*store.SnapActionError)
@@ -471,5 +584,6 @@
 	theStore := Store(st, nil)
 	st.Unlock() // calls to the store should be done without holding the state lock
 	defer st.Lock()
-	return theStore.SnapAction(context.TODO(), curSnaps, actions, user, opts)
+	results, _, err := theStore.SnapAction(context.TODO(), curSnaps, actions, nil, user, opts)
+	return results, err
 }
diff -Nru snapd-2.45.1+20.04.2/overlord/snapstate/storehelpers_test.go snapd-2.48.3+20.04/overlord/snapstate/storehelpers_test.go
--- snapd-2.45.1+20.04.2/overlord/snapstate/storehelpers_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/snapstate/storehelpers_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,347 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapstate_test
+
+import (
+	"context"
+	"fmt"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/overlord/auth"
+	"github.com/snapcore/snapd/overlord/ifacestate/ifacerepo"
+	"github.com/snapcore/snapd/overlord/snapstate"
+	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/store"
+)
+
+const snapYaml1 = `
+name: some-snap
+version: 1.0
+`
+const snapYaml2 = `
+name: some-snap
+version: 1.0
+base: none
+`
+
+const snapYamlWithBase1 = `
+name: some-snap1
+version: 1.0
+base: some-base
+`
+const snapYamlWithBase2 = `
+name: some-snap2
+version: 1.0
+base: some-base
+`
+const snapYamlWithBase3 = `
+name: some-snap3
+version: 2.0
+base: other-base
+`
+const snapYamlWithBase4 = `
+name: some-snap4
+version: 1.0
+base: yet-another-base
+`
+const snapYamlWithContentPlug1 = `
+name: some-snap
+version: 1.0
+base: some-base
+plugs:
+  some-plug:
+    interface: content
+    content: shared-content
+    default-provider: snap-content-slot
+`
+
+const snapYamlWithContentPlug2 = `
+name: some-snap2
+version: 1.0
+base: some-base
+plugs:
+  some-plug:
+    interface: content
+    content: shared-content
+    default-provider: snap-content-slot
+`
+
+const snapYamlWithContentPlug3 = `
+name: some-snap
+version: 1.0
+base: some-base
+plugs:
+  some-plug:
+    interface: content
+    content: shared-content
+    default-provider: snap-content-slot-other
+`
+
+const (
+	// use sizes that make it easier to spot unexpected dependencies in the
+	// total sum.
+	someBaseSize             = 1
+	otherBaseSize            = 100
+	snap1Size                = 1000
+	snap2Size                = 10000
+	snap3Size                = 100000
+	snap4Size                = 1000000
+	snapContentSlotSize      = 10000000
+	snapOtherContentSlotSize = 100000000
+	someOtherBaseSize        = 1000000000
+)
+
+type installSizeTestStore struct {
+	*fakeStore
+}
+
+func (f installSizeTestStore) SnapAction(ctx context.Context, currentSnaps []*store.CurrentSnap, actions []*store.SnapAction, assertQuery store.AssertionQuery, user *auth.UserState, opts *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
+	sizes := map[string]int64{
+		"some-base":               someBaseSize,
+		"other-base":              otherBaseSize,
+		"snap-content-slot":       snapContentSlotSize,
+		"snap-content-slot-other": snapOtherContentSlotSize,
+		"some-other-base":         someOtherBaseSize,
+	}
+	for _, sa := range actions {
+		if sa.Action != "install" {
+			panic(fmt.Sprintf("unexpected action: %s", sa.Action))
+		}
+		if sa.Channel != "stable" {
+			panic(fmt.Sprintf("unexpected channel: %s", sa.Channel))
+		}
+		if _, ok := sizes[sa.InstanceName]; !ok {
+			panic(fmt.Sprintf("unexpected snap: %q", sa.InstanceName))
+		}
+	}
+	sars, _, err := f.fakeStore.SnapAction(ctx, currentSnaps, actions, assertQuery, user, opts)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for _, sr := range sars {
+		if sz, ok := sizes[sr.Info.InstanceName()]; ok {
+			sr.Info.Size = sz
+		} else {
+			panic(fmt.Sprintf("unexpected snap: %q", sr.Info.InstanceName()))
+		}
+		if sr.Info.InstanceName() == "snap-content-slot-other" {
+			sr.Info.Base = "some-other-base"
+		}
+	}
+	return sars, nil, nil
+}
+
+func (s *snapmgrTestSuite) mockCoreSnap(c *C) {
+	snapstate.Set(s.state, "core", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "core", SnapID: "core-id", Revision: snap.R(1)},
+		},
+		Current:  snap.R(1),
+		SnapType: "os",
+	})
+	// mock the yaml
+	makeInstalledMockCoreSnap(c)
+}
+
+func (s *snapmgrTestSuite) setupInstallSizeStore() {
+	fakestore := installSizeTestStore{fakeStore: s.fakeStore}
+	snapstate.ReplaceStore(s.state, fakestore)
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeSimple(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	s.setupInstallSizeStore()
+	s.mockCoreSnap(c)
+
+	snap1 := snaptest.MockSnap(c, snapYaml1, &snap.SideInfo{
+		RealName: "some-snap1",
+		Revision: snap.R(1),
+	})
+	snap1.Size = snap1Size
+	snap2 := snaptest.MockSnap(c, snapYaml2, &snap.SideInfo{
+		RealName: "some-snap2",
+		Revision: snap.R(2),
+	})
+	snap2.Size = snap2Size
+
+	sz, err := snapstate.InstallSize(st, []*snap.Info{snap1, snap2}, 0)
+	c.Assert(err, IsNil)
+	c.Check(sz, Equals, uint64(snap1Size+snap2Size))
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeWithBases(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	s.setupInstallSizeStore()
+
+	snap1 := snaptest.MockSnap(c, snapYamlWithBase1, &snap.SideInfo{
+		RealName: "some-snap1",
+		Revision: snap.R(1),
+	})
+	snap1.Size = snap1Size
+	snap2 := snaptest.MockSnap(c, snapYamlWithBase2, &snap.SideInfo{
+		RealName: "some-snap2",
+		Revision: snap.R(2),
+	})
+	snap2.Size = snap2Size
+	snap3 := snaptest.MockSnap(c, snapYamlWithBase3, &snap.SideInfo{
+		RealName: "some-snap3",
+		Revision: snap.R(4),
+	})
+	snap3.Size = snap3Size
+	snap4 := snaptest.MockSnap(c, snapYamlWithBase4, &snap.SideInfo{
+		RealName: "some-snap4",
+		Revision: snap.R(1),
+	})
+	snap4.Size = snap4Size
+
+	// base of some-snap4 is already installed
+	snapstate.Set(st, "yet-another-base", &snapstate.SnapState{
+		Active: true,
+		Sequence: []*snap.SideInfo{
+			{RealName: "yet-another-base", Revision: snap.R(1), SnapID: "yet-another-base-id"},
+		},
+		Current: snap.R(1),
+	})
+
+	sz, err := snapstate.InstallSize(st, []*snap.Info{snap1, snap2, snap3, snap4}, 0)
+	c.Assert(err, IsNil)
+	c.Check(sz, Equals, uint64(snap1Size+snap2Size+snap3Size+snap4Size+someBaseSize+otherBaseSize))
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeWithContentProviders(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(st, repo)
+
+	s.setupInstallSizeStore()
+
+	snap1 := snaptest.MockSnap(c, snapYamlWithContentPlug1, &snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(1),
+	})
+	snap1.Size = snap1Size
+
+	snap2 := snaptest.MockSnap(c, snapYamlWithContentPlug2, &snap.SideInfo{
+		RealName: "some-snap2",
+		Revision: snap.R(1),
+	})
+	snap2.Size = snap2Size
+
+	s.mockCoreSnap(c)
+
+	// both snaps have same content providers and base
+	sz, err := snapstate.InstallSize(st, []*snap.Info{snap1, snap2}, 0)
+	c.Assert(err, IsNil)
+	c.Check(sz, Equals, uint64(snap1Size+snap2Size+someBaseSize+snapContentSlotSize))
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeWithNestedDependencies(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	repo := interfaces.NewRepository()
+	ifacerepo.Replace(st, repo)
+
+	s.setupInstallSizeStore()
+	snap1 := snaptest.MockSnap(c, snapYamlWithContentPlug3, &snap.SideInfo{
+		RealName: "some-snap",
+		Revision: snap.R(1),
+	})
+	snap1.Size = snap1Size
+
+	s.mockCoreSnap(c)
+
+	sz, err := snapstate.InstallSize(st, []*snap.Info{snap1}, 0)
+	c.Assert(err, IsNil)
+	c.Check(sz, Equals, uint64(snap1Size+someBaseSize+snapOtherContentSlotSize+someOtherBaseSize))
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeWithOtherChangeAffectingSameSnaps(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	var currentSnapsCalled int
+	restore := snapstate.MockCurrentSnaps(func(st *state.State) ([]*store.CurrentSnap, error) {
+		currentSnapsCalled++
+		// call original implementation of currentSnaps
+		curr, err := snapstate.CurrentSnaps(st)
+		if currentSnapsCalled == 1 {
+			return curr, err
+		}
+		// simulate other change that installed some-snap3 and other-base while
+		// we release the lock inside InstallSize.
+		curr = append(curr, &store.CurrentSnap{InstanceName: "some-snap3"})
+		curr = append(curr, &store.CurrentSnap{InstanceName: "other-base"})
+		return curr, nil
+	})
+	defer restore()
+
+	s.setupInstallSizeStore()
+
+	snap1 := snaptest.MockSnap(c, snapYamlWithBase1, &snap.SideInfo{
+		RealName: "some-snap1",
+		Revision: snap.R(1),
+	})
+	snap1.Size = snap1Size
+	snap3 := snaptest.MockSnap(c, snapYamlWithBase3, &snap.SideInfo{
+		RealName: "some-snap3",
+		Revision: snap.R(2),
+	})
+	snap3.Size = snap3Size
+
+	sz, err := snapstate.InstallSize(st, []*snap.Info{snap1, snap3}, 0)
+	c.Assert(err, IsNil)
+	// snap3 and its base installed by another change, not counted here
+	c.Check(sz, Equals, uint64(snap1Size+someBaseSize))
+
+	// sanity
+	c.Check(currentSnapsCalled, Equals, 2)
+}
+
+func (s *snapmgrTestSuite) TestInstallSizeErrorNoDownloadInfo(c *C) {
+	st := s.state
+	st.Lock()
+	defer st.Unlock()
+
+	snap1 := &snap.Info{
+		SideInfo: snap.SideInfo{
+			RealName: "snap",
+		}}
+
+	_, err := snapstate.InstallSize(st, []*snap.Info{snap1}, 0)
+	c.Assert(err, ErrorMatches, `internal error: download info missing.*`)
+}
diff -Nru snapd-2.45.1+20.04.2/overlord/state/task.go snapd-2.48.3+20.04/overlord/state/task.go
--- snapd-2.45.1+20.04.2/overlord/state/task.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/state/task.go	2021-02-02 08:21:12.000000000 +0000
@@ -509,7 +509,7 @@
 	}
 }
 
-// AddTask adds the the task to the task set.
+// AddTask adds the task to the task set.
 func (ts *TaskSet) AddTask(task *Task) {
 	for _, t := range ts.tasks {
 		if t == task {
diff -Nru snapd-2.45.1+20.04.2/overlord/state/taskrunner.go snapd-2.48.3+20.04/overlord/state/taskrunner.go
--- snapd-2.45.1+20.04.2/overlord/state/taskrunner.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/overlord/state/taskrunner.go	2021-02-02 08:21:12.000000000 +0000
@@ -197,7 +197,7 @@
 	r.tombs[t.ID()] = tomb
 	tomb.Go(func() error {
 		// Capture the error result with tomb.Kill so we can
-		// use tomb.Err uniformily to consider both it or a
+		// use tomb.Err uniformly to consider both it or a
 		// overriding previous Kill reason.
 		t0 := time.Now()
 		tomb.Kill(handler(t, tomb))
diff -Nru snapd-2.45.1+20.04.2/packaging/amzn-2/snapd.spec snapd-2.48.3+20.04/packaging/amzn-2/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/amzn-2/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/amzn-2/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/arch/PKGBUILD snapd-2.48.3+20.04/packaging/arch/PKGBUILD
--- snapd-2.45.1+20.04.2/packaging/arch/PKGBUILD	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/arch/PKGBUILD	2021-02-02 08:21:12.000000000 +0000
@@ -8,11 +8,12 @@
 
 pkgname=snapd
 pkgdesc="Service and tools for management of snap packages."
-depends=('squashfs-tools' 'libseccomp' 'libsystemd')
-optdepends=('bash-completion: bash completion support')
-pkgver=2.45.1
+depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'apparmor')
+optdepends=('bash-completion: bash completion support'
+            'xdg-desktop-portal: desktop integration')
+pkgver=2.48.3
 pkgrel=1
-arch=('x86_64')
+arch=('x86_64' 'i686' 'armv7h' 'aarch64')
 url="https://github.com/snapcore/snapd"
 license=('GPL3')
 makedepends=('git' 'go' 'go-tools' 'libseccomp' 'libcap' 'systemd' 'xfsprogs' 'python-docutils' 'apparmor')
@@ -49,10 +50,16 @@
   export GOPATH="$srcdir/go"
 
   # GOFLAGS may be modified by CI tools
+  # GOFLAGS are the go build flags for all binaries, GOFLAGS_SNAP are for snap
+  # build only.
   GOFLAGS=""
+  GOFLAGS_SNAP="-tags nomanagers"
   if [[ "$WITH_TEST_KEYS" == 1 ]]; then
       GOFLAGS="$GOFLAGS -tags withtestkeys"
+      GOFLAGS_SNAP="-tags nomanagers,withtestkeys"
   fi
+  # snapd does not support modules yet, explicitly disable Go modules
+  export GO111MODULE=off
 
   export CGO_ENABLED="1"
   export CGO_CFLAGS="${CFLAGS}"
@@ -67,17 +74,20 @@
   cd "$srcdir/go/src/${_gourl}"
   XDG_CONFIG_HOME="$srcdir" ./get-deps.sh
 
-  gobuild="go build -x -v -buildmode=pie"
-  gobuild_static="go build -x -v -buildmode=pie -ldflags=-extldflags=-static"
+  # because argument expansion with quoting in bash is hard, and -ldflags=-extldflags='-foo'
+  # is not exactly the same as -ldflags "-extldflags '-foo'" use the array trick
+  # to pass exactly what we want
+  flags=(-buildmode=pie -ldflags "-s -extldflags '$LDFLAGS'")
+  staticflags=(-buildmode=pie -ldflags "-s -linkmode external -extldflags '$LDFLAGS -static'")
   # Build/install snap and snapd
-  $gobuild -o $srcdir/go/bin/snap $GOFLAGS "${_gourl}/cmd/snap"
-  $gobuild -o $srcdir/go/bin/snapd $GOFLAGS "${_gourl}/cmd/snapd"
-  $gobuild -o $srcdir/go/bin/snap-seccomp $GOFLAGS "${_gourl}/cmd/snap-seccomp"
-  $gobuild -o $srcdir/go/bin/snap-failure $GOFLAGS "${_gourl}/cmd/snap-failure"
+  go build "${flags[@]}" -o "$srcdir/go/bin/snap" $GOFLAGS_SNAP "${_gourl}/cmd/snap"
+  go build "${flags[@]}" -o "$srcdir/go/bin/snapd" $GOFLAGS "${_gourl}/cmd/snapd"
+  go build "${flags[@]}" -o "$srcdir/go/bin/snap-seccomp" $GOFLAGS "${_gourl}/cmd/snap-seccomp"
+  go build "${flags[@]}" -o "$srcdir/go/bin/snap-failure" $GOFLAGS "${_gourl}/cmd/snap-failure"
   # build snap-exec and snap-update-ns completely static for base snaps
-  $gobuild_static -o $srcdir/go/bin/snap-update-ns $GOFLAGS "${_gourl}/cmd/snap-update-ns"
-  $gobuild_static -o $srcdir/go/bin/snap-exec $GOFLAGS "${_gourl}/cmd/snap-exec"
-  $gobuild_static -o $srcdir/go/bin/snapctl $GOFLAGS "${_gourl}/cmd/snapctl"
+  go build "${staticflags[@]}" -o "$srcdir/go/bin/snap-update-ns" $GOFLAGS "${_gourl}/cmd/snap-update-ns"
+  go build "${staticflags[@]}" -o "$srcdir/go/bin/snap-exec" $GOFLAGS "${_gourl}/cmd/snap-exec"
+  go build "${staticflags[@]}" -o "$srcdir/go/bin/snapctl" $GOFLAGS "${_gourl}/cmd/snapctl"
 
   # Generate data files such as real systemd units, dbus service, environment
   # setup helpers out of the available templates
@@ -104,6 +114,11 @@
   export GOPATH="$srcdir/go"
   cd "$srcdir/go/src/${_gourl}"
 
+  # make sure the binaries that need to be built statically really are
+  for binary in snap-exec snap-update-ns snapctl; do
+      LC_ALL=C ldd "$srcdir/go/bin/$binary" 2>&1 | grep -q 'not a dynamic executable'
+  done
+
   SKIP_UNCLEAN=1 ./run-checks --unit
   # XXX: Static checks choke on autotools generated cruft. Let's not run them
   # here as they are designed to pass on a clean tree, before anything else is
@@ -143,20 +158,22 @@
 
   # Install executables
   install -Dm755 "$srcdir/go/bin/snap" "$pkgdir/usr/bin/snap"
+  install -Dm755 "$srcdir/go/bin/snapctl" "$pkgdir/usr/lib/snapd/snapctl"
   install -Dm755 "$srcdir/go/bin/snapd" "$pkgdir/usr/lib/snapd/snapd"
   install -Dm755 "$srcdir/go/bin/snap-seccomp" "$pkgdir/usr/lib/snapd/snap-seccomp"
   install -Dm755 "$srcdir/go/bin/snap-failure" "$pkgdir/usr/lib/snapd/snap-failure"
   install -Dm755 "$srcdir/go/bin/snap-update-ns" "$pkgdir/usr/lib/snapd/snap-update-ns"
   install -Dm755 "$srcdir/go/bin/snap-exec" "$pkgdir/usr/lib/snapd/snap-exec"
   # Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl
-  install -Dm755 "$srcdir/go/bin/snapctl" "$pkgdir/usr/lib/snapd/snapctl"
-  ln -s  ../lib/snapd/snapctl  "$pkgdir/usr/bin/snapctl"
+  ln -s /usr/lib/snapd/snapctl "$pkgdir/usr/bin/snapctl"
 
   # pre-create directories
   install -dm755 "$pkgdir/var/lib/snapd/snap"
   install -dm755 "$pkgdir/var/cache/snapd"
   install -dm755 "$pkgdir/var/lib/snapd/apparmor"
   install -dm755 "$pkgdir/var/lib/snapd/assertions"
+  install -dm755 "$pkgdir/var/lib/snapd/dbus-1/services"
+  install -dm755 "$pkgdir/var/lib/snapd/dbus-1/system-services"
   install -dm755 "$pkgdir/var/lib/snapd/desktop/applications"
   install -dm755 "$pkgdir/var/lib/snapd/device"
   install -dm755 "$pkgdir/var/lib/snapd/hostfs"
@@ -164,6 +181,7 @@
   install -dm755 "$pkgdir/var/lib/snapd/seccomp/bpf"
   install -dm755 "$pkgdir/var/lib/snapd/snap/bin"
   install -dm755 "$pkgdir/var/lib/snapd/snaps"
+  install -dm755 "$pkgdir/var/lib/snapd/inhibit"
   install -dm755 "$pkgdir/var/lib/snapd/lib/gl"
   install -dm755 "$pkgdir/var/lib/snapd/lib/gl32"
   install -dm755 "$pkgdir/var/lib/snapd/lib/vulkan"
diff -Nru snapd-2.45.1+20.04.2/packaging/centos-7/snapd.spec snapd-2.48.3+20.04/packaging/centos-7/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/centos-7/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/centos-7/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/centos-8/snapd.spec snapd-2.48.3+20.04/packaging/centos-8/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/centos-8/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/centos-8/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/debian-sid/changelog snapd-2.48.3+20.04/packaging/debian-sid/changelog
--- snapd-2.45.1+20.04.2/packaging/debian-sid/changelog	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/debian-sid/changelog	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,1303 @@
+snapd (2.48.3-1) unstable; urgency=medium
+
+  * SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  * interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 02 Feb 2021 09:21:12 +0100
+
+snapd (2.48.2-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - tests: sign new nested-18|20* models to allow for generic serials
+    - secboot: add extra paranoia when waiting for that fde-reveal-key
+    - tests: backport netplan workarounds from #9785
+    - secboot: add workaround for snapcore/core-initrd issue #13
+    - devicestate: log checkEncryption errors via logger.Noticef
+    - tests: add nested spread end-to-end test for fde-hooks
+    - devicestate: implement checkFDEFeatures()
+    - boot: tweak resealing with fde-setup hooks
+    - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+      init restrict file
+    - secboot: add new LockSealedKeys() that uses either TPM or
+      fde-reveal-key
+    - gadget: use "sealed-keys" to determine what method to use for
+      reseal
+    - boot: add sealKeyToModeenvUsingFdeSetupHook()
+    - secboot: use `fde-reveal-key` if available to unseal key
+    - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+      other entries
+    - o/devicestate: save model with serial in the device save db
+    - devicestate: add runFDESetupHook() helper
+    - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+    - hookstate: add new HookManager.EphemeralRunHook()
+    - update-pot: fix typo in plural keyword spec
+    - store,cmd/snap-repair: increase initial expontential time
+      intervals
+    - o/devicestate,daemon: fix reboot system action to not require a
+      system label
+    - github: run nested suite when commit is pushed to release branch
+    - tests: reset fakestore unit status
+    - tests: fix uc20-create-parition-* tests for updated gadget
+    - hookstate: implement snapctl fde-setup-{request,result}
+    - devicestate: make checkEncryption fde-setup hook aware
+    - client,snapctl: add naive support for "stdin"
+    - devicestate: support "storage-safety" defaults during install
+    - snap: use the boot-base for kernel hooks
+    - vendor: update secboot repo to avoid including secboot.test binary
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 15 Dec 2020 20:21:44 +0100
+
+snapd (2.48.1-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - gadget: disable ubuntu-boot role validation check
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Dec 2020 17:43:30 +0100
+
+snapd (2.48-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1904098
+    - osutil: add KernelCommandLineKeyValue
+    - devicestate: implement boot.HasFDESetupHook
+    - boot/makebootable.go: set snapd_recovery_mode=install at image-
+      build time
+    - bootloader: use ForGadget when installing boot config
+    - interfaces/raw_usb: allow read access to /proc/tty/drivers
+    - boot: add scaffolding for "fde-setup" hook support for sealing
+    - tests: fix basic20 test on arm devices
+    - seed: make a shared seed system label validation helper
+    - snap: add new "fde-setup" hooktype
+    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+      device handling
+    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+      messiness
+    - tests/nested/manual/refresh-revert-fundamentals: temporarily
+      disable secure boot
+    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+      boot modes
+    - many: address degraded recover mode feedback, cleanups
+    - tests: Use systemd-run on tests part2
+    - tests: set the opensuse tumbleweed system as manual in spread.yaml
+    - secboot: call BlockPCRProtectionPolicies even if the TPM is
+      disabled
+    - vendor: update to current secboot
+    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+      save
+    - spread.yaml: increase number of workers on 20.10
+    - snap: add new `snap recovery --show-keys` option
+    - tests: minor test tweaks suggested in the review of 9607
+    - snapd-generator: set standard snapfuse options when generating
+      units for containers
+    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+    - interfaces: share /tmp/.X11-unix/ from host or provider
+    - tests: enable main lxd test on 20.10
+    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+      degraded mode
+    - gadget/install: add progress logging
+    - packaging: keep secboot/encrypt_dummy.go in debian
+    - interfaces/udev: use distro specific path to snap-device-helper
+    - o/devistate: fix chaining of tasks related to regular snaps when
+      preseeding
+    - gadget, overlord/devicestate: validate that system supports
+      encrypted data before install
+    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+      ESP layout
+    - many: add /v2/system-recovery-keys API and client
+    - secboot, many: return UnlockMethod from Unlock* methods for future
+      usage
+    - many: mv keys to ubuntu-boot, move model file, rename keyring
+      prefix for secboot
+    - tests: using systemd-run instead of manually create a systemd unit
+      - part 1
+    - secboot, cmd/snap-bootstrap: enable or disable activation with
+      recovery key
+    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+      disks first
+    - secboot: add LockTPMSealedKeys() to lock access to keys
+      independently
+    - gadget: correct sfdisk arguments
+    - bootloader/assets/grub: adjust fwsetup menuentry label
+    - tests: new boot state tool
+    - spread: use the official image for Ubuntu 20.10, no longer an
+      unstable system
+    - tests/lib/nested: enable snapd logging to console for core18
+    - osutil/disks: re-implement partition searching for disk w/ non-
+      adjacent parts
+    - tests: using the nested-state tool in nested tests
+    - many: seal a fallback object to the recovery boot chain
+    - gadget, gadget/install: move helpers to install package, refactor
+      unit tests
+    - dirs: add "gentoo" to altDirDistros
+    - update-pot: include file locations in translation template, and
+      extract strings from desktop files
+    - gadget/many: drop usage of gpt attr 59 for indicating creation of
+      partitions
+    - gadget/quantity: tweak test name
+    - snap: fix failing unittest for quantity.FormatDuration()
+    - gadget/quantity: introduce a new package that captures quantities
+    - o/devicestate,a/sysdb: make a backup of the device serial to save
+    - tests: fix rare interaction of tests.session and specific tests
+    - features: enable classic-preserves-xdg-runtime-dir
+    - tests/nested/core20/save: check the bind mount and size bump
+    - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+    - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+      tests
+    - o/devicestate: unit test tweaks
+    - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+    - testutil, cmd/snap/version: fix misc little errors
+    - overlord/devicestate: bind mount ubuntu-save under
+      /var/lib/snapd/save on startup
+    - gadget/internal: tune ext4 setting for smaller filesystems
+    - tests/nested/core20/save: a test that verifies ubuntu-save is
+      present and set up
+    - tests: update google sru backend to support groovy
+    - o/ifacestate: handle interface hooks when preseeding
+    - tests: re-enable the apt hooks test
+    - interfaces,snap: use correct type: {os,snapd} for test data
+    - secboot: set metadata and keyslots sizes when formatting LUKS2
+      volumes
+    - tests: improve uc20-create-partitions-reinstall test
+    - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+    - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+    - secboot: fix doc comment on helper for unlocking volume with key
+    - tests: add spread test for refreshing from an old snapd and core18
+    - o/snapstate: generate snapd snap wrappers again after restart on
+      refresh
+    - secboot: version bump, unlock volume with key
+    - tests/snap-advise-command: re-enable test
+    - cmd/snap, snapmgr, tests: cleanups after #9418
+    - interfaces: deny connected x11 plugs access to ICE
+    - daemon,client: write and read a maintenance.json file for when
+      snapd is shut down
+    - many: update to secboot v1 (part 1)
+    - osutil/disks/mockdisk: panic if same mountpoint shows up again
+      with diff opts
+    - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+      reseal tests
+    - many: implement snap routine console-conf-start for synchronizing
+      auto-refreshes
+    - dirs, boot: add ubuntu-save directories and related locations
+    - usersession: fix typo in test name
+    - overlord/snapstate: refactor ihibitRefresh
+    - overlord/snapstate: stop warning about inhibited refreshes
+    - cmd/snap: do not hardcode snapshot age value
+    - overlord,usersession: initial notifications of pending refreshes
+    - tests: add a unit test for UpdateMany where a single snap fails
+    - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+      mode uc20
+    - tests: also check snapst.Current in undo-unlink tests
+    - tests: new nested tool
+    - o/snapstate: implement undo handler for unlink-snap
+    - tests: clean systems.sh helper and migrate last set of tests
+    - tests: moving the lib section from systems.sh helper to os.query
+      tool
+    - tests/uc20-create-partitions: don't check for grub.cfg
+    - packaging: make sure that static binaries are indeed static, fix
+      openSUSE
+    - many: have install return encryption keys for data and save,
+      improve tests
+    - overlord: add link participant for linkage transitions
+    - tests: lxd smoke test
+    - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+      seed too
+    - tests: moving main suite from systems.sh to os.query tool
+    - tests: moving the core test suite from systems.sh to os.query tool
+    - cmd/snap-confine: mask host's apparmor config
+    - o/snapstate: move setting updated SnapState after error paths
+    - tests: add value to INSTANCE_KEY/regular
+    - spread, tests: tweaks for openSUSE
+    - cmd/snap-confine: update path to snap-device-helper in AppArmor
+      profile
+    - tests: new os.query tool
+    - overlord/snapshotstate/backend: specify tar format for snapshots
+    - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+      UC20
+    - client,daemon,snap: auto-import does not error on managed devices
+    - interfaces: PTP hardware clock interface
+    - tests: use tests.backup tool
+    - many: verify that unit tests work with nosecboot tag and without
+      secboot package
+    - wrappers: do not error out on read-only /etc/dbus-1/session.d
+      filesystem on core18
+    - snapshots: import of a snapshot set
+    - tests: more output for sbuild test
+    - o/snapstate: re-order remove tasks for individual snap revisions
+      to remove current last
+    - boot: skip some unit tests when running as root
+    - o/assertstate: introduce
+      ValidationTrackingKey/ValidationSetTracking and basic methods
+    - many: allow ignoring running apps for specific request
+    - tests: allow the searching test to fail under load
+    - overlord/snapstate: inhibit startup while unlinked
+    - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+      features
+    - tests/main/sudo-env: snap bin is available on Fedora
+    - boot, overlord/devicestate: list trusted and managed assets
+      upfront
+    - gadget, gadget/install: support for ubuntu-save, create one during
+      install if needed
+    - spread-shellcheck: temporary workaround for deadlock, drop
+      unnecessary test
+    - snap: support different exit-code in the snap command
+    - logger: use strutil.KernelCommandLineSplit in
+      debugEnabledOnKernelCmdline
+    - logger: fix snapd.debug=1 parsing
+    - overlord: increase refresh postpone limit to 14 days
+    - spread-shellcheck: use single thread pool executor
+    - gadget/install,secboot: add debug messages
+    - spread-shellcheck: speed up spread-shellcheck even more
+    - spread-shellcheck: process paths from arguments in parallel
+    - tests: tweak error from tests.cleanup
+    - spread: remove workaround for openSUSE go issue
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - tests: new tests.backup tool
+    - tests: add tests.cleanup pop sub-command
+    - tests: migration of the main suite to snaps-state tool part 6
+    - tests: fix journal-state test
+    - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+      recover files
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - boot, gadget, bootloader: observer preserves managed bootloader
+      configs
+    - tests/nested/manual: add uc20 grade signed cloud-init test
+    - o/snapstate/autorefresh.go: eliminate race when launching
+      autorefresh
+    - daemon,snapshotstate: do not return "size" from Import()
+    - daemon: limit reading from snapshot import to Content-Length
+    - many: set/expect Content-Length header when importing snapshots
+    - github: switch from ::set-env command to environment file
+    - tests: migration of the main suite to snaps-state tool part 5
+    - client: cleanup the Client.raw* and Client.do* method families
+    - tests: moving main suite to snaps-state tool part 4
+    - client,daemon,snap: use constant for snapshot content-type
+    - many: fix typos and repeated "the"
+    - secboot: fix tpm connection leak when it's not enabled
+    - many: scaffolding for snapshots import API
+    - run-checks: run spread-shellcheck too
+    - interfaces: update network-manager interface to allow
+      ObjectManager access from unconfined clients
+    - tests: move core and regression suites to snaps-state tool
+    - tests: moving interfaces tests to snaps-state tool
+    - gadget: preserve files when indicated by content change observer
+    - tests: moving smoke test suite and some tests from main suite to
+      snaps-state tool
+    - o/snapshotstate: pass set id to backend.Open, update tests
+    - asserts/snapasserts: introduce ValidationSets
+    - o/snapshotstate: improve allocation of new set IDs
+    - boot: look at the gadget for run mode bootloader when making the
+      system bootable
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - usersession/userd: separate bus name ownership from defining
+      interfaces
+    - o/snapshotstate: set snapshot set id from its filename
+    - o/snapstate: move remove-related tests to snapstate_remove_test.go
+    - desktop/notification: switch ExpireTimeout to time.Duration
+    - desktop/notification: add unit tests
+    - snap: snap help output refresh
+    - tests/nested/manual/preseed: include a system-usernames snap when
+      preseeding
+    - tests: fix sudo-env test
+    - tests: fix nested core20 shellcheck bug
+    - tests/lib: move to new directory when restoring PWD, cleanup
+      unpacked unpacked snap directories
+    - desktop/notification: add bindings for FDO notifications
+    - dbustest: fix stale comment references
+    - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+      drop former
+    - snap-repair: add uc20 support
+    - tests: print all the serial logs for the nested test
+    - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+      bug in test
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+      as Unknown*
+    - asserts: deserialize grouping only once in Pool.AddBatch if needed
+    - gadget: allow content observer to have opinions about a change
+    - tests: new snaps-state command - part1
+    - o/assertstate: support refreshing any number of snap-declarations
+    - boot: use test helpers
+    - tests/core/snap-debug-bootvars: also check snap_mode
+    - many/apparmor: adjust rules for reading profile/ execing new
+      profiles for new kernel
+    - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+      vars
+    - tests/lib/nested.sh: more little tweaks
+    - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - overlord: explicitly set refresh-app-awareness in tests
+    - kernel: remove "edition" from kernel.yaml and add "update"
+    - spread: drop vendor from the packed project archive
+    - boot: fix debug bootloader variables dump on UC20 systems
+    - wrappers, systemd: allow empty root dir and conditionally do not
+      pass --root to systemctl
+    - tests/nested/manual: add test for grades above signed booting with
+      testkeys
+    - tests/nested: misc robustness fixes
+    - o/assertstate,asserts: use bulk refresh to refresh snap-
+      declarations
+    - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+      been updated now
+    - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+    - update-pot: ignore .go files inside .git when running xgettext-go
+    - tests: disable part of the lxd test completely on 16.04.
+    - o/snapshotstate: tweak comment regarding snapshot filename
+    - o/snapstate: improve snapshot iteration
+    - bootloader: lk cleanups
+    - tests: update to support nested kvm without reboots on UC20
+    - tests/nested/manual/preseed: disable system-key check for 20.04
+      image
+    - spread.yaml: add ubuntu-20.10-64 to qemu
+    - store: handle v2 error when fetching assertions
+    - gadget: resolve device mapper devices for fallback device lookup
+    - tests/nested/cloud-init-many: simplify tests and unify
+      helpers/seed inputs
+    - tests: copy /usr/lib/snapd/info to correct directory
+    - check-pr-title.py * : allow "*" in the first part of the title
+    - many: typos and small test tweak
+    - tests/main/lxd: disable cgroup combination for 16.04 that is
+      failing a lot
+    - tests: make nested signing helpers less confusing
+    - tests: misc nested changes
+    - tests/nested/manual/refresh-revert-fundamentals: disable
+      temporarily
+    - tests/lib/cla_check: default to Python 3, tweaks, formatting
+    - tests/lib/cl_check.py: use python3 compatible code
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 Nov 2020 17:51:02 +0100
+
+snapd (2.47.1-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - snap: snap help output refresh
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 08 Oct 2020 09:30:44 +0200
+
+snapd (2.47-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - tests: fix nested core20 shellcheck bug
+    - many/apparmor: adjust rule for reading apparmor profile for new
+      kernel
+    - snap-repair: add uc20 support
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - gadget: resolve device mapper devices for fallback device lookup
+    - secboot: add boot manager profile to pcr protection profile
+    - sysconfig,o/devicestate: mv DisableNoCloud to
+      DisableAfterLocalDatasourcesRun
+    - tests: make gadget-reseal more robust
+    - tests: skip nested images pre-configuration by default
+    - tests: fix for basic20 test running on external backend and rpi
+    - tests: improve kernel reseal test
+    - boot: adjust comments, naming, log success around reseal
+    - tests/nested, fakestore: changes necessary to run nested uc20
+      signed/secured tests
+    - tests: add nested core20 gadget reseal test
+    - boot/modeenv: track unknown keys in Read and put back into modeenv
+      during Write
+    - interfaces/process-control: add sched_setattr to seccomp
+    - boot: with unasserted kernels reseal if there's a hint modeenv
+      changed
+    - client: bump the default request timeout to 120s
+    - configcore: do not error in console-conf.disable for install mode
+    - boot: streamline bootstate20.go reseal and tests changes
+    - boot: reseal when changing kernel
+    - cmd/snap/model: specify grade in the model command output
+    - tests: simplify
+      repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+    - test: improve logging in nested tests
+    - nested: add support to telnet to serial port in nested VM
+    - secboot: use the snapcore/secboot native recovery key type
+    - tests/lib/nested.sh: use more focused cloud-init config for uc20
+    - tests/lib/nested.sh: wait for the tpm socket to exist
+    - spread.yaml, tests/nested: misc changes
+    - tests: add more checks to disk space awareness spread test
+    - tests: disk space awareness spread test
+    - boot: make MockUC20Device use a model and MockDevice more
+      realistic
+    - boot,many: reseal only when meaningful and necessary
+    - tests/nested/core20/kernel-failover: add test for failed refresh
+      of uc20 kernel
+    - tests: fix nested to work with qemu and kvm
+    - boot: reseal when updating boot assets
+    - tests: fix snap-routime-portal-info test
+    - boot: verify boot chain file in seal and reseal tests
+    - tests: use full path to test-snapd-refresh.version binary
+    - boot: store boot chains during install, helper for checking
+      whether reseal is needed
+    - boot: add call to reseal an existing key
+    - boot: consider boot chains with unrevisioned kernels incomparable
+    - overlord: assorted typos and miscellaneous changes
+    - boot: group SealKeyModelParams by model, improve testing
+    - secboot: adjust parameters to buildPCRProtectionProfile
+    - strutil: add SortedListsUniqueMergefrom the doc comment:
+    - snap/naming: upgrade TODO to TODO:UC20
+    - secboot: add call to reseal an existing key
+    - boot: in seal.go adjust error message and function names
+    - o/snapstate: check available disk space in RemoveMany
+    - boot: build bootchains data for sealing
+    - tests: remove "set -e" from function only shell libs
+    - o/snapstate: disk space check on UpdateMany
+    - o/snapstate: disk space check with snap update
+    - snap: implement new `snap reboot` command
+    - boot: do not reorder boot assets when generating predictable boot
+      chains and other small tweaks
+    - tests: some fixes and improvements for nested execution
+    - tests/core/uc20-recovery: fix check for at least specific calls to
+      mock-shutdown
+    - boot: be consistent using bootloader.Role* consts instead of
+      strings
+    - boot: helper for generating secboot load chains from a given boot
+      asset sequence
+    - boot: tweak boot chains to support a list of kernel command lines,
+      keep track of model and kernel boot file
+    - boot,secboot: switch to expose and use snapcore/secboot load event
+      trees
+    - tests: use `nested_exec` in core{20,}-early-config test
+    - devicestate: enable cloud-init on uc20 for grade signed and
+      secured
+    - boot: add "rootdir" to baseBootenvSuite and use in tests
+    - tests/lib/cla_check.py: don't allow users.noreply.github.com
+      commits to pass CLA
+    - boot: represent boot chains, helpers for marshalling and
+      equivalence checks
+    - boot: mark successful with boot assets
+    - client, api: handle insufficient space error
+    - o/snapstate: disk space check with single snap install
+    - configcore: "service.console-conf.disable" is gadget defaults only
+    - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+      AppArmor profile path
+    - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+    - packaging/debian-sid: tweak code preparing _build tree
+    - many: move seal code from gadget/install to boot
+    - tests: remove workaround for cups on ubuntu-20.10
+    - client: implement RebootToSystem
+    - many: seed.Model panics now if called before LoadAssertions
+    - daemon: add /v2/systems "reboot" action API
+    - github: run tests also on push to release branches
+    - interfaces/bluez: let slot access audio streams
+    - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+      new seed.ReadSystemEssential
+    - interfaces: allow snap-update-ns to read /proc/cmdline
+    - tests: new organization for nested tests
+    - o/snapstate, features: add feature flags for disk space awareness
+    - tests: workaround for cups issue on 20.10 where default printer is
+      not configured.
+    - interfaces: update cups-control and add cups for providing snaps
+    - boot: keep track of the original asset when observing updates
+    - tests: simplify and fix tests for disk space checks on snap remove
+    - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+      cloud.conf
+    - tests/main: mv core specific tests to core suite
+    - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+    - devicestate: rename "mockLogger" to "logbuf"
+    - many: introduce ContentChange for tracking gadget content in
+      observers
+    - many: fix partion vs partition typo
+    - bootloader: retrieve boot chains from bootloader
+    - devicestate: add tests around logging in RequestSystemAction
+    - boot: handle canceled update
+    - bootloader: tweak doc comments (thanks Samuele)
+    - seed/seedwriter: test local asserted snaps with UC20 grade signed
+    - sysconfig/cloudinit.go: add DisableNoCloud to
+      CloudInitRestrictOptions
+    - many: use BootFile type in load sequences
+    - boot,bootloader: clarifications after the changes to introduce
+      bootloader.Options.Role
+    - boot,bootloader,gadget: apply new bootloader.Options.Role
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - testutil: add checkers for symbolic link target
+    - many: refactor tpm seal parameter setting
+    - boot/bootstate20: reboot to rollback to previous kernel
+    - boot: add unit test helpers
+    - boot: observe update & rollback of trusted assets
+    - interfaces/utf: Add MIRKey to u2f devices
+    - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+      cloud-init tests
+    - many: check that users of BaseTest don't forget to consume
+      cleanups
+    - tests/nested/core20/tpm: verify trusted boot assets tracking
+    - github: run macOS job with Go 1.14
+    - many: misc doc-comment changes and typo fixes
+    - o/snapstate: disk space check with InstallMany
+    - many: cloud-init cleanups from previous PR's
+    - tests: running tests on opensuse leap 15.2
+    - run-checks: check for dirty build tree too
+    - vendor: run ./get-deps.sh to update the secboot hash
+    - tests: update listing test for "-dirty" versions
+    - overlord/devicestate: do not release the state lock when updating
+      gadget assets
+    - secboot: read kernel efi image from snap file
+    - snap: add size to the random access file return interface
+    - daemon: correctly parse Content-Type HTTP header.
+    - tests: account for apt-get on core18
+    - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+      loop
+    - mkversion.sh: simple hack to include dirty in version if the tree
+      is dirty
+    - cgroup,snap: track hooks on system bus only
+    - interfaces/systemd: compare dereferenced Service
+    - run-checks: only check files in git for misspelling
+    - osutil: add a package doc comment (via doc.go)
+    - boot: complain about reused asset name during initial install
+    - snapstate: installSize helper that calculates total size of snaps
+      and their prerequisites
+    - snapshots: export of snapshots
+    - boot/initramfs_test.go: reset boot vars on the bootloader for each
+      iteration
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Sep 2020 17:19:13 +0200
+
+snapd (2.46.1-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - interfaces: allow snap-update-ns to read
+      /proc/cmdline
+    - github: run macOS job with Go 1.14
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - tests: account for apt-get on core18
+    - mkversion.sh: include dirty in version if the tree
+      is dirty
+    - interfaces/systemd: compare dereferenced Service
+    - vendor.json: update mysterious secboot SHA again
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Sep 2020 17:42:54 +0200
+
+snapd (2.46-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - logger: add support for setting snapd.debug=1 on kernel cmdline
+    - o/snapstate: check disk space before creating automatic snapshot
+      on remove
+    - boot, o/devicestate: observe existing recovery bootloader trusted
+      boot assets
+    - many: use transient scope for tracking apps and hooks
+    - features: add HiddenSnapFolder feature flag
+    - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+      too
+    - runinhibit: open the lock file in read-only mode in IsLocked
+    - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+      automatic
+    - tests: update spread test for unknown plug/slot with snapctl is-
+      connected
+    - osutil: add OpenExistingLockForReading
+    - kernel: add kernel.Validate()
+    - interfaces: add vcio interface
+    - interfaces/{docker,kubernetes}-support: load overlay and support
+      systemd cgroup driver
+    - tests/lib/nested.sh: use more robust code for finding what loop
+      dev we mounted
+    - cmd/snap-update-ns: detach all bind-mounted file
+    - snap/snapenv: set SNAP_REAL_HOME
+    - packaging: umount /snap on purge in containers
+    - interfaces: misc policy updates xlvi
+    - secboot,cmd/snap-bootstrap: cross-check partitions before
+      unlocking, mounting
+    - boot: copy boot assets cache to new root
+    - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+    - o/hookstate/ctlcmd: make is-connected check whether the plug or
+      slot exists
+    - tests: find -ignore_readdir_race when scanning cgroups
+    - interfaces/many: deny arbitrary desktop files and misc from
+      /usr/share
+    - tests: use "set -ex" in prep-snapd-in-lxd.sh
+    - tests: re-enable udisks test on debian-sid
+    - cmd/snapd-generator: use PATH fallback if PATH is not set
+    - tests: disable udisks2 test on arch linux
+    - github: use latest/stable go, not latest/edge
+    - tests: remove support for ubuntu 19.10 from spread tests
+    - tests: fix lxd test wrongly tracking 'latest'
+    - secboot: document exported functions
+    - cmd: compile snap gdbserver shim correctly
+    - many: correctly calculate the desktop file prefix everywhere
+    - interfaces: add kernel-crypto-api interface
+    - corecfg: add "system.timezone" setting to the system settings
+    - cmd/snapd-generator: generate drop-in to use fuse in container
+    - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+      from previous PR
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+    - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+      the-tool
+    - tests: work around broken update of systemd-networkd
+    - tests/main/install-fontconfig-cache-gen: enhance test by
+      verifying, add fonts to test
+    - o/devicestate: wrap asset update observer error
+    - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+    - mkversion.sh: disallow changelog versions that have git in it, if
+      we also have git version
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - snap: fix repeated "cannot list recovery system" and add test
+    - boot: track trusted assets during initial install, assets cache
+    - vendor: update secboot to fix key data validation
+    - tests: unmount FUSE file-systems from XDG runtime dir
+    - overlord/devicestate: workaround non-nil interface with nil struct
+    - sandbox/cgroup: remove temporary workaround for multiple cgroup
+      writers
+    - sandbox/cgroup: detect dangling v2 cgroup
+    - bootloader: add helper for creating a bootloader based on gadget
+    - tests: support different images on nested execution
+    - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+    - packaging/arch: use external linker when building statically
+    - tests: cope with ghost cgroupv2
+    - tests: fix issues related to restarting systemd-logind.service
+    - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+      gadget updates
+    - vendor: update github.com/kr/pretty to fix diffs of values with
+      pointer cycles
+    - boot: move bootloaderKernelState20 impls to separate file
+    - .github/workflows: move snap building to test.yaml as separate
+      cached job
+    - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+      meeting minimal requirements
+    - osutil: add CommitAs to atomic file
+    - gadget: introduce content update observer
+    - bootloader: introduce TrustedAssetsBootloader, implement for grub
+    - o/snapshotstate: helpers for calculating disk space needed for an
+      automatic snapshot
+    - gadget/install: retrieve command lines from bootloader
+    - boot/bootstate20: unify commit method impls, rm
+      bootState20MarkSuccessful
+    - tests: add system information and image information when debug
+      info is displayed
+    - tests/main/cgroup-tracking: try to collect some information about
+      cgroups
+    - boot: introduce current_boot_assets and
+      current_recovery_boot_assets to modeenv
+    - tests: fix for timing issues on journal-state test
+    - many: remove usage and creation of hijacked pid cgroup
+    - tests: port regression-home-snap-root-owned to tests.session
+    - tests: run as hightest via tests.session
+    - github: run CLA checks on self-hosted workers
+    - github: remove Ubuntu 19.10 from actions workflow
+    - tests: remove End-Of-Life opensuse/fedora releases
+    - tests: remove End-Of-Life releases from spread.yaml
+    - tests: fix debug section of appstream-id test
+    - interfaces: check !b.preseed earlier
+    - tests: work around bug in systemd/debian
+    - boot: add deepEqual, Copy helpers for Modeenv to simplify
+      bootstate20 refactor
+    - cmd: add new "snap recovery" command
+    - interfaces/systemd: use emulation mode when preseeding
+    - interfaces/kmod: don't load kernel modules in kmod backend when
+      preseeding
+    - interfaces/udev: do not reload udevadm rules when preseeding
+    - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+    - boot: fancy marshaller for modeenv values
+    - gadget, osutil: use atomic file copy, adjust tests
+    - overlord: use new tracking cgroup for refresh app awareness
+    - github: do not skip gofmt with Go 1.9/1.10
+    - many: introduce content write observer, install mode glue, initial
+      seal stubs
+    - daemon,many: switch to use client.ErrorKind and drop the local
+      errorKind...
+    - tests: new parameters for nested execution
+    - client: move all error kinds into errors.go and add doc strings
+    - cmd/snap: display the error in snap debug seeding if seeding is in
+      error
+    - cmd/snap/debug/seeding: use unicode for proper yaml
+    - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+      recovery_mode
+    - osutil/disks: add mock disk and tests for happy path of mock disks
+    - tests: refresh/revert snapd in uc20
+    - osutil/disks: use a dedicated error to indicate a fs label wasn't
+      found
+    - interfaces/system-key: in WriteSystemKey during tests, don't call
+      ParserFeatures
+    - boot: add current recovery systems to modeenv
+    - bootloader: extend managed assets bootloader interface to compose
+      a candidate command line
+    - interfaces: make the unmarshal test match more the comment
+    - daemon/api: use pointers to time.Time for debug seeding aspect
+    - o/ifacestate: update security profiles in connect undo handler
+    - interfaces: add uinput interface
+    - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+      tests
+    - o/devicestate: save seeding/preseeding times for use with debug
+      seeding api
+    - cmd/snap/debug: add "snap debug seeding" command for preseeding
+      debugging
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+    - bootloader: compose command line with mode and extra arguments
+    - cmd/snap, daemon: detect and bail purge on multi-snap
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - interfaces/builtin/multipass: replace U+00A0 no-break space with
+      simple space
+    - bootloader/assets: generate bootloader assets from files
+    - many/tests/preseed: reset the preseeded images before preseeding
+      them
+    - tests: drop accidental accents from e
+    - secboot: improve key sealing tests
+    - tests: replace _wait_for_file_change with retry
+    - tests: new fs-state which replaces the files.sh helper
+    - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+      from path
+    - cmd/snap: track started apps and hooks
+    - tests/main/interfaces-pulseaudio: disable start limit checking for
+      pulseaudio service
+    - api: seeding debug api
+    - .github/workflows/snap-build.yaml: build the snapd snap via GH
+      Actions too
+    - tests: moving journalctl.sh to a new journal-state tool
+    - tests/nested/manual: add spread tests for cloud-init vuln
+    - bootloader/assets: helpers for registering per-edition snippets,
+      register snippets for grub
+    - data,packaging,wrappers: extend D-Bus service activation search
+      path
+    - spread: add opensuse 15.2 and tumbleweed for qemu
+    - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+    - sysconfig/cloudinit: add RestrictCloudInit
+    - cmd/snap-preseed: check that target path exists and is a directory
+      on --reset
+    - tests: check for pids correctly
+    - gadget,gadget/install: refactor partition table update
+    - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+      type
+    - interface/fwupd: add more policies for making fwupd upstream
+      strict
+    - tests: new to-one-line tool which replaces the strings.sh helper
+    - interfaces: new helpers to get and compare system key, for use
+      with seeding debug api
+    - osutil, many: add helper for checking whether the process is a go
+      test binary
+    - cmd/snap-seccomp/syscalls: add faccessat2
+    - tests: adjust xdg-open after launcher changes
+    - tests: new core config helper
+    - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+      open
+    - cmd/snap-preseed: handle relative chroot path
+    - snapshotstate: move sizer to osutil.Sizer()
+    - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+      kernel tests
+    - gadget/install,secboot: use snapcore/secboot luks2 api
+    - boot/initramfs_test.go: add Commentf to more Assert()'s
+    - tests/lib: account for changes in arch package file name extension
+    - bootloader/bootloadertest: fix comment typo
+    - bootloader: add helper for getting recovery system environment
+      variables
+    - tests: preinstall shellcheck and run tests on focal
+    - strutil: add a helper for parsing kernel command line
+    - osutil: add CheckFreeSpace helper
+    - secboot: update tpm connection error handling
+    - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+    - tests: add tests.cleanup helper
+    - packaging: add "ca-certificates" to build-depends
+    - tests: more checks in core20 early config spread test
+    - tests: fix some snapstate tests to use pointers for
+      snapmgrTestSuite
+    - boot: better naming of helpers for obtaining kernel command line
+    - many: use more specific check for unit test mocking
+    - systemd/escape: fix issues with "" and "\t" handling
+    - asserts: small improvements and corrections for sequence-forming
+      assertions' support
+    - boot, bootloader: query kernel command line of run mod and
+      recovery mode systems
+    - snap/validate.go: disallow snap layouts with new top-level
+      directories
+    - tests: allow to add a new label to run nested tests as part of PR
+      validation
+    - tests/core/gadget-update-pc: port to UC20
+    - tests: improve nested tests flexibility
+    - asserts: integer headers: disallow prefix zeros and make parsing
+      more uniform
+    - asserts: implement Database.FindSequence
+    - asserts: introduce SequenceMemberAfter in the asserts backstores
+    - spread.yaml: remove tests/lib/tools from PATH
+    - overlord: refuse to install snaps whose activatable D-Bus services
+      conflict with installed snaps
+    - tests: shorten lxd-state undo-mount-changes
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - tests: fix argument handling of apt-state
+    - tests: rename lxd-tool to lxd-state
+    - tests: rename user-tool to user-state, fix --help
+    - interfaces: add gconf interface
+    - sandbox/cgroup: avoid parsing security tags twice
+    - tests: rename version-tool to version-compare
+    - cmd/snap-update-ns: handle anomalies better
+    - tests: fix call to apt.Package.mark_install(auto_inst=True)
+    - tests: rename mountinfo-tool to mountinfo.query
+    - tests: rename memory-tool to memory-observe-do
+    - tests: rename invariant-tool to tests.invariant
+    - tests: rename apt-tool to apt-state
+    - many: managed boot config during run mode setup
+    - asserts: introduce the concept of sequence-forming assertion types
+    - tests: tweak comments/output in uc20-recovery test
+    - tests/lib/pkgdb: do not use quiet when purging debs
+    - interfaces/apparmor: allow snap-specific /run/lock
+    - interfaces: add system-source-code for access to /usr/src
+    - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+    - gadget/install: move udev trigger to gadget/install
+    - many: make nested spread tests more reliable
+    - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+      w/ external backend
+    - tests: enable tests on uc20 which now work with the real model
+      assertion
+    - tests: enable system-snap-refresh test on uc20
+    - gadget, bootloader: preserve managed boot assets during gadget
+      updates
+    - tests: fix leaked dbus-daemon in selinux-clean
+    - tests: add servicestate.Control tests
+    - tests: fix "restart.service"
+    - wrappers: helper for enabling services - extract and move enabling
+      of services into a helper
+    - tests: new test to validate refresh and revert of kernel and
+      gadget on uc20
+    - tests/lib/prepare-restore: collect debug info when prepare purge
+      fails
+    - bootloader: allow managed bootloader to update its boot config
+    - tests: Remove unity test from nightly test suite
+    - o/devicestate: set mark-seeded to done in the task itself
+    - tests: add spread test for disconnect undo caused by failing
+      disconnect hook
+    - sandbox/cgroup: allow discovering PIDs of given snap
+    - osutil/disks: support IsDecryptedDevice for mountpoints which are
+      dm devices
+    - osutil: detect autofs mounted in /home
+    - spread.yaml: allow amazon-linux-2-64 qemu with
+      ec2-user/ec2-user
+    - usersession: support additional zoom URL schemes
+    - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+    - sandbox/cgroup: add tracking helpers
+    - tests: detect stray dbus-daemon
+    - overlord: refuse to install snaps providing user daemons on Ubuntu
+      14.04
+    - many: move encryption and installer from snap-boostrap to gadget
+    - o/ifacestate: fix connect undo handler
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - bootloader: introduce managed bootloader, implement for grub
+    - tests: fix incorrect check in smoke/remove test
+    - asserts,seed: split handling of essential/not essential model
+      snaps
+    - gadget: fix typo in mounted filesystem updater
+    - gadget: do only one mount point lookup in mounted fs updater
+    - tests/core/snap-auto-mount: try to make the test more robust
+    - tests: adding ubuntu-20.04 to google-sru backend
+    - o/servicestate: add updateSnapstateServices helper
+    - bootloader: pull recovery grub config from internal assets
+    - tests/lib/tools: apply linger workaround when needed
+    - overlord/snapstate: graceful handling of denied "managed" refresh
+      schedule
+    - snapstate: fix autorefresh from classic->strict
+    - overlord/configstate: add system.kernel.printk.console-loglevel
+      option
+    - tests: fix assertion disk handling for nested UC systems
+    - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+    - tests: extra worker for google-nested backend to avoid timeout
+      error on uc20
+    - snapdtool: helper to check whether the current binary is reexeced
+      from a snap
+    - tests: mock servicestate in api tests to avoid systemctl checks
+    - many: rename back snap.Info.GetType to Type
+    - tests/lib/cla_check: expect explicit commit range
+    - osutil/disks: refactor diskFromMountPointImpl a bit
+    - o/snapstate: service-control task handler
+    - osutil: add disks pkg for associating mountpoints with
+      disks/partitions
+    - gadget,cmd/snap-bootstrap: move partitioning to gadget
+    - seed: fix LoadEssentialMeta when gadget is not loaded
+    - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+      secure_path
+    - asserts: introduce new assertion validation-set
+    - asserts,daemon: add support for "serials" field in system-user
+      assertion
+    - data/sudo: drop a failed sudo secure_path workaround
+    - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+    - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+    - spread.yaml: update secure boot attribute name
+    - interfaces/block_devices: add NVMe subsystem devices, support
+      multipath paths
+    - tests: use the "jq" snap from the edge channel
+    - tests: simplify the tpm test by removing the test-snapd-mokutil
+      snap
+    - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+      status too
+    - tests/main/sudo-env: check snap path under sudo
+    - tests/main/lxd: add test for snaps inside nested lxd containers
+      not working
+    - asserts/internal: expand errors about invalid serialized grouping
+      labels
+    - usersession/userd: add msteams url support
+    - tests/lib/prepare.sh: adjust comment about sgdisk
+    - tests: fix how gadget pc is detected when the snap does not exist
+      and ls fails
+    - tests: move a few more tests to snapstate_update_test.go
+    - tests/main: add spread test for running svc from install hook
+    - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+    - tests/special-home-can-run-classic-snaps: re-enable
+    - workflow: test PR title as part of the static checks again
+    - tests/main/xdg-open-compat: backup and restore original xdg-open
+    - tests: move update-related tests to snapstate_update_test.go
+    - cmd,many: move Version and bits related to snapd tools to
+      snapdtool, merge cmdutil
+    - tests/prepare-restore.sh: reset-failed systemd-journald before
+      restarting
+    - interfaces: misc small interface updates
+    - spread: use find rather than recursive ls, skip mounted snaps
+    - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+      /var/lib/snapd
+    - tests: enable snap-auto-mount test on core20
+    - cmd/snap: do not show $PATH warning when executing under sudo on a
+      known distro
+    - asserts/internal: add some iteration benchmarks
+    - sandbox/cgroup: improve pid parsing code
+    - snap: add new `snap run --experimental-gdbserver` option
+    - asserts/internal: limit Grouping size switching to a bitset
+      representationWe don't always use the bit-set representation
+      because:
+    - snap: add an activates-on property to apps for D-Bus activation
+    - dirs: delete unused Cloud var, fix typo
+    - sysconfig/cloudinit: make callers of DisableCloudInit use
+      WritableDefaultsDir
+    - tests: fix classic ubuntu core transition auth
+    - tests: fail in setup_reflash_magic() if there is snapd state left
+    - tests: port interfaces-many-core-provided to tests.session
+    - tests: wait after creating partitions with sfdisk
+    - bootloader: introduce bootloarder assets, import grub.cfg with an
+      edition marker
+    - riscv64: bump timeouts
+    - gadget: drop dead code, hide exports that are not used externally
+    - tests: port 2 uc20 part1
+    - tests: fix bug waiting for snap command to be ready
+    - tests: move try-related tests to snapstate_try_test.go
+    - tests: add debug for 20.04 prepare failure
+    - travis.yml: removed, all our checks run in GH actions now
+    - tests: clean up up the use of configcoreSuite in the configcore
+      tests
+    - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+    - sandbox/cgroup: add tests for ParsePids
+    - tests: fix the basic20 test for uc20 on external backend
+    - tests: use configcoreSuite in journalSuite and remove some
+      duplicated code
+    - tests: move a few more tests to snapstate_install_test
+    - tests: assorted small patches
+    - dbusutil/dbustest: separate license from package
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+    - tests: check that host settings like hostname are settable on core
+    - tests: port xdg-settings test to tests.session
+    - tests: port snap-handle-link test to tests.session
+    - arch: add riscv64
+    - tests: core20 early defaults spread test
+    - tests: move install tests from snapstate_test.go to
+      snapstate_install_test.go
+    - github: port macOS sanity checks from travis
+    - data/selinux: allow checking /var/cache/app-info
+    - o/devicestate: core20 early config from gadget defaults
+    - tests: autoremove after removing lxd in preseed-lxd test
+    - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+    - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+    - tests: update the file used to detect the boot path on uc20
+    - spread.yaml: show /var/lib/snapd in debug
+    - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+      netplan files
+    - snap/naming: add helpers to parse app and hook security tags
+    - tests: modernize retry tool
+    - tests: fix and trim debug section in xdg-open-portal
+    - tests: modernize and use snapd.tool
+    - vendor: update to latest github.com/snapcore/bolt for riscv64
+    - cmd/snap-confine: add support for libc6-lse
+    - interfaces: miscellaneous policy updates xlv
+    - interfaces/system-packages-doc: fix typo in variable names
+    - tests: port interfaces-calendar-service to tests.session
+    - tests: install/run the lzo test snap too
+    - snap: (small) refactor of `snap download` code for
+      testing/extending
+    - data: fix shellcheck warnings in snapd.sh.in
+    - packaging: disable buildmode=pie for riscv64
+    - tests: install test-snapd-rsync snap from edge channel
+    - tests: modernize tests.session and port everything using it
+    - tests: add ubuntu 20.10 to spread tests
+    - cmd/snap/remove: mention snap restore/automatic snapshots
+    - dbusutil: move all D-Bus helpers and D-Bus test helpers
+    - wrappers: pass 'disable' flag to StopServices wrapper
+    - osutil: enable riscv64 build
+    - snap/naming: add ParseSecurityTag and friends
+    - tests: port document-portal-activation to session-tool
+    - bootloader: rename test helpers to reflect we are mocking EFI boot
+      locations
+    - tests: disable test of nfs v3 with udp proto on debian-sid
+    - tests: plan to improve the naming and uniformity of utilities
+    - tests: move *-tool tests to their own suite
+    - snap-bootstrap: remove sealed key file on reinstall
+    - bootloader/ubootenv: don't panic with an empty uboot env
+    - systemd: rename actualFsTypeAndMountOptions to
+      hostFsTypeAndMountOptions
+    - daemon: fix filtering of service-control changes for snap.app
+    - tests: spread test for preseeding in lxd container
+    - tests: fix broken snapd.session agent.socket
+    - wrappers: add RestartServices function and ReloadOrRestart to
+      systemd
+    - o/cmdstate: handle ignore flag on exec-command tasks
+    - gadget: make ext4 filesystems with or without metadata checksum
+    - tests: update statx test to run on all LTS releases
+    - configcore: show better error when disabling services
+    - interfaces: add hugepages-control
+    - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+    - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+    - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+    - tests: reload systemd --user for root, if present
+    - tests: reload systemd after editing /etc/fstab
+    - tests: add missing dependencies needed for sbuild test on debian
+    - tests: reload systemd after removing pulseaudio
+    - image, tests: core18 early config.
+    - interfaces: add system-packages-doc interface
+    - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+      preseeding
+    - interfaces/fwupd: allow bind mount to /boot on core
+    - tests: improve oom-vitality tests
+    - tests: add fedora 32 to spread.yaml
+    - config: apply vitality-hint immediately when the config changes
+    - tests: port snap-routine-portal-info to session-tool
+    - configcore: add "service.console-conf.disable" config option
+    - tests: port xdg-open to session-tool
+    - tests: port xdg-open-compat to session-tool
+    - tests: port interfaces-desktop-* to session-tool
+    - spread.yaml: apply yaml formatter/linter
+    - tests: port interfaces-wayland to session-tool
+    - o/devicestate: refactor current system handling
+    - snap-mgmt: perform cleanup of user services
+    - snap/snapfile,squashfs: followups from 8729
+    - boot, many: require mode in modeenv
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests: log stderr from dbus-monitor
+    - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+      tag
+    - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+      layout
+    - interfaces/builtin/desktop: do not mount fonts cache on distros
+      with quirks
+    - data/selinux: allow snapd to remove/create the its socket
+    - testutil/exec.go: set PATH after running shellcheck
+    - tests: silence stderr from dbus-monitor
+    - snap,many: mv Open to snapfile pkg to support add'l options to
+      Container methods
+    - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+      gadget
+    - github: remove workaround for bug 133 in actions/cache
+    - tests: remove dbus.sh
+    - cmd/snap-preseed: improve mountpoint checks of the preseeded
+      chroot
+    - spread.yaml: add ps aux to debug section
+    - github: run all spread systems in a single go with cached results
+    - test: session-tool cli tweaks
+    - asserts: rest of the Pool API
+    - tests: port interfaces-network-status-classic to session-tool
+    - packaging: remove obsolete 16.10,17.04 symlinks
+    - tests: setup portals before starting user session
+    - o/devicestate: typo fix
+    - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+      devices
+    - cmd/snap/model: support store, system-user-authority keys in
+      --verbose
+    - o/devicestate: raise conflict when requesting system action while
+      seeding
+    - tests: detect signs of crashed snap-confine
+    - tests: sign kernel and gadget to run nested tests using current
+      snapd code
+    - tests: remove gnome-online-accounts we install
+    - tests: fix the issue where all the tests were executed on secboot
+      system
+    - tests: port interfaces-accounts-service to session-tool
+    - interfaces/network-control: bring /var/lib/dhcp from host
+    - image,cmd/snap,tests: add support for store-wide cohort keys
+    - configcore: add nomanagers buildtag for conditional build
+    - tests: port interfaces-password-manager-service to session-tool
+    - o/devicestate: cleanup system actions supported by recover mode
+    - snap-bootstrap: remove create-partitions and update tests
+    - tests: fix nested tests
+    - packaging/arch: update PKGBUILD to match one in AUR
+    - tests: port interfaces-location-control to session-tool
+    - tests: port interfaces-contacts-service to session-tool
+    - state: log task errors in the journal too
+    - o/devicestate: change how current system is reported for different
+      modes
+    - devicestate: do not report "ErrNoState" for seeded up
+    - tests: add a note about broken test sequence
+    - tests: port interfaces-autopilot-introspection to session-tool
+    - tests: port interfaces-dbus to session-tool
+    - packaging: update sid packaging to match 16.04+
+    - tests: enable degraded test on uc20
+    - c/snaplock/runinhibit: add run inhibition operations
+    - tests: detect and report root-owned files in /home
+    - tests: reload root's systemd --user after snapd tests
+    - tests: test registration with serial-authority: [generic]
+    - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+      key in recover
+    - tests/mount-ns: stop binfmt_misc mount unit
+    - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+      uuid if available
+    - daemon, tests: indicate system mode, test switching to recovery
+      and back to run
+    - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+      denials
+    - tests/mount-ns: update to reflect new UEFI boot mode
+    - usersession,tests: clean ups for userd/settings.go and move
+      xdgopenproxy under usersession
+    - tests: disable mount-ns test
+    - tests: test user belongs to systemd-journald, on core20
+    - tests: run core/snap-set-core-config on uc20 too
+    - tests: remove generated session-agent units
+    - sysconfig: use new _writable_defaults dir to create cloud config
+    - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+      future work
+    - asserts: make clearer that with label we mean a serialized label
+    - cmd/snap-bootstrap: tweak recovery trigger log messages
+    - asserts: introduce PoolTo 
+    - userd: allow setting default-url-scheme-handler
+    - secboot: append uuid to ubuntu-data when decrypting
+    - o/configcore: pass extra options to FileSystemOnlyApply
+    - tests: add dbus-user-session to bionic and reorder package names
+    - boot, bootloader: adjust comments, expand tests
+    - tests: improve debugging of user session agent tests
+    - packaging: add the inhibit directory
+    - many: add core.resiliance.vitality-hint config setting
+    - tests: test adjustments and fixes for recently published images
+    - cmd/snap: coldplug auto-import assertions from all removable
+      devices
+    - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+      secboot
+    - tests: not fail when boot dir cannot be determined
+    - tests: new directory used to store the cloud images on gce
+    - tests: inject snapd from edge into seeds of the image in manual
+      preseed test
+    - usersession/agent,wrappers: fix races between Shutdown and Serve
+    - tests: add dependency needed for next upgrade of bionic
+    - tests: new test user is used for external backend
+    - cmd/snap: fix the order of positional parameters in help output
+    - tests: don't create root-owned things in ~test
+    - tests/lib/prepare.sh: delete patching of the initrd
+    - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+      as well
+    - progress: tweak multibyte label unit test data
+    - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+    - gadget: fix fallback device lookup for 'mbr' type structures
+    - configcore: only reload journald if systemd is new enough
+    - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+    - wrappers: allow user mode systemd daemons
+    - progress: fix progress bar with multibyte duration units
+    - tests: fix raciness in pulseaudio test
+    - asserts/internal: introduce Grouping and Groupings
+    - tests: remove user.sh
+    - tests: pair of follow-ups from earlier reviews
+    - overlord/snapstate: warn of refresh/postpone events
+    - configcore,tests: use daemon-reexec to apply watchdog config
+    - c/snap-bootstrap: check mount states via initramfsMountStates
+    - store: implement DownloadAssertions
+    - tests: run smoke test with different bases
+    - tests: port user-mounts test to session-tool
+    - store: handle error-list in fetch-assertions results
+    - tests: port interfaces-audio-playback-record to session-tool
+    - data/completion: add `snap` command completion for zsh
+    - tests/degraded: ignore failure in systemd-vconsole-setup.service
+    - image: stub implementation of image.Prepare for darwin
+    - tests: session-tool --restore -u stops user-$UID.slice
+    - o/ifacestate/handlers.go: fix typo
+    - tests: port pulseaudio test to session-tool
+    - tests: port user-session-env to session-tool
+    - tests: work around journald bug in core16
+    - tests: add debug to core-persistent-journal test
+    - tests: port selinux-clean to session-tool
+    - tests: port portals test to session-tool, fix portal tests on sid
+    - tests: adding option --no-install-recommends option also when
+      install all the deps
+    - tests: add session-tool --has-systemd-and-dbus
+    - packaging/debian-sid: add gcc-multilib to build deps
+    - osutil: expand FileLock to support shared locks and more
+    - packaging: stop depending on python-docutils
+    - store,asserts,many: support the new action fetch-assertions
+    - tests: port snap-session-agent-* to session-tool
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - tests: fix for preseeding failures
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 25 Aug 2020 17:26:21 +0200
+
+snapd (2.45.3.1-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+
+ -- Samuele Pedroni <pedronis@lucediurna.net>  Tue, 28 Jul 2020 21:43:38 +0200
+
+snapd (2.45.3-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - many: backport _writable_defaults dir changes
+    - tests: fix incorrect check in smoke/remove test
+    - cmd/snap-bootstrap,seed: backport of uc20 PRs
+    - tests: avoid exit when nested type var is not defined
+    - cmd/snap-preseed: backport fixes
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - many: cherry-picks for 2.45, gh-action, test fixes
+    - tests/lib: account for changes in arch package file name extension
+    - postrm, snap-mgmt: cleanup modules and other cherry-picks
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests/main/interfaces-time-control: exercise setting time via date
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+
+ -- Zygmunt Krynicki <me@zygoon.pl>  Mon, 27 Jul 2020 12:01:14 +0200
+
+snapd (2.45.2-1) unstable; urgency=high
+
+  * SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+    implementation
+    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+      variable modification when calling the system xdg-open. Patch
+      thanks to James Henstridge
+    - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+      restarted. Patch thanks to Michael Vogt
+    - CVE-2020-11934
+  * SECURITY UPDATE: arbitrary code execution vulnerability on core
+    devices with access to physical removable media
+    - devicestate: Disable/restrict cloud-init after seeding.
+    - CVE-2020-11933
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 10 Jul 2020 20:06:29 +0200
+
 snapd (2.45.1-1) unstable; urgency=medium
 
   * New upstream release, LP: #1875071
     - data/selinux: allow checking /var/cache/app-info
     - cmd/snap-confine: add support for libc6-lse
-    - interfaces: miscellanious policy updates xlv
+    - interfaces: miscellaneous policy updates xlv
     - snap-bootstrap: remove sealed key file on reinstall
     - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
     - gadget: make ext4 filesystems with or without metadata checksum
@@ -408,6 +1702,35 @@
 
  -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 May 2020 17:17:57 +0200
 
+snapd (2.44.5-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - spread.yaml: adding more workers for ubuntu 20.04
+    - packaging: stop depending on python-docutils on opensuse
+    - spread.yaml: do not run ubuntu-core-20-64 with snapd 2.44, snapd
+      is not recent enough to drive ubuntu-core-20
+    - spread.yaml: Preserve size for centos images on spread.yaml
+    - spread.yaml: use non-uefi enabled image for uc20
+    - tests: ensure $cache_dir is actually available
+    - tests: disable preseed tests, they work in master but require too
+      much cherry-picking here
+    - travis.yml: remove go/master unit tests from 2.44
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 30 Apr 2020 09:09:22 +0200
+
+snapd (2.44.4-1) unstable; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - interfaces/firewall-control: allow -legacy and -nft for core20
+    - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
+      syscalls
+    - tests: 16.04 and 18.04 now have mediating pulseaudio
+    - tests: ignore user@12345.service hierarchy
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Apr 2020 08:32:56 +0200
+
 snapd (2.44.3-1) unstable; urgency=medium
 
   * New upstream release, LP: #1864808
diff -Nru snapd-2.45.1+20.04.2/packaging/debian-sid/control snapd-2.48.3+20.04/packaging/debian-sid/control
--- snapd-2.45.1+20.04.2/packaging/debian-sid/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/debian-sid/control	2021-02-02 08:21:12.000000000 +0000
@@ -9,12 +9,14 @@
                automake,
                autotools-dev,
                bash-completion,
+               ca-certificates,
                dbus,
                debhelper (>= 9.20160709),
                dh-apparmor,
                dh-autoreconf,
                dh-golang (>=1.7),
                fakeroot,
+               gcc-multilib [amd64],
                gettext,
                grub-common,
                gnupg2,
@@ -47,6 +49,7 @@
                libcap-dev,
                libapparmor-dev,
                libglib2.0-dev,
+               liblzo2-dev,
                libseccomp-dev,
                libudev-dev,
                openssh-client,
diff -Nru snapd-2.45.1+20.04.2/packaging/debian-sid/rules snapd-2.48.3+20.04/packaging/debian-sid/rules
--- snapd-2.45.1+20.04.2/packaging/debian-sid/rules	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/debian-sid/rules	2021-02-02 08:21:12.000000000 +0000
@@ -60,9 +60,13 @@
 endif
 
 # check if we need to include the testkeys in the binary
+# TAGS are the go build tags for all binaries, SNAP_TAGS are for snap
+# build only.
 TAGS=nosecboot
+SNAP_TAGS=nosecboot nomanagers
 ifneq (,$(filter testkeys,$(DEB_BUILD_OPTIONS)))
 	TAGS+= withtestkeys
+	SNAP_TAGS+= withtestkeys
 endif
 
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
@@ -139,13 +143,18 @@
 	# Build golang bits
 	mkdir -p _build/src/$(DH_GOPKG)/cmd/snap/test-data
 	cp -a cmd/snap/test-data/*.gpg _build/src/$(DH_GOPKG)/cmd/snap/test-data/
+	cp -a bootloader/assets/data _build/src/$(DH_GOPKG)/bootloader/assets
+
 	# exclude certain parts that won't be used by debian
-	find _build/src/$(DH_GOPKG)/cmd/snap-bootstrap -name "*.go" | grep -vE '(bootstrap_dummy\.go|options\.go)'| xargs rm -f
+	find _build/src/$(DH_GOPKG)/cmd/snap-bootstrap -name "*.go" | xargs rm -f
+	find _build/src/$(DH_GOPKG)/gadget/install -name "*.go" | grep -vE '(params\.go|install_dummy\.go)'| xargs rm -f
 	# XXX: once dh-golang understands go build tags this would not be needed
-	find _build/src/$(DH_GOPKG)/secboot/ -name "*.go" | grep -Ev '(secboot_dummy\.go|secboot\.go)' | xargs rm -f
+	find _build/src/$(DH_GOPKG)/secboot/ -name "*.go" | grep -Ev '(encrypt\.go|secboot_dummy\.go|secboot\.go|encrypt_dummy\.go)' | xargs rm -f
 	# and build
 	dh_auto_build -- $(BUILDFLAGS) -tags "$(TAGS)" $(GCCGOFLAGS)
 
+	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build $(BUILDFLAGS) $(GCCGOFLAGS) -tags "$(SNAP_TAGS)" $(DH_GOPKG)/cmd/snap)
+
 	# (static linking on powerpc with cgo is broken)
 ifneq ($(shell dpkg-architecture -qDEB_HOST_ARCH),powerpc)
 	# Generate static snap-exec, snapctl and snap-update-ns - it somehow includes CGO so
@@ -213,6 +222,9 @@
 	rm -f ${CURDIR}/debian/tmp/usr/bin/snappy
 	# chrorder generator
 	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
+	# docs generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/docs
+
 	dh_install
 
 override_dh_install-arch:
@@ -229,6 +241,10 @@
 	fi
 	# chrorder generator
 	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
+	# bootloader assets generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/genasset
+	# docs generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/docs
 
 	# Install snapd's systemd units / upstart jobs, done
 	# here instead of debian/snapd.install because the
diff -Nru snapd-2.45.1+20.04.2/packaging/debian-sid/snapd.dirs snapd-2.48.3+20.04/packaging/debian-sid/snapd.dirs
--- snapd-2.45.1+20.04.2/packaging/debian-sid/snapd.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/debian-sid/snapd.dirs	2021-02-02 08:21:12.000000000 +0000
@@ -6,6 +6,7 @@
 var/lib/snapd/desktop
 var/lib/snapd/environment
 var/lib/snapd/firstboot
+var/lib/snapd/inhibit
 var/lib/snapd/lib/gl
 var/lib/snapd/lib/gl32
 var/lib/snapd/lib/vulkan
diff -Nru snapd-2.45.1+20.04.2/packaging/debian-sid/snapd.install snapd-2.48.3+20.04/packaging/debian-sid/snapd.install
--- snapd-2.45.1+20.04.2/packaging/debian-sid/snapd.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/debian-sid/snapd.install	2021-02-02 08:21:12.000000000 +0000
@@ -32,6 +32,7 @@
 
 # gdb helper
 usr/lib/snapd/snap-gdb-shim
+usr/lib/snapd/snap-gdbserver-shim
 
 # use "usr/lib" here because apparently systemd looks only there
 usr/lib/systemd/system-environment-generators
diff -Nru snapd-2.45.1+20.04.2/packaging/debian-sid/snapd.postrm snapd-2.48.3+20.04/packaging/debian-sid/snapd.postrm
--- snapd-2.45.1+20.04.2/packaging/debian-sid/snapd.postrm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/debian-sid/snapd.postrm	2021-02-02 08:21:12.000000000 +0000
@@ -76,11 +76,19 @@
             if [ -d /etc/dbus-1/system.d ]; then
                 find /etc/dbus-1/system.d -name "snap.${snap}.*.conf" -execdir rm -f "{}" \;
             fi
+            # modules
+            rm -f "/etc/modules-load.d/snap.${snap}.conf"
             # timer and socket units
             find /etc/systemd/system -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" | while read -r f; do
                 systemctl_stop "$(basename "$f")"
                 rm -f "$f"
             done
+            # user services, sockets, and timers - we make no attempt to stop any of them.
+            # TODO: ask snapd to ask each snapd.session-agent.service to stop snaps
+            # user-session services and stop itself.
+            find /etc/systemd/user -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" -o -name "snap.${snap}.*.service" | while read -r f; do
+                rm -f "$f"
+            done
         fi
 
         echo "Removing $unit"
@@ -88,6 +96,11 @@
         rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
     done
 
+    # snapd session-agent
+    rm -f /etc/systemd/user/snapd.session-agent.socket
+    rm -f /etc/systemd/user/snapd.session-agent.service
+    rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+
     # generated readme files
     rm -f "/snap/README"
 
@@ -109,14 +122,16 @@
                 rm -f "$mnt"
             done
         fi
-        if [ "$(find /run/snapd/ns/ -name "*.fstab" | wc -l)" -gt 0 ]; then
-            for fstab in /run/snapd/ns/*.fstab; do
-                rm -f "$fstab"
-            done
-        fi
+        find /run/snapd/ns/ \( -name '*.fstab' -o -name '*.user-fstab' -o -name '*.info' \) -delete
         umount -l /run/snapd/ns/ || true
     fi
 
+    # inside containers we have a generator that creates a bind mount to /snap
+    if [ -e /run/systemd/container ]; then
+        echo "Unmount /snap inside a container"
+        umount /snap || true
+    fi
+
     echo "Removing extra snap-confine apparmor rules"
     rm -f /etc/apparmor.d/snap.core.*.usr.lib.snapd.snap-confine
 
diff -Nru snapd-2.45.1+20.04.2/packaging/fedora/snapd.spec snapd-2.48.3+20.04/packaging/fedora/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/fedora/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/fedora/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/fedora-29/snapd.spec snapd-2.48.3+20.04/packaging/fedora-29/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/fedora-29/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/fedora-29/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/fedora-30/snapd.spec snapd-2.48.3+20.04/packaging/fedora-30/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/fedora-30/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/fedora-30/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/fedora-31/snapd.spec snapd-2.48.3+20.04/packaging/fedora-31/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/fedora-31/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/fedora-31/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/fedora-32/snapd.spec snapd-2.48.3+20.04/packaging/fedora-32/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/fedora-32/snapd.spec	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/fedora-32/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8340 @@
+# With Fedora, nothing is bundled. For everything else, bundling is used.
+# To use bundled stuff, use "--with vendorized" on rpmbuild
+%if 0%{?fedora}
+%bcond_with vendorized
+%else
+%bcond_without vendorized
+%endif
+
+# With Amazon Linux 2+, we're going to provide the /snap symlink by default,
+# since classic snaps currently require it... :(
+%if 0%{?amzn} >= 2
+%bcond_without snap_symlink
+%else
+%bcond_with snap_symlink
+%endif
+
+# A switch to allow building the package with support for testkeys which
+# are used for the spread test suite of snapd.
+%bcond_with testkeys
+
+%global with_devel 1
+%global with_debug 1
+%global with_check 0
+%global with_unit_test 0
+%global with_test_keys 0
+%global with_selinux 1
+
+# For the moment, we don't support all golang arches...
+%global with_goarches 0
+
+# Set if multilib is enabled for supported arches
+%ifarch x86_64 aarch64 %{power64} s390x
+%global with_multilib 1
+%endif
+
+%if ! %{with vendorized}
+%global with_bundled 0
+%else
+%global with_bundled 1
+%endif
+
+%if ! %{with testkeys}
+%global with_test_keys 0
+%else
+%global with_test_keys 1
+%endif
+
+%if 0%{?with_debug}
+%global _dwz_low_mem_die_limit 0
+%else
+%global debug_package   %{nil}
+%endif
+
+%global provider        github
+%global provider_tld    com
+%global project         snapcore
+%global repo            snapd
+# https://github.com/snapcore/snapd
+%global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo}
+%global import_path     %{provider_prefix}
+
+%global snappy_svcs     snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service
+%global snappy_user_svcs snapd.session-agent.socket
+
+# Until we have a way to add more extldflags to gobuild macro...
+%if 0%{?fedora} || 0%{?rhel} >= 8
+# buildmode PIE triggers external linker consumes -extldflags
+%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags -static'" -a -v -x %{?**};
+%endif
+%if 0%{?rhel} == 7
+# trigger external linker manually, otherwise -extldflags have no meaning
+%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**};
+%endif
+
+# These macros are missing BUILDTAGS in RHEL 8
+%if 0%{?rhel} == 8
+%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**};
+%endif
+
+# These macros are not defined in RHEL 7
+%if 0%{?rhel} == 7
+%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**};
+%define gotest() go test -compiler gc -ldflags "${LDFLAGS:-}" %{?**};
+%endif
+
+# Compat path macros
+%{!?_environmentdir: %global _environmentdir %{_prefix}/lib/environment.d}
+%{!?_systemdgeneratordir: %global _systemdgeneratordir %{_prefix}/lib/systemd/system-generators}
+%{!?_systemd_system_env_generator_dir: %global _systemd_system_env_generator_dir %{_prefix}/lib/systemd/system-environment-generators}
+
+# Fedora selinux-policy includes 'map' permission on a 'file' class. However,
+# Amazon Linux 2 does not have the updated policy containing the fix for
+# https://bugzilla.redhat.com/show_bug.cgi?id=1574383.
+# For now disable SELinux on Amazon Linux 2 until it's fixed.
+%if 0%{?amzn2} == 1
+%global with_selinux 0
+%endif
+
+Name:           snapd
+Version:        2.48.3
+Release:        0%{?dist}
+Summary:        A transactional software package manager
+License:        GPLv3
+URL:            https://%{provider_prefix}
+Source0:        https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz
+Source1:        https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz
+
+%if 0%{?with_goarches}
+# e.g. el6 has ppc64 arch without gcc-go, so EA tag is required
+ExclusiveArch:  %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}}
+%else
+# Verified arches from snapd upstream
+ExclusiveArch:  %{ix86} x86_64 %{arm} aarch64 ppc64le s390x
+%endif
+
+# If go_compiler is not set to 1, there is no virtual provide. Use golang instead.
+BuildRequires:  %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang >= 1.9}
+BuildRequires:  systemd
+%{?systemd_requires}
+
+Requires:       snap-confine%{?_isa} = %{version}-%{release}
+Requires:       squashfs-tools
+
+%if 0%{?rhel} && 0%{?rhel} < 8
+# Rich dependencies not available, always pull in squashfuse
+# snapd will use squashfs.ko instead of squashfuse if it's on the system
+# NOTE: Amazon Linux 2 does not have squashfuse, squashfs.ko is part of the kernel package
+%if ! 0%{?amzn2}
+Requires:       squashfuse
+Requires:       fuse
+%endif
+%else
+# snapd will use squashfuse in the event that squashfs.ko isn't available (cloud instances, containers, etc.)
+Requires:       ((squashfuse and fuse) or kmod(squashfs.ko))
+%endif
+
+# bash-completion owns /usr/share/bash-completion/completions
+Requires:       bash-completion
+
+%if 0%{?with_selinux}
+# Force the SELinux module to be installed
+Requires:       %{name}-selinux = %{version}-%{release}
+%endif
+
+%if 0%{?fedora} && 0%{?fedora} < 30
+# snapd-login-service is no more
+# Note: Remove when F29 is EOL
+Obsoletes:      %{name}-login-service < 1.33
+Provides:       %{name}-login-service = 1.33
+Provides:       %{name}-login-service%{?_isa} = 1.33
+%endif
+
+%if ! 0%{?with_bundled}
+BuildRequires: golang(github.com/boltdb/bolt)
+BuildRequires: golang(github.com/coreos/go-systemd/activation)
+BuildRequires: golang(github.com/godbus/dbus)
+BuildRequires: golang(github.com/godbus/dbus/introspect)
+BuildRequires: golang(github.com/gorilla/mux)
+BuildRequires: golang(github.com/jessevdk/go-flags)
+BuildRequires: golang(github.com/juju/ratelimit)
+BuildRequires: golang(github.com/kr/pretty)
+BuildRequires: golang(github.com/kr/text)
+BuildRequires: golang(github.com/mvo5/goconfigparser)
+BuildRequires: golang(github.com/seccomp/libseccomp-golang)
+BuildRequires: golang(github.com/snapcore/go-gettext)
+BuildRequires: golang(golang.org/x/crypto/openpgp/armor)
+BuildRequires: golang(golang.org/x/crypto/openpgp/packet)
+BuildRequires: golang(golang.org/x/crypto/sha3)
+BuildRequires: golang(golang.org/x/crypto/ssh/terminal)
+BuildRequires: golang(golang.org/x/xerrors)
+BuildRequires: golang(golang.org/x/xerrors/internal)
+BuildRequires: golang(gopkg.in/check.v1)
+BuildRequires: golang(gopkg.in/macaroon.v1)
+BuildRequires: golang(gopkg.in/mgo.v2/bson)
+BuildRequires: golang(gopkg.in/retry.v1)
+BuildRequires: golang(gopkg.in/tomb.v2)
+BuildRequires: golang(gopkg.in/yaml.v2)
+%endif
+
+%description
+Snappy is a modern, cross-distribution, transactional package manager
+designed for working with self-contained, immutable packages.
+
+%package -n snap-confine
+Summary:        Confinement system for snap applications
+License:        GPLv3
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  libtool
+BuildRequires:  gcc
+BuildRequires:  gettext
+BuildRequires:  gnupg
+BuildRequires:  pkgconfig(glib-2.0)
+BuildRequires:  pkgconfig(libcap)
+BuildRequires:  pkgconfig(libseccomp)
+%if 0%{?with_selinux}
+BuildRequires:  pkgconfig(libselinux)
+%endif
+BuildRequires:  pkgconfig(libudev)
+BuildRequires:  pkgconfig(systemd)
+BuildRequires:  pkgconfig(udev)
+BuildRequires:  xfsprogs-devel
+BuildRequires:  glibc-static
+%if ! 0%{?rhel}
+BuildRequires:  libseccomp-static
+%endif
+BuildRequires:  valgrind
+BuildRequires:  %{_bindir}/rst2man
+%if 0%{?fedora}
+# ShellCheck in EPEL is too old...
+BuildRequires:  %{_bindir}/shellcheck
+%endif
+
+# Ensures older version from split packaging is replaced
+Obsoletes:      snap-confine < 2.19
+
+%description -n snap-confine
+This package is used internally by snapd to apply confinement to
+the started snap applications.
+
+%if 0%{?with_selinux}
+%package selinux
+Summary:        SELinux module for snapd
+License:        GPLv2+
+BuildArch:      noarch
+BuildRequires:  selinux-policy, selinux-policy-devel
+Requires(post): selinux-policy-base >= %{_selinux_policy_version}
+Requires(post): policycoreutils
+%if 0%{?rhel} == 7
+Requires(post): policycoreutils-python
+%else
+Requires(post): policycoreutils-python-utils
+%endif
+Requires(pre):  libselinux-utils
+Requires(post): libselinux-utils
+
+%description selinux
+This package provides the SELinux policy module to ensure snapd
+runs properly under an environment with SELinux enabled.
+%endif
+
+%if 0%{?with_devel}
+%package devel
+Summary:       Development files for %{name}
+BuildArch:     noarch
+
+%if 0%{?with_check} && ! 0%{?with_bundled}
+%endif
+
+%if ! 0%{?with_bundled}
+Requires:      golang(github.com/boltdb/bolt)
+Requires:      golang(github.com/coreos/go-systemd/activation)
+Requires:      golang(github.com/godbus/dbus)
+Requires:      golang(github.com/godbus/dbus/introspect)
+Requires:      golang(github.com/gorilla/mux)
+Requires:      golang(github.com/jessevdk/go-flags)
+Requires:      golang(github.com/juju/ratelimit)
+Requires:      golang(github.com/kr/pretty)
+Requires:      golang(github.com/kr/text)
+Requires:      golang(github.com/mvo5/goconfigparser)
+Requires:      golang(github.com/seccomp/libseccomp-golang)
+Requires:      golang(github.com/snapcore/go-gettext)
+Requires:      golang(golang.org/x/crypto/openpgp/armor)
+Requires:      golang(golang.org/x/crypto/openpgp/packet)
+Requires:      golang(golang.org/x/crypto/sha3)
+Requires:      golang(golang.org/x/crypto/ssh/terminal)
+Requires:      golang(golang.org/x/xerrors)
+Requires:      golang(golang.org/x/xerrors/internal)
+Requires:      golang(gopkg.in/check.v1)
+Requires:      golang(gopkg.in/macaroon.v1)
+Requires:      golang(gopkg.in/mgo.v2/bson)
+Requires:      golang(gopkg.in/retry.v1)
+Requires:      golang(gopkg.in/tomb.v2)
+Requires:      golang(gopkg.in/yaml.v2)
+%else
+# These Provides are unversioned because the sources in
+# the bundled tarball are unversioned (they go by git commit)
+# *sigh*... I hate golang...
+Provides:      bundled(golang(github.com/snapcore/bolt))
+Provides:      bundled(golang(github.com/coreos/go-systemd/activation))
+Provides:      bundled(golang(github.com/godbus/dbus))
+Provides:      bundled(golang(github.com/godbus/dbus/introspect))
+Provides:      bundled(golang(github.com/gorilla/mux))
+Provides:      bundled(golang(github.com/jessevdk/go-flags))
+Provides:      bundled(golang(github.com/juju/ratelimit))
+Provides:      bundled(golang(github.com/kr/pretty))
+Provides:      bundled(golang(github.com/kr/text))
+Provides:      bundled(golang(github.com/mvo5/goconfigparser))
+Provides:      bundled(golang(github.com/mvo5/libseccomp-golang))
+Provides:      bundled(golang(github.com/snapcore/go-gettext))
+Provides:      bundled(golang(golang.org/x/crypto/openpgp/armor))
+Provides:      bundled(golang(golang.org/x/crypto/openpgp/packet))
+Provides:      bundled(golang(golang.org/x/crypto/sha3))
+Provides:      bundled(golang(golang.org/x/crypto/ssh/terminal))
+Provides:      bundled(golang(golang.org/x/xerrors))
+Provides:      bundled(golang(golang.org/x/xerrors/internal))
+Provides:      bundled(golang(gopkg.in/check.v1))
+Provides:      bundled(golang(gopkg.in/macaroon.v1))
+Provides:      bundled(golang(gopkg.in/mgo.v2/bson))
+Provides:      bundled(golang(gopkg.in/retry.v1))
+Provides:      bundled(golang(gopkg.in/tomb.v2))
+Provides:      bundled(golang(gopkg.in/yaml.v2))
+%endif
+
+# Generated by gofed
+Provides:      golang(%{import_path}/advisor) = %{version}-%{release}
+Provides:      golang(%{import_path}/arch) = %{version}-%{release}
+Provides:      golang(%{import_path}/asserts) = %{version}-%{release}
+Provides:      golang(%{import_path}/asserts/assertstest) = %{version}-%{release}
+Provides:      golang(%{import_path}/asserts/signtool) = %{version}-%{release}
+Provides:      golang(%{import_path}/asserts/snapasserts) = %{version}-%{release}
+Provides:      golang(%{import_path}/asserts/sysdb) = %{version}-%{release}
+Provides:      golang(%{import_path}/asserts/systestkeys) = %{version}-%{release}
+Provides:      golang(%{import_path}/boot) = %{version}-%{release}
+Provides:      golang(%{import_path}/boot/boottest) = %{version}-%{release}
+Provides:      golang(%{import_path}/bootloader) = %{version}-%{release}
+Provides:      golang(%{import_path}/bootloader/androidbootenv) = %{version}-%{release}
+Provides:      golang(%{import_path}/bootloader/grubenv) = %{version}-%{release}
+Provides:      golang(%{import_path}/bootloader/ubootenv) = %{version}-%{release}
+Provides:      golang(%{import_path}/client) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/cmdutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snap-seccomp/syscalls) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snaplock) = %{version}-%{release}
+Provides:      golang(%{import_path}/daemon) = %{version}-%{release}
+Provides:      golang(%{import_path}/dirs) = %{version}-%{release}
+Provides:      golang(%{import_path}/errtracker) = %{version}-%{release}
+Provides:      golang(%{import_path}/features) = %{version}-%{release}
+Provides:      golang(%{import_path}/gadget) = %{version}-%{release}
+Provides:      golang(%{import_path}/httputil) = %{version}-%{release}
+Provides:      golang(%{import_path}/i18n) = %{version}-%{release}
+Provides:      golang(%{import_path}/image) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/apparmor) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/backends) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/builtin) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/dbus) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/hotplug) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/ifacetest) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/kmod) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/mount) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/policy) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/seccomp) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/systemd) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/udev) = %{version}-%{release}
+Provides:      golang(%{import_path}/interfaces/utils) = %{version}-%{release}
+Provides:      golang(%{import_path}/jsonutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/jsonutil/safejson) = %{version}-%{release}
+Provides:      golang(%{import_path}/logger) = %{version}-%{release}
+Provides:      golang(%{import_path}/metautil) = %{version}-%{release}
+Provides:      golang(%{import_path}/netutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/osutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/osutil/squashfs) = %{version}-%{release}
+Provides:      golang(%{import_path}/osutil/strace) = %{version}-%{release}
+Provides:      golang(%{import_path}/osutil/sys) = %{version}-%{release}
+Provides:      golang(%{import_path}/osutil/udev/crawler) = %{version}-%{release}
+Provides:      golang(%{import_path}/osutil/udev/netlink) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/assertstate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/auth) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/cmdstate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/configstate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/configstate/config) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/configstate/configcore) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/configstate/proxyconf) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/configstate/settings) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/devicestate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/devicestate/devicestatetest) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/hookstate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/hookstate/ctlcmd) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/hookstate/hooktest) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/ifacestate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/ifacestate/ifacerepo) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/ifacestate/udevmonitor) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/patch) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/servicestate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/snapshotstate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/snapshotstate/backend) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/snapstate) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/snapstate/backend) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/standby) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/state) = %{version}-%{release}
+Provides:      golang(%{import_path}/overlord/storecontext) = %{version}-%{release}
+Provides:      golang(%{import_path}/polkit) = %{version}-%{release}
+Provides:      golang(%{import_path}/progress) = %{version}-%{release}
+Provides:      golang(%{import_path}/progress/progresstest) = %{version}-%{release}
+Provides:      golang(%{import_path}/release) = %{version}-%{release}
+Provides:      golang(%{import_path}/sandbox/seccomp) = %{version}-%{release}
+Provides:      golang(%{import_path}/sanity) = %{version}-%{release}
+Provides:      golang(%{import_path}/selinux) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap/naming) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap/pack) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap/snapdir) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap/snapenv) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap/snaptest) = %{version}-%{release}
+Provides:      golang(%{import_path}/snap/squashfs) = %{version}-%{release}
+Provides:      golang(%{import_path}/spdx) = %{version}-%{release}
+Provides:      golang(%{import_path}/store) = %{version}-%{release}
+Provides:      golang(%{import_path}/store/storetest) = %{version}-%{release}
+Provides:      golang(%{import_path}/strutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/strutil/quantity) = %{version}-%{release}
+Provides:      golang(%{import_path}/strutil/shlex) = %{version}-%{release}
+Provides:      golang(%{import_path}/systemd) = %{version}-%{release}
+Provides:      golang(%{import_path}/tests/lib/fakestore/refresh) = %{version}-%{release}
+Provides:      golang(%{import_path}/tests/lib/fakestore/store) = %{version}-%{release}
+Provides:      golang(%{import_path}/testutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/timeout) = %{version}-%{release}
+Provides:      golang(%{import_path}/timeutil) = %{version}-%{release}
+Provides:      golang(%{import_path}/timings) = %{version}-%{release}
+Provides:      golang(%{import_path}/userd) = %{version}-%{release}
+Provides:      golang(%{import_path}/userd/ui) = %{version}-%{release}
+Provides:      golang(%{import_path}/wrappers) = %{version}-%{release}
+Provides:      golang(%{import_path}/x11) = %{version}-%{release}
+Provides:      golang(%{import_path}/xdgopenproxy) = %{version}-%{release}
+
+%description devel
+This package contains library source intended for
+building other packages which use import path with
+%{import_path} prefix.
+%endif
+
+%if 0%{?with_unit_test} && 0%{?with_devel}
+%package unit-test-devel
+Summary:         Unit tests for %{name} package
+
+%if 0%{?with_check}
+#Here comes all BuildRequires: PACKAGE the unit tests
+#in %%check section need for running
+%endif
+
+# test subpackage tests code from devel subpackage
+Requires:        %{name}-devel = %{version}-%{release}
+
+%description unit-test-devel
+This package contains unit tests for project
+providing packages with %{import_path} prefix.
+%endif
+
+%prep
+%if ! 0%{?with_bundled}
+%setup -q
+# Ensure there's no bundled stuff accidentally leaking in...
+rm -rf vendor/*
+%else
+# Extract each tarball properly
+%setup -q -D -b 1
+%endif
+
+%build
+# Generate version files
+./mkversion.sh "%{version}-%{release}"
+
+# We don't want/need squashfuse in the rpm, as it's available in Fedora and EPEL
+sed -e 's:_ "github.com/snapcore/squashfuse"::g' -i systemd/systemd.go
+
+# Build snapd
+mkdir -p src/github.com/snapcore
+ln -s ../../../ src/github.com/snapcore/snapd
+
+%if ! 0%{?with_bundled}
+export GOPATH=$(pwd):%{gopath}
+%else
+export GOPATH=$(pwd):$(pwd)/Godeps/_workspace:%{gopath}
+%endif
+
+# see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang
+BUILDTAGS=
+%if 0%{?with_test_keys}
+BUILDTAGS="withtestkeys nosecboot"
+%else
+BUILDTAGS="nosecboot"
+%endif
+
+%if ! 0%{?with_bundled}
+# We don't need mvo5 fork for seccomp, as we have seccomp 2.3.x
+sed -e "s:github.com/mvo5/libseccomp-golang:github.com/seccomp/libseccomp-golang:g" -i cmd/snap-seccomp/*.go
+# We don't need the snapcore fork for bolt - it is just a fix on ppc
+sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go errtracker/*.go
+%endif
+
+# We have to build snapd first to prevent the build from
+# building various things from the tree without additional
+# set tags.
+%gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
+%gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
+%gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
+
+# To ensure things work correctly with base snaps,
+# snap-exec, snap-update-ns, and snapctl need to be built statically
+(
+%if 0%{?rhel} >= 8
+    # since 1.12.1, the go-toolset module is built with FIPS compliance that
+    # defaults to using libcrypto.so which gets loaded at runtime via dlopen(),
+    # disable that functionality for statically built binaries
+    BUILDTAGS="${BUILDTAGS} no_openssl"
+%endif
+    %gobuild_static -o bin/snap-exec $GOFLAGS %{import_path}/cmd/snap-exec
+    %gobuild_static -o bin/snap-update-ns $GOFLAGS %{import_path}/cmd/snap-update-ns
+    %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl
+)
+
+%if 0%{?rhel}
+# There's no static link library for libseccomp in RHEL/CentOS...
+sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go
+%endif
+%gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp
+
+%if 0%{?with_selinux}
+(
+%if 0%{?rhel} == 7
+    M4PARAM='-D distro_rhel7'
+%endif
+    # Build SELinux module
+    cd ./data/selinux
+    # pass M4PARAM in env instead of as an override, so that make can still
+    # manipulate it freely, for more details see:
+    # https://www.gnu.org/software/make/manual/html_node/Override-Directive.html
+    M4PARAM="$M4PARAM" make SHARE="%{_datadir}" TARGETS="snappy"
+)
+%endif
+
+# Build snap-confine
+pushd ./cmd
+# FIXME This is a hack to get rid of a patch we have to ship for the
+# Fedora package at the moment as /usr/lib/rpm/redhat/redhat-hardened-ld
+# accidentially adds -pie for static executables. See
+# https://bugzilla.redhat.com/show_bug.cgi?id=1343892 for a few more
+# details. To prevent this from happening we drop the linker
+# script and define our LDFLAGS manually for now.
+export LDFLAGS="-Wl,-z,relro -z now"
+autoreconf --force --install --verbose
+# FIXME: add --enable-caps-over-setuid as soon as possible (setuid discouraged!)
+%configure \
+    --disable-apparmor \
+%if 0%{?with_selinux}
+    --enable-selinux \
+%endif
+    --libexecdir=%{_libexecdir}/snapd/ \
+    --enable-nvidia-biarch \
+    %{?with_multilib:--with-32bit-libdir=%{_prefix}/lib} \
+    --with-snap-mount-dir=%{_sharedstatedir}/snapd/snap \
+    --enable-merged-usr
+
+%make_build
+popd
+
+# Build systemd units, dbus services, and env files
+pushd ./data
+make BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" \
+     SYSTEMDSYSTEMUNITDIR="%{_unitdir}" \
+     SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \
+     SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
+popd
+
+%install
+install -d -p %{buildroot}%{_bindir}
+install -d -p %{buildroot}%{_libexecdir}/snapd
+install -d -p %{buildroot}%{_mandir}/man8
+install -d -p %{buildroot}%{_environmentdir}
+install -d -p %{buildroot}%{_systemdgeneratordir}
+install -d -p %{buildroot}%{_systemd_system_env_generator_dir}
+install -d -p %{buildroot}%{_unitdir}
+install -d -p %{buildroot}%{_sysconfdir}/profile.d
+install -d -p %{buildroot}%{_sysconfdir}/sysconfig
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/vulkan
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/mount
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/seccomp/bpf
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/snaps
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/snap/bin
+install -d -p %{buildroot}%{_localstatedir}/snap
+install -d -p %{buildroot}%{_localstatedir}/cache/snapd
+install -d -p %{buildroot}%{_datadir}/polkit-1/actions
+%if 0%{?with_selinux}
+install -d -p %{buildroot}%{_datadir}/selinux/devel/include/contrib
+install -d -p %{buildroot}%{_datadir}/selinux/packages
+%endif
+
+# Install snap and snapd
+install -p -m 0755 bin/snap %{buildroot}%{_bindir}
+install -p -m 0755 bin/snap-exec %{buildroot}%{_libexecdir}/snapd
+install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd
+install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd
+install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd
+install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd
+# Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl
+install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl
+ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl
+
+%if 0%{?with_selinux}
+# Install SELinux module
+install -p -m 0644 data/selinux/snappy.if %{buildroot}%{_datadir}/selinux/devel/include/contrib
+install -p -m 0644 data/selinux/snappy.pp.bz2 %{buildroot}%{_datadir}/selinux/packages
+%endif
+
+# Install snap(8) man page
+bin/snap help --man > %{buildroot}%{_mandir}/man8/snap.8
+
+# Install the "info" data file with snapd version
+install -m 644 -D data/info %{buildroot}%{_libexecdir}/snapd/info
+
+# Install bash completion for "snap"
+install -m 644 -D data/completion/bash/snap %{buildroot}%{_datadir}/bash-completion/completions/snap
+install -m 644 -D data/completion/bash/complete.sh %{buildroot}%{_libexecdir}/snapd
+install -m 644 -D data/completion/bash/etelpmoc.sh %{buildroot}%{_libexecdir}/snapd
+# Install zsh completion for "snap"
+install -d -p %{buildroot}%{_datadir}/zsh/site-functions
+install -m 644 -D data/completion/zsh/_snap %{buildroot}%{_datadir}/zsh/site-functions/_snap
+
+# Install snap-confine
+pushd ./cmd
+%make_install
+# Undo the 0111 permissions, they are restored in the files section
+chmod 0755 %{buildroot}%{_sharedstatedir}/snapd/void
+# We don't use AppArmor
+rm -rfv %{buildroot}%{_sysconfdir}/apparmor.d
+# ubuntu-core-launcher is dead
+rm -fv %{buildroot}%{_bindir}/ubuntu-core-launcher
+popd
+
+# Install all systemd and dbus units, and env files
+pushd ./data
+%make_install BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" \
+              SYSTEMDSYSTEMUNITDIR="%{_unitdir}" \
+              SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \
+              SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
+popd
+
+%if 0%{?rhel} == 7
+# Install kernel tweaks
+# See: https://access.redhat.com/articles/3128691
+install -m 644 -D data/sysctl/rhel7-snap.conf %{buildroot}%{_sysctldir}/99-snap.conf
+%endif
+
+# Remove snappy core specific units
+rm -fv %{buildroot}%{_unitdir}/snapd.system-shutdown.service
+rm -fv %{buildroot}%{_unitdir}/snapd.snap-repair.*
+rm -fv %{buildroot}%{_unitdir}/snapd.core-fixup.*
+rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service
+
+# Remove snappy core specific scripts
+rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh
+
+# Remove snapd apparmor service
+rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service
+rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor
+
+# Install Polkit configuration
+install -m 644 -D data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions
+
+# Disable re-exec by default
+echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd
+
+# Create state.json and the README file to be ghosted
+touch %{buildroot}%{_sharedstatedir}/snapd/state.json
+touch %{buildroot}%{_sharedstatedir}/snapd/snap/README
+
+# When enabled, create a symlink for /snap to point to /var/lib/snapd/snap
+%if %{with snap_symlink}
+ln -sr %{buildroot}%{_sharedstatedir}/snapd/snap %{buildroot}/snap
+%endif
+
+# source codes for building projects
+%if 0%{?with_devel}
+install -d -p %{buildroot}/%{gopath}/src/%{import_path}/
+echo "%%dir %%{gopath}/src/%%{import_path}/." >> devel.file-list
+# find all *.go but no *_test.go files and generate devel.file-list
+for file in $(find . -iname "*.go" -o -iname "*.s" \! -iname "*_test.go") ; do
+    echo "%%dir %%{gopath}/src/%%{import_path}/$(dirname $file)" >> devel.file-list
+    install -d -p %{buildroot}/%{gopath}/src/%{import_path}/$(dirname $file)
+    cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file
+    echo "%%{gopath}/src/%%{import_path}/$file" >> devel.file-list
+done
+%endif
+
+# testing files for this project
+%if 0%{?with_unit_test} && 0%{?with_devel}
+install -d -p %{buildroot}/%{gopath}/src/%{import_path}/
+# find all *_test.go files and generate unit-test.file-list
+for file in $(find . -iname "*_test.go"); do
+    echo "%%dir %%{gopath}/src/%%{import_path}/$(dirname $file)" >> devel.file-list
+    install -d -p %{buildroot}/%{gopath}/src/%{import_path}/$(dirname $file)
+    cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file
+    echo "%%{gopath}/src/%%{import_path}/$file" >> unit-test-devel.file-list
+done
+
+# Install additional testdata
+install -d %{buildroot}/%{gopath}/src/%{import_path}/cmd/snap/test-data/
+cp -pav cmd/snap/test-data/* %{buildroot}/%{gopath}/src/%{import_path}/cmd/snap/test-data/
+echo "%%{gopath}/src/%%{import_path}/cmd/snap/test-data" >> unit-test-devel.file-list
+%endif
+
+%if 0%{?with_devel}
+sort -u -o devel.file-list devel.file-list
+%endif
+
+%check
+for binary in snap-exec snap-update-ns snapctl; do
+    ldd bin/$binary | grep 'not a dynamic executable'
+done
+
+# snapd tests
+%if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel}
+%if ! 0%{?with_bundled}
+export GOPATH=%{buildroot}/%{gopath}:%{gopath}
+%else
+export GOPATH=%{buildroot}/%{gopath}:$(pwd)/Godeps/_workspace:%{gopath}
+%endif
+%gotest %{import_path}/...
+%endif
+
+# snap-confine tests (these always run!)
+pushd ./cmd
+make check
+popd
+
+%files
+#define license tag if not already defined
+%{!?_licensedir:%global license %doc}
+%license COPYING
+%doc README.md docs/*
+%{_bindir}/snap
+%{_bindir}/snapctl
+%{_environmentdir}/990-snapd.conf
+%if 0%{?rhel} == 7
+%{_sysctldir}/99-snap.conf
+%endif
+%dir %{_libexecdir}/snapd
+%{_libexecdir}/snapd/snapctl
+%{_libexecdir}/snapd/snapd
+%{_libexecdir}/snapd/snap-exec
+%{_libexecdir}/snapd/snap-failure
+%{_libexecdir}/snapd/info
+%{_libexecdir}/snapd/snap-mgmt
+%if 0%{?with_selinux}
+%{_libexecdir}/snapd/snap-mgmt-selinux
+%endif
+%{_mandir}/man8/snap.8*
+%{_datadir}/applications/snap-handle-link.desktop
+%{_datadir}/bash-completion/completions/snap
+%{_libexecdir}/snapd/complete.sh
+%{_libexecdir}/snapd/etelpmoc.sh
+%{_datadir}/zsh/site-functions/_snap
+%{_libexecdir}/snapd/snapd.run-from-snap
+%{_sysconfdir}/profile.d/snapd.sh
+%{_mandir}/man8/snapd-env-generator.8*
+%{_systemd_system_env_generator_dir}/snapd-env-generator
+%{_unitdir}/snapd.socket
+%{_unitdir}/snapd.service
+%{_unitdir}/snapd.autoimport.service
+%{_unitdir}/snapd.failure.service
+%{_unitdir}/snapd.seeded.service
+%{_userunitdir}/snapd.session-agent.service
+%{_userunitdir}/snapd.session-agent.socket
+%{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
+%{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
+%{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
+%{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
+%config(noreplace) %{_sysconfdir}/sysconfig/snapd
+%dir %{_sharedstatedir}/snapd
+%dir %{_sharedstatedir}/snapd/assertions
+%dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
+%dir %{_sharedstatedir}/snapd/desktop
+%dir %{_sharedstatedir}/snapd/desktop/applications
+%dir %{_sharedstatedir}/snapd/device
+%dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
+%dir %{_sharedstatedir}/snapd/lib
+%dir %{_sharedstatedir}/snapd/lib/gl
+%dir %{_sharedstatedir}/snapd/lib/gl32
+%dir %{_sharedstatedir}/snapd/lib/glvnd
+%dir %{_sharedstatedir}/snapd/lib/vulkan
+%dir %{_sharedstatedir}/snapd/mount
+%dir %{_sharedstatedir}/snapd/seccomp
+%dir %{_sharedstatedir}/snapd/seccomp/bpf
+%dir %{_sharedstatedir}/snapd/snaps
+%dir %{_sharedstatedir}/snapd/snap
+%ghost %dir %{_sharedstatedir}/snapd/snap/bin
+%dir %{_localstatedir}/cache/snapd
+%dir %{_localstatedir}/snap
+%ghost %{_sharedstatedir}/snapd/state.json
+%ghost %{_sharedstatedir}/snapd/snap/README
+%if %{with snap_symlink}
+/snap
+%endif
+# this is typically owned by zsh, but we do not want to explicitly require zsh
+%dir %{_datadir}/zsh
+%dir %{_datadir}/zsh/site-functions
+
+%files -n snap-confine
+%doc cmd/snap-confine/PORTING
+%license COPYING
+%dir %{_libexecdir}/snapd
+# For now, we can't use caps
+# FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap!
+%attr(4755,root,root) %{_libexecdir}/snapd/snap-confine
+%{_libexecdir}/snapd/snap-device-helper
+%{_libexecdir}/snapd/snap-discard-ns
+%{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
+%{_libexecdir}/snapd/snap-seccomp
+%{_libexecdir}/snapd/snap-update-ns
+%{_libexecdir}/snapd/system-shutdown
+%{_mandir}/man8/snap-confine.8*
+%{_mandir}/man8/snap-discard-ns.8*
+%{_systemdgeneratordir}/snapd-generator
+%attr(0111,root,root) %{_sharedstatedir}/snapd/void
+
+%if 0%{?with_selinux}
+%files selinux
+%license data/selinux/COPYING
+%doc data/selinux/README.md
+%{_datadir}/selinux/packages/snappy.pp.bz2
+%{_datadir}/selinux/devel/include/contrib/snappy.if
+%endif
+
+%if 0%{?with_devel}
+%files devel -f devel.file-list
+%license COPYING
+%doc README.md
+%dir %{gopath}/src/%{provider}.%{provider_tld}/%{project}
+%endif
+
+%if 0%{?with_unit_test} && 0%{?with_devel}
+%files unit-test-devel -f unit-test-devel.file-list
+%license COPYING
+%doc README.md
+%endif
+
+%post
+%if 0%{?rhel} == 7
+%sysctl_apply 99-snap.conf
+%endif
+%systemd_post %{snappy_svcs}
+%systemd_user_post %{snappy_user_svcs}
+# If install, test if snapd socket and timer are enabled.
+# If enabled, then attempt to start them. This will silently fail
+# in chroots or other environments where services aren't expected
+# to be started.
+if [ $1 -eq 1 ] ; then
+   if systemctl -q is-enabled snapd.socket > /dev/null 2>&1 ; then
+      systemctl start snapd.socket > /dev/null 2>&1 || :
+   fi
+fi
+
+%preun
+%systemd_preun %{snappy_svcs}
+%systemd_user_preun %{snappy_user_svcs}
+
+# Remove all Snappy content if snapd is being fully uninstalled
+if [ $1 -eq 0 ]; then
+   %{_libexecdir}/snapd/snap-mgmt --purge || :
+fi
+
+%postun
+%systemd_postun_with_restart %{snappy_svcs}
+%systemd_user_postun %{snappy_user_svcs}
+
+%if 0%{?with_selinux}
+%triggerun -- snapd < 2.39
+# TODO: the trigger relies on a very specific snapd version that introduced SELinux
+# mount context, figure out how to update the trigger condition to run when needed
+
+# Trigger on uninstall, with one version of the package being pre 2.38 see
+# https://rpm-packaging-guide.github.io/#triggers-and-scriptlets for details
+# when triggers are run
+if [ "$1" -eq 2 -a "$2" -eq 1 ]; then
+   # Upgrade from pre 2.38 version
+   %{_libexecdir}/snapd/snap-mgmt-selinux --patch-selinux-mount-context=system_u:object_r:snappy_snap_t:s0 || :
+
+   # snapd might have created fontconfig cache directory earlier, but with
+   # incorrect context due to bugs in the policy, make sure it gets the right one
+   # on upgrade when the new policy was introduced
+   if [ -d "%{_localstatedir}/cache/fontconfig" ]; then
+      restorecon -R %{_localstatedir}/cache/fontconfig || :
+   fi
+elif [ "$1" -eq 1 -a "$2" -eq 2 ]; then
+   # Downgrade to a pre 2.38 version
+   %{_libexecdir}/snapd/snap-mgmt-selinux --remove-selinux-mount-context=system_u:object_r:snappy_snap_t:s0 || :
+fi
+
+%pre selinux
+%selinux_relabel_pre
+
+%post selinux
+%selinux_modules_install %{_datadir}/selinux/packages/snappy.pp.bz2
+%selinux_relabel_post
+
+%posttrans selinux
+%selinux_relabel_post
+
+%postun selinux
+%selinux_modules_uninstall snappy
+if [ $1 -eq 0 ]; then
+    %selinux_relabel_post
+fi
+%endif
+
+
+%changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
+* Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.1
+ - data/selinux: allow checking /var/cache/app-info
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - snap-bootstrap: remove sealed key file on reinstall
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: cherry-pick test fixes from master
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - data/completion, packaging: cherry-pick zsh completion
+ - state: log task errors in the journal too
+ - devicestate: do not report "ErrNoState" for seeded up
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - packaging: stop depending on python-docutils
+
+* Tue May 12 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45
+ - o/devicestate: support doing system action reboots from recover
+   mode
+ - vendor: update to latest secboot
+ - tests: not fail when boot dir cannot be determined
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-bootstrap/initramfs-mounts: append uuid to ubuntu-data
+   when decrypting
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - cmd/snap: fix the order of positional parameters in help output
+ - c/snap-bootstrap: port mount state mocking to the new style on
+   master
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline,
+   unlock in recover mode initramfs
+ - progress: tweak multibyte label unit test data
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - progress: fix progress bar with multibyte duration units
+ - many: use /run/mnt/data over /run/mnt/ubuntu-data for uc20
+ - many: put the sealed keys in a directory on seed for tidiness
+ - cmd/snap-bootstrap: measure epoch and model before unlocking
+   encrypted data
+ - o/configstate: core config handler for persistent journal
+ - bootloader/uboot: use secondary ubootenv file boot.sel for uc20
+ - packaging: add "$TAGS" to dh_auto_test for debian packaging
+ - tests: ensure $cache_dir is actually available
+ - secboot,cmd/snap-bootstrap: add model to pcr protection profile
+ - devicestate: do not use snap-boostrap in devicestate to install
+ - tests: fix a typo in nested.sh helper
+ - devicestate: add support for cloud.cfg.d config from the gadget
+ - cmd/snap-bootstrap: cleanups, naming tweaks
+ - testutil: add NewDBusTestConn
+ - snap-bootstrap: lock access to sealed keys
+ - overlord/devicestate: preserve the current model inside ubuntu-
+   boot
+ - interfaces/apparmor: use differently templated policy for non-core
+   bases
+ - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
+   syscalls
+ - cmd/snap-bootstrap/initramfs-mounts: mount ubuntu-seed first,
+   other misc changes
+ - o/snapstate: tweak "waiting for restart" message
+ - boot: store model model and grade information in modeenv
+ - interfaces/firewall-control: allow -legacy and -nft for core20
+ - boot: enable makeBootable20RunMode for EnvRefExtractedKernel
+   bootloaders
+ - boot/bootstate20: add EnvRefExtractedKernelBootloader bootstate20
+   implementation
+ - daemon: fix error message from `snap remove-user foo` on classic
+ - overlord: have a variant of Mock that can take a state.State
+ - tests: 16.04 and 18.04 now have mediating pulseaudio (again)
+ - seed: clearer errors for missing essential snapd or core snap
+ - cmd/snap-bootstrap/initramfs-mounts: support
+   EnvRefExtractedKernelBootloader's
+ - gadget, cmd/snap-bootstrap: MBR schema support
+ - image: improve/adjust DownloadSnap doc comment
+ - asserts: introduce ModelGrade.Code
+ - tests: ignore user-12345 slice and service
+ - image,seed/seedwriter: support redirect channel aka default
+   tracks
+ - bootloader: use binary.Read/Write
+ - tests: uc20 nested suite part II
+ - tests/boot: refactor to make it easier for new
+   bootloaderKernelState20 impl
+ - interfaces/openvswitch: support use of ovs-appctl
+ - snap-bootstrap: copy auth data from real ubuntu-data in recovery
+   mode
+ - snap-bootstrap: seal and unseal encryption key using tpm
+ - tests: disable special-home-can-run-classic-snaps due to jenkins
+   repo issue
+ - packaging: fix build on Centos8 to support BUILDTAGS
+ - boot/bootstate20: small changes to bootloaderKernelState20
+ - cmd/snap: Implement a "snap routine file-access" command
+ - spread.yaml: switch back to latest/candidate for lxd snap
+ - boot/bootstate20: re-factor kernel methods to use new interface
+   for state
+ - spread.yaml,tests/many: use global env var for lxd channel
+ - boot/bootstate20: fix bug in try-kernel cleanup
+ - config: add system.store-certs.[a-zA-Z0-9] support
+ - secboot: key sealing also depends on secure boot enabled
+ - httputil: fix client timeout retry tests
+ - cmd/snap-update-ns: handle EBUSY when unlinking files
+ - cmd/snap/debug/boot-vars: add opts for setting dir and/or uc20
+   vars
+ - secboot: add tpm support helpers
+ - tests/lib/assertions/developer1-pi-uc20.model: use 20/edge for
+   kernel and gadget
+ - cmd/snap-bootstrap: switch to a 64-byte key for unlocking
+ - tests: preserve size for centos images on spread.yaml
+ - github: partition the github action workflows
+ - run-checks: use consistent "Checking ..." style messages
+ - bootloader: add efi pkg for reading efi variables
+ - data/systemd: do not run snapd.system-shutdown if finalrd is
+   available
+ - overlord: update tests to work with latest go
+ - cmd/snap: do not hide debug boot-vars on core
+ - cmd/snap-bootstrap: no error when not input devices are found
+ - snap-bootstrap: fix partition numbering in create-partitions
+ - httputil/client_test.go: add two TLS version tests
+ - tests: ignore user@12345.service hierarchy
+ - bootloader, gadget, cmd/snap-bootstrap: misc cosmetic things
+ - tests: rewrite timeserver-control test
+ - tests: fix racy pulseaudio tests
+ - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS
+ - tests: update snap-preseed --reset logic to accommodate for 2.44
+   change
+ - cmd/snap: don't wait for system key when stopping
+ - sandbox/cgroup: avoid making arrays we don't use
+ - osutil: mock proc/self/mountinfo properly everywhere
+ - selinux: export MockIsEnforcing; systemd: use in tests
+ - tests: add 32 bit machine to GH actions
+ - tests/session-tool: kill cron session, if any
+ - asserts: it should be possible to omit many snap-ids if allowed,
+   fix
+ - boot: cleanup more things, simplify code
+ - github: skip spread jobs when corresponding label is set
+ - dirs: don't depend on osutil anymore, mv apparmor vars to apparmor
+   pkg
+ - tests/session-tool: add session-tool --dump
+ - github: allow cached debian downloads to restore
+ - tests/session-tool: session ordering is non-deterministic
+ - tests: enable unit tests on debian-sid again
+ - github: move spread to self-hosted workers
+ - secboot: import secboot on ubuntu, provide dummy on !ubuntu
+ - overlord/devicestate: support for recover and run modes
+ - snap/naming: add validator for snap security tag
+ - interfaces: add case for rootWritableOverlay + NFS
+ - tests/main/uc20-create-partitions: tweaks, renames, switch to
+   20.04
+ - github: port CLA check to Github Actions
+ - interfaces/many: miscellaneous policy updates xliv
+ - configcore,tests: fix setting watchdog options on UC18/20
+ - tests/session-tool: collect information about services on startup
+ - tests/main/uc20-snap-recovery: unbreak, rename to uc20-create-
+   partitions
+ - state: add state.CopyState() helper
+ - tests/session-tool: stop anacron.service in prepare
+ - interfaces: don't use the owner modifier for files shared via
+   document portal
+ - systemd: move the doc comments to the interface so they are
+   visible
+ - cmd/snap-recovery-chooser: tweaks
+ - interfaces/docker-support: add overlayfs file access
+ - packaging: use debian/not-installed to ignore snap-preseed
+ - travis.yml: disable unit tests on travis
+ - store: start splitting store.go and store_test.go into subtopic
+   files
+ - tests/session-tool: stop cron/anacron from meddling
+ - github: disable fail-fast as spread cannot be interrupted
+ - github: move static checks and spread over
+ - tests: skip "/etc/machine-id" in "writablepaths" test
+ - snap-bootstrap: store encrypted partition recovery key
+ - httputil: increase testRetryStrategy max timelimit to 5s
+ - tests/session-tool: kill leaking closing session
+ - interfaces: allow raw access to USB printers
+ - tests/session-tool: reset failed session-tool units
+ - httputil: increase httpclient timeout in
+   TestRetryRequestTimeoutHandling
+ - usersession: extend timerange in TestExitOnIdle
+ - client: increase timeout in client tests to 100ms
+ - many: disentagle release and snapdenv from sandbox/*
+ - boot: simplify modeenv mocking to always write a modeenv
+ - snap-bootstrap: expand data partition on install
+ - o/configstate: add backlight option for core config
+ - cmd/snap-recovery-chooser: add recovery chooser
+ - features: enable robust mount ns updates
+ - snap: improve TestWaitRecovers test
+ - sandbox/cgroup: add ProcessPathInTrackingCgroup
+ - interfaces/policy: fix comment in recent new test
+ - tests: make session tool way more robust
+ - interfaces/seccomp: allow passing an address to setgroups
+ - o/configcore: introduce core config handlers (3/N)
+ - interfaces: updates to login-session-observe, network-manager and
+   modem-manager interfaces
+ - interfaces/policy/policy_test.go: add more tests'allow-
+   installation: false' and we grant based on interface attributes
+ - packaging: detect/disable broken seed in the postinst
+ - cmd/snap-confine/mount-support-nvidia.c: add libnvoptix as nvidia
+   library
+ - tests: remove google-tpm backend from spread.yaml
+ - tests: install dependencies with apt using --no-install-recommends
+ - usersession/userd: add zoommtg url support
+ - snap-bootstrap: fix disk layout sanity check
+ - snap: add `snap debug state --is-seeded` helper
+ - devicestate: generate warning if seeding fails
+ - config, features: move and rename config.GetFeatureFlag helper to
+   features.Flag
+ - boot, overlord/devicestate, daemon:  implement requesting boot
+   into a given recovery system
+ - xdgopenproxy: forward requests to the desktop portal
+ - many: support immediate reboot
+ - store: search v2 tweaks
+ - tests: fix cross build tests when installing dependencies
+ - daemon: make POST /v2/systems/<label> root only
+ - tests/lib/prepare.sh: use only initrd from the kernel snap
+ - cmd/snap,seed: validate full seeds (UC 16/18)
+ - tests/main/user-session-env: stop the user session before deleting
+   the test-zsh user
+ - overlord/devicestate, daemon: record the seed current system was
+   installed from
+ - gadget: SystemDefaults helper function to convert system defaults
+   config into a flattened map suitable for FilesystemOnlyApply.
+ - many: comment or avoid cryptic snap-ids in tests
+ - tests: add LXD_CHANNEL environment
+ - store: support for search API v2
+ - .github: register a problem matcher to detect spread failures
+ - seed: add Info() method for seed.Snap
+ - github: always run the "Discard spread workers" step, even if the
+   job fails
+ - github: offload self-hosted workers
+ - cmd/snap: the model command needs just a client, no waitMixin
+ - github: combine tests into one workflow
+ - github: fix order of go get caches
+ - tests: adding more workers for ubuntu 20.04
+ - boot,overlord: rename operating mode to system mode
+ - config: add new Transaction.GetPristine{,Maybe}() function
+ - o/devicestate: rename readMaybe* to maybeRead*
+ - github: cache Debian dependencies for unit tests
+ - wrappers: respect pre-seeding in error path
+ - seed: validate UC20 seed system label
+ - client, daemon, overlord/devicestate: request system action API
+   and stubs
+ - asserts,o/devicestate: support model specified alternative serial-
+   authority
+ - many: introduce naming.WellKnownSnapID
+ - o/configcore: FilesystemOnlyApply method for early configuration
+   of core (1/N)
+ - github: run C unit tests
+ - github: run spread tests on PRs only
+ - interfaces/docker-support: make containerd abstract socket more
+   generic
+ - tests: cleanup security-private-tmp properly
+ - overlord/devicestate,boot: do not hold to the originally read
+   modeenv
+ - dirs: rm RunMnt; boot: add vars for early boot env layout;
+   sysconfig: take targetdir arg
+ - cmd/snap-bootstrap/initramfs-mounts/tests: use dirs.RunMnt over
+   s.runMnt
+ - tests: add regression test for MAAS refresh bug
+ - errtracker: add missing mocks
+ - github: apt-get update before installing build-deps
+ - github: don't fail-fast
+ - github: run spread via github actions
+ - boot,many: add modeenv.WriteTo, make Write take no args
+ - wrappers: fix timer schedules that are days only
+ - tests/main/snap-seccomp-syscalls: install gperf
+ - github: always checkout to snapcore/snapd
+ - github: add prototype workflow running unit tests
+ - many: improve comments, naming, a possible TODO
+ - client: use Assert when checking for error
+ - tests: ensure sockets target is ready in session agent spread
+   tests
+ - osutil: do not leave processes behind after the test run
+ - tests: update proxy-no-core to match latest CDN changes
+ - devicestate,sysconfig: support "cloud.cfg.d" in uc20 for grade:
+   dangerous
+ - cmd/snap-failure,tests: try to make snap-failure more robust
+ - many: fix packages having mistakenly their copyright as doc
+ - many: enumerate system seeds, return them on the /v2/systems API
+   endpoint
+ - randutil: don't consume kernel entropy at init, just mix more info
+   to try to avoid fleet collisions
+ - snap-bootstrap: add creationSupported predicate for partition
+   types
+ - tests: umount partitions which are not umounted after remount
+   gadget
+ - snap: run gofmt -s
+ - many: improve environment handling, fixing duplicate entries
+ - boot_test: add many boot robustness tests for UC20 kernel
+   MarkBootSuccessul and SetNextBoot
+ - overlord: remove unneeded overlord.MockPruneInterval() mocks
+ - interfaces/greengrass-support: fix typo
+ - overlord,timings,daemon: separate timings from overlord/state
+ - tests: enable nested on core20 and test current branch
+ - snap-bootstrap: remove created partitions on reinstall
+ - boot: apply Go 1.10 formatting
+ - apparmor: use rw for uuidd request to default and remove from
+   elsewhere
+ - packaging: add README.source for debian
+ - tests: cleanup various uc20 boot tests from previous PR
+ - devicestate: disable cloud-init by default on uc20
+ - run-checks: tweak formatting checks
+ - packaging,tests: ensure debian-sid builds without vendor/
+ - travis.yml: run unit tests with go/master as well* travis.yml: run
+   unit tests with go/master as well
+ - seed: make Brand() part of the Seed interface
+ - cmd/snap-update-ns: ignore EROFS from rmdir/unlink
+ - daemon: do a forceful server shutdown if we hit a deadline
+ - tests/many: don't use StartLimitInterval anymore, unify snapd-
+   failover variants, build snapd snap for UC16 tests
+ - snap-seccomp: robustness improvements
+ - run-tests: disable -v for go test to avoid spaming the logs
+ - snap: whitelist lzo as support compression for snap pack
+ - snap: tweak comment in Install() for overlayfs detection
+ - many: introduce snapdenv.Preseeding instead of release.PreseedMode
+ - client, daemon, overlord/devicestate: structures and stubs for
+   systems API
+ - o/devicestate: delay the creation of mark-seeded task until
+   asserts are loaded
+ - data/selinux, tests/main/selinux: cleanup tmpfs operations in the
+   policy, updates
+ - interfaces/greengrass-support: add new 1.9 access
+ - snap: do not hardlink on overlayfs
+ - boot,image: ARM kernel extract prepare image
+ - interfaces: make gpio robust against not-existing gpios in /sys
+ - cmd/snap-preseed: handle --reset flag
+ - many: introduce snapdenv to present common snapd env options
+ - interfaces/kubernetes-support: allow autobind to journald socket
+ - snap-seccomp: allow mprotect() to unblock the tests
+ - tests/lib/reset: workaround unicode dot in systemctl output
+ - interfaces/udisks2: also allow Introspection on
+   /org/freedesktop/UDisks/**
+ - snap: introduce Container.RandomAccessFile
+ - o/ifacestate, api: implementation of snap disconnect --forget
+ - cmd/snap: make the portal-info command search for the network-
+   status interface
+ - interfaces: work around apparmor_parser slowness affecting uio
+ - tests: fix/improve failing spread tests
+ - many: clean separation of bootenv mocking vs mock bootloader kinds
+ - tests: mock prune ticker in overlord tests to reduce wait times
+ - travis: disable arm64 again
+ - httputil: add support for extra snapd certs
+ - travis.yml: run unit tests on arm64 as well
+ - many: fix a pair of ineffectual assignments
+ - tests: add uc20 kernel snap upgrade managers test, fix
+   bootloadertest bugs
+ - o/snapstate: set base in SnapSetup on snap revert
+ - interfaces/{docker,kubernetes}-support: updates for lastest k8s
+ - cmd/snap-exec: add test case for LP bug 1860369
+ - interfaces: make the network-status interface implicit on
+   classic
+ - interfaces: power control interfaceIt is documented in the
+   kernel
+ - interfaces: miscellaneous policy updates
+ - cmd/snap: add a "snap routine portal-info" command
+ - usersession/userd: add "apt" to the white list of URL schemes
+   handled by xdg-open
+ - interfaces/desktop: allow access to system prompter interface
+ - devicestate: allow encryption regardless of grade
+ - tests: run ipv6 network-retry test too
+ - tests: test that after "remove-user" the system is unmanaged
+ - snap-confine: unconditionally add /dev/net/tun to the device
+   cgroup
+ - snapcraft.yaml: use sudo -E and remove workaround
+ - interfaces/audio_playback: Fix pulseaudio config access
+ - ovelord/snapstate: update only system wide fonts cache
+ - wrappers: import /etc/environment in all services
+ - interfaces/u2f: Add Titan USB-C key
+ - overlord, taskrunner: exit on task/ensure error when preseeding
+ - tests: add session-tool, a su / sudo replacement
+ - wrappers: add mount unit dependency for snapd services on core
+   devices
+ - tests: just remove user when the system is not managed on create-
+   user-2 test
+ - snap-preseed: support for preseeding of snapd and core18
+ - boot: misc UC20 changes
+ - tests: adding arch-linux execution
+ - packaging: revert "work around review-tools and snap-confine"
+ - netlink: fix panic on arm64 with the new rawsockstop codewith a
+   nil Timeval panics
+ - spread, data/selinux: add CentOS 8, update policy
+ - tests: updating checks to new test account for snapd-test snaps
+ - spread.yaml: mv opensuse 15.1 to unstable
+ - cmd/snap-bootstrap,seed: verify only in-play snaps
+ - tests: use ipv4 in retry-network to unblock failing master
+ - data/systemd: improve the description
+ - client: add "Resume" to DownloadOptions and new test
+ - tests: enable snapd-failover on uc20
+ - tests: add more debug output to the snapd-failure handling
+ - o/devicestate: unset recovery_system when done seeding
+
+* Fri Apr 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.44.3
+ - tests: fix racy pulseaudio tests
+ - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS
+ - tests: update snap-preseed --reset logic
+ - tests: backport partition fixes
+ - cmd/snap: don't wait for system key when stopping
+ - interfaces/many: miscellaneous policy updates xliv
+ - tests/main/uc20-snap-recovery: use 20.04 system
+ - tests: skip "/etc/machine-id" in "writablepaths
+ - interfaces/docker-support: add overlays file access
+
+* Thu Apr 2 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.44.2
+ - packaging: detect/disable broken seeds in the postinst
+ - cmd/snap,seed: validate full seeds (UC 16/18)
+ - snap: add `snap debug state --is-seeded` helper
+ - devicestate: generate warning if seeding fails
+ - store: support for search API v2
+ - cmd/snap-seccomp/syscalls: update the list of known syscalls
+ - snap/cmd: the model command needs just a client, no waitMixin
+ - tests: cleanup security-private-tmp properly
+ - wrappers: fix timer schedules that are days only
+ - tests: update proxy-no-core to match latest CDN changes
+ - cmd/snap-failure,tests: make snap-failure more robust
+ - tests, many: don't use StartLimitInterval anymore, unify snapd-
+   failover variants, build snapd snap for UC16 tests
+
+* Sat Mar 21 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.44.1
+ - randutil: switch back to setting up seed with lower entropy data
+ - interfaces/greengrass-support: fix typo
+ - packaging,tests: ensure debian-sid builds without vendor/
+ - travis.yml: run unit tests with go/master as well
+ - cmd/snap-update-ns: ignore EROFS from rmdir/unlink
+
+* Tue Mar 17 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.44
+ - daemon: do a forceful serer shutdown if we hit a deadline
+ - snap: whitelist lzo as support compression for snap pack
+ - data/selinux: update policy to allow more ops
+ - interfaces/greengrass-support: add new 1.9 access
+ - snap: do not hardlink on overlayfs
+ - cmd/snap-preseed: handle --reset flag
+ - interfaces/kubernetes-support: allow autobind to journald socket
+ - snap-seccomp: allow mprotect() to unblock the tests
+ - tests/lib/reset: workaround unicode dot in systemctl output
+ - interfaces: work around apparmor_parser slowness affecting uio
+ - interfaces/udisks2: also allow Introspection on
+   /org/freedesktop/UDisks2/**
+ - tests: mock prune ticker in overlord tests to reduce wait times
+ - interfaces/{docker,kubernetes}-support: updates for lastest k8s
+ - interfaces: miscellaneous policy updates
+ - interfaces/audio_playback: Fix pulseaudio config access
+ - overlord: disable Test..AbortShortlyAfterStartOfOperation for 2.44
+ - ovelord/snapstate: update only system wide fonts cache
+ - wrappers: import /etc/environment in all services
+ - interfaces/u2f: Add Titan USB-C key
+ - overlord, taskrunner: exit on task/ensure error when preseeding
+ - overlord/snapstate/backend: update snapd services contents in unit
+   tests
+ - wrappers: add mount unit dependency for snapd services on core
+   devices
+ - Revert "tests: remove /tmp/snap.* left over by other tests"
+ - Revert "packaging: work around review-tools and snap-confine"
+ - netlink: fix panic on arm64 with the new rawsockstop code
+ - spread, data/selinux: add CentOS 8, update policy
+ - spread.yaml: mv opensuse tumbleweed to unstable too
+ - spread.yaml: mv opensuse 15.1 to unstable
+ - tests: use ipv4 in retry-network to unblock failing master
+ - data/systemd: improve the description
+ - tests/lib/prepare.sh: simplify, combine code paths
+ - tests/main/user-session-env: add test verifying environment
+   variables inside the user session
+ - spread.yaml: make qemu ubuntu-core-20-64 use ubuntu-20.04-64
+ - run-checks: SKIP_GMFMT really skips formatting checks
+ - tests: enable more tests for UC20/UC18
+ - tests: remove tmp dir for snap not-test-snapd-sh on security-
+   private-tmp test
+ - seed,cmd/snap-bootstrap: introduce seed.Snap.EssentialType,
+   simplify bootstrap code
+ - snapstate: do not restart in undoLinkSnap unless on first install
+ - cmd/snap-bootstrap: subcommand to detect UC chooser trigger
+ - cmd/snap-bootstrap/initramfs-mounts: mount the snapd snap in run-
+   mode too
+ - cmd/libsnap, tests: fix C unit tests failing as non-root
+ - cmd/snap-bootstrap: verify kernel snap is in modeenv before
+   mounting it
+ - tests: adding amazon linux to google backend
+ - cmd/snap-failure/snapd: rm snapd.socket, reset snapd.socket failed
+   status
+ - client: add support for "ResumeToken", "HeaderPeek" to download
+ - build: enable type: snapd
+ - tests: rm -rf /tmp/snap.* in restore
+ - cmd/snap-confine: deny snap-confine to load nss libs
+ - snapcraft.yaml: add comments, rename snapd part to snapd-deb
+ - boot: write current_kernels in bootstate20, makebootable
+ - packaging: work around review-tools and snap-confine
+ - tests: skipping interfaces-openvswitch on centos due to package is
+   not available
+ - packaging,snap-confine: stop being setgid root
+ - cmd/snap-confine: bring /var/lib/dhcp from host, if present
+ - store: rely on CommandFromSystemSnap to find xdelta3
+ - tests: bump sleep time of the new overlord tests
+ - cmd/snap-preseed: snapd version check for the target
+ - netlink: fix/support stopping goroutines reading netlink raw
+   sockets
+ - tests: reset PS1 before possibly interactive dash
+ - overlord, state: don't abort changes if spawn time before
+   StartOfOperationTime (2/2)
+ - snapcraft.yaml: add python3-apt, tzdata as build-deps for the
+   snapd snap
+ - tests: ask tar to speak English
+ - tests: using google storage when downloading ubuntu cloud images
+   from gce
+ - Coverity produces false positives for code like this:
+ - many: maybe restart & security backend options
+ - o/standby: add SNAPD_STANDBY_WAIT to control standby in
+   development
+ - snap: use the actual staging snap-id for snapd
+ - cmd/snap-bootstrap: create a new parser instance
+ - snapcraft.yaml: use build-base and adopt-info, rm builddeb
+   plugin
+ - tests: set StartLimitInterval in snapd failover test
+ - tests: disable archlinux system
+ - tests: add preseed test for classic
+ - many, tests: integrate all preseed bits and add spread tests
+ - daemon: support resuming downloads
+ - tests: use Filename() instead of filepath.Base(sn.MountFile())
+ - tests/core: add swapfiles test
+ - interfaces/cpu-control: allow to control cpufreq tunables
+ - interfaces: use commonInteface for desktopInterface
+ - interfaces/{desktop-legacy,unity7}: adjust for new ibus socket
+   location
+ - snap/info: add Filename
+ - bootloader: make uboot a RecoveryAwareBootloader
+ - gadget: skip update when mounted filesystem content is identical
+ - systemd: improve is-active check for 'failed' services
+ - boot: add current_kernels to modeenv
+ - o/devicestate: StartOfOperationTime helper for Prune (1/2)
+ - tests: detect LXD launching i386 containers
+ - tests: move main/ubuntu-core-* tests to core/ suite
+ - tests: remove snapd in ubuntu-core-snapd
+ - boot: enable base snap updates in bootstate20
+ - tests: Fix core revert channel after 2.43 has been released to
+   stable
+ - data/selinux: unify tabs/spaces
+ - o/ifacestate: move ResolveDisconnect to ifacestate
+ - spread: move centos to stable systems
+ - interfaces/opengl: allow datagrams to nvidia-driver
+ - httputil: add NoNetwork(err) helper, spread test and use in serial
+   acquire
+ - store: detect if server does not support http range headers
+ - test/lib/user: add helper lib for doing things for and as a user
+ - overlord/snapstate, wrappers: undo of snapd on core
+ - tests/main/interfaces-pulseaudio: use custom pulseaudio script,
+   set kill timeout
+ - store: add support for resume in DownloadStream
+ - cmd/snap: implement 'snap remove-user'
+ - overlord/devicestate: fix preseed unit tests on systems not using
+   /snap
+ - tests/main/static: ldd in glibc 2.31 logs to stderr now
+ - run-checks, travis: allow skipping spread jobs by adding a label
+ - tests: add new backend which includes images with tpm support
+ - boot: use constants for boot status values
+ - tests: add "core" suite for UC specific tests
+ - tests/lib/prepare: use a local copy of uc20 initramfs skeleton
+ - tests: retry mounting the udisk2 device due to timing issue
+ - usersession/client: add a client library for the user session
+   agent
+ - o/devicestate: Handle preseed mode in the firstboot mode (core16
+   only for now).
+ - boot: add TryBase and BaseStatus to modeenv; use in snap-bootstrap
+ - cmd/snap-confine: detect base transitions on core16
+ - boot: don't use "kernel" from the modeenv anymore
+ - interfaces: add uio interface
+ - tests: repack the initramfs + kernel snap for UC20 spread tests
+ - interfaces/greengrass-support: add /dev/null ->
+   /proc/latency_stats mount
+ - httputil: remove workaround for redirect handling in go1.7
+ - httputil: remove go1.6 transport workaround
+ - snap: add `snap pack --compression=<comp>` options
+ - tests/lib/prepare: fix hardcoded loopback device names for UC
+   images
+ - timeutil: add a unit test case for trivial schedule
+ - randutil,o/snapstate,-mkauthors.sh: follow ups to randutil
+   introduction
+ - dirs: variable with distros using alternate snap mount
+ - many,randutil: centralize and streamline our random value
+   generation
+ - tests/lib/prepare-restore: Revert "Continue on errors updating or
+   installing dependencies"
+ - daemon: Allow clients to call /v2/logout via Polkit
+ - dirs: manjaro-arm is like manjaro
+ - data, packaging: Add sudoers snippet to allow snaps to be run with
+   sudo
+ - daemon, store: better expose single action errors
+ - tests: switch mount-ns test to differential data set
+ - snapstate: refactor things to add the re-refresh task last
+ - daemon: drop support for the DELETE method
+ - client: move to /v2/users; implement RemoveUser
+ - boot: enable UC20 kernel extraction and bootState20 handling
+ - interfaces/policy: enforce plug-names/slot-names constraints
+ - asserts: parse plug-names/slot-names constraints
+ - daemon: make users result more consistent
+ - cmd/snap-confine,tests: support x.y.z nvidia version
+ - dirs: fixlet for XdgRuntimeDirGlob
+ - boot: add bootloader options to coreKernel
+ - o/auth,daemon: do not remove unknown user
+ - tests: tweak and enable tests on ubuntu 20.04
+ - daemon: implement user removal
+ - cmd/snap-confine: allow snap-confine to link to libpcre2
+ - interfaces/builtin: Allow NotificationReplied signal on
+   org.freedesktop.Notifications
+ - overlord/auth: add RemoveUserByName
+ - client: move user-related things to their own files
+ - boot: tweak kernel cmdline helper docstring
+ - osutil: implement deluser
+ - gadget: skip update when raw structure content is unchanged
+ - boot, cmd/snap, cmd/snap-bootstrap: move run mode and system label
+   detection to boot
+ - tests: fix revisions leaking from snapd-refresh test
+ - daemon: refactor create-user to a user action & hide behind a flag
+ - osutil/tests: check there are no leftover symlinks with
+   AtomicSymlink
+ - grub: support atomically renaming kernel symlinks
+ - osutil: add helpers for creating symlinks and renaming in an
+   atomic manner
+ - tests: add marker tag for core 20 test failure
+ - tests: fix gadget-update-pc test leaking snaps
+ - tests: remove revision leaking from ubuntu-core-refresh
+ - tests: remove revision leaking from remodel-kernel
+ - tests: disable system-usernames test on core20
+ - travis, tests, run-checks: skip nakedret
+ - tests: run `uc20-snap-recovery-encrypt` test on 20.04-64 as well
+ - tests: update mount-ns test tables
+ - snap: disable auto-import in uc20 install-mode
+ - tests: add a command-chain service test
+ - tests: use test-snapd-upower instead of upower
+ - data/selinux: workaround incorrect fonts cache labeling on RHEL7
+ - spread.yaml: fix ubuntu 19.10 and 20.04 names
+ - debian: check embedded keys for snap-{bootstrap,preseed} too
+ - interfaces/apparmor: fix doc-comments, unnecessary code
+ - o/ifacestate,o/devicestatate: merge gadget-connect logic into
+   auto-connect
+ - bootloader: add ExtractedRunKernelImageBootloader interface,
+   implement in grub
+ - tests: add spread test for hook permissions
+ - cmd/snap-bootstrap: check device size before boostrapping and
+   produce a meaningful error
+ - cmd/snap: add ability to register "snap routine" commands
+ - tests: add a test demonstrating that snaps can't access the
+   session agent socket
+ - api: don't return connections referring to non-existing
+   plugs/slots
+ - interfaces: refactor path() from raw-volume into utils with
+   comments for old
+ - gitignore: ignore snap files
+ - tests: skip interfaces-network-manager on arm devices
+ - o/devicestate: do not create perfTimings if not needed inside
+   ensureSeed/Operational
+ - tests: add ubuntu 20.04 to the tests execution and remove
+   tumbleweed from unstable
+ - usersession: add systemd user instance service control to user
+   session agent
+ - cmd/snap: print full channel in 'snap list', 'snap info'
+ - tests: remove execution of ubuntu 19.04 from google backend
+ - cmd/snap-boostrap: add mocking for fakeroot
+ - tests/core18/snapd-failover: collect more debug info
+ - many: run black formatter on all python files
+ - overlord: increase settle timeout for slow machines
+ - httputil: use shorter timeout in TestRetryRequestTimeoutHandling
+ - store, o/snapstate: send default-tracks header, use
+   RedirectChannel
+ - overlord/standby: fix possible deadlock in standby test
+ - cmd/snap-discard-ns: fix pattern for .info files
+ - boot: add HasModeenv to Device
+ - devicestate: do not allow remodel between core20 models
+ - bootloader,snap: misc tweaks
+ - store, overlord/snapstate, etc: SnapAction now returns a []…Result
+ - snap-bootstrap: create encrypted partition
+ - snap: remove "host" output from `snap version`
+ - tests: use snap remove --purge flag in most of the spread tests
+ - data/selinux, test/main/selinux-clean: update the test to cover
+   more scenarios
+ - many: drop NameAndRevision, use snap.PlaceInfo instead
+ - boot: split MakeBootable tests into their own file
+ - travis-ci: add go import path
+ - boot: split MakeBootable implementations into their own file
+ - tests: enable a lot of the tests of main on uc20
+ - packaging, tests: stop services in prerm
+ - tests: enable regression suite on core20
+ - overlord/snapstate: improve snapd snap backend link unit tests
+ - boot: implement SetNextBoot in terms of bootState.setNext
+ - wrappers: write and undo snapd services on core
+ - boot,o/devicestate: refactor MarkBootSuccessful over bootState
+ - snap-bootstrap: mount the correct snapd snap to /run/mnt/snapd
+ - snap-bootstrap: refactor partition creation
+ - tests: use new snapd.spread-tests-run-mode-tweaks.service unit
+ - tests: add core20 tests
+ - boot,o/snapstate: SetNextBoot/LinkSnap return whether to reboot,
+   use the information
+ - tests/main/snap-sign: add test for non-stdin signing
+ - snap-bootstrap: trigger udev after filesystem creation
+ - boot,overlord: introduce internal abstraction bootState and use it
+   for InUse/GetCurrentBoot
+ - overlord/snapstate: tracks are now sticky
+ - cmd: sign: add filename param
+ - tests: remove "test-snapd-tools" in smoke/sandbox on restore
+ - cmd/snap, daemon: stop over-normalising channels
+ - tests: fix classic-ubuntu-core-transition-two-cores after refactor
+   of MATCH -v
+ - packaging: ship var/lib/snapd/desktop/applications in the pkg
+ - spread: drop copr repo with F30 build dependencies
+ - tests: use test-snapd-sh snap instead of test-snapd-tools - Part 3
+ - tests: fix partition creation test
+ - tests: unify/rename services-related spread tests to start with
+   services- prefix
+ - test: extract code that modifies "writable" for test prep
+ - systemd: handle preseed mode
+ - snap-bootstrap: read only stdout when parsing the sfdisk json
+ - interfaces/browser-support: add more product/vendor paths
+ - boot: write compat UC16 bootvars in makeBootable20RunMode
+ - devicestate: avoid adding mockModel to deviceMgrInstallModeSuite
+ - devicestate: request reboot after successful doSetupRunSystem()
+ - snapd.core-fixup.sh: do not run on UC20 at all
+ - tests: unmount automounted snap-bootstrap devices
+ - devicestate: run boot.MakeBootable in doSetupRunSystem
+ - boot: copy kernel/base to data partition in makeBootable20RunMode
+ - tests: also check nested lxd container
+ - run-checks: complain about MATCH -v
+ - boot: always return the trivial boot participant in ephemeral mode
+ - o/devicestate,o/snapstate: move the gadget.yaml checkdrive-by: use
+   gadget.ReadInfoFromSnapFile in checkGadgetRemodelCompatible
+ - snap-bootstrap: append new partitions
+ - snap-bootstrap: mount filesystems after creation
+ - snapstate: do not try to detect rollback in ephemeral modes
+ - snap-bootstrap: trigger udev for new partitions
+ - cmd/snap-bootstrap: xxx todos about kernel cross-checks
+ - tests: avoid mask rsyslog service in case is not enabled on the
+   system
+ - tests: fix use of MATCH -v
+ - cmd/snap-preseed: update help strings
+ - cmd/snap-bootstrap: actually parse snapd_recovery_system label
+ - bootstrap: reduce runmode mounts from 5 to 2 steps.
+ - lkenv.go: adjust for new location of include file
+ - snap: improve squashfs.ReadFile() error
+ - systemd: fix uc20 shutdown
+ - boot: write modeenv when creating the run mode
+ - boot,image: add skeleton boot.makeBootable20RunMode
+ - cmd/snap-preseed: add snap-preseed executable
+ - overlord,boot: follow ups to #7889 and #7899
+ - interfaces/wayland: Add access to Xwayland's shm files
+ - o/hookstate/ctlcmd: fix command name in snapctl -h
+ - daemon,snap: remove screenshot deprecation notice
+ - overlord,o/snapstate: make sure we never leave config behind
+ - many: pass consistently boot.Device state to boot methods
+ - run-checks: check multiline string blocks in
+   restore/prepare/execute sections of spread tests
+ - intrefaces: login-session-control - added missing dbus commands
+ - tests/main/parallel-install-remove-after: parallel installs should
+   not break removal
+ - overlord/snapstate: tweak assumes error hint
+ - overlord: replace DeviceContext.OldModel with GroundContext
+ - devicestate: use httputil.ShouldRetryError() in
+   prepareSerialRequest
+ - tests: replace "test-snapd-base-bare" with real "bare" base snap
+ - many: pass a Model to the gadget info reading functions
+ - snapstate: relax gadget constraints in ConfigDefaults Et al.
+ - devicestate: only run ensureBootOk() in "run" mode
+ - tests/many: quiet lxc launching, file pushing
+ - tests: disable apt-hooks test until it can be properly fixed
+ - tests: 16.04 and 18.04 now have mediating pulseaudio
+
+* Wed Feb 12 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.43.3
+ - interfaces/opengl: allow datagrams to nvidia-driver
+ - httputil: add NoNetwork(err) helper, spread test and use
+   in serial acquire
+ - interfaces: add uio interface
+ - interfaces/greengrass-support: 'aws-iot-greengrass' snap fails to
+   start due to apparmor deny on mounting of "/proc/latency_stats".
+ - data, packaging: Add sudoers snippet to allow snaps to be run with
+   sudo
+
+* Tue Jan 28 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.43.2
+ - cmd/snap-confine: Revert #7421 (unmount /writable from snap view)
+ - overlord/snapstate: fix for re-refresh bug
+ - tests, run-checks, many: fix nakedret issues
+ - data/selinux: workaround incorrect fonts cache labeling on RHEL7
+ - tests: use test-snapd-upower instead of upower
+ - overlord: increase overall settle timeout for slow arm boards
+
+* Tue Jan 14 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.43.1
+ - devicestate: use httputil.ShouldRetryError() in prepareSerialRequest
+ - overlord/standby: fix possible deadlock in standby test
+ - cmd/snap-discard-ns: fix pattern for .info files
+ - overlord,o/snapstate: make sure we never leave config behind
+ - data/selinux: update policy to cover more cases
+ - snap: remove "host" output from `snap version`
+
+* Thu Jan 09 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.43
+ - snap: default to "--direct" in `snap known`
+ - packaging: ship var/lib/snapd/desktop/applications in the
+   pkg
+ - tests: cherry-pick fixes for  snap-set-core-config/ubuntu-core-
+   config-defaults-once
+ - tests: use test-snapd-sh snap instead of test-snapd-tools
+ - tests: rename "test-snapd-sh" in smoke test to test-snapd-sandbox
+ - tests: fix partition creation test
+ - packaging: fix incorrect changelog entry
+ - Revert "tests: 16.04 and 18.04 now have mediating pulseaudio"
+ - tests: 16.04 and 18.04 now have mediating pulseaudio
+ - interfaces: include hooks in plug/slot apparmor label
+ - interfaces: add raw-volume interface for access to partitions
+ - image: set recovery system label when creating the image
+ - cmd/snapd-generator: fix unit name for non /snap mount locations
+ - boot,bootloader: setup the snap recovery system bootenv
+ - seed: support ModeSnaps(mode) for mode != "run"
+ - seed: fix seed location of local but asserted snaps
+ - doc: HACKING.md change autopkgtest-trusty-amd64.img name
+ - interfaces/seccomp: parallelize seccomp backend setup
+ - cmd/snap-bootstrap: mount ubuntu-data tmpfs, in one go with kernel
+   & base
+ - interfaces: add audio-playback/record and pulseaudio spread tests
+ - apparmor: allow 'r'
+   /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
+ - cmd/snap-mgmt, packaging/postrm: stop and remove socket units when
+   purging
+ - tests: use test-snapd-sh snap instead of test-snapd-tools
+ - snap-confine: raise egid before calling setup_private_mount()
+ - tests: fix fwupd version regular expression
+ - snap-bootstrap: parse seed if either kernel or base are not
+   mounted
+ - tests: check for SELinux denials in interfaces-kvm spread test
+ - tests: run snap-set-core-config on all core devices
+ - selinux: update policy to allow modifications related to kmod
+   backend
+ - o/hookstate/ctlcmd: snapctl is-connected command
+ - devicestate: add missing test for failing task setup-run-system
+ - gadget: add missing test for duplicate detection of roles
+ - tests/cmd/snapctl: unset SNAP_CONTEXT for the suite
+ - snap/pack, cmd_pack: 'snap pack --check-skeleton' checks
+   interfaces
+ - gitignore: ignore visual studio code directory
+ - snap-bootstrap: implement "run" mode in snap-bootstrap initramfs-
+   mounts
+ - interfaces/apparmor: handle pre-seeding mode
+ - devicestate: implement creating partitions in "install" mode
+ - seed: support extra snaps on top of Core 20 dangerous models
+ - tests: cache snaps also for ubuntu core and add new snaps to cache
+ - snap-bootstrap: support auto-detect device in create-partitions
+ - tests: fix partitioning test debug message
+ - tests: prevent partitioning test errors
+ - cmd/snap-bootstrap: stub out snap.SanitizePlugsSlots for real
+ - gadget: extract and export new DiskFromPartition() helper
+ - snap-bootstrap: force partition table operations
+ - HACKING.md: add nvidia options to configure example
+ - tests: move the watchdog timeout to 2s to make the tests work in
+   rpi
+ - tests: demand silence from check_journalctl_log
+ - tests: fix the channels checks done on nested tests
+ - tests: reduce the complexity of the test-snapd-sh snap
+ - snap/squashfs, osutil: verify files/dirs can be accessed by
+   mksquashfs when building a snap
+ - boot: add boot.Modeenv.Kernel support
+ - devicestate: ensure system installation
+ - tests: apply change on permissions to serial port on hotplug test
+ - cmd/snap-update-ns: adjust debugging output for usability
+ - devicestate: add reading of modeenv to uc20 firstboot code
+ - tests/lib/prepare: drop workarounds for rpmbuild rewriting /bin/sh
+ - cmd/snap-bootstrap: write /var/lib/snapd/modeenv to the right
+   place
+ - boot: add boot.Modeenv.Base support
+ - overlord/snapstate: install task edges
+ - cmd/snap-bootstrap: some small naming and code org tweaks
+ - snap-bootstrap: remove SNAPPY_TESTING check, we use it for real
+   now
+ - interfaces: remove leftover reservedForOS
+ - snap-bootstrap: write /run/mnt/ubuntu-data/var/lib/snapd/modeenv
+ - osutil/mount: optimize flagOptSearch some more
+ - devicestate: read modeenv early and store in devicestate
+ - interfaces: add login-session-observe for who, {fail,last}log and
+   loginctl
+ - tests: add Ubuntu Eoan to google-sru backend
+ - osutil/mount: de-duplicate code to use a list
+ - interfaces: remove reservedForOS from commonInterface
+ - interfaces/browser-support: allow reading status of huge pages
+ - interfaces: update system-backup tests to not check for sanitize
+   errors related to os
+ - interfaces: add system-backup interface
+ - osutil/mount: add {Unm,M}outFlagsToOpts helpers
+ - snap-bootstrap: make cmdline parsing robust
+ - overlord/patch: normalize tracking channel in state
+ - boot: add boot.Modeenv that can read/write the UC20 modeenv files
+ - bootloader: add new bootloader.InstallBootConfig()
+ - many: share single implementation to list needed default-providers
+ - snap-bootstrap: implement "snap-bootstrap initramfs-mounts"
+ - seccomp: allow chown 'snap_daemon:root' and 'root:snap_daemon'
+ - osutil: handle "rw" mount flag in ParseMountEntry
+ - overlord/ifacestate: report bad plug/slots with warnings on snap
+   install
+ - po: sync translations from launchpad
+ - tests: cleanup most test snaps icons, they were anyway in the
+   wrong place
+ - seed: fix confusing pre snapd dates in tests
+ - many: make ValidateBasesAndProviders signature simpler/canonical
+ - snap-bootstrap: set expected filesystem labels
+ - testutil, many: make MockCommand() create prefix of absolute paths
+ - tests: improve TestDoPrereqRetryWhenBaseInFlight to fix occasional
+   flakiness.
+ - seed: proper support for optional snaps for Core 20 models
+ - many: test various kinds of overriding for the snapd snap in Core
+   20
+ - cmd/snap-failure: passthrough snapd logs, add informational
+   logging
+ - cmd/snap-failure: fallback to snapd from core, extend tests
+ - configcore: fix missing error propagation
+ - devicestate: rename ensureSeedYaml -> ensureSeeded
+ - tests: adding fedora 31
+ - tests: restart the snapd service in the snapd-failover test
+ - seed: Core 20 seeds channel overrides support for grade dangerous
+ - cmd: fix the get command help message
+ - tests: enable degraded test on arch linux after latest image
+   updates
+ - overlord/snapstate: don't re-enable and start disabled services on
+   refresh, etc.
+ - seed: support in Core 20 seeds local unasserted snaps for model
+   snaps
+ - snap-bootstrap: add go-flags cmdline parsing and tests
+ - gadget: skip fakeroot if not needed
+ - overlord/state: panic in MarkEdge() if task is nil
+ - spread: fix typo in spread suite
+ - overlord: mock device serial in gadget remodel unit tests
+ - tests: fix spread shellcheck and degraded tests to unbreak master
+ - spread, tests: openSUSE Tumbleweed to unstable systems, update
+   system-usernames on Amazon Linux 2
+ - snap: extract printInstallHint in cmd_download.go
+ - cmd: fix a pair of typos
+ - release: preseed mode flag
+ - cmd/snap-confine: tracking processes with classic confinement
+ - overlord/ifacestate: remove automatic connections if plug/slot
+   missing
+ - o/ifacestate,interfaces,interfaces/policy: slots-per-plug: *
+ - tests/lib/state: snapshot and restore /var/snap during the tests
+ - overlord: add base->base remodel undo tests and fixes
+ - seed: test and improve Core 20 seed handling errors
+ - asserts: add "snapd" type to valid types in the model assertion
+ - snap-bootstrap: check gadget versus disk partitions
+ - devicestate: add support for gadget->gadget remodel
+ - snap/snapenv: preserve XDG_RUNTIME_DIR for classic confinement
+ - daemon: parse and reject invalid channels in snap ops
+ - overlord: add kernel remodel undo tests and fix undo
+ - cmd/snap: support (but warn) using deprecated multi-slash channel
+ - overlord: refactor mgrsSuite and extract kernelSuite
+ - tests/docker-smoke: add minimal docker smoke test
+ - interfaces: extend the fwupd slot to be implicit on classic
+ - cmd/snap: make 'snap list' shorten latest/$RISK to $RISK
+ - tests: fix for journalctl which is failing to restart
+ - cmd/snap,image: initial support for Core 20 in prepare-image with
+   test
+ - cmd/snap-confine: add support for parallel instances of classic
+   snaps, global mount ns initialization
+ - overlord: add kernel rollback across reboots manager test and
+   fixes
+ - o/devicestate: the basics of Core 20 firstboot support with test
+ - asserts: support and parsing for slots-per-plug/plugs-per-slotSee
+   https://forum.snapcraft.io/t/plug-slot-declaration-rules-greedy-
+   plugs/12438
+ - parts/plugins: don't xz-compress a deb we're going to discard
+ - cmd/snap: make completion skip hidden commands (unless overridden)
+ - many: load/consume Core 20 seeds (aka recovery systems)
+ - tests: add netplan test on ubuntu core
+ - seed/internal: doc comment fix and drop handled TODOs
+ - o/ifacestate: unify code into
+   autoConnectChecker.addAutoConnectionsneed to change to support
+   slots-per-plugs: *
+ - many: changes to testing in preparation of Core 20 seed consuming
+   code
+ - snapstate,devicestate: make OldModel() available in DeviceContext
+ - tests: opensuse tumbleweed has similar issue than arch linux with
+   snap --strace
+ - client,daemon: pass sha3-384 in /v2/download to the client
+ - builtin/browser_support.go: allow monitoring process memory
+   utilization (used by chromium)
+ - overlord/ifacestate: use SetupMany in setupSecurityByBackend
+ - tests: add 14.04 canonical-livepatch test
+ - snap: make `snap known --remote` use snapd if available
+ - seed: share auxInfo20 and makeSystemSnap via internal
+ - spread: disable secondary compression for deltas
+ - interfaces/content: workaround for renamed target
+ - tests/lib/gendevmodel: helper tool for generating developer model
+   assertions
+ - tests: tweak wording in mount-ns test
+ - tests: don't depend on GNU time
+ - o/snapstate, etc: SnapState.Channel -> TrackingChannel, and a
+   setter
+ - seed/seedwriter: support writing Core 20 seeds (aka recovery
+   systems)
+ - snap-recovery: rename to "snap-bootstrap"
+ - managers: add remodel undo test for new required snaps case
+ - client: add xerrors and wrap errors coming from "client"
+ - tests: verify host is not affected by mount-ns tests
+ - tests: configure the journald service for core systems
+ - cmd/snap, store: include snapcraft.io page URL in snap info output
+ - cmd/cmdutil: version helper
+ - spread: enable bboozzoo/snapd-devel-deps COPR repo for getting
+   golang-x-xerrors
+ - interfaces: simplify AddUpdateNS and emit
+ - interfaces/policy: expand cstrs/cstrs1 to
+   altConstraints/constraints
+ - overlord/devicestate: check snap handler for gadget remodel
+   compatibility
+ - snap-recovery: deploy gadget content when creating partitions
+ - gadget: skip structures with MBR role during remodel
+ - tests: do not use lsblk in uc20-snap-recovery test
+ - overlord/snapstate: add LastActiveDisabledServices,
+   missingDisabledServices
+ - overlord/devicestate: refactor and split into per-functionality
+   files, drop dead code
+ - tests: update mount-ns after addition of /etc/systemd/user
+ - interfaces/pulseaudio: adjust to manually connect by default
+ - interfaces/u2f-devices: add OnlyKey to devices list
+ - interfaces: emit update-ns snippets to function
+ - interfaces/net-setup-{observe,control}: add Info D-Bus method
+   accesses
+ - tests: moving ubuntu-19.10-64 from google-unstable to google
+   backend
+ - gadget: rename existing and add new helpers for checking
+   filesystem/partition presence
+ - gadget, overlord/devicestate: add support for customized update
+   policy, add remodel policy
+ - snap-recovery: create filesystems as defined in the gadget
+ - tests: ignore directories for go modules
+ - policy: implement CanRemove policy for the snapd type
+ - overlord/snapstate: skip catalog refresh if unseeded
+ - strutil: add OrderedSet
+ - snap-recovery: add minimal binary so that we can use spread on it
+ - gadget, snap/pack: perform extended validation of gadget metadata
+   and contents
+ - timeutil: fix schedules with ambiguous nth weekday spans
+ - interfaces/many: allow k8s/systemd-run to mount volume subPaths
+   plus cleanups
+ - client: add KnownOptions to Know() and support remote assertions
+ - tests: check the apparmor_parser when the file exists on snap-
+   confine test
+ - gadget: helper for volume compatibility checks
+ - tests: update snap logs to match for multiple lines for "running"
+ - overlord: add checks for bootvars in
+   TestRemodelSwitchToDifferentKernel
+ - snap-install: add ext4,vfat creation support
+ - snap-recovery: remove "usedPartitions" from sfdisk.Create()
+ - image,seed: hide Seed16/Snap16, use seed.Open in image_test.go
+ - cmd/snap: Sort tasks in snap debug timings output by lanes and
+   ready-time.
+ - snap-confine.apparmor.in: harden pivot_root until we have full
+   mediation
+ - gadget: refactor ensureVolumeConsistency
+ - gadget: add a public helper for parsing gadget metadata
+ - many: address issues related to explicit/implicit channels for
+   image building
+ - overlord/many: switch order of check snap parameters
+ - cmd/snap-confine: remove leftover condition from capability world
+ - overlord: set fake serial in TestRemodelSwitchToDifferentKernel
+ - overlord/many: extend check snap callback to take snap container
+ - recovery-tool: add sfdisk wrapper
+ - tests: launch the lxd images following the pattern
+   ubuntu:${VERSION_ID}
+ - sandbox/cgroup: move freeze/thaw code
+ - gadget: accept system-seed role and ubuntu-data label
+ - test/lib/names.sh: make backslash escaping explicit
+ - spread: generate delta when using google backend
+ - cmd/snap-confine: remove loads of dead code
+ - boot,dirs,image: various refinements in the prepare-image code
+   switched to seedwriter
+ - spread: include mounts list in task debug output
+ - .gitignore: pair of trivial changes
+ - image,seed/seedwriter: switch image to use seedwriter.Writer
+ - asserts: introduce explicit support for grade for Core 20 models
+ - usersession: drive by fixes for things flagged by unused or
+   gosimple
+ - spread.yaml: exclude vendor dir
+ - sandbox/cgroup, overlord/snapstate: move helper for listing pids
+   in group to the cgroup package
+ - sandbox/cgroup: refactor process cgroup helper to support v2 and
+   named hierarchies
+ - snap-repair: error if run as non-root
+ - snap: when running `snap repair` without arguments, show hint
+ - interfaces: add cgroup-version to system-key
+ - snap-repair: add missing check in TestRepairBasicRun
+ - tests: use `snap model` instead of `snap known model` in tests
+ - daemon: make /v2/download take snapRevisionOptions
+ - snap-repair: add additional comment about trust in runner.Verify()
+ - client: add support to use the new "download" API
+ - interfaces: bump system-key version (and keep on bumping)
+ - interfaces/mount: account for cgroup version when reporting
+   supported features
+ - tests: change regex to validate access to cdn during snap
+   download
+ - daemon: change /v2/download API to take "snap-name" as input
+ - release: make forced dev mode look at cgroupv2 support
+ - seed/seedwriter: support for extra snaps
+ - wrappers/services.go: add disabled svc list arg to AddSnapServices
+ - overlord/snapstate: add SetTaskSnapSetup helper + unit tests
+ - cmd/libsnap: use cgroup.procs instead of tasks
+ - tests: fix snapd-failover test for core18 tests on boards
+ - overlord/snapstate/policy, etc: introduce policy, move canRemove
+   to it
+ - seed/seedwriter: cleanups and small left over todos* drive-by: use
+   testutil.FilePresent consistently
+ - cmd/snap: update 'snap find' help because it's no longer narrow
+ - seed/seedwriter,snap/naming: support classic models
+ - cmd/snap-confine: unmount /writable from snap view
+ - spread.yaml: exclude automake cacheThe error message is looks like
+   this:dpkg-source: info: local changes detected, the modified files
+   are:
+ - interfaces/openvswitch: allow access to other openvswitch sockets
+ - cmd/model: don't show model with display-name inline w/ opts
+ - daemon: add a 'prune' debug action
+ - client: add doTimeout to http.Client{Timeout}
+ - interfaces/seccomp: query apparmor sandbox helper rather than
+   aggregate info
+ - sandbox/cgroup: avoid dependency on dirs
+ - seed/seedwriter,snap: support local snaps
+ - overlord/snapstate: fix undo on firstboot seeding.
+ - usersession: track connections to session agent for exit on idle
+   and peer credential checks
+ - tests: fix ubuntu-core-device-reg test for arm devices on core18
+ - sandbox/seccomp: move the remaining sandbox bits to a
+   corresponding sandbox package
+ - osutil: generalize SyncDir with FileState interface
+ - daemon, client, cmd/snap: include architecture in 'snap version'
+ - daemon: allow /v2/assertions/{assertType} to query store
+ - gadget: do not fail the update when old gadget snap is missing
+   bare content
+ - sandbox/selinux: move SELinux related bits from 'release' to
+   'sandbox/selinux'
+ - tests: add unit test for gadget defaults with a multiline string
+ - overlord/snapstate: have more context in the errors about
+   prerequisites
+ - httputil: set user agent for CONNECT
+ - seed/seedwriter: resolve channels using channel.Resolve* for snaps
+ - run-checks: allow overriding gofmt binary, show gofmt diff
+ - asserts,seed/seedwriter: follow snap type sorting in the model
+   assertion snap listings
+ - daemon: return "snapname_rev.snap" style when using /v2/download
+ - tests: when the backend is external skip the loop waiting for snap
+   version
+ - many: move AppArmor probing code under sandbox/apparmor
+ - cmd: add `snap debug boot-vars` that dumps the current bootvars
+ - tests: skip the ubuntu-core-upgrade on arm devices on core18
+ - seed/seedwriter: implement WriteMeta and tree16 corresponding code
+ - interfaces/docker-support,kubernetes-support: misc updates for
+   strict k8s
+ - tests: restart the journald service while preparing the test
+ - tests/cmd/debug_state: make the test output TZ independent
+ - interfaces/kubernetes-support: allow use of /run/flannel
+ - seed/seedwriter: start of Writer and internal policy16/tree16
+ - sandbox/cgroup, usersession/userd: move cgroup related helper to a
+   dedicated package
+ - tests: move "centos-7" to unstable systems
+ - snapstate: add missing tests for checkGadgetOrKernel
+ - docs: Update README.md
+ - snapcraft: set license to GPL-3.0
+ - interfaces/wayland: allow a confined server running in a user
+   session to work with Qt, GTK3 & SDL2 clients
+ - selinux: move the package under sandbox/selinux
+ - interfaces/udev: account for cgroup version when reporting
+   supported features
+ - store, ..., client: add a "website" field
+ - sanity: sanity check cgroup probing
+ - snapstate: increase settleTimeout in
+   TestRemodelSwitchToDifferentKernel
+ - packaging: remove obsolete usr.lib.snapd.snap-confine in postinst
+ - data/selinux: allow snapd/snap to do statfs() on the cgroup
+   mountpoint
+ - usersession/userd: make sure to export DBus interfaces before
+   requesting a name
+ - data/selinux: allow snapd to issue sigkill to journalctl
+ - docs: Add Code of Conduct
+ - store: download propagates options to delta download
+ - tests/main/listing: account for dots in ~pre suffix
+
+* Fri Dec 06 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.42.5
+ - snap-confine: revert, with comment, explicit unix deny for nested
+   lxd
+ - Disable mount-ns test on 16.04. It is too flaky currently.
+
+* Thu Nov 28 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.42.4
+ - overlord/snapstate: make sure configuration defaults are applied
+   only once
+
+* Wed Nov 27 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.42.3
+ - overlord/snapstate: pick up system defaults when seeding the snapd
+   snap
+ - cmd/snap-update-ns: fix overlapping, nested writable mimic
+   handling
+ - interfaces: misc updates for u2f-devices, browser-support,
+   hardware-observe, et al
+ - tests: reset failing "fwupd-refresh.service" if needed
+ - tests/main/gadget-update-pc: use a program to modify gadget yaml
+ - snap-confine: suppress noisy classic snap file_inherit denials
+
+* Wed Nov 20 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.42.2
+ - interfaces/lxd-support: Fix on core18
+ - tests/main/system-usernames: Amazon Linux 2 comes with libseccomp
+   2.4.1 now
+ - snap-seccomp: add missing clock_getres_time64
+ - cmd/snap-seccomp/syscalls: update the list of known
+   syscalls
+ - sandbox/seccomp: accept build ID generated by Go toolchain
+ - interfaces: allow access to ovs bridge sockets
+
+* Wed Oct 30 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.42.1
+ - interfaces: de-duplicate emitted update-ns profiles
+ - packaging: tweak handling of usr.lib.snapd.snap-confine
+ - interfaces: allow introspecting network-manager on core
+ - tests/main/interfaces-contacts-service: disable on openSUSE
+   Tumbleweed
+ - tests/lib/lxd-snapfuse: restore mount changes introduced by LXD
+ - snap: fix default-provider in seed validation
+ - tests: update system-usernames test now that opensuse-15.1 works
+ - overlord: set fake sertial in TestRemodelSwitchToDifferentKernel
+ - gadget: rename "boot{select,img}" -> system-boot-{select,image}
+ - tests: listing test, make accepted snapd/core versions consistent
+
+* Tue Oct 01 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.42
+ - tests: disable {contacts,calendar}-service tests on debian-sid
+ - tests/main/snap-run: disable strace test cases on Arch
+ - cmd/system-shutdown: include correct prototype for die
+ - snap/naming: add test for hook name connect-plug-i2c
+ - cmd/snap-confine: allow digits in hook names
+ - gadget: do not fail the update when old gadget snap is missing
+   bare content
+ - tests: disable {contacts,calendar}-service tests on Arch Linux
+ - tests: move "centos-7" to unstable systems
+ - interfaces/docker-support,kubernetes-support: misc updates for
+   strict k8s
+ - packaging: remove obsolete usr.lib.snapd.snap-confine in
+   postinst
+ - tests: add test that ensures our snapfuse binary actually works
+ - packaging: use snapfuse_ll to speed up snapfuse performance
+ - usersession/userd: make sure to export DBus interfaces before
+   requesting a name
+ - data/selinux: allow snapd to issue sigkill to journalctl
+ - store: download propagates options to delta download
+ - wrappers: allow snaps to install icon theme icons
+ - debug: state-inspect debugging utility
+ - sandbox/cgroup: introduce cgroup wrappers package
+ - snap-confine: fix return value checks for udev functions
+ - cmd/model: output tweaks, add'l tests
+ - wrappers/services: add ServicesEnableState + unit tests
+ - tests: fix newline and wrong test name pointed out in previous PRs
+ - tests: extend mount-ns test to handle mimics
+ - run-checks, tests/main/go: allow gofmt checks to be skipped on
+   19.10
+ - tests/main/interfaces-{calendar,contacts}-service: disable on
+   19.10
+ - tests: part3 making tests work on ubuntu-core-18
+ - tests: fix interfaces-timeserver-control on 19.10
+ - overlord/snapstate: config revision code cleanup and extra tests
+ - devicestate: allow remodel to different kernels
+ - overlord,daemon: adjust startup timeout via EXTEND_TIMEOUT_USEC
+   using an estimate
+ - tests/main/many: increase kill-timeout to 5m
+ - interfaces/kubernetes-support: allow systemd-run to ptrace read
+   unconfined
+ - snapstate: auto transition on experimental.snapd-snap=true
+ - tests: retry checking until the written file on desktop-portal-
+   filechooser
+ - tests: unit test for a refresh failing on configure hook
+ - tests: remove mount_id and parent_id from mount-ns test data
+ - tests: move classic-ubuntu-core-transition* to nightly
+ - tests/mountinfo-tool: proper formatting of opt_fields
+ - overlord/configstate: special-case "null" in transaction Changes()
+ - snap-confine: fallback gracefully on a cgroup v2 only system
+ - tests: debian sid now ships new seccomp, adjust tests
+ - tests: explicitly restore after using LXD
+ - snapstate: make progress reporting less granular
+ - bootloader: little kernel support
+ - fixme: rename ubuntu*architectures to dpkg*architectures
+ - tests: run dbus-launch inside a systemd unit
+ - channel: introduce Resolve and ResolveLocked
+ - tests: run failing tests on ubuntu eoan due to is now set as
+   unstable
+ - systemd: detach rather than unmount .mount units
+ - cmd/snap-confine: add unit tests for sc_invocation, cleanup memory
+   leaks in tests
+ - boot,dirs,image: introduce boot.MakeBootable, use it in image
+   instead of ad hoc code
+ - cmd/snap-update-ns: clarify sharing comment
+ - tests/overlord/snapstate: refactor for cleaner test failures
+ - cmd/snap-update-ns: don't propagate detaching changes
+ - interfaces: allow reading mutter Xauthority file
+ - cmd/snap-confine: fix /snap duplication in legacy mode
+ - tests: fix mountinfo-tool filtering when used with rewriting
+ - seed,image,o/devicestate: extract seed loading to seed/seed16.go
+ - many: pass the rootdir and options to bootloader.Find
+ - tests: part5 making tests work on ubuntu-core-18
+ - cmd/snap-confine: keep track of snap instance name and the snap
+   name
+ - cmd: unify die() across C programs
+ - tests: add functions to make an abstraction for the snaps
+ - packaging/fedora, tests/lib/prepare-restore: helper tool for
+   packing sources for RPM
+ - cmd/snap: improve help and error msg for snapshot commands
+ - hookstate/ctlcmd: fix snapctl set help message
+ - cmd/snap: don't append / to snap name just because a dir exists
+ - tests: support fastly-global.cdn.snapcraft.io url on proxy-no-core
+   test
+ - tests: add --quiet switch to retry-tool
+ - tests: add unstable stage for travis execution
+ - tests: disable interfaces-timeserver-control on 19.10
+ - tests: don't guess in is_classic_confinement_supported
+ - boot, etc: simplify BootParticipant (etc) usage
+ - tests: verify retry-tool not retrying missing commands
+ - tests: rewrite "retry" command as retry-tool
+ - tests: move debug section after restore
+ - cmd/libsnap-confine-private, cmd/s-c: use constants for
+   snap/instance name lengths
+ - tests: measure behavior of the device cgroup
+ - boot, bootloader, o/devicestate: boot env manip goes in boot
+ - tests: enabling ubuntu 19.10-64 on spread.yaml
+ - tests: fix ephemeral mount table in left over by prepare
+ - tests: add version-tool for comparing versions
+ - cmd/libsnap: make feature flag enum 1<<N style
+ - many: refactor boot/boottest and move to bootloader/bootloadertest
+ - tests/cross/go-build: use go list rather than shell trickery
+ - HACKING.md: clarify where "make fmt" is needed
+ - osutil: make flock test more robust
+ - features, overlord: make parallel-installs exported, export flags
+   on startup
+ - overlord/devicestate:  support the device service returning a
+   stream of assertions
+ - many: add snap model command, add /v2/model, /v2/model/serial REST
+   APIs
+ - debian: set GOCACHE dir during build to fix FTBFS on eoan
+ - boot, etc.: refactor boot to have a lookup with different imps
+ - many: add the start of Core 20 extensions support to the model
+   assertion
+ - overlord/snapstate: revert track-risk behavior change and
+   validation on install
+ - cmd/snap,image,seed:  move image.ValidateSeed to
+   seed.ValidateFromYaml
+ - image,o/devicestate,seed: oops, make sure to clear seedtest
+   helpers
+ - tests/main/snap-info: update check.py for test-snapd-tools 2.0
+ - tests: moving tests to nightly suite
+ - overlord/devicestate,seed:  small step, introduce
+   seed.LoadAssertions and use it from firstboot
+ - snapstate: add comment to checkVersion vs strutil.VersionCompare
+ - tests: add unit tests for cmd_whoami
+ - tests: add debug section to interfaces-contacts-service
+ - many: introduce package seed and seedtest
+ - interfaces/bluez: enable communication between bluetoothd and
+   meshd via dbus
+ - cmd/snap: fix snap switch message
+ - overlord/snapstate: check channel names on install
+ - tests: check snap_daemon user and group on system-usernames-
+   illegal test are not created
+ - cmd/snap-confine: fix group and permission of .info files
+ - gadget: do not error on gadget refreshes with multiple volumes
+ - snap: use deterministic paths to find the built deb
+ - tests: just build snapd commands on go-build test
+ - tests: re-enable mount-ns test on classic
+ - tests: rename fuse_support to fuse-support
+ - tests: move restore-project-each code to existing function
+ - tests: simplify interfaces-account-control test
+ - i18n, vendor, packaging: drop github.com/ojii/gettext.go, use
+   github.com/snapcore/go-gettext
+ - tests: always say 'restore: |'
+ - tests: new test to check the output after refreshing/reverting
+   core
+ - snapstate: validate all system-usernames before creating them
+ - tests: fix system version check on listing test for external
+   backend
+ - tests: add check for snap_daemon user/group
+ - tests: don't look for lxcfs in mountinfo
+ - tests: adding support for arm devices on ubuntu-core-device-reg
+   test
+ - snap: explicitly forbid trying to parallel install from seed
+ - tests: remove trailing spaces from shell scripts
+ - tests: remove locally installed revisions of core
+ - tests: fix removal of snaps on ubuntu-core
+ - interfaces: support Tegra display drivers
+ - tests: move interfaces-contacts-service to /tmp
+ - interfaces/network-manager: allow using
+   org.freedesktop.DBus.ObjectManager
+ - tests: restore dpkg selections after upgrade-from-2.15 test
+ - tests: pass --remove to userdel on core
+ - snap/naming: simplify SnapSet somewhat
+ - devicestate/firstboot: check for missing bases early
+ - httputil: rework protocol error detection
+ - tests: unmount fuse connections only if not initially mounted
+ - snap: prevent duplicated snap name and snap files when parsing
+   seed.yaml
+ - tests: re-implement user tool in python
+ - image: improve/tweak some warning/error messages
+ - cmd/libsnap-confine-private: add checks for parallel instances
+   feature flag
+ - tests: wait_for_service shows status after actual first minute
+ - sanity: report proper errror when fuse is needed but not available
+ - snap/naming: introduce SnapRef, Snap, and SnapSet
+ - image: support prepare-image --classic for snapd snap only
+   imagesConsequently:
+ - tests/main/mount-ns: account for clone_children in cpuset cgroup
+   on 18.04
+ - many:  merging asserts.Batch Precheck with CommitTo and other
+   clarifications
+ - devicestate: add missing test for remodeling possibly removing
+   required flag
+ - tests: use user-tool to remove test user in the non-home test
+ - overlord/configstate: sort patch keys to have deterministic order
+   with snap set
+ - many: generalize assertstate.Batch to asserts.Batch, have
+   assertstate.AddBatch
+ - gadget, overlord/devicestate: rename Position/Layout
+ - store, image, cmd: make 'snap download' leave partials
+ - httputil: improve http2 PROTOCOL_ERROR detection
+ - tests: add new "user-tool" helper and use in system-user tests
+ - tests: clean up after NFS tests
+ - ifacestate: optimize auto-connect by setting profiles once after
+   all connects
+ - hookstate/ctlcmd: snapctl unset command
+ - tests: allow test user XDG_RUNTIME_DIR to phase out
+ - tests: cleanup "snap_daemon" user in system-usernames-install-
+   twice
+ - cmd/snap-mgmt: set +x on startup
+ - interfaces/wayland,x11: allow reading an Xwayland Xauth file
+ - many: move channel parsing to snap/channel
+ - check-pr-title.py: allow {} in pr prefix
+ - tests: spam test logs less while waiting for systemd unit to stop
+ - tests: remove redundant activation check for snapd.socket
+   snapd.service
+ - tests: trivial snapctl test cleanup
+ - tests: ubuntu 18.10 removed from the google-sru backend on the
+   spread.yaml
+ - tests: add new cases into arch_test
+ - tests: clean user and group for test system-usernames-install-
+   twice
+ - interfaces: k8s worker node updates
+ - asserts: move Model to its own model.go
+ - tests: unmount binfmt_misc on cleanup
+ - tests: restore nsdelegate clobbered by LXD
+ - cmd/snap: fix snap unset help string
+ - tests: unmount fusectl after testing
+ - cmd/snap: fix remote snap info for parallel installed snaps
+
+* Fri Aug 30 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.41
+ - overlord/snapstate: revert track-risk behavior
+ - tests: fix snap info test
+ - httputil: rework protocol error detection
+ - gadget: do not error on gadget refreshes with multiple volumes
+ - i18n, vendor, packaging: drop github.com/ojii/gettext.go, use
+   github.com/snapcore/go-gettext
+ - snapstate: validate all system-usernames before creating them
+ - mkversion.sh: fix version from git checkouts
+ - interfaces/network-{control,manager}: allow 'k' on
+   /run/resolvconf/**
+ - interfaces/wayland,x11: allow reading an Xwayland Xauth file
+ - interfaces: k8s worker node updates
+ - debian: re-enable systemd environment generator
+ - many: create system-usernames user/group if both don't exist
+ - packaging: fix symlink for snapd.session-agent.socket
+ - tests: change cgroups so that LXD doesn't have to
+ - interfaces/network-setup-control: allow dbus netplan apply
+   messages
+ - tests: add /var/cache/snapd to the snapd state to prevent error on
+   the store
+ - tests: add test for services disabled during refresh hook
+ - many: simpler access to snap-seccomp version-info
+ - snap: cleanup some tests, clarify some errorsThis is a follow up
+   from work on system usernames:
+ - osutil: add osutil.Find{Uid,Gid}
+ - tests: use a different archive based on the spread backend on go-
+   build test
+ - cmd/snap-update-ns: fix pair of bugs affecting refresh of snap
+   with layouts
+ - overlord/devicestate: detect clashing concurrent (ongoing, just
+   finished) remodels or changes
+ - interfaces/docker-support: declare controls-device-cgroup
+ - packaging: fix removal of old apparmor profile
+ - store: use track/risk for "channel" name when parsing store
+   details
+ - many: allow 'system-usernames' with libseccomp > 2.4 and golang-
+   seccomp > 0.9.0
+ - overlord/devicestate, tests: use gadget.Update() proper, spread
+   test
+ - overlord/configstate/configcore: allow setting start_x=1 to enable
+   CSI camera on RPi
+ - interfaces: remove BeforePrepareSlot from commonInterface
+ - many: support system-usernames for 'snap_daemon' user
+ - overlord/devicestate,o/snapstate: queue service commands before
+   mark-seeded and other final tasks
+ - interfaces/mount: discard mount ns on backend Remove
+ - packaging/fedora: build on RHEL8
+ - overlord/devicestate: support seeding a classic system with the
+   snapd snap and no core
+ - interfaces: fix test failure in gpio_control_test
+ - interfaces, policy: remove sanitize helpers and use minimal policy
+   check
+ - packaging: use %systemd_user_* macros to enable session agent
+   socket according to presets
+ - snapstate, store: handle 429s on catalog refresh a little bit
+   better
+ - tests: part4 making tests work on ubuntu-core-18
+ - many: drop snap.ReadGadgetInfo wrapper
+ - xdgopenproxy: update test API to match upstream
+ - tests: show why sbuild failed
+ - data/selinux: allow mandb_t to search /var/lib/snapd
+ - tests: be less verbose when checking service status
+ - tests: set sbuild test as manual
+ - overlord: DeviceCtx must find the remodel context for a remodel
+   change
+ - tests: use snap info --verbose to check for base
+ - sanity: unmount squashfs with --lazy
+ - overlord/snapstate: keep current track if only risk is specified
+ - interfaces/firewall-control: support nft routing expressions and
+   device groups
+ - gadget: support for writing symlinks
+ - tests: mountinfo-tool fail if there are no matches
+ - tests: sync journal log before start the test
+ - cmd/snap, data/completion: improve completion for 'snap debug'
+ - httputil: retry for http2 PROTOCOL_ERROR
+ - Errata commit: pulseaudio still auto-connects on classic
+ - interfaces/misc: updates for k8s 1.15 (and greengrass test)
+ - tests: set GOTRACEBACK=1 when running tests
+ - cmd/libsnap: don't leak memory in sc_die_on_error
+ - tests: improve how the system is restored when the upgrade-
+   from-2.15 test fails
+ - interfaces/bluetooth-control: add udev rules for BT_chrdev devices
+ - interfaces: add audio-playback/audio-record and make pulseaudio
+   manually connect
+ - tests: split the sbuild test in 2 depending on the type of build
+ - interfaces: add an interface granting access to AppStream metadata
+ - gadget: ensure filesystem labels are unique
+ - usersession/agent: use background context when stopping the agent
+ - HACKING.md: update spread section, other updates
+ - data/selinux: allow snap-confine to read entries on nsfs
+ - tests: respect SPREAD_DEBUG_EACH on the main suite
+ - packaging/debian-sid: set GOCACHE to a known writable location
+ - interfaces: add gpio-control interface
+ - cmd/snap: use showDone helper with 'snap switch'
+ - gadget: effective structure role fallback, extra tests
+ - many: fix unit tests getting stuck
+ - tests: remove installed snap on restore
+ - daemon: do not modify test data in user suite
+ - data/selinux: allow read on sysfs
+ - packaging/debian: don't md5sum absent files
+ - tests: remove test-snapd-curl
+ - tests: remove test-snapd-snapctl-core18 in restore
+ - tests: remove installed snap in the restore section
+ - tests: remove installed test snap
+ - tests: correctly escape mount unit path
+ - cmd/Makefile.am: support building with the go snap
+ - tests: work around classic snap affecting the host
+ - tests: fix typo "current"
+ - overlord/assertstate: add Batch.Precheck to check for the full
+   validity of the batch before Commit
+ - tests: restore cpuset clone_children clobbered by lxd
+ - usersession: move userd package to usersession/userd
+ - tests: reformat and fix markdown in snapd-state.md
+ - gadget: select the right updater for given structure
+ - tests: show stderr only if it exists
+ - sessionagent: add a REST interface with socket activation
+ - tests: remove locally installed core in more tests
+ - tests: remove local revision of core
+ - packaging/debian-sid: use correct apparmor Depends for Debian
+ - packaging/debian-sid: merge debian upload changes back into master
+ - cmd/snap-repair: make sure the goroutine doesn't stick around on
+   timeout
+ - packaging/fedora: github.com/cheggaaa/pb is no longer used
+ - configstate/config: fix crash in purgeNulls
+ - boot, o/snapst, o/devicest: limit knowledge of boot vars to boot
+ - client,cmd/snap: stop depending on status/status-code in the JSON
+   responses in client
+ - tests: unmount leftover /run/netns
+ - tests: switch mount-ns test to manual
+ - overlord,daemon,cmd/snapd:  move expensive startup to dedicated
+   StartUp methods
+ - osutil: add EnsureTreeState helper
+ - tests: measure properties of various  mount namespaces
+ - tests: part2 making tests work on ubuntu-core-18
+ - interfaces/policy: minimal policy check for replacing
+   sanitizeReservedFor helpers (1/2)
+ - interfaces: add an interface that grants access to the PackageKit
+   service
+ - overlord/devicestate: update gadget update handlers and mocks
+ - tests: add mountinfo-tool --ref-x1000
+ - tests: remove lxd / lxcfs if pre-installed
+ - tests: removing support for ubuntu cosmic on spread test suite
+ - tests: don't leak /run/netns mount
+ - image: clean up the validateSuite
+ - bootloader: remove "Dir()" from Bootloader interface
+ - many: retry to reboot if snapd gets restarted before expected
+   reboot
+ - overlord: implement re-registration remodeling
+ - cmd: revert PR#6933 (tweak of GOMAXPROCS)
+ - cmd/snap: add snap unset command
+ - many: add Client-User-Agent to "SnapAction" install API call
+ - tests: first part making tests run on ubuntu-core-18
+ - hookstate/ctlcmd: support hidden commands in snapctl
+ - many: replace snapd snap name checks with type checks (3/4)
+ - overlord: mostly stop needing Kernel/CoreInfo, make GadgetInfo
+   consider a DeviceContext
+ - snapctl: handle unsetting of config options with "!"
+ - tests: move core migration snaps to tests/lib/snaps dir
+ - cmd/snap: handle unsetting of config options with "!"
+ - cmd/snap, etc: add health to 'snap list' and 'snap info'
+ - gadget: use struct field names when intializing data in mounted
+   updater unit tests
+ - cmd/snap-confine: bring /lib/firmware from the host
+ - snap: set snapd snap type (1/4)
+ - snap: add checks in validate-seed for missing base/default-
+   provider
+ - daemon: replace shutdownServer with net/http's native shutdown
+   support
+ - interfaces/builtin: add exec "/bin/runc" to docker-support
+ - gadget: mounted filesystem updater
+ - overlord/patch: simplify conditions for re-applying sublevel
+   patches for level 6
+ - seccomp/compiler: adjust test case names and comment for later
+   changes
+ - tests: fix error doing snap pack running failover test
+ - tests: don't preserve size= when rewriting mount tables
+ - tests: allow reordering of rewrite operations
+ - gadget: main update routine
+ - overlord/config: normalize nulls to support config unsetting
+   semantics
+ - snap-userd-autostart: don't list as a startup application on the
+   GUI
+ - tests: renumber snap revisions as seen via writable
+ - tests: change allocation for mount options
+ - tests: re-enable ns-re-associate test
+ - tests: mountinfo-tool allow many --refs
+ - overlord/devicestate: implement reregRemodelContext with the
+   essential re-registration logic
+ - tests: replace various numeric mount options
+ - gadget: filesystem image writer
+ - tests: add more unit tests for mountinfo-tool
+ - tests: introduce mountinfo-tool --ref feature
+ - tests: refactor mountinfo-tool rewrite state
+ - tests: allow renumbering mount namespace identifiers
+ - snap: refactor and explain layout blacklisting
+ - tests: renumber snap revisions as seen via hostfs
+ - daemon, interfaces, travis: workaround build ID with Go 1.9, use
+   1.9 for travis tests
+ - cmd/libsnap: add sc_error_init_{simple,api_misuse}
+ - gadget: make raw updater handle shifted structures
+ - tests/lib/nested: create WORK_DIR before accessing it
+ - cmd/libsnap: rename SC_LIBSNAP_ERROR to SC_LIBSNAP_DOMAIN
+ - cmd,tests: forcibly discard mount namespace when bases change
+ - many: introduce healthstate, run check-health
+   post-(install/refresh/try/revert)
+ - interfaces/optical-drive: add scsi-generic type 4 and 5 support
+ - cmd/snap-confine: exit from helper when parent dies
+
+* Fri Jul 12 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.40
+ - overlord/patch: simplify conditions for re-applying sublevel
+   patches for level 6
+ - cmd,tests: forcibly discard mount namespace when bases change
+ - cmd/snap-confine: handle device cgroup before pivot
+ - cmd/snap-apparmor-service: quit if there are no profiles
+ - cmd/snap, image: add --target-directory and --basename to 'snap
+   download'
+ - interfaces: add jack1 implicit classic interface
+ - interfaces: miscellaneous policy updates
+ - daemon: classic confinement is not supported on core
+ - interfaces: bluetooth-control: add mtk BT device node
+ - cmd/snap-seccomp: initial support for negative arguments with
+   uid/gid caching
+ - snap-confine: move seccomp load after permanent privilege drop
+ - tests: new profiler snap used to track cpu and memory for snapd
+   and snap commands
+ - debian: make maintainer scripts do nothing on powerpc
+ - gadget: mounted filesystem writer
+ - cmd/snap: use padded checkers for snapshot output
+ - bootloader: switch to bootloader_test style testing
+ - gadget: add a wrapper for generating partitioned images with
+   sfdisk
+ - tests/main/snap-seccomp-syscalls: add description
+ - tests: continue executing on errors either updating the repo db or
+   installing dependencies
+ - cmd/snap-seccomp/syscalls: add io_uring syscalls
+ - systemd: add InstanceMode enumeration to control which systemd
+   instance to control
+ - netutil: extract socket activation helpers from daemon package.
+ - interfaces: spi: update regex rules to accept spi nodes like
+   spidev12345.0
+ - gadget: fallback device lookup
+ - many: add strutil.ElliptLeft, use it for shortening cohorts
+ - wrappers: allow sockets under $XDG_RUNTIME_DIR
+ - gadget: add wrapper for creating and populating filesystems
+ - gadget: add writer for offset-write
+ - gadget: support relative symlinks in device lookup
+ - snap, snapstate: additional validation of base field
+ - many: fix some races and missing locking, make sure UDevMonitor is
+   stopped
+ - boot: move ExtractKernelAssets
+ - daemon, snap: screenshots _only_ shows the deprecation notice,
+   from 2.39
+ - osutil: add a workaround for overlayfs apparmor as it is used on
+   Manjaro
+ - snap: introduce GetType() function for snap.Info
+ - tests: update systems to be used for during sru validation
+ - daemon: increase `shutdownTimeout` to 25s to deal with slow
+   HW
+ - interfaces/network-manager: move deny ptrace to the connected slot
+ - interfaces: allow locking of pppd files
+ - cmd/snap-exec: fix snap completion for classic snaps with non
+   /usr/lib/snapd libexecdir
+ - daemon: expose pprof endpoints
+ - travis: disable snap pack on OSX
+ - client, cmd/snap: expose the new cohort options for snap ops
+ - overlord/snapstate: tweak switch summaries
+ - tests: reuse the image created initially for nested tests
+   execution
+ - tests/lib/nested: tweak assert disk prepare step
+ - daemon, overlord/snapstate: support leave-cohort
+ - tests/main/appstream-id: collect debug info
+ - store,daemon: add client-user-agent support to store.SnapInfo
+ - tests: add check for invalid PR titles in the static checks
+ - tests: add snap-tool for easier access to internal tools
+ - daemon: unexport file{Response,Stream}
+ - devicestate: make TestUpdateGadgetOnClassicErrorsOut less racy
+ - tests: fix test desktop-portal-filechooser
+ - tests: sort commands from DumpCommands in the dumpDbHook
+ - cmd/snap: add unit test for "advise-snap --dump-db".
+ - bootloader: remove extra mock bootloader implementation
+ - daemon: tweak for "add api endpoint for download" PR
+ - packaging: fix reproducible build error
+ - tests: synchronize journal logs before check logs
+ - tests: fix snap service watchdog test
+ - tests: use more readable test directory names
+ - tests/regression/lp-1805485: update test description
+ - overlord: make changes conflict with remodel
+ - tests: make sure the snapshot unit test uses a snapshot time
+   relative to Now()
+ - tests: revert "tests: stop catalog-update/apt-hooks test for now"
+ - tests: mountinfo-tool --one prints matches on failure
+ - data/selinux: fix policy for snaps with bases and classic snaps
+ - debian: fix building on eoan by tweaking golang build-deps
+ - packaging/debian-sid: update required golang version to 1.10
+ - httputil: handle "no such host" error explicitly and do not retry
+   it
+ - overlord/snapstate, & fallout: give Install a *RevisionOptions
+ - cmd/snap: don't run install on 'snap --help install'
+ - gadget: raw/bare structure writer and updater
+ - daemon, client, cmd/snap: show cohort key in snap info --verbose
+ - overlord/snapstate: add update-gadget task when needed, block
+   other changes
+ - image: turn a missing default content provider into an error
+ - overlord/devicestate: update-gadget-assets task handler with
+   stubbed gadget callbacks
+ - interface: builtin: avahi-observe/control: update label for
+   implicit slot
+ - tests/lib/nested: fix multi argument copy_remote
+ - tests/lib/nested: have mkfs.ext4 use a rootdir instead of mounting
+   an image
+ - packaging: fix permissions powerpc docs dir
+ - overlord: mock store to avoid net requests
+ - debian: rework how we run autopkgtests
+ - interface: builtin: avahi-observe/control: allow slots
+   implementation also by app snap on classic system
+ - interfaces: builtin: utils: add helper function to identify system
+   slots
+ - interfaces: add missing adjtimex to time-control
+ - overlord/snapstate, snap: support base = "none"
+ - daemon, overlord/snapstate: give RevisionOptions a CohortKey
+ - data/selinux: permit init_t to remount snappy_snap_t
+ - cmd/snap: test for a friendly error on 'okay' without 'warnings'
+ - cmd/snap: support snap debug timings --startup=.. and measure
+   loadState time
+ - advise-snap: add --dump-db which dumps the command database
+ - interfaces/docker-support: support overlayfs on ubuntu core
+ - cmd/okay: Remove err message when warning file not exist
+ - devicestate: disallow removal of snaps used in booting early
+ - packaging: fix build-depends on powerpc
+ - tests: run spread tests on opensuse leap 15.1
+ - strutil/shlex: fix ineffassign
+ - cmd/snapd: ensure GOMAXPROCS is at least 2
+ - cmd/snap-update-ns: detach unused mount points
+ - gadget: record gadget root directory used during positioning
+ - tests: force removal to prevent restore fails when directory
+   doesn't exist on lp-1801955 test
+ - overlord: implement store switch remodeling
+ - tests: stop using ! for naive negation in shell scripts
+ - snap,store,daemon,client: send new "Snap-Client-User-Agent" header
+   in Search()
+ - osutil: now that we require golang-1.10, use user.LookupGroup()
+ - spread.yaml,tests: change MATCH and REBOOT to cmds
+ - packaging/fedora: force external linker to ensure static linking
+   and -extldflags use
+ - timings: tweak the conditional for ensure timings
+ - timings: always store ensure timings as long as they have an
+   associated change
+ - cmd/snap: tweak the output of snap debug timings --ensure=...
+ - overlord/devicestate: introduce remodel kinds and
+   contextsregistrationContext:
+ - snaptest: add helper for mocking snap with contents
+ - snapstate: allow removal of non-model kernels
+ - tests: change strace parameters on snap-run test to avoid the test
+   gets stuck
+ - gadget: keep track of the index where structure content was
+   defined
+ - cmd/snap-update-ns: rename leftover ctx to upCtx
+ - tests: add "not" command
+ - spread.yaml: use "snap connections" in debug
+ - tests: fix how strings are matched on auto-refresh-retry test
+ - spread-shellcheck: add support for variants and environment
+ - gadget: helper for shifting structure start position
+ - cmd/snap-update-ns: add several TODO comments
+ - cmd/snap-update-ns: rename ctx to upCtx
+ - spread.yaml: make HOST: usage shellcheck-clean
+ - overlord/snapstate, daemon: snapstate.Switch now takes a
+   RevisionOption
+ - tests: add mountinfo-tool
+ - many: make snapstate.Update take *RevisionOptions instead of chan,
+   rev
+ - tests/unit/spread-shellcheck: temporary workaround for SC2251
+ - daemon: refactor user ops to api_users
+ - cmd/snap, tests: refactor info to unify handling of 'direct' snaps
+ - cmd/snap-confine: combine sc_make_slave_mount_ns into caller
+ - cmd/snap-update-ns: use "none" for propagation changes
+ - cmd/snap-confine: don't pass MS_SLAVE along with MS_BIND
+ - cmd/snap, api, snapstate: implement "snap remove --purge"
+ - tests: new hotplug test executed on ubuntu core
+ - tests: running tests on fedora 30
+ - gadget: offset-write: fix validation, calculate absolute position
+ - data/selinux: allow snap-confine to do search on snappy_var_t
+   directories
+ - daemon, o/snapstate, store: support for installing from cohorts
+ - cmd/snap-confine: do not mount over non files/directories
+ - tests: validates snapd from ppa
+ - overlord/configstate: don't panic on invalid configuration
+ - gadget: improve device lookup, add helper for mount point lookup
+ - cmd/snap-update-ns: add tests for executeMountProfileUpdate
+ - overlord/hookstate: don't run handler unless hooksup.Always
+ - cmd/snap-update-ns: allow changing mount propagation
+ - systemd: workaround systemctl show quirks on older systemd
+   versions
+ - cmd/snap: allow option descriptions to start with the command
+ - many: introduce a gadget helper for locating device matching given
+   structure
+ - cmd/snap-update-ns: fix golint complaints about variable names
+ - cmd/snap: unit tests for debug timings
+ - testutil: support sharing-related mount flags
+ - packaging/fedora: Merge changes from Fedora Dist-Git and drop EOL
+   Fedora releases
+ - cmd/snap: support for --ensure argument for snap debug timings
+ - cmd,sandbox: tweak seccomp version info handling
+ - gadget: record sector size in positioned volume
+ - tests: make create-user test support managed devices
+ - packaging: build empty package on powerpc
+ - overlord/snapstate: perform hard refresh check
+ - gadget: add volume level update checks
+ - cmd/snap: mangle descriptions that have indent > terminal width
+ - cmd/snap-update-ns: rename applyFstab to executeMountProfileUpdate
+ - cmd/snap-confine: unshare per-user mount ns once
+ - tests: retry govendor sync
+ - tests: avoid removing snaps which are cached to speed up the
+   prepare on boards
+ - tests: fix how the base snap are deleted when there are multiple
+   to deleted on reset
+ - cmd/snap-update-ns: merge apply functions
+ - many: introduce assertstest.SigningAccounts and AddMany test
+   helpers
+ - interfaces: special-case "snapd" in sanitizeSlotReservedForOS*
+   helpers
+ - cmd/snap-update-ns: make apply{User,System}Fstab identical
+ - gadget: introduce checkers for sanitizing structure updates
+ - cmd/snap-update-ns: move apply{Profile,{User,System}Fstab} to same
+   file
+ - overlord/devicestate: introduce registrationContext
+ - cmd/snap-update-ns: add no-op load/save current user profile logic
+ - devicestate: set "new-model" on the remodel change
+ - devicestate: use deviceCtx in checkGadgetOrKernel
+ - many: use a fake assertion model in the device contexts for tests
+ - gadget: fix handling of positioning constrains for structures of
+   MBR role
+ - snap-confine: improve error when running on a not /home homedir
+ - devicestate: make Remodel() return a state.Change
+ - many: make which store to use contextualThis reworks
+   snapstate.Store instead of relying solely on DeviceContext,
+   because:
+ - tests: enable tests on centos 7 again
+ - interfaces: add login-session-control interface
+ - tests: extra debug for snapshot-basic test
+ - overlord,overlord/devicestate: do without GadgetInfo/KernelInfo in
+   devicestate
+ - gadget: more validation checks for legacy MBR structure type &
+   role
+ - osutil: fix TestReadBuildGo test in sbuild
+ - data: update XDG_DATA_DIRS via the systemd environment.d mechanism
+   too
+ - many: do without device state/assertions accessors based on state
+   only outside of devicestate/tests
+ - interfaces/dbus: fix unit tests when default snap mount dir is not
+   /snap
+ - tests: add security-seccomp to verify seccomp with arg filtering
+ - snapshotstate: disable automatic snapshots on core for now
+ - snapstate: auto-install snapd when needed
+ - overlord/ifacestate: update static attributes of "content"
+   interface
+ - interfaces: add support for the snapd snap in the dbus backend*
+ - overlord/snapstate: tweak autorefresh logic if network is not
+   available
+ - snapcraft: also include ld.so.conf from libc in the snapcraft.yml
+ - snapcraft.yaml: fix links ld-linux-x86-64.so.2/ld64.so.2
+ - overlord: pass a DeviceContext to the checkSnap implementations
+ - daemon: add RootOnly flag to commands
+ - many:  make access to the device model assertion etc contextual
+   via a DeviceCtx hook/DeviceContext interface
+ - snapcraft.yaml: include libc6 in snapd
+ - tests: reduce snapcraft leftovers from PROJECT_PATH,  temp disable
+   centos
+ - overlord: make the store context composably backed by separate
+   backends for device asserts/info etc.
+ - snapstate: revert "overlord/snapstate: remove PlugsOnly"
+ - osutil,cmdutil: move CommandFromCore and make it use the snapd
+   snap (if available)
+ - travis: bump Go version to 1.10.x
+ - cmd/snap-update-ns: remove instanceName argument from applyProfile
+ - gadget: embed volume in positioned volume, rename fields
+ - osutil: use go build-id when no gnu build-id is available
+ - snap-seccomp: add 4th field to version-info for golang-seccomp
+   features
+ - cmd/snap-update-ns: merge computeAndSaveSystemChanges into
+   applySystemFstab
+ - cmd/snap, client, daemon, store: create-cohort
+ - tests: give more time until nc returns on appstream test
+ - tests: run spread tests on ubuntu 19.04
+ - gadget: layout, smaller fixes
+ - overlord: update static attrs when reloading connections
+ - daemon: verify snap instructions for multi-snap requests
+ - overlord/corecfg: make expiration of automatic snapshots
+   configurable (4/4)
+ - cmd/snap-update-ns: pass MountProfileUpdate to
+   apply{System,User}Fstab
+ - snap: fix interface bindings on implicit hooks
+ - tests: improve how snaps are cached
+ - cmd/snap-update-ns: formatting tweaks
+ - data/selinux: policy tweaks
+ - cmd/snap-update-ns: move locking to the common layer
+ - overlord: use private YAML inside several tests
+ - cmd/snap, store, image: support for cohorts in "snap download"
+ - overlord/snapstate: add timings to critical task handlers and the
+   backend
+ - cmd: add `snap debug validate-seed <path>` cmd
+ - state: add possible error return to TaskSet.Edge()
+ - snap-seccomp: use username regex as defined in osutil/user.go
+ - osutil: make IsValidUsername public and fix regex
+ - store: serialize the acquisition of device sessions
+ - interfaces/builtin/desktop: fonconfig v6/v7 cache handling on
+   Fedora
+ - many: move Device/SetDevice to devicestate, start of making them
+   pluggable in storecontext
+ - overlord/snapstate: remove PlugsOnly
+ - interfaces/apparmor: allow running /usr/bin/od
+ - spread: add qemu:fedora-29-64
+ - tests: make test parallel-install-interfaces work for boards with
+   pre-installed snaps
+ - interfaces/builtin/intel_mei: fix /dev/mei* AppArmor pattern
+ - spread.yaml: add qemu:centos-7-64
+ - overlord/devicestate: extra measurements related to
+   populateStateFromSeed
+ - cmd/snap-update-ns: move Assumption to {System,User}ProfileUpdate
+ - cmd/libsnap: remove fringe error function
+ - gadget: add validation of cross structure overlap and offset
+   writes
+ - cmd/snap-update-ns: refactor of profile application (3/N)
+ - data/selinux: tweak the policy for runuser and s-c, interpret
+   audit entries
+ - tests: fix spaces issue in the base snaps names to remove during
+   reset phase
+ - tests: wait for man db cache is updated before after install snapd
+   on Fedora
+ - tests: extend timeout of sbuild test
+
+* Fri Jun 21 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.39.3
+  - daemon: increase `shutdownTimeout` to 25s to deal with slow HW
+  - spread: run tests against openSUSE 15.1
+  - data/selinux: fix policy for snaps with bases and classic snaps
+
+* Wed Jun 05 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.39.2
+ - debian: rework how we run autopkgtests
+ - interfaces/docker-support: add overlayfs accesses for ubuntu core
+ - data/selinux: permit init_t to remount snappy_snap_t
+ - strutil/shlex: fix ineffassign
+ - packaging: fix build-depends on powerpc
+
+* Wed May 29 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.39.1
+ - spread: enable Fedora 30
+ - cmd/snap-confine, data/selinux: cherry pick Fedora 30 fixes
+ - tests/unit/spread-shellcheck: temporary workaround for SC2251
+ - packaging: build empty package on powerpc
+ - interfaces: special-case "snapd" in sanitizeSlotReservedForOS*
+   helper
+ - cmd/snap: mangle descriptions that have indent > terminal width
+ - cmd/snap-confine: unshare per-user mount ns once
+ - tests: avoid adding spaces to the base snaps names
+ - systemd: workaround systemctl show quirks on older systemd
+   versions
+
+* Mon May 06 2019 Neal Gompa <ngompa13@gmail.com> - 2.39-1
+- Release 2.39 to Fedora (RH#1699087)
+- Enable basic SELinux integration
+- Fix changelog entry to fix build for EPEL 7
+- Exclude bash and POSIX sh shebangs from mangling (LP:1824158)
+- Drop some old pre Fedora 28 logic
+
+* Fri May 03 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.39
+ - overlord/ifacestate: update static attributes of "content"
+   interface
+ - data/selinux: tweak the policy for runuser and s-c, interpret
+   audit entries
+ - snapshotstate: disable automatic snapshots on core for now
+ - overlord/corecfg: make expiration of automatic snapshots
+   configurable
+ - snapstate: auto-install snapd when needed
+ - interfaces: add support for the snapd snap in the dbus backend
+ - overlord/snapstate: tweak autorefresh logic if network is not
+   available
+ - interfaces/apparmor: allow running /usr/bin/od
+ - osutil,cmdutil: move CommandFromCore and make it use the snapd
+   snap (if available)
+ - daemon: also verify snap instructions for multi-snap requests
+ - data/selinux: allow snap-confine to mount on top of bin
+ - data/selinux: auto transition /var/snap to snappy_var_t
+ - cmd: add `snap debug validate-seed <path>` cmd
+ - interfaces/builtin/desktop: fonconfig v6/v7 cache handling on
+   Fedora
+ - interfaces/builtin/intel_mei: fix /dev/mei* AppArmor pattern
+ - tests: make snap-connections test work on boards with snaps pre-
+   installed
+ - tests: check for /snap/core16/current in core16-provided-by-core
+ - tests: run livepatch test on 18.04 as well
+ - devicestate: deal correctly with the "required" flag on Remodel
+ - snapstate,state: add TaskSet.AddAllWithEdges() and use in doUpdate
+ - snapstate: add new NoReRefresh flag and use in Remodel()
+ - many: allow core as a fallback for core16
+ - snapcraft: build static fontconfig in the snapd snap
+ - cmd/snap-confine: remove unused sc_open_snap_{update,discard}_ns
+ - data/selinux: allow snapd to execute runuser under snappy_t
+ - spread, tests: do not leave mislabeled files in restorecon test,
+   attempt to catch similar files
+ - interfaces: cleanup internal tool lookup in system-key
+ - many: move auth.AuthContext to store.DeviceAndAuthContext, the
+   implemention to a separate storecontext packageThis:
+ - overlord/devicestate: measurements around ensure and related tasks
+ - cmd: tweak internal tool lookup to accept more possible locations
+ - overlord/snapstate,snapshotstate: create snapshot on snap removal
+ - tests: run smoke tests on (almost) pristine systems
+ - tests: system disable ssh for config defaults in gadget
+ - cmd/debug: integrate new task timings with "snap debug timings"
+ - tests/upgrade/basic, packaging/fedoar: restore SELinux context of
+   /var/cache/fontconfig, patch pre-2.39 mount units
+ - image: simplify prefer local logic  and fixes
+ - tests/main/selinux-lxd: make sure LXD from snaps works cleanly
+   with enforcing SELinux
+ - tests: deny ioctl - TIOCSTI with garbage in high bits
+ - overlord: factor out mocking of device service and gadget w.
+   prepare-device for registration tests
+ - data/selinux, tests/main/selinux-clean: fine tune the policy, make
+   sure that no denials are raised
+ - cmd/libsnap,osutil: fix parsing of mountinfo
+ - ubuntu: disable -buildmode=pie on armhf to fix memory issue
+ - overlord/snapstate: inhibit refresh for up to a week
+ - cmd/snap-confine: prevent cwd restore permission bypass
+ - overlord/ifacestate: introduce HotplugKey type use short key in
+   change summaries
+ - many: make Remodel() download everything first before installing
+ - tests: fixes discovered debugging refresh-app-awareness
+ - overlord/snapstate: track time of postponed refreshes
+ - snap-confine: set rootfs_dir in sc_invocation struct
+ - tests: run create-user on core devices
+ - boot: add flag file "meta/force-kernel-extraction"
+ - tests: add regression test for systemctl race fix
+ - overlord/snapshotstate: helpers for snapshot expirations
+ - overlord,tests: perform soft refresh check in doInstall
+ - tests: enable tests that write /etc/{hostname,timezone} on core18
+ - overlord/ifacestate: implement String() method of
+   HotplugDeviceInfo for better logs/messages
+ - cmd/snap-confine: move ubuntu-core fallback checks
+ - testutil: fix MockCmd for shellcheck 0.5
+ - snap, gadget: move gadget read/validation into separate package,
+   tweak naming
+ - tests: split travis spread execution in 2 jobs for ubuntu and non
+   ubuntu systems
+ - testutil: make mocked command work with shellcheck from snaps
+ - packaging/fedora, tests/upgrade/basic: patch existing mount units
+   with SELinux context on upgrade
+ - metautil, snap: extract yaml value normalization to a helper
+   package
+ - tests: use apt via eatmydata
+ - dirs,overlord/snapstate: add Soft and Hard refresh checks
+ - cmd/snap-confine: allow using tools from snapd snap
+ - cmd,interfaces: replace local helpers with cmd.InternalToolPath
+ - tweak: fix "make hack" on Fedora
+ - snap: add validation of gadget.yaml
+ - cmd/snap-update-ns: refactor of profile application
+ - cmd/snap,client,daemon,store: layout and sanity tweaks for
+   find/search options
+ - tests: add workaround for missing cache reset on older snapd
+ - interfaces: deal with the snapd snap correctly for apparmor 2.13
+ - release-tools: add debian-package-builder
+ - tests: enable opensuse 15 and add force-resolution installing
+   packages
+ - timings: AddTag helper
+ - testutil: run mocked commands through shellcheck
+ - overlord/snapshotstate: support auto flag
+ - client, daemon, store: search by common-id
+ - tests: all the systems for google backend with 6 workers
+ - interfaces: hotplug nested vm test, updated serial-port interface
+   for hotplug.
+ - sanity: use proper SELinux context when mounting squashfs
+ - cmd/libsnap: neuter variables in cleanup functions
+ - interfaces/adb-support: account for hubs on sysfs path
+ - interfaces/seccomp: regenerate changed profiles only
+ - snap: reject layouts to /lib/{firmware,modules}
+ - cmd/snap-confine, packaging: support SELinux
+ - selinux, systemd: support mount contexts for snap images
+ - interfaces/builtin/opengl: allow access to Tegra X1
+ - cmd/snap: make 'snap warnings' output yamlish
+ - tests: add check to detect a broken snap on reset
+ - interfaces: add one-plus devices to adb-support
+ - cmd: prevent umask from breaking snap-run chain
+ - tests/lib/pkgdb: allow downgrade when installing packages in
+   openSUSE
+ - cmd/snap-confine: use fixed private tmp directory
+ - snap: tweak parsing errors of gadget updates
+ - overlord/ifacemgr: basic measurements
+ - spread: refresh metadata on openSUSE
+ - cmd/snap-confine: pass sc_invocation instead of numerous args
+   around
+ - snap/gadget: introduce volume update info
+ - partition,bootloader: rename 'partition' package to 'bootloader'
+ - interfaces/builtin: add dev/pts/ptmx access to docker_support
+ - tests: restore sbuild test
+ - strutil: make SplitUnit public, allow negative numbers
+ - overlord/snapstate,: retry less for auto-stuff
+ - interfaces/builtin: add add exec "/" to docker-support
+ - cmd/snap: fix regression of snap saved command
+ - cmd/libsnap: rename C enum for feature flag
+ - cmd: typedef mountinfo structures
+ - tests/main/remodel: clean up before reverting the state
+ - cmd/snap-confine: umount scratch dir using UMOUNT_NOFOLLOW
+ - timings: add new helpers, Measurer interface and DurationThreshold
+ - cmd/snap-seccomp: version-info subcommand
+ - errortracker: fix panic in Report if db cannot be opened
+ - sandbox/seccomp: a helper package wrapping calls to snap-seccomp
+ - many: add /v2/model API, `snap remodel` CLI and spread test
+ - tests: enable opensuse tumbleweed back
+ - overlord/snapstate, store: set a header when auto-refreshing
+ - data/selinux, tests: refactor SELinux policy, add minimal tests
+ - spread: restore SELinux context when we mess with system files
+ - daemon/api: filter connections with hotplug-gone=true
+ - daemon: support returning assertion information as JSON with the
+   "json" query parameter
+ - cmd/snap: hide 'interfaces' command, show deprecation notice
+ - timings: base API for recording timings in state
+ - cmd/snap-confine: drop unused dependency on libseccomp
+ - interfaces/apparmor: factor out test boilerplate
+ - daemon: extract assertions api endpoint implementation into
+   api_asserts.go
+ - spread.yaml: bump delta reference
+ - cmd/snap-confine: track per-app and per-hook processes
+ - cmd/snap-confine: make sc_args helpers const-correct
+ - daemon: move a function that was between an other struct and its
+   methods
+ - overlord/snapstate: fix restoring of "old-current" revision config
+   in undoLinkSnap
+ - cmd/snap, client, daemon, ifacestate: show a leading attribute of
+   a connection
+ - cmd/snap-confine: call sc_should_use_normal_mode once
+ - cmd/snap-confine: populate enter_non_classic_execution_environment
+ - daemon: allow downloading snaps blobs via .../file
+ - cmd/snap-confine: introduce sc_invocation
+ - devicestate: add initial Remodel support
+ - snap: remove obsolete license-* fields in the yaml
+ - cmd/libsnap: add cgroup-pids-support module
+ - overlord/snapstate/backend: make LinkSnap clean up more
+ - snapstate: only keep 2 snaps on classic
+ - ctlcmd/tests: tests tweaks (followup to #6322)
+
+* Tue Apr 23 2019 Robert-André Mauchin <zebob.m@gmail.com> - 2.38-3
+- Rebuilt for fix in golang-github-seccomp-libseccomp-golang
+
+* Fri Apr 05 2019 Neal Gompa <ngompa13@gmail.com> - 2.38-2
+- Readd snapd-login-service Provides for gnome-software for F29 and older
+
+* Thu Mar 21 2019 Neal Gompa <ngompa13@gmail.com> - 2.38-1
+- Release 2.38 to Fedora (RH#1691296)
+- Switch to officially released main source tarball
+- Drop obsolete snapd-login-service Provides
+
+* Thu Mar 21 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.38
+ - overlord/snapstate,: retry less for auto-stuff
+ - cmd/snap: fix regression of snap saved command
+ - interfaces/builtin: add dev/pts/ptmx access to docker_support
+ - overlord/snapstate, store: set a header when auto-refreshing
+ - interfaces/builtin: add add exec "/" to docker-support
+ - cmd/snap, client, daemon, ifacestate: show a leading attribute of
+   a connection
+ - interface: avahi-observe: Fixing socket permissions on 4.15
+   kernels
+ - tests: check that apt works before using it
+ - apparmor: support AppArmor 2.13
+ - snapstate: restart into the snapd snap on classic
+ - overlord/snapstate: during refresh, re-refresh on epoch bump
+ - cmd, daemon: split out the common bits of mapLocal and mapRemote
+ - cmd/snap-confine: chown private /tmp to root.root
+ - cmd/snap-confine: drop uid from random /tmp name
+ - overlord/hookstate: apply pending transaction changes onto
+   temporary configuration for snapctl get
+ - cmd/snap: `snap connections` command
+ - interfaces/greengrass_support: update accesses for GGC 1.8
+ - cmd/snap, daemon: make the connectivity check use GET
+ - interfaces/builtin,/udev: add spec support to disable udev +
+   device cgroup and use it for greengrass
+ - interfaces/intel-mei: small follow up tweaks
+ - ifacestate/tests: fix/improve udev mon test
+ - interfaces: add multipass-support interface
+ - tests/main/high-user-handling: fix the test for Go 1.12
+ - interfaces: add new intel-mei interface
+ - systemd: decrease the checker counter before unlocking otherwise
+   we can get spurious panics
+ - daemon/tests: fix race in the disconnect conflict test
+ - cmd/snap-confine: allow moving tasks to pids cgroup
+ - tests: enable opensuse tumbleweed on spread
+ - cmd/snap: fix `snap services` completion
+ - ifacestate/hotplug: integration with udev monitor
+ - packaging: build snapctl as a static binary
+ - packaging/opensuse: move most logic to snapd.mk
+ - overlord: fix ensure before slowness on Retry
+ - overlord/ifacestate: fix migration of connections on upgrade from
+   ubuntu-core
+ - daemon, client, cmd/snap: debug GETs ask aspects, not actions
+ - tests/main/desktop-portal-*: fix handling of python dependencies
+ - interfaces/wayland: allow wayland server snaps function on classic
+   too
+ - daemon, client, cmd/snap: snap debug base-declaration
+ - tests: run tests on opensuse leap 15.0 instead of 42.3
+ - cmd/snap: fix error messages for snapshots commands if ID is not
+   uint
+ - interfaces/seccomp: increase filter precision
+ - interfaces/network-manager: no peer label check for hostname1
+ - tests: add a tests for xdg-desktop-portal integration
+ - tests: not checking 'tracking channel' after refresh core on
+   nested execution
+ - tests: remove snapweb from tests
+ - snap, wrappers: support StartTimeout
+ - wrappers: Add an X-SnapInstanceName field to desktop files
+ - cmd/snap: produce better output for help on subcommands
+ - tests/main/nfs-support: use archive mode for creating fstab backup
+ - many: collect time each task runs and display it with `snap debug
+   timings <id>`
+ - tests: add attribution to helper script
+ - daemon: make ucrednetGet not loop
+ - squashfs: unset SOURCE_DATE_EPOCH in the TestBuildDate test
+ - features,cmd/libsnap: add new feature "refresh-app-awareness"
+ - overlord: fix random typos
+ - interfaces/seccomp: generate global seccomp profile
+ - daemon/api: fix error case for disconnect conflict
+ - overlord/snapstate: add some randomness to the catalog refresh
+ - tests: disable trusty-proposed for now
+ - tests: fix upgrade-from-2.15 with kernel 4.15
+ - interfaces/apparmor: allow sending and receiving signals from
+   ourselves
+ - tests: split the test interfaces-many in 2 and remove snaps on
+   restore
+ - tests: use snap which takes 15 seconds to install on retryable-
+   error test
+ - packaging: avoid race in snapd.postinst
+ - overlord/snapstate: discard mount namespace when undoing 1st link
+   snap
+ - cmd/snap-confine: allow writes to /var/lib/**
+ - tests: stop catalog-update test for now
+ - tests/main/auto-refresh-private: make sure to actually download
+   with the expired macaroon
+ - many: save media info when installing, show it when listing
+ - userd: handle help urls which requires prepending XDG_DATA_DIRS
+ - tests: fix NFS home mocking
+ - tests: improve snaps-system-env test
+ - tests: pre-cache core on core18 systems
+ - interfaces/hotplug: renamed RequestedSlotSpec to ProposedSlot,
+   removed Specification
+ - debian: ensure leftover usr.lib.snapd.snap-confine is gone
+ - image,cmd/snap,tests: introduce support for modern prepare-image
+   --snap <snap>[=<channel>]
+ - overlord/ifacestate: tweak logic for generating unique slot names
+ - packaging: import debian salsa packaging work, add sbuild test and
+   use in spead
+ - overlord/ifacestate: hotplug-add-slot handler
+ - image,cmd/snap:  simplify --classic-arch to --arch, expose
+   prepare-image
+ - tests: run test snap as user in the smoke test
+ - cmd/snap: tweak man output to have no doubled up .TP lines
+ - cmd/snap, overlord/snapstate: silently ignore classic flag when a
+   snap is strictly confined
+ - snap-confine: remove special handling of /var/lib/jenkins
+ - cmd/snap-confine: handle death of helper process
+ - packaging: disable systemd environment generator on 18.04
+ - snap-confine: fix classic snaps for users with /var/lib/* homedirs
+ - tests/prepare: prevent console-conf from running
+ - image: bootstrapToRootDir => setupSeed
+ - image,cmd/snap,tests:  introduce prepare-image --classic
+ - tests: update smoke/sandbox test for armhf
+ - client, daemon: introduce helper for querying snapd API for the
+   list of slot/plug connections
+ - cmd/snap-confine: refactor and cleanup of seccomp loading
+ - snapstate, snap: allow update/switch requests with risk only
+   channel to DTRT
+ - interfaces: add network-manager-observe interface
+ - snap-confine: increase locking timeout to 30s
+ - snap-confine: fix incorrect "sanity timeout 3s" message
+ - snap-confine: provide proper error message on sc_sanity_timeout
+ - snapd,state: improve error message on state reading failure
+ - interfaces/apparmor: deny inet/inet6 in snap-update-ns profile
+ - snap: fix reexec from the snapd snap for classic snaps
+ - snap: fix hook autodiscovery for parallel installed snaps
+ - overlord/snapstate: format the refresh time for the log
+ - cmd/snap-confine: add special case for Jenkins
+ - snapcraft.yaml: fix XBuildDeb PATH for go-1.10
+ - overlord/snapstate: validate instance names early
+ - overlord/ifacestate: handler for hotplug-update-slot tasks
+ - polkit: cast pid to uint32 to keep polkit happy for now
+ - snap/naming: move various name validation helpers to separate
+   package
+ - tests: iterate getting journal logs to support delay on boards on
+   daemon-notify test
+ - cmd/snap: fix typo in cmd_wait.go
+ - snap/channel: improve channel parsing
+ - daemon, polkit: pid_t is signed
+ - daemon: introduce /v2/connections snapd API endpoint
+ - cmd/snap: small refactor of cmd_info's channel handling
+ - overlord/snapstate: use an ad-hoc error when no results
+ - cmd/snap: wrap "summary" better
+ - tests: workaround missing go dependencies in debian-9
+ - daemon: try to tidy up the icon stuff a little
+ - interfaces: add display-control interface
+ - snapcraft.yaml: fix snap building in launchpad
+ - tests: update fedora 29 workers to speed up the whole testing time
+ - interfaces: add u2f-devices interface and allow reading udev
+   +power_supply:* in hardware-observe
+ - cmd/snap-update-ns: save errno from strtoul
+ - tests: interfaces tests normalization
+ - many: cleanup golang.org/x/net/context
+ - tests: add spread test for system dbus interface
+ - tests: remove -o pipefail
+ - interfaces: add block-devices interface
+ - spread: enable upgrade suite on fedora
+ - tests/main/searching: video section got renamed to photo-and-video
+ - interfaces/home: use dac_read_search instead of dac_override with
+   'read: all'
+ - snap: really run the RunSuite
+ - interfaces/camera: allow reading vendor/etc info from
+   /run/udev/data/+usb:*
+ - interfaces/dbus: be less strict about alternations for well-known
+   names
+ - interfaces/home: allow dac_override with 'read:
+   all'
+ - interfaces/pulseaudio: allow reading subdirectories of
+   /etc/pulse
+ - interfaces/system-observe: allow read on
+   /proc/locks
+ - run-checks: ensure we use go-1.10 if available
+ - tests: get test-snapd-dbus-{provider,consumer} from the beta
+   channel
+ - interfaces/apparmor: mock presence of overlayfs root
+ - spread: increase default kill-timeout to 30min
+ - tests: simplify interfaces-contacts-service test
+ - packaging/ubuntu: build with golang 1.10
+ - ifacestate/tests: extra test for hotplug-connect handler
+ - packaging: make sure that /var/lib/snapd/lib/glvnd is accounted
+   for
+ - overlord/snapstate/backend: call fontconfig helpers from the new
+   'current'
+ - kvm: load required kernel modules if necessary
+ - cmd/snap: use a fake user for 'run' tests
+ - tests: update systems for google sru backend
+ - tests: fix install-snaps test by changing the snap info regex
+ - interfaces: helpers for sorting plug/slot/connection refs
+ - tests: moving core-snap-refresh-on-core test from main to nested
+   suite
+ - tests: fix daemon-notify test checking denials considering all the
+   log lines
+ - tests: skip lp-1802591 on "official" images
+ - tests: fix listing tests to match "snap list --unicode=never"
+ - debian: fix silly typo in the spread test invocation
+ - interface: raw-usb: Adding ttyACM ttyACA permissions
+ - tests: fix enable-disable-unit-gpio test on external boards
+ - overlord/ifacestate: helper API to obtain the state of connections
+ - tests: define new "tests/smoke" suite and use that for
+   autopkgtests
+ - cmd/snap-update-ns: explicitly check for return value from
+   parse_arg_u
+ - interfaces/builtin/opengl: allow access to NVIDIA VDPAU library
+ - tests: auto-clean the test directory
+ - cmd/snap: further tweak messaging; add a test
+ - overlord/ifacestate: handler for hotplug-connect task
+ - cmd/snap-confine: join freezer only after setting up user mount
+ - cmd/snap-confine: don't preemptively create .mnt files
+ - cmd/snap-update-ns: manually implement isspace
+ - cmd/snap-update-ns: let the go parser know we are parsing -u
+ - cmd/snap-discard-ns: fix name of user fstab files
+ - snapshotstate: don't task.Log without the lock
+ - tests: exclude some more slow tests from runs in autopkgtest
+ - many: remove .user-fstab files from /run/snapd/ns
+ - cmd/libsnap: pass --from-snap-confine when calling snap-update-ns
+   as user
+ - cmd/snap-update-ns: make freezer mockable
+ - cmd/snap-update-ns: move XDG code to dedicated file
+ - osutil: add helper for loading fstab from string
+ - cmd/snap-update-ns: move existing code around, renaming some
+   functions
+ - overlord/configstate/configcore: support - and _ in cloud init
+   field names
+ - * cmd/snap-confine: use makedev instead of MKDEV
+ - tests: review/fix the autopkgtest failures in disco
+ - overlord: drop old v1 store api support from managers test
+ - tests: new test for snapshots with more than 1 user
+
+* Thu Feb 28 2019 Neal Gompa <ngompa13@gmail.com> - 2.37.4-2
+- Fix accidentally corrupted changelog merge
+
+* Thu Feb 28 2019 Zygmunt Bazyli Krynicki <me@zygoon.pl> - 2.37.4-1
+- Release 2.37.4 to Fedora (RH#1683795)
+- Fix RPM macro in changelog (rpmlint)
+- Fix non-break space in changelog (rpmlint)
+
+* Wed Feb 27 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.37.4
+ - squashfs: unset SOURCE_DATE_EPOCH in the TestBuildDate test
+ - overlord/ifacestate: fix migration of connections on upgrade from
+   ubuntu-core
+ - tests: fix upgrade-from-2.15 with kernel 4.15
+ - interfaces/seccomp: increase filter precision
+ - tests: remove snapweb from tests
+
+* Tue Feb 19 2019 Zygmunt Bazyli Krynicki <me@zygoon.pl> - 2.37.3-1
+- Release 2.37.3 to Fedora (RH#1678603)
+
+* Mon Feb 18 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.37.3
+ - interfaces/seccomp: generate global seccomp profile
+ - overlord/snapstate: add some randomness to the catalog refresh
+ - tests: add upgrade test from 2.15.2ubuntu1 -> current snapd
+ - snap-confine: fix fallback to ubuntu-core
+ - packaging: avoid race in snapd.postinst
+ - overlord/snapstate: discard mount namespace when undoing 1st link
+   snap
+ - cmd/snap-confine: allow writes to /var/lib/** again
+ - tests: stop catalog-update/apt-hooks test until the catlog refresh
+   is randomized
+ - debian: ensure leftover usr.lib.snapd.snap-confine is gone
+
+* Wed Feb 06 2019 Neal Gompa <ngompa13@gmail.com> - 2.37.2-1
+- Release 2.37.2 to Fedora (RH#1667460)
+
+* Wed Feb 06 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.37.2
+ - cmd/snap, overlord/snapstate: silently ignore classic flag when a
+   snap is strictly confined
+ - snap-confine: remove special handling of /var/lib/jenkins
+ - cmd/snap-confine: handle death of helper process gracefully
+ - snap-confine: fix classic snaps for users with /var/lib/* homedirs
+   like jenkins/postgres
+ - packaging: disable systemd environment generator on 18.04
+ - tests: update smoke/sandbox test for armhf
+ - cmd/snap-confine: refactor and cleanup of seccomp loading
+ - snap-confine: increase locking timeout to 30s
+ - snap-confine: fix incorrect "sanity timeout 3s" message
+ - snap: fix hook autodiscovery for parallel installed snaps
+ - tests: iterate getting journal logs to support delay on boards on
+   daemon-notify test
+ - interfaces/apparmor: deny inet/inet6 in snap-update-ns profile
+ - interfaces: add u2f-devices interface
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.36.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Tue Jan 29 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.37.1
+ - cmd/snap-confine: add special case for Jenkins
+ - tests: workaround missing go dependencies in debian-9
+ - daemon, polkit: pid_t is signed
+ - interfaces: add display-control interface
+ - interfaces: add block-devices interface
+ - tests/main/searching: video section got renamed to photo-and-video
+ - interfaces/camera: allow reading vendor/etc info from
+   /run/udev/data/+usb
+ - interfaces/dbus: be less strict about alternations for well-known
+   names
+ - interfaces/home: allow dac_read_search with 'read: all'
+ - interfaces/pulseaudio: allow reading subdirectories of
+   /etc/pulse
+ - interfaces/system-observe: allow read on
+   /proc/locks
+ - tests: get test-snapd-dbus-{provider,consumer} from the beta
+   channel
+ - interfaces/apparmor: mock presence of overlayfs root
+ - packaging/{fedora,opensuse,ubuntu}: add /var/lib/snapd/lib/glvnd
+
+* Wed Jan 16 2019 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.37
+ - snapd: fix race in TestSanityFailGoesIntoDegradedMode test
+ - cmd: fix snap-device-helper to deal correctly with hooks
+ - tests: various fixes for external backend
+ - interface: raw-usb: Adding ttyACM[0-9]* as many serial devices
+   have device node /dev/ttyACM[0-9]
+ - tests: fix enable-disable-unit-gpio test on external boards
+ - tests: define new "tests/smoke" suite and use that for
+   autopkgtests
+ - interfaces/builtin/opengl: allow access to NVIDIA VDPAU
+   library
+ - snapshotstate: don't task.Log without the lock
+ - overlord/configstate/configcore: support - and _ in cloud init
+   field names
+ - cmd/snap-confine: use makedev instead of MKDEV
+ - tests: review/fix the autopkgtest failures in disco
+ - systemd: allow only a single daemon-reload at the same time
+ - cmd/snap: only auto-enable unicode to a tty
+ - cmd/snap: right-align revision and size in info's channel map
+ - dirs, interfaces/builtin/desktop: system fontconfig cache path is
+   different on Fedora
+ - tests: fix "No space left on device" issue on amazon-linux
+ - store: undo workaround for timezone-less released-at
+ - store, snap, cmd/snap: channels have released-at
+ - snap-confine: fix incorrect use "src" var in mount-support.c
+ - release: support probing SELinux state
+ - release-tools: display self-help
+ - interface: add new `{personal,system}-files` interface
+ - snap: give Epoch an Equal method
+ - many: remove unused interface code
+ - interfaces/many: use 'unsafe' with docker-support change_profile
+   rules
+ - run-checks: stop running HEAD of staticcheck
+ - release: use sync.Once around lazy intialized state
+ - overlord/ifacestate: include interface name in the hotplug-
+   disconnect task summary
+ - spread: show free space in debug output
+ - cmd/snap: attempt to restore SELinux context of snap user
+   directories
+ - image: do not write empty etc/cloud
+ - tests: skip snapd snap on reset for core systems
+ - cmd/snap-discard-ns: fix umount(2) typo
+ - overlord/ifacestate: hotplug-remove-slot task handler
+ - overlord/ifacestate: handler for hotplug-disconnect task
+ - ifacestate/hotplug: updateDevice helper
+ - tests: reset snapd state on tests restore
+ - interfaces: return security setup errors
+ - overlord: make InstallMany work like UpdateMany, issuing a single
+   request to get candidates
+ - systemd/systemd.go: add missing tests for systemd.IsActive
+ - overlord/ifacestate: addHotplugSeqWaitTask helper
+ - cmd/snap-confine: refactor call to snap-update-ns --user-mounts
+ - tests: new backend used to run upgrade test suite
+ - travis: short circuit failures in static and unit tests travis job
+ - cmd: automatically fix localized <option>s to <option>
+ - overlord/configstate,features: expose features to snapd tools
+ - selinux: package to query SELinux status and verify/restore file
+   contexts
+ - wrappers: use new systemd.IsActive in core18 early boot
+ - cmd: add tests for lintArg and lintDesc
+ - httputil: retry on temporary net errors
+ - cmd/snap-confine: remove unused sc_discard_preserved_mount_ns
+ - wrappers: only restart service in core18 when they are active
+ - overlord/ifacestate: helpers for serializing hotplug changes
+ - packaging/{fedora,opensuse}: own /var/lib/snapd/cookie
+ - systemd: start snapd.autoimport.service in --no-block mode
+ - data/selinux: fix syntax error in definition of snappy_admin
+   interface
+ - snap/info: bind global plugs/slots to implicit hooks
+ - cmd/snap-confine: remove SC_NS_MNT_FILE
+ - spread: record each tests/upgrade job
+ - osutil: do not import dirs
+ - cmd/snap-confine: fix typo "a pipe"
+ - tests: make security-device-cgroups-{devmode,jailmode} work on arm
+   devices
+ - tests: force test-snapd-daemon-notify exit 0 when the interface is
+   not connected
+ - overlord/snapstate: run 'remove' hook before 'auto-disconnect'
+ - centos: enable SELinux support on CentOS 7
+ - apparmor: allow hard link to snap-specific semaphore files
+ - tests/lib/pkgdb: disable weak deps on Fedora
+ - release: detect too old apparmor_parser
+ - tests: improve how the log is checked to see if the system is
+   waiting for a reboot
+ - cmd, dirs, interfaces/apparmor: update distro identification to
+   support ID="archlinux"
+ - spread, tests: add Fedora 29
+ - cmd/snap-confine: refactor calling snapd tools into helper module
+ - apparmor: allow snap-update-ns access to common devices
+ - cmd/snap-confine: capture initialized per-user mount ns
+ - tests: reduce verbosity around package installation
+ - data: set KillMode=process for snapd
+ - cmd/snap: handle DNS error gracefully
+ - spread, tests: use checkpoints when dumping audit log
+ - tests/lib/prepare: make sure that SELinux context of repacked core
+   snap is controlled
+ - testutils: split checkers, tweak tests
+ - tests: fix for tests test-*-cgroup
+ - spread: show AVC audits when debugging, start auditd on Fedora
+ - spread: drop Fedora 27, add Fedora 29
+ - tests/lib/reset: restore context of removed snapd directories
+ - testutil: add File{Present,Absent} checkers
+ - snap: add new `snap run --trace-exec`
+ - tests: fix for failover test on how logs are checked
+ - snapctl: add "services"
+ - overlord/snapstate: use file timestamp to initialize timer
+ - cmd/libsnap: introduce and use sc_strdup
+ - interfaces: let NM access ifindex/ifupdown files
+ - overlord/snapstate: on refresh, check new rev can read current
+ - client, store: don't use store from client (use client from store)
+ - tests/main/parallel-install-store: verify installation of more
+   than one instance at a time
+ - overlord: don't write system key if security setup fails
+ - packaging/fedora/snapd.spec: fix bogus date in changelog
+ - snapstate: update fontconfig caches on install
+ - interfaces/apparmor/backend.go:411:38: regular expression does not
+   contain any meta characters (SA6004)
+ - asserts/header_checks.go:199:35: regular expression does not
+   contain any meta characters (SA6004)
+ - run staticcheck every time :-)
+ - tests/lib/systemd-escape/main.go:46:14: printf-style function with
+   dynamic first argument and no further arguments should use print-
+   style function instead (SA1006)
+ - tests/lib/fakestore/cmd/fakestore/cmd_run.go:66:15: the channel
+   used with signal.Notify should be buffered (SA1017)
+ - tests/lib/fakedevicesvc/main.go:55:15: the channel used with
+   signal.Notify should be buffered (SA1017)
+ - spdx/parser.go:30:1: only the first constant has an explicit type
+   (SA9004)
+ - overlord/snapstate/snapmgr.go:553:21: printf-style function with
+   dynamic first argument and no further arguments should use print-
+   style function instead (SA1006)
+ - overlord/patch/patch3.go:44:70: printf-style function with dynamic
+   first argument and no further arguments should use print-style
+   function instead (SA1006)
+ - cmd/snap/cmd_advise.go:200:2: empty branch (SA9003)
+ - osutil/udev/netlink/conn.go:120:5: ineffective break statement.
+   Did you mean to break out of the outer loop? (SA4011)
+ - daemon/api.go:992:22: printf-style function with dynamic first
+   argument and no further arguments should use print-style function
+   instead (SA1006)
+ - cmd/snapd/main.go:94:5: ineffective break statement. Did you mean
+   to break out of the outer loop? (SA4011)
+ - cmd/snap/cmd_userd.go:73:15: the channel used with signal.Notify
+   should be buffered (SA1017)
+ - cmd/snap/cmd_help.go:102:7: io.Writer.Write must not modify the
+   provided buffer, not even temporarily (SA1023)
+ - release: probe apparmor features lazily
+ - overlord,daemon: mock security backends for testing
+ - cmd/libsnap: move apparmor-support to libsnap
+ - cmd: drop cruft from snap-discard-ns build rules
+ - cmd/snap-confine: use snap-discard-ns ns to discard stale
+   namespaces
+ - cmd/snap-confine: handle mounted shared /run/snapd/ns
+ - many: fix composite literals with unkeyed fields
+ - dirs, wrappers, overlord/snapstate: make completion + bases work
+ - tests: revert "tests: restore in restore, not prepare"
+ - many: validate title
+ - snap: make description maximum in runes, not bytes
+ - tests: discard mount namespaces in reset.sh
+ - tests/lib: sync cla check back from snapcraft
+ - Revert "cmd/snap, tests/main/snap-info: highlight the current
+   channel"
+ - daemon: remove enableInternalInterfaceActions
+ - mkversion: use "test -n" rather than "! test -z"
+ - run-checks: assorted fixes
+ - tests: restore in restore, not in prepare
+ - cmd/snap: fix missing newline in "snap keys" error message
+ - snap: epoch lists must contain no duplicate entries
+ - interfaces/avahi_observe: Fix typo in comment
+ - tests: add SPREAD_JOB to the description of
+   systemd_create_and_start_unit
+ - daemon, vendor: bump github.com/coreos/go-systemd/activation,
+   handle API changes
+ - Revert "cmd/snap-confine: don't allow mapping lib{uuid,blkid}"
+ - packaging/fedora: use %%_sysctldir macro
+ - cmd/snap-confine: remove unneeded unshare
+ - sanity: extend the kernel version check to cover CentOS/RHEL
+   kernels
+ - wrappers: remove all desktop files from a snap on removal
+ - snap: add an explicit check for `epoch: null` loading
+ - snap: check max description length in validate
+ - spread, tests: add CentOS support
+ - cmd/snap-confine: allow mapping more libc shards
+ - cmd/snap-discard-ns: add support for --from-snap-confine
+ - tests: make tinyproxy support systemd notify
+ - tests: fix shellcheck
+ - snap, store: rename `snap.Epoch`'s `Unset` to `IsZero`
+ - store: add a test for a non-zero epoch refresh (with epoch bump)
+ - store: v1 search doesn't send epoch, stop pretending it does
+ - snap: make any "0" epoch be Unset, and marshalled to {[0],[0]}
+ - overlord/snapstate: amend test should send local revision
+ - tests: use mock-gpio.py in enable-disable-units-gpio test
+ - snap: enforce minimal snap name len of 2
+ - cmd/libsnap: add sc_verify_snap_lock
+ - cmd/snap-update-ns: extra debugging of trespassing events
+ - userd: force zenity width if the text displayed is long
+ - overlord/snapstate, store: always send epochs
+ - cmd/snap-confine,snap-update-ns: discard quirks
+ - cmd/snap: add nanosleep to blacklisted syscalls when running with
+   --strace
+ - cmd/snap-update-ns, tests: clean trespassing paths
+ - nvidia, interfaces/builtin: OpenCL fixes
+ - ifacestate/hotplug: removeDevice helper
+ - cmd: install snap-discard-ns in "make hack"
+ - overlord/ifacestate: setup security backends phased by backends
+   first
+ - ifacestate/helpers: added SystemSnapName mapper helper method
+ - overlord/ifacestate: set hotplug-key of the connection when
+   connecting hotplug slots
+ - snapd: allow snap-update-ns to read /proc/version
+ - cmd: handle tumbleweed and leap in autogen.sh
+ - interfaces/tests: MockHotplugSlot test helper
+ - store,daemon: make UserInfo,LoginUser part of the store interface
+ - overlord/ifacestate: use remapper when checking if system snap is
+   installed
+ - tests: fix how pinentry is prepared for new gpg v 2.1 and 2.2
+ - packaging/arch: fix bash completions path
+ - interfaces/builtin: add device-buttons interface for accessing
+   events
+ - tests, fakestore: extend refresh tests with parallel installed
+   snaps
+ - snap, store, overlord/snapshotstate: drop epoch pointers
+ - snap: make Epoch default to {[0],[0]} on load from yaml
+ - data/completion: pass documented arguments to completion functions
+ - tests: skip opensuse from interfaces-openvswitch-support test
+ - tests: simple reproducer for snap try and hooks bug
+ - snapstate: do not allow classic mode for strict snaps
+ - snap: make Epoch's MarshalJSON not simplify
+ - store: remove unused currentSnap and currentSnapJSON
+ - many: some small doc comment fixes in recent hotplug code
+ - ifacestate/udevmonitor: added callback to signal end of
+   enumeration
+ - cmd/libsnap: add simplified feature flag checker
+ - interfaces/opengl: add additional accesses for cuda
+ - tests: add core18 only hooks test and fix running core18 only on
+   classic
+ - sanity, release, cmd/snap: refuse to try to do things on WSL.
+ - cmd: make coreSupportsReExec faster
+ - overlord/ifacestate: don't remove the dash when generating unique
+   slot name
+ - cmd/snap-seccomp: add full complement of ptrace constants
+ - cmd: update autogen.sh for opensuse
+ - interfaces/apparmor: allow access to /run/snap.$SNAP_INSTANCE_NAME
+ - spread.yaml: add more systems to the autopkgtest and qemu backends
+ - daemon: spool sideloaded snap into blob dir
+   overlord/snapstate: address review feedback
+ - packaging/opensuse: stop using golang-packaging
+ - overlord/snapshots: survive an unknown user
+ - wrappers: fix generating of service units with multiple `before`
+   dependencies
+ - data: run snapd.autoimport.service only after seeding
+ - cmd/snap: unhide --name parameter to snap install, tweak help
+   message
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+ - tests/main/snap-service-after-before-install: verify after/before
+   in snap install
+ - overlord/ifacestate: mark connections disconnected by hotplug with
+   hotplug-gone
+ - ifacestate/ifacemgr: don't reload hotplug-gone connections on
+   startup
+ - tests: install dependencies during prepare
+ - tests,store,daemon: ensure proxy settings are honored in
+   auth/userinfo too
+ - tests: core 18 does not support classic confinement
+ - tests: add debug output for degraded test
+ - strutil: make VersionCompare faster
+ - overlord/snapshotstate/backend: survive missing directories
+ - overlord/ifacestate: use map[string]*connState when passing conns
+   around
+ - tests: move fedora 28 to manual
+ - overlord/snapshotstate/backend: be more verbose when
+   SNAPPY_TESTING=1
+ - tests: removing fedora 26 system from spread.yaml
+ - tests: linode execution is not needed anymore
+ - tests/lib: adjust to changed systemctl behaviour on debian-9
+ - tests: fixes and new backend for tests on nested suite
+ - strutil: let MatchCounter work with a nil regexp
+ - ifacestate/helpers: findConnsForHotplugKey helper
+ - many: move regexp.(Must)Compile out of non-init functions into
+   variables
+ - store: also make snaps downloaded via deltas 0600
+ - snap: use Lstat to determine snap size, remove
+   ReadSnapInfoExceptSize
+ - interfaces/builtin: add adb-support interface
+ - tests: fail if install_snap_local fails
+ - strutil: add extra test to CommaSeparatedList as suggested by
+   mborzecki
+ - cmd/snap, daemon, strutil: use CommaSeparatedList to split a CSL
+ - ifacestate: optimize disconnect hooks
+ - cmd/snap-update-ns: parse the -u <uid> command line option
+ - cmd/snap, tests: snapshots for all
+ - client, cmd/daemon: allow disabling keepalive, improve degraded
+   mode unit tests
+ - snap: only show "next" refresh time if its after the hold time
+ - overlord/snapstate: run tests for classic snaps even on systems
+   that don't support classic
+ - overlord/standby: fix a race between standby goroutine and stop
+ - cmd/snap-exec: don't fail on some try mode snaps
+ - cmd/snap, userd, testutil: tweak DBus tests to use private session
+   bus connection
+ - cmd: remove remnants of sc_should_populate_mount_ns
+ - client, daemon, cmd/snap: indicate that services are socket/timer
+   activated
+ - cmd/snap-seccomp: only look for PTRACE_GETFPX?REGS where available
+ - cmd/snap-confine: remove SC_NS_FAIL_GRACEFULLY
+ - snap/pack, cmd/snap: allow specifying the filename of 'snap pack'
+ - cmd/snap-discard-ns: add support for per-user mount namespaces
+ - cmd/snap-confine: remove stale mount profile along stale namespace
+ - data/apt: close stderr when calling snap in the apt install hook.
+ - tests/main: fixes for the new shellcheck
+ - testutil, cmd/snap: introduce and use testutil.EqualsWrapped and
+   fly
+ - tests: initial setup for testing current branch on nested vm and
+   hotplug management
+ - cmd: refactor IPC and lifecycle of the helper process
+ - tests/main/parallel-install-store: the store has caught up, do not
+   expect failures
+ - overlord/snapstate, snap, wrappers: start services in the right
+   order during install
+ - interfaces/browser-support, cmd/snap-seccomp: Allow read-only
+   ptrace, for the Breakpad crash reporter
+ - snap,client: use a different exit code for retryable errors
+ - overlord/ifacestate: don't conflict on own discard-snap tasks when
+   refreshing & doing garbage collection
+ - cmd/snap: tweak `snap services` output when there is no services
+ - interfaces/many: updates to support k8s worker nodes
+ - cmd/snap: gnome-software install via snap:// handler
+ - overlord/many: cleanup use of snapName vs. instanceName
+ - snapstate: add command-chain to supported featureset
+ - daemon, snap: mark screenshots as deprecated
+ - interfaces: fix decoding of json numbers for static/dynamic
+   attributes* ifstate: fix decoding of json numbers
+ - cmd/snap: try not to panic on error from "snap try"
+ - tests: new cosmic image for spread tests on gce
+ - interfaces/system-key: add parser mtime and only discover features
+   on write
+ - overlord/snapshotstate/backend: detect path to tar in unit tests
+ - tests/unit/gccgo: drop gccgo unit tests
+ - cmd: use relative file names in locking APIs
+ - interfaces: fix NormalizeInterfaceAttributes, add tests
+ - overlord/snapshotstate/backend: fall back on sudo when no runuser
+ - cmd/snap-confine: reduce verbosity of debug and error messages
+ - systemd: extend Status() to work for socket and timer units
+ - interfaces: typo 'allows' for consistency with other ifaces
+ - systemd,wrappers: don't start disabled services
+ - ifacestate: simplify task chaining in ifacestate.Connect
+ - tests: ensure that goa-daemon is off
+ - snap/pack, snap/squashfs: remove extra copy before mksquashfs
+ - cmd/snap: block 'snap help <cmd> --all'
+ - asserts, image: ensure kernel, gadget, base and required-snaps use
+   valid snap names
+ - apparmor: add unit test for probeAppArmorParser and simplify code
+ - interfaces/apparmor: conditionally add explicit deny rules for
+   ptrace
+ - po: sync translations from launchpad
+ - osutil: tweak handling of error adduser errors
+ - cmd: rename ns_group to mount_ns
+ - tests/main/interfaces-accounts-service: more debugging
+ - snap/pack, snap/squashfs: use type to determine mksquashfs args
+ - data/systemd, wrappers: tweak system-shutdown helper for core18
+ - tests: show list of processes when ifaces-accounts-service fails
+ - tests: do not run degraded test in autopkgtest env
+ - snap: overhaul validation error messages
+ - ifacestate/hooks: only create interface hook tasks if hooks exist
+ - osutil: workaround overlayfs on ubuntu 18.10
+ - interfaces/home: don't allow snaps to write to $HOME/bin
+ - interfaces: improve Attr error further
+ - snapstate: tweak GetFeatureFlagBool() to have a default argument
+ - many: cleanup remaining parallel installs TODOs
+ - image: improve validation of extra snaps
+
+* Tue Dec 18 2018 Neal Gompa <ngompa13@gmail.com> - 2.36.3-1
+- Release 2.36.3 to Fedora
+- Remove merged patch
+
+* Fri Dec 14 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.36.3
+ - wrappers: use new systemd.IsActive in core18 early boot
+ - httputil: retry on temporary net errors
+ - wrappers: only restart service in core18 when they are active
+ - systemd: start snapd.autoimport.service in --no-block mode
+ - data/selinux: fix syntax error in definition of snappy_admin
+   interfacewhen installing selinux-policy-devel package.
+ - centos: enable SELinux support on CentOS 7
+ - cmd, dirs, interfaces/apparmor: update distro identification to
+   support ID="archlinux"
+ - apparmor: allow hard link to snap-specific semaphore files
+ - overlord,apparmor: new syskey behaviour + non-ignored snap-confine
+   profile errors
+ - snap: add new `snap run --trace-exec` call
+ - interfaces/backends: detect too old apparmor_parser
+
+* Thu Nov 29 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.36.2
+ - daemon, vendor: bump github.com/coreos/go-systemd/activation,
+   handle API changes
+ - snapstate: update fontconfig caches on install
+ - overlord,daemon: mock security backends for testing
+ - sanity, spread, tests: add CentOS
+ - Revert "cmd/snap, tests/main/snap-info: highlight the current
+   channel"
+ - cmd/snap: add nanosleep to blacklisted syscalls when running with
+   --strace
+ - tests: add regression test for LP: #1803535
+ - snap-update-ns: fix trailing slash bug on trespassing error
+ - interfaces/builtin/opengl: allow reading /etc/OpenCL/vendors
+ - cmd/snap-confine: nvidia: pick up libnvidia-opencl.so
+ - interfaces/opengl: add additional accesses for cuda
+
+* Wed Nov 21 2018 Neal Gompa <ngompa13@gmail.com> - 2.36-4
+- Fix backport patch
+
+* Wed Nov 21 2018 Neal Gompa <ngompa13@gmail.com> - 2.36-3
+- Backport fixes for EL7 support
+
+* Wed Nov 14 2018 Neal Gompa <ngompa13@gmail.com> - 2.36-2
+- Fix runtime dependency for selinux subpackage for EL7
+
+* Fri Nov 09 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.36.1
+ - tests,snap-confine: add core18 only hooks test and fix running
+   core18 only hooks on classic
+ - interfaces/apparmor: allow access to
+   /run/snap.$SNAP_INSTANCE_NAME
+ - spread.yaml: add more systems to the autopkgtest and qemu backends
+ - daemon: spool sideloaded snap into blob dir
+ - wrappers: fix generating of service units with multiple `before`
+   dependencies
+ - data: run snapd.autoimport.service only after seeding
+ - tests,store,daemon: ensure proxy settings are honored in
+   auth/userinfo too
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+ - tests/lib: adjust to changed systemctl behaviour on debian-9
+ - tests/main/interfces-accounts-service: switch to busctl, more
+   debugging
+ - store: also make snaps downloaded via deltas 0600
+ - cmd/snap-exec: don't fail on some try mode snaps
+ - cmd/snap, userd, testutil: tweak DBus tests to use private session
+   bus connection
+ - tests/main: fixes for the new shellcheck
+ - cmd/snap-confine: remove stale mount profile along stale namespace
+ - data/apt: close stderr when calling snap in the apt install hook
+
+* Sun Nov 04 2018 Neal Gompa <ngompa13@gmail.com> - 2.36-1
+- Release 2.36 to Fedora
+
+* Wed Oct 24 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.36
+ - overlord/snapstate, snap, wrappers: start services in the right
+   order during install
+ - tests: the store has caught up, drop gccgo test, update cosmic
+   image
+ - cmd/snap: try not to panic on error from "snap try"`--devmode`
+ - overlord/ifacestate: don't conflict on own discard-snap tasks when
+   refreshing & doing garbage collection
+ - snapstate: add command-chain to supported featureset
+ - daemon, snap: mark screenshots as deprecated
+ - interfaces: fix decoding of json numbers for static/dynamic
+   attributes
+ - data/systemd, wrappers: tweak system-shutdown helper for core18
+ - interfaces/system-key: add parser mtime and only discover features
+   on write
+ - interfaces: fix NormalizeInterfaceAttributes, add tests
+ - systemd,wrappers: don't start disabled services
+ - ifacestate/hooks: only create interface hook tasks if hooks exist
+ - tests: do not run degraded test in autopkgtest env
+ - osutil: workaround overlayfs on ubuntu 18.10
+ - interfaces: include invalid type in Attr error
+ - many: enable layouts by default
+ - interfaces/default: don't scrub with change_profile with classic
+ - cmd/snap: speed up unit tests
+ - vendor, cmd/snap: refactor to accommodate the new less buggy go-
+   flags
+ - daemon: expose snapshots to the API
+ - interfaces: updates for default, screen-inhibit-control, tpm,
+   {hardware,system,network}-observe
+ - interfaces/hotplug: rename HotplugDeviceKey method to HotplugKey,
+   update test interface
+ - interfaces/tests: use TestInterface instead of a custom local
+   helper
+ - overlord/snapstate: export getFeatureFlagBool.
+ - osutil,asserts,daemon: support force password change in system-
+   user assertion
+ - snap, wrappers: support restart-delay, generate RestartSec=<value>
+   in service units
+ - tests/ifacestate: moved asserts-related mocking into helper
+ - image: fetch device store assertion if available
+ - many: enable AppArmor on Arch
+ - interfaces/repo: two helper methods for hotplug
+ - overlord/ifacestate: add hotplug slots with implicit slots
+ - interfaces/hotplug: helpers and struct updates
+ - tests: run the snapd tests on Ubuntu 18.10
+ - snapstate: only report errors if there is an actual error
+ - store: speedup unit tests
+ - spread-shellcheck: fix interleaved error messages, tweaks
+ - apparmor: create SnapAppArmorDir in setupSnapConfineReexec
+ - ifacestate: implementation of defaultDeviceKey function for
+   hotplug
+ - cmd/snap-update-ns: remove empty placeholders used for mounting
+ - snapshotstate: restore to current revision
+ - tests/lib: rework the CLA checker
+ - many: support and consider store friendly-stores when checking
+   device scope constraints
+ - overlord/snapstate: block parallel installs of snapd, core, base,
+   kernel, gadget snaps
+ - overlord/patch: patch for static plug/slot attributes
+ - interfaces: honor static attributes when reloading conns
+ - osutils: unit tests speedup; introduce «run-checks --short-
+   unit».
+ - systemd, wrappers: speed up wrappers unit tests
+ - client: speedup unit tests
+ - spread-shellcheck: use threads to parallelise
+ - snap: validate plug and slot names
+ - osutil, interfaces/apparmor: add and use of osutil.UnlinkMany
+ - wrappers: do not depend on network.taget in socket units, tweak
+   generated units
+ - interfaces/apparmor: (un)load profiles in one apparmor_parser call
+ - store: gracefully handle unexpected errors in 'action'
+   response
+ - cmd: put our manpages in section 8
+ - overlord: don't make become-operational interfere with user
+   requests
+ - store: tweak unmatched refresh result error log
+ - snap, client, daemon, store: use and expose "media" more
+ - tests,cmd/snap-update-ns: add test showing mount update bug
+   cmd/snap-update-ns: better detection of snapd-made tmpfs
+ - tests: spread tests for aliases with parallel installed snaps
+ - interfaces/seccomp: allow using statx by default
+ - store: gracefully handle unexpected errors in 'action' response
+ - overlord/snapshotstate: chown the tempdir
+ - cmd/snap: attempt to start the document portal if running with a
+   session bus
+ - snap: detect layouts vs layout in snap.yaml
+ - interfaces/apparmor: handle overlayfs snippet for snap-update-ns
+ - snapcraft.yaml: set grade to stable
+ - tests: shellchecks, final round
+ - interfaces/apparmor: handle overlayfs snippet for snap-update-ns
+ - snap: detect layouts vs layout in snap.yaml
+ - overlord/snapshotstate: store epoch in snapshot, check on restore
+ - cmd/snap: tweak UX of snap refresh --list
+ - overlord/snapstate: improve consistency, use validateInfoAndFlags
+   also in InstallPath
+ - snap: give Epoch a CanRead helper
+ - overlord/snapshotstate: small refactor of internal helpers
+ - interfaces/builtin: adding missing permission to create
+   /run/wpa_supplicant directory
+ - interfaces/builtin: avahi interface update
+ - client, daemon: support passing of 'unaliased' option when
+   installing from local files
+ - selftest: rename selftest.Run() to sanity.Check()
+ - interfaces/apparmor: report apparmor support level and policy
+ - ifacestate: helpers for generating slot names for hotplug
+ - overlord/ifacestate: make sure to pass in the Model assertion when
+   enforcing policies
+ - overlord/snapshotstate: store the SnapID in snapshot, block
+   restore if changed
+ - interfaces: generalize writable mimic profile
+ - asserts,interfaces/policy: add support for on-store/on-brand/on-
+   model plug/slot rule constraints
+ - many: fetch the device store assertion together and in the context
+   of interpreting snap-declarations
+ - tests: disable gccgo tests on 18.04 for now, until dh-golang vs
+   gccgo is fixed
+ - tests/main/parallel-install-services: add spread test for snaps
+   with services
+ - tests/main/snap-env: extend to cover parallel installations of
+   snaps
+ - tests/main/parallel-install-local: rename from *-sideload, extend
+   to run snaps
+ - cmd/snapd,daemon,overlord: without snaps, stop and wait for socket
+ - cmd/snap: tame the help zoo
+ - tests/main/parallel-install-store: run installed snap
+ - cmd/snap: add a bunch of TRANSLATORS notes (and a little more
+   i18n)
+ - cmd: fix C formatting
+ - tests: remove unneeded cleanup from layout tests
+ - image: warn on missing default-providers
+ - selftest: add test to ensure selftest.checks is up-to-date
+ - interfaces/apparmor, interfaces/builtin: tweaks for parallel snap
+   installs
+ - userd: extend the list of supported XDG Desktop properties when
+   autostarting user applications
+ - cmd/snap-update-ns: enforce trespassing checks
+ - selftest: actually run the kernel version selftest
+ - snapd: go into degraded mode when the selftest fails
+ - tests: add test that runs snapctl with a core18 snap
+ - tests: add snap install hook with base: core18
+ - overlord/{snapstate,assertstate}: parallel instances and
+   refresh validation
+ - interfaces/docker-support: add rules to read apparmor macros
+ - tests: make nfs test available for more systems
+ - tests: cleanup copy/paste dup in interfaces-network-setup-control
+ - tests: using single sh snap in interface tests
+ - overlord/snapstate: improve cleaup in mount-snap handler
+ - tests: don't fail interfaces-bluez test if bluez is already
+   installed
+ - tests: find snaps just for edge and beta channels
+ - daemon, snapstate: consistent snap list [--all] output with broken
+   snaps
+ - tests: fix listing to allow extra things in the notes column
+ - cmd/snap: improve UX when removing specific snap revision
+ - cmd/snap, tests/main/snap-info: highlight the current channel
+ - interfaces/testiface: added TestHotplugInterface
+ - snap: tweak commands
+ - interfaces/hotplug: hotplug spec takes one slot definition
+ - overlord/snapstate, snap: handle shared snap directories when
+   installing/remove snaps with instance key
+ - interfaces/opengl: misc accesses for VA-API
+ - client, cmd/snap: expose warnings to the world
+ - cmd/snap-update-ns: introduce trespassing state tracking
+ - cmd/snap: commands no longer build their own client
+ - tests: try to build cmd/snap for darwin
+ - daemon: make error responders not printf when called with 1
+   argument
+ - many: return real snap name in API response
+ - overlord/state: return latest LastAdded time in WarningsSummary
+ - many: mount namespace mapping for parallel installs of snaps
+ - ifacestate/autoconnect: do not self-conflict on setup-profiles if
+   core-phase-2
+ - client, cmd/snap: on !linux, exit when the client tries to Do
+   something
+ - tests: refactor for nested suite and tests fixed
+ - tests: use lxd's waitready instead of polling lxd socket
+ - ifacestate: don't initialize udev monitor until we have a system
+   snap
+ - interfaces: extra argument for static attrs in
+   NewConnectedPlug/NewConnectedSlot
+ - packaging/arch: sync packaging with AUR
+ - snapstate/tests: serialize all appends in fake backend
+ - snap-confine: make /lib/modules optional
+ - cmd/snap: handle "snap interfaces core" better
+ - store: move download tests into downloadSuite
+ - tests,interfaces: run interfaces-account-control on UC18
+ - tests: fix install snaps test by adding link to /snap
+ - tests: fix for nested test suite
+ - daemon: fix snap list --all with parallel snap instances
+ - snapstate: refactor tests to use SetModel*
+ - wrappers: fix snap services order in tests
+ - many: provide salt for generating instance-key in store requests
+ - ifacestate: fix hang when retrying content providers
+ - snapd-env-generator: fix when PATH is empty or unset
+ - overlord/assertstate: propagate TaskSnapSetup error
+ - client: catch and expose logs errors
+ - overlord: integrate device enumeration with udev monitor
+ - daemon, overlord/state: warnings pipeline
+ - tests: add publisher regex to fix the snap-info test pass on sru
+ - cmd: use systemdsystemgeneratorsdir, cleanup automake complaints,
+   tweaks
+ - cmd/snap-update-ns: remove the unused Secure type
+ - osutil, o/snapshotstate, o/sss/backend: quick fixes
+ - tests: update the listing expression to support core from
+   different channels
+ - store: use stable instance key in store refresh requests
+ - cmd/snap-update-ns: detach Mk{Prefix,{File,Dir,Symlink{,All}}}
+ - overlord/patch: support for sublevel patches
+ - tests: update prepare/restore for nightly suite
+ - cmd/snap-update-ns: detach BindMount from the Secure type
+ - cmd/snap-update-ns: re-factor pair of helpers to call fstatfs once
+ - ifacestate: retry on "discard-snap" in autoconnect conflict check
+ - cmd/snap-update-ns: separate OpenPath from the Secure struct
+ - wrappers: remove Wants=network-online.target
+ - tests: add new core16-base test
+ - store: refactor tests so that they work as store_test package
+ - many: add refresh.rate-limit core option
+ - tests: run account-control test with different bases
+ - tests: port proxy test to use python tinyproxy
+ - overlord: introduce snapshotstate.
+ - testutil: allow Fstatfs results to vary over time
+ - snap-update-ns: add comments about the "deadcode" in bootstrap.go
+ - overlord: add chg.Err() in testUpdateWithAutoconnectRetry
+ - many: remove deadcode
+ - tests: also run unit/gccgo in 18.04
+ - tests: introduce a helper for installing local snaps with --name
+ - tests: avoid removing core snap on reset
+ - snap: use snap.SideInfo in test to fix build with gccgo
+ - partition: remove unused runCommand
+ - image: fix incorrect error when using local bases
+ - overlord/snapstate: fix format
+ - cmd: fix format
+ - tests: setting "storage: preserve-size" just for amazon-linux
+   system
+ - tests: test for the hostname interface
+ - interfaces/modem-manager: allow access to more USB strings
+ - overlord: instantiate UDevMonitor
+ - interfaces/apparmor: tweak naming, rename to AddLayout()
+ - interfaces: take instance name in ifacetest.InstallSnap
+ - snapcraft: do not use --dirty in mkversion
+ - cmd: add systemd environment generator
+ - devicestate: support getting (http) proxy from core config
+ - many: rename ClientOpts to ClientOptions
+ - prepare-image-grub-core18: remove image root in restore
+ - overlord/ifacestate: remove "old-conn" from connect/undo connect
+   handlers
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+ - image: handle errors when downloadedSnapsInfoForBootConfig has no
+   data
+ - tests: use official core18 model assertion in tests
+ - snap-confine: map /var/lib/extrausers into snaps mount-namespace
+ - overlord,store: support proxy settings internally too
+ - cmd/snap: bring back 'snap version'
+ - interfaces/mount: tweak naming of things
+ - strutil: fix MatchCounter to also work with buffer reuse
+ - cmd,interfaces,tests: add /mnt to removable-media interface
+ - systemd: do not run "snapd.snap-repair.service.in on firstboot
+   bootstrap
+ - snap/snapenv: drop some instance specific variables, use instance-
+   specific ones for user locations
+ - firstboot: sort by type when installing the firstboot snaps
+ - cmd, cmd/snap: better support for non-linux
+ - strutil: add new ParseByteSize
+ - image: detect and error if bases are missing
+ - interfaces/apparmor: do not downgrade confinement on arch with
+   linux-hardened 4.17.4+
+ - daemon: add pokeStateLock helper to the daemon tests
+ - snap/squashfs: improve error message from Build on mksquashfs
+   failure
+ - tests: remove /etc/alternatives from dirs-not-shared-with-host
+ - cmd: support re-exec into the "snapd" snap
+ - spdx: remove "Other Open Source" from the support licenses
+ - snap: add new type "TypeSnapd" and attach to the snapd snap
+ - interfaces: retain order of inserted security backends
+ - tests: spread test for parallel-installs desktop file handling
+ - overlord/devicestate: use OpenSSL's PEM format when generating
+   keys
+ - cmd: remove --skip-command-chain from snap run and snap-exec
+ - selftest: detect if apparmor is unusable and error
+ - snap,snap-exec: support command-chain for hooks
+ - tests: significantly reduce execution time for managers test
+ - snapstate: use new "snap.ByType" sorting
+ - overlord/snapstate: fix UpdateMany() to work with parallel
+   instances
+ - testutil: have File* checker produce more useful error output
+ - overlord/ifacestate: introduce connectOpts
+ - interfaces: parallel instances support, extend unit tests
+ - tests: normalize tests
+ - snapstate: make InstallPath() return *snap.Info too
+ - snap: add ByType sorting
+ - interfaces: add cifs-mount interface
+ - tests: use file based markers in snap-service-stop-mode
+ - osutil: reorg and stub out things to get it building on darwin
+ - tests/main/layout: cleanup after the test
+ - osutil/sys: small tweaks to let it build on darwin
+ - daemon, overlord/snapstate: set instance name when installing from
+   snap file
+ - many: move Uname to osutil, for more DRY and easier porting.
+ - cmd/snap: create snap user directory when running parallel
+   installed snaps
+ - cmd/snap-confine: switch to validation of SNAP_INSTANCE_NAME
+ - tests: basic test for parallel installs from the store
+ - image: download the gadget from the model.GadgetTrack()
+ - snapstate: add support for gadget tracks in model assertion
+ - image: add support for "gadget=track"
+ - overlord: handle sigterm during shutdown better
+ - tests: add the original function to fix the errors on new kernels
+ - tests/main/lxd: pull lxd from candidate; reënable i386
+ - wayland: add extra sockets that are used by older toolkits (e.g.
+   gtk3)
+ - asserts: add support for gadget tracks in the model assertion
+ - overlord/snapstate: improve feature flag validation
+ - tests/main/lxd: run ubuntu-16.04 only on 64 bit variant
+ - interfaces: workaround for activated services and newer DBus
+ - tests: get the linux-image-extra available for the current kernel
+ - interfaces: add new "sysfs-name" to i2c interfaces code
+ - interfaces: disconnect hooks
+ - cmd/libsnap: unify detection of core/classic with go
+ - tests: fix autopkgtest failures in cosmic
+ - snap: fix advice json
+ - overlord/snapstate: parallel snap install
+ - store: backward compatible instance-key handling for non-instance
+   snaps
+ - interfaces: add screencast-legacy for video and audio recording
+ - tests: skip unsupported architectures for fedora-base-smoke test
+ - tests: avoid using the journalctl cursor when it has not been
+   created yet
+ - snapstate: ensure normal snaps wait for the "snapd" snap on
+   refresh
+ - tests: enable lxd again everywhere
+ - tests: new test for udisks2 interface
+ - interfaces: add cpu-control for setting CPU tunables
+ - overlord/devicestate: fix tests, set seeded in registration
+   through proxy tests
+ - debian: add missing breaks on cosmic
+ - devicestate: only run device-hook when fully seeded
+ - seccomp: conditionally add socketcall() based on system and base
+ - tests: new test for juju client observe interface
+ - overlord/devicestate: DTRT w/a snap proxy to reach a serial vault
+ - snapcraft: set version information for the snapd snap
+ - cmd/snap, daemon: error out if trying to install a snap using
+   empty name
+ - hookstate: simplify some hook tests
+ - cmd/snap-confine: extend security tag validation to cover instance
+   names
+ - snap: fix mocking of systemkey in snap-run tests
+ - packaging/opensuse: fix static build of snap-update-ns and snap-
+   exec
+ - interfaces/builtin: addtl network-manager resolved DBus fix
+ - udev: skip TestParseUdevEvent on ppc
+ - interfaces: miscellaneous policy updates
+ - debian: add tzdata to build-dep to ensure snapd builds correctly
+ - cmd/libsnap-confine-private: intoduce helpers for validating snap
+   instance name and instance key
+ - snap,snap-exec: support command-chain for app
+ - interfaces/builtin: network-manager resolved DBus changes
+ - snap: tweak `snap wait` command
+ - cmd/snap-update-ns: introduce validation of snap instance names
+ - cmd/snap: fix some corner-case test setup weirdness
+ - cmd,dirs: fix various issues discovered by a Fedora base snap
+ - tests/lib/prepare: fix extra snaps test
+
+* Mon Oct 15 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.35.5
+ - interfaces/home: don't allow snaps to write to $HOME/bin
+ - osutil: workaround overlayfs on ubuntu 18.10
+
+* Fri Oct 05 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.35.4
+  - wrappers: do not depend on network.taget in socket units, tweak
+    generated units
+
+* Fri Oct 05 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.35.3
+ - overlord: don't make become-operational interfere with user
+   requests
+ - docker_support.go: add rules to read apparmor macros
+ - interfaces/apparmor: handle overlayfs snippet for snap-update-
+   nsFixes:
+ - snapcraft.yaml: add workaround to fix snapcraft build
+ - interfaces/opengl: misc accesses for VA-API
+
+* Wed Sep 12 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.35.2
+ - cmd,overlord/snapstate: go 1.11 format fixes
+ - ifacestate: fix hang when retrying content providers
+ - snap-env-generator: do nothing when PATH is unset
+ - interfaces/modem-manager: allow access to more USB strings
+
+* Mon Sep 03 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.35.1
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+ - snapcraft: do not use --diry in mkversion.sh
+ - cmd: add systemd environment generator
+ - snap-confine: map /var/lib/extrausers into snaps mount-namespace
+ - tests: cherry-pick test fixes from master for 2.35
+ - systemd: do not run "snapd.snap-repair.service.in on firstboot
+   bootstrap
+ - interfaces: retain order of inserted security backends
+ - selftest: detect if apparmor is unusable and error
+
+* Sat Aug 25 2018 Neal Gompa <ngompa13@gmail.com> - 2.35-1
+- Release 2.35 to Fedora (RH#1598946)
+
+* Mon Aug 20 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.35
+ - snapstate: add support for gadget tracks in model assertion
+ - image: add support for "gadget=track"
+ - asserts: add support for gadget tracks in the model assertion
+ - interfaces: add new "sysfs-name" to i2c interfaces code
+ - overlord: handle sigterm during shutdown better
+ - wayland: add extra sockets that are used by older toolkits
+ - snap: fix advice json
+ - tests: fix autopkgtest failures in cosmic
+ - store: backward compatible instance-key handling for non-instance
+   snaps
+ - snapstate: ensure normal snaps wait for the "snapd" snap on
+   refresh
+ - interfaces: add cpu-control for setting CPU tunables
+ - debian: add missing breaks on comisc
+ - overlord/devicestate: DTRT w/a snap proxy to reach a serial vault
+ - devicestate: only run device-hook when fully seeded
+ - seccomp: conditionally add socketcall() based on system and base
+ - interfaces/builtin: addtl network-manager resolved DBus fix
+ - hookstate: simplify some hook tests
+ - udev: skip TestParseUdevEvent on ppc
+ - interfaces: miscellaneous policy updates
+ - debian: add tzdata to build-dep to ensure snapd builds correctly
+ - interfaces/builtin: network-manager resolved DBus changes
+ - tests: add spread test for fedora29 base snap
+ - cmd/libsnap: treat distributions with VARIANT_ID=snappy as "core"
+ - dirs: fix SnapMountDir inside a Fedora base snap
+ - tests: fix snapd-failover for core18 with external backend
+ - overlord/snapstate: always clean SnapState when doing Get()
+ - overlod/ifacestate: always use a new SnapState when fetching the
+   snap state
+ - overlord/devicestate: have the serial request talk to the proxy if
+   set
+ - interfaces/hotplug: udevadm output parser
+ - tests: New test for daemon-notify interface
+ - image: ensure "core" is ordered early if base: and core is used
+ - cmd/snap-confine: snap-device-helper parallel installs support
+ - tests: enable interfaces-framebuffer everywhere
+ - tests: reduce nc wait time from 2 to 1 second
+ - snap/snapenv: add snap instance specific variables
+ - cmd/snap-confine: add minimal test for snap-device-helper
+ - tests: enable snapctl test on core18
+ - overlord: added UDevMonitor for future hotplug support
+ - wrappers: do not glob when removing desktop files
+ - tests: add dbus monitor log to interfaces-accounts-service
+ - tests: add core-18 systems to external backend
+ - wrappers: account for changed app wrapper in parallel installed
+   snaps
+ - wrappers: make sure that the tests pass on non-Ubuntu too
+ - many: add snapd snap failure handling
+ - tests: new test for dvb interface
+ - configstate: accept refresh.timer=managed
+ - tests: new test for snap logs command
+ - wrapper: generate all the snapd unit files when generating
+   wrappers
+ - store: keep all files with link-count > 1 in the cache
+ - store: be less verbose in the common refresh case of "no updates"
+ - snap-confine: update snappy-app-dev path
+ - debian: ensure dependency on fixed apt on 18.04
+ - snapd: add initial software watchdog for snapd
+ - daemon, systemd: change journalctl -n=all to --no-tail
+ - systemd: fix snapd.apparmor.service.in dependencies
+ - snapstate: refuse to remove bases or core if snaps need them
+ - snap: introduce package-level helpers for building snap related
+   directory/file paths
+ - overlord/devicestate: deny parallel install of kernel or gadget
+   snaps
+ - store: clean up parallel-install TODOs in store tests
+ - timeutil: fix first weekday of the month schedule
+ - interfaces: match all possible tty but console
+ - tests: shellchecks part 5
+ - cmd/snap-confine: allow ptrace read for 4.18 kernels
+ - advise: make the bolt database do the atomic rename dance
+ - tests/main/apt-hooks: debug dump of commands.db
+ - tests/lib/prepare-restore: update Arch Linux kernel LOCALVERSION
+   handling
+ - snap: validate instance name as part of Validate()
+ - daemon: if a snap is inactive, don't ask systemd about its
+   services.
+ - udev: skip TestParseUdevEvent on s390x
+ - tests: switch core-amd64-18 to use `kernel: pc-kernel=18`
+ - asserts,image: add support for new kernel=track syntax
+ - tests: new gce image for fedora 27
+ - interfaces/apparmor: use the cache in mtime-resilient way
+ - store, overlord/snapstate: introduce instance name in store APIs
+ - tests: drive-by cleanup of redudant pkgname matching
+ - tests: ensure apt-hook is only run after catalog update ran
+ - tests: use pkill instead of kilall
+ - tests/main: another bunch of updates for Amazon Linux 2
+ - tests/lib/snaps: avoid using relative command paths that go up in
+   the  directory tree
+ - tests: disable/fix more tests for Amazon Linux 2
+ - overlord: introduce InstanceKey to SnapState and SnapSetup,
+   renames
+ - daemon: make sure most change generating handlers can produce
+   errors with kinds
+ - tests/main/interfaces-calendar-service: skip the test on AMZN2
+ - tests/lib/snaps: avoid using relative command paths that go up in
+   the directory tree
+ - cmd/snap: add a green check mark to verified publishers
+ - cmd/snap: fix two issues in the cmd/snap unit tests
+ - packaging/fedora: fix target path of /snap symlink
+ - cmd/snap: support `--last=<type>?` to mean "no error on empty"
+ - cmd/snap-confine: (nvidia) pick up libnvidia-glvkspirv.so
+ - strutil: detect and bail out of Unmarshal on duplicate key
+ - packaging/fedora(amzn2): disable SELinux, drop dependency on
+   squashfuse for AMZN2
+ - spread, tests: add support for Amazon Linux 2
+ - packaging/fedora: Add Amazon Linux 2 support
+ - many: make Wait/Stop optional on StateManagers
+ - snap/squashfs: stop printing unsquashfs info to stderr
+ - snap: add support for `snap advise-snap --from-apt`
+ - overlord/ifacestate: ignore connect if already connected
+ - tests: change the service snap used instead of network-bind-
+   consumer
+ - interfaces/network-control: update for wpa-supplicant and ifupdown
+ - tests: fix raciness in stop mode tests
+ - logger: try to not have double dates
+ - debian: use deb-systemd-invoke instead of systemctl directly
+ - tests: run all main tests on core18
+ - many: finish sharing a single TaskRunner with all the the managers
+ - interfaces/repo: added AllHotplugInterfaces helper
+ - snapstate: ensure kernel-track is honored on switch/refresh
+ - overlord/ifacestate: support implicit slots on snapd
+ - image: add support for "kernel-track" in `snap prepare-image`
+ - tests: add test that ensures we do not boot any system in degraded
+   state
+ - tests: update tests to work on core18
+ - cmd/snap: check for typographic dashes in command
+ - tests: fix tests expecting old email address
+ - client: add some existing error kinds that were not listed in
+   client.go
+ - tests: add missing slots in classic and core provider test snaps
+ - overlord,daemon,cmd: re-map snap names around the edges of snapd
+ - tests: use install_local in snap-run-hooks
+ - coreconfig: add support for `snap set system network.disable-
+   ipv6`
+ - overlord/snapstate: dedupe default content providers
+ - osutil/udev: sync with upstream
+ - debian: do not ship snapd.apparmor.service on ubuntu
+ - overlord: have SnapManager use a passed in TaskRunner created by
+   Overlord
+ - many: streamline the generic conflict check mechanisms
+ - tests: remove unneeded setup code in snap-run-symlink
+ - cmd/snap: print unset license as "unset", instead of "unknown"
+ - asserts: add (optional) kernel-track to model assertion
+ - snap/squashfs, tests: pass -n[o-progress] to {mk,un}squashfs
+ - interfaces/pulseaudio: be clear that the interface allows playback
+   and record
+ - snap: support hook environment
+ - interfaces: fix typo "daemonNotify" (add missing "n")
+ - interfaces: tweak tests of daemon-notify, use common naming
+ - interfaces: allow invoking systemd-notify when daemon-notify is
+   connected
+ - store: make snap blobs be 0600
+ - interfaces,daemon: move JSON types to the daemon
+ - tests: prepare needs to handle bin/snapctl being a symlink
+ - tests: do not mask errors in interfaces-timezone-control (#5405)
+ - packaging: put snapctl into /usr/lib/snapd and symlink in usr/bin
+ - tests: add basic integration test for spread hold
+ - overlord/snapstate: improve PlugsOnly comment
+ - many: assorted shellcheck fixes
+ - store, daemon, client, cmd/snap: expose "scope", default to wide
+ - snapstate: allow setting "refresh.timer=managed"
+ - cmd/snap: display a link to data privacy notice for interactive
+   snap login
+ - client, cmd/snap: pass snap instance name when installing from
+   file
+ - cmd/snap: add 'debug paths' command
+ - snapstate: make sure all *link-*snap tasks carry a snap type and
+   further hints
+ - devicestate: fix race when refreshing a snap with snapd-control
+ - tests: fix tests on arch
+ - tests: start active system units on reset
+ - tests: new test for joystick interface
+ - tests: moving install of dependencies to pkgdb helper
+ - tests: enable new fedora image with test dependencies installed
+ - tests: start using the new opensuse image with test dependencies
+ - tests: check catalog refresh before and after restart snapd
+ - tests: stop restarting journald service on prepare
+ - interfaces: make core-support a no-op interface
+ - interfaces: prefer "snapd" when resolving implicit connections
+ - interfaces/hotplug: add hotplug Specification and
+   HotplugDeviceInfo
+ - many: lessen the use of core-support
+ - tests: fixes for the autopkgtest failures in cosmic
+ - tests: remove extra ' which breaks interfaces-bluetooth-control
+   test
+ - dirs: fix antergos typo
+ - tests: use grep to avoid non-matching messages from MATCH
+ - dirs: improve distro detection for Antegros
+ - vendor: switch to latest bson
+ - interfaces/builtin: create can-bus interface
+ - tests: "snap connect" is idempotent so just connect
+ - many: use extra "releases" information on store "revision-not-
+   found" errors to produce better errors
+ - interfaces: treat "snapd" snap as type:os
+ - interfaces: tweak tests to have less repetition of "core" and
+   "ubuntu…
+ - tests: simplify econnreset test
+ - snap: add helper for renaming slots
+ - devicestate: fix panic in firstboot code when no snaps are seeded
+ - tests: add artful for sru validation on google backend
+ - snap,interfaces: move interface name validation to snap
+ - overlord/snapstate: introduce path to fake backend ops
+ - cmd/snap-confine: fix snaps running on core18
+ - many: expose publisher's validation throughout the API
+
+* Fri Jul 27 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.34.3
+ - interfaces/apparmor: use the cache in mtime-resilient way
+ - cmd/snap-confine: (nvidia) pick up libnvidia-glvkspirv.so
+ - snapstate: allow setting "refresh.timer=managed"
+ - spread: switch Fedora and openSUSE images
+
+* Thu Jul 19 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.34.2
+ - packaging: fix bogus date in fedora snapd.spec
+ - tests: fix tests expecting old email address
+
+* Tue Jul 17 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.34.1
+ - tests: cherry-pick test fixes from master for 2.34
+ - coreconfig: add support for `snap set system network.disable-
+   ipv6`
+ - debian: do not ship snapd.apparmor.service on ubuntu
+ - overlord/snapstate: dedupe default content providers
+ - interfaces/builtin: create can-bus interface
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.33.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Fri Jul 06 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.34
+ - store, daemon, client, cmd/snap: expose "scope", default to wide*
+ - tests: fix arch tests
+ - snapstate: make sure all *link-*snap tasks carry a snap type and
+   further hints
+ - snapstate: allow setting "refresh.timer=managed"
+ - cmd/snap: display a link to data privacy notice for interactive
+   snap login
+ - devicestate: fix race when refreshing a snap with snapd-control
+ - tests: skip interfaces-framebuffer when no /dev/fb0 is found
+ - tests: run interfaces-contacts-service only where test-snapd-eds
+   is available
+ - many: expose publisher's validation throughout the API
+ - many: use extra "releases" information on store "revision-not-
+   found" errors to produce better errors
+ - dirs: improve distro detection for Antegros
+ - Revert "dirs: improve identification of Arch Linux like systems"
+ - devicestate: fix panic in firstboot code when no snaps are seeded
+ - i18n: use xgettext-go --files-from to avoid running into cmdline
+   size limits
+ - interfaces: move ValidateName helper to utils
+ - snapstate,ifstate: wait for pending restarts before auto-
+   connecting
+ - snap: account for parallel installs in wrappers, place info and
+   tests
+ - configcore: fix incorrect handling of keys with numbers (like
+   gpu_mem_512)
+ - tests: fix tests when no keyboard input detected
+ - overlord/configstate: add watchdog options
+ - snap-mgmt: fix for non-existent dbus system policy dir,
+   shellchecks
+ - tests/main/snapd-notify: use systemd's service properties rater
+   than the journal
+ - snapstate: allow removal of snap.TypeOS when using a model with a
+   base
+ - interfaces: make findSnapdPath smarter
+ - tests: run "arp" tests only if arp is available
+ - spread: increase the number of auto retries for package downloads
+   in opensuse
+ - cmd/snap-confine: fix nvidia support under lxd
+ - corecfg: added experimental.hotplug feature flag
+ - image: block installation of parallel snap instances
+ - interfaces: moved normalize method to interfaces/utils and made it
+   public
+ - api/snapctl: allow -h and --help for regular users.
+ - interfaces/udisks2: also implement implicit classic slot
+ - cmd/snap-confine: include CUDA runtime libraries
+ - tests: disable auto-refresh test on core18
+ - many: switch to account validation: unproven|verified
+ - overlord/ifacestate: get/set connection state only via helpers
+ - tests: adding extra check to validate journalctl is showing
+   current test data
+ - data: add systemd environment configuration
+ - i18n: handle write errors in xgettext-go
+ - snap: helper for validating snap instance names
+ - snap{/snaptest}: set instance key based on snap name
+ - userd: fix running unit tests on KDE
+ - tests/main/econnreset: limit ingress traffic to 512kB/s
+ - snap: introduce a struct Channel to represent store channels, and
+   helpers to work with it
+ - tests: add fedora to distro_clean_package_cache function
+ - many: rename snap.Info.StoreName() to snap.Info.SnapName()
+ - tests: add spread test to ensure snapd/core18 are not removable
+ - tests: tweaks for running the main tests on core18
+ - overlord/{config,snap}state: introduce experimental.parallel-
+   instances feature flag
+ - strutil: support iteration over almost clean paths
+ - strutil: add PathIterator.Rewind
+ - tests: update interfaces-timeserver-control to core18
+ - tests: add halt-timeout to google backend
+ - tests: skip security-udev-input-subsystem without /dev/input/by-
+   path
+ - snap: introduce the instance key field
+ - packaging/opensuse: remaining packaging updates for 2.33.1
+ - overlord/snapstate: disallow installing snapd on baseless models
+ - tests: disable core tests on all core systems (16 and 18)
+ - dirs: improve identification of Arch Linux like systems
+ - many: expose full publisher info over the snapd API
+ - tests: disable core tests on all core systems (16 and 18)
+ - tests/main/xdg-open: restore or clean up xdg-open
+ - tests/main/interfaces-firewall-control: shellcheck fix
+ - snapstate: sort "snapd" first
+ - systemd: require snapd.socket in snapd.seeded.service; make sure
+   snapd.seeded
+ - spread-shellcheck: use the latest shellcheck available from snaps
+ - tests: use "ss" instead of "netstat" (netstat is not available in
+   core18)
+ - data/complete: fix three out of four shellcheck warnings in
+   data/complete
+ - packaging/opensuse: fix typo, missing assignment
+ - tests: initial core18 spread image building
+ - overlord: introduce a gadget-connect task and use it at first boot
+ - data/completion: fix inconsistency in +x and shebang
+ - firstboot: mark essential snaps as "Required" in the state
+ - spread-shellcheck: use a whitelist of files that are allowed to
+   fail validation
+ - packaging/opensuse: build position-independent binaries
+ - ifacestate: prevent running interface hooks twice when self-
+   connecting on autoconnect
+ - data: remove /bin/sh from snapd.sh
+ - tests: fix shellcheck 0.5.0 warnings
+ - packaging/opensuse: snap-confine should be 06755
+ - packaging/opensuse: ship apparmor integration if enabled
+ - interfaces/udev,misc: only trigger udev events on input subsystem
+   as needed
+ - packaging/opensuse: add missing bits for snapd.seeded.service
+ - packaging/opensuse: don't use %-macros in comments
+ - tests: shellchecks part 4
+ - many: rename snap.Info.Name() to snap.Info.InstanceName(), leave
+   parallel-install TODOs
+ - store: drop unused: channel map types, and details fixture.
+ - store: have a basic test about the unmarshalling of /search
+   results
+ - tests: show executed tests on current system when a test fails
+ - tests: fix for the download of the big snap
+ - interfaces/apparmor: add chopTree
+ - tests: remove double debug: | entry in tests and add more checks
+ - cmd/snap-update-ns: introduce mimicRequired helper
+ - interfaces: move assertions around for better failure line number
+ - store: log a nice clear "download succeeded" message
+ - snap: run snap-confine from the re-exec location
+ - snapstate: support restarting snapd from the snapd snap on core18
+ - tests: show status of the partial test-snapd-huge snap in
+   econnreset test
+ - tests: fix interfaces-calendar-service test when gvfsd-metadata
+   loks the xdg dirctory
+ - store: switch store.SnapInfo to use the new v2/info endpoint
+ - interfaces: add Repository.AllInterfaces
+ - snapstate: stop using evolving SnapSpec internally, use an
+   internal-only snapSpec instead
+ - cmd/libsnap-confine-private: introduce a helper for splitting snap
+   name
+ - tests: econnreset/retry tweaks
+ - store, et al: kill dead code that uses the bulk endpoint
+ - tests/lib/prepare-restore: fix upgrade/reboot handling on arch
+ - cmd/snap-update-ns,strutil: move PathIterator to strutil, add
+   Depth helper
+ - data/systemd/snapd.run-from-snap: ensure snapd tooling is
+   available
+ - store: switch connectivity check to use v2/info
+ - devicestate: support seeding from a base snap instead of core
+ - snapstate,ifacestate: remove core-phase-2 handling
+ - interfaces/docker-support: update for docker 18.05
+ - tests: enable fedora 28 again
+ - overlord/ifacestate:  simplify checkConnectConflicts and also
+   connect signature
+ - snap: parse connect instructions in gadget.yaml
+ - tests: fix snapd-repair.timer on ubuntu-core-snapd-run- from-snap
+   test
+ - interfaces/apparmor: allow killing snap-update-ns
+ - tests: skip "try" test on s390x
+ - store, image: have 'snap download' use v2/refresh action=download
+ - interfaces/policy: test that base policy can be parsed
+ - tests: publish test-snapd-appstreamid for any architecture
+ - snap: don't include newline in hook environment
+ - cmd/snap-update-ns: use RCall with SyscallsEqual
+ - cmd/snap-update-ns: add IsSnapdCreatedPrivateTmpfs and tests
+ - tests: skip security-dev-input-event-denied on s390x/arm64
+ - interfaces: add the dvb interface
+ - daemon: paging is not a thing.
+ - cmd/snap-mgmt: remove system key on purge
+ - testutil: syscall sequence checker
+ - cmd/snap-update-ns: fix a leaking file descriptor in MkSymlink
+ - packaging: use official bolt in the errtracker on fedora
+ - many: add `snap debug connectivity` command* many: add `snap debug
+   connectivity` command
+ - configstate: deny configuration of base snaps and for the "snapd"
+   snap
+ - interfaces/raw-usb: also allow usb serial devices
+ - snap: reject more layout locations
+ - errtracker: do not send duplicated reports
+ - httputil: extra debug if an error is not retried
+ - cmd/snap-update-ns: improve wording in many errors
+ - cmd/snap: use snaptest.MockSnapCurrent in `snap run` tests
+ - cmd/snap-update-ns: add helper for checking for read-only
+   filesystems
+ - interfaces/builtin/docker: use commonInterface over specific
+   struct
+ - testutil: add test support for Fstatfs
+ - cmd/snap-update-ns: discard the concept of segments
+ - cmd/libsnap-confine-private: helper for extracting store snap name
+   from local-name
+ - tests: fix flaky test for hooks undo
+ - interfaces: add {contacts,calendar}-service interfaces
+ - tests: retry 'restarting into..' match in the snap-confine-from-
+   core test
+ - systemd: adjust TestWriteMountUnitForDirs() to use
+   squashfs.MockUseFuse(false)
+ - data: add helper that can generate/start/stop the snapd service
+ - sefltest: advise reboot into 4.4 on trusty running 3.13
+ - selftest: add new selftest package that tests squashfs mounting
+ - store, jsonutil: move store.getStructFields to
+   jsonutil.StructFields
+ - ifacestate: improved conflict and error handling when creating
+   autoconnect tasks
+ - cmd/snap-confine: applied make fmt
+ - interfaces/udev: call 'udevadm settle --timeout=10' after
+   triggering events
+ - tests: wait more time until snap start to be downloaded on
+   econnreset test
+ - snapstate: ensure fakestore returns TypeOS for the core snap
+ - tests: fix lxd test which hangs on restore
+ - cmd/snap-update-ns: add PathIterator
+ - asserts,image: add support for models with bases
+ - tests: shellchecks part 3
+ - overlord/hookstate: support undo for hooks
+ - interfaces/tpm: Allow access to the kernel resource manager
+ - tests: skip appstream-id test for core systems 32 bits
+ - interfaces/home: remove redundant common interface assignment
+ - tests: reprioritise a few tests that are known to be slow
+ - cmd/snap: small help tweaks and fixes
+ - tests: add test to ensure /dev/input/event* for non-joysticks is
+   denied
+ - spread-shellcheck: silly fix & pep8
+ - spread: switch fedora 28 to manual
+ - client,cmd/snap,daemon,tests: expose base of a snap over API, show
+   it in snap info --verbose
+ - tests: fix lxd test - --auto now sets up networking
+ - tests: adding fedora-28 to spread.yaml
+ - interfaces: add juju-client-observe interface
+ - client, daemon: add a "mounted-from" entry to local snaps' JSON
+ - image: set model.DisplayName() in bootenv as "snap_menuentry"
+ - packaging/opensuse: Refactor packaging to support all openSUSE
+   targets
+ - interfaces/joystick: force use of the device cgroup with joystick
+   interface
+ - interfaces/hardware-observe: allow access to /etc/sensors* for
+   libsensors
+ - interfaces: remove Plug/Slot types
+ - interface hooks: update old AutoConnect methods
+ - snapcraft: run with DEB_BUILD_OPTIONS=nocheck
+ - overlord/{config,snap}state: the number of inactive revisions is
+   config
+ - cmd/snap: check with snapd for unknown sections
+ - tests: moving test helpers from sh to bash
+ - data/systemd: add snapd.apparmor.service
+ - many: expose AppStream IDs (AKA common ID)
+ - many: hold refresh when on metered connections
+ - interfaces/joystick: also support modern evdev joysticks and
+   gamepads
+ - xdgopenproxy: skip TestOpenUnreadableFile when run as root
+ - snapcraft: use dpkg-buildpackage options that work in xenial
+ - spread: openSUSE LEAP 42.2 was EOLd in January, remove it
+ - get-deps: work with an unset GOPATH too
+ - interfaces/apparmor: use strict template on openSUSE tumbleweed
+ - packaging: filter out verbose flags from "dh-golang"
+ - packaging: fix description
+ - snapcraft.yaml: add minimal snapcraft.yaml with custom build
+
+* Fri Jun 22 2018 Neal Gompa <ngompa13@gmail.com> - 2.33.1-1
+- Release 2.33.1 to Fedora (RH#1567916)
+
+* Thu Jun 21 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.33.1
+ - many: improve udev trigger on refresh experience
+ - systemd: require snapd.socket in snapd.seeded.service
+ - snap: don't include newline in hook environment
+ - interfaces/apparmor: allow killing snap-update-ns
+ - tests: skip "try" test on s390x
+ - tests: skip security-dev-input-event-denied when /dev/input/by-
+   path/ is missing
+ - tests: skip security-dev-input-event-denied on s390x/arm64
+
+* Fri Jun 08 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.33
+ - packaging: use official bolt in the errtracker on fedora
+ - many: add `snap debug connectivity` command
+ - interfaces/raw-usb: also allow usb serial devices
+ - errtracker: do not send duplicated reports
+ - selftest: add new selftest package that tests squashfs mounting
+ - tests: backport lxd force stop and econnreset fixes
+ - tests: add test to ensure /dev/input/event* for non-joysticks is
+   denied
+ - interfaces/joystick: support modern evdev joysticks
+ - interfaces: add juju-client-observe
+ - interfaces/hardware-observe: allow access to /etc/sensors* for
+   libsensors
+ - many: holding refresh on metered connections
+ - many: expose AppStream IDs (AKA common ID)
+ - tests: speed up save/restore snapd state for all-snap systems
+   during tests execution
+ - interfaces/apparmor: use helper to load stray profile
+ - tests: ubuntu core abstraction
+ - overlord/snapstate: don't panic in a corner case interaction of
+   cleanup tasks and pruning
+ - interfaces/apparmor: add 'mediate_deleted' profile flag for all
+   snaps
+ - tests: new parameter for the journalctl rate limit
+ - spread-shellcheck: port to python
+ - interfaces/home: add 'read' attribute to allow non-owner read to
+   @{HOME}
+ - testutil: import check.v1 differently to workaround gccgo error
+ - interfaces/many: miscellaneous updates for default, desktop,
+   desktop-legacy, system-observe, hardware-observe, opengl and gpg-
+   keys
+ - snapstate/hooks: reorder autoconnect and reconnect hooks
+ - daemon: update unit tests to match current master
+ - overlord/snapshotstate/backend: introducing the snapshot backend
+ - many: support 'system' nickname in interfaces
+ - userd: add the "snap" scheme to the whitelist
+ - many: make rebooting of core on refresh immediate, refactor logic
+   around it
+ - tests/main/snap-service-timer: account for service timer being in
+   the 'running' state
+ - interfaces/builtin: allow access to libGLESv* too for opengl
+   interface
+ - daemon: fix unit tests on arch
+ - interfaces/default,process-control: miscellaneous signal policy
+   fixes
+ - interfaces/bulitin: add write permission to optical-drive
+ - configstate: validate known core.* options
+ - snap, wrappers: systemd WatchdogSec support
+ - ifacestate: do not auto-connect manually disconnected interfaces
+ - systemd: mock useFuse() so testsuite passes in container via lxd
+   snap
+ - snap/env: fix env duplication logic
+ - snap: some doc comments fixes and additions
+ - cmd/snap-confine, interfaces/opengl: allow access to glvnd EGL
+   vendor files
+ - ifacestate: unify reconnect and autoconnect methods
+ - tests: fix user mounts test for external systems
+ - overlord/snapstate,overlord/auth,store: coalesce no auth user
+   refresh requests
+ - boot,partition: improve tests/docs around SetNextBoot()
+ - many: improve `snap wait` command
+ - snap: fix `snap interface --attrs` output when numbers are used
+ - cmd/snap-update-ns: poke holes when creating source paths for
+   layouts
+ - snapstate: support getting new bases/default-providers on refresh
+ - ifacemgr: remove stale connections on startup
+ - asserts: use Attrer in policy checks
+ - testutil: record system call errors / return values
+ - tests: increase timeouts to make tests reliable on slow boards
+ - repo: pass and return ConnRef via pointers
+ - interfaces: add xdg-document-portal support to desktop interface
+ - debian: add a zenity|kdialog suggests
+ - snapstate: make TestDoPrereqRetryWhenBaseInFlight less brittle
+ - tests: go must be installed as a classic snap
+ - tests: use journalctl cursors instead rotating logs
+ - daemon: add confinement-options to /v2/system-info
+   daemon: refactor classic support flag to be more structured
+ - tests: build spread in the autopkgtests with a more recent go
+ - cmd/snap: fix the message when snap.channel != snap.tracking
+ - overlord/snapstate: allow core defaults configuration via 'system'
+   key
+ - many: add "snap debug sandbox-features" and needed bits
+ - interfaces: interface hooks for refresh
+ - snapd.core-fixup.sh: add workaround for corrupted uboot.env
+ - boot: clear "snap_mode" when needed
+ - many: add wait command and `snapd.seeded` service
+ - interfaces: move host font update-ns AppArmor rules to desktop
+   interface
+ - jsonutil/safejson: introducing safejson.String &
+   safejson.Paragraph
+ - cmd/snap-update-ns: use Secure.BindMount to bind mount files
+ - cmd/snap-update-ns,tests: mimic the mode and ownership of
+   directories
+ - cmd/snap-update-ns: add support for ignoring mounts with missing
+   source/target
+ - interfaces: interface hooks implementation
+ - cmd/libsnap: fix compile error on more restrictive gcc
+   cmd/libsnap: fix compilation errors on gcc 8
+ - interfaces/apparmor: allow bash and dash to be in /usr/bin/
+ - cmd/snap-confine: allow any base snap to provide /etc/alternatives
+ - tests: fix interfaces-network test for systems with partial
+   confinement
+ - spread.yaml: add cosmic (18.10) to autopkgtest/qemu
+ - tests: ubuntu 18.04 or higher does not need linux-image-extra-
+ - configcore: validate experimental.layouts option
+ - interfaces:minor autoconnect cleanup
+ - HACKING: fix typos
+ - spread: add adt for ubuntu 18.10
+ - tests: skip test lp-1721518 for arch, snapd is failing to start
+   after reboot
+ - interfaces/x11: allow X11 slot implementations
+ - tests: checking interfaces declaring the specific interface
+ - snap: improve error for snaps not available in the given context
+ - cmdstate: add missing test for default timeout handling
+ - tests: shellcheck spread tasks
+ - cmd/snap: update install/refresh help vs --revision
+ - cmd/snap-confine: add support for per-user mounts
+ - snap: do not use overly short timeout in `snap
+   {start,stop,restart}`
+ - tests: adding google-sru backend replacing linode-sur
+ - interfaces/apparmor: fix incorrect apparmor profile glob
+ - systemd: replace ancient paths with 16.04+ standards
+ - overlord,systemd: store snap revision in mount units
+ - testutil: add test helper for SysLstat
+ - testutil,cmd: rename test helper of Lstat to OsLstat
+ - testutil: document all fake syscall/os functions
+ - osutil,interfaces,cmd: use less hardcoded strings
+ - testutil: rename UNMOUNT_NOFOLLOW to umountNoFollow
+ - testutil: don't dot-import check.v1
+ - store: getStructFields takes pointers now
+ - tests: drop `linux-image-extra-$(uname -r)` install in 18.04
+ - many: fix false negatives reported by vet
+ - osutil,interfaces: use uint32 for uid, gid
+ - many: fix various issues reported by shellcheck
+ - tests: add pending shutdown detection
+ - image: support refreshing soft-expired user macaroons in tooling
+ - interfaces/builtin, daemon: cleanup mocked builtin interfaces in
+   daemon tests
+ - interfaces/builtin: add support for software-watchdog interface
+ - spread: auto accept key changes when calling dnf
+ - snap,overlord/snapstate: introduce and use BrokenSnapError
+ - tests: detect kernel oops during tests and abort tests in this
+   case
+ - tests: bring back one missing test in snap-service-stop-mode
+ - debian: update LP bug for the 2.32.5 SRU
+ - userd: set up journal logging streams for autostarted apps
+ - snap,tests : don't fail if we cannot stat MountFile
+ - tests: smaller fixes for Arch tests
+ - tests: run interfaces-broadcom-asic-control early
+ - client: support for snapshot sets, snapshots, and snapshot actions
+ - tests: skip interfaces-content test on core devices
+ - cmd: generalize locking to global, snap and per-user locks
+ - release-tools: handle the snapd-x.y.z version
+ - packaging: fix incorrectly auto-generated changelog entry for
+   2.32.5
+ - tests: add arch to CI
+ - systemd: add helper for opening stream file descriptors to the
+   journal
+ - cmd/snap: handle distros with no version ID
+ - many: add "stop-mode: sig{term,hup,usr[12]}{,-all}" instead of
+   conflating that with refresh-mode
+ - tests: removing linode-sru backend
+ - tests: updating bionic version for spread tests on google
+ - overlord/snapstate: poll for up to 10s if a snap is unexpectedly
+   not mounted in doMountSnap
+ - overlord/snapstate: allow to get an error from readInfo instead of
+   a broken stub, use it in doMountSnap
+ - snap: snap.AppInfo is now a fmt.Stringer
+ - tests: move fedora 27 to google backend
+ - many: add `core.problem-reports.disabled` option
+ - cmd/snap-update-ns: remove the need for stash directory in secure
+   bind mount implementation
+ - errtracker: check for whoopsie.service instead of reading
+   /etc/whoopsie
+ - cmd/snap: user session application autostart v3
+ - tests: add test to ensure `snap refresh --amend` works with
+   different channels
+ - tests: add check for OOM error after each test
+ - cmd/snap-seccomp: graceful handling of non-multilib host
+ - interfaces/shutdown: allow calling SetWallMessage
+ - cmd/snap-update-ns: add secure bind mount implementation for use
+   with user mounts
+ - snap: fix `snap advise-snap --command` output to match spec
+ - overlord/snapstate: on multi-snap refresh make sure bases and core
+   are finished before dependent snaps
+ - overlord/snapstate: introduce envvars to control the channels for
+   based and prereqs
+ - cmd/snap-confine: ignore missing cgroups in snap-device-helper
+ - debian: add gbp.conf script to build snapd via `gbp buildpackage`
+ - daemon,overlord/hookstate: stop/wait for running hooks before
+   closing the snapctl socket
+ - advisor: use json for package database
+ - interfaces/hostname-control: allow setting the hostname via
+   syscall and systemd
+ - tests/main/interfaces-opengl-nvidia: verify access to 32bit
+   libraries
+ - interfaces: misc updates for default, firewall-control, fuse-
+   support and process-control
+ - data/selinux: Give snapd access to more aspects of the system
+ - many: use the new install/refresh API by switching snapstate to
+   use store.SnapAction
+ - errtracker: make TestJournalErrorSilentError work on gccgo
+ - ifacestate: add to the repo also snaps that are pending being
+   activated but have a done setup-profiles
+ - snapstate, ifacestate: inject auto-connect tasks try 2
+ - cmd/snap-confine: allow creating missing gl32, gl, vulkan dirs
+ - errtracker: add more fields to aid debugging
+ - interfaces: make system-key more robust against invalid fstab
+   entries
+ - overlord,interfaces: be more vocal about broken snaps and read
+   errors
+ - ifacestate: injectTasks helper
+ - osutil: fix fstab parser to allow for # in field values
+ - cmd/snap-mgmt: remove timers, udev rules, dbus policy files
+ - release-tools: add repack-debian-tarball.sh
+ - daemon,client: add build-id to /v2/system-info
+ - cmd: make fmt (indent 2.2.11)
+ - interfaces/content: add rule so slot can access writable files at
+   plug's mountpoint
+ - interfaces: add /var/lib/snapd/snap to @{INSTALL_DIR}
+ - ifacestate: don't surface errors from stale connections
+ - cmd/snap-update-ns: convert Secure* family of functions into
+   methods
+ - tests: adjust canonical-livepatch test on GCE
+ - tests: fix quoting issues in econnreset test
+ - cmd/snap-confine: make /run/media an alias of /media
+ - cmd/snap-update-ns: rename i to segNum
+ - interfaces/serial: change pattern not to exclude /dev/ttymxc*
+ - spread: disable StartLimitInterval option on opensuse-42.3
+ - configstate: give a chance to immediately recompute the next
+   refresh time when schedules are set
+ - cmd/snap-confine: attempt to detect if multiarch host uses
+   arch triplets
+ - store: add Store.SnapAction to support the new install/refresh API
+   endpoint
+ - tests: adding test for removable-media interface
+ - tests: update interface tests to remove extra checks and normalize
+   tests
+ - timeutil: in Human, count days with fingers
+ - vendor: update gopkg.in/yaml.v2 to the latest version
+ - cmd/snap-confine: fix Archlinux compatibility
+ - cmd/snapd: make sure signal handlers are established during early
+   daemon startup
+ - cmd/snap-confine: apparmor: allow creating prefix path for
+   gl/vulkan
+ - osutil: use tilde suffix for temporary files used for atomic
+   replacement
+ - tests: copy or sanity check core users using usernames
+ - tests: disentangle etc vs extrausers in core tests
+ - tests: fix snap-run tests when snapd is not running
+ - overlord/configstate: change how ssh is stopped/started
+ - snap: make `snap run` look at the system-key for security profiles
+ - strutil, cmd/snap: drop strutil.WordWrap, first pass at
+   replacement
+ - tests: adding opensuse-42.3 to google
+ - cmd/snap: fix one issue with noWait error handling logic, add
+   tests plus other cleanups
+ - cmd/snap-confine: nvidia: preserve globbed file prefix
+ - advisor: add comment why osutil.FileExists(dirs.SnapCommandsDB) is
+   needed
+ - interfaces,release: probe seccomp features lazily
+ - tests: change debug for layout test
+ - advisor: deal with missing commands.db file
+ - interfaces/apparmor: simplify UpdateNS internals
+ - polkit: Pass caller uid to PolicyKit authority
+ - tests: moving debian 9 from linode to google backend
+ - cmd/snap-confine: nvidia: add tls/libnvidia-tls.so* glob
+ - po: specify charset in po/snappy.pot
+ - interfaces: harden snap-update-ns profile
+ - snap: Call SanitizePlugsSlots from InfoFromSnapYaml
+ - tests: update tests to deal with s390x quirks
+ - debian: run snap.mount upgrade fixup *before* debhelper
+ - tests: move xenial i386 to google backend
+ - snapstate: add compat mode for default-provider
+ - tests: a bunch of test fixes for s390x from looking at the
+   autopkgtest logs
+ - packaging: recommend "gnupg" instead of "gnupg1 | gnupg"
+ - interfaces/builtin: let MM change qmi device attributes
+ - tests: add workaround for s390x failure
+ - snap/pack, cmd/snap: add `snap pack --check-skeleton`
+ - daemon: support 'system' as nickname of the core snap
+ - cmd/snap-update-ns: use x-snapd.{synthetic,needed-by} in practice
+ - devicestate: add DeviceManager.Registered returning a channel
+   closed when the device is known to be registered
+ - store: Sections and WriteCatalogs need to strictly send device
+   auth only if the device has a custom store
+ - tests: add bionic system to google backend
+ - many: fix shellcheck warnings in bionic
+ - cmd/snap-update-ns: don't fail on existing symlinks
+ - tests: make autopkgtest tests more targeted
+ - cmd/snap-update-ns: fix creation of layout symlinks
+ - spread,tests: move suite-level prepare/restore to central script
+ - many: propagate contexts enough to be able to mark store
+   operations done from the Ensure loop
+ - snap: don't create empty Change with "Hold" state on disconnect
+ - snap: unify snap name validation w/python; enforce length limit.
+ - cmd/snap: use shlex when parsing `snap run --strace` arguments
+ - osutil,testutil: add symlinkat(2) and readlinkat(2)
+ - tests: autopkgtest may have non edge core too
+ - tests: adding checks before stopping snapd service to avoid job
+   canceled on ubuntu 14.04
+ - errtracker: respect the /etc/whoopsie configuration
+ - overlord/snapstate:  hold refreshes for 2h after seeding on
+   classic
+ - cmd/snap: tweak and polish help strings
+ - snapstate: put layout feature behind feature flag
+ - tests: force profile re-generation via system-key
+ - snap/squashfs: when installing from seed, try symlink before cp
+ - wrappers: services which are socket or timer activated should not
+   be started during boot
+ - many: go vet cleanups
+ - tests: define MATCH from spread
+ - packaging/fedora: Merge changes from Fedora Dist-Git plus trivial
+   fix
+ - cmd/snap: use timeutil.Human to show times in `snap refresh
+   --time`
+ - cmd/snap: in changes and tasks, default to human-friendly times
+ - many: support holding refreshes by setting refresh.hold
+ - Revert "cmd/snap: use timeutil.Human to show times in `snap
+   refresh -…-time`"
+ - cmd/snap: use timeutil.Human to show times in `snap refresh
+   --time`
+ - tests/main/snap-service-refresh-mode: refactor the test to rely on
+   comparing PIDs
+ - tests/main/media-sharing: improve the test to cover /media and
+   /run/media
+ - store: enable deltas for core devices too
+ - cmd/snap: unhide --no-wait; make wait use go via waitMixin
+ - strutil/shlex: import github.com/google/shlex into the tree
+ - vendor: update github.com/mvo5/libseccomp-golang
+ - overlord/snapstate: block install of "system"
+ - cmd/snap: "current"→"installed"; "refreshed"→"refresh-date"
+ - many: add the snapd-generator
+ - cmd/snap-seccomp: Cancel the atomic file on error, not just Close
+ - polkit: ensure error is properly set if dialog is dismissed
+ - snap-confine, snap-seccomp: utilize new seccomp logging features
+ - progress: tweak ansimeter cvvis use to no longer confuse minicom
+ - xdgopenproxy: integrate xdg-open implementation into snapctl
+ - tests: avoid removing preinstalled snaps on core
+ - tests: chroot into core to run xdg-open there
+ - userd: add an OpenFile method for launching local files with xdg-
+   open
+ - tests: moving ubuntu core from linode to google backend
+ - run-checks: remove accidental bashism
+ - i18n: simplify NG usage by doing the modulo math in-package.
+ - snap/squashfs: set timezone when calling unsquashfs to get the
+   build date
+ - timeutil: timeutil.Human(t) gives a human-friendly string for t
+ - snap: add autostart app property
+ - tests: add support for external backend executions on listing test
+ - tests: make interface-broadcom-asic-control test work on rpi
+ - configstate: when disable "ssh" we must disable the "sshd" service
+ - interfaces/apparmor,system-key: add upperdir snippets for strict
+   snaps on livecd
+ - snap/squashfs: add BuildDate
+ - store: parse the JSON format used by the coming new store API to
+   convey snap information
+ - many: remove snapd.refresh.{timer,service}
+ - tests: adding ubuntu-14.04-64 to the google backend
+ - interfaces: add xdg-desktop-portal support to desktop interface
+ - packaging/arch: sync with snapd/snapd-git from AUR
+ - wrappers, tests/main/snap-service-timer: restore missing commit,
+   add spread test for timer services
+ - store: don't ask for snap_yaml_raw except on the details endpoint
+ - many: generate and use per-snap snap-update-ns profile
+ - tests: add debug for layout test
+ - wrappers: detect whether systemd-analyze can be used in unit tests
+ - osutil: allow creating strings out of MountInfoEntry
+ - servicestate: use systemctl enable+start and disable+stop instead
+   of --now flag
+ - osutil: handle file being matched by multiple patterns
+ - daemon, snap: fix InstallDate, make a method of *snap.Info
+ - wrappers: timer services
+ - wrappers: generator for systemd OnCalendar schedules
+ - asserts: fix flaky storeSuite.TestCheckAuthority
+ - tests: fix dependency for ubuntu artful
+ - spread: start moving towards google backend
+ - tests: add a spread test for layouts
+ - ifacestate: be consistent passing Retry.After as named field
+ - cmd/snap-update-ns: use recursive bind mounts for writable mimic
+ - testutil: allow mocking syscall.Fstat
+ - overlord/snapstate: verify that default schedule is randomized and
+   is  not a single time
+ - many: simplify mocking of home-on-NFS
+ - cmd/snap-update-ns: use syscall.Symlink instead of os.Symlink
+ - store: move infoFromRemote into details.go close to snapDetails
+ - userd/tests: Test kdialog calls and mock kdialog too to make tests
+   work in KDE
+ - cmd/snap: tweaks to 'snap info' (feat. installed->current rename)
+ - cmd/snap: add self-strace to `snap run`
+ - interfaces/screen-inhibit-control,network-status: fix dbus path
+   and interface typos
+ - update-pot: Force xgettext() to return true
+ - store: cleanup test naming, dropping remoteRepo  and
+   UbuntuStore(Repository)? references
+ - store: reorg auth refresh
+
+* Wed May 16 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.9
+ - tests: run all spread tests inside GCE
+ - tests: build spread in the autopkgtests with a more recent go
+
+* Fri May 11 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.8
+ - snapd.core-fixup.sh: add workaround for corrupted uboot.env
+
+* Fri May 11 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.7
+ - many: add wait command and seeded target (2
+ - snapd.core-fixup.sh: add workaround for corrupted uboot.env
+ - boot: clear "snap_mode" when needed
+ - cmd/libsnap: fix compile error on more restrictive gcc
+ - tests: cherry-pick commits to move spread to google backend
+ - spread.yaml: add cosmic (18.10) to autopkgtest/qemu
+ - userd: set up journal logging streams for autostarted apps
+
+* Sun Apr 29 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.6
+ - snap: do not use overly short timeout in `snap
+   {start,stop,restart}`
+ - interfaces/apparmor: fix incorrect apparmor profile glob
+ - tests: detect kernel oops during tests and abort tests in this
+   case
+ - tests: run interfaces-boradcom-asic-control early
+ - tests: skip interfaces-content test on core devices
+
+* Mon Apr 16 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.5
+ - many: add "stop-mode: sig{term,hup,usr[12]}{,-all}" instead of
+   conflating that with refresh-mode
+ - overlord/snapstate:  poll for up to 10s if a snap is unexpectedly
+   not mounted in doMountSnap
+ - daemon: support 'system' as nickname of the core snap
+
+* Thu Apr 12 2018 Neal Gompa <ngompa13@gmail.com> - 2.32.4-1
+- Release 2.32.4 to Fedora (RH#1553734)
+
+* Wed Apr 11 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.4
+ - cmd/snap: user session application autostart
+ - overlord/snapstate: introduce envvars to control the channels for
+   bases and prereqs
+ - overlord/snapstate: on multi-snap refresh make sure bases and core
+   are finished before dependent snaps
+ - many: use the new install/refresh /v2/snaps/refresh store API
+
+* Wed Apr 11 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.3.2
+ - errtracker: make TestJournalErrorSilentError work on
+   gccgo
+ - errtracker: check for whoopsie.service instead of reading
+   /etc/whoopsie
+
+* Wed Apr 11 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.3.1
+ - debian: add gbp.conf script to build snapd via `gbp
+   buildpackage`
+ - tests: add check for OOM error after each test
+ - cmd/snap-seccomp: graceful handling of non-multilib host
+ - interfaces/shutdown: allow calling SetWallMessage
+ - data/selinux: Give snapd access to more aspects of the system
+ - daemon,overlord/hookstate: stop/wait for running hooks before
+   closing the snapctl socket
+ - cmd/snap-confine: ignore missing cgroups in snap-device-helper
+ - interfaces: misc updates for default, firewall-control, fuse-
+   support and process-control
+ - overlord: test fix, address corner case
+
+* Thu Apr 05 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.3
+ - ifacestate: add to the repo also snaps that are pending being
+   activated but have a done setup-profiles
+ - snapstate: inject autoconnect tasks in doLinkSnap for regular
+   snaps
+ - cmd/snap-confine: allow creating missing gl32, gl, vulkan dirs
+ - errtracker: add more fields to aid debugging
+ - interfaces: make system-key more robust against invalid fstab
+   entries
+ - cmd/snap-mgmt: remove timers, udev rules, dbus policy files
+ - overlord,interfaces: be more vocal about broken snaps and read
+   errors
+ - osutil: fix fstab parser to allow for # in field values
+
+* Sat Mar 31 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.2
+ - interfaces/content: add rule so slot can access writable files at
+   plug's mountpoint
+ - tests: adjust canonical-livepatch test on GCE
+ - interfaces/serial: change pattern not to exclude /dev/ttymxc
+ - spread.yaml: switch Fedora 27 tests to manual
+ - store: Sections and WriteCatalogs need to strictly send device
+   auth only if the device has a custom store
+ - configstate: give a chance to immediately recompute the next
+   refresh time when schedules are set
+ - cmd/snap-confine: attempt to detect if multiarch host uses arch
+   triplets
+ - vendor: update gopkg.in/yaml.v2 to the latest version (#4945)
+
+* Mon Mar 26 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32.1
+ - cmd/snapd: make sure signal handlers are established during early
+   daemon startup
+ - osutil: use tilde suffix for temporary files used for atomic
+   replacement
+ - cmd/snap-confine: apparmor: allow creating prefix path for
+   gl/vulkan
+ - tests: disentangle etc vs extrausers in core tests
+ - packaging: fix changelogs' typo
+
+* Sat Mar 24 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.32
+ - snap: make `snap run` look at the system-key for security profiles
+ - overlord/configstate: change how ssh is stopped/started
+ - cmd/snap-confine: nvidia: preserve globbed file prefix
+ - advisor: deal with missing commands.db file
+ - interfaces,release: probe seccomp features lazily
+ - interfaces: harden snap-update-ns profile
+ - polkit: Pass caller uid to PolicyKit authority
+ - tests: change debug for layout test
+ - cmd/snap-confine: don't use per-snap s-u-n profile
+ - many: backported fixes for layouts and symlinks
+ - cmd/snap-confine: nvidia: add tls/libnvidia-tls.so* glob
+ - cmd/snap-update-ns: use x-snapd.{synthetic,needed-by} in practice
+ - snap: Call SanitizePlugsSlots from InfoFromSnapYaml
+ - cmd/snap-confine: fix ptrace rule with snap-confine peer
+ - tests: update tests to deal with s390x quirks
+ - snapstate: add compat mode for default-provider"snapname:ifname"
+ - snap-confine: fallback to /lib/udev/snappy-app-dev if the core is
+   older
+ - tests: a bunch of test fixes for s390x from looking at the
+   autopkgtest logs
+ - packaging: recommend "gnupg" instead of "gnupg1 | gnupg"
+ - interfaces/builtin: let MM change qmi device attributes
+ - debian: undo snap.mount system unit removal
+ - snap: don't create empty Change with "Hold" state on disconnect
+ - tests: add workaround for s390x failure
+ - tests: make autopkgtest tests more targeted
+ - many: propagate contexts enough to be able to mark store
+   operations done from the Ensure loop
+ - store: cleanup test naming, dropping remoteRepo and
+   UbuntuStore(Repository)? references
+ - store: reorg auth refresh
+ - tests: autopkgtest may have non edge core too
+ - data: translate polkit strings
+ - snapstate: put layout feature behind feature flag
+ - errtracker: respect the /etc/whoopsie configuration
+ - overlord/snapstate: hold refreshes for 2h after seeding on classic
+ - many: cherry-pick relevant `go vet` 1.10 fixes to 2.32
+ - snap/squashfs: when installing from seed, try symlink before cp
+ - wrappers: services which are socket or timer activated should not
+   be started during boot
+ - many: generate and use per-snap snap-update-ns profile
+ - many: support holding refreshes by setting refresh.hold
+ - snap-confine, snap-seccomp: utilize new seccomp logging features
+ - many: remove snapd.refresh.{timer,service}
+ - many: add the snapd-generator
+ - polkit: do not shadow dbus errors, avoid panic in case of errors
+ - polkit: ensure error is properly set if dialog is dismissed
+ - xdgopenproxy: integrate xdg-open implementation into snapctl
+ - userd: add an OpenFile method for launching local files with xdg-
+   open
+ - asserts:  use a timestamp for the assertion after the signing key
+   has been created
+ - ifacestate: be consistent passing Retry.After as named field
+ - interfaces/apparmor,system-key: add upperdir snippets for strict
+   snaps on livecd
+   interfaces/apparmor,system-key: add upperdir snippets for strict
+   snaps
+ - configstate: when disable "ssh" we must disable the "sshd"
+   service
+ - store: don't ask for snap_yaml_raw except on the details endpoint
+ - osutil: handle file being matched by multiple patterns
+ - cmd/snap-update-ns: use recursive bind mounts for writable mimic
+ - cmd/snap-update-ns: use syscall.Symlink instead of os.Symlink
+ - interfaces/screen-inhibit-control,network-status: fix dbus path
+   and interface typos
+ - interfaces/network-status: fix use of '/' in interface in DBus
+   rule
+ - interfaces/screen-inhibit-control: fix use of '.' in path in DBus
+   rule
+ - overlord/snapstate: fix task iteration order in
+   TestDoPrereqRetryWhenBaseInFlight
+ - interfaces: add an interface for gnome-online-accounts D-Bus
+   service
+ - snap: pass full timer spec in `snap run --timer`
+ - cmd/snap: introduce `snap run --timer`
+ - snapstate: auto install default-providers for content snaps
+ - hooks/strutil: limit the number of data read from the hooks to
+   avoid oom
+ - osutil: aggregate mockable symbols
+ - tests: make sure snapd is running before attempting to remove
+   leftover snaps
+ - timeutil: account for 24h wrap when flattening clock spans
+ - many: send  new Snap-CDN header with none or with cloud instance
+   placement info as needed
+ - cmd/snap-update-ns,testutil: move syscall testing helpers
+ - tests: disable interfaces-location-control on s390x
+ - tests: new spread test for gpio-memory-control interface
+ - tests: spread test for broadcom-asic-control interface
+ - tests: make restore of interfaces-password-manager-service more
+   robust
+ - tests/lib/prepare-restore: sync journal before rotating and
+   vacuuming
+ - overlord/snapstate: use spread in the default refresh schedule
+ - tests: fixes for autopkgtest in bionic
+ - timeutil: introduce helpers for checking it time falls inside the
+   schedule
+ - cmd/snap-repair,httputil: set snap-repair User-Agent on requests
+ - vendor: resync formatting of vendor.json
+ - snapstate/ifacestate: auto-connect tasks
+ - cmd/snap: also include tracking channel in list output.
+ - interfaces/apparmor: use snap revision with surrounding '.' when
+   replacing in glob
+ - debian,vendor: import github.com/snapcore/squashfs and use
+ - many: implement "refresh-mode: {restart,endure,...}" for services
+ - daemon: make the ast-inspecting test smarter; drop 'exceptions'
+ - tests: new spread test for kvm interface
+ - cmd/snap: tweaks to 'snap info' output
+ - snap: remove underscore from version validator regexp
+ - testutil: add File{Matches,Equals,Contains} checkers.
+ - snap: improve the version validator's error messages.
+ - osutil: refactor EnsureFileState to separate out the comparator
+ - timeutil: fix scheduling on nth weekday of the month
+ - cmd/snap-update-ns: small refactor for upcoming per-user mounts
+ - many: rename snappy-app-dev to snap-device-helper
+ - systemd: add default target for timers
+ - interfaces: miscellaneous policy updates for home, opengl, time-
+   control, network, et al
+ - cmd/snap: linter cleanups
+ - interfaces/mount: generate per-user mount profiles
+ - cmd/snap: use proper help strings for `snap userd --help`
+ - packaging: provide a compat symlink for snappy-app-dev
+ - interfaces/time-control,netlink-audit: adjust for util-linux
+   compiled with libaudit
+ - tests: adding new test to validate the raw-usb interface
+ - snap: add support for `snap run --gdb`
+ - interfaces/builtin: allow MM to access login1
+ - packaging: fix build on sbuild
+ - store: revert PR#4532 and do not display displayname
+ - interfaces/mount: add support for per-user mount entries
+ - cmd/system-shutdown: move sync to be even more pessimistic
+ - osutil: reimplement IsMounted with LoadMountInfo
+ - tests/main/ubuntu-core-services: enable snapd.refresh.timer for
+   the test
+ - many: don't allow layout construction to silently fail
+ - interfaces/apparmor: ensure snap-confine profile for reexec is
+   current
+ - interfaces/apparmor: generalize apparmor load and unload helpers
+ - tests: removing packages which are not needed anymore to generate
+   random data
+ - snap: improve `snap run` comments/naming
+ - snap: allow options for --strace, e.g. `snap run --strace="-tt"`
+ - tests: fix spread test failures on 18.04
+ - systemd: update comment on SocketsTarget
+ - osutil: add and update docstrings
+ - osutil: parse mount entries without options field
+ - interfaces: mock away real mountinfo/fstab
+ - many: move /lib/udev/snappy-app-dev to /usr/lib/snapd/snappy-app-
+   dev
+ - overlord/snapstate/backend: perform cleanup if snap setup fails
+ - tests/lib/prepare: disable snapd.refresh.timer
+ - daemon: remove redundant UserOK markings from api commands
+ - snap: introduce  timer service data types and validation
+ - cmd/snap: fix UX of snap services
+ - daemon: allow `snapctl get` from any uid
+ - debian, snap: only static link libseccomp in snap-seccomp on
+   ubuntu
+ - all: snap versions are now validated
+ - many: add nfs-home flag to system-key
+ - snap: disallow layouts in various special directories
+ - cmd/snap: add help for service commands.
+ - devicestate: fix autopkgtest failure in
+   TestDoRequestSerialErrorsOnNoHost
+ - snap,interfaces: allow using bind-file layouts
+ - many: move mount code to osutil
+ - snap: understand directories in layout blacklist
+ - snap: use custom unsquashfsStderrWriter for unsquashfs error
+   detection
+ - tests/main/user-data-handling: get rid of ordering bug
+ - snap: exclude `gettimeofday` from `snap run --strace`
+ - tests: check if snapd.socket is active before stoping it
+ - snap: sort layout elements before validating
+ - strutil: introducing MatchCounter
+ - snap: detect unsquashfs write failures
+ - spread: add missing ubuntu-18.04-arm64 to available autopkgtest
+   machines
+ - cmd/snap-confine: allow mounting anywhere, effectively
+ - daemon: improve ucrednet code for the snap.socket
+ - release, interfaces: add new release.AppArmorFeatures helper
+ - snap: apply some golint suggestions
+ - many: add interfaces.SystemKey() helper
+ - tests: new snaps to test installs nightly
+ - tests: skip alsa interface test when the system does not have any
+   audio devices
+ - debian/rules: workaround for
+   https://github.com/golang/go/issues/23721
+ - interfaces/apparmor: early support for snap-update-ns snippets
+ - wrappers: cleanup enabled service sockets
+ - cmd/snap-update-ns: large refactor / update of unit tests
+ - interfaces/apparmor: remove leaked future layout code
+ - many: allow constructing layouts (phase 1)
+ - data/systemd: for debugging/testing use /etc/environment also for
+   snap-repair runs
+ - cmd/snap-confine: create lib/{gl,gl32,vulkan} under /var/lib/snapd
+   and chown as root:root
+ - overlord/configstate/config: make [GS]etSnapConfig use *RawMessage
+ - daemon: refactor snapFooMany helpers a little
+ - cmd/snap-confine: allow snap-update-ns to chown things
+ - interfaces/apparmor: use a helper to set the scope
+ - overlord/configstate/config: make SetSnapConfig delete on empty
+ - osutil: make MkdirAllChown clean the path passed in
+ - many: at seeding try to capture cloud information into core config
+   under "cloud"
+ - cmd/snap: add completion conversion helper to increase DRY
+ - many: remove "content" argument from snaptest.MockSnap()
+ - osutil: allow using many globs in EnsureDirState
+ - cmd/snap-confine: fix read-only filesystem when mounting nvidia
+   files in biarch
+ - tests: use root path to /home/test/tmp to avoid lack of space
+   issue
+ - packaging: create /var/lib/snapd/lib/{gl,gl32,vulkan} as part of
+   packaging
+ - tests: update kill-timeout focused on making tests pass on boards
+ - advisor: ensure commands.db has mode 0644 and add test
+ - snap: improve validation of snap layouts
+ - tests: ensure disabled services are masked
+ - interfaces/desktop-legacy,unity7: support gtk2/gvfs gtk_show_uri()
+ - systemd, wrappers: start all snap services in one systemctl call
+ - mir: software clients need access to shared memory /dev/shm/#*
+ - snap: add support for `snap advise-snap pkgName`
+ - snap: fix command-not-found on core devices
+ - tests: new spead test for openvswitch-support interface
+ - tests: add integration for local snap licenses
+ - config: add (Get|Set)SnapConfig to do bulk config e.g. from
+   snapshots
+ - cmd/snap: display snap license information
+ - tests: enable content sharing test for $SNAP
+ - osutil: add ContextWriter and RunWithContext helpers.
+ - osutil: add DirExists and IsDirNotExist
+
+* Fri Mar 09 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.31.2
+ - many: add the snapd-generator
+ - polkit: ensure error is properly set if dialog is dismissed
+ - xdgopenproxy: integrate xdg-open implementation into snapctl
+ - userd: add an OpenFile method for launching local files with xdg-
+   open
+ - configstate: when disable "ssh" we must disable the "sshd"
+   service
+ - many: remove snapd.refresh.{timer,service}
+ - interfaces/builtin: allow MM to access login1
+ - timeutil: account for 24h wrap when flattening clock spans
+ - interfaces/screen-inhibit-control,network-status: fix dbus path
+   and interface typos
+ - systemd, wrappers: start all snap services in one systemctl
+   call
+ - tests: disable interfaces-location-control on s390x
+
+* Mon Mar 05 2018 Neal Gompa <ngompa13@gmail.com> - 2.31.1-2
+- Fix dependencies for devel subpackage
+
+* Sun Mar 04 2018 Neal Gompa <ngompa13@gmail.com> - 2.31.1-1
+- Release 2.31.1 to Fedora (RH#1542483)
+- Drop all backported patches as they're part of this release
+
+* Tue Feb 20 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.31.1
+ - tests: multiple autopkgtest related fixes for 18.04
+ - overlord/snapstate: use spread in the default refresh schedule
+ - timeutil: fix scheduling on nth weekday of the month
+ - interfaces: miscellaneous policy updates for home, opengl, time-
+   control, network, et al
+ - cmd/snap: use proper help strings for `snap userd --help`
+ - interfaces/time-control,netlink-audit: adjust for util-linux
+   compiled with libaudit
+ - rules: do not static link on powerpc
+ - packaging: revert LDFLAGS rewrite again after building snap-
+   seccomp
+ - store: revert PR#4532 and do not display displayname
+ - daemon: allow `snapctl get` from any uid
+ - debian, snap: only static link libseccomp in snap-seccomp on
+   ubuntu
+ - daemon: improve ucrednet code for the snap.socket
+
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.30-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Tue Feb 06 2018 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.31
+ - cmd/snap-confine: allow snap-update-ns to chown things
+ - cmd/snap-confine: fix read-only filesystem when mounting nvidia
+   files in biarch
+ - packaging: create /var/lib/snapd/lib/{gl,gl32,vulkan} as part of
+   packaging
+ - advisor: ensure commands.db has mode 0644 and add test
+ - interfaces/desktop-legacy,unity7: support gtk2/gvfs gtk_show_uri()
+ - snap: improve validation of snap layoutsRules for validating
+   layouts:
+ - snap: fix command-not-found on core devices
+ - cmd/snap: display snap license information
+ - tests: enable content sharing test for $SNAP
+ - userd: add support for a simple UI that can be used from userd
+ - snap-confine/nvidia: Support legacy biarch trees for GLVND systems
+ - tests: generic detection of gadget and kernel snaps
+ - cmd/snap-update-ns: refactor and improve Change.Perform to handle
+   EROFS
+ - cmd/snap: improve output when snaps were found in a section or the
+   section is invalid
+ - cmd/snap-confine,tests: hide message about stale base snap
+ - cmd/snap-mgmt: fix out of source tree build
+ - strutil/quantity: new package that exports formatFoo (from
+   progress)
+ - cmd/snap: snap refresh --time with new and legacy schedules
+ - state: unknown tasks handler
+ - cmd/snap-confine,data/systemd: fix removal of snaps inside LXD
+ - snap: add io.snapcraft.Settings to `snap userd`
+ - spread: remove more EOLed releases
+ - snap: tidy up top-level help output
+ - snap: fix race in `snap run --strace`
+ - tests: update "searching" test to match store changes
+ - store: use the "publisher" when populating the "publisher" field
+ - snap: make `snap find --section` show all sections
+ - tests: new test to validate location control interface
+ - many: add new `snap refresh --amend <snap>` command
+ - tests/main/kernel-snap-refresh-on-core: skip the whole test if
+   edge and stable are the same version
+ - tests: set test kernel-snap-refresh-on-core to manual
+ - tests: new spread test for interface gpg-keys
+ - packaging/fedora: Merge changes from Fedora Dist-Git plus trivial
+   fix
+ - interfaces: miscellaneous policy updates
+ - interfaces/builtin: Replace Solus support with GLVND support
+ - tests/main/kernel-snap-refresh-on-core: do not fail if edge and
+   stable kernels are the same version
+ - snap: add `snap run --strace` to be able to strace snap apps
+ - tests: new spread test for ssh-keys interface
+ - errtracker: include detected virtualisation
+ - tests: add new kernel refresh/revert test for spread-cron
+ - interfaces/builtin: blacklist zigbee dongle
+ - cmd/snap-confine: discard stale mount namespaces
+ - cmd: remove unused execArg0/execEnv
+ - snap,interfaces/mount: disallow nobody/nogroup
+ - cmd/snap: improve `snap aliases` output when no aliases are
+   defined
+ - tests/lib/snaps/test-snapd-service: refactor service reload
+ - tests: new spread test for gpg-public-keys interface
+ - tests: new spread test for ssh-public-keys interface
+ - spread: setup machine creation on Linode
+ - interfaces/builtin: allow introspecting UDisks2
+ - interfaces/builtin: add support for content "source" section
+ - tests: new spread test for netlink-audit interface
+ - daemon: avoid panic'ing building an error response w/no snaps
+   given
+ - interfaces/mount,snap: early support for snap layouts
+ - daemon: unlock state even if RefreshSchedule() fails
+ - arch: add "armv8l" to ubuntuArchFromKernelArch table
+ - tests: fix for test interface-netlink-connector
+ - data/dbus: add AssumedAppArmorLabel=unconfined
+ - advisor: use forked bolt to make it work on ppc
+ - overlord/snapstate: record the 'kind' of conflicting change
+ - dirs: fix snap mount dir on Manjaro
+ - overlord/{snapstate,configstate}, daemon: introduce refresh.timer,
+   fallback to refresh.schedule
+ - config: add support for `snap set core proxy.no_proxy=...`
+ - snap-mgmt: extend spread tests, stop, disable and cleanup snap
+   services
+ - spread.yaml: add fedora 27
+ - cmd/snap-confine: allow snap-update-ns to poke writable holes in
+   $SNAP
+ - packaging/14.04: move linux-generic-lts-xenial to recommends
+ - osutil/sys: ppc has 32-bit getuid already
+ - snapstate: make no autorefresh message clearer
+ - spread: try to enable Fedora once more
+ - overlord/snapstate: do a minimal sanity check on containers
+ - configcore: ensure config.txt has a final newline
+ - cmd/libsnap-confine-private: print failed mount/umount regardless
+   of SNAP_CONFINE_DEBUG
+ - debian/tests: add missing autopkgtest test dependencies for debian
+ - image: port ini handling to goconfigparser
+ - tests/main/snap-service-after-before: add test for after/before
+   service ordering
+ - tests: enabling opensuse for tests
+ - tests: update auto-refresh-private to match messages from current
+   master
+ - dirs: check if distro 'is like' fedora when picking path to
+   libexecdir
+ - tests: fix "job canceled" issue and improve cleanup for snaps
+ - cmd/libsnap-confine-private: add debug build of libsnap-confine-
+   private.a, link it into snap-confine-debug
+ - vendor: remove x/sys/unix to fix builds on arm64 and powerpc
+ - image: let consume snapcraft export-login files from tooling
+ - interfaces/mir: allow Wayland socket and non-root sockets
+ - interfaces/builtin: use snap.{Plug,Slot}Info over
+   interfaces.{Plug,Slot}
+ - tests: add simple snap-mgmt test
+ - wrappers: autogenerate After/Before in systemd's service files for
+   apps
+ - snap: add usage hints in `snap download`
+ - snap: provide more meaningful errors for installMany and friends
+ - cmd/snap: show header/footer when `snap find` is used without
+   arguments
+ - overlord/snapstate: for Enable's tasks refer to the first task
+   with snap-setup, do not duplicate
+ - tests: add hard-coded fully expired macaroons to run related tests
+ - cmd/snap-update-ns: new test features
+ - cmd/snap-update-ns: we don't want to bind mount symlinks
+ - interfaces/mount: test OptsToCommonFlags, filter out x-snapd.
+   options
+ - cmd/snap-update-ns: untangle upcoming cyclic initialization
+ - client, daemon: update user's email when logging in with new
+   account
+ - tests: ensure snap-confine apparmor profile is parsable
+ - snap: do not leak internal errors on install/refresh etc
+ - snap: fix missing error check when multiple snaps are refreshed
+ - spread: trying to re-enable tests on Fedora
+ - snap: fix gadget.yaml parsing for multi volume gadgets
+ - snap: give the snap.Container interface a Walk method
+ - snap: rename `snap advise-command` to `snap advise-snap --command`
+ - overlord/snapstate: no refresh just for hints if there was a
+   recent regular full refresh
+ - progress: switch ansimeter's Spin() to use a spinner
+ - snap: support `command-not-found` symlink for `snap advise-
+   command`
+ - daemon: store email, ID and macaroon when creating a new user
+ - snap: app startup after/before validation
+ - timeutil: refresh timer take 2
+ - store, daemon/api: Rename MyAppsServer, point to
+   dashboard.snapcraft.io instead
+ - tests: use "quiet" helper instead of "dnf -q" to get errors on
+   failures
+ - cmd/snap-update-ns: improve mocking for tests
+ - many: implement the advisor backend, populate it from the store
+ - tests: make less calls to the package manager
+ - tests/main/confinement-classic: enable the test on Fedora
+ - snap: do not leak internal network errors to the user
+ - snap: use stdout instead of stderr for "fetching" message
+ - tests: fix test whoami, share successful_login.exp
+ - many: refresh with appropriate creds
+ - snap: add new `snap advice-command` skeleton
+ - tests: add test that ensures we never parse versions as numbers
+ - overlord/snapstate: override Snapstate.UserID in refresh if the
+   installing user is gone
+ - interfaces: allow socket "shutdown" syscall in default profile
+ - snap: print friendly message if `snap keys` is empty
+ - cmd/snap-update-ns: add execWritableMimic
+ - snap: make `snap info invalid-snap` output more user friendly
+ - cmd/snap,  tests/main/classic-confinement: fix snap-exec path when
+   running under classic confinement
+ - overlord/ifacestate: fix disable/enable cycle to setup security
+ - snap: fix snap find " " output
+ - daemon: add new polkit action to manage interfaces
+ - packaging/arch: disable services when removing
+ - asserts/signtool: support for building tools on top that fill-
+   in/compute some headers
+ - cmd: clarify "This leaves %s tracking %s." message
+ - daemon: return "bad-query" error kind for store.ErrBadQuery
+ - taskrunner/many: KnownTaskKinds helper
+ - tests/main/interfaces-fuse_support: fix confinement, allow
+   unmount, fix spread tests
+ - snap: use the -no-fragments mksquashfs option
+ - data/selinux: allow messages from policykit
+ - tests: fix catalog-update wait loop
+ - tests/lib/prepare-restore: disable rate limiting in journald
+ - tests: change interfaces-fuse_support to be debug friendly
+ - tests/main/postrm-purge: stop snapd before purge
+ - This is an example of test log:https://paste.ubuntu.com/26215170/
+ - tests/main/interfaces-fuse_support: dump more debugging
+   information
+ - interfaces/dbus: adjust slot policy for listen, accept and accept4
+   syscalls
+ - tests: save the snapd-state without compression
+ - tests/main/searching: handle changes in featured snaps list
+ - overlord/snapstate: fix auto-refresh summary for 2 snaps
+ - overlord/auth,daemon: introduce an explicit auth.ErrInvalidUser
+ - interfaces: add /proc/partitions to system-observe (This addresses
+   LP#1708527.)
+ - tests/lib: introduce helpers for setting up /dev/random using
+   /dev/urandom in project prepare
+ - tests: new test for interface network status
+ - interfaces: interfaces: also add an app/hook-specific udev RUN
+   rule for hotplugging
+ - tests: fix external backend for tests that need DEBUG output
+ - tests: do not disable refresh timer on external backend
+ - client: send all snap related bool json fields
+ - interfaces/desktop,unity7: allow status/activate/lock of
+   screensavers
+ - tests/main: source mkpinentry.sh
+ - tests: fix security-device-cgroups-serial-port test for rpi and db
+ - cmd/snap-mgmt: add more directories for cleanup and refactor
+   purge() code
+ - snap: YAML and data structures for app before/after ordering
+ - tests: set TRUST_TEST_KEYS=false for all the external backends
+ - packaging/arch: install snap-mgmt tool
+ - tests: add support on tests for cm3 gadget
+ - interfaces/removable-media: also allow 'k' (lock)
+ - interfaces: use ConnectedPlug/ConnectedSlot types (step 2)
+ - interfaces: rename sanitize methods
+ - devicestate: fix misbehaving test when using systemd-resolved
+ - interfaces: added Ref() helpers, restored more detailed error
+   message on spi iface
+ - debian: make "gnupg" a recommends
+ - interfaces/many: misc updates for default, browser-support,
+   opengl, desktop, unity7, x11
+ - interfaces: PlugInfo/SlotInfo/ConnectedPlug/ConnectedSlot
+   attribute helpers
+ - interfaces: update fixme comments
+ - tests: make interfaces-snapd-control-with-manage more robust
+ - userd: generalize dbusInterface
+ - interfaces: use ConnectedPlug/ConnectedSlot types (step 1)
+ - hookstate: add compat "configure-snapd" task.
+ - config, overlord/snapstate, timeutil: rename ParseSchedule to
+   ParseLegacySchedule
+ - tests: adding tests for time*-control interfaces
+ - tests: new test to check interfaces after reboot the system
+ - cmd/snap-mgmt: fixes
+ - packaging/opensuse-42.2: package and use snap-mgmt
+ - corecfg: also "mask" services when disabling them
+ - cmd/snap-mgmt: introduce snap-mgmt tool
+ - configstate: simplify ConfigManager
+ - interfaces: add gpio-memory-control interface
+ - cmd: disable check-syntax-c
+ - packaging/arch: add bash-completion as optional dependency
+ - corecfg: rename package to overlord/configstate/configcore
+ - wrappers: fix unit tests to use dirs.SnapMountDir
+ - osutil/sys: reimplement getuid and chown with the right int type
+ - interfaces-netlink-connector: fix sourcing snaps.sh
+
+* Thu Jan 25 2018 Neal Gompa <ngompa13@gmail.com> - 2.30-1
+- Release 2.30 to Fedora (RH#1527519)
+- Backport fix to correctly locate snapd libexecdir on Fedora derivatives (RH#1536895)
+- Refresh SELinux policy fix patches with upstream backport version
+
+* Mon Dec 18 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.30
+ - tests: set TRUST_TEST_KEYS=false for all the external backends
+ - tests: fix external backend for tests that need DEBUG output
+ - tests: do not disable refresh timer on external backend
+ - client: send all snap related bool json fields
+ - interfaces: interfaces: also add an app/hook-specific udev RUN
+   rule for hotplugging
+ - interfaces/desktop,unity7: allow status/activate/lock of
+   screensavers
+ - tests/main: source mkpinentry.sh
+ - devicestate: use a different nowhere domain
+ - interfaces: add ssh-keys, ssh-public-keys, gpg-keys and gpg-public
+   keys interfaces
+ - interfaces/many: misc updates for default, browser-support, opengl,
+   desktop, unity7, x11
+ - devicestate: fix misbehaving test when using systemd-resolved
+ - interfaces/removable-media: also allow 'k' (lock)
+ - interfaces/many: misc updates for default, browser-support,
+   opengl, desktop, unity7, x11
+ - corecfg: also "mask" services when disabling them
+ - tests: add support for autopkgtests on s390x
+ - snapstate: support for pre-refresh hook
+ - many: allow to configure core before it is installed
+ - devicestate: fix unkeyed fields error
+ - snap-confine: create mount target for lib32,vulkan on demand
+ - snapstate: add support for refresh.schedule=managed
+ - cmd/snap-update-ns: teach update logic to handle synthetic changes
+ - many: remove configure-snapd task again and handle internally
+ - snap: fix TestDirAndFileMethods() test to work with gccgo
+ - debian: ensure /var/lib/snapd/lib/vulkan is available
+ - cmd/snap-confine: use #include instead of bare include
+ - snapstate: store userID in snapstate
+ - snapd.dirs: add var/lib/snapd/lib/gl32
+ - timeutil, overlod/snapstate: cleanup remaining pieces of timeutil
+   weekday support
+ - packaging/arch: install missing directories, manpages and version
+   info
+ - snapstate,store: store if a snap is a paid snap in the sideinfo
+ - packaging/arch: pre-create snapd directories when packaging
+ - tests/main/manpages: set LC_ALL=C as man may complain if the
+   locale is unset or unsupported
+ - repo: ConnectedPlug and ConnectedSlot types
+ - snapd: fix handling of undo in the taskrunner
+ - store: fix download caching and add integration test
+ - snapstate: move autorefresh code into autoRefresh helper
+ - snapctl: don't error out on start/stop/restart from configure hook
+   during install or refresh
+ - cmd/snap-update-ns: add planWritableMimic
+ - deamon: don't omit responses, even if null
+ - tests: add test for frame buffer interface
+ - tests/lib: fix shellcheck errors
+ - apparmor: generate the snap-confine re-exec profile for
+   AppArmor{Partial,Full}
+ - tests: remove obsolete workaround
+ - snap: use existing files in `snap download` if digest/size matches
+ - tests: merge pepare-project.sh into prepare-restore.sh
+ - tests: cache snaps to $TESTSLIB/cache
+ - tests: set -e, -o pipefail in prepare-restore.sh
+ - apparmor: generate the snap-confine re-exec profile for
+   AppArmor{Partial,Full}
+ - cmd/snap-seccomp: fix uid/gid restrictions tests on Arch
+ - tests: document and slightly refactor prepare/restore code
+ - snapstate: ensure RefreshSchedule() gives accurate results
+ - snapstate: add new refresh-hints helper and use it
+ - spread.yaml,tests: move most of project-wide prepare/restore to
+   separate file
+ - timeutil: introduce helpers for weekdays and TimeOfDay
+ - tests: adding new test for uhid interface
+ - cmd/libsnap: fix parsing of empty mountinfo fields
+ - overlord/devicestate:  best effort to go to early full retries for
+   registration on the like of DNS no host
+ - spread.yaml: bump delta ref to 2.29
+ - tests: adding test to test physical memory observe interface
+ - cmd, errtracker: get rid of SNAP_DID_REEXEC environment
+ - timeutil: remove support to parse weekday schedules
+ - snap-confine: add workaround for snap-confine on 4.13/upstream
+ - store: do not log the http body for catalog updates
+ - snapstate: move catalogRefresh into its own helper
+ - spread.yaml: fix shellcheck issues and trivial refactor
+ - spread.yaml: move prepare-each closer to restore-each
+ - spread.yaml: increase workers for opensuse to 3
+ - tests: force delete when tests are restore to avoid suite failure
+ - test: ignore /snap/README
+ - interfaces/opengl: also allow read on 'revision' in
+   /sys/devices/pci...
+ - interfaces/screen-inhibit-control: fix case in screen inhibit
+   control
+ - asserts/sysdb: panic early if pointed to staging but staging keys
+   are not compiled-in
+ - interfaces: allow /bin/chown and fchownat to root:root
+ - timeutil: include test input in error message in
+   TestParseSchedule()
+ - interfaces/browser-support: adjust base declaration for auto-
+   connection
+ - snap-confine: fix snap-confine under lxd
+ - store: bit less aggressive retry strategy
+ - tests: add new `fakestore new-snap-{declaration,revision}` helpers
+ - cmd/snap-update-ns: add secureMkfileAll
+ - snap: use field names when initializing composite literals
+ - HACKING: fix path in snap install
+ - store: add support for flags in ListRefresh()
+ - interfaces: remove invalid plugs/slots from SnapInfo on
+   sanitization.
+ - debian: add missing udev dependency
+ - snap/validate: extend socket validation tests
+ - interfaces: add "refresh-schedule" attribute to snapd-control
+ - interfaces/builtin/account_control: use gid owning /etc/shadow to
+   setup seccomp rules
+ - cmd/snap-update-ns: tweak changePerform
+ - interfaces,tests: skip unknown plug/slot interfaces
+ - tests: disable interfaces-network-control-tuntap
+ - cmd: use a preinit_array function rather than parsing
+   /proc/self/cmdline
+ - interfaces/time*_control: explicitly deny noisy read on
+   /proc/1/environ
+ - cmd/snap-update-ns: misc cleanups
+ - snapd: allow hooks to have slots
+ - fakestore: add go-flags to prepare for `new-snap-declaration` cmd
+ - interfaces/browser-support: add shm path for nwjs
+ - many: add magic /snap/README file
+ - overlord/snapstate: support completion for command aliases
+ - tests: re-enable tun/tap test on Debian
+ - snap,wrappers: add support for socket activation
+ - repo: use PlugInfo and SlotInfo for permanent plugs/slots
+ - tests/interfaces-network-control-tuntap: disable on debian-
+   unstable for now
+ - cmd/snap-confine: Loosen the NVIDIA Vulkan ICD glob
+ - cmd/snap-update-ns: detect and report read-only filesystems
+ - cmd/snap-update-ns: re-factor secureMkdirAll into
+   secureMk{Prefix,Dir}
+ - run-checks, tests/lib/snaps/: shellcheck fixes
+ - corecfg: validate refresh.schedule when it is applied
+ - tests: adjust test to match stderr
+ - snapd: fix snap cookie bugs
+ - packaging/arch: do not quote MAKEFLAGS
+ - state: add change.LaneTasks helper
+ - cmd/snap-update-ns: do not assume 'nogroup' exists
+ - tests/lib: handle distro specific grub-editenv naming
+ - cmd/snap-confine: Add missing bi-arch NVIDIA filesthe
+   `/var/lib/snapd/lib/gl:/var/lib/snapd/lib/gl/vdpau` paths within
+ - cmd: Support exposing NVIDIA Vulkan ICD files to the snaps
+ - cmd/snap-confine: Implement full 32-bit NVIDIA driver support
+ - packaging/arch: packaging update
+ - cmd/snap-confine: Support bash as base runtime entry
+ - wrappers: do not error on incorrect Exec= lines
+ - interfaces: fix udev tagging for hooks
+ - tests/set-proxy-store: exclude ubuntu-core-16 via systems: key
+ - tests: new tests for network setup control and observe interfaces
+ - osutil: add helper for obtaining group ID of given file path
+ - daemon,overlord/snapstate: return snap-not-installed error in more
+   cases
+ - interfaces/builtin/lxd_support: allow discovering of host's os-
+   release
+ - configstate: add support for configure-snapd for
+   snapstate.IgnoreHookError
+ - tests:  add a spread test for proxy.store setting together with
+   store assertion
+ - cmd/snap-seccomp: do not use group 'shadow' in tests
+ - asserts/assertstest:  fix use of hardcoded value when the passed
+   or default keys should be used
+ - interfaces/many: misc policy updates for browser-support, cups-
+   control and network-status
+ - tests: fix xdg-open-compat
+ - daemon: for /v2/logs, 404 when no services are found
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+ - cmd/snap-update-ns: add new helpers for mount entries
+ - cmd/snap-confine: Respect biarch nature of libdirs
+ - cmd/snap-confine: Ensure snap-confine is allowed to access os-
+   release
+ - cmd: fix re-exec bug with classic confinement for host snapd <
+   2.28
+ - interfaces/kmod: simplify loadModules now that errors are ignored
+ - tests: disable xdg-open-compat test
+ - tests: add test that checks core reverts on core devices
+ - dirs: use alt root when checking classic confinement support
+   without …
+ - interfaces/kmod: treat failure to load module as non-fatal
+ - cmd/snap-update-ns: fix golint and some stale comments
+ - corecfg:  support setting proxy.store if there's a matching store
+   assertion
+ - overlord/snapstate: toggle ignore-validation as needed as we do
+   for channel
+ - tests: fix security-device-cgroup* tests on devices with
+   framebuffer
+ - interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS
+ - interfaces: add USB interface number attribute in udev rule for
+   serial-port interface
+ - overlord/devicestate: switch to the new endpoints for registration
+ - snap-update-ns: add missing unit test for desired/current profile
+   handling
+ - cmd/{snap-confine,libsnap-confine-private,snap-shutdown}: cleanup
+   low-level C bits
+ - ifacestate: make interfaces.Repository available via state cache
+ - overlord/snapstate: cleanups around switch-snap*
+ - cmd/snapd,client,daemon: display ignore-validation flag through
+   the notes mechanism
+ - cmd/snap-update-ns: add logging to snap-update-ns
+ - many: have a timestamp on store assertions
+ - many: lookup and use the URL from a store assertion if one is set
+   for use
+ - tests/test-snapd-service: fix shellcheck issues
+ - tests: new test for hardware-random-control interface
+ - tests: use `snap change --last=install` in snapd-reexec test
+ - repo, daemon: use PlugInfo, SlotInfo
+ - many: handle core configuration internally instead of using the
+   core configure hook
+ - tests: refactor and expand content interface test
+ - snap-seccomp: skip in-kernel bpf tests for socket() in trusty/i386
+ - cmd/snap-update-ns: allow Change.Perform to return changes
+ - snap-confine: Support biarch Linux distribution confinement
+ - partition/ubootenv: don't panic when uboot.env is missing the eof
+   marker
+ - cmd/snap-update-ns: allow fault injection to provide dynamic
+   result
+ - interfaces/mount: exspose mount.{Escape,Unescape}
+ - snapctl: added long help to stop/start/restart command
+ - cmd/snap-update-ns: create missing mount points automatically.
+ - cmd: downgrade log message in InternalToolPath to Debugf()
+ - tests: wait for service status change & file update in the test to
+   avoid races
+ - daemon, store: forward SSO invalid credentials errors as 401
+   Unauthorized responses
+ - spdx: fix for WITH syntax, require a license name before the
+   operator
+ - many: reorg things in preparation to make handling of the base url
+   in store dynamic
+ - hooks/configure: queue service restarts
+ - cmd/snap: warn when a snap is not from the tracking channel
+ - interfaces/mount: add support for parsing x-snapd.{mode,uid,gid}=
+ - cmd/snap-confine: add detection of stale mount namespace
+ - interfaces: add plugRef/slotRef helpers for PlugInfo/SlotInfo
+ - tests: check for invalid udev files during all tests
+ - daemon: use newChange() in changeAliases for consistency
+ - servicestate: use taskset
+ - many: add support for /home on NFS
+ - packaging,spread: fix and re-enable opensuse builds
+
+* Sun Dec 17 2017 Neal Gompa <ngompa13@gmail.com> - 2.29.4-3
+- Add patch to SELinux policy to allow snapd to receive replies from polkit
+
+* Sun Nov 19 2017 Neal Gompa <ngompa13@gmail.com> - 2.29.4-2
+- Add missing bash completion files and cache directory
+
+* Sun Nov 19 2017 Neal Gompa <ngompa13@gmail.com> - 2.29.4-1
+- Release 2.29.4 to Fedora (RH#1508433)
+- Install Polkit configuration (RH#1509586)
+- Drop changes to revert cheggaaa/pb import path used
+
+* Fri Nov 17 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.29.4
+ - snap-confine: fix snap-confine under lxd
+ - tests: disable classic-ubuntu-core-transition on i386 temporarily
+ - many: reject bad plugs/slots
+ - interfaces,tests: skip unknown plug/slot interfaces
+ - store: enable "base" field from the store
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+
+* Thu Nov 09 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.29.3
+ - daemon: cherry-picked /v2/logs fixes
+ - cmd/snap-confine: Respect biarch nature of libdirs
+ - cmd/snap-confine: Ensure snap-confine is allowed to access os-
+   release
+ - interfaces: fix udev tagging for hooks
+ - cmd: fix re-exec bug with classic confinement for host snapd
+ - tests: disable xdg-open-compat test
+ - cmd/snap-confine: add slave PTYs and let devpts newinstance
+   perform mediation
+ - interfaces/many: misc policy updates for browser-support, cups-
+   control and network-status
+ - interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS
+ - tests: fix security-device-cgroup* tests on devices with
+   framebuffer
+
+* Fri Nov 03 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.29.2
+  - snapctl: disable stop/start/restart (2.29)
+  - cmd/snap-update-ns: fix collection of changes made
+
+* Fri Nov 03 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.29.1
+ - interfaces: fix incorrect signature of ofono DBusPermanentSlot
+ - interfaces/serial-port: udev tag plugged slots that have just
+   'path' via KERNEL
+ - interfaces/hidraw: udev tag plugged slots that have just 'path'
+   via KERNEL
+ - interfaces/uhid: unconditionally add existing uhid device to the
+   device cgroup
+ - cmd/snap-update-ns: fix mount rules for font sharing
+ - tests: disable refresh-undo test on trusty for now
+ - tests: use `snap change --last=install` in snapd-reexec test
+ - Revert " wrappers: fail install if exec-line cannot be re-written
+ - interfaces: don't udev tag devmode or classic snaps
+ - many: make ignore-validation sticky and send the flag with refresh
+   requests
+
+* Mon Oct 30 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.29
+ - interfaces/many: miscellaneous updates based on feedback from the
+   field
+ - snap-confine: allow reading uevents from any where in /sys
+ - spread: add bionic beaver
+ - debian: make packaging/ubuntu-14.04/copyright a real file again
+ - tests: cherry pick the fix for services test into 2.29
+ - cmd/snap-update-ns: initialize logger
+ - hooks/configure: queue service restarts
+ - snap-{confine,seccomp}: make @unrestricted fully unrestricted
+ - interfaces: clean system apparmor cache on core device
+ - debian: do not build static snap-exec on powerpc
+ - snap-confine: increase sanity_timeout to 6s
+ - snapctl: cherry pick service commands changes
+ - cmd/snap: tell translators about arg names and descs req's
+ - systemd: run all mount units before snapd.service to avoid race
+ - store: add a test to show auth failures are forwarded by doRequest
+ - daemon: convert ErrInvalidCredentials to a 401 Unauthorized error.
+ - store: forward on INVALID_CREDENTIALS error as
+   ErrInvalidCredentials
+ - daemon: generate a forbidden response message if polkit dialog is
+   dismissed
+ - daemon: Allow Polkit authorization to cancel changes.
+ - travis: switch to container based test runs
+ - interfaces: reduce duplicated code in interface tests mocks
+ - tests: improve revert related testing
+ - interfaces: sanitize plugs and slots early in ReadInfo
+ - store: add download caching
+ - preserve TMPDIR and HOSTALIASES across snap-confine invocation
+ - snap-confine: init all arrays with `= {0,}`
+ - tests: adding test for network-manager interface
+ - interfaces/mount: don't generate legacy per-hook/per-app mount
+   profiles
+ - snap: introduce structured epochs
+ - tests: fix interfaces-cups-control test for cups-2.2.5
+ - snap-confine: cleanup incorrectly created nvidia udev tags
+ - cmd/snap-confine: update valid security tag regexp
+ - cmd/libsnap: enable two stranded tests
+ - cmd,packaging: enable apparmor on openSUSE
+ - overlord/ifacestate: refresh all security backends on startup
+ - interfaces/dbus: drop unneeded check for
+   release.ReleaseInfo.ForceDevMode
+ - dbus: ensure io.snapcraft.Launcher.service is created on re-
+   exec
+ - overlord/auth: continue for now supporting UBUNTU_STORE_ID if the
+   model is generic-classic
+ - snap-confine: add support for handling /dev/nvidia-modeset
+ - interfaces/network-control: remove incorrect rules for tun
+ - spread: allow setting SPREAD_DEBUG_EACH=0 to disable debug-each
+   section
+ - packaging: remove .mnt files on removal
+ - tests: fix econnreset scenario when the iptables rule was not
+   created
+ - tests: add test for lxd interface
+ - run-checks: use nakedret static checker to check for naked
+   returns on long functions
+ - progress: be more flexible in testing ansimeter
+ - interfaces: fix udev rules for tun
+ - many: implement our own ANSI-escape-using progress indicator
+ - snap-exec: update tests to follow main_test pattern
+ - snap: support "command: foo $ENV_STRING"
+ - packaging: update nvidia configure options
+ - snap: add new `snap pack` and use in tests
+ - cmd: correctly name the "Ubuntu" and "Arch" NVIDIA methods
+ - cmd: add autogen case for solus
+ - tests: do not use http://canihazip.com/ which appears to be down
+ - hooks: commands for controlling own services from snapctl
+ - snap: refactor cmdGet.Execute()
+ - interfaces/mount: make Change.Perform testable and test it
+ - interfaces/mount,cmd/snap-update-ns: move change code
+ - snap-confine: is_running_on_classic_distribution() looks into os-
+   release
+ - interfaces: misc updates for default, browser-support, home and
+   system-observe
+ - interfaces: deny lttng by default
+ - interfaces/lxd: lxd slot implementation can also be an app snap
+ - release,cmd,dirs: Redo the distro checks to take into account
+   distribution families
+ - cmd/snap: completion for alias and unalias
+ - snap-confine: add new SC_CLEANUP and use it
+ - snap: refrain from running filepath.Base on random strings
+ - cmd/snap-confine: put processes into freezer hierarchy
+ - wrappers: fail install if exec-line cannot be re-written
+ - cmd/snap-seccomp,osutil: make user/group lookup functions public
+ - snapstate: deal with snap user data in the /root/ directory
+ - interfaces: Enhance full-confinement support for biarch
+   distributions
+ - snap-confine: Only attempt to copy/mount NVIDIA libs when NVIDIA
+   is used
+ - packaging/fedora: Add Fedora 26, 27, and Rawhide symlinks
+ - overlord/snapstate: prefer a smaller corner case for doing the
+   wrong thing
+ - cmd/snap-repair:  set user agent for snap-repair http requests
+ - packaging: bring down the delta between 14.04 and 16.04
+ - snap-confine: Ensure lib64 biarch directory is respected
+ - snap-confine: update apparmor rules for fedora based base snaps
+ - tests: Increase SNAPD_CONFIGURE_HOOK_TIMEOUT to 3 minutes to
+   install real snaps
+ - daemon: use client.Snap instead of map[string]interface{} for
+   snaps.
+ - hooks: rename refresh hook to post-refresh
+ - git: make the .gitingore file a bit more targeted
+ - interfaces/opengl: don't udev tag nvidia devices and use snap-
+   confine instead
+ - cmd/snap-{confine,update-ns}: apply mount profiles using snap-
+   update-ns
+ - cmd: update "make hack"
+ - interfaces/system-observe: allow clients to enumerate DBus
+   connection names
+ - snap-repair: implement `snap-repair {list,show}`
+ - dirs,interfaces: create snap-confine.d on demand when re-executing
+ - snap-confine: fix base snaps on core
+ - cmd/snap-repair: fix tests when running as root
+ - interfaces: add Connection type
+ - cmd/snap-repair: skip disabled repairs
+ - cmd/snap-repair: prefer leaking unmanaged fds on test failure over
+   closing random ones
+ - snap-repair: make `repair` binary available for repair scripts
+ - snap-repair: fix missing Close() in TestStatusHappy
+ - cmd/snap-confine,packaging: import snapd-generated policy
+ - cmd/snap: return empty document if snap has no configuration
+ - snap-seccomp: run secondary-arch tests via gcc-multilib
+ - snap: implement `snap {repair,repairs}` and pass-through to snap-
+   repair
+ - interfaces/builtin: allow receiving dbus messages
+ - snap-repair: implement `snap-repair {done,skip,retry}`
+ - data/completion: small tweak to snap completion snippet
+ - dirs: fix classic support detection
+ - cmd/snap-repair: integrate root public keys for repairs
+ - tests: fix ubuntu core services
+ - tests: add new test that checks that the compat snapd-xdg-open
+   works
+ - snap-confine: improve error message if core/u-core cannot be found
+ - tests: only run tests/regression/nmcli on amd64
+ - interfaces: mount host system fonts in desktop interface
+ - interfaces: enable partial apparmor support
+ - snapstate: auto-install missing base snaps
+ - spread: work around temporary packaging issue in debian sid
+ - asserts,cmd/snap-repair: introduce a mandatory summary for repairs
+ - asserts,cmd/snap-repair: represent RepairID internally as an int
+ - tests: test the real "xdg-open" from the core snap
+ - many: implement fetching sections and package names periodically.
+ - interfaces/network: allow using netcat as client
+ - snap-seccomp, osutil: use osutil.AtomicFile in snap-seccomp
+ - snap-seccomp: skip mknod syscall on arm64
+ - tests: add trivial canonical-livepatch test
+ - tests: add test that ensures that all core services are working
+ - many: add logger.MockLogger() and use it in the tests
+ - snap-repair: fix test failure in TestRepairHitsTimeout
+ - asserts: add empty values check in HeadersFromPrimaryKey
+ - daemon: remove unused installSnap var in test
+ - daemon: reach for Overlord.Loop less thanks to overlord.Mock
+ - snap-seccomp: manually resolve socket() call in tests
+ - tests: change regex used to validate installed ubuntu core snap
+ - cmd/snapctl: allow snapctl -h without a context (regression fix).
+ - many: use snapcore/snapd/i18n instead of i18n/dumb
+ - many: introduce asserts.NotFoundError replacing both ErrNotFound
+   and store.AssertionNotFoundError
+ - packaging: don't include any marcos in comments
+ - overlord: use overlord.Mock in more tests, make sure we check the
+   outcome of Settle
+ - tests: try to fix staging tests
+ - store: simplify api base url config
+ - systemd: add systemd.MockJournalctl()
+ - many: provide systemd.MockSystemctl() helper
+ - tests: improve the listing test to not fail for e.g. 2.28~rc2
+ - snapstate: give snapmgrTestSuite.settle() more time to settle
+ - tests: fix regex to check core version on snap list
+ - debian: update trusted account-keys check on 14.04 packaging
+ - interfaces: add udev netlink support to hardware-observe
+ - overlord: introduce Mock which enables to use Overlord.Settle for
+   settle in many more places
+ - snap-repair: execute the repair and capture logs/status
+ - tests: run the tests/unit/go everywhere
+ - daemon, snapstate: move ensureCore from daemon/api.go into
+   snapstate.go
+ - cmd/snap: get keys or root document
+ - spread.yaml: turn suse to manual given that it's breaking master
+ - many: configure store from state, reconfigure store at runtime
+ - osutil: AtomicWriter (an io.Writer), and io.Reader versions of
+   AtomicWrite*
+ - tests: check for negative syscalls in runBpf() and skip those
+   tests
+ - docs: use abolute path in PULL_REQUEST_TEMPLATE.md
+ - store: move device auth endpoint uris to config (#3831)
+
+* Sat Oct 14 2017 Neal Gompa <ngompa13@gmail.com> - 2.28.5-2
+- Properly fix the build for Fedora 25
+- Incorporate misc build fixes
+
+* Sat Oct 14 2017 Neal Gompa <ngompa13@gmail.com> - 2.28.5-1
+- Release 2.28.5 to Fedora (RH#1502186)
+- Build snap-exec and snap-update-ns statically to support base snaps
+
+* Fri Oct 13 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.28.5
+  - snap-confine: cleanup broken nvidia udev tags
+  - cmd/snap-confine: update valid security tag regexp
+  - overlord/ifacestate: refresh udev backend on startup
+  - dbus: ensure io.snapcraft.Launcher.service is created on re-
+    exec
+  - snap-confine: add support for handling /dev/nvidia-modeset
+  - interfaces/network-control: remove incorrect rules for tun
+
+* Thu Oct 12 2017 Neal Gompa <ngompa13@gmail.com> - 2.28.4-1
+- Release 2.28.4 to Fedora (RH#1501141)
+- Drop distro check backport patches (released with 2.28.2)
+
+* Wed Oct 11 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.28.4
+  - interfaces/opengl: don't udev tag nvidia devices and use snap-
+    confine instead
+  - debian: fix replaces/breaks for snap-xdg-open (thanks to apw!)
+
+* Wed Oct 11 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.28.3
+  - interfaces/lxd: lxd slot implementation can also be an app
+    snap
+
+* Tue Oct 10 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.28.2
+  - interfaces: fix udev rules for tun
+  - release,cmd,dirs: Redo the distro checks to take into account
+    distribution families
+
+* Sun Oct 08 2017 Neal Gompa <ngompa13@gmail.com> - 2.28.1-1
+- Release 2.28.1 to Fedora (RH#1495852)
+- Drop userd backport patches, they are part of 2.28 release
+- Backport changes to rework distro checks to fix derivative distro usage of snapd
+- Revert import path change for cheggaaa/pb as it breaks build on Fedora
+- Add a posttrans relabel to snapd-selinux to ensure everything is labeled correctly
+
+* Wed Sep 27 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.28.1
+  - snap-confine: update apparmor rules for fedora based basesnaps
+  - snapstate: rename refresh hook to post-refresh for consistency
+
+* Mon Sep 25 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.28
+ - hooks: rename refresh to after-refresh
+ - snap-confine: bind mount /usr/lib/snapd relative to snap-confine
+ - cmd,dirs: treat "liri" the same way as "arch"
+ - snap-confine: fix base snaps on core
+ - hooks: substitute env vars when executing hooks
+ - interfaces: updates for default, browser-support, desktop, opengl,
+   upower and stub-resolv.conf
+ - cmd,dirs: treat manjaro the same as arch
+ - systemd: do not run auto-import and repair services on classic
+ - packaging/fedora: Ensure vendor/ is empty for builds and fix spec
+   to build current master
+ - many: fix TestSetConfNumber missing an Unlock and other fragility
+   improvements
+ - osutil: adjust StreamCommand tests for golang 1.9
+ - daemon: allow polkit authorisation to install/remove snaps
+ - tests: make TestCmdWatch more robust
+ - debian: improve package description
+ - interfaces: add netlink kobject uevent to hardware observe
+ - debian: update trusted account-keys check on 14.04 packaging
+ - interfaces/network-{control,observe}: allow receiving
+   kobject_uevent() messages
+ - tests: fix lxd test for external backend
+ - snap-confine,snap-update-ns: add -no-pie to fix FTBFS on
+   go1.7,ppc64
+ - corecfg: mock "systemctl" in all corecfg tests
+ - tests: fix unit tests on Ubuntu 14.04
+ - debian: add missing flags when building static snap-exec
+ - many: end-to-end support for the bare base snap
+ - overlord/snapstate: SetRootDir from SetUpTest, not in just some
+   tests
+ - store: have an ad-hoc method on cfg to get its list of uris for
+   tests
+ - daemon: let client decide whether to allow interactive auth via
+   polkit
+ - client,daemon,snap,store: add license field
+ - overlord/snapstate: rename HasCurrent to IsInstalled, remove
+   superfluous/misleading check from All
+ - cmd/snap: SetRootDir from SetUpTest, not in just some individual
+   tests.
+ - systemd: rename snap-repair.{service,timer} to snapd.snap-
+   repair.{service,timer}
+ - snap-seccomp: remove use of x/net/bpf from tests
+ - httputil: more naive per go version way to recreate a default
+   transport for tls reconfig
+ - cmd/snap-seccomp/main_test.go: add one more syscall for arm64
+ - interfaces/opengl: use == to compare, not =
+ - cmd/snap-seccomp/main_test.go: add syscalls for armhf and arm64
+ - cmd/snap-repair: track and use a lower bound for the time for
+   TLS checks
+ - interfaces: expose bluez interface on classic OS
+ - snap-seccomp: add in-kernel bpf tests
+ - overlord: always try to get a serial, lazily on classic
+ - tests: add nmcli regression test
+ - tests: deal with __PNR_chown on aarch64 to fix FTBFS on arm64
+ - tests: add autopilot-introspection interface test
+ - vendor: fix artifact from manually editing vendor/vendor.json
+ - tests: rename complexion to test-snapd-complexion
+ - interfaces: add desktop and desktop-legacy
+   interfaces/desktop: add new 'desktop' interface for modern DEs*
+   interfaces/builtin/desktop_test.go: use modern testing techniques*
+   interfaces/wayland: allow read on /etc/drirc for Plasma desktop*
+   interfaces/desktop-legacy: add new 'legacy' interface (currently
+   for a11y and input)
+ - tests: fix race in snap userd test
+ - devices/iio: add read/write for missing sysfs entries
+ - spread: don't set HTTPS?_PROXY for linode
+ - cmd/snap-repair: check signatures of repairs from Next
+ - env: set XDG_DATA_DIRS for wayland et.al.
+ - interfaces/{default,account-control}: Use username/group instead
+   of uid/gid
+ - interfaces/builtin: use udev tagging more broadly
+ - tests: add basic lxd test
+ - wrappers: ensure bash completion snaps install on core
+ - vendor: use old golang.org/x/crypto/ssh/terminal to build on
+   powerpc again
+ - docs: add PULL_REQUEST_TEMPLATE.md
+ - interfaces: fix network-manager plug
+ - hooks: do not error out when hook is optional and no hook handler
+   is registered
+ - cmd/snap: add userd command to replace snapd-xdg-open
+ - tests: new regex used to validate the core version on extra snaps
+   ass...
+ - snap: add new `snap switch` command
+ - tests: wait more and more debug info about fakestore start issues
+ - apparmor,release: add better apparmor detection/mocking code
+ - interfaces/i2c: adjust sysfs rule for alternate paths
+ - interfaces/apparmor: add missing call to dirs.SetRootDir
+ - cmd: "make hack" now also installs snap-update-ns
+ - tests: copy files with less verbosity
+ - cmd/snap-confine: allow using additional libraries required by
+   openSUSE
+ - packaging/fedora: Merge changes from Fedora Dist-Git
+ - snapstate: improve the error message when classic confinement is
+   not supported
+ - tests: add test to ensure amd64 can run i386 syscall binaries
+ - tests: adding extra info for fakestore when fails to start
+ - tests: install most important snaps
+ - cmd/snap-repair: more test coverage of filtering
+ - squashfs: remove runCommand/runCommandWithOutput as we do not need
+   it
+ - cmd/snap-repair: ignore superseded revisions, filter on arch and
+   models
+ - hooks: support for refresh hook
+ - Partial revert "overlord/devicestate, store: update device auth
+   endpoints URLs"
+ - cmd/snap-confine: allow reading /proc/filesystems
+ - cmd/snap-confine: genearlize apparmor profile for various lib
+   layout
+ - corecfg: fix proxy.* writing and add integration test
+ - corecfg: deal with system.power-key-action="" correctly
+ - vendor: update vendor.json after (presumed) manual edits
+ - cmd/snap: in `snap info`, don't print a newline between tracks
+ - daemon: add polkit support to /v2/login
+ - snapd,snapctl: decode json using Number
+ - client: fix go vet 1.7 errors
+ - tests: make 17.04 shellcheck clean
+ - tests: remove TestInterfacesHelp as it breaks when go-flags
+   changes
+ - snapstate: undo a daemon restart on classic if needed
+ - cmd/snap-repair: recover brand/model from
+   /var/lib/snapd/seed/assertions checking signatures and brand
+   account
+ - spread: opt into unsafe IO during spread tests
+ - snap-repair: update snap-repair/runner_test.go for API change in
+   makeMockServer
+ - cmd/snap-repair: skeleton code around actually running a repair
+ - tests: wait until the port is listening after start the fake store
+ - corecfg: fix typo in tests
+ - cmd/snap-repair: test that redirects works during fetching
+ - osutil: honor SNAPD_UNSAFE_IO for testing
+ - vendor: explode and make more precise our golang.go/x/crypto deps,
+   use same version as Debian unstable
+ - many: sanitize NewStoreStack signature, have shared default store
+   test private keys
+ - systemd: disable `Nice=-5` to fix error when running inside lxd
+ - spread.yaml: update delta ref to 2.27
+ - cmd/snap-repair: use E-Tags when refetching a repair to retry
+ - interfaces/many: updates based on chromium and mrrescue denials
+ - cmd/snap-repair: implement most logic to get the next repair to
+   run/retry in a brand sequence
+ - asserts/assertstest: copy headers in SigningDB.Sign
+ - interfaces: convert uhid to common interface and test cases
+   improvement for time_control and opengl
+ - many tests: move all panicing fake store methods to a common place
+ - asserts: add store assertion type
+ - interfaces: don't crash if content slot has no attributes
+ - debian: do not build with -buildmode=pie on i386
+ - wrappers: symlink completion snippets when symlinking binaries
+ - tests: adding more debug information for the interfaces-cups-
+   control …
+ - apparmor: pass --quiet to parser on load unless SNAPD_DEBUG is set
+ - many: allow and support serials signed by the 'generic' authority
+   instead of the brand
+ - corecfg: add proxy configuration via `snap set core
+   proxy.{http,https,ftp}=...`
+ - interfaces: a bunch of interfaces test improvement
+ - tests: enable regression and completion suites for opensuse
+ - tests: installing snapd for nested test suite
+ - interfaces: convert lxd_support to common iface
+ - interfaces: add missing test for camera interface.
+ - snap: add support for parsing snap layout section
+ - cmd/snap-repair: like for downloads we cannot have a timeout (at
+   least for now), less aggressive retry strategies
+ - overlord: rely on more conservative ensure interval
+ - overlord,store: no piles of return args for methods gathering
+   device session request params
+ - overlord,store: send model assertion when setting up device
+   sessions
+ - interfaces/misc: updates for unity7/x11, browser-
+   support, network-control and mount-observe
+   interfaces/unity7,x11: update for NETLINK_KOBJECT_UEVENT
+   interfaces/browser-support: update sysfs reads for
+   newer browser versions, interfaces/network-control: rw for
+   ieee80211 advanced wireless interfaces/mount-observe: allow read
+   on sysfs entries for block devices
+ - tests: use dnf --refresh install to avert stale cache
+ - osutil: ensure TestLockUnlockWorks uses supported flock
+ - interfaces: convert lxd to common iface
+ - tests: restart snapd to ensure re-exec settings are applied
+ - tests: fix interfaces-cups-control test
+ - interfaces: improve and tweak bunch of interfaces test cases.
+ - tests: adding extra worker for fedora
+ - asserts,overlord/devicestate: support predefined assertions that
+   don't establish foundational trust
+ - interfaces: convert two hardware_random interfaces to common iface
+ - interfaces: convert io_ports_control to common iface
+ - tests: fix for  upgrade test on fedora
+ - daemon, client, cmd/snap: implement snap start/stop/restart
+ - cmd/snap-confine: set _FILE_OFFSET_BITS to 64
+ - interfaces: covert framebuffer to commonInterface
+ - interfaces: convert joystick to common iface
+ - interfaces/builtin: add the spi interface
+ - wrappers, overlord/snapstate/backend: make link-snap clean up on
+   failure.
+ - interfaces/wayland: add wayland interface
+ - interfaces: convert kvm to common iface
+ - tests: extend upower-observe test to cover snaps providing slots
+ - tests: enable main suite for opensuse
+ - interfaces: convert physical_memory_observe to common iface
+ - interfaces: add missing test for optical_drive interface.
+ - interfaces: convert physical_memory_control to common iface
+ - interfaces: convert ppp to common iface
+ - interfaces: convert time-control to common iface
+ - tests: fix failover test
+ - interfaces/builtin: rework for avahi interface
+ - interfaces: convert broadcom-asic-control to common iface
+ - snap/snapenv: document the use of CoreSnapMountDir for SNAP
+ - packaging/arch: drop patches merged into master
+ - cmd: fix mustUnsetenv docstring (thanks to Chipaca)
+ - release: remove default from VERSION_ID
+ - tests: enable regression, upgrade and completion test suites for
+   fedora
+ - tests: restore interfaces-account-control properly
+ - overlord/devicestate, store: update device auth endpoints URLs
+ - tests: fix install-hook test failure
+ - tests: download core and ubuntu-core at most once
+ - interfaces: add common support for udev
+ - overlord/devicestate: fix, don't assume that the serial is backed
+   by a 1-key chain
+ - cmd/snap-confine: don't share /etc/nsswitch from host
+ - store: do not resume a download when we already have the whole
+   thing
+ - many: implement "snap logs"
+ - store: don't call useDeltas() twice in quick succession
+ - interfaces/builtin: add kvm interface
+ - snap/snapenv: always expect /snap for $SNAP
+ - cmd: mark arch as non-reexecing distro
+ - cmd: fix tests that assume /snap mount
+ - gitignore: ignore more build artefacts
+ - packaging: add current arch packaging
+ - interfaces/unity7: allow receiving media key events in (at least)
+   gnome-shell
+ - interfaces/many, cmd/snap-confine: miscellaneous policy updates
+ - interfaces/builtin: implement broadcom-asic-control interface
+ - interfaces/builtin: reduce duplication and remove cruft in
+   Sanitize{Plug,Slot}
+ - tests: apply underscore convention for SNAPMOUNTDIR variable
+ - interfaces/greengrass-support: adjust accesses now that have
+   working snap
+ - daemon, client, cmd/snap: implement "snap services"
+ - tests: fix refresh tests not stopping fake store for fedora
+ - many: add the interface command
+ - overlord/snapstate/backend: some copydata improvements
+ - many: support querying and completing assertion type names
+ - interfaces/builtin: discard empty Validate{Plug,Slot}
+ - cmd/snap-repair:  start of Runner, implement first pass of Peek
+   and Fetch
+ - tests: enable main suite on fedora
+ - snap: do not always quote the snap info summary
+ - vendor: update go-flags to address crash in "snap debug"
+ - interfaces: opengl support pci device and vendor
+ - many: start implenting "base" snap type on the snapd side
+ - arch,release: map armv6 correctly
+ - many: expose service status in 'snap info'
+ - tests: add browser-support interface test
+ - tests: disable snapd-notify for the external backend
+ - interfaces: Add /run/uuid/request to openvswitch
+ - interfaces: add password-manager-service implicit classic
+   interface
+ - cmd: rework reexec detection
+ - cmd: fix re-exec bug when starting from snapd 2.21
+ - tests: dependency packages installed during prepare-project
+ - tests: remove unneeded check for re-exec in InternalToolPath()
+ - cmd,tests: fix classic confinement confusing re-execution code
+ - store: configurable base api
+ - tests: fix how package lists are updated for opensuse and fedora
+
+* Sun Sep 10 2017 Neal Gompa <ngompa13@gmail.com> - 2.27.6-1
+- Release 2.27.6 to Fedora (RH#1489437)
+
+* Thu Sep 07 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27.6
+  - interfaces: add udev netlink support to hardware-observe
+  - interfaces/network-{control,observe}: allow receiving
+    kobject_uevent() messages
+
+* Mon Sep 04 2017 Neal Gompa <ngompa13@gmail.com> - 2.27.5-1
+- Release 2.27.5 to Fedora (RH#1483177)
+- Backport userd from upstream to support xdg-open
+
+* Wed Aug 30 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27.5
+  - interfaces: fix network-manager plug regression
+  - hooks: do not error when hook handler is not registered
+  - interfaces/alsa,pulseaudio: allow read on udev data for sound
+  - interfaces/optical-drive: read access to udev data for /dev/scd*
+  - interfaces/browser-support: read on /proc/vmstat and misc udev
+    data
+
+* Thu Aug 24 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27.4
+  - snap-seccomp: add secondary arch for unrestricted snaps as well
+
+* Fri Aug 18 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27.3
+  - systemd: disable `Nice=-5` to fix error when running inside lxdSee
+    https://bugs.launchpad.net/snapd/+bug/1709536
+
+* Wed Aug 16 2017 Neal Gompa <ngompa13@gmail.com> - 2.27.2-2
+- Bump to rebuild for F27 and Rawhide
+
+* Wed Aug 16 2017 Neal Gompa <ngompa13@gmail.com> - 2.27.2-1
+- Release 2.27.2 to Fedora (RH#1482173)
+
+* Wed Aug 16 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27.2
+ - tests: remove TestInterfacesHelp as it breaks when go-flags
+   changes
+ - interfaces: don't crash if content slot has no attributes
+ - debian: do not build with -buildmode=pie on i386
+ - interfaces: backport broadcom-asic-control interface
+ - interfaces: allow /usr/bin/xdg-open in unity7
+ - store: do not resume a download when we already have the whole
+   thing
+
+* Mon Aug 14 2017 Neal Gompa <ngompa13@gmail.com> - 2.27.1-1
+- Release 2.27.1 to Fedora (RH#1481247)
+
+* Mon Aug 14 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27.1
+ - tests: use dnf --refresh install to avert stale cache
+ - tests: fix test failure on 14.04 due to old version of
+   flock
+ - updates for unity7/x11, browser-support, network-control,
+   mount-observe
+ - interfaces/unity7,x11: update for NETLINK_KOBJECT_UEVENT
+ - interfaces/browser-support: update sysfs reads for
+   newer browser versions
+ - interfaces/network-control: rw for ieee80211 advanced wireless
+ - interfaces/mount-observe: allow read on sysfs entries for block
+   devices
+
+* Thu Aug 10 2017 Neal Gompa <ngompa13@gmail.com> - 2.27-1
+- Release 2.27 to Fedora (RH#1458086)
+
+* Thu Aug 10 2017 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.27
+ - fix build failure on 32bit fedora
+ - interfaces: add password-manager-service implicit classic interface
+ - interfaces/greengrass-support: adjust accesses now that have working
+   snap
+ - interfaces/many, cmd/snap-confine: miscellaneous policy updates
+ - interfaces/unity7: allow receiving media key events in (at least)
+   gnome-shell
+ - cmd: fix re-exec bug when starting from snapd 2.21
+ - tests: restore interfaces-account-control properly
+ - cmd: fix tests that assume /snap mount
+ - cmd: mark arch as non-reexecing distro
+ - snap-confine: don't share /etc/nsswitch from host
+ - store: talk to api.snapcraft.io for purchases
+ - hooks: support for install and remove hooks
+ - packaging: fix Fedora support
+ - tests: add bluetooth-control interface test
+ - store: talk to api.snapcraft.io for assertions
+ - tests: remove snapd before building from branch
+ - tests: add avahi-observe interface test
+ - store: orders API now checks if customer is ready
+ - cmd/snap: snap find only searches stable
+ - interfaces: updates default, mir, optical-observe, system-observe,
+   screen-inhibit-control and unity7
+ - tests: speedup prepare statement part 1
+ - store: do not send empty refresh requests
+ - asserts: fix error handling in snap-developer consistency check
+ - systemd: add explicit sync to snapd.core-fixup.sh
+ - snapd: generate snap cookies on startup
+ - cmd,client,daemon: expose "force devmode" in sysinfo
+ - many: introduce and use strutil.ListContains and also
+   strutil.SortedListContains
+ - assserts,overlord/assertstate: test we don't accept chains of
+   assertions founded on a self-signed key coming externally
+ - interfaces: enable access to bridge settings
+ - interfaces: fix copy-pasted iio vs io in io-ports-control
+ - cmd/snap-confine: various small fixes and tweaks to seccomp
+   support code
+ - interfaces: bring back seccomp argument filtering
+ - systemd, osutil: rework systemd logs in preparation for services
+   commands
+ - tests: store /etc/systemd/system/snap-*core*.mount in snapd-
+   state.tar.gz
+ - tests: shellcheck improvements for tests/main tasks - first set of
+   tests
+ - cmd/snap: `--last` for abort and watch, and aliases
+   (search→find, change→tasks)
+ - tests: shellcheck improvements for tests/lib scripts
+ - tests: create ramdisk if it's not present
+ - tests: shellcheck improvements for nightly upgrade and regressions
+   tests
+ - snapd: fix for snapctl get panic on null config values.
+ - tests: fix for rng-tools service not restarting
+ - systemd: add snapd.core-fixup.service unit
+ - cmd: avoid using current symlink in InternalToolPath
+ - tests: fix timeout issue for test refresh core with hanging …
+ - intefaces: control bridged vlan/ppoe-tagged traffic
+ - cmd/snap: include snap type in notes
+ - overlord/state: Abort() only visits each task once
+ - tests: extend find-private test to cover more cases
+ - snap-seccomp: skip socket() tests on systems that use socketcall()
+   instead of socket()
+ - many: support snap title as localized/title-cased name
+ - snap-seccomp: deal with mknod on aarch64 in the seccomp tests
+ - interfaces: put base policy fragments inside each interface
+ - asserts: introduce NewDecoderWithTypeMaxBodySize
+ - tests: fix snapd-notify when it takes more time to restart
+ - snap-seccomp: fix snap-seccomp tests in artful
+ - tests: fix for create-key task to avoid rng-tools service ramains
+   alive
+ - snap-seccomp: make sure snap-seccomp writes the bpf file
+   atomically
+ - tests: do not disable ipv6 on core systems
+ - arch: the kernel architecture name is armv7l instead of armv7
+ - snap-confine: ensure snap-confine waits some seconds for seccomp
+   security profiles
+ - tests: shellcheck improvements for tests/nested tasks
+ - wrappers: add SyslogIdentifier to the service unit files.
+ - tests: shellcheck improvements for unit tasks
+ - asserts: implement FindManyTrusted as well
+ - asserts: open up and optimize Encoder to help avoiding unnecessary
+   copying
+ - interfaces: simplify snap-confine by just loading pre-generated
+   bpf code
+ - tests: restart rng-tools services after few seconds
+ - interfaces, tests: add mising dbus abstraction to system-observe
+   and extend spread test
+ - store: change main store host to api.snapcraft.io
+ - overlord/cmdstate: new package for running commands as tasks.
+ - spread: help libapt resolve installing libudev-dev
+ - tests: show the IP from .travis.yaml
+ - tests/main: use pkgdb function in more test cases
+ - cmd,daemon: add debug command for displaying the base policy
+ - tests: prevent quoting error on opensuse
+ - tests: fix nightly suite
+ - tests: add linode-sru backend
+ - snap-confine: validate SNAP_NAME against security tag
+ - tests: fix ipv6 disable for ubuntu-core
+ - tests: extend core-revert test to cover bluez issues
+ - interfaces/greengrass-support: add support for Amazon Greengrass
+   as a snap
+ - asserts: support timestamp and optional disabled header on repair
+ - tests: reboot after upgrading to snapd on the -proposed pocket
+ - many: fix test cases to work with different DistroLibExecDir
+ - tests: reenable help test on ubuntu and debian systems
+ - packaging/{opensuse,fedora}: allow package build with testkeys
+   included
+ - tests/lib: generalize RPM build support
+ - interfaces/builtin: sync connected slot and permanent slot snippet
+ - tests: fix snap create-key by restarting automatically rng-tools
+ - many: switch to use http numeric statuses as agreed
+ - debian: add missing  Type=notify in 14.04 packaging
+ - tests: mark interfaces-openvswitch as manual due to prepare errors
+ - debian: unify built_using between the 14.04 and 16.04 packaging
+   branch
+ - tests: pull from urandom when real entropy is not enough
+ - tests/main/manpages: install missing man package
+ - tests: add refresh --time output check
+ - debian: add missing "make -C data/systemd clean"
+ - tests: fix for upgrade test when it is repeated
+ - tests/main: use dir abstraction in a few more test cases
+ - tests/main: check for confinement in a few more interface tests
+ - spread: add fedora snap bin dir to global PATH
+ - tests: check that locale-control is not present on core
+ - many: snapctl outside hooks
+ - tests: add whoami check
+ - interfaces: compose the base declaration from interfaces
+ - tests: fix spread flaky tests linode
+ - tests,packaging: add package build support for openSUSE
+ - many: slight improvement of some snap error messaging
+ - errtracker: Include /etc/apparmor.d/usr.lib.snap-confine md5sum in
+   err reports
+ - tests: fix for the test postrm-purge
+ - tests: restoring the /etc/environment and service units config for
+   each test
+ - daemon: make snapd a "Type=notify" daemon and notify when startup
+   is done
+ - cmd/snap-confine: add support for --base snap
+ - many: derive implicit slots from interface meta-data
+ - tests: add core revert test
+ - tests,packaging: add package build support for Fedora for our
+   spread setup
+ - interfaces: move base declaration to the policy sub-package
+ - tests: fix for snapd-reexec test cheking for restart info on debug
+   log
+ - tests: show available entropy on error
+ - tests: clean journalctl logs on trusty
+ - tests: fix econnreset on staging
+ - tests: modify core before calling set
+ - tests: add snap-confine privilege test
+ - tests: add staging snap-id
+ - interfaces/builtin: silence ptrace denial for network-manager
+ - tests: add alsa interface spread test
+ - tests: prefer ipv4 over ipv6
+ - tests: fix for econnreset test checking that the download already
+   started
+ - httputil,store: extract retry code to httputil, reorg usages
+ - errtracker: report if snapd did re-execute itself
+ - errtracker: include bits of snap-confine apparmor profile
+ - tests: take into account staging snap-ids for snap-info
+ - cmd: add stub new snap-repair command and add timer
+ - many: stop "snap refresh $x --channel invalid" from working
+ - interfaces: revert "interfaces: re-add reverted ioctl and quotactl
+ - snapstate: consider connect/disconnect tasks in
+   CheckChangeConflict.
+ - interfaces: disable "mknod |N" in the default seccomp template
+   again
+ - interfaces,overlord/ifacestate: make sure installing slots after
+   plugs works similarly to plugs after slots
+ - interfaces/seccomp: add bind() syscall for forced-devmode systems
+ - packaging/fedora: Sync packaging from Fedora Dist-Git
+ - tests: move static and unit tests to spread task
+ - many: error types should be called FooError, not ErrFoo.
+ - partition: add directory sync to the save uboot.env file code
+ - cmd: test everything (100% coverage \o/)
+ - many: make shell scripts shellcheck-clean
+ - tests: remove additional setup for docker on core
+ - interfaces: add summary to each interface
+ - many: remove interface meta-data from list of connections
+ - logger (& many more, to accommodate): drop explicit syslog.
+ - packaging: import packaging bits for opensuse
+ - snapstate,many: implement snap install --unaliased
+ - tests/lib: abstract build dependency installation a bit more
+ - interfaces, osutil: move flock code from interfaces/mount to
+   osutil
+ - cmd: auto import assertions only from ext4,vfat file systems
+ - many: refactor in preparation for 'snap start'
+ - overlord/snapstate: have an explicit code path last-refresh
+   unset/zero => immediately refresh try
+ - tests: fixes for executions using the staging store
+ - tests: use pollinate to seed the rng
+ - cmd/snap,tests: show the sha3-384 of the snap for snap info
+   --verbose SNAP-FILE
+ - asserts: simplify and adjust repair assertion definition
+ - cmd/snap,tests: show the snap id if available in snap info
+ - daemon,overlord/auth: store from model assertion wins
+ - cmd/snap,tests/main: add confinement switch instead of spread
+   system blacklisting
+ - many: cleanup MockCommands and don't leave a process around after
+   hookstate tests
+ - tests: update listing test to the core version number schema
+ - interfaces: allow snaps to use the timedatectl utility
+ - packaging: Add Fedora packaging files
+ - tests/libs: add distro_auto_remove_packages function
+ - cmd/snap: correct devmode note for anomalous state
+ - tests/main/snap-info: use proper pkgdb functions to install distro
+   packages
+ - tests/lib: use mktemp instead of tempfile to work cross-distro
+ - tests: abstract common dirs which differ on distributions
+ - many: model and expose interface meta-data.
+ - overlord: make config defaults from gadget work also at first boot
+ - interfaces/log-observe: allow using journalctl from hostfs for
+   classic distro
+ - partition,snap: add support for android boot
+ - errtracker: small simplification around readMachineID
+ - snap-confine: move rm_rf_tmp to test-utils.
+ - tests/lib: introduce pkgdb helper library
+ - errtracker: try multiple paths to read machine-id
+ - overlord/hooks: make sure only one hook for given snap is executed
+   at a time.
+ - cmd/snap-confine: use SNAP_MOUNT_DIR to setup /snap inside the
+   confinement env
+ - tests: bump kill-timeout and remove quiet call on build
+ - tests/lib/snaps: add a test store snap with a passthrough
+   configure hook
+ - daemon: teach the daemon to wait on active connections when
+   shutting down
+ - tests: remove unit tests task
+ - tests/main/completion: source from /usr/share/bash-completion
+ - assertions: add "repair" assertion
+ - interfaces/seccomp: document Backend.NewSpecification
+ - wrappers: make StartSnapServices cleanup any services that were
+   added if a later one fails
+ - overlord/snapstate: avoid creating command aliases for daemons
+ - vendor: remove unused packages
+ - vendor,partition: fix panics from uenv
+ - cmd,interfaces/mount: run snap-update-ns and snap-discard-ns from
+   core if possible
+ - daemon: do not allow to install ubuntu-core anymore
+ - wrappers: service start/stop were inconsistent
+ - tests: fix failing tests (snap core version, syslog changes)
+ - cmd/snap-update-ns: add actual implementation
+ - tests: improve entropy also for ubuntu
+ - cmd/snap-confine: use /etc/ssl from the core snap
+ - wrappers: don't convert between []byte and string needlessly.
+ - hooks: default timeout
+ - overlord/snapstate: Enable() was ignoring the flags from the
+   snap's state, resulting in losing "devmode" on disable/enable.
+ - difs,interfaces/mount: add support for locking namespaces
+ - interfaces/mount: keep track of kept mount entries
+ - tests/main: move a bunch of greps over to MATCH
+ - interfaces/builtin: make all interfaces private
+ - interfaces/mount: spell unmount correctly
+ - tests: allow 16-X.Y.Z version of core snap
+ - the timezone_control interface only allows changing /etc/timezone
+   and /etc/writable/timezone. systemd-timedated also updated the
+   link of /etc/localtime and /etc/writable/localtime ... allow
+   access to this file too
+ - cmd/snap-confine: aggregate operations holding global lock
+ - api, ifacestate: resolve disconnect early
+ - interfaces/builtin: ensure we don't register interfaces twice
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.26.3-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.26.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Thu May 25 2017 Neal Gompa <ngompa13@gmail.com> - 2.26.3-3
+- Cover even more stuff for proper erasure on final uninstall (RH#1444422)
+
+* Sun May 21 2017 Neal Gompa <ngompa13@gmail.com> - 2.26.3-2
+- Fix error in script for removing Snappy content (RH#1444422)
+- Adjust changelog bug references to be specific on origin
+
+* Wed May 17 2017 Neal Gompa <ngompa13@gmail.com> - 2.26.3-1
+- Update to snapd 2.26.3
+- Drop merged and unused patches
+- Cover more Snappy content for proper erasure on final uninstall (RH#1444422)
+- Add temporary fix to ensure generated seccomp profiles don't break snapctl
+
+* Mon May 01 2017 Neal Gompa <ngompa13@gmail.com> - 2.25-1
+- Update to snapd 2.25
+- Ensure all Snappy content is gone on final uninstall (RH#1444422)
+
+* Tue Apr 11 2017 Neal Gompa <ngompa13@gmail.com> - 2.24-1
+- Update to snapd 2.24
+- Drop merged patches
+- Install snap bash completion and snapd info file
+
+* Wed Apr 05 2017 Neal Gompa <ngompa13@gmail.com> - 2.23.6-4
+- Test if snapd socket and timer enabled and start them if enabled on install
+
+* Sat Apr 01 2017 Neal Gompa <ngompa13@gmail.com> - 2.23.6-3
+- Fix profile.d generation so that vars aren't expanded in package build
+
+* Fri Mar 31 2017 Neal Gompa <ngompa13@gmail.com> - 2.23.6-2
+- Fix the overlapping file conflicts between snapd and snap-confine
+- Rework package descriptions slightly
+
+* Thu Mar 30 2017 Neal Gompa <ngompa13@gmail.com> - 2.23.6-1
+- Rebase to snapd 2.23.6
+- Rediff patches
+- Re-enable seccomp
+- Fix building snap-confine on 32-bit arches
+- Set ExclusiveArch based on upstream supported arch list
+
+* Wed Mar 29 2017 Neal Gompa <ngompa13@gmail.com> - 2.23.5-1
+- Rebase to snapd 2.23.5
+- Disable seccomp temporarily avoid snap-confine bugs (LP#1674193)
+- Use vendorized build for non-Fedora
+
+* Mon Mar 13 2017 Neal Gompa <ngompa13@gmail.com> - 2.23.1-1
+- Rebase to snapd 2.23.1
+- Add support for vendored tarball for non-Fedora targets
+- Use merged in SELinux policy module
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.16-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Wed Oct 19 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.16-1
+- New upstream release
+
+* Tue Oct 18 2016 Neal Gompa <ngompa13@gmail.com> - 2.14-2
+- Add SELinux policy module subpackage
+
+* Tue Aug 30 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.14-1
+- New upstream release
+
+* Tue Aug 23 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.13-1
+- New upstream release
+
+* Thu Aug 18 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.12-2
+- Correct license identifier
+
+* Thu Aug 18 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.12-1
+- New upstream release
+
+* Thu Aug 18 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-8
+- Add %%dir entries for various snapd directories
+- Tweak Source0 URL
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-7
+- Disable snapd re-exec feature by default
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-6
+- Don't auto-start snapd.socket and snapd.refresh.timer
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-5
+- Don't touch snapd state on removal
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-4
+- Use ExecStartPre to load squashfs.ko before snapd starts
+- Use dedicated systemd units for Fedora
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-3
+- Remove systemd preset (will be requested separately according to distribution
+  standards).
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-2
+- Use Requires: kmod(squashfs.ko) instead of Requires: kernel-modules
+
+* Tue Aug 16 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.11-1
+- New upstream release
+- Move private executables to /usr/libexec/snapd/
+
+* Fri Jun 24 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.0.9-2
+- Depend on kernel-modules to ensure that squashfs can be loaded. Load it afer
+  installing the package. This hopefully fixes
+  https://github.com/zyga/snapcore-fedora/issues/2
+
+* Fri Jun 17 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.0.9
+- New upstream release
+  https://github.com/snapcore/snapd/releases/tag/2.0.9
+
+* Tue Jun 14 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.0.8.1
+- New upstream release
+
+* Fri Jun 10 2016 Zygmunt Krynicki <me@zygoon.pl> - 2.0.8
+- First package for Fedora
diff -Nru snapd-2.45.1+20.04.2/packaging/fedora-rawhide/snapd.spec snapd-2.48.3+20.04/packaging/fedora-rawhide/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/fedora-rawhide/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/fedora-rawhide/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -97,7 +97,7 @@
 %endif
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPLv3
@@ -483,6 +483,7 @@
 # building various things from the tree without additional
 # set tags.
 %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd
+BUILDTAGS="${BUILDTAGS} nomanagers"
 %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap
 %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure
 
@@ -563,12 +564,14 @@
 install -d -p %{buildroot}%{_unitdir}
 install -d -p %{buildroot}%{_sysconfdir}/profile.d
 install -d -p %{buildroot}%{_sysconfdir}/sysconfig
-install -d -p %{buildroot}%{_sysconfdir}/sudoers.d
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/device
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs
+install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32
 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd
@@ -635,7 +638,6 @@
               SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd"
 popd
 
-
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -753,7 +755,6 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_libexecdir}/snapd/snapd.run-from-snap
 %{_sysconfdir}/profile.d/snapd.sh
-%{_sysconfdir}/sudoers.d/99-snapd.conf
 %{_mandir}/man8/snapd-env-generator.8*
 %{_systemd_system_env_generator_dir}/snapd-env-generator
 %{_unitdir}/snapd.socket
@@ -765,16 +766,22 @@
 %{_userunitdir}/snapd.session-agent.socket
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
 %config(noreplace) %{_sysconfdir}/sysconfig/snapd
 %dir %{_sharedstatedir}/snapd
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -807,6 +814,7 @@
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
 %{_libexecdir}/snapd/system-shutdown
@@ -907,11 +915,1274 @@
 
 
 %changelog
+* Tue Feb 02 2021 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.3
+  - SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  - interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+* Thu Dec 15 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.2
+ - tests: sign new nested-18|20* models to allow for generic serials
+ - secboot: add extra paranoia when waiting for that fde-reveal-key
+ - tests: backport netplan workarounds from #9785
+ - secboot: add workaround for snapcore/core-initrd issue #13
+ - devicestate: log checkEncryption errors via logger.Noticef
+ - tests: add nested spread end-to-end test for fde-hooks
+ - devicestate: implement checkFDEFeatures()
+ - boot: tweak resealing with fde-setup hooks
+ - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+   init restrict file
+ - secboot: add new LockSealedKeys() that uses either TPM or
+   fde-reveal-key
+ - gadget: use "sealed-keys" to determine what method to use for
+   reseal
+ - boot: add sealKeyToModeenvUsingFdeSetupHook()
+ - secboot: use `fde-reveal-key` if available to unseal key
+ - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+   other entries
+ - o/devicestate: save model with serial in the device save db
+ - devicestate: add runFDESetupHook() helper
+ - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+ - hookstate: add new HookManager.EphemeralRunHook()
+ - update-pot: fix typo in plural keyword spec
+ - store,cmd/snap-repair: increase initial expontential time
+   intervals
+ - o/devicestate,daemon: fix reboot system action to not require a
+   system label
+ - github: run nested suite when commit is pushed to release branch
+ - tests: reset fakestore unit status
+ - tests: fix uc20-create-parition-* tests for updated gadget
+ - hookstate: implement snapctl fde-setup-{request,result}
+ - devicestate: make checkEncryption fde-setup hook aware
+ - client,snapctl: add naive support for "stdin"
+ - devicestate: support "storage-safety" defaults during install
+ - snap: use the boot-base for kernel hooks
+ - vendor: update secboot repo to avoid including secboot.test binary
+
+* Thu Dec 03 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48.1
+ - gadget: disable ubuntu-boot role validation check
+
+* Thu Nov 19 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.48
+ - osutil: add KernelCommandLineKeyValue
+ - devicestate: implement boot.HasFDESetupHook
+ - boot/makebootable.go: set snapd_recovery_mode=install at image-
+   build time
+ - bootloader: use ForGadget when installing boot config
+ - interfaces/raw_usb: allow read access to /proc/tty/drivers
+ - boot: add scaffolding for "fde-setup" hook support for sealing
+ - tests: fix basic20 test on arm devices
+ - seed: make a shared seed system label validation helper
+ - snap: add new "fde-setup" hooktype
+ - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+ - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+   device handling
+ - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+   messiness
+ - tests/nested/manual/refresh-revert-fundamentals: temporarily
+   disable secure boot
+ - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+   boot modes
+ - many: address degraded recover mode feedback, cleanups
+ - tests: Use systemd-run on tests part2
+ - tests: set the opensuse tumbleweed system as manual in spread.yaml
+ - secboot: call BlockPCRProtectionPolicies even if the TPM is
+   disabled
+ - vendor: update to current secboot
+ - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+   save
+ - spread.yaml: increase number of workers on 20.10
+ - snap: add new `snap recovery --show-keys` option
+ - tests: minor test tweaks suggested in the review of 9607
+ - snapd-generator: set standard snapfuse options when generating
+   units for containers
+ - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+ - interfaces: share /tmp/.X11-unix/ from host or provider
+ - tests: enable main lxd test on 20.10
+ - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+   degraded mode
+ - gadget/install: add progress logging
+ - packaging: keep secboot/encrypt_dummy.go in debian
+ - interfaces/udev: use distro specific path to snap-device-helper
+ - o/devistate: fix chaining of tasks related to regular snaps when
+   preseeding
+ - gadget, overlord/devicestate: validate that system supports
+   encrypted data before install
+ - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+   ESP layout
+ - many: add /v2/system-recovery-keys API and client
+ - secboot, many: return UnlockMethod from Unlock* methods for future
+   usage
+ - many: mv keys to ubuntu-boot, move model file, rename keyring
+   prefix for secboot
+ - tests: using systemd-run instead of manually create a systemd unit
+   - part 1
+ - secboot, cmd/snap-bootstrap: enable or disable activation with
+   recovery key
+ - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+   disks first
+ - secboot: add LockTPMSealedKeys() to lock access to keys
+   independently
+ - gadget: correct sfdisk arguments
+ - bootloader/assets/grub: adjust fwsetup menuentry label
+ - tests: new boot state tool
+ - spread: use the official image for Ubuntu 20.10, no longer an
+   unstable system
+ - tests/lib/nested: enable snapd logging to console for core18
+ - osutil/disks: re-implement partition searching for disk w/ non-
+   adjacent parts
+ - tests: using the nested-state tool in nested tests
+ - many: seal a fallback object to the recovery boot chain
+ - gadget, gadget/install: move helpers to install package, refactor
+   unit tests
+ - dirs: add "gentoo" to altDirDistros
+ - update-pot: include file locations in translation template, and
+   extract strings from desktop files
+ - gadget/many: drop usage of gpt attr 59 for indicating creation of
+   partitions
+ - gadget/quantity: tweak test name
+ - snap: fix failing unittest for quantity.FormatDuration()
+ - gadget/quantity: introduce a new package that captures quantities
+ - o/devicestate,a/sysdb: make a backup of the device serial to save
+ - tests: fix rare interaction of tests.session and specific tests
+ - features: enable classic-preserves-xdg-runtime-dir
+ - tests/nested/core20/save: check the bind mount and size bump
+ - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+ - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+   tests
+ - o/devicestate: unit test tweaks
+ - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+ - testutil, cmd/snap/version: fix misc little errors
+ - overlord/devicestate: bind mount ubuntu-save under
+   /var/lib/snapd/save on startup
+ - gadget/internal: tune ext4 setting for smaller filesystems
+ - tests/nested/core20/save: a test that verifies ubuntu-save is
+   present and set up
+ - tests: update google sru backend to support groovy
+ - o/ifacestate: handle interface hooks when preseeding
+ - tests: re-enable the apt hooks test
+ - interfaces,snap: use correct type: {os,snapd} for test data
+ - secboot: set metadata and keyslots sizes when formatting LUKS2
+   volumes
+ - tests: improve uc20-create-partitions-reinstall test
+ - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+ - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+ - secboot: fix doc comment on helper for unlocking volume with key
+ - tests: add spread test for refreshing from an old snapd and core18
+ - o/snapstate: generate snapd snap wrappers again after restart on
+   refresh
+ - secboot: version bump, unlock volume with key
+ - tests/snap-advise-command: re-enable test
+ - cmd/snap, snapmgr, tests: cleanups after #9418
+ - interfaces: deny connected x11 plugs access to ICE
+ - daemon,client: write and read a maintenance.json file for when
+   snapd is shut down
+ - many: update to secboot v1 (part 1)
+ - osutil/disks/mockdisk: panic if same mountpoint shows up again
+   with diff opts
+ - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+   reseal tests
+ - many: implement snap routine console-conf-start for synchronizing
+   auto-refreshes
+ - dirs, boot: add ubuntu-save directories and related locations
+ - usersession: fix typo in test name
+ - overlord/snapstate: refactor ihibitRefresh
+ - overlord/snapstate: stop warning about inhibited refreshes
+ - cmd/snap: do not hardcode snapshot age value
+ - overlord,usersession: initial notifications of pending refreshes
+ - tests: add a unit test for UpdateMany where a single snap fails
+ - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+   mode uc20
+ - tests: also check snapst.Current in undo-unlink tests
+ - tests: new nested tool
+ - o/snapstate: implement undo handler for unlink-snap
+ - tests: clean systems.sh helper and migrate last set of tests
+ - tests: moving the lib section from systems.sh helper to os.query
+   tool
+ - tests/uc20-create-partitions: don't check for grub.cfg
+ - packaging: make sure that static binaries are indeed static, fix
+   openSUSE
+ - many: have install return encryption keys for data and save,
+   improve tests
+ - overlord: add link participant for linkage transitions
+ - tests: lxd smoke test
+ - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+   seed too
+ - tests: moving main suite from systems.sh to os.query tool
+ - tests: moving the core test suite from systems.sh to os.query tool
+ - cmd/snap-confine: mask host's apparmor config
+ - o/snapstate: move setting updated SnapState after error paths
+ - tests: add value to INSTANCE_KEY/regular
+ - spread, tests: tweaks for openSUSE
+ - cmd/snap-confine: update path to snap-device-helper in AppArmor
+   profile
+ - tests: new os.query tool
+ - overlord/snapshotstate/backend: specify tar format for snapshots
+ - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+   UC20
+ - client,daemon,snap: auto-import does not error on managed devices
+ - interfaces: PTP hardware clock interface
+ - tests: use tests.backup tool
+ - many: verify that unit tests work with nosecboot tag and without
+   secboot package
+ - wrappers: do not error out on read-only /etc/dbus-1/session.d
+   filesystem on core18
+ - snapshots: import of a snapshot set
+ - tests: more output for sbuild test
+ - o/snapstate: re-order remove tasks for individual snap revisions
+   to remove current last
+ - boot: skip some unit tests when running as root
+ - o/assertstate: introduce
+   ValidationTrackingKey/ValidationSetTracking and basic methods
+ - many: allow ignoring running apps for specific request
+ - tests: allow the searching test to fail under load
+ - overlord/snapstate: inhibit startup while unlinked
+ - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+   features
+ - tests/main/sudo-env: snap bin is available on Fedora
+ - boot, overlord/devicestate: list trusted and managed assets
+   upfront
+ - gadget, gadget/install: support for ubuntu-save, create one during
+   install if needed
+ - spread-shellcheck: temporary workaround for deadlock, drop
+   unnecessary test
+ - snap: support different exit-code in the snap command
+ - logger: use strutil.KernelCommandLineSplit in
+   debugEnabledOnKernelCmdline
+ - logger: fix snapd.debug=1 parsing
+ - overlord: increase refresh postpone limit to 14 days
+ - spread-shellcheck: use single thread pool executor
+ - gadget/install,secboot: add debug messages
+ - spread-shellcheck: speed up spread-shellcheck even more
+ - spread-shellcheck: process paths from arguments in parallel
+ - tests: tweak error from tests.cleanup
+ - spread: remove workaround for openSUSE go issue
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - tests: new tests.backup tool
+ - tests: add tests.cleanup pop sub-command
+ - tests: migration of the main suite to snaps-state tool part 6
+ - tests: fix journal-state test
+ - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+   recover files
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - boot, gadget, bootloader: observer preserves managed bootloader
+   configs
+ - tests/nested/manual: add uc20 grade signed cloud-init test
+ - o/snapstate/autorefresh.go: eliminate race when launching
+   autorefresh
+ - daemon,snapshotstate: do not return "size" from Import()
+ - daemon: limit reading from snapshot import to Content-Length
+ - many: set/expect Content-Length header when importing snapshots
+ - github: switch from ::set-env command to environment file
+ - tests: migration of the main suite to snaps-state tool part 5
+ - client: cleanup the Client.raw* and Client.do* method families
+ - tests: moving main suite to snaps-state tool part 4
+ - client,daemon,snap: use constant for snapshot content-type
+ - many: fix typos and repeated "the"
+ - secboot: fix tpm connection leak when it's not enabled
+ - many: scaffolding for snapshots import API
+ - run-checks: run spread-shellcheck too
+ - interfaces: update network-manager interface to allow
+   ObjectManager access from unconfined clients
+ - tests: move core and regression suites to snaps-state tool
+ - tests: moving interfaces tests to snaps-state tool
+ - gadget: preserve files when indicated by content change observer
+ - tests: moving smoke test suite and some tests from main suite to
+   snaps-state tool
+ - o/snapshotstate: pass set id to backend.Open, update tests
+ - asserts/snapasserts: introduce ValidationSets
+ - o/snapshotstate: improve allocation of new set IDs
+ - boot: look at the gadget for run mode bootloader when making the
+   system bootable
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - usersession/userd: separate bus name ownership from defining
+   interfaces
+ - o/snapshotstate: set snapshot set id from its filename
+ - o/snapstate: move remove-related tests to snapstate_remove_test.go
+ - desktop/notification: switch ExpireTimeout to time.Duration
+ - desktop/notification: add unit tests
+ - snap: snap help output refresh
+ - tests/nested/manual/preseed: include a system-usernames snap when
+   preseeding
+ - tests: fix sudo-env test
+ - tests: fix nested core20 shellcheck bug
+ - tests/lib: move to new directory when restoring PWD, cleanup
+   unpacked unpacked snap directories
+ - desktop/notification: add bindings for FDO notifications
+ - dbustest: fix stale comment references
+ - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+   drop former
+ - snap-repair: add uc20 support
+ - tests: print all the serial logs for the nested test
+ - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+   bug in test
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+   as Unknown*
+ - asserts: deserialize grouping only once in Pool.AddBatch if needed
+ - gadget: allow content observer to have opinions about a change
+ - tests: new snaps-state command - part1
+ - o/assertstate: support refreshing any number of snap-declarations
+ - boot: use test helpers
+ - tests/core/snap-debug-bootvars: also check snap_mode
+ - many/apparmor: adjust rules for reading profile/ execing new
+   profiles for new kernel
+ - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+   vars
+ - tests/lib/nested.sh: more little tweaks
+ - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - overlord: explicitly set refresh-app-awareness in tests
+ - kernel: remove "edition" from kernel.yaml and add "update"
+ - spread: drop vendor from the packed project archive
+ - boot: fix debug bootloader variables dump on UC20 systems
+ - wrappers, systemd: allow empty root dir and conditionally do not
+   pass --root to systemctl
+ - tests/nested/manual: add test for grades above signed booting with
+   testkeys
+ - tests/nested: misc robustness fixes
+ - o/assertstate,asserts: use bulk refresh to refresh snap-
+   declarations
+ - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+   been updated now
+ - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+ - update-pot: ignore .go files inside .git when running xgettext-go
+ - tests: disable part of the lxd test completely on 16.04.
+ - o/snapshotstate: tweak comment regarding snapshot filename
+ - o/snapstate: improve snapshot iteration
+ - bootloader: lk cleanups
+ - tests: update to support nested kvm without reboots on UC20
+ - tests/nested/manual/preseed: disable system-key check for 20.04
+   image
+ - spread.yaml: add ubuntu-20.10-64 to qemu
+ - store: handle v2 error when fetching assertions
+ - gadget: resolve device mapper devices for fallback device lookup
+ - tests/nested/cloud-init-many: simplify tests and unify
+   helpers/seed inputs
+ - tests: copy /usr/lib/snapd/info to correct directory
+ - check-pr-title.py * : allow "*" in the first part of the title
+ - many: typos and small test tweak
+ - tests/main/lxd: disable cgroup combination for 16.04 that is
+   failing a lot
+ - tests: make nested signing helpers less confusing
+ - tests: misc nested changes
+ - tests/nested/manual/refresh-revert-fundamentals: disable
+   temporarily
+ - tests/lib/cla_check: default to Python 3, tweaks, formatting
+ - tests/lib/cl_check.py: use python3 compatible code
+
+* Thu Oct 08 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47.1
+ - o/configstate: create /etc/sysctl.d when applying early config
+   defaults
+ - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+   same IP addr
+ - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+   building snapd
+ - cmd/snap: allow snap help vs --all to diverge purposefully
+ - snap: snap help output refresh
+
+* Tue Sep 29 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.47
+ - tests: fix nested core20 shellcheck bug
+ - many/apparmor: adjust rule for reading apparmor profile for new
+   kernel
+ - snap-repair: add uc20 support
+ - cmd/snap/auto-import: stop importing system user assertions from
+   initramfs mnts
+ - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+   recover modes
+ - gadget: resolve device mapper devices for fallback device lookup
+ - secboot: add boot manager profile to pcr protection profile
+ - sysconfig,o/devicestate: mv DisableNoCloud to
+   DisableAfterLocalDatasourcesRun
+ - tests: make gadget-reseal more robust
+ - tests: skip nested images pre-configuration by default
+ - tests: fix for basic20 test running on external backend and rpi
+ - tests: improve kernel reseal test
+ - boot: adjust comments, naming, log success around reseal
+ - tests/nested, fakestore: changes necessary to run nested uc20
+   signed/secured tests
+ - tests: add nested core20 gadget reseal test
+ - boot/modeenv: track unknown keys in Read and put back into modeenv
+   during Write
+ - interfaces/process-control: add sched_setattr to seccomp
+ - boot: with unasserted kernels reseal if there's a hint modeenv
+   changed
+ - client: bump the default request timeout to 120s
+ - configcore: do not error in console-conf.disable for install mode
+ - boot: streamline bootstate20.go reseal and tests changes
+ - boot: reseal when changing kernel
+ - cmd/snap/model: specify grade in the model command output
+ - tests: simplify
+   repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+ - test: improve logging in nested tests
+ - nested: add support to telnet to serial port in nested VM
+ - secboot: use the snapcore/secboot native recovery key type
+ - tests/lib/nested.sh: use more focused cloud-init config for uc20
+ - tests/lib/nested.sh: wait for the tpm socket to exist
+ - spread.yaml, tests/nested: misc changes
+ - tests: add more checks to disk space awareness spread test
+ - tests: disk space awareness spread test
+ - boot: make MockUC20Device use a model and MockDevice more
+   realistic
+ - boot,many: reseal only when meaningful and necessary
+ - tests/nested/core20/kernel-failover: add test for failed refresh
+   of uc20 kernel
+ - tests: fix nested to work with qemu and kvm
+ - boot: reseal when updating boot assets
+ - tests: fix snap-routime-portal-info test
+ - boot: verify boot chain file in seal and reseal tests
+ - tests: use full path to test-snapd-refresh.version binary
+ - boot: store boot chains during install, helper for checking
+   whether reseal is needed
+ - boot: add call to reseal an existing key
+ - boot: consider boot chains with unrevisioned kernels incomparable
+ - overlord: assorted typos and miscellaneous changes
+ - boot: group SealKeyModelParams by model, improve testing
+ - secboot: adjust parameters to buildPCRProtectionProfile
+ - strutil: add SortedListsUniqueMergefrom the doc comment:
+ - snap/naming: upgrade TODO to TODO:UC20
+ - secboot: add call to reseal an existing key
+ - boot: in seal.go adjust error message and function names
+ - o/snapstate: check available disk space in RemoveMany
+ - boot: build bootchains data for sealing
+ - tests: remove "set -e" from function only shell libs
+ - o/snapstate: disk space check on UpdateMany
+ - o/snapstate: disk space check with snap update
+ - snap: implement new `snap reboot` command
+ - boot: do not reorder boot assets when generating predictable boot
+   chains and other small tweaks
+ - tests: some fixes and improvements for nested execution
+ - tests/core/uc20-recovery: fix check for at least specific calls to
+   mock-shutdown
+ - boot: be consistent using bootloader.Role* consts instead of
+   strings
+ - boot: helper for generating secboot load chains from a given boot
+   asset sequence
+ - boot: tweak boot chains to support a list of kernel command lines,
+   keep track of model and kernel boot file
+ - boot,secboot: switch to expose and use snapcore/secboot load event
+   trees
+ - tests: use `nested_exec` in core{20,}-early-config test
+ - devicestate: enable cloud-init on uc20 for grade signed and
+   secured
+ - boot: add "rootdir" to baseBootenvSuite and use in tests
+ - tests/lib/cla_check.py: don't allow users.noreply.github.com
+   commits to pass CLA
+ - boot: represent boot chains, helpers for marshalling and
+   equivalence checks
+ - boot: mark successful with boot assets
+ - client, api: handle insufficient space error
+ - o/snapstate: disk space check with single snap install
+ - configcore: "service.console-conf.disable" is gadget defaults only
+ - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+   AppArmor profile path
+ - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+ - packaging/debian-sid: tweak code preparing _build tree
+ - many: move seal code from gadget/install to boot
+ - tests: remove workaround for cups on ubuntu-20.10
+ - client: implement RebootToSystem
+ - many: seed.Model panics now if called before LoadAssertions
+ - daemon: add /v2/systems "reboot" action API
+ - github: run tests also on push to release branches
+ - interfaces/bluez: let slot access audio streams
+ - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+   new seed.ReadSystemEssential
+ - interfaces: allow snap-update-ns to read /proc/cmdline
+ - tests: new organization for nested tests
+ - o/snapstate, features: add feature flags for disk space awareness
+ - tests: workaround for cups issue on 20.10 where default printer is
+   not configured.
+ - interfaces: update cups-control and add cups for providing snaps
+ - boot: keep track of the original asset when observing updates
+ - tests: simplify and fix tests for disk space checks on snap remove
+ - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+   cloud.conf
+ - tests/main: mv core specific tests to core suite
+ - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+ - devicestate: rename "mockLogger" to "logbuf"
+ - many: introduce ContentChange for tracking gadget content in
+   observers
+ - many: fix partion vs partition typo
+ - bootloader: retrieve boot chains from bootloader
+ - devicestate: add tests around logging in RequestSystemAction
+ - boot: handle canceled update
+ - bootloader: tweak doc comments (thanks Samuele)
+ - seed/seedwriter: test local asserted snaps with UC20 grade signed
+ - sysconfig/cloudinit.go: add DisableNoCloud to
+   CloudInitRestrictOptions
+ - many: use BootFile type in load sequences
+ - boot,bootloader: clarifications after the changes to introduce
+   bootloader.Options.Role
+ - boot,bootloader,gadget: apply new bootloader.Options.Role
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - testutil: add checkers for symbolic link target
+ - many: refactor tpm seal parameter setting
+ - boot/bootstate20: reboot to rollback to previous kernel
+ - boot: add unit test helpers
+ - boot: observe update & rollback of trusted assets
+ - interfaces/utf: Add MIRKey to u2f devices
+ - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+   cloud-init tests
+ - many: check that users of BaseTest don't forget to consume
+   cleanups
+ - tests/nested/core20/tpm: verify trusted boot assets tracking
+ - github: run macOS job with Go 1.14
+ - many: misc doc-comment changes and typo fixes
+ - o/snapstate: disk space check with InstallMany
+ - many: cloud-init cleanups from previous PR's
+ - tests: running tests on opensuse leap 15.2
+ - run-checks: check for dirty build tree too
+ - vendor: run ./get-deps.sh to update the secboot hash
+ - tests: update listing test for "-dirty" versions
+ - overlord/devicestate: do not release the state lock when updating
+   gadget assets
+ - secboot: read kernel efi image from snap file
+ - snap: add size to the random access file return interface
+ - daemon: correctly parse Content-Type HTTP header.
+ - tests: account for apt-get on core18
+ - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+   loop
+ - mkversion.sh: simple hack to include dirty in version if the tree
+   is dirty
+ - cgroup,snap: track hooks on system bus only
+ - interfaces/systemd: compare dereferenced Service
+ - run-checks: only check files in git for misspelling
+ - osutil: add a package doc comment (via doc.go)
+ - boot: complain about reused asset name during initial install
+ - snapstate: installSize helper that calculates total size of snaps
+   and their prerequisites
+ - snapshots: export of snapshots
+ - boot/initramfs_test.go: reset boot vars on the bootloader for each
+   iteration
+
+* Fri Sep 04 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46.1
+ - interfaces: allow snap-update-ns to read
+   /proc/cmdline
+ - github: run macOS job with Go 1.14
+ - o/snapstate, features: add feature flag for disk space check on
+   remove
+ - tests: account for apt-get on core18
+ - mkversion.sh: include dirty in version if the tree
+   is dirty
+ - interfaces/systemd: compare dereferenced Service
+ - vendor.json: update mysterious secboot SHA again
+
+* Tue Aug 25 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.46
+ - logger: add support for setting snapd.debug=1 on kernel cmdline
+ - o/snapstate: check disk space before creating automatic snapshot
+   on remove
+ - boot, o/devicestate: observe existing recovery bootloader trusted
+   boot assets
+ - many: use transient scope for tracking apps and hooks
+ - features: add HiddenSnapFolder feature flag
+ - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+   too
+ - runinhibit: open the lock file in read-only mode in IsLocked
+ - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+   automatic
+ - tests: update spread test for unknown plug/slot with snapctl is-
+   connected
+ - osutil: add OpenExistingLockForReading
+ - kernel: add kernel.Validate()
+ - interfaces: add vcio interface
+ - interfaces/{docker,kubernetes}-support: load overlay and support
+   systemd cgroup driver
+ - tests/lib/nested.sh: use more robust code for finding what loop
+   dev we mounted
+ - cmd/snap-update-ns: detach all bind-mounted file
+ - snap/snapenv: set SNAP_REAL_HOME
+ - packaging: umount /snap on purge in containers
+ - interfaces: misc policy updates xlvi
+ - secboot,cmd/snap-bootstrap: cross-check partitions before
+   unlocking, mounting
+ - boot: copy boot assets cache to new root
+ - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+ - o/hookstate/ctlcmd: make is-connected check whether the plug or
+   slot exists
+ - tests: find -ignore_readdir_race when scanning cgroups
+ - interfaces/many: deny arbitrary desktop files and misc from
+   /usr/share
+ - tests: use "set -ex" in prep-snapd-in-lxd.sh
+ - tests: re-enable udisks test on debian-sid
+ - cmd/snapd-generator: use PATH fallback if PATH is not set
+ - tests: disable udisks2 test on arch linux
+ - github: use latest/stable go, not latest/edge
+ - tests: remove support for ubuntu 19.10 from spread tests
+ - tests: fix lxd test wrongly tracking 'latest'
+ - secboot: document exported functions
+ - cmd: compile snap gdbserver shim correctly
+ - many: correctly calculate the desktop file prefix everywhere
+ - interfaces: add kernel-crypto-api interface
+ - corecfg: add "system.timezone" setting to the system settings
+ - cmd/snapd-generator: generate drop-in to use fuse in container
+ - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+   from previous PR
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+ - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+   the-tool
+ - tests: work around broken update of systemd-networkd
+ - tests/main/install-fontconfig-cache-gen: enhance test by
+   verifying, add fonts to test
+ - o/devicestate: wrap asset update observer error
+ - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+ - mkversion.sh: disallow changelog versions that have git in it, if
+   we also have git version
+ - interfaces/many: miscellaneous updates for strict microk8s
+ - snap: fix repeated "cannot list recovery system" and add test
+ - boot: track trusted assets during initial install, assets cache
+ - vendor: update secboot to fix key data validation
+ - tests: unmount FUSE file-systems from XDG runtime dir
+ - overlord/devicestate: workaround non-nil interface with nil struct
+ - sandbox/cgroup: remove temporary workaround for multiple cgroup
+   writers
+ - sandbox/cgroup: detect dangling v2 cgroup
+ - bootloader: add helper for creating a bootloader based on gadget
+ - tests: support different images on nested execution
+ - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+ - packaging/arch: use external linker when building statically
+ - tests: cope with ghost cgroupv2
+ - tests: fix issues related to restarting systemd-logind.service
+ - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+   gadget updates
+ - vendor: update github.com/kr/pretty to fix diffs of values with
+   pointer cycles
+ - boot: move bootloaderKernelState20 impls to separate file
+ - .github/workflows: move snap building to test.yaml as separate
+   cached job
+ - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+   meeting minimal requirements
+ - osutil: add CommitAs to atomic file
+ - gadget: introduce content update observer
+ - bootloader: introduce TrustedAssetsBootloader, implement for grub
+ - o/snapshotstate: helpers for calculating disk space needed for an
+   automatic snapshot
+ - gadget/install: retrieve command lines from bootloader
+ - boot/bootstate20: unify commit method impls, rm
+   bootState20MarkSuccessful
+ - tests: add system information and image information when debug
+   info is displayed
+ - tests/main/cgroup-tracking: try to collect some information about
+   cgroups
+ - boot: introduce current_boot_assets and
+   current_recovery_boot_assets to modeenv
+ - tests: fix for timing issues on journal-state test
+ - many: remove usage and creation of hijacked pid cgroup
+ - tests: port regression-home-snap-root-owned to tests.session
+ - tests: run as hightest via tests.session
+ - github: run CLA checks on self-hosted workers
+ - github: remove Ubuntu 19.10 from actions workflow
+ - tests: remove End-Of-Life opensuse/fedora releases
+ - tests: remove End-Of-Life releases from spread.yaml
+ - tests: fix debug section of appstream-id test
+ - interfaces: check !b.preseed earlier
+ - tests: work around bug in systemd/debian
+ - boot: add deepEqual, Copy helpers for Modeenv to simplify
+   bootstate20 refactor
+ - cmd: add new "snap recovery" command
+ - interfaces/systemd: use emulation mode when preseeding
+ - interfaces/kmod: don't load kernel modules in kmod backend when
+   preseeding
+ - interfaces/udev: do not reload udevadm rules when preseeding
+ - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+ - boot: fancy marshaller for modeenv values
+ - gadget, osutil: use atomic file copy, adjust tests
+ - overlord: use new tracking cgroup for refresh app awareness
+ - github: do not skip gofmt with Go 1.9/1.10
+ - many: introduce content write observer, install mode glue, initial
+   seal stubs
+ - daemon,many: switch to use client.ErrorKind and drop the local
+   errorKind...
+ - tests: new parameters for nested execution
+ - client: move all error kinds into errors.go and add doc strings
+ - cmd/snap: display the error in snap debug seeding if seeding is in
+   error
+ - cmd/snap/debug/seeding: use unicode for proper yaml
+ - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+   recovery_mode
+ - osutil/disks: add mock disk and tests for happy path of mock disks
+ - tests: refresh/revert snapd in uc20
+ - osutil/disks: use a dedicated error to indicate a fs label wasn't
+   found
+ - interfaces/system-key: in WriteSystemKey during tests, don't call
+   ParserFeatures
+ - boot: add current recovery systems to modeenv
+ - bootloader: extend managed assets bootloader interface to compose
+   a candidate command line
+ - interfaces: make the unmarshal test match more the comment
+ - daemon/api: use pointers to time.Time for debug seeding aspect
+ - o/ifacestate: update security profiles in connect undo handler
+ - interfaces: add uinput interface
+ - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+   tests
+ - o/devicestate: save seeding/preseeding times for use with debug
+   seeding api
+ - cmd/snap/debug: add "snap debug seeding" command for preseeding
+   debugging
+ - tests/main/selinux-clean: workaround SELinux denials triggered by
+   linger setup on Centos8
+ - bootloader: compose command line with mode and extra arguments
+ - cmd/snap, daemon: detect and bail purge on multi-snap
+ - o/ifacestate: fix bug in snapsWithSecurityProfiles
+ - interfaces/builtin/multipass: replace U+00A0 no-break space with
+   simple space
+ - bootloader/assets: generate bootloader assets from files
+ - many/tests/preseed: reset the preseeded images before preseeding
+   them
+ - tests: drop accidental accents from e
+ - secboot: improve key sealing tests
+ - tests: replace _wait_for_file_change with retry
+ - tests: new fs-state which replaces the files.sh helper
+ - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+   from path
+ - cmd/snap: track started apps and hooks
+ - tests/main/interfaces-pulseaudio: disable start limit checking for
+   pulseaudio service
+ - api: seeding debug api
+ - .github/workflows/snap-build.yaml: build the snapd snap via GH
+   Actions too
+ - tests: moving journalctl.sh to a new journal-state tool
+ - tests/nested/manual: add spread tests for cloud-init vuln
+ - bootloader/assets: helpers for registering per-edition snippets,
+   register snippets for grub
+ - data,packaging,wrappers: extend D-Bus service activation search
+   path
+ - spread: add opensuse 15.2 and tumbleweed for qemu
+ - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+ - sysconfig/cloudinit: add RestrictCloudInit
+ - cmd/snap-preseed: check that target path exists and is a directory
+   on --reset
+ - tests: check for pids correctly
+ - gadget,gadget/install: refactor partition table update
+ - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+   type
+ - interface/fwupd: add more policies for making fwupd upstream
+   strict
+ - tests: new to-one-line tool which replaces the strings.sh helper
+ - interfaces: new helpers to get and compare system key, for use
+   with seeding debug api
+ - osutil, many: add helper for checking whether the process is a go
+   test binary
+ - cmd/snap-seccomp/syscalls: add faccessat2
+ - tests: adjust xdg-open after launcher changes
+ - tests: new core config helper
+ - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+   open
+ - cmd/snap-preseed: handle relative chroot path
+ - snapshotstate: move sizer to osutil.Sizer()
+ - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+   kernel tests
+ - gadget/install,secboot: use snapcore/secboot luks2 api
+ - boot/initramfs_test.go: add Commentf to more Assert()'s
+ - tests/lib: account for changes in arch package file name extension
+ - bootloader/bootloadertest: fix comment typo
+ - bootloader: add helper for getting recovery system environment
+   variables
+ - tests: preinstall shellcheck and run tests on focal
+ - strutil: add a helper for parsing kernel command line
+ - osutil: add CheckFreeSpace helper
+ - secboot: update tpm connection error handling
+ - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+ - tests: add tests.cleanup helper
+ - packaging: add "ca-certificates" to build-depends
+ - tests: more checks in core20 early config spread test
+ - tests: fix some snapstate tests to use pointers for
+   snapmgrTestSuite
+ - boot: better naming of helpers for obtaining kernel command line
+ - many: use more specific check for unit test mocking
+ - systemd/escape: fix issues with "" and "\t" handling
+ - asserts: small improvements and corrections for sequence-forming
+   assertions' support
+ - boot, bootloader: query kernel command line of run mod and
+   recovery mode systems
+ - snap/validate.go: disallow snap layouts with new top-level
+   directories
+ - tests: allow to add a new label to run nested tests as part of PR
+   validation
+ - tests/core/gadget-update-pc: port to UC20
+ - tests: improve nested tests flexibility
+ - asserts: integer headers: disallow prefix zeros and make parsing
+   more uniform
+ - asserts: implement Database.FindSequence
+ - asserts: introduce SequenceMemberAfter in the asserts backstores
+ - spread.yaml: remove tests/lib/tools from PATH
+ - overlord: refuse to install snaps whose activatable D-Bus services
+   conflict with installed snaps
+ - tests: shorten lxd-state undo-mount-changes
+ - snap-confine: don't die if a device from sysfs path cannot be
+   found by udev
+ - tests: fix argument handling of apt-state
+ - tests: rename lxd-tool to lxd-state
+ - tests: rename user-tool to user-state, fix --help
+ - interfaces: add gconf interface
+ - sandbox/cgroup: avoid parsing security tags twice
+ - tests: rename version-tool to version-compare
+ - cmd/snap-update-ns: handle anomalies better
+ - tests: fix call to apt.Package.mark_install(auto_inst=True)
+ - tests: rename mountinfo-tool to mountinfo.query
+ - tests: rename memory-tool to memory-observe-do
+ - tests: rename invariant-tool to tests.invariant
+ - tests: rename apt-tool to apt-state
+ - many: managed boot config during run mode setup
+ - asserts: introduce the concept of sequence-forming assertion types
+ - tests: tweak comments/output in uc20-recovery test
+ - tests/lib/pkgdb: do not use quiet when purging debs
+ - interfaces/apparmor: allow snap-specific /run/lock
+ - interfaces: add system-source-code for access to /usr/src
+ - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+ - gadget/install: move udev trigger to gadget/install
+ - many: make nested spread tests more reliable
+ - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+   w/ external backend
+ - tests: enable tests on uc20 which now work with the real model
+   assertion
+ - tests: enable system-snap-refresh test on uc20
+ - gadget, bootloader: preserve managed boot assets during gadget
+   updates
+ - tests: fix leaked dbus-daemon in selinux-clean
+ - tests: add servicestate.Control tests
+ - tests: fix "restart.service"
+ - wrappers: helper for enabling services - extract and move enabling
+   of services into a helper
+ - tests: new test to validate refresh and revert of kernel and
+   gadget on uc20
+ - tests/lib/prepare-restore: collect debug info when prepare purge
+   fails
+ - bootloader: allow managed bootloader to update its boot config
+ - tests: Remove unity test from nightly test suite
+ - o/devicestate: set mark-seeded to done in the task itself
+ - tests: add spread test for disconnect undo caused by failing
+   disconnect hook
+ - sandbox/cgroup: allow discovering PIDs of given snap
+ - osutil/disks: support IsDecryptedDevice for mountpoints which are
+   dm devices
+ - osutil: detect autofs mounted in /home
+ - spread.yaml: allow amazon-linux-2-64 qemu with
+   ec2-user/ec2-user
+ - usersession: support additional zoom URL schemes
+ - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+ - sandbox/cgroup: add tracking helpers
+ - tests: detect stray dbus-daemon
+ - overlord: refuse to install snaps providing user daemons on Ubuntu
+   14.04
+ - many: move encryption and installer from snap-boostrap to gadget
+ - o/ifacestate: fix connect undo handler
+ - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+ - bootloader: introduce managed bootloader, implement for grub
+ - tests: fix incorrect check in smoke/remove test
+ - asserts,seed: split handling of essential/not essential model
+   snaps
+ - gadget: fix typo in mounted filesystem updater
+ - gadget: do only one mount point lookup in mounted fs updater
+ - tests/core/snap-auto-mount: try to make the test more robust
+ - tests: adding ubuntu-20.04 to google-sru backend
+ - o/servicestate: add updateSnapstateServices helper
+ - bootloader: pull recovery grub config from internal assets
+ - tests/lib/tools: apply linger workaround when needed
+ - overlord/snapstate: graceful handling of denied "managed" refresh
+   schedule
+ - snapstate: fix autorefresh from classic->strict
+ - overlord/configstate: add system.kernel.printk.console-loglevel
+   option
+ - tests: fix assertion disk handling for nested UC systems
+ - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+ - tests: extra worker for google-nested backend to avoid timeout
+   error on uc20
+ - snapdtool: helper to check whether the current binary is reexeced
+   from a snap
+ - tests: mock servicestate in api tests to avoid systemctl checks
+ - many: rename back snap.Info.GetType to Type
+ - tests/lib/cla_check: expect explicit commit range
+ - osutil/disks: refactor diskFromMountPointImpl a bit
+ - o/snapstate: service-control task handler
+ - osutil: add disks pkg for associating mountpoints with
+   disks/partitions
+ - gadget,cmd/snap-bootstrap: move partitioning to gadget
+ - seed: fix LoadEssentialMeta when gadget is not loaded
+ - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+   secure_path
+ - asserts: introduce new assertion validation-set
+ - asserts,daemon: add support for "serials" field in system-user
+   assertion
+ - data/sudo: drop a failed sudo secure_path workaround
+ - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+ - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+ - spread.yaml: update secure boot attribute name
+ - interfaces/block_devices: add NVMe subsystem devices, support
+   multipath paths
+ - tests: use the "jq" snap from the edge channel
+ - tests: simplify the tpm test by removing the test-snapd-mokutil
+   snap
+ - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+   status too
+ - tests/main/sudo-env: check snap path under sudo
+ - tests/main/lxd: add test for snaps inside nested lxd containers
+   not working
+ - asserts/internal: expand errors about invalid serialized grouping
+   labels
+ - usersession/userd: add msteams url support
+ - tests/lib/prepare.sh: adjust comment about sgdisk
+ - tests: fix how gadget pc is detected when the snap does not exist
+   and ls fails
+ - tests: move a few more tests to snapstate_update_test.go
+ - tests/main: add spread test for running svc from install hook
+ - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+ - tests/special-home-can-run-classic-snaps: re-enable
+ - workflow: test PR title as part of the static checks again
+ - tests/main/xdg-open-compat: backup and restore original xdg-open
+ - tests: move update-related tests to snapstate_update_test.go
+ - cmd,many: move Version and bits related to snapd tools to
+   snapdtool, merge cmdutil
+ - tests/prepare-restore.sh: reset-failed systemd-journald before
+   restarting
+ - interfaces: misc small interface updates
+ - spread: use find rather than recursive ls, skip mounted snaps
+ - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+   /var/lib/snapd
+ - tests: enable snap-auto-mount test on core20
+ - cmd/snap: do not show $PATH warning when executing under sudo on a
+   known distro
+ - asserts/internal: add some iteration benchmarks
+ - sandbox/cgroup: improve pid parsing code
+ - snap: add new `snap run --experimental-gdbserver` option
+ - asserts/internal: limit Grouping size switching to a bitset
+   representationWe don't always use the bit-set representation
+   because:
+ - snap: add an activates-on property to apps for D-Bus activation
+ - dirs: delete unused Cloud var, fix typo
+ - sysconfig/cloudinit: make callers of DisableCloudInit use
+   WritableDefaultsDir
+ - tests: fix classic ubuntu core transition auth
+ - tests: fail in setup_reflash_magic() if there is snapd state left
+ - tests: port interfaces-many-core-provided to tests.session
+ - tests: wait after creating partitions with sfdisk
+ - bootloader: introduce bootloarder assets, import grub.cfg with an
+   edition marker
+ - riscv64: bump timeouts
+ - gadget: drop dead code, hide exports that are not used externally
+ - tests: port 2 uc20 part1
+ - tests: fix bug waiting for snap command to be ready
+ - tests: move try-related tests to snapstate_try_test.go
+ - tests: add debug for 20.04 prepare failure
+ - travis.yml: removed, all our checks run in GH actions now
+ - tests: clean up up the use of configcoreSuite in the configcore
+   tests
+ - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+ - sandbox/cgroup: add tests for ParsePids
+ - tests: fix the basic20 test for uc20 on external backend
+ - tests: use configcoreSuite in journalSuite and remove some
+   duplicated code
+ - tests: move a few more tests to snapstate_install_test
+ - tests: assorted small patches
+ - dbusutil/dbustest: separate license from package
+ - interfaces/builtin/time-control: allow POSIX clock API
+ - usersession/userd: add "slack" to the white list of URL schemes
+   handled by xdg-open
+ - tests: check that host settings like hostname are settable on core
+ - tests: port xdg-settings test to tests.session
+ - tests: port snap-handle-link test to tests.session
+ - arch: add riscv64
+ - tests: core20 early defaults spread test
+ - tests: move install tests from snapstate_test.go to
+   snapstate_install_test.go
+ - github: port macOS sanity checks from travis
+ - data/selinux: allow checking /var/cache/app-info
+ - o/devicestate: core20 early config from gadget defaults
+ - tests: autoremove after removing lxd in preseed-lxd test
+ - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+ - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+ - tests: update the file used to detect the boot path on uc20
+ - spread.yaml: show /var/lib/snapd in debug
+ - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+   netplan files
+ - snap/naming: add helpers to parse app and hook security tags
+ - tests: modernize retry tool
+ - tests: fix and trim debug section in xdg-open-portal
+ - tests: modernize and use snapd.tool
+ - vendor: update to latest github.com/snapcore/bolt for riscv64
+ - cmd/snap-confine: add support for libc6-lse
+ - interfaces: miscellaneous policy updates xlv
+ - interfaces/system-packages-doc: fix typo in variable names
+ - tests: port interfaces-calendar-service to tests.session
+ - tests: install/run the lzo test snap too
+ - snap: (small) refactor of `snap download` code for
+   testing/extending
+ - data: fix shellcheck warnings in snapd.sh.in
+ - packaging: disable buildmode=pie for riscv64
+ - tests: install test-snapd-rsync snap from edge channel
+ - tests: modernize tests.session and port everything using it
+ - tests: add ubuntu 20.10 to spread tests
+ - cmd/snap/remove: mention snap restore/automatic snapshots
+ - dbusutil: move all D-Bus helpers and D-Bus test helpers
+ - wrappers: pass 'disable' flag to StopServices wrapper
+ - osutil: enable riscv64 build
+ - snap/naming: add ParseSecurityTag and friends
+ - tests: port document-portal-activation to session-tool
+ - bootloader: rename test helpers to reflect we are mocking EFI boot
+   locations
+ - tests: disable test of nfs v3 with udp proto on debian-sid
+ - tests: plan to improve the naming and uniformity of utilities
+ - tests: move *-tool tests to their own suite
+ - snap-bootstrap: remove sealed key file on reinstall
+ - bootloader/ubootenv: don't panic with an empty uboot env
+ - systemd: rename actualFsTypeAndMountOptions to
+   hostFsTypeAndMountOptions
+ - daemon: fix filtering of service-control changes for snap.app
+ - tests: spread test for preseeding in lxd container
+ - tests: fix broken snapd.session agent.socket
+ - wrappers: add RestartServices function and ReloadOrRestart to
+   systemd
+ - o/cmdstate: handle ignore flag on exec-command tasks
+ - gadget: make ext4 filesystems with or without metadata checksum
+ - tests: update statx test to run on all LTS releases
+ - configcore: show better error when disabling services
+ - interfaces: add hugepages-control
+ - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+ - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+ - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+ - tests: reload systemd --user for root, if present
+ - tests: reload systemd after editing /etc/fstab
+ - tests: add missing dependencies needed for sbuild test on debian
+ - tests: reload systemd after removing pulseaudio
+ - image, tests: core18 early config.
+ - interfaces: add system-packages-doc interface
+ - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+   preseeding
+ - interfaces/fwupd: allow bind mount to /boot on core
+ - tests: improve oom-vitality tests
+ - tests: add fedora 32 to spread.yaml
+ - config: apply vitality-hint immediately when the config changes
+ - tests: port snap-routine-portal-info to session-tool
+ - configcore: add "service.console-conf.disable" config option
+ - tests: port xdg-open to session-tool
+ - tests: port xdg-open-compat to session-tool
+ - tests: port interfaces-desktop-* to session-tool
+ - spread.yaml: apply yaml formatter/linter
+ - tests: port interfaces-wayland to session-tool
+ - o/devicestate: refactor current system handling
+ - snap-mgmt: perform cleanup of user services
+ - snap/snapfile,squashfs: followups from 8729
+ - boot, many: require mode in modeenv
+ - data/selinux: update policy to allow forked processes to call
+   getpw*()
+ - tests: log stderr from dbus-monitor
+ - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+   tag
+ - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+   layout
+ - interfaces/builtin/desktop: do not mount fonts cache on distros
+   with quirks
+ - data/selinux: allow snapd to remove/create the its socket
+ - testutil/exec.go: set PATH after running shellcheck
+ - tests: silence stderr from dbus-monitor
+ - snap,many: mv Open to snapfile pkg to support add'l options to
+   Container methods
+ - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+   gadget
+ - github: remove workaround for bug 133 in actions/cache
+ - tests: remove dbus.sh
+ - cmd/snap-preseed: improve mountpoint checks of the preseeded
+   chroot
+ - spread.yaml: add ps aux to debug section
+ - github: run all spread systems in a single go with cached results
+ - test: session-tool cli tweaks
+ - asserts: rest of the Pool API
+ - tests: port interfaces-network-status-classic to session-tool
+ - packaging: remove obsolete 16.10,17.04 symlinks
+ - tests: setup portals before starting user session
+ - o/devicestate: typo fix
+ - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+   devices
+ - cmd/snap/model: support store, system-user-authority keys in
+   --verbose
+ - o/devicestate: raise conflict when requesting system action while
+   seeding
+ - tests: detect signs of crashed snap-confine
+ - tests: sign kernel and gadget to run nested tests using current
+   snapd code
+ - tests: remove gnome-online-accounts we install
+ - tests: fix the issue where all the tests were executed on secboot
+   system
+ - tests: port interfaces-accounts-service to session-tool
+ - interfaces/network-control: bring /var/lib/dhcp from host
+ - image,cmd/snap,tests: add support for store-wide cohort keys
+ - configcore: add nomanagers buildtag for conditional build
+ - tests: port interfaces-password-manager-service to session-tool
+ - o/devicestate: cleanup system actions supported by recover mode
+ - snap-bootstrap: remove create-partitions and update tests
+ - tests: fix nested tests
+ - packaging/arch: update PKGBUILD to match one in AUR
+ - tests: port interfaces-location-control to session-tool
+ - tests: port interfaces-contacts-service to session-tool
+ - state: log task errors in the journal too
+ - o/devicestate: change how current system is reported for different
+   modes
+ - devicestate: do not report "ErrNoState" for seeded up
+ - tests: add a note about broken test sequence
+ - tests: port interfaces-autopilot-introspection to session-tool
+ - tests: port interfaces-dbus to session-tool
+ - packaging: update sid packaging to match 16.04+
+ - tests: enable degraded test on uc20
+ - c/snaplock/runinhibit: add run inhibition operations
+ - tests: detect and report root-owned files in /home
+ - tests: reload root's systemd --user after snapd tests
+ - tests: test registration with serial-authority: [generic]
+ - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+   key in recover
+ - tests/mount-ns: stop binfmt_misc mount unit
+ - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+   uuid if available
+ - daemon, tests: indicate system mode, test switching to recovery
+   and back to run
+ - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+   denials
+ - tests/mount-ns: update to reflect new UEFI boot mode
+ - usersession,tests: clean ups for userd/settings.go and move
+   xdgopenproxy under usersession
+ - tests: disable mount-ns test
+ - tests: test user belongs to systemd-journald, on core20
+ - tests: run core/snap-set-core-config on uc20 too
+ - tests: remove generated session-agent units
+ - sysconfig: use new _writable_defaults dir to create cloud config
+ - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+   future work
+ - asserts: make clearer that with label we mean a serialized label
+ - cmd/snap-bootstrap: tweak recovery trigger log messages
+ - asserts: introduce PoolTo 
+ - userd: allow setting default-url-scheme-handler
+ - secboot: append uuid to ubuntu-data when decrypting
+ - o/configcore: pass extra options to FileSystemOnlyApply
+ - tests: add dbus-user-session to bionic and reorder package names
+ - boot, bootloader: adjust comments, expand tests
+ - tests: improve debugging of user session agent tests
+ - packaging: add the inhibit directory
+ - many: add core.resiliance.vitality-hint config setting
+ - tests: test adjustments and fixes for recently published images
+ - cmd/snap: coldplug auto-import assertions from all removable
+   devices
+ - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+   secboot
+ - tests: not fail when boot dir cannot be determined
+ - tests: new directory used to store the cloud images on gce
+ - tests: inject snapd from edge into seeds of the image in manual
+   preseed test
+ - usersession/agent,wrappers: fix races between Shutdown and Serve
+ - tests: add dependency needed for next upgrade of bionic
+ - tests: new test user is used for external backend
+ - cmd/snap: fix the order of positional parameters in help output
+ - tests: don't create root-owned things in ~test
+ - tests/lib/prepare.sh: delete patching of the initrd
+ - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+   as well
+ - progress: tweak multibyte label unit test data
+ - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+ - gadget: fix fallback device lookup for 'mbr' type structures
+ - configcore: only reload journald if systemd is new enough
+ - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+ - wrappers: allow user mode systemd daemons
+ - progress: fix progress bar with multibyte duration units
+ - tests: fix raciness in pulseaudio test
+ - asserts/internal: introduce Grouping and Groupings
+ - tests: remove user.sh
+ - tests: pair of follow-ups from earlier reviews
+ - overlord/snapstate: warn of refresh/postpone events
+ - configcore,tests: use daemon-reexec to apply watchdog config
+ - c/snap-bootstrap: check mount states via initramfsMountStates
+ - store: implement DownloadAssertions
+ - tests: run smoke test with different bases
+ - tests: port user-mounts test to session-tool
+ - store: handle error-list in fetch-assertions results
+ - tests: port interfaces-audio-playback-record to session-tool
+ - data/completion: add `snap` command completion for zsh
+ - tests/degraded: ignore failure in systemd-vconsole-setup.service
+ - image: stub implementation of image.Prepare for darwin
+ - tests: session-tool --restore -u stops user-$UID.slice
+ - o/ifacestate/handlers.go: fix typo
+ - tests: port pulseaudio test to session-tool
+ - tests: port user-session-env to session-tool
+ - tests: work around journald bug in core16
+ - tests: add debug to core-persistent-journal test
+ - tests: port selinux-clean to session-tool
+ - tests: port portals test to session-tool, fix portal tests on sid
+ - tests: adding option --no-install-recommends option also when
+   install all the deps
+ - tests: add session-tool --has-systemd-and-dbus
+ - packaging/debian-sid: add gcc-multilib to build deps
+ - osutil: expand FileLock to support shared locks and more
+ - packaging: stop depending on python-docutils
+ - store,asserts,many: support the new action fetch-assertions
+ - tests: port snap-session-agent-* to session-tool
+ - packaging/fedora: disable FIPS compliant crypto for static
+   binaries
+ - tests: fix for preseeding failures
+
+* Tue Jul 28 2020 Samuele Pedroni <pedronis@lucediurna.net>
+- New upstream release, LP: #1875071
+  - o/ifacestate: fix bug in snapsWithSecurityProfiles
+  - tests/main/selinux-clean: workaround SELinux denials triggered by
+    linger setup on Centos8
+
+* Mon Jul 27 2020 Zygmunt Krynicki <me@zygoon.pl>
+- New upstream release, LP: #1875071
+  - many: backport _writable_defaults dir changes
+  - tests: fix incorrect check in smoke/remove test
+  - cmd/snap-bootstrap,seed: backport of uc20 PRs
+  - tests: avoid exit when nested type var is not defined
+  - cmd/snap-preseed: backport fixes
+  - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+  - many: cherry-picks for 2.45, gh-action, test fixes
+  - tests/lib: account for changes in arch package file name extension
+  - postrm, snap-mgmt: cleanup modules and other cherry-picks
+  - snap-confine: don't die if a device from sysfs path cannot be
+    found by udev
+  - data/selinux: update policy to allow forked processes to call
+    getpw*()
+  - tests/main/interfaces-time-control: exercise setting time via date
+  - interfaces/builtin/time-control: allow POSIX clock API
+  - usersession/userd: add "slack" to the white list of URL schemes
+    handled by xdg-open
+
+* Fri Jul 10 2020 Michael Vogt <mvo@ubuntu.com>
+- New upstream release 2.45.2
+ - SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+   implementation
+   - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+     variable modification when calling the system xdg-open. Patch
+     thanks to James Henstridge
+   - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+     restarted. Patch thanks to Michael Vogt
+   - CVE-2020-11934
+ - SECURITY UPDATE: arbitrary code execution vulnerability on core
+   devices with access to physical removable media
+   - devicestate: Disable/restrict cloud-init after seeding.
+   - CVE-2020-11933
+
 * Fri Jun 05 2020 Michael Vogt <mvo@ubuntu.com>
 - New upstream release 2.45.1
  - data/selinux: allow checking /var/cache/app-info
  - cmd/snap-confine: add support for libc6-lse
- - interfaces: miscellanious policy updates xlv
+ - interfaces: miscellaneous policy updates xlv
  - snap-bootstrap: remove sealed key file on reinstall
  - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
  - gadget: make ext4 filesystems with or without metadata checksum
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse/snapd.changes snapd-2.48.3+20.04/packaging/opensuse/snapd.changes
--- snapd-2.45.1+20.04.2/packaging/opensuse/snapd.changes	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse/snapd.changes	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,59 @@
 -------------------------------------------------------------------
+Tue, 02 Feb 2021 09:24:52 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.3
+
+-------------------------------------------------------------------
+Tue, 15 Dec 2020 20:38:36 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.2
+
+-------------------------------------------------------------------
+Thu, 03 Dec 2020 17:46:49 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.1
+
+-------------------------------------------------------------------
+Thu, 19 Nov 2020 17:55:24 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48
+
+-------------------------------------------------------------------
+Thu Oct 08 2020 09:30:44 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47.1
+
+-------------------------------------------------------------------
+Tue Sep 29 2020 15:19:13 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47
+
+-------------------------------------------------------------------
+Fri Sep 04 2020 15:42:54 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46.1
+
+-------------------------------------------------------------------
+Tue Aug 25 2020 15:26:21 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46
+
+-------------------------------------------------------------------
+Tue Jul 28 2020 21:43:38 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.45.3.1
+
+-------------------------------------------------------------------
+Mon Jul 27 2020 12:01:14 +0200 - me@zygoon.pl
+
+- Update to upstream release 2.45.3
+
+-------------------------------------------------------------------
+Fri Jul 10 18:05:48 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45.2
+
+-------------------------------------------------------------------
 Fri Jun 05 13:13:49 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.45.1
@@ -9,6 +64,16 @@
 - Update to upstream release 2.45
 
 -------------------------------------------------------------------
+Thu Apr 30 07:09:22 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.5
+
+-------------------------------------------------------------------
+Wed Apr 29 06:43:56 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.4
+
+-------------------------------------------------------------------
 Thu Apr 10 14:57:25 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.44.3
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse/snapd.spec snapd-2.48.3+20.04/packaging/opensuse/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/opensuse/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -14,6 +14,9 @@
 
 # Please submit bugfixes or comments via http://bugs.opensuse.org/
 
+# takes an absolute path with slashes and turns it into an AppArmor profile path
+%define as_apparmor_path() %(echo "%1" | tr / . | cut -c2-)
+
 # Test keys: used for internal testing in snapd.
 %bcond_with testkeys
 
@@ -70,6 +73,9 @@
 # GOPATH so that nothing needs to be moved or copied for "go build" to work.
 %global indigo_srcdir   %{indigo_gopath}/src/%{import_path}
 
+# path to snap-confine encoded as AppArmor profile
+%define apparmor_snapconfine_profile %as_apparmor_path %{_libexecdir}/snapd/snap-confine
+
 # Set if multilib is enabled for supported arches
 %ifarch x86_64 aarch64 %{power64} s390x
 %global with_multilib 1
@@ -77,7 +83,7 @@
 
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0
 Summary:        Tools enabling systems to work with .snap files
 License:        GPL-3.0
@@ -134,6 +140,7 @@
 Requires:       gpg2
 Requires:       openssh
 Requires:       squashfs
+Requires:       system-user-daemon
 
 # Old versions of xdg-document-portal can expose data belonging to
 # other confied apps.  Older OpenSUSE releases are unlikely to change,
@@ -249,6 +256,10 @@
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH all
 
 %check
+for binary in snap-exec snap-update-ns snapctl; do
+    ldd $binary 2>&1 | grep 'not a dynamic executable'
+done
+
 %make_build -C %{indigo_srcdir}/cmd check
 # Use the common packaging helper for testing.
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH check
@@ -310,7 +321,7 @@
 %post
 %set_permissions %{_libexecdir}/snapd/snap-confine
 %if %{with apparmor}
-%apparmor_reload /etc/apparmor.d/usr.lib.snapd.snap-confine
+%apparmor_reload /etc/apparmor.d/%{apparmor_snapconfine_profile}
 %endif
 %service_add_post %{systemd_services_list}
 %systemd_user_post %{systemd_user_services_list}
@@ -340,12 +351,13 @@
 %config %{_sysconfdir}/permissions.d/snapd
 %config %{_sysconfdir}/permissions.d/snapd.paranoid
 %config %{_sysconfdir}/profile.d/snapd.sh
-%config %{_sysconfdir}/sudoers.d/99-snapd.conf
 
 # Directories
 %dir %attr(0111,root,root) %{_sharedstatedir}/snapd/void
 %dir %{_datadir}/dbus-1
 %dir %{_datadir}/dbus-1/services
+%dir %{_datadir}/dbus-1/session.d
+%dir %{_datadir}/dbus-1/system.d
 %dir %{_datadir}/polkit-1
 %dir %{_datadir}/polkit-1/actions
 %dir %{_environmentdir}
@@ -358,10 +370,14 @@
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cache
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -398,6 +414,8 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_environmentdir}/990-snapd.conf
 %{_libexecdir}/snapd/complete.sh
@@ -407,6 +425,7 @@
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-exec
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-mgmt
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
@@ -434,7 +453,7 @@
 %config %{_sysconfdir}/apparmor.d
 %{_libexecdir}/snapd/snapd-apparmor
 %{_sbindir}/rcsnapd.apparmor
-%{_sysconfdir}/apparmor.d/usr.lib.snapd.snap-confine
+%{_sysconfdir}/apparmor.d/%{apparmor_snapconfine_profile}
 %{_unitdir}/snapd.apparmor.service
 %endif
 
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.0/snapd.changes snapd-2.48.3+20.04/packaging/opensuse-15.0/snapd.changes
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.0/snapd.changes	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.0/snapd.changes	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,59 @@
 -------------------------------------------------------------------
+Tue, 02 Feb 2021 09:24:52 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.3
+
+-------------------------------------------------------------------
+Tue, 15 Dec 2020 20:38:36 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.2
+
+-------------------------------------------------------------------
+Thu, 03 Dec 2020 17:46:49 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.1
+
+-------------------------------------------------------------------
+Thu, 19 Nov 2020 17:55:24 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48
+
+-------------------------------------------------------------------
+Thu Oct 08 2020 09:30:44 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47.1
+
+-------------------------------------------------------------------
+Tue Sep 29 2020 15:19:13 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47
+
+-------------------------------------------------------------------
+Fri Sep 04 2020 15:42:54 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46.1
+
+-------------------------------------------------------------------
+Tue Aug 25 2020 15:26:21 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46
+
+-------------------------------------------------------------------
+Tue Jul 28 2020 21:43:38 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.45.3.1
+
+-------------------------------------------------------------------
+Mon Jul 27 2020 12:01:14 +0200 - me@zygoon.pl
+
+- Update to upstream release 2.45.3
+
+-------------------------------------------------------------------
+Fri Jul 10 18:05:48 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45.2
+
+-------------------------------------------------------------------
 Fri Jun 05 13:13:49 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.45.1
@@ -9,6 +64,16 @@
 - Update to upstream release 2.45
 
 -------------------------------------------------------------------
+Thu Apr 30 07:09:22 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.5
+
+-------------------------------------------------------------------
+Wed Apr 29 06:43:56 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.4
+
+-------------------------------------------------------------------
 Thu Apr 10 14:57:25 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.44.3
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.0/snapd.spec snapd-2.48.3+20.04/packaging/opensuse-15.0/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.0/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.0/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -14,6 +14,9 @@
 
 # Please submit bugfixes or comments via http://bugs.opensuse.org/
 
+# takes an absolute path with slashes and turns it into an AppArmor profile path
+%define as_apparmor_path() %(echo "%1" | tr / . | cut -c2-)
+
 # Test keys: used for internal testing in snapd.
 %bcond_with testkeys
 
@@ -70,6 +73,9 @@
 # GOPATH so that nothing needs to be moved or copied for "go build" to work.
 %global indigo_srcdir   %{indigo_gopath}/src/%{import_path}
 
+# path to snap-confine encoded as AppArmor profile
+%define apparmor_snapconfine_profile %as_apparmor_path %{_libexecdir}/snapd/snap-confine
+
 # Set if multilib is enabled for supported arches
 %ifarch x86_64 aarch64 %{power64} s390x
 %global with_multilib 1
@@ -77,7 +83,7 @@
 
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0
 Summary:        Tools enabling systems to work with .snap files
 License:        GPL-3.0
@@ -134,6 +140,7 @@
 Requires:       gpg2
 Requires:       openssh
 Requires:       squashfs
+Requires:       system-user-daemon
 
 # Old versions of xdg-document-portal can expose data belonging to
 # other confied apps.  Older OpenSUSE releases are unlikely to change,
@@ -249,6 +256,10 @@
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH all
 
 %check
+for binary in snap-exec snap-update-ns snapctl; do
+    ldd $binary 2>&1 | grep 'not a dynamic executable'
+done
+
 %make_build -C %{indigo_srcdir}/cmd check
 # Use the common packaging helper for testing.
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH check
@@ -310,7 +321,7 @@
 %post
 %set_permissions %{_libexecdir}/snapd/snap-confine
 %if %{with apparmor}
-%apparmor_reload /etc/apparmor.d/usr.lib.snapd.snap-confine
+%apparmor_reload /etc/apparmor.d/%{apparmor_snapconfine_profile}
 %endif
 %service_add_post %{systemd_services_list}
 %systemd_user_post %{systemd_user_services_list}
@@ -340,12 +351,13 @@
 %config %{_sysconfdir}/permissions.d/snapd
 %config %{_sysconfdir}/permissions.d/snapd.paranoid
 %config %{_sysconfdir}/profile.d/snapd.sh
-%config %{_sysconfdir}/sudoers.d/99-snapd.conf
 
 # Directories
 %dir %attr(0111,root,root) %{_sharedstatedir}/snapd/void
 %dir %{_datadir}/dbus-1
 %dir %{_datadir}/dbus-1/services
+%dir %{_datadir}/dbus-1/session.d
+%dir %{_datadir}/dbus-1/system.d
 %dir %{_datadir}/polkit-1
 %dir %{_datadir}/polkit-1/actions
 %dir %{_environmentdir}
@@ -358,10 +370,14 @@
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cache
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -398,6 +414,8 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_environmentdir}/990-snapd.conf
 %{_libexecdir}/snapd/complete.sh
@@ -407,6 +425,7 @@
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-exec
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-mgmt
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
@@ -434,7 +453,7 @@
 %config %{_sysconfdir}/apparmor.d
 %{_libexecdir}/snapd/snapd-apparmor
 %{_sbindir}/rcsnapd.apparmor
-%{_sysconfdir}/apparmor.d/usr.lib.snapd.snap-confine
+%{_sysconfdir}/apparmor.d/%{apparmor_snapconfine_profile}
 %{_unitdir}/snapd.apparmor.service
 %endif
 
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.1/snapd.changes snapd-2.48.3+20.04/packaging/opensuse-15.1/snapd.changes
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.1/snapd.changes	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.1/snapd.changes	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,59 @@
 -------------------------------------------------------------------
+Tue, 02 Feb 2021 09:24:52 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.3
+
+-------------------------------------------------------------------
+Tue, 15 Dec 2020 20:38:36 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.2
+
+-------------------------------------------------------------------
+Thu, 03 Dec 2020 17:46:49 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.1
+
+-------------------------------------------------------------------
+Thu, 19 Nov 2020 17:55:24 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48
+
+-------------------------------------------------------------------
+Thu Oct 08 2020 09:30:44 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47.1
+
+-------------------------------------------------------------------
+Tue Sep 29 2020 15:19:13 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47
+
+-------------------------------------------------------------------
+Fri Sep 04 2020 15:42:54 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46.1
+
+-------------------------------------------------------------------
+Tue Aug 25 2020 15:26:21 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46
+
+-------------------------------------------------------------------
+Tue Jul 28 2020 21:43:38 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.45.3.1
+
+-------------------------------------------------------------------
+Mon Jul 27 2020 12:01:14 +0200 - me@zygoon.pl
+
+- Update to upstream release 2.45.3
+
+-------------------------------------------------------------------
+Fri Jul 10 18:05:48 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45.2
+
+-------------------------------------------------------------------
 Fri Jun 05 13:13:49 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.45.1
@@ -9,6 +64,16 @@
 - Update to upstream release 2.45
 
 -------------------------------------------------------------------
+Thu Apr 30 07:09:22 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.5
+
+-------------------------------------------------------------------
+Wed Apr 29 06:43:56 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.4
+
+-------------------------------------------------------------------
 Thu Apr 10 14:57:25 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.44.3
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.1/snapd.spec snapd-2.48.3+20.04/packaging/opensuse-15.1/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.1/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.1/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -14,6 +14,9 @@
 
 # Please submit bugfixes or comments via http://bugs.opensuse.org/
 
+# takes an absolute path with slashes and turns it into an AppArmor profile path
+%define as_apparmor_path() %(echo "%1" | tr / . | cut -c2-)
+
 # Test keys: used for internal testing in snapd.
 %bcond_with testkeys
 
@@ -70,6 +73,9 @@
 # GOPATH so that nothing needs to be moved or copied for "go build" to work.
 %global indigo_srcdir   %{indigo_gopath}/src/%{import_path}
 
+# path to snap-confine encoded as AppArmor profile
+%define apparmor_snapconfine_profile %as_apparmor_path %{_libexecdir}/snapd/snap-confine
+
 # Set if multilib is enabled for supported arches
 %ifarch x86_64 aarch64 %{power64} s390x
 %global with_multilib 1
@@ -77,7 +83,7 @@
 
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0
 Summary:        Tools enabling systems to work with .snap files
 License:        GPL-3.0
@@ -134,6 +140,7 @@
 Requires:       gpg2
 Requires:       openssh
 Requires:       squashfs
+Requires:       system-user-daemon
 
 # Old versions of xdg-document-portal can expose data belonging to
 # other confied apps.  Older OpenSUSE releases are unlikely to change,
@@ -249,6 +256,10 @@
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH all
 
 %check
+for binary in snap-exec snap-update-ns snapctl; do
+    ldd $binary 2>&1 | grep 'not a dynamic executable'
+done
+
 %make_build -C %{indigo_srcdir}/cmd check
 # Use the common packaging helper for testing.
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH check
@@ -310,7 +321,7 @@
 %post
 %set_permissions %{_libexecdir}/snapd/snap-confine
 %if %{with apparmor}
-%apparmor_reload /etc/apparmor.d/usr.lib.snapd.snap-confine
+%apparmor_reload /etc/apparmor.d/%{apparmor_snapconfine_profile}
 %endif
 %service_add_post %{systemd_services_list}
 %systemd_user_post %{systemd_user_services_list}
@@ -340,12 +351,13 @@
 %config %{_sysconfdir}/permissions.d/snapd
 %config %{_sysconfdir}/permissions.d/snapd.paranoid
 %config %{_sysconfdir}/profile.d/snapd.sh
-%config %{_sysconfdir}/sudoers.d/99-snapd.conf
 
 # Directories
 %dir %attr(0111,root,root) %{_sharedstatedir}/snapd/void
 %dir %{_datadir}/dbus-1
 %dir %{_datadir}/dbus-1/services
+%dir %{_datadir}/dbus-1/session.d
+%dir %{_datadir}/dbus-1/system.d
 %dir %{_datadir}/polkit-1
 %dir %{_datadir}/polkit-1/actions
 %dir %{_environmentdir}
@@ -358,10 +370,14 @@
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cache
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -398,6 +414,8 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_environmentdir}/990-snapd.conf
 %{_libexecdir}/snapd/complete.sh
@@ -407,6 +425,7 @@
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-exec
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-mgmt
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
@@ -434,7 +453,7 @@
 %config %{_sysconfdir}/apparmor.d
 %{_libexecdir}/snapd/snapd-apparmor
 %{_sbindir}/rcsnapd.apparmor
-%{_sysconfdir}/apparmor.d/usr.lib.snapd.snap-confine
+%{_sysconfdir}/apparmor.d/%{apparmor_snapconfine_profile}
 %{_unitdir}/snapd.apparmor.service
 %endif
 
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+/usr/lib/snapd/snap-confine                             root:root         4755
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions.easy snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions.easy
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions.easy	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions.easy	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+/usr/lib/snapd/snap-confine                             root:root         4755
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions.paranoid snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions.paranoid
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions.paranoid	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions.paranoid	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+/usr/lib/snapd/snap-confine                             root:root         755
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions.secure snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions.secure
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/permissions.secure	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/permissions.secure	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+/usr/lib/snapd/snap-confine                             root:root         4755
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/snapd.changes snapd-2.48.3+20.04/packaging/opensuse-15.2/snapd.changes
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/snapd.changes	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/snapd.changes	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,530 @@
+-------------------------------------------------------------------
+Tue, 02 Feb 2021 09:24:52 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.3
+
+-------------------------------------------------------------------
+Tue, 15 Dec 2020 20:38:36 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.2
+
+-------------------------------------------------------------------
+Thu, 03 Dec 2020 17:46:49 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.1
+
+-------------------------------------------------------------------
+Thu, 19 Nov 2020 17:55:24 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48
+
+-------------------------------------------------------------------
+Thu Oct 08 2020 09:30:44 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47.1
+
+-------------------------------------------------------------------
+Tue Sep 29 2020 15:19:13 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47
+
+-------------------------------------------------------------------
+Fri Sep 04 2020 15:42:54 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46.1
+
+-------------------------------------------------------------------
+Tue Aug 25 2020 15:26:21 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46
+
+-------------------------------------------------------------------
+Tue Jul 28 2020 21:43:38 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.45.3.1
+
+-------------------------------------------------------------------
+Mon Jul 27 2020 12:01:14 +0200 - me@zygoon.pl
+
+- Update to upstream release 2.45.3
+
+-------------------------------------------------------------------
+Fri Jul 10 18:05:48 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45.2
+
+-------------------------------------------------------------------
+Fri Jun 05 13:13:49 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45.1
+
+-------------------------------------------------------------------
+Tue May 12 15:17:57 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45
+
+-------------------------------------------------------------------
+Thu Apr 30 07:09:22 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.5
+
+-------------------------------------------------------------------
+Wed Apr 29 06:43:56 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.4
+
+-------------------------------------------------------------------
+Thu Apr 10 14:57:25 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.3
+
+-------------------------------------------------------------------
+Thu Apr 2 07:51:34 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.2
+
+-------------------------------------------------------------------
+Sat Mar 21 17:32:12 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.1
+
+-------------------------------------------------------------------
+Tue Mar 17 19:55:47 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44
+
+-------------------------------------------------------------------
+Wed Feb 12 13:59:15 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.43.3
+
+-------------------------------------------------------------------
+Tue Jan 28 14:50:25 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.43.2
+
+-------------------------------------------------------------------
+Tue Jan 14 19:30:07 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.43.1
+
+-------------------------------------------------------------------
+Thu Jan 09 16:16:56 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.43
+
+-------------------------------------------------------------------
+Fri Dec 06 12:10:56 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.42.5
+
+-------------------------------------------------------------------
+Thu Nov 28 04:48:26 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.42.4
+
+-------------------------------------------------------------------
+Wed Nov 27 10:41:07 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.42.3
+
+-------------------------------------------------------------------
+Wed Nov 20 06:09:15 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.42.2
+
+-------------------------------------------------------------------
+Wed Oct 30 11:17:43 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.42.1
+
+-------------------------------------------------------------------
+Tue Oct 01 09:42:48 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.42
+
+-------------------------------------------------------------------
+Fri Aug 30 06:55:43 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.41
+
+-------------------------------------------------------------------
+Fri Jul 12 08:40:08 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.40
+
+-------------------------------------------------------------------
+Fri Jun 21 07:06:01 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.39.3
+
+-------------------------------------------------------------------
+Wed Jun 05 06:41:21 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.39.2
+
+-------------------------------------------------------------------
+Wed May 29 10:19:43 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.39.1
+
+-------------------------------------------------------------------
+Thu May 03 09:29:50 UTC 2019 - mvo@ubuntu.com
+
+- Update to upstream release 2.39
+
+-------------------------------------------------------------------
+Thu Mar 21 09:55:27 UTC 2019 - mvo@fastmail.fm
+
+- Update to upstream release 2.38
+
+-------------------------------------------------------------------
+Wed Feb 27 18:53:36 UTC 2019 - mvo@fastmail.fm
+
+- Update to upstream release 2.37.4
+
+-------------------------------------------------------------------
+Mon Feb 18 16:17:33 UTC 2019 - mvo@fastmail.fm
+
+- Update to upstream release 2.37.3
+
+-------------------------------------------------------------------
+Wed Feb 06 09:08:07 UTC 2019 - mvo@fastmail.fm
+
+- Update to upstream release 2.37.2
+
+-------------------------------------------------------------------
+Tue Jan 29 17:35:36 UTC 2019 - mvo@fastmail.fm
+
+- Update to upstream release 2.37.1
+
+-------------------------------------------------------------------
+Wed Jan 16 16:16:56 UTC 2019 - mvo@fastmail.fm
+
+- Update to upstream release 2.37
+
+-------------------------------------------------------------------
+Fri Dec 14 07:30:58 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.36.3
+
+-------------------------------------------------------------------
+Thu Nov 29 10:48:29 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.36.2
+
+-------------------------------------------------------------------
+Fri Nov 09 14:42:28 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.36.1
+
+-------------------------------------------------------------------
+Wed Oct 24 17:30:45 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.36
+
+-------------------------------------------------------------------
+Mon Oct 15 22:23:02 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.35.5
+
+-------------------------------------------------------------------
+Fri Oct 05 14:42:33 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.35.4
+
+-------------------------------------------------------------------
+Fri Oct 05 09:32:00 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.35.3
+
+-------------------------------------------------------------------
+Wed Sep 12 09:32:00 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.35.2
+
+-------------------------------------------------------------------
+Mon Sep 03 14:44:06 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.35.1
+
+-------------------------------------------------------------------
+Mon Aug 20 12:36:33 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.35
+
+-------------------------------------------------------------------
+Fri Jul 27 19:08:44 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.34.3
+
+-------------------------------------------------------------------
+Thu Jul 19 12:05:50 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.34.2
+
+-------------------------------------------------------------------
+Wed Jul 17 19:46:56 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.34.1
+
+-------------------------------------------------------------------
+Fri Jul 06 16:08:17 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.34
+
+-------------------------------------------------------------------
+Fri Jun 22 15:58:54 UTC 2018 - me@zygoon.pl
+
+- Fixed changelog chronology
+
+-------------------------------------------------------------------
+Fri Jun 22 14:25:35 UTC 2018 - me@zygoon.pl
+
+- Sync with snapd upstream packaging
+- Backport support for apparmor on tumbleweed
+- Install polkit files
+- Load snap-confine apparmor profile in post, if apparmor is enabled
+- Adjust badness of polkit-untracked-privlege
+-------------------------------------------------------------------
+Thu Jun 21 17:37:56 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.33.1
+
+-------------------------------------------------------------------
+Fri Jun 08 17:13:47 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.33
+
+-------------------------------------------------------------------
+Mon May 28 08:06:53 UTC 2018 - ngompa13@gmail.com
+
+- Refactor to support openSUSE Tumbleweed and Leap 42.3 and 15.0
+- Enable AppArmor support for openSUSE Tumbleweed (post Leap 15.0)
+- Enable support for handling the proprietary nvidia driver
+- Drop ancient spec stuff that was being ignored by RPM anyway
+- Drop spurious find command that didn't do anything...
+
+-------------------------------------------------------------------
+Wed May 16 10:20:08 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.9
+
+-------------------------------------------------------------------
+Fri May 11 14:36:16 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.8
+
+-------------------------------------------------------------------
+Fri May 11 13:09:32 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.7
+
+-------------------------------------------------------------------
+Sun Apr 29 19:21:53 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.6
+
+-------------------------------------------------------------------
+Mon Apr 16 16:41:48 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.5
+
+-------------------------------------------------------------------
+Wed Apr 11 16:30:45 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.4
+
+-------------------------------------------------------------------
+Wed Apr 11 12:40:09 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.3.2
+
+-------------------------------------------------------------------
+Wed Apr 11 10:34:00 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.3.1
+
+-------------------------------------------------------------------
+Thu Apr 05 22:35:35 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.3
+
+-------------------------------------------------------------------
+Sat Mar 31 21:09:29 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.2
+
+-------------------------------------------------------------------
+Mon Mar 26 21:03:02 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32.1
+
+-------------------------------------------------------------------
+Sat Mar 24 08:50:11 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.32
+
+-------------------------------------------------------------------
+Tue Feb 20 17:32:42 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.31.1
+
+-------------------------------------------------------------------
+Tue Feb 06 09:46:22 UTC 2018 - mvo@fastmail.fm
+
+- Update to upstream release 2.31
+
+-------------------------------------------------------------------
+Sat Nov 18 15:31:24 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.30
+
+-------------------------------------------------------------------
+Fri Nov 17 22:56:09 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.29.4
+
+-------------------------------------------------------------------
+Thu Nov 09 19:16:29 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.29.3
+
+-------------------------------------------------------------------
+Fri Nov 03 17:26:14 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.29.2
+
+-------------------------------------------------------------------
+Fri Nov 03 07:27:08 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.29.1
+
+-------------------------------------------------------------------
+Mon Oct 30 16:24:08 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.29
+
+-------------------------------------------------------------------
+Wed Oct 11 19:46:37 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.28.4
+
+-------------------------------------------------------------------
+Wed Oct 11 08:23:47 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.28.3
+
+-------------------------------------------------------------------
+Tue Oct 10 18:42:45 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.28.2
+
+-------------------------------------------------------------------
+Wed Sep 27 22:04:59 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.28.1
+
+-------------------------------------------------------------------
+Mon Sep 25 16:09:15 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.28
+
+-------------------------------------------------------------------
+Thu Sep 07 10:32:21 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27.6
+
+-------------------------------------------------------------------
+Wed Aug 30 07:45:01 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27.5
+
+-------------------------------------------------------------------
+Thu Aug 24 09:08:32 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27.4
+
+-------------------------------------------------------------------
+Fri Aug 18 15:51:22 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27.3
+
+-------------------------------------------------------------------
+Wed Aug 16 12:16:01 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27.2
+
+-------------------------------------------------------------------
+Mon Aug 14 08:07:21 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27.1
+
+-------------------------------------------------------------------
+Thu Aug 10 11:25:11 UTC 2017 - mvo@fastmail.fm
+
+- Update to upstream release 2.27
+
+-------------------------------------------------------------------
+Fri May 19 14:35:29 UTC 2017 - morphis@gravedo.de
+
+- Add bind() syscall to default seccomp policy to allow execution
+  of snap hooks.
+- Do not share /etc/ssl with the host but use the one from the core
+  snap.
+
+-------------------------------------------------------------------
+Wed May 10 12:24:44 UTC 2017 - morphis@gravedo.de
+
+- Update to upstream release 2.25
+
+-------------------------------------------------------------------
+Thu Apr 13 14:06:13 UTC 2017 - morphis@gravedo.de
+
+- Update to upstream release 2.24
+
+-------------------------------------------------------------------
+Thu Mar 30 14:14:44 UTC 2017 - morphis@gravedo.de
+
+- Update to upstream release 2.23.6
+
+-------------------------------------------------------------------
+Thu Mar 23 08:53:37 UTC 2017 - morphis@gravedo.de
+
+- Update to upstream release 2.23.5
+- Disable seccomp support to work around bugs in snap-confine
+  (see https://bugs.launchpad.net/snappy/+bug/1674193 for details)
+
+-------------------------------------------------------------------
+Wed Mar 08 16:09:03 UTC 2017 - me@zygoon.pl
+
+- Fix log-out prompt to be displayed only when really necessary.
+- Fix installation of /usr/lib/snapd/info (version information)
+- Install bash completion for "snap"
+
+-------------------------------------------------------------------
+Wed Mar 08 15:53:06 UTC 2017 - me@zygoon.pl
+
+- New upstream release.
+  More details are available at https://github.com/snapcore/snapd/releases/tag/2.23.1
+
+-------------------------------------------------------------------
+Tue Mar 07 23:00:34 UTC 2017 - me@zygoon.pl
+
+- Add PATH integration and post-install message asking the user to logout to
+  see PATH changes.
+
+-------------------------------------------------------------------
+Tue Mar 07 00:45:12 UTC 2017 - me@zygoon.pl
+
+- (hacky) Disable shellcheck as it is missing on Leap 42.1
+
+-------------------------------------------------------------------
+Tue Mar 07 00:43:58 UTC 2017 - me@zygoon.pl
+
+- (hacky) fix the 32bit build
+
+-------------------------------------------------------------------
+Mon Mar 06 18:08:04 UTC 2017 - me@zygoon.pl
+
+- Initial package based on fully vendorized source tarball
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/snapd-rpmlintrc snapd-2.48.3+20.04/packaging/opensuse-15.2/snapd-rpmlintrc
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/snapd-rpmlintrc	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/snapd-rpmlintrc	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+setBadness('permissions-unauthorized-file', 22)
+setBadness('polkit-untracked-privilege', 11)
+setBadness('non-position-independent-executable', 33)
+setBadness('polkit-untracked-privilege', 44)
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-15.2/snapd.spec snapd-2.48.3+20.04/packaging/opensuse-15.2/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/opensuse-15.2/snapd.spec	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-15.2/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,460 @@
+# spec file for package snapd
+#
+# Copyright (c) 2017 Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
+# Copyright (c) 2018 Neal Gompa <ngompa13@gmail.com>
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via http://bugs.opensuse.org/
+
+# takes an absolute path with slashes and turns it into an AppArmor profile path
+%define as_apparmor_path() %(echo "%1" | tr / . | cut -c2-)
+
+# Test keys: used for internal testing in snapd.
+%bcond_with testkeys
+
+# Enable AppArmor on openSUSE Tumbleweed (post 15.0) or higher
+# N.B.: Prior to openSUSE Tumbleweed in May 2018, the AppArmor userspace in SUSE
+# did not support what we needed to be able to turn on basic integration.
+%if 0%{?suse_version} >= 1550
+%bcond_without apparmor
+%else
+%bcond_with apparmor
+%endif
+
+# The list of systemd services we are expected to ship. Note that this does
+# not include services that are only required on core systems.
+%global systemd_services_list snapd.socket snapd.service snapd.seeded.service snapd.failure.service %{?with_apparmor:snapd.apparmor.service}
+%global systemd_user_services_list snapd.session-agent.socket
+
+# Alternate snap mount directory: not used by openSUSE.
+# If this spec file is integrated into Fedora then consider
+# adding global with_alt_snap_mount_dir 1 then.
+%global snap_mount_dir /snap
+
+# Compat macros
+%{!?make_build: %global make_build %{__make} %{?_smp_mflags}}
+%{?!_environmentdir: %global _environmentdir %{_prefix}/lib/environment.d}
+%{?!_userunitdir: %global _userunitdir %{_prefix}/lib/systemd/user}
+
+# Define the variable for systemd generators, if missing.
+%{?!_systemdgeneratordir: %global _systemdgeneratordir %{_prefix}/lib/systemd/system-generators}
+%{?!_systemdusergeneratordir: %global _systemdusergeneratordir %{_prefix}/lib/systemd/user-generators}
+%{?!_systemd_system_env_generator_dir: %global _systemd_system_env_generator_dir %{_prefix}/lib/systemd/system-environment-generators}
+%{?!_systemd_user_env_generator_dir: %global _systemd_user_env_generator_dir %{_prefix}/lib/systemd/user-environment-generators}
+
+# This is fixed in SUSE Linux 15
+# Cf. https://build.opensuse.org/package/rdiff/Base:System/rpm?linkrev=base&rev=396
+%if 0%{?suse_version} < 1500
+%global _sharedstatedir %{_localstatedir}/lib
+%endif
+
+%global provider        github
+%global provider_tld    com
+%global project         snapcore
+%global repo            snapd
+%global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo}
+%global import_path     %{provider_prefix}
+
+# Additional entry of $GOPATH during the build process.
+# This is designed to be a sub-directory of {_builddir}/{name}-{version}
+# because that directory is automatically cleaned-up by the build process.
+%global indigo_gopath   %{_builddir}/%{name}-%{version}/gopath
+
+# Directory where "name-version" directory from upstream taball is unpacked to.
+# This directory is arranged so that it is already contained inside the future
+# GOPATH so that nothing needs to be moved or copied for "go build" to work.
+%global indigo_srcdir   %{indigo_gopath}/src/%{import_path}
+
+# path to snap-confine encoded as AppArmor profile
+%define apparmor_snapconfine_profile %as_apparmor_path %{_libexecdir}/snapd/snap-confine
+
+# Set if multilib is enabled for supported arches
+%ifarch x86_64 aarch64 %{power64} s390x
+%global with_multilib 1
+%endif
+
+
+Name:           snapd
+Version:        2.48.3
+Release:        0
+Summary:        Tools enabling systems to work with .snap files
+License:        GPL-3.0
+Group:          System/Packages
+Url:            https://%{import_path}
+Source0:        https://github.com/snapcore/snapd/releases/download/%{version}/%{name}_%{version}.vendor.tar.xz
+Source1:        snapd-rpmlintrc
+%if (0%{?sle_version} >= 120200 || 0%{?suse_version} >= 1500) && 0%{?is_opensuse}
+BuildRequires:  ShellCheck
+%endif
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  glib2-devel
+BuildRequires:  glibc-devel-static
+BuildRequires:  go >= 1.9
+BuildRequires:  gpg2
+BuildRequires:  indent
+BuildRequires:  libcap-devel
+BuildRequires:  libseccomp-devel
+BuildRequires:  libtool
+BuildRequires:  libudev-devel
+BuildRequires:  libuuid-devel
+BuildRequires:  make
+BuildRequires:  openssh
+BuildRequires:  pkg-config
+BuildRequires:  python3-docutils
+BuildRequires:  squashfs
+# Due to: rpm -q --whatprovides /usr/share/pkgconfig/systemd.pc
+BuildRequires:  systemd
+BuildRequires:  systemd-rpm-macros
+BuildRequires:  timezone
+BuildRequires:  udev
+BuildRequires:  xfsprogs-devel
+BuildRequires:  xz
+%ifarch x86_64
+# This is needed for seccomp tests
+BuildRequires:  glibc-devel-32bit
+BuildRequires:  glibc-devel-static-32bit
+BuildRequires:  gcc-32bit
+%endif
+
+%if %{with apparmor}
+BuildRequires:  libapparmor-devel
+BuildRequires:  apparmor-rpm-macros
+%endif
+
+PreReq:         permissions
+
+Requires(post): permissions
+%if %{with apparmor}
+Requires:       apparmor-parser
+Requires:       apparmor-profiles
+%endif
+Requires:       gpg2
+Requires:       openssh
+Requires:       squashfs
+Requires:       system-user-daemon
+
+# Old versions of xdg-document-portal can expose data belonging to
+# other confied apps.  Older OpenSUSE releases are unlikely to change,
+# so for now limit this to Tumbleweed.
+%if 0%{?suse_version} >= 1550
+Conflicts:      xdg-desktop-portal < 0.11
+%endif
+
+%{?systemd_requires}
+
+%description
+This package contains that snapd daemon and the snap command line tool.
+Together they can be used to install, refresh (update), remove and configure
+snap packages on a system. Snap packages are a novel format based on simple
+principles. Bundle your dependencies, run in a predictable environment, use
+modern kernel features for setting up the execution environment and security.
+The same binary snap package can be installed and used on many diverse systems
+such as Debian, Fedora and OpenSUSE as well as their multiple derivatives.
+
+This package contains the official build, endorsed by snapd developers. It is
+updated as soon as new upstream releases are made and is designed to live in
+the system:snappy repository.
+
+%prep
+# NOTE: Instead of using setup -q we are unpacking a subdirectory of the source
+# tarball into a directory that is automatically on the future GOPATH. This
+# means that while go doesn't care at all the current working directory is not
+# the top-level directory of the source tarball which some people may find
+# unusual.
+
+# Create indigo compatible build layout.
+mkdir -p %{indigo_srcdir}
+tar -axf %{_sourcedir}/%{name}_%{version}.vendor.tar.xz --strip-components=1 -C %{indigo_srcdir}
+
+# Patch the source in the place it got extracted to.
+pushd %{indigo_srcdir}
+# Add patch0 -p1 ... as appropriate here.
+popd
+
+# Generate snapd.defines.mk, this file is included by snapd.mk. It contains a
+# number of variable definitions that are set based on their RPM equivalents.
+# Since we can apply any conditional overrides here in the spec file we can
+# maintain one consistent set of variables across the spec and makefile worlds.
+cat >snapd.defines.mk <<__DEFINES__
+# This file is generated by openSUSE's snapd.spec
+# Directory variables.
+prefix = %{_prefix}
+bindir = %{_bindir}
+sbindir = %{_sbindir}
+libexecdir = %{_libexecdir}
+mandir = %{_mandir}
+datadir = %{_datadir}
+localstatedir = %{_localstatedir}
+sharedstatedir = %{_sharedstatedir}
+unitdir = %{_unitdir}
+# Build configuration
+with_core_bits = 0
+with_alt_snap_mount_dir = %{!?with_alt_snap_mount_dir:0}%{?with_alt_snap_mount_dir:1}
+with_apparmor = %{with apparmor}
+with_testkeys = %{with_testkeys}
+__DEFINES__
+
+# Set the version that is compiled into the various executables/
+pushd %{indigo_srcdir}
+./mkversion.sh %{version}-%{release}
+popd
+
+# Sanity check, ensure that systemd system generator directory is in agreement between the build system and packaging.
+if [ "$(pkg-config --variable=systemdsystemgeneratordir systemd)" != "%{_systemdgeneratordir}" ]; then
+  echo "pkg-confing and rpm macros disagree about the location of systemd system generator directory"
+  exit 1
+fi
+
+# Enable hardening; Also see https://bugzilla.redhat.com/show_bug.cgi?id=1343892
+CFLAGS="$RPM_OPT_FLAGS -fPIC -Wl,-z,relro -Wl,-z,now"
+CXXFLAGS="$RPM_OPT_FLAGS -fPIC -Wl,-z,relro -Wl,-z,now"
+LDFLAGS=""
+
+# On openSUSE Leap 15 or more recent build position independent executables.
+# For a helpful guide about the versions and macros used below, please see:
+# https://en.opensuse.org/openSUSE:Build_Service_cross_distribution_howto
+%if 0%{?suse_version} >= 1500
+CFLAGS="$CFLAGS -fPIE"
+CXXFLAGS="$CXXFLAGS -fPIE"
+LDFLAGS="$LDFLAGS -pie"
+%endif
+
+export CFLAGS
+export CXXFLAGS
+export LDFLAGS
+
+# Generate autotools build system files.
+pushd %{indigo_srcdir}/cmd
+autoreconf -i -f
+
+%configure \
+    %{!?with_apparmor:--disable-apparmor} \
+    %{?with_apparmor:--enable-apparmor} \
+    --libexecdir=%{_libexecdir}/snapd \
+    --enable-nvidia-biarch \
+    %{?with_multilib:--with-32bit-libdir=%{_prefix}/lib} \
+    --with-snap-mount-dir=%{snap_mount_dir} \
+    --enable-merged-usr
+
+popd
+
+%build
+%make_build -C %{indigo_srcdir}/cmd
+# Use the common packaging helper for building.
+#
+# NOTE: indigo_gopath takes priority over GOPATH. This ensures that we
+# build the code that we intended in case GOPATH points to another copy.
+%make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH all
+
+%check
+for binary in snap-exec snap-update-ns snapctl; do
+    ldd $binary 2>&1 | grep 'not a dynamic executable'
+done
+
+%make_build -C %{indigo_srcdir}/cmd check
+# Use the common packaging helper for testing.
+%make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH check
+
+%install
+# Install all systemd and dbus units, and env files.
+%make_install -C %{indigo_srcdir}/data \
+		BINDIR=%{_bindir} \
+		LIBEXECDIR=%{_libexecdir} \
+		SYSTEMDSYSTEMUNITDIR=%{_unitdir} \
+		SNAP_MOUNT_DIR=%{snap_mount_dir}
+# Install all the C executables.
+%make_install -C %{indigo_srcdir}/cmd
+# Use the common packaging helper for bulk of installation.
+%make_install -f %{indigo_srcdir}/packaging/snapd.mk install
+
+# Undo special permissions of the void directory. We handle that in RPM files
+# section below.
+chmod 755 %{buildroot}%{_localstatedir}/lib/snapd/void
+
+# Install local permissions policy for snap-confine. This should be removed
+# once snap-confine is added to the permissions package. This is done following
+# the recommendations on
+# https://en.opensuse.org/openSUSE:Package_security_guidelines
+install -m 644 -D %{indigo_srcdir}/packaging/opensuse/permissions %{buildroot}%{_sysconfdir}/permissions.d/snapd
+install -m 644 -D %{indigo_srcdir}/packaging/opensuse/permissions.paranoid %{buildroot}%{_sysconfdir}/permissions.d/snapd.paranoid
+
+# See https://en.opensuse.org/openSUSE:Packaging_checks#suse-missing-rclink for details
+install -d %{buildroot}%{_sbindir}
+ln -sf %{_sbindir}/service %{buildroot}%{_sbindir}/rcsnapd
+ln -sf %{_sbindir}/service %{buildroot}%{_sbindir}/rcsnapd.seeded
+%if %{with apparmor}
+ln -sf %{_sbindir}/service %{buildroot}%{_sbindir}/rcsnapd.apparmor
+%endif
+
+# Install Polkit configuration.
+# TODO: This should be handled by data makefile.
+install -m 644 -D %{indigo_srcdir}/data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions
+
+# Install the "info" data file with snapd version
+# TODO: This should be handled by data makefile.
+install -m 644 -D %{indigo_srcdir}/data/info %{buildroot}%{_libexecdir}/snapd/info
+
+# Install bash completion for "snap"
+# TODO: This should be handled by data makefile.
+install -m 644 -D %{indigo_srcdir}/data/completion/bash/snap %{buildroot}%{_datadir}/bash-completion/completions/snap
+install -m 644 -D %{indigo_srcdir}/data/completion/bash/complete.sh %{buildroot}%{_libexecdir}/snapd
+install -m 644 -D %{indigo_srcdir}/data/completion/bash/etelpmoc.sh %{buildroot}%{_libexecdir}/snapd
+# Install zsh completion for "snap"
+install -d -p %{buildroot}%{_datadir}/zsh/site-functions
+install -m 644 -D %{indigo_srcdir}/data/completion/zsh/_snap %{buildroot}%{_datadir}/zsh/site-functions/_snap
+
+%verifyscript
+%verify_permissions -e %{_libexecdir}/snapd/snap-confine
+
+%pre
+%service_add_pre %{systemd_services_list}
+
+%post
+%set_permissions %{_libexecdir}/snapd/snap-confine
+%if %{with apparmor}
+%apparmor_reload /etc/apparmor.d/%{apparmor_snapconfine_profile}
+%endif
+%service_add_post %{systemd_services_list}
+%systemd_user_post %{systemd_user_services_list}
+case ":$PATH:" in
+    *:/snap/bin:*)
+        ;;
+    *)
+        echo "Please reboot, logout/login or source /etc/profile to have /snap/bin added to PATH."
+        echo "On a Tumbleweed system you need to run: systemctl enable snapd.apparmor.service"
+        ;;
+esac
+
+%preun
+%service_del_preun %{systemd_services_list}
+%systemd_user_preun %{systemd_user_services_list}
+if [ $1 -eq 0 ]; then
+    %{_libexecdir}/snapd/snap-mgmt --purge || :
+fi
+
+%postun
+%service_del_postun %{systemd_services_list}
+%systemd_user_postun %{systemd_user_services_list}
+
+%files
+
+# Configuration files
+%config %{_sysconfdir}/permissions.d/snapd
+%config %{_sysconfdir}/permissions.d/snapd.paranoid
+%config %{_sysconfdir}/profile.d/snapd.sh
+
+# Directories
+%dir %attr(0111,root,root) %{_sharedstatedir}/snapd/void
+%dir %{_datadir}/dbus-1
+%dir %{_datadir}/dbus-1/services
+%dir %{_datadir}/dbus-1/session.d
+%dir %{_datadir}/dbus-1/system.d
+%dir %{_datadir}/polkit-1
+%dir %{_datadir}/polkit-1/actions
+%dir %{_environmentdir}
+%dir %{_libexecdir}/snapd
+%dir %{_localstatedir}/cache/snapd
+%dir %{_sharedstatedir}/snapd
+%dir %{_sharedstatedir}/snapd/apparmor
+%dir %{_sharedstatedir}/snapd/apparmor/profiles
+%dir %{_sharedstatedir}/snapd/apparmor/snap-confine
+%dir %{_sharedstatedir}/snapd/assertions
+%dir %{_sharedstatedir}/snapd/cache
+%dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
+%dir %{_sharedstatedir}/snapd/desktop
+%dir %{_sharedstatedir}/snapd/desktop/applications
+%dir %{_sharedstatedir}/snapd/device
+%dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
+%dir %{_sharedstatedir}/snapd/lib
+%dir %{_sharedstatedir}/snapd/lib/gl
+%dir %{_sharedstatedir}/snapd/lib/gl32
+%dir %{_sharedstatedir}/snapd/lib/glvnd
+%dir %{_sharedstatedir}/snapd/lib/vulkan
+%dir %{_sharedstatedir}/snapd/mount
+%dir %{_sharedstatedir}/snapd/seccomp
+%dir %{_sharedstatedir}/snapd/seccomp/bpf
+%dir %{_sharedstatedir}/snapd/sequence
+%dir %{_sharedstatedir}/snapd/snaps
+%dir %{_systemd_system_env_generator_dir}
+%dir %{_systemdgeneratordir}
+%dir %{_userunitdir}
+%dir %{snap_mount_dir}
+%dir %{snap_mount_dir}/bin
+# this is typically owned by zsh, but we do not want to explicitly require zsh
+%dir %{_datadir}/zsh
+%dir %{_datadir}/zsh/site-functions
+
+# Ghost entries for things created at runtime
+%ghost %dir %{_localstatedir}/snap
+%ghost %{_localstatedir}/cache/snapd/commands
+%ghost %{_localstatedir}/cache/snapd/names
+%ghost %{_localstatedir}/cache/snapd/sections
+%ghost %{_sharedstatedir}/snapd/seccomp/bpf/global.bin
+%ghost %{_sharedstatedir}/snapd/state.json
+%ghost %{_sharedstatedir}/snapd/system-key
+%ghost %{snap_mount_dir}/README
+%verify(not user group mode) %attr(04755,root,root) %{_libexecdir}/snapd/snap-confine
+%{_bindir}/snap
+%{_bindir}/snapctl
+%{_datadir}/applications/snap-handle-link.desktop
+%{_datadir}/bash-completion/completions/snap
+%{_datadir}/zsh/site-functions/_snap
+%{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
+%{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
+%{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
+%{_environmentdir}/990-snapd.conf
+%{_libexecdir}/snapd/complete.sh
+%{_libexecdir}/snapd/etelpmoc.sh
+%{_libexecdir}/snapd/info
+%{_libexecdir}/snapd/snap-device-helper
+%{_libexecdir}/snapd/snap-discard-ns
+%{_libexecdir}/snapd/snap-exec
+%{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
+%{_libexecdir}/snapd/snap-mgmt
+%{_libexecdir}/snapd/snap-seccomp
+%{_libexecdir}/snapd/snap-update-ns
+%{_libexecdir}/snapd/snapctl
+%{_libexecdir}/snapd/snapd
+%{_libexecdir}/snapd/snapd.run-from-snap
+%{_mandir}/man8/snap-confine.8*
+%{_mandir}/man8/snap-discard-ns.8*
+%{_mandir}/man8/snap.8*
+%{_mandir}/man8/snapd-env-generator.8*
+%{_sbindir}/rcsnapd
+%{_sbindir}/rcsnapd.seeded
+%{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop
+%{_systemd_system_env_generator_dir}/snapd-env-generator
+%{_systemdgeneratordir}/snapd-generator
+%{_unitdir}/snapd.failure.service
+%{_unitdir}/snapd.seeded.service
+%{_unitdir}/snapd.service
+%{_unitdir}/snapd.socket
+%{_userunitdir}/snapd.session-agent.service
+%{_userunitdir}/snapd.session-agent.socket
+
+# When apparmor is enabled there are some additional entries.
+%if %{with apparmor}
+%config %{_sysconfdir}/apparmor.d
+%{_libexecdir}/snapd/snapd-apparmor
+%{_sbindir}/rcsnapd.apparmor
+%{_sysconfdir}/apparmor.d/%{apparmor_snapconfine_profile}
+%{_unitdir}/snapd.apparmor.service
+%endif
+
+%changelog
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-tumbleweed/snapd.changes snapd-2.48.3+20.04/packaging/opensuse-tumbleweed/snapd.changes
--- snapd-2.45.1+20.04.2/packaging/opensuse-tumbleweed/snapd.changes	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-tumbleweed/snapd.changes	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,59 @@
 -------------------------------------------------------------------
+Tue, 02 Feb 2021 09:24:52 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.3
+
+-------------------------------------------------------------------
+Tue, 15 Dec 2020 20:38:36 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.2
+
+-------------------------------------------------------------------
+Thu, 03 Dec 2020 17:46:49 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48.1
+
+-------------------------------------------------------------------
+Thu, 19 Nov 2020 17:55:24 +0100 - mvo@ubuntu.com
+
+- Update to upstream release 2.48
+
+-------------------------------------------------------------------
+Thu Oct 08 2020 09:30:44 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47.1
+
+-------------------------------------------------------------------
+Tue Sep 29 2020 15:19:13 +0200 - mvo@ubuntu.com
+
+- Update to upstream release 2.47
+
+-------------------------------------------------------------------
+Fri Sep 04 2020 15:42:54 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46.1
+
+-------------------------------------------------------------------
+Tue Aug 25 2020 15:26:21 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.46
+
+-------------------------------------------------------------------
+Tue Jul 28 2020 21:43:38 +0200 - pedronis@lucediurna.net
+
+- Update to upstream release 2.45.3.1
+
+-------------------------------------------------------------------
+Mon Jul 27 2020 12:01:14 +0200 - me@zygoon.pl
+
+- Update to upstream release 2.45.3
+
+-------------------------------------------------------------------
+Fri Jul 10 18:05:48 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.45.2
+
+-------------------------------------------------------------------
 Fri Jun 05 13:13:49 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.45.1
@@ -9,6 +64,16 @@
 - Update to upstream release 2.45
 
 -------------------------------------------------------------------
+Thu Apr 30 07:09:22 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.5
+
+-------------------------------------------------------------------
+Wed Apr 29 06:43:56 UTC 2020 - mvo@ubuntu.com
+
+- Update to upstream release 2.44.4
+
+-------------------------------------------------------------------
 Thu Apr 10 14:57:25 UTC 2020 - mvo@ubuntu.com
 
 - Update to upstream release 2.44.3
diff -Nru snapd-2.45.1+20.04.2/packaging/opensuse-tumbleweed/snapd.spec snapd-2.48.3+20.04/packaging/opensuse-tumbleweed/snapd.spec
--- snapd-2.45.1+20.04.2/packaging/opensuse-tumbleweed/snapd.spec	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/opensuse-tumbleweed/snapd.spec	2021-02-02 08:21:12.000000000 +0000
@@ -14,6 +14,9 @@
 
 # Please submit bugfixes or comments via http://bugs.opensuse.org/
 
+# takes an absolute path with slashes and turns it into an AppArmor profile path
+%define as_apparmor_path() %(echo "%1" | tr / . | cut -c2-)
+
 # Test keys: used for internal testing in snapd.
 %bcond_with testkeys
 
@@ -70,6 +73,9 @@
 # GOPATH so that nothing needs to be moved or copied for "go build" to work.
 %global indigo_srcdir   %{indigo_gopath}/src/%{import_path}
 
+# path to snap-confine encoded as AppArmor profile
+%define apparmor_snapconfine_profile %as_apparmor_path %{_libexecdir}/snapd/snap-confine
+
 # Set if multilib is enabled for supported arches
 %ifarch x86_64 aarch64 %{power64} s390x
 %global with_multilib 1
@@ -77,7 +83,7 @@
 
 
 Name:           snapd
-Version:        2.45.1
+Version:        2.48.3
 Release:        0
 Summary:        Tools enabling systems to work with .snap files
 License:        GPL-3.0
@@ -134,6 +140,7 @@
 Requires:       gpg2
 Requires:       openssh
 Requires:       squashfs
+Requires:       system-user-daemon
 
 # Old versions of xdg-document-portal can expose data belonging to
 # other confied apps.  Older OpenSUSE releases are unlikely to change,
@@ -249,6 +256,10 @@
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH all
 
 %check
+for binary in snap-exec snap-update-ns snapctl; do
+    ldd $binary 2>&1 | grep 'not a dynamic executable'
+done
+
 %make_build -C %{indigo_srcdir}/cmd check
 # Use the common packaging helper for testing.
 %make_build -f %{indigo_srcdir}/packaging/snapd.mk GOPATH=%{indigo_gopath}:$GOPATH check
@@ -310,7 +321,7 @@
 %post
 %set_permissions %{_libexecdir}/snapd/snap-confine
 %if %{with apparmor}
-%apparmor_reload /etc/apparmor.d/usr.lib.snapd.snap-confine
+%apparmor_reload /etc/apparmor.d/%{apparmor_snapconfine_profile}
 %endif
 %service_add_post %{systemd_services_list}
 %systemd_user_post %{systemd_user_services_list}
@@ -340,12 +351,13 @@
 %config %{_sysconfdir}/permissions.d/snapd
 %config %{_sysconfdir}/permissions.d/snapd.paranoid
 %config %{_sysconfdir}/profile.d/snapd.sh
-%config %{_sysconfdir}/sudoers.d/99-snapd.conf
 
 # Directories
 %dir %attr(0111,root,root) %{_sharedstatedir}/snapd/void
 %dir %{_datadir}/dbus-1
 %dir %{_datadir}/dbus-1/services
+%dir %{_datadir}/dbus-1/session.d
+%dir %{_datadir}/dbus-1/system.d
 %dir %{_datadir}/polkit-1
 %dir %{_datadir}/polkit-1/actions
 %dir %{_environmentdir}
@@ -358,10 +370,14 @@
 %dir %{_sharedstatedir}/snapd/assertions
 %dir %{_sharedstatedir}/snapd/cache
 %dir %{_sharedstatedir}/snapd/cookie
+%dir %{_sharedstatedir}/snapd/dbus-1
+%dir %{_sharedstatedir}/snapd/dbus-1/services
+%dir %{_sharedstatedir}/snapd/dbus-1/system-services
 %dir %{_sharedstatedir}/snapd/desktop
 %dir %{_sharedstatedir}/snapd/desktop/applications
 %dir %{_sharedstatedir}/snapd/device
 %dir %{_sharedstatedir}/snapd/hostfs
+%dir %{_sharedstatedir}/snapd/inhibit
 %dir %{_sharedstatedir}/snapd/lib
 %dir %{_sharedstatedir}/snapd/lib/gl
 %dir %{_sharedstatedir}/snapd/lib/gl32
@@ -398,6 +414,8 @@
 %{_datadir}/zsh/site-functions/_snap
 %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service
 %{_datadir}/dbus-1/services/io.snapcraft.Settings.service
+%{_datadir}/dbus-1/session.d/snapd.session-services.conf
+%{_datadir}/dbus-1/system.d/snapd.system-services.conf
 %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy
 %{_environmentdir}/990-snapd.conf
 %{_libexecdir}/snapd/complete.sh
@@ -407,6 +425,7 @@
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-exec
 %{_libexecdir}/snapd/snap-gdb-shim
+%{_libexecdir}/snapd/snap-gdbserver-shim
 %{_libexecdir}/snapd/snap-mgmt
 %{_libexecdir}/snapd/snap-seccomp
 %{_libexecdir}/snapd/snap-update-ns
@@ -434,7 +453,7 @@
 %config %{_sysconfdir}/apparmor.d
 %{_libexecdir}/snapd/snapd-apparmor
 %{_sbindir}/rcsnapd.apparmor
-%{_sysconfdir}/apparmor.d/usr.lib.snapd.snap-confine
+%{_sysconfdir}/apparmor.d/%{apparmor_snapconfine_profile}
 %{_unitdir}/snapd.apparmor.service
 %endif
 
diff -Nru snapd-2.45.1+20.04.2/packaging/snapd.mk snapd-2.48.3+20.04/packaging/snapd.mk
--- snapd-2.45.1+20.04.2/packaging/snapd.mk	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/snapd.mk	2021-02-02 08:21:12.000000000 +0000
@@ -57,14 +57,17 @@
 .PHONY: all
 all: $(go_binaries) 
 
+snap: GO_TAGS += nomanagers
 snap snap-seccomp:
-	go build -buildmode=pie $(import_path)/cmd/$@
+	go build $(if $(GO_TAGS),-tags $(GO_TAGS)) -buildmode=pie $(import_path)/cmd/$@
 
 # Those three need to be built as static binaries. They run on the inside of a
 # nearly-arbitrary mount namespace that does not contain anything we can depend
 # on (no standard library, for example).
 snap-update-ns snap-exec snapctl:
-	go build -buildmode=default -ldflags '-extldflags "-static"' $(import_path)/cmd/$@
+	# Explicit request to use an external linker, otherwise extldflags may not be
+	# used
+	go build -buildmode=default -ldflags '-linkmode external -extldflags "-static"' $(import_path)/cmd/$@
 
 # Snapd can be built with test keys. This is only used by the internal test
 # suite to add test assertions. Do not enable this in distribution packages.
@@ -104,9 +107,12 @@
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/assertions
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/cache
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/cookie
+	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/dbus-1/services
+	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/dbus-1/system-services
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/desktop/applications
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/device
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/hostfs
+	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/inhibit
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/lib/gl
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/lib/gl32
 	install -m 755 -d $(DESTDIR)/$(sharedstatedir)/snapd/lib/glvnd
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/changelog snapd-2.48.3+20.04/packaging/ubuntu-14.04/changelog
--- snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/changelog	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-14.04/changelog	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,1305 @@
+snapd (2.48.3~14.04) trusty; urgency=medium
+
+  * SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  * interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 02 Feb 2021 09:21:12 +0100
+
+snapd (2.48.2~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - tests: sign new nested-18|20* models to allow for generic serials
+    - secboot: add extra paranoia when waiting for that fde-reveal-key
+    - tests: backport netplan workarounds from #9785
+    - secboot: add workaround for snapcore/core-initrd issue #13
+    - devicestate: log checkEncryption errors via logger.Noticef
+    - tests: add nested spread end-to-end test for fde-hooks
+    - devicestate: implement checkFDEFeatures()
+    - boot: tweak resealing with fde-setup hooks
+    - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+      init restrict file
+    - secboot: add new LockSealedKeys() that uses either TPM or
+      fde-reveal-key
+    - gadget: use "sealed-keys" to determine what method to use for
+      reseal
+    - boot: add sealKeyToModeenvUsingFdeSetupHook()
+    - secboot: use `fde-reveal-key` if available to unseal key
+    - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+      other entries
+    - o/devicestate: save model with serial in the device save db
+    - devicestate: add runFDESetupHook() helper
+    - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+    - hookstate: add new HookManager.EphemeralRunHook()
+    - update-pot: fix typo in plural keyword spec
+    - store,cmd/snap-repair: increase initial expontential time
+      intervals
+    - o/devicestate,daemon: fix reboot system action to not require a
+      system label
+    - github: run nested suite when commit is pushed to release branch
+    - tests: reset fakestore unit status
+    - tests: fix uc20-create-parition-* tests for updated gadget
+    - hookstate: implement snapctl fde-setup-{request,result}
+    - devicestate: make checkEncryption fde-setup hook aware
+    - client,snapctl: add naive support for "stdin"
+    - devicestate: support "storage-safety" defaults during install
+    - snap: use the boot-base for kernel hooks
+    - vendor: update secboot repo to avoid including secboot.test binary
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 15 Dec 2020 20:21:44 +0100
+
+snapd (2.48.1~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - gadget: disable ubuntu-boot role validation check
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Dec 2020 17:43:30 +0100
+
+snapd (2.48~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1904098
+    - osutil: add KernelCommandLineKeyValue
+    - devicestate: implement boot.HasFDESetupHook
+    - boot/makebootable.go: set snapd_recovery_mode=install at image-
+      build time
+    - bootloader: use ForGadget when installing boot config
+    - interfaces/raw_usb: allow read access to /proc/tty/drivers
+    - boot: add scaffolding for "fde-setup" hook support for sealing
+    - tests: fix basic20 test on arm devices
+    - seed: make a shared seed system label validation helper
+    - snap: add new "fde-setup" hooktype
+    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+      device handling
+    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+      messiness
+    - tests/nested/manual/refresh-revert-fundamentals: temporarily
+      disable secure boot
+    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+      boot modes
+    - many: address degraded recover mode feedback, cleanups
+    - tests: Use systemd-run on tests part2
+    - tests: set the opensuse tumbleweed system as manual in spread.yaml
+    - secboot: call BlockPCRProtectionPolicies even if the TPM is
+      disabled
+    - vendor: update to current secboot
+    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+      save
+    - spread.yaml: increase number of workers on 20.10
+    - snap: add new `snap recovery --show-keys` option
+    - tests: minor test tweaks suggested in the review of 9607
+    - snapd-generator: set standard snapfuse options when generating
+      units for containers
+    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+    - interfaces: share /tmp/.X11-unix/ from host or provider
+    - tests: enable main lxd test on 20.10
+    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+      degraded mode
+    - gadget/install: add progress logging
+    - packaging: keep secboot/encrypt_dummy.go in debian
+    - interfaces/udev: use distro specific path to snap-device-helper
+    - o/devistate: fix chaining of tasks related to regular snaps when
+      preseeding
+    - gadget, overlord/devicestate: validate that system supports
+      encrypted data before install
+    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+      ESP layout
+    - many: add /v2/system-recovery-keys API and client
+    - secboot, many: return UnlockMethod from Unlock* methods for future
+      usage
+    - many: mv keys to ubuntu-boot, move model file, rename keyring
+      prefix for secboot
+    - tests: using systemd-run instead of manually create a systemd unit
+      - part 1
+    - secboot, cmd/snap-bootstrap: enable or disable activation with
+      recovery key
+    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+      disks first
+    - secboot: add LockTPMSealedKeys() to lock access to keys
+      independently
+    - gadget: correct sfdisk arguments
+    - bootloader/assets/grub: adjust fwsetup menuentry label
+    - tests: new boot state tool
+    - spread: use the official image for Ubuntu 20.10, no longer an
+      unstable system
+    - tests/lib/nested: enable snapd logging to console for core18
+    - osutil/disks: re-implement partition searching for disk w/ non-
+      adjacent parts
+    - tests: using the nested-state tool in nested tests
+    - many: seal a fallback object to the recovery boot chain
+    - gadget, gadget/install: move helpers to install package, refactor
+      unit tests
+    - dirs: add "gentoo" to altDirDistros
+    - update-pot: include file locations in translation template, and
+      extract strings from desktop files
+    - gadget/many: drop usage of gpt attr 59 for indicating creation of
+      partitions
+    - gadget/quantity: tweak test name
+    - snap: fix failing unittest for quantity.FormatDuration()
+    - gadget/quantity: introduce a new package that captures quantities
+    - o/devicestate,a/sysdb: make a backup of the device serial to save
+    - tests: fix rare interaction of tests.session and specific tests
+    - features: enable classic-preserves-xdg-runtime-dir
+    - tests/nested/core20/save: check the bind mount and size bump
+    - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+    - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+      tests
+    - o/devicestate: unit test tweaks
+    - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+    - testutil, cmd/snap/version: fix misc little errors
+    - overlord/devicestate: bind mount ubuntu-save under
+      /var/lib/snapd/save on startup
+    - gadget/internal: tune ext4 setting for smaller filesystems
+    - tests/nested/core20/save: a test that verifies ubuntu-save is
+      present and set up
+    - tests: update google sru backend to support groovy
+    - o/ifacestate: handle interface hooks when preseeding
+    - tests: re-enable the apt hooks test
+    - interfaces,snap: use correct type: {os,snapd} for test data
+    - secboot: set metadata and keyslots sizes when formatting LUKS2
+      volumes
+    - tests: improve uc20-create-partitions-reinstall test
+    - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+    - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+    - secboot: fix doc comment on helper for unlocking volume with key
+    - tests: add spread test for refreshing from an old snapd and core18
+    - o/snapstate: generate snapd snap wrappers again after restart on
+      refresh
+    - secboot: version bump, unlock volume with key
+    - tests/snap-advise-command: re-enable test
+    - cmd/snap, snapmgr, tests: cleanups after #9418
+    - interfaces: deny connected x11 plugs access to ICE
+    - daemon,client: write and read a maintenance.json file for when
+      snapd is shut down
+    - many: update to secboot v1 (part 1)
+    - osutil/disks/mockdisk: panic if same mountpoint shows up again
+      with diff opts
+    - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+      reseal tests
+    - many: implement snap routine console-conf-start for synchronizing
+      auto-refreshes
+    - dirs, boot: add ubuntu-save directories and related locations
+    - usersession: fix typo in test name
+    - overlord/snapstate: refactor ihibitRefresh
+    - overlord/snapstate: stop warning about inhibited refreshes
+    - cmd/snap: do not hardcode snapshot age value
+    - overlord,usersession: initial notifications of pending refreshes
+    - tests: add a unit test for UpdateMany where a single snap fails
+    - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+      mode uc20
+    - tests: also check snapst.Current in undo-unlink tests
+    - tests: new nested tool
+    - o/snapstate: implement undo handler for unlink-snap
+    - tests: clean systems.sh helper and migrate last set of tests
+    - tests: moving the lib section from systems.sh helper to os.query
+      tool
+    - tests/uc20-create-partitions: don't check for grub.cfg
+    - packaging: make sure that static binaries are indeed static, fix
+      openSUSE
+    - many: have install return encryption keys for data and save,
+      improve tests
+    - overlord: add link participant for linkage transitions
+    - tests: lxd smoke test
+    - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+      seed too
+    - tests: moving main suite from systems.sh to os.query tool
+    - tests: moving the core test suite from systems.sh to os.query tool
+    - cmd/snap-confine: mask host's apparmor config
+    - o/snapstate: move setting updated SnapState after error paths
+    - tests: add value to INSTANCE_KEY/regular
+    - spread, tests: tweaks for openSUSE
+    - cmd/snap-confine: update path to snap-device-helper in AppArmor
+      profile
+    - tests: new os.query tool
+    - overlord/snapshotstate/backend: specify tar format for snapshots
+    - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+      UC20
+    - client,daemon,snap: auto-import does not error on managed devices
+    - interfaces: PTP hardware clock interface
+    - tests: use tests.backup tool
+    - many: verify that unit tests work with nosecboot tag and without
+      secboot package
+    - wrappers: do not error out on read-only /etc/dbus-1/session.d
+      filesystem on core18
+    - snapshots: import of a snapshot set
+    - tests: more output for sbuild test
+    - o/snapstate: re-order remove tasks for individual snap revisions
+      to remove current last
+    - boot: skip some unit tests when running as root
+    - o/assertstate: introduce
+      ValidationTrackingKey/ValidationSetTracking and basic methods
+    - many: allow ignoring running apps for specific request
+    - tests: allow the searching test to fail under load
+    - overlord/snapstate: inhibit startup while unlinked
+    - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+      features
+    - tests/main/sudo-env: snap bin is available on Fedora
+    - boot, overlord/devicestate: list trusted and managed assets
+      upfront
+    - gadget, gadget/install: support for ubuntu-save, create one during
+      install if needed
+    - spread-shellcheck: temporary workaround for deadlock, drop
+      unnecessary test
+    - snap: support different exit-code in the snap command
+    - logger: use strutil.KernelCommandLineSplit in
+      debugEnabledOnKernelCmdline
+    - logger: fix snapd.debug=1 parsing
+    - overlord: increase refresh postpone limit to 14 days
+    - spread-shellcheck: use single thread pool executor
+    - gadget/install,secboot: add debug messages
+    - spread-shellcheck: speed up spread-shellcheck even more
+    - spread-shellcheck: process paths from arguments in parallel
+    - tests: tweak error from tests.cleanup
+    - spread: remove workaround for openSUSE go issue
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - tests: new tests.backup tool
+    - tests: add tests.cleanup pop sub-command
+    - tests: migration of the main suite to snaps-state tool part 6
+    - tests: fix journal-state test
+    - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+      recover files
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - boot, gadget, bootloader: observer preserves managed bootloader
+      configs
+    - tests/nested/manual: add uc20 grade signed cloud-init test
+    - o/snapstate/autorefresh.go: eliminate race when launching
+      autorefresh
+    - daemon,snapshotstate: do not return "size" from Import()
+    - daemon: limit reading from snapshot import to Content-Length
+    - many: set/expect Content-Length header when importing snapshots
+    - github: switch from ::set-env command to environment file
+    - tests: migration of the main suite to snaps-state tool part 5
+    - client: cleanup the Client.raw* and Client.do* method families
+    - tests: moving main suite to snaps-state tool part 4
+    - client,daemon,snap: use constant for snapshot content-type
+    - many: fix typos and repeated "the"
+    - secboot: fix tpm connection leak when it's not enabled
+    - many: scaffolding for snapshots import API
+    - run-checks: run spread-shellcheck too
+    - interfaces: update network-manager interface to allow
+      ObjectManager access from unconfined clients
+    - tests: move core and regression suites to snaps-state tool
+    - tests: moving interfaces tests to snaps-state tool
+    - gadget: preserve files when indicated by content change observer
+    - tests: moving smoke test suite and some tests from main suite to
+      snaps-state tool
+    - o/snapshotstate: pass set id to backend.Open, update tests
+    - asserts/snapasserts: introduce ValidationSets
+    - o/snapshotstate: improve allocation of new set IDs
+    - boot: look at the gadget for run mode bootloader when making the
+      system bootable
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - usersession/userd: separate bus name ownership from defining
+      interfaces
+    - o/snapshotstate: set snapshot set id from its filename
+    - o/snapstate: move remove-related tests to snapstate_remove_test.go
+    - desktop/notification: switch ExpireTimeout to time.Duration
+    - desktop/notification: add unit tests
+    - snap: snap help output refresh
+    - tests/nested/manual/preseed: include a system-usernames snap when
+      preseeding
+    - tests: fix sudo-env test
+    - tests: fix nested core20 shellcheck bug
+    - tests/lib: move to new directory when restoring PWD, cleanup
+      unpacked unpacked snap directories
+    - desktop/notification: add bindings for FDO notifications
+    - dbustest: fix stale comment references
+    - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+      drop former
+    - snap-repair: add uc20 support
+    - tests: print all the serial logs for the nested test
+    - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+      bug in test
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+      as Unknown*
+    - asserts: deserialize grouping only once in Pool.AddBatch if needed
+    - gadget: allow content observer to have opinions about a change
+    - tests: new snaps-state command - part1
+    - o/assertstate: support refreshing any number of snap-declarations
+    - boot: use test helpers
+    - tests/core/snap-debug-bootvars: also check snap_mode
+    - many/apparmor: adjust rules for reading profile/ execing new
+      profiles for new kernel
+    - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+      vars
+    - tests/lib/nested.sh: more little tweaks
+    - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - overlord: explicitly set refresh-app-awareness in tests
+    - kernel: remove "edition" from kernel.yaml and add "update"
+    - spread: drop vendor from the packed project archive
+    - boot: fix debug bootloader variables dump on UC20 systems
+    - wrappers, systemd: allow empty root dir and conditionally do not
+      pass --root to systemctl
+    - tests/nested/manual: add test for grades above signed booting with
+      testkeys
+    - tests/nested: misc robustness fixes
+    - o/assertstate,asserts: use bulk refresh to refresh snap-
+      declarations
+    - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+      been updated now
+    - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+    - update-pot: ignore .go files inside .git when running xgettext-go
+    - tests: disable part of the lxd test completely on 16.04.
+    - o/snapshotstate: tweak comment regarding snapshot filename
+    - o/snapstate: improve snapshot iteration
+    - bootloader: lk cleanups
+    - tests: update to support nested kvm without reboots on UC20
+    - tests/nested/manual/preseed: disable system-key check for 20.04
+      image
+    - spread.yaml: add ubuntu-20.10-64 to qemu
+    - store: handle v2 error when fetching assertions
+    - gadget: resolve device mapper devices for fallback device lookup
+    - tests/nested/cloud-init-many: simplify tests and unify
+      helpers/seed inputs
+    - tests: copy /usr/lib/snapd/info to correct directory
+    - check-pr-title.py * : allow "*" in the first part of the title
+    - many: typos and small test tweak
+    - tests/main/lxd: disable cgroup combination for 16.04 that is
+      failing a lot
+    - tests: make nested signing helpers less confusing
+    - tests: misc nested changes
+    - tests/nested/manual/refresh-revert-fundamentals: disable
+      temporarily
+    - tests/lib/cla_check: default to Python 3, tweaks, formatting
+    - tests/lib/cl_check.py: use python3 compatible code
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 Nov 2020 17:51:02 +0100
+
+snapd (2.47.1~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - snap: snap help output refresh
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 08 Oct 2020 09:30:44 +0200
+
+snapd (2.47~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - tests: fix nested core20 shellcheck bug
+    - many/apparmor: adjust rule for reading apparmor profile for new
+      kernel
+    - snap-repair: add uc20 support
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - gadget: resolve device mapper devices for fallback device lookup
+    - secboot: add boot manager profile to pcr protection profile
+    - sysconfig,o/devicestate: mv DisableNoCloud to
+      DisableAfterLocalDatasourcesRun
+    - tests: make gadget-reseal more robust
+    - tests: skip nested images pre-configuration by default
+    - tests: fix for basic20 test running on external backend and rpi
+    - tests: improve kernel reseal test
+    - boot: adjust comments, naming, log success around reseal
+    - tests/nested, fakestore: changes necessary to run nested uc20
+      signed/secured tests
+    - tests: add nested core20 gadget reseal test
+    - boot/modeenv: track unknown keys in Read and put back into modeenv
+      during Write
+    - interfaces/process-control: add sched_setattr to seccomp
+    - boot: with unasserted kernels reseal if there's a hint modeenv
+      changed
+    - client: bump the default request timeout to 120s
+    - configcore: do not error in console-conf.disable for install mode
+    - boot: streamline bootstate20.go reseal and tests changes
+    - boot: reseal when changing kernel
+    - cmd/snap/model: specify grade in the model command output
+    - tests: simplify
+      repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+    - test: improve logging in nested tests
+    - nested: add support to telnet to serial port in nested VM
+    - secboot: use the snapcore/secboot native recovery key type
+    - tests/lib/nested.sh: use more focused cloud-init config for uc20
+    - tests/lib/nested.sh: wait for the tpm socket to exist
+    - spread.yaml, tests/nested: misc changes
+    - tests: add more checks to disk space awareness spread test
+    - tests: disk space awareness spread test
+    - boot: make MockUC20Device use a model and MockDevice more
+      realistic
+    - boot,many: reseal only when meaningful and necessary
+    - tests/nested/core20/kernel-failover: add test for failed refresh
+      of uc20 kernel
+    - tests: fix nested to work with qemu and kvm
+    - boot: reseal when updating boot assets
+    - tests: fix snap-routime-portal-info test
+    - boot: verify boot chain file in seal and reseal tests
+    - tests: use full path to test-snapd-refresh.version binary
+    - boot: store boot chains during install, helper for checking
+      whether reseal is needed
+    - boot: add call to reseal an existing key
+    - boot: consider boot chains with unrevisioned kernels incomparable
+    - overlord: assorted typos and miscellaneous changes
+    - boot: group SealKeyModelParams by model, improve testing
+    - secboot: adjust parameters to buildPCRProtectionProfile
+    - strutil: add SortedListsUniqueMergefrom the doc comment:
+    - snap/naming: upgrade TODO to TODO:UC20
+    - secboot: add call to reseal an existing key
+    - boot: in seal.go adjust error message and function names
+    - o/snapstate: check available disk space in RemoveMany
+    - boot: build bootchains data for sealing
+    - tests: remove "set -e" from function only shell libs
+    - o/snapstate: disk space check on UpdateMany
+    - o/snapstate: disk space check with snap update
+    - snap: implement new `snap reboot` command
+    - boot: do not reorder boot assets when generating predictable boot
+      chains and other small tweaks
+    - tests: some fixes and improvements for nested execution
+    - tests/core/uc20-recovery: fix check for at least specific calls to
+      mock-shutdown
+    - boot: be consistent using bootloader.Role* consts instead of
+      strings
+    - boot: helper for generating secboot load chains from a given boot
+      asset sequence
+    - boot: tweak boot chains to support a list of kernel command lines,
+      keep track of model and kernel boot file
+    - boot,secboot: switch to expose and use snapcore/secboot load event
+      trees
+    - tests: use `nested_exec` in core{20,}-early-config test
+    - devicestate: enable cloud-init on uc20 for grade signed and
+      secured
+    - boot: add "rootdir" to baseBootenvSuite and use in tests
+    - tests/lib/cla_check.py: don't allow users.noreply.github.com
+      commits to pass CLA
+    - boot: represent boot chains, helpers for marshalling and
+      equivalence checks
+    - boot: mark successful with boot assets
+    - client, api: handle insufficient space error
+    - o/snapstate: disk space check with single snap install
+    - configcore: "service.console-conf.disable" is gadget defaults only
+    - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+      AppArmor profile path
+    - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+    - packaging/debian-sid: tweak code preparing _build tree
+    - many: move seal code from gadget/install to boot
+    - tests: remove workaround for cups on ubuntu-20.10
+    - client: implement RebootToSystem
+    - many: seed.Model panics now if called before LoadAssertions
+    - daemon: add /v2/systems "reboot" action API
+    - github: run tests also on push to release branches
+    - interfaces/bluez: let slot access audio streams
+    - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+      new seed.ReadSystemEssential
+    - interfaces: allow snap-update-ns to read /proc/cmdline
+    - tests: new organization for nested tests
+    - o/snapstate, features: add feature flags for disk space awareness
+    - tests: workaround for cups issue on 20.10 where default printer is
+      not configured.
+    - interfaces: update cups-control and add cups for providing snaps
+    - boot: keep track of the original asset when observing updates
+    - tests: simplify and fix tests for disk space checks on snap remove
+    - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+      cloud.conf
+    - tests/main: mv core specific tests to core suite
+    - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+    - devicestate: rename "mockLogger" to "logbuf"
+    - many: introduce ContentChange for tracking gadget content in
+      observers
+    - many: fix partion vs partition typo
+    - bootloader: retrieve boot chains from bootloader
+    - devicestate: add tests around logging in RequestSystemAction
+    - boot: handle canceled update
+    - bootloader: tweak doc comments (thanks Samuele)
+    - seed/seedwriter: test local asserted snaps with UC20 grade signed
+    - sysconfig/cloudinit.go: add DisableNoCloud to
+      CloudInitRestrictOptions
+    - many: use BootFile type in load sequences
+    - boot,bootloader: clarifications after the changes to introduce
+      bootloader.Options.Role
+    - boot,bootloader,gadget: apply new bootloader.Options.Role
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - testutil: add checkers for symbolic link target
+    - many: refactor tpm seal parameter setting
+    - boot/bootstate20: reboot to rollback to previous kernel
+    - boot: add unit test helpers
+    - boot: observe update & rollback of trusted assets
+    - interfaces/utf: Add MIRKey to u2f devices
+    - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+      cloud-init tests
+    - many: check that users of BaseTest don't forget to consume
+      cleanups
+    - tests/nested/core20/tpm: verify trusted boot assets tracking
+    - github: run macOS job with Go 1.14
+    - many: misc doc-comment changes and typo fixes
+    - o/snapstate: disk space check with InstallMany
+    - many: cloud-init cleanups from previous PR's
+    - tests: running tests on opensuse leap 15.2
+    - run-checks: check for dirty build tree too
+    - vendor: run ./get-deps.sh to update the secboot hash
+    - tests: update listing test for "-dirty" versions
+    - overlord/devicestate: do not release the state lock when updating
+      gadget assets
+    - secboot: read kernel efi image from snap file
+    - snap: add size to the random access file return interface
+    - daemon: correctly parse Content-Type HTTP header.
+    - tests: account for apt-get on core18
+    - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+      loop
+    - mkversion.sh: simple hack to include dirty in version if the tree
+      is dirty
+    - cgroup,snap: track hooks on system bus only
+    - interfaces/systemd: compare dereferenced Service
+    - run-checks: only check files in git for misspelling
+    - osutil: add a package doc comment (via doc.go)
+    - boot: complain about reused asset name during initial install
+    - snapstate: installSize helper that calculates total size of snaps
+      and their prerequisites
+    - snapshots: export of snapshots
+    - boot/initramfs_test.go: reset boot vars on the bootloader for each
+      iteration
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Sep 2020 17:19:13 +0200
+
+snapd (2.46.1~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - interfaces: allow snap-update-ns to read
+      /proc/cmdline
+    - github: run macOS job with Go 1.14
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - tests: account for apt-get on core18
+    - mkversion.sh: include dirty in version if the tree
+      is dirty
+    - interfaces/systemd: compare dereferenced Service
+    - vendor.json: update mysterious secboot SHA again
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Sep 2020 17:42:54 +0200
+
+snapd (2.46~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - logger: add support for setting snapd.debug=1 on kernel cmdline
+    - o/snapstate: check disk space before creating automatic snapshot
+      on remove
+    - boot, o/devicestate: observe existing recovery bootloader trusted
+      boot assets
+    - many: use transient scope for tracking apps and hooks
+    - features: add HiddenSnapFolder feature flag
+    - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+      too
+    - runinhibit: open the lock file in read-only mode in IsLocked
+    - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+      automatic
+    - tests: update spread test for unknown plug/slot with snapctl is-
+      connected
+    - osutil: add OpenExistingLockForReading
+    - kernel: add kernel.Validate()
+    - interfaces: add vcio interface
+    - interfaces/{docker,kubernetes}-support: load overlay and support
+      systemd cgroup driver
+    - tests/lib/nested.sh: use more robust code for finding what loop
+      dev we mounted
+    - cmd/snap-update-ns: detach all bind-mounted file
+    - snap/snapenv: set SNAP_REAL_HOME
+    - packaging: umount /snap on purge in containers
+    - interfaces: misc policy updates xlvi
+    - secboot,cmd/snap-bootstrap: cross-check partitions before
+      unlocking, mounting
+    - boot: copy boot assets cache to new root
+    - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+    - o/hookstate/ctlcmd: make is-connected check whether the plug or
+      slot exists
+    - tests: find -ignore_readdir_race when scanning cgroups
+    - interfaces/many: deny arbitrary desktop files and misc from
+      /usr/share
+    - tests: use "set -ex" in prep-snapd-in-lxd.sh
+    - tests: re-enable udisks test on debian-sid
+    - cmd/snapd-generator: use PATH fallback if PATH is not set
+    - tests: disable udisks2 test on arch linux
+    - github: use latest/stable go, not latest/edge
+    - tests: remove support for ubuntu 19.10 from spread tests
+    - tests: fix lxd test wrongly tracking 'latest'
+    - secboot: document exported functions
+    - cmd: compile snap gdbserver shim correctly
+    - many: correctly calculate the desktop file prefix everywhere
+    - interfaces: add kernel-crypto-api interface
+    - corecfg: add "system.timezone" setting to the system settings
+    - cmd/snapd-generator: generate drop-in to use fuse in container
+    - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+      from previous PR
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+    - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+      the-tool
+    - tests: work around broken update of systemd-networkd
+    - tests/main/install-fontconfig-cache-gen: enhance test by
+      verifying, add fonts to test
+    - o/devicestate: wrap asset update observer error
+    - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+    - mkversion.sh: disallow changelog versions that have git in it, if
+      we also have git version
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - snap: fix repeated "cannot list recovery system" and add test
+    - boot: track trusted assets during initial install, assets cache
+    - vendor: update secboot to fix key data validation
+    - tests: unmount FUSE file-systems from XDG runtime dir
+    - overlord/devicestate: workaround non-nil interface with nil struct
+    - sandbox/cgroup: remove temporary workaround for multiple cgroup
+      writers
+    - sandbox/cgroup: detect dangling v2 cgroup
+    - bootloader: add helper for creating a bootloader based on gadget
+    - tests: support different images on nested execution
+    - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+    - packaging/arch: use external linker when building statically
+    - tests: cope with ghost cgroupv2
+    - tests: fix issues related to restarting systemd-logind.service
+    - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+      gadget updates
+    - vendor: update github.com/kr/pretty to fix diffs of values with
+      pointer cycles
+    - boot: move bootloaderKernelState20 impls to separate file
+    - .github/workflows: move snap building to test.yaml as separate
+      cached job
+    - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+      meeting minimal requirements
+    - osutil: add CommitAs to atomic file
+    - gadget: introduce content update observer
+    - bootloader: introduce TrustedAssetsBootloader, implement for grub
+    - o/snapshotstate: helpers for calculating disk space needed for an
+      automatic snapshot
+    - gadget/install: retrieve command lines from bootloader
+    - boot/bootstate20: unify commit method impls, rm
+      bootState20MarkSuccessful
+    - tests: add system information and image information when debug
+      info is displayed
+    - tests/main/cgroup-tracking: try to collect some information about
+      cgroups
+    - boot: introduce current_boot_assets and
+      current_recovery_boot_assets to modeenv
+    - tests: fix for timing issues on journal-state test
+    - many: remove usage and creation of hijacked pid cgroup
+    - tests: port regression-home-snap-root-owned to tests.session
+    - tests: run as hightest via tests.session
+    - github: run CLA checks on self-hosted workers
+    - github: remove Ubuntu 19.10 from actions workflow
+    - tests: remove End-Of-Life opensuse/fedora releases
+    - tests: remove End-Of-Life releases from spread.yaml
+    - tests: fix debug section of appstream-id test
+    - interfaces: check !b.preseed earlier
+    - tests: work around bug in systemd/debian
+    - boot: add deepEqual, Copy helpers for Modeenv to simplify
+      bootstate20 refactor
+    - cmd: add new "snap recovery" command
+    - interfaces/systemd: use emulation mode when preseeding
+    - interfaces/kmod: don't load kernel modules in kmod backend when
+      preseeding
+    - interfaces/udev: do not reload udevadm rules when preseeding
+    - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+    - boot: fancy marshaller for modeenv values
+    - gadget, osutil: use atomic file copy, adjust tests
+    - overlord: use new tracking cgroup for refresh app awareness
+    - github: do not skip gofmt with Go 1.9/1.10
+    - many: introduce content write observer, install mode glue, initial
+      seal stubs
+    - daemon,many: switch to use client.ErrorKind and drop the local
+      errorKind...
+    - tests: new parameters for nested execution
+    - client: move all error kinds into errors.go and add doc strings
+    - cmd/snap: display the error in snap debug seeding if seeding is in
+      error
+    - cmd/snap/debug/seeding: use unicode for proper yaml
+    - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+      recovery_mode
+    - osutil/disks: add mock disk and tests for happy path of mock disks
+    - tests: refresh/revert snapd in uc20
+    - osutil/disks: use a dedicated error to indicate a fs label wasn't
+      found
+    - interfaces/system-key: in WriteSystemKey during tests, don't call
+      ParserFeatures
+    - boot: add current recovery systems to modeenv
+    - bootloader: extend managed assets bootloader interface to compose
+      a candidate command line
+    - interfaces: make the unmarshal test match more the comment
+    - daemon/api: use pointers to time.Time for debug seeding aspect
+    - o/ifacestate: update security profiles in connect undo handler
+    - interfaces: add uinput interface
+    - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+      tests
+    - o/devicestate: save seeding/preseeding times for use with debug
+      seeding api
+    - cmd/snap/debug: add "snap debug seeding" command for preseeding
+      debugging
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+    - bootloader: compose command line with mode and extra arguments
+    - cmd/snap, daemon: detect and bail purge on multi-snap
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - interfaces/builtin/multipass: replace U+00A0 no-break space with
+      simple space
+    - bootloader/assets: generate bootloader assets from files
+    - many/tests/preseed: reset the preseeded images before preseeding
+      them
+    - tests: drop accidental accents from e
+    - secboot: improve key sealing tests
+    - tests: replace _wait_for_file_change with retry
+    - tests: new fs-state which replaces the files.sh helper
+    - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+      from path
+    - cmd/snap: track started apps and hooks
+    - tests/main/interfaces-pulseaudio: disable start limit checking for
+      pulseaudio service
+    - api: seeding debug api
+    - .github/workflows/snap-build.yaml: build the snapd snap via GH
+      Actions too
+    - tests: moving journalctl.sh to a new journal-state tool
+    - tests/nested/manual: add spread tests for cloud-init vuln
+    - bootloader/assets: helpers for registering per-edition snippets,
+      register snippets for grub
+    - data,packaging,wrappers: extend D-Bus service activation search
+      path
+    - spread: add opensuse 15.2 and tumbleweed for qemu
+    - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+    - sysconfig/cloudinit: add RestrictCloudInit
+    - cmd/snap-preseed: check that target path exists and is a directory
+      on --reset
+    - tests: check for pids correctly
+    - gadget,gadget/install: refactor partition table update
+    - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+      type
+    - interface/fwupd: add more policies for making fwupd upstream
+      strict
+    - tests: new to-one-line tool which replaces the strings.sh helper
+    - interfaces: new helpers to get and compare system key, for use
+      with seeding debug api
+    - osutil, many: add helper for checking whether the process is a go
+      test binary
+    - cmd/snap-seccomp/syscalls: add faccessat2
+    - tests: adjust xdg-open after launcher changes
+    - tests: new core config helper
+    - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+      open
+    - cmd/snap-preseed: handle relative chroot path
+    - snapshotstate: move sizer to osutil.Sizer()
+    - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+      kernel tests
+    - gadget/install,secboot: use snapcore/secboot luks2 api
+    - boot/initramfs_test.go: add Commentf to more Assert()'s
+    - tests/lib: account for changes in arch package file name extension
+    - bootloader/bootloadertest: fix comment typo
+    - bootloader: add helper for getting recovery system environment
+      variables
+    - tests: preinstall shellcheck and run tests on focal
+    - strutil: add a helper for parsing kernel command line
+    - osutil: add CheckFreeSpace helper
+    - secboot: update tpm connection error handling
+    - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+    - tests: add tests.cleanup helper
+    - packaging: add "ca-certificates" to build-depends
+    - tests: more checks in core20 early config spread test
+    - tests: fix some snapstate tests to use pointers for
+      snapmgrTestSuite
+    - boot: better naming of helpers for obtaining kernel command line
+    - many: use more specific check for unit test mocking
+    - systemd/escape: fix issues with "" and "\t" handling
+    - asserts: small improvements and corrections for sequence-forming
+      assertions' support
+    - boot, bootloader: query kernel command line of run mod and
+      recovery mode systems
+    - snap/validate.go: disallow snap layouts with new top-level
+      directories
+    - tests: allow to add a new label to run nested tests as part of PR
+      validation
+    - tests/core/gadget-update-pc: port to UC20
+    - tests: improve nested tests flexibility
+    - asserts: integer headers: disallow prefix zeros and make parsing
+      more uniform
+    - asserts: implement Database.FindSequence
+    - asserts: introduce SequenceMemberAfter in the asserts backstores
+    - spread.yaml: remove tests/lib/tools from PATH
+    - overlord: refuse to install snaps whose activatable D-Bus services
+      conflict with installed snaps
+    - tests: shorten lxd-state undo-mount-changes
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - tests: fix argument handling of apt-state
+    - tests: rename lxd-tool to lxd-state
+    - tests: rename user-tool to user-state, fix --help
+    - interfaces: add gconf interface
+    - sandbox/cgroup: avoid parsing security tags twice
+    - tests: rename version-tool to version-compare
+    - cmd/snap-update-ns: handle anomalies better
+    - tests: fix call to apt.Package.mark_install(auto_inst=True)
+    - tests: rename mountinfo-tool to mountinfo.query
+    - tests: rename memory-tool to memory-observe-do
+    - tests: rename invariant-tool to tests.invariant
+    - tests: rename apt-tool to apt-state
+    - many: managed boot config during run mode setup
+    - asserts: introduce the concept of sequence-forming assertion types
+    - tests: tweak comments/output in uc20-recovery test
+    - tests/lib/pkgdb: do not use quiet when purging debs
+    - interfaces/apparmor: allow snap-specific /run/lock
+    - interfaces: add system-source-code for access to /usr/src
+    - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+    - gadget/install: move udev trigger to gadget/install
+    - many: make nested spread tests more reliable
+    - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+      w/ external backend
+    - tests: enable tests on uc20 which now work with the real model
+      assertion
+    - tests: enable system-snap-refresh test on uc20
+    - gadget, bootloader: preserve managed boot assets during gadget
+      updates
+    - tests: fix leaked dbus-daemon in selinux-clean
+    - tests: add servicestate.Control tests
+    - tests: fix "restart.service"
+    - wrappers: helper for enabling services - extract and move enabling
+      of services into a helper
+    - tests: new test to validate refresh and revert of kernel and
+      gadget on uc20
+    - tests/lib/prepare-restore: collect debug info when prepare purge
+      fails
+    - bootloader: allow managed bootloader to update its boot config
+    - tests: Remove unity test from nightly test suite
+    - o/devicestate: set mark-seeded to done in the task itself
+    - tests: add spread test for disconnect undo caused by failing
+      disconnect hook
+    - sandbox/cgroup: allow discovering PIDs of given snap
+    - osutil/disks: support IsDecryptedDevice for mountpoints which are
+      dm devices
+    - osutil: detect autofs mounted in /home
+    - spread.yaml: allow amazon-linux-2-64 qemu with
+      ec2-user/ec2-user
+    - usersession: support additional zoom URL schemes
+    - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+    - sandbox/cgroup: add tracking helpers
+    - tests: detect stray dbus-daemon
+    - overlord: refuse to install snaps providing user daemons on Ubuntu
+      14.04
+    - many: move encryption and installer from snap-boostrap to gadget
+    - o/ifacestate: fix connect undo handler
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - bootloader: introduce managed bootloader, implement for grub
+    - tests: fix incorrect check in smoke/remove test
+    - asserts,seed: split handling of essential/not essential model
+      snaps
+    - gadget: fix typo in mounted filesystem updater
+    - gadget: do only one mount point lookup in mounted fs updater
+    - tests/core/snap-auto-mount: try to make the test more robust
+    - tests: adding ubuntu-20.04 to google-sru backend
+    - o/servicestate: add updateSnapstateServices helper
+    - bootloader: pull recovery grub config from internal assets
+    - tests/lib/tools: apply linger workaround when needed
+    - overlord/snapstate: graceful handling of denied "managed" refresh
+      schedule
+    - snapstate: fix autorefresh from classic->strict
+    - overlord/configstate: add system.kernel.printk.console-loglevel
+      option
+    - tests: fix assertion disk handling for nested UC systems
+    - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+    - tests: extra worker for google-nested backend to avoid timeout
+      error on uc20
+    - snapdtool: helper to check whether the current binary is reexeced
+      from a snap
+    - tests: mock servicestate in api tests to avoid systemctl checks
+    - many: rename back snap.Info.GetType to Type
+    - tests/lib/cla_check: expect explicit commit range
+    - osutil/disks: refactor diskFromMountPointImpl a bit
+    - o/snapstate: service-control task handler
+    - osutil: add disks pkg for associating mountpoints with
+      disks/partitions
+    - gadget,cmd/snap-bootstrap: move partitioning to gadget
+    - seed: fix LoadEssentialMeta when gadget is not loaded
+    - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+      secure_path
+    - asserts: introduce new assertion validation-set
+    - asserts,daemon: add support for "serials" field in system-user
+      assertion
+    - data/sudo: drop a failed sudo secure_path workaround
+    - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+    - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+    - spread.yaml: update secure boot attribute name
+    - interfaces/block_devices: add NVMe subsystem devices, support
+      multipath paths
+    - tests: use the "jq" snap from the edge channel
+    - tests: simplify the tpm test by removing the test-snapd-mokutil
+      snap
+    - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+      status too
+    - tests/main/sudo-env: check snap path under sudo
+    - tests/main/lxd: add test for snaps inside nested lxd containers
+      not working
+    - asserts/internal: expand errors about invalid serialized grouping
+      labels
+    - usersession/userd: add msteams url support
+    - tests/lib/prepare.sh: adjust comment about sgdisk
+    - tests: fix how gadget pc is detected when the snap does not exist
+      and ls fails
+    - tests: move a few more tests to snapstate_update_test.go
+    - tests/main: add spread test for running svc from install hook
+    - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+    - tests/special-home-can-run-classic-snaps: re-enable
+    - workflow: test PR title as part of the static checks again
+    - tests/main/xdg-open-compat: backup and restore original xdg-open
+    - tests: move update-related tests to snapstate_update_test.go
+    - cmd,many: move Version and bits related to snapd tools to
+      snapdtool, merge cmdutil
+    - tests/prepare-restore.sh: reset-failed systemd-journald before
+      restarting
+    - interfaces: misc small interface updates
+    - spread: use find rather than recursive ls, skip mounted snaps
+    - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+      /var/lib/snapd
+    - tests: enable snap-auto-mount test on core20
+    - cmd/snap: do not show $PATH warning when executing under sudo on a
+      known distro
+    - asserts/internal: add some iteration benchmarks
+    - sandbox/cgroup: improve pid parsing code
+    - snap: add new `snap run --experimental-gdbserver` option
+    - asserts/internal: limit Grouping size switching to a bitset
+      representationWe don't always use the bit-set representation
+      because:
+    - snap: add an activates-on property to apps for D-Bus activation
+    - dirs: delete unused Cloud var, fix typo
+    - sysconfig/cloudinit: make callers of DisableCloudInit use
+      WritableDefaultsDir
+    - tests: fix classic ubuntu core transition auth
+    - tests: fail in setup_reflash_magic() if there is snapd state left
+    - tests: port interfaces-many-core-provided to tests.session
+    - tests: wait after creating partitions with sfdisk
+    - bootloader: introduce bootloarder assets, import grub.cfg with an
+      edition marker
+    - riscv64: bump timeouts
+    - gadget: drop dead code, hide exports that are not used externally
+    - tests: port 2 uc20 part1
+    - tests: fix bug waiting for snap command to be ready
+    - tests: move try-related tests to snapstate_try_test.go
+    - tests: add debug for 20.04 prepare failure
+    - travis.yml: removed, all our checks run in GH actions now
+    - tests: clean up up the use of configcoreSuite in the configcore
+      tests
+    - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+    - sandbox/cgroup: add tests for ParsePids
+    - tests: fix the basic20 test for uc20 on external backend
+    - tests: use configcoreSuite in journalSuite and remove some
+      duplicated code
+    - tests: move a few more tests to snapstate_install_test
+    - tests: assorted small patches
+    - dbusutil/dbustest: separate license from package
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+    - tests: check that host settings like hostname are settable on core
+    - tests: port xdg-settings test to tests.session
+    - tests: port snap-handle-link test to tests.session
+    - arch: add riscv64
+    - tests: core20 early defaults spread test
+    - tests: move install tests from snapstate_test.go to
+      snapstate_install_test.go
+    - github: port macOS sanity checks from travis
+    - data/selinux: allow checking /var/cache/app-info
+    - o/devicestate: core20 early config from gadget defaults
+    - tests: autoremove after removing lxd in preseed-lxd test
+    - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+    - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+    - tests: update the file used to detect the boot path on uc20
+    - spread.yaml: show /var/lib/snapd in debug
+    - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+      netplan files
+    - snap/naming: add helpers to parse app and hook security tags
+    - tests: modernize retry tool
+    - tests: fix and trim debug section in xdg-open-portal
+    - tests: modernize and use snapd.tool
+    - vendor: update to latest github.com/snapcore/bolt for riscv64
+    - cmd/snap-confine: add support for libc6-lse
+    - interfaces: miscellaneous policy updates xlv
+    - interfaces/system-packages-doc: fix typo in variable names
+    - tests: port interfaces-calendar-service to tests.session
+    - tests: install/run the lzo test snap too
+    - snap: (small) refactor of `snap download` code for
+      testing/extending
+    - data: fix shellcheck warnings in snapd.sh.in
+    - packaging: disable buildmode=pie for riscv64
+    - tests: install test-snapd-rsync snap from edge channel
+    - tests: modernize tests.session and port everything using it
+    - tests: add ubuntu 20.10 to spread tests
+    - cmd/snap/remove: mention snap restore/automatic snapshots
+    - dbusutil: move all D-Bus helpers and D-Bus test helpers
+    - wrappers: pass 'disable' flag to StopServices wrapper
+    - osutil: enable riscv64 build
+    - snap/naming: add ParseSecurityTag and friends
+    - tests: port document-portal-activation to session-tool
+    - bootloader: rename test helpers to reflect we are mocking EFI boot
+      locations
+    - tests: disable test of nfs v3 with udp proto on debian-sid
+    - tests: plan to improve the naming and uniformity of utilities
+    - tests: move *-tool tests to their own suite
+    - snap-bootstrap: remove sealed key file on reinstall
+    - bootloader/ubootenv: don't panic with an empty uboot env
+    - systemd: rename actualFsTypeAndMountOptions to
+      hostFsTypeAndMountOptions
+    - daemon: fix filtering of service-control changes for snap.app
+    - tests: spread test for preseeding in lxd container
+    - tests: fix broken snapd.session agent.socket
+    - wrappers: add RestartServices function and ReloadOrRestart to
+      systemd
+    - o/cmdstate: handle ignore flag on exec-command tasks
+    - gadget: make ext4 filesystems with or without metadata checksum
+    - tests: update statx test to run on all LTS releases
+    - configcore: show better error when disabling services
+    - interfaces: add hugepages-control
+    - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+    - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+    - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+    - tests: reload systemd --user for root, if present
+    - tests: reload systemd after editing /etc/fstab
+    - tests: add missing dependencies needed for sbuild test on debian
+    - tests: reload systemd after removing pulseaudio
+    - image, tests: core18 early config.
+    - interfaces: add system-packages-doc interface
+    - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+      preseeding
+    - interfaces/fwupd: allow bind mount to /boot on core
+    - tests: improve oom-vitality tests
+    - tests: add fedora 32 to spread.yaml
+    - config: apply vitality-hint immediately when the config changes
+    - tests: port snap-routine-portal-info to session-tool
+    - configcore: add "service.console-conf.disable" config option
+    - tests: port xdg-open to session-tool
+    - tests: port xdg-open-compat to session-tool
+    - tests: port interfaces-desktop-* to session-tool
+    - spread.yaml: apply yaml formatter/linter
+    - tests: port interfaces-wayland to session-tool
+    - o/devicestate: refactor current system handling
+    - snap-mgmt: perform cleanup of user services
+    - snap/snapfile,squashfs: followups from 8729
+    - boot, many: require mode in modeenv
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests: log stderr from dbus-monitor
+    - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+      tag
+    - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+      layout
+    - interfaces/builtin/desktop: do not mount fonts cache on distros
+      with quirks
+    - data/selinux: allow snapd to remove/create the its socket
+    - testutil/exec.go: set PATH after running shellcheck
+    - tests: silence stderr from dbus-monitor
+    - snap,many: mv Open to snapfile pkg to support add'l options to
+      Container methods
+    - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+      gadget
+    - github: remove workaround for bug 133 in actions/cache
+    - tests: remove dbus.sh
+    - cmd/snap-preseed: improve mountpoint checks of the preseeded
+      chroot
+    - spread.yaml: add ps aux to debug section
+    - github: run all spread systems in a single go with cached results
+    - test: session-tool cli tweaks
+    - asserts: rest of the Pool API
+    - tests: port interfaces-network-status-classic to session-tool
+    - packaging: remove obsolete 16.10,17.04 symlinks
+    - tests: setup portals before starting user session
+    - o/devicestate: typo fix
+    - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+      devices
+    - cmd/snap/model: support store, system-user-authority keys in
+      --verbose
+    - o/devicestate: raise conflict when requesting system action while
+      seeding
+    - tests: detect signs of crashed snap-confine
+    - tests: sign kernel and gadget to run nested tests using current
+      snapd code
+    - tests: remove gnome-online-accounts we install
+    - tests: fix the issue where all the tests were executed on secboot
+      system
+    - tests: port interfaces-accounts-service to session-tool
+    - interfaces/network-control: bring /var/lib/dhcp from host
+    - image,cmd/snap,tests: add support for store-wide cohort keys
+    - configcore: add nomanagers buildtag for conditional build
+    - tests: port interfaces-password-manager-service to session-tool
+    - o/devicestate: cleanup system actions supported by recover mode
+    - snap-bootstrap: remove create-partitions and update tests
+    - tests: fix nested tests
+    - packaging/arch: update PKGBUILD to match one in AUR
+    - tests: port interfaces-location-control to session-tool
+    - tests: port interfaces-contacts-service to session-tool
+    - state: log task errors in the journal too
+    - o/devicestate: change how current system is reported for different
+      modes
+    - devicestate: do not report "ErrNoState" for seeded up
+    - tests: add a note about broken test sequence
+    - tests: port interfaces-autopilot-introspection to session-tool
+    - tests: port interfaces-dbus to session-tool
+    - packaging: update sid packaging to match 16.04+
+    - tests: enable degraded test on uc20
+    - c/snaplock/runinhibit: add run inhibition operations
+    - tests: detect and report root-owned files in /home
+    - tests: reload root's systemd --user after snapd tests
+    - tests: test registration with serial-authority: [generic]
+    - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+      key in recover
+    - tests/mount-ns: stop binfmt_misc mount unit
+    - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+      uuid if available
+    - daemon, tests: indicate system mode, test switching to recovery
+      and back to run
+    - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+      denials
+    - tests/mount-ns: update to reflect new UEFI boot mode
+    - usersession,tests: clean ups for userd/settings.go and move
+      xdgopenproxy under usersession
+    - tests: disable mount-ns test
+    - tests: test user belongs to systemd-journald, on core20
+    - tests: run core/snap-set-core-config on uc20 too
+    - tests: remove generated session-agent units
+    - sysconfig: use new _writable_defaults dir to create cloud config
+    - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+      future work
+    - asserts: make clearer that with label we mean a serialized label
+    - cmd/snap-bootstrap: tweak recovery trigger log messages
+    - asserts: introduce PoolTo 
+    - userd: allow setting default-url-scheme-handler
+    - secboot: append uuid to ubuntu-data when decrypting
+    - o/configcore: pass extra options to FileSystemOnlyApply
+    - tests: add dbus-user-session to bionic and reorder package names
+    - boot, bootloader: adjust comments, expand tests
+    - tests: improve debugging of user session agent tests
+    - packaging: add the inhibit directory
+    - many: add core.resiliance.vitality-hint config setting
+    - tests: test adjustments and fixes for recently published images
+    - cmd/snap: coldplug auto-import assertions from all removable
+      devices
+    - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+      secboot
+    - tests: not fail when boot dir cannot be determined
+    - tests: new directory used to store the cloud images on gce
+    - tests: inject snapd from edge into seeds of the image in manual
+      preseed test
+    - usersession/agent,wrappers: fix races between Shutdown and Serve
+    - tests: add dependency needed for next upgrade of bionic
+    - tests: new test user is used for external backend
+    - cmd/snap: fix the order of positional parameters in help output
+    - tests: don't create root-owned things in ~test
+    - tests/lib/prepare.sh: delete patching of the initrd
+    - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+      as well
+    - progress: tweak multibyte label unit test data
+    - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+    - gadget: fix fallback device lookup for 'mbr' type structures
+    - configcore: only reload journald if systemd is new enough
+    - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+    - wrappers: allow user mode systemd daemons
+    - progress: fix progress bar with multibyte duration units
+    - tests: fix raciness in pulseaudio test
+    - asserts/internal: introduce Grouping and Groupings
+    - tests: remove user.sh
+    - tests: pair of follow-ups from earlier reviews
+    - overlord/snapstate: warn of refresh/postpone events
+    - configcore,tests: use daemon-reexec to apply watchdog config
+    - c/snap-bootstrap: check mount states via initramfsMountStates
+    - store: implement DownloadAssertions
+    - tests: run smoke test with different bases
+    - tests: port user-mounts test to session-tool
+    - store: handle error-list in fetch-assertions results
+    - tests: port interfaces-audio-playback-record to session-tool
+    - data/completion: add `snap` command completion for zsh
+    - tests/degraded: ignore failure in systemd-vconsole-setup.service
+    - image: stub implementation of image.Prepare for darwin
+    - tests: session-tool --restore -u stops user-$UID.slice
+    - o/ifacestate/handlers.go: fix typo
+    - tests: port pulseaudio test to session-tool
+    - tests: port user-session-env to session-tool
+    - tests: work around journald bug in core16
+    - tests: add debug to core-persistent-journal test
+    - tests: port selinux-clean to session-tool
+    - tests: port portals test to session-tool, fix portal tests on sid
+    - tests: adding option --no-install-recommends option also when
+      install all the deps
+    - tests: add session-tool --has-systemd-and-dbus
+    - packaging/debian-sid: add gcc-multilib to build deps
+    - osutil: expand FileLock to support shared locks and more
+    - packaging: stop depending on python-docutils
+    - store,asserts,many: support the new action fetch-assertions
+    - tests: port snap-session-agent-* to session-tool
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - tests: fix for preseeding failures
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 25 Aug 2020 17:26:21 +0200
+
+snapd (2.45.3.1~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+
+ -- Samuele Pedroni <pedronis@lucediurna.net>  Tue, 28 Jul 2020 21:43:38 +0200
+
+snapd (2.45.3~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - many: backport _writable_defaults dir changes
+    - tests: fix incorrect check in smoke/remove test
+    - cmd/snap-bootstrap,seed: backport of uc20 PRs
+    - tests: avoid exit when nested type var is not defined
+    - cmd/snap-preseed: backport fixes
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - many: cherry-picks for 2.45, gh-action, test fixes
+    - tests/lib: account for changes in arch package file name extension
+    - postrm, snap-mgmt: cleanup modules and other cherry-picks
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests/main/interfaces-time-control: exercise setting time via date
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+
+ -- Zygmunt Krynicki <me@zygoon.pl>  Mon, 27 Jul 2020 12:01:14 +0200
+
+snapd (2.45.2~14.04) trusty; urgency=medium
+
+  * SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+    implementation
+    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
+      variable modification when calling the system xdg-open. Patch
+      thanks to James Henstridge
+    - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+      restarted. Patch thanks to Michael Vogt
+    - CVE-2020-11934
+    - LP: #1880085
+  * SECURITY UPDATE: arbitrary code execution vulnerability on core
+    devices with access to physical removable media
+    - devicestate: Disable/restrict cloud-init after seeding.
+    - CVE-2020-11933
+    - LP: #1879530
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 10 Jul 2020 20:06:29 +0200
+
 snapd (2.45.1~14.04) trusty; urgency=medium
 
   * New upstream release, LP: #1875071
     - data/selinux: allow checking /var/cache/app-info
     - cmd/snap-confine: add support for libc6-lse
-    - interfaces: miscellanious policy updates xlv
+    - interfaces: miscellaneous policy updates xlv
     - snap-bootstrap: remove sealed key file on reinstall
     - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
     - gadget: make ext4 filesystems with or without metadata checksum
@@ -408,6 +1704,35 @@
 
  -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 May 2020 17:17:57 +0200
 
+snapd (2.44.5~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - spread.yaml: adding more workers for ubuntu 20.04
+    - packaging: stop depending on python-docutils on opensuse
+    - spread.yaml: do not run ubuntu-core-20-64 with snapd 2.44, snapd
+      is not recent enough to drive ubuntu-core-20
+    - spread.yaml: Preserve size for centos images on spread.yaml
+    - spread.yaml: use non-uefi enabled image for uc20
+    - tests: ensure $cache_dir is actually available
+    - tests: disable preseed tests, they work in master but require too
+      much cherry-picking here
+    - travis.yml: remove go/master unit tests from 2.44
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 30 Apr 2020 09:09:22 +0200
+
+snapd (2.44.4~14.04) trusty; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - interfaces/firewall-control: allow -legacy and -nft for core20
+    - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
+      syscalls
+    - tests: 16.04 and 18.04 now have mediating pulseaudio
+    - tests: ignore user@12345.service hierarchy
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Apr 2020 08:32:56 +0200
+
 snapd (2.44.3~14.04) trusty; urgency=medium
 
   * New upstream release, LP: #1864808
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/control snapd-2.48.3+20.04/packaging/ubuntu-14.04/control
--- snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-14.04/control	2021-02-02 08:21:12.000000000 +0000
@@ -6,6 +6,7 @@
                automake,
                autotools-dev,
                bash-completion,
+               ca-certificates,
                debhelper (>= 9),
                dbus,
                dh-apparmor,
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/rules snapd-2.48.3+20.04/packaging/ubuntu-14.04/rules
--- snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/rules	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-14.04/rules	2021-02-02 08:21:12.000000000 +0000
@@ -53,9 +53,15 @@
 endif
 
 # check if we need to include the testkeys in the binary
+# TAGS are the go build tags for all binaries, SNAP_TAGS are for snap
+# build only.
 TAGS=
+SNAP_TAGS=
 ifneq (,$(filter testkeys,$(DEB_BUILD_OPTIONS)))
 	TAGS=-tags withtestkeys
+	SNAP_TAGS=-tags "nomanagers withtestkeys"
+else
+	SNAP_TAGS=-tags nomanagers
 endif
 
 BUILT_USING_PACKAGES=
@@ -122,7 +128,11 @@
 	# Build golang bits
 	mkdir -p _build/src/$(DH_GOPKG)/cmd/snap/test-data
 	cp -a cmd/snap/test-data/*.gpg _build/src/$(DH_GOPKG)/cmd/snap/test-data/
+	cp -a bootloader/assets/data _build/src/$(DH_GOPKG)/bootloader/assets
 	dh_auto_build -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
+
+	(cd _build/bin && GOPATH=$$(pwd)/.. go build $(BUILDFLAGS) $(GCCGOFLAGS) $(SNAP_TAGS) $(DH_GOPKG)/cmd/snap)
+
 	# Generate static snap-exec, snapctl and snap-udpate-ns - it somehow includes CGO so we must
 	# force a static build here. We need a static snap-{exec,update-ns}/snapctl inside
 	# the core snap because not all bases will have a libc
@@ -143,7 +153,7 @@
 	$(MAKE) -C data all
 
 override_dh_auto_test:
-	dh_auto_test -- $(BUILDFLAGS) -tags "$(TAGS)" $(GCCGOFLAGS)
+	dh_auto_test -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
 # a tested default (production) build should have no test keys
 ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
 	# check that only the main trusted account-keys are included
@@ -181,6 +191,10 @@
 	fi
 	# chrorder generator
 	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
+	# bootloader assets generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/genasset
+	# docs generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/docs
 
 	# Install snapd's systemd units / upstart jobs, done
 	# here instead of debian/snapd.install because the
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/snapd.dirs snapd-2.48.3+20.04/packaging/ubuntu-14.04/snapd.dirs
--- snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/snapd.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-14.04/snapd.dirs	2021-02-02 08:21:12.000000000 +0000
@@ -7,6 +7,7 @@
 var/lib/snapd/desktop
 var/lib/snapd/environment
 var/lib/snapd/firstboot
+var/lib/snapd/inhibit
 var/lib/snapd/lib/gl
 var/lib/snapd/lib/gl32
 var/lib/snapd/lib/glvnd
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/snapd.install snapd-2.48.3+20.04/packaging/ubuntu-14.04/snapd.install
--- snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/snapd.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-14.04/snapd.install	2021-02-02 08:21:12.000000000 +0000
@@ -35,6 +35,7 @@
 
 # gdb helper
 usr/lib/snapd/snap-gdb-shim
+usr/lib/snapd/snap-gdbserver-shim
 
 # use "usr/lib" here because apparently systemd looks only there
 usr/lib/systemd/system-environment-generators
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/snapd.postrm snapd-2.48.3+20.04/packaging/ubuntu-14.04/snapd.postrm
--- snapd-2.45.1+20.04.2/packaging/ubuntu-14.04/snapd.postrm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-14.04/snapd.postrm	2021-02-02 08:21:12.000000000 +0000
@@ -70,6 +70,8 @@
                     rmdir --ignore-fail-on-non-empty "$d" || true
                 fi
             done
+            # modules
+            rm -f "/etc/modules-load.d/snap.${snap}.conf"
             # udev rules
             find /etc/udev/rules.d -name "*-snap.${snap}.rules" -execdir rm -f "{}" \;
             # dbus policy files
@@ -81,6 +83,12 @@
                 systemctl_stop "$(basename "$f")"
                 rm -f "$f"
             done
+            # user services, sockets, and timers - we make no attempt to stop any of them.
+            # TODO: ask snapd to ask each snapd.session-agent.service to stop snaps
+            # user-session services and stop itself.
+            find /etc/systemd/user -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" -o -name "snap.${snap}.*.service" | while read -r f; do
+                rm -f "$f"
+            done
         fi
 
         echo "Removing $unit"
@@ -88,6 +96,11 @@
         rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
     done
 
+    # snapd session-agent
+    rm -f /etc/systemd/user/snapd.session-agent.socket
+    rm -f /etc/systemd/user/snapd.session-agent.service
+    rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+
     # generated readme files
     rm -f "/snap/README"
 
@@ -113,6 +126,12 @@
         umount -l /run/snapd/ns/ || true
     fi
 
+    # inside containers we have a generator that creates a bind mount to /snap
+    if [ -e /run/systemd/container ]; then
+        echo "Unmount /snap inside a container"
+        umount /snap || true
+    fi
+
     echo "Removing extra snap-confine apparmor rules"
     rm -f /etc/apparmor.d/snap.core.*.usr.lib.snapd.snap-confine
 
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/changelog snapd-2.48.3+20.04/packaging/ubuntu-16.04/changelog
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/changelog	2020-07-10 13:59:20.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/changelog	2021-02-02 08:21:12.000000000 +0000
@@ -1,23 +1,1305 @@
-snapd (2.45.1+20.04.2) focal-security; urgency=medium
+snapd (2.48.3+20.04) focal-security; urgency=medium
 
-  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
-    (xdg-open)
-    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment 
+  * SECURITY UPDATE: sandbox escape vulnerability for containers
+    (LP: #1910456)
+    - many: add Delegate=true to generated systemd units for special
+      interfaces
+    - interfaces/greengrass-support: back-port interface changes to
+      2.48
+    - CVE-2020-27352
+  * interfaces/builtin/docker-support: allow /run/containerd/s/...
+    - This is a new path that docker 19.03.14 (with a new version of
+      containerd) uses to avoid containerd CVE issues around the unix
+      socket. See also CVE-2020-15257.
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 02 Feb 2021 09:21:12 +0100
+
+snapd (2.48.2) xenial; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - tests: sign new nested-18|20* models to allow for generic serials
+    - secboot: add extra paranoia when waiting for that fde-reveal-key
+    - tests: backport netplan workarounds from #9785
+    - secboot: add workaround for snapcore/core-initrd issue #13
+    - devicestate: log checkEncryption errors via logger.Noticef
+    - tests: add nested spread end-to-end test for fde-hooks
+    - devicestate: implement checkFDEFeatures()
+    - boot: tweak resealing with fde-setup hooks
+    - sysconfig/cloudinit.go: add "manual_cache_clean: true" to cloud-
+      init restrict file
+    - secboot: add new LockSealedKeys() that uses either TPM or
+      fde-reveal-key
+    - gadget: use "sealed-keys" to determine what method to use for
+      reseal
+    - boot: add sealKeyToModeenvUsingFdeSetupHook()
+    - secboot: use `fde-reveal-key` if available to unseal key
+    - cmd/snap-update-ns: fix sorting of overname mount entries wrt
+      other entries
+    - o/devicestate: save model with serial in the device save db
+    - devicestate: add runFDESetupHook() helper
+    - secboot,devicestate: add scaffoling for "fde-reveal-key" support
+    - hookstate: add new HookManager.EphemeralRunHook()
+    - update-pot: fix typo in plural keyword spec
+    - store,cmd/snap-repair: increase initial expontential time
+      intervals
+    - o/devicestate,daemon: fix reboot system action to not require a
+      system label
+    - github: run nested suite when commit is pushed to release branch
+    - tests: reset fakestore unit status
+    - tests: fix uc20-create-parition-* tests for updated gadget
+    - hookstate: implement snapctl fde-setup-{request,result}
+    - devicestate: make checkEncryption fde-setup hook aware
+    - client,snapctl: add naive support for "stdin"
+    - devicestate: support "storage-safety" defaults during install
+    - snap: use the boot-base for kernel hooks
+    - vendor: update secboot repo to avoid including secboot.test binary
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 15 Dec 2020 20:21:44 +0100
+
+snapd (2.48.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1906690
+    - gadget: disable ubuntu-boot role validation check
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Dec 2020 17:43:30 +0100
+
+snapd (2.48) xenial; urgency=medium
+
+  * New upstream release, LP: #1904098
+    - osutil: add KernelCommandLineKeyValue
+    - devicestate: implement boot.HasFDESetupHook
+    - boot/makebootable.go: set snapd_recovery_mode=install at image-
+      build time
+    - bootloader: use ForGadget when installing boot config
+    - interfaces/raw_usb: allow read access to /proc/tty/drivers
+    - boot: add scaffolding for "fde-setup" hook support for sealing
+    - tests: fix basic20 test on arm devices
+    - seed: make a shared seed system label validation helper
+    - snap: add new "fde-setup" hooktype
+    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
+    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
+      device handling
+    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
+      messiness
+    - tests/nested/manual/refresh-revert-fundamentals: temporarily
+      disable secure boot
+    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
+      boot modes
+    - many: address degraded recover mode feedback, cleanups
+    - tests: Use systemd-run on tests part2
+    - tests: set the opensuse tumbleweed system as manual in spread.yaml
+    - secboot: call BlockPCRProtectionPolicies even if the TPM is
+      disabled
+    - vendor: update to current secboot
+    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
+      save
+    - spread.yaml: increase number of workers on 20.10
+    - snap: add new `snap recovery --show-keys` option
+    - tests: minor test tweaks suggested in the review of 9607
+    - snapd-generator: set standard snapfuse options when generating
+      units for containers
+    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
+    - interfaces: share /tmp/.X11-unix/ from host or provider
+    - tests: enable main lxd test on 20.10
+    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
+      degraded mode
+    - gadget/install: add progress logging
+    - packaging: keep secboot/encrypt_dummy.go in debian
+    - interfaces/udev: use distro specific path to snap-device-helper
+    - o/devistate: fix chaining of tasks related to regular snaps when
+      preseeding
+    - gadget, overlord/devicestate: validate that system supports
+      encrypted data before install
+    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
+      ESP layout
+    - many: add /v2/system-recovery-keys API and client
+    - secboot, many: return UnlockMethod from Unlock* methods for future
+      usage
+    - many: mv keys to ubuntu-boot, move model file, rename keyring
+      prefix for secboot
+    - tests: using systemd-run instead of manually create a systemd unit
+      - part 1
+    - secboot, cmd/snap-bootstrap: enable or disable activation with
+      recovery key
+    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
+      disks first
+    - secboot: add LockTPMSealedKeys() to lock access to keys
+      independently
+    - gadget: correct sfdisk arguments
+    - bootloader/assets/grub: adjust fwsetup menuentry label
+    - tests: new boot state tool
+    - spread: use the official image for Ubuntu 20.10, no longer an
+      unstable system
+    - tests/lib/nested: enable snapd logging to console for core18
+    - osutil/disks: re-implement partition searching for disk w/ non-
+      adjacent parts
+    - tests: using the nested-state tool in nested tests
+    - many: seal a fallback object to the recovery boot chain
+    - gadget, gadget/install: move helpers to install package, refactor
+      unit tests
+    - dirs: add "gentoo" to altDirDistros
+    - update-pot: include file locations in translation template, and
+      extract strings from desktop files
+    - gadget/many: drop usage of gpt attr 59 for indicating creation of
+      partitions
+    - gadget/quantity: tweak test name
+    - snap: fix failing unittest for quantity.FormatDuration()
+    - gadget/quantity: introduce a new package that captures quantities
+    - o/devicestate,a/sysdb: make a backup of the device serial to save
+    - tests: fix rare interaction of tests.session and specific tests
+    - features: enable classic-preserves-xdg-runtime-dir
+    - tests/nested/core20/save: check the bind mount and size bump
+    - o/devicetate,dirs: keep device keys in ubuntu-save/save for UC20
+    - tests: rename hasHooks to hasInterfaceHooks in the ifacestate
+      tests
+    - o/devicestate: unit test tweaks
+    - boot: store the TPM{PolicyAuthKey,LockoutAuth}File in ubuntu-save
+    - testutil, cmd/snap/version: fix misc little errors
+    - overlord/devicestate: bind mount ubuntu-save under
+      /var/lib/snapd/save on startup
+    - gadget/internal: tune ext4 setting for smaller filesystems
+    - tests/nested/core20/save: a test that verifies ubuntu-save is
+      present and set up
+    - tests: update google sru backend to support groovy
+    - o/ifacestate: handle interface hooks when preseeding
+    - tests: re-enable the apt hooks test
+    - interfaces,snap: use correct type: {os,snapd} for test data
+    - secboot: set metadata and keyslots sizes when formatting LUKS2
+      volumes
+    - tests: improve uc20-create-partitions-reinstall test
+    - client, daemon, cmd/snap: cleanups from #9489 + more unit tests
+    - cmd/snap-bootstrap: mount ubuntu-save during boot if present
+    - secboot: fix doc comment on helper for unlocking volume with key
+    - tests: add spread test for refreshing from an old snapd and core18
+    - o/snapstate: generate snapd snap wrappers again after restart on
+      refresh
+    - secboot: version bump, unlock volume with key
+    - tests/snap-advise-command: re-enable test
+    - cmd/snap, snapmgr, tests: cleanups after #9418
+    - interfaces: deny connected x11 plugs access to ICE
+    - daemon,client: write and read a maintenance.json file for when
+      snapd is shut down
+    - many: update to secboot v1 (part 1)
+    - osutil/disks/mockdisk: panic if same mountpoint shows up again
+      with diff opts
+    - tests/nested/core20/gadget,kernel-reseal: add sanity checks to the
+      reseal tests
+    - many: implement snap routine console-conf-start for synchronizing
+      auto-refreshes
+    - dirs, boot: add ubuntu-save directories and related locations
+    - usersession: fix typo in test name
+    - overlord/snapstate: refactor ihibitRefresh
+    - overlord/snapstate: stop warning about inhibited refreshes
+    - cmd/snap: do not hardcode snapshot age value
+    - overlord,usersession: initial notifications of pending refreshes
+    - tests: add a unit test for UpdateMany where a single snap fails
+    - o/snapstate/catalogrefresh.go: don't refresh catalog in install
+      mode uc20
+    - tests: also check snapst.Current in undo-unlink tests
+    - tests: new nested tool
+    - o/snapstate: implement undo handler for unlink-snap
+    - tests: clean systems.sh helper and migrate last set of tests
+    - tests: moving the lib section from systems.sh helper to os.query
+      tool
+    - tests/uc20-create-partitions: don't check for grub.cfg
+    - packaging: make sure that static binaries are indeed static, fix
+      openSUSE
+    - many: have install return encryption keys for data and save,
+      improve tests
+    - overlord: add link participant for linkage transitions
+    - tests: lxd smoke test
+    - tests: add tests for fsck; cmd/s-b/initramfs-mounts: fsck ubuntu-
+      seed too
+    - tests: moving main suite from systems.sh to os.query tool
+    - tests: moving the core test suite from systems.sh to os.query tool
+    - cmd/snap-confine: mask host's apparmor config
+    - o/snapstate: move setting updated SnapState after error paths
+    - tests: add value to INSTANCE_KEY/regular
+    - spread, tests: tweaks for openSUSE
+    - cmd/snap-confine: update path to snap-device-helper in AppArmor
+      profile
+    - tests: new os.query tool
+    - overlord/snapshotstate/backend: specify tar format for snapshots
+    - tests/nested/manual/minimal-smoke: use 384MB of RAM for nested
+      UC20
+    - client,daemon,snap: auto-import does not error on managed devices
+    - interfaces: PTP hardware clock interface
+    - tests: use tests.backup tool
+    - many: verify that unit tests work with nosecboot tag and without
+      secboot package
+    - wrappers: do not error out on read-only /etc/dbus-1/session.d
+      filesystem on core18
+    - snapshots: import of a snapshot set
+    - tests: more output for sbuild test
+    - o/snapstate: re-order remove tasks for individual snap revisions
+      to remove current last
+    - boot: skip some unit tests when running as root
+    - o/assertstate: introduce
+      ValidationTrackingKey/ValidationSetTracking and basic methods
+    - many: allow ignoring running apps for specific request
+    - tests: allow the searching test to fail under load
+    - overlord/snapstate: inhibit startup while unlinked
+    - seed/seedwriter/writer.go: check DevModeConfinement for dangerous
+      features
+    - tests/main/sudo-env: snap bin is available on Fedora
+    - boot, overlord/devicestate: list trusted and managed assets
+      upfront
+    - gadget, gadget/install: support for ubuntu-save, create one during
+      install if needed
+    - spread-shellcheck: temporary workaround for deadlock, drop
+      unnecessary test
+    - snap: support different exit-code in the snap command
+    - logger: use strutil.KernelCommandLineSplit in
+      debugEnabledOnKernelCmdline
+    - logger: fix snapd.debug=1 parsing
+    - overlord: increase refresh postpone limit to 14 days
+    - spread-shellcheck: use single thread pool executor
+    - gadget/install,secboot: add debug messages
+    - spread-shellcheck: speed up spread-shellcheck even more
+    - spread-shellcheck: process paths from arguments in parallel
+    - tests: tweak error from tests.cleanup
+    - spread: remove workaround for openSUSE go issue
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - tests: new tests.backup tool
+    - tests: add tests.cleanup pop sub-command
+    - tests: migration of the main suite to snaps-state tool part 6
+    - tests: fix journal-state test
+    - cmd/snap-bootstrap/initramfs-mounts: split off new helper for misc
+      recover files
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - boot, gadget, bootloader: observer preserves managed bootloader
+      configs
+    - tests/nested/manual: add uc20 grade signed cloud-init test
+    - o/snapstate/autorefresh.go: eliminate race when launching
+      autorefresh
+    - daemon,snapshotstate: do not return "size" from Import()
+    - daemon: limit reading from snapshot import to Content-Length
+    - many: set/expect Content-Length header when importing snapshots
+    - github: switch from ::set-env command to environment file
+    - tests: migration of the main suite to snaps-state tool part 5
+    - client: cleanup the Client.raw* and Client.do* method families
+    - tests: moving main suite to snaps-state tool part 4
+    - client,daemon,snap: use constant for snapshot content-type
+    - many: fix typos and repeated "the"
+    - secboot: fix tpm connection leak when it's not enabled
+    - many: scaffolding for snapshots import API
+    - run-checks: run spread-shellcheck too
+    - interfaces: update network-manager interface to allow
+      ObjectManager access from unconfined clients
+    - tests: move core and regression suites to snaps-state tool
+    - tests: moving interfaces tests to snaps-state tool
+    - gadget: preserve files when indicated by content change observer
+    - tests: moving smoke test suite and some tests from main suite to
+      snaps-state tool
+    - o/snapshotstate: pass set id to backend.Open, update tests
+    - asserts/snapasserts: introduce ValidationSets
+    - o/snapshotstate: improve allocation of new set IDs
+    - boot: look at the gadget for run mode bootloader when making the
+      system bootable
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - usersession/userd: separate bus name ownership from defining
+      interfaces
+    - o/snapshotstate: set snapshot set id from its filename
+    - o/snapstate: move remove-related tests to snapstate_remove_test.go
+    - desktop/notification: switch ExpireTimeout to time.Duration
+    - desktop/notification: add unit tests
+    - snap: snap help output refresh
+    - tests/nested/manual/preseed: include a system-usernames snap when
+      preseeding
+    - tests: fix sudo-env test
+    - tests: fix nested core20 shellcheck bug
+    - tests/lib: move to new directory when restoring PWD, cleanup
+      unpacked unpacked snap directories
+    - desktop/notification: add bindings for FDO notifications
+    - dbustest: fix stale comment references
+    - many: move ManagedAssetsBootloader into TrustedAssetsBootloader,
+      drop former
+    - snap-repair: add uc20 support
+    - tests: print all the serial logs for the nested test
+    - o/snapstate/check_snap_test.go: mock osutil.Find{U,G}id to avoid
+      bug in test
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - osutil/group.go: treat all non-nil errs from user.Lookup{Group,}
+      as Unknown*
+    - asserts: deserialize grouping only once in Pool.AddBatch if needed
+    - gadget: allow content observer to have opinions about a change
+    - tests: new snaps-state command - part1
+    - o/assertstate: support refreshing any number of snap-declarations
+    - boot: use test helpers
+    - tests/core/snap-debug-bootvars: also check snap_mode
+    - many/apparmor: adjust rules for reading profile/ execing new
+      profiles for new kernel
+    - tests/core/snap-debug-bootvars: spread test for snap debug boot-
+      vars
+    - tests/lib/nested.sh: more little tweaks
+    - tests/nested/manual/grade-signed-above-testkeys-boot: enable kvm
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - overlord: explicitly set refresh-app-awareness in tests
+    - kernel: remove "edition" from kernel.yaml and add "update"
+    - spread: drop vendor from the packed project archive
+    - boot: fix debug bootloader variables dump on UC20 systems
+    - wrappers, systemd: allow empty root dir and conditionally do not
+      pass --root to systemctl
+    - tests/nested/manual: add test for grades above signed booting with
+      testkeys
+    - tests/nested: misc robustness fixes
+    - o/assertstate,asserts: use bulk refresh to refresh snap-
+      declarations
+    - tests/lib/prepare.sh: stop patching the uc20 initrd since it has
+      been updated now
+    - tests/nested/manual/refresh-revert-fundamentals: re-enable test
+    - update-pot: ignore .go files inside .git when running xgettext-go
+    - tests: disable part of the lxd test completely on 16.04.
+    - o/snapshotstate: tweak comment regarding snapshot filename
+    - o/snapstate: improve snapshot iteration
+    - bootloader: lk cleanups
+    - tests: update to support nested kvm without reboots on UC20
+    - tests/nested/manual/preseed: disable system-key check for 20.04
+      image
+    - spread.yaml: add ubuntu-20.10-64 to qemu
+    - store: handle v2 error when fetching assertions
+    - gadget: resolve device mapper devices for fallback device lookup
+    - tests/nested/cloud-init-many: simplify tests and unify
+      helpers/seed inputs
+    - tests: copy /usr/lib/snapd/info to correct directory
+    - check-pr-title.py * : allow "*" in the first part of the title
+    - many: typos and small test tweak
+    - tests/main/lxd: disable cgroup combination for 16.04 that is
+      failing a lot
+    - tests: make nested signing helpers less confusing
+    - tests: misc nested changes
+    - tests/nested/manual/refresh-revert-fundamentals: disable
+      temporarily
+    - tests/lib/cla_check: default to Python 3, tweaks, formatting
+    - tests/lib/cl_check.py: use python3 compatible code
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 Nov 2020 17:51:02 +0100
+
+snapd (2.47.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - o/configstate: create /etc/sysctl.d when applying early config
+      defaults
+    - cmd/snap-bootstrap/initramfs-mounts: also copy /etc/machine-id for
+      same IP addr
+    - packaging/{ubuntu,debian}: add liblzo2-dev as a dependency for
+      building snapd
+    - cmd/snap: allow snap help vs --all to diverge purposefully
+    - snap: snap help output refresh
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 08 Oct 2020 09:30:44 +0200
+
+snapd (2.47) xenial; urgency=medium
+
+  * New upstream release, LP: #1895929
+    - tests: fix nested core20 shellcheck bug
+    - many/apparmor: adjust rule for reading apparmor profile for new
+      kernel
+    - snap-repair: add uc20 support
+    - cmd/snap/auto-import: stop importing system user assertions from
+      initramfs mnts
+    - cmd/s-b/initramfs-mounts: use ConfigureTargetSystem for install,
+      recover modes
+    - gadget: resolve device mapper devices for fallback device lookup
+    - secboot: add boot manager profile to pcr protection profile
+    - sysconfig,o/devicestate: mv DisableNoCloud to
+      DisableAfterLocalDatasourcesRun
+    - tests: make gadget-reseal more robust
+    - tests: skip nested images pre-configuration by default
+    - tests: fix for basic20 test running on external backend and rpi
+    - tests: improve kernel reseal test
+    - boot: adjust comments, naming, log success around reseal
+    - tests/nested, fakestore: changes necessary to run nested uc20
+      signed/secured tests
+    - tests: add nested core20 gadget reseal test
+    - boot/modeenv: track unknown keys in Read and put back into modeenv
+      during Write
+    - interfaces/process-control: add sched_setattr to seccomp
+    - boot: with unasserted kernels reseal if there's a hint modeenv
+      changed
+    - client: bump the default request timeout to 120s
+    - configcore: do not error in console-conf.disable for install mode
+    - boot: streamline bootstate20.go reseal and tests changes
+    - boot: reseal when changing kernel
+    - cmd/snap/model: specify grade in the model command output
+    - tests: simplify
+      repack_snapd_snap_with_deb_content_and_run_mode_first_boot_tweaks
+    - test: improve logging in nested tests
+    - nested: add support to telnet to serial port in nested VM
+    - secboot: use the snapcore/secboot native recovery key type
+    - tests/lib/nested.sh: use more focused cloud-init config for uc20
+    - tests/lib/nested.sh: wait for the tpm socket to exist
+    - spread.yaml, tests/nested: misc changes
+    - tests: add more checks to disk space awareness spread test
+    - tests: disk space awareness spread test
+    - boot: make MockUC20Device use a model and MockDevice more
+      realistic
+    - boot,many: reseal only when meaningful and necessary
+    - tests/nested/core20/kernel-failover: add test for failed refresh
+      of uc20 kernel
+    - tests: fix nested to work with qemu and kvm
+    - boot: reseal when updating boot assets
+    - tests: fix snap-routime-portal-info test
+    - boot: verify boot chain file in seal and reseal tests
+    - tests: use full path to test-snapd-refresh.version binary
+    - boot: store boot chains during install, helper for checking
+      whether reseal is needed
+    - boot: add call to reseal an existing key
+    - boot: consider boot chains with unrevisioned kernels incomparable
+    - overlord: assorted typos and miscellaneous changes
+    - boot: group SealKeyModelParams by model, improve testing
+    - secboot: adjust parameters to buildPCRProtectionProfile
+    - strutil: add SortedListsUniqueMergefrom the doc comment:
+    - snap/naming: upgrade TODO to TODO:UC20
+    - secboot: add call to reseal an existing key
+    - boot: in seal.go adjust error message and function names
+    - o/snapstate: check available disk space in RemoveMany
+    - boot: build bootchains data for sealing
+    - tests: remove "set -e" from function only shell libs
+    - o/snapstate: disk space check on UpdateMany
+    - o/snapstate: disk space check with snap update
+    - snap: implement new `snap reboot` command
+    - boot: do not reorder boot assets when generating predictable boot
+      chains and other small tweaks
+    - tests: some fixes and improvements for nested execution
+    - tests/core/uc20-recovery: fix check for at least specific calls to
+      mock-shutdown
+    - boot: be consistent using bootloader.Role* consts instead of
+      strings
+    - boot: helper for generating secboot load chains from a given boot
+      asset sequence
+    - boot: tweak boot chains to support a list of kernel command lines,
+      keep track of model and kernel boot file
+    - boot,secboot: switch to expose and use snapcore/secboot load event
+      trees
+    - tests: use `nested_exec` in core{20,}-early-config test
+    - devicestate: enable cloud-init on uc20 for grade signed and
+      secured
+    - boot: add "rootdir" to baseBootenvSuite and use in tests
+    - tests/lib/cla_check.py: don't allow users.noreply.github.com
+      commits to pass CLA
+    - boot: represent boot chains, helpers for marshalling and
+      equivalence checks
+    - boot: mark successful with boot assets
+    - client, api: handle insufficient space error
+    - o/snapstate: disk space check with single snap install
+    - configcore: "service.console-conf.disable" is gadget defaults only
+    - packaging/opensuse: fix for /usr/libexec on TW, do not hardcode
+      AppArmor profile path
+    - tests: skip udp protocol in nfs-support test on ubuntu-20.10
+    - packaging/debian-sid: tweak code preparing _build tree
+    - many: move seal code from gadget/install to boot
+    - tests: remove workaround for cups on ubuntu-20.10
+    - client: implement RebootToSystem
+    - many: seed.Model panics now if called before LoadAssertions
+    - daemon: add /v2/systems "reboot" action API
+    - github: run tests also on push to release branches
+    - interfaces/bluez: let slot access audio streams
+    - seed,c/snap-bootstrap: simplify snap-bootstrap seed reading with
+      new seed.ReadSystemEssential
+    - interfaces: allow snap-update-ns to read /proc/cmdline
+    - tests: new organization for nested tests
+    - o/snapstate, features: add feature flags for disk space awareness
+    - tests: workaround for cups issue on 20.10 where default printer is
+      not configured.
+    - interfaces: update cups-control and add cups for providing snaps
+    - boot: keep track of the original asset when observing updates
+    - tests: simplify and fix tests for disk space checks on snap remove
+    - sysconfig/cloudinit.go: add AllowCloudInit and use GadgetDir for
+      cloud.conf
+    - tests/main: mv core specific tests to core suite
+    - tests/lib/nested.sh: reset the TPM when we create the uc20 vm
+    - devicestate: rename "mockLogger" to "logbuf"
+    - many: introduce ContentChange for tracking gadget content in
+      observers
+    - many: fix partion vs partition typo
+    - bootloader: retrieve boot chains from bootloader
+    - devicestate: add tests around logging in RequestSystemAction
+    - boot: handle canceled update
+    - bootloader: tweak doc comments (thanks Samuele)
+    - seed/seedwriter: test local asserted snaps with UC20 grade signed
+    - sysconfig/cloudinit.go: add DisableNoCloud to
+      CloudInitRestrictOptions
+    - many: use BootFile type in load sequences
+    - boot,bootloader: clarifications after the changes to introduce
+      bootloader.Options.Role
+    - boot,bootloader,gadget: apply new bootloader.Options.Role
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - testutil: add checkers for symbolic link target
+    - many: refactor tpm seal parameter setting
+    - boot/bootstate20: reboot to rollback to previous kernel
+    - boot: add unit test helpers
+    - boot: observe update & rollback of trusted assets
+    - interfaces/utf: Add MIRKey to u2f devices
+    - o/devicestate/devicestate_cloudinit_test.go: test cleanup for uc20
+      cloud-init tests
+    - many: check that users of BaseTest don't forget to consume
+      cleanups
+    - tests/nested/core20/tpm: verify trusted boot assets tracking
+    - github: run macOS job with Go 1.14
+    - many: misc doc-comment changes and typo fixes
+    - o/snapstate: disk space check with InstallMany
+    - many: cloud-init cleanups from previous PR's
+    - tests: running tests on opensuse leap 15.2
+    - run-checks: check for dirty build tree too
+    - vendor: run ./get-deps.sh to update the secboot hash
+    - tests: update listing test for "-dirty" versions
+    - overlord/devicestate: do not release the state lock when updating
+      gadget assets
+    - secboot: read kernel efi image from snap file
+    - snap: add size to the random access file return interface
+    - daemon: correctly parse Content-Type HTTP header.
+    - tests: account for apt-get on core18
+    - cmd/snap-bootstrap/initramfs-mounts: compute string outside of
+      loop
+    - mkversion.sh: simple hack to include dirty in version if the tree
+      is dirty
+    - cgroup,snap: track hooks on system bus only
+    - interfaces/systemd: compare dereferenced Service
+    - run-checks: only check files in git for misspelling
+    - osutil: add a package doc comment (via doc.go)
+    - boot: complain about reused asset name during initial install
+    - snapstate: installSize helper that calculates total size of snaps
+      and their prerequisites
+    - snapshots: export of snapshots
+    - boot/initramfs_test.go: reset boot vars on the bootloader for each
+      iteration
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Sep 2020 17:19:13 +0200
+
+snapd (2.46.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - interfaces: allow snap-update-ns to read
+      /proc/cmdline
+    - github: run macOS job with Go 1.14
+    - o/snapstate, features: add feature flag for disk space check on
+      remove
+    - tests: account for apt-get on core18
+    - mkversion.sh: include dirty in version if the tree
+      is dirty
+    - interfaces/systemd: compare dereferenced Service
+    - vendor.json: update mysterious secboot SHA again
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Sep 2020 17:42:54 +0200
+
+snapd (2.46) xenial; urgency=medium
+
+  * New upstream release, LP: #1891134
+    - logger: add support for setting snapd.debug=1 on kernel cmdline
+    - o/snapstate: check disk space before creating automatic snapshot
+      on remove
+    - boot, o/devicestate: observe existing recovery bootloader trusted
+      boot assets
+    - many: use transient scope for tracking apps and hooks
+    - features: add HiddenSnapFolder feature flag
+    - tests/lib/nested.sh: fix partition typo, unmount the image on uc20
+      too
+    - runinhibit: open the lock file in read-only mode in IsLocked
+    - cmd/s-b/initramfs-mounts: make recover -> run mode transition
+      automatic
+    - tests: update spread test for unknown plug/slot with snapctl is-
+      connected
+    - osutil: add OpenExistingLockForReading
+    - kernel: add kernel.Validate()
+    - interfaces: add vcio interface
+    - interfaces/{docker,kubernetes}-support: load overlay and support
+      systemd cgroup driver
+    - tests/lib/nested.sh: use more robust code for finding what loop
+      dev we mounted
+    - cmd/snap-update-ns: detach all bind-mounted file
+    - snap/snapenv: set SNAP_REAL_HOME
+    - packaging: umount /snap on purge in containers
+    - interfaces: misc policy updates xlvi
+    - secboot,cmd/snap-bootstrap: cross-check partitions before
+      unlocking, mounting
+    - boot: copy boot assets cache to new root
+    - gadget,kernel: add new kernel.{Info,Asset} struct and helpers
+    - o/hookstate/ctlcmd: make is-connected check whether the plug or
+      slot exists
+    - tests: find -ignore_readdir_race when scanning cgroups
+    - interfaces/many: deny arbitrary desktop files and misc from
+      /usr/share
+    - tests: use "set -ex" in prep-snapd-in-lxd.sh
+    - tests: re-enable udisks test on debian-sid
+    - cmd/snapd-generator: use PATH fallback if PATH is not set
+    - tests: disable udisks2 test on arch linux
+    - github: use latest/stable go, not latest/edge
+    - tests: remove support for ubuntu 19.10 from spread tests
+    - tests: fix lxd test wrongly tracking 'latest'
+    - secboot: document exported functions
+    - cmd: compile snap gdbserver shim correctly
+    - many: correctly calculate the desktop file prefix everywhere
+    - interfaces: add kernel-crypto-api interface
+    - corecfg: add "system.timezone" setting to the system settings
+    - cmd/snapd-generator: generate drop-in to use fuse in container
+    - cmd/snap-bootstrap/initramfs-mounts: tweak names, add comments
+      from previous PR
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - secboot,cmd/snap-bootstrap: don't import boot package from secboot
+    - cmd/snap-bootstrap/initramfs-mounts: call systemd-mount instead of
+      the-tool
+    - tests: work around broken update of systemd-networkd
+    - tests/main/install-fontconfig-cache-gen: enhance test by
+      verifying, add fonts to test
+    - o/devicestate: wrap asset update observer error
+    - boot: refactor such that bootStateUpdate20 mainly carries Modeenv
+    - mkversion.sh: disallow changelog versions that have git in it, if
+      we also have git version
+    - interfaces/many: miscellaneous updates for strict microk8s
+    - snap: fix repeated "cannot list recovery system" and add test
+    - boot: track trusted assets during initial install, assets cache
+    - vendor: update secboot to fix key data validation
+    - tests: unmount FUSE file-systems from XDG runtime dir
+    - overlord/devicestate: workaround non-nil interface with nil struct
+    - sandbox/cgroup: remove temporary workaround for multiple cgroup
+      writers
+    - sandbox/cgroup: detect dangling v2 cgroup
+    - bootloader: add helper for creating a bootloader based on gadget
+    - tests: support different images on nested execution
+    - many: reorg cmd/snapinfo.go into snap and new client/clientutil
+    - packaging/arch: use external linker when building statically
+    - tests: cope with ghost cgroupv2
+    - tests: fix issues related to restarting systemd-logind.service
+    - boot, o/devicestate: TrustedAssetUpdateObserver stubs, hook up to
+      gadget updates
+    - vendor: update github.com/kr/pretty to fix diffs of values with
+      pointer cycles
+    - boot: move bootloaderKernelState20 impls to separate file
+    - .github/workflows: move snap building to test.yaml as separate
+      cached job
+    - tests/nested/manual/minimal-smoke: run core smoke tests in a VM
+      meeting minimal requirements
+    - osutil: add CommitAs to atomic file
+    - gadget: introduce content update observer
+    - bootloader: introduce TrustedAssetsBootloader, implement for grub
+    - o/snapshotstate: helpers for calculating disk space needed for an
+      automatic snapshot
+    - gadget/install: retrieve command lines from bootloader
+    - boot/bootstate20: unify commit method impls, rm
+      bootState20MarkSuccessful
+    - tests: add system information and image information when debug
+      info is displayed
+    - tests/main/cgroup-tracking: try to collect some information about
+      cgroups
+    - boot: introduce current_boot_assets and
+      current_recovery_boot_assets to modeenv
+    - tests: fix for timing issues on journal-state test
+    - many: remove usage and creation of hijacked pid cgroup
+    - tests: port regression-home-snap-root-owned to tests.session
+    - tests: run as hightest via tests.session
+    - github: run CLA checks on self-hosted workers
+    - github: remove Ubuntu 19.10 from actions workflow
+    - tests: remove End-Of-Life opensuse/fedora releases
+    - tests: remove End-Of-Life releases from spread.yaml
+    - tests: fix debug section of appstream-id test
+    - interfaces: check !b.preseed earlier
+    - tests: work around bug in systemd/debian
+    - boot: add deepEqual, Copy helpers for Modeenv to simplify
+      bootstate20 refactor
+    - cmd: add new "snap recovery" command
+    - interfaces/systemd: use emulation mode when preseeding
+    - interfaces/kmod: don't load kernel modules in kmod backend when
+      preseeding
+    - interfaces/udev: do not reload udevadm rules when preseeding
+    - cmd/snap-preseed: use snapd from the deb if newer than from seeds
+    - boot: fancy marshaller for modeenv values
+    - gadget, osutil: use atomic file copy, adjust tests
+    - overlord: use new tracking cgroup for refresh app awareness
+    - github: do not skip gofmt with Go 1.9/1.10
+    - many: introduce content write observer, install mode glue, initial
+      seal stubs
+    - daemon,many: switch to use client.ErrorKind and drop the local
+      errorKind...
+    - tests: new parameters for nested execution
+    - client: move all error kinds into errors.go and add doc strings
+    - cmd/snap: display the error in snap debug seeding if seeding is in
+      error
+    - cmd/snap/debug/seeding: use unicode for proper yaml
+    - tests/cmd/snap-bootstrap/initramfs-mounts: add test case for empty
+      recovery_mode
+    - osutil/disks: add mock disk and tests for happy path of mock disks
+    - tests: refresh/revert snapd in uc20
+    - osutil/disks: use a dedicated error to indicate a fs label wasn't
+      found
+    - interfaces/system-key: in WriteSystemKey during tests, don't call
+      ParserFeatures
+    - boot: add current recovery systems to modeenv
+    - bootloader: extend managed assets bootloader interface to compose
+      a candidate command line
+    - interfaces: make the unmarshal test match more the comment
+    - daemon/api: use pointers to time.Time for debug seeding aspect
+    - o/ifacestate: update security profiles in connect undo handler
+    - interfaces: add uinput interface
+    - cmd/snap-bootstrap/initramfs-mounts: add doSystemdMount + unit
+      tests
+    - o/devicestate: save seeding/preseeding times for use with debug
+      seeding api
+    - cmd/snap/debug: add "snap debug seeding" command for preseeding
+      debugging
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+    - bootloader: compose command line with mode and extra arguments
+    - cmd/snap, daemon: detect and bail purge on multi-snap
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - interfaces/builtin/multipass: replace U+00A0 no-break space with
+      simple space
+    - bootloader/assets: generate bootloader assets from files
+    - many/tests/preseed: reset the preseeded images before preseeding
+      them
+    - tests: drop accidental accents from e
+    - secboot: improve key sealing tests
+    - tests: replace _wait_for_file_change with retry
+    - tests: new fs-state which replaces the files.sh helper
+    - sysconfig/cloudinit_test.go: add test for initramfs case, rm "/"
+      from path
+    - cmd/snap: track started apps and hooks
+    - tests/main/interfaces-pulseaudio: disable start limit checking for
+      pulseaudio service
+    - api: seeding debug api
+    - .github/workflows/snap-build.yaml: build the snapd snap via GH
+      Actions too
+    - tests: moving journalctl.sh to a new journal-state tool
+    - tests/nested/manual: add spread tests for cloud-init vuln
+    - bootloader/assets: helpers for registering per-edition snippets,
+      register snippets for grub
+    - data,packaging,wrappers: extend D-Bus service activation search
+      path
+    - spread: add opensuse 15.2 and tumbleweed for qemu
+    - overlord,o/devicestate: restrict cloud-init on Ubuntu Core
+    - sysconfig/cloudinit: add RestrictCloudInit
+    - cmd/snap-preseed: check that target path exists and is a directory
+      on --reset
+    - tests: check for pids correctly
+    - gadget,gadget/install: refactor partition table update
+    - sysconfig/cloudinit: add CloudInitStatus func + CloudInitState
+      type
+    - interface/fwupd: add more policies for making fwupd upstream
+      strict
+    - tests: new to-one-line tool which replaces the strings.sh helper
+    - interfaces: new helpers to get and compare system key, for use
+      with seeding debug api
+    - osutil, many: add helper for checking whether the process is a go
+      test binary
+    - cmd/snap-seccomp/syscalls: add faccessat2
+    - tests: adjust xdg-open after launcher changes
+    - tests: new core config helper
+    - usersession/userd: do not modify XDG_DATA_DIRS when calling xdg-
+      open
+    - cmd/snap-preseed: handle relative chroot path
+    - snapshotstate: move sizer to osutil.Sizer()
+    - tests/cmd/snap-bootstrap/initramfs-mounts: rm duplicated env ref
+      kernel tests
+    - gadget/install,secboot: use snapcore/secboot luks2 api
+    - boot/initramfs_test.go: add Commentf to more Assert()'s
+    - tests/lib: account for changes in arch package file name extension
+    - bootloader/bootloadertest: fix comment typo
+    - bootloader: add helper for getting recovery system environment
+      variables
+    - tests: preinstall shellcheck and run tests on focal
+    - strutil: add a helper for parsing kernel command line
+    - osutil: add CheckFreeSpace helper
+    - secboot: update tpm connection error handling
+    - packaging, cmd/snap-mgmt, tests: remove modules files on purge
+    - tests: add tests.cleanup helper
+    - packaging: add "ca-certificates" to build-depends
+    - tests: more checks in core20 early config spread test
+    - tests: fix some snapstate tests to use pointers for
+      snapmgrTestSuite
+    - boot: better naming of helpers for obtaining kernel command line
+    - many: use more specific check for unit test mocking
+    - systemd/escape: fix issues with "" and "\t" handling
+    - asserts: small improvements and corrections for sequence-forming
+      assertions' support
+    - boot, bootloader: query kernel command line of run mod and
+      recovery mode systems
+    - snap/validate.go: disallow snap layouts with new top-level
+      directories
+    - tests: allow to add a new label to run nested tests as part of PR
+      validation
+    - tests/core/gadget-update-pc: port to UC20
+    - tests: improve nested tests flexibility
+    - asserts: integer headers: disallow prefix zeros and make parsing
+      more uniform
+    - asserts: implement Database.FindSequence
+    - asserts: introduce SequenceMemberAfter in the asserts backstores
+    - spread.yaml: remove tests/lib/tools from PATH
+    - overlord: refuse to install snaps whose activatable D-Bus services
+      conflict with installed snaps
+    - tests: shorten lxd-state undo-mount-changes
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - tests: fix argument handling of apt-state
+    - tests: rename lxd-tool to lxd-state
+    - tests: rename user-tool to user-state, fix --help
+    - interfaces: add gconf interface
+    - sandbox/cgroup: avoid parsing security tags twice
+    - tests: rename version-tool to version-compare
+    - cmd/snap-update-ns: handle anomalies better
+    - tests: fix call to apt.Package.mark_install(auto_inst=True)
+    - tests: rename mountinfo-tool to mountinfo.query
+    - tests: rename memory-tool to memory-observe-do
+    - tests: rename invariant-tool to tests.invariant
+    - tests: rename apt-tool to apt-state
+    - many: managed boot config during run mode setup
+    - asserts: introduce the concept of sequence-forming assertion types
+    - tests: tweak comments/output in uc20-recovery test
+    - tests/lib/pkgdb: do not use quiet when purging debs
+    - interfaces/apparmor: allow snap-specific /run/lock
+    - interfaces: add system-source-code for access to /usr/src
+    - sandbox/cgroup: extend SnapNameFromPid with tracking cgroup data
+    - gadget/install: move udev trigger to gadget/install
+    - many: make nested spread tests more reliable
+    - tests/core/uc20-recovery: apply hack to get gopath in recover mode
+      w/ external backend
+    - tests: enable tests on uc20 which now work with the real model
+      assertion
+    - tests: enable system-snap-refresh test on uc20
+    - gadget, bootloader: preserve managed boot assets during gadget
+      updates
+    - tests: fix leaked dbus-daemon in selinux-clean
+    - tests: add servicestate.Control tests
+    - tests: fix "restart.service"
+    - wrappers: helper for enabling services - extract and move enabling
+      of services into a helper
+    - tests: new test to validate refresh and revert of kernel and
+      gadget on uc20
+    - tests/lib/prepare-restore: collect debug info when prepare purge
+      fails
+    - bootloader: allow managed bootloader to update its boot config
+    - tests: Remove unity test from nightly test suite
+    - o/devicestate: set mark-seeded to done in the task itself
+    - tests: add spread test for disconnect undo caused by failing
+      disconnect hook
+    - sandbox/cgroup: allow discovering PIDs of given snap
+    - osutil/disks: support IsDecryptedDevice for mountpoints which are
+      dm devices
+    - osutil: detect autofs mounted in /home
+    - spread.yaml: allow amazon-linux-2-64 qemu with
+      ec2-user/ec2-user
+    - usersession: support additional zoom URL schemes
+    - overlord: mock timings.DurationThreshold in TestNewWithGoodState
+    - sandbox/cgroup: add tracking helpers
+    - tests: detect stray dbus-daemon
+    - overlord: refuse to install snaps providing user daemons on Ubuntu
+      14.04
+    - many: move encryption and installer from snap-boostrap to gadget
+    - o/ifacestate: fix connect undo handler
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - bootloader: introduce managed bootloader, implement for grub
+    - tests: fix incorrect check in smoke/remove test
+    - asserts,seed: split handling of essential/not essential model
+      snaps
+    - gadget: fix typo in mounted filesystem updater
+    - gadget: do only one mount point lookup in mounted fs updater
+    - tests/core/snap-auto-mount: try to make the test more robust
+    - tests: adding ubuntu-20.04 to google-sru backend
+    - o/servicestate: add updateSnapstateServices helper
+    - bootloader: pull recovery grub config from internal assets
+    - tests/lib/tools: apply linger workaround when needed
+    - overlord/snapstate: graceful handling of denied "managed" refresh
+      schedule
+    - snapstate: fix autorefresh from classic->strict
+    - overlord/configstate: add system.kernel.printk.console-loglevel
+      option
+    - tests: fix assertion disk handling for nested UC systems
+    - snapstate: use testutil.HostScaledTimeout() in snapstate tests
+    - tests: extra worker for google-nested backend to avoid timeout
+      error on uc20
+    - snapdtool: helper to check whether the current binary is reexeced
+      from a snap
+    - tests: mock servicestate in api tests to avoid systemctl checks
+    - many: rename back snap.Info.GetType to Type
+    - tests/lib/cla_check: expect explicit commit range
+    - osutil/disks: refactor diskFromMountPointImpl a bit
+    - o/snapstate: service-control task handler
+    - osutil: add disks pkg for associating mountpoints with
+      disks/partitions
+    - gadget,cmd/snap-bootstrap: move partitioning to gadget
+    - seed: fix LoadEssentialMeta when gadget is not loaded
+    - cmd/snap: Debian does not allow $SNAP_MOUNT_DIR/bin in sudo
+      secure_path
+    - asserts: introduce new assertion validation-set
+    - asserts,daemon: add support for "serials" field in system-user
+      assertion
+    - data/sudo: drop a failed sudo secure_path workaround
+    - gadget: mv encodeLabel to osutil/disks.EncodeHexBlkIDFormat
+    - boot, snap-bootstrap: move initramfs-mounts logic to boot pkg
+    - spread.yaml: update secure boot attribute name
+    - interfaces/block_devices: add NVMe subsystem devices, support
+      multipath paths
+    - tests: use the "jq" snap from the edge channel
+    - tests: simplify the tpm test by removing the test-snapd-mokutil
+      snap
+    - boot/bootstate16.go: clean snap_try_* vars when not in Trying
+      status too
+    - tests/main/sudo-env: check snap path under sudo
+    - tests/main/lxd: add test for snaps inside nested lxd containers
+      not working
+    - asserts/internal: expand errors about invalid serialized grouping
+      labels
+    - usersession/userd: add msteams url support
+    - tests/lib/prepare.sh: adjust comment about sgdisk
+    - tests: fix how gadget pc is detected when the snap does not exist
+      and ls fails
+    - tests: move a few more tests to snapstate_update_test.go
+    - tests/main: add spread test for running svc from install hook
+    - tests/lib/prepare: increase the size of the uc16/uc18 partitions
+    - tests/special-home-can-run-classic-snaps: re-enable
+    - workflow: test PR title as part of the static checks again
+    - tests/main/xdg-open-compat: backup and restore original xdg-open
+    - tests: move update-related tests to snapstate_update_test.go
+    - cmd,many: move Version and bits related to snapd tools to
+      snapdtool, merge cmdutil
+    - tests/prepare-restore.sh: reset-failed systemd-journald before
+      restarting
+    - interfaces: misc small interface updates
+    - spread: use find rather than recursive ls, skip mounted snaps
+    - tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls
+      /var/lib/snapd
+    - tests: enable snap-auto-mount test on core20
+    - cmd/snap: do not show $PATH warning when executing under sudo on a
+      known distro
+    - asserts/internal: add some iteration benchmarks
+    - sandbox/cgroup: improve pid parsing code
+    - snap: add new `snap run --experimental-gdbserver` option
+    - asserts/internal: limit Grouping size switching to a bitset
+      representationWe don't always use the bit-set representation
+      because:
+    - snap: add an activates-on property to apps for D-Bus activation
+    - dirs: delete unused Cloud var, fix typo
+    - sysconfig/cloudinit: make callers of DisableCloudInit use
+      WritableDefaultsDir
+    - tests: fix classic ubuntu core transition auth
+    - tests: fail in setup_reflash_magic() if there is snapd state left
+    - tests: port interfaces-many-core-provided to tests.session
+    - tests: wait after creating partitions with sfdisk
+    - bootloader: introduce bootloarder assets, import grub.cfg with an
+      edition marker
+    - riscv64: bump timeouts
+    - gadget: drop dead code, hide exports that are not used externally
+    - tests: port 2 uc20 part1
+    - tests: fix bug waiting for snap command to be ready
+    - tests: move try-related tests to snapstate_try_test.go
+    - tests: add debug for 20.04 prepare failure
+    - travis.yml: removed, all our checks run in GH actions now
+    - tests: clean up up the use of configcoreSuite in the configcore
+      tests
+    - sandbox/cgroup: remove redundant pathOfProcPidCgroup
+    - sandbox/cgroup: add tests for ParsePids
+    - tests: fix the basic20 test for uc20 on external backend
+    - tests: use configcoreSuite in journalSuite and remove some
+      duplicated code
+    - tests: move a few more tests to snapstate_install_test
+    - tests: assorted small patches
+    - dbusutil/dbustest: separate license from package
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+    - tests: check that host settings like hostname are settable on core
+    - tests: port xdg-settings test to tests.session
+    - tests: port snap-handle-link test to tests.session
+    - arch: add riscv64
+    - tests: core20 early defaults spread test
+    - tests: move install tests from snapstate_test.go to
+      snapstate_install_test.go
+    - github: port macOS sanity checks from travis
+    - data/selinux: allow checking /var/cache/app-info
+    - o/devicestate: core20 early config from gadget defaults
+    - tests: autoremove after removing lxd in preseed-lxd test
+    - secboot,cmd/snap-bootstrap: add tpm sealing support to secboot
+    - sandbox/cgroup: move FreezerCgroupDir from dirs.go
+    - tests: update the file used to detect the boot path on uc20
+    - spread.yaml: show /var/lib/snapd in debug
+    - cmd/snap-bootstrap/initramfs-mounts: also copy systemd clock +
+      netplan files
+    - snap/naming: add helpers to parse app and hook security tags
+    - tests: modernize retry tool
+    - tests: fix and trim debug section in xdg-open-portal
+    - tests: modernize and use snapd.tool
+    - vendor: update to latest github.com/snapcore/bolt for riscv64
+    - cmd/snap-confine: add support for libc6-lse
+    - interfaces: miscellaneous policy updates xlv
+    - interfaces/system-packages-doc: fix typo in variable names
+    - tests: port interfaces-calendar-service to tests.session
+    - tests: install/run the lzo test snap too
+    - snap: (small) refactor of `snap download` code for
+      testing/extending
+    - data: fix shellcheck warnings in snapd.sh.in
+    - packaging: disable buildmode=pie for riscv64
+    - tests: install test-snapd-rsync snap from edge channel
+    - tests: modernize tests.session and port everything using it
+    - tests: add ubuntu 20.10 to spread tests
+    - cmd/snap/remove: mention snap restore/automatic snapshots
+    - dbusutil: move all D-Bus helpers and D-Bus test helpers
+    - wrappers: pass 'disable' flag to StopServices wrapper
+    - osutil: enable riscv64 build
+    - snap/naming: add ParseSecurityTag and friends
+    - tests: port document-portal-activation to session-tool
+    - bootloader: rename test helpers to reflect we are mocking EFI boot
+      locations
+    - tests: disable test of nfs v3 with udp proto on debian-sid
+    - tests: plan to improve the naming and uniformity of utilities
+    - tests: move *-tool tests to their own suite
+    - snap-bootstrap: remove sealed key file on reinstall
+    - bootloader/ubootenv: don't panic with an empty uboot env
+    - systemd: rename actualFsTypeAndMountOptions to
+      hostFsTypeAndMountOptions
+    - daemon: fix filtering of service-control changes for snap.app
+    - tests: spread test for preseeding in lxd container
+    - tests: fix broken snapd.session agent.socket
+    - wrappers: add RestartServices function and ReloadOrRestart to
+      systemd
+    - o/cmdstate: handle ignore flag on exec-command tasks
+    - gadget: make ext4 filesystems with or without metadata checksum
+    - tests: update statx test to run on all LTS releases
+    - configcore: show better error when disabling services
+    - interfaces: add hugepages-control
+    - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
+    - tests: run ubuntu-20.04-* tests on all ubuntu-2* releases
+    - tests: skip interfaces-openvswitch for centos 8 in nightly suite
+    - tests: reload systemd --user for root, if present
+    - tests: reload systemd after editing /etc/fstab
+    - tests: add missing dependencies needed for sbuild test on debian
+    - tests: reload systemd after removing pulseaudio
+    - image, tests: core18 early config.
+    - interfaces: add system-packages-doc interface
+    - cmd/snap-preseed, systemd: fix handling of fuse.squashfuse when
+      preseeding
+    - interfaces/fwupd: allow bind mount to /boot on core
+    - tests: improve oom-vitality tests
+    - tests: add fedora 32 to spread.yaml
+    - config: apply vitality-hint immediately when the config changes
+    - tests: port snap-routine-portal-info to session-tool
+    - configcore: add "service.console-conf.disable" config option
+    - tests: port xdg-open to session-tool
+    - tests: port xdg-open-compat to session-tool
+    - tests: port interfaces-desktop-* to session-tool
+    - spread.yaml: apply yaml formatter/linter
+    - tests: port interfaces-wayland to session-tool
+    - o/devicestate: refactor current system handling
+    - snap-mgmt: perform cleanup of user services
+    - snap/snapfile,squashfs: followups from 8729
+    - boot, many: require mode in modeenv
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests: log stderr from dbus-monitor
+    - packaging: build cmd/snap and cmd/snap-bootstrap with nomanagers
+      tag
+    - snap/squashfs: also symlink snap Install with uc20 seed snap dir
+      layout
+    - interfaces/builtin/desktop: do not mount fonts cache on distros
+      with quirks
+    - data/selinux: allow snapd to remove/create the its socket
+    - testutil/exec.go: set PATH after running shellcheck
+    - tests: silence stderr from dbus-monitor
+    - snap,many: mv Open to snapfile pkg to support add'l options to
+      Container methods
+    - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
+      gadget
+    - github: remove workaround for bug 133 in actions/cache
+    - tests: remove dbus.sh
+    - cmd/snap-preseed: improve mountpoint checks of the preseeded
+      chroot
+    - spread.yaml: add ps aux to debug section
+    - github: run all spread systems in a single go with cached results
+    - test: session-tool cli tweaks
+    - asserts: rest of the Pool API
+    - tests: port interfaces-network-status-classic to session-tool
+    - packaging: remove obsolete 16.10,17.04 symlinks
+    - tests: setup portals before starting user session
+    - o/devicestate: typo fix
+    - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
+      devices
+    - cmd/snap/model: support store, system-user-authority keys in
+      --verbose
+    - o/devicestate: raise conflict when requesting system action while
+      seeding
+    - tests: detect signs of crashed snap-confine
+    - tests: sign kernel and gadget to run nested tests using current
+      snapd code
+    - tests: remove gnome-online-accounts we install
+    - tests: fix the issue where all the tests were executed on secboot
+      system
+    - tests: port interfaces-accounts-service to session-tool
+    - interfaces/network-control: bring /var/lib/dhcp from host
+    - image,cmd/snap,tests: add support for store-wide cohort keys
+    - configcore: add nomanagers buildtag for conditional build
+    - tests: port interfaces-password-manager-service to session-tool
+    - o/devicestate: cleanup system actions supported by recover mode
+    - snap-bootstrap: remove create-partitions and update tests
+    - tests: fix nested tests
+    - packaging/arch: update PKGBUILD to match one in AUR
+    - tests: port interfaces-location-control to session-tool
+    - tests: port interfaces-contacts-service to session-tool
+    - state: log task errors in the journal too
+    - o/devicestate: change how current system is reported for different
+      modes
+    - devicestate: do not report "ErrNoState" for seeded up
+    - tests: add a note about broken test sequence
+    - tests: port interfaces-autopilot-introspection to session-tool
+    - tests: port interfaces-dbus to session-tool
+    - packaging: update sid packaging to match 16.04+
+    - tests: enable degraded test on uc20
+    - c/snaplock/runinhibit: add run inhibition operations
+    - tests: detect and report root-owned files in /home
+    - tests: reload root's systemd --user after snapd tests
+    - tests: test registration with serial-authority: [generic]
+    - cmd/snap-bootstrap/initramfs-mounts: copy auth.json and macaroon-
+      key in recover
+    - tests/mount-ns: stop binfmt_misc mount unit
+    - cmd/snap-bootstrap/initramfs-mounts: use booted kernel partition
+      uuid if available
+    - daemon, tests: indicate system mode, test switching to recovery
+      and back to run
+    - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
+      denials
+    - tests/mount-ns: update to reflect new UEFI boot mode
+    - usersession,tests: clean ups for userd/settings.go and move
+      xdgopenproxy under usersession
+    - tests: disable mount-ns test
+    - tests: test user belongs to systemd-journald, on core20
+    - tests: run core/snap-set-core-config on uc20 too
+    - tests: remove generated session-agent units
+    - sysconfig: use new _writable_defaults dir to create cloud config
+    - cmd/snap-bootstrap/initramfs-mounts: cosmetic changes in prep for
+      future work
+    - asserts: make clearer that with label we mean a serialized label
+    - cmd/snap-bootstrap: tweak recovery trigger log messages
+    - asserts: introduce PoolTo 
+    - userd: allow setting default-url-scheme-handler
+    - secboot: append uuid to ubuntu-data when decrypting
+    - o/configcore: pass extra options to FileSystemOnlyApply
+    - tests: add dbus-user-session to bionic and reorder package names
+    - boot, bootloader: adjust comments, expand tests
+    - tests: improve debugging of user session agent tests
+    - packaging: add the inhibit directory
+    - many: add core.resiliance.vitality-hint config setting
+    - tests: test adjustments and fixes for recently published images
+    - cmd/snap: coldplug auto-import assertions from all removable
+      devices
+    - secboot,cmd/snap-bootstrap: move initramfs-mounts tpm access to
+      secboot
+    - tests: not fail when boot dir cannot be determined
+    - tests: new directory used to store the cloud images on gce
+    - tests: inject snapd from edge into seeds of the image in manual
+      preseed test
+    - usersession/agent,wrappers: fix races between Shutdown and Serve
+    - tests: add dependency needed for next upgrade of bionic
+    - tests: new test user is used for external backend
+    - cmd/snap: fix the order of positional parameters in help output
+    - tests: don't create root-owned things in ~test
+    - tests/lib/prepare.sh: delete patching of the initrd
+    - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
+      as well
+    - progress: tweak multibyte label unit test data
+    - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline
+    - gadget: fix fallback device lookup for 'mbr' type structures
+    - configcore: only reload journald if systemd is new enough
+    - cmd/snap-boostrap, boot: use /run/mnt/data instead of ubuntu-data
+    - wrappers: allow user mode systemd daemons
+    - progress: fix progress bar with multibyte duration units
+    - tests: fix raciness in pulseaudio test
+    - asserts/internal: introduce Grouping and Groupings
+    - tests: remove user.sh
+    - tests: pair of follow-ups from earlier reviews
+    - overlord/snapstate: warn of refresh/postpone events
+    - configcore,tests: use daemon-reexec to apply watchdog config
+    - c/snap-bootstrap: check mount states via initramfsMountStates
+    - store: implement DownloadAssertions
+    - tests: run smoke test with different bases
+    - tests: port user-mounts test to session-tool
+    - store: handle error-list in fetch-assertions results
+    - tests: port interfaces-audio-playback-record to session-tool
+    - data/completion: add `snap` command completion for zsh
+    - tests/degraded: ignore failure in systemd-vconsole-setup.service
+    - image: stub implementation of image.Prepare for darwin
+    - tests: session-tool --restore -u stops user-$UID.slice
+    - o/ifacestate/handlers.go: fix typo
+    - tests: port pulseaudio test to session-tool
+    - tests: port user-session-env to session-tool
+    - tests: work around journald bug in core16
+    - tests: add debug to core-persistent-journal test
+    - tests: port selinux-clean to session-tool
+    - tests: port portals test to session-tool, fix portal tests on sid
+    - tests: adding option --no-install-recommends option also when
+      install all the deps
+    - tests: add session-tool --has-systemd-and-dbus
+    - packaging/debian-sid: add gcc-multilib to build deps
+    - osutil: expand FileLock to support shared locks and more
+    - packaging: stop depending on python-docutils
+    - store,asserts,many: support the new action fetch-assertions
+    - tests: port snap-session-agent-* to session-tool
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - tests: fix for preseeding failures
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 25 Aug 2020 17:26:21 +0200
+
+snapd (2.45.3.1) xenial; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - o/ifacestate: fix bug in snapsWithSecurityProfiles
+    - tests/main/selinux-clean: workaround SELinux denials triggered by
+      linger setup on Centos8
+
+ -- Samuele Pedroni <pedronis@lucediurna.net>  Tue, 28 Jul 2020 21:43:38 +0200
+
+snapd (2.45.3) xenial; urgency=medium
+
+  * New upstream release, LP: #1875071
+    - many: backport _writable_defaults dir changes
+    - tests: fix incorrect check in smoke/remove test
+    - cmd/snap-bootstrap,seed: backport of uc20 PRs
+    - tests: avoid exit when nested type var is not defined
+    - cmd/snap-preseed: backport fixes
+    - interfaces: optimize rules of multiple connected iio/i2c/spi plugs
+    - many: cherry-picks for 2.45, gh-action, test fixes
+    - tests/lib: account for changes in arch package file name extension
+    - postrm, snap-mgmt: cleanup modules and other cherry-picks
+    - snap-confine: don't die if a device from sysfs path cannot be
+      found by udev
+    - data/selinux: update policy to allow forked processes to call
+      getpw*()
+    - tests/main/interfaces-time-control: exercise setting time via date
+    - interfaces/builtin/time-control: allow POSIX clock API
+    - usersession/userd: add "slack" to the white list of URL schemes
+      handled by xdg-open
+
+ -- Zygmunt Krynicki <me@zygoon.pl>  Mon, 27 Jul 2020 12:01:14 +0200
+
+snapd (2.45.2) xenial; urgency=medium
+
+  * SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open
+    implementation
+    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
       variable modification when calling the system xdg-open. Patch
       thanks to James Henstridge
-    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
-      may autostart on next use. Patch thanks to Michael Vogt
+    - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is
+      restarted. Patch thanks to Michael Vogt
     - CVE-2020-11934
     - LP: #1880085
+  * SECURITY UPDATE: arbitrary code execution vulnerability on core
+    devices with access to physical removable media
+    - devicestate: Disable/restrict cloud-init after seeding.
+    - CVE-2020-11933
+    - LP: #1879530
 
- -- Emilia Torino <emilia.torino@canonical.com>  Fri, 10 Jul 2020 10:59:20 -0300
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 10 Jul 2020 20:06:29 +0200
 
-snapd (2.45.1+20.04) focal; urgency=medium
+snapd (2.45.1) xenial; urgency=medium
 
   * New upstream release, LP: #1875071
     - data/selinux: allow checking /var/cache/app-info
     - cmd/snap-confine: add support for libc6-lse
-    - interfaces: miscellanious policy updates xlv
+    - interfaces: miscellaneous policy updates xlv
     - snap-bootstrap: remove sealed key file on reinstall
     - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
     - gadget: make ext4 filesystems with or without metadata checksum
@@ -422,6 +1704,35 @@
 
  -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 May 2020 17:17:57 +0200
 
+snapd (2.44.5) xenial; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - spread.yaml: adding more workers for ubuntu 20.04
+    - packaging: stop depending on python-docutils on opensuse
+    - spread.yaml: do not run ubuntu-core-20-64 with snapd 2.44, snapd
+      is not recent enough to drive ubuntu-core-20
+    - spread.yaml: Preserve size for centos images on spread.yaml
+    - spread.yaml: use non-uefi enabled image for uc20
+    - tests: ensure $cache_dir is actually available
+    - tests: disable preseed tests, they work in master but require too
+      much cherry-picking here
+    - travis.yml: remove go/master unit tests from 2.44
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 30 Apr 2020 09:09:22 +0200
+
+snapd (2.44.4) xenial; urgency=medium
+
+  * New upstream release, LP: #1864808
+    - packaging/fedora: disable FIPS compliant crypto for static
+      binaries
+    - interfaces/firewall-control: allow -legacy and -nft for core20
+    - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
+      syscalls
+    - tests: 16.04 and 18.04 now have mediating pulseaudio
+    - tests: ignore user@12345.service hierarchy
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Apr 2020 08:32:56 +0200
+
 snapd (2.44.3) xenial; urgency=medium
 
   * New upstream release, LP: #1864808
@@ -3576,7 +4887,7 @@
     - logger: try to not have double dates
     - debian: use deb-systemd-invoke instead of systemctl directly
     - tests: run all main tests on core18
-    - many: finish sharing a single TaskRunner with all the the managers
+    - many: finish sharing a single TaskRunner with all the managers
     - interfaces/repo: added AllHotplugInterfaces helper
     - snapstate: ensure kernel-track is honored on switch/refresh
     - overlord/ifacestate: support implicit slots on snapd
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/control snapd-2.48.3+20.04/packaging/ubuntu-16.04/control
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/control	2021-02-02 08:21:12.000000000 +0000
@@ -6,6 +6,7 @@
                automake,
                autotools-dev,
                bash-completion,
+               ca-certificates,
                debhelper (>= 9),
                dbus,
                dh-apparmor,
@@ -25,6 +26,7 @@
                libfuse-dev,
                libglib2.0-dev,
                liblzma-dev,
+               liblzo2-dev,
                libseccomp-dev,
                libudev-dev,
                openssh-client,
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/copyright snapd-2.48.3+20.04/packaging/ubuntu-16.04/copyright
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/copyright	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/copyright	2021-02-02 08:21:12.000000000 +0000
@@ -6,7 +6,7 @@
 Copyright: Copyright (C) 2014,2015 Canonical, Ltd.
 License: GPL-3
  This program is free software: you can redistribute it and/or modify it
- under the terms of the the GNU General Public License version 3, as
+ under the terms of the GNU General Public License version 3, as
  published by the Free Software Foundation.
  .
  This program is distributed in the hope that it will be useful, but
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/rules snapd-2.48.3+20.04/packaging/ubuntu-16.04/rules
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/rules	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/rules	2021-02-02 08:21:12.000000000 +0000
@@ -60,10 +60,16 @@
 endif
 
 # build with "tpm" support on ubuntu by default
+# TAGS are the go build tags for all binaries, SNAP_TAGS are for snap and
+# snap-bootstrap build only.
 TAGS=
+SNAP_TAGS=
 # check if we need to include the testkeys in the binary
 ifneq (,$(filter testkeys,$(DEB_BUILD_OPTIONS)))
 	TAGS=-tags withtestkeys
+	SNAP_TAGS=-tags "nomanagers withtestkeys"
+else
+	SNAP_TAGS=-tags nomanagers
 endif
 
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
@@ -162,10 +168,14 @@
 	# Build golang bits
 	mkdir -p _build/src/$(DH_GOPKG)/cmd/snap/test-data
 	cp -a cmd/snap/test-data/*.gpg _build/src/$(DH_GOPKG)/cmd/snap/test-data/
+	cp -a bootloader/assets/data _build/src/$(DH_GOPKG)/bootloader/assets
 
 	# this is the main go build
 	SNAPD_VANILLA_GO=$$(which go) PATH="$$(pwd)/packaging/build-tools/:$$PATH" dh_auto_build -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
 
+	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build $(BUILDFLAGS) $(GCCGOFLAGS) $(SNAP_TAGS) $(DH_GOPKG)/cmd/snap)
+	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build $(BUILDFLAGS) $(GCCGOFLAGS) $(SNAP_TAGS) $(DH_GOPKG)/cmd/snap-bootstrap)
+
 	# Generate static snap-exec, snapctl and snap-update-ns - it somehow includes CGO so
 	# we must force a static build here. We need a static snap-{exec,update-ns}/snapctl
 	# inside the core snap because not all bases will have a libc
@@ -201,7 +211,7 @@
 	(cd vendor/github.com/snapcore/squashfuse/src && mkdir -p autom4te.cache && ./autogen.sh --disable-demo && ./configure --disable-demo && make && mv squashfuse_ll snapfuse)
 
 override_dh_auto_test:
-	dh_auto_test -- $(BUILDFLAGS) -tags "$(TAGS)" $(GCCGOFLAGS)
+	dh_auto_test -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
 # a tested default (production) build should have no test keys
 ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
 	# check that only the main trusted account-keys are included
@@ -237,6 +247,10 @@
 	fi
 	# chrorder generator
 	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
+	# bootloader assets generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/genasset
+	# docs generator
+	rm -f ${CURDIR}/debian/tmp/usr/bin/docs
 
 	# Install snapd's systemd units / upstart jobs, done
 	# here instead of debian/snapd.install because the
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/snapd.dirs snapd-2.48.3+20.04/packaging/ubuntu-16.04/snapd.dirs
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/snapd.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/snapd.dirs	2021-02-02 08:21:12.000000000 +0000
@@ -1,12 +1,18 @@
 snap
 var/cache/snapd
 usr/lib/snapd
+usr/share/dbus-1/session.d
+usr/share/dbus-1/system.d
 var/lib/snapd/apparmor/snap-confine
 var/lib/snapd/desktop/applications
 var/lib/snapd/auto-import
+var/lib/snapd/dbus-1
+var/lib/snapd/dbus-1/services
+var/lib/snapd/dbus-1/system-services
 var/lib/snapd/desktop
 var/lib/snapd/environment
 var/lib/snapd/firstboot
+var/lib/snapd/inhibit
 var/lib/snapd/lib/gl
 var/lib/snapd/lib/gl32
 var/lib/snapd/lib/glvnd
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/snapd.install snapd-2.48.3+20.04/packaging/ubuntu-16.04/snapd.install
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/snapd.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/snapd.install	2021-02-02 08:21:12.000000000 +0000
@@ -39,6 +39,7 @@
 
 # gdb helper
 usr/lib/snapd/snap-gdb-shim
+usr/lib/snapd/snap-gdbserver-shim
 
 # install squashfuse as snapfuse to ensure it is available in e.g. lxd
 vendor/github.com/snapcore/squashfuse/src/snapfuse usr/bin
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/snapd.postrm snapd-2.48.3+20.04/packaging/ubuntu-16.04/snapd.postrm
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/snapd.postrm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/snapd.postrm	2021-02-02 08:21:12.000000000 +0000
@@ -82,11 +82,19 @@
             if [ -d /etc/dbus-1/system.d ]; then
                 find /etc/dbus-1/system.d -name "snap.${snap}.*.conf" -execdir rm -f "{}" \;
             fi
+            # modules
+            rm -f "/etc/modules-load.d/snap.${snap}.conf"
             # timer and socket units
             find /etc/systemd/system -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" | while read -r f; do
                 systemctl_stop "$(basename "$f")"
                 rm -f "$f"
             done
+            # user services, sockets, and timers - we make no attempt to stop any of them.
+            # TODO: ask snapd to ask each snapd.session-agent.service to stop snaps
+            # user-session services and stop itself.
+            find /etc/systemd/user -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" -o -name "snap.${snap}.*.service" | while read -r f; do
+                rm -f "$f"
+            done
         fi
 
         echo "Removing $unit"
@@ -94,6 +102,15 @@
         rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
     done
 
+    # snapd session-agent
+    rm -f /etc/systemd/user/snapd.session-agent.socket
+    rm -f /etc/systemd/user/snapd.session-agent.service
+    rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+
+    # dbus activation configuration
+    rm -f /etc/dbus-1/session.d/snapd.session-services.conf
+    rm -f /etc/dbus-1/system.d/snapd.system-services.conf
+
     # generated readme files
     rm -f "/snap/README"
 
@@ -119,6 +136,12 @@
         umount -l /run/snapd/ns/ || true
     fi
 
+    # inside containers we have a generator that creates a bind mount to /snap
+    if [ -e /run/systemd/container ]; then
+        echo "Unmount /snap inside a container"
+        umount /snap || true
+    fi
+
     echo "Removing extra snap-confine apparmor rules"
     rm -f /etc/apparmor.d/snap.core.*.usr.lib.snapd.snap-confine
 
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/tests/integrationtests snapd-2.48.3+20.04/packaging/ubuntu-16.04/tests/integrationtests
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.04/tests/integrationtests	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.04/tests/integrationtests	2021-02-02 08:21:12.000000000 +0000
@@ -63,8 +63,9 @@
 environment:
     PROJECT_PATH: /home/gopath/src/github.com/snapcore/snapd
     TESTSLIB: $PROJECT_PATH/tests/lib
+    TESTSTOOLS: $PROJECT_PATH/tests/lib/tools
     SNAPPY_TESTING: 1
-    PATH: $PATH:$PROJECT_PATH/tests/lib/bin
+    PATH: $PATH:$PROJECT_PATH/tests/bin
 backends:
     autopkgtest:
         type: adhoc
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/changelog snapd-2.48.3+20.04/packaging/ubuntu-16.10/changelog
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/changelog	2020-07-10 13:59:20.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/changelog	1970-01-01 00:00:00.000000000 +0000
@@ -1,9321 +0,0 @@
-snapd (2.45.1+20.04.2) focal-security; urgency=medium
-
-  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
-    (xdg-open)
-    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment 
-      variable modification when calling the system xdg-open. Patch
-      thanks to James Henstridge
-    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
-      may autostart on next use. Patch thanks to Michael Vogt
-    - CVE-2020-11934
-    - LP: #1880085
-
- -- Emilia Torino <emilia.torino@canonical.com>  Fri, 10 Jul 2020 10:59:20 -0300
-
-snapd (2.45.1+20.04) focal; urgency=medium
-
-  * New upstream release, LP: #1875071
-    - data/selinux: allow checking /var/cache/app-info
-    - cmd/snap-confine: add support for libc6-lse
-    - interfaces: miscellanious policy updates xlv
-    - snap-bootstrap: remove sealed key file on reinstall
-    - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
-    - gadget: make ext4 filesystems with or without metadata checksum
-    - interfaces/fwupd: allow bind mount to /boot on core
-    - tests: cherry-pick test fixes from master
-    - snap/squashfs: also symlink snap Install with uc20 seed snap dir
-      layout
-    - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
-      devices
-    - snap,many: mv Open to snapfile pkg to support add'l options to
-      Container methods
-    - interfaces/builtin/desktop: do not mount fonts cache on distros
-      with quirks
-    - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
-      gadget
-    - data/completion, packaging: cherry-pick zsh completion
-    - state: log task errors in the journal too
-    - devicestate: do not report "ErrNoState" for seeded up
-    - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
-      denials
-    - packaging/fedora: disable FIPS compliant crypto for static
-      binaries
-    - packaging: stop depending on python-docutils
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Jun 2020 15:13:49 +0200
-
-snapd (2.45) xenial; urgency=medium
-
-  * New upstream release, LP: #1875071
-    - o/devicestate: support doing system action reboots from recover
-      mode
-    - vendor: update to latest secboot
-    - tests: not fail when boot dir cannot be determined
-    - configcore: only reload journald if systemd is new enough
-    - cmd/snap-bootstrap/initramfs-mounts: append uuid to ubuntu-data
-      when decrypting
-    - tests/lib/prepare.sh: delete patching of the initrd
-    - cmd/snap: coldplug auto-import assertions from all removable
-      devices
-    - cmd/snap: fix the order of positional parameters in help output
-    - c/snap-bootstrap: port mount state mocking to the new style on
-      master
-    - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
-      as well
-    - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline,
-      unlock in recover mode initramfs
-    - progress: tweak multibyte label unit test data
-    - gadget: fix fallback device lookup for 'mbr' type structures
-    - progress: fix progress bar with multibyte duration units
-    - many: use /run/mnt/data over /run/mnt/ubuntu-data for uc20
-    - many: put the sealed keys in a directory on seed for tidiness
-    - cmd/snap-bootstrap: measure epoch and model before unlocking
-      encrypted data
-    - o/configstate: core config handler for persistent journal
-    - bootloader/uboot: use secondary ubootenv file boot.sel for uc20
-    - packaging: add "$TAGS" to dh_auto_test for debian packaging
-    - tests: ensure $cache_dir is actually available
-    - secboot,cmd/snap-bootstrap: add model to pcr protection profile
-    - devicestate: do not use snap-boostrap in devicestate to install
-    - tests: fix a typo in nested.sh helper
-    - devicestate: add support for cloud.cfg.d config from the gadget
-    - cmd/snap-bootstrap: cleanups, naming tweaks
-    - testutil: add NewDBusTestConn
-    - snap-bootstrap: lock access to sealed keys
-    - overlord/devicestate: preserve the current model inside ubuntu-
-      boot
-    - interfaces/apparmor: use differently templated policy for non-core
-      bases
-    - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
-      syscalls
-    - cmd/snap-bootstrap/initramfs-mounts: mount ubuntu-seed first,
-      other misc changes
-    - o/snapstate: tweak "waiting for restart" message
-    - boot: store model model and grade information in modeenv
-    - interfaces/firewall-control: allow -legacy and -nft for core20
-    - boot: enable makeBootable20RunMode for EnvRefExtractedKernel
-      bootloaders
-    - boot/bootstate20: add EnvRefExtractedKernelBootloader bootstate20
-      implementation
-    - daemon: fix error message from `snap remove-user foo` on classic
-    - overlord: have a variant of Mock that can take a state.State
-    - tests: 16.04 and 18.04 now have mediating pulseaudio (again)
-    - seed: clearer errors for missing essential snapd or core snap
-    - cmd/snap-bootstrap/initramfs-mounts: support
-      EnvRefExtractedKernelBootloader's
-    - gadget, cmd/snap-bootstrap: MBR schema support
-    - image: improve/adjust DownloadSnap doc comment
-    - asserts: introduce ModelGrade.Code
-    - tests: ignore user-12345 slice and service
-    - image,seed/seedwriter: support redirect channel aka default
-      tracks
-    - bootloader: use binary.Read/Write
-    - tests: uc20 nested suite part II
-    - tests/boot: refactor to make it easier for new
-      bootloaderKernelState20 impl
-    - interfaces/openvswitch: support use of ovs-appctl
-    - snap-bootstrap: copy auth data from real ubuntu-data in recovery
-      mode
-    - snap-bootstrap: seal and unseal encryption key using tpm
-    - tests: disable special-home-can-run-classic-snaps due to jenkins
-      repo issue
-    - packaging: fix build on Centos8 to support BUILDTAGS
-    - boot/bootstate20: small changes to bootloaderKernelState20
-    - cmd/snap: Implement a "snap routine file-access" command
-    - spread.yaml: switch back to latest/candidate for lxd snap
-    - boot/bootstate20: re-factor kernel methods to use new interface
-      for state
-    - spread.yaml,tests/many: use global env var for lxd channel
-    - boot/bootstate20: fix bug in try-kernel cleanup
-    - config: add system.store-certs.[a-zA-Z0-9] support
-    - secboot: key sealing also depends on secure boot enabled
-    - httputil: fix client timeout retry tests
-    - cmd/snap-update-ns: handle EBUSY when unlinking files
-    - cmd/snap/debug/boot-vars: add opts for setting dir and/or uc20
-      vars
-    - secboot: add tpm support helpers
-    - tests/lib/assertions/developer1-pi-uc20.model: use 20/edge for
-      kernel and gadget
-    - cmd/snap-bootstrap: switch to a 64-byte key for unlocking
-    - tests: preserve size for centos images on spread.yaml
-    - github: partition the github action workflows
-    - run-checks: use consistent "Checking ..." style messages
-    - bootloader: add efi pkg for reading efi variables
-    - data/systemd: do not run snapd.system-shutdown if finalrd is
-      available
-    - overlord: update tests to work with latest go
-    - cmd/snap: do not hide debug boot-vars on core
-    - cmd/snap-bootstrap: no error when not input devices are found
-    - snap-bootstrap: fix partition numbering in create-partitions
-    - httputil/client_test.go: add two TLS version tests
-    - tests: ignore user@12345.service hierarchy
-    - bootloader, gadget, cmd/snap-bootstrap: misc cosmetic things
-    - tests: rewrite timeserver-control test
-    - tests: fix racy pulseaudio tests
-    - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS
-    - tests: update snap-preseed --reset logic to accommodate for 2.44
-      change
-    - cmd/snap: don't wait for system key when stopping
-    - sandbox/cgroup: avoid making arrays we don't use
-    - osutil: mock proc/self/mountinfo properly everywhere
-    - selinux: export MockIsEnforcing; systemd: use in tests
-    - tests: add 32 bit machine to GH actions
-    - tests/session-tool: kill cron session, if any
-    - asserts: it should be possible to omit many snap-ids if allowed,
-      fix
-    - boot: cleanup more things, simplify code
-    - github: skip spread jobs when corresponding label is set
-    - dirs: don't depend on osutil anymore, mv apparmor vars to apparmor
-      pkg
-    - tests/session-tool: add session-tool --dump
-    - github: allow cached debian downloads to restore
-    - tests/session-tool: session ordering is non-deterministic
-    - tests: enable unit tests on debian-sid again
-    - github: move spread to self-hosted workers
-    - secboot: import secboot on ubuntu, provide dummy on !ubuntu
-    - overlord/devicestate: support for recover and run modes
-    - snap/naming: add validator for snap security tag
-    - interfaces: add case for rootWritableOverlay + NFS
-    - tests/main/uc20-create-partitions: tweaks, renames, switch to
-      20.04
-    - github: port CLA check to Github Actions
-    - interfaces/many: miscellaneous policy updates xliv
-    - configcore,tests: fix setting watchdog options on UC18/20
-    - tests/session-tool: collect information about services on startup
-    - tests/main/uc20-snap-recovery: unbreak, rename to uc20-create-
-      partitions
-    - state: add state.CopyState() helper
-    - tests/session-tool: stop anacron.service in prepare
-    - interfaces: don't use the owner modifier for files shared via
-      document portal
-    - systemd: move the doc comments to the interface so they are
-      visible
-    - cmd/snap-recovery-chooser: tweaks
-    - interfaces/docker-support: add overlayfs file access
-    - packaging: use debian/not-installed to ignore snap-preseed
-    - travis.yml: disable unit tests on travis
-    - store: start splitting store.go and store_test.go into subtopic
-      files
-    - tests/session-tool: stop cron/anacron from meddling
-    - github: disable fail-fast as spread cannot be interrupted
-    - github: move static checks and spread over
-    - tests: skip "/etc/machine-id" in "writablepaths" test
-    - snap-bootstrap: store encrypted partition recovery key
-    - httputil: increase testRetryStrategy max timelimit to 5s
-    - tests/session-tool: kill leaking closing session
-    - interfaces: allow raw access to USB printers
-    - tests/session-tool: reset failed session-tool units
-    - httputil: increase httpclient timeout in
-      TestRetryRequestTimeoutHandling
-    - usersession: extend timerange in TestExitOnIdle
-    - client: increase timeout in client tests to 100ms
-    - many: disentagle release and snapdenv from sandbox/*
-    - boot: simplify modeenv mocking to always write a modeenv
-    - snap-bootstrap: expand data partition on install
-    - o/configstate: add backlight option for core config
-    - cmd/snap-recovery-chooser: add recovery chooser
-    - features: enable robust mount ns updates
-    - snap: improve TestWaitRecovers test
-    - sandbox/cgroup: add ProcessPathInTrackingCgroup
-    - interfaces/policy: fix comment in recent new test
-    - tests: make session tool way more robust
-    - interfaces/seccomp: allow passing an address to setgroups
-    - o/configcore: introduce core config handlers (3/N)
-    - interfaces: updates to login-session-observe, network-manager and
-      modem-manager interfaces
-    - interfaces/policy/policy_test.go: add more tests'allow-
-      installation: false' and we grant based on interface attributes
-    - packaging: detect/disable broken seed in the postinst
-    - cmd/snap-confine/mount-support-nvidia.c: add libnvoptix as nvidia
-      library
-    - tests: remove google-tpm backend from spread.yaml
-    - tests: install dependencies with apt using --no-install-recommends
-    - usersession/userd: add zoommtg url support
-    - snap-bootstrap: fix disk layout sanity check
-    - snap: add `snap debug state --is-seeded` helper
-    - devicestate: generate warning if seeding fails
-    - config, features: move and rename config.GetFeatureFlag helper to
-      features.Flag
-    - boot, overlord/devicestate, daemon:  implement requesting boot
-      into a given recovery system
-    - xdgopenproxy: forward requests to the desktop portal
-    - many: support immediate reboot
-    - store: search v2 tweaks
-    - tests: fix cross build tests when installing dependencies
-    - daemon: make POST /v2/systems/<label> root only
-    - tests/lib/prepare.sh: use only initrd from the kernel snap
-    - cmd/snap,seed: validate full seeds (UC 16/18)
-    - tests/main/user-session-env: stop the user session before deleting
-      the test-zsh user
-    - overlord/devicestate, daemon: record the seed current system was
-      installed from
-    - gadget: SystemDefaults helper function to convert system defaults
-      config into a flattened map suitable for FilesystemOnlyApply.
-    - many: comment or avoid cryptic snap-ids in tests
-    - tests: add LXD_CHANNEL environment
-    - store: support for search API v2
-    - .github: register a problem matcher to detect spread failures
-    - seed: add Info() method for seed.Snap
-    - github: always run the "Discard spread workers" step, even if the
-      job fails
-    - github: offload self-hosted workers
-    - cmd/snap: the model command needs just a client, no waitMixin
-    - github: combine tests into one workflow
-    - github: fix order of go get caches
-    - tests: adding more workers for ubuntu 20.04
-    - boot,overlord: rename operating mode to system mode
-    - config: add new Transaction.GetPristine{,Maybe}() function
-    - o/devicestate: rename readMaybe* to maybeRead*
-    - github: cache Debian dependencies for unit tests
-    - wrappers: respect pre-seeding in error path
-    - seed: validate UC20 seed system label
-    - client, daemon, overlord/devicestate: request system action API
-      and stubs
-    - asserts,o/devicestate: support model specified alternative serial-
-      authority
-    - many: introduce naming.WellKnownSnapID
-    - o/configcore: FilesystemOnlyApply method for early configuration
-      of core (1/N)
-    - github: run C unit tests
-    - github: run spread tests on PRs only
-    - interfaces/docker-support: make containerd abstract socket more
-      generic
-    - tests: cleanup security-private-tmp properly
-    - overlord/devicestate,boot: do not hold to the originally read
-      modeenv
-    - dirs: rm RunMnt; boot: add vars for early boot env layout;
-      sysconfig: take targetdir arg
-    - cmd/snap-bootstrap/initramfs-mounts/tests: use dirs.RunMnt over
-      s.runMnt
-    - tests: add regression test for MAAS refresh bug
-    - errtracker: add missing mocks
-    - github: apt-get update before installing build-deps
-    - github: don't fail-fast
-    - github: run spread via github actions
-    - boot,many: add modeenv.WriteTo, make Write take no args
-    - wrappers: fix timer schedules that are days only
-    - tests/main/snap-seccomp-syscalls: install gperf
-    - github: always checkout to snapcore/snapd
-    - github: add prototype workflow running unit tests
-    - many: improve comments, naming, a possible TODO
-    - client: use Assert when checking for error
-    - tests: ensure sockets target is ready in session agent spread
-      tests
-    - osutil: do not leave processes behind after the test run
-    - tests: update proxy-no-core to match latest CDN changes
-    - devicestate,sysconfig: support "cloud.cfg.d" in uc20 for grade:
-      dangerous
-    - cmd/snap-failure,tests: try to make snap-failure more robust
-    - many: fix packages having mistakenly their copyright as doc
-    - many: enumerate system seeds, return them on the /v2/systems API
-      endpoint
-    - randutil: don't consume kernel entropy at init, just mix more info
-      to try to avoid fleet collisions
-    - snap-bootstrap: add creationSupported predicate for partition
-      types
-    - tests: umount partitions which are not umounted after remount
-      gadget
-    - snap: run gofmt -s
-    - many: improve environment handling, fixing duplicate entries
-    - boot_test: add many boot robustness tests for UC20 kernel
-      MarkBootSuccessul and SetNextBoot
-    - overlord: remove unneeded overlord.MockPruneInterval() mocks
-    - interfaces/greengrass-support: fix typo
-    - overlord,timings,daemon: separate timings from overlord/state
-    - tests: enable nested on core20 and test current branch
-    - snap-bootstrap: remove created partitions on reinstall
-    - boot: apply Go 1.10 formatting
-    - apparmor: use rw for uuidd request to default and remove from
-      elsewhere
-    - packaging: add README.source for debian
-    - tests: cleanup various uc20 boot tests from previous PR
-    - devicestate: disable cloud-init by default on uc20
-    - run-checks: tweak formatting checks
-    - packaging,tests: ensure debian-sid builds without vendor/
-    - travis.yml: run unit tests with go/master as well* travis.yml: run
-      unit tests with go/master as well
-    - seed: make Brand() part of the Seed interface
-    - cmd/snap-update-ns: ignore EROFS from rmdir/unlink
-    - daemon: do a forceful server shutdown if we hit a deadline
-    - tests/many: don't use StartLimitInterval anymore, unify snapd-
-      failover variants, build snapd snap for UC16 tests
-    - snap-seccomp: robustness improvements
-    - run-tests: disable -v for go test to avoid spaming the logs
-    - snap: whitelist lzo as support compression for snap pack
-    - snap: tweak comment in Install() for overlayfs detection
-    - many: introduce snapdenv.Preseeding instead of release.PreseedMode
-    - client, daemon, overlord/devicestate: structures and stubs for
-      systems API
-    - o/devicestate: delay the creation of mark-seeded task until
-      asserts are loaded
-    - data/selinux, tests/main/selinux: cleanup tmpfs operations in the
-      policy, updates
-    - interfaces/greengrass-support: add new 1.9 access
-    - snap: do not hardlink on overlayfs
-    - boot,image: ARM kernel extract prepare image
-    - interfaces: make gpio robust against not-existing gpios in /sys
-    - cmd/snap-preseed: handle --reset flag
-    - many: introduce snapdenv to present common snapd env options
-    - interfaces/kubernetes-support: allow autobind to journald socket
-    - snap-seccomp: allow mprotect() to unblock the tests
-    - tests/lib/reset: workaround unicode dot in systemctl output
-    - interfaces/udisks2: also allow Introspection on
-      /org/freedesktop/UDisks/**
-    - snap: introduce Container.RandomAccessFile
-    - o/ifacestate, api: implementation of snap disconnect --forget
-    - cmd/snap: make the portal-info command search for the network-
-      status interface
-    - interfaces: work around apparmor_parser slowness affecting uio
-    - tests: fix/improve failing spread tests
-    - many: clean separation of bootenv mocking vs mock bootloader kinds
-    - tests: mock prune ticker in overlord tests to reduce wait times
-    - travis: disable arm64 again
-    - httputil: add support for extra snapd certs
-    - travis.yml: run unit tests on arm64 as well
-    - many: fix a pair of ineffectual assignments
-    - tests: add uc20 kernel snap upgrade managers test, fix
-      bootloadertest bugs
-    - o/snapstate: set base in SnapSetup on snap revert
-    - interfaces/{docker,kubernetes}-support: updates for lastest k8s
-    - cmd/snap-exec: add test case for LP bug 1860369
-    - interfaces: make the network-status interface implicit on
-      classic
-    - interfaces: power control interfaceIt is documented in the
-      kernel
-    - interfaces: miscellaneous policy updates
-    - cmd/snap: add a "snap routine portal-info" command
-    - usersession/userd: add "apt" to the white list of URL schemes
-      handled by xdg-open
-    - interfaces/desktop: allow access to system prompter interface
-    - devicestate: allow encryption regardless of grade
-    - tests: run ipv6 network-retry test too
-    - tests: test that after "remove-user" the system is unmanaged
-    - snap-confine: unconditionally add /dev/net/tun to the device
-      cgroup
-    - snapcraft.yaml: use sudo -E and remove workaround
-    - interfaces/audio_playback: Fix pulseaudio config access
-    - ovelord/snapstate: update only system wide fonts cache
-    - wrappers: import /etc/environment in all services
-    - interfaces/u2f: Add Titan USB-C key
-    - overlord, taskrunner: exit on task/ensure error when preseeding
-    - tests: add session-tool, a su / sudo replacement
-    - wrappers: add mount unit dependency for snapd services on core
-      devices
-    - tests: just remove user when the system is not managed on create-
-      user-2 test
-    - snap-preseed: support for preseeding of snapd and core18
-    - boot: misc UC20 changes
-    - tests: adding arch-linux execution
-    - packaging: revert "work around review-tools and snap-confine"
-    - netlink: fix panic on arm64 with the new rawsockstop codewith a
-      nil Timeval panics
-    - spread, data/selinux: add CentOS 8, update policy
-    - tests: updating checks to new test account for snapd-test snaps
-    - spread.yaml: mv opensuse 15.1 to unstable
-    - cmd/snap-bootstrap,seed: verify only in-play snaps
-    - tests: use ipv4 in retry-network to unblock failing master
-    - data/systemd: improve the description
-    - client: add "Resume" to DownloadOptions and new test
-    - tests: enable snapd-failover on uc20
-    - tests: add more debug output to the snapd-failure handling
-    - o/devicestate: unset recovery_system when done seeding
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 May 2020 17:17:57 +0200
-
-snapd (2.44.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - tests: fix racy pulseaudio tests
-    - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS
-    - tests: update snap-preseed --reset logic
-    - tests: backport partition fixes
-    - cmd/snap: don't wait for system key when stopping
-    - interfaces/many: miscellaneous policy updates xliv
-    - tests/main/uc20-snap-recovery: use 20.04 system
-    - tests: skip "/etc/machine-id" in "writablepaths
-    - interfaces/docker-support: add overlays file access
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 10 Apr 2020 16:57:25 +0200
-
-snapd (2.44.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - packaging: detect/disable broken seeds in the postinst
-    - cmd/snap,seed: validate full seeds (UC 16/18)
-    - snap: add `snap debug state --is-seeded` helper
-    - devicestate: generate warning if seeding fails
-    - store: support for search API v2
-    - cmd/snap-seccomp/syscalls: update the list of known syscalls
-    - snap/cmd: the model command needs just a client, no waitMixin
-    - tests: cleanup security-private-tmp properly
-    - wrappers: fix timer schedules that are days only
-    - tests: update proxy-no-core to match latest CDN changes
-    - cmd/snap-failure,tests: make snap-failure more robust
-    - tests, many: don't use StartLimitInterval anymore, unify snapd-
-      failover variants, build snapd snap for UC16 tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 02 Apr 2020 09:51:34 +0200
-
-snapd (2.44.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - randutil: switch back to setting up seed with lower entropy data
-    - interfaces/greengrass-support: fix typo
-    - packaging,tests: ensure debian-sid builds without vendor/
-    - travis.yml: run unit tests with go/master as well
-    - cmd/snap-update-ns: ignore EROFS from rmdir/unlink
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 21 Mar 2020 18:32:12 +0100
-
-snapd (2.44) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - daemon: do a forceful serer shutdown if we hit a deadline
-    - snap: whitelist lzo as support compression for snap pack
-    - data/selinux: update policy to allow more ops
-    - interfaces/greengrass-support: add new 1.9 access
-    - snap: do not hardlink on overlayfs
-    - cmd/snap-preseed: handle --reset flag
-    - interfaces/kubernetes-support: allow autobind to journald socket
-    - snap-seccomp: allow mprotect() to unblock the tests
-    - tests/lib/reset: workaround unicode dot in systemctl output
-    - interfaces: work around apparmor_parser slowness affecting uio
-    - interfaces/udisks2: also allow Introspection on
-      /org/freedesktop/UDisks2/**
-    - tests: mock prune ticker in overlord tests to reduce wait times
-    - interfaces/{docker,kubernetes}-support: updates for lastest k8s
-    - interfaces: miscellaneous policy updates
-    - interfaces/audio_playback: Fix pulseaudio config access
-    - overlord: disable Test..AbortShortlyAfterStartOfOperation for 2.44
-    - ovelord/snapstate: update only system wide fonts cache
-    - wrappers: import /etc/environment in all services
-    - interfaces/u2f: Add Titan USB-C key
-    - overlord, taskrunner: exit on task/ensure error when preseeding
-    - overlord/snapstate/backend: update snapd services contents in unit
-      tests
-    - wrappers: add mount unit dependency for snapd services on core
-      devices
-    - Revert "tests: remove /tmp/snap.* left over by other tests"
-    - Revert "packaging: work around review-tools and snap-confine"
-    - netlink: fix panic on arm64 with the new rawsockstop code
-    - spread, data/selinux: add CentOS 8, update policy
-    - spread.yaml: mv opensuse tumbleweed to unstable too
-    - spread.yaml: mv opensuse 15.1 to unstable
-    - tests: use ipv4 in retry-network to unblock failing master
-    - data/systemd: improve the description
-    - tests/lib/prepare.sh: simplify, combine code paths
-    - tests/main/user-session-env: add test verifying environment
-      variables inside the user session
-    - spread.yaml: make qemu ubuntu-core-20-64 use ubuntu-20.04-64
-    - run-checks: SKIP_GMFMT really skips formatting checks
-    - tests: enable more tests for UC20/UC18
-    - tests: remove tmp dir for snap not-test-snapd-sh on security-
-      private-tmp test
-    - seed,cmd/snap-bootstrap: introduce seed.Snap.EssentialType,
-      simplify bootstrap code
-    - snapstate: do not restart in undoLinkSnap unless on first install
-    - cmd/snap-bootstrap: subcommand to detect UC chooser trigger
-    - cmd/snap-bootstrap/initramfs-mounts: mount the snapd snap in run-
-      mode too
-    - cmd/libsnap, tests: fix C unit tests failing as non-root
-    - cmd/snap-bootstrap: verify kernel snap is in modeenv before
-      mounting it
-    - tests: adding amazon linux to google backend
-    - cmd/snap-failure/snapd: rm snapd.socket, reset snapd.socket failed
-      status
-    - client: add support for "ResumeToken", "HeaderPeek" to download
-    - build: enable type: snapd
-    - tests: rm -rf /tmp/snap.* in restore
-    - cmd/snap-confine: deny snap-confine to load nss libs
-    - snapcraft.yaml: add comments, rename snapd part to snapd-deb
-    - boot: write current_kernels in bootstate20, makebootable
-    - packaging: work around review-tools and snap-confine
-    - tests: skipping interfaces-openvswitch on centos due to package is
-      not available
-    - packaging,snap-confine: stop being setgid root
-    - cmd/snap-confine: bring /var/lib/dhcp from host, if present
-    - store: rely on CommandFromSystemSnap to find xdelta3
-    - tests: bump sleep time of the new overlord tests
-    - cmd/snap-preseed: snapd version check for the target
-    - netlink: fix/support stopping goroutines reading netlink raw
-      sockets
-    - tests: reset PS1 before possibly interactive dash
-    - overlord, state: don't abort changes if spawn time before
-      StartOfOperationTime (2/2)
-    - snapcraft.yaml: add python3-apt, tzdata as build-deps for the
-      snapd snap
-    - tests: ask tar to speak English
-    - tests: using google storage when downloading ubuntu cloud images
-      from gce
-    - Coverity produces false positives for code like this:
-    - many: maybe restart & security backend options
-    - o/standby: add SNAPD_STANDBY_WAIT to control standby in
-      development
-    - snap: use the actual staging snap-id for snapd
-    - cmd/snap-bootstrap: create a new parser instance
-    - snapcraft.yaml: use build-base and adopt-info, rm builddeb
-      plugin
-    - tests: set StartLimitInterval in snapd failover test
-    - tests: disable archlinux system
-    - tests: add preseed test for classic
-    - many, tests: integrate all preseed bits and add spread tests
-    - daemon: support resuming downloads
-    - tests: use Filename() instead of filepath.Base(sn.MountFile())
-    - tests/core: add swapfiles test
-    - interfaces/cpu-control: allow to control cpufreq tunables
-    - interfaces: use commonInteface for desktopInterface
-    - interfaces/{desktop-legacy,unity7}: adjust for new ibus socket
-      location
-    - snap/info: add Filename
-    - bootloader: make uboot a RecoveryAwareBootloader
-    - gadget: skip update when mounted filesystem content is identical
-    - systemd: improve is-active check for 'failed' services
-    - boot: add current_kernels to modeenv
-    - o/devicestate: StartOfOperationTime helper for Prune (1/2)
-    - tests: detect LXD launching i386 containers
-    - tests: move main/ubuntu-core-* tests to core/ suite
-    - tests: remove snapd in ubuntu-core-snapd
-    - boot: enable base snap updates in bootstate20
-    - tests: Fix core revert channel after 2.43 has been released to
-      stable
-    - data/selinux: unify tabs/spaces
-    - o/ifacestate: move ResolveDisconnect to ifacestate
-    - spread: move centos to stable systems
-    - interfaces/opengl: allow datagrams to nvidia-driver
-    - httputil: add NoNetwork(err) helper, spread test and use in serial
-      acquire
-    - store: detect if server does not support http range headers
-    - test/lib/user: add helper lib for doing things for and as a user
-    - overlord/snapstate, wrappers: undo of snapd on core
-    - tests/main/interfaces-pulseaudio: use custom pulseaudio script,
-      set kill timeout
-    - store: add support for resume in DownloadStream
-    - cmd/snap: implement 'snap remove-user'
-    - overlord/devicestate: fix preseed unit tests on systems not using
-      /snap
-    - tests/main/static: ldd in glibc 2.31 logs to stderr now
-    - run-checks, travis: allow skipping spread jobs by adding a label
-    - tests: add new backend which includes images with tpm support
-    - boot: use constants for boot status values
-    - tests: add "core" suite for UC specific tests
-    - tests/lib/prepare: use a local copy of uc20 initramfs skeleton
-    - tests: retry mounting the udisk2 device due to timing issue
-    - usersession/client: add a client library for the user session
-      agent
-    - o/devicestate: Handle preseed mode in the firstboot mode (core16
-      only for now).
-    - boot: add TryBase and BaseStatus to modeenv; use in snap-bootstrap
-    - cmd/snap-confine: detect base transitions on core16
-    - boot: don't use "kernel" from the modeenv anymore
-    - interfaces: add uio interface
-    - tests: repack the initramfs + kernel snap for UC20 spread tests
-    - interfaces/greengrass-support: add /dev/null ->
-      /proc/latency_stats mount
-    - httputil: remove workaround for redirect handling in go1.7
-    - httputil: remove go1.6 transport workaround
-    - snap: add `snap pack --compression=<comp>` options
-    - tests/lib/prepare: fix hardcoded loopback device names for UC
-      images
-    - timeutil: add a unit test case for trivial schedule
-    - randutil,o/snapstate,-mkauthors.sh: follow ups to randutil
-      introduction
-    - dirs: variable with distros using alternate snap mount
-    - many,randutil: centralize and streamline our random value
-      generation
-    - tests/lib/prepare-restore: Revert "Continue on errors updating or
-      installing dependencies"
-    - daemon: Allow clients to call /v2/logout via Polkit
-    - dirs: manjaro-arm is like manjaro
-    - data, packaging: Add sudoers snippet to allow snaps to be run with
-      sudo
-    - daemon, store: better expose single action errors
-    - tests: switch mount-ns test to differential data set
-    - snapstate: refactor things to add the re-refresh task last
-    - daemon: drop support for the DELETE method
-    - client: move to /v2/users; implement RemoveUser
-    - boot: enable UC20 kernel extraction and bootState20 handling
-    - interfaces/policy: enforce plug-names/slot-names constraints
-    - asserts: parse plug-names/slot-names constraints
-    - daemon: make users result more consistent
-    - cmd/snap-confine,tests: support x.y.z nvidia version
-    - dirs: fixlet for XdgRuntimeDirGlob
-    - boot: add bootloader options to coreKernel
-    - o/auth,daemon: do not remove unknown user
-    - tests: tweak and enable tests on ubuntu 20.04
-    - daemon: implement user removal
-    - cmd/snap-confine: allow snap-confine to link to libpcre2
-    - interfaces/builtin: Allow NotificationReplied signal on
-      org.freedesktop.Notifications
-    - overlord/auth: add RemoveUserByName
-    - client: move user-related things to their own files
-    - boot: tweak kernel cmdline helper docstring
-    - osutil: implement deluser
-    - gadget: skip update when raw structure content is unchanged
-    - boot, cmd/snap, cmd/snap-bootstrap: move run mode and system label
-      detection to boot
-    - tests: fix revisions leaking from snapd-refresh test
-    - daemon: refactor create-user to a user action & hide behind a flag
-    - osutil/tests: check there are no leftover symlinks with
-      AtomicSymlink
-    - grub: support atomically renaming kernel symlinks
-    - osutil: add helpers for creating symlinks and renaming in an
-      atomic manner
-    - tests: add marker tag for core 20 test failure
-    - tests: fix gadget-update-pc test leaking snaps
-    - tests: remove revision leaking from ubuntu-core-refresh
-    - tests: remove revision leaking from remodel-kernel
-    - tests: disable system-usernames test on core20
-    - travis, tests, run-checks: skip nakedret
-    - tests: run `uc20-snap-recovery-encrypt` test on 20.04-64 as well
-    - tests: update mount-ns test tables
-    - snap: disable auto-import in uc20 install-mode
-    - tests: add a command-chain service test
-    - tests: use test-snapd-upower instead of upower
-    - data/selinux: workaround incorrect fonts cache labeling on RHEL7
-    - spread.yaml: fix ubuntu 19.10 and 20.04 names
-    - debian: check embedded keys for snap-{bootstrap,preseed} too
-    - interfaces/apparmor: fix doc-comments, unnecessary code
-    - o/ifacestate,o/devicestatate: merge gadget-connect logic into
-      auto-connect
-    - bootloader: add ExtractedRunKernelImageBootloader interface,
-      implement in grub
-    - tests: add spread test for hook permissions
-    - cmd/snap-bootstrap: check device size before boostrapping and
-      produce a meaningful error
-    - cmd/snap: add ability to register "snap routine" commands
-    - tests: add a test demonstrating that snaps can't access the
-      session agent socket
-    - api: don't return connections referring to non-existing
-      plugs/slots
-    - interfaces: refactor path() from raw-volume into utils with
-      comments for old
-    - gitignore: ignore snap files
-    - tests: skip interfaces-network-manager on arm devices
-    - o/devicestate: do not create perfTimings if not needed inside
-      ensureSeed/Operational
-    - tests: add ubuntu 20.04 to the tests execution and remove
-      tumbleweed from unstable
-    - usersession: add systemd user instance service control to user
-      session agent
-    - cmd/snap: print full channel in 'snap list', 'snap info'
-    - tests: remove execution of ubuntu 19.04 from google backend
-    - cmd/snap-boostrap: add mocking for fakeroot
-    - tests/core18/snapd-failover: collect more debug info
-    - many: run black formatter on all python files
-    - overlord: increase settle timeout for slow machines
-    - httputil: use shorter timeout in TestRetryRequestTimeoutHandling
-    - store, o/snapstate: send default-tracks header, use
-      RedirectChannel
-    - overlord/standby: fix possible deadlock in standby test
-    - cmd/snap-discard-ns: fix pattern for .info files
-    - boot: add HasModeenv to Device
-    - devicestate: do not allow remodel between core20 models
-    - bootloader,snap: misc tweaks
-    - store, overlord/snapstate, etc: SnapAction now returns a []…Result
-    - snap-bootstrap: create encrypted partition
-    - snap: remove "host" output from `snap version`
-    - tests: use snap remove --purge flag in most of the spread tests
-    - data/selinux, test/main/selinux-clean: update the test to cover
-      more scenarios
-    - many: drop NameAndRevision, use snap.PlaceInfo instead
-    - boot: split MakeBootable tests into their own file
-    - travis-ci: add go import path
-    - boot: split MakeBootable implementations into their own file
-    - tests: enable a lot of the tests of main on uc20
-    - packaging, tests: stop services in prerm
-    - tests: enable regression suite on core20
-    - overlord/snapstate: improve snapd snap backend link unit tests
-    - boot: implement SetNextBoot in terms of bootState.setNext
-    - wrappers: write and undo snapd services on core
-    - boot,o/devicestate: refactor MarkBootSuccessful over bootState
-    - snap-bootstrap: mount the correct snapd snap to /run/mnt/snapd
-    - snap-bootstrap: refactor partition creation
-    - tests: use new snapd.spread-tests-run-mode-tweaks.service unit
-    - tests: add core20 tests
-    - boot,o/snapstate: SetNextBoot/LinkSnap return whether to reboot,
-      use the information
-    - tests/main/snap-sign: add test for non-stdin signing
-    - snap-bootstrap: trigger udev after filesystem creation
-    - boot,overlord: introduce internal abstraction bootState and use it
-      for InUse/GetCurrentBoot
-    - overlord/snapstate: tracks are now sticky
-    - cmd: sign: add filename param
-    - tests: remove "test-snapd-tools" in smoke/sandbox on restore
-    - cmd/snap, daemon: stop over-normalising channels
-    - tests: fix classic-ubuntu-core-transition-two-cores after refactor
-      of MATCH -v
-    - packaging: ship var/lib/snapd/desktop/applications in the pkg
-    - spread: drop copr repo with F30 build dependencies
-    - tests: use test-snapd-sh snap instead of test-snapd-tools - Part 3
-    - tests: fix partition creation test
-    - tests: unify/rename services-related spread tests to start with
-      services- prefix
-    - test: extract code that modifies "writable" for test prep
-    - systemd: handle preseed mode
-    - snap-bootstrap: read only stdout when parsing the sfdisk json
-    - interfaces/browser-support: add more product/vendor paths
-    - boot: write compat UC16 bootvars in makeBootable20RunMode
-    - devicestate: avoid adding mockModel to deviceMgrInstallModeSuite
-    - devicestate: request reboot after successful doSetupRunSystem()
-    - snapd.core-fixup.sh: do not run on UC20 at all
-    - tests: unmount automounted snap-bootstrap devices
-    - devicestate: run boot.MakeBootable in doSetupRunSystem
-    - boot: copy kernel/base to data partition in makeBootable20RunMode
-    - tests: also check nested lxd container
-    - run-checks: complain about MATCH -v
-    - boot: always return the trivial boot participant in ephemeral mode
-    - o/devicestate,o/snapstate: move the gadget.yaml checkdrive-by: use
-      gadget.ReadInfoFromSnapFile in checkGadgetRemodelCompatible
-    - snap-bootstrap: append new partitions
-    - snap-bootstrap: mount filesystems after creation
-    - snapstate: do not try to detect rollback in ephemeral modes
-    - snap-bootstrap: trigger udev for new partitions
-    - cmd/snap-bootstrap: xxx todos about kernel cross-checks
-    - tests: avoid mask rsyslog service in case is not enabled on the
-      system
-    - tests: fix use of MATCH -v
-    - cmd/snap-preseed: update help strings
-    - cmd/snap-bootstrap: actually parse snapd_recovery_system label
-    - bootstrap: reduce runmode mounts from 5 to 2 steps.
-    - lkenv.go: adjust for new location of include file
-    - snap: improve squashfs.ReadFile() error
-    - systemd: fix uc20 shutdown
-    - boot: write modeenv when creating the run mode
-    - boot,image: add skeleton boot.makeBootable20RunMode
-    - cmd/snap-preseed: add snap-preseed executable
-    - overlord,boot: follow ups to #7889 and #7899
-    - interfaces/wayland: Add access to Xwayland's shm files
-    - o/hookstate/ctlcmd: fix command name in snapctl -h
-    - daemon,snap: remove screenshot deprecation notice
-    - overlord,o/snapstate: make sure we never leave config behind
-    - many: pass consistently boot.Device state to boot methods
-    - run-checks: check multiline string blocks in
-      restore/prepare/execute sections of spread tests
-    - intrefaces: login-session-control - added missing dbus commands
-    - tests/main/parallel-install-remove-after: parallel installs should
-      not break removal
-    - overlord/snapstate: tweak assumes error hint
-    - overlord: replace DeviceContext.OldModel with GroundContext
-    - devicestate: use httputil.ShouldRetryError() in
-      prepareSerialRequest
-    - tests: replace "test-snapd-base-bare" with real "bare" base snap
-    - many: pass a Model to the gadget info reading functions
-    - snapstate: relax gadget constraints in ConfigDefaults Et al.
-    - devicestate: only run ensureBootOk() in "run" mode
-    - tests/many: quiet lxc launching, file pushing
-    - tests: disable apt-hooks test until it can be properly fixed
-    - tests: 16.04 and 18.04 now have mediating pulseaudio
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 17 Mar 2020 20:55:47 +0100
-
-snapd (2.43.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - interfaces/opengl: allow datagrams to nvidia-driver
-    - httputil: add NoNetwork(err) helper, spread test and use
-      in serial acquire
-    - interfaces: add uio interface
-    - interfaces/greengrass-support: 'aws-iot-greengrass' snap fails to
-      start due to apparmor deny on mounting of "/proc/latency_stats".
-    - data, packaging: Add sudoers snippet to allow snaps to be run with
-      sudo
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 12 Feb 2020 14:59:15 +0100
-
-snapd (2.43.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - cmd/snap-confine: Revert #7421 (unmount /writable from snap view)
-    - overlord/snapstate: fix for re-refresh bug
-    - tests, run-checks, many: fix nakedret issues
-    - data/selinux: workaround incorrect fonts cache labeling on RHEL7
-    - tests: use test-snapd-upower instead of upower
-    - overlord: increase overall settle timeout for slow arm boards
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 28 Jan 2020 15:50:25 +0100
-
-snapd (2.43.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - devicestate: use httputil.ShouldRetryError() in prepareSerialRequest
-    - overlord/standby: fix possible deadlock in standby test
-    - cmd/snap-discard-ns: fix pattern for .info files
-    - overlord,o/snapstate: make sure we never leave config behind
-    - data/selinux: update policy to cover more cases
-    - snap: remove "host" output from `snap version`
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 14 Jan 2020 20:30:07 +0100
-
-snapd (2.43) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - snap: default to "--direct" in `snap known`
-    - packaging: ship var/lib/snapd/desktop/applications in the
-      pkg
-    - tests: cherry-pick fixes for  snap-set-core-config/ubuntu-core-
-      config-defaults-once
-    - tests: use test-snapd-sh snap instead of test-snapd-tools
-    - tests: rename "test-snapd-sh" in smoke test to test-snapd-sandbox
-    - tests: fix partition creation test
-    - packaging: fix incorrect changelog entry
-    - Revert "tests: 16.04 and 18.04 now have mediating pulseaudio"
-    - tests: 16.04 and 18.04 now have mediating pulseaudio
-    - interfaces: include hooks in plug/slot apparmor label
-    - interfaces: add raw-volume interface for access to partitions
-    - image: set recovery system label when creating the image
-    - cmd/snapd-generator: fix unit name for non /snap mount locations
-    - boot,bootloader: setup the snap recovery system bootenv
-    - seed: support ModeSnaps(mode) for mode != "run"
-    - seed: fix seed location of local but asserted snaps
-    - doc: HACKING.md change autopkgtest-trusty-amd64.img name
-    - interfaces/seccomp: parallelize seccomp backend setup
-    - cmd/snap-bootstrap: mount ubuntu-data tmpfs, in one go with kernel
-      & base
-    - interfaces: add audio-playback/record and pulseaudio spread tests
-    - apparmor: allow 'r'
-      /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
-    - cmd/snap-mgmt, packaging/postrm: stop and remove socket units when
-      purging
-    - tests: use test-snapd-sh snap instead of test-snapd-tools
-    - snap-confine: raise egid before calling setup_private_mount()
-    - tests: fix fwupd version regular expression
-    - snap-bootstrap: parse seed if either kernel or base are not
-      mounted
-    - tests: check for SELinux denials in interfaces-kvm spread test
-    - tests: run snap-set-core-config on all core devices
-    - selinux: update policy to allow modifications related to kmod
-      backend
-    - o/hookstate/ctlcmd: snapctl is-connected command
-    - devicestate: add missing test for failing task setup-run-system
-    - gadget: add missing test for duplicate detection of roles
-    - tests/cmd/snapctl: unset SNAP_CONTEXT for the suite
-    - snap/pack, cmd_pack: 'snap pack --check-skeleton' checks
-      interfaces
-    - gitignore: ignore visual studio code directory
-    - snap-bootstrap: implement "run" mode in snap-bootstrap initramfs-
-      mounts
-    - interfaces/apparmor: handle pre-seeding mode
-    - devicestate: implement creating partitions in "install" mode
-    - seed: support extra snaps on top of Core 20 dangerous models
-    - tests: cache snaps also for ubuntu core and add new snaps to cache
-    - snap-bootstrap: support auto-detect device in create-partitions
-    - tests: fix partitioning test debug message
-    - tests: prevent partitioning test errors
-    - cmd/snap-bootstrap: stub out snap.SanitizePlugsSlots for real
-    - gadget: extract and export new DiskFromPartition() helper
-    - snap-bootstrap: force partition table operations
-    - HACKING.md: add nvidia options to configure example
-    - tests: move the watchdog timeout to 2s to make the tests work in
-      rpi
-    - tests: demand silence from check_journalctl_log
-    - tests: fix the channels checks done on nested tests
-    - tests: reduce the complexity of the test-snapd-sh snap
-    - snap/squashfs, osutil: verify files/dirs can be accessed by
-      mksquashfs when building a snap
-    - boot: add boot.Modeenv.Kernel support
-    - devicestate: ensure system installation
-    - tests: apply change on permissions to serial port on hotplug test
-    - cmd/snap-update-ns: adjust debugging output for usability
-    - devicestate: add reading of modeenv to uc20 firstboot code
-    - tests/lib/prepare: drop workarounds for rpmbuild rewriting /bin/sh
-    - cmd/snap-bootstrap: write /var/lib/snapd/modeenv to the right
-      place
-    - boot: add boot.Modeenv.Base support
-    - overlord/snapstate: install task edges
-    - cmd/snap-bootstrap: some small naming and code org tweaks
-    - snap-bootstrap: remove SNAPPY_TESTING check, we use it for real
-      now
-    - interfaces: remove leftover reservedForOS
-    - snap-bootstrap: write /run/mnt/ubuntu-data/var/lib/snapd/modeenv
-    - osutil/mount: optimize flagOptSearch some more
-    - devicestate: read modeenv early and store in devicestate
-    - interfaces: add login-session-observe for who, {fail,last}log and
-      loginctl
-    - tests: add Ubuntu Eoan to google-sru backend
-    - osutil/mount: de-duplicate code to use a list
-    - interfaces: remove reservedForOS from commonInterface
-    - interfaces/browser-support: allow reading status of huge pages
-    - interfaces: update system-backup tests to not check for sanitize
-      errors related to os
-    - interfaces: add system-backup interface
-    - osutil/mount: add {Unm,M}outFlagsToOpts helpers
-    - snap-bootstrap: make cmdline parsing robust
-    - overlord/patch: normalize tracking channel in state
-    - boot: add boot.Modeenv that can read/write the UC20 modeenv files
-    - bootloader: add new bootloader.InstallBootConfig()
-    - many: share single implementation to list needed default-providers
-    - snap-bootstrap: implement "snap-bootstrap initramfs-mounts"
-    - seccomp: allow chown 'snap_daemon:root' and 'root:snap_daemon'
-    - osutil: handle "rw" mount flag in ParseMountEntry
-    - overlord/ifacestate: report bad plug/slots with warnings on snap
-      install
-    - po: sync translations from launchpad
-    - tests: cleanup most test snaps icons, they were anyway in the
-      wrong place
-    - seed: fix confusing pre snapd dates in tests
-    - many: make ValidateBasesAndProviders signature simpler/canonical
-    - snap-bootstrap: set expected filesystem labels
-    - testutil, many: make MockCommand() create prefix of absolute paths
-    - tests: improve TestDoPrereqRetryWhenBaseInFlight to fix occasional
-      flakiness.
-    - seed: proper support for optional snaps for Core 20 models
-    - many: test various kinds of overriding for the snapd snap in Core
-      20
-    - cmd/snap-failure: passthrough snapd logs, add informational
-      logging
-    - cmd/snap-failure: fallback to snapd from core, extend tests
-    - configcore: fix missing error propagation
-    - devicestate: rename ensureSeedYaml -> ensureSeeded
-    - tests: adding fedora 31
-    - tests: restart the snapd service in the snapd-failover test
-    - seed: Core 20 seeds channel overrides support for grade dangerous
-    - cmd: fix the get command help message
-    - tests: enable degraded test on arch linux after latest image
-      updates
-    - overlord/snapstate: don't re-enable and start disabled services on
-      refresh, etc.
-    - seed: support in Core 20 seeds local unasserted snaps for model
-      snaps
-    - snap-bootstrap: add go-flags cmdline parsing and tests
-    - gadget: skip fakeroot if not needed
-    - overlord/state: panic in MarkEdge() if task is nil
-    - spread: fix typo in spread suite
-    - overlord: mock device serial in gadget remodel unit tests
-    - tests: fix spread shellcheck and degraded tests to unbreak master
-    - spread, tests: openSUSE Tumbleweed to unstable systems, update
-      system-usernames on Amazon Linux 2
-    - snap: extract printInstallHint in cmd_download.go
-    - cmd: fix a pair of typos
-    - release: preseed mode flag
-    - cmd/snap-confine: tracking processes with classic confinement
-    - overlord/ifacestate: remove automatic connections if plug/slot
-      missing
-    - o/ifacestate,interfaces,interfaces/policy: slots-per-plug: *
-    - tests/lib/state: snapshot and restore /var/snap during the tests
-    - overlord: add base->base remodel undo tests and fixes
-    - seed: test and improve Core 20 seed handling errors
-    - asserts: add "snapd" type to valid types in the model assertion
-    - snap-bootstrap: check gadget versus disk partitions
-    - devicestate: add support for gadget->gadget remodel
-    - snap/snapenv: preserve XDG_RUNTIME_DIR for classic confinement
-    - daemon: parse and reject invalid channels in snap ops
-    - overlord: add kernel remodel undo tests and fix undo
-    - cmd/snap: support (but warn) using deprecated multi-slash channel
-    - overlord: refactor mgrsSuite and extract kernelSuite
-    - tests/docker-smoke: add minimal docker smoke test
-    - interfaces: extend the fwupd slot to be implicit on classic
-    - cmd/snap: make 'snap list' shorten latest/$RISK to $RISK
-    - tests: fix for journalctl which is failing to restart
-    - cmd/snap,image: initial support for Core 20 in prepare-image with
-      test
-    - cmd/snap-confine: add support for parallel instances of classic
-      snaps, global mount ns initialization
-    - overlord: add kernel rollback across reboots manager test and
-      fixes
-    - o/devicestate: the basics of Core 20 firstboot support with test
-    - asserts: support and parsing for slots-per-plug/plugs-per-slotSee
-      https://forum.snapcraft.io/t/plug-slot-declaration-rules-greedy-
-      plugs/12438
-    - parts/plugins: don't xz-compress a deb we're going to discard
-    - cmd/snap: make completion skip hidden commands (unless overridden)
-    - many: load/consume Core 20 seeds (aka recovery systems)
-    - tests: add netplan test on ubuntu core
-    - seed/internal: doc comment fix and drop handled TODOs
-    - o/ifacestate: unify code into
-      autoConnectChecker.addAutoConnectionsneed to change to support
-      slots-per-plugs: *
-    - many: changes to testing in preparation of Core 20 seed consuming
-      code
-    - snapstate,devicestate: make OldModel() available in DeviceContext
-    - tests: opensuse tumbleweed has similar issue than arch linux with
-      snap --strace
-    - client,daemon: pass sha3-384 in /v2/download to the client
-    - builtin/browser_support.go: allow monitoring process memory
-      utilization (used by chromium)
-    - overlord/ifacestate: use SetupMany in setupSecurityByBackend
-    - tests: add 14.04 canonical-livepatch test
-    - snap: make `snap known --remote` use snapd if available
-    - seed: share auxInfo20 and makeSystemSnap via internal
-    - spread: disable secondary compression for deltas
-    - interfaces/content: workaround for renamed target
-    - tests/lib/gendevmodel: helper tool for generating developer model
-      assertions
-    - tests: tweak wording in mount-ns test
-    - tests: don't depend on GNU time
-    - o/snapstate, etc: SnapState.Channel -> TrackingChannel, and a
-      setter
-    - seed/seedwriter: support writing Core 20 seeds (aka recovery
-      systems)
-    - snap-recovery: rename to "snap-bootstrap"
-    - managers: add remodel undo test for new required snaps case
-    - client: add xerrors and wrap errors coming from "client"
-    - tests: verify host is not affected by mount-ns tests
-    - tests: configure the journald service for core systems
-    - cmd/snap, store: include snapcraft.io page URL in snap info output
-    - cmd/cmdutil: version helper
-    - spread: enable bboozzoo/snapd-devel-deps COPR repo for getting
-      golang-x-xerrors
-    - interfaces: simplify AddUpdateNS and emit
-    - interfaces/policy: expand cstrs/cstrs1 to
-      altConstraints/constraints
-    - overlord/devicestate: check snap handler for gadget remodel
-      compatibility
-    - snap-recovery: deploy gadget content when creating partitions
-    - gadget: skip structures with MBR role during remodel
-    - tests: do not use lsblk in uc20-snap-recovery test
-    - overlord/snapstate: add LastActiveDisabledServices,
-      missingDisabledServices
-    - overlord/devicestate: refactor and split into per-functionality
-      files, drop dead code
-    - tests: update mount-ns after addition of /etc/systemd/user
-    - interfaces/pulseaudio: adjust to manually connect by default
-    - interfaces/u2f-devices: add OnlyKey to devices list
-    - interfaces: emit update-ns snippets to function
-    - interfaces/net-setup-{observe,control}: add Info D-Bus method
-      accesses
-    - tests: moving ubuntu-19.10-64 from google-unstable to google
-      backend
-    - gadget: rename existing and add new helpers for checking
-      filesystem/partition presence
-    - gadget, overlord/devicestate: add support for customized update
-      policy, add remodel policy
-    - snap-recovery: create filesystems as defined in the gadget
-    - tests: ignore directories for go modules
-    - policy: implement CanRemove policy for the snapd type
-    - overlord/snapstate: skip catalog refresh if unseeded
-    - strutil: add OrderedSet
-    - snap-recovery: add minimal binary so that we can use spread on it
-    - gadget, snap/pack: perform extended validation of gadget metadata
-      and contents
-    - timeutil: fix schedules with ambiguous nth weekday spans
-    - interfaces/many: allow k8s/systemd-run to mount volume subPaths
-      plus cleanups
-    - client: add KnownOptions to Know() and support remote assertions
-    - tests: check the apparmor_parser when the file exists on snap-
-      confine test
-    - gadget: helper for volume compatibility checks
-    - tests: update snap logs to match for multiple lines for "running"
-    - overlord: add checks for bootvars in
-      TestRemodelSwitchToDifferentKernel
-    - snap-install: add ext4,vfat creation support
-    - snap-recovery: remove "usedPartitions" from sfdisk.Create()
-    - image,seed: hide Seed16/Snap16, use seed.Open in image_test.go
-    - cmd/snap: Sort tasks in snap debug timings output by lanes and
-      ready-time.
-    - snap-confine.apparmor.in: harden pivot_root until we have full
-      mediation
-    - gadget: refactor ensureVolumeConsistency
-    - gadget: add a public helper for parsing gadget metadata
-    - many: address issues related to explicit/implicit channels for
-      image building
-    - overlord/many: switch order of check snap parameters
-    - cmd/snap-confine: remove leftover condition from capability world
-    - overlord: set fake serial in TestRemodelSwitchToDifferentKernel
-    - overlord/many: extend check snap callback to take snap container
-    - recovery-tool: add sfdisk wrapper
-    - tests: launch the lxd images following the pattern
-      ubuntu:${VERSION_ID}
-    - sandbox/cgroup: move freeze/thaw code
-    - gadget: accept system-seed role and ubuntu-data label
-    - test/lib/names.sh: make backslash escaping explicit
-    - spread: generate delta when using google backend
-    - cmd/snap-confine: remove loads of dead code
-    - boot,dirs,image: various refinements in the prepare-image code
-      switched to seedwriter
-    - spread: include mounts list in task debug output
-    - .gitignore: pair of trivial changes
-    - image,seed/seedwriter: switch image to use seedwriter.Writer
-    - asserts: introduce explicit support for grade for Core 20 models
-    - usersession: drive by fixes for things flagged by unused or
-      gosimple
-    - spread.yaml: exclude vendor dir
-    - sandbox/cgroup, overlord/snapstate: move helper for listing pids
-      in group to the cgroup package
-    - sandbox/cgroup: refactor process cgroup helper to support v2 and
-      named hierarchies
-    - snap-repair: error if run as non-root
-    - snap: when running `snap repair` without arguments, show hint
-    - interfaces: add cgroup-version to system-key
-    - snap-repair: add missing check in TestRepairBasicRun
-    - tests: use `snap model` instead of `snap known model` in tests
-    - daemon: make /v2/download take snapRevisionOptions
-    - snap-repair: add additional comment about trust in runner.Verify()
-    - client: add support to use the new "download" API
-    - interfaces: bump system-key version (and keep on bumping)
-    - interfaces/mount: account for cgroup version when reporting
-      supported features
-    - tests: change regex to validate access to cdn during snap
-      download
-    - daemon: change /v2/download API to take "snap-name" as input
-    - release: make forced dev mode look at cgroupv2 support
-    - seed/seedwriter: support for extra snaps
-    - wrappers/services.go: add disabled svc list arg to AddSnapServices
-    - overlord/snapstate: add SetTaskSnapSetup helper + unit tests
-    - cmd/libsnap: use cgroup.procs instead of tasks
-    - tests: fix snapd-failover test for core18 tests on boards
-    - overlord/snapstate/policy, etc: introduce policy, move canRemove
-      to it
-    - seed/seedwriter: cleanups and small left over todos* drive-by: use
-      testutil.FilePresent consistently
-    - cmd/snap: update 'snap find' help because it's no longer narrow
-    - seed/seedwriter,snap/naming: support classic models
-    - cmd/snap-confine: unmount /writable from snap view
-    - spread.yaml: exclude automake cacheThe error message is looks like
-      this:dpkg-source: info: local changes detected, the modified files
-      are:
-    - interfaces/openvswitch: allow access to other openvswitch sockets
-    - cmd/model: don't show model with display-name inline w/ opts
-    - daemon: add a 'prune' debug action
-    - client: add doTimeout to http.Client{Timeout}
-    - interfaces/seccomp: query apparmor sandbox helper rather than
-      aggregate info
-    - sandbox/cgroup: avoid dependency on dirs
-    - seed/seedwriter,snap: support local snaps
-    - overlord/snapstate: fix undo on firstboot seeding.
-    - usersession: track connections to session agent for exit on idle
-      and peer credential checks
-    - tests: fix ubuntu-core-device-reg test for arm devices on core18
-    - sandbox/seccomp: move the remaining sandbox bits to a
-      corresponding sandbox package
-    - osutil: generalize SyncDir with FileState interface
-    - daemon, client, cmd/snap: include architecture in 'snap version'
-    - daemon: allow /v2/assertions/{assertType} to query store
-    - gadget: do not fail the update when old gadget snap is missing
-      bare content
-    - sandbox/selinux: move SELinux related bits from 'release' to
-      'sandbox/selinux'
-    - tests: add unit test for gadget defaults with a multiline string
-    - overlord/snapstate: have more context in the errors about
-      prerequisites
-    - httputil: set user agent for CONNECT
-    - seed/seedwriter: resolve channels using channel.Resolve* for snaps
-    - run-checks: allow overriding gofmt binary, show gofmt diff
-    - asserts,seed/seedwriter: follow snap type sorting in the model
-      assertion snap listings
-    - daemon: return "snapname_rev.snap" style when using /v2/download
-    - tests: when the backend is external skip the loop waiting for snap
-      version
-    - many: move AppArmor probing code under sandbox/apparmor
-    - cmd: add `snap debug boot-vars` that dumps the current bootvars
-    - tests: skip the ubuntu-core-upgrade on arm devices on core18
-    - seed/seedwriter: implement WriteMeta and tree16 corresponding code
-    - interfaces/docker-support,kubernetes-support: misc updates for
-      strict k8s
-    - tests: restart the journald service while preparing the test
-    - tests/cmd/debug_state: make the test output TZ independent
-    - interfaces/kubernetes-support: allow use of /run/flannel
-    - seed/seedwriter: start of Writer and internal policy16/tree16
-    - sandbox/cgroup, usersession/userd: move cgroup related helper to a
-      dedicated package
-    - tests: move "centos-7" to unstable systems
-    - snapstate: add missing tests for checkGadgetOrKernel
-    - docs: Update README.md
-    - snapcraft: set license to GPL-3.0
-    - interfaces/wayland: allow a confined server running in a user
-      session to work with Qt, GTK3 & SDL2 clients
-    - selinux: move the package under sandbox/selinux
-    - interfaces/udev: account for cgroup version when reporting
-      supported features
-    - store, ..., client: add a "website" field
-    - sanity: sanity check cgroup probing
-    - snapstate: increase settleTimeout in
-      TestRemodelSwitchToDifferentKernel
-    - packaging: remove obsolete usr.lib.snapd.snap-confine in postinst
-    - data/selinux: allow snapd/snap to do statfs() on the cgroup
-      mountpoint
-    - usersession/userd: make sure to export DBus interfaces before
-      requesting a name
-    - data/selinux: allow snapd to issue sigkill to journalctl
-    - docs: Add Code of Conduct
-    - store: download propagates options to delta download
-    - tests/main/listing: account for dots in ~pre suffix
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 09 Jan 2020 17:14:51 +0100
-
-snapd (2.42.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - snap-confine: revert, with comment, explicit unix deny for nested
-      lxd
-    - Disable mount-ns test on 16.04. It is too flaky currently.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 06 Dec 2019 14:10:56 +0100
-
-snapd (2.42.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - overlord/snapstate: make sure configuration defaults are applied
-      only once
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 28 Nov 2019 06:48:26 +0100
-
-snapd (2.42.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - overlord/snapstate: pick up system defaults when seeding the snapd
-      snap
-    - cmd/snap-update-ns: fix overlapping, nested writable mimic
-      handling
-    - interfaces: misc updates for u2f-devices, browser-support,
-      hardware-observe, et al
-    - tests: reset failing "fwupd-refresh.service" if needed
-    - tests/main/gadget-update-pc: use a program to modify gadget yaml
-    - snap-confine: suppress noisy classic snap file_inherit denials
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 27 Nov 2019 12:41:07 +0100
-
-snapd (2.42.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - interfaces/lxd-support: Fix on core18
-    - tests/main/system-usernames: Amazon Linux 2 comes with libseccomp
-      2.4.1 now
-    - snap-seccomp: add missing clock_getres_time64
-    - cmd/snap-seccomp/syscalls: update the list of known
-      syscalls
-    - sandbox/seccomp: accept build ID generated by Go toolchain
-    - interfaces: allow access to ovs bridge sockets
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 20 Nov 2019 08:09:15 +0100
-
-snapd (2.42.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1846181
-    - interfaces: de-duplicate emitted update-ns profiles
-    - packaging: tweak handling of usr.lib.snapd.snap-confine
-    - interfaces: allow introspecting network-manager on core
-    - tests/main/interfaces-contacts-service: disable on openSUSE
-      Tumbleweed
-    - tests/lib/lxd-snapfuse: restore mount changes introduced by LXD
-    - snap: fix default-provider in seed validation
-    - tests: update system-usernames test now that opensuse-15.1 works
-    - overlord: set fake sertial in TestRemodelSwitchToDifferentKernel
-    - gadget: rename "boot{select,img}" -> system-boot-{select,image}
-    - tests: listing test, make accepted snapd/core versions consistent
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 30 Oct 2019 13:17:43 +0100
-
-snapd (2.42) xenial; urgency=medium
-
-  * New upstream release, LP: #1846181
-    - tests: disable {contacts,calendar}-service tests on debian-sid
-    - tests/main/snap-run: disable strace test cases on Arch
-    - cmd/system-shutdown: include correct prototype for die
-    - snap/naming: add test for hook name connect-plug-i2c
-    - cmd/snap-confine: allow digits in hook names
-    - gadget: do not fail the update when old gadget snap is missing
-      bare content
-    - tests: disable {contacts,calendar}-service tests on Arch Linux
-    - tests: move "centos-7" to unstable systems
-    - interfaces/docker-support,kubernetes-support: misc updates for
-      strict k8s
-    - packaging: remove obsolete usr.lib.snapd.snap-confine in
-      postinst
-    - tests: add test that ensures our snapfuse binary actually works
-    - packaging: use snapfuse_ll to speed up snapfuse performance
-    - usersession/userd: make sure to export DBus interfaces before
-      requesting a name
-    - data/selinux: allow snapd to issue sigkill to journalctl
-    - store: download propagates options to delta download
-    - wrappers: allow snaps to install icon theme icons
-    - debug: state-inspect debugging utility
-    - sandbox/cgroup: introduce cgroup wrappers package
-    - snap-confine: fix return value checks for udev functions
-    - cmd/model: output tweaks, add'l tests
-    - wrappers/services: add ServicesEnableState + unit tests
-    - tests: fix newline and wrong test name pointed out in previous PRs
-    - tests: extend mount-ns test to handle mimics
-    - run-checks, tests/main/go: allow gofmt checks to be skipped on
-      19.10
-    - tests/main/interfaces-{calendar,contacts}-service: disable on
-      19.10
-    - tests: part3 making tests work on ubuntu-core-18
-    - tests: fix interfaces-timeserver-control on 19.10
-    - overlord/snapstate: config revision code cleanup and extra tests
-    - devicestate: allow remodel to different kernels
-    - overlord,daemon: adjust startup timeout via EXTEND_TIMEOUT_USEC
-      using an estimate
-    - tests/main/many: increase kill-timeout to 5m
-    - interfaces/kubernetes-support: allow systemd-run to ptrace read
-      unconfined
-    - snapstate: auto transition on experimental.snapd-snap=true
-    - tests: retry checking until the written file on desktop-portal-
-      filechooser
-    - tests: unit test for a refresh failing on configure hook
-    - tests: remove mount_id and parent_id from mount-ns test data
-    - tests: move classic-ubuntu-core-transition* to nightly
-    - tests/mountinfo-tool: proper formatting of opt_fields
-    - overlord/configstate: special-case "null" in transaction Changes()
-    - snap-confine: fallback gracefully on a cgroup v2 only system
-    - tests: debian sid now ships new seccomp, adjust tests
-    - tests: explicitly restore after using LXD
-    - snapstate: make progress reporting less granular
-    - bootloader: little kernel support
-    - fixme: rename ubuntu*architectures to dpkg*architectures
-    - tests: run dbus-launch inside a systemd unit
-    - channel: introduce Resolve and ResolveLocked
-    - tests: run failing tests on ubuntu eoan due to is now set as
-      unstable
-    - systemd: detach rather than unmount .mount units
-    - cmd/snap-confine: add unit tests for sc_invocation, cleanup memory
-      leaks in tests
-    - boot,dirs,image: introduce boot.MakeBootable, use it in image
-      instead of ad hoc code
-    - cmd/snap-update-ns: clarify sharing comment
-    - tests/overlord/snapstate: refactor for cleaner test failures
-    - cmd/snap-update-ns: don't propagate detaching changes
-    - interfaces: allow reading mutter Xauthority file
-    - cmd/snap-confine: fix /snap duplication in legacy mode
-    - tests: fix mountinfo-tool filtering when used with rewriting
-    - seed,image,o/devicestate: extract seed loading to seed/seed16.go
-    - many: pass the rootdir and options to bootloader.Find
-    - tests: part5 making tests work on ubuntu-core-18
-    - cmd/snap-confine: keep track of snap instance name and the snap
-      name
-    - cmd: unify die() across C programs
-    - tests: add functions to make an abstraction for the snaps
-    - packaging/fedora, tests/lib/prepare-restore: helper tool for
-      packing sources for RPM
-    - cmd/snap: improve help and error msg for snapshot commands
-    - hookstate/ctlcmd: fix snapctl set help message
-    - cmd/snap: don't append / to snap name just because a dir exists
-    - tests: support fastly-global.cdn.snapcraft.io url on proxy-no-core
-      test
-    - tests: add --quiet switch to retry-tool
-    - tests: add unstable stage for travis execution
-    - tests: disable interfaces-timeserver-control on 19.10
-    - tests: don't guess in is_classic_confinement_supported
-    - boot, etc: simplify BootParticipant (etc) usage
-    - tests: verify retry-tool not retrying missing commands
-    - tests: rewrite "retry" command as retry-tool
-    - tests: move debug section after restore
-    - cmd/libsnap-confine-private, cmd/s-c: use constants for
-      snap/instance name lengths
-    - tests: measure behavior of the device cgroup
-    - boot, bootloader, o/devicestate: boot env manip goes in boot
-    - tests: enabling ubuntu 19.10-64 on spread.yaml
-    - tests: fix ephemeral mount table in left over by prepare
-    - tests: add version-tool for comparing versions
-    - cmd/libsnap: make feature flag enum 1<<N style
-    - many: refactor boot/boottest and move to bootloader/bootloadertest
-    - tests/cross/go-build: use go list rather than shell trickery
-    - HACKING.md: clarify where "make fmt" is needed
-    - osutil: make flock test more robust
-    - features, overlord: make parallel-installs exported, export flags
-      on startup
-    - overlord/devicestate:  support the device service returning a
-      stream of assertions
-    - many: add snap model command, add /v2/model, /v2/model/serial REST
-      APIs
-    - debian: set GOCACHE dir during build to fix FTBFS on eoan
-    - boot, etc.: refactor boot to have a lookup with different imps
-    - many: add the start of Core 20 extensions support to the model
-      assertion
-    - overlord/snapstate: revert track-risk behavior change and
-      validation on install
-    - cmd/snap,image,seed:  move image.ValidateSeed to
-      seed.ValidateFromYaml
-    - image,o/devicestate,seed: oops, make sure to clear seedtest
-      helpers
-    - tests/main/snap-info: update check.py for test-snapd-tools 2.0
-    - tests: moving tests to nightly suite
-    - overlord/devicestate,seed:  small step, introduce
-      seed.LoadAssertions and use it from firstboot
-    - snapstate: add comment to checkVersion vs strutil.VersionCompare
-    - tests: add unit tests for cmd_whoami
-    - tests: add debug section to interfaces-contacts-service
-    - many: introduce package seed and seedtest
-    - interfaces/bluez: enable communication between bluetoothd and
-      meshd via dbus
-    - cmd/snap: fix snap switch message
-    - overlord/snapstate: check channel names on install
-    - tests: check snap_daemon user and group on system-usernames-
-      illegal test are not created
-    - cmd/snap-confine: fix group and permission of .info files
-    - gadget: do not error on gadget refreshes with multiple volumes
-    - snap: use deterministic paths to find the built deb
-    - tests: just build snapd commands on go-build test
-    - tests: re-enable mount-ns test on classic
-    - tests: rename fuse_support to fuse-support
-    - tests: move restore-project-each code to existing function
-    - tests: simplify interfaces-account-control test
-    - i18n, vendor, packaging: drop github.com/ojii/gettext.go, use
-      github.com/snapcore/go-gettext
-    - tests: always say 'restore: |'
-    - tests: new test to check the output after refreshing/reverting
-      core
-    - snapstate: validate all system-usernames before creating them
-    - tests: fix system version check on listing test for external
-      backend
-    - tests: add check for snap_daemon user/group
-    - tests: don't look for lxcfs in mountinfo
-    - tests: adding support for arm devices on ubuntu-core-device-reg
-      test
-    - snap: explicitly forbid trying to parallel install from seed
-    - tests: remove trailing spaces from shell scripts
-    - tests: remove locally installed revisions of core
-    - tests: fix removal of snaps on ubuntu-core
-    - interfaces: support Tegra display drivers
-    - tests: move interfaces-contacts-service to /tmp
-    - interfaces/network-manager: allow using
-      org.freedesktop.DBus.ObjectManager
-    - tests: restore dpkg selections after upgrade-from-2.15 test
-    - tests: pass --remove to userdel on core
-    - snap/naming: simplify SnapSet somewhat
-    - devicestate/firstboot: check for missing bases early
-    - httputil: rework protocol error detection
-    - tests: unmount fuse connections only if not initially mounted
-    - snap: prevent duplicated snap name and snap files when parsing
-      seed.yaml
-    - tests: re-implement user tool in python
-    - image: improve/tweak some warning/error messages
-    - cmd/libsnap-confine-private: add checks for parallel instances
-      feature flag
-    - tests: wait_for_service shows status after actual first minute
-    - sanity: report proper errror when fuse is needed but not available
-    - snap/naming: introduce SnapRef, Snap, and SnapSet
-    - image: support prepare-image --classic for snapd snap only
-      imagesConsequently:
-    - tests/main/mount-ns: account for clone_children in cpuset cgroup
-      on 18.04
-    - many:  merging asserts.Batch Precheck with CommitTo and other
-      clarifications
-    - devicestate: add missing test for remodeling possibly removing
-      required flag
-    - tests: use user-tool to remove test user in the non-home test
-    - overlord/configstate: sort patch keys to have deterministic order
-      with snap set
-    - many: generalize assertstate.Batch to asserts.Batch, have
-      assertstate.AddBatch
-    - gadget, overlord/devicestate: rename Position/Layout
-    - store, image, cmd: make 'snap download' leave partials
-    - httputil: improve http2 PROTOCOL_ERROR detection
-    - tests: add new "user-tool" helper and use in system-user tests
-    - tests: clean up after NFS tests
-    - ifacestate: optimize auto-connect by setting profiles once after
-      all connects
-    - hookstate/ctlcmd: snapctl unset command
-    - tests: allow test user XDG_RUNTIME_DIR to phase out
-    - tests: cleanup "snap_daemon" user in system-usernames-install-
-      twice
-    - cmd/snap-mgmt: set +x on startup
-    - interfaces/wayland,x11: allow reading an Xwayland Xauth file
-    - many: move channel parsing to snap/channel
-    - check-pr-title.py: allow {} in pr prefix
-    - tests: spam test logs less while waiting for systemd unit to stop
-    - tests: remove redundant activation check for snapd.socket
-      snapd.service
-    - tests: trivial snapctl test cleanup
-    - tests: ubuntu 18.10 removed from the google-sru backend on the
-      spread.yaml
-    - tests: add new cases into arch_test
-    - tests: clean user and group for test system-usernames-install-
-      twice
-    - interfaces: k8s worker node updates
-    - asserts: move Model to its own model.go
-    - tests: unmount binfmt_misc on cleanup
-    - tests: restore nsdelegate clobbered by LXD
-    - cmd/snap: fix snap unset help string
-    - tests: unmount fusectl after testing
-    - cmd/snap: fix remote snap info for parallel installed snaps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 01 Oct 2019 11:24:41 +0200
-
-snapd (2.41) xenial; urgency=medium
-
-  * New upstream release, LP: #1840740
-    - overlord/snapstate: revert track-risk behavior
-    - tests: fix snap info test
-    - httputil: rework protocol error detection
-    - gadget: do not error on gadget refreshes with multiple volumes
-    - i18n, vendor, packaging: drop github.com/ojii/gettext.go, use
-      github.com/snapcore/go-gettext
-    - snapstate: validate all system-usernames before creating them
-    - mkversion.sh: fix version from git checkouts
-    - interfaces/network-{control,manager}: allow 'k' on
-      /run/resolvconf/**
-    - interfaces/wayland,x11: allow reading an Xwayland Xauth file
-    - interfaces: k8s worker node updates
-    - debian: re-enable systemd environment generator
-    - many: create system-usernames user/group if both don't exist
-    - packaging: fix symlink for snapd.session-agent.socket
-    - tests: change cgroups so that LXD doesn't have to
-    - interfaces/network-setup-control: allow dbus netplan apply
-      messages
-    - tests: add /var/cache/snapd to the snapd state to prevent error on
-      the store
-    - tests: add test for services disabled during refresh hook
-    - many: simpler access to snap-seccomp version-info
-    - snap: cleanup some tests, clarify some errorsThis is a follow up
-      from work on system usernames:
-    - osutil: add osutil.Find{Uid,Gid}
-    - tests: use a different archive based on the spread backend on go-
-      build test
-    - cmd/snap-update-ns: fix pair of bugs affecting refresh of snap
-      with layouts
-    - overlord/devicestate: detect clashing concurrent (ongoing, just
-      finished) remodels or changes
-    - interfaces/docker-support: declare controls-device-cgroup
-    - packaging: fix removal of old apparmor profile
-    - store: use track/risk for "channel" name when parsing store
-      details
-    - many: allow 'system-usernames' with libseccomp > 2.4 and golang-
-      seccomp > 0.9.0
-    - overlord/devicestate, tests: use gadget.Update() proper, spread
-      test
-    - overlord/configstate/configcore: allow setting start_x=1 to enable
-      CSI camera on RPi
-    - interfaces: remove BeforePrepareSlot from commonInterface
-    - many: support system-usernames for 'snap_daemon' user
-    - overlord/devicestate,o/snapstate: queue service commands before
-      mark-seeded and other final tasks
-    - interfaces/mount: discard mount ns on backend Remove
-    - packaging/fedora: build on RHEL8
-    - overlord/devicestate: support seeding a classic system with the
-      snapd snap and no core
-    - interfaces: fix test failure in gpio_control_test
-    - interfaces, policy: remove sanitize helpers and use minimal policy
-      check
-    - packaging: use %systemd_user_* macros to enable session agent
-      socket according to presets
-    - snapstate, store: handle 429s on catalog refresh a little bit
-      better
-    - tests: part4 making tests work on ubuntu-core-18
-    - many: drop snap.ReadGadgetInfo wrapper
-    - xdgopenproxy: update test API to match upstream
-    - tests: show why sbuild failed
-    - data/selinux: allow mandb_t to search /var/lib/snapd
-    - tests: be less verbose when checking service status
-    - tests: set sbuild test as manual
-    - overlord: DeviceCtx must find the remodel context for a remodel
-      change
-    - tests: use snap info --verbose to check for base
-    - sanity: unmount squashfs with --lazy
-    - overlord/snapstate: keep current track if only risk is specified
-    - interfaces/firewall-control: support nft routing expressions and
-      device groups
-    - gadget: support for writing symlinks
-    - tests: mountinfo-tool fail if there are no matches
-    - tests: sync journal log before start the test
-    - cmd/snap, data/completion: improve completion for 'snap debug'
-    - httputil: retry for http2 PROTOCOL_ERROR
-    - Errata commit: pulseaudio still auto-connects on classic
-    - interfaces/misc: updates for k8s 1.15 (and greengrass test)
-    - tests: set GOTRACEBACK=1 when running tests
-    - cmd/libsnap: don't leak memory in sc_die_on_error
-    - tests: improve how the system is restored when the upgrade-
-      from-2.15 test fails
-    - interfaces/bluetooth-control: add udev rules for BT_chrdev devices
-    - interfaces: add audio-playback/audio-record and make pulseaudio
-      manually connect
-    - tests: split the sbuild test in 2 depending on the type of build
-    - interfaces: add an interface granting access to AppStream metadata
-    - gadget: ensure filesystem labels are unique
-    - usersession/agent: use background context when stopping the agent
-    - HACKING.md: update spread section, other updates
-    - data/selinux: allow snap-confine to read entries on nsfs
-    - tests: respect SPREAD_DEBUG_EACH on the main suite
-    - packaging/debian-sid: set GOCACHE to a known writable location
-    - interfaces: add gpio-control interface
-    - cmd/snap: use showDone helper with 'snap switch'
-    - gadget: effective structure role fallback, extra tests
-    - many: fix unit tests getting stuck
-    - tests: remove installed snap on restore
-    - daemon: do not modify test data in user suite
-    - data/selinux: allow read on sysfs
-    - packaging/debian: don't md5sum absent files
-    - tests: remove test-snapd-curl
-    - tests: remove test-snapd-snapctl-core18 in restore
-    - tests: remove installed snap in the restore section
-    - tests: remove installed test snap
-    - tests: correctly escape mount unit path
-    - cmd/Makefile.am: support building with the go snap
-    - tests: work around classic snap affecting the host
-    - tests: fix typo "current"
-    - overlord/assertstate: add Batch.Precheck to check for the full
-      validity of the batch before Commit
-    - tests: restore cpuset clone_children clobbered by lxd
-    - usersession: move userd package to usersession/userd
-    - tests: reformat and fix markdown in snapd-state.md
-    - gadget: select the right updater for given structure
-    - tests: show stderr only if it exists
-    - sessionagent: add a REST interface with socket activation
-    - tests: remove locally installed core in more tests
-    - tests: remove local revision of core
-    - packaging/debian-sid: use correct apparmor Depends for Debian
-    - packaging/debian-sid: merge debian upload changes back into master
-    - cmd/snap-repair: make sure the goroutine doesn't stick around on
-      timeout
-    - packaging/fedora: github.com/cheggaaa/pb is no longer used
-    - configstate/config: fix crash in purgeNulls
-    - boot, o/snapst, o/devicest: limit knowledge of boot vars to boot
-    - client,cmd/snap: stop depending on status/status-code in the JSON
-      responses in client
-    - tests: unmount leftover /run/netns
-    - tests: switch mount-ns test to manual
-    - overlord,daemon,cmd/snapd:  move expensive startup to dedicated
-      StartUp methods
-    - osutil: add EnsureTreeState helper
-    - tests: measure properties of various  mount namespaces
-    - tests: part2 making tests work on ubuntu-core-18
-    - interfaces/policy: minimal policy check for replacing
-      sanitizeReservedFor helpers (1/2)
-    - interfaces: add an interface that grants access to the PackageKit
-      service
-    - overlord/devicestate: update gadget update handlers and mocks
-    - tests: add mountinfo-tool --ref-x1000
-    - tests: remove lxd / lxcfs if pre-installed
-    - tests: removing support for ubuntu cosmic on spread test suite
-    - tests: don't leak /run/netns mount
-    - image: clean up the validateSuite
-    - bootloader: remove "Dir()" from Bootloader interface
-    - many: retry to reboot if snapd gets restarted before expected
-      reboot
-    - overlord: implement re-registration remodeling
-    - cmd: revert PR#6933 (tweak of GOMAXPROCS)
-    - cmd/snap: add snap unset command
-    - many: add Client-User-Agent to "SnapAction" install API call
-    - tests: first part making tests run on ubuntu-core-18
-    - hookstate/ctlcmd: support hidden commands in snapctl
-    - many: replace snapd snap name checks with type checks (3/4)
-    - overlord: mostly stop needing Kernel/CoreInfo, make GadgetInfo
-      consider a DeviceContext
-    - snapctl: handle unsetting of config options with "!"
-    - tests: move core migration snaps to tests/lib/snaps dir
-    - cmd/snap: handle unsetting of config options with "!"
-    - cmd/snap, etc: add health to 'snap list' and 'snap info'
-    - gadget: use struct field names when intializing data in mounted
-      updater unit tests
-    - cmd/snap-confine: bring /lib/firmware from the host
-    - snap: set snapd snap type (1/4)
-    - snap: add checks in validate-seed for missing base/default-
-      provider
-    - daemon: replace shutdownServer with net/http's native shutdown
-      support
-    - interfaces/builtin: add exec "/bin/runc" to docker-support
-    - gadget: mounted filesystem updater
-    - overlord/patch: simplify conditions for re-applying sublevel
-      patches for level 6
-    - seccomp/compiler: adjust test case names and comment for later
-      changes
-    - tests: fix error doing snap pack running failover test
-    - tests: don't preserve size= when rewriting mount tables
-    - tests: allow reordering of rewrite operations
-    - gadget: main update routine
-    - overlord/config: normalize nulls to support config unsetting
-      semantics
-    - snap-userd-autostart: don't list as a startup application on the
-      GUI
-    - tests: renumber snap revisions as seen via writable
-    - tests: change allocation for mount options
-    - tests: re-enable ns-re-associate test
-    - tests: mountinfo-tool allow many --refs
-    - overlord/devicestate: implement reregRemodelContext with the
-      essential re-registration logic
-    - tests: replace various numeric mount options
-    - gadget: filesystem image writer
-    - tests: add more unit tests for mountinfo-tool
-    - tests: introduce mountinfo-tool --ref feature
-    - tests: refactor mountinfo-tool rewrite state
-    - tests: allow renumbering mount namespace identifiers
-    - snap: refactor and explain layout blacklisting
-    - tests: renumber snap revisions as seen via hostfs
-    - daemon, interfaces, travis: workaround build ID with Go 1.9, use
-      1.9 for travis tests
-    - cmd/libsnap: add sc_error_init_{simple,api_misuse}
-    - gadget: make raw updater handle shifted structures
-    - tests/lib/nested: create WORK_DIR before accessing it
-    - cmd/libsnap: rename SC_LIBSNAP_ERROR to SC_LIBSNAP_DOMAIN
-    - cmd,tests: forcibly discard mount namespace when bases change
-    - many: introduce healthstate, run check-health
-      post-(install/refresh/try/revert)
-    - interfaces/optical-drive: add scsi-generic type 4 and 5 support
-    - cmd/snap-confine: exit from helper when parent dies
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 30 Aug 2019 08:56:16 +0200
-
-snapd (2.40) xenial; urgency=medium
-
-  * New upstream release, LP: #1836327
-    - overlord/patch: simplify conditions for re-applying sublevel
-      patches for level 6
-    - cmd,tests: forcibly discard mount namespace when bases change
-    - cmd/snap-confine: handle device cgroup before pivot
-    - cmd/snap-apparmor-service: quit if there are no profiles
-    - cmd/snap, image: add --target-directory and --basename to 'snap
-      download'
-    - interfaces: add jack1 implicit classic interface
-    - interfaces: miscellaneous policy updates
-    - daemon: classic confinement is not supported on core
-    - interfaces: bluetooth-control: add mtk BT device node
-    - cmd/snap-seccomp: initial support for negative arguments with
-      uid/gid caching
-    - snap-confine: move seccomp load after permanent privilege drop
-    - tests: new profiler snap used to track cpu and memory for snapd
-      and snap commands
-    - debian: make maintainer scripts do nothing on powerpc
-    - gadget: mounted filesystem writer
-    - cmd/snap: use padded checkers for snapshot output
-    - bootloader: switch to bootloader_test style testing
-    - gadget: add a wrapper for generating partitioned images with
-      sfdisk
-    - tests/main/snap-seccomp-syscalls: add description
-    - tests: continue executing on errors either updating the repo db or
-      installing dependencies
-    - cmd/snap-seccomp/syscalls: add io_uring syscalls
-    - systemd: add InstanceMode enumeration to control which systemd
-      instance to control
-    - netutil: extract socket activation helpers from daemon package.
-    - interfaces: spi: update regex rules to accept spi nodes like
-      spidev12345.0
-    - gadget: fallback device lookup
-    - many: add strutil.ElliptLeft, use it for shortening cohorts
-    - wrappers: allow sockets under $XDG_RUNTIME_DIR
-    - gadget: add wrapper for creating and populating filesystems
-    - gadget: add writer for offset-write
-    - gadget: support relative symlinks in device lookup
-    - snap, snapstate: additional validation of base field
-    - many: fix some races and missing locking, make sure UDevMonitor is
-      stopped
-    - boot: move ExtractKernelAssets
-    - daemon, snap: screenshots _only_ shows the deprecation notice,
-      from 2.39
-    - osutil: add a workaround for overlayfs apparmor as it is used on
-      Manjaro
-    - snap: introduce GetType() function for snap.Info
-    - tests: update systems to be used for during sru validation
-    - daemon: increase `shutdownTimeout` to 25s to deal with slow
-      HW
-    - interfaces/network-manager: move deny ptrace to the connected slot
-    - interfaces: allow locking of pppd files
-    - cmd/snap-exec: fix snap completion for classic snaps with non
-      /usr/lib/snapd libexecdir
-    - daemon: expose pprof endpoints
-    - travis: disable snap pack on OSX
-    - client, cmd/snap: expose the new cohort options for snap ops
-    - overlord/snapstate: tweak switch summaries
-    - tests: reuse the image created initially for nested tests
-      execution
-    - tests/lib/nested: tweak assert disk prepare step
-    - daemon, overlord/snapstate: support leave-cohort
-    - tests/main/appstream-id: collect debug info
-    - store,daemon: add client-user-agent support to store.SnapInfo
-    - tests: add check for invalid PR titles in the static checks
-    - tests: add snap-tool for easier access to internal tools
-    - daemon: unexport file{Response,Stream}
-    - devicestate: make TestUpdateGadgetOnClassicErrorsOut less racy
-    - tests: fix test desktop-portal-filechooser
-    - tests: sort commands from DumpCommands in the dumpDbHook
-    - cmd/snap: add unit test for "advise-snap --dump-db".
-    - bootloader: remove extra mock bootloader implementation
-    - daemon: tweak for "add api endpoint for download" PR
-    - packaging: fix reproducible build error
-    - tests: synchronize journal logs before check logs
-    - tests: fix snap service watchdog test
-    - tests: use more readable test directory names
-    - tests/regression/lp-1805485: update test description
-    - overlord: make changes conflict with remodel
-    - tests: make sure the snapshot unit test uses a snapshot time
-      relative to Now()
-    - tests: revert "tests: stop catalog-update/apt-hooks test for now"
-    - tests: mountinfo-tool --one prints matches on failure
-    - data/selinux: fix policy for snaps with bases and classic snaps
-    - debian: fix building on eoan by tweaking golang build-deps
-    - packaging/debian-sid: update required golang version to 1.10
-    - httputil: handle "no such host" error explicitly and do not retry
-      it
-    - overlord/snapstate, & fallout: give Install a *RevisionOptions
-    - cmd/snap: don't run install on 'snap --help install'
-    - gadget: raw/bare structure writer and updater
-    - daemon, client, cmd/snap: show cohort key in snap info --verbose
-    - overlord/snapstate: add update-gadget task when needed, block
-      other changes
-    - image: turn a missing default content provider into an error
-    - overlord/devicestate: update-gadget-assets task handler with
-      stubbed gadget callbacks
-    - interface: builtin: avahi-observe/control: update label for
-      implicit slot
-    - tests/lib/nested: fix multi argument copy_remote
-    - tests/lib/nested: have mkfs.ext4 use a rootdir instead of mounting
-      an image
-    - packaging: fix permissions powerpc docs dir
-    - overlord: mock store to avoid net requests
-    - debian: rework how we run autopkgtests
-    - interface: builtin: avahi-observe/control: allow slots
-      implementation also by app snap on classic system
-    - interfaces: builtin: utils: add helper function to identify system
-      slots
-    - interfaces: add missing adjtimex to time-control
-    - overlord/snapstate, snap: support base = "none"
-    - daemon, overlord/snapstate: give RevisionOptions a CohortKey
-    - data/selinux: permit init_t to remount snappy_snap_t
-    - cmd/snap: test for a friendly error on 'okay' without 'warnings'
-    - cmd/snap: support snap debug timings --startup=.. and measure
-      loadState time
-    - advise-snap: add --dump-db which dumps the command database
-    - interfaces/docker-support: support overlayfs on ubuntu core
-    - cmd/okay: Remove err message when warning file not exist
-    - devicestate: disallow removal of snaps used in booting early
-    - packaging: fix build-depends on powerpc
-    - tests: run spread tests on opensuse leap 15.1
-    - strutil/shlex: fix ineffassign
-    - cmd/snapd: ensure GOMAXPROCS is at least 2
-    - cmd/snap-update-ns: detach unused mount points
-    - gadget: record gadget root directory used during positioning
-    - tests: force removal to prevent restore fails when directory
-      doesn't exist on lp-1801955 test
-    - overlord: implement store switch remodeling
-    - tests: stop using ! for naive negation in shell scripts
-    - snap,store,daemon,client: send new "Snap-Client-User-Agent" header
-      in Search()
-    - osutil: now that we require golang-1.10, use user.LookupGroup()
-    - spread.yaml,tests: change MATCH and REBOOT to cmds
-    - packaging/fedora: force external linker to ensure static linking
-      and -extldflags use
-    - timings: tweak the conditional for ensure timings
-    - timings: always store ensure timings as long as they have an
-      associated change
-    - cmd/snap: tweak the output of snap debug timings --ensure=...
-    - overlord/devicestate: introduce remodel kinds and
-      contextsregistrationContext:
-    - snaptest: add helper for mocking snap with contents
-    - snapstate: allow removal of non-model kernels
-    - tests: change strace parameters on snap-run test to avoid the test
-      gets stuck
-    - gadget: keep track of the index where structure content was
-      defined
-    - cmd/snap-update-ns: rename leftover ctx to upCtx
-    - tests: add "not" command
-    - spread.yaml: use "snap connections" in debug
-    - tests: fix how strings are matched on auto-refresh-retry test
-    - spread-shellcheck: add support for variants and environment
-    - gadget: helper for shifting structure start position
-    - cmd/snap-update-ns: add several TODO comments
-    - cmd/snap-update-ns: rename ctx to upCtx
-    - spread.yaml: make HOST: usage shellcheck-clean
-    - overlord/snapstate, daemon: snapstate.Switch now takes a
-      RevisionOption
-    - tests: add mountinfo-tool
-    - many: make snapstate.Update take *RevisionOptions instead of chan,
-      rev
-    - tests/unit/spread-shellcheck: temporary workaround for SC2251
-    - daemon: refactor user ops to api_users
-    - cmd/snap, tests: refactor info to unify handling of 'direct' snaps
-    - cmd/snap-confine: combine sc_make_slave_mount_ns into caller
-    - cmd/snap-update-ns: use "none" for propagation changes
-    - cmd/snap-confine: don't pass MS_SLAVE along with MS_BIND
-    - cmd/snap, api, snapstate: implement "snap remove --purge"
-    - tests: new hotplug test executed on ubuntu core
-    - tests: running tests on fedora 30
-    - gadget: offset-write: fix validation, calculate absolute position
-    - data/selinux: allow snap-confine to do search on snappy_var_t
-      directories
-    - daemon, o/snapstate, store: support for installing from cohorts
-    - cmd/snap-confine: do not mount over non files/directories
-    - tests: validates snapd from ppa
-    - overlord/configstate: don't panic on invalid configuration
-    - gadget: improve device lookup, add helper for mount point lookup
-    - cmd/snap-update-ns: add tests for executeMountProfileUpdate
-    - overlord/hookstate: don't run handler unless hooksup.Always
-    - cmd/snap-update-ns: allow changing mount propagation
-    - systemd: workaround systemctl show quirks on older systemd
-      versions
-    - cmd/snap: allow option descriptions to start with the command
-    - many: introduce a gadget helper for locating device matching given
-      structure
-    - cmd/snap-update-ns: fix golint complaints about variable names
-    - cmd/snap: unit tests for debug timings
-    - testutil: support sharing-related mount flags
-    - packaging/fedora: Merge changes from Fedora Dist-Git and drop EOL
-      Fedora releases
-    - cmd/snap: support for --ensure argument for snap debug timings
-    - cmd,sandbox: tweak seccomp version info handling
-    - gadget: record sector size in positioned volume
-    - tests: make create-user test support managed devices
-    - packaging: build empty package on powerpc
-    - overlord/snapstate: perform hard refresh check
-    - gadget: add volume level update checks
-    - cmd/snap: mangle descriptions that have indent > terminal width
-    - cmd/snap-update-ns: rename applyFstab to executeMountProfileUpdate
-    - cmd/snap-confine: unshare per-user mount ns once
-    - tests: retry govendor sync
-    - tests: avoid removing snaps which are cached to speed up the
-      prepare on boards
-    - tests: fix how the base snap are deleted when there are multiple
-      to deleted on reset
-    - cmd/snap-update-ns: merge apply functions
-    - many: introduce assertstest.SigningAccounts and AddMany test
-      helpers
-    - interfaces: special-case "snapd" in sanitizeSlotReservedForOS*
-      helpers
-    - cmd/snap-update-ns: make apply{User,System}Fstab identical
-    - gadget: introduce checkers for sanitizing structure updates
-    - cmd/snap-update-ns: move apply{Profile,{User,System}Fstab} to same
-      file
-    - overlord/devicestate: introduce registrationContext
-    - cmd/snap-update-ns: add no-op load/save current user profile logic
-    - devicestate: set "new-model" on the remodel change
-    - devicestate: use deviceCtx in checkGadgetOrKernel
-    - many: use a fake assertion model in the device contexts for tests
-    - gadget: fix handling of positioning constrains for structures of
-      MBR role
-    - snap-confine: improve error when running on a not /home homedir
-    - devicestate: make Remodel() return a state.Change
-    - many: make which store to use contextualThis reworks
-      snapstate.Store instead of relying solely on DeviceContext,
-      because:
-    - tests: enable tests on centos 7 again
-    - interfaces: add login-session-control interface
-    - tests: extra debug for snapshot-basic test
-    - overlord,overlord/devicestate: do without GadgetInfo/KernelInfo in
-      devicestate
-    - gadget: more validation checks for legacy MBR structure type &
-      role
-    - osutil: fix TestReadBuildGo test in sbuild
-    - data: update XDG_DATA_DIRS via the systemd environment.d mechanism
-      too
-    - many: do without device state/assertions accessors based on state
-      only outside of devicestate/tests
-    - interfaces/dbus: fix unit tests when default snap mount dir is not
-      /snap
-    - tests: add security-seccomp to verify seccomp with arg filtering
-    - snapshotstate: disable automatic snapshots on core for now
-    - snapstate: auto-install snapd when needed
-    - overlord/ifacestate: update static attributes of "content"
-      interface
-    - interfaces: add support for the snapd snap in the dbus backend*
-    - overlord/snapstate: tweak autorefresh logic if network is not
-      available
-    - snapcraft: also include ld.so.conf from libc in the snapcraft.yml
-    - snapcraft.yaml: fix links ld-linux-x86-64.so.2/ld64.so.2
-    - overlord: pass a DeviceContext to the checkSnap implementations
-    - daemon: add RootOnly flag to commands
-    - many:  make access to the device model assertion etc contextual
-      via a DeviceCtx hook/DeviceContext interface
-    - snapcraft.yaml: include libc6 in snapd
-    - tests: reduce snapcraft leftovers from PROJECT_PATH,  temp disable
-      centos
-    - overlord: make the store context composably backed by separate
-      backends for device asserts/info etc.
-    - snapstate: revert "overlord/snapstate: remove PlugsOnly"
-    - osutil,cmdutil: move CommandFromCore and make it use the snapd
-      snap (if available)
-    - travis: bump Go version to 1.10.x
-    - cmd/snap-update-ns: remove instanceName argument from applyProfile
-    - gadget: embed volume in positioned volume, rename fields
-    - osutil: use go build-id when no gnu build-id is available
-    - snap-seccomp: add 4th field to version-info for golang-seccomp
-      features
-    - cmd/snap-update-ns: merge computeAndSaveSystemChanges into
-      applySystemFstab
-    - cmd/snap, client, daemon, store: create-cohort
-    - tests: give more time until nc returns on appstream test
-    - tests: run spread tests on ubuntu 19.04
-    - gadget: layout, smaller fixes
-    - overlord: update static attrs when reloading connections
-    - daemon: verify snap instructions for multi-snap requests
-    - overlord/corecfg: make expiration of automatic snapshots
-      configurable (4/4)
-    - cmd/snap-update-ns: pass MountProfileUpdate to
-      apply{System,User}Fstab
-    - snap: fix interface bindings on implicit hooks
-    - tests: improve how snaps are cached
-    - cmd/snap-update-ns: formatting tweaks
-    - data/selinux: policy tweaks
-    - cmd/snap-update-ns: move locking to the common layer
-    - overlord: use private YAML inside several tests
-    - cmd/snap, store, image: support for cohorts in "snap download"
-    - overlord/snapstate: add timings to critical task handlers and the
-      backend
-    - cmd: add `snap debug validate-seed <path>` cmd
-    - state: add possible error return to TaskSet.Edge()
-    - snap-seccomp: use username regex as defined in osutil/user.go
-    - osutil: make IsValidUsername public and fix regex
-    - store: serialize the acquisition of device sessions
-    - interfaces/builtin/desktop: fonconfig v6/v7 cache handling on
-      Fedora
-    - many: move Device/SetDevice to devicestate, start of making them
-      pluggable in storecontext
-    - overlord/snapstate: remove PlugsOnly
-    - interfaces/apparmor: allow running /usr/bin/od
-    - spread: add qemu:fedora-29-64
-    - tests: make test parallel-install-interfaces work for boards with
-      pre-installed snaps
-    - interfaces/builtin/intel_mei: fix /dev/mei* AppArmor pattern
-    - spread.yaml: add qemu:centos-7-64
-    - overlord/devicestate: extra measurements related to
-      populateStateFromSeed
-    - cmd/snap-update-ns: move Assumption to {System,User}ProfileUpdate
-    - cmd/libsnap: remove fringe error function
-    - gadget: add validation of cross structure overlap and offset
-      writes
-    - cmd/snap-update-ns: refactor of profile application (3/N)
-    - data/selinux: tweak the policy for runuser and s-c, interpret
-      audit entries
-    - tests: fix spaces issue in the base snaps names to remove during
-      reset phase
-    - tests: wait for man db cache is updated before after install snapd
-      on Fedora
-    - tests: extend timeout of sbuild test
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 12 Jul 2019 10:40:08 +0200
-
-snapd (2.39.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - daemon: increase `shutdownTimeout` to 25s to deal with slow HW
-    - spread: run tests against openSUSE 15.1
-    - data/selinux: fix policy for snaps with bases and classic snaps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 21 Jun 2019 09:06:01 +0200
-
-snapd (2.39.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - debian: rework how we run autopkgtests
-    - interfaces/docker-support: add overlayfs accesses for ubuntu core
-    - data/selinux: permit init_t to remount snappy_snap_t
-    - strutil/shlex: fix ineffassign
-    - packaging: fix build-depends on powerpc
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 05 Jun 2019 08:41:21 +0200
-
-snapd (2.39.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - spread: enable Fedora 30
-    - cmd/snap-confine, data/selinux: cherry pick Fedora 30 fixes
-    - tests/unit/spread-shellcheck: temporary workaround for SC2251
-    - packaging: build empty package on powerpc
-    - interfaces: special-case "snapd" in sanitizeSlotReservedForOS*
-      helper
-    - cmd/snap: mangle descriptions that have indent > terminal width
-    - cmd/snap-confine: unshare per-user mount ns once
-    - tests: avoid adding spaces to the base snaps names
-    - systemd: workaround systemctl show quirks on older systemd
-      versions
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 May 2019 12:08:43 +0200
-
-snapd (2.39) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - overlord/ifacestate: update static attributes of "content"
-      interface
-    - data/selinux: tweak the policy for runuser and s-c, interpret
-      audit entries
-    - snapshotstate: disable automatic snapshots on core for now
-    - overlord/corecfg: make expiration of automatic snapshots
-      configurable
-    - snapstate: auto-install snapd when needed
-    - interfaces: add support for the snapd snap in the dbus backend
-    - overlord/snapstate: tweak autorefresh logic if network is not
-      available
-    - interfaces/apparmor: allow running /usr/bin/od
-    - osutil,cmdutil: move CommandFromCore and make it use the snapd
-      snap (if available)
-    - daemon: also verify snap instructions for multi-snap requests
-    - data/selinux: allow snap-confine to mount on top of bin
-    - data/selinux: auto transition /var/snap to snappy_var_t
-    - cmd: add `snap debug validate-seed <path>` cmd
-    - interfaces/builtin/desktop: fonconfig v6/v7 cache handling on
-      Fedora
-    - interfaces/builtin/intel_mei: fix /dev/mei* AppArmor pattern
-    - tests: make snap-connections test work on boards with snaps pre-
-      installed
-    - tests: check for /snap/core16/current in core16-provided-by-core
-    - tests: run livepatch test on 18.04 as well
-    - devicestate: deal correctly with the "required" flag on Remodel
-    - snapstate,state: add TaskSet.AddAllWithEdges() and use in doUpdate
-    - snapstate: add new NoReRefresh flag and use in Remodel()
-    - many: allow core as a fallback for core16
-    - snapcraft: build static fontconfig in the snapd snap
-    - cmd/snap-confine: remove unused sc_open_snap_{update,discard}_ns
-    - data/selinux: allow snapd to execute runuser under snappy_t
-    - spread, tests: do not leave mislabeled files in restorecon test,
-      attempt to catch similar files
-    - interfaces: cleanup internal tool lookup in system-key
-    - many: move auth.AuthContext to store.DeviceAndAuthContext, the
-      implemention to a separate storecontext packageThis:
-    - overlord/devicestate: measurements around ensure and related tasks
-    - cmd: tweak internal tool lookup to accept more possible locations
-    - overlord/snapstate,snapshotstate: create snapshot on snap removal
-    - tests: run smoke tests on (almost) pristine systems
-    - tests: system disable ssh for config defaults in gadget
-    - cmd/debug: integrate new task timings with "snap debug timings"
-    - tests/upgrade/basic, packaging/fedoar: restore SELinux context of
-      /var/cache/fontconfig, patch pre-2.39 mount units
-    - image: simplify prefer local logic  and fixes
-    - tests/main/selinux-lxd: make sure LXD from snaps works cleanly
-      with enforcing SELinux
-    - tests: deny ioctl - TIOCSTI with garbage in high bits
-    - overlord: factor out mocking of device service and gadget w.
-      prepare-device for registration tests
-    - data/selinux, tests/main/selinux-clean: fine tune the policy, make
-      sure that no denials are raised
-    - cmd/libsnap,osutil: fix parsing of mountinfo
-    - ubuntu: disable -buildmode=pie on armhf to fix memory issue
-    - overlord/snapstate: inhibit refresh for up to a week
-    - cmd/snap-confine: prevent cwd restore permission bypass
-    - overlord/ifacestate: introduce HotplugKey type use short key in
-      change summaries
-    - many: make Remodel() download everything first before installing
-    - tests: fixes discovered debugging refresh-app-awareness
-    - overlord/snapstate: track time of postponed refreshes
-    - snap-confine: set rootfs_dir in sc_invocation struct
-    - tests: run create-user on core devices
-    - boot: add flag file "meta/force-kernel-extraction"
-    - tests: add regression test for systemctl race fix
-    - overlord/snapshotstate: helpers for snapshot expirations
-    - overlord,tests: perform soft refresh check in doInstall
-    - tests: enable tests that write /etc/{hostname,timezone} on core18
-    - overlord/ifacestate: implement String() method of
-      HotplugDeviceInfo for better logs/messages
-    - cmd/snap-confine: move ubuntu-core fallback checks
-    - testutil: fix MockCmd for shellcheck 0.5
-    - snap, gadget: move gadget read/validation into separate package,
-      tweak naming
-    - tests: split travis spread execution in 2 jobs for ubuntu and non
-      ubuntu systems
-    - testutil: make mocked command work with shellcheck from snaps
-    - packaging/fedora, tests/upgrade/basic: patch existing mount units
-      with SELinux context on upgrade
-    - metautil, snap: extract yaml value normalization to a helper
-      package
-    - tests: use apt via eatmydata
-    - dirs,overlord/snapstate: add Soft and Hard refresh checks
-    - cmd/snap-confine: allow using tools from snapd snap
-    - cmd,interfaces: replace local helpers with cmd.InternalToolPath
-    - tweak: fix "make hack" on Fedora
-    - snap: add validation of gadget.yaml
-    - cmd/snap-update-ns: refactor of profile application
-    - cmd/snap,client,daemon,store: layout and sanity tweaks for
-      find/search options
-    - tests: add workaround for missing cache reset on older snapd
-    - interfaces: deal with the snapd snap correctly for apparmor 2.13
-    - release-tools: add debian-package-builder
-    - tests: enable opensuse 15 and add force-resolution installing
-      packages
-    - timings: AddTag helper
-    - testutil: run mocked commands through shellcheck
-    - overlord/snapshotstate: support auto flag
-    - client, daemon, store: search by common-id
-    - tests: all the systems for google backend with 6 workers
-    - interfaces: hotplug nested vm test, updated serial-port interface
-      for hotplug.
-    - sanity: use proper SELinux context when mounting squashfs
-    - cmd/libsnap: neuter variables in cleanup functions
-    - interfaces/adb-support: account for hubs on sysfs path
-    - interfaces/seccomp: regenerate changed profiles only
-    - snap: reject layouts to /lib/{firmware,modules}
-    - cmd/snap-confine, packaging: support SELinux
-    - selinux, systemd: support mount contexts for snap images
-    - interfaces/builtin/opengl: allow access to Tegra X1
-    - cmd/snap: make 'snap warnings' output yamlish
-    - tests: add check to detect a broken snap on reset
-    - interfaces: add one-plus devices to adb-support
-    - cmd: prevent umask from breaking snap-run chain
-    - tests/lib/pkgdb: allow downgrade when installing packages in
-      openSUSE
-    - cmd/snap-confine: use fixed private tmp directory
-    - snap: tweak parsing errors of gadget updates
-    - overlord/ifacemgr: basic measurements
-    - spread: refresh metadata on openSUSE
-    - cmd/snap-confine: pass sc_invocation instead of numerous args
-      around
-    - snap/gadget: introduce volume update info
-    - partition,bootloader: rename 'partition' package to 'bootloader'
-    - interfaces/builtin: add dev/pts/ptmx access to docker_support
-    - tests: restore sbuild test
-    - strutil: make SplitUnit public, allow negative numbers
-    - overlord/snapstate,: retry less for auto-stuff
-    - interfaces/builtin: add add exec "/" to docker-support
-    - cmd/snap: fix regression of snap saved command
-    - cmd/libsnap: rename C enum for feature flag
-    - cmd: typedef mountinfo structures
-    - tests/main/remodel: clean up before reverting the state
-    - cmd/snap-confine: umount scratch dir using UMOUNT_NOFOLLOW
-    - timings: add new helpers, Measurer interface and DurationThreshold
-    - cmd/snap-seccomp: version-info subcommand
-    - errortracker: fix panic in Report if db cannot be opened
-    - sandbox/seccomp: a helper package wrapping calls to snap-seccomp
-    - many: add /v2/model API, `snap remodel` CLI and spread test
-    - tests: enable opensuse tumbleweed back
-    - overlord/snapstate, store: set a header when auto-refreshing
-    - data/selinux, tests: refactor SELinux policy, add minimal tests
-    - spread: restore SELinux context when we mess with system files
-    - daemon/api: filter connections with hotplug-gone=true
-    - daemon: support returning assertion information as JSON with the
-      "json" query parameter
-    - cmd/snap: hide 'interfaces' command, show deprecation notice
-    - timings: base API for recording timings in state
-    - cmd/snap-confine: drop unused dependency on libseccomp
-    - interfaces/apparmor: factor out test boilerplate
-    - daemon: extract assertions api endpoint implementation into
-      api_asserts.go
-    - spread.yaml: bump delta reference
-    - cmd/snap-confine: track per-app and per-hook processes
-    - cmd/snap-confine: make sc_args helpers const-correct
-    - daemon: move a function that was between an other struct and its
-      methods
-    - overlord/snapstate: fix restoring of "old-current" revision config
-      in undoLinkSnap
-    - cmd/snap, client, daemon, ifacestate: show a leading attribute of
-      a connection
-    - cmd/snap-confine: call sc_should_use_normal_mode once
-    - cmd/snap-confine: populate enter_non_classic_execution_environment
-    - daemon: allow downloading snaps blobs via .../file
-    - cmd/snap-confine: introduce sc_invocation
-    - devicestate: add initial Remodel support
-    - snap: remove obsolete license-* fields in the yaml
-    - cmd/libsnap: add cgroup-pids-support module
-    - overlord/snapstate/backend: make LinkSnap clean up more
-    - snapstate: only keep 2 snaps on classic
-    - ctlcmd/tests: tests tweaks (followup to #6322)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 03 May 2019 11:29:50 +0200
-
-snapd (2.38.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1824394
-    - tests: add workaround for missing cache reset on older snapd
-    - ubuntu: disable -buildmode=pie on armhf to fix memory issue
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 Apr 2019 18:26:47 +0200
-
-snapd (2.38) xenial; urgency=medium
-
-  * New upstream release, LP: #1818648
-    - overlord/snapstate,: retry less for auto-stuff
-    - cmd/snap: fix regression of snap saved command
-    - interfaces/builtin: add dev/pts/ptmx access to docker_support
-    - overlord/snapstate, store: set a header when auto-refreshing
-    - interfaces/builtin: add add exec "/" to docker-support
-    - cmd/snap, client, daemon, ifacestate: show a leading attribute of
-      a connection
-    - interface: avahi-observe: Fixing socket permissions on 4.15
-      kernels
-    - tests: check that apt works before using it
-    - apparmor: support AppArmor 2.13
-    - snapstate: restart into the snapd snap on classic
-    - overlord/snapstate: during refresh, re-refresh on epoch bump
-    - cmd, daemon: split out the common bits of mapLocal and mapRemote
-    - cmd/snap-confine: chown private /tmp to root.root
-    - cmd/snap-confine: drop uid from random /tmp name
-    - overlord/hookstate: apply pending transaction changes onto
-      temporary configuration for snapctl get
-    - cmd/snap: `snap connections` command
-    - interfaces/greengrass_support: update accesses for GGC 1.8
-    - cmd/snap, daemon: make the connectivity check use GET
-    - interfaces/builtin,/udev: add spec support to disable udev +
-      device cgroup and use it for greengrass
-    - interfaces/intel-mei: small follow up tweaks
-    - ifacestate/tests: fix/improve udev mon test
-    - interfaces: add multipass-support interface
-    - tests/main/high-user-handling: fix the test for Go 1.12
-    - interfaces: add new intel-mei interface
-    - systemd: decrease the checker counter before unlocking otherwise
-      we can get spurious panics
-    - daemon/tests: fix race in the disconnect conflict test
-    - cmd/snap-confine: allow moving tasks to pids cgroup
-    - tests: enable opensuse tumbleweed on spread
-    - cmd/snap: fix `snap services` completion
-    - ifacestate/hotplug: integration with udev monitor
-    - packaging: build snapctl as a static binary
-    - packaging/opensuse: move most logic to snapd.mk
-    - overlord: fix ensure before slowness on Retry
-    - overlord/ifacestate: fix migration of connections on upgrade from
-      ubuntu-core
-    - daemon, client, cmd/snap: debug GETs ask aspects, not actions
-    - tests/main/desktop-portal-*: fix handling of python dependencies
-    - interfaces/wayland: allow wayland server snaps function on classic
-      too
-    - daemon, client, cmd/snap: snap debug base-declaration
-    - tests: run tests on opensuse leap 15.0 instead of 42.3
-    - cmd/snap: fix error messages for snapshots commands if ID is not
-      uint
-    - interfaces/seccomp: increase filter precision
-    - interfaces/network-manager: no peer label check for hostname1
-    - tests: add a tests for xdg-desktop-portal integration
-    - tests: not checking 'tracking channel' after refresh core on
-      nested execution
-    - tests: remove snapweb from tests
-    - snap, wrappers: support StartTimeout
-    - wrappers: Add an X-SnapInstanceName field to desktop files
-    - cmd/snap: produce better output for help on subcommands
-    - tests/main/nfs-support: use archive mode for creating fstab backup
-    - many: collect time each task runs and display it with `snap debug
-      timings <id>`
-    - tests: add attribution to helper script
-    - daemon: make ucrednetGet not loop
-    - squashfs: unset SOURCE_DATE_EPOCH in the TestBuildDate test
-    - features,cmd/libsnap: add new feature "refresh-app-awareness"
-    - overlord: fix random typos
-    - interfaces/seccomp: generate global seccomp profile
-    - daemon/api: fix error case for disconnect conflict
-    - overlord/snapstate: add some randomness to the catalog refresh
-    - tests: disable trusty-proposed for now
-    - tests: fix upgrade-from-2.15 with kernel 4.15
-    - interfaces/apparmor: allow sending and receiving signals from
-      ourselves
-    - tests: split the test interfaces-many in 2 and remove snaps on
-      restore
-    - tests: use snap which takes 15 seconds to install on retryable-
-      error test
-    - packaging: avoid race in snapd.postinst
-    - overlord/snapstate: discard mount namespace when undoing 1st link
-      snap
-    - cmd/snap-confine: allow writes to /var/lib/**
-    - tests: stop catalog-update test for now
-    - tests/main/auto-refresh-private: make sure to actually download
-      with the expired macaroon
-    - many: save media info when installing, show it when listing
-    - userd: handle help urls which requires prepending XDG_DATA_DIRS
-    - tests: fix NFS home mocking
-    - tests: improve snaps-system-env test
-    - tests: pre-cache core on core18 systems
-    - interfaces/hotplug: renamed RequestedSlotSpec to ProposedSlot,
-      removed Specification
-    - debian: ensure leftover usr.lib.snapd.snap-confine is gone
-    - image,cmd/snap,tests: introduce support for modern prepare-image
-      --snap <snap>[=<channel>]
-    - overlord/ifacestate: tweak logic for generating unique slot names
-    - packaging: import debian salsa packaging work, add sbuild test and
-      use in spead
-    - overlord/ifacestate: hotplug-add-slot handler
-    - image,cmd/snap:  simplify --classic-arch to --arch, expose
-      prepare-image
-    - tests: run test snap as user in the smoke test
-    - cmd/snap: tweak man output to have no doubled up .TP lines
-    - cmd/snap, overlord/snapstate: silently ignore classic flag when a
-      snap is strictly confined
-    - snap-confine: remove special handling of /var/lib/jenkins
-    - cmd/snap-confine: handle death of helper process
-    - packaging: disable systemd environment generator on 18.04
-    - snap-confine: fix classic snaps for users with /var/lib/* homedirs
-    - tests/prepare: prevent console-conf from running
-    - image: bootstrapToRootDir => setupSeed
-    - image,cmd/snap,tests:  introduce prepare-image --classic
-    - tests: update smoke/sandbox test for armhf
-    - client, daemon: introduce helper for querying snapd API for the
-      list of slot/plug connections
-    - cmd/snap-confine: refactor and cleanup of seccomp loading
-    - snapstate, snap: allow update/switch requests with risk only
-      channel to DTRT
-    - interfaces: add network-manager-observe interface
-    - snap-confine: increase locking timeout to 30s
-    - snap-confine: fix incorrect "sanity timeout 3s" message
-    - snap-confine: provide proper error message on sc_sanity_timeout
-    - snapd,state: improve error message on state reading failure
-    - interfaces/apparmor: deny inet/inet6 in snap-update-ns profile
-    - snap: fix reexec from the snapd snap for classic snaps
-    - snap: fix hook autodiscovery for parallel installed snaps
-    - overlord/snapstate: format the refresh time for the log
-    - cmd/snap-confine: add special case for Jenkins
-    - snapcraft.yaml: fix XBuildDeb PATH for go-1.10
-    - overlord/snapstate: validate instance names early
-    - overlord/ifacestate: handler for hotplug-update-slot tasks
-    - polkit: cast pid to uint32 to keep polkit happy for now
-    - snap/naming: move various name validation helpers to separate
-      package
-    - tests: iterate getting journal logs to support delay on boards on
-      daemon-notify test
-    - cmd/snap: fix typo in cmd_wait.go
-    - snap/channel: improve channel parsing
-    - daemon, polkit: pid_t is signed
-    - daemon: introduce /v2/connections snapd API endpoint
-    - cmd/snap: small refactor of cmd_info's channel handling
-    - overlord/snapstate: use an ad-hoc error when no results
-    - cmd/snap: wrap "summary" better
-    - tests: workaround missing go dependencies in debian-9
-    - daemon: try to tidy up the icon stuff a little
-    - interfaces: add display-control interface
-    - snapcraft.yaml: fix snap building in launchpad
-    - tests: update fedora 29 workers to speed up the whole testing time
-    - interfaces: add u2f-devices interface and allow reading udev
-      +power_supply:* in hardware-observe
-    - cmd/snap-update-ns: save errno from strtoul
-    - tests: interfaces tests normalization
-    - many: cleanup golang.org/x/net/context
-    - tests: add spread test for system dbus interface
-    - tests: remove -o pipefail
-    - interfaces: add block-devices interface
-    - spread: enable upgrade suite on fedora
-    - tests/main/searching: video section got renamed to photo-and-video
-    - interfaces/home: use dac_read_search instead of dac_override with
-      'read: all'
-    - snap: really run the RunSuite
-    - interfaces/camera: allow reading vendor/etc info from
-      /run/udev/data/+usb:*
-    - interfaces/dbus: be less strict about alternations for well-known
-      names
-    - interfaces/home: allow dac_override with 'read:
-      all'
-    - interfaces/pulseaudio: allow reading subdirectories of
-      /etc/pulse
-    - interfaces/system-observe: allow read on
-      /proc/locks
-    - run-checks: ensure we use go-1.10 if available
-    - tests: get test-snapd-dbus-{provider,consumer} from the beta
-      channel
-    - interfaces/apparmor: mock presence of overlayfs root
-    - spread: increase default kill-timeout to 30min
-    - tests: simplify interfaces-contacts-service test
-    - packaging/ubuntu: build with golang 1.10
-    - ifacestate/tests: extra test for hotplug-connect handler
-    - packaging: make sure that /var/lib/snapd/lib/glvnd is accounted
-      for
-    - overlord/snapstate/backend: call fontconfig helpers from the new
-      'current'
-    - kvm: load required kernel modules if necessary
-    - cmd/snap: use a fake user for 'run' tests
-    - tests: update systems for google sru backend
-    - tests: fix install-snaps test by changing the snap info regex
-    - interfaces: helpers for sorting plug/slot/connection refs
-    - tests: moving core-snap-refresh-on-core test from main to nested
-      suite
-    - tests: fix daemon-notify test checking denials considering all the
-      log lines
-    - tests: skip lp-1802591 on "official" images
-    - tests: fix listing tests to match "snap list --unicode=never"
-    - debian: fix silly typo in the spread test invocation
-    - interface: raw-usb: Adding ttyACM ttyACA permissions
-    - tests: fix enable-disable-unit-gpio test on external boards
-    - overlord/ifacestate: helper API to obtain the state of connections
-    - tests: define new "tests/smoke" suite and use that for
-      autopkgtests
-    - cmd/snap-update-ns: explicitly check for return value from
-      parse_arg_u
-    - interfaces/builtin/opengl: allow access to NVIDIA VDPAU library
-    - tests: auto-clean the test directory
-    - cmd/snap: further tweak messaging; add a test
-    - overlord/ifacestate: handler for hotplug-connect task
-    - cmd/snap-confine: join freezer only after setting up user mount
-    - cmd/snap-confine: don't preemptively create .mnt files
-    - cmd/snap-update-ns: manually implement isspace
-    - cmd/snap-update-ns: let the go parser know we are parsing -u
-    - cmd/snap-discard-ns: fix name of user fstab files
-    - snapshotstate: don't task.Log without the lock
-    - tests: exclude some more slow tests from runs in autopkgtest
-    - many: remove .user-fstab files from /run/snapd/ns
-    - cmd/libsnap: pass --from-snap-confine when calling snap-update-ns
-      as user
-    - cmd/snap-update-ns: make freezer mockable
-    - cmd/snap-update-ns: move XDG code to dedicated file
-    - osutil: add helper for loading fstab from string
-    - cmd/snap-update-ns: move existing code around, renaming some
-      functions
-    - overlord/configstate/configcore: support - and _ in cloud init
-      field names
-    - * cmd/snap-confine: use makedev instead of MKDEV
-    - tests: review/fix the autopkgtest failures in disco
-    - overlord: drop old v1 store api support from managers test
-    - tests: new test for snapshots with more than 1 user
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 21 Mar 2019 10:55:27 +0100
-
-snapd (2.37.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1817949
-    - squashfs: unset SOURCE_DATE_EPOCH in the TestBuildDate test
-    - overlord/ifacestate: fix migration of connections on upgrade from
-      ubuntu-core
-    - tests: fix upgrade-from-2.15 with kernel 4.15
-    - interfaces/seccomp: increase filter precision
-    - tests: remove snapweb from tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 27 Feb 2019 19:53:36 +0100
-
-snapd (2.37.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - interfaces/seccomp: generate global seccomp profile
-    - overlord/snapstate: add some randomness to the catalog refresh
-    - tests: add upgrade test from 2.15.2ubuntu1 -> current snapd
-    - snap-confine: fix fallback to ubuntu-core
-    - packaging: avoid race in snapd.postinst
-    - overlord/snapstate: discard mount namespace when undoing 1st link
-      snap
-    - cmd/snap-confine: allow writes to /var/lib/** again
-    - tests: stop catalog-update/apt-hooks test until the catlog refresh
-      is randomized
-    - debian: ensure leftover usr.lib.snapd.snap-confine is gone
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 18 Feb 2019 17:17:33 +0100
-
-snapd (2.37.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - cmd/snap, overlord/snapstate: silently ignore classic flag when a
-      snap is strictly confined
-    - snap-confine: remove special handling of /var/lib/jenkins
-    - cmd/snap-confine: handle death of helper process gracefully
-    - snap-confine: fix classic snaps for users with /var/lib/* homedirs
-      like jenkins/postgres
-    - packaging: disable systemd environment generator on 18.04
-    - tests: update smoke/sandbox test for armhf
-    - cmd/snap-confine: refactor and cleanup of seccomp loading
-    - snap-confine: increase locking timeout to 30s
-    - snap-confine: fix incorrect "sanity timeout 3s" message
-    - snap: fix hook autodiscovery for parallel installed snaps
-    - tests: iterate getting journal logs to support delay on boards on
-      daemon-notify test
-    - interfaces/apparmor: deny inet/inet6 in snap-update-ns profile
-    - interfaces: add u2f-devices interface
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 06 Feb 2019 10:08:07 +0100
-
-snapd (2.37.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - cmd/snap-confine: add special case for Jenkins
-    - tests: workaround missing go dependencies in debian-9
-    - daemon, polkit: pid_t is signed
-    - interfaces: add display-control interface
-    - interfaces: add block-devices interface
-    - tests/main/searching: video section got renamed to photo-and-video
-    - interfaces/camera: allow reading vendor/etc info from
-      /run/udev/data/+usb
-    - interfaces/dbus: be less strict about alternations for well-known
-      names
-    - interfaces/home: allow dac_read_search with 'read: all'
-    - interfaces/pulseaudio: allow reading subdirectories of
-      /etc/pulse
-    - interfaces/system-observe: allow read on
-      /proc/locks
-    - tests: get test-snapd-dbus-{provider,consumer} from the beta
-      channel
-    - interfaces/apparmor: mock presence of overlayfs root
-    - packaging/{fedora,opensuse,ubuntu}: add /var/lib/snapd/lib/glvnd
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Jan 2019 18:35:36 +0100
-
-snapd (2.37) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - snapd: fix race in TestSanityFailGoesIntoDegradedMode test
-    - cmd: fix snap-device-helper to deal correctly with hooks
-    - tests: various fixes for external backend
-    - interface: raw-usb: Adding ttyACM[0-9]* as many serial devices
-      have device node /dev/ttyACM[0-9]
-    - tests: fix enable-disable-unit-gpio test on external boards
-    - tests: define new "tests/smoke" suite and use that for
-      autopkgtests
-    - interfaces/builtin/opengl: allow access to NVIDIA VDPAU
-      library
-    - snapshotstate: don't task.Log without the lock
-    - overlord/configstate/configcore: support - and _ in cloud init
-      field names
-    - cmd/snap-confine: use makedev instead of MKDEV
-    - tests: review/fix the autopkgtest failures in disco
-    - systemd: allow only a single daemon-reload at the same time
-    - cmd/snap: only auto-enable unicode to a tty
-    - cmd/snap: right-align revision and size in info's channel map
-    - dirs, interfaces/builtin/desktop: system fontconfig cache path is
-      different on Fedora
-    - tests: fix "No space left on device" issue on amazon-linux
-    - store: undo workaround for timezone-less released-at
-    - store, snap, cmd/snap: channels have released-at
-    - snap-confine: fix incorrect use "src" var in mount-support.c
-    - release: support probing SELinux state
-    - release-tools: display self-help
-    - interface: add new `{personal,system}-files` interface
-    - snap: give Epoch an Equal method
-    - many: remove unused interface code
-    - interfaces/many: use 'unsafe' with docker-support change_profile
-      rules
-    - run-checks: stop running HEAD of staticcheck
-    - release: use sync.Once around lazy intialized state
-    - overlord/ifacestate: include interface name in the hotplug-
-      disconnect task summary
-    - spread: show free space in debug output
-    - cmd/snap: attempt to restore SELinux context of snap user
-      directories
-    - image: do not write empty etc/cloud
-    - tests: skip snapd snap on reset for core systems
-    - cmd/snap-discard-ns: fix umount(2) typo
-    - overlord/ifacestate: hotplug-remove-slot task handler
-    - overlord/ifacestate: handler for hotplug-disconnect task
-    - ifacestate/hotplug: updateDevice helper
-    - tests: reset snapd state on tests restore
-    - interfaces: return security setup errors
-    - overlord: make InstallMany work like UpdateMany, issuing a single
-      request to get candidates
-    - systemd/systemd.go: add missing tests for systemd.IsActive
-    - overlord/ifacestate: addHotplugSeqWaitTask helper
-    - cmd/snap-confine: refactor call to snap-update-ns --user-mounts
-    - tests: new backend used to run upgrade test suite
-    - travis: short circuit failures in static and unit tests travis job
-    - cmd: automatically fix localized <option>s to <option>
-    - overlord/configstate,features: expose features to snapd tools
-    - selinux: package to query SELinux status and verify/restore file
-      contexts
-    - wrappers: use new systemd.IsActive in core18 early boot
-    - cmd: add tests for lintArg and lintDesc
-    - httputil: retry on temporary net errors
-    - cmd/snap-confine: remove unused sc_discard_preserved_mount_ns
-    - wrappers: only restart service in core18 when they are active
-    - overlord/ifacestate: helpers for serializing hotplug changes
-    - packaging/{fedora,opensuse}: own /var/lib/snapd/cookie
-    - systemd: start snapd.autoimport.service in --no-block mode
-    - data/selinux: fix syntax error in definition of snappy_admin
-      interface
-    - snap/info: bind global plugs/slots to implicit hooks
-    - cmd/snap-confine: remove SC_NS_MNT_FILE
-    - spread: record each tests/upgrade job
-    - osutil: do not import dirs
-    - cmd/snap-confine: fix typo "a pipe"
-    - tests: make security-device-cgroups-{devmode,jailmode} work on arm
-      devices
-    - tests: force test-snapd-daemon-notify exit 0 when the interface is
-      not connected
-    - overlord/snapstate: run 'remove' hook before 'auto-disconnect'
-    - centos: enable SELinux support on CentOS 7
-    - apparmor: allow hard link to snap-specific semaphore files
-    - tests/lib/pkgdb: disable weak deps on Fedora
-    - release: detect too old apparmor_parser
-    - tests: improve how the log is checked to see if the system is
-      waiting for a reboot
-    - cmd, dirs, interfaces/apparmor: update distro identification to
-      support ID="archlinux"
-    - spread, tests: add Fedora 29
-    - cmd/snap-confine: refactor calling snapd tools into helper module
-    - apparmor: allow snap-update-ns access to common devices
-    - cmd/snap-confine: capture initialized per-user mount ns
-    - tests: reduce verbosity around package installation
-    - data: set KillMode=process for snapd
-    - cmd/snap: handle DNS error gracefully
-    - spread, tests: use checkpoints when dumping audit log
-    - tests/lib/prepare: make sure that SELinux context of repacked core
-      snap is controlled
-    - testutils: split checkers, tweak tests
-    - tests: fix for tests test-*-cgroup
-    - spread: show AVC audits when debugging, start auditd on Fedora
-    - spread: drop Fedora 27, add Fedora 29
-    - tests/lib/reset: restore context of removed snapd directories
-    - testutil: add File{Present,Absent} checkers
-    - snap: add new `snap run --trace-exec`
-    - tests: fix for failover test on how logs are checked
-    - snapctl: add "services"
-    - overlord/snapstate: use file timestamp to initialize timer
-    - cmd/libsnap: introduce and use sc_strdup
-    - interfaces: let NM access ifindex/ifupdown files
-    - overlord/snapstate: on refresh, check new rev can read current
-    - client, store: don't use store from client (use client from store)
-    - tests/main/parallel-install-store: verify installation of more
-      than one instance at a time
-    - overlord: don't write system key if security setup fails
-    - packaging/fedora/snapd.spec: fix bogus date in changelog
-    - snapstate: update fontconfig caches on install
-    - interfaces/apparmor/backend.go:411:38: regular expression does not
-      contain any meta characters (SA6004)
-    - asserts/header_checks.go:199:35: regular expression does not
-      contain any meta characters (SA6004)
-    - run staticcheck every time :-)
-    - tests/lib/systemd-escape/main.go:46:14: printf-style function with
-      dynamic first argument and no further arguments should use print-
-      style function instead (SA1006)
-    - tests/lib/fakestore/cmd/fakestore/cmd_run.go:66:15: the channel
-      used with signal.Notify should be buffered (SA1017)
-    - tests/lib/fakedevicesvc/main.go:55:15: the channel used with
-      signal.Notify should be buffered (SA1017)
-    - spdx/parser.go:30:1: only the first constant has an explicit type
-      (SA9004)
-    - overlord/snapstate/snapmgr.go:553:21: printf-style function with
-      dynamic first argument and no further arguments should use print-
-      style function instead (SA1006)
-    - overlord/patch/patch3.go:44:70: printf-style function with dynamic
-      first argument and no further arguments should use print-style
-      function instead (SA1006)
-    - cmd/snap/cmd_advise.go:200:2: empty branch (SA9003)
-    - osutil/udev/netlink/conn.go:120:5: ineffective break statement.
-      Did you mean to break out of the outer loop? (SA4011)
-    - daemon/api.go:992:22: printf-style function with dynamic first
-      argument and no further arguments should use print-style function
-      instead (SA1006)
-    - cmd/snapd/main.go:94:5: ineffective break statement. Did you mean
-      to break out of the outer loop? (SA4011)
-    - cmd/snap/cmd_userd.go:73:15: the channel used with signal.Notify
-      should be buffered (SA1017)
-    - cmd/snap/cmd_help.go:102:7: io.Writer.Write must not modify the
-      provided buffer, not even temporarily (SA1023)
-    - release: probe apparmor features lazily
-    - overlord,daemon: mock security backends for testing
-    - cmd/libsnap: move apparmor-support to libsnap
-    - cmd: drop cruft from snap-discard-ns build rules
-    - cmd/snap-confine: use snap-discard-ns ns to discard stale
-      namespaces
-    - cmd/snap-confine: handle mounted shared /run/snapd/ns
-    - many: fix composite literals with unkeyed fields
-    - dirs, wrappers, overlord/snapstate: make completion + bases work
-    - tests: revert "tests: restore in restore, not prepare"
-    - many: validate title
-    - snap: make description maximum in runes, not bytes
-    - tests: discard mount namespaces in reset.sh
-    - tests/lib: sync cla check back from snapcraft
-    - Revert "cmd/snap, tests/main/snap-info: highlight the current
-      channel"
-    - daemon: remove enableInternalInterfaceActions
-    - mkversion: use "test -n" rather than "! test -z"
-    - run-checks: assorted fixes
-    - tests: restore in restore, not in prepare
-    - cmd/snap: fix missing newline in "snap keys" error message
-    - snap: epoch lists must contain no duplicate entries
-    - interfaces/avahi_observe: Fix typo in comment
-    - tests: add SPREAD_JOB to the description of
-      systemd_create_and_start_unit
-    - daemon, vendor: bump github.com/coreos/go-systemd/activation,
-      handle API changes
-    - Revert "cmd/snap-confine: don't allow mapping lib{uuid,blkid}"
-    - packaging/fedora: use %_sysctldir macro
-    - cmd/snap-confine: remove unneeded unshare
-    - sanity: extend the kernel version check to cover CentOS/RHEL
-      kernels
-    - wrappers: remove all desktop files from a snap on removal
-    - snap: add an explicit check for `epoch: null` loading
-    - snap: check max description length in validate
-    - spread, tests: add CentOS support
-    - cmd/snap-confine: allow mapping more libc shards
-    - cmd/snap-discard-ns: add support for --from-snap-confine
-    - tests: make tinyproxy support systemd notify
-    - tests: fix shellcheck
-    - snap, store: rename `snap.Epoch`'s `Unset` to `IsZero`
-    - store: add a test for a non-zero epoch refresh (with epoch bump)
-    - store: v1 search doesn't send epoch, stop pretending it does
-    - snap: make any "0" epoch be Unset, and marshalled to {[0],[0]}
-    - overlord/snapstate: amend test should send local revision
-    - tests: use mock-gpio.py in enable-disable-units-gpio test
-    - snap: enforce minimal snap name len of 2
-    - cmd/libsnap: add sc_verify_snap_lock
-    - cmd/snap-update-ns: extra debugging of trespassing events
-    - userd: force zenity width if the text displayed is long
-    - overlord/snapstate, store: always send epochs
-    - cmd/snap-confine,snap-update-ns: discard quirks
-    - cmd/snap: add nanosleep to blacklisted syscalls when running with
-      --strace
-    - cmd/snap-update-ns, tests: clean trespassing paths
-    - nvidia, interfaces/builtin: OpenCL fixes
-    - ifacestate/hotplug: removeDevice helper
-    - cmd: install snap-discard-ns in "make hack"
-    - overlord/ifacestate: setup security backends phased by backends
-      first
-    - ifacestate/helpers: added SystemSnapName mapper helper method
-    - overlord/ifacestate: set hotplug-key of the connection when
-      connecting hotplug slots
-    - snapd: allow snap-update-ns to read /proc/version
-    - cmd: handle tumbleweed and leap in autogen.sh
-    - interfaces/tests: MockHotplugSlot test helper
-    - store,daemon: make UserInfo,LoginUser part of the store interface
-    - overlord/ifacestate: use remapper when checking if system snap is
-      installed
-    - tests: fix how pinentry is prepared for new gpg v 2.1 and 2.2
-    - packaging/arch: fix bash completions path
-    - interfaces/builtin: add device-buttons interface for accessing
-      events
-    - tests, fakestore: extend refresh tests with parallel installed
-      snaps
-    - snap, store, overlord/snapshotstate: drop epoch pointers
-    - snap: make Epoch default to {[0],[0]} on load from yaml
-    - data/completion: pass documented arguments to completion functions
-    - tests: skip opensuse from interfaces-openvswitch-support test
-    - tests: simple reproducer for snap try and hooks bug
-    - snapstate: do not allow classic mode for strict snaps
-    - snap: make Epoch's MarshalJSON not simplify
-    - store: remove unused currentSnap and currentSnapJSON
-    - many: some small doc comment fixes in recent hotplug code
-    - ifacestate/udevmonitor: added callback to signal end of
-      enumeration
-    - cmd/libsnap: add simplified feature flag checker
-    - interfaces/opengl: add additional accesses for cuda
-    - tests: add core18 only hooks test and fix running core18 only on
-      classic
-    - sanity, release, cmd/snap: refuse to try to do things on WSL.
-    - cmd: make coreSupportsReExec faster
-    - overlord/ifacestate: don't remove the dash when generating unique
-      slot name
-    - cmd/snap-seccomp: add full complement of ptrace constants
-    - cmd: update autogen.sh for opensuse
-    - interfaces/apparmor: allow access to /run/snap.$SNAP_INSTANCE_NAME
-    - spread.yaml: add more systems to the autopkgtest and qemu backends
-    - daemon: spool sideloaded snap into blob dir
-      overlord/snapstate: address review feedback
-    - packaging/opensuse: stop using golang-packaging
-    - overlord/snapshots: survive an unknown user
-    - wrappers: fix generating of service units with multiple `before`
-      dependencies
-    - data: run snapd.autoimport.service only after seeding
-    - cmd/snap: unhide --name parameter to snap install, tweak help
-      message
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - tests/main/snap-service-after-before-install: verify after/before
-      in snap install
-    - overlord/ifacestate: mark connections disconnected by hotplug with
-      hotplug-gone
-    - ifacestate/ifacemgr: don't reload hotplug-gone connections on
-      startup
-    - tests: install dependencies during prepare
-    - tests,store,daemon: ensure proxy settings are honored in
-      auth/userinfo too
-    - tests: core 18 does not support classic confinement
-    - tests: add debug output for degraded test
-    - strutil: make VersionCompare faster
-    - overlord/snapshotstate/backend: survive missing directories
-    - overlord/ifacestate: use map[string]*connState when passing conns
-      around
-    - tests: move fedora 28 to manual
-    - overlord/snapshotstate/backend: be more verbose when
-      SNAPPY_TESTING=1
-    - tests: removing fedora 26 system from spread.yaml
-    - tests: linode execution is not needed anymore
-    - tests/lib: adjust to changed systemctl behaviour on debian-9
-    - tests: fixes and new backend for tests on nested suite
-    - strutil: let MatchCounter work with a nil regexp
-    - ifacestate/helpers: findConnsForHotplugKey helper
-    - many: move regexp.(Must)Compile out of non-init functions into
-      variables
-    - store: also make snaps downloaded via deltas 0600
-    - snap: use Lstat to determine snap size, remove
-      ReadSnapInfoExceptSize
-    - interfaces/builtin: add adb-support interface
-    - tests: fail if install_snap_local fails
-    - strutil: add extra test to CommaSeparatedList as suggested by
-      mborzecki
-    - cmd/snap, daemon, strutil: use CommaSeparatedList to split a CSL
-    - ifacestate: optimize disconnect hooks
-    - cmd/snap-update-ns: parse the -u <uid> command line option
-    - cmd/snap, tests: snapshots for all
-    - client, cmd/daemon: allow disabling keepalive, improve degraded
-      mode unit tests
-    - snap: only show "next" refresh time if its after the hold time
-    - overlord/snapstate: run tests for classic snaps even on systems
-      that don't support classic
-    - overlord/standby: fix a race between standby goroutine and stop
-    - cmd/snap-exec: don't fail on some try mode snaps
-    - cmd/snap, userd, testutil: tweak DBus tests to use private session
-      bus connection
-    - cmd: remove remnants of sc_should_populate_mount_ns
-    - client, daemon, cmd/snap: indicate that services are socket/timer
-      activated
-    - cmd/snap-seccomp: only look for PTRACE_GETFPX?REGS where available
-    - cmd/snap-confine: remove SC_NS_FAIL_GRACEFULLY
-    - snap/pack, cmd/snap: allow specifying the filename of 'snap pack'
-    - cmd/snap-discard-ns: add support for per-user mount namespaces
-    - cmd/snap-confine: remove stale mount profile along stale namespace
-    - data/apt: close stderr when calling snap in the apt install hook.
-    - tests/main: fixes for the new shellcheck
-    - testutil, cmd/snap: introduce and use testutil.EqualsWrapped and
-      fly
-    - tests: initial setup for testing current branch on nested vm and
-      hotplug management
-    - cmd: refactor IPC and lifecycle of the helper process
-    - tests/main/parallel-install-store: the store has caught up, do not
-      expect failures
-    - overlord/snapstate, snap, wrappers: start services in the right
-      order during install
-    - interfaces/browser-support, cmd/snap-seccomp: Allow read-only
-      ptrace, for the Breakpad crash reporter
-    - snap,client: use a different exit code for retryable errors
-    - overlord/ifacestate: don't conflict on own discard-snap tasks when
-      refreshing & doing garbage collection
-    - cmd/snap: tweak `snap services` output when there is no services
-    - interfaces/many: updates to support k8s worker nodes
-    - cmd/snap: gnome-software install via snap:// handler
-    - overlord/many: cleanup use of snapName vs. instanceName
-    - snapstate: add command-chain to supported featureset
-    - daemon, snap: mark screenshots as deprecated
-    - interfaces: fix decoding of json numbers for static/dynamic
-      attributes* ifstate: fix decoding of json numbers
-    - cmd/snap: try not to panic on error from "snap try"
-    - tests: new cosmic image for spread tests on gce
-    - interfaces/system-key: add parser mtime and only discover features
-      on write
-    - overlord/snapshotstate/backend: detect path to tar in unit tests
-    - tests/unit/gccgo: drop gccgo unit tests
-    - cmd: use relative file names in locking APIs
-    - interfaces: fix NormalizeInterfaceAttributes, add tests
-    - overlord/snapshotstate/backend: fall back on sudo when no runuser
-    - cmd/snap-confine: reduce verbosity of debug and error messages
-    - systemd: extend Status() to work for socket and timer units
-    - interfaces: typo 'allows' for consistency with other ifaces
-    - systemd,wrappers: don't start disabled services
-    - ifacestate: simplify task chaining in ifacestate.Connect
-    - tests: ensure that goa-daemon is off
-    - snap/pack, snap/squashfs: remove extra copy before mksquashfs
-    - cmd/snap: block 'snap help <cmd> --all'
-    - asserts, image: ensure kernel, gadget, base and required-snaps use
-      valid snap names
-    - apparmor: add unit test for probeAppArmorParser and simplify code
-    - interfaces/apparmor: conditionally add explicit deny rules for
-      ptrace
-    - po: sync translations from launchpad
-    - osutil: tweak handling of error adduser errors
-    - cmd: rename ns_group to mount_ns
-    - tests/main/interfaces-accounts-service: more debugging
-    - snap/pack, snap/squashfs: use type to determine mksquashfs args
-    - data/systemd, wrappers: tweak system-shutdown helper for core18
-    - tests: show list of processes when ifaces-accounts-service fails
-    - tests: do not run degraded test in autopkgtest env
-    - snap: overhaul validation error messages
-    - ifacestate/hooks: only create interface hook tasks if hooks exist
-    - osutil: workaround overlayfs on ubuntu 18.10
-    - interfaces/home: don't allow snaps to write to $HOME/bin
-    - interfaces: improve Attr error further
-    - snapstate: tweak GetFeatureFlagBool() to have a default argument
-    - many: cleanup remaining parallel installs TODOs
-    - image: improve validation of extra snaps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 16 Jan 2019 17:16:56 +0100
-
-snapd (2.36.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - wrappers: use new systemd.IsActive in core18 early boot
-    - httputil: retry on temporary net errors
-    - wrappers: only restart service in core18 when they are active
-    - systemd: start snapd.autoimport.service in --no-block mode
-    - data/selinux: fix syntax error in definition of snappy_admin
-      interfacewhen installing selinux-policy-devel package.
-    - centos: enable SELinux support on CentOS 7
-    - cmd, dirs, interfaces/apparmor: update distro identification to
-      support ID="archlinux"
-    - apparmor: allow hard link to snap-specific semaphore files
-    - overlord,apparmor: new syskey behaviour + non-ignored snap-confine
-      profile errors
-    - snap: add new `snap run --trace-exec` call
-    - interfaces/backends: detect too old apparmor_parser
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 14 Dec 2018 07:30:58 +0100
-
-snapd (2.36.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - daemon, vendor: bump github.com/coreos/go-systemd/activation,
-      handle API changes
-    - snapstate: update fontconfig caches on install
-    - overlord,daemon: mock security backends for testing
-    - sanity, spread, tests: add CentOS
-    - Revert "cmd/snap, tests/main/snap-info: highlight the current
-      channel"
-    - cmd/snap: add nanosleep to blacklisted syscalls when running with
-      --strace
-    - tests: add regression test for LP #1803535
-    - snap-update-ns: fix trailing slash bug on trespassing error
-    - interfaces/builtin/opengl: allow reading /etc/OpenCL/vendors
-    - cmd/snap-confine: nvidia: pick up libnvidia-opencl.so
-    - interfaces/opengl: add additional accesses for cuda
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 29 Nov 2018 10:48:29 +0100
-
-snapd (2.36.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - tests,snap-confine: add core18 only hooks test and fix running
-      core18 only hooks on classic
-    - interfaces/apparmor: allow access to
-      /run/snap.$SNAP_INSTANCE_NAME
-    - spread.yaml: add more systems to the autopkgtest and qemu backends
-    - daemon: spool sideloaded snap into blob dir
-    - wrappers: fix generating of service units with multiple `before`
-      dependencies
-    - data: run snapd.autoimport.service only after seeding
-    - tests,store,daemon: ensure proxy settings are honored in
-      auth/userinfo too
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - tests/lib: adjust to changed systemctl behaviour on debian-9
-    - tests/main/interfces-accounts-service: switch to busctl, more
-      debugging
-    - store: also make snaps downloaded via deltas 0600
-    - cmd/snap-exec: don't fail on some try mode snaps
-    - cmd/snap, userd, testutil: tweak DBus tests to use private session
-      bus connection
-    - tests/main: fixes for the new shellcheck
-    - cmd/snap-confine: remove stale mount profile along stale namespace
-    - data/apt: close stderr when calling snap in the apt install hook
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 09 Nov 2018 14:42:28 +0100
-
-snapd (2.36) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - overlord/snapstate, snap, wrappers: start services in the right
-      order during install
-    - tests: the store has caught up, drop gccgo test, update cosmic
-      image
-    - cmd/snap: try not to panic on error from "snap try"`--devmode`
-    - overlord/ifacestate: don't conflict on own discard-snap tasks when
-      refreshing & doing garbage collection
-    - snapstate: add command-chain to supported featureset
-    - daemon, snap: mark screenshots as deprecated
-    - interfaces: fix decoding of json numbers for static/dynamic
-      attributes
-    - data/systemd, wrappers: tweak system-shutdown helper for core18
-    - interfaces/system-key: add parser mtime and only discover features
-      on write
-    - interfaces: fix NormalizeInterfaceAttributes, add tests
-    - systemd,wrappers: don't start disabled services
-    - ifacestate/hooks: only create interface hook tasks if hooks exist
-    - tests: do not run degraded test in autopkgtest env
-    - osutil: workaround overlayfs on ubuntu 18.10
-    - interfaces: include invalid type in Attr error
-    - many: enable layouts by default
-    - interfaces/default: don't scrub with change_profile with classic
-    - cmd/snap: speed up unit tests
-    - vendor, cmd/snap: refactor to accommodate the new less buggy go-
-      flags
-    - daemon: expose snapshots to the API
-    - interfaces: updates for default, screen-inhibit-control, tpm,
-      {hardware,system,network}-observe
-    - interfaces/hotplug: rename HotplugDeviceKey method to HotplugKey,
-      update test interface
-    - interfaces/tests: use TestInterface instead of a custom local
-      helper
-    - overlord/snapstate: export getFeatureFlagBool.
-    - osutil,asserts,daemon: support force password change in system-
-      user assertion
-    - snap, wrappers: support restart-delay, generate RestartSec=<value>
-      in service units
-    - tests/ifacestate: moved asserts-related mocking into helper
-    - image: fetch device store assertion if available
-    - many: enable AppArmor on Arch
-    - interfaces/repo: two helper methods for hotplug
-    - overlord/ifacestate: add hotplug slots with implicit slots
-    - interfaces/hotplug: helpers and struct updates
-    - tests: run the snapd tests on Ubuntu 18.10
-    - snapstate: only report errors if there is an actual error
-    - store: speedup unit tests
-    - spread-shellcheck: fix interleaved error messages, tweaks
-    - apparmor: create SnapAppArmorDir in setupSnapConfineReexec
-    - ifacestate: implementation of defaultDeviceKey function for
-      hotplug
-    - cmd/snap-update-ns: remove empty placeholders used for mounting
-    - snapshotstate: restore to current revision
-    - tests/lib: rework the CLA checker
-    - many: support and consider store friendly-stores when checking
-      device scope constraints
-    - overlord/snapstate: block parallel installs of snapd, core, base,
-      kernel, gadget snaps
-    - overlord/patch: patch for static plug/slot attributes
-    - interfaces: honor static attributes when reloading conns
-    - osutils: unit tests speedup; introduce «run-checks --short-
-      unit».
-    - systemd, wrappers: speed up wrappers unit tests
-    - client: speedup unit tests
-    - spread-shellcheck: use threads to parallelise
-    - snap: validate plug and slot names
-    - osutil, interfaces/apparmor: add and use of osutil.UnlinkMany
-    - wrappers: do not depend on network.taget in socket units, tweak
-      generated units
-    - interfaces/apparmor: (un)load profiles in one apparmor_parser call
-    - store: gracefully handle unexpected errors in 'action'
-      response
-    - cmd: put our manpages in section 8
-    - overlord: don't make become-operational interfere with user
-      requests
-    - store: tweak unmatched refresh result error log
-    - snap, client, daemon, store: use and expose "media" more
-    - tests,cmd/snap-update-ns: add test showing mount update bug
-      cmd/snap-update-ns: better detection of snapd-made tmpfs
-    - tests: spread tests for aliases with parallel installed snaps
-    - interfaces/seccomp: allow using statx by default
-    - store: gracefully handle unexpected errors in 'action' response
-    - overlord/snapshotstate: chown the tempdir
-    - cmd/snap: attempt to start the document portal if running with a
-      session bus
-    - snap: detect layouts vs layout in snap.yaml
-    - interfaces/apparmor: handle overlayfs snippet for snap-update-ns
-    - snapcraft.yaml: set grade to stable
-    - tests: shellchecks, final round
-    - interfaces/apparmor: handle overlayfs snippet for snap-update-ns
-    - snap: detect layouts vs layout in snap.yaml
-    - overlord/snapshotstate: store epoch in snapshot, check on restore
-    - cmd/snap: tweak UX of snap refresh --list
-    - overlord/snapstate: improve consistency, use validateInfoAndFlags
-      also in InstallPath
-    - snap: give Epoch a CanRead helper
-    - overlord/snapshotstate: small refactor of internal helpers
-    - interfaces/builtin: adding missing permission to create
-      /run/wpa_supplicant directory
-    - interfaces/builtin: avahi interface update
-    - client, daemon: support passing of 'unaliased' option when
-      installing from local files
-    - selftest: rename selftest.Run() to sanity.Check()
-    - interfaces/apparmor: report apparmor support level and policy
-    - ifacestate: helpers for generating slot names for hotplug
-    - overlord/ifacestate: make sure to pass in the Model assertion when
-      enforcing policies
-    - overlord/snapshotstate: store the SnapID in snapshot, block
-      restore if changed
-    - interfaces: generalize writable mimic profile
-    - asserts,interfaces/policy: add support for on-store/on-brand/on-
-      model plug/slot rule constraints
-    - many: fetch the device store assertion together and in the context
-      of interpreting snap-declarations
-    - tests: disable gccgo tests on 18.04 for now, until dh-golang vs
-      gccgo is fixed
-    - tests/main/parallel-install-services: add spread test for snaps
-      with services
-    - tests/main/snap-env: extend to cover parallel installations of
-      snaps
-    - tests/main/parallel-install-local: rename from *-sideload, extend
-      to run snaps
-    - cmd/snapd,daemon,overlord: without snaps, stop and wait for socket
-    - cmd/snap: tame the help zoo
-    - tests/main/parallel-install-store: run installed snap
-    - cmd/snap: add a bunch of TRANSLATORS notes (and a little more
-      i18n)
-    - cmd: fix C formatting
-    - tests: remove unneeded cleanup from layout tests
-    - image: warn on missing default-providers
-    - selftest: add test to ensure selftest.checks is up-to-date
-    - interfaces/apparmor, interfaces/builtin: tweaks for parallel snap
-      installs
-    - userd: extend the list of supported XDG Desktop properties when
-      autostarting user applications
-    - cmd/snap-update-ns: enforce trespassing checks
-    - selftest: actually run the kernel version selftest
-    - snapd: go into degraded mode when the selftest fails
-    - tests: add test that runs snapctl with a core18 snap
-    - tests: add snap install hook with base: core18
-    - overlord/{snapstate,assertstate}: parallel instances and
-      refresh validation
-    - interfaces/docker-support: add rules to read apparmor macros
-    - tests: make nfs test available for more systems
-    - tests: cleanup copy/paste dup in interfaces-network-setup-control
-    - tests: using single sh snap in interface tests
-    - overlord/snapstate: improve cleaup in mount-snap handler
-    - tests: don't fail interfaces-bluez test if bluez is already
-      installed
-    - tests: find snaps just for edge and beta channels
-    - daemon, snapstate: consistent snap list [--all] output with broken
-      snaps
-    - tests: fix listing to allow extra things in the notes column
-    - cmd/snap: improve UX when removing specific snap revision
-    - cmd/snap, tests/main/snap-info: highlight the current channel
-    - interfaces/testiface: added TestHotplugInterface
-    - snap: tweak commands
-    - interfaces/hotplug: hotplug spec takes one slot definition
-    - overlord/snapstate, snap: handle shared snap directories when
-      installing/remove snaps with instance key
-    - interfaces/opengl: misc accesses for VA-API
-    - client, cmd/snap: expose warnings to the world
-    - cmd/snap-update-ns: introduce trespassing state tracking
-    - cmd/snap: commands no longer build their own client
-    - tests: try to build cmd/snap for darwin
-    - daemon: make error responders not printf when called with 1
-      argument
-    - many: return real snap name in API response
-    - overlord/state: return latest LastAdded time in WarningsSummary
-    - many: mount namespace mapping for parallel installs of snaps
-    - ifacestate/autoconnect: do not self-conflict on setup-profiles if
-      core-phase-2
-    - client, cmd/snap: on !linux, exit when the client tries to Do
-      something
-    - tests: refactor for nested suite and tests fixed
-    - tests: use lxd's waitready instead of polling lxd socket
-    - ifacestate: don't initialize udev monitor until we have a system
-      snap
-    - interfaces: extra argument for static attrs in
-      NewConnectedPlug/NewConnectedSlot
-    - packaging/arch: sync packaging with AUR
-    - snapstate/tests: serialize all appends in fake backend
-    - snap-confine: make /lib/modules optional
-    - cmd/snap: handle "snap interfaces core" better
-    - store: move download tests into downloadSuite
-    - tests,interfaces: run interfaces-account-control on UC18
-    - tests: fix install snaps test by adding link to /snap
-    - tests: fix for nested test suite
-    - daemon: fix snap list --all with parallel snap instances
-    - snapstate: refactor tests to use SetModel*
-    - wrappers: fix snap services order in tests
-    - many: provide salt for generating instance-key in store requests
-    - ifacestate: fix hang when retrying content providers
-    - snapd-env-generator: fix when PATH is empty or unset
-    - overlord/assertstate: propagate TaskSnapSetup error
-    - client: catch and expose logs errors
-    - overlord: integrate device enumeration with udev monitor
-    - daemon, overlord/state: warnings pipeline
-    - tests: add publisher regex to fix the snap-info test pass on sru
-    - cmd: use systemdsystemgeneratorsdir, cleanup automake complaints,
-      tweaks
-    - cmd/snap-update-ns: remove the unused Secure type
-    - osutil, o/snapshotstate, o/sss/backend: quick fixes
-    - tests: update the listing expression to support core from
-      different channels
-    - store: use stable instance key in store refresh requests
-    - cmd/snap-update-ns: detach Mk{Prefix,{File,Dir,Symlink{,All}}}
-    - overlord/patch: support for sublevel patches
-    - tests: update prepare/restore for nightly suite
-    - cmd/snap-update-ns: detach BindMount from the Secure type
-    - cmd/snap-update-ns: re-factor pair of helpers to call fstatfs once
-    - ifacestate: retry on "discard-snap" in autoconnect conflict check
-    - cmd/snap-update-ns: separate OpenPath from the Secure struct
-    - wrappers: remove Wants=network-online.target
-    - tests: add new core16-base test
-    - store: refactor tests so that they work as store_test package
-    - many: add refresh.rate-limit core option
-    - tests: run account-control test with different bases
-    - tests: port proxy test to use python tinyproxy
-    - overlord: introduce snapshotstate.
-    - testutil: allow Fstatfs results to vary over time
-    - snap-update-ns: add comments about the "deadcode" in bootstrap.go
-    - overlord: add chg.Err() in testUpdateWithAutoconnectRetry
-    - many: remove deadcode
-    - tests: also run unit/gccgo in 18.04
-    - tests: introduce a helper for installing local snaps with --name
-    - tests: avoid removing core snap on reset
-    - snap: use snap.SideInfo in test to fix build with gccgo
-    - partition: remove unused runCommand
-    - image: fix incorrect error when using local bases
-    - overlord/snapstate: fix format
-    - cmd: fix format
-    - tests: setting "storage: preserve-size" just for amazon-linux
-      system
-    - tests: test for the hostname interface
-    - interfaces/modem-manager: allow access to more USB strings
-    - overlord: instantiate UDevMonitor
-    - interfaces/apparmor: tweak naming, rename to AddLayout()
-    - interfaces: take instance name in ifacetest.InstallSnap
-    - snapcraft: do not use --dirty in mkversion
-    - cmd: add systemd environment generator
-    - devicestate: support getting (http) proxy from core config
-    - many: rename ClientOpts to ClientOptions
-    - prepare-image-grub-core18: remove image root in restore
-    - overlord/ifacestate: remove "old-conn" from connect/undo connect
-      handlers
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - image: handle errors when downloadedSnapsInfoForBootConfig has no
-      data
-    - tests: use official core18 model assertion in tests
-    - snap-confine: map /var/lib/extrausers into snaps mount-namespace
-    - overlord,store: support proxy settings internally too
-    - cmd/snap: bring back 'snap version'
-    - interfaces/mount: tweak naming of things
-    - strutil: fix MatchCounter to also work with buffer reuse
-    - cmd,interfaces,tests: add /mnt to removable-media interface
-    - systemd: do not run "snapd.snap-repair.service.in on firstboot
-      bootstrap
-    - snap/snapenv: drop some instance specific variables, use instance-
-      specific ones for user locations
-    - firstboot: sort by type when installing the firstboot snaps
-    - cmd, cmd/snap: better support for non-linux
-    - strutil: add new ParseByteSize
-    - image: detect and error if bases are missing
-    - interfaces/apparmor: do not downgrade confinement on arch with
-      linux-hardened 4.17.4+
-    - daemon: add pokeStateLock helper to the daemon tests
-    - snap/squashfs: improve error message from Build on mksquashfs
-      failure
-    - tests: remove /etc/alternatives from dirs-not-shared-with-host
-    - cmd: support re-exec into the "snapd" snap
-    - spdx: remove "Other Open Source" from the support licenses
-    - snap: add new type "TypeSnapd" and attach to the snapd snap
-    - interfaces: retain order of inserted security backends
-    - tests: spread test for parallel-installs desktop file handling
-    - overlord/devicestate: use OpenSSL's PEM format when generating
-      keys
-    - cmd: remove --skip-command-chain from snap run and snap-exec
-    - selftest: detect if apparmor is unusable and error
-    - snap,snap-exec: support command-chain for hooks
-    - tests: significantly reduce execution time for managers test
-    - snapstate: use new "snap.ByType" sorting
-    - overlord/snapstate: fix UpdateMany() to work with parallel
-      instances
-    - testutil: have File* checker produce more useful error output
-    - overlord/ifacestate: introduce connectOpts
-    - interfaces: parallel instances support, extend unit tests
-    - tests: normalize tests
-    - snapstate: make InstallPath() return *snap.Info too
-    - snap: add ByType sorting
-    - interfaces: add cifs-mount interface
-    - tests: use file based markers in snap-service-stop-mode
-    - osutil: reorg and stub out things to get it building on darwin
-    - tests/main/layout: cleanup after the test
-    - osutil/sys: small tweaks to let it build on darwin
-    - daemon, overlord/snapstate: set instance name when installing from
-      snap file
-    - many: move Uname to osutil, for more DRY and easier porting.
-    - cmd/snap: create snap user directory when running parallel
-      installed snaps
-    - cmd/snap-confine: switch to validation of SNAP_INSTANCE_NAME
-    - tests: basic test for parallel installs from the store
-    - image: download the gadget from the model.GadgetTrack()
-    - snapstate: add support for gadget tracks in model assertion
-    - image: add support for "gadget=track"
-    - overlord: handle sigterm during shutdown better
-    - tests: add the original function to fix the errors on new kernels
-    - tests/main/lxd: pull lxd from candidate; reënable i386
-    - wayland: add extra sockets that are used by older toolkits (e.g.
-      gtk3)
-    - asserts: add support for gadget tracks in the model assertion
-    - overlord/snapstate: improve feature flag validation
-    - tests/main/lxd: run ubuntu-16.04 only on 64 bit variant
-    - interfaces: workaround for activated services and newer DBus
-    - tests: get the linux-image-extra available for the current kernel
-    - interfaces: add new "sysfs-name" to i2c interfaces code
-    - interfaces: disconnect hooks
-    - cmd/libsnap: unify detection of core/classic with go
-    - tests: fix autopkgtest failures in cosmic
-    - snap: fix advice json
-    - overlord/snapstate: parallel snap install
-    - store: backward compatible instance-key handling for non-instance
-      snaps
-    - interfaces: add screencast-legacy for video and audio recording
-    - tests: skip unsupported architectures for fedora-base-smoke test
-    - tests: avoid using the journalctl cursor when it has not been
-      created yet
-    - snapstate: ensure normal snaps wait for the "snapd" snap on
-      refresh
-    - tests: enable lxd again everywhere
-    - tests: new test for udisks2 interface
-    - interfaces: add cpu-control for setting CPU tunables
-    - overlord/devicestate: fix tests, set seeded in registration
-      through proxy tests
-    - debian: add missing breaks on cosmic
-    - devicestate: only run device-hook when fully seeded
-    - seccomp: conditionally add socketcall() based on system and base
-    - tests: new test for juju client observe interface
-    - overlord/devicestate: DTRT w/a snap proxy to reach a serial vault
-    - snapcraft: set version information for the snapd snap
-    - cmd/snap, daemon: error out if trying to install a snap using
-      empty name
-    - hookstate: simplify some hook tests
-    - cmd/snap-confine: extend security tag validation to cover instance
-      names
-    - snap: fix mocking of systemkey in snap-run tests
-    - packaging/opensuse: fix static build of snap-update-ns and snap-
-      exec
-    - interfaces/builtin: addtl network-manager resolved DBus fix
-    - udev: skip TestParseUdevEvent on ppc
-    - interfaces: miscellaneous policy updates
-    - debian: add tzdata to build-dep to ensure snapd builds correctly
-    - cmd/libsnap-confine-private: intoduce helpers for validating snap
-      instance name and instance key
-    - snap,snap-exec: support command-chain for app
-    - interfaces/builtin: network-manager resolved DBus changes
-    - snap: tweak `snap wait` command
-    - cmd/snap-update-ns: introduce validation of snap instance names
-    - cmd/snap: fix some corner-case test setup weirdness
-    - cmd,dirs: fix various issues discovered by a Fedora base snap
-    - tests/lib/prepare: fix extra snaps test
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 24 Oct 2018 11:30:45 -0600
-
-snapd (2.35.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - interfaces/home: don't allow snaps to write to $HOME/bin
-    - osutil: workaround overlayfs on ubuntu 18.10
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 15 Oct 2018 22:23:02 +0200
-
-snapd (2.35.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - wrappers: do not depend on network.taget in socket units, tweak
-      generated units
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Oct 2018 14:41:33 +0200
-
-snapd (2.35.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - overlord: don't make become-operational interfere with user
-      requests
-    - docker_support.go: add rules to read apparmor macros
-    - interfaces/apparmor: handle overlayfs snippet for snap-update-
-      nsFixes:
-    - snapcraft.yaml: add workaround to fix snapcraft build
-    - interfaces/opengl: misc accesses for VA-API
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Oct 2018 09:32:00 +0200
-
-snapd (2.35.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - cmd,overlord/snapstate: go 1.11 format fixes
-    - ifacestate: fix hang when retrying content providers
-    - snap-env-generator: do nothing when PATH is unset
-    - interfaces/modem-manager: allow access to more USB strings
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 12 Sep 2018 09:32:00 +0200
-
-snapd (2.35.1) xenial; urgency=medium
-
-  *  New upstream release, LP: #1786438
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - snapcraft: do not use --diry in mkversion.sh
-    - cmd: add systemd environment generator
-    - snap-confine: map /var/lib/extrausers into snaps mount-namespace
-    - tests: cherry-pick test fixes from master for 2.35
-    - systemd: do not run "snapd.snap-repair.service.in on firstboot
-      bootstrap
-    - interfaces: retain order of inserted security backends
-    - selftest: detect if apparmor is unusable and error
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 03 Sep 2018 14:44:06 +0200
-
-snapd (2.35) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - snapstate: add support for gadget tracks in model assertion
-    - image: add support for "gadget=track"
-    - asserts: add support for gadget tracks in the model assertion
-    - interfaces: add new "sysfs-name" to i2c interfaces code
-    - overlord: handle sigterm during shutdown better
-    - wayland: add extra sockets that are used by older toolkits
-    - snap: fix advice json
-    - tests: fix autopkgtest failures in cosmic
-    - store: backward compatible instance-key handling for non-instance
-      snaps
-    - snapstate: ensure normal snaps wait for the "snapd" snap on
-      refresh
-    - interfaces: add cpu-control for setting CPU tunables
-    - debian: add missing breaks on comisc
-    - overlord/devicestate: DTRT w/a snap proxy to reach a serial vault
-    - devicestate: only run device-hook when fully seeded
-    - seccomp: conditionally add socketcall() based on system and base
-    - interfaces/builtin: addtl network-manager resolved DBus fix
-    - hookstate: simplify some hook tests
-    - udev: skip TestParseUdevEvent on ppc
-    - interfaces: miscellaneous policy updates
-    - debian: add tzdata to build-dep to ensure snapd builds correctly
-    - interfaces/builtin: network-manager resolved DBus changes
-    - tests: add spread test for fedora29 base snap
-    - cmd/libsnap: treat distributions with VARIANT_ID=snappy as "core"
-    - dirs: fix SnapMountDir inside a Fedora base snap
-    - tests: fix snapd-failover for core18 with external backend
-    - overlord/snapstate: always clean SnapState when doing Get()
-    - overlod/ifacestate: always use a new SnapState when fetching the
-      snap state
-    - overlord/devicestate: have the serial request talk to the proxy if
-      set
-    - interfaces/hotplug: udevadm output parser
-    - tests: New test for daemon-notify interface
-    - image: ensure "core" is ordered early if base: and core is used
-    - cmd/snap-confine: snap-device-helper parallel installs support
-    - tests: enable interfaces-framebuffer everywhere
-    - tests: reduce nc wait time from 2 to 1 second
-    - snap/snapenv: add snap instance specific variables
-    - cmd/snap-confine: add minimal test for snap-device-helper
-    - tests: enable snapctl test on core18
-    - overlord: added UDevMonitor for future hotplug support
-    - wrappers: do not glob when removing desktop files
-    - tests: add dbus monitor log to interfaces-accounts-service
-    - tests: add core-18 systems to external backend
-    - wrappers: account for changed app wrapper in parallel installed
-      snaps
-    - wrappers: make sure that the tests pass on non-Ubuntu too
-    - many: add snapd snap failure handling
-    - tests: new test for dvb interface
-    - configstate: accept refresh.timer=managed
-    - tests: new test for snap logs command
-    - wrapper: generate all the snapd unit files when generating
-      wrappers
-    - store: keep all files with link-count > 1 in the cache
-    - store: be less verbose in the common refresh case of "no updates"
-    - snap-confine: update snappy-app-dev path
-    - debian: ensure dependency on fixed apt on 18.04
-    - snapd: add initial software watchdog for snapd
-    - daemon, systemd: change journalctl -n=all to --no-tail
-    - systemd: fix snapd.apparmor.service.in dependencies
-    - snapstate: refuse to remove bases or core if snaps need them
-    - snap: introduce package-level helpers for building snap related
-      directory/file paths
-    - overlord/devicestate: deny parallel install of kernel or gadget
-      snaps
-    - store: clean up parallel-install TODOs in store tests
-    - timeutil: fix first weekday of the month schedule
-    - interfaces: match all possible tty but console
-    - tests: shellchecks part 5
-    - cmd/snap-confine: allow ptrace read for 4.18 kernels
-    - advise: make the bolt database do the atomic rename dance
-    - tests/main/apt-hooks: debug dump of commands.db
-    - tests/lib/prepare-restore: update Arch Linux kernel LOCALVERSION
-      handling
-    - snap: validate instance name as part of Validate()
-    - daemon: if a snap is inactive, don't ask systemd about its
-      services.
-    - udev: skip TestParseUdevEvent on s390x
-    - tests: switch core-amd64-18 to use `kernel: pc-kernel=18`
-    - asserts,image: add support for new kernel=track syntax
-    - tests: new gce image for fedora 27
-    - interfaces/apparmor: use the cache in mtime-resilient way
-    - store, overlord/snapstate: introduce instance name in store APIs
-    - tests: drive-by cleanup of redudant pkgname matching
-    - tests: ensure apt-hook is only run after catalog update ran
-    - tests: use pkill instead of kilall
-    - tests/main: another bunch of updates for Amazon Linux 2
-    - tests/lib/snaps: avoid using relative command paths that go up in
-      the  directory tree
-    - tests: disable/fix more tests for Amazon Linux 2
-    - overlord: introduce InstanceKey to SnapState and SnapSetup,
-      renames
-    - daemon: make sure most change generating handlers can produce
-      errors with kinds
-    - tests/main/interfaces-calendar-service: skip the test on AMZN2
-    - tests/lib/snaps: avoid using relative command paths that go up in
-      the directory tree
-    - cmd/snap: add a green check mark to verified publishers
-    - cmd/snap: fix two issues in the cmd/snap unit tests
-    - packaging/fedora: fix target path of /snap symlink
-    - cmd/snap: support `--last=<type>?` to mean "no error on empty"
-    - cmd/snap-confine: (nvidia) pick up libnvidia-glvkspirv.so
-    - strutil: detect and bail out of Unmarshal on duplicate key
-    - packaging/fedora(amzn2): disable SELinux, drop dependency on
-      squashfuse for AMZN2
-    - spread, tests: add support for Amazon Linux 2
-    - packaging/fedora: Add Amazon Linux 2 support
-    - many: make Wait/Stop optional on StateManagers
-    - snap/squashfs: stop printing unsquashfs info to stderr
-    - snap: add support for `snap advise-snap --from-apt`
-    - overlord/ifacestate: ignore connect if already connected
-    - tests: change the service snap used instead of network-bind-
-      consumer
-    - interfaces/network-control: update for wpa-supplicant and ifupdown
-    - tests: fix raciness in stop mode tests
-    - logger: try to not have double dates
-    - debian: use deb-systemd-invoke instead of systemctl directly
-    - tests: run all main tests on core18
-    - many: finish sharing a single TaskRunner with all the the managers
-    - interfaces/repo: added AllHotplugInterfaces helper
-    - snapstate: ensure kernel-track is honored on switch/refresh
-    - overlord/ifacestate: support implicit slots on snapd
-    - image: add support for "kernel-track" in `snap prepare-image`
-    - tests: add test that ensures we do not boot any system in degraded
-      state
-    - tests: update tests to work on core18
-    - cmd/snap: check for typographic dashes in command
-    - tests: fix tests expecting old email address
-    - client: add some existing error kinds that were not listed in
-      client.go
-    - tests: add missing slots in classic and core provider test snaps
-    - overlord,daemon,cmd: re-map snap names around the edges of snapd
-    - tests: use install_local in snap-run-hooks
-    - coreconfig: add support for `snap set system network.disable-
-      ipv6`
-    - overlord/snapstate: dedupe default content providers
-    - osutil/udev: sync with upstream
-    - debian: do not ship snapd.apparmor.service on ubuntu
-    - overlord: have SnapManager use a passed in TaskRunner created by
-      Overlord
-    - many: streamline the generic conflict check mechanisms
-    - tests: remove unneeded setup code in snap-run-symlink
-    - cmd/snap: print unset license as "unset", instead of "unknown"
-    - asserts: add (optional) kernel-track to model assertion
-    - snap/squashfs, tests: pass -n[o-progress] to {mk,un}squashfs
-    - interfaces/pulseaudio: be clear that the interface allows playback
-      and record
-    - snap: support hook environment
-    - interfaces: fix typo "daemonNotify" (add missing "n")
-    - interfaces: tweak tests of daemon-notify, use common naming
-    - interfaces: allow invoking systemd-notify when daemon-notify is
-      connected
-    - store: make snap blobs be 0600
-    - interfaces,daemon: move JSON types to the daemon
-    - tests: prepare needs to handle bin/snapctl being a symlink
-    - tests: do not mask errors in interfaces-timezone-control (#5405)
-    - packaging: put snapctl into /usr/lib/snapd and symlink in usr/bin
-    - tests: add basic integration test for spread hold
-    - overlord/snapstate: improve PlugsOnly comment
-    - many: assorted shellcheck fixes
-    - store, daemon, client, cmd/snap: expose "scope", default to wide
-    - snapstate: allow setting "refresh.timer=managed"
-    - cmd/snap: display a link to data privacy notice for interactive
-      snap login
-    - client, cmd/snap: pass snap instance name when installing from
-      file
-    - cmd/snap: add 'debug paths' command
-    - snapstate: make sure all *link-*snap tasks carry a snap type and
-      further hints
-    - devicestate: fix race when refreshing a snap with snapd-control
-    - tests: fix tests on arch
-    - tests: start active system units on reset
-    - tests: new test for joystick interface
-    - tests: moving install of dependencies to pkgdb helper
-    - tests: enable new fedora image with test dependencies installed
-    - tests: start using the new opensuse image with test dependencies
-    - tests: check catalog refresh before and after restart snapd
-    - tests: stop restarting journald service on prepare
-    - interfaces: make core-support a no-op interface
-    - interfaces: prefer "snapd" when resolving implicit connections
-    - interfaces/hotplug: add hotplug Specification and
-      HotplugDeviceInfo
-    - many: lessen the use of core-support
-    - tests: fixes for the autopkgtest failures in cosmic
-    - tests: remove extra ' which breaks interfaces-bluetooth-control
-      test
-    - dirs: fix antergos typo
-    - tests: use grep to avoid non-matching messages from MATCH
-    - dirs: improve distro detection for Antegros
-    - vendor: switch to latest bson
-    - interfaces/builtin: create can-bus interface
-    - tests: "snap connect" is idempotent so just connect
-    - many: use extra "releases" information on store "revision-not-
-      found" errors to produce better errors
-    - interfaces: treat "snapd" snap as type:os
-    - interfaces: tweak tests to have less repetition of "core" and
-      "ubuntu…
-    - tests: simplify econnreset test
-    - snap: add helper for renaming slots
-    - devicestate: fix panic in firstboot code when no snaps are seeded
-    - tests: add artful for sru validation on google backend
-    - snap,interfaces: move interface name validation to snap
-    - overlord/snapstate: introduce path to fake backend ops
-    - cmd/snap-confine: fix snaps running on core18
-    - many: expose publisher's validation throughout the API
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 20 Aug 2018 12:36:33 +0200
-
-snapd (2.34.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - interfaces/apparmor: use the cache in mtime-resilient way
-    - cmd/snap-confine: (nvidia) pick up libnvidia-glvkspirv.so
-    - snapstate: allow setting "refresh.timer=managed"
-    - spread: switch Fedora and openSUSE images
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 27 Jul 2018 19:08:44 +0200
-
-snapd (2.34.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - packaging: fix bogus date in fedora snapd.spec
-    - tests: fix tests expecting old email address
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 Jul 2018 12:05:50 +0200
-
-snapd (2.34.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - tests: cherry-pick test fixes from master for 2.34
-    - coreconfig: add support for `snap set system network.disable-
-      ipv6`
-    - debian: do not ship snapd.apparmor.service on ubuntu
-    - overlord/snapstate: dedupe default content providers
-    - interfaces/builtin: create can-bus interface
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 17 Jul 2018 19:46:56 +0200
-
-snapd (2.34) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - store, daemon, client, cmd/snap: expose "scope", default to wide*
-    - tests: fix arch tests
-    - snapstate: make sure all *link-*snap tasks carry a snap type and
-      further hints
-    - snapstate: allow setting "refresh.timer=managed"
-    - cmd/snap: display a link to data privacy notice for interactive
-      snap login
-    - devicestate: fix race when refreshing a snap with snapd-control
-    - tests: skip interfaces-framebuffer when no /dev/fb0 is found
-    - tests: run interfaces-contacts-service only where test-snapd-eds
-      is available
-    - many: expose publisher's validation throughout the API
-    - many: use extra "releases" information on store "revision-not-
-      found" errors to produce better errors
-    - dirs: improve distro detection for Antegros
-    - Revert "dirs: improve identification of Arch Linux like systems"
-    - devicestate: fix panic in firstboot code when no snaps are seeded
-    - i18n: use xgettext-go --files-from to avoid running into cmdline
-      size limits
-    - interfaces: move ValidateName helper to utils
-    - snapstate,ifstate: wait for pending restarts before auto-
-      connecting
-    - snap: account for parallel installs in wrappers, place info and
-      tests
-    - configcore: fix incorrect handling of keys with numbers (like
-      gpu_mem_512)
-    - tests: fix tests when no keyboard input detected
-    - overlord/configstate: add watchdog options
-    - snap-mgmt: fix for non-existent dbus system policy dir,
-      shellchecks
-    - tests/main/snapd-notify: use systemd's service properties rater
-      than the journal
-    - snapstate: allow removal of snap.TypeOS when using a model with a
-      base
-    - interfaces: make findSnapdPath smarter
-    - tests: run "arp" tests only if arp is available
-    - spread: increase the number of auto retries for package downloads
-      in opensuse
-    - cmd/snap-confine: fix nvidia support under lxd
-    - corecfg: added experimental.hotplug feature flag
-    - image: block installation of parallel snap instances
-    - interfaces: moved normalize method to interfaces/utils and made it
-      public
-    - api/snapctl: allow -h and --help for regular users.
-    - interfaces/udisks2: also implement implicit classic slot
-    - cmd/snap-confine: include CUDA runtime libraries
-    - tests: disable auto-refresh test on core18
-    - many: switch to account validation: unproven|verified
-    - overlord/ifacestate: get/set connection state only via helpers
-    - tests: adding extra check to validate journalctl is showing
-      current test data
-    - data: add systemd environment configuration
-    - i18n: handle write errors in xgettext-go
-    - snap: helper for validating snap instance names
-    - snap{/snaptest}: set instance key based on snap name
-    - userd: fix running unit tests on KDE
-    - tests/main/econnreset: limit ingress traffic to 512kB/s
-    - snap: introduce a struct Channel to represent store channels, and
-      helpers to work with it
-    - tests: add fedora to distro_clean_package_cache function
-    - many: rename snap.Info.StoreName() to snap.Info.SnapName()
-    - tests: add spread test to ensure snapd/core18 are not removable
-    - tests: tweaks for running the main tests on core18
-    - overlord/{config,snap}state: introduce experimental.parallel-
-      instances feature flag
-    - strutil: support iteration over almost clean paths
-    - strutil: add PathIterator.Rewind
-    - tests: update interfaces-timeserver-control to core18
-    - tests: add halt-timeout to google backend
-    - tests: skip security-udev-input-subsystem without /dev/input/by-
-      path
-    - snap: introduce the instance key field
-    - packaging/opensuse: remaining packaging updates for 2.33.1
-    - overlord/snapstate: disallow installing snapd on baseless models
-    - tests: disable core tests on all core systems (16 and 18)
-    - dirs: improve identification of Arch Linux like systems
-    - many: expose full publisher info over the snapd API
-    - tests: disable core tests on all core systems (16 and 18)
-    - tests/main/xdg-open: restore or clean up xdg-open
-    - tests/main/interfaces-firewall-control: shellcheck fix
-    - snapstate: sort "snapd" first
-    - systemd: require snapd.socket in snapd.seeded.service; make sure
-      snapd.seeded
-    - spread-shellcheck: use the latest shellcheck available from snaps
-    - tests: use "ss" instead of "netstat" (netstat is not available in
-      core18)
-    - data/complete: fix three out of four shellcheck warnings in
-      data/complete
-    - packaging/opensuse: fix typo, missing assignment
-    - tests: initial core18 spread image building
-    - overlord: introduce a gadget-connect task and use it at first boot
-    - data/completion: fix inconsistency in +x and shebang
-    - firstboot: mark essential snaps as "Required" in the state
-    - spread-shellcheck: use a whitelist of files that are allowed to
-      fail validation
-    - packaging/opensuse: build position-independent binaries
-    - ifacestate: prevent running interface hooks twice when self-
-      connecting on autoconnect
-    - data: remove /bin/sh from snapd.sh
-    - tests: fix shellcheck 0.5.0 warnings
-    - packaging/opensuse: snap-confine should be 06755
-    - packaging/opensuse: ship apparmor integration if enabled
-    - interfaces/udev,misc: only trigger udev events on input subsystem
-      as needed
-    - packaging/opensuse: add missing bits for snapd.seeded.service
-    - packaging/opensuse: don't use %-macros in comments
-    - tests: shellchecks part 4
-    - many: rename snap.Info.Name() to snap.Info.InstanceName(), leave
-      parallel-install TODOs
-    - store: drop unused: channel map types, and details fixture.
-    - store: have a basic test about the unmarshalling of /search
-      results
-    - tests: show executed tests on current system when a test fails
-    - tests: fix for the download of the big snap
-    - interfaces/apparmor: add chopTree
-    - tests: remove double debug: | entry in tests and add more checks
-    - cmd/snap-update-ns: introduce mimicRequired helper
-    - interfaces: move assertions around for better failure line number
-    - store: log a nice clear "download succeeded" message
-    - snap: run snap-confine from the re-exec location
-    - snapstate: support restarting snapd from the snapd snap on core18
-    - tests: show status of the partial test-snapd-huge snap in
-      econnreset test
-    - tests: fix interfaces-calendar-service test when gvfsd-metadata
-      loks the xdg dirctory
-    - store: switch store.SnapInfo to use the new v2/info endpoint
-    - interfaces: add Repository.AllInterfaces
-    - snapstate: stop using evolving SnapSpec internally, use an
-      internal-only snapSpec instead
-    - cmd/libsnap-confine-private: introduce a helper for splitting snap
-      name
-    - tests: econnreset/retry tweaks
-    - store, et al: kill dead code that uses the bulk endpoint
-    - tests/lib/prepare-restore: fix upgrade/reboot handling on arch
-    - cmd/snap-update-ns,strutil: move PathIterator to strutil, add
-      Depth helper
-    - data/systemd/snapd.run-from-snap: ensure snapd tooling is
-      available
-    - store: switch connectivity check to use v2/info
-    - devicestate: support seeding from a base snap instead of core
-    - snapstate,ifacestate: remove core-phase-2 handling
-    - interfaces/docker-support: update for docker 18.05
-    - tests: enable fedora 28 again
-    - overlord/ifacestate:  simplify checkConnectConflicts and also
-      connect signature
-    - snap: parse connect instructions in gadget.yaml
-    - tests: fix snapd-repair.timer on ubuntu-core-snapd-run- from-snap
-      test
-    - interfaces/apparmor: allow killing snap-update-ns
-    - tests: skip "try" test on s390x
-    - store, image: have 'snap download' use v2/refresh action=download
-    - interfaces/policy: test that base policy can be parsed
-    - tests: publish test-snapd-appstreamid for any architecture
-    - snap: don't include newline in hook environment
-    - cmd/snap-update-ns: use RCall with SyscallsEqual
-    - cmd/snap-update-ns: add IsSnapdCreatedPrivateTmpfs and tests
-    - tests: skip security-dev-input-event-denied on s390x/arm64
-    - interfaces: add the dvb interface
-    - daemon: paging is not a thing.
-    - cmd/snap-mgmt: remove system key on purge
-    - testutil: syscall sequence checker
-    - cmd/snap-update-ns: fix a leaking file descriptor in MkSymlink
-    - packaging: use official bolt in the errtracker on fedora
-    - many: add `snap debug connectivity` command* many: add `snap debug
-      connectivity` command
-    - configstate: deny configuration of base snaps and for the "snapd"
-      snap
-    - interfaces/raw-usb: also allow usb serial devices
-    - snap: reject more layout locations
-    - errtracker: do not send duplicated reports
-    - httputil: extra debug if an error is not retried
-    - cmd/snap-update-ns: improve wording in many errors
-    - cmd/snap: use snaptest.MockSnapCurrent in `snap run` tests
-    - cmd/snap-update-ns: add helper for checking for read-only
-      filesystems
-    - interfaces/builtin/docker: use commonInterface over specific
-      struct
-    - testutil: add test support for Fstatfs
-    - cmd/snap-update-ns: discard the concept of segments
-    - cmd/libsnap-confine-private: helper for extracting store snap name
-      from local-name
-    - tests: fix flaky test for hooks undo
-    - interfaces: add {contacts,calendar}-service interfaces
-    - tests: retry 'restarting into..' match in the snap-confine-from-
-      core test
-    - systemd: adjust TestWriteMountUnitForDirs() to use
-      squashfs.MockUseFuse(false)
-    - data: add helper that can generate/start/stop the snapd service
-    - sefltest: advise reboot into 4.4 on trusty running 3.13
-    - selftest: add new selftest package that tests squashfs mounting
-    - store, jsonutil: move store.getStructFields to
-      jsonutil.StructFields
-    - ifacestate: improved conflict and error handling when creating
-      autoconnect tasks
-    - cmd/snap-confine: applied make fmt
-    - interfaces/udev: call 'udevadm settle --timeout=10' after
-      triggering events
-    - tests: wait more time until snap start to be downloaded on
-      econnreset test
-    - snapstate: ensure fakestore returns TypeOS for the core snap
-    - tests: fix lxd test which hangs on restore
-    - cmd/snap-update-ns: add PathIterator
-    - asserts,image: add support for models with bases
-    - tests: shellchecks part 3
-    - overlord/hookstate: support undo for hooks
-    - interfaces/tpm: Allow access to the kernel resource manager
-    - tests: skip appstream-id test for core systems 32 bits
-    - interfaces/home: remove redundant common interface assignment
-    - tests: reprioritise a few tests that are known to be slow
-    - cmd/snap: small help tweaks and fixes
-    - tests: add test to ensure /dev/input/event* for non-joysticks is
-      denied
-    - spread-shellcheck: silly fix & pep8
-    - spread: switch fedora 28 to manual
-    - client,cmd/snap,daemon,tests: expose base of a snap over API, show
-      it in snap info --verbose
-    - tests: fix lxd test - --auto now sets up networking
-    - tests: adding fedora-28 to spread.yaml
-    - interfaces: add juju-client-observe interface
-    - client, daemon: add a "mounted-from" entry to local snaps' JSON
-    - image: set model.DisplayName() in bootenv as "snap_menuentry"
-    - packaging/opensuse: Refactor packaging to support all openSUSE
-      targets
-    - interfaces/joystick: force use of the device cgroup with joystick
-      interface
-    - interfaces/hardware-observe: allow access to /etc/sensors* for
-      libsensors
-    - interfaces: remove Plug/Slot types
-    - interface hooks: update old AutoConnect methods
-    - snapcraft: run with DEB_BUILD_OPTIONS=nocheck
-    - overlord/{config,snap}state: the number of inactive revisions is
-      config
-    - cmd/snap: check with snapd for unknown sections
-    - tests: moving test helpers from sh to bash
-    - data/systemd: add snapd.apparmor.service
-    - many: expose AppStream IDs (AKA common ID)
-    - many: hold refresh when on metered connections
-    - interfaces/joystick: also support modern evdev joysticks and
-      gamepads
-    - xdgopenproxy: skip TestOpenUnreadableFile when run as root
-    - snapcraft: use dpkg-buildpackage options that work in xenial
-    - spread: openSUSE LEAP 42.2 was EOLd in January, remove it
-    - get-deps: work with an unset GOPATH too
-    - interfaces/apparmor: use strict template on openSUSE tumbleweed
-    - packaging: filter out verbose flags from "dh-golang"
-    - packaging: fix description
-    - snapcraft.yaml: add minimal snapcraft.yaml with custom build
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 06 Jul 2018 16:08:17 +0200
-
-snapd (2.33.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1773118
-    - many: improve udev trigger on refresh experience
-    - systemd: require snapd.socket in snapd.seeded.service
-    - snap: don't include newline in hook environment
-    - interfaces/apparmor: allow killing snap-update-ns
-    - tests: skip "try" test on s390x
-    - tests: skip security-dev-input-event-denied when /dev/input/by-
-      path/ is missing
-    - tests: skip security-dev-input-event-denied on s390x/arm64
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 21 Jun 2018 17:37:56 +0200
-
-snapd (2.33) xenial; urgency=medium
-
-  * New upstream release, LP: #1773118
-    - packaging: use official bolt in the errtracker on fedora
-    - many: add `snap debug connectivity` command
-    - interfaces/raw-usb: also allow usb serial devices
-    - errtracker: do not send duplicated reports
-    - selftest: add new selftest package that tests squashfs mounting
-    - tests: backport lxd force stop and econnreset fixes
-    - tests: add test to ensure /dev/input/event* for non-joysticks is
-      denied
-    - interfaces/joystick: support modern evdev joysticks
-    - interfaces: add juju-client-observe
-    - interfaces/hardware-observe: allow access to /etc/sensors* for
-      libsensors
-    - many: holding refresh on metered connections
-    - many: expose AppStream IDs (AKA common ID)
-    - tests: speed up save/restore snapd state for all-snap systems
-      during tests execution
-    - interfaces/apparmor: use helper to load stray profile
-    - tests: ubuntu core abstraction
-    - overlord/snapstate: don't panic in a corner case interaction of
-      cleanup tasks and pruning
-    - interfaces/apparmor: add 'mediate_deleted' profile flag for all
-      snaps
-    - tests: new parameter for the journalctl rate limit
-    - spread-shellcheck: port to python
-    - interfaces/home: add 'read' attribute to allow non-owner read to
-      @{HOME}
-    - testutil: import check.v1 differently to workaround gccgo error
-    - interfaces/many: miscellaneous updates for default, desktop,
-      desktop-legacy, system-observe, hardware-observe, opengl and gpg-
-      keys
-    - snapstate/hooks: reorder autoconnect and reconnect hooks
-    - daemon: update unit tests to match current master
-    - overlord/snapshotstate/backend: introducing the snapshot backend
-    - many: support 'system' nickname in interfaces
-    - userd: add the "snap" scheme to the whitelist
-    - many: make rebooting of core on refresh immediate, refactor logic
-      around it
-    - tests/main/snap-service-timer: account for service timer being in
-      the 'running' state
-    - interfaces/builtin: allow access to libGLESv* too for opengl
-      interface
-    - daemon: fix unit tests on arch
-    - interfaces/default,process-control: miscellaneous signal policy
-      fixes
-    - interfaces/bulitin: add write permission to optical-drive
-    - configstate: validate known core.* options
-    - snap, wrappers: systemd WatchdogSec support
-    - ifacestate: do not auto-connect manually disconnected interfaces
-    - systemd: mock useFuse() so testsuite passes in container via lxd
-      snap
-    - snap/env: fix env duplication logic
-    - snap: some doc comments fixes and additions
-    - cmd/snap-confine, interfaces/opengl: allow access to glvnd EGL
-      vendor files
-    - ifacestate: unify reconnect and autoconnect methods
-    - tests: fix user mounts test for external systems
-    - overlord/snapstate,overlord/auth,store: coalesce no auth user
-      refresh requests
-    - boot,partition: improve tests/docs around SetNextBoot()
-    - many: improve `snap wait` command
-    - snap: fix `snap interface --attrs` output when numbers are used
-    - cmd/snap-update-ns: poke holes when creating source paths for
-      layouts
-    - snapstate: support getting new bases/default-providers on refresh
-    - ifacemgr: remove stale connections on startup
-    - asserts: use Attrer in policy checks
-    - testutil: record system call errors / return values
-    - tests: increase timeouts to make tests reliable on slow boards
-    - repo: pass and return ConnRef via pointers
-    - interfaces: add xdg-document-portal support to desktop interface
-    - debian: add a zenity|kdialog suggests
-    - snapstate: make TestDoPrereqRetryWhenBaseInFlight less brittle
-    - tests: go must be installed as a classic snap
-    - tests: use journalctl cursors instead rotating logs
-    - daemon: add confinement-options to /v2/system-info
-      daemon: refactor classic support flag to be more structured
-    - tests: build spread in the autopkgtests with a more recent go
-    - cmd/snap: fix the message when snap.channel != snap.tracking
-    - overlord/snapstate: allow core defaults configuration via 'system'
-      key
-    - many: add "snap debug sandbox-features" and needed bits
-    - interfaces: interface hooks for refresh
-    - snapd.core-fixup.sh: add workaround for corrupted uboot.env
-    - boot: clear "snap_mode" when needed
-    - many: add wait command and `snapd.seeded` service
-    - interfaces: move host font update-ns AppArmor rules to desktop
-      interface
-    - jsonutil/safejson: introducing safejson.String &
-      safejson.Paragraph
-    - cmd/snap-update-ns: use Secure.BindMount to bind mount files
-    - cmd/snap-update-ns,tests: mimic the mode and ownership of
-      directories
-    - cmd/snap-update-ns: add support for ignoring mounts with missing
-      source/target
-    - interfaces: interface hooks implementation
-    - cmd/libsnap: fix compile error on more restrictive gcc
-      cmd/libsnap: fix compilation errors on gcc 8
-    - interfaces/apparmor: allow bash and dash to be in /usr/bin/
-    - cmd/snap-confine: allow any base snap to provide /etc/alternatives
-    - tests: fix interfaces-network test for systems with partial
-      confinement
-    - spread.yaml: add cosmic (18.10) to autopkgtest/qemu
-    - tests: ubuntu 18.04 or higher does not need linux-image-extra-
-    - configcore: validate experimental.layouts option
-    - interfaces:minor autoconnect cleanup
-    - HACKING: fix typos
-    - spread: add adt for ubuntu 18.10
-    - tests: skip test lp-1721518 for arch, snapd is failing to start
-      after reboot
-    - interfaces/x11: allow X11 slot implementations
-    - tests: checking interfaces declaring the specific interface
-    - snap: improve error for snaps not available in the given context
-    - cmdstate: add missing test for default timeout handling
-    - tests: shellcheck spread tasks
-    - cmd/snap: update install/refresh help vs --revision
-    - cmd/snap-confine: add support for per-user mounts
-    - snap: do not use overly short timeout in `snap
-      {start,stop,restart}`
-    - tests: adding google-sru backend replacing linode-sur
-    - interfaces/apparmor: fix incorrect apparmor profile glob
-    - systemd: replace ancient paths with 16.04+ standards
-    - overlord,systemd: store snap revision in mount units
-    - testutil: add test helper for SysLstat
-    - testutil,cmd: rename test helper of Lstat to OsLstat
-    - testutil: document all fake syscall/os functions
-    - osutil,interfaces,cmd: use less hardcoded strings
-    - testutil: rename UNMOUNT_NOFOLLOW to umountNoFollow
-    - testutil: don't dot-import check.v1
-    - store: getStructFields takes pointers now
-    - tests: drop `linux-image-extra-$(uname -r)` install in 18.04
-    - many: fix false negatives reported by vet
-    - osutil,interfaces: use uint32 for uid, gid
-    - many: fix various issues reported by shellcheck
-    - tests: add pending shutdown detection
-    - image: support refreshing soft-expired user macaroons in tooling
-    - interfaces/builtin, daemon: cleanup mocked builtin interfaces in
-      daemon tests
-    - interfaces/builtin: add support for software-watchdog interface
-    - spread: auto accept key changes when calling dnf
-    - snap,overlord/snapstate: introduce and use BrokenSnapError
-    - tests: detect kernel oops during tests and abort tests in this
-      case
-    - tests: bring back one missing test in snap-service-stop-mode
-    - debian: update LP bug for the 2.32.5 SRU
-    - userd: set up journal logging streams for autostarted apps
-    - snap,tests : don't fail if we cannot stat MountFile
-    - tests: smaller fixes for Arch tests
-    - tests: run interfaces-broadcom-asic-control early
-    - client: support for snapshot sets, snapshots, and snapshot actions
-    - tests: skip interfaces-content test on core devices
-    - cmd: generalize locking to global, snap and per-user locks
-    - release-tools: handle the snapd-x.y.z version
-    - packaging: fix incorrectly auto-generated changelog entry for
-      2.32.5
-    - tests: add arch to CI
-    - systemd: add helper for opening stream file descriptors to the
-      journal
-    - cmd/snap: handle distros with no version ID
-    - many: add "stop-mode: sig{term,hup,usr[12]}{,-all}" instead of
-      conflating that with refresh-mode
-    - tests: removing linode-sru backend
-    - tests: updating bionic version for spread tests on google
-    - overlord/snapstate: poll for up to 10s if a snap is unexpectedly
-      not mounted in doMountSnap
-    - overlord/snapstate: allow to get an error from readInfo instead of
-      a broken stub, use it in doMountSnap
-    - snap: snap.AppInfo is now a fmt.Stringer
-    - tests: move fedora 27 to google backend
-    - many: add `core.problem-reports.disabled` option
-    - cmd/snap-update-ns: remove the need for stash directory in secure
-      bind mount implementation
-    - errtracker: check for whoopsie.service instead of reading
-      /etc/whoopsie
-    - cmd/snap: user session application autostart v3
-    - tests: add test to ensure `snap refresh --amend` works with
-      different channels
-    - tests: add check for OOM error after each test
-    - cmd/snap-seccomp: graceful handling of non-multilib host
-    - interfaces/shutdown: allow calling SetWallMessage
-    - cmd/snap-update-ns: add secure bind mount implementation for use
-      with user mounts
-    - snap: fix `snap advise-snap --command` output to match spec
-    - overlord/snapstate: on multi-snap refresh make sure bases and core
-      are finished before dependent snaps
-    - overlord/snapstate: introduce envvars to control the channels for
-      based and prereqs
-    - cmd/snap-confine: ignore missing cgroups in snap-device-helper
-    - debian: add gbp.conf script to build snapd via `gbp buildpackage`
-    - daemon,overlord/hookstate: stop/wait for running hooks before
-      closing the snapctl socket
-    - advisor: use json for package database
-    - interfaces/hostname-control: allow setting the hostname via
-      syscall and systemd
-    - tests/main/interfaces-opengl-nvidia: verify access to 32bit
-      libraries
-    - interfaces: misc updates for default, firewall-control, fuse-
-      support and process-control
-    - data/selinux: Give snapd access to more aspects of the system
-    - many: use the new install/refresh API by switching snapstate to
-      use store.SnapAction
-    - errtracker: make TestJournalErrorSilentError work on gccgo
-    - ifacestate: add to the repo also snaps that are pending being
-      activated but have a done setup-profiles
-    - snapstate, ifacestate: inject auto-connect tasks try 2
-    - cmd/snap-confine: allow creating missing gl32, gl, vulkan dirs
-    - errtracker: add more fields to aid debugging
-    - interfaces: make system-key more robust against invalid fstab
-      entries
-    - overlord,interfaces: be more vocal about broken snaps and read
-      errors
-    - ifacestate: injectTasks helper
-    - osutil: fix fstab parser to allow for # in field values
-    - cmd/snap-mgmt: remove timers, udev rules, dbus policy files
-    - release-tools: add repack-debian-tarball.sh
-    - daemon,client: add build-id to /v2/system-info
-    - cmd: make fmt (indent 2.2.11)
-    - interfaces/content: add rule so slot can access writable files at
-      plug's mountpoint
-    - interfaces: add /var/lib/snapd/snap to @{INSTALL_DIR}
-    - ifacestate: don't surface errors from stale connections
-    - cmd/snap-update-ns: convert Secure* family of functions into
-      methods
-    - tests: adjust canonical-livepatch test on GCE
-    - tests: fix quoting issues in econnreset test
-    - cmd/snap-confine: make /run/media an alias of /media
-    - cmd/snap-update-ns: rename i to segNum
-    - interfaces/serial: change pattern not to exclude /dev/ttymxc*
-    - spread: disable StartLimitInterval option on opensuse-42.3
-    - configstate: give a chance to immediately recompute the next
-      refresh time when schedules are set
-    - cmd/snap-confine: attempt to detect if multiarch host uses
-      arch triplets
-    - store: add Store.SnapAction to support the new install/refresh API
-      endpoint
-    - tests: adding test for removable-media interface
-    - tests: update interface tests to remove extra checks and normalize
-      tests
-    - timeutil: in Human, count days with fingers
-    - vendor: update gopkg.in/yaml.v2 to the latest version
-    - cmd/snap-confine: fix Archlinux compatibility
-    - cmd/snapd: make sure signal handlers are established during early
-      daemon startup
-    - cmd/snap-confine: apparmor: allow creating prefix path for
-      gl/vulkan
-    - osutil: use tilde suffix for temporary files used for atomic
-      replacement
-    - tests: copy or sanity check core users using usernames
-    - tests: disentangle etc vs extrausers in core tests
-    - tests: fix snap-run tests when snapd is not running
-    - overlord/configstate: change how ssh is stopped/started
-    - snap: make `snap run` look at the system-key for security profiles
-    - strutil, cmd/snap: drop strutil.WordWrap, first pass at
-      replacement
-    - tests: adding opensuse-42.3 to google
-    - cmd/snap: fix one issue with noWait error handling logic, add
-      tests plus other cleanups
-    - cmd/snap-confine: nvidia: preserve globbed file prefix
-    - advisor: add comment why osutil.FileExists(dirs.SnapCommandsDB) is
-      needed
-    - interfaces,release: probe seccomp features lazily
-    - tests: change debug for layout test
-    - advisor: deal with missing commands.db file
-    - interfaces/apparmor: simplify UpdateNS internals
-    - polkit: Pass caller uid to PolicyKit authority
-    - tests: moving debian 9 from linode to google backend
-    - cmd/snap-confine: nvidia: add tls/libnvidia-tls.so* glob
-    - po: specify charset in po/snappy.pot
-    - interfaces: harden snap-update-ns profile
-    - snap: Call SanitizePlugsSlots from InfoFromSnapYaml
-    - tests: update tests to deal with s390x quirks
-    - debian: run snap.mount upgrade fixup *before* debhelper
-    - tests: move xenial i386 to google backend
-    - snapstate: add compat mode for default-provider
-    - tests: a bunch of test fixes for s390x from looking at the
-      autopkgtest logs
-    - packaging: recommend "gnupg" instead of "gnupg1 | gnupg"
-    - interfaces/builtin: let MM change qmi device attributes
-    - tests: add workaround for s390x failure
-    - snap/pack, cmd/snap: add `snap pack --check-skeleton`
-    - daemon: support 'system' as nickname of the core snap
-    - cmd/snap-update-ns: use x-snapd.{synthetic,needed-by} in practice
-    - devicestate: add DeviceManager.Registered returning a channel
-      closed when the device is known to be registered
-    - store: Sections and WriteCatalogs need to strictly send device
-      auth only if the device has a custom store
-    - tests: add bionic system to google backend
-    - many: fix shellcheck warnings in bionic
-    - cmd/snap-update-ns: don't fail on existing symlinks
-    - tests: make autopkgtest tests more targeted
-    - cmd/snap-update-ns: fix creation of layout symlinks
-    - spread,tests: move suite-level prepare/restore to central script
-    - many: propagate contexts enough to be able to mark store
-      operations done from the Ensure loop
-    - snap: don't create empty Change with "Hold" state on disconnect
-    - snap: unify snap name validation w/python; enforce length limit.
-    - cmd/snap: use shlex when parsing `snap run --strace` arguments
-    - osutil,testutil: add symlinkat(2) and readlinkat(2)
-    - tests: autopkgtest may have non edge core too
-    - tests: adding checks before stopping snapd service to avoid job
-      canceled on ubuntu 14.04
-    - errtracker: respect the /etc/whoopsie configuration
-    - overlord/snapstate:  hold refreshes for 2h after seeding on
-      classic
-    - cmd/snap: tweak and polish help strings
-    - snapstate: put layout feature behind feature flag
-    - tests: force profile re-generation via system-key
-    - snap/squashfs: when installing from seed, try symlink before cp
-    - wrappers: services which are socket or timer activated should not
-      be started during boot
-    - many: go vet cleanups
-    - tests: define MATCH from spread
-    - packaging/fedora: Merge changes from Fedora Dist-Git plus trivial
-      fix
-    - cmd/snap: use timeutil.Human to show times in `snap refresh
-      --time`
-    - cmd/snap: in changes and tasks, default to human-friendly times
-    - many: support holding refreshes by setting refresh.hold
-    - Revert "cmd/snap: use timeutil.Human to show times in `snap
-      refresh -…-time`"
-    - cmd/snap: use timeutil.Human to show times in `snap refresh
-      --time`
-    - tests/main/snap-service-refresh-mode: refactor the test to rely on
-      comparing PIDs
-    - tests/main/media-sharing: improve the test to cover /media and
-      /run/media
-    - store: enable deltas for core devices too
-    - cmd/snap: unhide --no-wait; make wait use go via waitMixin
-    - strutil/shlex: import github.com/google/shlex into the tree
-    - vendor: update github.com/mvo5/libseccomp-golang
-    - overlord/snapstate: block install of "system"
-    - cmd/snap: "current"→"installed"; "refreshed"→"refresh-date"
-    - many: add the snapd-generator
-    - cmd/snap-seccomp: Cancel the atomic file on error, not just Close
-    - polkit: ensure error is properly set if dialog is dismissed
-    - snap-confine, snap-seccomp: utilize new seccomp logging features
-    - progress: tweak ansimeter cvvis use to no longer confuse minicom
-    - xdgopenproxy: integrate xdg-open implementation into snapctl
-    - tests: avoid removing preinstalled snaps on core
-    - tests: chroot into core to run xdg-open there
-    - userd: add an OpenFile method for launching local files with xdg-
-      open
-    - tests: moving ubuntu core from linode to google backend
-    - run-checks: remove accidental bashism
-    - i18n: simplify NG usage by doing the modulo math in-package.
-    - snap/squashfs: set timezone when calling unsquashfs to get the
-      build date
-    - timeutil: timeutil.Human(t) gives a human-friendly string for t
-    - snap: add autostart app property
-    - tests: add support for external backend executions on listing test
-    - tests: make interface-broadcom-asic-control test work on rpi
-    - configstate: when disable "ssh" we must disable the "sshd" service
-    - interfaces/apparmor,system-key: add upperdir snippets for strict
-      snaps on livecd
-    - snap/squashfs: add BuildDate
-    - store: parse the JSON format used by the coming new store API to
-      convey snap information
-    - many: remove snapd.refresh.{timer,service}
-    - tests: adding ubuntu-14.04-64 to the google backend
-    - interfaces: add xdg-desktop-portal support to desktop interface
-    - packaging/arch: sync with snapd/snapd-git from AUR
-    - wrappers, tests/main/snap-service-timer: restore missing commit,
-      add spread test for timer services
-    - store: don't ask for snap_yaml_raw except on the details endpoint
-    - many: generate and use per-snap snap-update-ns profile
-    - tests: add debug for layout test
-    - wrappers: detect whether systemd-analyze can be used in unit tests
-    - osutil: allow creating strings out of MountInfoEntry
-    - servicestate: use systemctl enable+start and disable+stop instead
-      of --now flag
-    - osutil: handle file being matched by multiple patterns
-    - daemon, snap: fix InstallDate, make a method of *snap.Info
-    - wrappers: timer services
-    - wrappers: generator for systemd OnCalendar schedules
-    - asserts: fix flaky storeSuite.TestCheckAuthority
-    - tests: fix dependency for ubuntu artful
-    - spread: start moving towards google backend
-    - tests: add a spread test for layouts
-    - ifacestate: be consistent passing Retry.After as named field
-    - cmd/snap-update-ns: use recursive bind mounts for writable mimic
-    - testutil: allow mocking syscall.Fstat
-    - overlord/snapstate: verify that default schedule is randomized and
-      is  not a single time
-    - many: simplify mocking of home-on-NFS
-    - cmd/snap-update-ns: use syscall.Symlink instead of os.Symlink
-    - store: move infoFromRemote into details.go close to snapDetails
-    - userd/tests: Test kdialog calls and mock kdialog too to make tests
-      work in KDE
-    - cmd/snap: tweaks to 'snap info' (feat. installed->current rename)
-    - cmd/snap: add self-strace to `snap run`
-    - interfaces/screen-inhibit-control,network-status: fix dbus path
-      and interface typos
-    - update-pot: Force xgettext() to return true
-    - store: cleanup test naming, dropping remoteRepo  and
-      UbuntuStore(Repository)? references
-    - store: reorg auth refresh
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 08 Jun 2018 17:13:47 +0200
-
-snapd (2.32.9) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - tests: run all spread tests inside GCE
-    - tests: build spread in the autopkgtests with a more recent go
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 16 May 2018 10:20:08 +0200
-
-snapd (2.32.8) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - snapd.core-fixup.sh: fix workaround for corrupted uboot.env
-      and add tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 11 May 2018 14:36:16 +0200
-
-snapd (2.32.7) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - many: add wait command and seeded target (2
-    - snapd.core-fixup.sh: add workaround for corrupted uboot.env
-    - boot: clear "snap_mode" when needed
-    - cmd/libsnap: fix compile error on more restrictive gcc
-    - tests: cherry-pick commits to move spread to google backend
-    - spread.yaml: add cosmic (18.10) to autopkgtest/qemu
-    - userd: set up journal logging streams for autostarted apps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 11 May 2018 13:09:32 +0200
-
-snapd (2.32.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - snap: do not use overly short timeout in `snap
-      {start,stop,restart}`
-    - interfaces/apparmor: fix incorrect apparmor profile glob
-    - tests: detect kernel oops during tests and abort tests in this
-      case
-    - tests: run interfaces-boradcom-asic-control early
-    - tests: skip interfaces-content test on core devices
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sun, 29 Apr 2018 19:21:53 +0200
-
-snapd (2.32.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1765090
-    - many: add "stop-mode: sig{term,hup,usr[12]}{,-all}" instead of
-      conflating that with refresh-mode
-    - overlord/snapstate:  poll for up to 10s if a snap is unexpectedly
-      not mounted in doMountSnap
-    - daemon: support 'system' as nickname of the core snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 16 Apr 2018 11:41:48 +0200
-
-snapd (2.32.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1756173
-    - cmd/snap: user session application autostart
-    - overlord/snapstate: introduce envvars to control the channels for
-      bases and prereqs
-    - overlord/snapstate: on multi-snap refresh make sure bases and core
-      are finished before dependent snaps
-    - many: use the new install/refresh /v2/snaps/refresh store API
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Apr 2018 16:30:45 +0200
-
-snapd (2.32.3.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1756173
-    - errtracker: make TestJournalErrorSilentError work on
-      gccgo
-    - errtracker: check for whoopsie.service instead of reading
-      /etc/whoopsie
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Apr 2018 12:40:09 +0200
-
-snapd (2.32.3.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1756173
-    - debian: add gbp.conf script to build snapd via `gbp
-      buildpackage`
-    - tests: add check for OOM error after each test
-    - cmd/snap-seccomp: graceful handling of non-multilib host
-    - interfaces/shutdown: allow calling SetWallMessage
-    - data/selinux: Give snapd access to more aspects of the system
-    - daemon,overlord/hookstate: stop/wait for running hooks before
-      closing the snapctl socket
-    - cmd/snap-confine: ignore missing cgroups in snap-device-helper
-    - interfaces: misc updates for default, firewall-control, fuse-
-      support and process-control
-    - overlord: test fix, address corner case
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Apr 2018 10:34:00 +0200
-
-snapd (2.32.3) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - ifacestate: add to the repo also snaps that are pending being
-      activated but have a done setup-profiles
-    - snapstate: inject autoconnect tasks in doLinkSnap for regular
-      snaps
-    - cmd/snap-confine: allow creating missing gl32, gl, vulkan dirs
-    - errtracker: add more fields to aid debugging
-    - interfaces: make system-key more robust against invalid fstab
-      entries
-    - cmd/snap-mgmt: remove timers, udev rules, dbus policy files
-    - overlord,interfaces: be more vocal about broken snaps and read
-      errors
-    - osutil: fix fstab parser to allow for # in field values
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 05 Apr 2018 22:35:35 +0200
-
-snapd (2.32.2) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - interfaces/content: add rule so slot can access writable files at
-      plug's mountpoint
-    - tests: adjust canonical-livepatch test on GCE
-    - interfaces/serial: change pattern not to exclude /dev/ttymxc
-    - spread.yaml: switch Fedora 27 tests to manual
-    - store: Sections and WriteCatalogs need to strictly send device
-      auth only if the device has a custom store
-    - configstate: give a chance to immediately recompute the next
-      refresh time when schedules are set
-    - cmd/snap-confine: attempt to detect if multiarch host uses arch
-      triplets
-    - vendor: update gopkg.in/yaml.v2 to the latest version (#4945)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 31 Mar 2018 21:09:29 +0200
-
-snapd (2.32.1) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - cmd/snapd: make sure signal handlers are established during early
-      daemon startup
-    - osutil: use tilde suffix for temporary files used for atomic
-      replacement
-    - cmd/snap-confine: apparmor: allow creating prefix path for
-      gl/vulkan
-    - tests: disentangle etc vs extrausers in core tests
-    - packaging: fix changelogs' typo
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 26 Mar 2018 21:01:41 +0200
-
-snapd (2.32) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - snap: make `snap run` look at the system-key for security profiles
-    - overlord/configstate: change how ssh is stopped/started
-    - cmd/snap-confine: nvidia: preserve globbed file prefix
-    - advisor: deal with missing commands.db file
-    - interfaces,release: probe seccomp features lazily
-    - interfaces: harden snap-update-ns profile
-    - polkit: Pass caller uid to PolicyKit authority
-    - tests: change debug for layout test
-    - cmd/snap-confine: don't use per-snap s-u-n profile
-    - many: backported fixes for layouts and symlinks
-    - cmd/snap-confine: nvidia: add tls/libnvidia-tls.so* glob
-    - cmd/snap-update-ns: use x-snapd.{synthetic,needed-by} in practice
-    - snap: Call SanitizePlugsSlots from InfoFromSnapYaml
-    - cmd/snap-confine: fix ptrace rule with snap-confine peer
-    - tests: update tests to deal with s390x quirks
-    - snapstate: add compat mode for default-provider"snapname:ifname"
-    - snap-confine: fallback to /lib/udev/snappy-app-dev if the core is
-      older
-    - tests: a bunch of test fixes for s390x from looking at the
-      autopkgtest logs
-    - packaging: recommend "gnupg" instead of "gnupg1 | gnupg"
-    - interfaces/builtin: let MM change qmi device attributes
-    - debian: undo snap.mount system unit removal
-    - snap: don't create empty Change with "Hold" state on disconnect
-    - tests: add workaround for s390x failure
-    - tests: make autopkgtest tests more targeted
-    - many: propagate contexts enough to be able to mark store
-      operations done from the Ensure loop
-    - store: cleanup test naming, dropping remoteRepo and
-      UbuntuStore(Repository)? references
-    - store: reorg auth refresh
-    - tests: autopkgtest may have non edge core too
-    - data: translate polkit strings
-    - snapstate: put layout feature behind feature flag
-    - errtracker: respect the /etc/whoopsie configuration
-    - overlord/snapstate: hold refreshes for 2h after seeding on classic
-    - many: cherry-pick relevant `go vet` 1.10 fixes to 2.32
-    - snap/squashfs: when installing from seed, try symlink before cp
-    - wrappers: services which are socket or timer activated should not
-      be started during boot
-    - many: generate and use per-snap snap-update-ns profile
-    - many: support holding refreshes by setting refresh.hold
-    - snap-confine, snap-seccomp: utilize new seccomp logging features
-    - many: remove snapd.refresh.{timer,service}
-    - many: add the snapd-generator
-    - polkit: do not shadow dbus errors, avoid panic in case of errors
-    - polkit: ensure error is properly set if dialog is dismissed
-    - xdgopenproxy: integrate xdg-open implementation into snapctl
-    - userd: add an OpenFile method for launching local files with xdg-
-      open
-    - asserts:  use a timestamp for the assertion after the signing key
-      has been created
-    - ifacestate: be consistent passing Retry.After as named field
-    - interfaces/apparmor,system-key: add upperdir snippets for strict
-      snaps on livecd
-      interfaces/apparmor,system-key: add upperdir snippets for strict
-      snaps
-    - configstate: when disable "ssh" we must disable the "sshd"
-      service
-    - store: don't ask for snap_yaml_raw except on the details endpoint
-    - osutil: handle file being matched by multiple patterns
-    - cmd/snap-update-ns: use recursive bind mounts for writable mimic
-    - cmd/snap-update-ns: use syscall.Symlink instead of os.Symlink
-    - interfaces/screen-inhibit-control,network-status: fix dbus path
-      and interface typos
-    - interfaces/network-status: fix use of '/' in interface in DBus
-      rule
-    - interfaces/screen-inhibit-control: fix use of '.' in path in DBus
-      rule
-    - overlord/snapstate: fix task iteration order in
-      TestDoPrereqRetryWhenBaseInFlight
-    - interfaces: add an interface for gnome-online-accounts D-Bus
-      service
-    - snap: pass full timer spec in `snap run --timer`
-    - cmd/snap: introduce `snap run --timer`
-    - snapstate: auto install default-providers for content snaps
-    - hooks/strutil: limit the number of data read from the hooks to
-      avoid oom
-    - osutil: aggregate mockable symbols
-    - tests: make sure snapd is running before attempting to remove
-      leftover snaps
-    - timeutil: account for 24h wrap when flattening clock spans
-    - many: send  new Snap-CDN header with none or with cloud instance
-      placement info as needed
-    - cmd/snap-update-ns,testutil: move syscall testing helpers
-    - tests: disable interfaces-location-control on s390x
-    - tests: new spread test for gpio-memory-control interface
-    - tests: spread test for broadcom-asic-control interface
-    - tests: make restore of interfaces-password-manager-service more
-      robust
-    - tests/lib/prepare-restore: sync journal before rotating and
-      vacuuming
-    - overlord/snapstate: use spread in the default refresh schedule
-    - tests: fixes for autopkgtest in bionic
-    - timeutil: introduce helpers for checking it time falls inside the
-      schedule
-    - cmd/snap-repair,httputil: set snap-repair User-Agent on requests
-    - vendor: resync formatting of vendor.json
-    - snapstate/ifacestate: auto-connect tasks
-    - cmd/snap: also include tracking channel in list output.
-    - interfaces/apparmor: use snap revision with surrounding '.' when
-      replacing in glob
-    - debian,vendor: import github.com/snapcore/squashfs and use
-    - many: implement "refresh-mode: {restart,endure,...}" for services
-    - daemon: make the ast-inspecting test smarter; drop 'exceptions'
-    - tests: new spread test for kvm interface
-    - cmd/snap: tweaks to 'snap info' output
-    - snap: remove underscore from version validator regexp
-    - testutil: add File{Matches,Equals,Contains} checkers.
-    - snap: improve the version validator's error messages.
-    - osutil: refactor EnsureFileState to separate out the comparator
-    - timeutil: fix scheduling on nth weekday of the month
-    - cmd/snap-update-ns: small refactor for upcoming per-user mounts
-    - many: rename snappy-app-dev to snap-device-helper
-    - systemd: add default target for timers
-    - interfaces: miscellaneous policy updates for home, opengl, time-
-      control, network, et al
-    - cmd/snap: linter cleanups
-    - interfaces/mount: generate per-user mount profiles
-    - cmd/snap: use proper help strings for `snap userd --help`
-    - packaging: provide a compat symlink for snappy-app-dev
-    - interfaces/time-control,netlink-audit: adjust for util-linux
-      compiled with libaudit
-    - tests: adding new test to validate the raw-usb interface
-    - snap: add support for `snap run --gdb`
-    - interfaces/builtin: allow MM to access login1
-    - packaging: fix build on sbuild
-    - store: revert PR#4532 and do not display displayname
-    - interfaces/mount: add support for per-user mount entries
-    - cmd/system-shutdown: move sync to be even more pessimistic
-    - osutil: reimplement IsMounted with LoadMountInfo
-    - tests/main/ubuntu-core-services: enable snapd.refresh.timer for
-      the test
-    - many: don't allow layout construction to silently fail
-    - interfaces/apparmor: ensure snap-confine profile for reexec is
-      current
-    - interfaces/apparmor: generalize apparmor load and unload helpers
-    - tests: removing packages which are not needed anymore to generate
-      random data
-    - snap: improve `snap run` comments/naming
-    - snap: allow options for --strace, e.g. `snap run --strace="-tt"`
-    - tests: fix spread test failures on 18.04
-    - systemd: update comment on SocketsTarget
-    - osutil: add and update docstrings
-    - osutil: parse mount entries without options field
-    - interfaces: mock away real mountinfo/fstab
-    - many: move /lib/udev/snappy-app-dev to /usr/lib/snapd/snappy-app-
-      dev
-    - overlord/snapstate/backend: perform cleanup if snap setup fails
-    - tests/lib/prepare: disable snapd.refresh.timer
-    - daemon: remove redundant UserOK markings from api commands
-    - snap: introduce  timer service data types and validation
-    - cmd/snap: fix UX of snap services
-    - daemon: allow `snapctl get` from any uid
-    - debian, snap: only static link libseccomp in snap-seccomp on
-      ubuntu
-    - all: snap versions are now validated
-    - many: add nfs-home flag to system-key
-    - snap: disallow layouts in various special directories
-    - cmd/snap: add help for service commands.
-    - devicestate: fix autopkgtest failure in
-      TestDoRequestSerialErrorsOnNoHost
-    - snap,interfaces: allow using bind-file layouts
-    - many: move mount code to osutil
-    - snap: understand directories in layout blacklist
-    - snap: use custom unsquashfsStderrWriter for unsquashfs error
-      detection
-    - tests/main/user-data-handling: get rid of ordering bug
-    - snap: exclude `gettimeofday` from `snap run --strace`
-    - tests: check if snapd.socket is active before stoping it
-    - snap: sort layout elements before validating
-    - strutil: introducing MatchCounter
-    - snap: detect unsquashfs write failures
-    - spread: add missing ubuntu-18.04-arm64 to available autopkgtest
-      machines
-    - cmd/snap-confine: allow mounting anywhere, effectively
-    - daemon: improve ucrednet code for the snap.socket
-    - release, interfaces: add new release.AppArmorFeatures helper
-    - snap: apply some golint suggestions
-    - many: add interfaces.SystemKey() helper
-    - tests: new snaps to test installs nightly
-    - tests: skip alsa interface test when the system does not have any
-      audio devices
-    - debian/rules: workaround for
-      https://github.com/golang/go/issues/23721
-    - interfaces/apparmor: early support for snap-update-ns snippets
-    - wrappers: cleanup enabled service sockets
-    - cmd/snap-update-ns: large refactor / update of unit tests
-    - interfaces/apparmor: remove leaked future layout code
-    - many: allow constructing layouts (phase 1)
-    - data/systemd: for debugging/testing use /etc/environment also for
-      snap-repair runs
-    - cmd/snap-confine: create lib/{gl,gl32,vulkan} under /var/lib/snapd
-      and chown as root:root
-    - overlord/configstate/config: make [GS]etSnapConfig use *RawMessage
-    - daemon: refactor snapFooMany helpers a little
-    - cmd/snap-confine: allow snap-update-ns to chown things
-    - interfaces/apparmor: use a helper to set the scope
-    - overlord/configstate/config: make SetSnapConfig delete on empty
-    - osutil: make MkdirAllChown clean the path passed in
-    - many: at seeding try to capture cloud information into core config
-      under "cloud"
-    - cmd/snap: add completion conversion helper to increase DRY
-    - many: remove "content" argument from snaptest.MockSnap()
-    - osutil: allow using many globs in EnsureDirState
-    - cmd/snap-confine: fix read-only filesystem when mounting nvidia
-      files in biarch
-    - tests: use root path to /home/test/tmp to avoid lack of space
-      issue
-    - packaging: create /var/lib/snapd/lib/{gl,gl32,vulkan} as part of
-      packaging
-    - tests: update kill-timeout focused on making tests pass on boards
-    - advisor: ensure commands.db has mode 0644 and add test
-    - snap: improve validation of snap layouts
-    - tests: ensure disabled services are masked
-    - interfaces/desktop-legacy,unity7: support gtk2/gvfs gtk_show_uri()
-    - systemd, wrappers: start all snap services in one systemctl call
-    - mir: software clients need access to shared memory /dev/shm/#*
-    - snap: add support for `snap advise-snap pkgName`
-    - snap: fix command-not-found on core devices
-    - tests: new spead test for openvswitch-support interface
-    - tests: add integration for local snap licenses
-    - config: add (Get|Set)SnapConfig to do bulk config e.g. from
-      snapshots
-    - cmd/snap: display snap license information
-    - tests: enable content sharing test for $SNAP
-    - osutil: add ContextWriter and RunWithContext helpers.
-    - osutil: add DirExists and IsDirNotExist
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 24 Mar 2018 08:23:31 +0100
-
-snapd (2.31.2) xenial; urgency=medium
-
-  *  New upstream release, LP: #1745217
-    - many: add the snapd-generator
-    - polkit: ensure error is properly set if dialog is dismissed
-    - xdgopenproxy: integrate xdg-open implementation into snapctl
-    - userd: add an OpenFile method for launching local files with xdg-
-      open
-    - configstate: when disable "ssh" we must disable the "sshd"
-      service
-    - many: remove snapd.refresh.{timer,service}
-    - interfaces/builtin: allow MM to access login1
-    - timeutil: account for 24h wrap when flattening clock spans
-    - interfaces/screen-inhibit-control,network-status: fix dbus path
-      and interface typos
-    - systemd, wrappers: start all snap services in one systemctl
-      call
-    - tests: disable interfaces-location-control on s390x
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 09 Mar 2018 11:11:31 +0100
-
-snapd (2.31.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1745217
-    - tests: multiple autopkgtest related fixes for 18.04
-    - overlord/snapstate: use spread in the default refresh schedule
-    - timeutil: fix scheduling on nth weekday of the month
-    - interfaces: miscellaneous policy updates for home, opengl, time-
-      control, network, et al
-    - cmd/snap: use proper help strings for `snap userd --help`
-    - interfaces/time-control,netlink-audit: adjust for util-linux
-      compiled with libaudit
-    - rules: do not static link on powerpc
-    - packaging: revert LDFLAGS rewrite again after building snap-
-      seccomp
-    - store: revert PR#4532 and do not display displayname
-    - daemon: allow `snapctl get` from any uid
-    - debian, snap: only static link libseccomp in snap-seccomp on
-      ubuntu
-    - daemon: improve ucrednet code for the snap.socket
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 20 Feb 2018 17:27:42 +0100
-
-snapd (2.31) xenial; urgency=medium
-
-  * New upstream release, LP: #1745217
-    - cmd/snap-confine: allow snap-update-ns to chown things
-    - cmd/snap-confine: fix read-only filesystem when mounting nvidia
-      files in biarch
-    - packaging: create /var/lib/snapd/lib/{gl,gl32,vulkan} as part of
-      packaging
-    - advisor: ensure commands.db has mode 0644 and add test
-    - interfaces/desktop-legacy,unity7: support gtk2/gvfs gtk_show_uri()
-    - snap: improve validation of snap layoutsRules for validating
-      layouts:
-    - snap: fix command-not-found on core devices
-    - cmd/snap: display snap license information
-    - tests: enable content sharing test for $SNAP
-    - userd: add support for a simple UI that can be used from userd
-    - snap-confine/nvidia: Support legacy biarch trees for GLVND systems
-    - tests: generic detection of gadget and kernel snaps
-    - cmd/snap-update-ns: refactor and improve Change.Perform to handle
-      EROFS
-    - cmd/snap: improve output when snaps were found in a section or the
-      section is invalid
-    - cmd/snap-confine,tests: hide message about stale base snap
-    - cmd/snap-mgmt: fix out of source tree build
-    - strutil/quantity: new package that exports formatFoo (from
-      progress)
-    - cmd/snap: snap refresh --time with new and legacy schedules
-    - state: unknown tasks handler
-    - cmd/snap-confine,data/systemd: fix removal of snaps inside LXD
-    - snap: add io.snapcraft.Settings to `snap userd`
-    - spread: remove more EOLed releases
-    - snap: tidy up top-level help output
-    - snap: fix race in `snap run --strace`
-    - tests: update "searching" test to match store changes
-    - store: use the "publisher" when populating the "publisher" field
-    - snap: make `snap find --section` show all sections
-    - tests: new test to validate location control interface
-    - many: add new `snap refresh --amend <snap>` command
-    - tests/main/kernel-snap-refresh-on-core: skip the whole test if
-      edge and stable are the same version
-    - tests: set test kernel-snap-refresh-on-core to manual
-    - tests: new spread test for interface gpg-keys
-    - packaging/fedora: Merge changes from Fedora Dist-Git plus trivial
-      fix
-    - interfaces: miscellaneous policy updates
-    - interfaces/builtin: Replace Solus support with GLVND support
-    - tests/main/kernel-snap-refresh-on-core: do not fail if edge and
-      stable kernels are the same version
-    - snap: add `snap run --strace` to be able to strace snap apps
-    - tests: new spread test for ssh-keys interface
-    - errtracker: include detected virtualisation
-    - tests: add new kernel refresh/revert test for spread-cron
-    - interfaces/builtin: blacklist zigbee dongle
-    - cmd/snap-confine: discard stale mount namespaces
-    - cmd: remove unused execArg0/execEnv
-    - snap,interfaces/mount: disallow nobody/nogroup
-    - cmd/snap: improve `snap aliases` output when no aliases are
-      defined
-    - tests/lib/snaps/test-snapd-service: refactor service reload
-    - tests: new spread test for gpg-public-keys interface
-    - tests: new spread test for ssh-public-keys interface
-    - spread: setup machine creation on Linode
-    - interfaces/builtin: allow introspecting UDisks2
-    - interfaces/builtin: add support for content "source" section
-    - tests: new spread test for netlink-audit interface
-    - daemon: avoid panic'ing building an error response w/no snaps
-      given
-    - interfaces/mount,snap: early support for snap layouts
-    - daemon: unlock state even if RefreshSchedule() fails
-    - arch: add "armv8l" to ubuntuArchFromKernelArch table
-    - tests: fix for test interface-netlink-connector
-    - data/dbus: add AssumedAppArmorLabel=unconfined
-    - advisor: use forked bolt to make it work on ppc
-    - overlord/snapstate: record the 'kind' of conflicting change
-    - dirs: fix snap mount dir on Manjaro
-    - overlord/{snapstate,configstate}, daemon: introduce refresh.timer,
-      fallback to refresh.schedule
-    - config: add support for `snap set core proxy.no_proxy=...`
-    - snap-mgmt: extend spread tests, stop, disable and cleanup snap
-      services
-    - spread.yaml: add fedora 27
-    - cmd/snap-confine: allow snap-update-ns to poke writable holes in
-      $SNAP
-    - packaging/14.04: move linux-generic-lts-xenial to recommends
-    - osutil/sys: ppc has 32-bit getuid already
-    - snapstate: make no autorefresh message clearer
-    - spread: try to enable Fedora once more
-    - overlord/snapstate: do a minimal sanity check on containers
-    - configcore: ensure config.txt has a final newline
-    - cmd/libsnap-confine-private: print failed mount/umount regardless
-      of SNAP_CONFINE_DEBUG
-    - debian/tests: add missing autopkgtest test dependencies for debian
-    - image: port ini handling to goconfigparser
-    - tests/main/snap-service-after-before: add test for after/before
-      service ordering
-    - tests: enabling opensuse for tests
-    - tests: update auto-refresh-private to match messages from current
-      master
-    - dirs: check if distro 'is like' fedora when picking path to
-      libexecdir
-    - tests: fix "job canceled" issue and improve cleanup for snaps
-    - cmd/libsnap-confine-private: add debug build of libsnap-confine-
-      private.a, link it into snap-confine-debug
-    - vendor: remove x/sys/unix to fix builds on arm64 and powerpc
-    - image: let consume snapcraft export-login files from tooling
-    - interfaces/mir: allow Wayland socket and non-root sockets
-    - interfaces/builtin: use snap.{Plug,Slot}Info over
-      interfaces.{Plug,Slot}
-    - tests: add simple snap-mgmt test
-    - wrappers: autogenerate After/Before in systemd's service files for
-      apps
-    - snap: add usage hints in `snap download`
-    - snap: provide more meaningful errors for installMany and friends
-    - cmd/snap: show header/footer when `snap find` is used without
-      arguments
-    - overlord/snapstate: for Enable's tasks refer to the first task
-      with snap-setup, do not duplicate
-    - tests: add hard-coded fully expired macaroons to run related tests
-    - cmd/snap-update-ns: new test features
-    - cmd/snap-update-ns: we don't want to bind mount symlinks
-    - interfaces/mount: test OptsToCommonFlags, filter out x-snapd.
-      options
-    - cmd/snap-update-ns: untangle upcoming cyclic initialization
-    - client, daemon: update user's email when logging in with new
-      account
-    - tests: ensure snap-confine apparmor profile is parsable
-    - snap: do not leak internal errors on install/refresh etc
-    - snap: fix missing error check when multiple snaps are refreshed
-    - spread: trying to re-enable tests on Fedora
-    - snap: fix gadget.yaml parsing for multi volume gadgets
-    - snap: give the snap.Container interface a Walk method
-    - snap: rename `snap advise-command` to `snap advise-snap --command`
-    - overlord/snapstate: no refresh just for hints if there was a
-      recent regular full refresh
-    - progress: switch ansimeter's Spin() to use a spinner
-    - snap: support `command-not-found` symlink for `snap advise-
-      command`
-    - daemon: store email, ID and macaroon when creating a new user
-    - snap: app startup after/before validation
-    - timeutil: refresh timer take 2
-    - store, daemon/api: Rename MyAppsServer, point to
-      dashboard.snapcraft.io instead
-    - tests: use "quiet" helper instead of "dnf -q" to get errors on
-      failures
-    - cmd/snap-update-ns: improve mocking for tests
-    - many: implement the advisor backend, populate it from the store
-    - tests: make less calls to the package manager
-    - tests/main/confinement-classic: enable the test on Fedora
-    - snap: do not leak internal network errors to the user
-    - snap: use stdout instead of stderr for "fetching" message
-    - tests: fix test whoami, share successful_login.exp
-    - many: refresh with appropriate creds
-    - snap: add new `snap advice-command` skeleton
-    - tests: add test that ensures we never parse versions as numbers
-    - overlord/snapstate: override Snapstate.UserID in refresh if the
-      installing user is gone
-    - interfaces: allow socket "shutdown" syscall in default profile
-    - snap: print friendly message if `snap keys` is empty
-    - cmd/snap-update-ns: add execWritableMimic
-    - snap: make `snap info invalid-snap` output more user friendly
-    - cmd/snap,  tests/main/classic-confinement: fix snap-exec path when
-      running under classic confinement
-    - overlord/ifacestate: fix disable/enable cycle to setup security
-    - snap: fix snap find " " output
-    - daemon: add new polkit action to manage interfaces
-    - packaging/arch: disable services when removing
-    - asserts/signtool: support for building tools on top that fill-
-      in/compute some headers
-    - cmd: clarify "This leaves %s tracking %s." message
-    - daemon: return "bad-query" error kind for store.ErrBadQuery
-    - taskrunner/many: KnownTaskKinds helper
-    - tests/main/interfaces-fuse_support: fix confinement, allow
-      unmount, fix spread tests
-    - snap: use the -no-fragments mksquashfs option
-    - data/selinux: allow messages from policykit
-    - tests: fix catalog-update wait loop
-    - tests/lib/prepare-restore: disable rate limiting in journald
-    - tests: change interfaces-fuse_support to be debug friendly
-    - tests/main/postrm-purge: stop snapd before purge
-    - This is an example of test log:https://paste.ubuntu.com/26215170/
-    - tests/main/interfaces-fuse_support: dump more debugging
-      information
-    - interfaces/dbus: adjust slot policy for listen, accept and accept4
-      syscalls
-    - tests: save the snapd-state without compression
-    - tests/main/searching: handle changes in featured snaps list
-    - overlord/snapstate: fix auto-refresh summary for 2 snaps
-    - overlord/auth,daemon: introduce an explicit auth.ErrInvalidUser
-    - interfaces: add /proc/partitions to system-observe (This addresses
-      LP#1708527.)
-    - tests/lib: introduce helpers for setting up /dev/random using
-      /dev/urandom in project prepare
-    - tests: new test for interface network status
-    - interfaces: interfaces: also add an app/hook-specific udev RUN
-      rule for hotplugging
-    - tests: fix external backend for tests that need DEBUG output
-    - tests: do not disable refresh timer on external backend
-    - client: send all snap related bool json fields
-    - interfaces/desktop,unity7: allow status/activate/lock of
-      screensavers
-    - tests/main: source mkpinentry.sh
-    - tests: fix security-device-cgroups-serial-port test for rpi and db
-    - cmd/snap-mgmt: add more directories for cleanup and refactor
-      purge() code
-    - snap: YAML and data structures for app before/after ordering
-    - tests: set TRUST_TEST_KEYS=false for all the external backends
-    - packaging/arch: install snap-mgmt tool
-    - tests: add support on tests for cm3 gadget
-    - interfaces/removable-media: also allow 'k' (lock)
-    - interfaces: use ConnectedPlug/ConnectedSlot types (step 2)
-    - interfaces: rename sanitize methods
-    - devicestate: fix misbehaving test when using systemd-resolved
-    - interfaces: added Ref() helpers, restored more detailed error
-      message on spi iface
-    - debian: make "gnupg" a recommends
-    - interfaces/many: misc updates for default, browser-support,
-      opengl, desktop, unity7, x11
-    - interfaces: PlugInfo/SlotInfo/ConnectedPlug/ConnectedSlot
-      attribute helpers
-    - interfaces: update fixme comments
-    - tests: make interfaces-snapd-control-with-manage more robust
-    - userd: generalize dbusInterface
-    - interfaces: use ConnectedPlug/ConnectedSlot types (step 1)
-    - hookstate: add compat "configure-snapd" task.
-    - config, overlord/snapstate, timeutil: rename ParseSchedule to
-      ParseLegacySchedule
-    - tests: adding tests for time*-control interfaces
-    - tests: new test to check interfaces after reboot the system
-    - cmd/snap-mgmt: fixes
-    - packaging/opensuse-42.2: package and use snap-mgmt
-    - corecfg: also "mask" services when disabling them
-    - cmd/snap-mgmt: introduce snap-mgmt tool
-    - configstate: simplify ConfigManager
-    - interfaces: add gpio-memory-control interface
-    - cmd: disable check-syntax-c
-    - packaging/arch: add bash-completion as optional dependency
-    - corecfg: rename package to overlord/configstate/configcore
-    - wrappers: fix unit tests to use dirs.SnapMountDir
-    - osutil/sys: reimplement getuid and chown with the right int type
-    - interfaces-netlink-connector: fix sourcing snaps.sh
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 06 Feb 2018 09:43:22 +0100
-
-snapd (2.30) xenial; urgency=medium
-
-  * New upstream release, LP: #1735344
-    - tests: set TRUST_TEST_KEYS=false for all the external backends
-    - tests: fix external backend for tests that need DEBUG output
-    - tests: do not disable refresh timer on external backend
-    - client: send all snap related bool json fields
-    - interfaces: interfaces: also add an app/hook-specific udev RUN
-      rule for hotplugging
-    - interfaces/desktop,unity7: allow status/activate/lock of
-      screensavers
-    - tests/main: source mkpinentry.sh
-    - devicestate: use a different nowhere domain
-    - interfaces: add ssh-keys, ssh-public-keys, gpg-keys and gpg-public
-      keys interfaces
-    - interfaces/many: misc updates for default, browser-support, opengl,
-      desktop, unity7, x11
-    - devicestate: fix misbehaving test when using systemd-resolved
-    - interfaces/removable-media: also allow 'k' (lock)
-    - interfaces/many: misc updates for default, browser-support,
-      opengl, desktop, unity7, x11
-    - corecfg: also "mask" services when disabling them
-    - tests: add support for autopkgtests on s390x
-    - snapstate: support for pre-refresh hook
-    - many: allow to configure core before it is installed
-    - devicestate: fix unkeyed fields error
-    - snap-confine: create mount target for lib32,vulkan on demand
-    - snapstate: add support for refresh.schedule=managed
-    - cmd/snap-update-ns: teach update logic to handle synthetic changes
-    - many: remove configure-snapd task again and handle internally
-    - snap: fix TestDirAndFileMethods() test to work with gccgo
-    - debian: ensure /var/lib/snapd/lib/vulkan is available
-    - cmd/snap-confine: use #include instead of bare include
-    - snapstate: store userID in snapstate
-    - snapd.dirs: add var/lib/snapd/lib/gl32
-    - timeutil, overlod/snapstate: cleanup remaining pieces of timeutil
-      weekday support
-    - packaging/arch: install missing directories, manpages and version
-      info
-    - snapstate,store: store if a snap is a paid snap in the sideinfo
-    - packaging/arch: pre-create snapd directories when packaging
-    - tests/main/manpages: set LC_ALL=C as man may complain if the
-      locale is unset or unsupported
-    - repo: ConnectedPlug and ConnectedSlot types
-    - snapd: fix handling of undo in the taskrunner
-    - store: fix download caching and add integration test
-    - snapstate: move autorefresh code into autoRefresh helper
-    - snapctl: don't error out on start/stop/restart from configure hook
-      during install or refresh
-    - cmd/snap-update-ns: add planWritableMimic
-    - deamon: don't omit responses, even if null
-    - tests: add test for frame buffer interface
-    - tests/lib: fix shellcheck errors
-    - apparmor: generate the snap-confine re-exec profile for
-      AppArmor{Partial,Full}
-    - tests: remove obsolete workaround
-    - snap: use existing files in `snap download` if digest/size matches
-    - tests: merge pepare-project.sh into prepare-restore.sh
-    - tests: cache snaps to $TESTSLIB/cache
-    - tests: set -e, -o pipefail in prepare-restore.sh
-    - apparmor: generate the snap-confine re-exec profile for
-      AppArmor{Partial,Full}
-    - cmd/snap-seccomp: fix uid/gid restrictions tests on Arch
-    - tests: document and slightly refactor prepare/restore code
-    - snapstate: ensure RefreshSchedule() gives accurate results
-    - snapstate: add new refresh-hints helper and use it
-    - spread.yaml,tests: move most of project-wide prepare/restore to
-      separate file
-    - timeutil: introduce helpers for weekdays and TimeOfDay
-    - tests: adding new test for uhid interface
-    - cmd/libsnap: fix parsing of empty mountinfo fields
-    - overlord/devicestate:  best effort to go to early full retries for
-      registration on the like of DNS no host
-    - spread.yaml: bump delta ref to 2.29
-    - tests: adding test to test physical memory observe interface
-    - cmd, errtracker: get rid of SNAP_DID_REEXEC environment
-    - timeutil: remove support to parse weekday schedules
-    - snap-confine: add workaround for snap-confine on 4.13/upstream
-    - store: do not log the http body for catalog updates
-    - snapstate: move catalogRefresh into its own helper
-    - spread.yaml: fix shellcheck issues and trivial refactor
-    - spread.yaml: move prepare-each closer to restore-each
-    - spread.yaml: increase workers for opensuse to 3
-    - tests: force delete when tests are restore to avoid suite failure
-    - test: ignore /snap/README
-    - interfaces/opengl: also allow read on 'revision' in
-      /sys/devices/pci...
-    - interfaces/screen-inhibit-control: fix case in screen inhibit
-      control
-    - asserts/sysdb: panic early if pointed to staging but staging keys
-      are not compiled-in
-    - interfaces: allow /bin/chown and fchownat to root:root
-    - timeutil: include test input in error message in
-      TestParseSchedule()
-    - interfaces/browser-support: adjust base declaration for auto-
-      connection
-    - snap-confine: fix snap-confine under lxd
-    - store: bit less aggressive retry strategy
-    - tests: add new `fakestore new-snap-{declaration,revision}` helpers
-    - cmd/snap-update-ns: add secureMkfileAll
-    - snap: use field names when initializing composite literals
-    - HACKING: fix path in snap install
-    - store: add support for flags in ListRefresh()
-    - interfaces: remove invalid plugs/slots from SnapInfo on
-      sanitization.
-    - debian: add missing udev dependency
-    - snap/validate: extend socket validation tests
-    - interfaces: add "refresh-schedule" attribute to snapd-control
-    - interfaces/builtin/account_control: use gid owning /etc/shadow to
-      setup seccomp rules
-    - cmd/snap-update-ns: tweak changePerform
-    - interfaces,tests: skip unknown plug/slot interfaces
-    - tests: disable interfaces-network-control-tuntap
-    - cmd: use a preinit_array function rather than parsing
-      /proc/self/cmdline
-    - interfaces/time*_control: explicitly deny noisy read on
-      /proc/1/environ
-    - cmd/snap-update-ns: misc cleanups
-    - snapd: allow hooks to have slots
-    - fakestore: add go-flags to prepare for `new-snap-declaration` cmd
-    - interfaces/browser-support: add shm path for nwjs
-    - many: add magic /snap/README file
-    - overlord/snapstate: support completion for command aliases
-    - tests: re-enable tun/tap test on Debian
-    - snap,wrappers: add support for socket activation
-    - repo: use PlugInfo and SlotInfo for permanent plugs/slots
-    - tests/interfaces-network-control-tuntap: disable on debian-
-      unstable for now
-    - cmd/snap-confine: Loosen the NVIDIA Vulkan ICD glob
-    - cmd/snap-update-ns: detect and report read-only filesystems
-    - cmd/snap-update-ns: re-factor secureMkdirAll into
-      secureMk{Prefix,Dir}
-    - run-checks, tests/lib/snaps/: shellcheck fixes
-    - corecfg: validate refresh.schedule when it is applied
-    - tests: adjust test to match stderr
-    - snapd: fix snap cookie bugs
-    - packaging/arch: do not quote MAKEFLAGS
-    - state: add change.LaneTasks helper
-    - cmd/snap-update-ns: do not assume 'nogroup' exists
-    - tests/lib: handle distro specific grub-editenv naming
-    - cmd/snap-confine: Add missing bi-arch NVIDIA filesthe
-      `/var/lib/snapd/lib/gl:/var/lib/snapd/lib/gl/vdpau` paths within
-    - cmd: Support exposing NVIDIA Vulkan ICD files to the snaps
-    - cmd/snap-confine: Implement full 32-bit NVIDIA driver support
-    - packaging/arch: packaging update
-    - cmd/snap-confine: Support bash as base runtime entry
-    - wrappers: do not error on incorrect Exec= lines
-    - interfaces: fix udev tagging for hooks
-    - tests/set-proxy-store: exclude ubuntu-core-16 via systems: key
-    - tests: new tests for network setup control and observe interfaces
-    - osutil: add helper for obtaining group ID of given file path
-    - daemon,overlord/snapstate: return snap-not-installed error in more
-      cases
-    - interfaces/builtin/lxd_support: allow discovering of host's os-
-      release
-    - configstate: add support for configure-snapd for
-      snapstate.IgnoreHookError
-    - tests:  add a spread test for proxy.store setting together with
-      store assertion
-    - cmd/snap-seccomp: do not use group 'shadow' in tests
-    - asserts/assertstest:  fix use of hardcoded value when the passed
-      or default keys should be used
-    - interfaces/many: misc policy updates for browser-support, cups-
-      control and network-status
-    - tests: fix xdg-open-compat
-    - daemon: for /v2/logs, 404 when no services are found
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - cmd/snap-update-ns: add new helpers for mount entries
-    - cmd/snap-confine: Respect biarch nature of libdirs
-    - cmd/snap-confine: Ensure snap-confine is allowed to access os-
-      release
-    - cmd: fix re-exec bug with classic confinement for host snapd <
-      2.28
-    - interfaces/kmod: simplify loadModules now that errors are ignored
-    - tests: disable xdg-open-compat test
-    - tests: add test that checks core reverts on core devices
-    - dirs: use alt root when checking classic confinement support
-      without …
-    - interfaces/kmod: treat failure to load module as non-fatal
-    - cmd/snap-update-ns: fix golint and some stale comments
-    - corecfg:  support setting proxy.store if there's a matching store
-      assertion
-    - overlord/snapstate: toggle ignore-validation as needed as we do
-      for channel
-    - tests: fix security-device-cgroup* tests on devices with
-      framebuffer
-    - interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS
-    - interfaces: add USB interface number attribute in udev rule for
-      serial-port interface
-    - overlord/devicestate: switch to the new endpoints for registration
-    - snap-update-ns: add missing unit test for desired/current profile
-      handling
-    - cmd/{snap-confine,libsnap-confine-private,snap-shutdown}: cleanup
-      low-level C bits
-    - ifacestate: make interfaces.Repository available via state cache
-    - overlord/snapstate: cleanups around switch-snap*
-    - cmd/snapd,client,daemon: display ignore-validation flag through
-      the notes mechanism
-    - cmd/snap-update-ns: add logging to snap-update-ns
-    - many: have a timestamp on store assertions
-    - many: lookup and use the URL from a store assertion if one is set
-      for use
-    - tests/test-snapd-service: fix shellcheck issues
-    - tests: new test for hardware-random-control interface
-    - tests: use `snap change --last=install` in snapd-reexec test
-    - repo, daemon: use PlugInfo, SlotInfo
-    - many: handle core configuration internally instead of using the
-      core configure hook
-    - tests: refactor and expand content interface test
-    - snap-seccomp: skip in-kernel bpf tests for socket() in trusty/i386
-    - cmd/snap-update-ns: allow Change.Perform to return changes
-    - snap-confine: Support biarch Linux distribution confinement
-    - partition/ubootenv: don't panic when uboot.env is missing the eof
-      marker
-    - cmd/snap-update-ns: allow fault injection to provide dynamic
-      result
-    - interfaces/mount: exspose mount.{Escape,Unescape}
-    - snapctl: added long help to stop/start/restart command
-    - cmd/snap-update-ns: create missing mount points automatically.
-    - cmd: downgrade log message in InternalToolPath to Debugf()
-    - tests: wait for service status change & file update in the test to
-      avoid races
-    - daemon, store: forward SSO invalid credentials errors as 401
-      Unauthorized responses
-    - spdx: fix for WITH syntax, require a license name before the
-      operator
-    - many: reorg things in preparation to make handling of the base url
-      in store dynamic
-    - hooks/configure: queue service restarts
-    - cmd/snap: warn when a snap is not from the tracking channel
-    - interfaces/mount: add support for parsing x-snapd.{mode,uid,gid}=
-    - cmd/snap-confine: add detection of stale mount namespace
-    - interfaces: add plugRef/slotRef helpers for PlugInfo/SlotInfo
-    - tests: check for invalid udev files during all tests
-    - daemon: use newChange() in changeAliases for consistency
-    - servicestate: use taskset
-    - many: add support for /home on NFS
-    - packaging,spread: fix and re-enable opensuse builds
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 18 Dec 2017 15:31:04 +0100
-
-snapd (2.29.4.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - tests: more debug info for classic-ubuntu-core-transition
-    - packaging: fix typo that causes error in the misspell test
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 28 Nov 2017 07:45:23 +0100
-
-snapd (2.29.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - snap-confine: fix snap-confine under lxd
-    - tests: disable classic-ubuntu-core-transition on i386 temporarily
-    - many: reject bad plugs/slots
-    - interfaces,tests: skip unknown plug/slot interfaces
-    - store: enable "base" field from the store
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Nov 2017 22:55:09 +0100
-
-snapd (2.29.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - daemon: cherry-picked /v2/logs fixes
-    - cmd/snap-confine: Respect biarch nature of libdirs
-    - cmd/snap-confine: Ensure snap-confine is allowed to access os-
-      release
-    - interfaces: fix udev tagging for hooks
-    - cmd: fix re-exec bug with classic confinement for host snapd
-    - tests: disable xdg-open-compat test
-    - cmd/snap-confine: add slave PTYs and let devpts newinstance
-      perform mediation
-    - interfaces/many: misc policy updates for browser-support, cups-
-      control and network-status
-    - interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS
-    - tests: fix security-device-cgroup* tests on devices with
-      framebuffer
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 09 Nov 2017 19:16:29 +0100
-
-snapd (2.29.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - snapctl: disable stop/start/restart (2.29)
-    - cmd/snap-update-ns: fix collection of changes made
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 03 Nov 2017 17:17:14 +0100
-
-snapd (2.29.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - interfaces: fix incorrect signature of ofono DBusPermanentSlot
-    - interfaces/serial-port: udev tag plugged slots that have just
-      'path' via KERNEL
-    - interfaces/hidraw: udev tag plugged slots that have just 'path'
-      via KERNEL
-    - interfaces/uhid: unconditionally add existing uhid device to the
-      device cgroup
-    - cmd/snap-update-ns: fix mount rules for font sharing
-    - tests: disable refresh-undo test on trusty for now
-    - tests: use `snap change --last=install` in snapd-reexec test
-    - Revert " wrappers: fail install if exec-line cannot be re-written
-    - interfaces: don't udev tag devmode or classic snaps
-    - many: make ignore-validation sticky and send the flag with refresh
-      requests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 03 Nov 2017 07:25:17 +0100
-
-snapd (2.29) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - interfaces/many: miscellaneous updates based on feedback from the
-      field
-    - snap-confine: allow reading uevents from any where in /sys
-    - spread: add bionic beaver
-    - debian: make packaging/ubuntu-14.04/copyright a real file again
-    - tests: cherry pick the fix for services test into 2.29
-    - cmd/snap-update-ns: initialize logger
-    - hooks/configure: queue service restarts
-    - snap-{confine,seccomp}: make @unrestricted fully unrestricted
-    - interfaces: clean system apparmor cache on core device
-    - debian: do not build static snap-exec on powerpc
-    - snap-confine: increase sanity_timeout to 6s
-    - snapctl: cherry pick service commands changes
-    - cmd/snap: tell translators about arg names and descs req's
-    - systemd: run all mount units before snapd.service to avoid race
-    - store: add a test to show auth failures are forwarded by doRequest
-    - daemon: convert ErrInvalidCredentials to a 401 Unauthorized error.
-    - store: forward on INVALID_CREDENTIALS error as
-      ErrInvalidCredentials
-    - daemon: generate a forbidden response message if polkit dialog is
-      dismissed
-    - daemon: Allow Polkit authorization to cancel changes.
-    - travis: switch to container based test runs
-    - interfaces: reduce duplicated code in interface tests mocks
-    - tests: improve revert related testing
-    - interfaces: sanitize plugs and slots early in ReadInfo
-    - store: add download caching
-    - preserve TMPDIR and HOSTALIASES across snap-confine invocation
-    - snap-confine: init all arrays with `= {0,}`
-    - tests: adding test for network-manager interface
-    - interfaces/mount: don't generate legacy per-hook/per-app mount
-      profiles
-    - snap: introduce structured epochs
-    - tests: fix interfaces-cups-control test for cups-2.2.5
-    - snap-confine: cleanup incorrectly created nvidia udev tags
-    - cmd/snap-confine: update valid security tag regexp
-    - cmd/libsnap: enable two stranded tests
-    - cmd,packaging: enable apparmor on openSUSE
-    - overlord/ifacestate: refresh all security backends on startup
-    - interfaces/dbus: drop unneeded check for
-      release.ReleaseInfo.ForceDevMode
-    - dbus: ensure io.snapcraft.Launcher.service is created on re-
-      exec
-    - overlord/auth: continue for now supporting UBUNTU_STORE_ID if the
-      model is generic-classic
-    - snap-confine: add support for handling /dev/nvidia-modeset
-    - interfaces/network-control: remove incorrect rules for tun
-    - spread: allow setting SPREAD_DEBUG_EACH=0 to disable debug-each
-      section
-    - packaging: remove .mnt files on removal
-    - tests: fix econnreset scenario when the iptables rule was not
-      created
-    - tests: add test for lxd interface
-    - run-checks: use nakedret static checker to check for naked
-      returns on long functions
-    - progress: be more flexible in testing ansimeter
-    - interfaces: fix udev rules for tun
-    - many: implement our own ANSI-escape-using progress indicator
-    - snap-exec: update tests to follow main_test pattern
-    - snap: support "command: foo $ENV_STRING"
-    - packaging: update nvidia configure options
-    - snap: add new `snap pack` and use in tests
-    - cmd: correctly name the "Ubuntu" and "Arch" NVIDIA methods
-    - cmd: add autogen case for solus
-    - tests: do not use http://canihazip.com/ which appears to be down
-    - hooks: commands for controlling own services from snapctl
-    - snap: refactor cmdGet.Execute()
-    - interfaces/mount: make Change.Perform testable and test it
-    - interfaces/mount,cmd/snap-update-ns: move change code
-    - snap-confine: is_running_on_classic_distribution() looks into os-
-      release
-    - interfaces: misc updates for default, browser-support, home and
-      system-observe
-    - interfaces: deny lttng by default
-    - interfaces/lxd: lxd slot implementation can also be an app snap
-    - release,cmd,dirs: Redo the distro checks to take into account
-      distribution families
-    - cmd/snap: completion for alias and unalias
-    - snap-confine: add new SC_CLEANUP and use it
-    - snap: refrain from running filepath.Base on random strings
-    - cmd/snap-confine: put processes into freezer hierarchy
-    - wrappers: fail install if exec-line cannot be re-written
-    - cmd/snap-seccomp,osutil: make user/group lookup functions public
-    - snapstate: deal with snap user data in the /root/ directory
-    - interfaces: Enhance full-confinement support for biarch
-      distributions
-    - snap-confine: Only attempt to copy/mount NVIDIA libs when NVIDIA
-      is used
-    - packaging/fedora: Add Fedora 26, 27, and Rawhide symlinks
-    - overlord/snapstate: prefer a smaller corner case for doing the
-      wrong thing
-    - cmd/snap-repair:  set user agent for snap-repair http requests
-    - packaging: bring down the delta between 14.04 and 16.04
-    - snap-confine: Ensure lib64 biarch directory is respected
-    - snap-confine: update apparmor rules for fedora based base snaps
-    - tests: Increase SNAPD_CONFIGURE_HOOK_TIMEOUT to 3 minutes to
-      install real snaps
-    - daemon: use client.Snap instead of map[string]interface{} for
-      snaps.
-    - hooks: rename refresh hook to post-refresh
-    - git: make the .gitingore file a bit more targeted
-    - interfaces/opengl: don't udev tag nvidia devices and use snap-
-      confine instead
-    - cmd/snap-{confine,update-ns}: apply mount profiles using snap-
-      update-ns
-    - cmd: update "make hack"
-    - interfaces/system-observe: allow clients to enumerate DBus
-      connection names
-    - snap-repair: implement `snap-repair {list,show}`
-    - dirs,interfaces: create snap-confine.d on demand when re-executing
-    - snap-confine: fix base snaps on core
-    - cmd/snap-repair: fix tests when running as root
-    - interfaces: add Connection type
-    - cmd/snap-repair: skip disabled repairs
-    - cmd/snap-repair: prefer leaking unmanaged fds on test failure over
-      closing random ones
-    - snap-repair: make `repair` binary available for repair scripts
-    - snap-repair: fix missing Close() in TestStatusHappy
-    - cmd/snap-confine,packaging: import snapd-generated policy
-    - cmd/snap: return empty document if snap has no configuration
-    - snap-seccomp: run secondary-arch tests via gcc-multilib
-    - snap: implement `snap {repair,repairs}` and pass-through to snap-
-      repair
-    - interfaces/builtin: allow receiving dbus messages
-    - snap-repair: implement `snap-repair {done,skip,retry}`
-    - data/completion: small tweak to snap completion snippet
-    - dirs: fix classic support detection
-    - cmd/snap-repair: integrate root public keys for repairs
-    - tests: fix ubuntu core services
-    - tests: add new test that checks that the compat snapd-xdg-open
-      works
-    - snap-confine: improve error message if core/u-core cannot be found
-    - tests: only run tests/regression/nmcli on amd64
-    - interfaces: mount host system fonts in desktop interface
-    - interfaces: enable partial apparmor support
-    - snapstate: auto-install missing base snaps
-    - spread: work around temporary packaging issue in debian sid
-    - asserts,cmd/snap-repair: introduce a mandatory summary for repairs
-    - asserts,cmd/snap-repair: represent RepairID internally as an int
-    - tests: test the real "xdg-open" from the core snap
-    - many: implement fetching sections and package names periodically.
-    - interfaces/network: allow using netcat as client
-    - snap-seccomp, osutil: use osutil.AtomicFile in snap-seccomp
-    - snap-seccomp: skip mknod syscall on arm64
-    - tests: add trivial canonical-livepatch test
-    - tests: add test that ensures that all core services are working
-    - many: add logger.MockLogger() and use it in the tests
-    - snap-repair: fix test failure in TestRepairHitsTimeout
-    - asserts: add empty values check in HeadersFromPrimaryKey
-    - daemon: remove unused installSnap var in test
-    - daemon: reach for Overlord.Loop less thanks to overlord.Mock
-    - snap-seccomp: manually resolve socket() call in tests
-    - tests: change regex used to validate installed ubuntu core snap
-    - cmd/snapctl: allow snapctl -h without a context (regression fix).
-    - many: use snapcore/snapd/i18n instead of i18n/dumb
-    - many: introduce asserts.NotFoundError replacing both ErrNotFound
-      and store.AssertionNotFoundError
-    - packaging: don't include any marcos in comments
-    - overlord: use overlord.Mock in more tests, make sure we check the
-      outcome of Settle
-    - tests: try to fix staging tests
-    - store: simplify api base url config
-    - systemd: add systemd.MockJournalctl()
-    - many: provide systemd.MockSystemctl() helper
-    - tests: improve the listing test to not fail for e.g. 2.28~rc2
-    - snapstate: give snapmgrTestSuite.settle() more time to settle
-    - tests: fix regex to check core version on snap list
-    - debian: update trusted account-keys check on 14.04 packaging
-    - interfaces: add udev netlink support to hardware-observe
-    - overlord: introduce Mock which enables to use Overlord.Settle for
-      settle in many more places
-    - snap-repair: execute the repair and capture logs/status
-    - tests: run the tests/unit/go everywhere
-    - daemon, snapstate: move ensureCore from daemon/api.go into
-      snapstate.go
-    - cmd/snap: get keys or root document
-    - spread.yaml: turn suse to manual given that it's breaking master
-    - many: configure store from state, reconfigure store at runtime
-    - osutil: AtomicWriter (an io.Writer), and io.Reader versions of
-      AtomicWrite*
-    - tests: check for negative syscalls in runBpf() and skip those
-      tests
-    - docs: use abolute path in PULL_REQUEST_TEMPLATE.md
-    - store: move device auth endpoint uris to config (#3831)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 30 Oct 2017 16:22:31 +0100
-
-snapd (2.28.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - snap-confine: cleanup broken nvidia udev tags
-    - cmd/snap-confine: update valid security tag regexp
-    - overlord/ifacestate: refresh udev backend on startup
-    - dbus: ensure io.snapcraft.Launcher.service is created on re-
-      exec
-    - snap-confine: add support for handling /dev/nvidia-modeset
-    - interfaces/network-control: remove incorrect rules for tun
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 13 Oct 2017 23:25:46 +0200
-
-snapd (2.28.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - interfaces/opengl: don't udev tag nvidia devices and use snap-
-      confine instead
-    - debian: fix replaces/breaks for snap-xdg-open (thanks to apw!)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Oct 2017 19:40:57 +0200
-
-snapd (2.28.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - interfaces/lxd: lxd slot implementation can also be an app
-      snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Oct 2017 08:20:26 +0200
-
-snapd (2.28.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - interfaces: fix udev rules for tun
-    - release,cmd,dirs: Redo the distro checks to take into account
-      distribution families
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 10 Oct 2017 18:39:58 +0200
-
-snapd (2.28.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - snap-confine: update apparmor rules for fedora based basesnaps
-    - snapstate: rename refresh hook to post-refresh for consistency
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 27 Sep 2017 17:59:49 -0400
-
-snapd (2.28) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - hooks: rename refresh to after-refresh
-    - snap-confine: bind mount /usr/lib/snapd relative to snap-confine
-    - cmd,dirs: treat "liri" the same way as "arch"
-    - snap-confine: fix base snaps on core
-    - hooks: substitute env vars when executing hooks
-    - interfaces: updates for default, browser-support, desktop, opengl,
-      upower and stub-resolv.conf
-    - cmd,dirs: treat manjaro the same as arch
-    - systemd: do not run auto-import and repair services on classic
-    - packaging/fedora: Ensure vendor/ is empty for builds and fix spec
-      to build current master
-    - many: fix TestSetConfNumber missing an Unlock and other fragility
-      improvements
-    - osutil: adjust StreamCommand tests for golang 1.9
-    - daemon: allow polkit authorisation to install/remove snaps
-    - tests: make TestCmdWatch more robust
-    - debian: improve package description
-    - interfaces: add netlink kobject uevent to hardware observe
-    - debian: update trusted account-keys check on 14.04 packaging
-    - interfaces/network-{control,observe}: allow receiving
-      kobject_uevent() messages
-    - tests: fix lxd test for external backend
-    - snap-confine,snap-update-ns: add -no-pie to fix FTBFS on
-      go1.7,ppc64
-    - corecfg: mock "systemctl" in all corecfg tests
-    - tests: fix unit tests on Ubuntu 14.04
-    - debian: add missing flags when building static snap-exec
-    - many: end-to-end support for the bare base snap
-    - overlord/snapstate: SetRootDir from SetUpTest, not in just some
-      tests
-    - store: have an ad-hoc method on cfg to get its list of uris for
-      tests
-    - daemon: let client decide whether to allow interactive auth via
-      polkit
-    - client,daemon,snap,store: add license field
-    - overlord/snapstate: rename HasCurrent to IsInstalled, remove
-      superfluous/misleading check from All
-    - cmd/snap: SetRootDir from SetUpTest, not in just some individual
-      tests.
-    - systemd: rename snap-repair.{service,timer} to snapd.snap-
-      repair.{service,timer}
-    - snap-seccomp: remove use of x/net/bpf from tests
-    - httputil: more naive per go version way to recreate a default
-      transport for tls reconfig
-    - cmd/snap-seccomp/main_test.go: add one more syscall for arm64
-    - interfaces/opengl: use == to compare, not =
-    - cmd/snap-seccomp/main_test.go: add syscalls for armhf and arm64
-    - cmd/snap-repair: track and use a lower bound for the time for
-      TLS checks
-    - interfaces: expose bluez interface on classic OS
-    - snap-seccomp: add in-kernel bpf tests
-    - overlord: always try to get a serial, lazily on classic
-    - tests: add nmcli regression test
-    - tests: deal with __PNR_chown on aarch64 to fix FTBFS on arm64
-    - tests: add autopilot-introspection interface test
-    - vendor: fix artifact from manually editing vendor/vendor.json
-    - tests: rename complexion to test-snapd-complexion
-    - interfaces: add desktop and desktop-legacy
-      interfaces/desktop: add new 'desktop' interface for modern DEs
-      interfaces/builtin/desktop_test.go: use modern testing techniques
-      interfaces/wayland: allow read on /etc/drirc for Plasma desktop
-      interfaces/desktop-legacy: add new 'legacy' interface (currently
-      for a11y and input)
-    - tests: fix race in snap userd test
-    - devices/iio: add read/write for missing sysfs entries
-    - spread: don't set HTTPS?_PROXY for linode
-    - cmd/snap-repair: check signatures of repairs from Next
-    - env: set XDG_DATA_DIRS for wayland et.al.
-    - interfaces/{default,account-control}: Use username/group instead
-      of uid/gid
-    - interfaces/builtin: use udev tagging more broadly
-    - tests: add basic lxd test
-    - wrappers: ensure bash completion snaps install on core
-    - vendor: use old golang.org/x/crypto/ssh/terminal to build on
-      powerpc again
-    - docs: add PULL_REQUEST_TEMPLATE.md
-    - interfaces: fix network-manager plug
-    - hooks: do not error out when hook is optional and no hook handler
-      is registered
-    - cmd/snap: add userd command to replace snapd-xdg-open
-    - tests: new regex used to validate the core version on extra snaps
-      ass...
-    - snap: add new `snap switch` command
-    - tests: wait more and more debug info about fakestore start issues
-    - apparmor,release: add better apparmor detection/mocking code
-    - interfaces/i2c: adjust sysfs rule for alternate paths
-    - interfaces/apparmor: add missing call to dirs.SetRootDir
-    - cmd: "make hack" now also installs snap-update-ns
-    - tests: copy files with less verbosity
-    - cmd/snap-confine: allow using additional libraries required by
-      openSUSE
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - snapstate: improve the error message when classic confinement is
-      not supported
-    - tests: add test to ensure amd64 can run i386 syscall binaries
-    - tests: adding extra info for fakestore when fails to start
-    - tests: install most important snaps
-    - cmd/snap-repair: more test coverage of filtering
-    - squashfs: remove runCommand/runCommandWithOutput as we do not need
-      it
-    - cmd/snap-repair: ignore superseded revisions, filter on arch and
-      models
-    - hooks: support for refresh hook
-    - Partial revert "overlord/devicestate, store: update device auth
-      endpoints URLs"
-    - cmd/snap-confine: allow reading /proc/filesystems
-    - cmd/snap-confine: genearlize apparmor profile for various lib
-      layout
-    - corecfg: fix proxy.* writing and add integration test
-    - corecfg: deal with system.power-key-action="" correctly
-    - vendor: update vendor.json after (presumed) manual edits
-    - cmd/snap: in `snap info`, don't print a newline between tracks
-    - daemon: add polkit support to /v2/login
-    - snapd,snapctl: decode json using Number
-    - client: fix go vet 1.7 errors
-    - tests: make 17.04 shellcheck clean
-    - tests: remove TestInterfacesHelp as it breaks when go-flags
-      changes
-    - snapstate: undo a daemon restart on classic if needed
-    - cmd/snap-repair: recover brand/model from
-      /var/lib/snapd/seed/assertions checking signatures and brand
-      account
-    - spread: opt into unsafe IO during spread tests
-    - snap-repair: update snap-repair/runner_test.go for API change in
-      makeMockServer
-    - cmd/snap-repair: skeleton code around actually running a repair
-    - tests: wait until the port is listening after start the fake store
-    - corecfg: fix typo in tests
-    - cmd/snap-repair: test that redirects works during fetching
-    - osutil: honor SNAPD_UNSAFE_IO for testing
-    - vendor: explode and make more precise our golang.go/x/crypto deps,
-      use same version as Debian unstable
-    - many: sanitize NewStoreStack signature, have shared default store
-      test private keys
-    - systemd: disable `Nice=-5` to fix error when running inside lxd
-    - spread.yaml: update delta ref to 2.27
-    - cmd/snap-repair: use E-Tags when refetching a repair to retry
-    - interfaces/many: updates based on chromium and mrrescue denials
-    - cmd/snap-repair: implement most logic to get the next repair to
-      run/retry in a brand sequence
-    - asserts/assertstest: copy headers in SigningDB.Sign
-    - interfaces: convert uhid to common interface and test cases
-      improvement for time_control and opengl
-    - many tests: move all panicing fake store methods to a common place
-    - asserts: add store assertion type
-    - interfaces: don't crash if content slot has no attributes
-    - debian: do not build with -buildmode=pie on i386
-    - wrappers: symlink completion snippets when symlinking binaries
-    - tests: adding more debug information for the interfaces-cups-
-      control …
-    - apparmor: pass --quiet to parser on load unless SNAPD_DEBUG is set
-    - many: allow and support serials signed by the 'generic' authority
-      instead of the brand
-    - corecfg: add proxy configuration via `snap set core
-      proxy.{http,https,ftp}=...`
-    - interfaces: a bunch of interfaces test improvement
-    - tests: enable regression and completion suites for opensuse
-    - tests: installing snapd for nested test suite
-    - interfaces: convert lxd_support to common iface
-    - interfaces: add missing test for camera interface.
-    - snap: add support for parsing snap layout section
-    - cmd/snap-repair: like for downloads we cannot have a timeout (at
-      least for now), less aggressive retry strategies
-    - overlord: rely on more conservative ensure interval
-    - overlord,store: no piles of return args for methods gathering
-      device session request params
-    - overlord,store: send model assertion when setting up device
-      sessions
-    - interfaces/misc: updates for unity7/x11, browser-
-      support, network-control and mount-observe
-      interfaces/unity7,x11: update for NETLINK_KOBJECT_UEVENT
-      interfaces/browser-support: update sysfs reads for
-      newer browser versions, interfaces/network-control: rw for
-      ieee80211 advanced wireless interfaces/mount-observe: allow read
-      on sysfs entries for block devices
-    - tests: use dnf --refresh install to avert stale cache
-    - osutil: ensure TestLockUnlockWorks uses supported flock
-    - interfaces: convert lxd to common iface
-    - tests: restart snapd to ensure re-exec settings are applied
-    - tests: fix interfaces-cups-control test
-    - interfaces: improve and tweak bunch of interfaces test cases.
-    - tests: adding extra worker for fedora
-    - asserts,overlord/devicestate: support predefined assertions that
-      don't establish foundational trust
-    - interfaces: convert two hardware_random interfaces to common iface
-    - interfaces: convert io_ports_control to common iface
-    - tests: fix for  upgrade test on fedora
-    - daemon, client, cmd/snap: implement snap start/stop/restart
-    - cmd/snap-confine: set _FILE_OFFSET_BITS to 64
-    - interfaces: covert framebuffer to commonInterface
-    - interfaces: convert joystick to common iface
-    - interfaces/builtin: add the spi interface
-    - wrappers, overlord/snapstate/backend: make link-snap clean up on
-      failure.
-    - interfaces/wayland: add wayland interface
-    - interfaces: convert kvm to common iface
-    - tests: extend upower-observe test to cover snaps providing slots
-    - tests: enable main suite for opensuse
-    - interfaces: convert physical_memory_observe to common iface
-    - interfaces: add missing test for optical_drive interface.
-    - interfaces: convert physical_memory_control to common iface
-    - interfaces: convert ppp to common iface
-    - interfaces: convert time-control to common iface
-    - tests: fix failover test
-    - interfaces/builtin: rework for avahi interface
-    - interfaces: convert broadcom-asic-control to common iface
-    - snap/snapenv: document the use of CoreSnapMountDir for SNAP
-    - packaging/arch: drop patches merged into master
-    - cmd: fix mustUnsetenv docstring (thanks to Chipaca)
-    - release: remove default from VERSION_ID
-    - tests: enable regression, upgrade and completion test suites for
-      fedora
-    - tests: restore interfaces-account-control properly
-    - overlord/devicestate, store: update device auth endpoints URLs
-    - tests: fix install-hook test failure
-    - tests: download core and ubuntu-core at most once
-    - interfaces: add common support for udev
-    - overlord/devicestate: fix, don't assume that the serial is backed
-      by a 1-key chain
-    - cmd/snap-confine: don't share /etc/nsswitch from host
-    - store: do not resume a download when we already have the whole
-      thing
-    - many: implement "snap logs"
-    - store: don't call useDeltas() twice in quick succession
-    - interfaces/builtin: add kvm interface
-    - snap/snapenv: always expect /snap for $SNAP
-    - cmd: mark arch as non-reexecing distro
-    - cmd: fix tests that assume /snap mount
-    - gitignore: ignore more build artefacts
-    - packaging: add current arch packaging
-    - interfaces/unity7: allow receiving media key events in (at least)
-      gnome-shell
-    - interfaces/many, cmd/snap-confine: miscellaneous policy updates
-    - interfaces/builtin: implement broadcom-asic-control interface
-    - interfaces/builtin: reduce duplication and remove cruft in
-      Sanitize{Plug,Slot}
-    - tests: apply underscore convention for SNAPMOUNTDIR variable
-    - interfaces/greengrass-support: adjust accesses now that have
-      working snap
-    - daemon, client, cmd/snap: implement "snap services"
-    - tests: fix refresh tests not stopping fake store for fedora
-    - many: add the interface command
-    - overlord/snapstate/backend: some copydata improvements
-    - many: support querying and completing assertion type names
-    - interfaces/builtin: discard empty Validate{Plug,Slot}
-    - cmd/snap-repair:  start of Runner, implement first pass of Peek
-      and Fetch
-    - tests: enable main suite on fedora
-    - snap: do not always quote the snap info summary
-    - vendor: update go-flags to address crash in "snap debug"
-    - interfaces: opengl support pci device and vendor
-    - many: start implenting "base" snap type on the snapd side
-    - arch,release: map armv6 correctly
-    - many: expose service status in 'snap info'
-    - tests: add browser-support interface test
-    - tests: disable snapd-notify for the external backend
-    - interfaces: Add /run/uuid/request to openvswitch
-    - interfaces: add password-manager-service implicit classic
-      interface
-    - cmd: rework reexec detection
-    - cmd: fix re-exec bug when starting from snapd 2.21
-    - tests: dependency packages installed during prepare-project
-    - tests: remove unneeded check for re-exec in InternalToolPath()
-    - cmd,tests: fix classic confinement confusing re-execution code
-    - store: configurable base api
-    - tests: fix how package lists are updated for opensuse and fedora
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 25 Sep 2017 12:07:34 -0400
-
-snapd (2.27.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - interfaces: add udev netlink support to hardware-observe
-    - interfaces/network-{control,observe}: allow receiving
-      kobject_uevent() messages
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 07 Sep 2017 10:22:18 +0200
-
-snapd (2.27.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - interfaces: fix network-manager plug regression
-    - hooks: do not error when hook handler is not registered
-    - interfaces/alsa,pulseaudio: allow read on udev data for sound
-    - interfaces/optical-drive: read access to udev data for /dev/scd*
-    - interfaces/browser-support: read on /proc/vmstat and misc udev
-      data
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 30 Aug 2017 07:32:20 +0200
-
-snapd (2.27.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - snap-seccomp: add secondary arch for unrestricted snaps as well
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 24 Aug 2017 08:51:22 +0200
-
-snapd (2.27.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - systemd: disable `Nice=-5` to fix error when running inside lxdSee
-      https://bugs.launchpad.net/snapd/+bug/1709536
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 18 Aug 2017 15:49:56 +0200
-
-snapd (2.27.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - tests: remove TestInterfacesHelp as it breaks when go-flags
-      changes
-    - interfaces: don't crash if content slot has no attributes
-    - debian: do not build with -buildmode=pie on i386
-    - interfaces: backport broadcom-asic-control interface
-    - interfaces: allow /usr/bin/xdg-open in unity7
-    - store: do not resume a download when we already have the whole
-      thing
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 16 Aug 2017 12:14:51 +0200
-
-snapd (2.27.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - tests: use dnf --refresh install to avert stale cache
-    - tests: fix test failure on 14.04 due to old version of
-      flock
-    - updates for unity7/x11, browser-support, network-control,
-      mount-observe
-    - interfaces/unity7,x11: update for NETLINK_KOBJECT_UEVENT
-    - interfaces/browser-support: update sysfs reads for
-      newer browser versions
-    - interfaces/network-control: rw for ieee80211 advanced wireless
-    - interfaces/mount-observe: allow read on sysfs entries for block
-      devices
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 14 Aug 2017 08:02:17 +0200
-
-snapd (2.27) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798
-    - fix build failure on 32bit fedora
-    - interfaces: add password-manager-service implicit classic interface
-    - interfaces/greengrass-support: adjust accesses now that have working
-      snap
-    - interfaces/many, cmd/snap-confine: miscellaneous policy updates
-    - interfaces/unity7: allow receiving media key events in (at least)
-      gnome-shell
-    - cmd: fix re-exec bug when starting from snapd 2.21
-    - tests: restore interfaces-account-control properly
-    - cmd: fix tests that assume /snap mount
-    - cmd: mark arch as non-reexecing distro
-    - snap-confine: don't share /etc/nsswitch from host
-    - store: talk to api.snapcraft.io for purchases
-    - hooks: support for install and remove hooks
-    - packaging: fix Fedora support
-    - tests: add bluetooth-control interface test
-    - store: talk to api.snapcraft.io for assertions
-    - tests: remove snapd before building from branch
-    - tests: add avahi-observe interface test
-    - store: orders API now checks if customer is ready
-    - cmd/snap: snap find only searches stable
-    - interfaces: updates default, mir, optical-observe, system-observe,
-      screen-inhibit-control and unity7
-    - tests: speedup prepare statement part 1
-    - store: do not send empty refresh requests
-    - asserts: fix error handling in snap-developer consistency check
-    - systemd: add explicit sync to snapd.core-fixup.sh
-    - snapd: generate snap cookies on startup
-    - cmd,client,daemon: expose "force devmode" in sysinfo
-    - many: introduce and use strutil.ListContains and also
-      strutil.SortedListContains
-    - assserts,overlord/assertstate: test we don't accept chains of
-      assertions founded on a self-signed key coming externally
-    - interfaces: enable access to bridge settings
-    - interfaces: fix copy-pasted iio vs io in io-ports-control
-    - cmd/snap-confine: various small fixes and tweaks to seccomp
-      support code
-    - interfaces: bring back seccomp argument filtering
-    - systemd, osutil: rework systemd logs in preparation for services
-      commands
-    - tests: store /etc/systemd/system/snap-*core*.mount in snapd-
-      state.tar.gz
-    - tests: shellcheck improvements for tests/main tasks - first set of
-      tests
-    - cmd/snap: `--last` for abort and watch, and aliases
-      (search→find, change→tasks)
-    - tests: shellcheck improvements for tests/lib scripts
-    - tests: create ramdisk if it's not present
-    - tests: shellcheck improvements for nightly upgrade and regressions
-      tests
-    - snapd: fix for snapctl get panic on null config values.
-    - tests: fix for rng-tools service not restarting
-    - systemd: add snapd.core-fixup.service unit
-    - cmd: avoid using current symlink in InternalToolPath
-    - tests: fix timeout issue for test refresh core with hanging …
-    - intefaces: control bridged vlan/ppoe-tagged traffic
-    - cmd/snap: include snap type in notes
-    - overlord/state: Abort() only visits each task once
-    - tests: extend find-private test to cover more cases
-    - snap-seccomp: skip socket() tests on systems that use socketcall()
-      instead of socket()
-    - many: support snap title as localized/title-cased name
-    - snap-seccomp: deal with mknod on aarch64 in the seccomp tests
-    - interfaces: put base policy fragments inside each interface
-    - asserts: introduce NewDecoderWithTypeMaxBodySize
-    - tests: fix snapd-notify when it takes more time to restart
-    - snap-seccomp: fix snap-seccomp tests in artful
-    - tests: fix for create-key task to avoid rng-tools service ramains
-      alive
-    - snap-seccomp: make sure snap-seccomp writes the bpf file
-      atomically
-    - tests: do not disable ipv6 on core systems
-    - arch: the kernel architecture name is armv7l instead of armv7
-    - snap-confine: ensure snap-confine waits some seconds for seccomp
-      security profiles
-    - tests: shellcheck improvements for tests/nested tasks
-    - wrappers: add SyslogIdentifier to the service unit files.
-    - tests: shellcheck improvements for unit tasks
-    - asserts: implement FindManyTrusted as well
-    - asserts: open up and optimize Encoder to help avoiding unnecessary
-      copying
-    - interfaces: simplify snap-confine by just loading pre-generated
-      bpf code
-    - tests: restart rng-tools services after few seconds
-    - interfaces, tests: add mising dbus abstraction to system-observe
-      and extend spread test
-    - store: change main store host to api.snapcraft.io
-    - overlord/cmdstate: new package for running commands as tasks.
-    - spread: help libapt resolve installing libudev-dev
-    - tests: show the IP from .travis.yaml
-    - tests/main: use pkgdb function in more test cases
-    - cmd,daemon: add debug command for displaying the base policy
-    - tests: prevent quoting error on opensuse
-    - tests: fix nightly suite
-    - tests: add linode-sru backend
-    - snap-confine: validate SNAP_NAME against security tag
-    - tests: fix ipv6 disable for ubuntu-core
-    - tests: extend core-revert test to cover bluez issues
-    - interfaces/greengrass-support: add support for Amazon Greengrass
-      as a snap
-    - asserts: support timestamp and optional disabled header on repair
-    - tests: reboot after upgrading to snapd on the -proposed pocket
-    - many: fix test cases to work with different DistroLibExecDir
-    - tests: reenable help test on ubuntu and debian systems
-    - packaging/{opensuse,fedora}: allow package build with testkeys
-      included
-    - tests/lib: generalize RPM build support
-    - interfaces/builtin: sync connected slot and permanent slot snippet
-    - tests: fix snap create-key by restarting automatically rng-tools
-    - many: switch to use http numeric statuses as agreed
-    - debian: add missing  Type=notify in 14.04 packaging
-    - tests: mark interfaces-openvswitch as manual due to prepare errors
-    - debian: unify built_using between the 14.04 and 16.04 packaging
-      branch
-    - tests: pull from urandom when real entropy is not enough
-    - tests/main/manpages: install missing man package
-    - tests: add refresh --time output check
-    - debian: add missing "make -C data/systemd clean"
-    - tests: fix for upgrade test when it is repeated
-    - tests/main: use dir abstraction in a few more test cases
-    - tests/main: check for confinement in a few more interface tests
-    - spread: add fedora snap bin dir to global PATH
-    - tests: check that locale-control is not present on core
-    - many: snapctl outside hooks
-    - tests: add whoami check
-    - interfaces: compose the base declaration from interfaces
-    - tests: fix spread flaky tests linode
-    - tests,packaging: add package build support for openSUSE
-    - many: slight improvement of some snap error messaging
-    - errtracker: Include /etc/apparmor.d/usr.lib.snap-confine md5sum in
-      err reports
-    - tests: fix for the test postrm-purge
-    - tests: restoring the /etc/environment and service units config for
-      each test
-    - daemon: make snapd a "Type=notify" daemon and notify when startup
-      is done
-    - cmd/snap-confine: add support for --base snap
-    - many: derive implicit slots from interface meta-data
-    - tests: add core revert test
-    - tests,packaging: add package build support for Fedora for our
-      spread setup
-    - interfaces: move base declaration to the policy sub-package
-    - tests: fix for snapd-reexec test cheking for restart info on debug
-      log
-    - tests: show available entropy on error
-    - tests: clean journalctl logs on trusty
-    - tests: fix econnreset on staging
-    - tests: modify core before calling set
-    - tests: add snap-confine privilege test
-    - tests: add staging snap-id
-    - interfaces/builtin: silence ptrace denial for network-manager
-    - tests: add alsa interface spread test
-    - tests: prefer ipv4 over ipv6
-    - tests: fix for econnreset test checking that the download already
-      started
-    - httputil,store: extract retry code to httputil, reorg usages
-    - errtracker: report if snapd did re-execute itself
-    - errtracker: include bits of snap-confine apparmor profile
-    - tests: take into account staging snap-ids for snap-info
-    - cmd: add stub new snap-repair command and add timer
-    - many: stop "snap refresh $x --channel invalid" from working
-    - interfaces: revert "interfaces: re-add reverted ioctl and quotactl
-    - snapstate: consider connect/disconnect tasks in
-      CheckChangeConflict.
-    - interfaces: disable "mknod |N" in the default seccomp template
-      again
-    - interfaces,overlord/ifacestate: make sure installing slots after
-      plugs works similarly to plugs after slots
-    - interfaces/seccomp: add bind() syscall for forced-devmode systems
-    - packaging/fedora: Sync packaging from Fedora Dist-Git
-    - tests: move static and unit tests to spread task
-    - many: error types should be called FooError, not ErrFoo.
-    - partition: add directory sync to the save uboot.env file code
-    - cmd: test everything (100% coverage \o/)
-    - many: make shell scripts shellcheck-clean
-    - tests: remove additional setup for docker on core
-    - interfaces: add summary to each interface
-    - many: remove interface meta-data from list of connections
-    - logger (& many more, to accommodate): drop explicit syslog.
-    - packaging: import packaging bits for opensuse
-    - snapstate,many: implement snap install --unaliased
-    - tests/lib: abstract build dependency installation a bit more
-    - interfaces, osutil: move flock code from interfaces/mount to
-      osutil
-    - cmd: auto import assertions only from ext4,vfat file systems
-    - many: refactor in preparation for 'snap start'
-    - overlord/snapstate: have an explicit code path last-refresh
-      unset/zero => immediately refresh try
-    - tests: fixes for executions using the staging store
-    - tests: use pollinate to seed the rng
-    - cmd/snap,tests: show the sha3-384 of the snap for snap info
-      --verbose SNAP-FILE
-    - asserts: simplify and adjust repair assertion definition
-    - cmd/snap,tests: show the snap id if available in snap info
-    - daemon,overlord/auth: store from model assertion wins
-    - cmd/snap,tests/main: add confinement switch instead of spread
-      system blacklisting
-    - many: cleanup MockCommands and don't leave a process around after
-      hookstate tests
-    - tests: update listing test to the core version number schema
-    - interfaces: allow snaps to use the timedatectl utility
-    - packaging: Add Fedora packaging files
-    - tests/libs: add distro_auto_remove_packages function
-    - cmd/snap: correct devmode note for anomalous state
-    - tests/main/snap-info: use proper pkgdb functions to install distro
-      packages
-    - tests/lib: use mktemp instead of tempfile to work cross-distro
-    - tests: abstract common dirs which differ on distributions
-    - many: model and expose interface meta-data.
-    - overlord: make config defaults from gadget work also at first boot
-    - interfaces/log-observe: allow using journalctl from hostfs for
-      classic distro
-    - partition,snap: add support for android boot
-    - errtracker: small simplification around readMachineID
-    - snap-confine: move rm_rf_tmp to test-utils.
-    - tests/lib: introduce pkgdb helper library
-    - errtracker: try multiple paths to read machine-id
-    - overlord/hooks: make sure only one hook for given snap is executed
-      at a time.
-    - cmd/snap-confine: use SNAP_MOUNT_DIR to setup /snap inside the
-      confinement env
-    - tests: bump kill-timeout and remove quiet call on build
-    - tests/lib/snaps: add a test store snap with a passthrough
-      configure hook
-    - daemon: teach the daemon to wait on active connections when
-      shutting down
-    - tests: remove unit tests task
-    - tests/main/completion: source from /usr/share/bash-completion
-    - assertions: add "repair" assertion
-    - interfaces/seccomp: document Backend.NewSpecification
-    - wrappers: make StartSnapServices cleanup any services that were
-      added if a later one fails
-    - overlord/snapstate: avoid creating command aliases for daemons
-    - vendor: remove unused packages
-    - vendor,partition: fix panics from uenv
-    - cmd,interfaces/mount: run snap-update-ns and snap-discard-ns from
-      core if possible
-    - daemon: do not allow to install ubuntu-core anymore
-    - wrappers: service start/stop were inconsistent
-    - tests: fix failing tests (snap core version, syslog changes)
-    - cmd/snap-update-ns: add actual implementation
-    - tests: improve entropy also for ubuntu
-    - cmd/snap-confine: use /etc/ssl from the core snap
-    - wrappers: don't convert between []byte and string needlessly.
-    - hooks: default timeout
-    - overlord/snapstate: Enable() was ignoring the flags from the
-      snap's state, resulting in losing "devmode" on disable/enable.
-    - difs,interfaces/mount: add support for locking namespaces
-    - interfaces/mount: keep track of kept mount entries
-    - tests/main: move a bunch of greps over to MATCH
-    - interfaces/builtin: make all interfaces private
-    - interfaces/mount: spell unmount correctly
-    - tests: allow 16-X.Y.Z version of core snap
-    - the timezone_control interface only allows changing /etc/timezone
-      and /etc/writable/timezone. systemd-timedated also updated the
-      link of /etc/localtime and /etc/writable/localtime ... allow
-      access to this file too
-    - cmd/snap-confine: aggregate operations holding global lock
-    - api, ifacestate: resolve disconnect early
-    - interfaces/builtin: ensure we don't register interfaces twice
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 10 Aug 2017 12:43:16 +0200
-
-snapd (2.26.14) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cmd: fix incorrect re-exec when starting from snapd 2.21
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 20 Jul 2017 13:52:05 +0200
-
-snapd (2.26.13) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cmd,tests: fix classic confinement confusing re-execution code
-    - cmd: fix incorrect check check for re-exec in InternalToolPath()
-    - snap-seccomp: add secondary arch for unrestricted snaps as well
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 18 Jul 2017 20:34:33 +0200
-
-snapd (2.26.10) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - Fix snap-seccomp tests in artful/trusty on i386/s390x/aarch64
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 17 Jul 2017 11:58:22 +0200
-
-snapd (2.26.9) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - statically link libseccomp in snap-seccomp to fix refresh issue
-      on trusty
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 12 Jul 2017 08:27:14 +0200
-
-snapd (2.26.8) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - Fix snap-seccomp tests in artful/trusty on i386/s390x/aarch64
-    - add snapd.core-fixup.service unit
-    - ensure re-exec uses the right internal tools
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 05 Jul 2017 07:48:22 +0200
-
-snapd (2.26.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - interfaces: allow snaps to use the timedatectl utility in
-      time-control
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 27 Jun 2017 08:36:23 +0100
-
-snapd (2.26.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - backport of seccomp-bpf branch to the 2.26 release to ensure snap
-      revert with new seccomp syntax works correctly
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 26 Jun 2017 15:30:15 +0100
-
-snapd (2.26.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - partly revert aace15ab53 to unbreak core reverts
-    - Revert "interfaces: re-add reverted ioctl and quotactl (revert 21bc6b9f)"
-    - Disable "mknod |N" in the default seccomp template
-      reasons outline in https://forum.snapcraft.io/t/snapd-2-25-blocked-because-of-revert-race-condition
-    - errtracker: include bits of snap-confine apparmor profile
-    - errtracker: report if snapd did re-execute itself 
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 01 Jun 2017 18:50:52 +0200
-
-snapd (2.26.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cherry pick test fixes f0103a6, 9de5c8a, d7725a7 to make
-      sure the image tests are updated for the changes in the
-      `snap info core` output and the removal of the rsyslog
-      package from core.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 17 May 2017 11:31:56 +0200
-
-snapd (2.26.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cherry pick d444728 to make the uboot.env file parsing more
-      robust
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 16 May 2017 18:37:07 +0200
-
-snapd (2.26.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - store: fix panic error in auth
-    - tests: the new ubuntu-image snap needs classic confinement, adjust
-      tests
-    - cmd/snap-confine: don't fail on pre 3.8 kernel
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 May 2017 21:44:27 +0200
-
-snapd (2.26) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - timeutil: avoid panicking when the window is very small
-    - image: fix go vet issue
-    - overlord/ifacestate: don't spam logs with harmless auto-connect
-      messages
-    - interfaces/builtin: add network-status interface
-    - interfaces/builtin: add online-accounts-service interface
-    - interfaces/builtin: distribute code of touching allInterfaces
-    - interfaces: API additions for interface hooks
-    - interfaces/builtin: add storage-framework-service interface
-    - tests: disable create-key test on ppc64el for artful (expect not
-      working)
-    - snap: make `snap prepare-image --extra-snaps` derive side info
-    - tests: unify tests/{main/completion,completion}/lib.exp0
-    - cmd/snap: tweak info channels output
-    - interfaces: ensure that legacy interface methods are unused
-    - packaging: cleanup how built-using is generated
-    - tests: extend kernel-module-control interface test
-    - interfaces/network: workaround Go's need for NETLINK_ROUTE with
-      'net'.
-    - cmd/snap-confine: use defensive argument parser
-    - tests: add test for empty snap name on revert
-    - overlord/hookstate: remove unused Context.timeout
-    - tests: additional setup in docker test for core systems
-    - configstate: return error if patch is invalid
-    - interfaces: add random interface
-    - store, daemon, client, cmd/snap: handle PASSWORD_POLICY_ERROR
-    - cmd/snap, client: add "whoami" command
-    - cmd/snap: iterate interface tab completion
-    - snap: move locale-control to only be present on classic
-    - interfaces/browser-support: deny read on squashfs backing files
-      and LVM vg names
-    - tests: wait for the docker socket to be listening
-    - snap: add `snap refresh --time` option
-    - tests: re-enable and moderninze /media sharing test
-    - cmd: make rst2man optional
-    - tests: remove quoting from [[ ]] when globs
-    - interfaces: allow plugging DBus clients to introspect the slot
-      service
-    - packaging/ubuntu*/changelog: drop extra dash
-    - snap-confine: init the ENTRY variable, coverity is unhappy
-      otherwise
-    - cmd/snap-confine/spread-tests: discard useless --version test
-    - spread: add spread target qemu:debian-9-64
-    - interfaces: mediate netlink sockets via seccomp
-    - tests,cmd/snap-confine: port older snapd-discard-ns tests
-    - cmd/snap-confine/tests: fix shellcheck on recently added files
-    - tests/upgrade: force install core snap from beta for debian
-    - overlord/snapstate/backend,interfaces/mount: move ns management
-      code.
-    - tests: extend network-control spread test to cope with network
-      namespaces
-    - tests: fail early in the spread suite if trying to run it inside a
-      container
-    - tests: set ownership of $PROJECT_PATH for the external backend
-    - tests: specify the auto-refreshable snap being tested
-    - many: fix tests with go1.8 / artful
-    - fix for tests: debian does not have /snap/bin in secure_path so
-      sudo
-    - snap: support for snap tasks --last=...
-    - cmd/snap-confine: remove obsolete debug message
-    - address review feedback, add a lot of comments :-), call
-      shellcheck on the completion scripts, fix a bug in compopt
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 May 2017 10:05:44 +0200
-
-snapd (2.25) xenial; urgency=medium
-
-  * New upstream release, LP: #1686713
-    - interfaces/default: allow mknod for regular files, pipes and
-      sockets
-    - many: use "SNAP.APP as ALIAS" instead of => when listing
-      added/removed aliases
-    - cmd/snap-confine: write current mount profile
-    - cmd/snap-discard-ns: remove current profile when cleaning up
-    - many: support debian in our CI
-    - tests: tweak time for econnreset test a bit more
-    - cmd/snap-confine: re-enable re-assciate fix for CE
-    - many: aliases v2 cleanups
-    - cmd/snap-confine: don't use apparmor if it is disabled on boot
-    - many: implement `snap prefer <snap>`  (aliases v2)
-    - many: adjust /aliases and "snap aliases" to aliases v2, also some
-      cleanup
-    - snapstate: normalize gadget defaults
-    - many: allow core refresh.schedule setting
-    - many: show alias changes on snap alias/unalias (aliases v2)
-    - client,cmd/snap: improve messaging on --devmode and --classic
-    - many: implement `snap unalias <alias-or-snap>` (aliases v2)
-    - store: retry on connection reset
-    - interfaces/mount: add Change.Perform
-    - tests: add openvswitch interface spread test
-    - interfaces/i2c: allow modifying device-specific sysfs entries
-    - interfaces: allow writing to /run/systemd/journal/stdout by
-      default
-    - tests: ensure travis fails early if static checks fail
-    - store,daemon: make store interpret channel="" as stable in most
-      cases
-    - overlord/snapstate: make UpdateAliases idempotent, simplify the
-      backend interface bits for aliases not used anymore (aliases v2)
-    - many: implement snap alias <snap.app> <alias> (aliases v2)
-    - snap-confine: add code to ensure that / or /snap is mounted
-      "shared"
-    - many: show available "tracks" in `snap info`
-    - cmd/snap: make users Xauthority file available in snap environment
-    - interfaces/mount: write current fstab files with mode 0644
-    - overlord: switch to aliases v2 tasks for install/refresh etc ops
-      plus transition
-    - tests: parameterize gadget snap channel (#3117)
-    - tests: copy .real profile as .real
-    - tests: add empty initrd failover test
-    - many: mount squashfs as read-only
-    - cmd: make locking around namespaces explicit
-    - tests: address review comments from #3186
-    - tests: add dbus interface spread test
-    - interfaces/mount: add ReadMountInfo and LoadMountInfo
-    - snap: require snap name for 'revert'
-    - overlord: maintain per-revision snapshots of snap configuration
-    - tests: relax network-bind interface regexps
-    - interfaces: re-add reverted ioctl and quotactl (revert 21bc6b9f)
-    - store: retry once on hashsum mismatches in a Download()
-    - interfaces/builtin: don't panic if content plug has nil attrs
-    - interfaces/mount: pass mount.Profile to mount.NeededChanges
-    - packaging: add `built-using` header for 16.04 packaging
-    - interfaces: add media-hub interface
-    - interfaces/builtin: allow full access to properties iface of the
-      udisks service
-    - tests: handle case when both .real and plain are present
-    - interfaces/mount: add Change.String for readable output
-    - tests: ensure we mock force dev mode as well to fix FTBFS in
-      sbuild
-    - store: add more logs around retry in download
-    - interfaces/mount: add stub Change.{Needed,Perform}
-    - tests: allow installing snapd from -proposed for SRU validation
-    - interfaces/mount: parse mount options to map[string]string
-    - snap: added tasks subcommand
-    - tests: copy snap-confine apparmor profile into testbed
-    - interfaces/mount: improve go identifier names of mountinfo, parse
-      optional fields
-    - Arch Linux wants to respect FHS
-      (https://bugs.archlinux.org/task/53656),
-    - daemon: do not set RemoveSnapPath flag when doing a try
-    - debian: add maintscript helper to remove usr.lib.snapd.snap-
-      confine in snap-confine
-    - cmd/snap-confine: don't use plain "classic" term
-    - cmd/snap-confine: set TMPDIR and TEMPDIR each time
-    - many: fixes for `go vet` in go 1.7
-    - tests: add kernel-module-control interface test
-    - overlord/snapstate: introduce tasks for aliases v2 semantics with
-      temporary names for now (aliases v2)
-    - overlord/devicestate: switch to ssh-keygen for device key
-      generation
-    - snap: skip /dev/ram from auto-import assertions to make it less
-      noisy (#3010)
-    - interfaces: add kubernetes-support interface and adjust related
-      interfaces (LP: #1664638)
-    - tests: download previous snapd package from published versions
-      instead of specific PPA
-    - snap: run snap-confine from core if snap is also running from core
-    - overlord/ifacestate: automatically rename connections on core snap
-    - many: break the /aliases mutation API with a clean 400 (aliases
-      v2)
-    - interfaces/builting: allow read-only access to /sys/module
-    - tests: add extra test after the core transition for snap get/set
-      core
-    - store: misc cleanups in tests
-    - interfaces/mount: add parser for mountinfo entries
-    - store: tests for unexpected EOF
-    - tests: fix unity test
-    - interfaces,overlord: log interface auto-connection failures
-    - cmd/snap-update-ns: add C preamble for setns
-    - interfaces: validate plug/slot uniqueness
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 28 Apr 2017 07:57:49 +0200
-
-snapd (2.24.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1681799:
-    - fix autopkgtest failures with stable core snap
-    - ensure the snap-confine transitional package cleans up
-      the no-longer-used apparmor profile to fix the kernels
-      autopkgtest failures
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 19 Apr 2017 11:54:33 +0200
-
-snapd (2.24) xenial; urgency=medium
-
-  * New upstream release, LP: #1681799:
-    - interfaces/mount: add InfoEntry type
-    - many: fix plug auto-connect during core transition
-    - interfaces: fold network bind into core support with tests
-    - .travis.yml: add option to make raw log less noisy
-    - interfaces: adjust shm accesses to use 'm' for updated mmap kernel
-      mediation
-    - many: rename two core plugs that clash with slot names
-    - snap-confine,browser-support: /dev/tty for snap-confine, misc
-      browser-support for gnome-shell
-    - store: add download test with EOF in the middle
-    - tests: adjust to look for network-bind-plug
-    - store: make hash error message more accurate
-    - overlord/snapstate: simplify AliasesStatus down to just an
-      AutoAliasesDisabled bool flag (aliases v2)
-    - errtracker: never send errtracker reports when running under
-      SNAPPY_TESTING
-    - interfaces/repo: validate slot/plug names
-    - daemon: Give the snap directories via GET /v2/system-info
-    - interfaces/unity7: support unity messaging menu
-    - interfaces/mount: add high-level Profile functions
-    - git: ignore only the cmd/Makefile{,.in}
-    - cmd: explicitly set _GNU_SOURCE and _FILE_OFFSET_BITS for xfs
-      support
-    - daemon: add desktop file location for app to the API
-    - overlord,release: disable classic snap support when not possible
-    - overlord: fix TestEnsureLoopPrune not to be so racy
-    - many: abstract path to /bin/{true,false}
-    - data/systemd: tweak data/systemd/Makefile to be slightly simpler
-    - store: handle EOF via url.Error check
-    - packaging: use templates for relevant systemd units
-    - tests: run gccgo only on ubuntu-16.04-64
-    - .travis.yml: remove travis matrix and do a single sequential run
-    - overlord/state: make sure that setting to nil a state key is
-      equivalent to deleting it
-    - tests: fix incorrect shell expression
-    - interfaces/mount: add OptsToFlags for converting arguments to
-      syscall…
-    - interfaces: add a joystick interface
-    - tests: enable docker test for more ubuntu-core systems
-    - tests: download and install additional dependencies when using
-      prepackaged snapd
-    - many: add support for partially static builds
-    - interfaces: allow slot to introspect dbus-daemon in dbus
-      interface, allow /usr/bin/arch by default
-    - interfaces/mount: fix golint issues
-    - interfaces/mount: add function for saving fstab-like file
-    - osutil: introducing GetenvInt64, like GetenvBool but Int64er.
-    - interfaces: drop udev tagging from framebuffer interface
-    - snapstate: more helpers to work with aliases state (aliases
-      v2)
-    - interfaces/mount: add function for parsing fstab-like file
-    - cmd: disable the re-associate fix as requested by jdstrand
-    - overlord/snapstate: unlock/relock the state less, especially not
-      across mutating the SnapState of a snap
-    - interfaces: allow executing ld.so (needed with new AppArmor base
-      abstraction)
-    - interfaces/mount: add function for parsing mount entries
-    - cmd: rework header check for xfs/xqm.h
-    - cmd: add poky to the list of distros which don't support reexec
-    - overlord: finish reorg, revert "be more conservative until we have
-      cut 2.23.x"
-    - cmd: select what socket to use in cmd/snap{,ctl}
-    - overlord: remove snap config values when snap is removed
-    - snapstate: introduce helper to apply to disk a alias states change
-      for a snap (aliases v2)
-    - configstate,hookstate: timeout the configure hook after 5 mins,
-      report failures to the errtracker
-    - interfaces/seccomp: add bind as part of the default seccomp policy
-      for hooks
-    - cmd: discard the C implementation of snap-update-ns
-    - tests: remove stale apt proxy leftover from cloud-init
-    - tests: move unity test to nightly suite
-    - interfaces: add support for location-observe for
-      dbus::ObjectManager session paths
-    - boot: log error in KernelOrOsRebootRequired
-    - interfaces: remove old API
-    - interfaces: use udev spec
-    - interfaces: convert systemd backend to new APIs
-    - osutil: add BootID
-    - tests: move docker test to new nightly suite
-    - interfaces/mount: compute mount changes required to transition
-      mount profiles
-    - data/selinux: add context definition for snapctl
-    - overlord: clean up organization under state packages
-    - overlord: make sure all managers packages have *state.go with the
-      main state manipulation/query APIs
-    - interfaces: use spec in the dbus backend
-    - store: download from authenticated URL if there is a device
-      session set
-    - tests: remove core_name variable
-    - interfaces: rename thumbnailer to thumbnailer-service
-    - interfaces: add chroot to base templates
-    - asserts: remove some unused things
-    - systemd: mount the squashfs with nodev
-    - overlord: when shutting down assume errors might be due to
-      cancellation so retry
-    - cmd: rename all unit tests to $command/unit-test
-    - cmd/snap: fix help string for version command
-    - asserts: don't allow revocations with other items for the same
-      developer
-    - tests: skip lp-1644439 test on older kernels
-    - interfaces: allow "sync" to be used by core support
-    - assertstate,snapstate: have assertstate.AutoAliases use the
-      "aliases" header
-    - interfaces: allow writing config.txt.tmp  in the core-support
-      interface
-    - tests: adjust network-bind test
-    - interfaces: dbus backend spec
-    - asserts: introduce a snap-declaration "aliases" header to list
-      auto aliases with explicit targets
-    - cmd: enable large file support
-    - cmd/snap: handle missing snap-confine
-    - cmd/snap-confine: re-associate with pid-1 mount namespace if
-      required
-    - cmd/libsnap: make mountinfo structures public
-    - tests: fix interfaces-cups-control for zesty
-    - misc: revert "Log if the system goes into ForceDevMode"
-    - interfaces: seccomp tests cleanup
-    - cmd: validate SNAP_NAME
-    - interfaces: log if the system goes into ForceDevMode
-    - tests: fix classic-ubuntu-core-transition race
-    - interfaces: use apparmor spec in the apparmor backend
-    - interfaces: alphabetize framebuffer in base decl and add it to
-      all_test.go
-    - tests: add ubuntu-core-16-32 system to the external backend and
-      fix docker test
-    - cmd/libsnap: simplify sc_string_quote default case
-    - osutil: fix double expand in environment map code and add test
-    - interfaces: extend location-control out-of-process provider
-      support
-    - cmd/snap-update-ns: use bidirectional lists for mount entries
-    - tests: prevent automatic transition before setting the initial
-      state of the test
-    - release: detect if we are in ForcedDevMode by inspecting the
-      kernel
-    - tests: add core-snap-refresh test
-    - interfaces: add maliit input method interface
-    - interfaces: seccomp spec API tweaks for better tests
-    - interfaces: updates for mir-kiosk in browser-support, mir, opengl,
-      unity7
-    - testutils: address review feedback from PR#2997
-    - tests: specify the core version to be unsquashfs'ed in the
-      failover tests
-    - interfaces: use MockInfo in tests
-    - cmd/libsnap: add sc_quote_string
-    - cmd/snap-confine: use sc_do_umount everywhere
-    - interfaces: add unity8 plug permissions
-    - timeutil: a few helpers for the recurring events
-    - asserts: implement snap-developer type
-    - partition: deal with grub{,2}-editenv in tests
-    - many: add new (hidden) `snap debug ensure-state-soon` command and
-      use in tests
-    - interfaces/builtin: small refactor of dbus tests
-    - packaging, tests: use "systemctl list-unit-files --full"
-      everywhere
-    - many: some opensuse patches that are ready to go into master
-    - packaging: add opensuse permissions files
-    - client, daemon: move "snap list" name filtering into snapd.
-    - interfaces: use seccomp specs
-    - overlord/snapstate: small cleanup of
-      ensureForceDevmodeDropsDevmodeFromState
-    - interfaces/builtin/alsa: add read access to alsa state dir
-    - interfaces: use spec in kmod backend, updated firewall_control,
-      openvswitch_support, ppp
-    - cmd/snap-confine: use sc_do_mount everywhere
-    - tests: remove workaround for docker again, snap-declaration is
-      fixed now
-    - interfaces: interface to allow autopilot introspection
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 11 Apr 2017 13:31:46 +0200
-
-snapd (2.23.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - cmd: use the most appropriate snap/snapctl sockets
-    - tests: fix interfaces-cups-control for zesty
-    - configstate,hookstate: timeout the configure hook after 5 mins,
-      report failures
-    - packaging: rename the file shipping snap-confine AA profile to
-      workaround dpkg bug #858004
-    - many: ignore configure hook failures on core refresh to ensure
-      upgrades are always possible
-    - snapstate: restart as needed if we undid unlinking aka relinked
-      core or kernel snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Mar 2017 15:30:35 +0200
-
-snapd (2.23.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - allow "sync" in core-support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Mar 2017 18:13:43 +0100
-
-snapd (2.23.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - fix core-support interface for the new pi-config options
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Mar 2017 16:05:57 +0100
-
-snapd (2.23.3) xenial; urgency=medium
-
-  * FTBFS due to missing files in vendor/
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Thu, 16 Mar 2017 19:56:55 +0100
-
-snapd (2.23.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - cmd/snap: handle missing snap-confine (#3041)
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Thu, 16 Mar 2017 19:38:24 +0100
-
-snapd (2.23.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1665608
-    - packaging, tests: use "systemctl list-unit-files --full"
-      everywhere
-    - interfaces: fix default content attribute value
-    - tests: do not nuke the entire snapd.conf.d dir when changing
-      store settings
-    - hookstate: run the right "snap" command in the hookmanager 
-    - snapstate: revert PR#2958, run configure hook again everywhere
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 08 Mar 2017 14:29:56 +0100
-
-snapd (2.23) xenial; urgency=medium
-
-  * New upstream release, LP: #1665608
-    - overlord: phase 2 with 2nd setup-profiles and hook done after
-      restart for core installation
-    - data: re-add snapd.refresh.{timer,service} with weekly schedule
-    - interfaces: allow 'getent' by default with some missing dbs to
-      various interfaces
-    - overlord/snapstate: drop forced devmode
-    - snapstate: disable running the configure hook on classic for the
-      core snap
-    - ifacestate: re-generate apparmor in InterfaceManager.initialize()
-    - daemon: DevModeDistro does not imply snapstate.Flags{DevMode:true}
-    - interfaces/bluez,network-manager: implement ConnectedSlot policy
-    - cmd: add helpers for mounting / unmounting
-    - snapstate: error in LinkSnap() if revision is unset
-    - release: add linuxmint 18 to the non-devmode distros
-    - cmd: fixes to run correctly on opensuse
-    - interfaces: consistently use 'const' instead of 'var' for security
-      policy
-    - interfaces: miscellaneous policy updates for unity7, udisks2 and
-      browser-support
-    - interfaces/apparmor: compensate for kernel behavior change
-    - many: only tweak core config if hook exists
-    - overlord/hookstate: don't report a run hook output error without
-      any context
-    - cmd/snap-update-ns: move test data and helpers to new module
-    - vet: fix vet error on mount test.
-    - tests: empty init (systemd) failover test
-    - cmd: add .indent.pro file to the tree 
-    - interfaces: specs for apparmor, seccomp, udev
-    - wrappers/services: RemainAfterExit=yes for oneshot daemons w/ stop
-      cmds
-    - tests: several improvements to the nested suite
-    - tests: do not use core for "All snaps up to date" check
-    - cmd/snap-update-ns: add function for sorting mount entries
-    - httputil: copy some headers over redirects
-    - data/selinux: merge SELinux policy module
-    - kmod: added Specification for kmod security backend
-    - tests: failover test for rc.local crash
-    - debian/tests: map snapd deb pockets to core snap channels for
-      autopkgtest
-    - many: switch channels on refresh if needed
-    - interfaces/builtin: add /boot/uboot/config.txt access to core-
-      support
-    - release: assume higher version of supported distros will still
-      work 
-    - cmd/snap-update-ns: add compare function for mount entries
-    - tests: enable docker test
-    - tests: bail out if core snap is not installed
-    - interfaces: use mount.Entry instead of string snippets.
-    - osutil: trivial tweaks to build ID support
-    - many: display kernel version in 'snap version'
-    - osutil: add package for reading Build-ID
-    - snap: error when `snap list foo` is run and no snap is installed
-    - cmd/snap-confine: don't crash if nvidia module is loaded but
-      drivers are not available
-    - tests: update listing test for latest core snap version update
-    - overlord/hookstate/ctlcmd: helper function for creating a deep
-      copy of interface attributes
-    - interfaces: add a linux framebuffer interface
-    - cmd/snap, store: change error messages to reflect latest UX doc
-    - interfaces: initial unity8 interface
-    - asserts: improved information about assertions format in the
-      Decode doc comment
-    - snapstate: ensure snapstate.CanAutoRefresh is nil in tests
-    - mkversion.sh: Add support for taking the version as a parameter
-    - interfaces: add an interface for use by thumbnailer
-    - cmd/snap-confine: ensure that hostfs is root owned.
-    - screen-inhibit-control: add methods for delaying screensavers
-    - overlord: optional device registration and gadget support on
-      classic
-    - overlord: make seeding work also on classic, optionally
-    - image,cmd/snap: refactoring and initial envvar support to use
-      stores needing auth
-    - tests: add libvirt interface spread test
-    - cmd/libsnap: add helper for dropping permissions
-    - interfaces: misc updates for network-control, firewall-control,
-      unity7 and default policy
-    - interfaces: allow recv* and send* by default, accept4 with accept
-      and other cleanups
-    - interfaces/builtin: add classic-support interface
-    - store: use xdelta3 from core if available and not on the regular
-      system
-    - snap: add contact: line in `snap info`
-    - interfaces/builtin: add network-setup-control which allows rw
-      access to netplan
-    - unity7: support missing signals and methods for status icons
-    - cmd: autoconf for RHEL
-    - cmd/snap-confine: look for PROCFS_SUPER_MAGIC
-    - dirs: use the right snap mount dir for the distribution
-    - many: differentiate between "distro" and "core" libexecdir
-    - cmd: don't reexec on RHEL family
-    - config: make helpers reusable
-    - snap-exec: support nested environment variables in environment
-    - release: add galliumos support
-    - interfaces/builtin: more path options for serial
-    - i18n: look into core snaps when checking for translations
-    - tests: nested image testing
-    - tests: add basic test for docker
-    - hookstate,ifacestate: support snapctl set/get slot and plug attrs
-      (step 3) 
-    - cmd/snap: add shell completion to connect
-    - cmd: add functions to load/save fstab-like files
-    - snap run: create "current" symlink in user data dir
-    - cmd: autoconf for centos
-    - tests: add more debug if ubuntu-core-upgrade fails
-    - tests: increase service retries
-    - packaging/ubuntu-14.04: inform user how to extend PATH with
-      /snap/bin.
-    - cmd: add helpers for working with mount/umount commands
-    - overlord/snapstate: prepare for using snap-update-ns
-    - cmd: use per-snap mount profile to populate the mount namespace
-    - overlord/ifacestate: setup seccomp security on startup
-    - interface/seccomp: sort combined snippets
-    - release: don't force devmode on LinuxMint "serena"
-    - tests: filter ubuntu-core systems for authenticated find-private
-      test
-    - interfaces/builtin/core-support: Allow modifying logind
-      configuration from the core snap
-    - tests: fix "snap managed" output check and suppress output from
-      expect in the authenticated login tests
-    - interfaces: shutdown: also allow shutdown/reboot/suspend via
-      logind
-    - cmd/snap-confine-tests: reformat test to pass shellcheck
-    - cmd: add sc_is_debug_enabled
-    - interfaces/mount: add dedicated mount entry type
-    - interfaces/core-support: allow modifying systemd-timesyncd and
-      sysctl configuration
-    - snap: improve message after `snap refresh pkg1 pkg2`
-    - tests: improve snap-env test
-    - interfaces/io-ports-control: use /dev/port, not /dev/ports
-    - interfaces/mount-observe: add quotactl with arg filtering (LP:
-      #1626359)
-    - interfaces/mount: generate per-snap mount profile
-    - tests: add spread test for delta downloads
-    - daemon: show "$snapname (delta)" in progress when downloading
-      deltas
-    - cmd: use safer functions in sc_mount_opt2str
-    - asserts: introduce a variant of model assertions for classic
-      systems
-    - interfaces/core-support: allow modifying snap rsyslog
-      configuration
-    - interfaces: remove some syscalls already in the default policy
-      plus comment cleanups
-    - interfaces: miscellaneous updates for hardware-observe, kernel-
-      module-control, unity7 and default
-    - snap-confine: add the key for which hsearch_r fails
-    - snap: improve the error message for `snap try`
-    - tests: fix pattern and use MATCH in find-private
-    - tests: stop tying setting up staging store access to the setup of
-      the state tarball
-    - tests: add regression spread test for #1660941
-    - interfaces/default: don't allow TIOCSTI ioctl
-    - interfaces: allow nice/setpriority to 0-19 values for calling
-      process by default
-    - tests: improve debug when the core transition test hangs
-    - tests: disable ubuntu-core->core transition on ppc64el (its just
-      too slow)
-    - snapstate: move refresh from a systemd timer to the internal
-      snapstate Ensure()
-    - tests/lib/fakestore/refresh: some more info when we fail to copy
-      asserts
-    - overlord/devicestate: backoff between retries if the server seems
-      to have refused the serial-request
-    - image: check kernel/gadget publisher vs model brand, warn on store
-      disconnected snaps
-    - vendor: move gettext.go back to github.com/ojii/gettext.go
-    - store: retry on 502 http response as well
-    - tests: increase snap-service kill-timeout
-    - store,osutil: use new osutil.ExecutableExists(exe) check to only
-      use deltas if xdelta3 is present
-    - cmd: fix autogen.sh on fedora
-    - overlord/devicemgr: fix test: setup account-key before using the
-      key for signing
-    - cmd: add /usr/local/* to PATH
-    - cmd: add sc_string_append
-    - asserts: support for correctly suggesting format 2 for snap-
-      declaration
-    - interfaces: port mount backend to new APIs, unify content of per
-      app/hook profiles
-    - overlord/devicestate: implement policy about gadget and kernel
-      matching the model
-    - interfaces: allow sched_setscheduler again by default
-    - debian: update breaks/replaces for snap-confine->snapd
-    - debian: move the snap-confine packaging into snapd
-    - 14.04/integrationtests: rely on upstart to restart ssh.
-    - store: enable download deltas on classic by default
-    - spread: add unit suite
-    - snapctl: add config in client to disable auth and use it in
-      snapctl
-    - overlord/ifacestate: register all security backends with the
-      repository
-    - overlord,tests: have enable/disable affect security profiles
-    - tests: install ubuntu-core from the same channel as core
-    - overlord: move configstate.Transaction into config package
-    - seccomp-support.c: add PF_* domains which can be used instead of
-      AF_*
-    - store: always log retry summary when SNAPD_DEBUG is set
-    - tests: parameterize kernel snap channel
-    - snapenv: do not append ":" to the SNAP_LIBRARY_PATH
-    - interfaces/builtin: refine the content interface rules using $SLOT
-    - asserts,interfaces/policy: add support for
-      $SLOT()/$PLUG()/$MISSING in *-attributes constraintsThis adds
-      support for $SLOT(arg), $PLUG(arg) and $MISSING attribute
-      constraints in plugs and slots rules in snap-declarations:
-    - cmd/snap-confine: add snap-confine command line parser module
-    - tests: remove (some) garbage files found by restore cleanup
-      analysis
-    - cmd: fix issues uncovered by valgrind
-    - tests: fix typo in systems name
-    - cmd: collect string utilities in one module, add missing tests
-    - cmd: rename mountinfo to sc_mountinfo
-    - tests: allow to install snapd debs from a ppa instead of building
-      them
-    - spread: remove state tar on project restore
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Feb 2017 12:21:42 +0100
-
-snapd (2.22.7) xenial; urgency=medium
-
-  * New upstream release:
-    - errtracker,overlord/snapstate: more info in errtracker reports
-    - interfaces/apparmor: compensate for kernel behavior change
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 24 Feb 2017 19:24:11 +0100
-
-snapd (2.22.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1667105
-    - overlord/ifacestate: don't fail if affected snap is gone
-    - revert #2910: osutil: add package for reading Build-ID (#2918)
-    - errtracker: include the build-id of host and core snapd (#2912)
-    - errtracker: include the number of ubuntu-core -> core retries
-      (#2915)
-    - snapstate: retry ubuntu-core -> core transition every 6h (#2914)
-    - osutil: add package for reading Build-ID (#2910)
-    - errtracker: include kernel version in error reports (#2905)
-    - release: return "unknown" if uname fails
-    - many: rebased uname branch for 2.22
-    - errtracker: include snapd version in err reports
-    - overlord/ifacestate: don't unconditionally retry stuff (#2906)
-    - snapstate: fix incorrect cut of the timestamps for the error
-      reports (#2908)
-    - tests: update listing test for latest core snap version update
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Wed, 22 Feb 2017 23:34:23 +0100
-
-snapd (2.22.5) xenial; urgency=medium
-
-  * Fix FTBFS due to machine-id file
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Tue, 21 Feb 2017 09:43:42 +0100
-
-snapd (2.22.4) xenial; urgency=medium
-
-  * New bugfix release:
-    - errtracker: add support for error reporting via daisy.ubuntu.com
-    - snapstate: allow for 6 retries for the core transition
-    - httputils: ensure User-Agent works across redirects
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 21 Feb 2017 09:07:10 +0100
-
-snapd (2.22.3) xenial; urgency=medium
-
-  * New bugfix release, LP: #1665729:
-    - Limit the number of retries for the ubuntu-core -> core
-      transition to fix possible store overload.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Feb 2017 18:58:34 +0100
-
-snapd (2.22.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1659522
-    - cherry pick fix for sched_setscheduler regression
-      (LP: #1661265)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 02 Feb 2017 17:13:51 +0100
-
-snapd (2.22.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1659522
-    - cherry pick fix for snapctl auth.json handling
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 01 Feb 2017 17:09:31 +0100
-
-snapd (2.22) xenial; urgency=medium
-
-  * New upstream release, LP: #1659522
-    - many: make ubuntu-core-launcher mostly go
-    - interfaces/builtin: add account-control interface
-    - interfaces/builtin: add missing syscalls to core-support needed
-      for systemctl
-    - interfaces/builtin: rework core-support to only allow full access
-      to systemctl
-    - debian/tests: drop stale autopkgtest dependencies.
-    - tests: make the debugging of c-unit-tests more useful
-    - store: retry auth-related requests
-    - tests: integration test for system reload
-    - snap: be more helpful in the `snap install <already-installed>`
-      error message
-    - tests: set SNAPPY_USE_STAGING_STORE in su call
-    - tests: use test snap
-    - spread: set SNAPD_DEBUG=1 in the core snap as well
-    - tests: add extra debugging to security-setuid-root test
-    - cmd,snap,wrappers: systemd reload command support
-    - interfaces: builtin: mir: Allow recv and send
-    - overlord/ifacestate: use ParseConnRef
-    - overlord/snapstate,overlord/ifacestate: add automatic ubuntu-core
-      -> core transition
-    - debian: remove aliases as well in snapd.postrm
-    - many: change interfaces.ParseID to return value
-    - interfaces/opengl: allow access to the nvidia abstract socket
-    - overlord, daemon: flag failures feature fancy forms.
-    - many: add --classic support to try and revert, and make missing
-      these things a little harder
-    - interfaces: allow reading non-PCI-attached usb devices via raw-usb
-    - many: rename snap-alter-ns to snap-update-ns
-    - interfaces/builtin: add core-support
-    - store: increase the retry.LimitTime()
-    - debian: move the packaging out into package/$id-$version_id
-    - overlord/stapstate: don't use unkeyed fields
-    - many: add stub implementation of snap-alter-ns
-    - asserts: improve error message when key is not valid at the given
-      time
-    - snapstate, ifacestate: add snapstate.CheckChangeConflict() to
-      ifacestate.{Connect,Disconnect}
-    - debian: remove trusty specific bits
-    - docs: Add a note about building snapd.
-    - interfaces: miscellaneous updates for default and network-control
-    - daemon: bubble out store.ErrSnapNotFound in the findOne codepath
-    - store: add retry logging into download as well
-    - snap: show price in `snap info`
-    - cmd: add fault injection support code
-    - interfaces: network-manager: allow rw access to /etc/netplan
-    - debian: move systemd files out of ./debian and into ./data/systemd
-    - asserts: implement SuggestFormat to help avoid specifying the
-      wrong format iteration for an assertion
-    - many: detect potentially insecure use of snap-confine
-    - interfaces: allow querying added security backends
-    - cmd: ensure that all .c files have a -test.c file
-    - asserts: don't use 'context' for the path of attributes, want to
-      reuse the concept for something else
-    - interfaces: abbreviate ConnRef construction
-    - tests: ensure systemd override directory is available before using
-      it
-    - cmd: more build system cleanups and a small fix
-    - tests: increase retries for service up
-    - cmd: move seccomp cleanup function to seccomp-support
-    - many: auto-connect plugs and slots symmetrically
-    - overlord: use a ticker for the pruning
-    - interfaces/builtin: add uhid interface
-    - cmd/snap-confine: add shutdown helper
-    - tests: fix path used when debugging
-    - cmd: switch to non-recursive make
-    - overlord/ifacestate: setup security of snaps affected by auto-
-      connection
-    - spread: refresh apt cache before first install
-    - overlord: allow max 500 changes in "ready" state to avoid growing
-      changes for 24h
-    - snap: add {Plug,Slot}Info.SecurityTags
-    - cmd: move snap-discard-ns to dedicated directory
-    - tests: skip i18n test when no "snappy.mo" file is available
-    - interfaces,overlord/ifacestate: small refactor around reference
-      methods
-    - tests: remove the snapd dirs last (should fix random test errors)
-    - interfaces: mm: permissions for protocol proxies
-    - interfaces/builtin: add evolution interfaces
-    - many: extract the logging http client and user-agent handling for
-      use in devicestate
-    - interfaces: unity8-download-manager is the chosen name for this
-      interface.
-    - tests: add "quiet" wrapper function that only prints output on
-      failure
-    - tests: fix failing snapd-reexec test
-    - docs: simplify HACKING.md that snapd itself supports setting up
-      the sockets
-    - overlord: flag required-snaps from model as required and prevent
-      removing them
-    - spread: exclude .o and .a files
-    - tests: parameterize remote store
-    - cmd: fix hardcoded paths to rst2man and support rst2man.py
-    - tests: improve debug output when reexec is used
-    - tests: disable ipv6 before unpacking delta
-    - interfaces: add new interface API
-    - tests: change TRUST_TEST_KEYS to be controlled from the host
-    - spread: add boilerplate for Linode delta uploads
-    - wrappers: add support for the X-Ayatana-Desktop-Shortcuts=
-      extension
-    - partition: add support for native grubenv read/write and use it
-    - tests: add test ensuring manual pages are shipped
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 27 Jan 2017 23:18:57 +0100
-
-snapd (2.21) xenial; urgency=medium
-
-  * New upstream release, LP: #1656382
-    - daemon: re-enable reexec
-    - interfaces: allow reading installed files from previous revisions
-      by default
-    - daemon: make activation optional
-    - tests: run all snap-confine tests in c-unit-tests task
-    - many: fix abbreviated forms of disconnect
-    - tests: switch more tests to MATCH
-    - store: export userAgent. daemon: print store.UserAgent() on
-      startup.
-    - tests: test classic confinement `snap list` and  `snap info`
-      output
-    - debian: skip snap-confine unit tests on nocheck
-    - overlord/snapstate: share code between Update and UpdateMany, so
-      that it deals with auto-aliases correctly
-    - interfaces: upower-observe: refactor to allow snaps to provide a
-      slot
-    - tests: add end-to-end store test for classic confinement
-    - overlord,overlord/snapstate: have UpdateMany retire/enable auto-
-      aliases even without new revision
-    - interfaces/browser-support: add @{PROC}/@{pid}/fd/[0-9] w and misc
-      /run/udev
-    - interfaces/builtin: add physical-memory-* and io-ports-control
-    - interfaces: allow getsockopt by default since it is so commonly
-      used
-    - cmd/snap, daemon, overlord/snapstate: tests and fixes for "snap
-      refresh" of a classic snap
-    - interfaces: allow read/write access of real-time clock with time-
-      control interface
-    - store: request no CDN via a header using SNAPPY_STORE_NO_CDN
-      envvar
-    - snap: add information about tracking channel (not just actual
-      channel)
-    - interfaces: use fewer dot imports
-    - overlord/snapstate: remove restrictions on ResetAliases
-    - overlord, store: move confinement filtering to the overlord (from
-      The Store)
-    - many: move interface test helpers to ifacetest package
-    - many: implement 'snap aliases'
-    - vet: fix for unkeyed fields error on aliases_test.go
-    - interfaces: miscellaneous policy updates for network-control,
-      unity7, pulseaudio, default and home
-    - tests: test for auto-aliases
-    - interface hooks: connect plug slot hooks (step 2)
-    - cmd/snap: fix internal naming in snap connect
-    - snap: use "size" as the json tag in snap.ChannelSnapInfo
-    - tests: restore the missing initialization of iface manager causing
-      race
-    - snap: fix missing sizes in `snap info <remote-snap>`
-    - tests: improve cleanup for c-unit-tests
-    - cmd/snap-confine: build non-installed libsnap-confine-private.a
-    - cmd/snap-confine: small tweaks to seccomp support code
-    - interfaces/docker-support: allow /run/shm/aufs.xeno for 14.04
-    - many: obtain installed snaps developer/publisher username through
-      assertions
-    - store: setting of fields for details endpoint
-    - cmd/snap-confine: check for rst2man on configure
-    - snap: show `snap --help` output when just running `snap`
-    - interface/builtin: drop the obsolete checks in udisks2
-      SanitizeSlot
-    - cmd/snap: remove currency switch following UX review
-    - spread: find top-level directory before running generate-
-      packaging-dir
-    - interface hooks: prepare plug slot hooks (step 1)
-    - i18n: use github.com/mvo5/gettext.go (pure go) for i18n to avoid
-      cgo
-    - many: put a marker in the User-Agent sent by snapd/snap when under
-      testingThe User-Agent will look like:
-    - tests: fix -reuse and -resend when govendor is missing
-    - snap: provide friendlier `snap find` message when no snaps are
-      found
-    - tests: fix mkversions.sh failure on zesty
-    - spread: install build-essential unconditionally
-    - spread: improve qemu ubuntu-14.04-{32,64} support
-    - overlord/snapstate,daemon: implement GET /v2/aliases handling
-    - store: retry user info request
-    - tests: port more snap-confine regression tests
-    - tests: cancel the scheduled reboot on ubuntu-core-upgrade-no-gc
-      and restore state
-    - tests: debug zesty autopkgtest failures
-    - overlord/snapstate: use keyed fields on literals
-    - tests: use MATCH in install-remove-multi
-    - tests: increase wait time for service to be up
-    - tests: make debug-each succeed if DENIED doesn't match
-    - tests: skip packaging dir generation for non-git based autopkgtest
-      runs
-    - tests: port refresh-all-undo to MATCH
-    - tests: improve snap connect test
-    - tests: port additional snap-confine regression tests
-    - tests: show --version when it matches unknown
-    - tests: optionally use apt proxy for qemu
-    - tests: add hello-classic test
-    - many: behave more consistently when pointed to staging and
-      possibly the fake store
-    - overlord/ifacestate: remove stale comments
-    - interfaces/apparmor: ignore snippets in classic confinement
-    - tests: port first regression test from snap-confine
-    - cmd/snap-confine: disable old tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 13 Jan 2017 19:39:51 +0100
-
-snapd (2.20.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1648520
-    - tests: enable the ppc64el tests again
-    - tests: add classic confinement test
-    - tests: run snap confine tests in debian/rules already
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 19 Dec 2016 11:53:29 +0100
-
-snapd (2.20) xenial; urgency=medium
-
-  * New upstream release, LP: #1648520
-    - many: implement  "snap alias --reset" using snapstate.ResetAliases
-    - debian: use a packaging branch for 14.04
-    - store: retry downloads on io.Copy errors and sha3 checksum errors
-    - snap: show apps in `snap info`
-    - store: send an explicit X-Ubuntu-Classic header to the store
-    - overlord/snapstate: implement snapstate.ResetAliases
-    - interfaces/builtin: add dbus interface
-    - tests: fix tests on 17.04
-    - store: use mocked retry strategy to make store tests faster
-    - overlord: apply auto-aliases information from the snap-declaration
-      on install or refresh
-    - many: prepare landing on trusty
-    - many: implement snap unalias using snapstate.Unalias
-    - overlord/snapstate: fixing the placement/grouping of some
-      functions
-    - interfaces: support network namespaces via 'ip netns' in network-
-      control
-    - interfaces/builtin: fix pulseaudio apparmor rules
-    - interfaces/builtin: add iio interface
-    - tests: update custom core snap with the freshly build snap-confine
-    - interfaces: use sysd.{Disable,Stop} instead of sysd.DisableNow()
-    - overlord,overlord/snapstate: implement snapstate.Unalias by
-      generalizing the "alias" task
-    - interfaces: misc openstack snap enablement
-    - cmd/snap: mock terminal.ReadPassword instead of using /dev/ptmx
-    - notifications, daemon: kill the unsupported events endpoint
-    - client: only allow Dangerous option in InstallPath
-    - overlord/ifacestate: no interface checks if no snap id
-    - many: implement alias command
-    - snap: tweak snap install output as designed by Mark
-    - debian: fix Pre-Depends on dpkg
-    - tests: check if snap-confine --version is unknown
-    - cmd/snap-confine: allow content interface mounts
-    - tests: remove ppa:snappy-dev/image again
-    - interfaces/apparmor: allow access to core snap
-    - tests: remove snap-confine/ubuntu-core-launcher after the tests
-    - overlord,overlord/snapstate: implement snapstate.Alias
-    - cmd/snap: reject "snap disconnect foo"
-    - debian: add split ubuntu-core-launcher and snap-confine packages
-    - cmd: fix mkversion.sh and add regression test
-    - overlord/snapstate: setup/remove aliases as we link/unlink snaps
-    - cmd/snap,tests: alias support in snap run
-    - snap/snapenv: don't obscure HOME if snap uses classic confinement
-    - store: decode response.Body json inside retry loops
-    - cmd/snap-confine: fix compilation on platforms with gcc < 4.9.0
-    - vendor: update tomb package fixing context support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 15 Dec 2016 22:07:08 +0100
-
-snapd (2.19) xenial; urgency=medium
-
-  * New upstream release, LP: #1648520
-    - cmd/snap-confine: disable support for XDG_RUNTIME_DIR
-    - cmd/snap-confine/tests: fix stale path after move to snapd
-    - cmd/snap-confine: don't use __attribute__((nonull))
-    - snap: add description to `snap info`
-    - snap: show last refresh time
-    - store: switch default delta format from xdelta to xdelta3
-    - interfaces: fix system-observe interface to work with ps_mem
-    - debian: add missing ca-certificates dependency
-    - cmd/snap-confine: add support for classic confinement
-    - snapstate/backend: add backend methods to manage aliases
-    - tests: re-enable snap-confine unit tests via spread
-    - many: merge snap-confine into snapd
-    - many: add support for classic confinement
-    - snap: abort install with ctrl+c
-    - cmd/snap: change terms accept URL following UX review
-    - interfaces/apparmor: use distinct apparmor template for classic
-    - snap: add snap size to `snap info`
-    - interfaces: add unconfined access to modem-manager
-    - snap: support for parsing and exposing on snap.Info aliases
-    - debian: disable autopkgtests on ppc64el
-    - snap: disable support for socket activation
-    - tests: fix incorrect restore of the current symlink
-    - asserts: introduce auto-aliases header in snap-declaration
-    - interfaces/seccomp: add support for classic confinement
-    - tests: do not use external snaps
-    - daemon: close the dup()ed file descriptor to not leak it
-    - overlord, daemon, progress: enable building snapd without CGO
-    - daemon, store: let snap info find things in any channel
-    - store: retry tweaks and logging
-    - snap: Improve `snap --help` output as designed by Mark
-    - interfaces/builtin: fix incorrect udev rule in i2c
-    - overlord: increase test timeout and improve failure message
-    - snap: remove unused experimental command
-    - debian: remove unneeded conflict against the "snappy" package
-    - daemon, strutil: move daemon.quotedNames to strutil.Quoted
-    - docs: document SNAP_DEBUG_HTTP in HACKING.md
-    - cmd/snap: have some completers
-    - snap: support "daemon: notify" in snap.yaml
-    - snap: fix try command when daemon linie is added
-    - interfaces: apparmor support for classic confinement
-    - debian/rules: build with -buildoptions=pie
-    - tests: include /boot in saved state (including bootenv and any
-      kernels)
-    - daemon: ensure `snap try` installs core if it's missing
-    - tests: save/restore /snap/core/current symlink
-    - tests: decrease the number of expected featured apps
-    - tests: add set -e to the prepare ssh script
-    - cmd/snap: add tests for section completion; fix bugs.
-    - cmd/snap: document 'snap list --all'
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 08 Dec 2016 16:16:04 +0100
-
-snapd (2.18.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1644625
-    - daemon: fix crash when `snap refresh` contains a single update
-    - fix unhandled error from io.Copy() in download()
-    - interfaces/builtin: fix incorrect udev rule in i2c
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 05 Dec 2016 15:04:13 +0100
-
-snapd (2.18) xenial; urgency=medium
-
-  * New upstream release, LP: #1644625
-    - store: retry on io.EOF
-    - tests: skip pty tests on ppc64el and powerpc
-    - client, cmd/snap: introducing "snap info"
-    - snap: do exit 0 on install/remove if that snap is already
-      installed or already removed
-    - snap: add `snap watch <change-id>` to attach to a running change
-    - store: retry downloads using retry loop
-    - snap: try doesn't require snap-dir when run in snap's directory
-    - daemon: show what will change in the "refresh-all" changes
-    - tests: disable autorefresh for the external backend
-    - snap: add `snap list -a` to show all snaps (even inactive ones)
-    - many: unify boolean env var handling
-    - overlord/ifacestate: don't setup jailmode snaps with devmode
-      confinement
-    - snapstate: do not garbage collect the snaps used by the bootenv
-    - debian: drop hard xdelta dependency for now
-    - snap: make `snap login` ask for email if not given as argument
-    - osutil: fix build on armhf (arm in go-arch) and powerpc (ppc in
-      go-arch)
-    - many: rename DevmodeConfinement to DevModeConfinement
-    - store: resp.Body.Close() missing in ReadyToBuy
-    - many: use ConfinementOptions instead of ConfinementType
-    - snap, daemon, store: fake the channel map in the REST API
-    - misc: run github.com/gordonklaus/ineffassign as part of the static
-      checks
-    - docs: add goreportcard badge and remove coveralls badge
-    - tests: force gofmt -s in static checks
-    - many: run gofmt -s -w on all the code
-    - store: DRY actual retry code
-    - many: fix various errors uncovered by goreportcard.com
-    - interfaces/builtin: allow additional shared memory for webkit
-    - many: some more missing snapState->snapst
-    - asserts: introduce an optional freeform display-name for model
-    - interfaces/builtin: rename usb-raw to raw-usb
-    - progress: init pbar with correct total value
-    - daemon/api.go: add quotedNames() helper
-    - interfaces: add ConfinementOptions type
-    - tests: add a test about the extra bits that prepare-device can
-      specify for device registration
-    - tests: check that gpio device nodes are exported after reboot
-    - tests: parameterize core channel with env var for classic too
-    - many: rename variable "ss" to "snapsup" or "snapst" or "st"
-      (depending on context)
-    - tests: do not use external snaps in spread
-    - store: retry buy request
-    - store: retry store.Find
-    - store: retry assertion store call
-    - store: retry call for snap details
-    - many: use snap.ConfinementType rather than bool devmode
-    - daemon: if a bad snap is posted it is not an internal error but a
-      bad request
-    - client: add "Snap.Screenshots" to the client API
-    - interfaces: update base declaration documentation and policy for
-      on-classic and snap-type
-    - store: check payment method before TOS for a better UX
-    - interfaces: allow sched_setaffinity in process-control
-    - tests: parameterize core channel with env var
-    - tests: ensure that the XDG_ env contains at least XDG_RUNTIME_DIR
-    - interfaces: fcitx also listens on the session bus for Qt apps
-    - store: retry ListRefresh
-    - snap: use "Password of <email>:" in the `snap login`
-    - many: reshuffle how we load/inject tests keys so image doesn't
-      need assertstate anymore
-    - store: use range requests if we have a local file already
-    - dirs,interfaces,overlord,snap,snapenv,test: export per-snap
-      XDG_RUNTIME_DIR per user
-    - osutil: make RealUser only look at SUDO_USER when uid==0
-    - tests: do not use the ppa:snappy-dev/image in the tests
-    - store: retry readyToBuy request
-    - tests: increase `expect` timeouts
-    - static tests: add spell check
-    - tests: add debug to all flaky expect tests
-    - systemd: correct the mount arguments when mounting with squashfuse
-    - interfaces: add avahi-observe
-    - store: bring delta downloads back
-    - interfaces: add alsa
-    - interfaces/builtin: fix a broken test that snuck into master
-    - osutil: add chattr funcs
-    - image: init "snap_mode" on image creation time to avoid ugly
-      messages
-    - tests: test-snapd-fuse-consumer needs python-fuse as a build-
-      package
-    - interfaces/builtin: add i2c interface
-    - interfaces: add ofono interface
-    - tests: do not use hello-world in our tests
-    - snap: add support for classic confinement
-    - interfaces: remove LegacyAutoConnect() from the interfaces
-    - interfaces: miscellaneous policy updates
-    - tests: run autopkgtests in the autopkgtest.ubuntu.com
-      infrastructure
-    - Implement lxd-client interface exposing the lxd snap
-    - asserts: validate optional account username
-    - many: remove unnecessary snap name parameter from buying endpoint
-    - tests: do not hardcode the size of /dev/ram0
-    - tests: add test that ensures the right content for /etc/os-release
-    - spread tests: fix snap mode check
-    - docs: fix path for source files location in HACKING.md
-    - interfaces/builtin/mir: allow slot to make recvfrom syscalls
-    - store: sections/featured snaps store support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 24 Nov 2016 19:43:08 +0100
-
-snapd (2.17.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1637215:
-    - release: os-release on core has changed
-    - tests: /dev/ptmx does not work on powerpc, skip here
-    - docs: moved to github.com/snapcore/snapd/wiki (#2258)
-    - debian: golang is not installable on powerpc, use golang-any
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Nov 2016 18:13:10 +0200
-
-snapd (2.17) xenial; urgency=medium
-
-  * New upstream release, LP: #1637215:
-    - overlord/ifacestate: add unit tests for undo of setup-snap-
-      security (#2243)
-    - daemon,overlord,snap,tests: download to .partial in final dir
-      (#2237)
-    - overlord/state: marshaling tests for lanes (#2245)
-    - overlord/state: introduce state lanes (#2241)
-    - overlord/snapstate: fix revert+refresh (#2224)
-    - interfaces/sytemd: enable/disable generated service units (#2229)
-    - many: fix incorrect security files generation on undo
-    - overlord/snapstate: add dynamic snapdX.Y assumes (#2227)
-    - interfaces: network-manager: give slot full read-write access to
-      /run/NetworkManager
-    - docs: update the name of the command for the cross-build
-    - overlord/snapstate: fix missing argument to Noticef
-    - snapstate: ensure gadget/core/kernel can not be disabled (#2218)
-    - asserts: limit to 1y only if len(models) == 0 (#2219)
-    - debian: only install share/locale if available (missing on
-      powerpc)
-    - overlrod/snapstate: fix revert followed by refresh to old-current
-      (#2214)
-    - interfaces/builtin: network-manager and bluez can change hostname
-      (#2204)
-    - snap: switch the auto-import dir to /run/snapd/auto-import
-    - docs: less details about cloud.cfg as requested in trello (#2206)
-    - spread.yaml: Ensure ubuntu user has passwordless sudo for
-      autopkgtests (#2201)
-    - interfaces/builtin: add dcdbas-control interface
-    - boot: do not set boot to try mode if the revision is unchanged
-    - interfaces: add shutdown interface (#2162)
-    - interfaces: add system-power-control interface
-    - many: use the new systemd backend for configuring GPIOs
-    - overlord/ifacestate: setup security for slots before plugs
-    - snap: spool assertion candidates if snapd is not up yet
-    - store,daemon,overlord: download things to a partials dir
-    - asserts,daemon: implement system-user-authority header/concept
-    - interfaces/builtin: home base declaration rule using on-classic
-      for its policy
-    - interfaces/builtin: finish decl based checks
-    - asserts: bump snap-declaration to allow signing with new-style
-      plugs and slots
-    - overlord: checks for kernel installation/refresh based on model
-      assertion and previous kernel
-    - tests/lib/fakestore: fix logic to distinguish assertion not found
-      errors
-    - client: add a few explicit error types (around the request cycle)
-    - tests/lib/fakestore/cmd/fakestore: make it log, and fix a typo
-    - overlord/snapstate: two bugs for one
-    - snappy: disable auto-import of assertions on classic (#2122)
-    - overlord/snapstate: move trash cleanup to a cleanup handler
-      (#2173)
-    - daemon: make create-user --known fail on classic without --force-
-      managed (#2123)
-    - asserts,interfaces/policy: implement on-classic plug/slot
-      constraints
-    - overlord: check that the first installed gadget matches the model
-      assertion
-    - tests: use the snapd-control-consumer snap from the store
-    - cmd/snap: make snap run not talk to snapd for finding the revision
-    - snap/squashfs: try to hard link instead of copying. Also, switch
-      to osutil.CopyFile for cp invocation.
-    - store: send supported max-format when retrieving assertions
-    - snapstate, devicestate: do not remove seed
-    - boot,image,overlord,partition: read/write boot variables in single
-      operation
-    - tests: reenable ubuntu-core tests on qemu
-    - asserts,interfaces/policy: allow OR-ing of subrule constraints in
-      plug/slot rules
-    - many: move from flags as ints to flags as structs-of-bools (#2156)
-    - many: add supports for keeping and finding assertions with
-      different format iterations
-    - snap: stop using ubuntu-core-launcher, use snap-confine
-    - many: introduce an assertion format iteration concept, refuse to
-      add unsupported assertion
-    - interfaces: tweak wording and comment
-    - spread.yaml: dump apparmor denials on spread failure
-    - tests: unflake ubuntu-core-reboot (#2150)
-    - cmd/snap: tweak unknown command error message (#2139)
-    - client,daemon,cmd: add payment-declined error kind (#2107)
-    - cmd/snap: update remove command help (#2145)
-    - many: removed frameworks target and fixed service files (#2138)
-    - asserts,snap: validate attributes to a JSON-compatible type subset
-      (#2140)
-    - asserts: remove unused serial-proof type
-    - tests: skip auto-import tests on systems without test keys (#2142)
-    - overlord/devicestate: don't spam the debug log on classic (#2141)
-    - cmd/snap: simplify auto-import mountinfo parsing (#2135)
-    - tests: run ubuntu-core upgrades on isolated machine (#2137)
-    - overlord/devicestate: recover seeding from old external approach
-      (#2134)
-    - overlord: merge overlord/boot pkg into overlord/devicestate
-      (#2118)
-    - daemon: add postCreateUserSuite test suite (#2124)
-    - tests: abort tests if an update process is scheduled (#2119)
-    - snapstate: avoid reboots if nothing in the boot setup has changed
-      (#2117)
-    - cmd/snap: do not auto-import from loop or non-dev devices (#2121)
-    - tests: add spread test for `snap auto-import` (#2126)
-    - tests: add test for auto-mount assertion import (#2127)
-    - osutil: add missing unit tests for IsMounted (#2133)
-    - tests: check for failure creating user on managed ubuntu-core
-      systems (#2096)
-    - snap: ignore /dev/loop addings from udev (#2111)
-    - tests: remove snapd.boot-ok reference (#2109)
-    - tests: enable tests related to the home interface in all-snaps
-      (#2106)
-    - snapstate: only import defaults from gadget on install (#2105)
-    - many: move firstboot code into the snapd daemon (#2033)
-    - store: send correct JSON type of string for expected payment
-      amount (#2103)
-    - cmd/snap: rename is-managed to managed and tune (#2102)
-    - interfaces,overlord/ifacestate: initial cleaning up of no arg
-      AutoConnect related bits (#2090)
-    - client, cmd: prompt for password when buying (#2086)
-    - snapstate: fix hanging `snap remove` if snap is no longer mounted
-    - image: support gadget specific cloud.conf file (#2101)
-    - cmd/snap,ctlcmd: fix behavior of snap(ctl) get (#2093)
-    - store: local users download from the anonymous url (#2100)
-    - docs/hooks.md: fix typos (#2099)
-    - many: check installation of slots and plugs against declarations
-    - docs: fix missing "=" in the systemd-active docs
-    - store: do not set store auth for local users (#2092)
-    - interfaces,overlord/ifacestate: use declaration-based checking for
-      auto-connect (#2071)
-    - overlord, daemon, snap: support gadget config defaults (#2082)The
-      main semantic changes are:
-    - tests: fix snap-disconnect tests after core rename (#2088)
-    - client,daemon,overlord,cmd: add /v2/users and create-user on auto-
-      import (#2074)
-    - many: abbreviated forms of disconnect (#2066)
-    - asserts: require lowercase model until insensitive matching is
-      ready (#2076)
-    - cmd/snap: add version command, same as --version (#2075)
-    - all: use "core" by default but allow "ubuntu-core" still (#2070)
-    - overlord/devicestate, docs/hooks.md: nest prepare-device
-      configuration options
-    - daemon: fix login API to return local macaroons (#2078)
-    - daemon: do not hardcode UID in userLookup (#2080)
-    - client, cmd: connect fixes (#2026)
-    - many: preparations for switching most of autoconnect to use the
-      declarationsfor now:
-    - overlord/auth: update CheckMacaroon to verify local snapd
-      macaroons (#2069)
-    - cmd/snap: trivial auto-import and download tweaks (#2067)
-    - interfaces: add repo.ResolveConnect that handles name resolution
-    - interfaces/policy: introduce InstallCandidate and its checks
-    - interfaces/policy,overlord: check connection requests against the
-      declarations in ifacestate
-    - many: setup snapd macaroon for local users (#2051)Next step: do
-      snapd macaroons verification.
-    - interfaces/policy: implement snap-id/publisher-id checks
-    - many: change Connect to take ConnRef instead of strings (#2060)
-    - snap: auto mount block devices and import assertions (#2047)
-    - daemon: add `snap create-user --force-managed` support (#2041)
-    - docs: remove references to removed buying features (#2057)
-    - interfaces,docs: allow sharing SNAP{,_DATA,_COMMON} via content
-      iface (#2063)
-    - interfaces: add Plug/Slot/Connection reference helpers (#2056)
-    - client,daemon,cmd/snap: improve create-user APIs (#2054)
-    - many: introduce snap refresh --ignore-validation <snap> to
-      override refresh validation (#2052)
-    - daemon: add support for `snap create-user --known` (#2040)
-    - interfaces/policy: start of interface policy checking code based
-      on declarations (#2050)
-    - overlord/configstate: support nested configuration (#2039)
-    - asserts,interfaces/builtin,overlord/assertstate: introduce base-
-      declaration (#2037)
-    - interfaces: builtin: Allow writing DHCP lease files to
-      /run/NetworkManager/dhcp (#2049)
-    - many: remove all traces of the /v2/buy/methods endpoint (#2045)
-    - tests: add external spread backend (#1918)
-    - asserts: parse the slot rules in snap-declarations (#2035)
-    - interfaces: allow read of /etc/ld.so.preload by default for armhf
-      on series 16 (#2048)
-    - store: change purchase to order and store clean up first pass
-      (#2043)
-    - daemon, store: switch to new store APIs in snapd (#2036)
-    - many: add email to UserState (#2038)
-    - asserts: support parsing the plugs stanza i.e. plug rules in snap-
-      declarations (#2027)
-    - store: apply deltas if explicitly enabled (#2031)
-    - tests: fix create-key/snap-sign test isolation (#2032)
-    - snap/implicit: don't restrict the camera iface to classic (#2025)
-    - client, cmd: change buy command to match UX document (#2011)
-    - coreconfig: nuke it. Also, ignore po/snappy.pot. (#2030)
-    - store: download deltas if explicitly enabled (#2017)
-    - many: allow use of the system user assertion with create-user
-      (#1990)
-    - asserts,overlord,snap: add prepare-device hook for device
-      registration (#2005)
-    - debian: adjust packaging for trusty/deputy systemd (#2003)
-    - asserts: introduce AttributeConstraints (#2015)
-    - interface/builtin: access system bus on screen-inhibit-control
-    - tests: add firewall-control interface test (#2009)
-    - snapstate: pass errors from ListRefresh in updateInfo (#2018)
-    - README: add links to IRC, mailing list and social media (#2022)
-    - docs: add `configure` hook to hooks list (#2024)LP: #1596629
-    - cmd/snap,configstate: rename apply-config variables to configure.
-      (#2023)
-    - store: retry download on 500 (#2019)
-    - interfaces/builtin: support time and date settings via
-      'org.freedesktop.timedate1 (#1832)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 02 Nov 2016 01:17:36 +0200
-
-snapd (2.16) xenial; urgency=medium
-
-  * New upstream release, LP: #1628425
-    - overlord/state: prune old empty changes
-    - interfaces: ppp: load needed kernel module (#2007)
-    - interfaces/builtin: add missing rule to allow run-parts to
-      execute all resolvconf scripts
-    - many: rename apply-config hook to configure
-    - tests: use new spread `debug` feature
-    - many: finish `snap set` API.
-    - overlord: fix and simplify configstate.Transaction
-    - assertions: add system-user assertion
-    - snap: add `snap known --remote`
-    - tests: replace systemd-run with on-the-fly generation of units.
-    - overlord/boot: switch to using assertstate.Batch
-    - snap, daemon, store: pass through screenshots from store
-    - image: add meta/gadget.yaml infrastructure
-    - tests: add test benchmark script
-    - daemon: add the actual ssh keys that got added to the create-user
-      response
-    - daemon: add REST API behind `snap get`
-    - debian: re-add golang-github-gosexy-gettext-dev
-    - tests: added install_local function
-    - interfaces/builtin: fix resolvconf permissions for network-manager
-      interface
-    - tests: use apt as compatible with trusty
-    - many: discard preserved namespace after removing snap
-    - daemon, overlord, store: add ReadyToBuy API to snapd
-    - many: add support for installing/removing multiple snaps
-    - progress: use New64 and fix output newline
-    - interfaces/builtin: allow network-manager to access netplan conf
-      files
-    - tests: build once and install test snap from cache
-    - overlord/state: introduce cleanup support
-    - snap: move/clarify Info.Broken
-    - ctlcmd: add snapctl get.
-    - overlord,store: clean up serial-proof plumbing code
-    - interfaces/builtin: add network-setup-observe interface
-    - daemon,overlord/assertstate: support streams of assertions with
-      snap ack
-    - snapd: kmod backend
-    - tests: ensure HOME is also set correctly
-    - configstate,hookstate: add snapctl set
-    - tests: disable broken create-key test
-    - interfaces: adjust bluetooth-control to allow getsockopt (LP:
-      #1613572)
-    - tests: add a test for core about device initialization and device
-      registration and auth
-    - many: show snap name before the download progress bar
-    - interfaces/builtin: add rcvfrom for client connected plugs to mir
-      interface
-    - asserts: support for maps in assertions
-    - tests: increase timeout for key generation in create-key test
-    - many: validate refreshes against validation assertions by gating
-      snaps
-    - interfaces/apparmor: allow 'm' in default policy for snap-exec
-    - many: avoid snap.InfoFromSnapYaml in tests
-    - interfaces/builtin: allow /dev/net/tun with network-control
-    - tests: add spread test for snap create-key/snap sign
-    - tests: add missing quotes in security-device-cgroups/task.yaml
-    - interfaces: drop ErrUnknownSecurity
-    - store: add "ready to buy" method
-    - snap/snapenv, tests: use root's data dirs when running via sudo
-    - interfaces/builtin: add initial docker interface
-    - snap: remove extra newline after progress is done
-    - docs: fix formating of HACKING.md "Testing snapd"
-    - store : add requestOptions.ExtraHeaders so that individual
-      requests can customise headers.
-    - many: use unique plug/slot names in tests
-    - tests: add tests for the classic dimension
-    - many: add vendoring of dependencies by default
-    - tests: use in-tree snap{ctl,-exec} for all tests
-    - many: support snapctl -h
-    - tests: adjust regex after changes in stat output
-    - store,snap: initial support for delta downloads
-    - interfaces/builtin: add run/udev/data paths to mir interface
-    - snap: lessen annoyance of implicit interface tests
-    - tests: ensure http{,s}_proxy is defined inside the fake-store
-    - interfaces: allow xdg-open in unity7, unity7 cleanups
-    - daemon,store: move store login user logic to store
-    - tests: replace realpath with readlink -f for trusty support.
-    - tests: add https_proxy into environment as well
-    - interfaces/builtin: allow mmaping pulseaudio buffers
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 28 Sep 2016 11:09:27 +0200
-
-snapd (2.15.2ubuntu1) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - snap/snapenv, tests: use root's data dirs when running via sudo
-      (cherry pick PR: #1857)
-    - tests: add https_proxy into environment
-      (cherry pick PR: #1926)
-    - interfaces: allow xdg-open in unity7, unity7 cleanups
-      (cherry pick PR: #1946)
-    - tests: ensure http{,s}_proxy is defined inside the fake-store
-      (cherry pick PR: #1949)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 21 Sep 2016 17:21:12 +0200
-
-snapd (2.15.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - asserts: define a bit less terse Ref.String
-    - interfaces: disable auto-connect in libvirt interface
-    - asserts: check that validation assertions are signed by the
-      publisher of the gating snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 19 Sep 2016 10:42:29 +0200
-
-snapd (2.15.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - image: ensure local snaps are put last in seed.yaml
-    - asserts: revert change that made the account-key's name mandatory.
-    - many: refresh all snap decls
-    - interfaces/apparmor: allow reading /etc/environment
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 19 Sep 2016 09:19:44 +0200
-
-snapd (2.15) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - tests: disable prepare-image-grub test in autopkgtest
-    - interfaces: allow special casing for auto-connect until we have
-      assertions
-    - docs: add a little documentation on hooks.
-    - hookstate,daemon: don't mock HookRunner, mock command.
-    - tests: add http_proxy to /etc/environment in the autopkgtest
-      environment
-    - backends: first bits of kernel-module security backend
-    - tests: ensure openssh-server is installed in autopkgtest
-    - tests: make ubuntu-core tests more robust
-    - many: mostly work to support ABA upgrades
-    - cmd/snap: do runtime linting of descriptions
-    - spread.yaml: don't assume LANG is set
-    - snap: fix SNAP* environment merging in `snap run`
-    - CONTRIBUTING.md: remove integration-tests, include spread
-    - store: don't discard error body from request device session call
-    - docs: add create-user documentation
-    - cmd/snap: match UX document for message when buying without login
-    - firstboot: do not overwrite any existing netplan config
-    - tests: add debug output to ubuntu-core-update-rollback-
-      stresstest:
-    - tests/lib/prepare.sh: test that classic does not setting bootvars
-    - snap: run all tests with gpg2
-    - asserts: basic support for validation assertion and refresh-
-      control
-    - interfaces: miscellaneous policy updates for default, browser-
-      support and camera
-    - snap: (re)add --force-dangerous compat option
-    - tests: ensure SUDO_{USER,GID} is unset in the spread tests
-    - many: clean out left over references to integration tests
-    - overlord/auth,store: fix raciness in updating device/user in state
-      through authcontext and other issuesbonus fixes:
-    - tests: fix spread tests on yakkety
-    - store: refactor auth/refresh tests
-    - asserts: use gpg --fixed-list-mode to be compatible with both gpg1
-      and gpg2
-    - cmd/snap: i18n option descriptions
-    - asserts: required account key name header
-    - tests: add yakkety test host
-    - packaging: make sure debhelper-generated snippet is invoked on
-      postrm
-    - snap,store: capture newest digest from the store, make it
-      DownloadInfo only
-    - tests: add upower-observe spread test
-    - Merge github.com:snapcore/snapd
-    - tests: fixes to actually run the spread tests inside autopkgtest
-    - cmd/snap: make "snap find" error nicer.
-    - tests: get the gadget name from snap list
-    - cmd/snap: tweak help of 'snap download'
-    - cmd/snap,image: teach snap download to download also assertions
-    - interfaces/builtin: tweak opengl interface
-    - interfaces: serial-port use udevUsbDeviceSnippet
-    - store: ensure the payment methods method handles auth failure
-    - overlord/snapstate: support revert flags
-    - many: add snap configuration to REST API
-    - tests: use ubuntu-image for the ubuntu-core-16 image creation
-    - cmd/snap: serialise empty keys list as [] rather than null
-    - cmd/snap,client: add snap set and snap get commands
-    - asserts: update trusted account-key asserts with names
-    - overlord/snapstate: misc fixes/tweaks/cleanups
-    - image: have prepare-image set devmode correctly
-    - overlord/boot: have firstboot support assertion files with
-      multiple assertions
-    - daemon: bail from enable and disable if revision given, and from
-      multi-op if unsupported optons given
-    - osutil: call sync after cp if
-      requested.overlord/snapstate/backend: switch to use osutil instead
-      of another buggy call to cp
-    - cmd/snap: generate account-key-request "since" header in UTC
-    - many: use symlinks instead of wrappers
-    - tests: remove silly [Service] entry from snapd.socket.d/local.conf
-    - store: switch device session to use device-session-request
-      assertion
-    - snap: ensure that plug and slot names are unique
-    - cmd/snap: fix test suite (no Exit(0) on tests!)
-    - interfaces: add interface for hidraw devices
-    - tests: use the real model assertion when creating the core test
-      image
-    - interfaces/builtin: add udisks2 and removable-media interfaces
-    - interface: network_manager: enable resolvconf
-    - interfaces/builtin: usb serial-port support via udev
-    - interfaces/udev: support noneSecurityTag keyed snippets
-    - snap: switch to the new agreed regexp for snap names
-    - tests: adjust test setup after ubuntu user removal
-    - many: start services only after the snap is fully ready (link-snap
-      was run)
-    - asserts: don't have Add/Check panic in the face of unsupported no-
-      authority assertions
-    - asserts: initial support to generate/sign snap-build assertions
-    - asserts: support checking account-key-request assertions
-    - overlord: introduce AuthContext.DeviceSessionRequest with support
-      in devicestate
-    - overlord/state: fix for reloaded task/change crashing on Set if
-      checkpointed w. no custom data  yet
-    - snapd.refresh.service: require snap.socket and /snap/*/current.
-    - many: spell --force-dangerous as just --dangerous, devmode should
-      imply it
-    - overlord/devicestate: try to fetch/refresh the signing key of
-      serial (also in case is not there yet)
-    - image,overlord/boot,snap: metadata from asserts for image snaps
-    - many: automatically restart all-snap devices after os/kernel
-      updates
-    - interfaces: modem-manager: ignore camera
-    - firstboot: only configure en* and eth* interfaces by default
-    - interfaces: fix interface handling on no-app snaps
-    - snap: set user variables even if HOME is unset (like with systemd
-      services)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 16 Sep 2016 07:46:22 +0200
-
-snapd (2.14.2~16.04) xenial; urgency=medium
-
-  * New upstream release: LP: #1618095
-    - tests: use the spread tests with the adhoc interface inside
-      autopkgtest
-    - interfaces: add fwupd interface
-    - asserts,cmd/snap: add "name" header to account-key(-request)
-    - client,cmd/snap: display os-release data only on classic
-    - asserts/tool,cmd/snap: introduce hidden "snap sign"
-    - many: when installing snap file derive metadata from assertions
-      unless --force-dangerous
-    - osutil: tweak the createUserTests a bit and extract common code
-    - debian: umount --lazy before rm on snapd.postrm
-    - interfaces: updates to default policy, browser-support, and x11
-    - store: set initial device session
-    - interfaces: add upower-observe interface (LP: #1595813)
-    - tests: use beta u-d-f in test by default
-    - interfaces/builtin: allow writing on /dev/vhci in bluetooth-
-      control
-    - interfaces/builtin: allow /dev/vhci on bluetooth-control
-    - tests: port integration tests to spread
-    - snapstate: use umount --lazy when removing the mount units
-    - spread: enable halt-timeout, tweak image selection
-    - tests: fix firstboot-assertions to actually be runnable on classic
-      again
-    - asserts: introduce device-session-request
-    - interfaces: add screen-inhibit-control interface (LP: #1604880)
-    - firstboot: change location of netplan config
-    - overlord/devicestate: some cleanups and solving a couple todos
-    - daemon,overlord: add subcommand handling to snapctl
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 01 Sep 2016 18:52:05 +0200
-
-snapd (2.14.1) xenial; urgency=medium
-
-  * New upstream release: LP: #1618095
-    - snap-exec: add support for commands with internal args in snap-
-      exec
-    - store: refresh expired device sessions
-    - debian: re-add ubuntu-core-snapd-units as a transitional package
-    - image: snap assertions into image
-    - overlord/assertstate,asserts/snapasserts: give snap assertions
-      helpers a package, introduce ReconstructSideInfo
-    - docs/interfaces: Add empty line after lxd-support title
-    - README: cover the new /run/snapd-snap.socket
-    - daemon: make socket split backward-compatible.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 30 Aug 2016 16:43:29 +0200
-
-snapd (2.14) xenial; urgency=medium
-
-  * New upstream release: LP: #1618095
-    - cmd: enable SNAP_REEXEC only if it is set to SNAP_REEXEC=1
-    - osutil: fix create-user on classic
-    - firstboot: disable firstboot on classic for now
-    - cmd/snap: add export-key --account= option
-    - many: split public snapd REST API into separate socket.
-    - many: drop ubuntu-core-snapd-units package, use release.OnClassic
-      instead
-    - tests: add content-shareing binary test that excersises snap-
-      confine
-    - snap: use "up to date" instead of "up-to-date"
-    - asserts: add an account-key-request assertion
-    - asserts: fix GPG key generation parameters
-    - tests, integration-tests: implement the cups-control manual test
-      as a spread test
-    - many: clarify/tie down model assertion
-    - cmd/snap: add "snap download" command
-    - integration-tests: remove them in favour of the spread tests
-    - tests: test all snap ubuntu core upgrade
-    - many: support install and remove by revision
-    - overlord/state: prevent change ready => unready
-    - tests: fixes to make the ubuntu-core-16 image usable with
-      -keep/-reuse
-    - asserts: authority-id and brand-id of serial must match
-    - firstboot: generate netplan config rather than ifupdown
-    - store: request device session macaroon from store
-    - tests: add workaround for u-d-f to unblock all-snap image tests
-    - tests: the stable ubuntu-core snap has snap run support now
-    - many: use make StripGlobalRootDir public
-    - asserts: add some stricter checks around format
-    - many: have AuthContext expose device store-id, serial and serial-
-      proof signing to the store
-    - tests: fix "tests/main/ack" to not break if asserts are alreay
-      there
-    - tests/main/ack: fix test/style
-    - snap: add key management commands
-    - firstboot: add firstboot assertions importing
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 29 Aug 2016 17:07:20 +0200
-
-snapd (2.13) xenial; urgency=medium
-
-  * New upstream release: LP: #1616157
-    - many: respect dirs.SnapSnapsDir in tests
-    - tests: update listing test for latest stable image
-    - many: hook in start of code to fetch/check assertions when
-      installing snap from store
-    - boot: add missing udevadm mock to fix FTBFS
-    - interfaces: add lxd-support interface
-    - dirs,snap: handle empty root directory in SetRootDir
-    - dirs,snap: define methods for SNAP_USER_DATA and SNAP_USER_COMMON
-    - tests: spread all-snap test cleanup
-    - tests: add all-snap spread image tests
-    - store,tests: have just one envvar SNAPPY_USE_STAGING_STORE to
-      control talking to staging
-    - overlord/hookstate: use snap run posix parameters.
-    - interfaces/builtin: allow bind in the network interface
-    - asserts,overlord/devicestate: simplify private key/key pairs APIs,
-      they take just key ids
-    - dependencies: update godeps
-    - boot: add support for "devmode: {true,false}" in seed.yaml
-    - many: teach prepare-image to copy the model assertion (and
-      prereqs) into the seed area of the image
-    - tests: start teaching the fakestore about assertions
-    - asserts/sysdb: embed the new format official root/trusted
-      assertions
-    - overlord/devicestate: first pass at device registration logic
-    - tests: add process-control interface spread test
-    - tests: disable unity test
-    - tests: adapt to new spread version
-    - asserts: add serial-proof device assertion
-    - client, cmd/snap: use the new multi-refresh endpoint
-    - many: preparations for image code to fetch model prereqs
-    - debian: add extra checks when debian/snapd.postrm purge is run
-    - overlord/snapstate, daemon: support for multi-snap refresh
-    - tests: do not leave "squashfs-root" around
-    - snap-exec: Fix broken `snap run --shell` and add test
-    - overlord/snapstate: check changes to SnapState for conflicts also.
-    - docs/interfaces: change snappy command to snap
-    - tests: test `snap run --hook` using in-tree snap-exec.
-    - partition: ensure that snap_{kernel,core} is not overridden with an
-      empty value
-    - asserts,overlord/assertstate: introduce an assertstate task
-      handler to fetch snap assertions
-    - spread: disable re-exec to always test development tree.
-    - interfaces: implement a fuse interface
-    - interfaces/hardware-observe.go: re-add /run/udev/data
-    - overlord/assertstate,daemon: reorg how the assert manager exposes
-      the assertion db and adding to it
-    - release: Remove "UBUNTU_CODENAME" from the test data
-    - many: implement snapctl command.
-    - interfaces: mpris updates (fix unconfined introspection, add name
-      attribute)
-    - asserts: export DecodePublicKey
-    - asserts: introduce support for assertions with no authority,
-      implement serial-request
-    - interfaces: bluez: add a few more tests to verify interface
-      connection works
-    - interfaces: bluez: add missing mount security snippet case
-    - interfaces: add kernel-module interface for module insertion.
-    - integration-tests: look for ubuntu-device-flash on PATH before
-      calling sudo
-    - client, cmd, daemon, osutil: support --yaml and --sudoer flags for
-      create-user
-    - spread: use snap-confine from ppa:snappy-dev/image for the tests
-    - many: move to purely hash based key lookup and to new
-      key/signature format (v1)
-    - spread: Use /home/gopath in spread.yaml
-    - tests: base security spread tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 24 Aug 2016 14:48:28 +0200
-
-snapd (2.12) xenial; urgency=medium
-
-  * New upstream release: LP: #1612362
-    - many: do not require root for `snap prepare-image`
-    - tests: prevent restore error on test failure
-    - osutil: change escaping for create-user's sudoers
-    - docs: private flag doesn't exist on /v2/find (it's select)
-    - snap: do not sort the result of `snap find`
-    - interfaces/builtin: add gpio interface
-    - partition: fix cleaning of the boot variables on the second good
-      boot
-    - tests: add udev rules spread test
-    - docs: fix references to refresh action
-    - interfaces/udev,osutil: avoid doubled rules and put all in a per
-      snap file
-    - store: minor store improvements from previous reviews
-    - many: support interactive payments in snapd, filter from command
-      line
-    - docs/interfaces.md: improve interfaces documentation
-    - overlord,store: set store device authorization header
-    - store: add device nonce API support
-    - many: various fixes around the `create-user` command
-    - client, osutil: chown the auth file
-    - interfaces/builtin: add transitional browser-support interface
-    - snap: don't load unsupported implicit hooks.
-    - cmd/snap,cmd/snap-exec: support hooks again.
-    - interfaces/builtin: improve pulseaudio interface
-    - asserts: make account-key's `until` optional to represent a never-
-      expiring key
-    - store: refactor newRequest/doRequest to take requestOptions
-    - tests: allow-downgrades on upgrade test to prevent version errors
-    - daemon: stop using group membership as succedaneous of running
-      things with sudo
-    - interfaces: add bluetooth-control interfaces
-    - many: remove integration-test coverage metrics
-    - daemon,docs: drop license docs and error kind
-    - tests: add network-control interface spread test
-    - tests: add hardware-observe spread test
-    - interfaces: add system-trace interface LP: #1600085
-    - boot: use `cp -aLv` instead of `cp -a` (no symlinks on vfat)
-    - store: soft-refresh discharge macaroon from store when required
-    - partition: clear snap_try_{kernel,core} on success
-    - tests: add snapd-control interface spread test
-    - tests: add locale-control write spread test
-    - store: fix buy method after some refactoring broke it
-    - interfaces/builtin: read perms for network devices in network-
-      observe
-    - interfaces: also allow rfkill in network_control
-    - snapstate: remove artifacts from a snap try dir that vanished
-    - client, cmd/snap: better errors for empty snap list result
-    - wrappers: set BAMF_DESKTOP_FILE_HINT for unity
-    - many: cleanup/update rest.md; improve auth errors
-    - interfaces: miscelleneous policy updates for default, log-observe,
-      mount-observe, opengl, pulseaudio, system-observe and unity7
-    - interfaces: add process-control interface (LP: #1598225)
-    - osutil: support both "nobody" and "nogroup" for grpnam tests
-    - cmd: support defaulting to the user's preferred payment method
-    - overlord: actually run hooks.
-    - overlord/state,overlord/ifacestate: define basic infrastructure
-      for and then setting up serialising of interface mgr tasks
-    - asserts: add Assertion.Prerequisites and SigningKey, Ref and
-      FindTrusted
-    - overlord/snapstate: ensure calls to store are done without the
-      state lock held
-    - asserts,client: switch snap-build and snap-revision to be indexed
-      by snap-sha3-384
-    - many: make seed.yaml on firstboot mandatory and include sideInfo
-    - asserts,many: start supporting structured headers using the new
-      parseHeaders
-    - many: update code for the new snap_mode
-    - tests: added spread find private test
-    - store: deal with 404 froms the SSO store properly
-    - snap: remove meta/kernel.yaml again
-    - daemon: always mock release info in tests
-    - snapstate: drop revisions after "current" on refresh
-    - asserts: introduce new parseHeadersThis introduces the new
-      parseHeaders returning map[string]interface{} and capable of
-      accepting:
-    - asserts: remove/disable comma separated lists and their uses
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 Aug 2016 19:30:36 +0200
-
-snapd (2.11) xenial; urgency=medium
-
-  * New upstream release: LP: #1605303
-    - increase version number to reflect the nature of the update
-      better
-    - store, daemon, client, cmd/snap, docs/rest.md: adieu search
-      grammar
-    - debian: move snapd.refresh.timer into timers.target
-    - snapstate: add daemon-reload to fix autopkgtest on yakkety
-    - Interfaces: hardware-observe
-    - snap: rework the output after a snap operation
-    - daemon, cmd/snap: refresh --devmode
-    - store, daemon, client, cmd/snap: implement `snap find --private`
-    - tests: add network-observe interface spread test
-    - interfaces/builtin: allow getsockopt for connected x11 plugs
-    - osutil: check for nogrup instead of adm
-    - store: small cleanups (more needed)
-    - snap/squashfs: fix test not to hardcode snap size
-    - client,cmd/snap: cleanup cmd/snap test suite, add extra args
-      testThis cleans up the cmd/snap test suite:
-    - wrappers: map "never" restart condition to "no."
-    - wrappers: run update-desktop-database after add/remove of desktop
-      files
-    - release: work around elementary mistake
-    - many: remove all traces of channel from the buying codepath
-    - store: kill setUbuntuStoreHeaders
-    - docs: add payment methods documentation
-    - many: present user with a choice of payment backends
-    - asserts: add cross checks for snap asserts
-    - cmd/snap,cmd/snap-exec: support running hooks via snap-exec.
-    - tests: improve snap run symlink tests
-    - tests: add content sharing interface spread test
-    - store & many: a mechanical branch shortening store names
-    - snappy: remove old snappy pkg
-    - overlord/snapstate: kill flagscompat
-    - overlord/snapstate, daemon, client, cmd/snap: devmode override
-      (aka confined)
-    - tests: extend refresh test to talk to the staging and production
-      stores
-    - asserts,daemon: cross checks for account and account-key
-      assertions
-    - client: existing JSON fixtures uses tabs for indentation
-    - snap-exec: add proper integration test for snap-exec
-    - spread.yaml, tests: replace hello-world with test-snapd-tools
-    - tests: add locale-control interface spread test
-    - tests: add mount-observe interface spread test
-    - tests: add system-observe interface spread test
-    - many: add AuthContext to mediate user updates to the state
-    - store/auth: add helper for the macaroon refresh endpoint
-    - cmd: add buy command
-    - overlord: switch snapstate.Update to use ListRefresh (aka
-      /snaps/metadata)
-    - snap-exec: fix silly off-by-one error
-    - tests: stop using hello-world.echo in the tests
-    - tests: add env command to test-snapd-tools
-    - classic: remove (most of) "classic" mode, this is implemented as a
-      snap now
-    - many: remove snapstate.Candidate and other cleanups
-    - many: removed authenticator, store gets a user instead
-    - asserts: fix minor doc comment typo
-    - snap: ensure unknown arguments to `snap run` are ignored
-    - overlord/auth: add Device/SetDevice to persist device identity in
-      state
-    - overlord: make SyncBoot work again
-    - tests: add -y flag to apt autoremove command in unity task restore
-    - many: migrate SnapSetup and SideInfo to use RealName
-    - daemon: drop auther()
-    - client: improve error from client.do() on json decode failures
-    - tests: readd the fake store tests
-    - many: allow removal of broken snaps, add spread test
-    - overlord: implement &Retry{After: duration} support for handlers
-    - interface: add new interfaces.all.SecurityBackends
-    - integration-tests: remove login tests
-    - cmd,interfaces,snap: implement hook whitelist.
-    - daemon,overlord/auth,store: update macaroon authentication to use
-      the new endpoints
-    - daemon, overlord: add buy endpoint to REST API
-    - tests: use systemd-run for starting and stopping the unity app
-    - tests, integration-tests: port systemd service check test to
-      spread
-    - store: switch search to new snap-specific endpoint
-    - store, many: start using the new details endpoint
-    - tests, integration-tests: port unity test to spread
-    - tests: add spread test for tried snaps removal
-    - tests, integration-tests: port auth errors test to spread
-    - snapstate: rename OfficialName to RealName in the new tests
-    - many: rename SideInfo.OfficialName to SideInfo.RealName
-    - snapstate: use snapstate.Type in backend.RemoveSnapFiles
-    - many: add `snap enable/disable` commands
-    - tests, integration-tests: port refresh all test to spread
-    - snap: add `snap run --shell`
-    - tests: set yaml indentation to 4 spaces
-    - snapstate: cleanup downloaded temp snap files
-    - overlord: make patch1_test more robust
-    - debian: add snapd.postrm that purges
-    - integration-tests: drop already covered refresh app test
-    - many: add concept of "broken" snaps
-    - tests, integration-tests: port remove errors tests to spread
-    - tests, integration-tests: port revert test to spread
-    - debian: fix snapbuild path
-    - overlord: fix access to the state without lock in firstboot.go and
-      add test
-    - snapstate: add very simple garbage collection on upgrade
-    - asserts: introduce assertstest with helpers to test code involving
-      assertions
-    - tests, integration tests: port undone failed install test to
-      spread
-    - snap,store: switch to the new snaps/metadata endpoint, introduce
-      and start capturing DeveloperID
-    - tests, integration-tests: port the op remove retry test to spread
-    - po: remove snappy.pot from git, it will be generated at build time
-    - many: add some missing tests, clarify some things and nitpicks as
-      follow up to `snap revert`
-    - snapstate: when doing snapsate.Update|Install, talk to the store
-      early
-    - tests, integration-tests: port the op remove test to spread
-    - interfaces: allow /usr/bin/locale in default policy
-    - many: add `snap revert`
-    - overlord/auth,store: add macaroon serialization/deserialization
-      helpers
-    - many: embed main store trusted assertions in snapd, way to have
-      test ones, spread tests for ack and known
-    - overlord/snapstate,daemon: clarify active vs current, add
-      SnapState.HasCurrent,CurrentInfo
-    - tests: do not search for a specific snap (we hit 100 items) and
-      pagination kicks in
-    - tests: use printf instead of echo where we need portability
-    - tests: rename and generalize basic-binaries to test-snapd-tools
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 26 Jul 2016 15:49:04 +0200
-
-snapd (2.0.10) xenial; urgency=medium
-
-  *  New upstream release: LP: #1597329
-    - interfaces: also allow @{PROC}/@{pid}/mountinfo and
-      @{PROC}/@{pid}/mountstats
-    - interfaces: allow read access to /etc/machine-id and
-      @{PROC}/@{pid}/smaps
-    - interfaces: miscelleneous policy updates for default, log-observe
-      and system-observe
-    - snapstate: add logging after a successful doLinkSnap
-    - tests, integration-tests: port try tests to spread
-    - store, cmd/snapd: send a basic user-agent to the store
-    - store: add buy method
-    - client: retry on failed GETs
-    - tests: actual refresh test
-    - docs: REST API update
-    - interfaces: add mount support for hooks.
-    - interfaces: add udev support for hooks.
-    - interfaces: add dbus support for hooks.
-    - tests, integration-tests: port refresh test to spread
-    - tests, integration-tests: port change errors test to spread
-    - overlord/ifacestate: don't retry snap security setup
-    - integration-tests: remove unused file
-    - tests: manage the socket unit when reseting state
-    - overlord: improve organization of state patches
-    - tests: wait for snapd listening after reset
-    - interfaces/builtin: allow other sr*/scd* optical devices
-    - systemd: add support for squashfuse
-    - snap: make snaps vanishing less fatal for the system
-    - snap-exec: os.Exec() needs argv0 in the args[] slice too
-    - many: add new `create-user` command
-    - interfaces: auto-connect content interfaces with the same content
-      and developer
-    - snapstate: add Current revision to SnapState
-    - readme: tweak readme blurb
-    - integration-tests: wait for listening port instead of active
-      service reported by systemd
-    - many: rename Current -> {CurrentSideInfo,CurrentInfo}
-    - spread: fix home interface test after suite move
-    - many: name unversioned data.
-    - interfaces: add "content" interface
-    - overlord/snapstate: defaultBackend can go away now
-    - debian: comment to remember why the timer is setup like it is
-    - tests,spread.yaml: introduce an upgrade test, support/split into
-      two suites for this
-    - overlord,overlord/snapstate: ensure we keep snap type in snapstate
-      of each snap
-    - many: rework the firstboot support
-    - integration-tests: fix test failure
-    - spread: keep core on suite restore
-    - tests: temporary fix for state reset
-    - overlord: add infrastructure for simple state format/content
-      migrations
-    - interfaces: add seccomp support for hooks.
-    - interfaces: allow gvfs shares in home and temporarily allow
-      socketcall by default (LP: #1592901, LP: #1594675)
-    - tests, integration-tests: port network-bind interface tests to
-      spread
-    - snap,snap/snaptest: use PopulateDir/MakeTestSnapWithFiles directly
-      and remove MockSnapWithHooks
-    - interfaces: add mpris interface
-    - tests: enable `snap run` on i386
-    - tests, integration-tests: port network interface test to spread
-    - tests, integration-tests: port interfaces cli to spread
-    - tests, integration-tests: port leftover install tests to spread
-    - interfaces: add apparmor support for hooks.
-    - tests, integration-tests: port log-observe interface tests to
-      spread
-    - asserts: improve Decode doc comment about assertion format
-    - tests: moved snaps to lib
-    - many: add the camera interface
-    - many: add optical-drive interface
-    - interfaces: auto-connect home if running on classic
-    - spread: bump gccgo test timeout
-    - interfaces: use security tags to index security snippets.
-    - daemon, overlord/snapstate, store: send confinement header to the
-      store for install
-    - spread: run tests on 16.04 i386 concurrently
-    - tests,integration-tests: port install error tests to spread
-    - interfaces: add a serial-port interface
-    - tests, integration-tests, debian: port sideload install tests to
-      spread
-    - interfaces: add new bind security backend and refactor
-      backendtests
-    - snap: load and validate implicit hooks.
-    - tests: add a build/run test for gccgo in spread
-    - cmd/snap/cmd_login: Adjust message after adding support for wheel
-      group
-    - tests, integration-tests: ported install from store tests to
-      spread
-    - snap: make `snap change <taskid>` show task progress
-    - tests, integration-tests: port search tests to spread
-    - overlord/state,daemon: make abort proceed immediately, fix doc
-      comment, improve tests
-    - daemon: extend privileged access to users in "wheel" group
-    - snap: tweak `snap refresh` and `snap refresh --list` outputTiny
-      branch that does three things:
-    - interfaces: refactor auto-connection candidate check
-    - snap: add support for snap {install,refresh}
-      --{edge,beta,candidate,stable}
-    - release: don't force KDE Neon into devmode.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Jun 2016 21:02:39 +0200
-
-snapd (2.0.9) xenial; urgency=medium
-
-  * New upstream release: LP: #1593201
-    - snap: add the magic redirect part of `snap run`
-    - tests, integration-tests: port server related tests to spread
-    - overlord/snapstate: log restarting in the task
-    - daemon: test restart wiring, fix setup/teardown
-    - cmd: don't show the price if a snap has already been purchased
-    - tests, integration-tests: port listing tests to spread
-    - integration-tests: do not try to kill ubuntu-clock-app.clock (no
-      longer a process)
-    - several: tie up overlord's restart handler into daemon; adjust
-      snap to cope
-    - tests, integration-tests: port abort tests to spread
-    - integration-tests: fix flaky TestRemoveBusyRetries
-    - testutils: refactor/mock exec
-    - snap,cmd: add hook support to snap run.
-    - overlord/snapstate: remove Download from backend
-    - store: use a custom logging transport
-    - overlord/hookstate: implement basic HookManager.
-    - spread: move the suite restore to restore-each
-    - asserts: turn model os into model core field, making it also more
-      like the kernel and gadget fields
-    - asserts: / is not allowed in primary key headers, follow the store
-      in this
-    - release: enable full confinement on Elementary 0.4
-    - integration-tests: fix another i386 autopkgtest failure.
-    - cmd/snap: create SNAP_USER_DATA and common dirs in `snap run`
-    - many: have the installation of the core snap request a restart (on
-      classic)
-    - asserts: allow to load also account assertions into the trusted
-      set
-    - many: install snaps in devmode on distributions without complete
-      apparmor and seccomp support
-    - spread: run on travis
-    - snapenv: do not hardcode amd64 in tests
-    - spread: initial harness and first test
-    - interfaces: miscelleneous policy updates for chromium, x86,
-      opengl, etc
-    - integration-tests: remove daemon to use the log-observe interface
-    - client: remove client.Revision and import snap.Revision instead
-    - integration-tests: wait for network-bind service in try test
-    - many: move over from snappy to snapstate/backend SetupSnap and
-      related code
-    - integration-tests: add interfaces cli tests
-    - snapenv: cleanup snapenv.{Basic,User}
-    - cmd/snap: also print slots that connect to the wanted snap (LP:
-      #1590704)
-    - asserts: error style, use "cannot" instead of "failed to"
-      following the main decided style
-    - integration-tests: wait until the network-bind service is up
-      before testing
-    - many: add new `snap run` command
-    - snappy: unexport snappy.Install and snappy.Overlord.{Un,}Install
-    - many: add some shared testing helpers to snap/snaptest and to
-      boot/boottest
-    - rest-api: support to send apps per snap (LP: #1564076)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 16 Jun 2016 13:56:12 +0200
-
-snapd (2.0.8.1) UNRELEASED; urgency=medium
-
-  * New upstream release
-    - Cherry pick four commits that show snaps as installed in devmode on
-    distributions without full confinement dependencies available:
-
-    25634d3364a46b5e9147e4466932c59b1b572d35
-    53f2e8d5f1b2d7ce13f5b50be4c09fa1de8cf1e0
-    38771f4cc324ad9dd4aa48b03108d13a2c361aad
-    c46e069351c61e45c338c98ab12689a319790bd5
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Tue, 14 Jun 2016 15:55:30 +0200
-
-snapd (2.0.8) xenial; urgency=medium
-
-  * New upstream release: LP: #1589534
-    - debian: make `snap refresh` times more random (LP: #1537793)
-    - cmd: ExecInCoreSnap looks in "core" snap first, and only in
-      "ubuntu-core" snap if rev>125.
-    - cmd/snap: have 'snap list' display helper message on stderr
-      (LP: #1587445)
-    - snap: make app names more restrictive.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 08 Jun 2016 07:56:58 +0200
-
-snapd (2.0.7) xenial; urgency=medium
-
-  * New upstream release: LP: #1589534
-    - debian: do not ship  /etc/ld.so.conf.d/snappy.conf (LP: #1589006)
-    - debian: fix snapd.refresh.service install and usage (LP: #1588977)
-    - ovlerlord/state: actually support task setting themself as
-      done/undone
-    - snap: do not use "." import in revision_test.go, as this breaks
-      gccgo-6 (fix build failure on powerpc)
-    - interfaces: add fcitx and mozc input methods to unity7
-    - interfaces: add global gsettings interfaces
-    - interfaces: autoconnect home and doc updates (LP: #1588886)
-    - integration-tests: remove
-      abortSuite.TestAbortWithValidIdInDoingStatus
-    - many: adding backward compatible code to upgrade SnapSetup.Flags
-    - overlord/snapstate: handle sideloading over an old sideloaded snap
-      without panicing
-    - interfaces: add socketcall() to the network/network-bind
-      interfaces (LP: #1588100)
-    - overlord/snapstate,snappy: move over CanRemoveThis moves over the
-      CanRemove check to snapstate itself.overlord/snapstate
-    - snappy: move over CanRemove
-    - overlord/snapstate,snappy: move over CopyData and Remove*Data code
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 06 Jun 2016 16:35:50 +0200
-
-snapd (2.0.6) xenial; urgency=medium
-
-  * New upstream release: LP: #1588052:
-    - many: repository moved to snapcore/snapd
-    - debian: add transitional pkg for the github location change
-    - snap: ensure `snap try` work with relative paths
-    - debian: drop run/build dependency on lsb-release
-    - asserts/tool: gpg key pair manager
-    - many: add new snap-exec
-    - many: implement `snap refresh --list` and  `snap refresh`
-    - snap: add parsing support for hooks.
-    - many: add the cups interface
-    - interfaces: misc policy fixes (LP: #1583794)
-    - many: add `snap try`
-    - interfaces: allow using sysctl and scmp_sys_resolver for parsing
-      kernel logs
-    - debian: make snapd get its environ from /etc/environment
-    - daemon,client,snap: revisions are now strings
-    - interfaces: allow access to new ibus abstract socket path
-      LP: #1580463
-    - integration-tests: add remove tests
-    - asserts: stronger crypto choices and follow better latest designs
-    - snappy,daemon: hollow out more of snappy (either removing or not
-      exporting stuff on its way out), snappy/gadget.go is gone
-    - asserts: rename device-serial to serial
-    - asserts: rename identity to account (and username access)
-    - integration-tests: add changes tests
-    - backend: add tests for environment wrapper generation
-    - interfaces/builtin: add location-control interface
-    - overlord/snapstate: move over check snap logic from snappy
-    - release: use os-release instead of lsb-release for cross-distro
-      use
-    - asserts: allow empty snap-name for snap-declaration
-    - interfaces/builtin,docs,snap: add the pulseaudio interface
-    - many: add support for an environment map inside snap.yaml
-    - overlord/snapstate: increase robustness of doLinkSnap/undoLinkSnap
-      with sanity unit tests
-    - snap: parse epoch property
-    - snappy: do nothing in SetNextBoot when running on classic
-    - snap: validate snap type
-    - integration-tests: extend find command tests
-    - asserts: extend tests to cover mandatory and empty headers
-    - tests: stop the update-pot check in run-checks
-    - snap: parse confinement property.
-    - store: change applyUbuntuStoreHeaders to not take accept, and to
-      take a channel
-    - many: struct-based revisions, new representation
-    - interfaces: remove 'audit deny' rules from network_control.go
-    - interfaces: add  com.canonical.UrlLauncher.XdgOpen to unity7
-      interface
-    - interfaces: firewall-control can access xtables lock file
-    - interfaces: allow unity7 AppMenu
-    - interfaces: allow unity7 launcher API
-    - interfaces/builtin: add location-observe interface
-    - snap: fixed snap empty list text LP: #1587445
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 02 Jun 2016 08:23:50 +0200
-
-snapd (2.0.5) xenial; urgency=medium
-
-  * New upstream release: LP: #1583085
-    - interfaces: add dbusmenu, freedesktop and kde notifications to
-      unity7 (LP: #1573188)
-    - daemon: make localSnapInfo return SnapState
-    - cmd: make snap list with no snaps not special
-    - debian: workaround for XDG_DATA_DIRS issues
-    - cmd,po: fix conflicts, apply review from #1154
-    - snap,store: load and store the private flag sent by the store in
-      SideInfo
-    - interfaces/apparmor/template.go: adjust /dev/shm to be more usable
-    - store: use purchase decorator in Snap and FindSnaps
-    - interfaces: first version of the networkmanager interface
-    - snap, snappy: implement the new (minmimal) kernel spec
-    - cmd/snap, debian: move manpage generation to depend on an environ
-      key; also, fix completion
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 May 2016 15:29:16 +0200
-
-snapd (2.0.4) xenial; urgency=medium
-
-  * New upstream release:
-    - interfaces: cleanup explicit denies
-    - integration-tests: remove the ancient integration daemon tests
-    - integration-tests: add network-bind interface test
-    - integration-tests: add actual checks for undoing install
-    - integration-tests: add store login test
-    - snap: add certain implicit slots only on classic
-    - integration-tests: add coverage flags to snapd.service ExecStart
-      setting when building from branch
-    - integration-tests: remove the tests for features removed in 16.04.
-    - daemon, overlord/snapstate: "(de)activate" is no longer a thing
-    - docs: update meta.md and security.md for current snappy
-    - debian: always start snapd
-    - integration-tests: add test for undoing failed install
-    - overlord: handle ensureNext being in the past
-    - overlord/snapstate,overlord/snapstate/backend,snappy: start
-      backend porting LinkSnap and UnlinkSnap
-    - debian/tests: add reboot capability to autopkgtest and execute
-      snapPersistsSuite
-    - daemon,snappy,progress: drop license agreement broken logic
-    - daemon,client,cmd/snap: nice access denied message
-      (LP: #1574829)
-    - daemon: add user parameter to all commands
-    - snap, store: rework purchase methods into decorators
-    - many: simplify release package and add OnClassic
-    - interfaces: miscellaneous policy updates
-    - snappy,wrappers: move desktop files handling to wrappers
-    - snappy: remove some obviously dead code
-    - interfaces/builtin: quote apparmor label
-    - many: remove the gadget yaml support from snappy
-    - snappy,systemd,wrappers: move service units generation to wrappers
-    - store: add method to determine if a snap must be bought
-    - store: add methods to read purchases from the store
-    - wrappers,snappy: move binary wrapper generation to new package
-      wrappers
-    - snap: add `snap help` command
-    - integration-tests: remove framework-test data and avoid using
-      config-snap for now
-    - add integration test to verify fix for LP: #1571721
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 13 May 2016 17:19:37 -0700
-
-snapd (2.0.3) xenial; urgency=medium
-
-  * New upstream micro release:
-    - integration-tests, debian/tests: add unity snap autopkg test
-    - snappy: introduce first feature flag for assumes: common-data-dir
-    - timeout,snap: add YAML unmarshal function for timeout.Timeout
-    - many: go into state.Retry state when unmounting a snap fails.
-      (LP: #1571721, #1575399)
-    - daemon,client,cmd/snap: improve output after snap
-      install/refresh/remove (LP: #1574830)
-    - integration-tests, debian/tests: add test for home interface
-    - interfaces,overlord: support unversioned data
-    - interfaces/builtin: improve the bluez interface
-    - cmd: don't include the unit tests when building with go test -c
-      for integration tests
-    - integration-tests: teach some new trick to the fake store,
-      reenable the app refresh test
-    - many: move with some simplifications test snap building to
-      snap/snaptest
-    - asserts: define type for revision related errors
-    - snap/snaptest,daemon,overlord/ifacestate,overlord/snapstate: unify
-      mocking snaps behind MockSnap
-    - snappy: fix openSnapFile's handling of sideInfo
-    - daemon: improve snap sideload form handling
-    - snap: add short and long description to the man-page
-      (LP: #1570280)
-    - snappy: remove unused SetProperty
-    - snappy: use more accurate test data
-    - integration-tests: add a integration test about remove removing
-      all revisions
-    - overlord/snapstate: make "snap remove" remove all revisions of a
-      snap (LP: #1571710)
-    - integration-tests: re-enable a bunch of integration tests
-    - snappy: remove unused dbus code
-    - overlord/ifacestate: fix setup-profiles to use new snap revision
-      for setup (LP: #1572463)
-    - integration-tests: add regression test for auth bug LP:#1571491
-    - client, snap: remove obsolete TypeCore which was used in the old
-      SystemImage days
-    - integration-tests: add apparmor test
-    - cmd: don't perform type assertion when we know error to be nil
-    - client: list correct snap types
-    - intefaces/builtin: allow getsockname on connected x11 plugs
-      (LP: #1574526)
-    - daemon,overlord/snapstate: read name out of sideloaded snap early,
-      improved change summary
-    - overlord: keep tasks unlinked from a change hidden, prune them
-    - integration-tests: snap list on fresh boot is good again
-    - integration-tests: add partial term to the find test
-    - integration-tests: changed default release to 16
-    - integration-tests: add regression test for snaps not present after
-      reboot
-    - integration-tests: network interface
-    - integration-tests: add proxy related environment variables to
-      snapd env file
-    - README.md: snappy => snap
-    - etc: trivial typo fix (LP:#1569892)
-    - debian: remove unneeded /var/lib/snapd/apparmor/additional
-      directory (LP: #1569577)
-    - builtin/unity7.go: allow using gmenu. LP: #1576287
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 03 May 2016 07:51:57 +0200
-
-snapd (2.0.2) xenial; urgency=medium
-
-  * New upstream release:
-    - systemd: add multi-user.target (LP: #1572125)
-    - release: our series is 16
-    - integration-tests: fix snapd binary path for mounting the daemon
-      built from branch
-    - overlord,snap: add firstboot state sync
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 19 Apr 2016 16:02:44 +0200
-
-snapd (2.0.1) xenial; urgency=medium
-
-  * client,daemon,overlord: fix authentication:
-    - fix incorrect authenication check (LP: #1571491)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 18 Apr 2016 07:24:33 +0200
-
-snapd (2.0) xenial; urgency=medium
-
-  * New upstream release:
-    - debian: put snapd in /usr/lib/snapd/
-    - cmd/snap: minor polishing
-    - cmd,client,daemon: add snap abort command
-    - overlord: don't hold locks when callling backends
-    - release,store,daemon: no more default-channel, release=>series
-    - many: drop support for deprecated environment variables
-      (SNAP_APP_*)
-    - many: support individual ids in changes cmd
-    - overlord/state: use numeric change and task ids
-    - overlord/auth,daemon,client,cmd/snap: logout
-    - daemon: don't install ubuntu-core twice
-    - daemon,client,overlord/state,cmd: add changes command
-    - interfaces/dbus: drop superfluous backslash from template
-    - daemon, overlord/snapstate: updates are users too!
-    - cmd/snap,daemon,overlord/ifacestate: add support for developer
-      mode
-    - daemon,overlord/snapstate: on refresh use the remembered channel,
-      default to stable channel otherwise
-    - cmd/snap: improve UX of snap interfaces when there are no results
-    - overlord/state: include time in task log messages
-    - overlord: prune and abort old changes and tasks
-    - overlord/ifacestate: add implicit slots in setup-profiles
-    - daemon,overlord: setup authentication for store downloads
-    - daemon: macaroon-authed users are like root, and sudoers can login
-    - daemon,client,docs: send install options to daemon
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 16 Apr 2016 22:15:40 +0200
-
-snapd (1.9.4) xenial; urgency=medium
-
-  * New upstream release:
-    - etc: fix desktop file location
-    - overlord/snapstate: stop an update once download sees the revision
-      is already installed
-    - overlord: make SnapState.DevMode a method, store flags
-    - snappy: no more snapYaml in snappy.Snap
-    - daemon,cmd,dirs,lockfile: drop all lockfiles
-    - debian: use sudo in setup of the proxy environment
-    - snap/snapenv,snappy,systemd: expose SNAP_REVISION to app
-      environment
-    - snap: validate similarly to what we did with old snapYaml info
-      from squashfs snaps
-    - daemon,store: plug in authentication for store search/details
-    - overlord/snapstate: fix JSON name of SnapState.Candidate
-    - overlord/snapstate: start using revisions higher than 100000 for
-      local installs (sideloads)
-    - interfaces,overlorf/ifacestate: honor user choice and don't auto-
-      connect disconnected plugs
-    - overlord/auth,daemon,client: hide user ids again
-    - daemon,overlord/snapstate: back /snaps (and so snap list) using
-      state
-    - daemon,client,overlord/auth: rework state auth data
-    - overlord/snapstate: disable Activate and Deactivate
-    - debian: fix silly typo in autopkgtest setup
-    - overlord/ifacestate: remove connection state with discard-conns
-      task, on the removal of last snap
-    - daemon,client: rename API update action to refresh
-    - cmd/snap: rework login to be more resilient
-    - overlord/snapstate: deny two changes on one snap
-    - snappy: fix crash on certain snap.yaml
-    - systemd: use native systemctl enable instead of our own
-      implementation
-    - store: add workaround for misbehaving store
-    - debian: make autopkgtest use the right env vars
-    - state: log do/undo status too when a task is run
-    - docs: update rest.md with price information
-    - daemon: only include price property if the snap is non-free
-    - daemon, client, cmd/snap: connect/disconnect now async
-    - snap,snappy: allow snaps to require system features
-    - integration-tests: fix report of skips in SetUpTest method
-    - snappy: clean out major bits (still using Installed) now
-      unreferenced as cmd/snappy is gone
-    - daemon/api,overlord/auth: add helper to get UserState from a
-      client request
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 15 Apr 2016 23:30:00 +0200
-
-snapd (1.9.3) xenial; urgency=medium
-
-  * New upstream release:
-    - many: prepare for opengl support on classic
-    - interfaces/apparmor: load all apparmor profiles on snap setup
-    - daemon,client: move async resource to change in meta
-    - debian: disable autopilot
-    - snap: add basic progress reporting
-    - client,cmd,daemon,snap,store: show the price of snaps in the cli
-    - state: add minimal taskrunner logging
-    - daemon,snap,overlord/snapstate: in the API get the snap icon using
-      state
-    - client,daemon,overlord: don't guess snap file vs. name
-    - overlord/ifacestate: reload snap connections when setting up
-      security for a given snap
-    - snappy: remove cmd/snappy (superseded in favour of cmd/snap)
-    - interfaecs/apparmor: remove all traces of old-security from
-      apparmor backend
-    - interfaces/builtin: add bluez interface
-    - overlord/ifacestate: don't crash if connection cannot be reloaded
-    - debian: add searchSuite to autopkgtest
-    - client, daemon, cmd/snap: no more tasks; everything is changes
-    - client: send authorization header in client requests
-    - client, daemon: marshal suggested currency over REST
-    - docs, snap: enumerate snap types correctly in docs and comments
-    - many: add store authenticator parameter
-    - overlord/ifacestate,daemon: setup security on conect and
-      disconnect
-    - interfaces/apparmor: remove unused apparmor variables
-    - snapstate: add missing "TaskProgressAdapter.Write()" for working
-      progress reporting
-    - many: clean out snap config related code not for OS
-    - daemon,client,cmd: return snap list from /v2/snaps
-    - docs: update `/v2/snaps` endpoint documentation
-    - interfaces: rename developerMode to devMode
-    - daemon,client,overlord: progress current => done
-    - daemon,client,cmd/snap: move query metadata to top-level doc
-    - interfaces: add TestSecurityBackend
-    - many: replace typographic quotes with ASCII
-    - client, daemon: rework rest changes to export "ready" and "err"
-    - overlord/snapstate,snap,store: track snap-id in side-info and
-      therefore in state
-    - daemon: improve mocking  of interfaces API tests
-    - integration-tests: remove origins in default snap names for udf
-      call
-    - integration-test: use "snap list" in GetCurrentVersion
-    - many: almost no more NewInstalledSnap reading manifest from
-      snapstate and backend
-    - daemon: auto install ubuntu-core if missing
-    - oauth,store: remove OAuth authentication logic
-    - overlord/ifacestate: simplify some tests with implicit manager
-      initialization
-    - store, snappy: move away from hitting details directly
-    - overlord/ifacestate: reload connections when restarting the
-      manager
-    - overlord/ifacestate: increase flexibility of unit tests
-    - overlord: use state to discover all installed snaps
-    - overlord/ifacestate: track connections in the state
-    - many: separate copy-data from unlinking of current snap
-    - overlord/auth,store/auth: add macaroon authenticator to UserState
-    - client: support for /v2/changes and /v2/changes/{id}
-    - daemon/api,overlord/auth: rework authenticated users information
-      in state
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 14 Apr 2016 23:29:43 +0200
-
-snapd (1.9.2) xenial; urgency=medium
-
-  * New upstream release:
-    - cmd/snap,daemon,store: rework login command to use daemon login
-      API
-    - store: cache suggested currency from the store
-    - overlord/ifacestate: modularize and extend tests
-    - integration-tests: reenable failure tests
-    - daemon: include progress in rest changes
-    - daemon, overlord/state: expose individual changes
-    - overlord/ifacestate: drop duplicate package comment
-    - overlord/ifacestate: allow tests to override security backends
-    - cmd/snap: install *.snap and *.snap.* as files too
-    - interfaces/apparmor: replace /var/lib/snap with /var/snap
-    - daemon,overlord/ifacestate: connect REST API to interfaces in the
-      overlord
-    - debian: remove unneeded dependencies from snapd
-    - overlord/state: checkpoint on final progress only
-    - osutil: introduce IsUIDInAny
-    - overlord/snapstate: rename GetSnapState to Get, SetSnapState to
-      Set
-    - daemon: add id to changes json
-    - overlord/snapstate: SetSnapState() needs locks
-    - overlord: fix broken tests
-    - overlord/snapstate,overlord/ifacestate: reimplement SnapInfo (as
-      Info) actually using the state
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 13 Apr 2016 17:27:00 +0200
-
-snapd (1.9.1.1) xenial; urgency=medium
-
-  * debian/tests/control:
-    - add git to make autopkgtest work
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 Apr 2016 17:19:19 +0200
-
-snapd (1.9.1) xenial; urgency=medium
-
-  * Add warning about installing ubuntu-core-snapd-units on Desktop systems.
-  * Add ${misc:Depends} to ubuntu-core-snapd-units.
-  * interfaces,overlord: add support for auto-connecting plugs on
-    install
-  * fix sideloading snaps and (re)add tests for this
-  * add `ca-certificates` to the test-dependencies to fix autopkgtest
-    failure on armhf
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 Apr 2016 14:39:57 +0200
-
-snapd (1.9) xenial; urgency=medium
-
-  * rename source and binary package to "snapd"
-  * update directory layout to final 16.04 layout
-  * use `snap` command instead of the previous `snappy`
-  * use `interface` based security
-  * use new state engine for install/update/remove
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 Apr 2016 01:05:09 +0200
-
-ubuntu-snappy (1.7.3+20160310ubuntu1) xenial; urgency=medium
-
-    - debian: update versionized ubuntu-core-launcher dependency
-    - debian: tweak desktop file dir, ship Xsession.d snip for seamless
-      integration
-    - snappy: fix hw-assign to work with per-app udev tags
-    - snappy: use $snap.$app as per-app udev tag
-    - snap,snappy,systemd: %s/\<SNAP_ORIGIN\>/SNAP_DEVELOPER/g
-    - snappy: add mksquashfs --no-xattrs parameter
-    - snap,snappy,systemd: kill SNAP_FULLNAME
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 10 Mar 2016 09:26:20 +0100
-
-ubuntu-snappy (1.7.3+20160308ubuntu1) xenial; urgency=medium
-
-    - snappy,snap: move icon under meta/gui/
-    - debian: add snap.8 manpage
-    - debian: move snapd to /usr/lib/snappy/snapd
-    - snap,snappy,systemd: remove TMPDIR, TEMPDIR, SNAP_APP_TMPDIR
-    - snappy,dirs: add support to use desktop files from inside snaps
-    - daemon: snapd API events endpoint redux
-    - interfaces/builtin: add "network" interface
-    - overlord/state: do small fixes (typo, id clashes paranoia)
-    - overlord: add first pass of the logic in StateEngine itself
-    - overlord/state: introduce Status/SetStatus on Change
-    - interfaces: support permanent security snippets
-    - overlord/state: introduce Status/SetStatus and
-      Progress/SetProgress on Task
-    - overlord/state: introduce Task and Change.NewTask
-    - many: selectively swap semantics of plugs and slots
-    - client,cmd/snap: remove useless indirection in Interfaces
-    - interfaces: maintain Plug and Slot connection details
-    - client,daemon,cmd/snap: change POST /2.0/interfaces to work with
-      lists
-    - overlord/state: introduce Change and NewChange on state to create
-      them
-    - snappy: bugfix for snap.yaml parsing to be more consistent with
-      the spec
-    - snappy,systemd: remove "ports" from snap.yaml
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 08 Mar 2016 11:24:09 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu4) xenial; urgency=medium
-
-  * rename:
-    debian/golang-snappy-dev.install ->
-       debian/golang-github-ubuntu-core-snappy-dev.install:
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 12:29:16 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu3) xenial; urgency=medium
-
-  * really fix typo in dependency name
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 12:21:39 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu2) xenial; urgency=medium
-
-  * fix typo in dependency name
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 12:05:36 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu1) xenial; urgency=medium
-
-    - debian: update build-depends for MIR
-    - many: implement new REST API: GET /2.0/interfaces
-    - integration-tests: properly stop snapd from branch
-    - cmd/snap: update tests for go-flags changes
-    - overlord/state: implement Lock/Unlock with implicit checkpointing
-    - overlord: split out the managers and State to their own
-      subpackages of overlord
-    - snappy: rename "migration-skill" to "old-security" and use new
-      interface names instead of skills
-    - client,cmd/snap: clarify name ambiguity in Plug or Slot
-    - overlord: start working on state engine along spec v2, have the
-      main skeleton follow that
-    - classic, oauth: update tests for change in MakeRandomString()
-    - client,cmd/snap: s/add/install/:-(
-    - interfaces,daemon: specialize Name to either Plug or Slot
-    - interfaces,interfaces/types: unify security snippet functions
-    - snapd: close the listener on Stop, to force the http.Serve loop to
-      exit
-    - snappy,daemon,snap/lightweight,cmd/snappy,docs/rest.md: expose
-      explicit channel selection to rest api
-    - interfaces,daemon: rename package holding built-in interfaces
-    - integration-tests: add the first classic dimension tests
-    - client,deaemon,docs: rename skills to interfaces on the wire
-    - asserts: add identity assertion type
-    - integration-tests: add the no_proxy env var
-    - debian: update build-depends for new package names
-    - oauth: fix oauth & quoting in the oauth_signature
-    - integration-tests: remove unused field
-    - integration-tests: add the http proxy argument
-    - interfaces,interfaces/types,deamon: mass internal rename to
-      interfaces
-    - client,cmd/snap: rename skills to interfaces (part 2)
-    - arch: fix missing mapping for powerpc
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 11:00:19 +0100
-
-ubuntu-snappy (1.7.3+20160225ubuntu1) xenial; urgency=medium
-
-    - integration-tests: always use the built snapd when compiling
-      binaries from branch
-    - cmd/snap: rename skills to interfaces
-    - testutil,skills/types,skills,daemon: tweak discovery of know skill
-      types
-    - docs: add docs for arm64 cross building
-    - overlord: implement basic ReadState/WriteState
-    - overlord: implement Get/Set/Copy on State
-    - integration-tests: fix dd output check
-    - integration-tests: add fromBranch config field
-    - integration-tests: use cli pkg methods in hwAssignSuite
-    - debian: do not create the snappypkg user, we don't need it anymore
-    - arch: fix build failure on s390x
-    - classic: cleanup downloaded lxd tarball
-    - cmd/snap,client,integration-tests: rename snap subcmds
-      'assert'=>'ack', 'asserts'=>'known'
-    - skills: fix broken tests builds
-    - skills,skills/types: pass slot to SlotSecuritySnippet()
-    - skills/types: teach bool-file about udev security
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 25 Feb 2016 16:17:19 +0100
-
-ubuntu-snappy (1.7.2+20160223ubuntu1) xenial; urgency=medium
-
-  * New git snapshot:
-    - asserts: introduce snap-declaration
-    - cmd/snap: fix integration tests for the "cmd_asserts"
-    - integration-tests: fix fanctl output check
-    - cmd/snap: fix test failure after merging 23a64e6
-    - cmd/snap: replace skip-help with empty description
-    - docs: update security.md to match current migration-skill
-      semantics
-    - snappy: treat commands with 'daemon' field as services
-    - asserts: use more consistent names for receivers in
-      snap_asserts*.go
-    - debian: add missing golang-websocket-dev build-dependency
-    - classic: if classic fails to get created, undo the bind mounts
-    - snappy: never return nil in NewLocalSnapRepository()
-    - notifications: A simple notification system
-    - snappy: when using staging, authenticate there instead
-    - integration-tests/snapd: fix the start of the test snapd socket
-    - skills/types: use CamelCase for security names
-    - skills: add support for implicit revoke
-    - skills: add security layer
-    - integration-tests: use exec.Command wrapper for updates
-    - cmd/snap: add 'snap skills'
-    - cms/snap: add 'snap revoke'
-    - docs: add docs for skills API
-    - cmd/snap: add 'snap grant'
-    - cmd/snappy, coreconfig, daemon, snappy: move config to always be
-      bytes (in and out)
-    - overlord: start with a skeleton and stubs for Overlord,
-      StateEngine, StateJournal and managers
-    - integration-tests: skip tests affected by LP: #1544507
-    - skills/types: add bool-file
-    - po: refresh translation templates
-    - cmd/snap: add 'snap experimental remove-skill-slot'
-    - asserts: introduce device assertion
-    - cmd/snap: implemented add, remove, purge, refresh, rollback,
-      activate, deactivate
-    - cmd/snap: add 'snap experimental add-skill-slot'
-    - cmd/snap: add 'snap experimental remove-skill'
-    - cmd/snap: add tests for common skills code
-    - cmd/snap: add 'snap experimental add-skill'
-    - asserts: make assertion checkers used by db.Check modular and
-      pluggable
-    - cmd,client,daemon,caps,docs,po: remove capabilities
-    - scripts: move the script to get dependencies to a separate file
-    - asserts: make the disk layout compatible for storing more than one
-      revision
-    - cmd/snap: make the assert command options exported
-    - integration-tests: Remove the target release and channel
-    - asserts: introduce model assertion
-    - integration-tests: add exec.Cmd wrapper
-    - cmd/snap: add client test support methods
-    - cmd/snap: move key=value attribute parsing to commmon
-    - cmd/snap: apply new style consistency to "snap" commands.
-    - cmd/snap: support redirecting the client for testing
-    - cmd/snap: support testing command output
-    - snappy,daemon: remove the meta repositories abstractions
-    - cmd: add support for experimental commands
-    - cmd/snappy,daemon,snap,snappy: remove SetActive from parts
-    - cmd/snappy,daemon,snappy,snap: remove config from parts interface
-    - client: improve test data
-    - cmd: allow to construct a fresh parser
-    - cmd: don't treat help as an error
-    - cmd/snappy,snappy: remove "Details" from the repository interface
-    - asserts: check that primary keys are set when
-      Decode()ing/assembling assertions
-    - snap,snappy: refactor to remove "Install" from the Part interface
-    - client,cmd: make client.New() configurable
-    - client: enable retrieving asynchronous operation information with
-      `Client.Operation`.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 23 Feb 2016 11:28:18 +0100
-
-ubuntu-snappy (1.7.2+20160204ubuntu1) xenial; urgency=medium
-
-  * New git snapshot:
-    - integration-tests: fix the rollback error messages
-    - integration-test: use the common cli method when trying to install
-      an unexisting snap
-    - integration-tests: rename snap find test
-    - daemon: refactor makeErrorResponder()
-    - integration: add regression test for LP: #1541317
-    - integration-tests: reenable TestRollbackMustRebootToOtherVersion
-    - asserts: introduce "snap asserts" subcmd to show assertions in the
-      system db
-    - docs: fix parameter style
-    - daemon: use underscore in JSON interface
-    - client: add skills API
-    - asserts,docs/rest.md: change Encoder not to add extra newlines at
-      the end of the stream
-    - integration-tests: "snappy search" is no more, its "snap search"
-      now
-    - README, integration-tests/tests: chmod snapd.socket after manual
-      start.
-    - snappy: add default security profile if none is specified
-    - skills,daemon: add REST APIs for skills
-    - cmd/snap, cmd/snappy: move from `snappy search` to `snap find`.
-    - The first step towards REST world domination: search is now done
-      via
-    - debian: remove obsolete /etc/grub.d/09_snappy on upgrade
-    - skills: provide different security snippets for skill and slot
-      side
-    - osutil: make go vet happy again
-    - snappy,systemd: use Type field in systemd.ServiceDescription
-    - skills: add basic grant-revoke methods
-    - client,daemon,asserts: expose the ability to query assertions in
-      the system db
-    - skills: add basic methods for slot handling
-    - snappy,daemon,snap: move "Uninstall" into overlord
-    - snappy: move SnapFile.Install() into Overlord.Install()
-    - integration-tests: re-enable some failover tests
-    - client: remove snaps
-    - asserts: uniform searching across trusted (account keys) and main
-      backstore
-    - asserts: introduce Decoder to parse streams of assertions and
-      Encoder to build them
-    - client: filter snaps with a search query
-    - client: pass query as well as path in client internals
-    - skills: provide different security snippets for skill and slot
-      side
-    - snappy: refactor snapYaml to remove methods on snapYaml type
-    - snappy: remove unused variable from test
-    - skills: add basic methods for skill handing
-    - snappy: remove support for meta/package.yaml and implement new
-      meta/snap.yaml
-    - snappy: add new overlord type responsible for
-      Installed/Install/Uninstall/SetActive and stub it out
-    - skills: add basic methods for type handling
-    - daemon, snappy: add find (aka search)
-    - client: filter snaps by type
-    - skills: tweak valid names and error messages
-    - skills: add special skill type for testing
-    - cmd/snapd,daemon: filter snaps by type
-    - partition: remove obsolete uEnv.txt
-    - skills: add Type interface
-    - integration-tests: fix the bootloader path
-    - asserts: introduce a memory backed assertion backstore
-    - integration-tests: get name of OS snap from bootloader
-    - cmd/snapd,daemon: filter snaps by source
-    - asserts,daemon: bump some copyright years for things that have
-      been touched in the new year
-    - skills: add the initial Repository type
-    - skills: add a name validation function
-    - client: filter snaps by source
-    - snappy: unmount the squashfs snap again if it fails to install
-    - snap: make a copy of the search uri before mutating it
-      Closes: LP#1537005
-    - cmd/snap,client,daemon,asserts: introduce "assert " snap
-      subcommand
-    - cmd/snappy, snappy: fix failover handling of the "active"
-      kernel/os snap
-    - daemon, client, docs/rest.md, snapd integration tests: move to the
-      new error response
-    - asserts: change Backstore interface, backstores can now access
-      primary key names from types
-    - asserts: make AssertionType into a real struct exposing the
-      metadata Name and PrimaryKey
-    - caps: improve bool-file sanitization
-    - asserts: fixup toolbelt to use exposed key ID.
-    - client: return by reference rather than by value
-    - asserts: exported filesystem backstores + explicit backstores
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 04 Feb 2016 16:35:31 +0100
-
-ubuntu-snappy (1.7.2+20160113ubuntu1) xenial; urgency=medium
-
-  * New git snapshot
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 13 Jan 2016 11:25:40 +0100
-
-ubuntu-snappy (1.7.2ubuntu1) xenial; urgency=medium
-
-  * New upstream release:
-    - bin-path integration
-    - assertions/capability work
-    - fix squashfs based snap building
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Dec 2015 08:46:35 +0100
-
-ubuntu-snappy (1.7.1ubuntu1) xenial; urgency=medium
-
-  * New upstream release:
-    - fix dependencies
-    - fix armhf builds
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 02 Dec 2015 07:46:07 +0100
-
-ubuntu-snappy (1.7ubuntu1) xenial; urgency=medium
-
-  * New upstream release:
-    - kernel/os snap support
-    - squashfs snap support
-    - initial capabilities work
-    - initial assertitions work
-    - rest API support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 18 Nov 2015 19:59:51 +0100
-
-ubuntu-snappy (1.6ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Fix hwaccess for gpio (LP: #1493389, LP: #1488618)
-    - Fix handleAssets name normalization
-    - Run boot-ok job late (LP: #1476129)
-    - Add support for systemd socket files
-    - Add "snappy service" command
-    - Documentation improvements
-    - Many test improvements (unit and integration)
-    - Override sideload versions
-    - Go1.5 fixes
-    - Add i18n
-    - Add man-page
-    - Add .snapignore
-    - Run services that uses external ports only after the network is up
-    - Bufix in Synbootloader (LP: 1474125)
-    - Use uboot.env for boot state tracking
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 09 Sep 2015 14:20:22 +0200
-
-ubuntu-snappy (1.5ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Use O_TRUNC when copying files
-    - Added path redefinition to include test's binaries location
-    - Don't run update-grub, instead use grub.cfg from the oem
-      package
-    - Do network configuration from first boot
-    - zero size systemd of new partition made executable to
-      prevent unrecoverable boot failure
-    - Close downloaded files
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Mon, 06 Jul 2015 15:14:37 -0300
-
-ubuntu-snappy (1.4ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Allow to run the integration tests using snappy from branch
-    - Add CopyFileOverwrite flag and behaviour to helpers.CopyFile
-    - add a bunch of missing i18n.G() now that we have gettext
-    - Generate only the translators comments that start with
-      TRANSLATORS
-    - Try both clickpkg and snappypkg when dropping privs
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Thu, 02 Jul 2015 16:21:53 -0300
-
-ubuntu-snappy (1.3ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - gettext support
-    - use snappypkg user for the installed snaps
-    - switch to system-image-3.x as the system-image backend
-    - more reliable developer mode detection
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 01 Jul 2015 10:37:05 +0200
-
-ubuntu-snappy (1.2-0ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Consider the root directory when installing and removing policies
-    - In the uboot TestHandleAssetsNoHardwareYaml, patch the cache dir
-      before creating the partition type
-    - In the PartitionTestSuite, remove the unnecessary patches for
-      defaultCacheDir
-    - Fix the help output of "snappy install -h"
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Wed, 17 Jun 2015 11:42:47 -0300
-
-ubuntu-snappy (1.1.2-0ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Remove compatibility for click-bin-path in generated exec-wrappers
-    - Release the readme.md after parsing it
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Thu, 11 Jun 2015 23:42:49 -0300
-
-ubuntu-snappy (1.1.1-0ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Set all app services to restart on failure
-    - Fixes the missing oauth quoting and makes the code a bit nicer
-    - Added integrate() to set Integration to default values needed for
-      integration
-    - Moved setActivateClick to be a method of SnapPart
-    - Make unsetActiveClick a method of SnapPart
-    - Check the package.yaml for the required fields
-    - Integrate lp:snappy/selftest branch into snappy itself
-    - API to record information about the image and to check if the kernel was
-      sideloaded.
-    - Factor out update from cmd
-    - Continue updating when a sideload error is returned
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Wed, 10 Jun 2015 15:54:12 -0300
-
-ubuntu-snappy (1.1-0ubuntu1) wily; urgency=low
-
-  * New wily upload with fix for go 1.4 syscall.Setgid() breakage
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 09 Jun 2015 10:02:04 +0200
-
-ubuntu-snappy (1.0.1-0ubuntu1) vivid; urgency=low
-
-  * fix symlink unpacking
-  * fix typo in apparmor rules generation
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 23 Apr 2015 16:09:56 +0200
-
-ubuntu-snappy (1.0-0ubuntu1) vivid; urgency=low
-
-  * 15.04 archive upload
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 23 Apr 2015 11:08:22 +0200
-
-ubuntu-snappy (0.1.2-0ubuntu1) vivid; urgency=medium
-
-  * initial ubuntu archive upload
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 13 Apr 2015 22:48:13 -0500
-
-ubuntu-snappy (0.1.1-0ubuntu1) vivid; urgency=low
-
-  * new snapshot
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 12 Feb 2015 13:51:22 +0100
-
-ubuntu-snappy (0.1-0ubuntu1) vivid; urgency=medium
-
-  * Initial packaging
-
- -- Sergio Schvezov <sergio.schvezov@canonical.com>  Fri, 06 Feb 2015 02:25:43 -0200
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/compat snapd-2.48.3+20.04/packaging/ubuntu-16.10/compat
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/compat	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/compat	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-9
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/control snapd-2.48.3+20.04/packaging/ubuntu-16.10/control
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/control	1970-01-01 00:00:00.000000000 +0000
@@ -1,128 +0,0 @@
-Source: snapd
-Section: devel
-Priority: optional
-Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
-Build-Depends: autoconf,
-               automake,
-               autotools-dev,
-               bash-completion,
-               debhelper (>= 9),
-               dbus,
-               dh-apparmor,
-               dh-autoreconf,
-               dh-golang (>=1.7),
-               dh-systemd,
-               fakeroot,
-               gcc-multilib [amd64],
-               gettext,
-               grub-common,
-               gnupg2,
-               golang-go (>=2:1.10)  [!powerpc] | golang-1.10 [!powerpc],
-               indent,
-               init-system-helpers,
-               libapparmor-dev,
-               libcap-dev,
-               libfuse-dev,
-               libglib2.0-dev,
-               liblzma-dev,
-               libseccomp-dev,
-               libudev-dev,
-               openssh-client,
-               pkg-config,
-               python3,
-               python3-docutils,
-               python3-markdown,
-               squashfs-tools,
-               tzdata,
-               udev,
-               xfslibs-dev
-Standards-Version: 3.9.7
-Homepage: https://github.com/snapcore/snapd
-Vcs-Browser: https://github.com/snapcore/snapd
-Vcs-Git: https://github.com/snapcore/snapd.git
-
-Package: golang-github-ubuntu-core-snappy-dev
-Architecture: all
-Depends: golang-github-snapcore-snapd-dev, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: golang-github-snapcore-snapd-dev
-Architecture: all
-Breaks: golang-github-ubuntu-core-snappy-dev (<< 2.0.6),
-        golang-snappy-dev (<< 1.7.3+20160303ubuntu4)
-Replaces: golang-github-ubuntu-core-snappy-dev (<< 2.0.6),
-          golang-snappy-dev (<< 1.7.3+20160303ubuntu4)
-Depends: ${misc:Depends}
-Description: snappy development go packages.
- Use these to use the snappy API.
-
-Package: snapd
-Architecture: any
-Depends: adduser,
-         apparmor (>= 2.10.95-0ubuntu2.2),
-         ca-certificates,
-         openssh-client,
-         squashfs-tools,
-         systemd,
-         udev,
-         ${misc:Depends},
-         ${shlibs:Depends}
-Replaces: ubuntu-snappy (<< 1.9), ubuntu-snappy-cli (<< 1.9), snap-confine (<< 2.23), ubuntu-core-launcher (<< 2.22), snapd-xdg-open (<= 0.0.0)
-Breaks: ubuntu-snappy (<< 1.9), ubuntu-snappy-cli (<< 1.9), snap-confine (<< 2.23), ubuntu-core-launcher (<< 2.22), snapd-xdg-open (<= 0.0.0), ${snapd:Breaks}
-Recommends: gnupg
-Suggests: zenity | kdialog
-Conflicts: snap (<< 2013-11-29-1ubuntu1)
-Built-Using: ${Built-Using} ${misc:Built-Using}
-Description: Daemon and tooling that enable snap packages
- Install, configure, refresh and remove snap packages. Snaps are
- 'universal' packages that work across many different Linux systems,
- enabling secure distribution of the latest apps and utilities for
- cloud, servers, desktops and the internet of things.
- .
- Start with 'snap list' to see installed snaps.
-
-Package: ubuntu-snappy
-Architecture: all
-Depends: snapd, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: ubuntu-snappy-cli
-Architecture: all
-Depends: snapd, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: ubuntu-core-snapd-units
-Architecture: all
-Depends: snapd, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: snap-confine
-Architecture: any
-Section: oldlibs
-Depends: snapd (= ${binary:Version}), ${misc:Depends}
-Description: Transitional package for snapd
- This is a transitional dummy package. It can safely be removed.
-
-Package: ubuntu-core-launcher
-Architecture: any
-Depends: snapd (= ${binary:Version}), ${misc:Depends}
-Section: oldlibs
-Pre-Depends: dpkg (>= 1.15.7.2)
-Description: Transitional package for snapd
- This is a transitional dummy package. It can safely be removed.
-
-Package: snapd-xdg-open
-Architecture: any
-Depends: snapd (= ${binary:Version}), ${misc:Depends}
-Section: oldlibs
-Pre-Depends: dpkg (>= 1.15.7.2)
-Description: Transitional package for snapd-xdg-open
- This is a transitional dummy package. It can safely be removed.
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/copyright snapd-2.48.3+20.04/packaging/ubuntu-16.10/copyright
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/copyright	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/copyright	1970-01-01 00:00:00.000000000 +0000
@@ -1,22 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: snappy
-Source: https://github.com/snapcore/snapd
-
-Files: *
-Copyright: Copyright (C) 2014,2015 Canonical, Ltd.
-License: GPL-3
- This program is free software: you can redistribute it and/or modify it
- under the terms of the the GNU General Public License version 3, as
- published by the Free Software Foundation.
- .
- This program is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranties of
- MERCHANTABILITY, SATISFACTORY QUALITY or FITNESS FOR A PARTICULAR
- PURPOSE.  See the applicable version of the GNU Lesser General Public
- License for more details.
- .
- You should have received a copy of the GNU General Public License
- along with this program.  If not, see <http://www.gnu.org/licenses/>.
- .
- On Debian systems, the complete text of the GNU General Public License
- can be found in `/usr/share/common-licenses/GPL-3'
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/gbp.conf snapd-2.48.3+20.04/packaging/ubuntu-16.10/gbp.conf
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/gbp.conf	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/gbp.conf	1970-01-01 00:00:00.000000000 +0000
@@ -1,7 +0,0 @@
-[buildpackage]
-# use a build area relative to the git repository
-export-dir = ../build-area
-# disable the since the sources are being exported first
-cleaner =
-# post export script that gets the vendored dependencies
-postexport = ./get-deps.sh
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/golang-github-snapcore-snapd-dev.install snapd-2.48.3+20.04/packaging/ubuntu-16.10/golang-github-snapcore-snapd-dev.install
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/golang-github-snapcore-snapd-dev.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/golang-github-snapcore-snapd-dev.install	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-debian/tmp/usr/share/gocode/src/*
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/README.powerpc snapd-2.48.3+20.04/packaging/ubuntu-16.10/README.powerpc
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/README.powerpc	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/README.powerpc	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-Unfortunately snapd is not support on powerpc.
\ No newline at end of file
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/rules snapd-2.48.3+20.04/packaging/ubuntu-16.10/rules
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/rules	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/rules	1970-01-01 00:00:00.000000000 +0000
@@ -1,271 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-#
-# These rules should work for any debian-ish distro that uses systemd
-# as init.  That does _not_ include Ubuntu 14.04 ("trusty"); look for
-# its own special rule file.
-#
-# Please keep the diff between that and this relatively small, even if
-# it means having suboptimal code; these need to be kept in sync by
-# sentient bags of meat.
-
-#export DH_VERBOSE=1
-export DH_OPTIONS
-export DH_GOPKG := github.com/snapcore/snapd
-#export DEB_BUILD_OPTIONS=nocheck
-export DH_GOLANG_EXCLUDES=tests
-export DH_GOLANG_GO_GENERATE=1
-
-export PATH:=${PATH}:${CURDIR}
-# make sure that correct go version is found on trusty
-export PATH:=/usr/lib/go-1.10/bin:${PATH}
-
-include /etc/os-release
-
-# On 18.04 the released version of apt (1.6.1) has a bug that causes
-# problem on "apt purge snapd". To ensure this won't happen add the
-# right dependency on 18.04.
-ifeq (${VERSION_ID},"18.04")
-	SUBSTVARS = -Vsnapd:Breaks="systemd (<< 237-3ubuntu10.24), apt (<< 1.6.3)"
-endif
-# Same as above for 18.10 just a different version.
-ifeq (${VERSION_ID},"18.10")
-	SUBSTVARS = -Vsnapd:Breaks="apt (<< 1.7.0~alpha2)"
-endif
-
-# this is overridden in the ubuntu/14.04 release branch
-SYSTEMD_UNITS_DESTDIR="lib/systemd/system/"
-
-# The go tool does not fully support vendoring with gccgo, but we can
-# work around that by constructing the appropriate -I flag by hand.
-GCCGO := $(shell go tool dist env > /dev/null 2>&1 && echo no || echo yes)
-
-BUILDFLAGS:=-pkgdir=$(CURDIR)/_build/std
-# Disable -buildmode=pie mode on all our 32bit platforms
-# (i386 and armhf). For i386 because of LP: #1711052 and for
-# armhf because of LP: #1822738
-ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH_BITS),64)
- BUILDFLAGS+= -buildmode=pie
-endif
-
-GCCGOFLAGS=
-ifeq ($(GCCGO),yes)
-GOARCH := $(shell go env GOARCH)
-GOOS := $(shell go env GOOS)
-BUILDFLAGS:=
-GCCGOFLAGS=-gccgoflags="-I $(CURDIR)/_build/pkg/gccgo_$(GOOS)_$(GOARCH)/$(DH_GOPKG)/vendor"
-export DH_GOLANG_GO_GENERATE=0
-# workaround for https://github.com/golang/go/issues/23721
-export GOMAXPROCS=2
-endif
-
-# build with "tpm" support on ubuntu by default
-TAGS=
-# check if we need to include the testkeys in the binary
-ifneq (,$(filter testkeys,$(DEB_BUILD_OPTIONS)))
-	TAGS=-tags withtestkeys
-endif
-
-DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
-
-BUILT_USING_PACKAGES=
-# export DEB_BUILD_MAINT_OPTIONS = hardening=+all
-# DPKG_EXPORT_BUILDFLAGS = 1
-# include /usr/share/dpkg/buildflags.mk
-
-# Currently, we enable confinement for Ubuntu only, not for derivatives,
-# because derivatives may have different kernels that don't support all the
-# required confinement features and we don't to mislead anyone about the
-# security of the system.  Discuss a proper approach to this for downstreams
-# if and when they approach us.
-ifeq ($(shell dpkg-vendor --query Vendor),Ubuntu)
-    # On Ubuntu 16.04 we need to produce a build that can be used on wide
-    # variety of systems. As such we prefer static linking over dynamic linking
-    # for stability, predicability and easy of deployment. We need to link some
-    # things dynamically though: udev has no stable IPC protocol between
-    # libudev and udevd so we need to link with it dynamically.
-    VENDOR_ARGS=--enable-nvidia-multiarch --enable-static-libcap --enable-static-libapparmor --with-host-arch-triplet=$(DEB_HOST_MULTIARCH)
-ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH),amd64)
-		VENDOR_ARGS+= --with-host-arch-32bit-triplet=$(shell dpkg-architecture -f -ai386 -qDEB_HOST_MULTIARCH)
-endif
-    BUILT_USING_PACKAGES=libcap-dev libapparmor-dev libseccomp-dev
-else
-ifeq ($(shell dpkg-vendor --query Vendor),Debian)
-    BUILT_USING_PACKAGES=libcap-dev
-else
-    VENDOR_ARGS=--disable-apparmor
-endif
-endif
-BUILT_USING=$(shell dpkg-query -f '$${source:Package} (= $${source:Version}), ' -W $(BUILT_USING_PACKAGES))
-
-%:
-ifneq ($(shell dpkg-architecture -qDEB_HOST_ARCH),powerpc)
-	dh $@ --buildsystem=golang --with=golang --fail-missing --with systemd --builddirectory=_build
-else
-	# "powerpc" is not supported unfortunately, do nothing here
-	# See https://github.com/tianon/debian-runc/compare/70957b315f82170dc2ab7085d39c23835c0fa996...xenial for a more elaborate version of this idea.
-	# Note that snapd never really worked on powerpc (we never had a core
-	# snap there) so we don't need to show anything to the user
-	if [ "$@" = "clean" ]; then \
-		rm -rf debian/snapd; \
-	fi; \
-	if [ "$@" = "binary" ] || [ "$@" = "binary-arch" ]; then \
-		install -m755 -d debian/snapd/usr/share/doc/snapd/; \
-		cp debian/README.powerpc debian/snapd/usr/share/doc/snapd/; \
-		dh_installdeb; \
-		dh_gencontrol; \
-		dh_builddeb; \
-	fi;
-endif
-
-override_dh_fixperms:
-	dh_fixperms -Xusr/lib/snapd/snap-confine
-
-
-# The .real profile is a workaround for a bug in dpkg LP: #1673247 that causes
-# ubiquity to crash. It allows us to "move" the snap-confine profile from
-# snap-confine into snapd in a way that works with old dpkg that is in the live
-# CD image.
-#
-# Because both the usual and the .real profile describe the same binary the
-# .real profile takes priority (as it is loaded later).
-#
-# We need run dh_apparmor *before* dh_systemd_enable to ensure the postinst
-# snippets are added in the right order (first the new apparmor profile
-# is loaded, then we restart the service).
-override_dh_systemd_enable:
-	dh_apparmor --profile-name=usr.lib.snapd.snap-confine.real -psnapd
-	dh_systemd_enable
-
-override_dh_clean:
-ifneq (,$(TEST_GITHUB_AUTOPKGTEST))
-	# this will be set by the GITHUB webhook to trigger a autopkgtest
-	# we only need to run "govendor sync" here and then its ready
-	(export GOPATH="/tmp/go"; \
-	  mkdir -p /tmp/go/src/github.com/snapcore/; \
-          cp -ar . /tmp/go/src/github.com/snapcore/snapd; \
-	  go get -u github.com/kardianos/govendor; \
-	  (cd /tmp/go/src/github.com/snapcore/snapd ; /tmp/go/bin/govendor sync); \
-	  cp -ar /tmp/go/src/github.com/snapcore/snapd/vendor/ .; \
-        )
-endif
-	dh_clean
-	$(MAKE) -C data clean
-	# XXX: hacky
-	$(MAKE) -C cmd distclean || true
-	# XXX: hacky^2
-	(cd vendor/github.com/snapcore/squashfuse/src && rm -f snapfuse && make distclean || true )
-
-override_dh_auto_build:
-	# usually done via `go generate` but that is not supported on powerpc
-	./mkversion.sh
-	# Build golang bits
-	mkdir -p _build/src/$(DH_GOPKG)/cmd/snap/test-data
-	cp -a cmd/snap/test-data/*.gpg _build/src/$(DH_GOPKG)/cmd/snap/test-data/
-
-	# this is the main go build
-	SNAPD_VANILLA_GO=$$(which go) PATH="$$(pwd)/packaging/build-tools/:$$PATH" dh_auto_build -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
-
-	# Generate static snap-exec, snapctl and snap-update-ns - it somehow includes CGO so
-	# we must force a static build here. We need a static snap-{exec,update-ns}/snapctl
-	# inside the core snap because not all bases will have a libc
-	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build CGO_ENABLED=0 go build $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snap-exec)
-	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build CGO_ENABLED=0 go build $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snapctl)
-	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build --ldflags '-extldflags "-static"' $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snap-update-ns)
-
-	# ensure we generated a static build
-	$(shell	if ldd _build/bin/snap-exec; then false "need static build"; fi)
-	$(shell	if ldd _build/bin/snap-update-ns; then false "need static build"; fi)
-	$(shell	if ldd _build/bin/snapctl; then false "need static build"; fi)
-
-	# ensure snap-seccomp is build with a static libseccomp on Ubuntu
-ifeq ($(shell dpkg-vendor --query Vendor),Ubuntu)
-	sed -i "s|#cgo LDFLAGS:|#cgo LDFLAGS: /usr/lib/$(shell dpkg-architecture -qDEB_TARGET_MULTIARCH)/libseccomp.a|" _build/src/$(DH_GOPKG)/cmd/snap-seccomp/main.go
-	(cd _build/bin && GOPATH=$$(pwd)/..  GOCACHE=/tmp/go-build CGO_LDFLAGS_ALLOW="/.*/libseccomp.a" go build $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snap-seccomp)
-	# ensure that libseccomp is not dynamically linked
-	ldd _build/bin/snap-seccomp
-	test "$$(ldd _build/bin/snap-seccomp | grep libseccomp)" = ""
-	# revert again so that the subsequent tests work
-	sed -i "s|#cgo LDFLAGS: /usr/lib/$(shell dpkg-architecture -qDEB_TARGET_MULTIARCH)/libseccomp.a|#cgo LDFLAGS:|" _build/src/$(DH_GOPKG)/cmd/snap-seccomp/main.go
-endif
-
-	# Build C bits, sadly manually
-	cd cmd && ( autoreconf -i -f )
-	cd cmd && ( ./configure --prefix=/usr --libexecdir=/usr/lib/snapd $(VENDOR_ARGS))
-	$(MAKE) -C cmd all
-
-	# Generate the real systemd/dbus/env config files
-	$(MAKE) -C data all
-
-	# build squashfuse and rename to snapfuse
-	(cd vendor/github.com/snapcore/squashfuse/src && mkdir -p autom4te.cache && ./autogen.sh --disable-demo && ./configure --disable-demo && make && mv squashfuse_ll snapfuse)
-
-override_dh_auto_test:
-	dh_auto_test -- $(BUILDFLAGS) -tags "$(TAGS)" $(GCCGOFLAGS)
-# a tested default (production) build should have no test keys
-ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
-	# check that only the main trusted account-keys are included
-	for b in _build/bin/snapd _build/bin/snap-bootstrap _build/bin/snap-preseed; do \
-	  [ $$(strings $$b |grep -c -E "public-key-sha3-384: [a-zA-Z0-9_-]{64}") -eq 2 ] && \
-	  strings $$b |grep -c "^public-key-sha3-384: -CvQKAwRQ5h3Ffn10FILJoEZUXOv6km9FwA80-Rcj-f-6jadQ89VRswHNiEB9Lxk$$" && \
-	  strings $$b |grep -c "^public-key-sha3-384: d-JcZF9nD9eBw7bwMnH61x-bklnQOhQud1Is6o_cn2wTj8EYDi9musrIT9z2MdAa$$"; \
-	done;
-	# same for snap-repair
-	[ $$(strings _build/bin/snap-repair|grep -c -E "public-key-sha3-384: [a-zA-Z0-9_-]{64}") -eq 3 ]
-	# common with snapd
-	strings _build/bin/snap-repair|grep -c "^public-key-sha3-384: -CvQKAwRQ5h3Ffn10FILJoEZUXOv6km9FwA80-Rcj-f-6jadQ89VRswHNiEB9Lxk$$"
-	strings _build/bin/snap-repair|grep -c "^public-key-sha3-384: d-JcZF9nD9eBw7bwMnH61x-bklnQOhQud1Is6o_cn2wTj8EYDi9musrIT9z2MdAa$$"
-	# repair-root
-	strings _build/bin/snap-repair|grep -c "^public-key-sha3-384: nttW6NfBXI_E-00u38W-KH6eiksfQNXuI7IiumoV49_zkbhM0sYTzSnFlwZC-W4t$$"
-endif
-ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
-	# run the snap-confine tests
-	$(MAKE) -C cmd check
-endif
-
-override_dh_install:
-	# we do not need this in the package, its just needed during build
-	rm -rf ${CURDIR}/debian/tmp/usr/bin/xgettext-go
-	# toolbelt is not shippable
-	rm -f ${CURDIR}/debian/tmp/usr/bin/toolbelt
-	# we do not like /usr/bin/snappy anymore
-	rm -f ${CURDIR}/debian/tmp/usr/bin/snappy
-	# i18n stuff
-	mkdir -p debian/snapd/usr/share
-	if [ -d share/locale ]; then \
-		cp -R share/locale debian/snapd/usr/share; \
-	fi
-	# chrorder generator
-	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
-
-	# Install snapd's systemd units / upstart jobs, done
-	# here instead of debian/snapd.install because the
-	# ubuntu/14.04 release branch adds/changes bits here
-	$(MAKE) -C data install DESTDIR=$(CURDIR)/debian/snapd/ \
-		SYSTEMDSYSTEMUNITDIR=$(SYSTEMD_UNITS_DESTDIR)
-	# We called this apps-bin-path.sh instead of snapd.sh, and
-	# it's a conf file so we're stuck with it
-	mv debian/snapd/etc/profile.d/snapd.sh debian/snapd/etc/profile.d/apps-bin-path.sh
-
-	$(MAKE) -C cmd install DESTDIR=$(CURDIR)/debian/tmp
-
-	# Rename the apparmor profile, see dh_apparmor call above for an explanation.
-	mv $(CURDIR)/debian/tmp/etc/apparmor.d/usr.lib.snapd.snap-confine $(CURDIR)/debian/tmp/etc/apparmor.d/usr.lib.snapd.snap-confine.real
-
-	dh_install
-
-override_dh_auto_install: snap.8
-	dh_auto_install -O--buildsystem=golang
-
-snap.8:
-	# fix reproducible builds as reported by:
-	#   https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/snapd.html
-	# once golang-go-flags is fixed we can remove the "sed" expression
-	$(CURDIR)/_build/bin/snap help --man | sed '1 s/^.*/.TH snap 8 "$(shell date --reference=debian/changelog +"%d %B %Y")"/' > $@
-
-override_dh_auto_clean:
-	dh_auto_clean -O--buildsystem=golang
-	rm -vf snap.8
-
-override_dh_gencontrol:
-	dh_gencontrol -- -VBuilt-Using="$(BUILT_USING)" $(SUBSTVARS)
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snap-confine.maintscript snapd-2.48.3+20.04/packaging/ubuntu-16.10/snap-confine.maintscript
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snap-confine.maintscript	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snap-confine.maintscript	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-rm_conffile /etc/apparmor.d/usr.lib.snapd.snap-confine 2.23.6~
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.autoimport.udev snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.autoimport.udev
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.autoimport.udev	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.autoimport.udev	1970-01-01 00:00:00.000000000 +0000
@@ -1,3 +0,0 @@
-# probe for assertions, must run before udisks2
-ACTION=="add", SUBSYSTEM=="block" \
-    RUN+="/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/%k"
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.dirs snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.dirs
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.dirs	1970-01-01 00:00:00.000000000 +0000
@@ -1,17 +0,0 @@
-snap
-var/cache/snapd
-usr/lib/snapd
-var/lib/snapd/apparmor/snap-confine
-var/lib/snapd/desktop/applications
-var/lib/snapd/auto-import
-var/lib/snapd/desktop
-var/lib/snapd/environment
-var/lib/snapd/firstboot
-var/lib/snapd/lib/gl
-var/lib/snapd/lib/gl32
-var/lib/snapd/lib/glvnd
-var/lib/snapd/lib/vulkan
-var/lib/snapd/ssl/store-certs
-var/lib/snapd/snaps/partial
-var/lib/snapd/void
-var/snap
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.install snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.install
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.install	1970-01-01 00:00:00.000000000 +0000
@@ -1,52 +0,0 @@
-usr/bin/snap
-usr/bin/snapctl /usr/lib/snapd/
-usr/lib/snapd/system-shutdown
-usr/bin/snap-exec /usr/lib/snapd/
-usr/bin/snap-repair /usr/lib/snapd/
-usr/bin/snap-failure /usr/lib/snapd/
-usr/bin/snap-update-ns /usr/lib/snapd/
-usr/bin/snapd /usr/lib/snapd/
-usr/bin/snap-seccomp /usr/lib/snapd/
-usr/bin/snap-bootstrap /usr/lib/snapd/
-usr/bin/snap-preseed /usr/lib/snapd/
-usr/bin/snap-recovery-chooser /usr/lib/snapd/
-
-# bash completion
-data/completion/bash/snap /usr/share/bash-completion/completions
-data/completion/bash/complete.sh /usr/lib/snapd/
-data/completion/bash/etelpmoc.sh /usr/lib/snapd/
-# zsh completion
-data/completion/zsh/_snap /usr/share/zsh/vendor-completions
-# udev, must be installed before 80-udisks
-data/udev/rules.d/66-snapd-autoimport.rules /lib/udev/rules.d
-# snap/snapd version information
-data/info /usr/lib/snapd/
-# polkit actions
-data/polkit/io.snapcraft.snapd.policy /usr/share/polkit-1/actions/
-# apt hook
-data/apt/20snapd.conf /etc/apt/apt.conf.d/
-
-# snap-confine stuff
-etc/apparmor.d/usr.lib.snapd.snap-confine.real
-usr/lib/snapd/snap-device-helper
-usr/lib/snapd/snap-mgmt
-usr/lib/snapd/snap-confine
-usr/lib/snapd/snap-discard-ns
-usr/share/man/
-# for compatibility with ancient snap installs that wrote the shell based
-# wrapper scripts instead of the modern symlinks
-usr/bin/ubuntu-core-launcher
-
-# gdb helper
-usr/lib/snapd/snap-gdb-shim
-
-# install squashfuse as snapfuse to ensure it is available in e.g. lxd
-vendor/github.com/snapcore/squashfuse/src/snapfuse usr/bin
-
-# use "usr/lib" here because apparently systemd looks only there
-usr/lib/systemd/system-environment-generators
-# but system generators end up in lib
-lib/systemd/system-generators
-
-# service for loading apparmor profiles for snap applications
-usr/lib/snapd/snapd-apparmor
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.links snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.links
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.links	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.links	1970-01-01 00:00:00.000000000 +0000
@@ -1,6 +0,0 @@
-/usr/lib/snapd/snap-device-helper  /lib/udev/snappy-app-dev
-usr/lib/snapd/snapctl usr/bin/snapctl
-
-# This should be removed once we can rely on debhelper >= 11.5:
-#     https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=764678
-/usr/lib/systemd/user/snapd.session-agent.socket /usr/lib/systemd/user/sockets.target.wants/snapd.session-agent.socket
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.maintscript snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.maintscript
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.maintscript	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.maintscript	1970-01-01 00:00:00.000000000 +0000
@@ -1,5 +0,0 @@
-# keep mount point busy
-# we used to ship a custom grub config that is no longer needed
-rm_conffile /etc/grub.d/09_snappy 1.7.3ubuntu1
-rm_conffile /etc/ld.so.conf.d/snappy.conf 2.0.7~
-rm_conffile /etc/apparmor.d/usr.lib.snapd.snap-confine 2.23.6~
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.manpages snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.manpages
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.manpages	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.manpages	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-snap.8
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.postinst snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.postinst
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.postinst	2020-07-10 13:34:33.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.postinst	1970-01-01 00:00:00.000000000 +0000
@@ -1,75 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-case "$1" in
-    configure)
-        # ensure /var/lib/snapd/lib/gl is cleared
-        if dpkg --compare-versions "$2" lt-nl "2.0.7"; then
-            ldconfig
-        fi
-
-        # Ensure that we undo the damage done by the snap.mount unit that was present
-        # in snapd 2.31.
-        #
-        # We found that update scripts make systemd stop inactive mount units and this
-        # in turn stops all the units that depend on it so when the snap.mount unit is
-        # stopped all the per-snap mount units gets stopped along with them.  The 2.31
-        # release was only out briefly in xenial-proposed and bionic but to keep the
-        # affected users safe let's start all the per-snap mount units so that snaps no
-        # longer appear as broken after update.
-        if dpkg --compare-versions "$2" ge-nl "2.31" && \
-                dpkg --compare-versions "$2" lt-nl "2.32"; then
-            units=$(systemctl list-unit-files --full | grep '^snap[-.]' | cut -f1 -d ' ' | grep -vF snap.mount.service || true)
-            mounts=$(echo "$units" | grep '^snap[-.].*\.mount$' || true)
-            for unit in $mounts; do
-                # ensure its really a snap mount unit or systemd unit
-                if ! grep -q 'What=/var/lib/snapd/snaps/' "/etc/systemd/system/$unit" && ! grep -q 'X-Snappy=yes' "/etc/systemd/system/$unit"; then
-                    echo "Skipping non-snapd systemd unit $unit"
-                    continue
-                fi
-
-                echo "Starting $unit"
-                deb-systemd-invoke start "$unit" || true
-            done
-        fi
-
-        # In commit 0dce4704a5d (2017-03-28, snapd v2.23.6) we renamed
-        # /etc/apparmor.d/usr.lib.snap-confine to usr.lib.snap-confine.real
-        # to fix LP: #1673247 - however some people (developers?) still have
-        # the old usr.lib.snap-confine file. This seems to be loaded instead
-        # of the correct usr.lib.snap-confine.real profile. To fix this we
-        # use the rather blunt approach to rename the file forcefully.
-        if test -f /etc/apparmor.d/usr.lib.snapd.snap-confine && test -f /etc/apparmor.d/usr.lib.snapd.snap-confine.real; then
-            mv /etc/apparmor.d/usr.lib.snapd.snap-confine /etc/apparmor.d/usr.lib.snapd.snap-confine.dpkg-bak
-        fi
-
-        # Ensure that the void directory has correct permissions.
-        chmod 111 /var/lib/snapd/void
-
-        # Ubuntu 20.04 had a incorrect seed directory during development.
-        #
-        # This was causing hangs in the postinst when systemctl tries to
-        # start snapd.seeded.service which will wait for snapd to finish
-        # seeding (which will never happen because seeding is broken).
-        # See LP: 1868706
-        # This snippet detect this incorrect seed and disables it.
-        if [ -e /var/lib/snapd/seed/seed.yaml ] && [ "$(snap debug state --is-seeded /var/lib/snapd/state.json)" = "false" ]; then
-            if ! snap debug validate-seed /var/lib/snapd/seed/seed.yaml; then
-                echo "Found incorrect seed, disabling it"
-                mv /var/lib/snapd/seed /var/lib/snapd/seed.disabled
-            fi
-        fi
-
-        # ensure "snap userd" is restarted
-        if dpkg --compare-versions "$2" lt-nl "2.45.2"; then
-            pkill -f "snap userd" || true
-        fi
-esac
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.postrm snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.postrm
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.postrm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.postrm	1970-01-01 00:00:00.000000000 +0000
@@ -1,132 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-systemctl_stop() {
-    unit="$1"
-
-    echo "Stopping unit $unit"
-    systemctl stop -q "$unit" || true
-
-    for i in $(seq 20); do
-        echo "Waiting until unit $unit is stopped [attempt $i]"
-        if ! systemctl is-active -q "$unit"; then
-            echo "$unit is stopped."
-            return
-        fi
-        sleep .1
-    done
-}
-
-if [ "$1" = "purge" ]; then
-    # Undo any bind mounts to /snap and /var/snap that resulted from parallel
-    # installs for classic snaps or LP:#1668659 (for /snap only, that bug can't
-    # happen in trusty -- and doing this would mess up snap.mount.service there)
-    for mp in /snap /var/snap; do
-        if grep -q " $mp $mp" /proc/self/mountinfo; then
-            umount -l "$mp" || true
-        fi
-    done
-
-    units=$(systemctl list-unit-files --full | grep '^snap[-.]' | cut -f1 -d ' ' | grep -vF snap.mount.service || true)
-    mounts=$(echo "$units" | grep '^snap[-.].*\.mount$' || true)
-    services=$(echo "$units" | grep '^snap[-.].*\.service$' || true)
-
-    for unit in $services $mounts; do
-        # ensure its really a snap mount unit or systemd unit
-        if ! grep -q 'What=/var/lib/snapd/snaps/' "/etc/systemd/system/$unit" && ! grep -q 'X-Snappy=yes' "/etc/systemd/system/$unit"; then
-            echo "Skipping non-snapd systemd unit $unit"
-            continue
-        fi
-
-        echo "Stopping $unit"
-        systemctl_stop "$unit"
-
-        # if it is a mount unit, we can find the snap name in the mount
-        # unit (we just ignore unit files)
-        snap=$(grep 'Where=/snap/' "/etc/systemd/system/$unit"|cut -f3 -d/)
-        rev=$(grep 'Where=/snap/' "/etc/systemd/system/$unit"|cut -f4 -d/)
-        if [ -n "$snap" ]; then
-            echo "Removing snap $snap and revision $rev"
-            # aliases
-            if [ -d /snap/bin ]; then
-                find /snap/bin -maxdepth 1 -lname "$snap" -delete
-                find /snap/bin -maxdepth 1 -lname "$snap.*" -delete
-            fi
-            # generated binaries
-            rm -f "/snap/bin/$snap"
-            rm -f "/snap/bin/$snap".*
-            # snap mount dir
-            # we pass -d (clean up loopback devices) for trusty compatibility
-            umount -d -l "/snap/$snap/$rev" 2> /dev/null || true
-            rm -rf "/snap/$snap/$rev"
-            rm -f "/snap/$snap/current"
-            # snap data dir
-            rm -rf "/var/snap/$snap/$rev"
-            rm -rf "/var/snap/$snap/common"
-            rm -f "/var/snap/$snap/current"
-            # opportunistic remove (may fail if there are still revisions left
-            for d in "/snap/$snap" "/var/snap/$snap"; do
-                if [ -d "$d" ]; then
-                    rmdir --ignore-fail-on-non-empty "$d" || true
-                fi
-            done
-            # udev rules
-            find /etc/udev/rules.d -name "*-snap.${snap}.rules" -execdir rm -f "{}" \;
-            # dbus policy files
-            if [ -d /etc/dbus-1/system.d ]; then
-                find /etc/dbus-1/system.d -name "snap.${snap}.*.conf" -execdir rm -f "{}" \;
-            fi
-            # timer and socket units
-            find /etc/systemd/system -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" | while read -r f; do
-                systemctl_stop "$(basename "$f")"
-                rm -f "$f"
-            done
-        fi
-
-        echo "Removing $unit"
-        rm -f "/etc/systemd/system/$unit"
-        rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
-    done
-
-    # generated readme files
-    rm -f "/snap/README"
-
-    echo "Final directory cleanup"
-    for d in "/snap/bin" "/snap" "/var/snap"; do
-        # Force remove due to directories for old revisions could still exist
-        rm -rf "$d"
-        if [ -d "$d" ]; then
-            echo "Cannot remove directory $d"
-        fi
-    done
-
-    echo "Discarding preserved snap namespaces"
-    # opportunistic as those might not be actually mounted
-    if [ -d /run/snapd/ns ]; then
-        if [ "$(find /run/snapd/ns/ -name "*.mnt" | wc -l)" -gt 0 ]; then
-            for mnt in /run/snapd/ns/*.mnt; do
-                umount -l "$mnt" || true
-                rm -f "$mnt"
-            done
-        fi
-        find /run/snapd/ns/ \( -name '*.fstab' -o -name '*.user-fstab' -o -name '*.info' \) -delete
-        umount -l /run/snapd/ns/ || true
-    fi
-
-    echo "Removing extra snap-confine apparmor rules"
-    rm -f /etc/apparmor.d/snap.core.*.usr.lib.snapd.snap-confine
-
-    echo "Removing snapd cache"
-    rm -rf /var/cache/snapd/*
-
-    echo "Removing snapd state"
-    rm -rf /var/lib/snapd
-fi
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.preinst snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.preinst
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.preinst	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.preinst	1970-01-01 00:00:00.000000000 +0000
@@ -1,10 +0,0 @@
-#!/bin/sh
-
-set -e 
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.prerm snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.prerm
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/snapd.prerm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/snapd.prerm	1970-01-01 00:00:00.000000000 +0000
@@ -1,42 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-systemctl_stop() {
-    unit="$1"
-
-    echo "Stopping unit $unit"
-    systemctl stop -q "$unit" || true
-
-    for i in $(seq 20); do
-        echo "Waiting until unit $unit is stopped [attempt $i]"
-        if ! systemctl is-active -q "$unit"; then
-            echo "$unit is stopped."
-            return
-        fi
-        sleep .1
-    done
-}
-
-if [ "$1" = "remove" ]; then
-    units=$(systemctl list-unit-files --full | grep '^snap\.' | cut -f1 -d ' ' | grep -vF snap.mount.service || true)
-    tostop=$(echo "$units" | grep -E '^snap\..*\.(service|timer|socket)$' || true)
-
-    for unit in $tostop; do
-        # ensure it's really a snap mount unit or systemd unit
-        if  ! grep -q 'X-Snappy=yes' "/etc/systemd/system/$unit"; then
-            echo "Skipping non-snapd systemd unit $unit"
-            continue
-        fi
-
-        echo "Stopping $unit"
-        systemctl_stop "$unit"
-    done
-fi
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/source/format snapd-2.48.3+20.04/packaging/ubuntu-16.10/source/format
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/source/format	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/source/format	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-3.0 (native)
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/source/options snapd-2.48.3+20.04/packaging/ubuntu-16.10/source/options
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/source/options	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/source/options	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-tar-ignore = "tests/lib/cache/*"
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/control snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/control
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/control	1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-Tests: integrationtests
-Restrictions: allow-stderr, rw-build-tree, needs-root, breaks-testbed, isolation-machine
-Depends: @builddeps@,
-         bzr,
-         ca-certificates,
-         git,
-         golang-golang-x-net-dev,
-         locales,
-         openssh-server,
-         netcat-openbsd,
-         net-tools,
-         snapd
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/integrationtests snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/integrationtests
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/integrationtests	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/integrationtests	1970-01-01 00:00:00.000000000 +0000
@@ -1,84 +0,0 @@
-#!/bin/sh
-
-set -ex
-
-# required for the debian adt host
-mkdir -p /etc/systemd/system/snapd.service.d/
-if [ "${http_proxy:-}" != "" ]; then
-    cat <<EOF | tee /etc/systemd/system/snapd.service.d/proxy.conf
-[Service]
-Environment=http_proxy=$http_proxy
-Environment=https_proxy=$http_proxy
-EOF
-
-    # ensure environment is updated
-    echo "http_proxy=$http_proxy" >> /etc/environment
-    echo "https_proxy=$http_proxy" >> /etc/environment
-fi
-systemctl daemon-reload
-
-# ensure we are not get killed too easily
-printf '%s\n' "-950" > /proc/$$/oom_score_adj
-
-# see what mem we have (for debugging)
-cat /proc/meminfo
-
-# ensure we can do a connect to localhost
-echo ubuntu:ubuntu|chpasswd
-sed -i 's/\(PermitRootLogin\|PasswordAuthentication\)\>.*/\1 yes/' /etc/ssh/sshd_config
-systemctl reload sshd.service
-
-# Map snapd deb package pockets to core snap channels. This is intended to cope
-# with the autopkgtest execution when testing packages from the different pockets
-if apt -qq list snapd | grep -q -- -proposed; then
-    export SPREAD_CORE_CHANNEL=candidate
-elif apt -qq list snapd | grep -q -- -updates; then
-    export SPREAD_CORE_CHANNEL=stable
-fi
-# ensure we always run from the deb that is currently tested
-export SNAP_REEXEC=0
-mkdir -p /etc/systemd/system/snapd.service.d
-cat <<EOF > /etc/systemd/system/snapd.service.d/no-reexec.conf
-[Service]
-Environment=SNAP_REEXEC=$SNAP_REEXEC
-EOF
-systemctl daemon-reload
-systemctl restart snapd
-
-# Spread will only buid with recent go
-snap install --classic go
-
-# and now run spread against localhost
-export GOPATH=/tmp/go
-/snap/bin/go get -u github.com/snapcore/spread/cmd/spread
-
-# the tests need this:
-groupadd --gid 12345 test
-adduser --uid 12345 --gid 12345 --disabled-password --gecos '' test
-
-# we build our own minimal spread.yaml
-cat > spread.yaml <<'EOF'
-project: snapd
-path: /home/gopath/src/github.com/snapcore/snapd
-environment:
-    PROJECT_PATH: /home/gopath/src/github.com/snapcore/snapd
-    TESTSLIB: $PROJECT_PATH/tests/lib
-    SNAPPY_TESTING: 1
-    PATH: $PATH:$PROJECT_PATH/tests/lib/bin
-backends:
-    autopkgtest:
-        type: adhoc
-        allocate: ADDRESS localhost:22
-        systems:
-        - adt-local:
-            username: ubuntu
-            password: ubuntu
-suites:
-        tests/smoke/:
-            summary: Essenial system level tests for snapd
-EOF
-/tmp/go/bin/spread -v autopkgtest:adt-local:tests/smoke/
-
-# store journal info for inspectsion
-journalctl --sync
-journalctl -ab > "$ADT_ARTIFACTS"/journal.txt
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/README.md snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/README.md
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/README.md	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/README.md	1970-01-01 00:00:00.000000000 +0000
@@ -1,10 +0,0 @@
-## Autopkgtest
-
-In order to run the autopkgtest suite locally you need first to generate an image:
-
-    $ adt-buildvm-ubuntu-cloud -a amd64 -r xenial -v
-
-This will create a `adt-xenial-amd64-cloud.img` file, then you can run the tests from
-the project's root with:
-
-    $ adt-run --unbuilt-tree . --- qemu ./adt-xenial-amd64-cloud.img
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/testconfig.json snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/testconfig.json
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/tests/testconfig.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/tests/testconfig.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,3 +0,0 @@
-{
-    "FromBranch": false
-}
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/ubuntu-snappy-cli.dirs snapd-2.48.3+20.04/packaging/ubuntu-16.10/ubuntu-snappy-cli.dirs
--- snapd-2.45.1+20.04.2/packaging/ubuntu-16.10/ubuntu-snappy-cli.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-16.10/ubuntu-snappy-cli.dirs	1970-01-01 00:00:00.000000000 +0000
@@ -1,2 +0,0 @@
-usr/lib/snapd
-var/lib/snapd/snaps
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/changelog snapd-2.48.3+20.04/packaging/ubuntu-17.04/changelog
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/changelog	2020-07-10 13:59:20.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/changelog	1970-01-01 00:00:00.000000000 +0000
@@ -1,9321 +0,0 @@
-snapd (2.45.1+20.04.2) focal-security; urgency=medium
-
-  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
-    (xdg-open)
-    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment 
-      variable modification when calling the system xdg-open. Patch
-      thanks to James Henstridge
-    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
-      may autostart on next use. Patch thanks to Michael Vogt
-    - CVE-2020-11934
-    - LP: #1880085
-
- -- Emilia Torino <emilia.torino@canonical.com>  Fri, 10 Jul 2020 10:59:20 -0300
-
-snapd (2.45.1+20.04) focal; urgency=medium
-
-  * New upstream release, LP: #1875071
-    - data/selinux: allow checking /var/cache/app-info
-    - cmd/snap-confine: add support for libc6-lse
-    - interfaces: miscellanious policy updates xlv
-    - snap-bootstrap: remove sealed key file on reinstall
-    - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/
-    - gadget: make ext4 filesystems with or without metadata checksum
-    - interfaces/fwupd: allow bind mount to /boot on core
-    - tests: cherry-pick test fixes from master
-    - snap/squashfs: also symlink snap Install with uc20 seed snap dir
-      layout
-    - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed
-      devices
-    - snap,many: mv Open to snapfile pkg to support add'l options to
-      Container methods
-    - interfaces/builtin/desktop: do not mount fonts cache on distros
-      with quirks
-    - devicestate, sysconfig: revert support for cloud.cfg.d/ in the
-      gadget
-    - data/completion, packaging: cherry-pick zsh completion
-    - state: log task errors in the journal too
-    - devicestate: do not report "ErrNoState" for seeded up
-    - interfaces/desktop: silence more /var/lib/snapd/desktop/icons
-      denials
-    - packaging/fedora: disable FIPS compliant crypto for static
-      binaries
-    - packaging: stop depending on python-docutils
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Jun 2020 15:13:49 +0200
-
-snapd (2.45) xenial; urgency=medium
-
-  * New upstream release, LP: #1875071
-    - o/devicestate: support doing system action reboots from recover
-      mode
-    - vendor: update to latest secboot
-    - tests: not fail when boot dir cannot be determined
-    - configcore: only reload journald if systemd is new enough
-    - cmd/snap-bootstrap/initramfs-mounts: append uuid to ubuntu-data
-      when decrypting
-    - tests/lib/prepare.sh: delete patching of the initrd
-    - cmd/snap: coldplug auto-import assertions from all removable
-      devices
-    - cmd/snap: fix the order of positional parameters in help output
-    - c/snap-bootstrap: port mount state mocking to the new style on
-      master
-    - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy
-      as well
-    - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline,
-      unlock in recover mode initramfs
-    - progress: tweak multibyte label unit test data
-    - gadget: fix fallback device lookup for 'mbr' type structures
-    - progress: fix progress bar with multibyte duration units
-    - many: use /run/mnt/data over /run/mnt/ubuntu-data for uc20
-    - many: put the sealed keys in a directory on seed for tidiness
-    - cmd/snap-bootstrap: measure epoch and model before unlocking
-      encrypted data
-    - o/configstate: core config handler for persistent journal
-    - bootloader/uboot: use secondary ubootenv file boot.sel for uc20
-    - packaging: add "$TAGS" to dh_auto_test for debian packaging
-    - tests: ensure $cache_dir is actually available
-    - secboot,cmd/snap-bootstrap: add model to pcr protection profile
-    - devicestate: do not use snap-boostrap in devicestate to install
-    - tests: fix a typo in nested.sh helper
-    - devicestate: add support for cloud.cfg.d config from the gadget
-    - cmd/snap-bootstrap: cleanups, naming tweaks
-    - testutil: add NewDBusTestConn
-    - snap-bootstrap: lock access to sealed keys
-    - overlord/devicestate: preserve the current model inside ubuntu-
-      boot
-    - interfaces/apparmor: use differently templated policy for non-core
-      bases
-    - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing
-      syscalls
-    - cmd/snap-bootstrap/initramfs-mounts: mount ubuntu-seed first,
-      other misc changes
-    - o/snapstate: tweak "waiting for restart" message
-    - boot: store model model and grade information in modeenv
-    - interfaces/firewall-control: allow -legacy and -nft for core20
-    - boot: enable makeBootable20RunMode for EnvRefExtractedKernel
-      bootloaders
-    - boot/bootstate20: add EnvRefExtractedKernelBootloader bootstate20
-      implementation
-    - daemon: fix error message from `snap remove-user foo` on classic
-    - overlord: have a variant of Mock that can take a state.State
-    - tests: 16.04 and 18.04 now have mediating pulseaudio (again)
-    - seed: clearer errors for missing essential snapd or core snap
-    - cmd/snap-bootstrap/initramfs-mounts: support
-      EnvRefExtractedKernelBootloader's
-    - gadget, cmd/snap-bootstrap: MBR schema support
-    - image: improve/adjust DownloadSnap doc comment
-    - asserts: introduce ModelGrade.Code
-    - tests: ignore user-12345 slice and service
-    - image,seed/seedwriter: support redirect channel aka default
-      tracks
-    - bootloader: use binary.Read/Write
-    - tests: uc20 nested suite part II
-    - tests/boot: refactor to make it easier for new
-      bootloaderKernelState20 impl
-    - interfaces/openvswitch: support use of ovs-appctl
-    - snap-bootstrap: copy auth data from real ubuntu-data in recovery
-      mode
-    - snap-bootstrap: seal and unseal encryption key using tpm
-    - tests: disable special-home-can-run-classic-snaps due to jenkins
-      repo issue
-    - packaging: fix build on Centos8 to support BUILDTAGS
-    - boot/bootstate20: small changes to bootloaderKernelState20
-    - cmd/snap: Implement a "snap routine file-access" command
-    - spread.yaml: switch back to latest/candidate for lxd snap
-    - boot/bootstate20: re-factor kernel methods to use new interface
-      for state
-    - spread.yaml,tests/many: use global env var for lxd channel
-    - boot/bootstate20: fix bug in try-kernel cleanup
-    - config: add system.store-certs.[a-zA-Z0-9] support
-    - secboot: key sealing also depends on secure boot enabled
-    - httputil: fix client timeout retry tests
-    - cmd/snap-update-ns: handle EBUSY when unlinking files
-    - cmd/snap/debug/boot-vars: add opts for setting dir and/or uc20
-      vars
-    - secboot: add tpm support helpers
-    - tests/lib/assertions/developer1-pi-uc20.model: use 20/edge for
-      kernel and gadget
-    - cmd/snap-bootstrap: switch to a 64-byte key for unlocking
-    - tests: preserve size for centos images on spread.yaml
-    - github: partition the github action workflows
-    - run-checks: use consistent "Checking ..." style messages
-    - bootloader: add efi pkg for reading efi variables
-    - data/systemd: do not run snapd.system-shutdown if finalrd is
-      available
-    - overlord: update tests to work with latest go
-    - cmd/snap: do not hide debug boot-vars on core
-    - cmd/snap-bootstrap: no error when not input devices are found
-    - snap-bootstrap: fix partition numbering in create-partitions
-    - httputil/client_test.go: add two TLS version tests
-    - tests: ignore user@12345.service hierarchy
-    - bootloader, gadget, cmd/snap-bootstrap: misc cosmetic things
-    - tests: rewrite timeserver-control test
-    - tests: fix racy pulseaudio tests
-    - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS
-    - tests: update snap-preseed --reset logic to accommodate for 2.44
-      change
-    - cmd/snap: don't wait for system key when stopping
-    - sandbox/cgroup: avoid making arrays we don't use
-    - osutil: mock proc/self/mountinfo properly everywhere
-    - selinux: export MockIsEnforcing; systemd: use in tests
-    - tests: add 32 bit machine to GH actions
-    - tests/session-tool: kill cron session, if any
-    - asserts: it should be possible to omit many snap-ids if allowed,
-      fix
-    - boot: cleanup more things, simplify code
-    - github: skip spread jobs when corresponding label is set
-    - dirs: don't depend on osutil anymore, mv apparmor vars to apparmor
-      pkg
-    - tests/session-tool: add session-tool --dump
-    - github: allow cached debian downloads to restore
-    - tests/session-tool: session ordering is non-deterministic
-    - tests: enable unit tests on debian-sid again
-    - github: move spread to self-hosted workers
-    - secboot: import secboot on ubuntu, provide dummy on !ubuntu
-    - overlord/devicestate: support for recover and run modes
-    - snap/naming: add validator for snap security tag
-    - interfaces: add case for rootWritableOverlay + NFS
-    - tests/main/uc20-create-partitions: tweaks, renames, switch to
-      20.04
-    - github: port CLA check to Github Actions
-    - interfaces/many: miscellaneous policy updates xliv
-    - configcore,tests: fix setting watchdog options on UC18/20
-    - tests/session-tool: collect information about services on startup
-    - tests/main/uc20-snap-recovery: unbreak, rename to uc20-create-
-      partitions
-    - state: add state.CopyState() helper
-    - tests/session-tool: stop anacron.service in prepare
-    - interfaces: don't use the owner modifier for files shared via
-      document portal
-    - systemd: move the doc comments to the interface so they are
-      visible
-    - cmd/snap-recovery-chooser: tweaks
-    - interfaces/docker-support: add overlayfs file access
-    - packaging: use debian/not-installed to ignore snap-preseed
-    - travis.yml: disable unit tests on travis
-    - store: start splitting store.go and store_test.go into subtopic
-      files
-    - tests/session-tool: stop cron/anacron from meddling
-    - github: disable fail-fast as spread cannot be interrupted
-    - github: move static checks and spread over
-    - tests: skip "/etc/machine-id" in "writablepaths" test
-    - snap-bootstrap: store encrypted partition recovery key
-    - httputil: increase testRetryStrategy max timelimit to 5s
-    - tests/session-tool: kill leaking closing session
-    - interfaces: allow raw access to USB printers
-    - tests/session-tool: reset failed session-tool units
-    - httputil: increase httpclient timeout in
-      TestRetryRequestTimeoutHandling
-    - usersession: extend timerange in TestExitOnIdle
-    - client: increase timeout in client tests to 100ms
-    - many: disentagle release and snapdenv from sandbox/*
-    - boot: simplify modeenv mocking to always write a modeenv
-    - snap-bootstrap: expand data partition on install
-    - o/configstate: add backlight option for core config
-    - cmd/snap-recovery-chooser: add recovery chooser
-    - features: enable robust mount ns updates
-    - snap: improve TestWaitRecovers test
-    - sandbox/cgroup: add ProcessPathInTrackingCgroup
-    - interfaces/policy: fix comment in recent new test
-    - tests: make session tool way more robust
-    - interfaces/seccomp: allow passing an address to setgroups
-    - o/configcore: introduce core config handlers (3/N)
-    - interfaces: updates to login-session-observe, network-manager and
-      modem-manager interfaces
-    - interfaces/policy/policy_test.go: add more tests'allow-
-      installation: false' and we grant based on interface attributes
-    - packaging: detect/disable broken seed in the postinst
-    - cmd/snap-confine/mount-support-nvidia.c: add libnvoptix as nvidia
-      library
-    - tests: remove google-tpm backend from spread.yaml
-    - tests: install dependencies with apt using --no-install-recommends
-    - usersession/userd: add zoommtg url support
-    - snap-bootstrap: fix disk layout sanity check
-    - snap: add `snap debug state --is-seeded` helper
-    - devicestate: generate warning if seeding fails
-    - config, features: move and rename config.GetFeatureFlag helper to
-      features.Flag
-    - boot, overlord/devicestate, daemon:  implement requesting boot
-      into a given recovery system
-    - xdgopenproxy: forward requests to the desktop portal
-    - many: support immediate reboot
-    - store: search v2 tweaks
-    - tests: fix cross build tests when installing dependencies
-    - daemon: make POST /v2/systems/<label> root only
-    - tests/lib/prepare.sh: use only initrd from the kernel snap
-    - cmd/snap,seed: validate full seeds (UC 16/18)
-    - tests/main/user-session-env: stop the user session before deleting
-      the test-zsh user
-    - overlord/devicestate, daemon: record the seed current system was
-      installed from
-    - gadget: SystemDefaults helper function to convert system defaults
-      config into a flattened map suitable for FilesystemOnlyApply.
-    - many: comment or avoid cryptic snap-ids in tests
-    - tests: add LXD_CHANNEL environment
-    - store: support for search API v2
-    - .github: register a problem matcher to detect spread failures
-    - seed: add Info() method for seed.Snap
-    - github: always run the "Discard spread workers" step, even if the
-      job fails
-    - github: offload self-hosted workers
-    - cmd/snap: the model command needs just a client, no waitMixin
-    - github: combine tests into one workflow
-    - github: fix order of go get caches
-    - tests: adding more workers for ubuntu 20.04
-    - boot,overlord: rename operating mode to system mode
-    - config: add new Transaction.GetPristine{,Maybe}() function
-    - o/devicestate: rename readMaybe* to maybeRead*
-    - github: cache Debian dependencies for unit tests
-    - wrappers: respect pre-seeding in error path
-    - seed: validate UC20 seed system label
-    - client, daemon, overlord/devicestate: request system action API
-      and stubs
-    - asserts,o/devicestate: support model specified alternative serial-
-      authority
-    - many: introduce naming.WellKnownSnapID
-    - o/configcore: FilesystemOnlyApply method for early configuration
-      of core (1/N)
-    - github: run C unit tests
-    - github: run spread tests on PRs only
-    - interfaces/docker-support: make containerd abstract socket more
-      generic
-    - tests: cleanup security-private-tmp properly
-    - overlord/devicestate,boot: do not hold to the originally read
-      modeenv
-    - dirs: rm RunMnt; boot: add vars for early boot env layout;
-      sysconfig: take targetdir arg
-    - cmd/snap-bootstrap/initramfs-mounts/tests: use dirs.RunMnt over
-      s.runMnt
-    - tests: add regression test for MAAS refresh bug
-    - errtracker: add missing mocks
-    - github: apt-get update before installing build-deps
-    - github: don't fail-fast
-    - github: run spread via github actions
-    - boot,many: add modeenv.WriteTo, make Write take no args
-    - wrappers: fix timer schedules that are days only
-    - tests/main/snap-seccomp-syscalls: install gperf
-    - github: always checkout to snapcore/snapd
-    - github: add prototype workflow running unit tests
-    - many: improve comments, naming, a possible TODO
-    - client: use Assert when checking for error
-    - tests: ensure sockets target is ready in session agent spread
-      tests
-    - osutil: do not leave processes behind after the test run
-    - tests: update proxy-no-core to match latest CDN changes
-    - devicestate,sysconfig: support "cloud.cfg.d" in uc20 for grade:
-      dangerous
-    - cmd/snap-failure,tests: try to make snap-failure more robust
-    - many: fix packages having mistakenly their copyright as doc
-    - many: enumerate system seeds, return them on the /v2/systems API
-      endpoint
-    - randutil: don't consume kernel entropy at init, just mix more info
-      to try to avoid fleet collisions
-    - snap-bootstrap: add creationSupported predicate for partition
-      types
-    - tests: umount partitions which are not umounted after remount
-      gadget
-    - snap: run gofmt -s
-    - many: improve environment handling, fixing duplicate entries
-    - boot_test: add many boot robustness tests for UC20 kernel
-      MarkBootSuccessul and SetNextBoot
-    - overlord: remove unneeded overlord.MockPruneInterval() mocks
-    - interfaces/greengrass-support: fix typo
-    - overlord,timings,daemon: separate timings from overlord/state
-    - tests: enable nested on core20 and test current branch
-    - snap-bootstrap: remove created partitions on reinstall
-    - boot: apply Go 1.10 formatting
-    - apparmor: use rw for uuidd request to default and remove from
-      elsewhere
-    - packaging: add README.source for debian
-    - tests: cleanup various uc20 boot tests from previous PR
-    - devicestate: disable cloud-init by default on uc20
-    - run-checks: tweak formatting checks
-    - packaging,tests: ensure debian-sid builds without vendor/
-    - travis.yml: run unit tests with go/master as well* travis.yml: run
-      unit tests with go/master as well
-    - seed: make Brand() part of the Seed interface
-    - cmd/snap-update-ns: ignore EROFS from rmdir/unlink
-    - daemon: do a forceful server shutdown if we hit a deadline
-    - tests/many: don't use StartLimitInterval anymore, unify snapd-
-      failover variants, build snapd snap for UC16 tests
-    - snap-seccomp: robustness improvements
-    - run-tests: disable -v for go test to avoid spaming the logs
-    - snap: whitelist lzo as support compression for snap pack
-    - snap: tweak comment in Install() for overlayfs detection
-    - many: introduce snapdenv.Preseeding instead of release.PreseedMode
-    - client, daemon, overlord/devicestate: structures and stubs for
-      systems API
-    - o/devicestate: delay the creation of mark-seeded task until
-      asserts are loaded
-    - data/selinux, tests/main/selinux: cleanup tmpfs operations in the
-      policy, updates
-    - interfaces/greengrass-support: add new 1.9 access
-    - snap: do not hardlink on overlayfs
-    - boot,image: ARM kernel extract prepare image
-    - interfaces: make gpio robust against not-existing gpios in /sys
-    - cmd/snap-preseed: handle --reset flag
-    - many: introduce snapdenv to present common snapd env options
-    - interfaces/kubernetes-support: allow autobind to journald socket
-    - snap-seccomp: allow mprotect() to unblock the tests
-    - tests/lib/reset: workaround unicode dot in systemctl output
-    - interfaces/udisks2: also allow Introspection on
-      /org/freedesktop/UDisks/**
-    - snap: introduce Container.RandomAccessFile
-    - o/ifacestate, api: implementation of snap disconnect --forget
-    - cmd/snap: make the portal-info command search for the network-
-      status interface
-    - interfaces: work around apparmor_parser slowness affecting uio
-    - tests: fix/improve failing spread tests
-    - many: clean separation of bootenv mocking vs mock bootloader kinds
-    - tests: mock prune ticker in overlord tests to reduce wait times
-    - travis: disable arm64 again
-    - httputil: add support for extra snapd certs
-    - travis.yml: run unit tests on arm64 as well
-    - many: fix a pair of ineffectual assignments
-    - tests: add uc20 kernel snap upgrade managers test, fix
-      bootloadertest bugs
-    - o/snapstate: set base in SnapSetup on snap revert
-    - interfaces/{docker,kubernetes}-support: updates for lastest k8s
-    - cmd/snap-exec: add test case for LP bug 1860369
-    - interfaces: make the network-status interface implicit on
-      classic
-    - interfaces: power control interfaceIt is documented in the
-      kernel
-    - interfaces: miscellaneous policy updates
-    - cmd/snap: add a "snap routine portal-info" command
-    - usersession/userd: add "apt" to the white list of URL schemes
-      handled by xdg-open
-    - interfaces/desktop: allow access to system prompter interface
-    - devicestate: allow encryption regardless of grade
-    - tests: run ipv6 network-retry test too
-    - tests: test that after "remove-user" the system is unmanaged
-    - snap-confine: unconditionally add /dev/net/tun to the device
-      cgroup
-    - snapcraft.yaml: use sudo -E and remove workaround
-    - interfaces/audio_playback: Fix pulseaudio config access
-    - ovelord/snapstate: update only system wide fonts cache
-    - wrappers: import /etc/environment in all services
-    - interfaces/u2f: Add Titan USB-C key
-    - overlord, taskrunner: exit on task/ensure error when preseeding
-    - tests: add session-tool, a su / sudo replacement
-    - wrappers: add mount unit dependency for snapd services on core
-      devices
-    - tests: just remove user when the system is not managed on create-
-      user-2 test
-    - snap-preseed: support for preseeding of snapd and core18
-    - boot: misc UC20 changes
-    - tests: adding arch-linux execution
-    - packaging: revert "work around review-tools and snap-confine"
-    - netlink: fix panic on arm64 with the new rawsockstop codewith a
-      nil Timeval panics
-    - spread, data/selinux: add CentOS 8, update policy
-    - tests: updating checks to new test account for snapd-test snaps
-    - spread.yaml: mv opensuse 15.1 to unstable
-    - cmd/snap-bootstrap,seed: verify only in-play snaps
-    - tests: use ipv4 in retry-network to unblock failing master
-    - data/systemd: improve the description
-    - client: add "Resume" to DownloadOptions and new test
-    - tests: enable snapd-failover on uc20
-    - tests: add more debug output to the snapd-failure handling
-    - o/devicestate: unset recovery_system when done seeding
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 May 2020 17:17:57 +0200
-
-snapd (2.44.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - tests: fix racy pulseaudio tests
-    - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS
-    - tests: update snap-preseed --reset logic
-    - tests: backport partition fixes
-    - cmd/snap: don't wait for system key when stopping
-    - interfaces/many: miscellaneous policy updates xliv
-    - tests/main/uc20-snap-recovery: use 20.04 system
-    - tests: skip "/etc/machine-id" in "writablepaths
-    - interfaces/docker-support: add overlays file access
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 10 Apr 2020 16:57:25 +0200
-
-snapd (2.44.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - packaging: detect/disable broken seeds in the postinst
-    - cmd/snap,seed: validate full seeds (UC 16/18)
-    - snap: add `snap debug state --is-seeded` helper
-    - devicestate: generate warning if seeding fails
-    - store: support for search API v2
-    - cmd/snap-seccomp/syscalls: update the list of known syscalls
-    - snap/cmd: the model command needs just a client, no waitMixin
-    - tests: cleanup security-private-tmp properly
-    - wrappers: fix timer schedules that are days only
-    - tests: update proxy-no-core to match latest CDN changes
-    - cmd/snap-failure,tests: make snap-failure more robust
-    - tests, many: don't use StartLimitInterval anymore, unify snapd-
-      failover variants, build snapd snap for UC16 tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 02 Apr 2020 09:51:34 +0200
-
-snapd (2.44.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - randutil: switch back to setting up seed with lower entropy data
-    - interfaces/greengrass-support: fix typo
-    - packaging,tests: ensure debian-sid builds without vendor/
-    - travis.yml: run unit tests with go/master as well
-    - cmd/snap-update-ns: ignore EROFS from rmdir/unlink
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 21 Mar 2020 18:32:12 +0100
-
-snapd (2.44) xenial; urgency=medium
-
-  * New upstream release, LP: #1864808
-    - daemon: do a forceful serer shutdown if we hit a deadline
-    - snap: whitelist lzo as support compression for snap pack
-    - data/selinux: update policy to allow more ops
-    - interfaces/greengrass-support: add new 1.9 access
-    - snap: do not hardlink on overlayfs
-    - cmd/snap-preseed: handle --reset flag
-    - interfaces/kubernetes-support: allow autobind to journald socket
-    - snap-seccomp: allow mprotect() to unblock the tests
-    - tests/lib/reset: workaround unicode dot in systemctl output
-    - interfaces: work around apparmor_parser slowness affecting uio
-    - interfaces/udisks2: also allow Introspection on
-      /org/freedesktop/UDisks2/**
-    - tests: mock prune ticker in overlord tests to reduce wait times
-    - interfaces/{docker,kubernetes}-support: updates for lastest k8s
-    - interfaces: miscellaneous policy updates
-    - interfaces/audio_playback: Fix pulseaudio config access
-    - overlord: disable Test..AbortShortlyAfterStartOfOperation for 2.44
-    - ovelord/snapstate: update only system wide fonts cache
-    - wrappers: import /etc/environment in all services
-    - interfaces/u2f: Add Titan USB-C key
-    - overlord, taskrunner: exit on task/ensure error when preseeding
-    - overlord/snapstate/backend: update snapd services contents in unit
-      tests
-    - wrappers: add mount unit dependency for snapd services on core
-      devices
-    - Revert "tests: remove /tmp/snap.* left over by other tests"
-    - Revert "packaging: work around review-tools and snap-confine"
-    - netlink: fix panic on arm64 with the new rawsockstop code
-    - spread, data/selinux: add CentOS 8, update policy
-    - spread.yaml: mv opensuse tumbleweed to unstable too
-    - spread.yaml: mv opensuse 15.1 to unstable
-    - tests: use ipv4 in retry-network to unblock failing master
-    - data/systemd: improve the description
-    - tests/lib/prepare.sh: simplify, combine code paths
-    - tests/main/user-session-env: add test verifying environment
-      variables inside the user session
-    - spread.yaml: make qemu ubuntu-core-20-64 use ubuntu-20.04-64
-    - run-checks: SKIP_GMFMT really skips formatting checks
-    - tests: enable more tests for UC20/UC18
-    - tests: remove tmp dir for snap not-test-snapd-sh on security-
-      private-tmp test
-    - seed,cmd/snap-bootstrap: introduce seed.Snap.EssentialType,
-      simplify bootstrap code
-    - snapstate: do not restart in undoLinkSnap unless on first install
-    - cmd/snap-bootstrap: subcommand to detect UC chooser trigger
-    - cmd/snap-bootstrap/initramfs-mounts: mount the snapd snap in run-
-      mode too
-    - cmd/libsnap, tests: fix C unit tests failing as non-root
-    - cmd/snap-bootstrap: verify kernel snap is in modeenv before
-      mounting it
-    - tests: adding amazon linux to google backend
-    - cmd/snap-failure/snapd: rm snapd.socket, reset snapd.socket failed
-      status
-    - client: add support for "ResumeToken", "HeaderPeek" to download
-    - build: enable type: snapd
-    - tests: rm -rf /tmp/snap.* in restore
-    - cmd/snap-confine: deny snap-confine to load nss libs
-    - snapcraft.yaml: add comments, rename snapd part to snapd-deb
-    - boot: write current_kernels in bootstate20, makebootable
-    - packaging: work around review-tools and snap-confine
-    - tests: skipping interfaces-openvswitch on centos due to package is
-      not available
-    - packaging,snap-confine: stop being setgid root
-    - cmd/snap-confine: bring /var/lib/dhcp from host, if present
-    - store: rely on CommandFromSystemSnap to find xdelta3
-    - tests: bump sleep time of the new overlord tests
-    - cmd/snap-preseed: snapd version check for the target
-    - netlink: fix/support stopping goroutines reading netlink raw
-      sockets
-    - tests: reset PS1 before possibly interactive dash
-    - overlord, state: don't abort changes if spawn time before
-      StartOfOperationTime (2/2)
-    - snapcraft.yaml: add python3-apt, tzdata as build-deps for the
-      snapd snap
-    - tests: ask tar to speak English
-    - tests: using google storage when downloading ubuntu cloud images
-      from gce
-    - Coverity produces false positives for code like this:
-    - many: maybe restart & security backend options
-    - o/standby: add SNAPD_STANDBY_WAIT to control standby in
-      development
-    - snap: use the actual staging snap-id for snapd
-    - cmd/snap-bootstrap: create a new parser instance
-    - snapcraft.yaml: use build-base and adopt-info, rm builddeb
-      plugin
-    - tests: set StartLimitInterval in snapd failover test
-    - tests: disable archlinux system
-    - tests: add preseed test for classic
-    - many, tests: integrate all preseed bits and add spread tests
-    - daemon: support resuming downloads
-    - tests: use Filename() instead of filepath.Base(sn.MountFile())
-    - tests/core: add swapfiles test
-    - interfaces/cpu-control: allow to control cpufreq tunables
-    - interfaces: use commonInteface for desktopInterface
-    - interfaces/{desktop-legacy,unity7}: adjust for new ibus socket
-      location
-    - snap/info: add Filename
-    - bootloader: make uboot a RecoveryAwareBootloader
-    - gadget: skip update when mounted filesystem content is identical
-    - systemd: improve is-active check for 'failed' services
-    - boot: add current_kernels to modeenv
-    - o/devicestate: StartOfOperationTime helper for Prune (1/2)
-    - tests: detect LXD launching i386 containers
-    - tests: move main/ubuntu-core-* tests to core/ suite
-    - tests: remove snapd in ubuntu-core-snapd
-    - boot: enable base snap updates in bootstate20
-    - tests: Fix core revert channel after 2.43 has been released to
-      stable
-    - data/selinux: unify tabs/spaces
-    - o/ifacestate: move ResolveDisconnect to ifacestate
-    - spread: move centos to stable systems
-    - interfaces/opengl: allow datagrams to nvidia-driver
-    - httputil: add NoNetwork(err) helper, spread test and use in serial
-      acquire
-    - store: detect if server does not support http range headers
-    - test/lib/user: add helper lib for doing things for and as a user
-    - overlord/snapstate, wrappers: undo of snapd on core
-    - tests/main/interfaces-pulseaudio: use custom pulseaudio script,
-      set kill timeout
-    - store: add support for resume in DownloadStream
-    - cmd/snap: implement 'snap remove-user'
-    - overlord/devicestate: fix preseed unit tests on systems not using
-      /snap
-    - tests/main/static: ldd in glibc 2.31 logs to stderr now
-    - run-checks, travis: allow skipping spread jobs by adding a label
-    - tests: add new backend which includes images with tpm support
-    - boot: use constants for boot status values
-    - tests: add "core" suite for UC specific tests
-    - tests/lib/prepare: use a local copy of uc20 initramfs skeleton
-    - tests: retry mounting the udisk2 device due to timing issue
-    - usersession/client: add a client library for the user session
-      agent
-    - o/devicestate: Handle preseed mode in the firstboot mode (core16
-      only for now).
-    - boot: add TryBase and BaseStatus to modeenv; use in snap-bootstrap
-    - cmd/snap-confine: detect base transitions on core16
-    - boot: don't use "kernel" from the modeenv anymore
-    - interfaces: add uio interface
-    - tests: repack the initramfs + kernel snap for UC20 spread tests
-    - interfaces/greengrass-support: add /dev/null ->
-      /proc/latency_stats mount
-    - httputil: remove workaround for redirect handling in go1.7
-    - httputil: remove go1.6 transport workaround
-    - snap: add `snap pack --compression=<comp>` options
-    - tests/lib/prepare: fix hardcoded loopback device names for UC
-      images
-    - timeutil: add a unit test case for trivial schedule
-    - randutil,o/snapstate,-mkauthors.sh: follow ups to randutil
-      introduction
-    - dirs: variable with distros using alternate snap mount
-    - many,randutil: centralize and streamline our random value
-      generation
-    - tests/lib/prepare-restore: Revert "Continue on errors updating or
-      installing dependencies"
-    - daemon: Allow clients to call /v2/logout via Polkit
-    - dirs: manjaro-arm is like manjaro
-    - data, packaging: Add sudoers snippet to allow snaps to be run with
-      sudo
-    - daemon, store: better expose single action errors
-    - tests: switch mount-ns test to differential data set
-    - snapstate: refactor things to add the re-refresh task last
-    - daemon: drop support for the DELETE method
-    - client: move to /v2/users; implement RemoveUser
-    - boot: enable UC20 kernel extraction and bootState20 handling
-    - interfaces/policy: enforce plug-names/slot-names constraints
-    - asserts: parse plug-names/slot-names constraints
-    - daemon: make users result more consistent
-    - cmd/snap-confine,tests: support x.y.z nvidia version
-    - dirs: fixlet for XdgRuntimeDirGlob
-    - boot: add bootloader options to coreKernel
-    - o/auth,daemon: do not remove unknown user
-    - tests: tweak and enable tests on ubuntu 20.04
-    - daemon: implement user removal
-    - cmd/snap-confine: allow snap-confine to link to libpcre2
-    - interfaces/builtin: Allow NotificationReplied signal on
-      org.freedesktop.Notifications
-    - overlord/auth: add RemoveUserByName
-    - client: move user-related things to their own files
-    - boot: tweak kernel cmdline helper docstring
-    - osutil: implement deluser
-    - gadget: skip update when raw structure content is unchanged
-    - boot, cmd/snap, cmd/snap-bootstrap: move run mode and system label
-      detection to boot
-    - tests: fix revisions leaking from snapd-refresh test
-    - daemon: refactor create-user to a user action & hide behind a flag
-    - osutil/tests: check there are no leftover symlinks with
-      AtomicSymlink
-    - grub: support atomically renaming kernel symlinks
-    - osutil: add helpers for creating symlinks and renaming in an
-      atomic manner
-    - tests: add marker tag for core 20 test failure
-    - tests: fix gadget-update-pc test leaking snaps
-    - tests: remove revision leaking from ubuntu-core-refresh
-    - tests: remove revision leaking from remodel-kernel
-    - tests: disable system-usernames test on core20
-    - travis, tests, run-checks: skip nakedret
-    - tests: run `uc20-snap-recovery-encrypt` test on 20.04-64 as well
-    - tests: update mount-ns test tables
-    - snap: disable auto-import in uc20 install-mode
-    - tests: add a command-chain service test
-    - tests: use test-snapd-upower instead of upower
-    - data/selinux: workaround incorrect fonts cache labeling on RHEL7
-    - spread.yaml: fix ubuntu 19.10 and 20.04 names
-    - debian: check embedded keys for snap-{bootstrap,preseed} too
-    - interfaces/apparmor: fix doc-comments, unnecessary code
-    - o/ifacestate,o/devicestatate: merge gadget-connect logic into
-      auto-connect
-    - bootloader: add ExtractedRunKernelImageBootloader interface,
-      implement in grub
-    - tests: add spread test for hook permissions
-    - cmd/snap-bootstrap: check device size before boostrapping and
-      produce a meaningful error
-    - cmd/snap: add ability to register "snap routine" commands
-    - tests: add a test demonstrating that snaps can't access the
-      session agent socket
-    - api: don't return connections referring to non-existing
-      plugs/slots
-    - interfaces: refactor path() from raw-volume into utils with
-      comments for old
-    - gitignore: ignore snap files
-    - tests: skip interfaces-network-manager on arm devices
-    - o/devicestate: do not create perfTimings if not needed inside
-      ensureSeed/Operational
-    - tests: add ubuntu 20.04 to the tests execution and remove
-      tumbleweed from unstable
-    - usersession: add systemd user instance service control to user
-      session agent
-    - cmd/snap: print full channel in 'snap list', 'snap info'
-    - tests: remove execution of ubuntu 19.04 from google backend
-    - cmd/snap-boostrap: add mocking for fakeroot
-    - tests/core18/snapd-failover: collect more debug info
-    - many: run black formatter on all python files
-    - overlord: increase settle timeout for slow machines
-    - httputil: use shorter timeout in TestRetryRequestTimeoutHandling
-    - store, o/snapstate: send default-tracks header, use
-      RedirectChannel
-    - overlord/standby: fix possible deadlock in standby test
-    - cmd/snap-discard-ns: fix pattern for .info files
-    - boot: add HasModeenv to Device
-    - devicestate: do not allow remodel between core20 models
-    - bootloader,snap: misc tweaks
-    - store, overlord/snapstate, etc: SnapAction now returns a []…Result
-    - snap-bootstrap: create encrypted partition
-    - snap: remove "host" output from `snap version`
-    - tests: use snap remove --purge flag in most of the spread tests
-    - data/selinux, test/main/selinux-clean: update the test to cover
-      more scenarios
-    - many: drop NameAndRevision, use snap.PlaceInfo instead
-    - boot: split MakeBootable tests into their own file
-    - travis-ci: add go import path
-    - boot: split MakeBootable implementations into their own file
-    - tests: enable a lot of the tests of main on uc20
-    - packaging, tests: stop services in prerm
-    - tests: enable regression suite on core20
-    - overlord/snapstate: improve snapd snap backend link unit tests
-    - boot: implement SetNextBoot in terms of bootState.setNext
-    - wrappers: write and undo snapd services on core
-    - boot,o/devicestate: refactor MarkBootSuccessful over bootState
-    - snap-bootstrap: mount the correct snapd snap to /run/mnt/snapd
-    - snap-bootstrap: refactor partition creation
-    - tests: use new snapd.spread-tests-run-mode-tweaks.service unit
-    - tests: add core20 tests
-    - boot,o/snapstate: SetNextBoot/LinkSnap return whether to reboot,
-      use the information
-    - tests/main/snap-sign: add test for non-stdin signing
-    - snap-bootstrap: trigger udev after filesystem creation
-    - boot,overlord: introduce internal abstraction bootState and use it
-      for InUse/GetCurrentBoot
-    - overlord/snapstate: tracks are now sticky
-    - cmd: sign: add filename param
-    - tests: remove "test-snapd-tools" in smoke/sandbox on restore
-    - cmd/snap, daemon: stop over-normalising channels
-    - tests: fix classic-ubuntu-core-transition-two-cores after refactor
-      of MATCH -v
-    - packaging: ship var/lib/snapd/desktop/applications in the pkg
-    - spread: drop copr repo with F30 build dependencies
-    - tests: use test-snapd-sh snap instead of test-snapd-tools - Part 3
-    - tests: fix partition creation test
-    - tests: unify/rename services-related spread tests to start with
-      services- prefix
-    - test: extract code that modifies "writable" for test prep
-    - systemd: handle preseed mode
-    - snap-bootstrap: read only stdout when parsing the sfdisk json
-    - interfaces/browser-support: add more product/vendor paths
-    - boot: write compat UC16 bootvars in makeBootable20RunMode
-    - devicestate: avoid adding mockModel to deviceMgrInstallModeSuite
-    - devicestate: request reboot after successful doSetupRunSystem()
-    - snapd.core-fixup.sh: do not run on UC20 at all
-    - tests: unmount automounted snap-bootstrap devices
-    - devicestate: run boot.MakeBootable in doSetupRunSystem
-    - boot: copy kernel/base to data partition in makeBootable20RunMode
-    - tests: also check nested lxd container
-    - run-checks: complain about MATCH -v
-    - boot: always return the trivial boot participant in ephemeral mode
-    - o/devicestate,o/snapstate: move the gadget.yaml checkdrive-by: use
-      gadget.ReadInfoFromSnapFile in checkGadgetRemodelCompatible
-    - snap-bootstrap: append new partitions
-    - snap-bootstrap: mount filesystems after creation
-    - snapstate: do not try to detect rollback in ephemeral modes
-    - snap-bootstrap: trigger udev for new partitions
-    - cmd/snap-bootstrap: xxx todos about kernel cross-checks
-    - tests: avoid mask rsyslog service in case is not enabled on the
-      system
-    - tests: fix use of MATCH -v
-    - cmd/snap-preseed: update help strings
-    - cmd/snap-bootstrap: actually parse snapd_recovery_system label
-    - bootstrap: reduce runmode mounts from 5 to 2 steps.
-    - lkenv.go: adjust for new location of include file
-    - snap: improve squashfs.ReadFile() error
-    - systemd: fix uc20 shutdown
-    - boot: write modeenv when creating the run mode
-    - boot,image: add skeleton boot.makeBootable20RunMode
-    - cmd/snap-preseed: add snap-preseed executable
-    - overlord,boot: follow ups to #7889 and #7899
-    - interfaces/wayland: Add access to Xwayland's shm files
-    - o/hookstate/ctlcmd: fix command name in snapctl -h
-    - daemon,snap: remove screenshot deprecation notice
-    - overlord,o/snapstate: make sure we never leave config behind
-    - many: pass consistently boot.Device state to boot methods
-    - run-checks: check multiline string blocks in
-      restore/prepare/execute sections of spread tests
-    - intrefaces: login-session-control - added missing dbus commands
-    - tests/main/parallel-install-remove-after: parallel installs should
-      not break removal
-    - overlord/snapstate: tweak assumes error hint
-    - overlord: replace DeviceContext.OldModel with GroundContext
-    - devicestate: use httputil.ShouldRetryError() in
-      prepareSerialRequest
-    - tests: replace "test-snapd-base-bare" with real "bare" base snap
-    - many: pass a Model to the gadget info reading functions
-    - snapstate: relax gadget constraints in ConfigDefaults Et al.
-    - devicestate: only run ensureBootOk() in "run" mode
-    - tests/many: quiet lxc launching, file pushing
-    - tests: disable apt-hooks test until it can be properly fixed
-    - tests: 16.04 and 18.04 now have mediating pulseaudio
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 17 Mar 2020 20:55:47 +0100
-
-snapd (2.43.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - interfaces/opengl: allow datagrams to nvidia-driver
-    - httputil: add NoNetwork(err) helper, spread test and use
-      in serial acquire
-    - interfaces: add uio interface
-    - interfaces/greengrass-support: 'aws-iot-greengrass' snap fails to
-      start due to apparmor deny on mounting of "/proc/latency_stats".
-    - data, packaging: Add sudoers snippet to allow snaps to be run with
-      sudo
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 12 Feb 2020 14:59:15 +0100
-
-snapd (2.43.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - cmd/snap-confine: Revert #7421 (unmount /writable from snap view)
-    - overlord/snapstate: fix for re-refresh bug
-    - tests, run-checks, many: fix nakedret issues
-    - data/selinux: workaround incorrect fonts cache labeling on RHEL7
-    - tests: use test-snapd-upower instead of upower
-    - overlord: increase overall settle timeout for slow arm boards
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 28 Jan 2020 15:50:25 +0100
-
-snapd (2.43.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - devicestate: use httputil.ShouldRetryError() in prepareSerialRequest
-    - overlord/standby: fix possible deadlock in standby test
-    - cmd/snap-discard-ns: fix pattern for .info files
-    - overlord,o/snapstate: make sure we never leave config behind
-    - data/selinux: update policy to cover more cases
-    - snap: remove "host" output from `snap version`
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 14 Jan 2020 20:30:07 +0100
-
-snapd (2.43) xenial; urgency=medium
-
-  * New upstream release, LP: #1856159
-    - snap: default to "--direct" in `snap known`
-    - packaging: ship var/lib/snapd/desktop/applications in the
-      pkg
-    - tests: cherry-pick fixes for  snap-set-core-config/ubuntu-core-
-      config-defaults-once
-    - tests: use test-snapd-sh snap instead of test-snapd-tools
-    - tests: rename "test-snapd-sh" in smoke test to test-snapd-sandbox
-    - tests: fix partition creation test
-    - packaging: fix incorrect changelog entry
-    - Revert "tests: 16.04 and 18.04 now have mediating pulseaudio"
-    - tests: 16.04 and 18.04 now have mediating pulseaudio
-    - interfaces: include hooks in plug/slot apparmor label
-    - interfaces: add raw-volume interface for access to partitions
-    - image: set recovery system label when creating the image
-    - cmd/snapd-generator: fix unit name for non /snap mount locations
-    - boot,bootloader: setup the snap recovery system bootenv
-    - seed: support ModeSnaps(mode) for mode != "run"
-    - seed: fix seed location of local but asserted snaps
-    - doc: HACKING.md change autopkgtest-trusty-amd64.img name
-    - interfaces/seccomp: parallelize seccomp backend setup
-    - cmd/snap-bootstrap: mount ubuntu-data tmpfs, in one go with kernel
-      & base
-    - interfaces: add audio-playback/record and pulseaudio spread tests
-    - apparmor: allow 'r'
-      /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
-    - cmd/snap-mgmt, packaging/postrm: stop and remove socket units when
-      purging
-    - tests: use test-snapd-sh snap instead of test-snapd-tools
-    - snap-confine: raise egid before calling setup_private_mount()
-    - tests: fix fwupd version regular expression
-    - snap-bootstrap: parse seed if either kernel or base are not
-      mounted
-    - tests: check for SELinux denials in interfaces-kvm spread test
-    - tests: run snap-set-core-config on all core devices
-    - selinux: update policy to allow modifications related to kmod
-      backend
-    - o/hookstate/ctlcmd: snapctl is-connected command
-    - devicestate: add missing test for failing task setup-run-system
-    - gadget: add missing test for duplicate detection of roles
-    - tests/cmd/snapctl: unset SNAP_CONTEXT for the suite
-    - snap/pack, cmd_pack: 'snap pack --check-skeleton' checks
-      interfaces
-    - gitignore: ignore visual studio code directory
-    - snap-bootstrap: implement "run" mode in snap-bootstrap initramfs-
-      mounts
-    - interfaces/apparmor: handle pre-seeding mode
-    - devicestate: implement creating partitions in "install" mode
-    - seed: support extra snaps on top of Core 20 dangerous models
-    - tests: cache snaps also for ubuntu core and add new snaps to cache
-    - snap-bootstrap: support auto-detect device in create-partitions
-    - tests: fix partitioning test debug message
-    - tests: prevent partitioning test errors
-    - cmd/snap-bootstrap: stub out snap.SanitizePlugsSlots for real
-    - gadget: extract and export new DiskFromPartition() helper
-    - snap-bootstrap: force partition table operations
-    - HACKING.md: add nvidia options to configure example
-    - tests: move the watchdog timeout to 2s to make the tests work in
-      rpi
-    - tests: demand silence from check_journalctl_log
-    - tests: fix the channels checks done on nested tests
-    - tests: reduce the complexity of the test-snapd-sh snap
-    - snap/squashfs, osutil: verify files/dirs can be accessed by
-      mksquashfs when building a snap
-    - boot: add boot.Modeenv.Kernel support
-    - devicestate: ensure system installation
-    - tests: apply change on permissions to serial port on hotplug test
-    - cmd/snap-update-ns: adjust debugging output for usability
-    - devicestate: add reading of modeenv to uc20 firstboot code
-    - tests/lib/prepare: drop workarounds for rpmbuild rewriting /bin/sh
-    - cmd/snap-bootstrap: write /var/lib/snapd/modeenv to the right
-      place
-    - boot: add boot.Modeenv.Base support
-    - overlord/snapstate: install task edges
-    - cmd/snap-bootstrap: some small naming and code org tweaks
-    - snap-bootstrap: remove SNAPPY_TESTING check, we use it for real
-      now
-    - interfaces: remove leftover reservedForOS
-    - snap-bootstrap: write /run/mnt/ubuntu-data/var/lib/snapd/modeenv
-    - osutil/mount: optimize flagOptSearch some more
-    - devicestate: read modeenv early and store in devicestate
-    - interfaces: add login-session-observe for who, {fail,last}log and
-      loginctl
-    - tests: add Ubuntu Eoan to google-sru backend
-    - osutil/mount: de-duplicate code to use a list
-    - interfaces: remove reservedForOS from commonInterface
-    - interfaces/browser-support: allow reading status of huge pages
-    - interfaces: update system-backup tests to not check for sanitize
-      errors related to os
-    - interfaces: add system-backup interface
-    - osutil/mount: add {Unm,M}outFlagsToOpts helpers
-    - snap-bootstrap: make cmdline parsing robust
-    - overlord/patch: normalize tracking channel in state
-    - boot: add boot.Modeenv that can read/write the UC20 modeenv files
-    - bootloader: add new bootloader.InstallBootConfig()
-    - many: share single implementation to list needed default-providers
-    - snap-bootstrap: implement "snap-bootstrap initramfs-mounts"
-    - seccomp: allow chown 'snap_daemon:root' and 'root:snap_daemon'
-    - osutil: handle "rw" mount flag in ParseMountEntry
-    - overlord/ifacestate: report bad plug/slots with warnings on snap
-      install
-    - po: sync translations from launchpad
-    - tests: cleanup most test snaps icons, they were anyway in the
-      wrong place
-    - seed: fix confusing pre snapd dates in tests
-    - many: make ValidateBasesAndProviders signature simpler/canonical
-    - snap-bootstrap: set expected filesystem labels
-    - testutil, many: make MockCommand() create prefix of absolute paths
-    - tests: improve TestDoPrereqRetryWhenBaseInFlight to fix occasional
-      flakiness.
-    - seed: proper support for optional snaps for Core 20 models
-    - many: test various kinds of overriding for the snapd snap in Core
-      20
-    - cmd/snap-failure: passthrough snapd logs, add informational
-      logging
-    - cmd/snap-failure: fallback to snapd from core, extend tests
-    - configcore: fix missing error propagation
-    - devicestate: rename ensureSeedYaml -> ensureSeeded
-    - tests: adding fedora 31
-    - tests: restart the snapd service in the snapd-failover test
-    - seed: Core 20 seeds channel overrides support for grade dangerous
-    - cmd: fix the get command help message
-    - tests: enable degraded test on arch linux after latest image
-      updates
-    - overlord/snapstate: don't re-enable and start disabled services on
-      refresh, etc.
-    - seed: support in Core 20 seeds local unasserted snaps for model
-      snaps
-    - snap-bootstrap: add go-flags cmdline parsing and tests
-    - gadget: skip fakeroot if not needed
-    - overlord/state: panic in MarkEdge() if task is nil
-    - spread: fix typo in spread suite
-    - overlord: mock device serial in gadget remodel unit tests
-    - tests: fix spread shellcheck and degraded tests to unbreak master
-    - spread, tests: openSUSE Tumbleweed to unstable systems, update
-      system-usernames on Amazon Linux 2
-    - snap: extract printInstallHint in cmd_download.go
-    - cmd: fix a pair of typos
-    - release: preseed mode flag
-    - cmd/snap-confine: tracking processes with classic confinement
-    - overlord/ifacestate: remove automatic connections if plug/slot
-      missing
-    - o/ifacestate,interfaces,interfaces/policy: slots-per-plug: *
-    - tests/lib/state: snapshot and restore /var/snap during the tests
-    - overlord: add base->base remodel undo tests and fixes
-    - seed: test and improve Core 20 seed handling errors
-    - asserts: add "snapd" type to valid types in the model assertion
-    - snap-bootstrap: check gadget versus disk partitions
-    - devicestate: add support for gadget->gadget remodel
-    - snap/snapenv: preserve XDG_RUNTIME_DIR for classic confinement
-    - daemon: parse and reject invalid channels in snap ops
-    - overlord: add kernel remodel undo tests and fix undo
-    - cmd/snap: support (but warn) using deprecated multi-slash channel
-    - overlord: refactor mgrsSuite and extract kernelSuite
-    - tests/docker-smoke: add minimal docker smoke test
-    - interfaces: extend the fwupd slot to be implicit on classic
-    - cmd/snap: make 'snap list' shorten latest/$RISK to $RISK
-    - tests: fix for journalctl which is failing to restart
-    - cmd/snap,image: initial support for Core 20 in prepare-image with
-      test
-    - cmd/snap-confine: add support for parallel instances of classic
-      snaps, global mount ns initialization
-    - overlord: add kernel rollback across reboots manager test and
-      fixes
-    - o/devicestate: the basics of Core 20 firstboot support with test
-    - asserts: support and parsing for slots-per-plug/plugs-per-slotSee
-      https://forum.snapcraft.io/t/plug-slot-declaration-rules-greedy-
-      plugs/12438
-    - parts/plugins: don't xz-compress a deb we're going to discard
-    - cmd/snap: make completion skip hidden commands (unless overridden)
-    - many: load/consume Core 20 seeds (aka recovery systems)
-    - tests: add netplan test on ubuntu core
-    - seed/internal: doc comment fix and drop handled TODOs
-    - o/ifacestate: unify code into
-      autoConnectChecker.addAutoConnectionsneed to change to support
-      slots-per-plugs: *
-    - many: changes to testing in preparation of Core 20 seed consuming
-      code
-    - snapstate,devicestate: make OldModel() available in DeviceContext
-    - tests: opensuse tumbleweed has similar issue than arch linux with
-      snap --strace
-    - client,daemon: pass sha3-384 in /v2/download to the client
-    - builtin/browser_support.go: allow monitoring process memory
-      utilization (used by chromium)
-    - overlord/ifacestate: use SetupMany in setupSecurityByBackend
-    - tests: add 14.04 canonical-livepatch test
-    - snap: make `snap known --remote` use snapd if available
-    - seed: share auxInfo20 and makeSystemSnap via internal
-    - spread: disable secondary compression for deltas
-    - interfaces/content: workaround for renamed target
-    - tests/lib/gendevmodel: helper tool for generating developer model
-      assertions
-    - tests: tweak wording in mount-ns test
-    - tests: don't depend on GNU time
-    - o/snapstate, etc: SnapState.Channel -> TrackingChannel, and a
-      setter
-    - seed/seedwriter: support writing Core 20 seeds (aka recovery
-      systems)
-    - snap-recovery: rename to "snap-bootstrap"
-    - managers: add remodel undo test for new required snaps case
-    - client: add xerrors and wrap errors coming from "client"
-    - tests: verify host is not affected by mount-ns tests
-    - tests: configure the journald service for core systems
-    - cmd/snap, store: include snapcraft.io page URL in snap info output
-    - cmd/cmdutil: version helper
-    - spread: enable bboozzoo/snapd-devel-deps COPR repo for getting
-      golang-x-xerrors
-    - interfaces: simplify AddUpdateNS and emit
-    - interfaces/policy: expand cstrs/cstrs1 to
-      altConstraints/constraints
-    - overlord/devicestate: check snap handler for gadget remodel
-      compatibility
-    - snap-recovery: deploy gadget content when creating partitions
-    - gadget: skip structures with MBR role during remodel
-    - tests: do not use lsblk in uc20-snap-recovery test
-    - overlord/snapstate: add LastActiveDisabledServices,
-      missingDisabledServices
-    - overlord/devicestate: refactor and split into per-functionality
-      files, drop dead code
-    - tests: update mount-ns after addition of /etc/systemd/user
-    - interfaces/pulseaudio: adjust to manually connect by default
-    - interfaces/u2f-devices: add OnlyKey to devices list
-    - interfaces: emit update-ns snippets to function
-    - interfaces/net-setup-{observe,control}: add Info D-Bus method
-      accesses
-    - tests: moving ubuntu-19.10-64 from google-unstable to google
-      backend
-    - gadget: rename existing and add new helpers for checking
-      filesystem/partition presence
-    - gadget, overlord/devicestate: add support for customized update
-      policy, add remodel policy
-    - snap-recovery: create filesystems as defined in the gadget
-    - tests: ignore directories for go modules
-    - policy: implement CanRemove policy for the snapd type
-    - overlord/snapstate: skip catalog refresh if unseeded
-    - strutil: add OrderedSet
-    - snap-recovery: add minimal binary so that we can use spread on it
-    - gadget, snap/pack: perform extended validation of gadget metadata
-      and contents
-    - timeutil: fix schedules with ambiguous nth weekday spans
-    - interfaces/many: allow k8s/systemd-run to mount volume subPaths
-      plus cleanups
-    - client: add KnownOptions to Know() and support remote assertions
-    - tests: check the apparmor_parser when the file exists on snap-
-      confine test
-    - gadget: helper for volume compatibility checks
-    - tests: update snap logs to match for multiple lines for "running"
-    - overlord: add checks for bootvars in
-      TestRemodelSwitchToDifferentKernel
-    - snap-install: add ext4,vfat creation support
-    - snap-recovery: remove "usedPartitions" from sfdisk.Create()
-    - image,seed: hide Seed16/Snap16, use seed.Open in image_test.go
-    - cmd/snap: Sort tasks in snap debug timings output by lanes and
-      ready-time.
-    - snap-confine.apparmor.in: harden pivot_root until we have full
-      mediation
-    - gadget: refactor ensureVolumeConsistency
-    - gadget: add a public helper for parsing gadget metadata
-    - many: address issues related to explicit/implicit channels for
-      image building
-    - overlord/many: switch order of check snap parameters
-    - cmd/snap-confine: remove leftover condition from capability world
-    - overlord: set fake serial in TestRemodelSwitchToDifferentKernel
-    - overlord/many: extend check snap callback to take snap container
-    - recovery-tool: add sfdisk wrapper
-    - tests: launch the lxd images following the pattern
-      ubuntu:${VERSION_ID}
-    - sandbox/cgroup: move freeze/thaw code
-    - gadget: accept system-seed role and ubuntu-data label
-    - test/lib/names.sh: make backslash escaping explicit
-    - spread: generate delta when using google backend
-    - cmd/snap-confine: remove loads of dead code
-    - boot,dirs,image: various refinements in the prepare-image code
-      switched to seedwriter
-    - spread: include mounts list in task debug output
-    - .gitignore: pair of trivial changes
-    - image,seed/seedwriter: switch image to use seedwriter.Writer
-    - asserts: introduce explicit support for grade for Core 20 models
-    - usersession: drive by fixes for things flagged by unused or
-      gosimple
-    - spread.yaml: exclude vendor dir
-    - sandbox/cgroup, overlord/snapstate: move helper for listing pids
-      in group to the cgroup package
-    - sandbox/cgroup: refactor process cgroup helper to support v2 and
-      named hierarchies
-    - snap-repair: error if run as non-root
-    - snap: when running `snap repair` without arguments, show hint
-    - interfaces: add cgroup-version to system-key
-    - snap-repair: add missing check in TestRepairBasicRun
-    - tests: use `snap model` instead of `snap known model` in tests
-    - daemon: make /v2/download take snapRevisionOptions
-    - snap-repair: add additional comment about trust in runner.Verify()
-    - client: add support to use the new "download" API
-    - interfaces: bump system-key version (and keep on bumping)
-    - interfaces/mount: account for cgroup version when reporting
-      supported features
-    - tests: change regex to validate access to cdn during snap
-      download
-    - daemon: change /v2/download API to take "snap-name" as input
-    - release: make forced dev mode look at cgroupv2 support
-    - seed/seedwriter: support for extra snaps
-    - wrappers/services.go: add disabled svc list arg to AddSnapServices
-    - overlord/snapstate: add SetTaskSnapSetup helper + unit tests
-    - cmd/libsnap: use cgroup.procs instead of tasks
-    - tests: fix snapd-failover test for core18 tests on boards
-    - overlord/snapstate/policy, etc: introduce policy, move canRemove
-      to it
-    - seed/seedwriter: cleanups and small left over todos* drive-by: use
-      testutil.FilePresent consistently
-    - cmd/snap: update 'snap find' help because it's no longer narrow
-    - seed/seedwriter,snap/naming: support classic models
-    - cmd/snap-confine: unmount /writable from snap view
-    - spread.yaml: exclude automake cacheThe error message is looks like
-      this:dpkg-source: info: local changes detected, the modified files
-      are:
-    - interfaces/openvswitch: allow access to other openvswitch sockets
-    - cmd/model: don't show model with display-name inline w/ opts
-    - daemon: add a 'prune' debug action
-    - client: add doTimeout to http.Client{Timeout}
-    - interfaces/seccomp: query apparmor sandbox helper rather than
-      aggregate info
-    - sandbox/cgroup: avoid dependency on dirs
-    - seed/seedwriter,snap: support local snaps
-    - overlord/snapstate: fix undo on firstboot seeding.
-    - usersession: track connections to session agent for exit on idle
-      and peer credential checks
-    - tests: fix ubuntu-core-device-reg test for arm devices on core18
-    - sandbox/seccomp: move the remaining sandbox bits to a
-      corresponding sandbox package
-    - osutil: generalize SyncDir with FileState interface
-    - daemon, client, cmd/snap: include architecture in 'snap version'
-    - daemon: allow /v2/assertions/{assertType} to query store
-    - gadget: do not fail the update when old gadget snap is missing
-      bare content
-    - sandbox/selinux: move SELinux related bits from 'release' to
-      'sandbox/selinux'
-    - tests: add unit test for gadget defaults with a multiline string
-    - overlord/snapstate: have more context in the errors about
-      prerequisites
-    - httputil: set user agent for CONNECT
-    - seed/seedwriter: resolve channels using channel.Resolve* for snaps
-    - run-checks: allow overriding gofmt binary, show gofmt diff
-    - asserts,seed/seedwriter: follow snap type sorting in the model
-      assertion snap listings
-    - daemon: return "snapname_rev.snap" style when using /v2/download
-    - tests: when the backend is external skip the loop waiting for snap
-      version
-    - many: move AppArmor probing code under sandbox/apparmor
-    - cmd: add `snap debug boot-vars` that dumps the current bootvars
-    - tests: skip the ubuntu-core-upgrade on arm devices on core18
-    - seed/seedwriter: implement WriteMeta and tree16 corresponding code
-    - interfaces/docker-support,kubernetes-support: misc updates for
-      strict k8s
-    - tests: restart the journald service while preparing the test
-    - tests/cmd/debug_state: make the test output TZ independent
-    - interfaces/kubernetes-support: allow use of /run/flannel
-    - seed/seedwriter: start of Writer and internal policy16/tree16
-    - sandbox/cgroup, usersession/userd: move cgroup related helper to a
-      dedicated package
-    - tests: move "centos-7" to unstable systems
-    - snapstate: add missing tests for checkGadgetOrKernel
-    - docs: Update README.md
-    - snapcraft: set license to GPL-3.0
-    - interfaces/wayland: allow a confined server running in a user
-      session to work with Qt, GTK3 & SDL2 clients
-    - selinux: move the package under sandbox/selinux
-    - interfaces/udev: account for cgroup version when reporting
-      supported features
-    - store, ..., client: add a "website" field
-    - sanity: sanity check cgroup probing
-    - snapstate: increase settleTimeout in
-      TestRemodelSwitchToDifferentKernel
-    - packaging: remove obsolete usr.lib.snapd.snap-confine in postinst
-    - data/selinux: allow snapd/snap to do statfs() on the cgroup
-      mountpoint
-    - usersession/userd: make sure to export DBus interfaces before
-      requesting a name
-    - data/selinux: allow snapd to issue sigkill to journalctl
-    - docs: Add Code of Conduct
-    - store: download propagates options to delta download
-    - tests/main/listing: account for dots in ~pre suffix
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 09 Jan 2020 17:14:51 +0100
-
-snapd (2.42.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - snap-confine: revert, with comment, explicit unix deny for nested
-      lxd
-    - Disable mount-ns test on 16.04. It is too flaky currently.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 06 Dec 2019 14:10:56 +0100
-
-snapd (2.42.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - overlord/snapstate: make sure configuration defaults are applied
-      only once
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 28 Nov 2019 06:48:26 +0100
-
-snapd (2.42.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - overlord/snapstate: pick up system defaults when seeding the snapd
-      snap
-    - cmd/snap-update-ns: fix overlapping, nested writable mimic
-      handling
-    - interfaces: misc updates for u2f-devices, browser-support,
-      hardware-observe, et al
-    - tests: reset failing "fwupd-refresh.service" if needed
-    - tests/main/gadget-update-pc: use a program to modify gadget yaml
-    - snap-confine: suppress noisy classic snap file_inherit denials
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 27 Nov 2019 12:41:07 +0100
-
-snapd (2.42.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1853244
-    - interfaces/lxd-support: Fix on core18
-    - tests/main/system-usernames: Amazon Linux 2 comes with libseccomp
-      2.4.1 now
-    - snap-seccomp: add missing clock_getres_time64
-    - cmd/snap-seccomp/syscalls: update the list of known
-      syscalls
-    - sandbox/seccomp: accept build ID generated by Go toolchain
-    - interfaces: allow access to ovs bridge sockets
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 20 Nov 2019 08:09:15 +0100
-
-snapd (2.42.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1846181
-    - interfaces: de-duplicate emitted update-ns profiles
-    - packaging: tweak handling of usr.lib.snapd.snap-confine
-    - interfaces: allow introspecting network-manager on core
-    - tests/main/interfaces-contacts-service: disable on openSUSE
-      Tumbleweed
-    - tests/lib/lxd-snapfuse: restore mount changes introduced by LXD
-    - snap: fix default-provider in seed validation
-    - tests: update system-usernames test now that opensuse-15.1 works
-    - overlord: set fake sertial in TestRemodelSwitchToDifferentKernel
-    - gadget: rename "boot{select,img}" -> system-boot-{select,image}
-    - tests: listing test, make accepted snapd/core versions consistent
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 30 Oct 2019 13:17:43 +0100
-
-snapd (2.42) xenial; urgency=medium
-
-  * New upstream release, LP: #1846181
-    - tests: disable {contacts,calendar}-service tests on debian-sid
-    - tests/main/snap-run: disable strace test cases on Arch
-    - cmd/system-shutdown: include correct prototype for die
-    - snap/naming: add test for hook name connect-plug-i2c
-    - cmd/snap-confine: allow digits in hook names
-    - gadget: do not fail the update when old gadget snap is missing
-      bare content
-    - tests: disable {contacts,calendar}-service tests on Arch Linux
-    - tests: move "centos-7" to unstable systems
-    - interfaces/docker-support,kubernetes-support: misc updates for
-      strict k8s
-    - packaging: remove obsolete usr.lib.snapd.snap-confine in
-      postinst
-    - tests: add test that ensures our snapfuse binary actually works
-    - packaging: use snapfuse_ll to speed up snapfuse performance
-    - usersession/userd: make sure to export DBus interfaces before
-      requesting a name
-    - data/selinux: allow snapd to issue sigkill to journalctl
-    - store: download propagates options to delta download
-    - wrappers: allow snaps to install icon theme icons
-    - debug: state-inspect debugging utility
-    - sandbox/cgroup: introduce cgroup wrappers package
-    - snap-confine: fix return value checks for udev functions
-    - cmd/model: output tweaks, add'l tests
-    - wrappers/services: add ServicesEnableState + unit tests
-    - tests: fix newline and wrong test name pointed out in previous PRs
-    - tests: extend mount-ns test to handle mimics
-    - run-checks, tests/main/go: allow gofmt checks to be skipped on
-      19.10
-    - tests/main/interfaces-{calendar,contacts}-service: disable on
-      19.10
-    - tests: part3 making tests work on ubuntu-core-18
-    - tests: fix interfaces-timeserver-control on 19.10
-    - overlord/snapstate: config revision code cleanup and extra tests
-    - devicestate: allow remodel to different kernels
-    - overlord,daemon: adjust startup timeout via EXTEND_TIMEOUT_USEC
-      using an estimate
-    - tests/main/many: increase kill-timeout to 5m
-    - interfaces/kubernetes-support: allow systemd-run to ptrace read
-      unconfined
-    - snapstate: auto transition on experimental.snapd-snap=true
-    - tests: retry checking until the written file on desktop-portal-
-      filechooser
-    - tests: unit test for a refresh failing on configure hook
-    - tests: remove mount_id and parent_id from mount-ns test data
-    - tests: move classic-ubuntu-core-transition* to nightly
-    - tests/mountinfo-tool: proper formatting of opt_fields
-    - overlord/configstate: special-case "null" in transaction Changes()
-    - snap-confine: fallback gracefully on a cgroup v2 only system
-    - tests: debian sid now ships new seccomp, adjust tests
-    - tests: explicitly restore after using LXD
-    - snapstate: make progress reporting less granular
-    - bootloader: little kernel support
-    - fixme: rename ubuntu*architectures to dpkg*architectures
-    - tests: run dbus-launch inside a systemd unit
-    - channel: introduce Resolve and ResolveLocked
-    - tests: run failing tests on ubuntu eoan due to is now set as
-      unstable
-    - systemd: detach rather than unmount .mount units
-    - cmd/snap-confine: add unit tests for sc_invocation, cleanup memory
-      leaks in tests
-    - boot,dirs,image: introduce boot.MakeBootable, use it in image
-      instead of ad hoc code
-    - cmd/snap-update-ns: clarify sharing comment
-    - tests/overlord/snapstate: refactor for cleaner test failures
-    - cmd/snap-update-ns: don't propagate detaching changes
-    - interfaces: allow reading mutter Xauthority file
-    - cmd/snap-confine: fix /snap duplication in legacy mode
-    - tests: fix mountinfo-tool filtering when used with rewriting
-    - seed,image,o/devicestate: extract seed loading to seed/seed16.go
-    - many: pass the rootdir and options to bootloader.Find
-    - tests: part5 making tests work on ubuntu-core-18
-    - cmd/snap-confine: keep track of snap instance name and the snap
-      name
-    - cmd: unify die() across C programs
-    - tests: add functions to make an abstraction for the snaps
-    - packaging/fedora, tests/lib/prepare-restore: helper tool for
-      packing sources for RPM
-    - cmd/snap: improve help and error msg for snapshot commands
-    - hookstate/ctlcmd: fix snapctl set help message
-    - cmd/snap: don't append / to snap name just because a dir exists
-    - tests: support fastly-global.cdn.snapcraft.io url on proxy-no-core
-      test
-    - tests: add --quiet switch to retry-tool
-    - tests: add unstable stage for travis execution
-    - tests: disable interfaces-timeserver-control on 19.10
-    - tests: don't guess in is_classic_confinement_supported
-    - boot, etc: simplify BootParticipant (etc) usage
-    - tests: verify retry-tool not retrying missing commands
-    - tests: rewrite "retry" command as retry-tool
-    - tests: move debug section after restore
-    - cmd/libsnap-confine-private, cmd/s-c: use constants for
-      snap/instance name lengths
-    - tests: measure behavior of the device cgroup
-    - boot, bootloader, o/devicestate: boot env manip goes in boot
-    - tests: enabling ubuntu 19.10-64 on spread.yaml
-    - tests: fix ephemeral mount table in left over by prepare
-    - tests: add version-tool for comparing versions
-    - cmd/libsnap: make feature flag enum 1<<N style
-    - many: refactor boot/boottest and move to bootloader/bootloadertest
-    - tests/cross/go-build: use go list rather than shell trickery
-    - HACKING.md: clarify where "make fmt" is needed
-    - osutil: make flock test more robust
-    - features, overlord: make parallel-installs exported, export flags
-      on startup
-    - overlord/devicestate:  support the device service returning a
-      stream of assertions
-    - many: add snap model command, add /v2/model, /v2/model/serial REST
-      APIs
-    - debian: set GOCACHE dir during build to fix FTBFS on eoan
-    - boot, etc.: refactor boot to have a lookup with different imps
-    - many: add the start of Core 20 extensions support to the model
-      assertion
-    - overlord/snapstate: revert track-risk behavior change and
-      validation on install
-    - cmd/snap,image,seed:  move image.ValidateSeed to
-      seed.ValidateFromYaml
-    - image,o/devicestate,seed: oops, make sure to clear seedtest
-      helpers
-    - tests/main/snap-info: update check.py for test-snapd-tools 2.0
-    - tests: moving tests to nightly suite
-    - overlord/devicestate,seed:  small step, introduce
-      seed.LoadAssertions and use it from firstboot
-    - snapstate: add comment to checkVersion vs strutil.VersionCompare
-    - tests: add unit tests for cmd_whoami
-    - tests: add debug section to interfaces-contacts-service
-    - many: introduce package seed and seedtest
-    - interfaces/bluez: enable communication between bluetoothd and
-      meshd via dbus
-    - cmd/snap: fix snap switch message
-    - overlord/snapstate: check channel names on install
-    - tests: check snap_daemon user and group on system-usernames-
-      illegal test are not created
-    - cmd/snap-confine: fix group and permission of .info files
-    - gadget: do not error on gadget refreshes with multiple volumes
-    - snap: use deterministic paths to find the built deb
-    - tests: just build snapd commands on go-build test
-    - tests: re-enable mount-ns test on classic
-    - tests: rename fuse_support to fuse-support
-    - tests: move restore-project-each code to existing function
-    - tests: simplify interfaces-account-control test
-    - i18n, vendor, packaging: drop github.com/ojii/gettext.go, use
-      github.com/snapcore/go-gettext
-    - tests: always say 'restore: |'
-    - tests: new test to check the output after refreshing/reverting
-      core
-    - snapstate: validate all system-usernames before creating them
-    - tests: fix system version check on listing test for external
-      backend
-    - tests: add check for snap_daemon user/group
-    - tests: don't look for lxcfs in mountinfo
-    - tests: adding support for arm devices on ubuntu-core-device-reg
-      test
-    - snap: explicitly forbid trying to parallel install from seed
-    - tests: remove trailing spaces from shell scripts
-    - tests: remove locally installed revisions of core
-    - tests: fix removal of snaps on ubuntu-core
-    - interfaces: support Tegra display drivers
-    - tests: move interfaces-contacts-service to /tmp
-    - interfaces/network-manager: allow using
-      org.freedesktop.DBus.ObjectManager
-    - tests: restore dpkg selections after upgrade-from-2.15 test
-    - tests: pass --remove to userdel on core
-    - snap/naming: simplify SnapSet somewhat
-    - devicestate/firstboot: check for missing bases early
-    - httputil: rework protocol error detection
-    - tests: unmount fuse connections only if not initially mounted
-    - snap: prevent duplicated snap name and snap files when parsing
-      seed.yaml
-    - tests: re-implement user tool in python
-    - image: improve/tweak some warning/error messages
-    - cmd/libsnap-confine-private: add checks for parallel instances
-      feature flag
-    - tests: wait_for_service shows status after actual first minute
-    - sanity: report proper errror when fuse is needed but not available
-    - snap/naming: introduce SnapRef, Snap, and SnapSet
-    - image: support prepare-image --classic for snapd snap only
-      imagesConsequently:
-    - tests/main/mount-ns: account for clone_children in cpuset cgroup
-      on 18.04
-    - many:  merging asserts.Batch Precheck with CommitTo and other
-      clarifications
-    - devicestate: add missing test for remodeling possibly removing
-      required flag
-    - tests: use user-tool to remove test user in the non-home test
-    - overlord/configstate: sort patch keys to have deterministic order
-      with snap set
-    - many: generalize assertstate.Batch to asserts.Batch, have
-      assertstate.AddBatch
-    - gadget, overlord/devicestate: rename Position/Layout
-    - store, image, cmd: make 'snap download' leave partials
-    - httputil: improve http2 PROTOCOL_ERROR detection
-    - tests: add new "user-tool" helper and use in system-user tests
-    - tests: clean up after NFS tests
-    - ifacestate: optimize auto-connect by setting profiles once after
-      all connects
-    - hookstate/ctlcmd: snapctl unset command
-    - tests: allow test user XDG_RUNTIME_DIR to phase out
-    - tests: cleanup "snap_daemon" user in system-usernames-install-
-      twice
-    - cmd/snap-mgmt: set +x on startup
-    - interfaces/wayland,x11: allow reading an Xwayland Xauth file
-    - many: move channel parsing to snap/channel
-    - check-pr-title.py: allow {} in pr prefix
-    - tests: spam test logs less while waiting for systemd unit to stop
-    - tests: remove redundant activation check for snapd.socket
-      snapd.service
-    - tests: trivial snapctl test cleanup
-    - tests: ubuntu 18.10 removed from the google-sru backend on the
-      spread.yaml
-    - tests: add new cases into arch_test
-    - tests: clean user and group for test system-usernames-install-
-      twice
-    - interfaces: k8s worker node updates
-    - asserts: move Model to its own model.go
-    - tests: unmount binfmt_misc on cleanup
-    - tests: restore nsdelegate clobbered by LXD
-    - cmd/snap: fix snap unset help string
-    - tests: unmount fusectl after testing
-    - cmd/snap: fix remote snap info for parallel installed snaps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 01 Oct 2019 11:24:41 +0200
-
-snapd (2.41) xenial; urgency=medium
-
-  * New upstream release, LP: #1840740
-    - overlord/snapstate: revert track-risk behavior
-    - tests: fix snap info test
-    - httputil: rework protocol error detection
-    - gadget: do not error on gadget refreshes with multiple volumes
-    - i18n, vendor, packaging: drop github.com/ojii/gettext.go, use
-      github.com/snapcore/go-gettext
-    - snapstate: validate all system-usernames before creating them
-    - mkversion.sh: fix version from git checkouts
-    - interfaces/network-{control,manager}: allow 'k' on
-      /run/resolvconf/**
-    - interfaces/wayland,x11: allow reading an Xwayland Xauth file
-    - interfaces: k8s worker node updates
-    - debian: re-enable systemd environment generator
-    - many: create system-usernames user/group if both don't exist
-    - packaging: fix symlink for snapd.session-agent.socket
-    - tests: change cgroups so that LXD doesn't have to
-    - interfaces/network-setup-control: allow dbus netplan apply
-      messages
-    - tests: add /var/cache/snapd to the snapd state to prevent error on
-      the store
-    - tests: add test for services disabled during refresh hook
-    - many: simpler access to snap-seccomp version-info
-    - snap: cleanup some tests, clarify some errorsThis is a follow up
-      from work on system usernames:
-    - osutil: add osutil.Find{Uid,Gid}
-    - tests: use a different archive based on the spread backend on go-
-      build test
-    - cmd/snap-update-ns: fix pair of bugs affecting refresh of snap
-      with layouts
-    - overlord/devicestate: detect clashing concurrent (ongoing, just
-      finished) remodels or changes
-    - interfaces/docker-support: declare controls-device-cgroup
-    - packaging: fix removal of old apparmor profile
-    - store: use track/risk for "channel" name when parsing store
-      details
-    - many: allow 'system-usernames' with libseccomp > 2.4 and golang-
-      seccomp > 0.9.0
-    - overlord/devicestate, tests: use gadget.Update() proper, spread
-      test
-    - overlord/configstate/configcore: allow setting start_x=1 to enable
-      CSI camera on RPi
-    - interfaces: remove BeforePrepareSlot from commonInterface
-    - many: support system-usernames for 'snap_daemon' user
-    - overlord/devicestate,o/snapstate: queue service commands before
-      mark-seeded and other final tasks
-    - interfaces/mount: discard mount ns on backend Remove
-    - packaging/fedora: build on RHEL8
-    - overlord/devicestate: support seeding a classic system with the
-      snapd snap and no core
-    - interfaces: fix test failure in gpio_control_test
-    - interfaces, policy: remove sanitize helpers and use minimal policy
-      check
-    - packaging: use %systemd_user_* macros to enable session agent
-      socket according to presets
-    - snapstate, store: handle 429s on catalog refresh a little bit
-      better
-    - tests: part4 making tests work on ubuntu-core-18
-    - many: drop snap.ReadGadgetInfo wrapper
-    - xdgopenproxy: update test API to match upstream
-    - tests: show why sbuild failed
-    - data/selinux: allow mandb_t to search /var/lib/snapd
-    - tests: be less verbose when checking service status
-    - tests: set sbuild test as manual
-    - overlord: DeviceCtx must find the remodel context for a remodel
-      change
-    - tests: use snap info --verbose to check for base
-    - sanity: unmount squashfs with --lazy
-    - overlord/snapstate: keep current track if only risk is specified
-    - interfaces/firewall-control: support nft routing expressions and
-      device groups
-    - gadget: support for writing symlinks
-    - tests: mountinfo-tool fail if there are no matches
-    - tests: sync journal log before start the test
-    - cmd/snap, data/completion: improve completion for 'snap debug'
-    - httputil: retry for http2 PROTOCOL_ERROR
-    - Errata commit: pulseaudio still auto-connects on classic
-    - interfaces/misc: updates for k8s 1.15 (and greengrass test)
-    - tests: set GOTRACEBACK=1 when running tests
-    - cmd/libsnap: don't leak memory in sc_die_on_error
-    - tests: improve how the system is restored when the upgrade-
-      from-2.15 test fails
-    - interfaces/bluetooth-control: add udev rules for BT_chrdev devices
-    - interfaces: add audio-playback/audio-record and make pulseaudio
-      manually connect
-    - tests: split the sbuild test in 2 depending on the type of build
-    - interfaces: add an interface granting access to AppStream metadata
-    - gadget: ensure filesystem labels are unique
-    - usersession/agent: use background context when stopping the agent
-    - HACKING.md: update spread section, other updates
-    - data/selinux: allow snap-confine to read entries on nsfs
-    - tests: respect SPREAD_DEBUG_EACH on the main suite
-    - packaging/debian-sid: set GOCACHE to a known writable location
-    - interfaces: add gpio-control interface
-    - cmd/snap: use showDone helper with 'snap switch'
-    - gadget: effective structure role fallback, extra tests
-    - many: fix unit tests getting stuck
-    - tests: remove installed snap on restore
-    - daemon: do not modify test data in user suite
-    - data/selinux: allow read on sysfs
-    - packaging/debian: don't md5sum absent files
-    - tests: remove test-snapd-curl
-    - tests: remove test-snapd-snapctl-core18 in restore
-    - tests: remove installed snap in the restore section
-    - tests: remove installed test snap
-    - tests: correctly escape mount unit path
-    - cmd/Makefile.am: support building with the go snap
-    - tests: work around classic snap affecting the host
-    - tests: fix typo "current"
-    - overlord/assertstate: add Batch.Precheck to check for the full
-      validity of the batch before Commit
-    - tests: restore cpuset clone_children clobbered by lxd
-    - usersession: move userd package to usersession/userd
-    - tests: reformat and fix markdown in snapd-state.md
-    - gadget: select the right updater for given structure
-    - tests: show stderr only if it exists
-    - sessionagent: add a REST interface with socket activation
-    - tests: remove locally installed core in more tests
-    - tests: remove local revision of core
-    - packaging/debian-sid: use correct apparmor Depends for Debian
-    - packaging/debian-sid: merge debian upload changes back into master
-    - cmd/snap-repair: make sure the goroutine doesn't stick around on
-      timeout
-    - packaging/fedora: github.com/cheggaaa/pb is no longer used
-    - configstate/config: fix crash in purgeNulls
-    - boot, o/snapst, o/devicest: limit knowledge of boot vars to boot
-    - client,cmd/snap: stop depending on status/status-code in the JSON
-      responses in client
-    - tests: unmount leftover /run/netns
-    - tests: switch mount-ns test to manual
-    - overlord,daemon,cmd/snapd:  move expensive startup to dedicated
-      StartUp methods
-    - osutil: add EnsureTreeState helper
-    - tests: measure properties of various  mount namespaces
-    - tests: part2 making tests work on ubuntu-core-18
-    - interfaces/policy: minimal policy check for replacing
-      sanitizeReservedFor helpers (1/2)
-    - interfaces: add an interface that grants access to the PackageKit
-      service
-    - overlord/devicestate: update gadget update handlers and mocks
-    - tests: add mountinfo-tool --ref-x1000
-    - tests: remove lxd / lxcfs if pre-installed
-    - tests: removing support for ubuntu cosmic on spread test suite
-    - tests: don't leak /run/netns mount
-    - image: clean up the validateSuite
-    - bootloader: remove "Dir()" from Bootloader interface
-    - many: retry to reboot if snapd gets restarted before expected
-      reboot
-    - overlord: implement re-registration remodeling
-    - cmd: revert PR#6933 (tweak of GOMAXPROCS)
-    - cmd/snap: add snap unset command
-    - many: add Client-User-Agent to "SnapAction" install API call
-    - tests: first part making tests run on ubuntu-core-18
-    - hookstate/ctlcmd: support hidden commands in snapctl
-    - many: replace snapd snap name checks with type checks (3/4)
-    - overlord: mostly stop needing Kernel/CoreInfo, make GadgetInfo
-      consider a DeviceContext
-    - snapctl: handle unsetting of config options with "!"
-    - tests: move core migration snaps to tests/lib/snaps dir
-    - cmd/snap: handle unsetting of config options with "!"
-    - cmd/snap, etc: add health to 'snap list' and 'snap info'
-    - gadget: use struct field names when intializing data in mounted
-      updater unit tests
-    - cmd/snap-confine: bring /lib/firmware from the host
-    - snap: set snapd snap type (1/4)
-    - snap: add checks in validate-seed for missing base/default-
-      provider
-    - daemon: replace shutdownServer with net/http's native shutdown
-      support
-    - interfaces/builtin: add exec "/bin/runc" to docker-support
-    - gadget: mounted filesystem updater
-    - overlord/patch: simplify conditions for re-applying sublevel
-      patches for level 6
-    - seccomp/compiler: adjust test case names and comment for later
-      changes
-    - tests: fix error doing snap pack running failover test
-    - tests: don't preserve size= when rewriting mount tables
-    - tests: allow reordering of rewrite operations
-    - gadget: main update routine
-    - overlord/config: normalize nulls to support config unsetting
-      semantics
-    - snap-userd-autostart: don't list as a startup application on the
-      GUI
-    - tests: renumber snap revisions as seen via writable
-    - tests: change allocation for mount options
-    - tests: re-enable ns-re-associate test
-    - tests: mountinfo-tool allow many --refs
-    - overlord/devicestate: implement reregRemodelContext with the
-      essential re-registration logic
-    - tests: replace various numeric mount options
-    - gadget: filesystem image writer
-    - tests: add more unit tests for mountinfo-tool
-    - tests: introduce mountinfo-tool --ref feature
-    - tests: refactor mountinfo-tool rewrite state
-    - tests: allow renumbering mount namespace identifiers
-    - snap: refactor and explain layout blacklisting
-    - tests: renumber snap revisions as seen via hostfs
-    - daemon, interfaces, travis: workaround build ID with Go 1.9, use
-      1.9 for travis tests
-    - cmd/libsnap: add sc_error_init_{simple,api_misuse}
-    - gadget: make raw updater handle shifted structures
-    - tests/lib/nested: create WORK_DIR before accessing it
-    - cmd/libsnap: rename SC_LIBSNAP_ERROR to SC_LIBSNAP_DOMAIN
-    - cmd,tests: forcibly discard mount namespace when bases change
-    - many: introduce healthstate, run check-health
-      post-(install/refresh/try/revert)
-    - interfaces/optical-drive: add scsi-generic type 4 and 5 support
-    - cmd/snap-confine: exit from helper when parent dies
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 30 Aug 2019 08:56:16 +0200
-
-snapd (2.40) xenial; urgency=medium
-
-  * New upstream release, LP: #1836327
-    - overlord/patch: simplify conditions for re-applying sublevel
-      patches for level 6
-    - cmd,tests: forcibly discard mount namespace when bases change
-    - cmd/snap-confine: handle device cgroup before pivot
-    - cmd/snap-apparmor-service: quit if there are no profiles
-    - cmd/snap, image: add --target-directory and --basename to 'snap
-      download'
-    - interfaces: add jack1 implicit classic interface
-    - interfaces: miscellaneous policy updates
-    - daemon: classic confinement is not supported on core
-    - interfaces: bluetooth-control: add mtk BT device node
-    - cmd/snap-seccomp: initial support for negative arguments with
-      uid/gid caching
-    - snap-confine: move seccomp load after permanent privilege drop
-    - tests: new profiler snap used to track cpu and memory for snapd
-      and snap commands
-    - debian: make maintainer scripts do nothing on powerpc
-    - gadget: mounted filesystem writer
-    - cmd/snap: use padded checkers for snapshot output
-    - bootloader: switch to bootloader_test style testing
-    - gadget: add a wrapper for generating partitioned images with
-      sfdisk
-    - tests/main/snap-seccomp-syscalls: add description
-    - tests: continue executing on errors either updating the repo db or
-      installing dependencies
-    - cmd/snap-seccomp/syscalls: add io_uring syscalls
-    - systemd: add InstanceMode enumeration to control which systemd
-      instance to control
-    - netutil: extract socket activation helpers from daemon package.
-    - interfaces: spi: update regex rules to accept spi nodes like
-      spidev12345.0
-    - gadget: fallback device lookup
-    - many: add strutil.ElliptLeft, use it for shortening cohorts
-    - wrappers: allow sockets under $XDG_RUNTIME_DIR
-    - gadget: add wrapper for creating and populating filesystems
-    - gadget: add writer for offset-write
-    - gadget: support relative symlinks in device lookup
-    - snap, snapstate: additional validation of base field
-    - many: fix some races and missing locking, make sure UDevMonitor is
-      stopped
-    - boot: move ExtractKernelAssets
-    - daemon, snap: screenshots _only_ shows the deprecation notice,
-      from 2.39
-    - osutil: add a workaround for overlayfs apparmor as it is used on
-      Manjaro
-    - snap: introduce GetType() function for snap.Info
-    - tests: update systems to be used for during sru validation
-    - daemon: increase `shutdownTimeout` to 25s to deal with slow
-      HW
-    - interfaces/network-manager: move deny ptrace to the connected slot
-    - interfaces: allow locking of pppd files
-    - cmd/snap-exec: fix snap completion for classic snaps with non
-      /usr/lib/snapd libexecdir
-    - daemon: expose pprof endpoints
-    - travis: disable snap pack on OSX
-    - client, cmd/snap: expose the new cohort options for snap ops
-    - overlord/snapstate: tweak switch summaries
-    - tests: reuse the image created initially for nested tests
-      execution
-    - tests/lib/nested: tweak assert disk prepare step
-    - daemon, overlord/snapstate: support leave-cohort
-    - tests/main/appstream-id: collect debug info
-    - store,daemon: add client-user-agent support to store.SnapInfo
-    - tests: add check for invalid PR titles in the static checks
-    - tests: add snap-tool for easier access to internal tools
-    - daemon: unexport file{Response,Stream}
-    - devicestate: make TestUpdateGadgetOnClassicErrorsOut less racy
-    - tests: fix test desktop-portal-filechooser
-    - tests: sort commands from DumpCommands in the dumpDbHook
-    - cmd/snap: add unit test for "advise-snap --dump-db".
-    - bootloader: remove extra mock bootloader implementation
-    - daemon: tweak for "add api endpoint for download" PR
-    - packaging: fix reproducible build error
-    - tests: synchronize journal logs before check logs
-    - tests: fix snap service watchdog test
-    - tests: use more readable test directory names
-    - tests/regression/lp-1805485: update test description
-    - overlord: make changes conflict with remodel
-    - tests: make sure the snapshot unit test uses a snapshot time
-      relative to Now()
-    - tests: revert "tests: stop catalog-update/apt-hooks test for now"
-    - tests: mountinfo-tool --one prints matches on failure
-    - data/selinux: fix policy for snaps with bases and classic snaps
-    - debian: fix building on eoan by tweaking golang build-deps
-    - packaging/debian-sid: update required golang version to 1.10
-    - httputil: handle "no such host" error explicitly and do not retry
-      it
-    - overlord/snapstate, & fallout: give Install a *RevisionOptions
-    - cmd/snap: don't run install on 'snap --help install'
-    - gadget: raw/bare structure writer and updater
-    - daemon, client, cmd/snap: show cohort key in snap info --verbose
-    - overlord/snapstate: add update-gadget task when needed, block
-      other changes
-    - image: turn a missing default content provider into an error
-    - overlord/devicestate: update-gadget-assets task handler with
-      stubbed gadget callbacks
-    - interface: builtin: avahi-observe/control: update label for
-      implicit slot
-    - tests/lib/nested: fix multi argument copy_remote
-    - tests/lib/nested: have mkfs.ext4 use a rootdir instead of mounting
-      an image
-    - packaging: fix permissions powerpc docs dir
-    - overlord: mock store to avoid net requests
-    - debian: rework how we run autopkgtests
-    - interface: builtin: avahi-observe/control: allow slots
-      implementation also by app snap on classic system
-    - interfaces: builtin: utils: add helper function to identify system
-      slots
-    - interfaces: add missing adjtimex to time-control
-    - overlord/snapstate, snap: support base = "none"
-    - daemon, overlord/snapstate: give RevisionOptions a CohortKey
-    - data/selinux: permit init_t to remount snappy_snap_t
-    - cmd/snap: test for a friendly error on 'okay' without 'warnings'
-    - cmd/snap: support snap debug timings --startup=.. and measure
-      loadState time
-    - advise-snap: add --dump-db which dumps the command database
-    - interfaces/docker-support: support overlayfs on ubuntu core
-    - cmd/okay: Remove err message when warning file not exist
-    - devicestate: disallow removal of snaps used in booting early
-    - packaging: fix build-depends on powerpc
-    - tests: run spread tests on opensuse leap 15.1
-    - strutil/shlex: fix ineffassign
-    - cmd/snapd: ensure GOMAXPROCS is at least 2
-    - cmd/snap-update-ns: detach unused mount points
-    - gadget: record gadget root directory used during positioning
-    - tests: force removal to prevent restore fails when directory
-      doesn't exist on lp-1801955 test
-    - overlord: implement store switch remodeling
-    - tests: stop using ! for naive negation in shell scripts
-    - snap,store,daemon,client: send new "Snap-Client-User-Agent" header
-      in Search()
-    - osutil: now that we require golang-1.10, use user.LookupGroup()
-    - spread.yaml,tests: change MATCH and REBOOT to cmds
-    - packaging/fedora: force external linker to ensure static linking
-      and -extldflags use
-    - timings: tweak the conditional for ensure timings
-    - timings: always store ensure timings as long as they have an
-      associated change
-    - cmd/snap: tweak the output of snap debug timings --ensure=...
-    - overlord/devicestate: introduce remodel kinds and
-      contextsregistrationContext:
-    - snaptest: add helper for mocking snap with contents
-    - snapstate: allow removal of non-model kernels
-    - tests: change strace parameters on snap-run test to avoid the test
-      gets stuck
-    - gadget: keep track of the index where structure content was
-      defined
-    - cmd/snap-update-ns: rename leftover ctx to upCtx
-    - tests: add "not" command
-    - spread.yaml: use "snap connections" in debug
-    - tests: fix how strings are matched on auto-refresh-retry test
-    - spread-shellcheck: add support for variants and environment
-    - gadget: helper for shifting structure start position
-    - cmd/snap-update-ns: add several TODO comments
-    - cmd/snap-update-ns: rename ctx to upCtx
-    - spread.yaml: make HOST: usage shellcheck-clean
-    - overlord/snapstate, daemon: snapstate.Switch now takes a
-      RevisionOption
-    - tests: add mountinfo-tool
-    - many: make snapstate.Update take *RevisionOptions instead of chan,
-      rev
-    - tests/unit/spread-shellcheck: temporary workaround for SC2251
-    - daemon: refactor user ops to api_users
-    - cmd/snap, tests: refactor info to unify handling of 'direct' snaps
-    - cmd/snap-confine: combine sc_make_slave_mount_ns into caller
-    - cmd/snap-update-ns: use "none" for propagation changes
-    - cmd/snap-confine: don't pass MS_SLAVE along with MS_BIND
-    - cmd/snap, api, snapstate: implement "snap remove --purge"
-    - tests: new hotplug test executed on ubuntu core
-    - tests: running tests on fedora 30
-    - gadget: offset-write: fix validation, calculate absolute position
-    - data/selinux: allow snap-confine to do search on snappy_var_t
-      directories
-    - daemon, o/snapstate, store: support for installing from cohorts
-    - cmd/snap-confine: do not mount over non files/directories
-    - tests: validates snapd from ppa
-    - overlord/configstate: don't panic on invalid configuration
-    - gadget: improve device lookup, add helper for mount point lookup
-    - cmd/snap-update-ns: add tests for executeMountProfileUpdate
-    - overlord/hookstate: don't run handler unless hooksup.Always
-    - cmd/snap-update-ns: allow changing mount propagation
-    - systemd: workaround systemctl show quirks on older systemd
-      versions
-    - cmd/snap: allow option descriptions to start with the command
-    - many: introduce a gadget helper for locating device matching given
-      structure
-    - cmd/snap-update-ns: fix golint complaints about variable names
-    - cmd/snap: unit tests for debug timings
-    - testutil: support sharing-related mount flags
-    - packaging/fedora: Merge changes from Fedora Dist-Git and drop EOL
-      Fedora releases
-    - cmd/snap: support for --ensure argument for snap debug timings
-    - cmd,sandbox: tweak seccomp version info handling
-    - gadget: record sector size in positioned volume
-    - tests: make create-user test support managed devices
-    - packaging: build empty package on powerpc
-    - overlord/snapstate: perform hard refresh check
-    - gadget: add volume level update checks
-    - cmd/snap: mangle descriptions that have indent > terminal width
-    - cmd/snap-update-ns: rename applyFstab to executeMountProfileUpdate
-    - cmd/snap-confine: unshare per-user mount ns once
-    - tests: retry govendor sync
-    - tests: avoid removing snaps which are cached to speed up the
-      prepare on boards
-    - tests: fix how the base snap are deleted when there are multiple
-      to deleted on reset
-    - cmd/snap-update-ns: merge apply functions
-    - many: introduce assertstest.SigningAccounts and AddMany test
-      helpers
-    - interfaces: special-case "snapd" in sanitizeSlotReservedForOS*
-      helpers
-    - cmd/snap-update-ns: make apply{User,System}Fstab identical
-    - gadget: introduce checkers for sanitizing structure updates
-    - cmd/snap-update-ns: move apply{Profile,{User,System}Fstab} to same
-      file
-    - overlord/devicestate: introduce registrationContext
-    - cmd/snap-update-ns: add no-op load/save current user profile logic
-    - devicestate: set "new-model" on the remodel change
-    - devicestate: use deviceCtx in checkGadgetOrKernel
-    - many: use a fake assertion model in the device contexts for tests
-    - gadget: fix handling of positioning constrains for structures of
-      MBR role
-    - snap-confine: improve error when running on a not /home homedir
-    - devicestate: make Remodel() return a state.Change
-    - many: make which store to use contextualThis reworks
-      snapstate.Store instead of relying solely on DeviceContext,
-      because:
-    - tests: enable tests on centos 7 again
-    - interfaces: add login-session-control interface
-    - tests: extra debug for snapshot-basic test
-    - overlord,overlord/devicestate: do without GadgetInfo/KernelInfo in
-      devicestate
-    - gadget: more validation checks for legacy MBR structure type &
-      role
-    - osutil: fix TestReadBuildGo test in sbuild
-    - data: update XDG_DATA_DIRS via the systemd environment.d mechanism
-      too
-    - many: do without device state/assertions accessors based on state
-      only outside of devicestate/tests
-    - interfaces/dbus: fix unit tests when default snap mount dir is not
-      /snap
-    - tests: add security-seccomp to verify seccomp with arg filtering
-    - snapshotstate: disable automatic snapshots on core for now
-    - snapstate: auto-install snapd when needed
-    - overlord/ifacestate: update static attributes of "content"
-      interface
-    - interfaces: add support for the snapd snap in the dbus backend*
-    - overlord/snapstate: tweak autorefresh logic if network is not
-      available
-    - snapcraft: also include ld.so.conf from libc in the snapcraft.yml
-    - snapcraft.yaml: fix links ld-linux-x86-64.so.2/ld64.so.2
-    - overlord: pass a DeviceContext to the checkSnap implementations
-    - daemon: add RootOnly flag to commands
-    - many:  make access to the device model assertion etc contextual
-      via a DeviceCtx hook/DeviceContext interface
-    - snapcraft.yaml: include libc6 in snapd
-    - tests: reduce snapcraft leftovers from PROJECT_PATH,  temp disable
-      centos
-    - overlord: make the store context composably backed by separate
-      backends for device asserts/info etc.
-    - snapstate: revert "overlord/snapstate: remove PlugsOnly"
-    - osutil,cmdutil: move CommandFromCore and make it use the snapd
-      snap (if available)
-    - travis: bump Go version to 1.10.x
-    - cmd/snap-update-ns: remove instanceName argument from applyProfile
-    - gadget: embed volume in positioned volume, rename fields
-    - osutil: use go build-id when no gnu build-id is available
-    - snap-seccomp: add 4th field to version-info for golang-seccomp
-      features
-    - cmd/snap-update-ns: merge computeAndSaveSystemChanges into
-      applySystemFstab
-    - cmd/snap, client, daemon, store: create-cohort
-    - tests: give more time until nc returns on appstream test
-    - tests: run spread tests on ubuntu 19.04
-    - gadget: layout, smaller fixes
-    - overlord: update static attrs when reloading connections
-    - daemon: verify snap instructions for multi-snap requests
-    - overlord/corecfg: make expiration of automatic snapshots
-      configurable (4/4)
-    - cmd/snap-update-ns: pass MountProfileUpdate to
-      apply{System,User}Fstab
-    - snap: fix interface bindings on implicit hooks
-    - tests: improve how snaps are cached
-    - cmd/snap-update-ns: formatting tweaks
-    - data/selinux: policy tweaks
-    - cmd/snap-update-ns: move locking to the common layer
-    - overlord: use private YAML inside several tests
-    - cmd/snap, store, image: support for cohorts in "snap download"
-    - overlord/snapstate: add timings to critical task handlers and the
-      backend
-    - cmd: add `snap debug validate-seed <path>` cmd
-    - state: add possible error return to TaskSet.Edge()
-    - snap-seccomp: use username regex as defined in osutil/user.go
-    - osutil: make IsValidUsername public and fix regex
-    - store: serialize the acquisition of device sessions
-    - interfaces/builtin/desktop: fonconfig v6/v7 cache handling on
-      Fedora
-    - many: move Device/SetDevice to devicestate, start of making them
-      pluggable in storecontext
-    - overlord/snapstate: remove PlugsOnly
-    - interfaces/apparmor: allow running /usr/bin/od
-    - spread: add qemu:fedora-29-64
-    - tests: make test parallel-install-interfaces work for boards with
-      pre-installed snaps
-    - interfaces/builtin/intel_mei: fix /dev/mei* AppArmor pattern
-    - spread.yaml: add qemu:centos-7-64
-    - overlord/devicestate: extra measurements related to
-      populateStateFromSeed
-    - cmd/snap-update-ns: move Assumption to {System,User}ProfileUpdate
-    - cmd/libsnap: remove fringe error function
-    - gadget: add validation of cross structure overlap and offset
-      writes
-    - cmd/snap-update-ns: refactor of profile application (3/N)
-    - data/selinux: tweak the policy for runuser and s-c, interpret
-      audit entries
-    - tests: fix spaces issue in the base snaps names to remove during
-      reset phase
-    - tests: wait for man db cache is updated before after install snapd
-      on Fedora
-    - tests: extend timeout of sbuild test
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 12 Jul 2019 10:40:08 +0200
-
-snapd (2.39.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - daemon: increase `shutdownTimeout` to 25s to deal with slow HW
-    - spread: run tests against openSUSE 15.1
-    - data/selinux: fix policy for snaps with bases and classic snaps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 21 Jun 2019 09:06:01 +0200
-
-snapd (2.39.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - debian: rework how we run autopkgtests
-    - interfaces/docker-support: add overlayfs accesses for ubuntu core
-    - data/selinux: permit init_t to remount snappy_snap_t
-    - strutil/shlex: fix ineffassign
-    - packaging: fix build-depends on powerpc
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 05 Jun 2019 08:41:21 +0200
-
-snapd (2.39.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - spread: enable Fedora 30
-    - cmd/snap-confine, data/selinux: cherry pick Fedora 30 fixes
-    - tests/unit/spread-shellcheck: temporary workaround for SC2251
-    - packaging: build empty package on powerpc
-    - interfaces: special-case "snapd" in sanitizeSlotReservedForOS*
-      helper
-    - cmd/snap: mangle descriptions that have indent > terminal width
-    - cmd/snap-confine: unshare per-user mount ns once
-    - tests: avoid adding spaces to the base snaps names
-    - systemd: workaround systemctl show quirks on older systemd
-      versions
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 May 2019 12:08:43 +0200
-
-snapd (2.39) xenial; urgency=medium
-
-  * New upstream release, LP: #1827495
-    - overlord/ifacestate: update static attributes of "content"
-      interface
-    - data/selinux: tweak the policy for runuser and s-c, interpret
-      audit entries
-    - snapshotstate: disable automatic snapshots on core for now
-    - overlord/corecfg: make expiration of automatic snapshots
-      configurable
-    - snapstate: auto-install snapd when needed
-    - interfaces: add support for the snapd snap in the dbus backend
-    - overlord/snapstate: tweak autorefresh logic if network is not
-      available
-    - interfaces/apparmor: allow running /usr/bin/od
-    - osutil,cmdutil: move CommandFromCore and make it use the snapd
-      snap (if available)
-    - daemon: also verify snap instructions for multi-snap requests
-    - data/selinux: allow snap-confine to mount on top of bin
-    - data/selinux: auto transition /var/snap to snappy_var_t
-    - cmd: add `snap debug validate-seed <path>` cmd
-    - interfaces/builtin/desktop: fonconfig v6/v7 cache handling on
-      Fedora
-    - interfaces/builtin/intel_mei: fix /dev/mei* AppArmor pattern
-    - tests: make snap-connections test work on boards with snaps pre-
-      installed
-    - tests: check for /snap/core16/current in core16-provided-by-core
-    - tests: run livepatch test on 18.04 as well
-    - devicestate: deal correctly with the "required" flag on Remodel
-    - snapstate,state: add TaskSet.AddAllWithEdges() and use in doUpdate
-    - snapstate: add new NoReRefresh flag and use in Remodel()
-    - many: allow core as a fallback for core16
-    - snapcraft: build static fontconfig in the snapd snap
-    - cmd/snap-confine: remove unused sc_open_snap_{update,discard}_ns
-    - data/selinux: allow snapd to execute runuser under snappy_t
-    - spread, tests: do not leave mislabeled files in restorecon test,
-      attempt to catch similar files
-    - interfaces: cleanup internal tool lookup in system-key
-    - many: move auth.AuthContext to store.DeviceAndAuthContext, the
-      implemention to a separate storecontext packageThis:
-    - overlord/devicestate: measurements around ensure and related tasks
-    - cmd: tweak internal tool lookup to accept more possible locations
-    - overlord/snapstate,snapshotstate: create snapshot on snap removal
-    - tests: run smoke tests on (almost) pristine systems
-    - tests: system disable ssh for config defaults in gadget
-    - cmd/debug: integrate new task timings with "snap debug timings"
-    - tests/upgrade/basic, packaging/fedoar: restore SELinux context of
-      /var/cache/fontconfig, patch pre-2.39 mount units
-    - image: simplify prefer local logic  and fixes
-    - tests/main/selinux-lxd: make sure LXD from snaps works cleanly
-      with enforcing SELinux
-    - tests: deny ioctl - TIOCSTI with garbage in high bits
-    - overlord: factor out mocking of device service and gadget w.
-      prepare-device for registration tests
-    - data/selinux, tests/main/selinux-clean: fine tune the policy, make
-      sure that no denials are raised
-    - cmd/libsnap,osutil: fix parsing of mountinfo
-    - ubuntu: disable -buildmode=pie on armhf to fix memory issue
-    - overlord/snapstate: inhibit refresh for up to a week
-    - cmd/snap-confine: prevent cwd restore permission bypass
-    - overlord/ifacestate: introduce HotplugKey type use short key in
-      change summaries
-    - many: make Remodel() download everything first before installing
-    - tests: fixes discovered debugging refresh-app-awareness
-    - overlord/snapstate: track time of postponed refreshes
-    - snap-confine: set rootfs_dir in sc_invocation struct
-    - tests: run create-user on core devices
-    - boot: add flag file "meta/force-kernel-extraction"
-    - tests: add regression test for systemctl race fix
-    - overlord/snapshotstate: helpers for snapshot expirations
-    - overlord,tests: perform soft refresh check in doInstall
-    - tests: enable tests that write /etc/{hostname,timezone} on core18
-    - overlord/ifacestate: implement String() method of
-      HotplugDeviceInfo for better logs/messages
-    - cmd/snap-confine: move ubuntu-core fallback checks
-    - testutil: fix MockCmd for shellcheck 0.5
-    - snap, gadget: move gadget read/validation into separate package,
-      tweak naming
-    - tests: split travis spread execution in 2 jobs for ubuntu and non
-      ubuntu systems
-    - testutil: make mocked command work with shellcheck from snaps
-    - packaging/fedora, tests/upgrade/basic: patch existing mount units
-      with SELinux context on upgrade
-    - metautil, snap: extract yaml value normalization to a helper
-      package
-    - tests: use apt via eatmydata
-    - dirs,overlord/snapstate: add Soft and Hard refresh checks
-    - cmd/snap-confine: allow using tools from snapd snap
-    - cmd,interfaces: replace local helpers with cmd.InternalToolPath
-    - tweak: fix "make hack" on Fedora
-    - snap: add validation of gadget.yaml
-    - cmd/snap-update-ns: refactor of profile application
-    - cmd/snap,client,daemon,store: layout and sanity tweaks for
-      find/search options
-    - tests: add workaround for missing cache reset on older snapd
-    - interfaces: deal with the snapd snap correctly for apparmor 2.13
-    - release-tools: add debian-package-builder
-    - tests: enable opensuse 15 and add force-resolution installing
-      packages
-    - timings: AddTag helper
-    - testutil: run mocked commands through shellcheck
-    - overlord/snapshotstate: support auto flag
-    - client, daemon, store: search by common-id
-    - tests: all the systems for google backend with 6 workers
-    - interfaces: hotplug nested vm test, updated serial-port interface
-      for hotplug.
-    - sanity: use proper SELinux context when mounting squashfs
-    - cmd/libsnap: neuter variables in cleanup functions
-    - interfaces/adb-support: account for hubs on sysfs path
-    - interfaces/seccomp: regenerate changed profiles only
-    - snap: reject layouts to /lib/{firmware,modules}
-    - cmd/snap-confine, packaging: support SELinux
-    - selinux, systemd: support mount contexts for snap images
-    - interfaces/builtin/opengl: allow access to Tegra X1
-    - cmd/snap: make 'snap warnings' output yamlish
-    - tests: add check to detect a broken snap on reset
-    - interfaces: add one-plus devices to adb-support
-    - cmd: prevent umask from breaking snap-run chain
-    - tests/lib/pkgdb: allow downgrade when installing packages in
-      openSUSE
-    - cmd/snap-confine: use fixed private tmp directory
-    - snap: tweak parsing errors of gadget updates
-    - overlord/ifacemgr: basic measurements
-    - spread: refresh metadata on openSUSE
-    - cmd/snap-confine: pass sc_invocation instead of numerous args
-      around
-    - snap/gadget: introduce volume update info
-    - partition,bootloader: rename 'partition' package to 'bootloader'
-    - interfaces/builtin: add dev/pts/ptmx access to docker_support
-    - tests: restore sbuild test
-    - strutil: make SplitUnit public, allow negative numbers
-    - overlord/snapstate,: retry less for auto-stuff
-    - interfaces/builtin: add add exec "/" to docker-support
-    - cmd/snap: fix regression of snap saved command
-    - cmd/libsnap: rename C enum for feature flag
-    - cmd: typedef mountinfo structures
-    - tests/main/remodel: clean up before reverting the state
-    - cmd/snap-confine: umount scratch dir using UMOUNT_NOFOLLOW
-    - timings: add new helpers, Measurer interface and DurationThreshold
-    - cmd/snap-seccomp: version-info subcommand
-    - errortracker: fix panic in Report if db cannot be opened
-    - sandbox/seccomp: a helper package wrapping calls to snap-seccomp
-    - many: add /v2/model API, `snap remodel` CLI and spread test
-    - tests: enable opensuse tumbleweed back
-    - overlord/snapstate, store: set a header when auto-refreshing
-    - data/selinux, tests: refactor SELinux policy, add minimal tests
-    - spread: restore SELinux context when we mess with system files
-    - daemon/api: filter connections with hotplug-gone=true
-    - daemon: support returning assertion information as JSON with the
-      "json" query parameter
-    - cmd/snap: hide 'interfaces' command, show deprecation notice
-    - timings: base API for recording timings in state
-    - cmd/snap-confine: drop unused dependency on libseccomp
-    - interfaces/apparmor: factor out test boilerplate
-    - daemon: extract assertions api endpoint implementation into
-      api_asserts.go
-    - spread.yaml: bump delta reference
-    - cmd/snap-confine: track per-app and per-hook processes
-    - cmd/snap-confine: make sc_args helpers const-correct
-    - daemon: move a function that was between an other struct and its
-      methods
-    - overlord/snapstate: fix restoring of "old-current" revision config
-      in undoLinkSnap
-    - cmd/snap, client, daemon, ifacestate: show a leading attribute of
-      a connection
-    - cmd/snap-confine: call sc_should_use_normal_mode once
-    - cmd/snap-confine: populate enter_non_classic_execution_environment
-    - daemon: allow downloading snaps blobs via .../file
-    - cmd/snap-confine: introduce sc_invocation
-    - devicestate: add initial Remodel support
-    - snap: remove obsolete license-* fields in the yaml
-    - cmd/libsnap: add cgroup-pids-support module
-    - overlord/snapstate/backend: make LinkSnap clean up more
-    - snapstate: only keep 2 snaps on classic
-    - ctlcmd/tests: tests tweaks (followup to #6322)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 03 May 2019 11:29:50 +0200
-
-snapd (2.38.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1824394
-    - tests: add workaround for missing cache reset on older snapd
-    - ubuntu: disable -buildmode=pie on armhf to fix memory issue
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 Apr 2019 18:26:47 +0200
-
-snapd (2.38) xenial; urgency=medium
-
-  * New upstream release, LP: #1818648
-    - overlord/snapstate,: retry less for auto-stuff
-    - cmd/snap: fix regression of snap saved command
-    - interfaces/builtin: add dev/pts/ptmx access to docker_support
-    - overlord/snapstate, store: set a header when auto-refreshing
-    - interfaces/builtin: add add exec "/" to docker-support
-    - cmd/snap, client, daemon, ifacestate: show a leading attribute of
-      a connection
-    - interface: avahi-observe: Fixing socket permissions on 4.15
-      kernels
-    - tests: check that apt works before using it
-    - apparmor: support AppArmor 2.13
-    - snapstate: restart into the snapd snap on classic
-    - overlord/snapstate: during refresh, re-refresh on epoch bump
-    - cmd, daemon: split out the common bits of mapLocal and mapRemote
-    - cmd/snap-confine: chown private /tmp to root.root
-    - cmd/snap-confine: drop uid from random /tmp name
-    - overlord/hookstate: apply pending transaction changes onto
-      temporary configuration for snapctl get
-    - cmd/snap: `snap connections` command
-    - interfaces/greengrass_support: update accesses for GGC 1.8
-    - cmd/snap, daemon: make the connectivity check use GET
-    - interfaces/builtin,/udev: add spec support to disable udev +
-      device cgroup and use it for greengrass
-    - interfaces/intel-mei: small follow up tweaks
-    - ifacestate/tests: fix/improve udev mon test
-    - interfaces: add multipass-support interface
-    - tests/main/high-user-handling: fix the test for Go 1.12
-    - interfaces: add new intel-mei interface
-    - systemd: decrease the checker counter before unlocking otherwise
-      we can get spurious panics
-    - daemon/tests: fix race in the disconnect conflict test
-    - cmd/snap-confine: allow moving tasks to pids cgroup
-    - tests: enable opensuse tumbleweed on spread
-    - cmd/snap: fix `snap services` completion
-    - ifacestate/hotplug: integration with udev monitor
-    - packaging: build snapctl as a static binary
-    - packaging/opensuse: move most logic to snapd.mk
-    - overlord: fix ensure before slowness on Retry
-    - overlord/ifacestate: fix migration of connections on upgrade from
-      ubuntu-core
-    - daemon, client, cmd/snap: debug GETs ask aspects, not actions
-    - tests/main/desktop-portal-*: fix handling of python dependencies
-    - interfaces/wayland: allow wayland server snaps function on classic
-      too
-    - daemon, client, cmd/snap: snap debug base-declaration
-    - tests: run tests on opensuse leap 15.0 instead of 42.3
-    - cmd/snap: fix error messages for snapshots commands if ID is not
-      uint
-    - interfaces/seccomp: increase filter precision
-    - interfaces/network-manager: no peer label check for hostname1
-    - tests: add a tests for xdg-desktop-portal integration
-    - tests: not checking 'tracking channel' after refresh core on
-      nested execution
-    - tests: remove snapweb from tests
-    - snap, wrappers: support StartTimeout
-    - wrappers: Add an X-SnapInstanceName field to desktop files
-    - cmd/snap: produce better output for help on subcommands
-    - tests/main/nfs-support: use archive mode for creating fstab backup
-    - many: collect time each task runs and display it with `snap debug
-      timings <id>`
-    - tests: add attribution to helper script
-    - daemon: make ucrednetGet not loop
-    - squashfs: unset SOURCE_DATE_EPOCH in the TestBuildDate test
-    - features,cmd/libsnap: add new feature "refresh-app-awareness"
-    - overlord: fix random typos
-    - interfaces/seccomp: generate global seccomp profile
-    - daemon/api: fix error case for disconnect conflict
-    - overlord/snapstate: add some randomness to the catalog refresh
-    - tests: disable trusty-proposed for now
-    - tests: fix upgrade-from-2.15 with kernel 4.15
-    - interfaces/apparmor: allow sending and receiving signals from
-      ourselves
-    - tests: split the test interfaces-many in 2 and remove snaps on
-      restore
-    - tests: use snap which takes 15 seconds to install on retryable-
-      error test
-    - packaging: avoid race in snapd.postinst
-    - overlord/snapstate: discard mount namespace when undoing 1st link
-      snap
-    - cmd/snap-confine: allow writes to /var/lib/**
-    - tests: stop catalog-update test for now
-    - tests/main/auto-refresh-private: make sure to actually download
-      with the expired macaroon
-    - many: save media info when installing, show it when listing
-    - userd: handle help urls which requires prepending XDG_DATA_DIRS
-    - tests: fix NFS home mocking
-    - tests: improve snaps-system-env test
-    - tests: pre-cache core on core18 systems
-    - interfaces/hotplug: renamed RequestedSlotSpec to ProposedSlot,
-      removed Specification
-    - debian: ensure leftover usr.lib.snapd.snap-confine is gone
-    - image,cmd/snap,tests: introduce support for modern prepare-image
-      --snap <snap>[=<channel>]
-    - overlord/ifacestate: tweak logic for generating unique slot names
-    - packaging: import debian salsa packaging work, add sbuild test and
-      use in spead
-    - overlord/ifacestate: hotplug-add-slot handler
-    - image,cmd/snap:  simplify --classic-arch to --arch, expose
-      prepare-image
-    - tests: run test snap as user in the smoke test
-    - cmd/snap: tweak man output to have no doubled up .TP lines
-    - cmd/snap, overlord/snapstate: silently ignore classic flag when a
-      snap is strictly confined
-    - snap-confine: remove special handling of /var/lib/jenkins
-    - cmd/snap-confine: handle death of helper process
-    - packaging: disable systemd environment generator on 18.04
-    - snap-confine: fix classic snaps for users with /var/lib/* homedirs
-    - tests/prepare: prevent console-conf from running
-    - image: bootstrapToRootDir => setupSeed
-    - image,cmd/snap,tests:  introduce prepare-image --classic
-    - tests: update smoke/sandbox test for armhf
-    - client, daemon: introduce helper for querying snapd API for the
-      list of slot/plug connections
-    - cmd/snap-confine: refactor and cleanup of seccomp loading
-    - snapstate, snap: allow update/switch requests with risk only
-      channel to DTRT
-    - interfaces: add network-manager-observe interface
-    - snap-confine: increase locking timeout to 30s
-    - snap-confine: fix incorrect "sanity timeout 3s" message
-    - snap-confine: provide proper error message on sc_sanity_timeout
-    - snapd,state: improve error message on state reading failure
-    - interfaces/apparmor: deny inet/inet6 in snap-update-ns profile
-    - snap: fix reexec from the snapd snap for classic snaps
-    - snap: fix hook autodiscovery for parallel installed snaps
-    - overlord/snapstate: format the refresh time for the log
-    - cmd/snap-confine: add special case for Jenkins
-    - snapcraft.yaml: fix XBuildDeb PATH for go-1.10
-    - overlord/snapstate: validate instance names early
-    - overlord/ifacestate: handler for hotplug-update-slot tasks
-    - polkit: cast pid to uint32 to keep polkit happy for now
-    - snap/naming: move various name validation helpers to separate
-      package
-    - tests: iterate getting journal logs to support delay on boards on
-      daemon-notify test
-    - cmd/snap: fix typo in cmd_wait.go
-    - snap/channel: improve channel parsing
-    - daemon, polkit: pid_t is signed
-    - daemon: introduce /v2/connections snapd API endpoint
-    - cmd/snap: small refactor of cmd_info's channel handling
-    - overlord/snapstate: use an ad-hoc error when no results
-    - cmd/snap: wrap "summary" better
-    - tests: workaround missing go dependencies in debian-9
-    - daemon: try to tidy up the icon stuff a little
-    - interfaces: add display-control interface
-    - snapcraft.yaml: fix snap building in launchpad
-    - tests: update fedora 29 workers to speed up the whole testing time
-    - interfaces: add u2f-devices interface and allow reading udev
-      +power_supply:* in hardware-observe
-    - cmd/snap-update-ns: save errno from strtoul
-    - tests: interfaces tests normalization
-    - many: cleanup golang.org/x/net/context
-    - tests: add spread test for system dbus interface
-    - tests: remove -o pipefail
-    - interfaces: add block-devices interface
-    - spread: enable upgrade suite on fedora
-    - tests/main/searching: video section got renamed to photo-and-video
-    - interfaces/home: use dac_read_search instead of dac_override with
-      'read: all'
-    - snap: really run the RunSuite
-    - interfaces/camera: allow reading vendor/etc info from
-      /run/udev/data/+usb:*
-    - interfaces/dbus: be less strict about alternations for well-known
-      names
-    - interfaces/home: allow dac_override with 'read:
-      all'
-    - interfaces/pulseaudio: allow reading subdirectories of
-      /etc/pulse
-    - interfaces/system-observe: allow read on
-      /proc/locks
-    - run-checks: ensure we use go-1.10 if available
-    - tests: get test-snapd-dbus-{provider,consumer} from the beta
-      channel
-    - interfaces/apparmor: mock presence of overlayfs root
-    - spread: increase default kill-timeout to 30min
-    - tests: simplify interfaces-contacts-service test
-    - packaging/ubuntu: build with golang 1.10
-    - ifacestate/tests: extra test for hotplug-connect handler
-    - packaging: make sure that /var/lib/snapd/lib/glvnd is accounted
-      for
-    - overlord/snapstate/backend: call fontconfig helpers from the new
-      'current'
-    - kvm: load required kernel modules if necessary
-    - cmd/snap: use a fake user for 'run' tests
-    - tests: update systems for google sru backend
-    - tests: fix install-snaps test by changing the snap info regex
-    - interfaces: helpers for sorting plug/slot/connection refs
-    - tests: moving core-snap-refresh-on-core test from main to nested
-      suite
-    - tests: fix daemon-notify test checking denials considering all the
-      log lines
-    - tests: skip lp-1802591 on "official" images
-    - tests: fix listing tests to match "snap list --unicode=never"
-    - debian: fix silly typo in the spread test invocation
-    - interface: raw-usb: Adding ttyACM ttyACA permissions
-    - tests: fix enable-disable-unit-gpio test on external boards
-    - overlord/ifacestate: helper API to obtain the state of connections
-    - tests: define new "tests/smoke" suite and use that for
-      autopkgtests
-    - cmd/snap-update-ns: explicitly check for return value from
-      parse_arg_u
-    - interfaces/builtin/opengl: allow access to NVIDIA VDPAU library
-    - tests: auto-clean the test directory
-    - cmd/snap: further tweak messaging; add a test
-    - overlord/ifacestate: handler for hotplug-connect task
-    - cmd/snap-confine: join freezer only after setting up user mount
-    - cmd/snap-confine: don't preemptively create .mnt files
-    - cmd/snap-update-ns: manually implement isspace
-    - cmd/snap-update-ns: let the go parser know we are parsing -u
-    - cmd/snap-discard-ns: fix name of user fstab files
-    - snapshotstate: don't task.Log without the lock
-    - tests: exclude some more slow tests from runs in autopkgtest
-    - many: remove .user-fstab files from /run/snapd/ns
-    - cmd/libsnap: pass --from-snap-confine when calling snap-update-ns
-      as user
-    - cmd/snap-update-ns: make freezer mockable
-    - cmd/snap-update-ns: move XDG code to dedicated file
-    - osutil: add helper for loading fstab from string
-    - cmd/snap-update-ns: move existing code around, renaming some
-      functions
-    - overlord/configstate/configcore: support - and _ in cloud init
-      field names
-    - * cmd/snap-confine: use makedev instead of MKDEV
-    - tests: review/fix the autopkgtest failures in disco
-    - overlord: drop old v1 store api support from managers test
-    - tests: new test for snapshots with more than 1 user
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 21 Mar 2019 10:55:27 +0100
-
-snapd (2.37.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1817949
-    - squashfs: unset SOURCE_DATE_EPOCH in the TestBuildDate test
-    - overlord/ifacestate: fix migration of connections on upgrade from
-      ubuntu-core
-    - tests: fix upgrade-from-2.15 with kernel 4.15
-    - interfaces/seccomp: increase filter precision
-    - tests: remove snapweb from tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 27 Feb 2019 19:53:36 +0100
-
-snapd (2.37.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - interfaces/seccomp: generate global seccomp profile
-    - overlord/snapstate: add some randomness to the catalog refresh
-    - tests: add upgrade test from 2.15.2ubuntu1 -> current snapd
-    - snap-confine: fix fallback to ubuntu-core
-    - packaging: avoid race in snapd.postinst
-    - overlord/snapstate: discard mount namespace when undoing 1st link
-      snap
-    - cmd/snap-confine: allow writes to /var/lib/** again
-    - tests: stop catalog-update/apt-hooks test until the catlog refresh
-      is randomized
-    - debian: ensure leftover usr.lib.snapd.snap-confine is gone
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 18 Feb 2019 17:17:33 +0100
-
-snapd (2.37.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - cmd/snap, overlord/snapstate: silently ignore classic flag when a
-      snap is strictly confined
-    - snap-confine: remove special handling of /var/lib/jenkins
-    - cmd/snap-confine: handle death of helper process gracefully
-    - snap-confine: fix classic snaps for users with /var/lib/* homedirs
-      like jenkins/postgres
-    - packaging: disable systemd environment generator on 18.04
-    - tests: update smoke/sandbox test for armhf
-    - cmd/snap-confine: refactor and cleanup of seccomp loading
-    - snap-confine: increase locking timeout to 30s
-    - snap-confine: fix incorrect "sanity timeout 3s" message
-    - snap: fix hook autodiscovery for parallel installed snaps
-    - tests: iterate getting journal logs to support delay on boards on
-      daemon-notify test
-    - interfaces/apparmor: deny inet/inet6 in snap-update-ns profile
-    - interfaces: add u2f-devices interface
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 06 Feb 2019 10:08:07 +0100
-
-snapd (2.37.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - cmd/snap-confine: add special case for Jenkins
-    - tests: workaround missing go dependencies in debian-9
-    - daemon, polkit: pid_t is signed
-    - interfaces: add display-control interface
-    - interfaces: add block-devices interface
-    - tests/main/searching: video section got renamed to photo-and-video
-    - interfaces/camera: allow reading vendor/etc info from
-      /run/udev/data/+usb
-    - interfaces/dbus: be less strict about alternations for well-known
-      names
-    - interfaces/home: allow dac_read_search with 'read: all'
-    - interfaces/pulseaudio: allow reading subdirectories of
-      /etc/pulse
-    - interfaces/system-observe: allow read on
-      /proc/locks
-    - tests: get test-snapd-dbus-{provider,consumer} from the beta
-      channel
-    - interfaces/apparmor: mock presence of overlayfs root
-    - packaging/{fedora,opensuse,ubuntu}: add /var/lib/snapd/lib/glvnd
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Jan 2019 18:35:36 +0100
-
-snapd (2.37) xenial; urgency=medium
-
-  * New upstream release, LP: #1811233
-    - snapd: fix race in TestSanityFailGoesIntoDegradedMode test
-    - cmd: fix snap-device-helper to deal correctly with hooks
-    - tests: various fixes for external backend
-    - interface: raw-usb: Adding ttyACM[0-9]* as many serial devices
-      have device node /dev/ttyACM[0-9]
-    - tests: fix enable-disable-unit-gpio test on external boards
-    - tests: define new "tests/smoke" suite and use that for
-      autopkgtests
-    - interfaces/builtin/opengl: allow access to NVIDIA VDPAU
-      library
-    - snapshotstate: don't task.Log without the lock
-    - overlord/configstate/configcore: support - and _ in cloud init
-      field names
-    - cmd/snap-confine: use makedev instead of MKDEV
-    - tests: review/fix the autopkgtest failures in disco
-    - systemd: allow only a single daemon-reload at the same time
-    - cmd/snap: only auto-enable unicode to a tty
-    - cmd/snap: right-align revision and size in info's channel map
-    - dirs, interfaces/builtin/desktop: system fontconfig cache path is
-      different on Fedora
-    - tests: fix "No space left on device" issue on amazon-linux
-    - store: undo workaround for timezone-less released-at
-    - store, snap, cmd/snap: channels have released-at
-    - snap-confine: fix incorrect use "src" var in mount-support.c
-    - release: support probing SELinux state
-    - release-tools: display self-help
-    - interface: add new `{personal,system}-files` interface
-    - snap: give Epoch an Equal method
-    - many: remove unused interface code
-    - interfaces/many: use 'unsafe' with docker-support change_profile
-      rules
-    - run-checks: stop running HEAD of staticcheck
-    - release: use sync.Once around lazy intialized state
-    - overlord/ifacestate: include interface name in the hotplug-
-      disconnect task summary
-    - spread: show free space in debug output
-    - cmd/snap: attempt to restore SELinux context of snap user
-      directories
-    - image: do not write empty etc/cloud
-    - tests: skip snapd snap on reset for core systems
-    - cmd/snap-discard-ns: fix umount(2) typo
-    - overlord/ifacestate: hotplug-remove-slot task handler
-    - overlord/ifacestate: handler for hotplug-disconnect task
-    - ifacestate/hotplug: updateDevice helper
-    - tests: reset snapd state on tests restore
-    - interfaces: return security setup errors
-    - overlord: make InstallMany work like UpdateMany, issuing a single
-      request to get candidates
-    - systemd/systemd.go: add missing tests for systemd.IsActive
-    - overlord/ifacestate: addHotplugSeqWaitTask helper
-    - cmd/snap-confine: refactor call to snap-update-ns --user-mounts
-    - tests: new backend used to run upgrade test suite
-    - travis: short circuit failures in static and unit tests travis job
-    - cmd: automatically fix localized <option>s to <option>
-    - overlord/configstate,features: expose features to snapd tools
-    - selinux: package to query SELinux status and verify/restore file
-      contexts
-    - wrappers: use new systemd.IsActive in core18 early boot
-    - cmd: add tests for lintArg and lintDesc
-    - httputil: retry on temporary net errors
-    - cmd/snap-confine: remove unused sc_discard_preserved_mount_ns
-    - wrappers: only restart service in core18 when they are active
-    - overlord/ifacestate: helpers for serializing hotplug changes
-    - packaging/{fedora,opensuse}: own /var/lib/snapd/cookie
-    - systemd: start snapd.autoimport.service in --no-block mode
-    - data/selinux: fix syntax error in definition of snappy_admin
-      interface
-    - snap/info: bind global plugs/slots to implicit hooks
-    - cmd/snap-confine: remove SC_NS_MNT_FILE
-    - spread: record each tests/upgrade job
-    - osutil: do not import dirs
-    - cmd/snap-confine: fix typo "a pipe"
-    - tests: make security-device-cgroups-{devmode,jailmode} work on arm
-      devices
-    - tests: force test-snapd-daemon-notify exit 0 when the interface is
-      not connected
-    - overlord/snapstate: run 'remove' hook before 'auto-disconnect'
-    - centos: enable SELinux support on CentOS 7
-    - apparmor: allow hard link to snap-specific semaphore files
-    - tests/lib/pkgdb: disable weak deps on Fedora
-    - release: detect too old apparmor_parser
-    - tests: improve how the log is checked to see if the system is
-      waiting for a reboot
-    - cmd, dirs, interfaces/apparmor: update distro identification to
-      support ID="archlinux"
-    - spread, tests: add Fedora 29
-    - cmd/snap-confine: refactor calling snapd tools into helper module
-    - apparmor: allow snap-update-ns access to common devices
-    - cmd/snap-confine: capture initialized per-user mount ns
-    - tests: reduce verbosity around package installation
-    - data: set KillMode=process for snapd
-    - cmd/snap: handle DNS error gracefully
-    - spread, tests: use checkpoints when dumping audit log
-    - tests/lib/prepare: make sure that SELinux context of repacked core
-      snap is controlled
-    - testutils: split checkers, tweak tests
-    - tests: fix for tests test-*-cgroup
-    - spread: show AVC audits when debugging, start auditd on Fedora
-    - spread: drop Fedora 27, add Fedora 29
-    - tests/lib/reset: restore context of removed snapd directories
-    - testutil: add File{Present,Absent} checkers
-    - snap: add new `snap run --trace-exec`
-    - tests: fix for failover test on how logs are checked
-    - snapctl: add "services"
-    - overlord/snapstate: use file timestamp to initialize timer
-    - cmd/libsnap: introduce and use sc_strdup
-    - interfaces: let NM access ifindex/ifupdown files
-    - overlord/snapstate: on refresh, check new rev can read current
-    - client, store: don't use store from client (use client from store)
-    - tests/main/parallel-install-store: verify installation of more
-      than one instance at a time
-    - overlord: don't write system key if security setup fails
-    - packaging/fedora/snapd.spec: fix bogus date in changelog
-    - snapstate: update fontconfig caches on install
-    - interfaces/apparmor/backend.go:411:38: regular expression does not
-      contain any meta characters (SA6004)
-    - asserts/header_checks.go:199:35: regular expression does not
-      contain any meta characters (SA6004)
-    - run staticcheck every time :-)
-    - tests/lib/systemd-escape/main.go:46:14: printf-style function with
-      dynamic first argument and no further arguments should use print-
-      style function instead (SA1006)
-    - tests/lib/fakestore/cmd/fakestore/cmd_run.go:66:15: the channel
-      used with signal.Notify should be buffered (SA1017)
-    - tests/lib/fakedevicesvc/main.go:55:15: the channel used with
-      signal.Notify should be buffered (SA1017)
-    - spdx/parser.go:30:1: only the first constant has an explicit type
-      (SA9004)
-    - overlord/snapstate/snapmgr.go:553:21: printf-style function with
-      dynamic first argument and no further arguments should use print-
-      style function instead (SA1006)
-    - overlord/patch/patch3.go:44:70: printf-style function with dynamic
-      first argument and no further arguments should use print-style
-      function instead (SA1006)
-    - cmd/snap/cmd_advise.go:200:2: empty branch (SA9003)
-    - osutil/udev/netlink/conn.go:120:5: ineffective break statement.
-      Did you mean to break out of the outer loop? (SA4011)
-    - daemon/api.go:992:22: printf-style function with dynamic first
-      argument and no further arguments should use print-style function
-      instead (SA1006)
-    - cmd/snapd/main.go:94:5: ineffective break statement. Did you mean
-      to break out of the outer loop? (SA4011)
-    - cmd/snap/cmd_userd.go:73:15: the channel used with signal.Notify
-      should be buffered (SA1017)
-    - cmd/snap/cmd_help.go:102:7: io.Writer.Write must not modify the
-      provided buffer, not even temporarily (SA1023)
-    - release: probe apparmor features lazily
-    - overlord,daemon: mock security backends for testing
-    - cmd/libsnap: move apparmor-support to libsnap
-    - cmd: drop cruft from snap-discard-ns build rules
-    - cmd/snap-confine: use snap-discard-ns ns to discard stale
-      namespaces
-    - cmd/snap-confine: handle mounted shared /run/snapd/ns
-    - many: fix composite literals with unkeyed fields
-    - dirs, wrappers, overlord/snapstate: make completion + bases work
-    - tests: revert "tests: restore in restore, not prepare"
-    - many: validate title
-    - snap: make description maximum in runes, not bytes
-    - tests: discard mount namespaces in reset.sh
-    - tests/lib: sync cla check back from snapcraft
-    - Revert "cmd/snap, tests/main/snap-info: highlight the current
-      channel"
-    - daemon: remove enableInternalInterfaceActions
-    - mkversion: use "test -n" rather than "! test -z"
-    - run-checks: assorted fixes
-    - tests: restore in restore, not in prepare
-    - cmd/snap: fix missing newline in "snap keys" error message
-    - snap: epoch lists must contain no duplicate entries
-    - interfaces/avahi_observe: Fix typo in comment
-    - tests: add SPREAD_JOB to the description of
-      systemd_create_and_start_unit
-    - daemon, vendor: bump github.com/coreos/go-systemd/activation,
-      handle API changes
-    - Revert "cmd/snap-confine: don't allow mapping lib{uuid,blkid}"
-    - packaging/fedora: use %_sysctldir macro
-    - cmd/snap-confine: remove unneeded unshare
-    - sanity: extend the kernel version check to cover CentOS/RHEL
-      kernels
-    - wrappers: remove all desktop files from a snap on removal
-    - snap: add an explicit check for `epoch: null` loading
-    - snap: check max description length in validate
-    - spread, tests: add CentOS support
-    - cmd/snap-confine: allow mapping more libc shards
-    - cmd/snap-discard-ns: add support for --from-snap-confine
-    - tests: make tinyproxy support systemd notify
-    - tests: fix shellcheck
-    - snap, store: rename `snap.Epoch`'s `Unset` to `IsZero`
-    - store: add a test for a non-zero epoch refresh (with epoch bump)
-    - store: v1 search doesn't send epoch, stop pretending it does
-    - snap: make any "0" epoch be Unset, and marshalled to {[0],[0]}
-    - overlord/snapstate: amend test should send local revision
-    - tests: use mock-gpio.py in enable-disable-units-gpio test
-    - snap: enforce minimal snap name len of 2
-    - cmd/libsnap: add sc_verify_snap_lock
-    - cmd/snap-update-ns: extra debugging of trespassing events
-    - userd: force zenity width if the text displayed is long
-    - overlord/snapstate, store: always send epochs
-    - cmd/snap-confine,snap-update-ns: discard quirks
-    - cmd/snap: add nanosleep to blacklisted syscalls when running with
-      --strace
-    - cmd/snap-update-ns, tests: clean trespassing paths
-    - nvidia, interfaces/builtin: OpenCL fixes
-    - ifacestate/hotplug: removeDevice helper
-    - cmd: install snap-discard-ns in "make hack"
-    - overlord/ifacestate: setup security backends phased by backends
-      first
-    - ifacestate/helpers: added SystemSnapName mapper helper method
-    - overlord/ifacestate: set hotplug-key of the connection when
-      connecting hotplug slots
-    - snapd: allow snap-update-ns to read /proc/version
-    - cmd: handle tumbleweed and leap in autogen.sh
-    - interfaces/tests: MockHotplugSlot test helper
-    - store,daemon: make UserInfo,LoginUser part of the store interface
-    - overlord/ifacestate: use remapper when checking if system snap is
-      installed
-    - tests: fix how pinentry is prepared for new gpg v 2.1 and 2.2
-    - packaging/arch: fix bash completions path
-    - interfaces/builtin: add device-buttons interface for accessing
-      events
-    - tests, fakestore: extend refresh tests with parallel installed
-      snaps
-    - snap, store, overlord/snapshotstate: drop epoch pointers
-    - snap: make Epoch default to {[0],[0]} on load from yaml
-    - data/completion: pass documented arguments to completion functions
-    - tests: skip opensuse from interfaces-openvswitch-support test
-    - tests: simple reproducer for snap try and hooks bug
-    - snapstate: do not allow classic mode for strict snaps
-    - snap: make Epoch's MarshalJSON not simplify
-    - store: remove unused currentSnap and currentSnapJSON
-    - many: some small doc comment fixes in recent hotplug code
-    - ifacestate/udevmonitor: added callback to signal end of
-      enumeration
-    - cmd/libsnap: add simplified feature flag checker
-    - interfaces/opengl: add additional accesses for cuda
-    - tests: add core18 only hooks test and fix running core18 only on
-      classic
-    - sanity, release, cmd/snap: refuse to try to do things on WSL.
-    - cmd: make coreSupportsReExec faster
-    - overlord/ifacestate: don't remove the dash when generating unique
-      slot name
-    - cmd/snap-seccomp: add full complement of ptrace constants
-    - cmd: update autogen.sh for opensuse
-    - interfaces/apparmor: allow access to /run/snap.$SNAP_INSTANCE_NAME
-    - spread.yaml: add more systems to the autopkgtest and qemu backends
-    - daemon: spool sideloaded snap into blob dir
-      overlord/snapstate: address review feedback
-    - packaging/opensuse: stop using golang-packaging
-    - overlord/snapshots: survive an unknown user
-    - wrappers: fix generating of service units with multiple `before`
-      dependencies
-    - data: run snapd.autoimport.service only after seeding
-    - cmd/snap: unhide --name parameter to snap install, tweak help
-      message
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - tests/main/snap-service-after-before-install: verify after/before
-      in snap install
-    - overlord/ifacestate: mark connections disconnected by hotplug with
-      hotplug-gone
-    - ifacestate/ifacemgr: don't reload hotplug-gone connections on
-      startup
-    - tests: install dependencies during prepare
-    - tests,store,daemon: ensure proxy settings are honored in
-      auth/userinfo too
-    - tests: core 18 does not support classic confinement
-    - tests: add debug output for degraded test
-    - strutil: make VersionCompare faster
-    - overlord/snapshotstate/backend: survive missing directories
-    - overlord/ifacestate: use map[string]*connState when passing conns
-      around
-    - tests: move fedora 28 to manual
-    - overlord/snapshotstate/backend: be more verbose when
-      SNAPPY_TESTING=1
-    - tests: removing fedora 26 system from spread.yaml
-    - tests: linode execution is not needed anymore
-    - tests/lib: adjust to changed systemctl behaviour on debian-9
-    - tests: fixes and new backend for tests on nested suite
-    - strutil: let MatchCounter work with a nil regexp
-    - ifacestate/helpers: findConnsForHotplugKey helper
-    - many: move regexp.(Must)Compile out of non-init functions into
-      variables
-    - store: also make snaps downloaded via deltas 0600
-    - snap: use Lstat to determine snap size, remove
-      ReadSnapInfoExceptSize
-    - interfaces/builtin: add adb-support interface
-    - tests: fail if install_snap_local fails
-    - strutil: add extra test to CommaSeparatedList as suggested by
-      mborzecki
-    - cmd/snap, daemon, strutil: use CommaSeparatedList to split a CSL
-    - ifacestate: optimize disconnect hooks
-    - cmd/snap-update-ns: parse the -u <uid> command line option
-    - cmd/snap, tests: snapshots for all
-    - client, cmd/daemon: allow disabling keepalive, improve degraded
-      mode unit tests
-    - snap: only show "next" refresh time if its after the hold time
-    - overlord/snapstate: run tests for classic snaps even on systems
-      that don't support classic
-    - overlord/standby: fix a race between standby goroutine and stop
-    - cmd/snap-exec: don't fail on some try mode snaps
-    - cmd/snap, userd, testutil: tweak DBus tests to use private session
-      bus connection
-    - cmd: remove remnants of sc_should_populate_mount_ns
-    - client, daemon, cmd/snap: indicate that services are socket/timer
-      activated
-    - cmd/snap-seccomp: only look for PTRACE_GETFPX?REGS where available
-    - cmd/snap-confine: remove SC_NS_FAIL_GRACEFULLY
-    - snap/pack, cmd/snap: allow specifying the filename of 'snap pack'
-    - cmd/snap-discard-ns: add support for per-user mount namespaces
-    - cmd/snap-confine: remove stale mount profile along stale namespace
-    - data/apt: close stderr when calling snap in the apt install hook.
-    - tests/main: fixes for the new shellcheck
-    - testutil, cmd/snap: introduce and use testutil.EqualsWrapped and
-      fly
-    - tests: initial setup for testing current branch on nested vm and
-      hotplug management
-    - cmd: refactor IPC and lifecycle of the helper process
-    - tests/main/parallel-install-store: the store has caught up, do not
-      expect failures
-    - overlord/snapstate, snap, wrappers: start services in the right
-      order during install
-    - interfaces/browser-support, cmd/snap-seccomp: Allow read-only
-      ptrace, for the Breakpad crash reporter
-    - snap,client: use a different exit code for retryable errors
-    - overlord/ifacestate: don't conflict on own discard-snap tasks when
-      refreshing & doing garbage collection
-    - cmd/snap: tweak `snap services` output when there is no services
-    - interfaces/many: updates to support k8s worker nodes
-    - cmd/snap: gnome-software install via snap:// handler
-    - overlord/many: cleanup use of snapName vs. instanceName
-    - snapstate: add command-chain to supported featureset
-    - daemon, snap: mark screenshots as deprecated
-    - interfaces: fix decoding of json numbers for static/dynamic
-      attributes* ifstate: fix decoding of json numbers
-    - cmd/snap: try not to panic on error from "snap try"
-    - tests: new cosmic image for spread tests on gce
-    - interfaces/system-key: add parser mtime and only discover features
-      on write
-    - overlord/snapshotstate/backend: detect path to tar in unit tests
-    - tests/unit/gccgo: drop gccgo unit tests
-    - cmd: use relative file names in locking APIs
-    - interfaces: fix NormalizeInterfaceAttributes, add tests
-    - overlord/snapshotstate/backend: fall back on sudo when no runuser
-    - cmd/snap-confine: reduce verbosity of debug and error messages
-    - systemd: extend Status() to work for socket and timer units
-    - interfaces: typo 'allows' for consistency with other ifaces
-    - systemd,wrappers: don't start disabled services
-    - ifacestate: simplify task chaining in ifacestate.Connect
-    - tests: ensure that goa-daemon is off
-    - snap/pack, snap/squashfs: remove extra copy before mksquashfs
-    - cmd/snap: block 'snap help <cmd> --all'
-    - asserts, image: ensure kernel, gadget, base and required-snaps use
-      valid snap names
-    - apparmor: add unit test for probeAppArmorParser and simplify code
-    - interfaces/apparmor: conditionally add explicit deny rules for
-      ptrace
-    - po: sync translations from launchpad
-    - osutil: tweak handling of error adduser errors
-    - cmd: rename ns_group to mount_ns
-    - tests/main/interfaces-accounts-service: more debugging
-    - snap/pack, snap/squashfs: use type to determine mksquashfs args
-    - data/systemd, wrappers: tweak system-shutdown helper for core18
-    - tests: show list of processes when ifaces-accounts-service fails
-    - tests: do not run degraded test in autopkgtest env
-    - snap: overhaul validation error messages
-    - ifacestate/hooks: only create interface hook tasks if hooks exist
-    - osutil: workaround overlayfs on ubuntu 18.10
-    - interfaces/home: don't allow snaps to write to $HOME/bin
-    - interfaces: improve Attr error further
-    - snapstate: tweak GetFeatureFlagBool() to have a default argument
-    - many: cleanup remaining parallel installs TODOs
-    - image: improve validation of extra snaps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 16 Jan 2019 17:16:56 +0100
-
-snapd (2.36.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - wrappers: use new systemd.IsActive in core18 early boot
-    - httputil: retry on temporary net errors
-    - wrappers: only restart service in core18 when they are active
-    - systemd: start snapd.autoimport.service in --no-block mode
-    - data/selinux: fix syntax error in definition of snappy_admin
-      interfacewhen installing selinux-policy-devel package.
-    - centos: enable SELinux support on CentOS 7
-    - cmd, dirs, interfaces/apparmor: update distro identification to
-      support ID="archlinux"
-    - apparmor: allow hard link to snap-specific semaphore files
-    - overlord,apparmor: new syskey behaviour + non-ignored snap-confine
-      profile errors
-    - snap: add new `snap run --trace-exec` call
-    - interfaces/backends: detect too old apparmor_parser
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 14 Dec 2018 07:30:58 +0100
-
-snapd (2.36.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - daemon, vendor: bump github.com/coreos/go-systemd/activation,
-      handle API changes
-    - snapstate: update fontconfig caches on install
-    - overlord,daemon: mock security backends for testing
-    - sanity, spread, tests: add CentOS
-    - Revert "cmd/snap, tests/main/snap-info: highlight the current
-      channel"
-    - cmd/snap: add nanosleep to blacklisted syscalls when running with
-      --strace
-    - tests: add regression test for LP #1803535
-    - snap-update-ns: fix trailing slash bug on trespassing error
-    - interfaces/builtin/opengl: allow reading /etc/OpenCL/vendors
-    - cmd/snap-confine: nvidia: pick up libnvidia-opencl.so
-    - interfaces/opengl: add additional accesses for cuda
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 29 Nov 2018 10:48:29 +0100
-
-snapd (2.36.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - tests,snap-confine: add core18 only hooks test and fix running
-      core18 only hooks on classic
-    - interfaces/apparmor: allow access to
-      /run/snap.$SNAP_INSTANCE_NAME
-    - spread.yaml: add more systems to the autopkgtest and qemu backends
-    - daemon: spool sideloaded snap into blob dir
-    - wrappers: fix generating of service units with multiple `before`
-      dependencies
-    - data: run snapd.autoimport.service only after seeding
-    - tests,store,daemon: ensure proxy settings are honored in
-      auth/userinfo too
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - tests/lib: adjust to changed systemctl behaviour on debian-9
-    - tests/main/interfces-accounts-service: switch to busctl, more
-      debugging
-    - store: also make snaps downloaded via deltas 0600
-    - cmd/snap-exec: don't fail on some try mode snaps
-    - cmd/snap, userd, testutil: tweak DBus tests to use private session
-      bus connection
-    - tests/main: fixes for the new shellcheck
-    - cmd/snap-confine: remove stale mount profile along stale namespace
-    - data/apt: close stderr when calling snap in the apt install hook
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 09 Nov 2018 14:42:28 +0100
-
-snapd (2.36) xenial; urgency=medium
-
-  * New upstream release, LP: #1795590
-    - overlord/snapstate, snap, wrappers: start services in the right
-      order during install
-    - tests: the store has caught up, drop gccgo test, update cosmic
-      image
-    - cmd/snap: try not to panic on error from "snap try"`--devmode`
-    - overlord/ifacestate: don't conflict on own discard-snap tasks when
-      refreshing & doing garbage collection
-    - snapstate: add command-chain to supported featureset
-    - daemon, snap: mark screenshots as deprecated
-    - interfaces: fix decoding of json numbers for static/dynamic
-      attributes
-    - data/systemd, wrappers: tweak system-shutdown helper for core18
-    - interfaces/system-key: add parser mtime and only discover features
-      on write
-    - interfaces: fix NormalizeInterfaceAttributes, add tests
-    - systemd,wrappers: don't start disabled services
-    - ifacestate/hooks: only create interface hook tasks if hooks exist
-    - tests: do not run degraded test in autopkgtest env
-    - osutil: workaround overlayfs on ubuntu 18.10
-    - interfaces: include invalid type in Attr error
-    - many: enable layouts by default
-    - interfaces/default: don't scrub with change_profile with classic
-    - cmd/snap: speed up unit tests
-    - vendor, cmd/snap: refactor to accommodate the new less buggy go-
-      flags
-    - daemon: expose snapshots to the API
-    - interfaces: updates for default, screen-inhibit-control, tpm,
-      {hardware,system,network}-observe
-    - interfaces/hotplug: rename HotplugDeviceKey method to HotplugKey,
-      update test interface
-    - interfaces/tests: use TestInterface instead of a custom local
-      helper
-    - overlord/snapstate: export getFeatureFlagBool.
-    - osutil,asserts,daemon: support force password change in system-
-      user assertion
-    - snap, wrappers: support restart-delay, generate RestartSec=<value>
-      in service units
-    - tests/ifacestate: moved asserts-related mocking into helper
-    - image: fetch device store assertion if available
-    - many: enable AppArmor on Arch
-    - interfaces/repo: two helper methods for hotplug
-    - overlord/ifacestate: add hotplug slots with implicit slots
-    - interfaces/hotplug: helpers and struct updates
-    - tests: run the snapd tests on Ubuntu 18.10
-    - snapstate: only report errors if there is an actual error
-    - store: speedup unit tests
-    - spread-shellcheck: fix interleaved error messages, tweaks
-    - apparmor: create SnapAppArmorDir in setupSnapConfineReexec
-    - ifacestate: implementation of defaultDeviceKey function for
-      hotplug
-    - cmd/snap-update-ns: remove empty placeholders used for mounting
-    - snapshotstate: restore to current revision
-    - tests/lib: rework the CLA checker
-    - many: support and consider store friendly-stores when checking
-      device scope constraints
-    - overlord/snapstate: block parallel installs of snapd, core, base,
-      kernel, gadget snaps
-    - overlord/patch: patch for static plug/slot attributes
-    - interfaces: honor static attributes when reloading conns
-    - osutils: unit tests speedup; introduce «run-checks --short-
-      unit».
-    - systemd, wrappers: speed up wrappers unit tests
-    - client: speedup unit tests
-    - spread-shellcheck: use threads to parallelise
-    - snap: validate plug and slot names
-    - osutil, interfaces/apparmor: add and use of osutil.UnlinkMany
-    - wrappers: do not depend on network.taget in socket units, tweak
-      generated units
-    - interfaces/apparmor: (un)load profiles in one apparmor_parser call
-    - store: gracefully handle unexpected errors in 'action'
-      response
-    - cmd: put our manpages in section 8
-    - overlord: don't make become-operational interfere with user
-      requests
-    - store: tweak unmatched refresh result error log
-    - snap, client, daemon, store: use and expose "media" more
-    - tests,cmd/snap-update-ns: add test showing mount update bug
-      cmd/snap-update-ns: better detection of snapd-made tmpfs
-    - tests: spread tests for aliases with parallel installed snaps
-    - interfaces/seccomp: allow using statx by default
-    - store: gracefully handle unexpected errors in 'action' response
-    - overlord/snapshotstate: chown the tempdir
-    - cmd/snap: attempt to start the document portal if running with a
-      session bus
-    - snap: detect layouts vs layout in snap.yaml
-    - interfaces/apparmor: handle overlayfs snippet for snap-update-ns
-    - snapcraft.yaml: set grade to stable
-    - tests: shellchecks, final round
-    - interfaces/apparmor: handle overlayfs snippet for snap-update-ns
-    - snap: detect layouts vs layout in snap.yaml
-    - overlord/snapshotstate: store epoch in snapshot, check on restore
-    - cmd/snap: tweak UX of snap refresh --list
-    - overlord/snapstate: improve consistency, use validateInfoAndFlags
-      also in InstallPath
-    - snap: give Epoch a CanRead helper
-    - overlord/snapshotstate: small refactor of internal helpers
-    - interfaces/builtin: adding missing permission to create
-      /run/wpa_supplicant directory
-    - interfaces/builtin: avahi interface update
-    - client, daemon: support passing of 'unaliased' option when
-      installing from local files
-    - selftest: rename selftest.Run() to sanity.Check()
-    - interfaces/apparmor: report apparmor support level and policy
-    - ifacestate: helpers for generating slot names for hotplug
-    - overlord/ifacestate: make sure to pass in the Model assertion when
-      enforcing policies
-    - overlord/snapshotstate: store the SnapID in snapshot, block
-      restore if changed
-    - interfaces: generalize writable mimic profile
-    - asserts,interfaces/policy: add support for on-store/on-brand/on-
-      model plug/slot rule constraints
-    - many: fetch the device store assertion together and in the context
-      of interpreting snap-declarations
-    - tests: disable gccgo tests on 18.04 for now, until dh-golang vs
-      gccgo is fixed
-    - tests/main/parallel-install-services: add spread test for snaps
-      with services
-    - tests/main/snap-env: extend to cover parallel installations of
-      snaps
-    - tests/main/parallel-install-local: rename from *-sideload, extend
-      to run snaps
-    - cmd/snapd,daemon,overlord: without snaps, stop and wait for socket
-    - cmd/snap: tame the help zoo
-    - tests/main/parallel-install-store: run installed snap
-    - cmd/snap: add a bunch of TRANSLATORS notes (and a little more
-      i18n)
-    - cmd: fix C formatting
-    - tests: remove unneeded cleanup from layout tests
-    - image: warn on missing default-providers
-    - selftest: add test to ensure selftest.checks is up-to-date
-    - interfaces/apparmor, interfaces/builtin: tweaks for parallel snap
-      installs
-    - userd: extend the list of supported XDG Desktop properties when
-      autostarting user applications
-    - cmd/snap-update-ns: enforce trespassing checks
-    - selftest: actually run the kernel version selftest
-    - snapd: go into degraded mode when the selftest fails
-    - tests: add test that runs snapctl with a core18 snap
-    - tests: add snap install hook with base: core18
-    - overlord/{snapstate,assertstate}: parallel instances and
-      refresh validation
-    - interfaces/docker-support: add rules to read apparmor macros
-    - tests: make nfs test available for more systems
-    - tests: cleanup copy/paste dup in interfaces-network-setup-control
-    - tests: using single sh snap in interface tests
-    - overlord/snapstate: improve cleaup in mount-snap handler
-    - tests: don't fail interfaces-bluez test if bluez is already
-      installed
-    - tests: find snaps just for edge and beta channels
-    - daemon, snapstate: consistent snap list [--all] output with broken
-      snaps
-    - tests: fix listing to allow extra things in the notes column
-    - cmd/snap: improve UX when removing specific snap revision
-    - cmd/snap, tests/main/snap-info: highlight the current channel
-    - interfaces/testiface: added TestHotplugInterface
-    - snap: tweak commands
-    - interfaces/hotplug: hotplug spec takes one slot definition
-    - overlord/snapstate, snap: handle shared snap directories when
-      installing/remove snaps with instance key
-    - interfaces/opengl: misc accesses for VA-API
-    - client, cmd/snap: expose warnings to the world
-    - cmd/snap-update-ns: introduce trespassing state tracking
-    - cmd/snap: commands no longer build their own client
-    - tests: try to build cmd/snap for darwin
-    - daemon: make error responders not printf when called with 1
-      argument
-    - many: return real snap name in API response
-    - overlord/state: return latest LastAdded time in WarningsSummary
-    - many: mount namespace mapping for parallel installs of snaps
-    - ifacestate/autoconnect: do not self-conflict on setup-profiles if
-      core-phase-2
-    - client, cmd/snap: on !linux, exit when the client tries to Do
-      something
-    - tests: refactor for nested suite and tests fixed
-    - tests: use lxd's waitready instead of polling lxd socket
-    - ifacestate: don't initialize udev monitor until we have a system
-      snap
-    - interfaces: extra argument for static attrs in
-      NewConnectedPlug/NewConnectedSlot
-    - packaging/arch: sync packaging with AUR
-    - snapstate/tests: serialize all appends in fake backend
-    - snap-confine: make /lib/modules optional
-    - cmd/snap: handle "snap interfaces core" better
-    - store: move download tests into downloadSuite
-    - tests,interfaces: run interfaces-account-control on UC18
-    - tests: fix install snaps test by adding link to /snap
-    - tests: fix for nested test suite
-    - daemon: fix snap list --all with parallel snap instances
-    - snapstate: refactor tests to use SetModel*
-    - wrappers: fix snap services order in tests
-    - many: provide salt for generating instance-key in store requests
-    - ifacestate: fix hang when retrying content providers
-    - snapd-env-generator: fix when PATH is empty or unset
-    - overlord/assertstate: propagate TaskSnapSetup error
-    - client: catch and expose logs errors
-    - overlord: integrate device enumeration with udev monitor
-    - daemon, overlord/state: warnings pipeline
-    - tests: add publisher regex to fix the snap-info test pass on sru
-    - cmd: use systemdsystemgeneratorsdir, cleanup automake complaints,
-      tweaks
-    - cmd/snap-update-ns: remove the unused Secure type
-    - osutil, o/snapshotstate, o/sss/backend: quick fixes
-    - tests: update the listing expression to support core from
-      different channels
-    - store: use stable instance key in store refresh requests
-    - cmd/snap-update-ns: detach Mk{Prefix,{File,Dir,Symlink{,All}}}
-    - overlord/patch: support for sublevel patches
-    - tests: update prepare/restore for nightly suite
-    - cmd/snap-update-ns: detach BindMount from the Secure type
-    - cmd/snap-update-ns: re-factor pair of helpers to call fstatfs once
-    - ifacestate: retry on "discard-snap" in autoconnect conflict check
-    - cmd/snap-update-ns: separate OpenPath from the Secure struct
-    - wrappers: remove Wants=network-online.target
-    - tests: add new core16-base test
-    - store: refactor tests so that they work as store_test package
-    - many: add refresh.rate-limit core option
-    - tests: run account-control test with different bases
-    - tests: port proxy test to use python tinyproxy
-    - overlord: introduce snapshotstate.
-    - testutil: allow Fstatfs results to vary over time
-    - snap-update-ns: add comments about the "deadcode" in bootstrap.go
-    - overlord: add chg.Err() in testUpdateWithAutoconnectRetry
-    - many: remove deadcode
-    - tests: also run unit/gccgo in 18.04
-    - tests: introduce a helper for installing local snaps with --name
-    - tests: avoid removing core snap on reset
-    - snap: use snap.SideInfo in test to fix build with gccgo
-    - partition: remove unused runCommand
-    - image: fix incorrect error when using local bases
-    - overlord/snapstate: fix format
-    - cmd: fix format
-    - tests: setting "storage: preserve-size" just for amazon-linux
-      system
-    - tests: test for the hostname interface
-    - interfaces/modem-manager: allow access to more USB strings
-    - overlord: instantiate UDevMonitor
-    - interfaces/apparmor: tweak naming, rename to AddLayout()
-    - interfaces: take instance name in ifacetest.InstallSnap
-    - snapcraft: do not use --dirty in mkversion
-    - cmd: add systemd environment generator
-    - devicestate: support getting (http) proxy from core config
-    - many: rename ClientOpts to ClientOptions
-    - prepare-image-grub-core18: remove image root in restore
-    - overlord/ifacestate: remove "old-conn" from connect/undo connect
-      handlers
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - image: handle errors when downloadedSnapsInfoForBootConfig has no
-      data
-    - tests: use official core18 model assertion in tests
-    - snap-confine: map /var/lib/extrausers into snaps mount-namespace
-    - overlord,store: support proxy settings internally too
-    - cmd/snap: bring back 'snap version'
-    - interfaces/mount: tweak naming of things
-    - strutil: fix MatchCounter to also work with buffer reuse
-    - cmd,interfaces,tests: add /mnt to removable-media interface
-    - systemd: do not run "snapd.snap-repair.service.in on firstboot
-      bootstrap
-    - snap/snapenv: drop some instance specific variables, use instance-
-      specific ones for user locations
-    - firstboot: sort by type when installing the firstboot snaps
-    - cmd, cmd/snap: better support for non-linux
-    - strutil: add new ParseByteSize
-    - image: detect and error if bases are missing
-    - interfaces/apparmor: do not downgrade confinement on arch with
-      linux-hardened 4.17.4+
-    - daemon: add pokeStateLock helper to the daemon tests
-    - snap/squashfs: improve error message from Build on mksquashfs
-      failure
-    - tests: remove /etc/alternatives from dirs-not-shared-with-host
-    - cmd: support re-exec into the "snapd" snap
-    - spdx: remove "Other Open Source" from the support licenses
-    - snap: add new type "TypeSnapd" and attach to the snapd snap
-    - interfaces: retain order of inserted security backends
-    - tests: spread test for parallel-installs desktop file handling
-    - overlord/devicestate: use OpenSSL's PEM format when generating
-      keys
-    - cmd: remove --skip-command-chain from snap run and snap-exec
-    - selftest: detect if apparmor is unusable and error
-    - snap,snap-exec: support command-chain for hooks
-    - tests: significantly reduce execution time for managers test
-    - snapstate: use new "snap.ByType" sorting
-    - overlord/snapstate: fix UpdateMany() to work with parallel
-      instances
-    - testutil: have File* checker produce more useful error output
-    - overlord/ifacestate: introduce connectOpts
-    - interfaces: parallel instances support, extend unit tests
-    - tests: normalize tests
-    - snapstate: make InstallPath() return *snap.Info too
-    - snap: add ByType sorting
-    - interfaces: add cifs-mount interface
-    - tests: use file based markers in snap-service-stop-mode
-    - osutil: reorg and stub out things to get it building on darwin
-    - tests/main/layout: cleanup after the test
-    - osutil/sys: small tweaks to let it build on darwin
-    - daemon, overlord/snapstate: set instance name when installing from
-      snap file
-    - many: move Uname to osutil, for more DRY and easier porting.
-    - cmd/snap: create snap user directory when running parallel
-      installed snaps
-    - cmd/snap-confine: switch to validation of SNAP_INSTANCE_NAME
-    - tests: basic test for parallel installs from the store
-    - image: download the gadget from the model.GadgetTrack()
-    - snapstate: add support for gadget tracks in model assertion
-    - image: add support for "gadget=track"
-    - overlord: handle sigterm during shutdown better
-    - tests: add the original function to fix the errors on new kernels
-    - tests/main/lxd: pull lxd from candidate; reënable i386
-    - wayland: add extra sockets that are used by older toolkits (e.g.
-      gtk3)
-    - asserts: add support for gadget tracks in the model assertion
-    - overlord/snapstate: improve feature flag validation
-    - tests/main/lxd: run ubuntu-16.04 only on 64 bit variant
-    - interfaces: workaround for activated services and newer DBus
-    - tests: get the linux-image-extra available for the current kernel
-    - interfaces: add new "sysfs-name" to i2c interfaces code
-    - interfaces: disconnect hooks
-    - cmd/libsnap: unify detection of core/classic with go
-    - tests: fix autopkgtest failures in cosmic
-    - snap: fix advice json
-    - overlord/snapstate: parallel snap install
-    - store: backward compatible instance-key handling for non-instance
-      snaps
-    - interfaces: add screencast-legacy for video and audio recording
-    - tests: skip unsupported architectures for fedora-base-smoke test
-    - tests: avoid using the journalctl cursor when it has not been
-      created yet
-    - snapstate: ensure normal snaps wait for the "snapd" snap on
-      refresh
-    - tests: enable lxd again everywhere
-    - tests: new test for udisks2 interface
-    - interfaces: add cpu-control for setting CPU tunables
-    - overlord/devicestate: fix tests, set seeded in registration
-      through proxy tests
-    - debian: add missing breaks on cosmic
-    - devicestate: only run device-hook when fully seeded
-    - seccomp: conditionally add socketcall() based on system and base
-    - tests: new test for juju client observe interface
-    - overlord/devicestate: DTRT w/a snap proxy to reach a serial vault
-    - snapcraft: set version information for the snapd snap
-    - cmd/snap, daemon: error out if trying to install a snap using
-      empty name
-    - hookstate: simplify some hook tests
-    - cmd/snap-confine: extend security tag validation to cover instance
-      names
-    - snap: fix mocking of systemkey in snap-run tests
-    - packaging/opensuse: fix static build of snap-update-ns and snap-
-      exec
-    - interfaces/builtin: addtl network-manager resolved DBus fix
-    - udev: skip TestParseUdevEvent on ppc
-    - interfaces: miscellaneous policy updates
-    - debian: add tzdata to build-dep to ensure snapd builds correctly
-    - cmd/libsnap-confine-private: intoduce helpers for validating snap
-      instance name and instance key
-    - snap,snap-exec: support command-chain for app
-    - interfaces/builtin: network-manager resolved DBus changes
-    - snap: tweak `snap wait` command
-    - cmd/snap-update-ns: introduce validation of snap instance names
-    - cmd/snap: fix some corner-case test setup weirdness
-    - cmd,dirs: fix various issues discovered by a Fedora base snap
-    - tests/lib/prepare: fix extra snaps test
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 24 Oct 2018 11:30:45 -0600
-
-snapd (2.35.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - interfaces/home: don't allow snaps to write to $HOME/bin
-    - osutil: workaround overlayfs on ubuntu 18.10
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 15 Oct 2018 22:23:02 +0200
-
-snapd (2.35.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - wrappers: do not depend on network.taget in socket units, tweak
-      generated units
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Oct 2018 14:41:33 +0200
-
-snapd (2.35.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - overlord: don't make become-operational interfere with user
-      requests
-    - docker_support.go: add rules to read apparmor macros
-    - interfaces/apparmor: handle overlayfs snippet for snap-update-
-      nsFixes:
-    - snapcraft.yaml: add workaround to fix snapcraft build
-    - interfaces/opengl: misc accesses for VA-API
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Oct 2018 09:32:00 +0200
-
-snapd (2.35.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - cmd,overlord/snapstate: go 1.11 format fixes
-    - ifacestate: fix hang when retrying content providers
-    - snap-env-generator: do nothing when PATH is unset
-    - interfaces/modem-manager: allow access to more USB strings
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 12 Sep 2018 09:32:00 +0200
-
-snapd (2.35.1) xenial; urgency=medium
-
-  *  New upstream release, LP: #1786438
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - snapcraft: do not use --diry in mkversion.sh
-    - cmd: add systemd environment generator
-    - snap-confine: map /var/lib/extrausers into snaps mount-namespace
-    - tests: cherry-pick test fixes from master for 2.35
-    - systemd: do not run "snapd.snap-repair.service.in on firstboot
-      bootstrap
-    - interfaces: retain order of inserted security backends
-    - selftest: detect if apparmor is unusable and error
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 03 Sep 2018 14:44:06 +0200
-
-snapd (2.35) xenial; urgency=medium
-
-  * New upstream release, LP: #1786438
-    - snapstate: add support for gadget tracks in model assertion
-    - image: add support for "gadget=track"
-    - asserts: add support for gadget tracks in the model assertion
-    - interfaces: add new "sysfs-name" to i2c interfaces code
-    - overlord: handle sigterm during shutdown better
-    - wayland: add extra sockets that are used by older toolkits
-    - snap: fix advice json
-    - tests: fix autopkgtest failures in cosmic
-    - store: backward compatible instance-key handling for non-instance
-      snaps
-    - snapstate: ensure normal snaps wait for the "snapd" snap on
-      refresh
-    - interfaces: add cpu-control for setting CPU tunables
-    - debian: add missing breaks on comisc
-    - overlord/devicestate: DTRT w/a snap proxy to reach a serial vault
-    - devicestate: only run device-hook when fully seeded
-    - seccomp: conditionally add socketcall() based on system and base
-    - interfaces/builtin: addtl network-manager resolved DBus fix
-    - hookstate: simplify some hook tests
-    - udev: skip TestParseUdevEvent on ppc
-    - interfaces: miscellaneous policy updates
-    - debian: add tzdata to build-dep to ensure snapd builds correctly
-    - interfaces/builtin: network-manager resolved DBus changes
-    - tests: add spread test for fedora29 base snap
-    - cmd/libsnap: treat distributions with VARIANT_ID=snappy as "core"
-    - dirs: fix SnapMountDir inside a Fedora base snap
-    - tests: fix snapd-failover for core18 with external backend
-    - overlord/snapstate: always clean SnapState when doing Get()
-    - overlod/ifacestate: always use a new SnapState when fetching the
-      snap state
-    - overlord/devicestate: have the serial request talk to the proxy if
-      set
-    - interfaces/hotplug: udevadm output parser
-    - tests: New test for daemon-notify interface
-    - image: ensure "core" is ordered early if base: and core is used
-    - cmd/snap-confine: snap-device-helper parallel installs support
-    - tests: enable interfaces-framebuffer everywhere
-    - tests: reduce nc wait time from 2 to 1 second
-    - snap/snapenv: add snap instance specific variables
-    - cmd/snap-confine: add minimal test for snap-device-helper
-    - tests: enable snapctl test on core18
-    - overlord: added UDevMonitor for future hotplug support
-    - wrappers: do not glob when removing desktop files
-    - tests: add dbus monitor log to interfaces-accounts-service
-    - tests: add core-18 systems to external backend
-    - wrappers: account for changed app wrapper in parallel installed
-      snaps
-    - wrappers: make sure that the tests pass on non-Ubuntu too
-    - many: add snapd snap failure handling
-    - tests: new test for dvb interface
-    - configstate: accept refresh.timer=managed
-    - tests: new test for snap logs command
-    - wrapper: generate all the snapd unit files when generating
-      wrappers
-    - store: keep all files with link-count > 1 in the cache
-    - store: be less verbose in the common refresh case of "no updates"
-    - snap-confine: update snappy-app-dev path
-    - debian: ensure dependency on fixed apt on 18.04
-    - snapd: add initial software watchdog for snapd
-    - daemon, systemd: change journalctl -n=all to --no-tail
-    - systemd: fix snapd.apparmor.service.in dependencies
-    - snapstate: refuse to remove bases or core if snaps need them
-    - snap: introduce package-level helpers for building snap related
-      directory/file paths
-    - overlord/devicestate: deny parallel install of kernel or gadget
-      snaps
-    - store: clean up parallel-install TODOs in store tests
-    - timeutil: fix first weekday of the month schedule
-    - interfaces: match all possible tty but console
-    - tests: shellchecks part 5
-    - cmd/snap-confine: allow ptrace read for 4.18 kernels
-    - advise: make the bolt database do the atomic rename dance
-    - tests/main/apt-hooks: debug dump of commands.db
-    - tests/lib/prepare-restore: update Arch Linux kernel LOCALVERSION
-      handling
-    - snap: validate instance name as part of Validate()
-    - daemon: if a snap is inactive, don't ask systemd about its
-      services.
-    - udev: skip TestParseUdevEvent on s390x
-    - tests: switch core-amd64-18 to use `kernel: pc-kernel=18`
-    - asserts,image: add support for new kernel=track syntax
-    - tests: new gce image for fedora 27
-    - interfaces/apparmor: use the cache in mtime-resilient way
-    - store, overlord/snapstate: introduce instance name in store APIs
-    - tests: drive-by cleanup of redudant pkgname matching
-    - tests: ensure apt-hook is only run after catalog update ran
-    - tests: use pkill instead of kilall
-    - tests/main: another bunch of updates for Amazon Linux 2
-    - tests/lib/snaps: avoid using relative command paths that go up in
-      the  directory tree
-    - tests: disable/fix more tests for Amazon Linux 2
-    - overlord: introduce InstanceKey to SnapState and SnapSetup,
-      renames
-    - daemon: make sure most change generating handlers can produce
-      errors with kinds
-    - tests/main/interfaces-calendar-service: skip the test on AMZN2
-    - tests/lib/snaps: avoid using relative command paths that go up in
-      the directory tree
-    - cmd/snap: add a green check mark to verified publishers
-    - cmd/snap: fix two issues in the cmd/snap unit tests
-    - packaging/fedora: fix target path of /snap symlink
-    - cmd/snap: support `--last=<type>?` to mean "no error on empty"
-    - cmd/snap-confine: (nvidia) pick up libnvidia-glvkspirv.so
-    - strutil: detect and bail out of Unmarshal on duplicate key
-    - packaging/fedora(amzn2): disable SELinux, drop dependency on
-      squashfuse for AMZN2
-    - spread, tests: add support for Amazon Linux 2
-    - packaging/fedora: Add Amazon Linux 2 support
-    - many: make Wait/Stop optional on StateManagers
-    - snap/squashfs: stop printing unsquashfs info to stderr
-    - snap: add support for `snap advise-snap --from-apt`
-    - overlord/ifacestate: ignore connect if already connected
-    - tests: change the service snap used instead of network-bind-
-      consumer
-    - interfaces/network-control: update for wpa-supplicant and ifupdown
-    - tests: fix raciness in stop mode tests
-    - logger: try to not have double dates
-    - debian: use deb-systemd-invoke instead of systemctl directly
-    - tests: run all main tests on core18
-    - many: finish sharing a single TaskRunner with all the the managers
-    - interfaces/repo: added AllHotplugInterfaces helper
-    - snapstate: ensure kernel-track is honored on switch/refresh
-    - overlord/ifacestate: support implicit slots on snapd
-    - image: add support for "kernel-track" in `snap prepare-image`
-    - tests: add test that ensures we do not boot any system in degraded
-      state
-    - tests: update tests to work on core18
-    - cmd/snap: check for typographic dashes in command
-    - tests: fix tests expecting old email address
-    - client: add some existing error kinds that were not listed in
-      client.go
-    - tests: add missing slots in classic and core provider test snaps
-    - overlord,daemon,cmd: re-map snap names around the edges of snapd
-    - tests: use install_local in snap-run-hooks
-    - coreconfig: add support for `snap set system network.disable-
-      ipv6`
-    - overlord/snapstate: dedupe default content providers
-    - osutil/udev: sync with upstream
-    - debian: do not ship snapd.apparmor.service on ubuntu
-    - overlord: have SnapManager use a passed in TaskRunner created by
-      Overlord
-    - many: streamline the generic conflict check mechanisms
-    - tests: remove unneeded setup code in snap-run-symlink
-    - cmd/snap: print unset license as "unset", instead of "unknown"
-    - asserts: add (optional) kernel-track to model assertion
-    - snap/squashfs, tests: pass -n[o-progress] to {mk,un}squashfs
-    - interfaces/pulseaudio: be clear that the interface allows playback
-      and record
-    - snap: support hook environment
-    - interfaces: fix typo "daemonNotify" (add missing "n")
-    - interfaces: tweak tests of daemon-notify, use common naming
-    - interfaces: allow invoking systemd-notify when daemon-notify is
-      connected
-    - store: make snap blobs be 0600
-    - interfaces,daemon: move JSON types to the daemon
-    - tests: prepare needs to handle bin/snapctl being a symlink
-    - tests: do not mask errors in interfaces-timezone-control (#5405)
-    - packaging: put snapctl into /usr/lib/snapd and symlink in usr/bin
-    - tests: add basic integration test for spread hold
-    - overlord/snapstate: improve PlugsOnly comment
-    - many: assorted shellcheck fixes
-    - store, daemon, client, cmd/snap: expose "scope", default to wide
-    - snapstate: allow setting "refresh.timer=managed"
-    - cmd/snap: display a link to data privacy notice for interactive
-      snap login
-    - client, cmd/snap: pass snap instance name when installing from
-      file
-    - cmd/snap: add 'debug paths' command
-    - snapstate: make sure all *link-*snap tasks carry a snap type and
-      further hints
-    - devicestate: fix race when refreshing a snap with snapd-control
-    - tests: fix tests on arch
-    - tests: start active system units on reset
-    - tests: new test for joystick interface
-    - tests: moving install of dependencies to pkgdb helper
-    - tests: enable new fedora image with test dependencies installed
-    - tests: start using the new opensuse image with test dependencies
-    - tests: check catalog refresh before and after restart snapd
-    - tests: stop restarting journald service on prepare
-    - interfaces: make core-support a no-op interface
-    - interfaces: prefer "snapd" when resolving implicit connections
-    - interfaces/hotplug: add hotplug Specification and
-      HotplugDeviceInfo
-    - many: lessen the use of core-support
-    - tests: fixes for the autopkgtest failures in cosmic
-    - tests: remove extra ' which breaks interfaces-bluetooth-control
-      test
-    - dirs: fix antergos typo
-    - tests: use grep to avoid non-matching messages from MATCH
-    - dirs: improve distro detection for Antegros
-    - vendor: switch to latest bson
-    - interfaces/builtin: create can-bus interface
-    - tests: "snap connect" is idempotent so just connect
-    - many: use extra "releases" information on store "revision-not-
-      found" errors to produce better errors
-    - interfaces: treat "snapd" snap as type:os
-    - interfaces: tweak tests to have less repetition of "core" and
-      "ubuntu…
-    - tests: simplify econnreset test
-    - snap: add helper for renaming slots
-    - devicestate: fix panic in firstboot code when no snaps are seeded
-    - tests: add artful for sru validation on google backend
-    - snap,interfaces: move interface name validation to snap
-    - overlord/snapstate: introduce path to fake backend ops
-    - cmd/snap-confine: fix snaps running on core18
-    - many: expose publisher's validation throughout the API
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 20 Aug 2018 12:36:33 +0200
-
-snapd (2.34.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - interfaces/apparmor: use the cache in mtime-resilient way
-    - cmd/snap-confine: (nvidia) pick up libnvidia-glvkspirv.so
-    - snapstate: allow setting "refresh.timer=managed"
-    - spread: switch Fedora and openSUSE images
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 27 Jul 2018 19:08:44 +0200
-
-snapd (2.34.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - packaging: fix bogus date in fedora snapd.spec
-    - tests: fix tests expecting old email address
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 Jul 2018 12:05:50 +0200
-
-snapd (2.34.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - tests: cherry-pick test fixes from master for 2.34
-    - coreconfig: add support for `snap set system network.disable-
-      ipv6`
-    - debian: do not ship snapd.apparmor.service on ubuntu
-    - overlord/snapstate: dedupe default content providers
-    - interfaces/builtin: create can-bus interface
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 17 Jul 2018 19:46:56 +0200
-
-snapd (2.34) xenial; urgency=medium
-
-  * New upstream release, LP: #1779403
-    - store, daemon, client, cmd/snap: expose "scope", default to wide*
-    - tests: fix arch tests
-    - snapstate: make sure all *link-*snap tasks carry a snap type and
-      further hints
-    - snapstate: allow setting "refresh.timer=managed"
-    - cmd/snap: display a link to data privacy notice for interactive
-      snap login
-    - devicestate: fix race when refreshing a snap with snapd-control
-    - tests: skip interfaces-framebuffer when no /dev/fb0 is found
-    - tests: run interfaces-contacts-service only where test-snapd-eds
-      is available
-    - many: expose publisher's validation throughout the API
-    - many: use extra "releases" information on store "revision-not-
-      found" errors to produce better errors
-    - dirs: improve distro detection for Antegros
-    - Revert "dirs: improve identification of Arch Linux like systems"
-    - devicestate: fix panic in firstboot code when no snaps are seeded
-    - i18n: use xgettext-go --files-from to avoid running into cmdline
-      size limits
-    - interfaces: move ValidateName helper to utils
-    - snapstate,ifstate: wait for pending restarts before auto-
-      connecting
-    - snap: account for parallel installs in wrappers, place info and
-      tests
-    - configcore: fix incorrect handling of keys with numbers (like
-      gpu_mem_512)
-    - tests: fix tests when no keyboard input detected
-    - overlord/configstate: add watchdog options
-    - snap-mgmt: fix for non-existent dbus system policy dir,
-      shellchecks
-    - tests/main/snapd-notify: use systemd's service properties rater
-      than the journal
-    - snapstate: allow removal of snap.TypeOS when using a model with a
-      base
-    - interfaces: make findSnapdPath smarter
-    - tests: run "arp" tests only if arp is available
-    - spread: increase the number of auto retries for package downloads
-      in opensuse
-    - cmd/snap-confine: fix nvidia support under lxd
-    - corecfg: added experimental.hotplug feature flag
-    - image: block installation of parallel snap instances
-    - interfaces: moved normalize method to interfaces/utils and made it
-      public
-    - api/snapctl: allow -h and --help for regular users.
-    - interfaces/udisks2: also implement implicit classic slot
-    - cmd/snap-confine: include CUDA runtime libraries
-    - tests: disable auto-refresh test on core18
-    - many: switch to account validation: unproven|verified
-    - overlord/ifacestate: get/set connection state only via helpers
-    - tests: adding extra check to validate journalctl is showing
-      current test data
-    - data: add systemd environment configuration
-    - i18n: handle write errors in xgettext-go
-    - snap: helper for validating snap instance names
-    - snap{/snaptest}: set instance key based on snap name
-    - userd: fix running unit tests on KDE
-    - tests/main/econnreset: limit ingress traffic to 512kB/s
-    - snap: introduce a struct Channel to represent store channels, and
-      helpers to work with it
-    - tests: add fedora to distro_clean_package_cache function
-    - many: rename snap.Info.StoreName() to snap.Info.SnapName()
-    - tests: add spread test to ensure snapd/core18 are not removable
-    - tests: tweaks for running the main tests on core18
-    - overlord/{config,snap}state: introduce experimental.parallel-
-      instances feature flag
-    - strutil: support iteration over almost clean paths
-    - strutil: add PathIterator.Rewind
-    - tests: update interfaces-timeserver-control to core18
-    - tests: add halt-timeout to google backend
-    - tests: skip security-udev-input-subsystem without /dev/input/by-
-      path
-    - snap: introduce the instance key field
-    - packaging/opensuse: remaining packaging updates for 2.33.1
-    - overlord/snapstate: disallow installing snapd on baseless models
-    - tests: disable core tests on all core systems (16 and 18)
-    - dirs: improve identification of Arch Linux like systems
-    - many: expose full publisher info over the snapd API
-    - tests: disable core tests on all core systems (16 and 18)
-    - tests/main/xdg-open: restore or clean up xdg-open
-    - tests/main/interfaces-firewall-control: shellcheck fix
-    - snapstate: sort "snapd" first
-    - systemd: require snapd.socket in snapd.seeded.service; make sure
-      snapd.seeded
-    - spread-shellcheck: use the latest shellcheck available from snaps
-    - tests: use "ss" instead of "netstat" (netstat is not available in
-      core18)
-    - data/complete: fix three out of four shellcheck warnings in
-      data/complete
-    - packaging/opensuse: fix typo, missing assignment
-    - tests: initial core18 spread image building
-    - overlord: introduce a gadget-connect task and use it at first boot
-    - data/completion: fix inconsistency in +x and shebang
-    - firstboot: mark essential snaps as "Required" in the state
-    - spread-shellcheck: use a whitelist of files that are allowed to
-      fail validation
-    - packaging/opensuse: build position-independent binaries
-    - ifacestate: prevent running interface hooks twice when self-
-      connecting on autoconnect
-    - data: remove /bin/sh from snapd.sh
-    - tests: fix shellcheck 0.5.0 warnings
-    - packaging/opensuse: snap-confine should be 06755
-    - packaging/opensuse: ship apparmor integration if enabled
-    - interfaces/udev,misc: only trigger udev events on input subsystem
-      as needed
-    - packaging/opensuse: add missing bits for snapd.seeded.service
-    - packaging/opensuse: don't use %-macros in comments
-    - tests: shellchecks part 4
-    - many: rename snap.Info.Name() to snap.Info.InstanceName(), leave
-      parallel-install TODOs
-    - store: drop unused: channel map types, and details fixture.
-    - store: have a basic test about the unmarshalling of /search
-      results
-    - tests: show executed tests on current system when a test fails
-    - tests: fix for the download of the big snap
-    - interfaces/apparmor: add chopTree
-    - tests: remove double debug: | entry in tests and add more checks
-    - cmd/snap-update-ns: introduce mimicRequired helper
-    - interfaces: move assertions around for better failure line number
-    - store: log a nice clear "download succeeded" message
-    - snap: run snap-confine from the re-exec location
-    - snapstate: support restarting snapd from the snapd snap on core18
-    - tests: show status of the partial test-snapd-huge snap in
-      econnreset test
-    - tests: fix interfaces-calendar-service test when gvfsd-metadata
-      loks the xdg dirctory
-    - store: switch store.SnapInfo to use the new v2/info endpoint
-    - interfaces: add Repository.AllInterfaces
-    - snapstate: stop using evolving SnapSpec internally, use an
-      internal-only snapSpec instead
-    - cmd/libsnap-confine-private: introduce a helper for splitting snap
-      name
-    - tests: econnreset/retry tweaks
-    - store, et al: kill dead code that uses the bulk endpoint
-    - tests/lib/prepare-restore: fix upgrade/reboot handling on arch
-    - cmd/snap-update-ns,strutil: move PathIterator to strutil, add
-      Depth helper
-    - data/systemd/snapd.run-from-snap: ensure snapd tooling is
-      available
-    - store: switch connectivity check to use v2/info
-    - devicestate: support seeding from a base snap instead of core
-    - snapstate,ifacestate: remove core-phase-2 handling
-    - interfaces/docker-support: update for docker 18.05
-    - tests: enable fedora 28 again
-    - overlord/ifacestate:  simplify checkConnectConflicts and also
-      connect signature
-    - snap: parse connect instructions in gadget.yaml
-    - tests: fix snapd-repair.timer on ubuntu-core-snapd-run- from-snap
-      test
-    - interfaces/apparmor: allow killing snap-update-ns
-    - tests: skip "try" test on s390x
-    - store, image: have 'snap download' use v2/refresh action=download
-    - interfaces/policy: test that base policy can be parsed
-    - tests: publish test-snapd-appstreamid for any architecture
-    - snap: don't include newline in hook environment
-    - cmd/snap-update-ns: use RCall with SyscallsEqual
-    - cmd/snap-update-ns: add IsSnapdCreatedPrivateTmpfs and tests
-    - tests: skip security-dev-input-event-denied on s390x/arm64
-    - interfaces: add the dvb interface
-    - daemon: paging is not a thing.
-    - cmd/snap-mgmt: remove system key on purge
-    - testutil: syscall sequence checker
-    - cmd/snap-update-ns: fix a leaking file descriptor in MkSymlink
-    - packaging: use official bolt in the errtracker on fedora
-    - many: add `snap debug connectivity` command* many: add `snap debug
-      connectivity` command
-    - configstate: deny configuration of base snaps and for the "snapd"
-      snap
-    - interfaces/raw-usb: also allow usb serial devices
-    - snap: reject more layout locations
-    - errtracker: do not send duplicated reports
-    - httputil: extra debug if an error is not retried
-    - cmd/snap-update-ns: improve wording in many errors
-    - cmd/snap: use snaptest.MockSnapCurrent in `snap run` tests
-    - cmd/snap-update-ns: add helper for checking for read-only
-      filesystems
-    - interfaces/builtin/docker: use commonInterface over specific
-      struct
-    - testutil: add test support for Fstatfs
-    - cmd/snap-update-ns: discard the concept of segments
-    - cmd/libsnap-confine-private: helper for extracting store snap name
-      from local-name
-    - tests: fix flaky test for hooks undo
-    - interfaces: add {contacts,calendar}-service interfaces
-    - tests: retry 'restarting into..' match in the snap-confine-from-
-      core test
-    - systemd: adjust TestWriteMountUnitForDirs() to use
-      squashfs.MockUseFuse(false)
-    - data: add helper that can generate/start/stop the snapd service
-    - sefltest: advise reboot into 4.4 on trusty running 3.13
-    - selftest: add new selftest package that tests squashfs mounting
-    - store, jsonutil: move store.getStructFields to
-      jsonutil.StructFields
-    - ifacestate: improved conflict and error handling when creating
-      autoconnect tasks
-    - cmd/snap-confine: applied make fmt
-    - interfaces/udev: call 'udevadm settle --timeout=10' after
-      triggering events
-    - tests: wait more time until snap start to be downloaded on
-      econnreset test
-    - snapstate: ensure fakestore returns TypeOS for the core snap
-    - tests: fix lxd test which hangs on restore
-    - cmd/snap-update-ns: add PathIterator
-    - asserts,image: add support for models with bases
-    - tests: shellchecks part 3
-    - overlord/hookstate: support undo for hooks
-    - interfaces/tpm: Allow access to the kernel resource manager
-    - tests: skip appstream-id test for core systems 32 bits
-    - interfaces/home: remove redundant common interface assignment
-    - tests: reprioritise a few tests that are known to be slow
-    - cmd/snap: small help tweaks and fixes
-    - tests: add test to ensure /dev/input/event* for non-joysticks is
-      denied
-    - spread-shellcheck: silly fix & pep8
-    - spread: switch fedora 28 to manual
-    - client,cmd/snap,daemon,tests: expose base of a snap over API, show
-      it in snap info --verbose
-    - tests: fix lxd test - --auto now sets up networking
-    - tests: adding fedora-28 to spread.yaml
-    - interfaces: add juju-client-observe interface
-    - client, daemon: add a "mounted-from" entry to local snaps' JSON
-    - image: set model.DisplayName() in bootenv as "snap_menuentry"
-    - packaging/opensuse: Refactor packaging to support all openSUSE
-      targets
-    - interfaces/joystick: force use of the device cgroup with joystick
-      interface
-    - interfaces/hardware-observe: allow access to /etc/sensors* for
-      libsensors
-    - interfaces: remove Plug/Slot types
-    - interface hooks: update old AutoConnect methods
-    - snapcraft: run with DEB_BUILD_OPTIONS=nocheck
-    - overlord/{config,snap}state: the number of inactive revisions is
-      config
-    - cmd/snap: check with snapd for unknown sections
-    - tests: moving test helpers from sh to bash
-    - data/systemd: add snapd.apparmor.service
-    - many: expose AppStream IDs (AKA common ID)
-    - many: hold refresh when on metered connections
-    - interfaces/joystick: also support modern evdev joysticks and
-      gamepads
-    - xdgopenproxy: skip TestOpenUnreadableFile when run as root
-    - snapcraft: use dpkg-buildpackage options that work in xenial
-    - spread: openSUSE LEAP 42.2 was EOLd in January, remove it
-    - get-deps: work with an unset GOPATH too
-    - interfaces/apparmor: use strict template on openSUSE tumbleweed
-    - packaging: filter out verbose flags from "dh-golang"
-    - packaging: fix description
-    - snapcraft.yaml: add minimal snapcraft.yaml with custom build
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 06 Jul 2018 16:08:17 +0200
-
-snapd (2.33.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1773118
-    - many: improve udev trigger on refresh experience
-    - systemd: require snapd.socket in snapd.seeded.service
-    - snap: don't include newline in hook environment
-    - interfaces/apparmor: allow killing snap-update-ns
-    - tests: skip "try" test on s390x
-    - tests: skip security-dev-input-event-denied when /dev/input/by-
-      path/ is missing
-    - tests: skip security-dev-input-event-denied on s390x/arm64
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 21 Jun 2018 17:37:56 +0200
-
-snapd (2.33) xenial; urgency=medium
-
-  * New upstream release, LP: #1773118
-    - packaging: use official bolt in the errtracker on fedora
-    - many: add `snap debug connectivity` command
-    - interfaces/raw-usb: also allow usb serial devices
-    - errtracker: do not send duplicated reports
-    - selftest: add new selftest package that tests squashfs mounting
-    - tests: backport lxd force stop and econnreset fixes
-    - tests: add test to ensure /dev/input/event* for non-joysticks is
-      denied
-    - interfaces/joystick: support modern evdev joysticks
-    - interfaces: add juju-client-observe
-    - interfaces/hardware-observe: allow access to /etc/sensors* for
-      libsensors
-    - many: holding refresh on metered connections
-    - many: expose AppStream IDs (AKA common ID)
-    - tests: speed up save/restore snapd state for all-snap systems
-      during tests execution
-    - interfaces/apparmor: use helper to load stray profile
-    - tests: ubuntu core abstraction
-    - overlord/snapstate: don't panic in a corner case interaction of
-      cleanup tasks and pruning
-    - interfaces/apparmor: add 'mediate_deleted' profile flag for all
-      snaps
-    - tests: new parameter for the journalctl rate limit
-    - spread-shellcheck: port to python
-    - interfaces/home: add 'read' attribute to allow non-owner read to
-      @{HOME}
-    - testutil: import check.v1 differently to workaround gccgo error
-    - interfaces/many: miscellaneous updates for default, desktop,
-      desktop-legacy, system-observe, hardware-observe, opengl and gpg-
-      keys
-    - snapstate/hooks: reorder autoconnect and reconnect hooks
-    - daemon: update unit tests to match current master
-    - overlord/snapshotstate/backend: introducing the snapshot backend
-    - many: support 'system' nickname in interfaces
-    - userd: add the "snap" scheme to the whitelist
-    - many: make rebooting of core on refresh immediate, refactor logic
-      around it
-    - tests/main/snap-service-timer: account for service timer being in
-      the 'running' state
-    - interfaces/builtin: allow access to libGLESv* too for opengl
-      interface
-    - daemon: fix unit tests on arch
-    - interfaces/default,process-control: miscellaneous signal policy
-      fixes
-    - interfaces/bulitin: add write permission to optical-drive
-    - configstate: validate known core.* options
-    - snap, wrappers: systemd WatchdogSec support
-    - ifacestate: do not auto-connect manually disconnected interfaces
-    - systemd: mock useFuse() so testsuite passes in container via lxd
-      snap
-    - snap/env: fix env duplication logic
-    - snap: some doc comments fixes and additions
-    - cmd/snap-confine, interfaces/opengl: allow access to glvnd EGL
-      vendor files
-    - ifacestate: unify reconnect and autoconnect methods
-    - tests: fix user mounts test for external systems
-    - overlord/snapstate,overlord/auth,store: coalesce no auth user
-      refresh requests
-    - boot,partition: improve tests/docs around SetNextBoot()
-    - many: improve `snap wait` command
-    - snap: fix `snap interface --attrs` output when numbers are used
-    - cmd/snap-update-ns: poke holes when creating source paths for
-      layouts
-    - snapstate: support getting new bases/default-providers on refresh
-    - ifacemgr: remove stale connections on startup
-    - asserts: use Attrer in policy checks
-    - testutil: record system call errors / return values
-    - tests: increase timeouts to make tests reliable on slow boards
-    - repo: pass and return ConnRef via pointers
-    - interfaces: add xdg-document-portal support to desktop interface
-    - debian: add a zenity|kdialog suggests
-    - snapstate: make TestDoPrereqRetryWhenBaseInFlight less brittle
-    - tests: go must be installed as a classic snap
-    - tests: use journalctl cursors instead rotating logs
-    - daemon: add confinement-options to /v2/system-info
-      daemon: refactor classic support flag to be more structured
-    - tests: build spread in the autopkgtests with a more recent go
-    - cmd/snap: fix the message when snap.channel != snap.tracking
-    - overlord/snapstate: allow core defaults configuration via 'system'
-      key
-    - many: add "snap debug sandbox-features" and needed bits
-    - interfaces: interface hooks for refresh
-    - snapd.core-fixup.sh: add workaround for corrupted uboot.env
-    - boot: clear "snap_mode" when needed
-    - many: add wait command and `snapd.seeded` service
-    - interfaces: move host font update-ns AppArmor rules to desktop
-      interface
-    - jsonutil/safejson: introducing safejson.String &
-      safejson.Paragraph
-    - cmd/snap-update-ns: use Secure.BindMount to bind mount files
-    - cmd/snap-update-ns,tests: mimic the mode and ownership of
-      directories
-    - cmd/snap-update-ns: add support for ignoring mounts with missing
-      source/target
-    - interfaces: interface hooks implementation
-    - cmd/libsnap: fix compile error on more restrictive gcc
-      cmd/libsnap: fix compilation errors on gcc 8
-    - interfaces/apparmor: allow bash and dash to be in /usr/bin/
-    - cmd/snap-confine: allow any base snap to provide /etc/alternatives
-    - tests: fix interfaces-network test for systems with partial
-      confinement
-    - spread.yaml: add cosmic (18.10) to autopkgtest/qemu
-    - tests: ubuntu 18.04 or higher does not need linux-image-extra-
-    - configcore: validate experimental.layouts option
-    - interfaces:minor autoconnect cleanup
-    - HACKING: fix typos
-    - spread: add adt for ubuntu 18.10
-    - tests: skip test lp-1721518 for arch, snapd is failing to start
-      after reboot
-    - interfaces/x11: allow X11 slot implementations
-    - tests: checking interfaces declaring the specific interface
-    - snap: improve error for snaps not available in the given context
-    - cmdstate: add missing test for default timeout handling
-    - tests: shellcheck spread tasks
-    - cmd/snap: update install/refresh help vs --revision
-    - cmd/snap-confine: add support for per-user mounts
-    - snap: do not use overly short timeout in `snap
-      {start,stop,restart}`
-    - tests: adding google-sru backend replacing linode-sur
-    - interfaces/apparmor: fix incorrect apparmor profile glob
-    - systemd: replace ancient paths with 16.04+ standards
-    - overlord,systemd: store snap revision in mount units
-    - testutil: add test helper for SysLstat
-    - testutil,cmd: rename test helper of Lstat to OsLstat
-    - testutil: document all fake syscall/os functions
-    - osutil,interfaces,cmd: use less hardcoded strings
-    - testutil: rename UNMOUNT_NOFOLLOW to umountNoFollow
-    - testutil: don't dot-import check.v1
-    - store: getStructFields takes pointers now
-    - tests: drop `linux-image-extra-$(uname -r)` install in 18.04
-    - many: fix false negatives reported by vet
-    - osutil,interfaces: use uint32 for uid, gid
-    - many: fix various issues reported by shellcheck
-    - tests: add pending shutdown detection
-    - image: support refreshing soft-expired user macaroons in tooling
-    - interfaces/builtin, daemon: cleanup mocked builtin interfaces in
-      daemon tests
-    - interfaces/builtin: add support for software-watchdog interface
-    - spread: auto accept key changes when calling dnf
-    - snap,overlord/snapstate: introduce and use BrokenSnapError
-    - tests: detect kernel oops during tests and abort tests in this
-      case
-    - tests: bring back one missing test in snap-service-stop-mode
-    - debian: update LP bug for the 2.32.5 SRU
-    - userd: set up journal logging streams for autostarted apps
-    - snap,tests : don't fail if we cannot stat MountFile
-    - tests: smaller fixes for Arch tests
-    - tests: run interfaces-broadcom-asic-control early
-    - client: support for snapshot sets, snapshots, and snapshot actions
-    - tests: skip interfaces-content test on core devices
-    - cmd: generalize locking to global, snap and per-user locks
-    - release-tools: handle the snapd-x.y.z version
-    - packaging: fix incorrectly auto-generated changelog entry for
-      2.32.5
-    - tests: add arch to CI
-    - systemd: add helper for opening stream file descriptors to the
-      journal
-    - cmd/snap: handle distros with no version ID
-    - many: add "stop-mode: sig{term,hup,usr[12]}{,-all}" instead of
-      conflating that with refresh-mode
-    - tests: removing linode-sru backend
-    - tests: updating bionic version for spread tests on google
-    - overlord/snapstate: poll for up to 10s if a snap is unexpectedly
-      not mounted in doMountSnap
-    - overlord/snapstate: allow to get an error from readInfo instead of
-      a broken stub, use it in doMountSnap
-    - snap: snap.AppInfo is now a fmt.Stringer
-    - tests: move fedora 27 to google backend
-    - many: add `core.problem-reports.disabled` option
-    - cmd/snap-update-ns: remove the need for stash directory in secure
-      bind mount implementation
-    - errtracker: check for whoopsie.service instead of reading
-      /etc/whoopsie
-    - cmd/snap: user session application autostart v3
-    - tests: add test to ensure `snap refresh --amend` works with
-      different channels
-    - tests: add check for OOM error after each test
-    - cmd/snap-seccomp: graceful handling of non-multilib host
-    - interfaces/shutdown: allow calling SetWallMessage
-    - cmd/snap-update-ns: add secure bind mount implementation for use
-      with user mounts
-    - snap: fix `snap advise-snap --command` output to match spec
-    - overlord/snapstate: on multi-snap refresh make sure bases and core
-      are finished before dependent snaps
-    - overlord/snapstate: introduce envvars to control the channels for
-      based and prereqs
-    - cmd/snap-confine: ignore missing cgroups in snap-device-helper
-    - debian: add gbp.conf script to build snapd via `gbp buildpackage`
-    - daemon,overlord/hookstate: stop/wait for running hooks before
-      closing the snapctl socket
-    - advisor: use json for package database
-    - interfaces/hostname-control: allow setting the hostname via
-      syscall and systemd
-    - tests/main/interfaces-opengl-nvidia: verify access to 32bit
-      libraries
-    - interfaces: misc updates for default, firewall-control, fuse-
-      support and process-control
-    - data/selinux: Give snapd access to more aspects of the system
-    - many: use the new install/refresh API by switching snapstate to
-      use store.SnapAction
-    - errtracker: make TestJournalErrorSilentError work on gccgo
-    - ifacestate: add to the repo also snaps that are pending being
-      activated but have a done setup-profiles
-    - snapstate, ifacestate: inject auto-connect tasks try 2
-    - cmd/snap-confine: allow creating missing gl32, gl, vulkan dirs
-    - errtracker: add more fields to aid debugging
-    - interfaces: make system-key more robust against invalid fstab
-      entries
-    - overlord,interfaces: be more vocal about broken snaps and read
-      errors
-    - ifacestate: injectTasks helper
-    - osutil: fix fstab parser to allow for # in field values
-    - cmd/snap-mgmt: remove timers, udev rules, dbus policy files
-    - release-tools: add repack-debian-tarball.sh
-    - daemon,client: add build-id to /v2/system-info
-    - cmd: make fmt (indent 2.2.11)
-    - interfaces/content: add rule so slot can access writable files at
-      plug's mountpoint
-    - interfaces: add /var/lib/snapd/snap to @{INSTALL_DIR}
-    - ifacestate: don't surface errors from stale connections
-    - cmd/snap-update-ns: convert Secure* family of functions into
-      methods
-    - tests: adjust canonical-livepatch test on GCE
-    - tests: fix quoting issues in econnreset test
-    - cmd/snap-confine: make /run/media an alias of /media
-    - cmd/snap-update-ns: rename i to segNum
-    - interfaces/serial: change pattern not to exclude /dev/ttymxc*
-    - spread: disable StartLimitInterval option on opensuse-42.3
-    - configstate: give a chance to immediately recompute the next
-      refresh time when schedules are set
-    - cmd/snap-confine: attempt to detect if multiarch host uses
-      arch triplets
-    - store: add Store.SnapAction to support the new install/refresh API
-      endpoint
-    - tests: adding test for removable-media interface
-    - tests: update interface tests to remove extra checks and normalize
-      tests
-    - timeutil: in Human, count days with fingers
-    - vendor: update gopkg.in/yaml.v2 to the latest version
-    - cmd/snap-confine: fix Archlinux compatibility
-    - cmd/snapd: make sure signal handlers are established during early
-      daemon startup
-    - cmd/snap-confine: apparmor: allow creating prefix path for
-      gl/vulkan
-    - osutil: use tilde suffix for temporary files used for atomic
-      replacement
-    - tests: copy or sanity check core users using usernames
-    - tests: disentangle etc vs extrausers in core tests
-    - tests: fix snap-run tests when snapd is not running
-    - overlord/configstate: change how ssh is stopped/started
-    - snap: make `snap run` look at the system-key for security profiles
-    - strutil, cmd/snap: drop strutil.WordWrap, first pass at
-      replacement
-    - tests: adding opensuse-42.3 to google
-    - cmd/snap: fix one issue with noWait error handling logic, add
-      tests plus other cleanups
-    - cmd/snap-confine: nvidia: preserve globbed file prefix
-    - advisor: add comment why osutil.FileExists(dirs.SnapCommandsDB) is
-      needed
-    - interfaces,release: probe seccomp features lazily
-    - tests: change debug for layout test
-    - advisor: deal with missing commands.db file
-    - interfaces/apparmor: simplify UpdateNS internals
-    - polkit: Pass caller uid to PolicyKit authority
-    - tests: moving debian 9 from linode to google backend
-    - cmd/snap-confine: nvidia: add tls/libnvidia-tls.so* glob
-    - po: specify charset in po/snappy.pot
-    - interfaces: harden snap-update-ns profile
-    - snap: Call SanitizePlugsSlots from InfoFromSnapYaml
-    - tests: update tests to deal with s390x quirks
-    - debian: run snap.mount upgrade fixup *before* debhelper
-    - tests: move xenial i386 to google backend
-    - snapstate: add compat mode for default-provider
-    - tests: a bunch of test fixes for s390x from looking at the
-      autopkgtest logs
-    - packaging: recommend "gnupg" instead of "gnupg1 | gnupg"
-    - interfaces/builtin: let MM change qmi device attributes
-    - tests: add workaround for s390x failure
-    - snap/pack, cmd/snap: add `snap pack --check-skeleton`
-    - daemon: support 'system' as nickname of the core snap
-    - cmd/snap-update-ns: use x-snapd.{synthetic,needed-by} in practice
-    - devicestate: add DeviceManager.Registered returning a channel
-      closed when the device is known to be registered
-    - store: Sections and WriteCatalogs need to strictly send device
-      auth only if the device has a custom store
-    - tests: add bionic system to google backend
-    - many: fix shellcheck warnings in bionic
-    - cmd/snap-update-ns: don't fail on existing symlinks
-    - tests: make autopkgtest tests more targeted
-    - cmd/snap-update-ns: fix creation of layout symlinks
-    - spread,tests: move suite-level prepare/restore to central script
-    - many: propagate contexts enough to be able to mark store
-      operations done from the Ensure loop
-    - snap: don't create empty Change with "Hold" state on disconnect
-    - snap: unify snap name validation w/python; enforce length limit.
-    - cmd/snap: use shlex when parsing `snap run --strace` arguments
-    - osutil,testutil: add symlinkat(2) and readlinkat(2)
-    - tests: autopkgtest may have non edge core too
-    - tests: adding checks before stopping snapd service to avoid job
-      canceled on ubuntu 14.04
-    - errtracker: respect the /etc/whoopsie configuration
-    - overlord/snapstate:  hold refreshes for 2h after seeding on
-      classic
-    - cmd/snap: tweak and polish help strings
-    - snapstate: put layout feature behind feature flag
-    - tests: force profile re-generation via system-key
-    - snap/squashfs: when installing from seed, try symlink before cp
-    - wrappers: services which are socket or timer activated should not
-      be started during boot
-    - many: go vet cleanups
-    - tests: define MATCH from spread
-    - packaging/fedora: Merge changes from Fedora Dist-Git plus trivial
-      fix
-    - cmd/snap: use timeutil.Human to show times in `snap refresh
-      --time`
-    - cmd/snap: in changes and tasks, default to human-friendly times
-    - many: support holding refreshes by setting refresh.hold
-    - Revert "cmd/snap: use timeutil.Human to show times in `snap
-      refresh -…-time`"
-    - cmd/snap: use timeutil.Human to show times in `snap refresh
-      --time`
-    - tests/main/snap-service-refresh-mode: refactor the test to rely on
-      comparing PIDs
-    - tests/main/media-sharing: improve the test to cover /media and
-      /run/media
-    - store: enable deltas for core devices too
-    - cmd/snap: unhide --no-wait; make wait use go via waitMixin
-    - strutil/shlex: import github.com/google/shlex into the tree
-    - vendor: update github.com/mvo5/libseccomp-golang
-    - overlord/snapstate: block install of "system"
-    - cmd/snap: "current"→"installed"; "refreshed"→"refresh-date"
-    - many: add the snapd-generator
-    - cmd/snap-seccomp: Cancel the atomic file on error, not just Close
-    - polkit: ensure error is properly set if dialog is dismissed
-    - snap-confine, snap-seccomp: utilize new seccomp logging features
-    - progress: tweak ansimeter cvvis use to no longer confuse minicom
-    - xdgopenproxy: integrate xdg-open implementation into snapctl
-    - tests: avoid removing preinstalled snaps on core
-    - tests: chroot into core to run xdg-open there
-    - userd: add an OpenFile method for launching local files with xdg-
-      open
-    - tests: moving ubuntu core from linode to google backend
-    - run-checks: remove accidental bashism
-    - i18n: simplify NG usage by doing the modulo math in-package.
-    - snap/squashfs: set timezone when calling unsquashfs to get the
-      build date
-    - timeutil: timeutil.Human(t) gives a human-friendly string for t
-    - snap: add autostart app property
-    - tests: add support for external backend executions on listing test
-    - tests: make interface-broadcom-asic-control test work on rpi
-    - configstate: when disable "ssh" we must disable the "sshd" service
-    - interfaces/apparmor,system-key: add upperdir snippets for strict
-      snaps on livecd
-    - snap/squashfs: add BuildDate
-    - store: parse the JSON format used by the coming new store API to
-      convey snap information
-    - many: remove snapd.refresh.{timer,service}
-    - tests: adding ubuntu-14.04-64 to the google backend
-    - interfaces: add xdg-desktop-portal support to desktop interface
-    - packaging/arch: sync with snapd/snapd-git from AUR
-    - wrappers, tests/main/snap-service-timer: restore missing commit,
-      add spread test for timer services
-    - store: don't ask for snap_yaml_raw except on the details endpoint
-    - many: generate and use per-snap snap-update-ns profile
-    - tests: add debug for layout test
-    - wrappers: detect whether systemd-analyze can be used in unit tests
-    - osutil: allow creating strings out of MountInfoEntry
-    - servicestate: use systemctl enable+start and disable+stop instead
-      of --now flag
-    - osutil: handle file being matched by multiple patterns
-    - daemon, snap: fix InstallDate, make a method of *snap.Info
-    - wrappers: timer services
-    - wrappers: generator for systemd OnCalendar schedules
-    - asserts: fix flaky storeSuite.TestCheckAuthority
-    - tests: fix dependency for ubuntu artful
-    - spread: start moving towards google backend
-    - tests: add a spread test for layouts
-    - ifacestate: be consistent passing Retry.After as named field
-    - cmd/snap-update-ns: use recursive bind mounts for writable mimic
-    - testutil: allow mocking syscall.Fstat
-    - overlord/snapstate: verify that default schedule is randomized and
-      is  not a single time
-    - many: simplify mocking of home-on-NFS
-    - cmd/snap-update-ns: use syscall.Symlink instead of os.Symlink
-    - store: move infoFromRemote into details.go close to snapDetails
-    - userd/tests: Test kdialog calls and mock kdialog too to make tests
-      work in KDE
-    - cmd/snap: tweaks to 'snap info' (feat. installed->current rename)
-    - cmd/snap: add self-strace to `snap run`
-    - interfaces/screen-inhibit-control,network-status: fix dbus path
-      and interface typos
-    - update-pot: Force xgettext() to return true
-    - store: cleanup test naming, dropping remoteRepo  and
-      UbuntuStore(Repository)? references
-    - store: reorg auth refresh
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 08 Jun 2018 17:13:47 +0200
-
-snapd (2.32.9) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - tests: run all spread tests inside GCE
-    - tests: build spread in the autopkgtests with a more recent go
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 16 May 2018 10:20:08 +0200
-
-snapd (2.32.8) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - snapd.core-fixup.sh: fix workaround for corrupted uboot.env
-      and add tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 11 May 2018 14:36:16 +0200
-
-snapd (2.32.7) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - many: add wait command and seeded target (2
-    - snapd.core-fixup.sh: add workaround for corrupted uboot.env
-    - boot: clear "snap_mode" when needed
-    - cmd/libsnap: fix compile error on more restrictive gcc
-    - tests: cherry-pick commits to move spread to google backend
-    - spread.yaml: add cosmic (18.10) to autopkgtest/qemu
-    - userd: set up journal logging streams for autostarted apps
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 11 May 2018 13:09:32 +0200
-
-snapd (2.32.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1767833
-    - snap: do not use overly short timeout in `snap
-      {start,stop,restart}`
-    - interfaces/apparmor: fix incorrect apparmor profile glob
-    - tests: detect kernel oops during tests and abort tests in this
-      case
-    - tests: run interfaces-boradcom-asic-control early
-    - tests: skip interfaces-content test on core devices
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sun, 29 Apr 2018 19:21:53 +0200
-
-snapd (2.32.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1765090
-    - many: add "stop-mode: sig{term,hup,usr[12]}{,-all}" instead of
-      conflating that with refresh-mode
-    - overlord/snapstate:  poll for up to 10s if a snap is unexpectedly
-      not mounted in doMountSnap
-    - daemon: support 'system' as nickname of the core snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 16 Apr 2018 11:41:48 +0200
-
-snapd (2.32.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1756173
-    - cmd/snap: user session application autostart
-    - overlord/snapstate: introduce envvars to control the channels for
-      bases and prereqs
-    - overlord/snapstate: on multi-snap refresh make sure bases and core
-      are finished before dependent snaps
-    - many: use the new install/refresh /v2/snaps/refresh store API
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Apr 2018 16:30:45 +0200
-
-snapd (2.32.3.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1756173
-    - errtracker: make TestJournalErrorSilentError work on
-      gccgo
-    - errtracker: check for whoopsie.service instead of reading
-      /etc/whoopsie
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Apr 2018 12:40:09 +0200
-
-snapd (2.32.3.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1756173
-    - debian: add gbp.conf script to build snapd via `gbp
-      buildpackage`
-    - tests: add check for OOM error after each test
-    - cmd/snap-seccomp: graceful handling of non-multilib host
-    - interfaces/shutdown: allow calling SetWallMessage
-    - data/selinux: Give snapd access to more aspects of the system
-    - daemon,overlord/hookstate: stop/wait for running hooks before
-      closing the snapctl socket
-    - cmd/snap-confine: ignore missing cgroups in snap-device-helper
-    - interfaces: misc updates for default, firewall-control, fuse-
-      support and process-control
-    - overlord: test fix, address corner case
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Apr 2018 10:34:00 +0200
-
-snapd (2.32.3) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - ifacestate: add to the repo also snaps that are pending being
-      activated but have a done setup-profiles
-    - snapstate: inject autoconnect tasks in doLinkSnap for regular
-      snaps
-    - cmd/snap-confine: allow creating missing gl32, gl, vulkan dirs
-    - errtracker: add more fields to aid debugging
-    - interfaces: make system-key more robust against invalid fstab
-      entries
-    - cmd/snap-mgmt: remove timers, udev rules, dbus policy files
-    - overlord,interfaces: be more vocal about broken snaps and read
-      errors
-    - osutil: fix fstab parser to allow for # in field values
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 05 Apr 2018 22:35:35 +0200
-
-snapd (2.32.2) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - interfaces/content: add rule so slot can access writable files at
-      plug's mountpoint
-    - tests: adjust canonical-livepatch test on GCE
-    - interfaces/serial: change pattern not to exclude /dev/ttymxc
-    - spread.yaml: switch Fedora 27 tests to manual
-    - store: Sections and WriteCatalogs need to strictly send device
-      auth only if the device has a custom store
-    - configstate: give a chance to immediately recompute the next
-      refresh time when schedules are set
-    - cmd/snap-confine: attempt to detect if multiarch host uses arch
-      triplets
-    - vendor: update gopkg.in/yaml.v2 to the latest version (#4945)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 31 Mar 2018 21:09:29 +0200
-
-snapd (2.32.1) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - cmd/snapd: make sure signal handlers are established during early
-      daemon startup
-    - osutil: use tilde suffix for temporary files used for atomic
-      replacement
-    - cmd/snap-confine: apparmor: allow creating prefix path for
-      gl/vulkan
-    - tests: disentangle etc vs extrausers in core tests
-    - packaging: fix changelogs' typo
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 26 Mar 2018 21:01:41 +0200
-
-snapd (2.32) xenial; urgency=medium
-
-  *  New upstream release, LP: #1756173
-    - snap: make `snap run` look at the system-key for security profiles
-    - overlord/configstate: change how ssh is stopped/started
-    - cmd/snap-confine: nvidia: preserve globbed file prefix
-    - advisor: deal with missing commands.db file
-    - interfaces,release: probe seccomp features lazily
-    - interfaces: harden snap-update-ns profile
-    - polkit: Pass caller uid to PolicyKit authority
-    - tests: change debug for layout test
-    - cmd/snap-confine: don't use per-snap s-u-n profile
-    - many: backported fixes for layouts and symlinks
-    - cmd/snap-confine: nvidia: add tls/libnvidia-tls.so* glob
-    - cmd/snap-update-ns: use x-snapd.{synthetic,needed-by} in practice
-    - snap: Call SanitizePlugsSlots from InfoFromSnapYaml
-    - cmd/snap-confine: fix ptrace rule with snap-confine peer
-    - tests: update tests to deal with s390x quirks
-    - snapstate: add compat mode for default-provider"snapname:ifname"
-    - snap-confine: fallback to /lib/udev/snappy-app-dev if the core is
-      older
-    - tests: a bunch of test fixes for s390x from looking at the
-      autopkgtest logs
-    - packaging: recommend "gnupg" instead of "gnupg1 | gnupg"
-    - interfaces/builtin: let MM change qmi device attributes
-    - debian: undo snap.mount system unit removal
-    - snap: don't create empty Change with "Hold" state on disconnect
-    - tests: add workaround for s390x failure
-    - tests: make autopkgtest tests more targeted
-    - many: propagate contexts enough to be able to mark store
-      operations done from the Ensure loop
-    - store: cleanup test naming, dropping remoteRepo and
-      UbuntuStore(Repository)? references
-    - store: reorg auth refresh
-    - tests: autopkgtest may have non edge core too
-    - data: translate polkit strings
-    - snapstate: put layout feature behind feature flag
-    - errtracker: respect the /etc/whoopsie configuration
-    - overlord/snapstate: hold refreshes for 2h after seeding on classic
-    - many: cherry-pick relevant `go vet` 1.10 fixes to 2.32
-    - snap/squashfs: when installing from seed, try symlink before cp
-    - wrappers: services which are socket or timer activated should not
-      be started during boot
-    - many: generate and use per-snap snap-update-ns profile
-    - many: support holding refreshes by setting refresh.hold
-    - snap-confine, snap-seccomp: utilize new seccomp logging features
-    - many: remove snapd.refresh.{timer,service}
-    - many: add the snapd-generator
-    - polkit: do not shadow dbus errors, avoid panic in case of errors
-    - polkit: ensure error is properly set if dialog is dismissed
-    - xdgopenproxy: integrate xdg-open implementation into snapctl
-    - userd: add an OpenFile method for launching local files with xdg-
-      open
-    - asserts:  use a timestamp for the assertion after the signing key
-      has been created
-    - ifacestate: be consistent passing Retry.After as named field
-    - interfaces/apparmor,system-key: add upperdir snippets for strict
-      snaps on livecd
-      interfaces/apparmor,system-key: add upperdir snippets for strict
-      snaps
-    - configstate: when disable "ssh" we must disable the "sshd"
-      service
-    - store: don't ask for snap_yaml_raw except on the details endpoint
-    - osutil: handle file being matched by multiple patterns
-    - cmd/snap-update-ns: use recursive bind mounts for writable mimic
-    - cmd/snap-update-ns: use syscall.Symlink instead of os.Symlink
-    - interfaces/screen-inhibit-control,network-status: fix dbus path
-      and interface typos
-    - interfaces/network-status: fix use of '/' in interface in DBus
-      rule
-    - interfaces/screen-inhibit-control: fix use of '.' in path in DBus
-      rule
-    - overlord/snapstate: fix task iteration order in
-      TestDoPrereqRetryWhenBaseInFlight
-    - interfaces: add an interface for gnome-online-accounts D-Bus
-      service
-    - snap: pass full timer spec in `snap run --timer`
-    - cmd/snap: introduce `snap run --timer`
-    - snapstate: auto install default-providers for content snaps
-    - hooks/strutil: limit the number of data read from the hooks to
-      avoid oom
-    - osutil: aggregate mockable symbols
-    - tests: make sure snapd is running before attempting to remove
-      leftover snaps
-    - timeutil: account for 24h wrap when flattening clock spans
-    - many: send  new Snap-CDN header with none or with cloud instance
-      placement info as needed
-    - cmd/snap-update-ns,testutil: move syscall testing helpers
-    - tests: disable interfaces-location-control on s390x
-    - tests: new spread test for gpio-memory-control interface
-    - tests: spread test for broadcom-asic-control interface
-    - tests: make restore of interfaces-password-manager-service more
-      robust
-    - tests/lib/prepare-restore: sync journal before rotating and
-      vacuuming
-    - overlord/snapstate: use spread in the default refresh schedule
-    - tests: fixes for autopkgtest in bionic
-    - timeutil: introduce helpers for checking it time falls inside the
-      schedule
-    - cmd/snap-repair,httputil: set snap-repair User-Agent on requests
-    - vendor: resync formatting of vendor.json
-    - snapstate/ifacestate: auto-connect tasks
-    - cmd/snap: also include tracking channel in list output.
-    - interfaces/apparmor: use snap revision with surrounding '.' when
-      replacing in glob
-    - debian,vendor: import github.com/snapcore/squashfs and use
-    - many: implement "refresh-mode: {restart,endure,...}" for services
-    - daemon: make the ast-inspecting test smarter; drop 'exceptions'
-    - tests: new spread test for kvm interface
-    - cmd/snap: tweaks to 'snap info' output
-    - snap: remove underscore from version validator regexp
-    - testutil: add File{Matches,Equals,Contains} checkers.
-    - snap: improve the version validator's error messages.
-    - osutil: refactor EnsureFileState to separate out the comparator
-    - timeutil: fix scheduling on nth weekday of the month
-    - cmd/snap-update-ns: small refactor for upcoming per-user mounts
-    - many: rename snappy-app-dev to snap-device-helper
-    - systemd: add default target for timers
-    - interfaces: miscellaneous policy updates for home, opengl, time-
-      control, network, et al
-    - cmd/snap: linter cleanups
-    - interfaces/mount: generate per-user mount profiles
-    - cmd/snap: use proper help strings for `snap userd --help`
-    - packaging: provide a compat symlink for snappy-app-dev
-    - interfaces/time-control,netlink-audit: adjust for util-linux
-      compiled with libaudit
-    - tests: adding new test to validate the raw-usb interface
-    - snap: add support for `snap run --gdb`
-    - interfaces/builtin: allow MM to access login1
-    - packaging: fix build on sbuild
-    - store: revert PR#4532 and do not display displayname
-    - interfaces/mount: add support for per-user mount entries
-    - cmd/system-shutdown: move sync to be even more pessimistic
-    - osutil: reimplement IsMounted with LoadMountInfo
-    - tests/main/ubuntu-core-services: enable snapd.refresh.timer for
-      the test
-    - many: don't allow layout construction to silently fail
-    - interfaces/apparmor: ensure snap-confine profile for reexec is
-      current
-    - interfaces/apparmor: generalize apparmor load and unload helpers
-    - tests: removing packages which are not needed anymore to generate
-      random data
-    - snap: improve `snap run` comments/naming
-    - snap: allow options for --strace, e.g. `snap run --strace="-tt"`
-    - tests: fix spread test failures on 18.04
-    - systemd: update comment on SocketsTarget
-    - osutil: add and update docstrings
-    - osutil: parse mount entries without options field
-    - interfaces: mock away real mountinfo/fstab
-    - many: move /lib/udev/snappy-app-dev to /usr/lib/snapd/snappy-app-
-      dev
-    - overlord/snapstate/backend: perform cleanup if snap setup fails
-    - tests/lib/prepare: disable snapd.refresh.timer
-    - daemon: remove redundant UserOK markings from api commands
-    - snap: introduce  timer service data types and validation
-    - cmd/snap: fix UX of snap services
-    - daemon: allow `snapctl get` from any uid
-    - debian, snap: only static link libseccomp in snap-seccomp on
-      ubuntu
-    - all: snap versions are now validated
-    - many: add nfs-home flag to system-key
-    - snap: disallow layouts in various special directories
-    - cmd/snap: add help for service commands.
-    - devicestate: fix autopkgtest failure in
-      TestDoRequestSerialErrorsOnNoHost
-    - snap,interfaces: allow using bind-file layouts
-    - many: move mount code to osutil
-    - snap: understand directories in layout blacklist
-    - snap: use custom unsquashfsStderrWriter for unsquashfs error
-      detection
-    - tests/main/user-data-handling: get rid of ordering bug
-    - snap: exclude `gettimeofday` from `snap run --strace`
-    - tests: check if snapd.socket is active before stoping it
-    - snap: sort layout elements before validating
-    - strutil: introducing MatchCounter
-    - snap: detect unsquashfs write failures
-    - spread: add missing ubuntu-18.04-arm64 to available autopkgtest
-      machines
-    - cmd/snap-confine: allow mounting anywhere, effectively
-    - daemon: improve ucrednet code for the snap.socket
-    - release, interfaces: add new release.AppArmorFeatures helper
-    - snap: apply some golint suggestions
-    - many: add interfaces.SystemKey() helper
-    - tests: new snaps to test installs nightly
-    - tests: skip alsa interface test when the system does not have any
-      audio devices
-    - debian/rules: workaround for
-      https://github.com/golang/go/issues/23721
-    - interfaces/apparmor: early support for snap-update-ns snippets
-    - wrappers: cleanup enabled service sockets
-    - cmd/snap-update-ns: large refactor / update of unit tests
-    - interfaces/apparmor: remove leaked future layout code
-    - many: allow constructing layouts (phase 1)
-    - data/systemd: for debugging/testing use /etc/environment also for
-      snap-repair runs
-    - cmd/snap-confine: create lib/{gl,gl32,vulkan} under /var/lib/snapd
-      and chown as root:root
-    - overlord/configstate/config: make [GS]etSnapConfig use *RawMessage
-    - daemon: refactor snapFooMany helpers a little
-    - cmd/snap-confine: allow snap-update-ns to chown things
-    - interfaces/apparmor: use a helper to set the scope
-    - overlord/configstate/config: make SetSnapConfig delete on empty
-    - osutil: make MkdirAllChown clean the path passed in
-    - many: at seeding try to capture cloud information into core config
-      under "cloud"
-    - cmd/snap: add completion conversion helper to increase DRY
-    - many: remove "content" argument from snaptest.MockSnap()
-    - osutil: allow using many globs in EnsureDirState
-    - cmd/snap-confine: fix read-only filesystem when mounting nvidia
-      files in biarch
-    - tests: use root path to /home/test/tmp to avoid lack of space
-      issue
-    - packaging: create /var/lib/snapd/lib/{gl,gl32,vulkan} as part of
-      packaging
-    - tests: update kill-timeout focused on making tests pass on boards
-    - advisor: ensure commands.db has mode 0644 and add test
-    - snap: improve validation of snap layouts
-    - tests: ensure disabled services are masked
-    - interfaces/desktop-legacy,unity7: support gtk2/gvfs gtk_show_uri()
-    - systemd, wrappers: start all snap services in one systemctl call
-    - mir: software clients need access to shared memory /dev/shm/#*
-    - snap: add support for `snap advise-snap pkgName`
-    - snap: fix command-not-found on core devices
-    - tests: new spead test for openvswitch-support interface
-    - tests: add integration for local snap licenses
-    - config: add (Get|Set)SnapConfig to do bulk config e.g. from
-      snapshots
-    - cmd/snap: display snap license information
-    - tests: enable content sharing test for $SNAP
-    - osutil: add ContextWriter and RunWithContext helpers.
-    - osutil: add DirExists and IsDirNotExist
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 24 Mar 2018 08:23:31 +0100
-
-snapd (2.31.2) xenial; urgency=medium
-
-  *  New upstream release, LP: #1745217
-    - many: add the snapd-generator
-    - polkit: ensure error is properly set if dialog is dismissed
-    - xdgopenproxy: integrate xdg-open implementation into snapctl
-    - userd: add an OpenFile method for launching local files with xdg-
-      open
-    - configstate: when disable "ssh" we must disable the "sshd"
-      service
-    - many: remove snapd.refresh.{timer,service}
-    - interfaces/builtin: allow MM to access login1
-    - timeutil: account for 24h wrap when flattening clock spans
-    - interfaces/screen-inhibit-control,network-status: fix dbus path
-      and interface typos
-    - systemd, wrappers: start all snap services in one systemctl
-      call
-    - tests: disable interfaces-location-control on s390x
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 09 Mar 2018 11:11:31 +0100
-
-snapd (2.31.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1745217
-    - tests: multiple autopkgtest related fixes for 18.04
-    - overlord/snapstate: use spread in the default refresh schedule
-    - timeutil: fix scheduling on nth weekday of the month
-    - interfaces: miscellaneous policy updates for home, opengl, time-
-      control, network, et al
-    - cmd/snap: use proper help strings for `snap userd --help`
-    - interfaces/time-control,netlink-audit: adjust for util-linux
-      compiled with libaudit
-    - rules: do not static link on powerpc
-    - packaging: revert LDFLAGS rewrite again after building snap-
-      seccomp
-    - store: revert PR#4532 and do not display displayname
-    - daemon: allow `snapctl get` from any uid
-    - debian, snap: only static link libseccomp in snap-seccomp on
-      ubuntu
-    - daemon: improve ucrednet code for the snap.socket
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 20 Feb 2018 17:27:42 +0100
-
-snapd (2.31) xenial; urgency=medium
-
-  * New upstream release, LP: #1745217
-    - cmd/snap-confine: allow snap-update-ns to chown things
-    - cmd/snap-confine: fix read-only filesystem when mounting nvidia
-      files in biarch
-    - packaging: create /var/lib/snapd/lib/{gl,gl32,vulkan} as part of
-      packaging
-    - advisor: ensure commands.db has mode 0644 and add test
-    - interfaces/desktop-legacy,unity7: support gtk2/gvfs gtk_show_uri()
-    - snap: improve validation of snap layoutsRules for validating
-      layouts:
-    - snap: fix command-not-found on core devices
-    - cmd/snap: display snap license information
-    - tests: enable content sharing test for $SNAP
-    - userd: add support for a simple UI that can be used from userd
-    - snap-confine/nvidia: Support legacy biarch trees for GLVND systems
-    - tests: generic detection of gadget and kernel snaps
-    - cmd/snap-update-ns: refactor and improve Change.Perform to handle
-      EROFS
-    - cmd/snap: improve output when snaps were found in a section or the
-      section is invalid
-    - cmd/snap-confine,tests: hide message about stale base snap
-    - cmd/snap-mgmt: fix out of source tree build
-    - strutil/quantity: new package that exports formatFoo (from
-      progress)
-    - cmd/snap: snap refresh --time with new and legacy schedules
-    - state: unknown tasks handler
-    - cmd/snap-confine,data/systemd: fix removal of snaps inside LXD
-    - snap: add io.snapcraft.Settings to `snap userd`
-    - spread: remove more EOLed releases
-    - snap: tidy up top-level help output
-    - snap: fix race in `snap run --strace`
-    - tests: update "searching" test to match store changes
-    - store: use the "publisher" when populating the "publisher" field
-    - snap: make `snap find --section` show all sections
-    - tests: new test to validate location control interface
-    - many: add new `snap refresh --amend <snap>` command
-    - tests/main/kernel-snap-refresh-on-core: skip the whole test if
-      edge and stable are the same version
-    - tests: set test kernel-snap-refresh-on-core to manual
-    - tests: new spread test for interface gpg-keys
-    - packaging/fedora: Merge changes from Fedora Dist-Git plus trivial
-      fix
-    - interfaces: miscellaneous policy updates
-    - interfaces/builtin: Replace Solus support with GLVND support
-    - tests/main/kernel-snap-refresh-on-core: do not fail if edge and
-      stable kernels are the same version
-    - snap: add `snap run --strace` to be able to strace snap apps
-    - tests: new spread test for ssh-keys interface
-    - errtracker: include detected virtualisation
-    - tests: add new kernel refresh/revert test for spread-cron
-    - interfaces/builtin: blacklist zigbee dongle
-    - cmd/snap-confine: discard stale mount namespaces
-    - cmd: remove unused execArg0/execEnv
-    - snap,interfaces/mount: disallow nobody/nogroup
-    - cmd/snap: improve `snap aliases` output when no aliases are
-      defined
-    - tests/lib/snaps/test-snapd-service: refactor service reload
-    - tests: new spread test for gpg-public-keys interface
-    - tests: new spread test for ssh-public-keys interface
-    - spread: setup machine creation on Linode
-    - interfaces/builtin: allow introspecting UDisks2
-    - interfaces/builtin: add support for content "source" section
-    - tests: new spread test for netlink-audit interface
-    - daemon: avoid panic'ing building an error response w/no snaps
-      given
-    - interfaces/mount,snap: early support for snap layouts
-    - daemon: unlock state even if RefreshSchedule() fails
-    - arch: add "armv8l" to ubuntuArchFromKernelArch table
-    - tests: fix for test interface-netlink-connector
-    - data/dbus: add AssumedAppArmorLabel=unconfined
-    - advisor: use forked bolt to make it work on ppc
-    - overlord/snapstate: record the 'kind' of conflicting change
-    - dirs: fix snap mount dir on Manjaro
-    - overlord/{snapstate,configstate}, daemon: introduce refresh.timer,
-      fallback to refresh.schedule
-    - config: add support for `snap set core proxy.no_proxy=...`
-    - snap-mgmt: extend spread tests, stop, disable and cleanup snap
-      services
-    - spread.yaml: add fedora 27
-    - cmd/snap-confine: allow snap-update-ns to poke writable holes in
-      $SNAP
-    - packaging/14.04: move linux-generic-lts-xenial to recommends
-    - osutil/sys: ppc has 32-bit getuid already
-    - snapstate: make no autorefresh message clearer
-    - spread: try to enable Fedora once more
-    - overlord/snapstate: do a minimal sanity check on containers
-    - configcore: ensure config.txt has a final newline
-    - cmd/libsnap-confine-private: print failed mount/umount regardless
-      of SNAP_CONFINE_DEBUG
-    - debian/tests: add missing autopkgtest test dependencies for debian
-    - image: port ini handling to goconfigparser
-    - tests/main/snap-service-after-before: add test for after/before
-      service ordering
-    - tests: enabling opensuse for tests
-    - tests: update auto-refresh-private to match messages from current
-      master
-    - dirs: check if distro 'is like' fedora when picking path to
-      libexecdir
-    - tests: fix "job canceled" issue and improve cleanup for snaps
-    - cmd/libsnap-confine-private: add debug build of libsnap-confine-
-      private.a, link it into snap-confine-debug
-    - vendor: remove x/sys/unix to fix builds on arm64 and powerpc
-    - image: let consume snapcraft export-login files from tooling
-    - interfaces/mir: allow Wayland socket and non-root sockets
-    - interfaces/builtin: use snap.{Plug,Slot}Info over
-      interfaces.{Plug,Slot}
-    - tests: add simple snap-mgmt test
-    - wrappers: autogenerate After/Before in systemd's service files for
-      apps
-    - snap: add usage hints in `snap download`
-    - snap: provide more meaningful errors for installMany and friends
-    - cmd/snap: show header/footer when `snap find` is used without
-      arguments
-    - overlord/snapstate: for Enable's tasks refer to the first task
-      with snap-setup, do not duplicate
-    - tests: add hard-coded fully expired macaroons to run related tests
-    - cmd/snap-update-ns: new test features
-    - cmd/snap-update-ns: we don't want to bind mount symlinks
-    - interfaces/mount: test OptsToCommonFlags, filter out x-snapd.
-      options
-    - cmd/snap-update-ns: untangle upcoming cyclic initialization
-    - client, daemon: update user's email when logging in with new
-      account
-    - tests: ensure snap-confine apparmor profile is parsable
-    - snap: do not leak internal errors on install/refresh etc
-    - snap: fix missing error check when multiple snaps are refreshed
-    - spread: trying to re-enable tests on Fedora
-    - snap: fix gadget.yaml parsing for multi volume gadgets
-    - snap: give the snap.Container interface a Walk method
-    - snap: rename `snap advise-command` to `snap advise-snap --command`
-    - overlord/snapstate: no refresh just for hints if there was a
-      recent regular full refresh
-    - progress: switch ansimeter's Spin() to use a spinner
-    - snap: support `command-not-found` symlink for `snap advise-
-      command`
-    - daemon: store email, ID and macaroon when creating a new user
-    - snap: app startup after/before validation
-    - timeutil: refresh timer take 2
-    - store, daemon/api: Rename MyAppsServer, point to
-      dashboard.snapcraft.io instead
-    - tests: use "quiet" helper instead of "dnf -q" to get errors on
-      failures
-    - cmd/snap-update-ns: improve mocking for tests
-    - many: implement the advisor backend, populate it from the store
-    - tests: make less calls to the package manager
-    - tests/main/confinement-classic: enable the test on Fedora
-    - snap: do not leak internal network errors to the user
-    - snap: use stdout instead of stderr for "fetching" message
-    - tests: fix test whoami, share successful_login.exp
-    - many: refresh with appropriate creds
-    - snap: add new `snap advice-command` skeleton
-    - tests: add test that ensures we never parse versions as numbers
-    - overlord/snapstate: override Snapstate.UserID in refresh if the
-      installing user is gone
-    - interfaces: allow socket "shutdown" syscall in default profile
-    - snap: print friendly message if `snap keys` is empty
-    - cmd/snap-update-ns: add execWritableMimic
-    - snap: make `snap info invalid-snap` output more user friendly
-    - cmd/snap,  tests/main/classic-confinement: fix snap-exec path when
-      running under classic confinement
-    - overlord/ifacestate: fix disable/enable cycle to setup security
-    - snap: fix snap find " " output
-    - daemon: add new polkit action to manage interfaces
-    - packaging/arch: disable services when removing
-    - asserts/signtool: support for building tools on top that fill-
-      in/compute some headers
-    - cmd: clarify "This leaves %s tracking %s." message
-    - daemon: return "bad-query" error kind for store.ErrBadQuery
-    - taskrunner/many: KnownTaskKinds helper
-    - tests/main/interfaces-fuse_support: fix confinement, allow
-      unmount, fix spread tests
-    - snap: use the -no-fragments mksquashfs option
-    - data/selinux: allow messages from policykit
-    - tests: fix catalog-update wait loop
-    - tests/lib/prepare-restore: disable rate limiting in journald
-    - tests: change interfaces-fuse_support to be debug friendly
-    - tests/main/postrm-purge: stop snapd before purge
-    - This is an example of test log:https://paste.ubuntu.com/26215170/
-    - tests/main/interfaces-fuse_support: dump more debugging
-      information
-    - interfaces/dbus: adjust slot policy for listen, accept and accept4
-      syscalls
-    - tests: save the snapd-state without compression
-    - tests/main/searching: handle changes in featured snaps list
-    - overlord/snapstate: fix auto-refresh summary for 2 snaps
-    - overlord/auth,daemon: introduce an explicit auth.ErrInvalidUser
-    - interfaces: add /proc/partitions to system-observe (This addresses
-      LP#1708527.)
-    - tests/lib: introduce helpers for setting up /dev/random using
-      /dev/urandom in project prepare
-    - tests: new test for interface network status
-    - interfaces: interfaces: also add an app/hook-specific udev RUN
-      rule for hotplugging
-    - tests: fix external backend for tests that need DEBUG output
-    - tests: do not disable refresh timer on external backend
-    - client: send all snap related bool json fields
-    - interfaces/desktop,unity7: allow status/activate/lock of
-      screensavers
-    - tests/main: source mkpinentry.sh
-    - tests: fix security-device-cgroups-serial-port test for rpi and db
-    - cmd/snap-mgmt: add more directories for cleanup and refactor
-      purge() code
-    - snap: YAML and data structures for app before/after ordering
-    - tests: set TRUST_TEST_KEYS=false for all the external backends
-    - packaging/arch: install snap-mgmt tool
-    - tests: add support on tests for cm3 gadget
-    - interfaces/removable-media: also allow 'k' (lock)
-    - interfaces: use ConnectedPlug/ConnectedSlot types (step 2)
-    - interfaces: rename sanitize methods
-    - devicestate: fix misbehaving test when using systemd-resolved
-    - interfaces: added Ref() helpers, restored more detailed error
-      message on spi iface
-    - debian: make "gnupg" a recommends
-    - interfaces/many: misc updates for default, browser-support,
-      opengl, desktop, unity7, x11
-    - interfaces: PlugInfo/SlotInfo/ConnectedPlug/ConnectedSlot
-      attribute helpers
-    - interfaces: update fixme comments
-    - tests: make interfaces-snapd-control-with-manage more robust
-    - userd: generalize dbusInterface
-    - interfaces: use ConnectedPlug/ConnectedSlot types (step 1)
-    - hookstate: add compat "configure-snapd" task.
-    - config, overlord/snapstate, timeutil: rename ParseSchedule to
-      ParseLegacySchedule
-    - tests: adding tests for time*-control interfaces
-    - tests: new test to check interfaces after reboot the system
-    - cmd/snap-mgmt: fixes
-    - packaging/opensuse-42.2: package and use snap-mgmt
-    - corecfg: also "mask" services when disabling them
-    - cmd/snap-mgmt: introduce snap-mgmt tool
-    - configstate: simplify ConfigManager
-    - interfaces: add gpio-memory-control interface
-    - cmd: disable check-syntax-c
-    - packaging/arch: add bash-completion as optional dependency
-    - corecfg: rename package to overlord/configstate/configcore
-    - wrappers: fix unit tests to use dirs.SnapMountDir
-    - osutil/sys: reimplement getuid and chown with the right int type
-    - interfaces-netlink-connector: fix sourcing snaps.sh
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 06 Feb 2018 09:43:22 +0100
-
-snapd (2.30) xenial; urgency=medium
-
-  * New upstream release, LP: #1735344
-    - tests: set TRUST_TEST_KEYS=false for all the external backends
-    - tests: fix external backend for tests that need DEBUG output
-    - tests: do not disable refresh timer on external backend
-    - client: send all snap related bool json fields
-    - interfaces: interfaces: also add an app/hook-specific udev RUN
-      rule for hotplugging
-    - interfaces/desktop,unity7: allow status/activate/lock of
-      screensavers
-    - tests/main: source mkpinentry.sh
-    - devicestate: use a different nowhere domain
-    - interfaces: add ssh-keys, ssh-public-keys, gpg-keys and gpg-public
-      keys interfaces
-    - interfaces/many: misc updates for default, browser-support, opengl,
-      desktop, unity7, x11
-    - devicestate: fix misbehaving test when using systemd-resolved
-    - interfaces/removable-media: also allow 'k' (lock)
-    - interfaces/many: misc updates for default, browser-support,
-      opengl, desktop, unity7, x11
-    - corecfg: also "mask" services when disabling them
-    - tests: add support for autopkgtests on s390x
-    - snapstate: support for pre-refresh hook
-    - many: allow to configure core before it is installed
-    - devicestate: fix unkeyed fields error
-    - snap-confine: create mount target for lib32,vulkan on demand
-    - snapstate: add support for refresh.schedule=managed
-    - cmd/snap-update-ns: teach update logic to handle synthetic changes
-    - many: remove configure-snapd task again and handle internally
-    - snap: fix TestDirAndFileMethods() test to work with gccgo
-    - debian: ensure /var/lib/snapd/lib/vulkan is available
-    - cmd/snap-confine: use #include instead of bare include
-    - snapstate: store userID in snapstate
-    - snapd.dirs: add var/lib/snapd/lib/gl32
-    - timeutil, overlod/snapstate: cleanup remaining pieces of timeutil
-      weekday support
-    - packaging/arch: install missing directories, manpages and version
-      info
-    - snapstate,store: store if a snap is a paid snap in the sideinfo
-    - packaging/arch: pre-create snapd directories when packaging
-    - tests/main/manpages: set LC_ALL=C as man may complain if the
-      locale is unset or unsupported
-    - repo: ConnectedPlug and ConnectedSlot types
-    - snapd: fix handling of undo in the taskrunner
-    - store: fix download caching and add integration test
-    - snapstate: move autorefresh code into autoRefresh helper
-    - snapctl: don't error out on start/stop/restart from configure hook
-      during install or refresh
-    - cmd/snap-update-ns: add planWritableMimic
-    - deamon: don't omit responses, even if null
-    - tests: add test for frame buffer interface
-    - tests/lib: fix shellcheck errors
-    - apparmor: generate the snap-confine re-exec profile for
-      AppArmor{Partial,Full}
-    - tests: remove obsolete workaround
-    - snap: use existing files in `snap download` if digest/size matches
-    - tests: merge pepare-project.sh into prepare-restore.sh
-    - tests: cache snaps to $TESTSLIB/cache
-    - tests: set -e, -o pipefail in prepare-restore.sh
-    - apparmor: generate the snap-confine re-exec profile for
-      AppArmor{Partial,Full}
-    - cmd/snap-seccomp: fix uid/gid restrictions tests on Arch
-    - tests: document and slightly refactor prepare/restore code
-    - snapstate: ensure RefreshSchedule() gives accurate results
-    - snapstate: add new refresh-hints helper and use it
-    - spread.yaml,tests: move most of project-wide prepare/restore to
-      separate file
-    - timeutil: introduce helpers for weekdays and TimeOfDay
-    - tests: adding new test for uhid interface
-    - cmd/libsnap: fix parsing of empty mountinfo fields
-    - overlord/devicestate:  best effort to go to early full retries for
-      registration on the like of DNS no host
-    - spread.yaml: bump delta ref to 2.29
-    - tests: adding test to test physical memory observe interface
-    - cmd, errtracker: get rid of SNAP_DID_REEXEC environment
-    - timeutil: remove support to parse weekday schedules
-    - snap-confine: add workaround for snap-confine on 4.13/upstream
-    - store: do not log the http body for catalog updates
-    - snapstate: move catalogRefresh into its own helper
-    - spread.yaml: fix shellcheck issues and trivial refactor
-    - spread.yaml: move prepare-each closer to restore-each
-    - spread.yaml: increase workers for opensuse to 3
-    - tests: force delete when tests are restore to avoid suite failure
-    - test: ignore /snap/README
-    - interfaces/opengl: also allow read on 'revision' in
-      /sys/devices/pci...
-    - interfaces/screen-inhibit-control: fix case in screen inhibit
-      control
-    - asserts/sysdb: panic early if pointed to staging but staging keys
-      are not compiled-in
-    - interfaces: allow /bin/chown and fchownat to root:root
-    - timeutil: include test input in error message in
-      TestParseSchedule()
-    - interfaces/browser-support: adjust base declaration for auto-
-      connection
-    - snap-confine: fix snap-confine under lxd
-    - store: bit less aggressive retry strategy
-    - tests: add new `fakestore new-snap-{declaration,revision}` helpers
-    - cmd/snap-update-ns: add secureMkfileAll
-    - snap: use field names when initializing composite literals
-    - HACKING: fix path in snap install
-    - store: add support for flags in ListRefresh()
-    - interfaces: remove invalid plugs/slots from SnapInfo on
-      sanitization.
-    - debian: add missing udev dependency
-    - snap/validate: extend socket validation tests
-    - interfaces: add "refresh-schedule" attribute to snapd-control
-    - interfaces/builtin/account_control: use gid owning /etc/shadow to
-      setup seccomp rules
-    - cmd/snap-update-ns: tweak changePerform
-    - interfaces,tests: skip unknown plug/slot interfaces
-    - tests: disable interfaces-network-control-tuntap
-    - cmd: use a preinit_array function rather than parsing
-      /proc/self/cmdline
-    - interfaces/time*_control: explicitly deny noisy read on
-      /proc/1/environ
-    - cmd/snap-update-ns: misc cleanups
-    - snapd: allow hooks to have slots
-    - fakestore: add go-flags to prepare for `new-snap-declaration` cmd
-    - interfaces/browser-support: add shm path for nwjs
-    - many: add magic /snap/README file
-    - overlord/snapstate: support completion for command aliases
-    - tests: re-enable tun/tap test on Debian
-    - snap,wrappers: add support for socket activation
-    - repo: use PlugInfo and SlotInfo for permanent plugs/slots
-    - tests/interfaces-network-control-tuntap: disable on debian-
-      unstable for now
-    - cmd/snap-confine: Loosen the NVIDIA Vulkan ICD glob
-    - cmd/snap-update-ns: detect and report read-only filesystems
-    - cmd/snap-update-ns: re-factor secureMkdirAll into
-      secureMk{Prefix,Dir}
-    - run-checks, tests/lib/snaps/: shellcheck fixes
-    - corecfg: validate refresh.schedule when it is applied
-    - tests: adjust test to match stderr
-    - snapd: fix snap cookie bugs
-    - packaging/arch: do not quote MAKEFLAGS
-    - state: add change.LaneTasks helper
-    - cmd/snap-update-ns: do not assume 'nogroup' exists
-    - tests/lib: handle distro specific grub-editenv naming
-    - cmd/snap-confine: Add missing bi-arch NVIDIA filesthe
-      `/var/lib/snapd/lib/gl:/var/lib/snapd/lib/gl/vdpau` paths within
-    - cmd: Support exposing NVIDIA Vulkan ICD files to the snaps
-    - cmd/snap-confine: Implement full 32-bit NVIDIA driver support
-    - packaging/arch: packaging update
-    - cmd/snap-confine: Support bash as base runtime entry
-    - wrappers: do not error on incorrect Exec= lines
-    - interfaces: fix udev tagging for hooks
-    - tests/set-proxy-store: exclude ubuntu-core-16 via systems: key
-    - tests: new tests for network setup control and observe interfaces
-    - osutil: add helper for obtaining group ID of given file path
-    - daemon,overlord/snapstate: return snap-not-installed error in more
-      cases
-    - interfaces/builtin/lxd_support: allow discovering of host's os-
-      release
-    - configstate: add support for configure-snapd for
-      snapstate.IgnoreHookError
-    - tests:  add a spread test for proxy.store setting together with
-      store assertion
-    - cmd/snap-seccomp: do not use group 'shadow' in tests
-    - asserts/assertstest:  fix use of hardcoded value when the passed
-      or default keys should be used
-    - interfaces/many: misc policy updates for browser-support, cups-
-      control and network-status
-    - tests: fix xdg-open-compat
-    - daemon: for /v2/logs, 404 when no services are found
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - cmd/snap-update-ns: add new helpers for mount entries
-    - cmd/snap-confine: Respect biarch nature of libdirs
-    - cmd/snap-confine: Ensure snap-confine is allowed to access os-
-      release
-    - cmd: fix re-exec bug with classic confinement for host snapd <
-      2.28
-    - interfaces/kmod: simplify loadModules now that errors are ignored
-    - tests: disable xdg-open-compat test
-    - tests: add test that checks core reverts on core devices
-    - dirs: use alt root when checking classic confinement support
-      without …
-    - interfaces/kmod: treat failure to load module as non-fatal
-    - cmd/snap-update-ns: fix golint and some stale comments
-    - corecfg:  support setting proxy.store if there's a matching store
-      assertion
-    - overlord/snapstate: toggle ignore-validation as needed as we do
-      for channel
-    - tests: fix security-device-cgroup* tests on devices with
-      framebuffer
-    - interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS
-    - interfaces: add USB interface number attribute in udev rule for
-      serial-port interface
-    - overlord/devicestate: switch to the new endpoints for registration
-    - snap-update-ns: add missing unit test for desired/current profile
-      handling
-    - cmd/{snap-confine,libsnap-confine-private,snap-shutdown}: cleanup
-      low-level C bits
-    - ifacestate: make interfaces.Repository available via state cache
-    - overlord/snapstate: cleanups around switch-snap*
-    - cmd/snapd,client,daemon: display ignore-validation flag through
-      the notes mechanism
-    - cmd/snap-update-ns: add logging to snap-update-ns
-    - many: have a timestamp on store assertions
-    - many: lookup and use the URL from a store assertion if one is set
-      for use
-    - tests/test-snapd-service: fix shellcheck issues
-    - tests: new test for hardware-random-control interface
-    - tests: use `snap change --last=install` in snapd-reexec test
-    - repo, daemon: use PlugInfo, SlotInfo
-    - many: handle core configuration internally instead of using the
-      core configure hook
-    - tests: refactor and expand content interface test
-    - snap-seccomp: skip in-kernel bpf tests for socket() in trusty/i386
-    - cmd/snap-update-ns: allow Change.Perform to return changes
-    - snap-confine: Support biarch Linux distribution confinement
-    - partition/ubootenv: don't panic when uboot.env is missing the eof
-      marker
-    - cmd/snap-update-ns: allow fault injection to provide dynamic
-      result
-    - interfaces/mount: exspose mount.{Escape,Unescape}
-    - snapctl: added long help to stop/start/restart command
-    - cmd/snap-update-ns: create missing mount points automatically.
-    - cmd: downgrade log message in InternalToolPath to Debugf()
-    - tests: wait for service status change & file update in the test to
-      avoid races
-    - daemon, store: forward SSO invalid credentials errors as 401
-      Unauthorized responses
-    - spdx: fix for WITH syntax, require a license name before the
-      operator
-    - many: reorg things in preparation to make handling of the base url
-      in store dynamic
-    - hooks/configure: queue service restarts
-    - cmd/snap: warn when a snap is not from the tracking channel
-    - interfaces/mount: add support for parsing x-snapd.{mode,uid,gid}=
-    - cmd/snap-confine: add detection of stale mount namespace
-    - interfaces: add plugRef/slotRef helpers for PlugInfo/SlotInfo
-    - tests: check for invalid udev files during all tests
-    - daemon: use newChange() in changeAliases for consistency
-    - servicestate: use taskset
-    - many: add support for /home on NFS
-    - packaging,spread: fix and re-enable opensuse builds
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 18 Dec 2017 15:31:04 +0100
-
-snapd (2.29.4.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - tests: more debug info for classic-ubuntu-core-transition
-    - packaging: fix typo that causes error in the misspell test
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 28 Nov 2017 07:45:23 +0100
-
-snapd (2.29.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - snap-confine: fix snap-confine under lxd
-    - tests: disable classic-ubuntu-core-transition on i386 temporarily
-    - many: reject bad plugs/slots
-    - interfaces,tests: skip unknown plug/slot interfaces
-    - store: enable "base" field from the store
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Nov 2017 22:55:09 +0100
-
-snapd (2.29.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - daemon: cherry-picked /v2/logs fixes
-    - cmd/snap-confine: Respect biarch nature of libdirs
-    - cmd/snap-confine: Ensure snap-confine is allowed to access os-
-      release
-    - interfaces: fix udev tagging for hooks
-    - cmd: fix re-exec bug with classic confinement for host snapd
-    - tests: disable xdg-open-compat test
-    - cmd/snap-confine: add slave PTYs and let devpts newinstance
-      perform mediation
-    - interfaces/many: misc policy updates for browser-support, cups-
-      control and network-status
-    - interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS
-    - tests: fix security-device-cgroup* tests on devices with
-      framebuffer
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 09 Nov 2017 19:16:29 +0100
-
-snapd (2.29.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - snapctl: disable stop/start/restart (2.29)
-    - cmd/snap-update-ns: fix collection of changes made
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 03 Nov 2017 17:17:14 +0100
-
-snapd (2.29.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - interfaces: fix incorrect signature of ofono DBusPermanentSlot
-    - interfaces/serial-port: udev tag plugged slots that have just
-      'path' via KERNEL
-    - interfaces/hidraw: udev tag plugged slots that have just 'path'
-      via KERNEL
-    - interfaces/uhid: unconditionally add existing uhid device to the
-      device cgroup
-    - cmd/snap-update-ns: fix mount rules for font sharing
-    - tests: disable refresh-undo test on trusty for now
-    - tests: use `snap change --last=install` in snapd-reexec test
-    - Revert " wrappers: fail install if exec-line cannot be re-written
-    - interfaces: don't udev tag devmode or classic snaps
-    - many: make ignore-validation sticky and send the flag with refresh
-      requests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 03 Nov 2017 07:25:17 +0100
-
-snapd (2.29) xenial; urgency=medium
-
-  * New upstream release, LP: #1726258
-    - interfaces/many: miscellaneous updates based on feedback from the
-      field
-    - snap-confine: allow reading uevents from any where in /sys
-    - spread: add bionic beaver
-    - debian: make packaging/ubuntu-14.04/copyright a real file again
-    - tests: cherry pick the fix for services test into 2.29
-    - cmd/snap-update-ns: initialize logger
-    - hooks/configure: queue service restarts
-    - snap-{confine,seccomp}: make @unrestricted fully unrestricted
-    - interfaces: clean system apparmor cache on core device
-    - debian: do not build static snap-exec on powerpc
-    - snap-confine: increase sanity_timeout to 6s
-    - snapctl: cherry pick service commands changes
-    - cmd/snap: tell translators about arg names and descs req's
-    - systemd: run all mount units before snapd.service to avoid race
-    - store: add a test to show auth failures are forwarded by doRequest
-    - daemon: convert ErrInvalidCredentials to a 401 Unauthorized error.
-    - store: forward on INVALID_CREDENTIALS error as
-      ErrInvalidCredentials
-    - daemon: generate a forbidden response message if polkit dialog is
-      dismissed
-    - daemon: Allow Polkit authorization to cancel changes.
-    - travis: switch to container based test runs
-    - interfaces: reduce duplicated code in interface tests mocks
-    - tests: improve revert related testing
-    - interfaces: sanitize plugs and slots early in ReadInfo
-    - store: add download caching
-    - preserve TMPDIR and HOSTALIASES across snap-confine invocation
-    - snap-confine: init all arrays with `= {0,}`
-    - tests: adding test for network-manager interface
-    - interfaces/mount: don't generate legacy per-hook/per-app mount
-      profiles
-    - snap: introduce structured epochs
-    - tests: fix interfaces-cups-control test for cups-2.2.5
-    - snap-confine: cleanup incorrectly created nvidia udev tags
-    - cmd/snap-confine: update valid security tag regexp
-    - cmd/libsnap: enable two stranded tests
-    - cmd,packaging: enable apparmor on openSUSE
-    - overlord/ifacestate: refresh all security backends on startup
-    - interfaces/dbus: drop unneeded check for
-      release.ReleaseInfo.ForceDevMode
-    - dbus: ensure io.snapcraft.Launcher.service is created on re-
-      exec
-    - overlord/auth: continue for now supporting UBUNTU_STORE_ID if the
-      model is generic-classic
-    - snap-confine: add support for handling /dev/nvidia-modeset
-    - interfaces/network-control: remove incorrect rules for tun
-    - spread: allow setting SPREAD_DEBUG_EACH=0 to disable debug-each
-      section
-    - packaging: remove .mnt files on removal
-    - tests: fix econnreset scenario when the iptables rule was not
-      created
-    - tests: add test for lxd interface
-    - run-checks: use nakedret static checker to check for naked
-      returns on long functions
-    - progress: be more flexible in testing ansimeter
-    - interfaces: fix udev rules for tun
-    - many: implement our own ANSI-escape-using progress indicator
-    - snap-exec: update tests to follow main_test pattern
-    - snap: support "command: foo $ENV_STRING"
-    - packaging: update nvidia configure options
-    - snap: add new `snap pack` and use in tests
-    - cmd: correctly name the "Ubuntu" and "Arch" NVIDIA methods
-    - cmd: add autogen case for solus
-    - tests: do not use http://canihazip.com/ which appears to be down
-    - hooks: commands for controlling own services from snapctl
-    - snap: refactor cmdGet.Execute()
-    - interfaces/mount: make Change.Perform testable and test it
-    - interfaces/mount,cmd/snap-update-ns: move change code
-    - snap-confine: is_running_on_classic_distribution() looks into os-
-      release
-    - interfaces: misc updates for default, browser-support, home and
-      system-observe
-    - interfaces: deny lttng by default
-    - interfaces/lxd: lxd slot implementation can also be an app snap
-    - release,cmd,dirs: Redo the distro checks to take into account
-      distribution families
-    - cmd/snap: completion for alias and unalias
-    - snap-confine: add new SC_CLEANUP and use it
-    - snap: refrain from running filepath.Base on random strings
-    - cmd/snap-confine: put processes into freezer hierarchy
-    - wrappers: fail install if exec-line cannot be re-written
-    - cmd/snap-seccomp,osutil: make user/group lookup functions public
-    - snapstate: deal with snap user data in the /root/ directory
-    - interfaces: Enhance full-confinement support for biarch
-      distributions
-    - snap-confine: Only attempt to copy/mount NVIDIA libs when NVIDIA
-      is used
-    - packaging/fedora: Add Fedora 26, 27, and Rawhide symlinks
-    - overlord/snapstate: prefer a smaller corner case for doing the
-      wrong thing
-    - cmd/snap-repair:  set user agent for snap-repair http requests
-    - packaging: bring down the delta between 14.04 and 16.04
-    - snap-confine: Ensure lib64 biarch directory is respected
-    - snap-confine: update apparmor rules for fedora based base snaps
-    - tests: Increase SNAPD_CONFIGURE_HOOK_TIMEOUT to 3 minutes to
-      install real snaps
-    - daemon: use client.Snap instead of map[string]interface{} for
-      snaps.
-    - hooks: rename refresh hook to post-refresh
-    - git: make the .gitingore file a bit more targeted
-    - interfaces/opengl: don't udev tag nvidia devices and use snap-
-      confine instead
-    - cmd/snap-{confine,update-ns}: apply mount profiles using snap-
-      update-ns
-    - cmd: update "make hack"
-    - interfaces/system-observe: allow clients to enumerate DBus
-      connection names
-    - snap-repair: implement `snap-repair {list,show}`
-    - dirs,interfaces: create snap-confine.d on demand when re-executing
-    - snap-confine: fix base snaps on core
-    - cmd/snap-repair: fix tests when running as root
-    - interfaces: add Connection type
-    - cmd/snap-repair: skip disabled repairs
-    - cmd/snap-repair: prefer leaking unmanaged fds on test failure over
-      closing random ones
-    - snap-repair: make `repair` binary available for repair scripts
-    - snap-repair: fix missing Close() in TestStatusHappy
-    - cmd/snap-confine,packaging: import snapd-generated policy
-    - cmd/snap: return empty document if snap has no configuration
-    - snap-seccomp: run secondary-arch tests via gcc-multilib
-    - snap: implement `snap {repair,repairs}` and pass-through to snap-
-      repair
-    - interfaces/builtin: allow receiving dbus messages
-    - snap-repair: implement `snap-repair {done,skip,retry}`
-    - data/completion: small tweak to snap completion snippet
-    - dirs: fix classic support detection
-    - cmd/snap-repair: integrate root public keys for repairs
-    - tests: fix ubuntu core services
-    - tests: add new test that checks that the compat snapd-xdg-open
-      works
-    - snap-confine: improve error message if core/u-core cannot be found
-    - tests: only run tests/regression/nmcli on amd64
-    - interfaces: mount host system fonts in desktop interface
-    - interfaces: enable partial apparmor support
-    - snapstate: auto-install missing base snaps
-    - spread: work around temporary packaging issue in debian sid
-    - asserts,cmd/snap-repair: introduce a mandatory summary for repairs
-    - asserts,cmd/snap-repair: represent RepairID internally as an int
-    - tests: test the real "xdg-open" from the core snap
-    - many: implement fetching sections and package names periodically.
-    - interfaces/network: allow using netcat as client
-    - snap-seccomp, osutil: use osutil.AtomicFile in snap-seccomp
-    - snap-seccomp: skip mknod syscall on arm64
-    - tests: add trivial canonical-livepatch test
-    - tests: add test that ensures that all core services are working
-    - many: add logger.MockLogger() and use it in the tests
-    - snap-repair: fix test failure in TestRepairHitsTimeout
-    - asserts: add empty values check in HeadersFromPrimaryKey
-    - daemon: remove unused installSnap var in test
-    - daemon: reach for Overlord.Loop less thanks to overlord.Mock
-    - snap-seccomp: manually resolve socket() call in tests
-    - tests: change regex used to validate installed ubuntu core snap
-    - cmd/snapctl: allow snapctl -h without a context (regression fix).
-    - many: use snapcore/snapd/i18n instead of i18n/dumb
-    - many: introduce asserts.NotFoundError replacing both ErrNotFound
-      and store.AssertionNotFoundError
-    - packaging: don't include any marcos in comments
-    - overlord: use overlord.Mock in more tests, make sure we check the
-      outcome of Settle
-    - tests: try to fix staging tests
-    - store: simplify api base url config
-    - systemd: add systemd.MockJournalctl()
-    - many: provide systemd.MockSystemctl() helper
-    - tests: improve the listing test to not fail for e.g. 2.28~rc2
-    - snapstate: give snapmgrTestSuite.settle() more time to settle
-    - tests: fix regex to check core version on snap list
-    - debian: update trusted account-keys check on 14.04 packaging
-    - interfaces: add udev netlink support to hardware-observe
-    - overlord: introduce Mock which enables to use Overlord.Settle for
-      settle in many more places
-    - snap-repair: execute the repair and capture logs/status
-    - tests: run the tests/unit/go everywhere
-    - daemon, snapstate: move ensureCore from daemon/api.go into
-      snapstate.go
-    - cmd/snap: get keys or root document
-    - spread.yaml: turn suse to manual given that it's breaking master
-    - many: configure store from state, reconfigure store at runtime
-    - osutil: AtomicWriter (an io.Writer), and io.Reader versions of
-      AtomicWrite*
-    - tests: check for negative syscalls in runBpf() and skip those
-      tests
-    - docs: use abolute path in PULL_REQUEST_TEMPLATE.md
-    - store: move device auth endpoint uris to config (#3831)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 30 Oct 2017 16:22:31 +0100
-
-snapd (2.28.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - snap-confine: cleanup broken nvidia udev tags
-    - cmd/snap-confine: update valid security tag regexp
-    - overlord/ifacestate: refresh udev backend on startup
-    - dbus: ensure io.snapcraft.Launcher.service is created on re-
-      exec
-    - snap-confine: add support for handling /dev/nvidia-modeset
-    - interfaces/network-control: remove incorrect rules for tun
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 13 Oct 2017 23:25:46 +0200
-
-snapd (2.28.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - interfaces/opengl: don't udev tag nvidia devices and use snap-
-      confine instead
-    - debian: fix replaces/breaks for snap-xdg-open (thanks to apw!)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Oct 2017 19:40:57 +0200
-
-snapd (2.28.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - interfaces/lxd: lxd slot implementation can also be an app
-      snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 11 Oct 2017 08:20:26 +0200
-
-snapd (2.28.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - interfaces: fix udev rules for tun
-    - release,cmd,dirs: Redo the distro checks to take into account
-      distribution families
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 10 Oct 2017 18:39:58 +0200
-
-snapd (2.28.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - snap-confine: update apparmor rules for fedora based basesnaps
-    - snapstate: rename refresh hook to post-refresh for consistency
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 27 Sep 2017 17:59:49 -0400
-
-snapd (2.28) xenial; urgency=medium
-
-  * New upstream release, LP: #1714984
-    - hooks: rename refresh to after-refresh
-    - snap-confine: bind mount /usr/lib/snapd relative to snap-confine
-    - cmd,dirs: treat "liri" the same way as "arch"
-    - snap-confine: fix base snaps on core
-    - hooks: substitute env vars when executing hooks
-    - interfaces: updates for default, browser-support, desktop, opengl,
-      upower and stub-resolv.conf
-    - cmd,dirs: treat manjaro the same as arch
-    - systemd: do not run auto-import and repair services on classic
-    - packaging/fedora: Ensure vendor/ is empty for builds and fix spec
-      to build current master
-    - many: fix TestSetConfNumber missing an Unlock and other fragility
-      improvements
-    - osutil: adjust StreamCommand tests for golang 1.9
-    - daemon: allow polkit authorisation to install/remove snaps
-    - tests: make TestCmdWatch more robust
-    - debian: improve package description
-    - interfaces: add netlink kobject uevent to hardware observe
-    - debian: update trusted account-keys check on 14.04 packaging
-    - interfaces/network-{control,observe}: allow receiving
-      kobject_uevent() messages
-    - tests: fix lxd test for external backend
-    - snap-confine,snap-update-ns: add -no-pie to fix FTBFS on
-      go1.7,ppc64
-    - corecfg: mock "systemctl" in all corecfg tests
-    - tests: fix unit tests on Ubuntu 14.04
-    - debian: add missing flags when building static snap-exec
-    - many: end-to-end support for the bare base snap
-    - overlord/snapstate: SetRootDir from SetUpTest, not in just some
-      tests
-    - store: have an ad-hoc method on cfg to get its list of uris for
-      tests
-    - daemon: let client decide whether to allow interactive auth via
-      polkit
-    - client,daemon,snap,store: add license field
-    - overlord/snapstate: rename HasCurrent to IsInstalled, remove
-      superfluous/misleading check from All
-    - cmd/snap: SetRootDir from SetUpTest, not in just some individual
-      tests.
-    - systemd: rename snap-repair.{service,timer} to snapd.snap-
-      repair.{service,timer}
-    - snap-seccomp: remove use of x/net/bpf from tests
-    - httputil: more naive per go version way to recreate a default
-      transport for tls reconfig
-    - cmd/snap-seccomp/main_test.go: add one more syscall for arm64
-    - interfaces/opengl: use == to compare, not =
-    - cmd/snap-seccomp/main_test.go: add syscalls for armhf and arm64
-    - cmd/snap-repair: track and use a lower bound for the time for
-      TLS checks
-    - interfaces: expose bluez interface on classic OS
-    - snap-seccomp: add in-kernel bpf tests
-    - overlord: always try to get a serial, lazily on classic
-    - tests: add nmcli regression test
-    - tests: deal with __PNR_chown on aarch64 to fix FTBFS on arm64
-    - tests: add autopilot-introspection interface test
-    - vendor: fix artifact from manually editing vendor/vendor.json
-    - tests: rename complexion to test-snapd-complexion
-    - interfaces: add desktop and desktop-legacy
-      interfaces/desktop: add new 'desktop' interface for modern DEs
-      interfaces/builtin/desktop_test.go: use modern testing techniques
-      interfaces/wayland: allow read on /etc/drirc for Plasma desktop
-      interfaces/desktop-legacy: add new 'legacy' interface (currently
-      for a11y and input)
-    - tests: fix race in snap userd test
-    - devices/iio: add read/write for missing sysfs entries
-    - spread: don't set HTTPS?_PROXY for linode
-    - cmd/snap-repair: check signatures of repairs from Next
-    - env: set XDG_DATA_DIRS for wayland et.al.
-    - interfaces/{default,account-control}: Use username/group instead
-      of uid/gid
-    - interfaces/builtin: use udev tagging more broadly
-    - tests: add basic lxd test
-    - wrappers: ensure bash completion snaps install on core
-    - vendor: use old golang.org/x/crypto/ssh/terminal to build on
-      powerpc again
-    - docs: add PULL_REQUEST_TEMPLATE.md
-    - interfaces: fix network-manager plug
-    - hooks: do not error out when hook is optional and no hook handler
-      is registered
-    - cmd/snap: add userd command to replace snapd-xdg-open
-    - tests: new regex used to validate the core version on extra snaps
-      ass...
-    - snap: add new `snap switch` command
-    - tests: wait more and more debug info about fakestore start issues
-    - apparmor,release: add better apparmor detection/mocking code
-    - interfaces/i2c: adjust sysfs rule for alternate paths
-    - interfaces/apparmor: add missing call to dirs.SetRootDir
-    - cmd: "make hack" now also installs snap-update-ns
-    - tests: copy files with less verbosity
-    - cmd/snap-confine: allow using additional libraries required by
-      openSUSE
-    - packaging/fedora: Merge changes from Fedora Dist-Git
-    - snapstate: improve the error message when classic confinement is
-      not supported
-    - tests: add test to ensure amd64 can run i386 syscall binaries
-    - tests: adding extra info for fakestore when fails to start
-    - tests: install most important snaps
-    - cmd/snap-repair: more test coverage of filtering
-    - squashfs: remove runCommand/runCommandWithOutput as we do not need
-      it
-    - cmd/snap-repair: ignore superseded revisions, filter on arch and
-      models
-    - hooks: support for refresh hook
-    - Partial revert "overlord/devicestate, store: update device auth
-      endpoints URLs"
-    - cmd/snap-confine: allow reading /proc/filesystems
-    - cmd/snap-confine: genearlize apparmor profile for various lib
-      layout
-    - corecfg: fix proxy.* writing and add integration test
-    - corecfg: deal with system.power-key-action="" correctly
-    - vendor: update vendor.json after (presumed) manual edits
-    - cmd/snap: in `snap info`, don't print a newline between tracks
-    - daemon: add polkit support to /v2/login
-    - snapd,snapctl: decode json using Number
-    - client: fix go vet 1.7 errors
-    - tests: make 17.04 shellcheck clean
-    - tests: remove TestInterfacesHelp as it breaks when go-flags
-      changes
-    - snapstate: undo a daemon restart on classic if needed
-    - cmd/snap-repair: recover brand/model from
-      /var/lib/snapd/seed/assertions checking signatures and brand
-      account
-    - spread: opt into unsafe IO during spread tests
-    - snap-repair: update snap-repair/runner_test.go for API change in
-      makeMockServer
-    - cmd/snap-repair: skeleton code around actually running a repair
-    - tests: wait until the port is listening after start the fake store
-    - corecfg: fix typo in tests
-    - cmd/snap-repair: test that redirects works during fetching
-    - osutil: honor SNAPD_UNSAFE_IO for testing
-    - vendor: explode and make more precise our golang.go/x/crypto deps,
-      use same version as Debian unstable
-    - many: sanitize NewStoreStack signature, have shared default store
-      test private keys
-    - systemd: disable `Nice=-5` to fix error when running inside lxd
-    - spread.yaml: update delta ref to 2.27
-    - cmd/snap-repair: use E-Tags when refetching a repair to retry
-    - interfaces/many: updates based on chromium and mrrescue denials
-    - cmd/snap-repair: implement most logic to get the next repair to
-      run/retry in a brand sequence
-    - asserts/assertstest: copy headers in SigningDB.Sign
-    - interfaces: convert uhid to common interface and test cases
-      improvement for time_control and opengl
-    - many tests: move all panicing fake store methods to a common place
-    - asserts: add store assertion type
-    - interfaces: don't crash if content slot has no attributes
-    - debian: do not build with -buildmode=pie on i386
-    - wrappers: symlink completion snippets when symlinking binaries
-    - tests: adding more debug information for the interfaces-cups-
-      control …
-    - apparmor: pass --quiet to parser on load unless SNAPD_DEBUG is set
-    - many: allow and support serials signed by the 'generic' authority
-      instead of the brand
-    - corecfg: add proxy configuration via `snap set core
-      proxy.{http,https,ftp}=...`
-    - interfaces: a bunch of interfaces test improvement
-    - tests: enable regression and completion suites for opensuse
-    - tests: installing snapd for nested test suite
-    - interfaces: convert lxd_support to common iface
-    - interfaces: add missing test for camera interface.
-    - snap: add support for parsing snap layout section
-    - cmd/snap-repair: like for downloads we cannot have a timeout (at
-      least for now), less aggressive retry strategies
-    - overlord: rely on more conservative ensure interval
-    - overlord,store: no piles of return args for methods gathering
-      device session request params
-    - overlord,store: send model assertion when setting up device
-      sessions
-    - interfaces/misc: updates for unity7/x11, browser-
-      support, network-control and mount-observe
-      interfaces/unity7,x11: update for NETLINK_KOBJECT_UEVENT
-      interfaces/browser-support: update sysfs reads for
-      newer browser versions, interfaces/network-control: rw for
-      ieee80211 advanced wireless interfaces/mount-observe: allow read
-      on sysfs entries for block devices
-    - tests: use dnf --refresh install to avert stale cache
-    - osutil: ensure TestLockUnlockWorks uses supported flock
-    - interfaces: convert lxd to common iface
-    - tests: restart snapd to ensure re-exec settings are applied
-    - tests: fix interfaces-cups-control test
-    - interfaces: improve and tweak bunch of interfaces test cases.
-    - tests: adding extra worker for fedora
-    - asserts,overlord/devicestate: support predefined assertions that
-      don't establish foundational trust
-    - interfaces: convert two hardware_random interfaces to common iface
-    - interfaces: convert io_ports_control to common iface
-    - tests: fix for  upgrade test on fedora
-    - daemon, client, cmd/snap: implement snap start/stop/restart
-    - cmd/snap-confine: set _FILE_OFFSET_BITS to 64
-    - interfaces: covert framebuffer to commonInterface
-    - interfaces: convert joystick to common iface
-    - interfaces/builtin: add the spi interface
-    - wrappers, overlord/snapstate/backend: make link-snap clean up on
-      failure.
-    - interfaces/wayland: add wayland interface
-    - interfaces: convert kvm to common iface
-    - tests: extend upower-observe test to cover snaps providing slots
-    - tests: enable main suite for opensuse
-    - interfaces: convert physical_memory_observe to common iface
-    - interfaces: add missing test for optical_drive interface.
-    - interfaces: convert physical_memory_control to common iface
-    - interfaces: convert ppp to common iface
-    - interfaces: convert time-control to common iface
-    - tests: fix failover test
-    - interfaces/builtin: rework for avahi interface
-    - interfaces: convert broadcom-asic-control to common iface
-    - snap/snapenv: document the use of CoreSnapMountDir for SNAP
-    - packaging/arch: drop patches merged into master
-    - cmd: fix mustUnsetenv docstring (thanks to Chipaca)
-    - release: remove default from VERSION_ID
-    - tests: enable regression, upgrade and completion test suites for
-      fedora
-    - tests: restore interfaces-account-control properly
-    - overlord/devicestate, store: update device auth endpoints URLs
-    - tests: fix install-hook test failure
-    - tests: download core and ubuntu-core at most once
-    - interfaces: add common support for udev
-    - overlord/devicestate: fix, don't assume that the serial is backed
-      by a 1-key chain
-    - cmd/snap-confine: don't share /etc/nsswitch from host
-    - store: do not resume a download when we already have the whole
-      thing
-    - many: implement "snap logs"
-    - store: don't call useDeltas() twice in quick succession
-    - interfaces/builtin: add kvm interface
-    - snap/snapenv: always expect /snap for $SNAP
-    - cmd: mark arch as non-reexecing distro
-    - cmd: fix tests that assume /snap mount
-    - gitignore: ignore more build artefacts
-    - packaging: add current arch packaging
-    - interfaces/unity7: allow receiving media key events in (at least)
-      gnome-shell
-    - interfaces/many, cmd/snap-confine: miscellaneous policy updates
-    - interfaces/builtin: implement broadcom-asic-control interface
-    - interfaces/builtin: reduce duplication and remove cruft in
-      Sanitize{Plug,Slot}
-    - tests: apply underscore convention for SNAPMOUNTDIR variable
-    - interfaces/greengrass-support: adjust accesses now that have
-      working snap
-    - daemon, client, cmd/snap: implement "snap services"
-    - tests: fix refresh tests not stopping fake store for fedora
-    - many: add the interface command
-    - overlord/snapstate/backend: some copydata improvements
-    - many: support querying and completing assertion type names
-    - interfaces/builtin: discard empty Validate{Plug,Slot}
-    - cmd/snap-repair:  start of Runner, implement first pass of Peek
-      and Fetch
-    - tests: enable main suite on fedora
-    - snap: do not always quote the snap info summary
-    - vendor: update go-flags to address crash in "snap debug"
-    - interfaces: opengl support pci device and vendor
-    - many: start implenting "base" snap type on the snapd side
-    - arch,release: map armv6 correctly
-    - many: expose service status in 'snap info'
-    - tests: add browser-support interface test
-    - tests: disable snapd-notify for the external backend
-    - interfaces: Add /run/uuid/request to openvswitch
-    - interfaces: add password-manager-service implicit classic
-      interface
-    - cmd: rework reexec detection
-    - cmd: fix re-exec bug when starting from snapd 2.21
-    - tests: dependency packages installed during prepare-project
-    - tests: remove unneeded check for re-exec in InternalToolPath()
-    - cmd,tests: fix classic confinement confusing re-execution code
-    - store: configurable base api
-    - tests: fix how package lists are updated for opensuse and fedora
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 25 Sep 2017 12:07:34 -0400
-
-snapd (2.27.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - interfaces: add udev netlink support to hardware-observe
-    - interfaces/network-{control,observe}: allow receiving
-      kobject_uevent() messages
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 07 Sep 2017 10:22:18 +0200
-
-snapd (2.27.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - interfaces: fix network-manager plug regression
-    - hooks: do not error when hook handler is not registered
-    - interfaces/alsa,pulseaudio: allow read on udev data for sound
-    - interfaces/optical-drive: read access to udev data for /dev/scd*
-    - interfaces/browser-support: read on /proc/vmstat and misc udev
-      data
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 30 Aug 2017 07:32:20 +0200
-
-snapd (2.27.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - snap-seccomp: add secondary arch for unrestricted snaps as well
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 24 Aug 2017 08:51:22 +0200
-
-snapd (2.27.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - systemd: disable `Nice=-5` to fix error when running inside lxdSee
-      https://bugs.launchpad.net/snapd/+bug/1709536
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 18 Aug 2017 15:49:56 +0200
-
-snapd (2.27.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - tests: remove TestInterfacesHelp as it breaks when go-flags
-      changes
-    - interfaces: don't crash if content slot has no attributes
-    - debian: do not build with -buildmode=pie on i386
-    - interfaces: backport broadcom-asic-control interface
-    - interfaces: allow /usr/bin/xdg-open in unity7
-    - store: do not resume a download when we already have the whole
-      thing
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 16 Aug 2017 12:14:51 +0200
-
-snapd (2.27.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798:
-    - tests: use dnf --refresh install to avert stale cache
-    - tests: fix test failure on 14.04 due to old version of
-      flock
-    - updates for unity7/x11, browser-support, network-control,
-      mount-observe
-    - interfaces/unity7,x11: update for NETLINK_KOBJECT_UEVENT
-    - interfaces/browser-support: update sysfs reads for
-      newer browser versions
-    - interfaces/network-control: rw for ieee80211 advanced wireless
-    - interfaces/mount-observe: allow read on sysfs entries for block
-      devices
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 14 Aug 2017 08:02:17 +0200
-
-snapd (2.27) xenial; urgency=medium
-
-  * New upstream release, LP: #1703798
-    - fix build failure on 32bit fedora
-    - interfaces: add password-manager-service implicit classic interface
-    - interfaces/greengrass-support: adjust accesses now that have working
-      snap
-    - interfaces/many, cmd/snap-confine: miscellaneous policy updates
-    - interfaces/unity7: allow receiving media key events in (at least)
-      gnome-shell
-    - cmd: fix re-exec bug when starting from snapd 2.21
-    - tests: restore interfaces-account-control properly
-    - cmd: fix tests that assume /snap mount
-    - cmd: mark arch as non-reexecing distro
-    - snap-confine: don't share /etc/nsswitch from host
-    - store: talk to api.snapcraft.io for purchases
-    - hooks: support for install and remove hooks
-    - packaging: fix Fedora support
-    - tests: add bluetooth-control interface test
-    - store: talk to api.snapcraft.io for assertions
-    - tests: remove snapd before building from branch
-    - tests: add avahi-observe interface test
-    - store: orders API now checks if customer is ready
-    - cmd/snap: snap find only searches stable
-    - interfaces: updates default, mir, optical-observe, system-observe,
-      screen-inhibit-control and unity7
-    - tests: speedup prepare statement part 1
-    - store: do not send empty refresh requests
-    - asserts: fix error handling in snap-developer consistency check
-    - systemd: add explicit sync to snapd.core-fixup.sh
-    - snapd: generate snap cookies on startup
-    - cmd,client,daemon: expose "force devmode" in sysinfo
-    - many: introduce and use strutil.ListContains and also
-      strutil.SortedListContains
-    - assserts,overlord/assertstate: test we don't accept chains of
-      assertions founded on a self-signed key coming externally
-    - interfaces: enable access to bridge settings
-    - interfaces: fix copy-pasted iio vs io in io-ports-control
-    - cmd/snap-confine: various small fixes and tweaks to seccomp
-      support code
-    - interfaces: bring back seccomp argument filtering
-    - systemd, osutil: rework systemd logs in preparation for services
-      commands
-    - tests: store /etc/systemd/system/snap-*core*.mount in snapd-
-      state.tar.gz
-    - tests: shellcheck improvements for tests/main tasks - first set of
-      tests
-    - cmd/snap: `--last` for abort and watch, and aliases
-      (search→find, change→tasks)
-    - tests: shellcheck improvements for tests/lib scripts
-    - tests: create ramdisk if it's not present
-    - tests: shellcheck improvements for nightly upgrade and regressions
-      tests
-    - snapd: fix for snapctl get panic on null config values.
-    - tests: fix for rng-tools service not restarting
-    - systemd: add snapd.core-fixup.service unit
-    - cmd: avoid using current symlink in InternalToolPath
-    - tests: fix timeout issue for test refresh core with hanging …
-    - intefaces: control bridged vlan/ppoe-tagged traffic
-    - cmd/snap: include snap type in notes
-    - overlord/state: Abort() only visits each task once
-    - tests: extend find-private test to cover more cases
-    - snap-seccomp: skip socket() tests on systems that use socketcall()
-      instead of socket()
-    - many: support snap title as localized/title-cased name
-    - snap-seccomp: deal with mknod on aarch64 in the seccomp tests
-    - interfaces: put base policy fragments inside each interface
-    - asserts: introduce NewDecoderWithTypeMaxBodySize
-    - tests: fix snapd-notify when it takes more time to restart
-    - snap-seccomp: fix snap-seccomp tests in artful
-    - tests: fix for create-key task to avoid rng-tools service ramains
-      alive
-    - snap-seccomp: make sure snap-seccomp writes the bpf file
-      atomically
-    - tests: do not disable ipv6 on core systems
-    - arch: the kernel architecture name is armv7l instead of armv7
-    - snap-confine: ensure snap-confine waits some seconds for seccomp
-      security profiles
-    - tests: shellcheck improvements for tests/nested tasks
-    - wrappers: add SyslogIdentifier to the service unit files.
-    - tests: shellcheck improvements for unit tasks
-    - asserts: implement FindManyTrusted as well
-    - asserts: open up and optimize Encoder to help avoiding unnecessary
-      copying
-    - interfaces: simplify snap-confine by just loading pre-generated
-      bpf code
-    - tests: restart rng-tools services after few seconds
-    - interfaces, tests: add mising dbus abstraction to system-observe
-      and extend spread test
-    - store: change main store host to api.snapcraft.io
-    - overlord/cmdstate: new package for running commands as tasks.
-    - spread: help libapt resolve installing libudev-dev
-    - tests: show the IP from .travis.yaml
-    - tests/main: use pkgdb function in more test cases
-    - cmd,daemon: add debug command for displaying the base policy
-    - tests: prevent quoting error on opensuse
-    - tests: fix nightly suite
-    - tests: add linode-sru backend
-    - snap-confine: validate SNAP_NAME against security tag
-    - tests: fix ipv6 disable for ubuntu-core
-    - tests: extend core-revert test to cover bluez issues
-    - interfaces/greengrass-support: add support for Amazon Greengrass
-      as a snap
-    - asserts: support timestamp and optional disabled header on repair
-    - tests: reboot after upgrading to snapd on the -proposed pocket
-    - many: fix test cases to work with different DistroLibExecDir
-    - tests: reenable help test on ubuntu and debian systems
-    - packaging/{opensuse,fedora}: allow package build with testkeys
-      included
-    - tests/lib: generalize RPM build support
-    - interfaces/builtin: sync connected slot and permanent slot snippet
-    - tests: fix snap create-key by restarting automatically rng-tools
-    - many: switch to use http numeric statuses as agreed
-    - debian: add missing  Type=notify in 14.04 packaging
-    - tests: mark interfaces-openvswitch as manual due to prepare errors
-    - debian: unify built_using between the 14.04 and 16.04 packaging
-      branch
-    - tests: pull from urandom when real entropy is not enough
-    - tests/main/manpages: install missing man package
-    - tests: add refresh --time output check
-    - debian: add missing "make -C data/systemd clean"
-    - tests: fix for upgrade test when it is repeated
-    - tests/main: use dir abstraction in a few more test cases
-    - tests/main: check for confinement in a few more interface tests
-    - spread: add fedora snap bin dir to global PATH
-    - tests: check that locale-control is not present on core
-    - many: snapctl outside hooks
-    - tests: add whoami check
-    - interfaces: compose the base declaration from interfaces
-    - tests: fix spread flaky tests linode
-    - tests,packaging: add package build support for openSUSE
-    - many: slight improvement of some snap error messaging
-    - errtracker: Include /etc/apparmor.d/usr.lib.snap-confine md5sum in
-      err reports
-    - tests: fix for the test postrm-purge
-    - tests: restoring the /etc/environment and service units config for
-      each test
-    - daemon: make snapd a "Type=notify" daemon and notify when startup
-      is done
-    - cmd/snap-confine: add support for --base snap
-    - many: derive implicit slots from interface meta-data
-    - tests: add core revert test
-    - tests,packaging: add package build support for Fedora for our
-      spread setup
-    - interfaces: move base declaration to the policy sub-package
-    - tests: fix for snapd-reexec test cheking for restart info on debug
-      log
-    - tests: show available entropy on error
-    - tests: clean journalctl logs on trusty
-    - tests: fix econnreset on staging
-    - tests: modify core before calling set
-    - tests: add snap-confine privilege test
-    - tests: add staging snap-id
-    - interfaces/builtin: silence ptrace denial for network-manager
-    - tests: add alsa interface spread test
-    - tests: prefer ipv4 over ipv6
-    - tests: fix for econnreset test checking that the download already
-      started
-    - httputil,store: extract retry code to httputil, reorg usages
-    - errtracker: report if snapd did re-execute itself
-    - errtracker: include bits of snap-confine apparmor profile
-    - tests: take into account staging snap-ids for snap-info
-    - cmd: add stub new snap-repair command and add timer
-    - many: stop "snap refresh $x --channel invalid" from working
-    - interfaces: revert "interfaces: re-add reverted ioctl and quotactl
-    - snapstate: consider connect/disconnect tasks in
-      CheckChangeConflict.
-    - interfaces: disable "mknod |N" in the default seccomp template
-      again
-    - interfaces,overlord/ifacestate: make sure installing slots after
-      plugs works similarly to plugs after slots
-    - interfaces/seccomp: add bind() syscall for forced-devmode systems
-    - packaging/fedora: Sync packaging from Fedora Dist-Git
-    - tests: move static and unit tests to spread task
-    - many: error types should be called FooError, not ErrFoo.
-    - partition: add directory sync to the save uboot.env file code
-    - cmd: test everything (100% coverage \o/)
-    - many: make shell scripts shellcheck-clean
-    - tests: remove additional setup for docker on core
-    - interfaces: add summary to each interface
-    - many: remove interface meta-data from list of connections
-    - logger (& many more, to accommodate): drop explicit syslog.
-    - packaging: import packaging bits for opensuse
-    - snapstate,many: implement snap install --unaliased
-    - tests/lib: abstract build dependency installation a bit more
-    - interfaces, osutil: move flock code from interfaces/mount to
-      osutil
-    - cmd: auto import assertions only from ext4,vfat file systems
-    - many: refactor in preparation for 'snap start'
-    - overlord/snapstate: have an explicit code path last-refresh
-      unset/zero => immediately refresh try
-    - tests: fixes for executions using the staging store
-    - tests: use pollinate to seed the rng
-    - cmd/snap,tests: show the sha3-384 of the snap for snap info
-      --verbose SNAP-FILE
-    - asserts: simplify and adjust repair assertion definition
-    - cmd/snap,tests: show the snap id if available in snap info
-    - daemon,overlord/auth: store from model assertion wins
-    - cmd/snap,tests/main: add confinement switch instead of spread
-      system blacklisting
-    - many: cleanup MockCommands and don't leave a process around after
-      hookstate tests
-    - tests: update listing test to the core version number schema
-    - interfaces: allow snaps to use the timedatectl utility
-    - packaging: Add Fedora packaging files
-    - tests/libs: add distro_auto_remove_packages function
-    - cmd/snap: correct devmode note for anomalous state
-    - tests/main/snap-info: use proper pkgdb functions to install distro
-      packages
-    - tests/lib: use mktemp instead of tempfile to work cross-distro
-    - tests: abstract common dirs which differ on distributions
-    - many: model and expose interface meta-data.
-    - overlord: make config defaults from gadget work also at first boot
-    - interfaces/log-observe: allow using journalctl from hostfs for
-      classic distro
-    - partition,snap: add support for android boot
-    - errtracker: small simplification around readMachineID
-    - snap-confine: move rm_rf_tmp to test-utils.
-    - tests/lib: introduce pkgdb helper library
-    - errtracker: try multiple paths to read machine-id
-    - overlord/hooks: make sure only one hook for given snap is executed
-      at a time.
-    - cmd/snap-confine: use SNAP_MOUNT_DIR to setup /snap inside the
-      confinement env
-    - tests: bump kill-timeout and remove quiet call on build
-    - tests/lib/snaps: add a test store snap with a passthrough
-      configure hook
-    - daemon: teach the daemon to wait on active connections when
-      shutting down
-    - tests: remove unit tests task
-    - tests/main/completion: source from /usr/share/bash-completion
-    - assertions: add "repair" assertion
-    - interfaces/seccomp: document Backend.NewSpecification
-    - wrappers: make StartSnapServices cleanup any services that were
-      added if a later one fails
-    - overlord/snapstate: avoid creating command aliases for daemons
-    - vendor: remove unused packages
-    - vendor,partition: fix panics from uenv
-    - cmd,interfaces/mount: run snap-update-ns and snap-discard-ns from
-      core if possible
-    - daemon: do not allow to install ubuntu-core anymore
-    - wrappers: service start/stop were inconsistent
-    - tests: fix failing tests (snap core version, syslog changes)
-    - cmd/snap-update-ns: add actual implementation
-    - tests: improve entropy also for ubuntu
-    - cmd/snap-confine: use /etc/ssl from the core snap
-    - wrappers: don't convert between []byte and string needlessly.
-    - hooks: default timeout
-    - overlord/snapstate: Enable() was ignoring the flags from the
-      snap's state, resulting in losing "devmode" on disable/enable.
-    - difs,interfaces/mount: add support for locking namespaces
-    - interfaces/mount: keep track of kept mount entries
-    - tests/main: move a bunch of greps over to MATCH
-    - interfaces/builtin: make all interfaces private
-    - interfaces/mount: spell unmount correctly
-    - tests: allow 16-X.Y.Z version of core snap
-    - the timezone_control interface only allows changing /etc/timezone
-      and /etc/writable/timezone. systemd-timedated also updated the
-      link of /etc/localtime and /etc/writable/localtime ... allow
-      access to this file too
-    - cmd/snap-confine: aggregate operations holding global lock
-    - api, ifacestate: resolve disconnect early
-    - interfaces/builtin: ensure we don't register interfaces twice
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 10 Aug 2017 12:43:16 +0200
-
-snapd (2.26.14) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cmd: fix incorrect re-exec when starting from snapd 2.21
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 20 Jul 2017 13:52:05 +0200
-
-snapd (2.26.13) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cmd,tests: fix classic confinement confusing re-execution code
-    - cmd: fix incorrect check check for re-exec in InternalToolPath()
-    - snap-seccomp: add secondary arch for unrestricted snaps as well
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 18 Jul 2017 20:34:33 +0200
-
-snapd (2.26.10) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - Fix snap-seccomp tests in artful/trusty on i386/s390x/aarch64
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 17 Jul 2017 11:58:22 +0200
-
-snapd (2.26.9) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - statically link libseccomp in snap-seccomp to fix refresh issue
-      on trusty
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 12 Jul 2017 08:27:14 +0200
-
-snapd (2.26.8) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - Fix snap-seccomp tests in artful/trusty on i386/s390x/aarch64
-    - add snapd.core-fixup.service unit
-    - ensure re-exec uses the right internal tools
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 05 Jul 2017 07:48:22 +0200
-
-snapd (2.26.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - interfaces: allow snaps to use the timedatectl utility in
-      time-control
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 27 Jun 2017 08:36:23 +0100
-
-snapd (2.26.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - backport of seccomp-bpf branch to the 2.26 release to ensure snap
-      revert with new seccomp syntax works correctly
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 26 Jun 2017 15:30:15 +0100
-
-snapd (2.26.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - partly revert aace15ab53 to unbreak core reverts
-    - Revert "interfaces: re-add reverted ioctl and quotactl (revert 21bc6b9f)"
-    - Disable "mknod |N" in the default seccomp template
-      reasons outline in https://forum.snapcraft.io/t/snapd-2-25-blocked-because-of-revert-race-condition
-    - errtracker: include bits of snap-confine apparmor profile
-    - errtracker: report if snapd did re-execute itself 
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 01 Jun 2017 18:50:52 +0200
-
-snapd (2.26.3) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cherry pick test fixes f0103a6, 9de5c8a, d7725a7 to make
-      sure the image tests are updated for the changes in the
-      `snap info core` output and the removal of the rsyslog
-      package from core.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 17 May 2017 11:31:56 +0200
-
-snapd (2.26.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - cherry pick d444728 to make the uboot.env file parsing more
-      robust
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 16 May 2017 18:37:07 +0200
-
-snapd (2.26.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - store: fix panic error in auth
-    - tests: the new ubuntu-image snap needs classic confinement, adjust
-      tests
-    - cmd/snap-confine: don't fail on pre 3.8 kernel
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 May 2017 21:44:27 +0200
-
-snapd (2.26) xenial; urgency=medium
-
-  * New upstream release, LP: #1690083
-    - timeutil: avoid panicking when the window is very small
-    - image: fix go vet issue
-    - overlord/ifacestate: don't spam logs with harmless auto-connect
-      messages
-    - interfaces/builtin: add network-status interface
-    - interfaces/builtin: add online-accounts-service interface
-    - interfaces/builtin: distribute code of touching allInterfaces
-    - interfaces: API additions for interface hooks
-    - interfaces/builtin: add storage-framework-service interface
-    - tests: disable create-key test on ppc64el for artful (expect not
-      working)
-    - snap: make `snap prepare-image --extra-snaps` derive side info
-    - tests: unify tests/{main/completion,completion}/lib.exp0
-    - cmd/snap: tweak info channels output
-    - interfaces: ensure that legacy interface methods are unused
-    - packaging: cleanup how built-using is generated
-    - tests: extend kernel-module-control interface test
-    - interfaces/network: workaround Go's need for NETLINK_ROUTE with
-      'net'.
-    - cmd/snap-confine: use defensive argument parser
-    - tests: add test for empty snap name on revert
-    - overlord/hookstate: remove unused Context.timeout
-    - tests: additional setup in docker test for core systems
-    - configstate: return error if patch is invalid
-    - interfaces: add random interface
-    - store, daemon, client, cmd/snap: handle PASSWORD_POLICY_ERROR
-    - cmd/snap, client: add "whoami" command
-    - cmd/snap: iterate interface tab completion
-    - snap: move locale-control to only be present on classic
-    - interfaces/browser-support: deny read on squashfs backing files
-      and LVM vg names
-    - tests: wait for the docker socket to be listening
-    - snap: add `snap refresh --time` option
-    - tests: re-enable and moderninze /media sharing test
-    - cmd: make rst2man optional
-    - tests: remove quoting from [[ ]] when globs
-    - interfaces: allow plugging DBus clients to introspect the slot
-      service
-    - packaging/ubuntu*/changelog: drop extra dash
-    - snap-confine: init the ENTRY variable, coverity is unhappy
-      otherwise
-    - cmd/snap-confine/spread-tests: discard useless --version test
-    - spread: add spread target qemu:debian-9-64
-    - interfaces: mediate netlink sockets via seccomp
-    - tests,cmd/snap-confine: port older snapd-discard-ns tests
-    - cmd/snap-confine/tests: fix shellcheck on recently added files
-    - tests/upgrade: force install core snap from beta for debian
-    - overlord/snapstate/backend,interfaces/mount: move ns management
-      code.
-    - tests: extend network-control spread test to cope with network
-      namespaces
-    - tests: fail early in the spread suite if trying to run it inside a
-      container
-    - tests: set ownership of $PROJECT_PATH for the external backend
-    - tests: specify the auto-refreshable snap being tested
-    - many: fix tests with go1.8 / artful
-    - fix for tests: debian does not have /snap/bin in secure_path so
-      sudo
-    - snap: support for snap tasks --last=...
-    - cmd/snap-confine: remove obsolete debug message
-    - address review feedback, add a lot of comments :-), call
-      shellcheck on the completion scripts, fix a bug in compopt
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 May 2017 10:05:44 +0200
-
-snapd (2.25) xenial; urgency=medium
-
-  * New upstream release, LP: #1686713
-    - interfaces/default: allow mknod for regular files, pipes and
-      sockets
-    - many: use "SNAP.APP as ALIAS" instead of => when listing
-      added/removed aliases
-    - cmd/snap-confine: write current mount profile
-    - cmd/snap-discard-ns: remove current profile when cleaning up
-    - many: support debian in our CI
-    - tests: tweak time for econnreset test a bit more
-    - cmd/snap-confine: re-enable re-assciate fix for CE
-    - many: aliases v2 cleanups
-    - cmd/snap-confine: don't use apparmor if it is disabled on boot
-    - many: implement `snap prefer <snap>`  (aliases v2)
-    - many: adjust /aliases and "snap aliases" to aliases v2, also some
-      cleanup
-    - snapstate: normalize gadget defaults
-    - many: allow core refresh.schedule setting
-    - many: show alias changes on snap alias/unalias (aliases v2)
-    - client,cmd/snap: improve messaging on --devmode and --classic
-    - many: implement `snap unalias <alias-or-snap>` (aliases v2)
-    - store: retry on connection reset
-    - interfaces/mount: add Change.Perform
-    - tests: add openvswitch interface spread test
-    - interfaces/i2c: allow modifying device-specific sysfs entries
-    - interfaces: allow writing to /run/systemd/journal/stdout by
-      default
-    - tests: ensure travis fails early if static checks fail
-    - store,daemon: make store interpret channel="" as stable in most
-      cases
-    - overlord/snapstate: make UpdateAliases idempotent, simplify the
-      backend interface bits for aliases not used anymore (aliases v2)
-    - many: implement snap alias <snap.app> <alias> (aliases v2)
-    - snap-confine: add code to ensure that / or /snap is mounted
-      "shared"
-    - many: show available "tracks" in `snap info`
-    - cmd/snap: make users Xauthority file available in snap environment
-    - interfaces/mount: write current fstab files with mode 0644
-    - overlord: switch to aliases v2 tasks for install/refresh etc ops
-      plus transition
-    - tests: parameterize gadget snap channel (#3117)
-    - tests: copy .real profile as .real
-    - tests: add empty initrd failover test
-    - many: mount squashfs as read-only
-    - cmd: make locking around namespaces explicit
-    - tests: address review comments from #3186
-    - tests: add dbus interface spread test
-    - interfaces/mount: add ReadMountInfo and LoadMountInfo
-    - snap: require snap name for 'revert'
-    - overlord: maintain per-revision snapshots of snap configuration
-    - tests: relax network-bind interface regexps
-    - interfaces: re-add reverted ioctl and quotactl (revert 21bc6b9f)
-    - store: retry once on hashsum mismatches in a Download()
-    - interfaces/builtin: don't panic if content plug has nil attrs
-    - interfaces/mount: pass mount.Profile to mount.NeededChanges
-    - packaging: add `built-using` header for 16.04 packaging
-    - interfaces: add media-hub interface
-    - interfaces/builtin: allow full access to properties iface of the
-      udisks service
-    - tests: handle case when both .real and plain are present
-    - interfaces/mount: add Change.String for readable output
-    - tests: ensure we mock force dev mode as well to fix FTBFS in
-      sbuild
-    - store: add more logs around retry in download
-    - interfaces/mount: add stub Change.{Needed,Perform}
-    - tests: allow installing snapd from -proposed for SRU validation
-    - interfaces/mount: parse mount options to map[string]string
-    - snap: added tasks subcommand
-    - tests: copy snap-confine apparmor profile into testbed
-    - interfaces/mount: improve go identifier names of mountinfo, parse
-      optional fields
-    - Arch Linux wants to respect FHS
-      (https://bugs.archlinux.org/task/53656),
-    - daemon: do not set RemoveSnapPath flag when doing a try
-    - debian: add maintscript helper to remove usr.lib.snapd.snap-
-      confine in snap-confine
-    - cmd/snap-confine: don't use plain "classic" term
-    - cmd/snap-confine: set TMPDIR and TEMPDIR each time
-    - many: fixes for `go vet` in go 1.7
-    - tests: add kernel-module-control interface test
-    - overlord/snapstate: introduce tasks for aliases v2 semantics with
-      temporary names for now (aliases v2)
-    - overlord/devicestate: switch to ssh-keygen for device key
-      generation
-    - snap: skip /dev/ram from auto-import assertions to make it less
-      noisy (#3010)
-    - interfaces: add kubernetes-support interface and adjust related
-      interfaces (LP: #1664638)
-    - tests: download previous snapd package from published versions
-      instead of specific PPA
-    - snap: run snap-confine from core if snap is also running from core
-    - overlord/ifacestate: automatically rename connections on core snap
-    - many: break the /aliases mutation API with a clean 400 (aliases
-      v2)
-    - interfaces/builting: allow read-only access to /sys/module
-    - tests: add extra test after the core transition for snap get/set
-      core
-    - store: misc cleanups in tests
-    - interfaces/mount: add parser for mountinfo entries
-    - store: tests for unexpected EOF
-    - tests: fix unity test
-    - interfaces,overlord: log interface auto-connection failures
-    - cmd/snap-update-ns: add C preamble for setns
-    - interfaces: validate plug/slot uniqueness
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 28 Apr 2017 07:57:49 +0200
-
-snapd (2.24.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1681799:
-    - fix autopkgtest failures with stable core snap
-    - ensure the snap-confine transitional package cleans up
-      the no-longer-used apparmor profile to fix the kernels
-      autopkgtest failures
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 19 Apr 2017 11:54:33 +0200
-
-snapd (2.24) xenial; urgency=medium
-
-  * New upstream release, LP: #1681799:
-    - interfaces/mount: add InfoEntry type
-    - many: fix plug auto-connect during core transition
-    - interfaces: fold network bind into core support with tests
-    - .travis.yml: add option to make raw log less noisy
-    - interfaces: adjust shm accesses to use 'm' for updated mmap kernel
-      mediation
-    - many: rename two core plugs that clash with slot names
-    - snap-confine,browser-support: /dev/tty for snap-confine, misc
-      browser-support for gnome-shell
-    - store: add download test with EOF in the middle
-    - tests: adjust to look for network-bind-plug
-    - store: make hash error message more accurate
-    - overlord/snapstate: simplify AliasesStatus down to just an
-      AutoAliasesDisabled bool flag (aliases v2)
-    - errtracker: never send errtracker reports when running under
-      SNAPPY_TESTING
-    - interfaces/repo: validate slot/plug names
-    - daemon: Give the snap directories via GET /v2/system-info
-    - interfaces/unity7: support unity messaging menu
-    - interfaces/mount: add high-level Profile functions
-    - git: ignore only the cmd/Makefile{,.in}
-    - cmd: explicitly set _GNU_SOURCE and _FILE_OFFSET_BITS for xfs
-      support
-    - daemon: add desktop file location for app to the API
-    - overlord,release: disable classic snap support when not possible
-    - overlord: fix TestEnsureLoopPrune not to be so racy
-    - many: abstract path to /bin/{true,false}
-    - data/systemd: tweak data/systemd/Makefile to be slightly simpler
-    - store: handle EOF via url.Error check
-    - packaging: use templates for relevant systemd units
-    - tests: run gccgo only on ubuntu-16.04-64
-    - .travis.yml: remove travis matrix and do a single sequential run
-    - overlord/state: make sure that setting to nil a state key is
-      equivalent to deleting it
-    - tests: fix incorrect shell expression
-    - interfaces/mount: add OptsToFlags for converting arguments to
-      syscall…
-    - interfaces: add a joystick interface
-    - tests: enable docker test for more ubuntu-core systems
-    - tests: download and install additional dependencies when using
-      prepackaged snapd
-    - many: add support for partially static builds
-    - interfaces: allow slot to introspect dbus-daemon in dbus
-      interface, allow /usr/bin/arch by default
-    - interfaces/mount: fix golint issues
-    - interfaces/mount: add function for saving fstab-like file
-    - osutil: introducing GetenvInt64, like GetenvBool but Int64er.
-    - interfaces: drop udev tagging from framebuffer interface
-    - snapstate: more helpers to work with aliases state (aliases
-      v2)
-    - interfaces/mount: add function for parsing fstab-like file
-    - cmd: disable the re-associate fix as requested by jdstrand
-    - overlord/snapstate: unlock/relock the state less, especially not
-      across mutating the SnapState of a snap
-    - interfaces: allow executing ld.so (needed with new AppArmor base
-      abstraction)
-    - interfaces/mount: add function for parsing mount entries
-    - cmd: rework header check for xfs/xqm.h
-    - cmd: add poky to the list of distros which don't support reexec
-    - overlord: finish reorg, revert "be more conservative until we have
-      cut 2.23.x"
-    - cmd: select what socket to use in cmd/snap{,ctl}
-    - overlord: remove snap config values when snap is removed
-    - snapstate: introduce helper to apply to disk a alias states change
-      for a snap (aliases v2)
-    - configstate,hookstate: timeout the configure hook after 5 mins,
-      report failures to the errtracker
-    - interfaces/seccomp: add bind as part of the default seccomp policy
-      for hooks
-    - cmd: discard the C implementation of snap-update-ns
-    - tests: remove stale apt proxy leftover from cloud-init
-    - tests: move unity test to nightly suite
-    - interfaces: add support for location-observe for
-      dbus::ObjectManager session paths
-    - boot: log error in KernelOrOsRebootRequired
-    - interfaces: remove old API
-    - interfaces: use udev spec
-    - interfaces: convert systemd backend to new APIs
-    - osutil: add BootID
-    - tests: move docker test to new nightly suite
-    - interfaces/mount: compute mount changes required to transition
-      mount profiles
-    - data/selinux: add context definition for snapctl
-    - overlord: clean up organization under state packages
-    - overlord: make sure all managers packages have *state.go with the
-      main state manipulation/query APIs
-    - interfaces: use spec in the dbus backend
-    - store: download from authenticated URL if there is a device
-      session set
-    - tests: remove core_name variable
-    - interfaces: rename thumbnailer to thumbnailer-service
-    - interfaces: add chroot to base templates
-    - asserts: remove some unused things
-    - systemd: mount the squashfs with nodev
-    - overlord: when shutting down assume errors might be due to
-      cancellation so retry
-    - cmd: rename all unit tests to $command/unit-test
-    - cmd/snap: fix help string for version command
-    - asserts: don't allow revocations with other items for the same
-      developer
-    - tests: skip lp-1644439 test on older kernels
-    - interfaces: allow "sync" to be used by core support
-    - assertstate,snapstate: have assertstate.AutoAliases use the
-      "aliases" header
-    - interfaces: allow writing config.txt.tmp  in the core-support
-      interface
-    - tests: adjust network-bind test
-    - interfaces: dbus backend spec
-    - asserts: introduce a snap-declaration "aliases" header to list
-      auto aliases with explicit targets
-    - cmd: enable large file support
-    - cmd/snap: handle missing snap-confine
-    - cmd/snap-confine: re-associate with pid-1 mount namespace if
-      required
-    - cmd/libsnap: make mountinfo structures public
-    - tests: fix interfaces-cups-control for zesty
-    - misc: revert "Log if the system goes into ForceDevMode"
-    - interfaces: seccomp tests cleanup
-    - cmd: validate SNAP_NAME
-    - interfaces: log if the system goes into ForceDevMode
-    - tests: fix classic-ubuntu-core-transition race
-    - interfaces: use apparmor spec in the apparmor backend
-    - interfaces: alphabetize framebuffer in base decl and add it to
-      all_test.go
-    - tests: add ubuntu-core-16-32 system to the external backend and
-      fix docker test
-    - cmd/libsnap: simplify sc_string_quote default case
-    - osutil: fix double expand in environment map code and add test
-    - interfaces: extend location-control out-of-process provider
-      support
-    - cmd/snap-update-ns: use bidirectional lists for mount entries
-    - tests: prevent automatic transition before setting the initial
-      state of the test
-    - release: detect if we are in ForcedDevMode by inspecting the
-      kernel
-    - tests: add core-snap-refresh test
-    - interfaces: add maliit input method interface
-    - interfaces: seccomp spec API tweaks for better tests
-    - interfaces: updates for mir-kiosk in browser-support, mir, opengl,
-      unity7
-    - testutils: address review feedback from PR#2997
-    - tests: specify the core version to be unsquashfs'ed in the
-      failover tests
-    - interfaces: use MockInfo in tests
-    - cmd/libsnap: add sc_quote_string
-    - cmd/snap-confine: use sc_do_umount everywhere
-    - interfaces: add unity8 plug permissions
-    - timeutil: a few helpers for the recurring events
-    - asserts: implement snap-developer type
-    - partition: deal with grub{,2}-editenv in tests
-    - many: add new (hidden) `snap debug ensure-state-soon` command and
-      use in tests
-    - interfaces/builtin: small refactor of dbus tests
-    - packaging, tests: use "systemctl list-unit-files --full"
-      everywhere
-    - many: some opensuse patches that are ready to go into master
-    - packaging: add opensuse permissions files
-    - client, daemon: move "snap list" name filtering into snapd.
-    - interfaces: use seccomp specs
-    - overlord/snapstate: small cleanup of
-      ensureForceDevmodeDropsDevmodeFromState
-    - interfaces/builtin/alsa: add read access to alsa state dir
-    - interfaces: use spec in kmod backend, updated firewall_control,
-      openvswitch_support, ppp
-    - cmd/snap-confine: use sc_do_mount everywhere
-    - tests: remove workaround for docker again, snap-declaration is
-      fixed now
-    - interfaces: interface to allow autopilot introspection
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 11 Apr 2017 13:31:46 +0200
-
-snapd (2.23.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - cmd: use the most appropriate snap/snapctl sockets
-    - tests: fix interfaces-cups-control for zesty
-    - configstate,hookstate: timeout the configure hook after 5 mins,
-      report failures
-    - packaging: rename the file shipping snap-confine AA profile to
-      workaround dpkg bug #858004
-    - many: ignore configure hook failures on core refresh to ensure
-      upgrades are always possible
-    - snapstate: restart as needed if we undid unlinking aka relinked
-      core or kernel snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Mar 2017 15:30:35 +0200
-
-snapd (2.23.5) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - allow "sync" in core-support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Mar 2017 18:13:43 +0100
-
-snapd (2.23.4) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - fix core-support interface for the new pi-config options
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Mar 2017 16:05:57 +0100
-
-snapd (2.23.3) xenial; urgency=medium
-
-  * FTBFS due to missing files in vendor/
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Thu, 16 Mar 2017 19:56:55 +0100
-
-snapd (2.23.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1673568
-    - cmd/snap: handle missing snap-confine (#3041)
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Thu, 16 Mar 2017 19:38:24 +0100
-
-snapd (2.23.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1665608
-    - packaging, tests: use "systemctl list-unit-files --full"
-      everywhere
-    - interfaces: fix default content attribute value
-    - tests: do not nuke the entire snapd.conf.d dir when changing
-      store settings
-    - hookstate: run the right "snap" command in the hookmanager 
-    - snapstate: revert PR#2958, run configure hook again everywhere
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 08 Mar 2017 14:29:56 +0100
-
-snapd (2.23) xenial; urgency=medium
-
-  * New upstream release, LP: #1665608
-    - overlord: phase 2 with 2nd setup-profiles and hook done after
-      restart for core installation
-    - data: re-add snapd.refresh.{timer,service} with weekly schedule
-    - interfaces: allow 'getent' by default with some missing dbs to
-      various interfaces
-    - overlord/snapstate: drop forced devmode
-    - snapstate: disable running the configure hook on classic for the
-      core snap
-    - ifacestate: re-generate apparmor in InterfaceManager.initialize()
-    - daemon: DevModeDistro does not imply snapstate.Flags{DevMode:true}
-    - interfaces/bluez,network-manager: implement ConnectedSlot policy
-    - cmd: add helpers for mounting / unmounting
-    - snapstate: error in LinkSnap() if revision is unset
-    - release: add linuxmint 18 to the non-devmode distros
-    - cmd: fixes to run correctly on opensuse
-    - interfaces: consistently use 'const' instead of 'var' for security
-      policy
-    - interfaces: miscellaneous policy updates for unity7, udisks2 and
-      browser-support
-    - interfaces/apparmor: compensate for kernel behavior change
-    - many: only tweak core config if hook exists
-    - overlord/hookstate: don't report a run hook output error without
-      any context
-    - cmd/snap-update-ns: move test data and helpers to new module
-    - vet: fix vet error on mount test.
-    - tests: empty init (systemd) failover test
-    - cmd: add .indent.pro file to the tree 
-    - interfaces: specs for apparmor, seccomp, udev
-    - wrappers/services: RemainAfterExit=yes for oneshot daemons w/ stop
-      cmds
-    - tests: several improvements to the nested suite
-    - tests: do not use core for "All snaps up to date" check
-    - cmd/snap-update-ns: add function for sorting mount entries
-    - httputil: copy some headers over redirects
-    - data/selinux: merge SELinux policy module
-    - kmod: added Specification for kmod security backend
-    - tests: failover test for rc.local crash
-    - debian/tests: map snapd deb pockets to core snap channels for
-      autopkgtest
-    - many: switch channels on refresh if needed
-    - interfaces/builtin: add /boot/uboot/config.txt access to core-
-      support
-    - release: assume higher version of supported distros will still
-      work 
-    - cmd/snap-update-ns: add compare function for mount entries
-    - tests: enable docker test
-    - tests: bail out if core snap is not installed
-    - interfaces: use mount.Entry instead of string snippets.
-    - osutil: trivial tweaks to build ID support
-    - many: display kernel version in 'snap version'
-    - osutil: add package for reading Build-ID
-    - snap: error when `snap list foo` is run and no snap is installed
-    - cmd/snap-confine: don't crash if nvidia module is loaded but
-      drivers are not available
-    - tests: update listing test for latest core snap version update
-    - overlord/hookstate/ctlcmd: helper function for creating a deep
-      copy of interface attributes
-    - interfaces: add a linux framebuffer interface
-    - cmd/snap, store: change error messages to reflect latest UX doc
-    - interfaces: initial unity8 interface
-    - asserts: improved information about assertions format in the
-      Decode doc comment
-    - snapstate: ensure snapstate.CanAutoRefresh is nil in tests
-    - mkversion.sh: Add support for taking the version as a parameter
-    - interfaces: add an interface for use by thumbnailer
-    - cmd/snap-confine: ensure that hostfs is root owned.
-    - screen-inhibit-control: add methods for delaying screensavers
-    - overlord: optional device registration and gadget support on
-      classic
-    - overlord: make seeding work also on classic, optionally
-    - image,cmd/snap: refactoring and initial envvar support to use
-      stores needing auth
-    - tests: add libvirt interface spread test
-    - cmd/libsnap: add helper for dropping permissions
-    - interfaces: misc updates for network-control, firewall-control,
-      unity7 and default policy
-    - interfaces: allow recv* and send* by default, accept4 with accept
-      and other cleanups
-    - interfaces/builtin: add classic-support interface
-    - store: use xdelta3 from core if available and not on the regular
-      system
-    - snap: add contact: line in `snap info`
-    - interfaces/builtin: add network-setup-control which allows rw
-      access to netplan
-    - unity7: support missing signals and methods for status icons
-    - cmd: autoconf for RHEL
-    - cmd/snap-confine: look for PROCFS_SUPER_MAGIC
-    - dirs: use the right snap mount dir for the distribution
-    - many: differentiate between "distro" and "core" libexecdir
-    - cmd: don't reexec on RHEL family
-    - config: make helpers reusable
-    - snap-exec: support nested environment variables in environment
-    - release: add galliumos support
-    - interfaces/builtin: more path options for serial
-    - i18n: look into core snaps when checking for translations
-    - tests: nested image testing
-    - tests: add basic test for docker
-    - hookstate,ifacestate: support snapctl set/get slot and plug attrs
-      (step 3) 
-    - cmd/snap: add shell completion to connect
-    - cmd: add functions to load/save fstab-like files
-    - snap run: create "current" symlink in user data dir
-    - cmd: autoconf for centos
-    - tests: add more debug if ubuntu-core-upgrade fails
-    - tests: increase service retries
-    - packaging/ubuntu-14.04: inform user how to extend PATH with
-      /snap/bin.
-    - cmd: add helpers for working with mount/umount commands
-    - overlord/snapstate: prepare for using snap-update-ns
-    - cmd: use per-snap mount profile to populate the mount namespace
-    - overlord/ifacestate: setup seccomp security on startup
-    - interface/seccomp: sort combined snippets
-    - release: don't force devmode on LinuxMint "serena"
-    - tests: filter ubuntu-core systems for authenticated find-private
-      test
-    - interfaces/builtin/core-support: Allow modifying logind
-      configuration from the core snap
-    - tests: fix "snap managed" output check and suppress output from
-      expect in the authenticated login tests
-    - interfaces: shutdown: also allow shutdown/reboot/suspend via
-      logind
-    - cmd/snap-confine-tests: reformat test to pass shellcheck
-    - cmd: add sc_is_debug_enabled
-    - interfaces/mount: add dedicated mount entry type
-    - interfaces/core-support: allow modifying systemd-timesyncd and
-      sysctl configuration
-    - snap: improve message after `snap refresh pkg1 pkg2`
-    - tests: improve snap-env test
-    - interfaces/io-ports-control: use /dev/port, not /dev/ports
-    - interfaces/mount-observe: add quotactl with arg filtering (LP:
-      #1626359)
-    - interfaces/mount: generate per-snap mount profile
-    - tests: add spread test for delta downloads
-    - daemon: show "$snapname (delta)" in progress when downloading
-      deltas
-    - cmd: use safer functions in sc_mount_opt2str
-    - asserts: introduce a variant of model assertions for classic
-      systems
-    - interfaces/core-support: allow modifying snap rsyslog
-      configuration
-    - interfaces: remove some syscalls already in the default policy
-      plus comment cleanups
-    - interfaces: miscellaneous updates for hardware-observe, kernel-
-      module-control, unity7 and default
-    - snap-confine: add the key for which hsearch_r fails
-    - snap: improve the error message for `snap try`
-    - tests: fix pattern and use MATCH in find-private
-    - tests: stop tying setting up staging store access to the setup of
-      the state tarball
-    - tests: add regression spread test for #1660941
-    - interfaces/default: don't allow TIOCSTI ioctl
-    - interfaces: allow nice/setpriority to 0-19 values for calling
-      process by default
-    - tests: improve debug when the core transition test hangs
-    - tests: disable ubuntu-core->core transition on ppc64el (its just
-      too slow)
-    - snapstate: move refresh from a systemd timer to the internal
-      snapstate Ensure()
-    - tests/lib/fakestore/refresh: some more info when we fail to copy
-      asserts
-    - overlord/devicestate: backoff between retries if the server seems
-      to have refused the serial-request
-    - image: check kernel/gadget publisher vs model brand, warn on store
-      disconnected snaps
-    - vendor: move gettext.go back to github.com/ojii/gettext.go
-    - store: retry on 502 http response as well
-    - tests: increase snap-service kill-timeout
-    - store,osutil: use new osutil.ExecutableExists(exe) check to only
-      use deltas if xdelta3 is present
-    - cmd: fix autogen.sh on fedora
-    - overlord/devicemgr: fix test: setup account-key before using the
-      key for signing
-    - cmd: add /usr/local/* to PATH
-    - cmd: add sc_string_append
-    - asserts: support for correctly suggesting format 2 for snap-
-      declaration
-    - interfaces: port mount backend to new APIs, unify content of per
-      app/hook profiles
-    - overlord/devicestate: implement policy about gadget and kernel
-      matching the model
-    - interfaces: allow sched_setscheduler again by default
-    - debian: update breaks/replaces for snap-confine->snapd
-    - debian: move the snap-confine packaging into snapd
-    - 14.04/integrationtests: rely on upstart to restart ssh.
-    - store: enable download deltas on classic by default
-    - spread: add unit suite
-    - snapctl: add config in client to disable auth and use it in
-      snapctl
-    - overlord/ifacestate: register all security backends with the
-      repository
-    - overlord,tests: have enable/disable affect security profiles
-    - tests: install ubuntu-core from the same channel as core
-    - overlord: move configstate.Transaction into config package
-    - seccomp-support.c: add PF_* domains which can be used instead of
-      AF_*
-    - store: always log retry summary when SNAPD_DEBUG is set
-    - tests: parameterize kernel snap channel
-    - snapenv: do not append ":" to the SNAP_LIBRARY_PATH
-    - interfaces/builtin: refine the content interface rules using $SLOT
-    - asserts,interfaces/policy: add support for
-      $SLOT()/$PLUG()/$MISSING in *-attributes constraintsThis adds
-      support for $SLOT(arg), $PLUG(arg) and $MISSING attribute
-      constraints in plugs and slots rules in snap-declarations:
-    - cmd/snap-confine: add snap-confine command line parser module
-    - tests: remove (some) garbage files found by restore cleanup
-      analysis
-    - cmd: fix issues uncovered by valgrind
-    - tests: fix typo in systems name
-    - cmd: collect string utilities in one module, add missing tests
-    - cmd: rename mountinfo to sc_mountinfo
-    - tests: allow to install snapd debs from a ppa instead of building
-      them
-    - spread: remove state tar on project restore
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Feb 2017 12:21:42 +0100
-
-snapd (2.22.7) xenial; urgency=medium
-
-  * New upstream release:
-    - errtracker,overlord/snapstate: more info in errtracker reports
-    - interfaces/apparmor: compensate for kernel behavior change
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 24 Feb 2017 19:24:11 +0100
-
-snapd (2.22.6) xenial; urgency=medium
-
-  * New upstream release, LP: #1667105
-    - overlord/ifacestate: don't fail if affected snap is gone
-    - revert #2910: osutil: add package for reading Build-ID (#2918)
-    - errtracker: include the build-id of host and core snapd (#2912)
-    - errtracker: include the number of ubuntu-core -> core retries
-      (#2915)
-    - snapstate: retry ubuntu-core -> core transition every 6h (#2914)
-    - osutil: add package for reading Build-ID (#2910)
-    - errtracker: include kernel version in error reports (#2905)
-    - release: return "unknown" if uname fails
-    - many: rebased uname branch for 2.22
-    - errtracker: include snapd version in err reports
-    - overlord/ifacestate: don't unconditionally retry stuff (#2906)
-    - snapstate: fix incorrect cut of the timestamps for the error
-      reports (#2908)
-    - tests: update listing test for latest core snap version update
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Wed, 22 Feb 2017 23:34:23 +0100
-
-snapd (2.22.5) xenial; urgency=medium
-
-  * Fix FTBFS due to machine-id file
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Tue, 21 Feb 2017 09:43:42 +0100
-
-snapd (2.22.4) xenial; urgency=medium
-
-  * New bugfix release:
-    - errtracker: add support for error reporting via daisy.ubuntu.com
-    - snapstate: allow for 6 retries for the core transition
-    - httputils: ensure User-Agent works across redirects
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 21 Feb 2017 09:07:10 +0100
-
-snapd (2.22.3) xenial; urgency=medium
-
-  * New bugfix release, LP: #1665729:
-    - Limit the number of retries for the ubuntu-core -> core
-      transition to fix possible store overload.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 17 Feb 2017 18:58:34 +0100
-
-snapd (2.22.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1659522
-    - cherry pick fix for sched_setscheduler regression
-      (LP: #1661265)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 02 Feb 2017 17:13:51 +0100
-
-snapd (2.22.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1659522
-    - cherry pick fix for snapctl auth.json handling
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 01 Feb 2017 17:09:31 +0100
-
-snapd (2.22) xenial; urgency=medium
-
-  * New upstream release, LP: #1659522
-    - many: make ubuntu-core-launcher mostly go
-    - interfaces/builtin: add account-control interface
-    - interfaces/builtin: add missing syscalls to core-support needed
-      for systemctl
-    - interfaces/builtin: rework core-support to only allow full access
-      to systemctl
-    - debian/tests: drop stale autopkgtest dependencies.
-    - tests: make the debugging of c-unit-tests more useful
-    - store: retry auth-related requests
-    - tests: integration test for system reload
-    - snap: be more helpful in the `snap install <already-installed>`
-      error message
-    - tests: set SNAPPY_USE_STAGING_STORE in su call
-    - tests: use test snap
-    - spread: set SNAPD_DEBUG=1 in the core snap as well
-    - tests: add extra debugging to security-setuid-root test
-    - cmd,snap,wrappers: systemd reload command support
-    - interfaces: builtin: mir: Allow recv and send
-    - overlord/ifacestate: use ParseConnRef
-    - overlord/snapstate,overlord/ifacestate: add automatic ubuntu-core
-      -> core transition
-    - debian: remove aliases as well in snapd.postrm
-    - many: change interfaces.ParseID to return value
-    - interfaces/opengl: allow access to the nvidia abstract socket
-    - overlord, daemon: flag failures feature fancy forms.
-    - many: add --classic support to try and revert, and make missing
-      these things a little harder
-    - interfaces: allow reading non-PCI-attached usb devices via raw-usb
-    - many: rename snap-alter-ns to snap-update-ns
-    - interfaces/builtin: add core-support
-    - store: increase the retry.LimitTime()
-    - debian: move the packaging out into package/$id-$version_id
-    - overlord/stapstate: don't use unkeyed fields
-    - many: add stub implementation of snap-alter-ns
-    - asserts: improve error message when key is not valid at the given
-      time
-    - snapstate, ifacestate: add snapstate.CheckChangeConflict() to
-      ifacestate.{Connect,Disconnect}
-    - debian: remove trusty specific bits
-    - docs: Add a note about building snapd.
-    - interfaces: miscellaneous updates for default and network-control
-    - daemon: bubble out store.ErrSnapNotFound in the findOne codepath
-    - store: add retry logging into download as well
-    - snap: show price in `snap info`
-    - cmd: add fault injection support code
-    - interfaces: network-manager: allow rw access to /etc/netplan
-    - debian: move systemd files out of ./debian and into ./data/systemd
-    - asserts: implement SuggestFormat to help avoid specifying the
-      wrong format iteration for an assertion
-    - many: detect potentially insecure use of snap-confine
-    - interfaces: allow querying added security backends
-    - cmd: ensure that all .c files have a -test.c file
-    - asserts: don't use 'context' for the path of attributes, want to
-      reuse the concept for something else
-    - interfaces: abbreviate ConnRef construction
-    - tests: ensure systemd override directory is available before using
-      it
-    - cmd: more build system cleanups and a small fix
-    - tests: increase retries for service up
-    - cmd: move seccomp cleanup function to seccomp-support
-    - many: auto-connect plugs and slots symmetrically
-    - overlord: use a ticker for the pruning
-    - interfaces/builtin: add uhid interface
-    - cmd/snap-confine: add shutdown helper
-    - tests: fix path used when debugging
-    - cmd: switch to non-recursive make
-    - overlord/ifacestate: setup security of snaps affected by auto-
-      connection
-    - spread: refresh apt cache before first install
-    - overlord: allow max 500 changes in "ready" state to avoid growing
-      changes for 24h
-    - snap: add {Plug,Slot}Info.SecurityTags
-    - cmd: move snap-discard-ns to dedicated directory
-    - tests: skip i18n test when no "snappy.mo" file is available
-    - interfaces,overlord/ifacestate: small refactor around reference
-      methods
-    - tests: remove the snapd dirs last (should fix random test errors)
-    - interfaces: mm: permissions for protocol proxies
-    - interfaces/builtin: add evolution interfaces
-    - many: extract the logging http client and user-agent handling for
-      use in devicestate
-    - interfaces: unity8-download-manager is the chosen name for this
-      interface.
-    - tests: add "quiet" wrapper function that only prints output on
-      failure
-    - tests: fix failing snapd-reexec test
-    - docs: simplify HACKING.md that snapd itself supports setting up
-      the sockets
-    - overlord: flag required-snaps from model as required and prevent
-      removing them
-    - spread: exclude .o and .a files
-    - tests: parameterize remote store
-    - cmd: fix hardcoded paths to rst2man and support rst2man.py
-    - tests: improve debug output when reexec is used
-    - tests: disable ipv6 before unpacking delta
-    - interfaces: add new interface API
-    - tests: change TRUST_TEST_KEYS to be controlled from the host
-    - spread: add boilerplate for Linode delta uploads
-    - wrappers: add support for the X-Ayatana-Desktop-Shortcuts=
-      extension
-    - partition: add support for native grubenv read/write and use it
-    - tests: add test ensuring manual pages are shipped
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 27 Jan 2017 23:18:57 +0100
-
-snapd (2.21) xenial; urgency=medium
-
-  * New upstream release, LP: #1656382
-    - daemon: re-enable reexec
-    - interfaces: allow reading installed files from previous revisions
-      by default
-    - daemon: make activation optional
-    - tests: run all snap-confine tests in c-unit-tests task
-    - many: fix abbreviated forms of disconnect
-    - tests: switch more tests to MATCH
-    - store: export userAgent. daemon: print store.UserAgent() on
-      startup.
-    - tests: test classic confinement `snap list` and  `snap info`
-      output
-    - debian: skip snap-confine unit tests on nocheck
-    - overlord/snapstate: share code between Update and UpdateMany, so
-      that it deals with auto-aliases correctly
-    - interfaces: upower-observe: refactor to allow snaps to provide a
-      slot
-    - tests: add end-to-end store test for classic confinement
-    - overlord,overlord/snapstate: have UpdateMany retire/enable auto-
-      aliases even without new revision
-    - interfaces/browser-support: add @{PROC}/@{pid}/fd/[0-9] w and misc
-      /run/udev
-    - interfaces/builtin: add physical-memory-* and io-ports-control
-    - interfaces: allow getsockopt by default since it is so commonly
-      used
-    - cmd/snap, daemon, overlord/snapstate: tests and fixes for "snap
-      refresh" of a classic snap
-    - interfaces: allow read/write access of real-time clock with time-
-      control interface
-    - store: request no CDN via a header using SNAPPY_STORE_NO_CDN
-      envvar
-    - snap: add information about tracking channel (not just actual
-      channel)
-    - interfaces: use fewer dot imports
-    - overlord/snapstate: remove restrictions on ResetAliases
-    - overlord, store: move confinement filtering to the overlord (from
-      The Store)
-    - many: move interface test helpers to ifacetest package
-    - many: implement 'snap aliases'
-    - vet: fix for unkeyed fields error on aliases_test.go
-    - interfaces: miscellaneous policy updates for network-control,
-      unity7, pulseaudio, default and home
-    - tests: test for auto-aliases
-    - interface hooks: connect plug slot hooks (step 2)
-    - cmd/snap: fix internal naming in snap connect
-    - snap: use "size" as the json tag in snap.ChannelSnapInfo
-    - tests: restore the missing initialization of iface manager causing
-      race
-    - snap: fix missing sizes in `snap info <remote-snap>`
-    - tests: improve cleanup for c-unit-tests
-    - cmd/snap-confine: build non-installed libsnap-confine-private.a
-    - cmd/snap-confine: small tweaks to seccomp support code
-    - interfaces/docker-support: allow /run/shm/aufs.xeno for 14.04
-    - many: obtain installed snaps developer/publisher username through
-      assertions
-    - store: setting of fields for details endpoint
-    - cmd/snap-confine: check for rst2man on configure
-    - snap: show `snap --help` output when just running `snap`
-    - interface/builtin: drop the obsolete checks in udisks2
-      SanitizeSlot
-    - cmd/snap: remove currency switch following UX review
-    - spread: find top-level directory before running generate-
-      packaging-dir
-    - interface hooks: prepare plug slot hooks (step 1)
-    - i18n: use github.com/mvo5/gettext.go (pure go) for i18n to avoid
-      cgo
-    - many: put a marker in the User-Agent sent by snapd/snap when under
-      testingThe User-Agent will look like:
-    - tests: fix -reuse and -resend when govendor is missing
-    - snap: provide friendlier `snap find` message when no snaps are
-      found
-    - tests: fix mkversions.sh failure on zesty
-    - spread: install build-essential unconditionally
-    - spread: improve qemu ubuntu-14.04-{32,64} support
-    - overlord/snapstate,daemon: implement GET /v2/aliases handling
-    - store: retry user info request
-    - tests: port more snap-confine regression tests
-    - tests: cancel the scheduled reboot on ubuntu-core-upgrade-no-gc
-      and restore state
-    - tests: debug zesty autopkgtest failures
-    - overlord/snapstate: use keyed fields on literals
-    - tests: use MATCH in install-remove-multi
-    - tests: increase wait time for service to be up
-    - tests: make debug-each succeed if DENIED doesn't match
-    - tests: skip packaging dir generation for non-git based autopkgtest
-      runs
-    - tests: port refresh-all-undo to MATCH
-    - tests: improve snap connect test
-    - tests: port additional snap-confine regression tests
-    - tests: show --version when it matches unknown
-    - tests: optionally use apt proxy for qemu
-    - tests: add hello-classic test
-    - many: behave more consistently when pointed to staging and
-      possibly the fake store
-    - overlord/ifacestate: remove stale comments
-    - interfaces/apparmor: ignore snippets in classic confinement
-    - tests: port first regression test from snap-confine
-    - cmd/snap-confine: disable old tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 13 Jan 2017 19:39:51 +0100
-
-snapd (2.20.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1648520
-    - tests: enable the ppc64el tests again
-    - tests: add classic confinement test
-    - tests: run snap confine tests in debian/rules already
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 19 Dec 2016 11:53:29 +0100
-
-snapd (2.20) xenial; urgency=medium
-
-  * New upstream release, LP: #1648520
-    - many: implement  "snap alias --reset" using snapstate.ResetAliases
-    - debian: use a packaging branch for 14.04
-    - store: retry downloads on io.Copy errors and sha3 checksum errors
-    - snap: show apps in `snap info`
-    - store: send an explicit X-Ubuntu-Classic header to the store
-    - overlord/snapstate: implement snapstate.ResetAliases
-    - interfaces/builtin: add dbus interface
-    - tests: fix tests on 17.04
-    - store: use mocked retry strategy to make store tests faster
-    - overlord: apply auto-aliases information from the snap-declaration
-      on install or refresh
-    - many: prepare landing on trusty
-    - many: implement snap unalias using snapstate.Unalias
-    - overlord/snapstate: fixing the placement/grouping of some
-      functions
-    - interfaces: support network namespaces via 'ip netns' in network-
-      control
-    - interfaces/builtin: fix pulseaudio apparmor rules
-    - interfaces/builtin: add iio interface
-    - tests: update custom core snap with the freshly build snap-confine
-    - interfaces: use sysd.{Disable,Stop} instead of sysd.DisableNow()
-    - overlord,overlord/snapstate: implement snapstate.Unalias by
-      generalizing the "alias" task
-    - interfaces: misc openstack snap enablement
-    - cmd/snap: mock terminal.ReadPassword instead of using /dev/ptmx
-    - notifications, daemon: kill the unsupported events endpoint
-    - client: only allow Dangerous option in InstallPath
-    - overlord/ifacestate: no interface checks if no snap id
-    - many: implement alias command
-    - snap: tweak snap install output as designed by Mark
-    - debian: fix Pre-Depends on dpkg
-    - tests: check if snap-confine --version is unknown
-    - cmd/snap-confine: allow content interface mounts
-    - tests: remove ppa:snappy-dev/image again
-    - interfaces/apparmor: allow access to core snap
-    - tests: remove snap-confine/ubuntu-core-launcher after the tests
-    - overlord,overlord/snapstate: implement snapstate.Alias
-    - cmd/snap: reject "snap disconnect foo"
-    - debian: add split ubuntu-core-launcher and snap-confine packages
-    - cmd: fix mkversion.sh and add regression test
-    - overlord/snapstate: setup/remove aliases as we link/unlink snaps
-    - cmd/snap,tests: alias support in snap run
-    - snap/snapenv: don't obscure HOME if snap uses classic confinement
-    - store: decode response.Body json inside retry loops
-    - cmd/snap-confine: fix compilation on platforms with gcc < 4.9.0
-    - vendor: update tomb package fixing context support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 15 Dec 2016 22:07:08 +0100
-
-snapd (2.19) xenial; urgency=medium
-
-  * New upstream release, LP: #1648520
-    - cmd/snap-confine: disable support for XDG_RUNTIME_DIR
-    - cmd/snap-confine/tests: fix stale path after move to snapd
-    - cmd/snap-confine: don't use __attribute__((nonull))
-    - snap: add description to `snap info`
-    - snap: show last refresh time
-    - store: switch default delta format from xdelta to xdelta3
-    - interfaces: fix system-observe interface to work with ps_mem
-    - debian: add missing ca-certificates dependency
-    - cmd/snap-confine: add support for classic confinement
-    - snapstate/backend: add backend methods to manage aliases
-    - tests: re-enable snap-confine unit tests via spread
-    - many: merge snap-confine into snapd
-    - many: add support for classic confinement
-    - snap: abort install with ctrl+c
-    - cmd/snap: change terms accept URL following UX review
-    - interfaces/apparmor: use distinct apparmor template for classic
-    - snap: add snap size to `snap info`
-    - interfaces: add unconfined access to modem-manager
-    - snap: support for parsing and exposing on snap.Info aliases
-    - debian: disable autopkgtests on ppc64el
-    - snap: disable support for socket activation
-    - tests: fix incorrect restore of the current symlink
-    - asserts: introduce auto-aliases header in snap-declaration
-    - interfaces/seccomp: add support for classic confinement
-    - tests: do not use external snaps
-    - daemon: close the dup()ed file descriptor to not leak it
-    - overlord, daemon, progress: enable building snapd without CGO
-    - daemon, store: let snap info find things in any channel
-    - store: retry tweaks and logging
-    - snap: Improve `snap --help` output as designed by Mark
-    - interfaces/builtin: fix incorrect udev rule in i2c
-    - overlord: increase test timeout and improve failure message
-    - snap: remove unused experimental command
-    - debian: remove unneeded conflict against the "snappy" package
-    - daemon, strutil: move daemon.quotedNames to strutil.Quoted
-    - docs: document SNAP_DEBUG_HTTP in HACKING.md
-    - cmd/snap: have some completers
-    - snap: support "daemon: notify" in snap.yaml
-    - snap: fix try command when daemon linie is added
-    - interfaces: apparmor support for classic confinement
-    - debian/rules: build with -buildoptions=pie
-    - tests: include /boot in saved state (including bootenv and any
-      kernels)
-    - daemon: ensure `snap try` installs core if it's missing
-    - tests: save/restore /snap/core/current symlink
-    - tests: decrease the number of expected featured apps
-    - tests: add set -e to the prepare ssh script
-    - cmd/snap: add tests for section completion; fix bugs.
-    - cmd/snap: document 'snap list --all'
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 08 Dec 2016 16:16:04 +0100
-
-snapd (2.18.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1644625
-    - daemon: fix crash when `snap refresh` contains a single update
-    - fix unhandled error from io.Copy() in download()
-    - interfaces/builtin: fix incorrect udev rule in i2c
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 05 Dec 2016 15:04:13 +0100
-
-snapd (2.18) xenial; urgency=medium
-
-  * New upstream release, LP: #1644625
-    - store: retry on io.EOF
-    - tests: skip pty tests on ppc64el and powerpc
-    - client, cmd/snap: introducing "snap info"
-    - snap: do exit 0 on install/remove if that snap is already
-      installed or already removed
-    - snap: add `snap watch <change-id>` to attach to a running change
-    - store: retry downloads using retry loop
-    - snap: try doesn't require snap-dir when run in snap's directory
-    - daemon: show what will change in the "refresh-all" changes
-    - tests: disable autorefresh for the external backend
-    - snap: add `snap list -a` to show all snaps (even inactive ones)
-    - many: unify boolean env var handling
-    - overlord/ifacestate: don't setup jailmode snaps with devmode
-      confinement
-    - snapstate: do not garbage collect the snaps used by the bootenv
-    - debian: drop hard xdelta dependency for now
-    - snap: make `snap login` ask for email if not given as argument
-    - osutil: fix build on armhf (arm in go-arch) and powerpc (ppc in
-      go-arch)
-    - many: rename DevmodeConfinement to DevModeConfinement
-    - store: resp.Body.Close() missing in ReadyToBuy
-    - many: use ConfinementOptions instead of ConfinementType
-    - snap, daemon, store: fake the channel map in the REST API
-    - misc: run github.com/gordonklaus/ineffassign as part of the static
-      checks
-    - docs: add goreportcard badge and remove coveralls badge
-    - tests: force gofmt -s in static checks
-    - many: run gofmt -s -w on all the code
-    - store: DRY actual retry code
-    - many: fix various errors uncovered by goreportcard.com
-    - interfaces/builtin: allow additional shared memory for webkit
-    - many: some more missing snapState->snapst
-    - asserts: introduce an optional freeform display-name for model
-    - interfaces/builtin: rename usb-raw to raw-usb
-    - progress: init pbar with correct total value
-    - daemon/api.go: add quotedNames() helper
-    - interfaces: add ConfinementOptions type
-    - tests: add a test about the extra bits that prepare-device can
-      specify for device registration
-    - tests: check that gpio device nodes are exported after reboot
-    - tests: parameterize core channel with env var for classic too
-    - many: rename variable "ss" to "snapsup" or "snapst" or "st"
-      (depending on context)
-    - tests: do not use external snaps in spread
-    - store: retry buy request
-    - store: retry store.Find
-    - store: retry assertion store call
-    - store: retry call for snap details
-    - many: use snap.ConfinementType rather than bool devmode
-    - daemon: if a bad snap is posted it is not an internal error but a
-      bad request
-    - client: add "Snap.Screenshots" to the client API
-    - interfaces: update base declaration documentation and policy for
-      on-classic and snap-type
-    - store: check payment method before TOS for a better UX
-    - interfaces: allow sched_setaffinity in process-control
-    - tests: parameterize core channel with env var
-    - tests: ensure that the XDG_ env contains at least XDG_RUNTIME_DIR
-    - interfaces: fcitx also listens on the session bus for Qt apps
-    - store: retry ListRefresh
-    - snap: use "Password of <email>:" in the `snap login`
-    - many: reshuffle how we load/inject tests keys so image doesn't
-      need assertstate anymore
-    - store: use range requests if we have a local file already
-    - dirs,interfaces,overlord,snap,snapenv,test: export per-snap
-      XDG_RUNTIME_DIR per user
-    - osutil: make RealUser only look at SUDO_USER when uid==0
-    - tests: do not use the ppa:snappy-dev/image in the tests
-    - store: retry readyToBuy request
-    - tests: increase `expect` timeouts
-    - static tests: add spell check
-    - tests: add debug to all flaky expect tests
-    - systemd: correct the mount arguments when mounting with squashfuse
-    - interfaces: add avahi-observe
-    - store: bring delta downloads back
-    - interfaces: add alsa
-    - interfaces/builtin: fix a broken test that snuck into master
-    - osutil: add chattr funcs
-    - image: init "snap_mode" on image creation time to avoid ugly
-      messages
-    - tests: test-snapd-fuse-consumer needs python-fuse as a build-
-      package
-    - interfaces/builtin: add i2c interface
-    - interfaces: add ofono interface
-    - tests: do not use hello-world in our tests
-    - snap: add support for classic confinement
-    - interfaces: remove LegacyAutoConnect() from the interfaces
-    - interfaces: miscellaneous policy updates
-    - tests: run autopkgtests in the autopkgtest.ubuntu.com
-      infrastructure
-    - Implement lxd-client interface exposing the lxd snap
-    - asserts: validate optional account username
-    - many: remove unnecessary snap name parameter from buying endpoint
-    - tests: do not hardcode the size of /dev/ram0
-    - tests: add test that ensures the right content for /etc/os-release
-    - spread tests: fix snap mode check
-    - docs: fix path for source files location in HACKING.md
-    - interfaces/builtin/mir: allow slot to make recvfrom syscalls
-    - store: sections/featured snaps store support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 24 Nov 2016 19:43:08 +0100
-
-snapd (2.17.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1637215:
-    - release: os-release on core has changed
-    - tests: /dev/ptmx does not work on powerpc, skip here
-    - docs: moved to github.com/snapcore/snapd/wiki (#2258)
-    - debian: golang is not installable on powerpc, use golang-any
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Nov 2016 18:13:10 +0200
-
-snapd (2.17) xenial; urgency=medium
-
-  * New upstream release, LP: #1637215:
-    - overlord/ifacestate: add unit tests for undo of setup-snap-
-      security (#2243)
-    - daemon,overlord,snap,tests: download to .partial in final dir
-      (#2237)
-    - overlord/state: marshaling tests for lanes (#2245)
-    - overlord/state: introduce state lanes (#2241)
-    - overlord/snapstate: fix revert+refresh (#2224)
-    - interfaces/sytemd: enable/disable generated service units (#2229)
-    - many: fix incorrect security files generation on undo
-    - overlord/snapstate: add dynamic snapdX.Y assumes (#2227)
-    - interfaces: network-manager: give slot full read-write access to
-      /run/NetworkManager
-    - docs: update the name of the command for the cross-build
-    - overlord/snapstate: fix missing argument to Noticef
-    - snapstate: ensure gadget/core/kernel can not be disabled (#2218)
-    - asserts: limit to 1y only if len(models) == 0 (#2219)
-    - debian: only install share/locale if available (missing on
-      powerpc)
-    - overlrod/snapstate: fix revert followed by refresh to old-current
-      (#2214)
-    - interfaces/builtin: network-manager and bluez can change hostname
-      (#2204)
-    - snap: switch the auto-import dir to /run/snapd/auto-import
-    - docs: less details about cloud.cfg as requested in trello (#2206)
-    - spread.yaml: Ensure ubuntu user has passwordless sudo for
-      autopkgtests (#2201)
-    - interfaces/builtin: add dcdbas-control interface
-    - boot: do not set boot to try mode if the revision is unchanged
-    - interfaces: add shutdown interface (#2162)
-    - interfaces: add system-power-control interface
-    - many: use the new systemd backend for configuring GPIOs
-    - overlord/ifacestate: setup security for slots before plugs
-    - snap: spool assertion candidates if snapd is not up yet
-    - store,daemon,overlord: download things to a partials dir
-    - asserts,daemon: implement system-user-authority header/concept
-    - interfaces/builtin: home base declaration rule using on-classic
-      for its policy
-    - interfaces/builtin: finish decl based checks
-    - asserts: bump snap-declaration to allow signing with new-style
-      plugs and slots
-    - overlord: checks for kernel installation/refresh based on model
-      assertion and previous kernel
-    - tests/lib/fakestore: fix logic to distinguish assertion not found
-      errors
-    - client: add a few explicit error types (around the request cycle)
-    - tests/lib/fakestore/cmd/fakestore: make it log, and fix a typo
-    - overlord/snapstate: two bugs for one
-    - snappy: disable auto-import of assertions on classic (#2122)
-    - overlord/snapstate: move trash cleanup to a cleanup handler
-      (#2173)
-    - daemon: make create-user --known fail on classic without --force-
-      managed (#2123)
-    - asserts,interfaces/policy: implement on-classic plug/slot
-      constraints
-    - overlord: check that the first installed gadget matches the model
-      assertion
-    - tests: use the snapd-control-consumer snap from the store
-    - cmd/snap: make snap run not talk to snapd for finding the revision
-    - snap/squashfs: try to hard link instead of copying. Also, switch
-      to osutil.CopyFile for cp invocation.
-    - store: send supported max-format when retrieving assertions
-    - snapstate, devicestate: do not remove seed
-    - boot,image,overlord,partition: read/write boot variables in single
-      operation
-    - tests: reenable ubuntu-core tests on qemu
-    - asserts,interfaces/policy: allow OR-ing of subrule constraints in
-      plug/slot rules
-    - many: move from flags as ints to flags as structs-of-bools (#2156)
-    - many: add supports for keeping and finding assertions with
-      different format iterations
-    - snap: stop using ubuntu-core-launcher, use snap-confine
-    - many: introduce an assertion format iteration concept, refuse to
-      add unsupported assertion
-    - interfaces: tweak wording and comment
-    - spread.yaml: dump apparmor denials on spread failure
-    - tests: unflake ubuntu-core-reboot (#2150)
-    - cmd/snap: tweak unknown command error message (#2139)
-    - client,daemon,cmd: add payment-declined error kind (#2107)
-    - cmd/snap: update remove command help (#2145)
-    - many: removed frameworks target and fixed service files (#2138)
-    - asserts,snap: validate attributes to a JSON-compatible type subset
-      (#2140)
-    - asserts: remove unused serial-proof type
-    - tests: skip auto-import tests on systems without test keys (#2142)
-    - overlord/devicestate: don't spam the debug log on classic (#2141)
-    - cmd/snap: simplify auto-import mountinfo parsing (#2135)
-    - tests: run ubuntu-core upgrades on isolated machine (#2137)
-    - overlord/devicestate: recover seeding from old external approach
-      (#2134)
-    - overlord: merge overlord/boot pkg into overlord/devicestate
-      (#2118)
-    - daemon: add postCreateUserSuite test suite (#2124)
-    - tests: abort tests if an update process is scheduled (#2119)
-    - snapstate: avoid reboots if nothing in the boot setup has changed
-      (#2117)
-    - cmd/snap: do not auto-import from loop or non-dev devices (#2121)
-    - tests: add spread test for `snap auto-import` (#2126)
-    - tests: add test for auto-mount assertion import (#2127)
-    - osutil: add missing unit tests for IsMounted (#2133)
-    - tests: check for failure creating user on managed ubuntu-core
-      systems (#2096)
-    - snap: ignore /dev/loop addings from udev (#2111)
-    - tests: remove snapd.boot-ok reference (#2109)
-    - tests: enable tests related to the home interface in all-snaps
-      (#2106)
-    - snapstate: only import defaults from gadget on install (#2105)
-    - many: move firstboot code into the snapd daemon (#2033)
-    - store: send correct JSON type of string for expected payment
-      amount (#2103)
-    - cmd/snap: rename is-managed to managed and tune (#2102)
-    - interfaces,overlord/ifacestate: initial cleaning up of no arg
-      AutoConnect related bits (#2090)
-    - client, cmd: prompt for password when buying (#2086)
-    - snapstate: fix hanging `snap remove` if snap is no longer mounted
-    - image: support gadget specific cloud.conf file (#2101)
-    - cmd/snap,ctlcmd: fix behavior of snap(ctl) get (#2093)
-    - store: local users download from the anonymous url (#2100)
-    - docs/hooks.md: fix typos (#2099)
-    - many: check installation of slots and plugs against declarations
-    - docs: fix missing "=" in the systemd-active docs
-    - store: do not set store auth for local users (#2092)
-    - interfaces,overlord/ifacestate: use declaration-based checking for
-      auto-connect (#2071)
-    - overlord, daemon, snap: support gadget config defaults (#2082)The
-      main semantic changes are:
-    - tests: fix snap-disconnect tests after core rename (#2088)
-    - client,daemon,overlord,cmd: add /v2/users and create-user on auto-
-      import (#2074)
-    - many: abbreviated forms of disconnect (#2066)
-    - asserts: require lowercase model until insensitive matching is
-      ready (#2076)
-    - cmd/snap: add version command, same as --version (#2075)
-    - all: use "core" by default but allow "ubuntu-core" still (#2070)
-    - overlord/devicestate, docs/hooks.md: nest prepare-device
-      configuration options
-    - daemon: fix login API to return local macaroons (#2078)
-    - daemon: do not hardcode UID in userLookup (#2080)
-    - client, cmd: connect fixes (#2026)
-    - many: preparations for switching most of autoconnect to use the
-      declarationsfor now:
-    - overlord/auth: update CheckMacaroon to verify local snapd
-      macaroons (#2069)
-    - cmd/snap: trivial auto-import and download tweaks (#2067)
-    - interfaces: add repo.ResolveConnect that handles name resolution
-    - interfaces/policy: introduce InstallCandidate and its checks
-    - interfaces/policy,overlord: check connection requests against the
-      declarations in ifacestate
-    - many: setup snapd macaroon for local users (#2051)Next step: do
-      snapd macaroons verification.
-    - interfaces/policy: implement snap-id/publisher-id checks
-    - many: change Connect to take ConnRef instead of strings (#2060)
-    - snap: auto mount block devices and import assertions (#2047)
-    - daemon: add `snap create-user --force-managed` support (#2041)
-    - docs: remove references to removed buying features (#2057)
-    - interfaces,docs: allow sharing SNAP{,_DATA,_COMMON} via content
-      iface (#2063)
-    - interfaces: add Plug/Slot/Connection reference helpers (#2056)
-    - client,daemon,cmd/snap: improve create-user APIs (#2054)
-    - many: introduce snap refresh --ignore-validation <snap> to
-      override refresh validation (#2052)
-    - daemon: add support for `snap create-user --known` (#2040)
-    - interfaces/policy: start of interface policy checking code based
-      on declarations (#2050)
-    - overlord/configstate: support nested configuration (#2039)
-    - asserts,interfaces/builtin,overlord/assertstate: introduce base-
-      declaration (#2037)
-    - interfaces: builtin: Allow writing DHCP lease files to
-      /run/NetworkManager/dhcp (#2049)
-    - many: remove all traces of the /v2/buy/methods endpoint (#2045)
-    - tests: add external spread backend (#1918)
-    - asserts: parse the slot rules in snap-declarations (#2035)
-    - interfaces: allow read of /etc/ld.so.preload by default for armhf
-      on series 16 (#2048)
-    - store: change purchase to order and store clean up first pass
-      (#2043)
-    - daemon, store: switch to new store APIs in snapd (#2036)
-    - many: add email to UserState (#2038)
-    - asserts: support parsing the plugs stanza i.e. plug rules in snap-
-      declarations (#2027)
-    - store: apply deltas if explicitly enabled (#2031)
-    - tests: fix create-key/snap-sign test isolation (#2032)
-    - snap/implicit: don't restrict the camera iface to classic (#2025)
-    - client, cmd: change buy command to match UX document (#2011)
-    - coreconfig: nuke it. Also, ignore po/snappy.pot. (#2030)
-    - store: download deltas if explicitly enabled (#2017)
-    - many: allow use of the system user assertion with create-user
-      (#1990)
-    - asserts,overlord,snap: add prepare-device hook for device
-      registration (#2005)
-    - debian: adjust packaging for trusty/deputy systemd (#2003)
-    - asserts: introduce AttributeConstraints (#2015)
-    - interface/builtin: access system bus on screen-inhibit-control
-    - tests: add firewall-control interface test (#2009)
-    - snapstate: pass errors from ListRefresh in updateInfo (#2018)
-    - README: add links to IRC, mailing list and social media (#2022)
-    - docs: add `configure` hook to hooks list (#2024)LP: #1596629
-    - cmd/snap,configstate: rename apply-config variables to configure.
-      (#2023)
-    - store: retry download on 500 (#2019)
-    - interfaces/builtin: support time and date settings via
-      'org.freedesktop.timedate1 (#1832)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 02 Nov 2016 01:17:36 +0200
-
-snapd (2.16) xenial; urgency=medium
-
-  * New upstream release, LP: #1628425
-    - overlord/state: prune old empty changes
-    - interfaces: ppp: load needed kernel module (#2007)
-    - interfaces/builtin: add missing rule to allow run-parts to
-      execute all resolvconf scripts
-    - many: rename apply-config hook to configure
-    - tests: use new spread `debug` feature
-    - many: finish `snap set` API.
-    - overlord: fix and simplify configstate.Transaction
-    - assertions: add system-user assertion
-    - snap: add `snap known --remote`
-    - tests: replace systemd-run with on-the-fly generation of units.
-    - overlord/boot: switch to using assertstate.Batch
-    - snap, daemon, store: pass through screenshots from store
-    - image: add meta/gadget.yaml infrastructure
-    - tests: add test benchmark script
-    - daemon: add the actual ssh keys that got added to the create-user
-      response
-    - daemon: add REST API behind `snap get`
-    - debian: re-add golang-github-gosexy-gettext-dev
-    - tests: added install_local function
-    - interfaces/builtin: fix resolvconf permissions for network-manager
-      interface
-    - tests: use apt as compatible with trusty
-    - many: discard preserved namespace after removing snap
-    - daemon, overlord, store: add ReadyToBuy API to snapd
-    - many: add support for installing/removing multiple snaps
-    - progress: use New64 and fix output newline
-    - interfaces/builtin: allow network-manager to access netplan conf
-      files
-    - tests: build once and install test snap from cache
-    - overlord/state: introduce cleanup support
-    - snap: move/clarify Info.Broken
-    - ctlcmd: add snapctl get.
-    - overlord,store: clean up serial-proof plumbing code
-    - interfaces/builtin: add network-setup-observe interface
-    - daemon,overlord/assertstate: support streams of assertions with
-      snap ack
-    - snapd: kmod backend
-    - tests: ensure HOME is also set correctly
-    - configstate,hookstate: add snapctl set
-    - tests: disable broken create-key test
-    - interfaces: adjust bluetooth-control to allow getsockopt (LP:
-      #1613572)
-    - tests: add a test for core about device initialization and device
-      registration and auth
-    - many: show snap name before the download progress bar
-    - interfaces/builtin: add rcvfrom for client connected plugs to mir
-      interface
-    - asserts: support for maps in assertions
-    - tests: increase timeout for key generation in create-key test
-    - many: validate refreshes against validation assertions by gating
-      snaps
-    - interfaces/apparmor: allow 'm' in default policy for snap-exec
-    - many: avoid snap.InfoFromSnapYaml in tests
-    - interfaces/builtin: allow /dev/net/tun with network-control
-    - tests: add spread test for snap create-key/snap sign
-    - tests: add missing quotes in security-device-cgroups/task.yaml
-    - interfaces: drop ErrUnknownSecurity
-    - store: add "ready to buy" method
-    - snap/snapenv, tests: use root's data dirs when running via sudo
-    - interfaces/builtin: add initial docker interface
-    - snap: remove extra newline after progress is done
-    - docs: fix formating of HACKING.md "Testing snapd"
-    - store : add requestOptions.ExtraHeaders so that individual
-      requests can customise headers.
-    - many: use unique plug/slot names in tests
-    - tests: add tests for the classic dimension
-    - many: add vendoring of dependencies by default
-    - tests: use in-tree snap{ctl,-exec} for all tests
-    - many: support snapctl -h
-    - tests: adjust regex after changes in stat output
-    - store,snap: initial support for delta downloads
-    - interfaces/builtin: add run/udev/data paths to mir interface
-    - snap: lessen annoyance of implicit interface tests
-    - tests: ensure http{,s}_proxy is defined inside the fake-store
-    - interfaces: allow xdg-open in unity7, unity7 cleanups
-    - daemon,store: move store login user logic to store
-    - tests: replace realpath with readlink -f for trusty support.
-    - tests: add https_proxy into environment as well
-    - interfaces/builtin: allow mmaping pulseaudio buffers
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 28 Sep 2016 11:09:27 +0200
-
-snapd (2.15.2ubuntu1) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - snap/snapenv, tests: use root's data dirs when running via sudo
-      (cherry pick PR: #1857)
-    - tests: add https_proxy into environment
-      (cherry pick PR: #1926)
-    - interfaces: allow xdg-open in unity7, unity7 cleanups
-      (cherry pick PR: #1946)
-    - tests: ensure http{,s}_proxy is defined inside the fake-store
-      (cherry pick PR: #1949)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 21 Sep 2016 17:21:12 +0200
-
-snapd (2.15.2) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - asserts: define a bit less terse Ref.String
-    - interfaces: disable auto-connect in libvirt interface
-    - asserts: check that validation assertions are signed by the
-      publisher of the gating snap
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 19 Sep 2016 10:42:29 +0200
-
-snapd (2.15.1) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - image: ensure local snaps are put last in seed.yaml
-    - asserts: revert change that made the account-key's name mandatory.
-    - many: refresh all snap decls
-    - interfaces/apparmor: allow reading /etc/environment
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 19 Sep 2016 09:19:44 +0200
-
-snapd (2.15) xenial; urgency=medium
-
-  * New upstream release, LP: #1623579
-    - tests: disable prepare-image-grub test in autopkgtest
-    - interfaces: allow special casing for auto-connect until we have
-      assertions
-    - docs: add a little documentation on hooks.
-    - hookstate,daemon: don't mock HookRunner, mock command.
-    - tests: add http_proxy to /etc/environment in the autopkgtest
-      environment
-    - backends: first bits of kernel-module security backend
-    - tests: ensure openssh-server is installed in autopkgtest
-    - tests: make ubuntu-core tests more robust
-    - many: mostly work to support ABA upgrades
-    - cmd/snap: do runtime linting of descriptions
-    - spread.yaml: don't assume LANG is set
-    - snap: fix SNAP* environment merging in `snap run`
-    - CONTRIBUTING.md: remove integration-tests, include spread
-    - store: don't discard error body from request device session call
-    - docs: add create-user documentation
-    - cmd/snap: match UX document for message when buying without login
-    - firstboot: do not overwrite any existing netplan config
-    - tests: add debug output to ubuntu-core-update-rollback-
-      stresstest:
-    - tests/lib/prepare.sh: test that classic does not setting bootvars
-    - snap: run all tests with gpg2
-    - asserts: basic support for validation assertion and refresh-
-      control
-    - interfaces: miscellaneous policy updates for default, browser-
-      support and camera
-    - snap: (re)add --force-dangerous compat option
-    - tests: ensure SUDO_{USER,GID} is unset in the spread tests
-    - many: clean out left over references to integration tests
-    - overlord/auth,store: fix raciness in updating device/user in state
-      through authcontext and other issuesbonus fixes:
-    - tests: fix spread tests on yakkety
-    - store: refactor auth/refresh tests
-    - asserts: use gpg --fixed-list-mode to be compatible with both gpg1
-      and gpg2
-    - cmd/snap: i18n option descriptions
-    - asserts: required account key name header
-    - tests: add yakkety test host
-    - packaging: make sure debhelper-generated snippet is invoked on
-      postrm
-    - snap,store: capture newest digest from the store, make it
-      DownloadInfo only
-    - tests: add upower-observe spread test
-    - Merge github.com:snapcore/snapd
-    - tests: fixes to actually run the spread tests inside autopkgtest
-    - cmd/snap: make "snap find" error nicer.
-    - tests: get the gadget name from snap list
-    - cmd/snap: tweak help of 'snap download'
-    - cmd/snap,image: teach snap download to download also assertions
-    - interfaces/builtin: tweak opengl interface
-    - interfaces: serial-port use udevUsbDeviceSnippet
-    - store: ensure the payment methods method handles auth failure
-    - overlord/snapstate: support revert flags
-    - many: add snap configuration to REST API
-    - tests: use ubuntu-image for the ubuntu-core-16 image creation
-    - cmd/snap: serialise empty keys list as [] rather than null
-    - cmd/snap,client: add snap set and snap get commands
-    - asserts: update trusted account-key asserts with names
-    - overlord/snapstate: misc fixes/tweaks/cleanups
-    - image: have prepare-image set devmode correctly
-    - overlord/boot: have firstboot support assertion files with
-      multiple assertions
-    - daemon: bail from enable and disable if revision given, and from
-      multi-op if unsupported optons given
-    - osutil: call sync after cp if
-      requested.overlord/snapstate/backend: switch to use osutil instead
-      of another buggy call to cp
-    - cmd/snap: generate account-key-request "since" header in UTC
-    - many: use symlinks instead of wrappers
-    - tests: remove silly [Service] entry from snapd.socket.d/local.conf
-    - store: switch device session to use device-session-request
-      assertion
-    - snap: ensure that plug and slot names are unique
-    - cmd/snap: fix test suite (no Exit(0) on tests!)
-    - interfaces: add interface for hidraw devices
-    - tests: use the real model assertion when creating the core test
-      image
-    - interfaces/builtin: add udisks2 and removable-media interfaces
-    - interface: network_manager: enable resolvconf
-    - interfaces/builtin: usb serial-port support via udev
-    - interfaces/udev: support noneSecurityTag keyed snippets
-    - snap: switch to the new agreed regexp for snap names
-    - tests: adjust test setup after ubuntu user removal
-    - many: start services only after the snap is fully ready (link-snap
-      was run)
-    - asserts: don't have Add/Check panic in the face of unsupported no-
-      authority assertions
-    - asserts: initial support to generate/sign snap-build assertions
-    - asserts: support checking account-key-request assertions
-    - overlord: introduce AuthContext.DeviceSessionRequest with support
-      in devicestate
-    - overlord/state: fix for reloaded task/change crashing on Set if
-      checkpointed w. no custom data  yet
-    - snapd.refresh.service: require snap.socket and /snap/*/current.
-    - many: spell --force-dangerous as just --dangerous, devmode should
-      imply it
-    - overlord/devicestate: try to fetch/refresh the signing key of
-      serial (also in case is not there yet)
-    - image,overlord/boot,snap: metadata from asserts for image snaps
-    - many: automatically restart all-snap devices after os/kernel
-      updates
-    - interfaces: modem-manager: ignore camera
-    - firstboot: only configure en* and eth* interfaces by default
-    - interfaces: fix interface handling on no-app snaps
-    - snap: set user variables even if HOME is unset (like with systemd
-      services)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 16 Sep 2016 07:46:22 +0200
-
-snapd (2.14.2~16.04) xenial; urgency=medium
-
-  * New upstream release: LP: #1618095
-    - tests: use the spread tests with the adhoc interface inside
-      autopkgtest
-    - interfaces: add fwupd interface
-    - asserts,cmd/snap: add "name" header to account-key(-request)
-    - client,cmd/snap: display os-release data only on classic
-    - asserts/tool,cmd/snap: introduce hidden "snap sign"
-    - many: when installing snap file derive metadata from assertions
-      unless --force-dangerous
-    - osutil: tweak the createUserTests a bit and extract common code
-    - debian: umount --lazy before rm on snapd.postrm
-    - interfaces: updates to default policy, browser-support, and x11
-    - store: set initial device session
-    - interfaces: add upower-observe interface (LP: #1595813)
-    - tests: use beta u-d-f in test by default
-    - interfaces/builtin: allow writing on /dev/vhci in bluetooth-
-      control
-    - interfaces/builtin: allow /dev/vhci on bluetooth-control
-    - tests: port integration tests to spread
-    - snapstate: use umount --lazy when removing the mount units
-    - spread: enable halt-timeout, tweak image selection
-    - tests: fix firstboot-assertions to actually be runnable on classic
-      again
-    - asserts: introduce device-session-request
-    - interfaces: add screen-inhibit-control interface (LP: #1604880)
-    - firstboot: change location of netplan config
-    - overlord/devicestate: some cleanups and solving a couple todos
-    - daemon,overlord: add subcommand handling to snapctl
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 01 Sep 2016 18:52:05 +0200
-
-snapd (2.14.1) xenial; urgency=medium
-
-  * New upstream release: LP: #1618095
-    - snap-exec: add support for commands with internal args in snap-
-      exec
-    - store: refresh expired device sessions
-    - debian: re-add ubuntu-core-snapd-units as a transitional package
-    - image: snap assertions into image
-    - overlord/assertstate,asserts/snapasserts: give snap assertions
-      helpers a package, introduce ReconstructSideInfo
-    - docs/interfaces: Add empty line after lxd-support title
-    - README: cover the new /run/snapd-snap.socket
-    - daemon: make socket split backward-compatible.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 30 Aug 2016 16:43:29 +0200
-
-snapd (2.14) xenial; urgency=medium
-
-  * New upstream release: LP: #1618095
-    - cmd: enable SNAP_REEXEC only if it is set to SNAP_REEXEC=1
-    - osutil: fix create-user on classic
-    - firstboot: disable firstboot on classic for now
-    - cmd/snap: add export-key --account= option
-    - many: split public snapd REST API into separate socket.
-    - many: drop ubuntu-core-snapd-units package, use release.OnClassic
-      instead
-    - tests: add content-shareing binary test that excersises snap-
-      confine
-    - snap: use "up to date" instead of "up-to-date"
-    - asserts: add an account-key-request assertion
-    - asserts: fix GPG key generation parameters
-    - tests, integration-tests: implement the cups-control manual test
-      as a spread test
-    - many: clarify/tie down model assertion
-    - cmd/snap: add "snap download" command
-    - integration-tests: remove them in favour of the spread tests
-    - tests: test all snap ubuntu core upgrade
-    - many: support install and remove by revision
-    - overlord/state: prevent change ready => unready
-    - tests: fixes to make the ubuntu-core-16 image usable with
-      -keep/-reuse
-    - asserts: authority-id and brand-id of serial must match
-    - firstboot: generate netplan config rather than ifupdown
-    - store: request device session macaroon from store
-    - tests: add workaround for u-d-f to unblock all-snap image tests
-    - tests: the stable ubuntu-core snap has snap run support now
-    - many: use make StripGlobalRootDir public
-    - asserts: add some stricter checks around format
-    - many: have AuthContext expose device store-id, serial and serial-
-      proof signing to the store
-    - tests: fix "tests/main/ack" to not break if asserts are alreay
-      there
-    - tests/main/ack: fix test/style
-    - snap: add key management commands
-    - firstboot: add firstboot assertions importing
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 29 Aug 2016 17:07:20 +0200
-
-snapd (2.13) xenial; urgency=medium
-
-  * New upstream release: LP: #1616157
-    - many: respect dirs.SnapSnapsDir in tests
-    - tests: update listing test for latest stable image
-    - many: hook in start of code to fetch/check assertions when
-      installing snap from store
-    - boot: add missing udevadm mock to fix FTBFS
-    - interfaces: add lxd-support interface
-    - dirs,snap: handle empty root directory in SetRootDir
-    - dirs,snap: define methods for SNAP_USER_DATA and SNAP_USER_COMMON
-    - tests: spread all-snap test cleanup
-    - tests: add all-snap spread image tests
-    - store,tests: have just one envvar SNAPPY_USE_STAGING_STORE to
-      control talking to staging
-    - overlord/hookstate: use snap run posix parameters.
-    - interfaces/builtin: allow bind in the network interface
-    - asserts,overlord/devicestate: simplify private key/key pairs APIs,
-      they take just key ids
-    - dependencies: update godeps
-    - boot: add support for "devmode: {true,false}" in seed.yaml
-    - many: teach prepare-image to copy the model assertion (and
-      prereqs) into the seed area of the image
-    - tests: start teaching the fakestore about assertions
-    - asserts/sysdb: embed the new format official root/trusted
-      assertions
-    - overlord/devicestate: first pass at device registration logic
-    - tests: add process-control interface spread test
-    - tests: disable unity test
-    - tests: adapt to new spread version
-    - asserts: add serial-proof device assertion
-    - client, cmd/snap: use the new multi-refresh endpoint
-    - many: preparations for image code to fetch model prereqs
-    - debian: add extra checks when debian/snapd.postrm purge is run
-    - overlord/snapstate, daemon: support for multi-snap refresh
-    - tests: do not leave "squashfs-root" around
-    - snap-exec: Fix broken `snap run --shell` and add test
-    - overlord/snapstate: check changes to SnapState for conflicts also.
-    - docs/interfaces: change snappy command to snap
-    - tests: test `snap run --hook` using in-tree snap-exec.
-    - partition: ensure that snap_{kernel,core} is not overridden with an
-      empty value
-    - asserts,overlord/assertstate: introduce an assertstate task
-      handler to fetch snap assertions
-    - spread: disable re-exec to always test development tree.
-    - interfaces: implement a fuse interface
-    - interfaces/hardware-observe.go: re-add /run/udev/data
-    - overlord/assertstate,daemon: reorg how the assert manager exposes
-      the assertion db and adding to it
-    - release: Remove "UBUNTU_CODENAME" from the test data
-    - many: implement snapctl command.
-    - interfaces: mpris updates (fix unconfined introspection, add name
-      attribute)
-    - asserts: export DecodePublicKey
-    - asserts: introduce support for assertions with no authority,
-      implement serial-request
-    - interfaces: bluez: add a few more tests to verify interface
-      connection works
-    - interfaces: bluez: add missing mount security snippet case
-    - interfaces: add kernel-module interface for module insertion.
-    - integration-tests: look for ubuntu-device-flash on PATH before
-      calling sudo
-    - client, cmd, daemon, osutil: support --yaml and --sudoer flags for
-      create-user
-    - spread: use snap-confine from ppa:snappy-dev/image for the tests
-    - many: move to purely hash based key lookup and to new
-      key/signature format (v1)
-    - spread: Use /home/gopath in spread.yaml
-    - tests: base security spread tests
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 24 Aug 2016 14:48:28 +0200
-
-snapd (2.12) xenial; urgency=medium
-
-  * New upstream release: LP: #1612362
-    - many: do not require root for `snap prepare-image`
-    - tests: prevent restore error on test failure
-    - osutil: change escaping for create-user's sudoers
-    - docs: private flag doesn't exist on /v2/find (it's select)
-    - snap: do not sort the result of `snap find`
-    - interfaces/builtin: add gpio interface
-    - partition: fix cleaning of the boot variables on the second good
-      boot
-    - tests: add udev rules spread test
-    - docs: fix references to refresh action
-    - interfaces/udev,osutil: avoid doubled rules and put all in a per
-      snap file
-    - store: minor store improvements from previous reviews
-    - many: support interactive payments in snapd, filter from command
-      line
-    - docs/interfaces.md: improve interfaces documentation
-    - overlord,store: set store device authorization header
-    - store: add device nonce API support
-    - many: various fixes around the `create-user` command
-    - client, osutil: chown the auth file
-    - interfaces/builtin: add transitional browser-support interface
-    - snap: don't load unsupported implicit hooks.
-    - cmd/snap,cmd/snap-exec: support hooks again.
-    - interfaces/builtin: improve pulseaudio interface
-    - asserts: make account-key's `until` optional to represent a never-
-      expiring key
-    - store: refactor newRequest/doRequest to take requestOptions
-    - tests: allow-downgrades on upgrade test to prevent version errors
-    - daemon: stop using group membership as succedaneous of running
-      things with sudo
-    - interfaces: add bluetooth-control interfaces
-    - many: remove integration-test coverage metrics
-    - daemon,docs: drop license docs and error kind
-    - tests: add network-control interface spread test
-    - tests: add hardware-observe spread test
-    - interfaces: add system-trace interface LP: #1600085
-    - boot: use `cp -aLv` instead of `cp -a` (no symlinks on vfat)
-    - store: soft-refresh discharge macaroon from store when required
-    - partition: clear snap_try_{kernel,core} on success
-    - tests: add snapd-control interface spread test
-    - tests: add locale-control write spread test
-    - store: fix buy method after some refactoring broke it
-    - interfaces/builtin: read perms for network devices in network-
-      observe
-    - interfaces: also allow rfkill in network_control
-    - snapstate: remove artifacts from a snap try dir that vanished
-    - client, cmd/snap: better errors for empty snap list result
-    - wrappers: set BAMF_DESKTOP_FILE_HINT for unity
-    - many: cleanup/update rest.md; improve auth errors
-    - interfaces: miscelleneous policy updates for default, log-observe,
-      mount-observe, opengl, pulseaudio, system-observe and unity7
-    - interfaces: add process-control interface (LP: #1598225)
-    - osutil: support both "nobody" and "nogroup" for grpnam tests
-    - cmd: support defaulting to the user's preferred payment method
-    - overlord: actually run hooks.
-    - overlord/state,overlord/ifacestate: define basic infrastructure
-      for and then setting up serialising of interface mgr tasks
-    - asserts: add Assertion.Prerequisites and SigningKey, Ref and
-      FindTrusted
-    - overlord/snapstate: ensure calls to store are done without the
-      state lock held
-    - asserts,client: switch snap-build and snap-revision to be indexed
-      by snap-sha3-384
-    - many: make seed.yaml on firstboot mandatory and include sideInfo
-    - asserts,many: start supporting structured headers using the new
-      parseHeaders
-    - many: update code for the new snap_mode
-    - tests: added spread find private test
-    - store: deal with 404 froms the SSO store properly
-    - snap: remove meta/kernel.yaml again
-    - daemon: always mock release info in tests
-    - snapstate: drop revisions after "current" on refresh
-    - asserts: introduce new parseHeadersThis introduces the new
-      parseHeaders returning map[string]interface{} and capable of
-      accepting:
-    - asserts: remove/disable comma separated lists and their uses
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 11 Aug 2016 19:30:36 +0200
-
-snapd (2.11) xenial; urgency=medium
-
-  * New upstream release: LP: #1605303
-    - increase version number to reflect the nature of the update
-      better
-    - store, daemon, client, cmd/snap, docs/rest.md: adieu search
-      grammar
-    - debian: move snapd.refresh.timer into timers.target
-    - snapstate: add daemon-reload to fix autopkgtest on yakkety
-    - Interfaces: hardware-observe
-    - snap: rework the output after a snap operation
-    - daemon, cmd/snap: refresh --devmode
-    - store, daemon, client, cmd/snap: implement `snap find --private`
-    - tests: add network-observe interface spread test
-    - interfaces/builtin: allow getsockopt for connected x11 plugs
-    - osutil: check for nogrup instead of adm
-    - store: small cleanups (more needed)
-    - snap/squashfs: fix test not to hardcode snap size
-    - client,cmd/snap: cleanup cmd/snap test suite, add extra args
-      testThis cleans up the cmd/snap test suite:
-    - wrappers: map "never" restart condition to "no."
-    - wrappers: run update-desktop-database after add/remove of desktop
-      files
-    - release: work around elementary mistake
-    - many: remove all traces of channel from the buying codepath
-    - store: kill setUbuntuStoreHeaders
-    - docs: add payment methods documentation
-    - many: present user with a choice of payment backends
-    - asserts: add cross checks for snap asserts
-    - cmd/snap,cmd/snap-exec: support running hooks via snap-exec.
-    - tests: improve snap run symlink tests
-    - tests: add content sharing interface spread test
-    - store & many: a mechanical branch shortening store names
-    - snappy: remove old snappy pkg
-    - overlord/snapstate: kill flagscompat
-    - overlord/snapstate, daemon, client, cmd/snap: devmode override
-      (aka confined)
-    - tests: extend refresh test to talk to the staging and production
-      stores
-    - asserts,daemon: cross checks for account and account-key
-      assertions
-    - client: existing JSON fixtures uses tabs for indentation
-    - snap-exec: add proper integration test for snap-exec
-    - spread.yaml, tests: replace hello-world with test-snapd-tools
-    - tests: add locale-control interface spread test
-    - tests: add mount-observe interface spread test
-    - tests: add system-observe interface spread test
-    - many: add AuthContext to mediate user updates to the state
-    - store/auth: add helper for the macaroon refresh endpoint
-    - cmd: add buy command
-    - overlord: switch snapstate.Update to use ListRefresh (aka
-      /snaps/metadata)
-    - snap-exec: fix silly off-by-one error
-    - tests: stop using hello-world.echo in the tests
-    - tests: add env command to test-snapd-tools
-    - classic: remove (most of) "classic" mode, this is implemented as a
-      snap now
-    - many: remove snapstate.Candidate and other cleanups
-    - many: removed authenticator, store gets a user instead
-    - asserts: fix minor doc comment typo
-    - snap: ensure unknown arguments to `snap run` are ignored
-    - overlord/auth: add Device/SetDevice to persist device identity in
-      state
-    - overlord: make SyncBoot work again
-    - tests: add -y flag to apt autoremove command in unity task restore
-    - many: migrate SnapSetup and SideInfo to use RealName
-    - daemon: drop auther()
-    - client: improve error from client.do() on json decode failures
-    - tests: readd the fake store tests
-    - many: allow removal of broken snaps, add spread test
-    - overlord: implement &Retry{After: duration} support for handlers
-    - interface: add new interfaces.all.SecurityBackends
-    - integration-tests: remove login tests
-    - cmd,interfaces,snap: implement hook whitelist.
-    - daemon,overlord/auth,store: update macaroon authentication to use
-      the new endpoints
-    - daemon, overlord: add buy endpoint to REST API
-    - tests: use systemd-run for starting and stopping the unity app
-    - tests, integration-tests: port systemd service check test to
-      spread
-    - store: switch search to new snap-specific endpoint
-    - store, many: start using the new details endpoint
-    - tests, integration-tests: port unity test to spread
-    - tests: add spread test for tried snaps removal
-    - tests, integration-tests: port auth errors test to spread
-    - snapstate: rename OfficialName to RealName in the new tests
-    - many: rename SideInfo.OfficialName to SideInfo.RealName
-    - snapstate: use snapstate.Type in backend.RemoveSnapFiles
-    - many: add `snap enable/disable` commands
-    - tests, integration-tests: port refresh all test to spread
-    - snap: add `snap run --shell`
-    - tests: set yaml indentation to 4 spaces
-    - snapstate: cleanup downloaded temp snap files
-    - overlord: make patch1_test more robust
-    - debian: add snapd.postrm that purges
-    - integration-tests: drop already covered refresh app test
-    - many: add concept of "broken" snaps
-    - tests, integration-tests: port remove errors tests to spread
-    - tests, integration-tests: port revert test to spread
-    - debian: fix snapbuild path
-    - overlord: fix access to the state without lock in firstboot.go and
-      add test
-    - snapstate: add very simple garbage collection on upgrade
-    - asserts: introduce assertstest with helpers to test code involving
-      assertions
-    - tests, integration tests: port undone failed install test to
-      spread
-    - snap,store: switch to the new snaps/metadata endpoint, introduce
-      and start capturing DeveloperID
-    - tests, integration-tests: port the op remove retry test to spread
-    - po: remove snappy.pot from git, it will be generated at build time
-    - many: add some missing tests, clarify some things and nitpicks as
-      follow up to `snap revert`
-    - snapstate: when doing snapsate.Update|Install, talk to the store
-      early
-    - tests, integration-tests: port the op remove test to spread
-    - interfaces: allow /usr/bin/locale in default policy
-    - many: add `snap revert`
-    - overlord/auth,store: add macaroon serialization/deserialization
-      helpers
-    - many: embed main store trusted assertions in snapd, way to have
-      test ones, spread tests for ack and known
-    - overlord/snapstate,daemon: clarify active vs current, add
-      SnapState.HasCurrent,CurrentInfo
-    - tests: do not search for a specific snap (we hit 100 items) and
-      pagination kicks in
-    - tests: use printf instead of echo where we need portability
-    - tests: rename and generalize basic-binaries to test-snapd-tools
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 26 Jul 2016 15:49:04 +0200
-
-snapd (2.0.10) xenial; urgency=medium
-
-  *  New upstream release: LP: #1597329
-    - interfaces: also allow @{PROC}/@{pid}/mountinfo and
-      @{PROC}/@{pid}/mountstats
-    - interfaces: allow read access to /etc/machine-id and
-      @{PROC}/@{pid}/smaps
-    - interfaces: miscelleneous policy updates for default, log-observe
-      and system-observe
-    - snapstate: add logging after a successful doLinkSnap
-    - tests, integration-tests: port try tests to spread
-    - store, cmd/snapd: send a basic user-agent to the store
-    - store: add buy method
-    - client: retry on failed GETs
-    - tests: actual refresh test
-    - docs: REST API update
-    - interfaces: add mount support for hooks.
-    - interfaces: add udev support for hooks.
-    - interfaces: add dbus support for hooks.
-    - tests, integration-tests: port refresh test to spread
-    - tests, integration-tests: port change errors test to spread
-    - overlord/ifacestate: don't retry snap security setup
-    - integration-tests: remove unused file
-    - tests: manage the socket unit when reseting state
-    - overlord: improve organization of state patches
-    - tests: wait for snapd listening after reset
-    - interfaces/builtin: allow other sr*/scd* optical devices
-    - systemd: add support for squashfuse
-    - snap: make snaps vanishing less fatal for the system
-    - snap-exec: os.Exec() needs argv0 in the args[] slice too
-    - many: add new `create-user` command
-    - interfaces: auto-connect content interfaces with the same content
-      and developer
-    - snapstate: add Current revision to SnapState
-    - readme: tweak readme blurb
-    - integration-tests: wait for listening port instead of active
-      service reported by systemd
-    - many: rename Current -> {CurrentSideInfo,CurrentInfo}
-    - spread: fix home interface test after suite move
-    - many: name unversioned data.
-    - interfaces: add "content" interface
-    - overlord/snapstate: defaultBackend can go away now
-    - debian: comment to remember why the timer is setup like it is
-    - tests,spread.yaml: introduce an upgrade test, support/split into
-      two suites for this
-    - overlord,overlord/snapstate: ensure we keep snap type in snapstate
-      of each snap
-    - many: rework the firstboot support
-    - integration-tests: fix test failure
-    - spread: keep core on suite restore
-    - tests: temporary fix for state reset
-    - overlord: add infrastructure for simple state format/content
-      migrations
-    - interfaces: add seccomp support for hooks.
-    - interfaces: allow gvfs shares in home and temporarily allow
-      socketcall by default (LP: #1592901, LP: #1594675)
-    - tests, integration-tests: port network-bind interface tests to
-      spread
-    - snap,snap/snaptest: use PopulateDir/MakeTestSnapWithFiles directly
-      and remove MockSnapWithHooks
-    - interfaces: add mpris interface
-    - tests: enable `snap run` on i386
-    - tests, integration-tests: port network interface test to spread
-    - tests, integration-tests: port interfaces cli to spread
-    - tests, integration-tests: port leftover install tests to spread
-    - interfaces: add apparmor support for hooks.
-    - tests, integration-tests: port log-observe interface tests to
-      spread
-    - asserts: improve Decode doc comment about assertion format
-    - tests: moved snaps to lib
-    - many: add the camera interface
-    - many: add optical-drive interface
-    - interfaces: auto-connect home if running on classic
-    - spread: bump gccgo test timeout
-    - interfaces: use security tags to index security snippets.
-    - daemon, overlord/snapstate, store: send confinement header to the
-      store for install
-    - spread: run tests on 16.04 i386 concurrently
-    - tests,integration-tests: port install error tests to spread
-    - interfaces: add a serial-port interface
-    - tests, integration-tests, debian: port sideload install tests to
-      spread
-    - interfaces: add new bind security backend and refactor
-      backendtests
-    - snap: load and validate implicit hooks.
-    - tests: add a build/run test for gccgo in spread
-    - cmd/snap/cmd_login: Adjust message after adding support for wheel
-      group
-    - tests, integration-tests: ported install from store tests to
-      spread
-    - snap: make `snap change <taskid>` show task progress
-    - tests, integration-tests: port search tests to spread
-    - overlord/state,daemon: make abort proceed immediately, fix doc
-      comment, improve tests
-    - daemon: extend privileged access to users in "wheel" group
-    - snap: tweak `snap refresh` and `snap refresh --list` outputTiny
-      branch that does three things:
-    - interfaces: refactor auto-connection candidate check
-    - snap: add support for snap {install,refresh}
-      --{edge,beta,candidate,stable}
-    - release: don't force KDE Neon into devmode.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 29 Jun 2016 21:02:39 +0200
-
-snapd (2.0.9) xenial; urgency=medium
-
-  * New upstream release: LP: #1593201
-    - snap: add the magic redirect part of `snap run`
-    - tests, integration-tests: port server related tests to spread
-    - overlord/snapstate: log restarting in the task
-    - daemon: test restart wiring, fix setup/teardown
-    - cmd: don't show the price if a snap has already been purchased
-    - tests, integration-tests: port listing tests to spread
-    - integration-tests: do not try to kill ubuntu-clock-app.clock (no
-      longer a process)
-    - several: tie up overlord's restart handler into daemon; adjust
-      snap to cope
-    - tests, integration-tests: port abort tests to spread
-    - integration-tests: fix flaky TestRemoveBusyRetries
-    - testutils: refactor/mock exec
-    - snap,cmd: add hook support to snap run.
-    - overlord/snapstate: remove Download from backend
-    - store: use a custom logging transport
-    - overlord/hookstate: implement basic HookManager.
-    - spread: move the suite restore to restore-each
-    - asserts: turn model os into model core field, making it also more
-      like the kernel and gadget fields
-    - asserts: / is not allowed in primary key headers, follow the store
-      in this
-    - release: enable full confinement on Elementary 0.4
-    - integration-tests: fix another i386 autopkgtest failure.
-    - cmd/snap: create SNAP_USER_DATA and common dirs in `snap run`
-    - many: have the installation of the core snap request a restart (on
-      classic)
-    - asserts: allow to load also account assertions into the trusted
-      set
-    - many: install snaps in devmode on distributions without complete
-      apparmor and seccomp support
-    - spread: run on travis
-    - snapenv: do not hardcode amd64 in tests
-    - spread: initial harness and first test
-    - interfaces: miscelleneous policy updates for chromium, x86,
-      opengl, etc
-    - integration-tests: remove daemon to use the log-observe interface
-    - client: remove client.Revision and import snap.Revision instead
-    - integration-tests: wait for network-bind service in try test
-    - many: move over from snappy to snapstate/backend SetupSnap and
-      related code
-    - integration-tests: add interfaces cli tests
-    - snapenv: cleanup snapenv.{Basic,User}
-    - cmd/snap: also print slots that connect to the wanted snap (LP:
-      #1590704)
-    - asserts: error style, use "cannot" instead of "failed to"
-      following the main decided style
-    - integration-tests: wait until the network-bind service is up
-      before testing
-    - many: add new `snap run` command
-    - snappy: unexport snappy.Install and snappy.Overlord.{Un,}Install
-    - many: add some shared testing helpers to snap/snaptest and to
-      boot/boottest
-    - rest-api: support to send apps per snap (LP: #1564076)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 16 Jun 2016 13:56:12 +0200
-
-snapd (2.0.8.1) UNRELEASED; urgency=medium
-
-  * New upstream release
-    - Cherry pick four commits that show snaps as installed in devmode on
-    distributions without full confinement dependencies available:
-
-    25634d3364a46b5e9147e4466932c59b1b572d35
-    53f2e8d5f1b2d7ce13f5b50be4c09fa1de8cf1e0
-    38771f4cc324ad9dd4aa48b03108d13a2c361aad
-    c46e069351c61e45c338c98ab12689a319790bd5
-
- -- Zygmunt Krynicki <zygmunt.krynicki@canonical.com>  Tue, 14 Jun 2016 15:55:30 +0200
-
-snapd (2.0.8) xenial; urgency=medium
-
-  * New upstream release: LP: #1589534
-    - debian: make `snap refresh` times more random (LP: #1537793)
-    - cmd: ExecInCoreSnap looks in "core" snap first, and only in
-      "ubuntu-core" snap if rev>125.
-    - cmd/snap: have 'snap list' display helper message on stderr
-      (LP: #1587445)
-    - snap: make app names more restrictive.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 08 Jun 2016 07:56:58 +0200
-
-snapd (2.0.7) xenial; urgency=medium
-
-  * New upstream release: LP: #1589534
-    - debian: do not ship  /etc/ld.so.conf.d/snappy.conf (LP: #1589006)
-    - debian: fix snapd.refresh.service install and usage (LP: #1588977)
-    - ovlerlord/state: actually support task setting themself as
-      done/undone
-    - snap: do not use "." import in revision_test.go, as this breaks
-      gccgo-6 (fix build failure on powerpc)
-    - interfaces: add fcitx and mozc input methods to unity7
-    - interfaces: add global gsettings interfaces
-    - interfaces: autoconnect home and doc updates (LP: #1588886)
-    - integration-tests: remove
-      abortSuite.TestAbortWithValidIdInDoingStatus
-    - many: adding backward compatible code to upgrade SnapSetup.Flags
-    - overlord/snapstate: handle sideloading over an old sideloaded snap
-      without panicing
-    - interfaces: add socketcall() to the network/network-bind
-      interfaces (LP: #1588100)
-    - overlord/snapstate,snappy: move over CanRemoveThis moves over the
-      CanRemove check to snapstate itself.overlord/snapstate
-    - snappy: move over CanRemove
-    - overlord/snapstate,snappy: move over CopyData and Remove*Data code
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 06 Jun 2016 16:35:50 +0200
-
-snapd (2.0.6) xenial; urgency=medium
-
-  * New upstream release: LP: #1588052:
-    - many: repository moved to snapcore/snapd
-    - debian: add transitional pkg for the github location change
-    - snap: ensure `snap try` work with relative paths
-    - debian: drop run/build dependency on lsb-release
-    - asserts/tool: gpg key pair manager
-    - many: add new snap-exec
-    - many: implement `snap refresh --list` and  `snap refresh`
-    - snap: add parsing support for hooks.
-    - many: add the cups interface
-    - interfaces: misc policy fixes (LP: #1583794)
-    - many: add `snap try`
-    - interfaces: allow using sysctl and scmp_sys_resolver for parsing
-      kernel logs
-    - debian: make snapd get its environ from /etc/environment
-    - daemon,client,snap: revisions are now strings
-    - interfaces: allow access to new ibus abstract socket path
-      LP: #1580463
-    - integration-tests: add remove tests
-    - asserts: stronger crypto choices and follow better latest designs
-    - snappy,daemon: hollow out more of snappy (either removing or not
-      exporting stuff on its way out), snappy/gadget.go is gone
-    - asserts: rename device-serial to serial
-    - asserts: rename identity to account (and username access)
-    - integration-tests: add changes tests
-    - backend: add tests for environment wrapper generation
-    - interfaces/builtin: add location-control interface
-    - overlord/snapstate: move over check snap logic from snappy
-    - release: use os-release instead of lsb-release for cross-distro
-      use
-    - asserts: allow empty snap-name for snap-declaration
-    - interfaces/builtin,docs,snap: add the pulseaudio interface
-    - many: add support for an environment map inside snap.yaml
-    - overlord/snapstate: increase robustness of doLinkSnap/undoLinkSnap
-      with sanity unit tests
-    - snap: parse epoch property
-    - snappy: do nothing in SetNextBoot when running on classic
-    - snap: validate snap type
-    - integration-tests: extend find command tests
-    - asserts: extend tests to cover mandatory and empty headers
-    - tests: stop the update-pot check in run-checks
-    - snap: parse confinement property.
-    - store: change applyUbuntuStoreHeaders to not take accept, and to
-      take a channel
-    - many: struct-based revisions, new representation
-    - interfaces: remove 'audit deny' rules from network_control.go
-    - interfaces: add  com.canonical.UrlLauncher.XdgOpen to unity7
-      interface
-    - interfaces: firewall-control can access xtables lock file
-    - interfaces: allow unity7 AppMenu
-    - interfaces: allow unity7 launcher API
-    - interfaces/builtin: add location-observe interface
-    - snap: fixed snap empty list text LP: #1587445
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 02 Jun 2016 08:23:50 +0200
-
-snapd (2.0.5) xenial; urgency=medium
-
-  * New upstream release: LP: #1583085
-    - interfaces: add dbusmenu, freedesktop and kde notifications to
-      unity7 (LP: #1573188)
-    - daemon: make localSnapInfo return SnapState
-    - cmd: make snap list with no snaps not special
-    - debian: workaround for XDG_DATA_DIRS issues
-    - cmd,po: fix conflicts, apply review from #1154
-    - snap,store: load and store the private flag sent by the store in
-      SideInfo
-    - interfaces/apparmor/template.go: adjust /dev/shm to be more usable
-    - store: use purchase decorator in Snap and FindSnaps
-    - interfaces: first version of the networkmanager interface
-    - snap, snappy: implement the new (minmimal) kernel spec
-    - cmd/snap, debian: move manpage generation to depend on an environ
-      key; also, fix completion
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 19 May 2016 15:29:16 +0200
-
-snapd (2.0.4) xenial; urgency=medium
-
-  * New upstream release:
-    - interfaces: cleanup explicit denies
-    - integration-tests: remove the ancient integration daemon tests
-    - integration-tests: add network-bind interface test
-    - integration-tests: add actual checks for undoing install
-    - integration-tests: add store login test
-    - snap: add certain implicit slots only on classic
-    - integration-tests: add coverage flags to snapd.service ExecStart
-      setting when building from branch
-    - integration-tests: remove the tests for features removed in 16.04.
-    - daemon, overlord/snapstate: "(de)activate" is no longer a thing
-    - docs: update meta.md and security.md for current snappy
-    - debian: always start snapd
-    - integration-tests: add test for undoing failed install
-    - overlord: handle ensureNext being in the past
-    - overlord/snapstate,overlord/snapstate/backend,snappy: start
-      backend porting LinkSnap and UnlinkSnap
-    - debian/tests: add reboot capability to autopkgtest and execute
-      snapPersistsSuite
-    - daemon,snappy,progress: drop license agreement broken logic
-    - daemon,client,cmd/snap: nice access denied message
-      (LP: #1574829)
-    - daemon: add user parameter to all commands
-    - snap, store: rework purchase methods into decorators
-    - many: simplify release package and add OnClassic
-    - interfaces: miscellaneous policy updates
-    - snappy,wrappers: move desktop files handling to wrappers
-    - snappy: remove some obviously dead code
-    - interfaces/builtin: quote apparmor label
-    - many: remove the gadget yaml support from snappy
-    - snappy,systemd,wrappers: move service units generation to wrappers
-    - store: add method to determine if a snap must be bought
-    - store: add methods to read purchases from the store
-    - wrappers,snappy: move binary wrapper generation to new package
-      wrappers
-    - snap: add `snap help` command
-    - integration-tests: remove framework-test data and avoid using
-      config-snap for now
-    - add integration test to verify fix for LP: #1571721
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 13 May 2016 17:19:37 -0700
-
-snapd (2.0.3) xenial; urgency=medium
-
-  * New upstream micro release:
-    - integration-tests, debian/tests: add unity snap autopkg test
-    - snappy: introduce first feature flag for assumes: common-data-dir
-    - timeout,snap: add YAML unmarshal function for timeout.Timeout
-    - many: go into state.Retry state when unmounting a snap fails.
-      (LP: #1571721, #1575399)
-    - daemon,client,cmd/snap: improve output after snap
-      install/refresh/remove (LP: #1574830)
-    - integration-tests, debian/tests: add test for home interface
-    - interfaces,overlord: support unversioned data
-    - interfaces/builtin: improve the bluez interface
-    - cmd: don't include the unit tests when building with go test -c
-      for integration tests
-    - integration-tests: teach some new trick to the fake store,
-      reenable the app refresh test
-    - many: move with some simplifications test snap building to
-      snap/snaptest
-    - asserts: define type for revision related errors
-    - snap/snaptest,daemon,overlord/ifacestate,overlord/snapstate: unify
-      mocking snaps behind MockSnap
-    - snappy: fix openSnapFile's handling of sideInfo
-    - daemon: improve snap sideload form handling
-    - snap: add short and long description to the man-page
-      (LP: #1570280)
-    - snappy: remove unused SetProperty
-    - snappy: use more accurate test data
-    - integration-tests: add a integration test about remove removing
-      all revisions
-    - overlord/snapstate: make "snap remove" remove all revisions of a
-      snap (LP: #1571710)
-    - integration-tests: re-enable a bunch of integration tests
-    - snappy: remove unused dbus code
-    - overlord/ifacestate: fix setup-profiles to use new snap revision
-      for setup (LP: #1572463)
-    - integration-tests: add regression test for auth bug LP:#1571491
-    - client, snap: remove obsolete TypeCore which was used in the old
-      SystemImage days
-    - integration-tests: add apparmor test
-    - cmd: don't perform type assertion when we know error to be nil
-    - client: list correct snap types
-    - intefaces/builtin: allow getsockname on connected x11 plugs
-      (LP: #1574526)
-    - daemon,overlord/snapstate: read name out of sideloaded snap early,
-      improved change summary
-    - overlord: keep tasks unlinked from a change hidden, prune them
-    - integration-tests: snap list on fresh boot is good again
-    - integration-tests: add partial term to the find test
-    - integration-tests: changed default release to 16
-    - integration-tests: add regression test for snaps not present after
-      reboot
-    - integration-tests: network interface
-    - integration-tests: add proxy related environment variables to
-      snapd env file
-    - README.md: snappy => snap
-    - etc: trivial typo fix (LP:#1569892)
-    - debian: remove unneeded /var/lib/snapd/apparmor/additional
-      directory (LP: #1569577)
-    - builtin/unity7.go: allow using gmenu. LP: #1576287
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 03 May 2016 07:51:57 +0200
-
-snapd (2.0.2) xenial; urgency=medium
-
-  * New upstream release:
-    - systemd: add multi-user.target (LP: #1572125)
-    - release: our series is 16
-    - integration-tests: fix snapd binary path for mounting the daemon
-      built from branch
-    - overlord,snap: add firstboot state sync
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 19 Apr 2016 16:02:44 +0200
-
-snapd (2.0.1) xenial; urgency=medium
-
-  * client,daemon,overlord: fix authentication:
-    - fix incorrect authenication check (LP: #1571491)
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 18 Apr 2016 07:24:33 +0200
-
-snapd (2.0) xenial; urgency=medium
-
-  * New upstream release:
-    - debian: put snapd in /usr/lib/snapd/
-    - cmd/snap: minor polishing
-    - cmd,client,daemon: add snap abort command
-    - overlord: don't hold locks when callling backends
-    - release,store,daemon: no more default-channel, release=>series
-    - many: drop support for deprecated environment variables
-      (SNAP_APP_*)
-    - many: support individual ids in changes cmd
-    - overlord/state: use numeric change and task ids
-    - overlord/auth,daemon,client,cmd/snap: logout
-    - daemon: don't install ubuntu-core twice
-    - daemon,client,overlord/state,cmd: add changes command
-    - interfaces/dbus: drop superfluous backslash from template
-    - daemon, overlord/snapstate: updates are users too!
-    - cmd/snap,daemon,overlord/ifacestate: add support for developer
-      mode
-    - daemon,overlord/snapstate: on refresh use the remembered channel,
-      default to stable channel otherwise
-    - cmd/snap: improve UX of snap interfaces when there are no results
-    - overlord/state: include time in task log messages
-    - overlord: prune and abort old changes and tasks
-    - overlord/ifacestate: add implicit slots in setup-profiles
-    - daemon,overlord: setup authentication for store downloads
-    - daemon: macaroon-authed users are like root, and sudoers can login
-    - daemon,client,docs: send install options to daemon
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Sat, 16 Apr 2016 22:15:40 +0200
-
-snapd (1.9.4) xenial; urgency=medium
-
-  * New upstream release:
-    - etc: fix desktop file location
-    - overlord/snapstate: stop an update once download sees the revision
-      is already installed
-    - overlord: make SnapState.DevMode a method, store flags
-    - snappy: no more snapYaml in snappy.Snap
-    - daemon,cmd,dirs,lockfile: drop all lockfiles
-    - debian: use sudo in setup of the proxy environment
-    - snap/snapenv,snappy,systemd: expose SNAP_REVISION to app
-      environment
-    - snap: validate similarly to what we did with old snapYaml info
-      from squashfs snaps
-    - daemon,store: plug in authentication for store search/details
-    - overlord/snapstate: fix JSON name of SnapState.Candidate
-    - overlord/snapstate: start using revisions higher than 100000 for
-      local installs (sideloads)
-    - interfaces,overlorf/ifacestate: honor user choice and don't auto-
-      connect disconnected plugs
-    - overlord/auth,daemon,client: hide user ids again
-    - daemon,overlord/snapstate: back /snaps (and so snap list) using
-      state
-    - daemon,client,overlord/auth: rework state auth data
-    - overlord/snapstate: disable Activate and Deactivate
-    - debian: fix silly typo in autopkgtest setup
-    - overlord/ifacestate: remove connection state with discard-conns
-      task, on the removal of last snap
-    - daemon,client: rename API update action to refresh
-    - cmd/snap: rework login to be more resilient
-    - overlord/snapstate: deny two changes on one snap
-    - snappy: fix crash on certain snap.yaml
-    - systemd: use native systemctl enable instead of our own
-      implementation
-    - store: add workaround for misbehaving store
-    - debian: make autopkgtest use the right env vars
-    - state: log do/undo status too when a task is run
-    - docs: update rest.md with price information
-    - daemon: only include price property if the snap is non-free
-    - daemon, client, cmd/snap: connect/disconnect now async
-    - snap,snappy: allow snaps to require system features
-    - integration-tests: fix report of skips in SetUpTest method
-    - snappy: clean out major bits (still using Installed) now
-      unreferenced as cmd/snappy is gone
-    - daemon/api,overlord/auth: add helper to get UserState from a
-      client request
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 15 Apr 2016 23:30:00 +0200
-
-snapd (1.9.3) xenial; urgency=medium
-
-  * New upstream release:
-    - many: prepare for opengl support on classic
-    - interfaces/apparmor: load all apparmor profiles on snap setup
-    - daemon,client: move async resource to change in meta
-    - debian: disable autopilot
-    - snap: add basic progress reporting
-    - client,cmd,daemon,snap,store: show the price of snaps in the cli
-    - state: add minimal taskrunner logging
-    - daemon,snap,overlord/snapstate: in the API get the snap icon using
-      state
-    - client,daemon,overlord: don't guess snap file vs. name
-    - overlord/ifacestate: reload snap connections when setting up
-      security for a given snap
-    - snappy: remove cmd/snappy (superseded in favour of cmd/snap)
-    - interfaecs/apparmor: remove all traces of old-security from
-      apparmor backend
-    - interfaces/builtin: add bluez interface
-    - overlord/ifacestate: don't crash if connection cannot be reloaded
-    - debian: add searchSuite to autopkgtest
-    - client, daemon, cmd/snap: no more tasks; everything is changes
-    - client: send authorization header in client requests
-    - client, daemon: marshal suggested currency over REST
-    - docs, snap: enumerate snap types correctly in docs and comments
-    - many: add store authenticator parameter
-    - overlord/ifacestate,daemon: setup security on conect and
-      disconnect
-    - interfaces/apparmor: remove unused apparmor variables
-    - snapstate: add missing "TaskProgressAdapter.Write()" for working
-      progress reporting
-    - many: clean out snap config related code not for OS
-    - daemon,client,cmd: return snap list from /v2/snaps
-    - docs: update `/v2/snaps` endpoint documentation
-    - interfaces: rename developerMode to devMode
-    - daemon,client,overlord: progress current => done
-    - daemon,client,cmd/snap: move query metadata to top-level doc
-    - interfaces: add TestSecurityBackend
-    - many: replace typographic quotes with ASCII
-    - client, daemon: rework rest changes to export "ready" and "err"
-    - overlord/snapstate,snap,store: track snap-id in side-info and
-      therefore in state
-    - daemon: improve mocking  of interfaces API tests
-    - integration-tests: remove origins in default snap names for udf
-      call
-    - integration-test: use "snap list" in GetCurrentVersion
-    - many: almost no more NewInstalledSnap reading manifest from
-      snapstate and backend
-    - daemon: auto install ubuntu-core if missing
-    - oauth,store: remove OAuth authentication logic
-    - overlord/ifacestate: simplify some tests with implicit manager
-      initialization
-    - store, snappy: move away from hitting details directly
-    - overlord/ifacestate: reload connections when restarting the
-      manager
-    - overlord/ifacestate: increase flexibility of unit tests
-    - overlord: use state to discover all installed snaps
-    - overlord/ifacestate: track connections in the state
-    - many: separate copy-data from unlinking of current snap
-    - overlord/auth,store/auth: add macaroon authenticator to UserState
-    - client: support for /v2/changes and /v2/changes/{id}
-    - daemon/api,overlord/auth: rework authenticated users information
-      in state
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 14 Apr 2016 23:29:43 +0200
-
-snapd (1.9.2) xenial; urgency=medium
-
-  * New upstream release:
-    - cmd/snap,daemon,store: rework login command to use daemon login
-      API
-    - store: cache suggested currency from the store
-    - overlord/ifacestate: modularize and extend tests
-    - integration-tests: reenable failure tests
-    - daemon: include progress in rest changes
-    - daemon, overlord/state: expose individual changes
-    - overlord/ifacestate: drop duplicate package comment
-    - overlord/ifacestate: allow tests to override security backends
-    - cmd/snap: install *.snap and *.snap.* as files too
-    - interfaces/apparmor: replace /var/lib/snap with /var/snap
-    - daemon,overlord/ifacestate: connect REST API to interfaces in the
-      overlord
-    - debian: remove unneeded dependencies from snapd
-    - overlord/state: checkpoint on final progress only
-    - osutil: introduce IsUIDInAny
-    - overlord/snapstate: rename GetSnapState to Get, SetSnapState to
-      Set
-    - daemon: add id to changes json
-    - overlord/snapstate: SetSnapState() needs locks
-    - overlord: fix broken tests
-    - overlord/snapstate,overlord/ifacestate: reimplement SnapInfo (as
-      Info) actually using the state
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 13 Apr 2016 17:27:00 +0200
-
-snapd (1.9.1.1) xenial; urgency=medium
-
-  * debian/tests/control:
-    - add git to make autopkgtest work
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 Apr 2016 17:19:19 +0200
-
-snapd (1.9.1) xenial; urgency=medium
-
-  * Add warning about installing ubuntu-core-snapd-units on Desktop systems.
-  * Add ${misc:Depends} to ubuntu-core-snapd-units.
-  * interfaces,overlord: add support for auto-connecting plugs on
-    install
-  * fix sideloading snaps and (re)add tests for this
-  * add `ca-certificates` to the test-dependencies to fix autopkgtest
-    failure on armhf
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 Apr 2016 14:39:57 +0200
-
-snapd (1.9) xenial; urgency=medium
-
-  * rename source and binary package to "snapd"
-  * update directory layout to final 16.04 layout
-  * use `snap` command instead of the previous `snappy`
-  * use `interface` based security
-  * use new state engine for install/update/remove
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 12 Apr 2016 01:05:09 +0200
-
-ubuntu-snappy (1.7.3+20160310ubuntu1) xenial; urgency=medium
-
-    - debian: update versionized ubuntu-core-launcher dependency
-    - debian: tweak desktop file dir, ship Xsession.d snip for seamless
-      integration
-    - snappy: fix hw-assign to work with per-app udev tags
-    - snappy: use $snap.$app as per-app udev tag
-    - snap,snappy,systemd: %s/\<SNAP_ORIGIN\>/SNAP_DEVELOPER/g
-    - snappy: add mksquashfs --no-xattrs parameter
-    - snap,snappy,systemd: kill SNAP_FULLNAME
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 10 Mar 2016 09:26:20 +0100
-
-ubuntu-snappy (1.7.3+20160308ubuntu1) xenial; urgency=medium
-
-    - snappy,snap: move icon under meta/gui/
-    - debian: add snap.8 manpage
-    - debian: move snapd to /usr/lib/snappy/snapd
-    - snap,snappy,systemd: remove TMPDIR, TEMPDIR, SNAP_APP_TMPDIR
-    - snappy,dirs: add support to use desktop files from inside snaps
-    - daemon: snapd API events endpoint redux
-    - interfaces/builtin: add "network" interface
-    - overlord/state: do small fixes (typo, id clashes paranoia)
-    - overlord: add first pass of the logic in StateEngine itself
-    - overlord/state: introduce Status/SetStatus on Change
-    - interfaces: support permanent security snippets
-    - overlord/state: introduce Status/SetStatus and
-      Progress/SetProgress on Task
-    - overlord/state: introduce Task and Change.NewTask
-    - many: selectively swap semantics of plugs and slots
-    - client,cmd/snap: remove useless indirection in Interfaces
-    - interfaces: maintain Plug and Slot connection details
-    - client,daemon,cmd/snap: change POST /2.0/interfaces to work with
-      lists
-    - overlord/state: introduce Change and NewChange on state to create
-      them
-    - snappy: bugfix for snap.yaml parsing to be more consistent with
-      the spec
-    - snappy,systemd: remove "ports" from snap.yaml
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 08 Mar 2016 11:24:09 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu4) xenial; urgency=medium
-
-  * rename:
-    debian/golang-snappy-dev.install ->
-       debian/golang-github-ubuntu-core-snappy-dev.install:
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 12:29:16 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu3) xenial; urgency=medium
-
-  * really fix typo in dependency name
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 12:21:39 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu2) xenial; urgency=medium
-
-  * fix typo in dependency name
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 12:05:36 +0100
-
-ubuntu-snappy (1.7.3+20160303ubuntu1) xenial; urgency=medium
-
-    - debian: update build-depends for MIR
-    - many: implement new REST API: GET /2.0/interfaces
-    - integration-tests: properly stop snapd from branch
-    - cmd/snap: update tests for go-flags changes
-    - overlord/state: implement Lock/Unlock with implicit checkpointing
-    - overlord: split out the managers and State to their own
-      subpackages of overlord
-    - snappy: rename "migration-skill" to "old-security" and use new
-      interface names instead of skills
-    - client,cmd/snap: clarify name ambiguity in Plug or Slot
-    - overlord: start working on state engine along spec v2, have the
-      main skeleton follow that
-    - classic, oauth: update tests for change in MakeRandomString()
-    - client,cmd/snap: s/add/install/:-(
-    - interfaces,daemon: specialize Name to either Plug or Slot
-    - interfaces,interfaces/types: unify security snippet functions
-    - snapd: close the listener on Stop, to force the http.Serve loop to
-      exit
-    - snappy,daemon,snap/lightweight,cmd/snappy,docs/rest.md: expose
-      explicit channel selection to rest api
-    - interfaces,daemon: rename package holding built-in interfaces
-    - integration-tests: add the first classic dimension tests
-    - client,deaemon,docs: rename skills to interfaces on the wire
-    - asserts: add identity assertion type
-    - integration-tests: add the no_proxy env var
-    - debian: update build-depends for new package names
-    - oauth: fix oauth & quoting in the oauth_signature
-    - integration-tests: remove unused field
-    - integration-tests: add the http proxy argument
-    - interfaces,interfaces/types,deamon: mass internal rename to
-      interfaces
-    - client,cmd/snap: rename skills to interfaces (part 2)
-    - arch: fix missing mapping for powerpc
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 03 Mar 2016 11:00:19 +0100
-
-ubuntu-snappy (1.7.3+20160225ubuntu1) xenial; urgency=medium
-
-    - integration-tests: always use the built snapd when compiling
-      binaries from branch
-    - cmd/snap: rename skills to interfaces
-    - testutil,skills/types,skills,daemon: tweak discovery of know skill
-      types
-    - docs: add docs for arm64 cross building
-    - overlord: implement basic ReadState/WriteState
-    - overlord: implement Get/Set/Copy on State
-    - integration-tests: fix dd output check
-    - integration-tests: add fromBranch config field
-    - integration-tests: use cli pkg methods in hwAssignSuite
-    - debian: do not create the snappypkg user, we don't need it anymore
-    - arch: fix build failure on s390x
-    - classic: cleanup downloaded lxd tarball
-    - cmd/snap,client,integration-tests: rename snap subcmds
-      'assert'=>'ack', 'asserts'=>'known'
-    - skills: fix broken tests builds
-    - skills,skills/types: pass slot to SlotSecuritySnippet()
-    - skills/types: teach bool-file about udev security
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 25 Feb 2016 16:17:19 +0100
-
-ubuntu-snappy (1.7.2+20160223ubuntu1) xenial; urgency=medium
-
-  * New git snapshot:
-    - asserts: introduce snap-declaration
-    - cmd/snap: fix integration tests for the "cmd_asserts"
-    - integration-tests: fix fanctl output check
-    - cmd/snap: fix test failure after merging 23a64e6
-    - cmd/snap: replace skip-help with empty description
-    - docs: update security.md to match current migration-skill
-      semantics
-    - snappy: treat commands with 'daemon' field as services
-    - asserts: use more consistent names for receivers in
-      snap_asserts*.go
-    - debian: add missing golang-websocket-dev build-dependency
-    - classic: if classic fails to get created, undo the bind mounts
-    - snappy: never return nil in NewLocalSnapRepository()
-    - notifications: A simple notification system
-    - snappy: when using staging, authenticate there instead
-    - integration-tests/snapd: fix the start of the test snapd socket
-    - skills/types: use CamelCase for security names
-    - skills: add support for implicit revoke
-    - skills: add security layer
-    - integration-tests: use exec.Command wrapper for updates
-    - cmd/snap: add 'snap skills'
-    - cms/snap: add 'snap revoke'
-    - docs: add docs for skills API
-    - cmd/snap: add 'snap grant'
-    - cmd/snappy, coreconfig, daemon, snappy: move config to always be
-      bytes (in and out)
-    - overlord: start with a skeleton and stubs for Overlord,
-      StateEngine, StateJournal and managers
-    - integration-tests: skip tests affected by LP: #1544507
-    - skills/types: add bool-file
-    - po: refresh translation templates
-    - cmd/snap: add 'snap experimental remove-skill-slot'
-    - asserts: introduce device assertion
-    - cmd/snap: implemented add, remove, purge, refresh, rollback,
-      activate, deactivate
-    - cmd/snap: add 'snap experimental add-skill-slot'
-    - cmd/snap: add 'snap experimental remove-skill'
-    - cmd/snap: add tests for common skills code
-    - cmd/snap: add 'snap experimental add-skill'
-    - asserts: make assertion checkers used by db.Check modular and
-      pluggable
-    - cmd,client,daemon,caps,docs,po: remove capabilities
-    - scripts: move the script to get dependencies to a separate file
-    - asserts: make the disk layout compatible for storing more than one
-      revision
-    - cmd/snap: make the assert command options exported
-    - integration-tests: Remove the target release and channel
-    - asserts: introduce model assertion
-    - integration-tests: add exec.Cmd wrapper
-    - cmd/snap: add client test support methods
-    - cmd/snap: move key=value attribute parsing to commmon
-    - cmd/snap: apply new style consistency to "snap" commands.
-    - cmd/snap: support redirecting the client for testing
-    - cmd/snap: support testing command output
-    - snappy,daemon: remove the meta repositories abstractions
-    - cmd: add support for experimental commands
-    - cmd/snappy,daemon,snap,snappy: remove SetActive from parts
-    - cmd/snappy,daemon,snappy,snap: remove config from parts interface
-    - client: improve test data
-    - cmd: allow to construct a fresh parser
-    - cmd: don't treat help as an error
-    - cmd/snappy,snappy: remove "Details" from the repository interface
-    - asserts: check that primary keys are set when
-      Decode()ing/assembling assertions
-    - snap,snappy: refactor to remove "Install" from the Part interface
-    - client,cmd: make client.New() configurable
-    - client: enable retrieving asynchronous operation information with
-      `Client.Operation`.
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 23 Feb 2016 11:28:18 +0100
-
-ubuntu-snappy (1.7.2+20160204ubuntu1) xenial; urgency=medium
-
-  * New git snapshot:
-    - integration-tests: fix the rollback error messages
-    - integration-test: use the common cli method when trying to install
-      an unexisting snap
-    - integration-tests: rename snap find test
-    - daemon: refactor makeErrorResponder()
-    - integration: add regression test for LP: #1541317
-    - integration-tests: reenable TestRollbackMustRebootToOtherVersion
-    - asserts: introduce "snap asserts" subcmd to show assertions in the
-      system db
-    - docs: fix parameter style
-    - daemon: use underscore in JSON interface
-    - client: add skills API
-    - asserts,docs/rest.md: change Encoder not to add extra newlines at
-      the end of the stream
-    - integration-tests: "snappy search" is no more, its "snap search"
-      now
-    - README, integration-tests/tests: chmod snapd.socket after manual
-      start.
-    - snappy: add default security profile if none is specified
-    - skills,daemon: add REST APIs for skills
-    - cmd/snap, cmd/snappy: move from `snappy search` to `snap find`.
-    - The first step towards REST world domination: search is now done
-      via
-    - debian: remove obsolete /etc/grub.d/09_snappy on upgrade
-    - skills: provide different security snippets for skill and slot
-      side
-    - osutil: make go vet happy again
-    - snappy,systemd: use Type field in systemd.ServiceDescription
-    - skills: add basic grant-revoke methods
-    - client,daemon,asserts: expose the ability to query assertions in
-      the system db
-    - skills: add basic methods for slot handling
-    - snappy,daemon,snap: move "Uninstall" into overlord
-    - snappy: move SnapFile.Install() into Overlord.Install()
-    - integration-tests: re-enable some failover tests
-    - client: remove snaps
-    - asserts: uniform searching across trusted (account keys) and main
-      backstore
-    - asserts: introduce Decoder to parse streams of assertions and
-      Encoder to build them
-    - client: filter snaps with a search query
-    - client: pass query as well as path in client internals
-    - skills: provide different security snippets for skill and slot
-      side
-    - snappy: refactor snapYaml to remove methods on snapYaml type
-    - snappy: remove unused variable from test
-    - skills: add basic methods for skill handing
-    - snappy: remove support for meta/package.yaml and implement new
-      meta/snap.yaml
-    - snappy: add new overlord type responsible for
-      Installed/Install/Uninstall/SetActive and stub it out
-    - skills: add basic methods for type handling
-    - daemon, snappy: add find (aka search)
-    - client: filter snaps by type
-    - skills: tweak valid names and error messages
-    - skills: add special skill type for testing
-    - cmd/snapd,daemon: filter snaps by type
-    - partition: remove obsolete uEnv.txt
-    - skills: add Type interface
-    - integration-tests: fix the bootloader path
-    - asserts: introduce a memory backed assertion backstore
-    - integration-tests: get name of OS snap from bootloader
-    - cmd/snapd,daemon: filter snaps by source
-    - asserts,daemon: bump some copyright years for things that have
-      been touched in the new year
-    - skills: add the initial Repository type
-    - skills: add a name validation function
-    - client: filter snaps by source
-    - snappy: unmount the squashfs snap again if it fails to install
-    - snap: make a copy of the search uri before mutating it
-      Closes: LP#1537005
-    - cmd/snap,client,daemon,asserts: introduce "assert " snap
-      subcommand
-    - cmd/snappy, snappy: fix failover handling of the "active"
-      kernel/os snap
-    - daemon, client, docs/rest.md, snapd integration tests: move to the
-      new error response
-    - asserts: change Backstore interface, backstores can now access
-      primary key names from types
-    - asserts: make AssertionType into a real struct exposing the
-      metadata Name and PrimaryKey
-    - caps: improve bool-file sanitization
-    - asserts: fixup toolbelt to use exposed key ID.
-    - client: return by reference rather than by value
-    - asserts: exported filesystem backstores + explicit backstores
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 04 Feb 2016 16:35:31 +0100
-
-ubuntu-snappy (1.7.2+20160113ubuntu1) xenial; urgency=medium
-
-  * New git snapshot
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 13 Jan 2016 11:25:40 +0100
-
-ubuntu-snappy (1.7.2ubuntu1) xenial; urgency=medium
-
-  * New upstream release:
-    - bin-path integration
-    - assertions/capability work
-    - fix squashfs based snap building
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 04 Dec 2015 08:46:35 +0100
-
-ubuntu-snappy (1.7.1ubuntu1) xenial; urgency=medium
-
-  * New upstream release:
-    - fix dependencies
-    - fix armhf builds
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 02 Dec 2015 07:46:07 +0100
-
-ubuntu-snappy (1.7ubuntu1) xenial; urgency=medium
-
-  * New upstream release:
-    - kernel/os snap support
-    - squashfs snap support
-    - initial capabilities work
-    - initial assertitions work
-    - rest API support
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 18 Nov 2015 19:59:51 +0100
-
-ubuntu-snappy (1.6ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Fix hwaccess for gpio (LP: #1493389, LP: #1488618)
-    - Fix handleAssets name normalization
-    - Run boot-ok job late (LP: #1476129)
-    - Add support for systemd socket files
-    - Add "snappy service" command
-    - Documentation improvements
-    - Many test improvements (unit and integration)
-    - Override sideload versions
-    - Go1.5 fixes
-    - Add i18n
-    - Add man-page
-    - Add .snapignore
-    - Run services that uses external ports only after the network is up
-    - Bufix in Synbootloader (LP: 1474125)
-    - Use uboot.env for boot state tracking
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 09 Sep 2015 14:20:22 +0200
-
-ubuntu-snappy (1.5ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Use O_TRUNC when copying files
-    - Added path redefinition to include test's binaries location
-    - Don't run update-grub, instead use grub.cfg from the oem
-      package
-    - Do network configuration from first boot
-    - zero size systemd of new partition made executable to
-      prevent unrecoverable boot failure
-    - Close downloaded files
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Mon, 06 Jul 2015 15:14:37 -0300
-
-ubuntu-snappy (1.4ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Allow to run the integration tests using snappy from branch
-    - Add CopyFileOverwrite flag and behaviour to helpers.CopyFile
-    - add a bunch of missing i18n.G() now that we have gettext
-    - Generate only the translators comments that start with
-      TRANSLATORS
-    - Try both clickpkg and snappypkg when dropping privs
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Thu, 02 Jul 2015 16:21:53 -0300
-
-ubuntu-snappy (1.3ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - gettext support
-    - use snappypkg user for the installed snaps
-    - switch to system-image-3.x as the system-image backend
-    - more reliable developer mode detection
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 01 Jul 2015 10:37:05 +0200
-
-ubuntu-snappy (1.2-0ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Consider the root directory when installing and removing policies
-    - In the uboot TestHandleAssetsNoHardwareYaml, patch the cache dir
-      before creating the partition type
-    - In the PartitionTestSuite, remove the unnecessary patches for
-      defaultCacheDir
-    - Fix the help output of "snappy install -h"
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Wed, 17 Jun 2015 11:42:47 -0300
-
-ubuntu-snappy (1.1.2-0ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Remove compatibility for click-bin-path in generated exec-wrappers
-    - Release the readme.md after parsing it
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Thu, 11 Jun 2015 23:42:49 -0300
-
-ubuntu-snappy (1.1.1-0ubuntu1) wily; urgency=medium
-
-  * New upstream release, including the following changes:
-    - Set all app services to restart on failure
-    - Fixes the missing oauth quoting and makes the code a bit nicer
-    - Added integrate() to set Integration to default values needed for
-      integration
-    - Moved setActivateClick to be a method of SnapPart
-    - Make unsetActiveClick a method of SnapPart
-    - Check the package.yaml for the required fields
-    - Integrate lp:snappy/selftest branch into snappy itself
-    - API to record information about the image and to check if the kernel was
-      sideloaded.
-    - Factor out update from cmd
-    - Continue updating when a sideload error is returned
-
- -- Ricardo Salveti de Araujo <ricardo.salveti@canonical.com>  Wed, 10 Jun 2015 15:54:12 -0300
-
-ubuntu-snappy (1.1-0ubuntu1) wily; urgency=low
-
-  * New wily upload with fix for go 1.4 syscall.Setgid() breakage
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 09 Jun 2015 10:02:04 +0200
-
-ubuntu-snappy (1.0.1-0ubuntu1) vivid; urgency=low
-
-  * fix symlink unpacking
-  * fix typo in apparmor rules generation
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 23 Apr 2015 16:09:56 +0200
-
-ubuntu-snappy (1.0-0ubuntu1) vivid; urgency=low
-
-  * 15.04 archive upload
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 23 Apr 2015 11:08:22 +0200
-
-ubuntu-snappy (0.1.2-0ubuntu1) vivid; urgency=medium
-
-  * initial ubuntu archive upload
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 13 Apr 2015 22:48:13 -0500
-
-ubuntu-snappy (0.1.1-0ubuntu1) vivid; urgency=low
-
-  * new snapshot
-
- -- Michael Vogt <michael.vogt@ubuntu.com>  Thu, 12 Feb 2015 13:51:22 +0100
-
-ubuntu-snappy (0.1-0ubuntu1) vivid; urgency=medium
-
-  * Initial packaging
-
- -- Sergio Schvezov <sergio.schvezov@canonical.com>  Fri, 06 Feb 2015 02:25:43 -0200
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/compat snapd-2.48.3+20.04/packaging/ubuntu-17.04/compat
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/compat	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/compat	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-9
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/control snapd-2.48.3+20.04/packaging/ubuntu-17.04/control
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/control	1970-01-01 00:00:00.000000000 +0000
@@ -1,128 +0,0 @@
-Source: snapd
-Section: devel
-Priority: optional
-Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
-Build-Depends: autoconf,
-               automake,
-               autotools-dev,
-               bash-completion,
-               debhelper (>= 9),
-               dbus,
-               dh-apparmor,
-               dh-autoreconf,
-               dh-golang (>=1.7),
-               dh-systemd,
-               fakeroot,
-               gcc-multilib [amd64],
-               gettext,
-               grub-common,
-               gnupg2,
-               golang-go (>=2:1.10)  [!powerpc] | golang-1.10 [!powerpc],
-               indent,
-               init-system-helpers,
-               libapparmor-dev,
-               libcap-dev,
-               libfuse-dev,
-               libglib2.0-dev,
-               liblzma-dev,
-               libseccomp-dev,
-               libudev-dev,
-               openssh-client,
-               pkg-config,
-               python3,
-               python3-docutils,
-               python3-markdown,
-               squashfs-tools,
-               tzdata,
-               udev,
-               xfslibs-dev
-Standards-Version: 3.9.7
-Homepage: https://github.com/snapcore/snapd
-Vcs-Browser: https://github.com/snapcore/snapd
-Vcs-Git: https://github.com/snapcore/snapd.git
-
-Package: golang-github-ubuntu-core-snappy-dev
-Architecture: all
-Depends: golang-github-snapcore-snapd-dev, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: golang-github-snapcore-snapd-dev
-Architecture: all
-Breaks: golang-github-ubuntu-core-snappy-dev (<< 2.0.6),
-        golang-snappy-dev (<< 1.7.3+20160303ubuntu4)
-Replaces: golang-github-ubuntu-core-snappy-dev (<< 2.0.6),
-          golang-snappy-dev (<< 1.7.3+20160303ubuntu4)
-Depends: ${misc:Depends}
-Description: snappy development go packages.
- Use these to use the snappy API.
-
-Package: snapd
-Architecture: any
-Depends: adduser,
-         apparmor (>= 2.10.95-0ubuntu2.2),
-         ca-certificates,
-         openssh-client,
-         squashfs-tools,
-         systemd,
-         udev,
-         ${misc:Depends},
-         ${shlibs:Depends}
-Replaces: ubuntu-snappy (<< 1.9), ubuntu-snappy-cli (<< 1.9), snap-confine (<< 2.23), ubuntu-core-launcher (<< 2.22), snapd-xdg-open (<= 0.0.0)
-Breaks: ubuntu-snappy (<< 1.9), ubuntu-snappy-cli (<< 1.9), snap-confine (<< 2.23), ubuntu-core-launcher (<< 2.22), snapd-xdg-open (<= 0.0.0), ${snapd:Breaks}
-Recommends: gnupg
-Suggests: zenity | kdialog
-Conflicts: snap (<< 2013-11-29-1ubuntu1)
-Built-Using: ${Built-Using} ${misc:Built-Using}
-Description: Daemon and tooling that enable snap packages
- Install, configure, refresh and remove snap packages. Snaps are
- 'universal' packages that work across many different Linux systems,
- enabling secure distribution of the latest apps and utilities for
- cloud, servers, desktops and the internet of things.
- .
- Start with 'snap list' to see installed snaps.
-
-Package: ubuntu-snappy
-Architecture: all
-Depends: snapd, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: ubuntu-snappy-cli
-Architecture: all
-Depends: snapd, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: ubuntu-core-snapd-units
-Architecture: all
-Depends: snapd, ${misc:Depends}
-Section: oldlibs
-Description: transitional dummy package
- This is a transitional dummy package. It can safely be removed.
-
-Package: snap-confine
-Architecture: any
-Section: oldlibs
-Depends: snapd (= ${binary:Version}), ${misc:Depends}
-Description: Transitional package for snapd
- This is a transitional dummy package. It can safely be removed.
-
-Package: ubuntu-core-launcher
-Architecture: any
-Depends: snapd (= ${binary:Version}), ${misc:Depends}
-Section: oldlibs
-Pre-Depends: dpkg (>= 1.15.7.2)
-Description: Transitional package for snapd
- This is a transitional dummy package. It can safely be removed.
-
-Package: snapd-xdg-open
-Architecture: any
-Depends: snapd (= ${binary:Version}), ${misc:Depends}
-Section: oldlibs
-Pre-Depends: dpkg (>= 1.15.7.2)
-Description: Transitional package for snapd-xdg-open
- This is a transitional dummy package. It can safely be removed.
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/copyright snapd-2.48.3+20.04/packaging/ubuntu-17.04/copyright
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/copyright	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/copyright	1970-01-01 00:00:00.000000000 +0000
@@ -1,22 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: snappy
-Source: https://github.com/snapcore/snapd
-
-Files: *
-Copyright: Copyright (C) 2014,2015 Canonical, Ltd.
-License: GPL-3
- This program is free software: you can redistribute it and/or modify it
- under the terms of the the GNU General Public License version 3, as
- published by the Free Software Foundation.
- .
- This program is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranties of
- MERCHANTABILITY, SATISFACTORY QUALITY or FITNESS FOR A PARTICULAR
- PURPOSE.  See the applicable version of the GNU Lesser General Public
- License for more details.
- .
- You should have received a copy of the GNU General Public License
- along with this program.  If not, see <http://www.gnu.org/licenses/>.
- .
- On Debian systems, the complete text of the GNU General Public License
- can be found in `/usr/share/common-licenses/GPL-3'
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/gbp.conf snapd-2.48.3+20.04/packaging/ubuntu-17.04/gbp.conf
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/gbp.conf	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/gbp.conf	1970-01-01 00:00:00.000000000 +0000
@@ -1,7 +0,0 @@
-[buildpackage]
-# use a build area relative to the git repository
-export-dir = ../build-area
-# disable the since the sources are being exported first
-cleaner =
-# post export script that gets the vendored dependencies
-postexport = ./get-deps.sh
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/golang-github-snapcore-snapd-dev.install snapd-2.48.3+20.04/packaging/ubuntu-17.04/golang-github-snapcore-snapd-dev.install
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/golang-github-snapcore-snapd-dev.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/golang-github-snapcore-snapd-dev.install	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-debian/tmp/usr/share/gocode/src/*
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/README.powerpc snapd-2.48.3+20.04/packaging/ubuntu-17.04/README.powerpc
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/README.powerpc	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/README.powerpc	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-Unfortunately snapd is not support on powerpc.
\ No newline at end of file
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/rules snapd-2.48.3+20.04/packaging/ubuntu-17.04/rules
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/rules	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/rules	1970-01-01 00:00:00.000000000 +0000
@@ -1,271 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-#
-# These rules should work for any debian-ish distro that uses systemd
-# as init.  That does _not_ include Ubuntu 14.04 ("trusty"); look for
-# its own special rule file.
-#
-# Please keep the diff between that and this relatively small, even if
-# it means having suboptimal code; these need to be kept in sync by
-# sentient bags of meat.
-
-#export DH_VERBOSE=1
-export DH_OPTIONS
-export DH_GOPKG := github.com/snapcore/snapd
-#export DEB_BUILD_OPTIONS=nocheck
-export DH_GOLANG_EXCLUDES=tests
-export DH_GOLANG_GO_GENERATE=1
-
-export PATH:=${PATH}:${CURDIR}
-# make sure that correct go version is found on trusty
-export PATH:=/usr/lib/go-1.10/bin:${PATH}
-
-include /etc/os-release
-
-# On 18.04 the released version of apt (1.6.1) has a bug that causes
-# problem on "apt purge snapd". To ensure this won't happen add the
-# right dependency on 18.04.
-ifeq (${VERSION_ID},"18.04")
-	SUBSTVARS = -Vsnapd:Breaks="systemd (<< 237-3ubuntu10.24), apt (<< 1.6.3)"
-endif
-# Same as above for 18.10 just a different version.
-ifeq (${VERSION_ID},"18.10")
-	SUBSTVARS = -Vsnapd:Breaks="apt (<< 1.7.0~alpha2)"
-endif
-
-# this is overridden in the ubuntu/14.04 release branch
-SYSTEMD_UNITS_DESTDIR="lib/systemd/system/"
-
-# The go tool does not fully support vendoring with gccgo, but we can
-# work around that by constructing the appropriate -I flag by hand.
-GCCGO := $(shell go tool dist env > /dev/null 2>&1 && echo no || echo yes)
-
-BUILDFLAGS:=-pkgdir=$(CURDIR)/_build/std
-# Disable -buildmode=pie mode on all our 32bit platforms
-# (i386 and armhf). For i386 because of LP: #1711052 and for
-# armhf because of LP: #1822738
-ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH_BITS),64)
- BUILDFLAGS+= -buildmode=pie
-endif
-
-GCCGOFLAGS=
-ifeq ($(GCCGO),yes)
-GOARCH := $(shell go env GOARCH)
-GOOS := $(shell go env GOOS)
-BUILDFLAGS:=
-GCCGOFLAGS=-gccgoflags="-I $(CURDIR)/_build/pkg/gccgo_$(GOOS)_$(GOARCH)/$(DH_GOPKG)/vendor"
-export DH_GOLANG_GO_GENERATE=0
-# workaround for https://github.com/golang/go/issues/23721
-export GOMAXPROCS=2
-endif
-
-# build with "tpm" support on ubuntu by default
-TAGS=
-# check if we need to include the testkeys in the binary
-ifneq (,$(filter testkeys,$(DEB_BUILD_OPTIONS)))
-	TAGS=-tags withtestkeys
-endif
-
-DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
-
-BUILT_USING_PACKAGES=
-# export DEB_BUILD_MAINT_OPTIONS = hardening=+all
-# DPKG_EXPORT_BUILDFLAGS = 1
-# include /usr/share/dpkg/buildflags.mk
-
-# Currently, we enable confinement for Ubuntu only, not for derivatives,
-# because derivatives may have different kernels that don't support all the
-# required confinement features and we don't to mislead anyone about the
-# security of the system.  Discuss a proper approach to this for downstreams
-# if and when they approach us.
-ifeq ($(shell dpkg-vendor --query Vendor),Ubuntu)
-    # On Ubuntu 16.04 we need to produce a build that can be used on wide
-    # variety of systems. As such we prefer static linking over dynamic linking
-    # for stability, predicability and easy of deployment. We need to link some
-    # things dynamically though: udev has no stable IPC protocol between
-    # libudev and udevd so we need to link with it dynamically.
-    VENDOR_ARGS=--enable-nvidia-multiarch --enable-static-libcap --enable-static-libapparmor --with-host-arch-triplet=$(DEB_HOST_MULTIARCH)
-ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH),amd64)
-		VENDOR_ARGS+= --with-host-arch-32bit-triplet=$(shell dpkg-architecture -f -ai386 -qDEB_HOST_MULTIARCH)
-endif
-    BUILT_USING_PACKAGES=libcap-dev libapparmor-dev libseccomp-dev
-else
-ifeq ($(shell dpkg-vendor --query Vendor),Debian)
-    BUILT_USING_PACKAGES=libcap-dev
-else
-    VENDOR_ARGS=--disable-apparmor
-endif
-endif
-BUILT_USING=$(shell dpkg-query -f '$${source:Package} (= $${source:Version}), ' -W $(BUILT_USING_PACKAGES))
-
-%:
-ifneq ($(shell dpkg-architecture -qDEB_HOST_ARCH),powerpc)
-	dh $@ --buildsystem=golang --with=golang --fail-missing --with systemd --builddirectory=_build
-else
-	# "powerpc" is not supported unfortunately, do nothing here
-	# See https://github.com/tianon/debian-runc/compare/70957b315f82170dc2ab7085d39c23835c0fa996...xenial for a more elaborate version of this idea.
-	# Note that snapd never really worked on powerpc (we never had a core
-	# snap there) so we don't need to show anything to the user
-	if [ "$@" = "clean" ]; then \
-		rm -rf debian/snapd; \
-	fi; \
-	if [ "$@" = "binary" ] || [ "$@" = "binary-arch" ]; then \
-		install -m755 -d debian/snapd/usr/share/doc/snapd/; \
-		cp debian/README.powerpc debian/snapd/usr/share/doc/snapd/; \
-		dh_installdeb; \
-		dh_gencontrol; \
-		dh_builddeb; \
-	fi;
-endif
-
-override_dh_fixperms:
-	dh_fixperms -Xusr/lib/snapd/snap-confine
-
-
-# The .real profile is a workaround for a bug in dpkg LP: #1673247 that causes
-# ubiquity to crash. It allows us to "move" the snap-confine profile from
-# snap-confine into snapd in a way that works with old dpkg that is in the live
-# CD image.
-#
-# Because both the usual and the .real profile describe the same binary the
-# .real profile takes priority (as it is loaded later).
-#
-# We need run dh_apparmor *before* dh_systemd_enable to ensure the postinst
-# snippets are added in the right order (first the new apparmor profile
-# is loaded, then we restart the service).
-override_dh_systemd_enable:
-	dh_apparmor --profile-name=usr.lib.snapd.snap-confine.real -psnapd
-	dh_systemd_enable
-
-override_dh_clean:
-ifneq (,$(TEST_GITHUB_AUTOPKGTEST))
-	# this will be set by the GITHUB webhook to trigger a autopkgtest
-	# we only need to run "govendor sync" here and then its ready
-	(export GOPATH="/tmp/go"; \
-	  mkdir -p /tmp/go/src/github.com/snapcore/; \
-          cp -ar . /tmp/go/src/github.com/snapcore/snapd; \
-	  go get -u github.com/kardianos/govendor; \
-	  (cd /tmp/go/src/github.com/snapcore/snapd ; /tmp/go/bin/govendor sync); \
-	  cp -ar /tmp/go/src/github.com/snapcore/snapd/vendor/ .; \
-        )
-endif
-	dh_clean
-	$(MAKE) -C data clean
-	# XXX: hacky
-	$(MAKE) -C cmd distclean || true
-	# XXX: hacky^2
-	(cd vendor/github.com/snapcore/squashfuse/src && rm -f snapfuse && make distclean || true )
-
-override_dh_auto_build:
-	# usually done via `go generate` but that is not supported on powerpc
-	./mkversion.sh
-	# Build golang bits
-	mkdir -p _build/src/$(DH_GOPKG)/cmd/snap/test-data
-	cp -a cmd/snap/test-data/*.gpg _build/src/$(DH_GOPKG)/cmd/snap/test-data/
-
-	# this is the main go build
-	SNAPD_VANILLA_GO=$$(which go) PATH="$$(pwd)/packaging/build-tools/:$$PATH" dh_auto_build -- $(BUILDFLAGS) $(TAGS) $(GCCGOFLAGS)
-
-	# Generate static snap-exec, snapctl and snap-update-ns - it somehow includes CGO so
-	# we must force a static build here. We need a static snap-{exec,update-ns}/snapctl
-	# inside the core snap because not all bases will have a libc
-	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build CGO_ENABLED=0 go build $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snap-exec)
-	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build CGO_ENABLED=0 go build $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snapctl)
-	(cd _build/bin && GOPATH=$$(pwd)/.. GOCACHE=/tmp/go-build go build --ldflags '-extldflags "-static"' $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snap-update-ns)
-
-	# ensure we generated a static build
-	$(shell	if ldd _build/bin/snap-exec; then false "need static build"; fi)
-	$(shell	if ldd _build/bin/snap-update-ns; then false "need static build"; fi)
-	$(shell	if ldd _build/bin/snapctl; then false "need static build"; fi)
-
-	# ensure snap-seccomp is build with a static libseccomp on Ubuntu
-ifeq ($(shell dpkg-vendor --query Vendor),Ubuntu)
-	sed -i "s|#cgo LDFLAGS:|#cgo LDFLAGS: /usr/lib/$(shell dpkg-architecture -qDEB_TARGET_MULTIARCH)/libseccomp.a|" _build/src/$(DH_GOPKG)/cmd/snap-seccomp/main.go
-	(cd _build/bin && GOPATH=$$(pwd)/..  GOCACHE=/tmp/go-build CGO_LDFLAGS_ALLOW="/.*/libseccomp.a" go build $(GCCGOFLAGS) $(DH_GOPKG)/cmd/snap-seccomp)
-	# ensure that libseccomp is not dynamically linked
-	ldd _build/bin/snap-seccomp
-	test "$$(ldd _build/bin/snap-seccomp | grep libseccomp)" = ""
-	# revert again so that the subsequent tests work
-	sed -i "s|#cgo LDFLAGS: /usr/lib/$(shell dpkg-architecture -qDEB_TARGET_MULTIARCH)/libseccomp.a|#cgo LDFLAGS:|" _build/src/$(DH_GOPKG)/cmd/snap-seccomp/main.go
-endif
-
-	# Build C bits, sadly manually
-	cd cmd && ( autoreconf -i -f )
-	cd cmd && ( ./configure --prefix=/usr --libexecdir=/usr/lib/snapd $(VENDOR_ARGS))
-	$(MAKE) -C cmd all
-
-	# Generate the real systemd/dbus/env config files
-	$(MAKE) -C data all
-
-	# build squashfuse and rename to snapfuse
-	(cd vendor/github.com/snapcore/squashfuse/src && mkdir -p autom4te.cache && ./autogen.sh --disable-demo && ./configure --disable-demo && make && mv squashfuse_ll snapfuse)
-
-override_dh_auto_test:
-	dh_auto_test -- $(BUILDFLAGS) -tags "$(TAGS)" $(GCCGOFLAGS)
-# a tested default (production) build should have no test keys
-ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
-	# check that only the main trusted account-keys are included
-	for b in _build/bin/snapd _build/bin/snap-bootstrap _build/bin/snap-preseed; do \
-	  [ $$(strings $$b |grep -c -E "public-key-sha3-384: [a-zA-Z0-9_-]{64}") -eq 2 ] && \
-	  strings $$b |grep -c "^public-key-sha3-384: -CvQKAwRQ5h3Ffn10FILJoEZUXOv6km9FwA80-Rcj-f-6jadQ89VRswHNiEB9Lxk$$" && \
-	  strings $$b |grep -c "^public-key-sha3-384: d-JcZF9nD9eBw7bwMnH61x-bklnQOhQud1Is6o_cn2wTj8EYDi9musrIT9z2MdAa$$"; \
-	done;
-	# same for snap-repair
-	[ $$(strings _build/bin/snap-repair|grep -c -E "public-key-sha3-384: [a-zA-Z0-9_-]{64}") -eq 3 ]
-	# common with snapd
-	strings _build/bin/snap-repair|grep -c "^public-key-sha3-384: -CvQKAwRQ5h3Ffn10FILJoEZUXOv6km9FwA80-Rcj-f-6jadQ89VRswHNiEB9Lxk$$"
-	strings _build/bin/snap-repair|grep -c "^public-key-sha3-384: d-JcZF9nD9eBw7bwMnH61x-bklnQOhQud1Is6o_cn2wTj8EYDi9musrIT9z2MdAa$$"
-	# repair-root
-	strings _build/bin/snap-repair|grep -c "^public-key-sha3-384: nttW6NfBXI_E-00u38W-KH6eiksfQNXuI7IiumoV49_zkbhM0sYTzSnFlwZC-W4t$$"
-endif
-ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
-	# run the snap-confine tests
-	$(MAKE) -C cmd check
-endif
-
-override_dh_install:
-	# we do not need this in the package, its just needed during build
-	rm -rf ${CURDIR}/debian/tmp/usr/bin/xgettext-go
-	# toolbelt is not shippable
-	rm -f ${CURDIR}/debian/tmp/usr/bin/toolbelt
-	# we do not like /usr/bin/snappy anymore
-	rm -f ${CURDIR}/debian/tmp/usr/bin/snappy
-	# i18n stuff
-	mkdir -p debian/snapd/usr/share
-	if [ -d share/locale ]; then \
-		cp -R share/locale debian/snapd/usr/share; \
-	fi
-	# chrorder generator
-	rm -f ${CURDIR}/debian/tmp/usr/bin/chrorder
-
-	# Install snapd's systemd units / upstart jobs, done
-	# here instead of debian/snapd.install because the
-	# ubuntu/14.04 release branch adds/changes bits here
-	$(MAKE) -C data install DESTDIR=$(CURDIR)/debian/snapd/ \
-		SYSTEMDSYSTEMUNITDIR=$(SYSTEMD_UNITS_DESTDIR)
-	# We called this apps-bin-path.sh instead of snapd.sh, and
-	# it's a conf file so we're stuck with it
-	mv debian/snapd/etc/profile.d/snapd.sh debian/snapd/etc/profile.d/apps-bin-path.sh
-
-	$(MAKE) -C cmd install DESTDIR=$(CURDIR)/debian/tmp
-
-	# Rename the apparmor profile, see dh_apparmor call above for an explanation.
-	mv $(CURDIR)/debian/tmp/etc/apparmor.d/usr.lib.snapd.snap-confine $(CURDIR)/debian/tmp/etc/apparmor.d/usr.lib.snapd.snap-confine.real
-
-	dh_install
-
-override_dh_auto_install: snap.8
-	dh_auto_install -O--buildsystem=golang
-
-snap.8:
-	# fix reproducible builds as reported by:
-	#   https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/snapd.html
-	# once golang-go-flags is fixed we can remove the "sed" expression
-	$(CURDIR)/_build/bin/snap help --man | sed '1 s/^.*/.TH snap 8 "$(shell date --reference=debian/changelog +"%d %B %Y")"/' > $@
-
-override_dh_auto_clean:
-	dh_auto_clean -O--buildsystem=golang
-	rm -vf snap.8
-
-override_dh_gencontrol:
-	dh_gencontrol -- -VBuilt-Using="$(BUILT_USING)" $(SUBSTVARS)
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snap-confine.maintscript snapd-2.48.3+20.04/packaging/ubuntu-17.04/snap-confine.maintscript
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snap-confine.maintscript	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snap-confine.maintscript	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-rm_conffile /etc/apparmor.d/usr.lib.snapd.snap-confine 2.23.6~
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.autoimport.udev snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.autoimport.udev
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.autoimport.udev	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.autoimport.udev	1970-01-01 00:00:00.000000000 +0000
@@ -1,3 +0,0 @@
-# probe for assertions, must run before udisks2
-ACTION=="add", SUBSYSTEM=="block" \
-    RUN+="/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/%k"
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.dirs snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.dirs
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.dirs	1970-01-01 00:00:00.000000000 +0000
@@ -1,17 +0,0 @@
-snap
-var/cache/snapd
-usr/lib/snapd
-var/lib/snapd/apparmor/snap-confine
-var/lib/snapd/desktop/applications
-var/lib/snapd/auto-import
-var/lib/snapd/desktop
-var/lib/snapd/environment
-var/lib/snapd/firstboot
-var/lib/snapd/lib/gl
-var/lib/snapd/lib/gl32
-var/lib/snapd/lib/glvnd
-var/lib/snapd/lib/vulkan
-var/lib/snapd/ssl/store-certs
-var/lib/snapd/snaps/partial
-var/lib/snapd/void
-var/snap
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.install snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.install
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.install	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.install	1970-01-01 00:00:00.000000000 +0000
@@ -1,52 +0,0 @@
-usr/bin/snap
-usr/bin/snapctl /usr/lib/snapd/
-usr/lib/snapd/system-shutdown
-usr/bin/snap-exec /usr/lib/snapd/
-usr/bin/snap-repair /usr/lib/snapd/
-usr/bin/snap-failure /usr/lib/snapd/
-usr/bin/snap-update-ns /usr/lib/snapd/
-usr/bin/snapd /usr/lib/snapd/
-usr/bin/snap-seccomp /usr/lib/snapd/
-usr/bin/snap-bootstrap /usr/lib/snapd/
-usr/bin/snap-preseed /usr/lib/snapd/
-usr/bin/snap-recovery-chooser /usr/lib/snapd/
-
-# bash completion
-data/completion/bash/snap /usr/share/bash-completion/completions
-data/completion/bash/complete.sh /usr/lib/snapd/
-data/completion/bash/etelpmoc.sh /usr/lib/snapd/
-# zsh completion
-data/completion/zsh/_snap /usr/share/zsh/vendor-completions
-# udev, must be installed before 80-udisks
-data/udev/rules.d/66-snapd-autoimport.rules /lib/udev/rules.d
-# snap/snapd version information
-data/info /usr/lib/snapd/
-# polkit actions
-data/polkit/io.snapcraft.snapd.policy /usr/share/polkit-1/actions/
-# apt hook
-data/apt/20snapd.conf /etc/apt/apt.conf.d/
-
-# snap-confine stuff
-etc/apparmor.d/usr.lib.snapd.snap-confine.real
-usr/lib/snapd/snap-device-helper
-usr/lib/snapd/snap-mgmt
-usr/lib/snapd/snap-confine
-usr/lib/snapd/snap-discard-ns
-usr/share/man/
-# for compatibility with ancient snap installs that wrote the shell based
-# wrapper scripts instead of the modern symlinks
-usr/bin/ubuntu-core-launcher
-
-# gdb helper
-usr/lib/snapd/snap-gdb-shim
-
-# install squashfuse as snapfuse to ensure it is available in e.g. lxd
-vendor/github.com/snapcore/squashfuse/src/snapfuse usr/bin
-
-# use "usr/lib" here because apparently systemd looks only there
-usr/lib/systemd/system-environment-generators
-# but system generators end up in lib
-lib/systemd/system-generators
-
-# service for loading apparmor profiles for snap applications
-usr/lib/snapd/snapd-apparmor
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.links snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.links
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.links	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.links	1970-01-01 00:00:00.000000000 +0000
@@ -1,6 +0,0 @@
-/usr/lib/snapd/snap-device-helper  /lib/udev/snappy-app-dev
-usr/lib/snapd/snapctl usr/bin/snapctl
-
-# This should be removed once we can rely on debhelper >= 11.5:
-#     https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=764678
-/usr/lib/systemd/user/snapd.session-agent.socket /usr/lib/systemd/user/sockets.target.wants/snapd.session-agent.socket
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.maintscript snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.maintscript
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.maintscript	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.maintscript	1970-01-01 00:00:00.000000000 +0000
@@ -1,5 +0,0 @@
-# keep mount point busy
-# we used to ship a custom grub config that is no longer needed
-rm_conffile /etc/grub.d/09_snappy 1.7.3ubuntu1
-rm_conffile /etc/ld.so.conf.d/snappy.conf 2.0.7~
-rm_conffile /etc/apparmor.d/usr.lib.snapd.snap-confine 2.23.6~
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.manpages snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.manpages
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.manpages	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.manpages	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-snap.8
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.postinst snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.postinst
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.postinst	2020-07-10 13:34:33.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.postinst	1970-01-01 00:00:00.000000000 +0000
@@ -1,75 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-case "$1" in
-    configure)
-        # ensure /var/lib/snapd/lib/gl is cleared
-        if dpkg --compare-versions "$2" lt-nl "2.0.7"; then
-            ldconfig
-        fi
-
-        # Ensure that we undo the damage done by the snap.mount unit that was present
-        # in snapd 2.31.
-        #
-        # We found that update scripts make systemd stop inactive mount units and this
-        # in turn stops all the units that depend on it so when the snap.mount unit is
-        # stopped all the per-snap mount units gets stopped along with them.  The 2.31
-        # release was only out briefly in xenial-proposed and bionic but to keep the
-        # affected users safe let's start all the per-snap mount units so that snaps no
-        # longer appear as broken after update.
-        if dpkg --compare-versions "$2" ge-nl "2.31" && \
-                dpkg --compare-versions "$2" lt-nl "2.32"; then
-            units=$(systemctl list-unit-files --full | grep '^snap[-.]' | cut -f1 -d ' ' | grep -vF snap.mount.service || true)
-            mounts=$(echo "$units" | grep '^snap[-.].*\.mount$' || true)
-            for unit in $mounts; do
-                # ensure its really a snap mount unit or systemd unit
-                if ! grep -q 'What=/var/lib/snapd/snaps/' "/etc/systemd/system/$unit" && ! grep -q 'X-Snappy=yes' "/etc/systemd/system/$unit"; then
-                    echo "Skipping non-snapd systemd unit $unit"
-                    continue
-                fi
-
-                echo "Starting $unit"
-                deb-systemd-invoke start "$unit" || true
-            done
-        fi
-
-        # In commit 0dce4704a5d (2017-03-28, snapd v2.23.6) we renamed
-        # /etc/apparmor.d/usr.lib.snap-confine to usr.lib.snap-confine.real
-        # to fix LP: #1673247 - however some people (developers?) still have
-        # the old usr.lib.snap-confine file. This seems to be loaded instead
-        # of the correct usr.lib.snap-confine.real profile. To fix this we
-        # use the rather blunt approach to rename the file forcefully.
-        if test -f /etc/apparmor.d/usr.lib.snapd.snap-confine && test -f /etc/apparmor.d/usr.lib.snapd.snap-confine.real; then
-            mv /etc/apparmor.d/usr.lib.snapd.snap-confine /etc/apparmor.d/usr.lib.snapd.snap-confine.dpkg-bak
-        fi
-
-        # Ensure that the void directory has correct permissions.
-        chmod 111 /var/lib/snapd/void
-
-        # Ubuntu 20.04 had a incorrect seed directory during development.
-        #
-        # This was causing hangs in the postinst when systemctl tries to
-        # start snapd.seeded.service which will wait for snapd to finish
-        # seeding (which will never happen because seeding is broken).
-        # See LP: 1868706
-        # This snippet detect this incorrect seed and disables it.
-        if [ -e /var/lib/snapd/seed/seed.yaml ] && [ "$(snap debug state --is-seeded /var/lib/snapd/state.json)" = "false" ]; then
-            if ! snap debug validate-seed /var/lib/snapd/seed/seed.yaml; then
-                echo "Found incorrect seed, disabling it"
-                mv /var/lib/snapd/seed /var/lib/snapd/seed.disabled
-            fi
-        fi
-
-        # ensure "snap userd" is restarted
-        if dpkg --compare-versions "$2" lt-nl "2.45.2"; then
-            pkill -f "snap userd" || true
-        fi
-esac
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.postrm snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.postrm
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.postrm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.postrm	1970-01-01 00:00:00.000000000 +0000
@@ -1,132 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-systemctl_stop() {
-    unit="$1"
-
-    echo "Stopping unit $unit"
-    systemctl stop -q "$unit" || true
-
-    for i in $(seq 20); do
-        echo "Waiting until unit $unit is stopped [attempt $i]"
-        if ! systemctl is-active -q "$unit"; then
-            echo "$unit is stopped."
-            return
-        fi
-        sleep .1
-    done
-}
-
-if [ "$1" = "purge" ]; then
-    # Undo any bind mounts to /snap and /var/snap that resulted from parallel
-    # installs for classic snaps or LP:#1668659 (for /snap only, that bug can't
-    # happen in trusty -- and doing this would mess up snap.mount.service there)
-    for mp in /snap /var/snap; do
-        if grep -q " $mp $mp" /proc/self/mountinfo; then
-            umount -l "$mp" || true
-        fi
-    done
-
-    units=$(systemctl list-unit-files --full | grep '^snap[-.]' | cut -f1 -d ' ' | grep -vF snap.mount.service || true)
-    mounts=$(echo "$units" | grep '^snap[-.].*\.mount$' || true)
-    services=$(echo "$units" | grep '^snap[-.].*\.service$' || true)
-
-    for unit in $services $mounts; do
-        # ensure its really a snap mount unit or systemd unit
-        if ! grep -q 'What=/var/lib/snapd/snaps/' "/etc/systemd/system/$unit" && ! grep -q 'X-Snappy=yes' "/etc/systemd/system/$unit"; then
-            echo "Skipping non-snapd systemd unit $unit"
-            continue
-        fi
-
-        echo "Stopping $unit"
-        systemctl_stop "$unit"
-
-        # if it is a mount unit, we can find the snap name in the mount
-        # unit (we just ignore unit files)
-        snap=$(grep 'Where=/snap/' "/etc/systemd/system/$unit"|cut -f3 -d/)
-        rev=$(grep 'Where=/snap/' "/etc/systemd/system/$unit"|cut -f4 -d/)
-        if [ -n "$snap" ]; then
-            echo "Removing snap $snap and revision $rev"
-            # aliases
-            if [ -d /snap/bin ]; then
-                find /snap/bin -maxdepth 1 -lname "$snap" -delete
-                find /snap/bin -maxdepth 1 -lname "$snap.*" -delete
-            fi
-            # generated binaries
-            rm -f "/snap/bin/$snap"
-            rm -f "/snap/bin/$snap".*
-            # snap mount dir
-            # we pass -d (clean up loopback devices) for trusty compatibility
-            umount -d -l "/snap/$snap/$rev" 2> /dev/null || true
-            rm -rf "/snap/$snap/$rev"
-            rm -f "/snap/$snap/current"
-            # snap data dir
-            rm -rf "/var/snap/$snap/$rev"
-            rm -rf "/var/snap/$snap/common"
-            rm -f "/var/snap/$snap/current"
-            # opportunistic remove (may fail if there are still revisions left
-            for d in "/snap/$snap" "/var/snap/$snap"; do
-                if [ -d "$d" ]; then
-                    rmdir --ignore-fail-on-non-empty "$d" || true
-                fi
-            done
-            # udev rules
-            find /etc/udev/rules.d -name "*-snap.${snap}.rules" -execdir rm -f "{}" \;
-            # dbus policy files
-            if [ -d /etc/dbus-1/system.d ]; then
-                find /etc/dbus-1/system.d -name "snap.${snap}.*.conf" -execdir rm -f "{}" \;
-            fi
-            # timer and socket units
-            find /etc/systemd/system -name "snap.${snap}.*.timer" -o -name "snap.${snap}.*.socket" | while read -r f; do
-                systemctl_stop "$(basename "$f")"
-                rm -f "$f"
-            done
-        fi
-
-        echo "Removing $unit"
-        rm -f "/etc/systemd/system/$unit"
-        rm -f "/etc/systemd/system/multi-user.target.wants/$unit"
-    done
-
-    # generated readme files
-    rm -f "/snap/README"
-
-    echo "Final directory cleanup"
-    for d in "/snap/bin" "/snap" "/var/snap"; do
-        # Force remove due to directories for old revisions could still exist
-        rm -rf "$d"
-        if [ -d "$d" ]; then
-            echo "Cannot remove directory $d"
-        fi
-    done
-
-    echo "Discarding preserved snap namespaces"
-    # opportunistic as those might not be actually mounted
-    if [ -d /run/snapd/ns ]; then
-        if [ "$(find /run/snapd/ns/ -name "*.mnt" | wc -l)" -gt 0 ]; then
-            for mnt in /run/snapd/ns/*.mnt; do
-                umount -l "$mnt" || true
-                rm -f "$mnt"
-            done
-        fi
-        find /run/snapd/ns/ \( -name '*.fstab' -o -name '*.user-fstab' -o -name '*.info' \) -delete
-        umount -l /run/snapd/ns/ || true
-    fi
-
-    echo "Removing extra snap-confine apparmor rules"
-    rm -f /etc/apparmor.d/snap.core.*.usr.lib.snapd.snap-confine
-
-    echo "Removing snapd cache"
-    rm -rf /var/cache/snapd/*
-
-    echo "Removing snapd state"
-    rm -rf /var/lib/snapd
-fi
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.preinst snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.preinst
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.preinst	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.preinst	1970-01-01 00:00:00.000000000 +0000
@@ -1,10 +0,0 @@
-#!/bin/sh
-
-set -e 
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.prerm snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.prerm
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/snapd.prerm	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/snapd.prerm	1970-01-01 00:00:00.000000000 +0000
@@ -1,42 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# "powerpc" is not supported unfortunately, do nothing here# 
-if [ "$DPKG_MAINTSCRIPT_ARCH" = powerpc ]; then
-    exit 0
-fi
-
-systemctl_stop() {
-    unit="$1"
-
-    echo "Stopping unit $unit"
-    systemctl stop -q "$unit" || true
-
-    for i in $(seq 20); do
-        echo "Waiting until unit $unit is stopped [attempt $i]"
-        if ! systemctl is-active -q "$unit"; then
-            echo "$unit is stopped."
-            return
-        fi
-        sleep .1
-    done
-}
-
-if [ "$1" = "remove" ]; then
-    units=$(systemctl list-unit-files --full | grep '^snap\.' | cut -f1 -d ' ' | grep -vF snap.mount.service || true)
-    tostop=$(echo "$units" | grep -E '^snap\..*\.(service|timer|socket)$' || true)
-
-    for unit in $tostop; do
-        # ensure it's really a snap mount unit or systemd unit
-        if  ! grep -q 'X-Snappy=yes' "/etc/systemd/system/$unit"; then
-            echo "Skipping non-snapd systemd unit $unit"
-            continue
-        fi
-
-        echo "Stopping $unit"
-        systemctl_stop "$unit"
-    done
-fi
-
-#DEBHELPER#
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/source/format snapd-2.48.3+20.04/packaging/ubuntu-17.04/source/format
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/source/format	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/source/format	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-3.0 (native)
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/source/options snapd-2.48.3+20.04/packaging/ubuntu-17.04/source/options
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/source/options	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/source/options	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-tar-ignore = "tests/lib/cache/*"
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/control snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/control
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/control	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/control	1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-Tests: integrationtests
-Restrictions: allow-stderr, rw-build-tree, needs-root, breaks-testbed, isolation-machine
-Depends: @builddeps@,
-         bzr,
-         ca-certificates,
-         git,
-         golang-golang-x-net-dev,
-         locales,
-         openssh-server,
-         netcat-openbsd,
-         net-tools,
-         snapd
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/integrationtests snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/integrationtests
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/integrationtests	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/integrationtests	1970-01-01 00:00:00.000000000 +0000
@@ -1,84 +0,0 @@
-#!/bin/sh
-
-set -ex
-
-# required for the debian adt host
-mkdir -p /etc/systemd/system/snapd.service.d/
-if [ "${http_proxy:-}" != "" ]; then
-    cat <<EOF | tee /etc/systemd/system/snapd.service.d/proxy.conf
-[Service]
-Environment=http_proxy=$http_proxy
-Environment=https_proxy=$http_proxy
-EOF
-
-    # ensure environment is updated
-    echo "http_proxy=$http_proxy" >> /etc/environment
-    echo "https_proxy=$http_proxy" >> /etc/environment
-fi
-systemctl daemon-reload
-
-# ensure we are not get killed too easily
-printf '%s\n' "-950" > /proc/$$/oom_score_adj
-
-# see what mem we have (for debugging)
-cat /proc/meminfo
-
-# ensure we can do a connect to localhost
-echo ubuntu:ubuntu|chpasswd
-sed -i 's/\(PermitRootLogin\|PasswordAuthentication\)\>.*/\1 yes/' /etc/ssh/sshd_config
-systemctl reload sshd.service
-
-# Map snapd deb package pockets to core snap channels. This is intended to cope
-# with the autopkgtest execution when testing packages from the different pockets
-if apt -qq list snapd | grep -q -- -proposed; then
-    export SPREAD_CORE_CHANNEL=candidate
-elif apt -qq list snapd | grep -q -- -updates; then
-    export SPREAD_CORE_CHANNEL=stable
-fi
-# ensure we always run from the deb that is currently tested
-export SNAP_REEXEC=0
-mkdir -p /etc/systemd/system/snapd.service.d
-cat <<EOF > /etc/systemd/system/snapd.service.d/no-reexec.conf
-[Service]
-Environment=SNAP_REEXEC=$SNAP_REEXEC
-EOF
-systemctl daemon-reload
-systemctl restart snapd
-
-# Spread will only buid with recent go
-snap install --classic go
-
-# and now run spread against localhost
-export GOPATH=/tmp/go
-/snap/bin/go get -u github.com/snapcore/spread/cmd/spread
-
-# the tests need this:
-groupadd --gid 12345 test
-adduser --uid 12345 --gid 12345 --disabled-password --gecos '' test
-
-# we build our own minimal spread.yaml
-cat > spread.yaml <<'EOF'
-project: snapd
-path: /home/gopath/src/github.com/snapcore/snapd
-environment:
-    PROJECT_PATH: /home/gopath/src/github.com/snapcore/snapd
-    TESTSLIB: $PROJECT_PATH/tests/lib
-    SNAPPY_TESTING: 1
-    PATH: $PATH:$PROJECT_PATH/tests/lib/bin
-backends:
-    autopkgtest:
-        type: adhoc
-        allocate: ADDRESS localhost:22
-        systems:
-        - adt-local:
-            username: ubuntu
-            password: ubuntu
-suites:
-        tests/smoke/:
-            summary: Essenial system level tests for snapd
-EOF
-/tmp/go/bin/spread -v autopkgtest:adt-local:tests/smoke/
-
-# store journal info for inspectsion
-journalctl --sync
-journalctl -ab > "$ADT_ARTIFACTS"/journal.txt
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/README.md snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/README.md
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/README.md	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/README.md	1970-01-01 00:00:00.000000000 +0000
@@ -1,10 +0,0 @@
-## Autopkgtest
-
-In order to run the autopkgtest suite locally you need first to generate an image:
-
-    $ adt-buildvm-ubuntu-cloud -a amd64 -r xenial -v
-
-This will create a `adt-xenial-amd64-cloud.img` file, then you can run the tests from
-the project's root with:
-
-    $ adt-run --unbuilt-tree . --- qemu ./adt-xenial-amd64-cloud.img
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/testconfig.json snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/testconfig.json
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/tests/testconfig.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/tests/testconfig.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,3 +0,0 @@
-{
-    "FromBranch": false
-}
diff -Nru snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/ubuntu-snappy-cli.dirs snapd-2.48.3+20.04/packaging/ubuntu-17.04/ubuntu-snappy-cli.dirs
--- snapd-2.45.1+20.04.2/packaging/ubuntu-17.04/ubuntu-snappy-cli.dirs	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/packaging/ubuntu-17.04/ubuntu-snappy-cli.dirs	1970-01-01 00:00:00.000000000 +0000
@@ -1,2 +0,0 @@
-usr/lib/snapd
-var/lib/snapd/snaps
diff -Nru snapd-2.45.1+20.04.2/progress/progress.go snapd-2.48.3+20.04/progress/progress.go
--- snapd-2.45.1+20.04.2/progress/progress.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/progress/progress.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,9 +22,10 @@
 import (
 	"fmt"
 	"os"
-	"strings"
 
 	"golang.org/x/crypto/ssh/terminal"
+
+	"github.com/snapcore/snapd/osutil"
 )
 
 // Meter is an interface to show progress to the user
@@ -82,7 +83,7 @@
 	}
 }
 
-var inTesting bool = len(os.Args) > 0 && strings.HasSuffix(os.Args[0], ".test") || os.Getenv("SPREAD_SYSTEM") != ""
+var inTesting bool = (osutil.IsTestBinary()) || os.Getenv("SPREAD_SYSTEM") != ""
 
 // MakeProgressBar creates an appropriate progress.Meter for the environ in
 // which it is called:
diff -Nru snapd-2.45.1+20.04.2/randutil/crypto.go snapd-2.48.3+20.04/randutil/crypto.go
--- snapd-2.45.1+20.04.2/randutil/crypto.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/randutil/crypto.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,6 +23,8 @@
 	cryptorand "crypto/rand"
 	"encoding/base64"
 	"fmt"
+	"io/ioutil"
+	"strings"
 )
 
 // CryptoTokenBytes returns a crypthographically secure token of
@@ -31,7 +33,7 @@
 	b := make([]byte, nbytes)
 	_, err := cryptorand.Read(b)
 	if err != nil {
-		return nil, fmt.Errorf("canot obtain %d crypto random bytes: %v", nbytes, err)
+		return nil, fmt.Errorf("cannot obtain %d crypto random bytes: %v", nbytes, err)
 	}
 	return b, nil
 }
@@ -46,3 +48,14 @@
 	}
 	return base64.RawURLEncoding.EncodeToString(b), nil
 }
+
+// RandomKernelUUID will return a UUID from the kernel's procfs API at
+// /proc/sys/kernel/random/uuid. Only to be used in very specific uses, most
+// random code should use CryptoToken(Bytes) instead.
+func RandomKernelUUID() string {
+	b, err := ioutil.ReadFile("/proc/sys/kernel/random/uuid")
+	if err != nil {
+		panic("cannot read kernel generated uuid")
+	}
+	return strings.TrimSpace(string(b))
+}
diff -Nru snapd-2.45.1+20.04.2/release/release.go snapd-2.48.3+20.04/release/release.go
--- snapd-2.45.1+20.04.2/release/release.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/release/release.go	2021-02-02 08:21:12.000000000 +0000
@@ -116,6 +116,15 @@
 	return false
 }
 
+// SystemctlSupportsUserUnits returns true if the systemctl utility
+// supports user units.
+func SystemctlSupportsUserUnits() bool {
+	// Ubuntu 14.04's systemctl does not support the arguments
+	// needed to enable user session units. Further more, it does
+	// not ship with a systemd user instance.
+	return !(ReleaseInfo.ID == "ubuntu" && ReleaseInfo.VersionID == "14.04")
+}
+
 // OnClassic states whether the process is running inside a
 // classic Ubuntu system or a native Ubuntu Core image.
 var OnClassic bool
diff -Nru snapd-2.45.1+20.04.2/release/release_test.go snapd-2.48.3+20.04/release/release_test.go
--- snapd-2.45.1+20.04.2/release/release_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/release/release_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -165,3 +165,27 @@
 
 	c.Check(release.IsWSL(), Equals, true)
 }
+
+func (s *ReleaseTestSuite) TestSystemctlSupportsUserUnits(c *C) {
+	for _, t := range []struct {
+		id, versionID string
+		supported     bool
+	}{
+		// Non-Ubuntu releases are assumed to be new enough
+		{"distro-id", "version", true},
+		// Ubuntu 14.04's systemd is too old for user units
+		{"ubuntu", "14.04", false},
+		// Other Ubuntu releases are fine
+		{"ubuntu", "16.04", true},
+		{"ubuntu", "18.04", true},
+		{"ubuntu", "20.04", true},
+	} {
+		reset := release.MockReleaseInfo(&release.OS{
+			ID:        t.id,
+			VersionID: t.versionID,
+		})
+		defer reset()
+
+		c.Check(release.SystemctlSupportsUserUnits(), Equals, t.supported)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/run-checks snapd-2.48.3+20.04/run-checks
--- snapd-2.45.1+20.04.2/run-checks	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/run-checks	2021-02-02 08:21:12.000000000 +0000
@@ -150,6 +150,8 @@
     echo Checking docs
     ./mdlint.py ./*.md docs/*.md
 
+    # XXX: remove once we can use an action, see workflows/test.yaml for
+    #      details why we still use this script
     if [ -n "${TRAVIS_PULL_REQUEST:-}" ] && [ "${TRAVIS_PULL_REQUEST:-}" != "false" ]; then
         echo Checking pull request summary
         ./check-pr-title.py "$TRAVIS_PULL_REQUEST"
@@ -168,6 +170,7 @@
         done
         if [ -n "$fmt" ]; then
             echo "Formatting wrong in following files:"
+            # shellcheck disable=SC2001
             echo "$fmt" | sed -e 's/\\n/\n/g'
             exit 1
         fi
@@ -214,7 +217,7 @@
                 find . \( -name .git -o -name vendor \) -prune -o -print0 ) |
             xargs -0 file -N |
             awk -F": " '$2~/shell.script/{print $1}' |
-            xargs shellcheck
+            xargs shellcheck -x
         regexp='GOPATH(?!%%:\*)(?!:)[^= ]*/'
         if  grep -qPr                   --exclude HACKING.md --exclude 'Makefile.*' --exclude-dir .git --exclude-dir vendor "$regexp"; then
             echo "Using GOPATH as if it were a single entry and not a list:"
@@ -223,25 +226,29 @@
             exit 1
         fi
         unset regexp
+        # also run spread-shellcheck
+        ./spread-shellcheck spread.yaml tests
     fi
 
     echo "Checking spelling errors"
     if ! command -v misspell >/dev/null; then
         go get -u github.com/client9/misspell/cmd/misspell
     fi
-    for file in *; do
-        if [ "$file" = "vendor" ] || [ "$file" = "po" ]; then
-            continue
+    # FIXME: auter is only misspelled in the changelog so we should fix there
+    # PROCES is used in the seccomp tests (PRIO_PROCES{,S,SS})
+    # exportfs is used in the nfs-support test
+    MISSPELL_IGNORE="auther,PROCES,PROCESSS,proces,processs,exportfs"
+    git ls-files -z -- . ':!:./po' ':!:./vendor' |
+        xargs -0 misspell -error -i "$MISSPELL_IGNORE"
+
+    if dpkg --compare-versions "$(go version | awk '$3 ~ /^go[0-9]/ {print substr($3, 3)}')" ge 1.12; then
+        echo "Checking for ineffective assignments"
+        if ! command -v ineffassign >/dev/null; then
+            go get -u github.com/gordonklaus/ineffassign
         fi
-        misspell -error -i auther,PROCES,PROCESSS,proces,processs,exportfs "$file"
-    done
-
-    echo "Checking for ineffective assignments"
-    if ! command -v ineffassign >/dev/null; then
-        go get -u github.com/gordonklaus/ineffassign
+        # ineffassign knows about ignoring vendor/ \o/
+        ineffassign ./...
     fi
-    # ineffassign knows about ignoring vendor/ \o/
-    ineffassign .
 
     echo "Checking for naked returns"
     if ! command -v nakedret >/dev/null; then
@@ -288,14 +295,21 @@
     command -v go
     go version
 
+    tags=
+    if [ -n "${GO_BUILD_TAGS-}" ]; then
+        echo "Using build tags: $GO_BUILD_TAGS"
+        tags="-tags $GO_BUILD_TAGS"
+    fi
+
     echo Building
-    go build -v github.com/snapcore/snapd/...
+    # shellcheck disable=SC2086
+    go build -v $tags github.com/snapcore/snapd/...
 
     # tests
     echo Running tests from "$PWD"
     if [ "$short" = 1 ]; then
-            # shellcheck disable=SC2046
-            GOTRACEBACK=1 $goctest -short -timeout 5m $(go list ./... | grep -v '/vendor/' )
+            # shellcheck disable=SC2046,SC2086
+            GOTRACEBACK=1 $goctest $tags -short -timeout 5m $(go list ./... | grep -v '/vendor/' )
     else
         # Prepare the coverage output profile.
         rm -rf .coverage
@@ -303,12 +317,14 @@
         echo "mode: $COVERMODE" > .coverage/coverage.out
 
         if dpkg --compare-versions "$(go version | awk '$3 ~ /^go[0-9]/ {print substr($3, 3)}')" ge 1.10; then
-            # shellcheck disable=SC2046
-            GOTRACEBACK=1 $goctest -timeout 5m -coverprofile=.coverage/coverage.out -covermode="$COVERMODE" $(go list ./... | grep -v '/vendor/' )
+            # shellcheck disable=SC2046,SC2086
+            GOTRACEBACK=1 $goctest $tags -timeout 5m -coverprofile=.coverage/coverage.out -covermode="$COVERMODE" $(go list ./... | grep -v '/vendor/' )
         else
             for pkg in $(go list ./... | grep -v '/vendor/' ); do
-                GOTRACEBACK=1 go test -timeout 5m -i "$pkg"
-                GOTRACEBACK=1 $goctest -timeout 5m -coverprofile=.coverage/profile.out -covermode="$COVERMODE" "$pkg"
+                # shellcheck disable=SC2086
+                GOTRACEBACK=1 go test $tags -timeout 5m -i "$pkg"
+                # shellcheck disable=SC2086
+                GOTRACEBACK=1 $goctest $tags -timeout 5m -coverprofile=.coverage/profile.out -covermode="$COVERMODE" "$pkg"
                 append_coverage .coverage/profile.out
             done
         fi
@@ -318,17 +334,17 @@
         fi
     fi
 
-    # python unit test for mountinfo-tool and version-tool
-    command -v python2 && python2 ./tests/lib/bin/mountinfo-tool --run-unit-tests
-    command -v python3 && python3 ./tests/lib/bin/mountinfo-tool --run-unit-tests
-    command -v python2 && python2 ./tests/lib/bin/version-tool --run-unit-tests
-    command -v python3 && python3 ./tests/lib/bin/version-tool --run-unit-tests
+    # python unit test for mountinfo.query and version-compare
+    command -v python2 && python2 ./tests/lib/tools/mountinfo.query --run-unit-tests
+    command -v python3 && python3 ./tests/lib/tools/mountinfo.query --run-unit-tests
+    command -v python2 && python2 ./tests/lib/tools/version-compare --run-unit-tests
+    command -v python3 && python3 ./tests/lib/tools/version-compare --run-unit-tests
 fi
 
 if [ -n "$SPREAD" ]; then
     if [ -n "${TRAVIS_PULL_REQUEST:-}" ] && [ "${TRAVIS_PULL_REQUEST:-}" != "false" ]; then
         echo "Checking whether PR author requested to skip spread"
-        if ./check-pr-skip-spread.py "$TRAVIS_PULL_REQUEST"; then
+        if ./check-pr-has-label.py "$TRAVIS_PULL_REQUEST" "LABEL_SKIP_SPREAD_JOB"; then
             echo "Skipping spread job on request"
             exit 0
         fi
@@ -363,6 +379,20 @@
             exit 1
     esac
 
+    if ./check-pr-has-label.py "$TRAVIS_PULL_REQUEST" "LABEL_RUN_SPREAD_NESTED"; then
+        case "$SPREAD" in
+            full)
+                spread "google-nested:tests/nested/"
+            ;;
+            ubuntu-only)
+                spread "google-nested:[u]...:tests/nested/"
+            ;;
+            *)
+                echo "Spread parameter $SPREAD not supported"
+                exit 1
+        esac
+    fi
+
     # cleanup the debian-ubuntu-14.04
     rm -rf debian-ubuntu-14.04
 fi
@@ -378,3 +408,13 @@
 EOF
     exit 1
 fi
+
+if [ -n "${SKIP_DIRTY_CHECK-}" ]; then
+    exit 0
+fi
+
+if git describe --always --dirty | grep -q dirty; then
+    echo "Build tree is dirty"
+    git diff
+    exit 1
+fi
diff -Nru snapd-2.45.1+20.04.2/sandbox/apparmor/process.go snapd-2.48.3+20.04/sandbox/apparmor/process.go
--- snapd-2.45.1+20.04.2/sandbox/apparmor/process.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/apparmor/process.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,10 +25,18 @@
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/snapcore/snapd/osutil"
 )
 
 func labelFromPid(pid int) (string, error) {
-	procFile := filepath.Join(rootPath, fmt.Sprintf("proc/%v/attr/current", pid))
+	// first check new kernel path, /proc/<pid>/attr/apparmor/current, falling
+	// back to the old path if that doesn't exist
+	procFile := filepath.Join(rootPath, fmt.Sprintf("proc/%v/attr/apparmor/current", pid))
+	if !osutil.FileExists(procFile) {
+		// fallback
+		procFile = filepath.Join(rootPath, fmt.Sprintf("proc/%v/attr/current", pid))
+	}
 	contents, err := ioutil.ReadFile(procFile)
 	if os.IsNotExist(err) {
 		return "unconfined", nil
diff -Nru snapd-2.45.1+20.04.2/sandbox/apparmor/process_test.go snapd-2.48.3+20.04/sandbox/apparmor/process_test.go
--- snapd-2.45.1+20.04.2/sandbox/apparmor/process_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/apparmor/process_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -57,6 +57,27 @@
 	c.Assert(err, ErrorMatches, `unknown snap related security label "snap.weird"`)
 }
 
+func (s *apparmorSuite) TestSnapAppFromPidNewKernelPath(c *C) {
+	d := c.MkDir()
+	restore := apparmor.MockFsRootPath(d)
+	defer restore()
+
+	// when the new file exists we use that one
+	newProcFile := filepath.Join(d, "proc/42/attr/apparmor/current")
+	c.Assert(os.MkdirAll(filepath.Dir(newProcFile), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(newProcFile, []byte("snap.foo.app"), 0644), IsNil)
+
+	oldProcFile := filepath.Join(d, "proc/42/attr/current")
+	c.Assert(os.MkdirAll(filepath.Dir(oldProcFile), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(oldProcFile, []byte("random-other-unread-data"), 0644), IsNil)
+
+	name, app, hook, err := apparmor.SnapAppFromPid(42)
+	c.Assert(err, IsNil)
+	c.Assert(name, Equals, "foo")
+	c.Assert(app, Equals, "app")
+	c.Assert(hook, Equals, "")
+}
+
 func (s *apparmorSuite) TestSnapAppFromPid(c *C) {
 	d := c.MkDir()
 	restore := apparmor.MockFsRootPath(d)
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/cgroup.go snapd-2.48.3+20.04/sandbox/cgroup/cgroup.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/cgroup.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/cgroup.go	2021-02-02 08:21:12.000000000 +0000
@@ -39,7 +39,7 @@
 	// The only cgroup path we expect, for v2 this is where the unified
 	// hierarchy is mounted, for v1 this is usually a tmpfs mount, under
 	// which the controller-hierarchies are mounted
-	expectedMountPoint = "/sys/fs/cgroup"
+	cgroupMountPoint = "/sys/fs/cgroup"
 )
 
 var (
@@ -82,14 +82,8 @@
 	return filepath.Join(rootPath, fmt.Sprintf("proc/%v/cgroup", pid))
 }
 
-// ControllerPathV1 returns the path to given controller assuming cgroup v1
-// hierarchy
-func ControllerPathV1(controller string) string {
-	return filepath.Join(rootPath, expectedMountPoint, controller)
-}
-
 func probeCgroupVersion() (version int, err error) {
-	cgroupMount := filepath.Join(rootPath, expectedMountPoint)
+	cgroupMount := filepath.Join(rootPath, cgroupMountPoint)
 	typ, err := fsTypeForPath(cgroupMount)
 	if err != nil {
 		return Unknown, fmt.Errorf("cannot determine filesystem type: %v", err)
@@ -208,49 +202,6 @@
 	return "", fmt.Errorf("cannot find %s cgroup path for pid %v", matcher, pid)
 }
 
-// PidsInGroup returns the list of process ID currently registered in a given cgroup
-func PidsInGroup(hierarchyMount, groupPath string) ([]int, error) {
-	// TODO: check whether hierarchyMount looks like a valid cgroup root
-	// (i.e. at cgroup.procs exists)
-	fname := filepath.Join(hierarchyMount, groupPath, "cgroup.procs")
-	file, err := os.Open(fname)
-	if os.IsNotExist(err) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer file.Close()
-	return parsePids(bufio.NewReader(file))
-}
-
-// parsePid parses a string as a process identifier.
-func parsePid(text string) (int, error) {
-	pid, err := strconv.Atoi(text)
-	if err != nil || (err == nil && pid <= 0) {
-		return 0, fmt.Errorf("cannot parse pid %q", text)
-	}
-	return pid, err
-}
-
-// parsePids parses a list of pids, one per line, from a reader.
-func parsePids(reader io.Reader) ([]int, error) {
-	scanner := bufio.NewScanner(reader)
-	var pids []int
-	for scanner.Scan() {
-		s := scanner.Text()
-		pid, err := parsePid(s)
-		if err != nil {
-			return nil, err
-		}
-		pids = append(pids, pid)
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, err
-	}
-	return pids, nil
-}
-
 // MockVersion sets the reported version of cgroup support. For use in testing only
 func MockVersion(mockVersion int, mockErr error) (restore func()) {
 	oldVersion, oldErr := probeVersion, probeErr
@@ -278,19 +229,6 @@
 	Path        string
 }
 
-var pathOfProcPidCgroup = func(pid int) string {
-	return fmt.Sprintf("/proc/%d/cgroup", pid)
-}
-
-// MockPathOfProcPidCgroup mocks the function used to compute /proc/PID/cgroup
-func MockPathOfProcPidCgroup(fn func(int) string) func() {
-	old := pathOfProcPidCgroup
-	pathOfProcPidCgroup = fn
-	return func() {
-		pathOfProcPidCgroup = old
-	}
-}
-
 // ProcessPathInTrackingCgroup returns the path in the hierarchy of the tracking cgroup.
 //
 // Tracking cgroup is whichever cgroup systemd uses for tracking processes.
@@ -300,12 +238,23 @@
 // This function fails on systems where systemd is not used and subsequently
 // cgroups are not mounted.
 func ProcessPathInTrackingCgroup(pid int) (string, error) {
-	fname := pathOfProcPidCgroup(pid)
+	fname := ProcPidPath(pid)
 	// Cgroup entries we're looking for look like this:
 	// 1:name=systemd:/user.slice/user-1000.slice/user@1000.service/tmux.slice/tmux@default.service
 	// 0::/user.slice/user-1000.slice/user@1000.service/tmux.slice/tmux@default.service
+
+	// It seems cgroupv2 can be "dangling" after being mounted and unmounted.
+	// It will forever stay present in the kernel but will not be present in
+	// the file-system. As such, allow v2 to register only if it is really
+	// mounted on the system.
+	var allowV2 bool
+	if ver, err := Version(); err != nil {
+		return "", err
+	} else if ver == V2 {
+		allowV2 = true
+	}
 	entry, err := scanProcCgroupFile(fname, func(e *procInfoEntry) bool {
-		if e.CgroupID == 0 {
+		if e.CgroupID == 0 && allowV2 {
 			return true
 		}
 		if len(e.Controllers) == 1 && e.Controllers[0] == "name=systemd" {
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/cgroup_test.go snapd-2.48.3+20.04/sandbox/cgroup/cgroup_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/cgroup_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/cgroup_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -126,11 +126,6 @@
 	c.Assert(cgroup.ProcPidPath(1234), Equals, filepath.Join(s.rootDir, "/proc/1234/cgroup"))
 }
 
-func (s *cgroupSuite) TestControllerPathV1(c *C) {
-	c.Assert(cgroup.ControllerPathV1("freezer"), Equals, filepath.Join(s.rootDir, "/sys/fs/cgroup/freezer"))
-	c.Assert(cgroup.ControllerPathV1("memory"), Equals, filepath.Join(s.rootDir, "/sys/fs/cgroup/memory"))
-}
-
 var mockCgroup = []byte(`
 10:devices:/user.slice
 9:cpuset:/
@@ -236,48 +231,6 @@
 	c.Check(group, Equals, "")
 }
 
-func (s *cgroupSuite) TestPidsHappy(c *C) {
-	err := os.MkdirAll(filepath.Join(s.rootDir, "group1/group2"), 0755)
-	c.Assert(err, IsNil)
-	g2Pids := []byte(`123
-234
-567
-`)
-	allPids := append(g2Pids, []byte(`999
-`)...)
-	err = ioutil.WriteFile(filepath.Join(s.rootDir, "group1/cgroup.procs"), allPids, 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(s.rootDir, "group1/group2/cgroup.procs"), g2Pids, 0755)
-	c.Assert(err, IsNil)
-
-	pids, err := cgroup.PidsInGroup(s.rootDir, "group1")
-	c.Assert(err, IsNil)
-	c.Assert(pids, DeepEquals, []int{123, 234, 567, 999})
-
-	pids, err = cgroup.PidsInGroup(s.rootDir, "group1/group2")
-	c.Assert(err, IsNil)
-	c.Assert(pids, DeepEquals, []int{123, 234, 567})
-
-	pids, err = cgroup.PidsInGroup(s.rootDir, "group.does.not.exist")
-	c.Assert(err, IsNil)
-	c.Assert(pids, IsNil)
-}
-
-func (s *cgroupSuite) TestPidsBadInput(c *C) {
-	err := os.MkdirAll(filepath.Join(s.rootDir, "group1"), 0755)
-	c.Assert(err, IsNil)
-	gPids := []byte(`123
-zebra
-567
-`)
-	err = ioutil.WriteFile(filepath.Join(s.rootDir, "group1/cgroup.procs"), gPids, 0755)
-	c.Assert(err, IsNil)
-
-	pids, err := cgroup.PidsInGroup(s.rootDir, "group1")
-	c.Assert(err, ErrorMatches, `cannot parse pid "zebra"`)
-	c.Assert(pids, IsNil)
-}
-
 func (s *cgroupSuite) TestProcessPathInTrackingCgroup(c *C) {
 	const noise = `12:cpuset:/
 11:rdma:/
@@ -293,13 +246,15 @@
 `
 
 	d := c.MkDir()
-	f := filepath.Join(d, "cgroup")
-	restore := cgroup.MockPathOfProcPidCgroup(func(pid int) string {
-		c.Assert(pid, Equals, 1234)
-		return f
-	})
+	restore := cgroup.MockFsRootPath(d)
 	defer restore()
 
+	restore = cgroup.MockVersion(cgroup.V2, nil)
+	defer restore()
+
+	f := filepath.Join(d, "proc", "1234", "cgroup")
+	c.Assert(os.MkdirAll(filepath.Dir(f), 0755), IsNil)
+
 	for _, scenario := range []struct{ cgroups, path, errMsg string }{
 		{cgroups: "", path: "", errMsg: "cannot find tracking cgroup"},
 		{cgroups: noise + "", path: "", errMsg: "cannot find tracking cgroup"},
@@ -319,5 +274,26 @@
 			c.Assert(path, Equals, scenario.path)
 		}
 	}
+}
 
+func (s *cgroupSuite) TestProcessPathInTrackingCgroupV2SpecialCase(c *C) {
+	const text = `0::/
+1:name=systemd:/user.slice/user-0.slice/session-1.scope
+`
+	d := c.MkDir()
+	restore := cgroup.MockFsRootPath(d)
+	defer restore()
+
+	restore = cgroup.MockVersion(cgroup.V1, nil)
+	defer restore()
+
+	f := filepath.Join(d, "proc", "1234", "cgroup")
+	c.Assert(os.MkdirAll(filepath.Dir(f), 0755), IsNil)
+
+	c.Assert(ioutil.WriteFile(f, []byte(text), 0644), IsNil)
+	path, err := cgroup.ProcessPathInTrackingCgroup(1234)
+	c.Assert(err, IsNil)
+	// Because v2 is not really mounted, we ignore the entry 0::/
+	// and return the v1 version instead.
+	c.Assert(path, Equals, "/user.slice/user-0.slice/session-1.scope")
 }
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/export_test.go snapd-2.48.3+20.04/sandbox/cgroup/export_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,12 +19,21 @@
 package cgroup
 
 import (
-	. "gopkg.in/check.v1"
+	"github.com/godbus/dbus"
 )
 
 var (
-	Cgroup2SuperMagic  = cgroup2SuperMagic
-	ProbeCgroupVersion = probeCgroupVersion
+	Cgroup2SuperMagic       = cgroup2SuperMagic
+	ProbeCgroupVersion      = probeCgroupVersion
+	ParsePid                = parsePid
+	DoCreateTransientScope  = doCreateTransientScope
+	SessionOrMaybeSystemBus = sessionOrMaybeSystemBus
+
+	ErrDBusUnknownMethod    = errDBusUnknownMethod
+	ErrDBusNameHasNoOwner   = errDBusNameHasNoOwner
+	ErrDBusSpawnChildExited = errDBusSpawnChildExited
+
+	SecurityTagFromCgroupPath = securityTagFromCgroupPath
 )
 
 func MockFsTypeForPath(mock func(string) (int64, error)) (restore func()) {
@@ -43,14 +52,48 @@
 	}
 }
 
-func MockFreezerCgroupDir(c *C) (restore func()) {
-	old := freezerCgroupDir
-	freezerCgroupDir = c.MkDir()
+func MockRandomUUID(uuid string) func() {
+	old := randomUUID
+	randomUUID = func() (string, error) {
+		return uuid, nil
+	}
+	return func() {
+		randomUUID = old
+	}
+}
+
+func MockOsGetuid(uid int) func() {
+	old := osGetuid
+	osGetuid = func() int {
+		return uid
+	}
+	return func() {
+		osGetuid = old
+	}
+}
+
+func MockOsGetpid(pid int) func() {
+	old := osGetpid
+	osGetpid = func() int {
+		return pid
+	}
 	return func() {
-		freezerCgroupDir = old
+		osGetpid = old
 	}
 }
 
-func FreezerCgroupDir() string {
-	return freezerCgroupDir
+func MockCgroupProcessPathInTrackingCgroup(fn func(pid int) (string, error)) func() {
+	old := cgroupProcessPathInTrackingCgroup
+	cgroupProcessPathInTrackingCgroup = fn
+	return func() {
+		cgroupProcessPathInTrackingCgroup = old
+	}
+}
+
+func MockDoCreateTransientScope(fn func(conn *dbus.Conn, unitName string, pid int) error) func() {
+	old := doCreateTransientScope
+	doCreateTransientScope = fn
+	return func() {
+		doCreateTransientScope = old
+	}
 }
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/freezer.go snapd-2.48.3+20.04/sandbox/cgroup/freezer.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/freezer.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/freezer.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,9 +26,19 @@
 	"os"
 	"path/filepath"
 	"time"
+
+	"github.com/snapcore/snapd/dirs"
 )
 
-var freezerCgroupDir = "/sys/fs/cgroup/freezer"
+const defaultFreezerCgroupDir = "/sys/fs/cgroup/freezer"
+
+var FreezerCgroupDir = defaultFreezerCgroupDir
+
+func init() {
+	dirs.AddRootDirCallback(func(root string) {
+		FreezerCgroupDir = filepath.Join(root, defaultFreezerCgroupDir)
+	})
+}
 
 // FreezeSnapProcessesImpl suspends execution of all the processes belonging to
 // a given snap. Processes remain frozen until ThawSnapProcesses is called,
@@ -51,7 +61,7 @@
 // Processes are frozen regardless of which particular snap application they
 // originate from.
 func freezeSnapProcessesImpl(snapName string) error {
-	fname := filepath.Join(freezerCgroupDir, fmt.Sprintf("snap.%s", snapName), "freezer.state")
+	fname := filepath.Join(FreezerCgroupDir, fmt.Sprintf("snap.%s", snapName), "freezer.state")
 	if err := ioutil.WriteFile(fname, []byte("FROZEN"), 0644); err != nil && os.IsNotExist(err) {
 		// When there's no freezer cgroup we don't have to freeze anything.
 		// This can happen when no process belonging to a given snap has been
@@ -78,7 +88,7 @@
 }
 
 func thawSnapProcessesImpl(snapName string) error {
-	fname := filepath.Join(freezerCgroupDir, fmt.Sprintf("snap.%s", snapName), "freezer.state")
+	fname := filepath.Join(FreezerCgroupDir, fmt.Sprintf("snap.%s", snapName), "freezer.state")
 	if err := ioutil.WriteFile(fname, []byte("THAWED"), 0644); err != nil && os.IsNotExist(err) {
 		// When there's no freezer cgroup we don't have to thaw anything.
 		// This can happen when no process belonging to a given snap has been
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/freezer_test.go snapd-2.48.3+20.04/sandbox/cgroup/freezer_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/freezer_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/freezer_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,7 @@
 
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/sandbox/cgroup"
 	"github.com/snapcore/snapd/testutil"
 )
@@ -35,12 +36,12 @@
 var _ = Suite(&freezerSuite{})
 
 func (s *freezerSuite) TestFreezeSnapProcesses(c *C) {
-	restore := cgroup.MockFreezerCgroupDir(c)
-	defer restore()
+	dirs.SetRootDir(c.MkDir())
+	defer dirs.SetRootDir("")
 
-	n := "foo"                                                               // snap name
-	p := filepath.Join(cgroup.FreezerCgroupDir(), fmt.Sprintf("snap.%s", n)) // snap freezer cgroup
-	f := filepath.Join(p, "freezer.state")                                   // freezer.state file of the cgroup
+	n := "foo"                                                             // snap name
+	p := filepath.Join(cgroup.FreezerCgroupDir, fmt.Sprintf("snap.%s", n)) // snap freezer cgroup
+	f := filepath.Join(p, "freezer.state")                                 // freezer.state file of the cgroup
 
 	// When the freezer cgroup filesystem doesn't exist we do nothing at all.
 	c.Assert(cgroup.FreezeSnapProcesses(n), IsNil)
@@ -49,7 +50,7 @@
 
 	// When the freezer cgroup filesystem exists but the particular cgroup
 	// doesn't exist we don nothing at all.
-	c.Assert(os.MkdirAll(cgroup.FreezerCgroupDir(), 0755), IsNil)
+	c.Assert(os.MkdirAll(cgroup.FreezerCgroupDir, 0755), IsNil)
 	c.Assert(cgroup.FreezeSnapProcesses(n), IsNil)
 	_, err = os.Stat(f)
 	c.Assert(os.IsNotExist(err), Equals, true)
@@ -63,12 +64,12 @@
 }
 
 func (s *freezerSuite) TestThawSnapProcesses(c *C) {
-	restore := cgroup.MockFreezerCgroupDir(c)
-	defer restore()
+	dirs.SetRootDir(c.MkDir())
+	defer dirs.SetRootDir("")
 
-	n := "foo"                                                               // snap name
-	p := filepath.Join(cgroup.FreezerCgroupDir(), fmt.Sprintf("snap.%s", n)) // snap freezer cgroup
-	f := filepath.Join(p, "freezer.state")                                   // freezer.state file of the cgroup
+	n := "foo"                                                             // snap name
+	p := filepath.Join(cgroup.FreezerCgroupDir, fmt.Sprintf("snap.%s", n)) // snap freezer cgroup
+	f := filepath.Join(p, "freezer.state")                                 // freezer.state file of the cgroup
 
 	// When the freezer cgroup filesystem doesn't exist we do nothing at all.
 	c.Assert(cgroup.ThawSnapProcesses(n), IsNil)
@@ -77,7 +78,7 @@
 
 	// When the freezer cgroup filesystem exists but the particular cgroup
 	// doesn't exist we don nothing at all.
-	c.Assert(os.MkdirAll(cgroup.FreezerCgroupDir(), 0755), IsNil)
+	c.Assert(os.MkdirAll(cgroup.FreezerCgroupDir, 0755), IsNil)
 	c.Assert(cgroup.ThawSnapProcesses(n), IsNil)
 	_, err = os.Stat(f)
 	c.Assert(os.IsNotExist(err), Equals, true)
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/pids.go snapd-2.48.3+20.04/sandbox/cgroup/pids.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/pids.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/pids.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,68 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package cgroup
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+)
+
+// pidsInFile returns the list of process IDs in a given file.
+func pidsInFile(fname string) ([]int, error) {
+	file, err := os.Open(fname)
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	return parsePids(bufio.NewReader(file))
+}
+
+// parsePids parses a list of pids, one per line, from a reader.
+func parsePids(reader io.Reader) ([]int, error) {
+	scanner := bufio.NewScanner(reader)
+	var pids []int
+	for scanner.Scan() {
+		s := scanner.Text()
+		pid, err := parsePid(s)
+		if err != nil {
+			return nil, err
+		}
+		pids = append(pids, pid)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+	return pids, nil
+}
+
+// parsePid parses a string as a process identifier.
+func parsePid(text string) (int, error) {
+	pid, err := strconv.Atoi(text)
+	if err != nil || (err == nil && pid <= 0) {
+		return 0, fmt.Errorf("cannot parse pid %q", text)
+	}
+	return pid, err
+}
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/pids_test.go snapd-2.48.3+20.04/sandbox/cgroup/pids_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/pids_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/pids_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,47 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+package cgroup_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/sandbox/cgroup"
+)
+
+type pidsSuite struct{}
+
+var _ = Suite(&pidsSuite{})
+
+func (s *pidsSuite) TestParsePid(c *C) {
+	pid, err := cgroup.ParsePid("10")
+	c.Assert(err, IsNil)
+	c.Check(pid, Equals, 10)
+	_, err = cgroup.ParsePid("")
+	c.Assert(err, ErrorMatches, `cannot parse pid ""`)
+	_, err = cgroup.ParsePid("-1")
+	c.Assert(err, ErrorMatches, `cannot parse pid "-1"`)
+	_, err = cgroup.ParsePid("foo")
+	c.Assert(err, ErrorMatches, `cannot parse pid "foo"`)
+	_, err = cgroup.ParsePid("12\x0034")
+	c.Assert(err.Error(), Equals, "cannot parse pid \"12\\x0034\"")
+	_, err = cgroup.ParsePid("ł")
+	c.Assert(err, ErrorMatches, `cannot parse pid "ł"`)
+	_, err = cgroup.ParsePid("1000000000000000000000000000000000000000000000")
+	c.Assert(err, ErrorMatches, `cannot parse pid "1000000000000000000000000000000000000000000000"`)
+}
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/process.go snapd-2.48.3+20.04/sandbox/cgroup/process.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/process.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/process.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,26 +25,44 @@
 	"strings"
 )
 
-func SnapNameFromPid(pid int) (string, error) {
+func snapNameFromPidUsingTrackingCgroup(pid int) (string, error) {
+	// Maybe we have application tracking and can use it?
+	path, err := ProcessPathInTrackingCgroup(pid)
+	if err != nil {
+		return "", err
+	}
+	if parsedTag := securityTagFromCgroupPath(path); parsedTag != nil {
+		return parsedTag.InstanceName(), nil
+	}
+	return "", fmt.Errorf("cannot find snap security tag")
+}
+
+func snapNameFromPidUsingFreezerCgroup(pid int) (string, error) {
+	// This logic only makes sense with cgroup v1.
 	if IsUnified() {
-		// not supported
 		return "", fmt.Errorf("not supported")
 	}
 
+	// Find the path in the freezer cgroup.
 	group, err := ProcGroup(pid, MatchV1Controller("freezer"))
 	if err != nil {
 		return "", fmt.Errorf("cannot determine cgroup path of pid %v: %v", pid, err)
 	}
-
 	if !strings.HasPrefix(group, "/snap.") {
 		return "", fmt.Errorf("cannot find a snap for pid %v", pid)
 	}
 
+	// Extract the snap name form the path.
 	snapName := strings.SplitN(filepath.Base(group), ".", 2)[1]
-
 	if snapName == "" {
 		return "", fmt.Errorf("snap name in cgroup path is empty")
 	}
-
 	return snapName, nil
 }
+
+func SnapNameFromPid(pid int) (string, error) {
+	if snapName, err := snapNameFromPidUsingTrackingCgroup(pid); err == nil {
+		return snapName, nil
+	}
+	return snapNameFromPidUsingFreezerCgroup(pid)
+}
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/process_test.go snapd-2.48.3+20.04/sandbox/cgroup/process_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/process_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/process_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -29,44 +29,47 @@
 	"github.com/snapcore/snapd/sandbox/cgroup"
 )
 
-func (s *cgroupSuite) TestSnapNameFromPidHappy(c *C) {
-	err := os.MkdirAll(filepath.Join(s.rootDir, "proc/333"), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(s.rootDir, "proc/333/cgroup"), mockCgroup, 0755)
-	c.Assert(err, IsNil)
+func (s *cgroupSuite) mockPidCgroup(c *C, text string) int {
+	f := filepath.Join(s.rootDir, "proc/333/cgroup")
+	c.Assert(os.MkdirAll(filepath.Dir(f), 0755), IsNil)
+	c.Assert(ioutil.WriteFile(f, []byte(text), 0755), IsNil)
+	return 333
+}
 
-	name, err := cgroup.SnapNameFromPid(333)
+func (s *cgroupSuite) TestSnapNameFromPidHappy(c *C) {
+	pid := s.mockPidCgroup(c, string(mockCgroup)) // defined in cgroup_test.go
+	name, err := cgroup.SnapNameFromPid(pid)
 	c.Assert(err, IsNil)
 	c.Check(name, Equals, "hello-world")
 }
 
 func (s *cgroupSuite) TestSnapNameFromPidUnhappy(c *C) {
-	err := os.MkdirAll(filepath.Join(s.rootDir, "proc/333"), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(s.rootDir, "proc/333/cgroup"), []byte("1:freezer:/\n"), 0755)
-	c.Assert(err, IsNil)
-
-	name, err := cgroup.SnapNameFromPid(333)
-	c.Assert(err, ErrorMatches, "cannot find a snap for pid 333")
+	pid := s.mockPidCgroup(c, "1:freezer:/\n")
+	name, err := cgroup.SnapNameFromPid(pid)
+	c.Assert(err, ErrorMatches, "cannot find a snap for pid .*")
 	c.Check(name, Equals, "")
 }
 
 func (s *cgroupSuite) TestSnapNameFromPidEmptyName(c *C) {
-	err := os.MkdirAll(filepath.Join(s.rootDir, "proc/333"), 0755)
-	c.Assert(err, IsNil)
-	err = ioutil.WriteFile(filepath.Join(s.rootDir, "proc/333/cgroup"), []byte("1:freezer:/snap./\n"), 0755)
-	c.Assert(err, IsNil)
-
-	name, err := cgroup.SnapNameFromPid(333)
+	pid := s.mockPidCgroup(c, "1:freezer:/snap./\n")
+	name, err := cgroup.SnapNameFromPid(pid)
 	c.Assert(err, ErrorMatches, "snap name in cgroup path is empty")
 	c.Check(name, Equals, "")
 }
 
-func (s *cgroupSuite) TestSnapNameFromPidCgroupV2(c *C) {
+func (s *cgroupSuite) TestSnapNameFromPidTracking(c *C) {
+	pid := s.mockPidCgroup(c, "1:name=systemd:/user.slice/user-1000.slice/user@1000.service/apps.slice/snap.foo.bar.00000-1111-3333.service\n")
+	name, err := cgroup.SnapNameFromPid(pid)
+	c.Assert(err, IsNil)
+	c.Check(name, Equals, "foo")
+}
+
+func (s *cgroupSuite) TestSnapNameFromPidWithoutSources(c *C) {
 	restore := cgroup.MockVersion(cgroup.V2, nil)
 	defer restore()
 
-	name, err := cgroup.SnapNameFromPid(333)
+	pid := s.mockPidCgroup(c, "")
+	name, err := cgroup.SnapNameFromPid(pid)
 	c.Assert(err, ErrorMatches, "not supported")
 	c.Check(name, Equals, "")
 }
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/scanning.go snapd-2.48.3+20.04/sandbox/cgroup/scanning.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/scanning.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/scanning.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,162 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package cgroup
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/snapcore/snapd/snap/naming"
+)
+
+var (
+	// string that looks like a hook security tag
+	roughHookTagPattern = regexp.MustCompile(`snap\.[^.]+\.hook\.[^.]+`)
+	// string that looks like an app security tag
+	roughAppTagPattern = regexp.MustCompile(`snap\.[^.]+\.[^.]+`)
+)
+
+// securityTagFromCgroupPath returns a security tag from cgroup path.
+func securityTagFromCgroupPath(path string) naming.SecurityTag {
+	leaf := filepath.Base(filepath.Clean(path))
+
+	// If the security cgroup name doesn't start with "snap." then there is no
+	// point in doing other checks.
+	if !strings.HasPrefix(leaf, "snap.") {
+		return nil
+	}
+
+	// We are only interested in cgroup directory names that correspond to
+	// services and scopes, as they contain processes that have been invoked
+	// from a snap.
+	// Expected format of leaf name:
+	//   snap.<pkg>.<app>.service - assigned by systemd for services
+	//   snap.<pkg>.<app>.<uuid>.scope - transient scope for apps
+	//   snap.<pkg>.hook.<app>.<uuid>.scope - transient scope for hooks
+	if ext := filepath.Ext(leaf); ext != ".service" && ext != ".scope" {
+		return nil
+	}
+
+	// There are two broad forms expressed by the pair of regular expressions defined above.
+	for _, re := range []*regexp.Regexp{roughHookTagPattern, roughAppTagPattern} {
+		if maybeTag := re.FindString(leaf); maybeTag != "" {
+			if tag, err := naming.ParseSecurityTag(maybeTag); err == nil {
+				return tag
+			}
+		}
+	}
+	return nil
+}
+
+// PidsOfSnap returns the association of security tags to PIDs.
+//
+// NOTE: This function returns a reliable result only if the refresh-app-awareness
+// feature was enabled since all processes related to the given snap were started.
+// If the feature wasn't always enabled then only service process are correctly
+// accounted for.
+//
+// The return value is a snapshot of the pids for a given snap, grouped by
+// security tag. The result may be immediately stale as processes fork and
+// exit.
+//
+// Importantly, if the per-snap lock is held while computing the set, then the
+// following guarantee is true: if a security tag is not among the results then
+// no such tag can come into existence while the lock is held.
+//
+// This can be used to classify the activity of a given snap into activity
+// classes, based on the nature of the security tags encountered.
+func PidsOfSnap(snapInstanceName string) (map[string][]int, error) {
+	// pidsByTag maps security tag to a list of pids.
+	pidsByTag := make(map[string][]int)
+
+	// Walk the cgroup tree and look for "cgroup.procs" files. Having found one
+	// we try to derive the snap security tag from it. If successful and the
+	// tag matches the snap we are interested in, we harvest the snapshot of
+	// PIDs that belong to the cgroup and put them into a bucket associated
+	// with the security tag.
+	walkFunc := func(path string, fileInfo os.FileInfo, err error) error {
+		if err != nil {
+			// See the documentation of path/filepath.Walk. The error we get is
+			// the error that was encountered while walking. We just surface
+			// that error quickly.
+			return err
+		}
+		if fileInfo.IsDir() {
+			// We don't care about directories.
+			return nil
+		}
+		if filepath.Base(path) != "cgroup.procs" {
+			// We are looking for "cgroup.procs" files. Those contain the set
+			// of processes that momentarily inhabit a cgroup.
+			return nil
+		}
+		// Now that we are confident that the file we're looking at is
+		// interesting, extract the security tag from the cgroup path and check
+		// if the security tag belongs to the snap we are interested in. Since
+		// not all cgroups are related to snaps it is not an error if the
+		// cgroup path does not denote a snap.
+		cgroupPath := filepath.Dir(path)
+		parsedTag := securityTagFromCgroupPath(cgroupPath)
+		if parsedTag == nil {
+			return nil
+		}
+		if parsedTag.InstanceName() != snapInstanceName {
+			return nil
+		}
+		pids, err := pidsInFile(path)
+		if err != nil {
+			return err
+		}
+		tag := parsedTag.String()
+		pidsByTag[tag] = append(pidsByTag[tag], pids...)
+		// Since we've found the file we are looking for (cgroup.procs) we no
+		// longer need to scan the remaining files of this directory.
+		return filepath.SkipDir
+	}
+
+	var cgroupPathToScan string
+	ver, err := Version()
+	if err != nil {
+		return nil, err
+	}
+	if ver == V2 {
+		// In v2 mode scan all of /sys/fs/cgroup as there is no specialization
+		// anymore (each directory represents a hierarchy with equal
+		// capabilities and old split into controllers is gone).
+		cgroupPathToScan = filepath.Join(rootPath, cgroupMountPoint)
+	} else {
+		// In v1 mode scan just /sys/fs/cgroup/systemd as that is sufficient
+		// for finding snap-specific cgroup names. Systemd uses this for
+		// tracking and scopes and services are represented there.
+		cgroupPathToScan = filepath.Join(rootPath, cgroupMountPoint, "systemd")
+	}
+	// NOTE: Walk is internally performed in lexical order so the output is
+	// deterministic and we don't need to sort the returned aggregated PIDs.
+	if err := filepath.Walk(cgroupPathToScan, walkFunc); err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	return pidsByTag, nil
+}
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/scanning_test.go snapd-2.48.3+20.04/sandbox/cgroup/scanning_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/scanning_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/scanning_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,224 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+package cgroup_test
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/sandbox/cgroup"
+	"github.com/snapcore/snapd/snap/naming"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type scanningSuite struct {
+	testutil.BaseTest
+	rootDir string
+}
+
+var _ = Suite(&scanningSuite{})
+
+func (s *scanningSuite) SetUpTest(c *C) {
+	s.BaseTest.SetUpTest(c)
+
+	s.rootDir = c.MkDir()
+	s.AddCleanup(cgroup.MockFsRootPath(s.rootDir))
+}
+
+func mustParseTag(tag string) naming.SecurityTag {
+	parsedTag, err := naming.ParseSecurityTag(tag)
+	if err != nil {
+		panic(err)
+	}
+	return parsedTag
+}
+
+func (s *scanningSuite) TestSecurityTagFromCgroupPath(c *C) {
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.foo.foo.service"), DeepEquals, mustParseTag("snap.foo.foo"))
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.foo.bar.service"), DeepEquals, mustParseTag("snap.foo.bar"))
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.foo.bar.$RANDOM.scope"), DeepEquals, mustParseTag("snap.foo.bar"))
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.foo.hook.bar.$RANDOM.scope"), DeepEquals, mustParseTag("snap.foo.hook.bar"))
+	// We are not confused by snapd things.
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.service"), IsNil)
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snapd.service"), IsNil)
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.foo.mount"), IsNil)
+	// Real data looks like this.
+	c.Check(cgroup.SecurityTagFromCgroupPath("snap.test-snapd-refresh.sh.d854bd35-2457-4ac8-b494-06061d74df33.scope"), DeepEquals, mustParseTag("snap.test-snapd-refresh.sh"))
+	c.Check(cgroup.SecurityTagFromCgroupPath("snap.test-snapd-refresh.hook.configure.d854bd35-2457-4ac8-b494-06061d74df33.scope"), DeepEquals, mustParseTag("snap.test-snapd-refresh.hook.configure"))
+	// Trailing slashes are automatically handled.
+	c.Check(cgroup.SecurityTagFromCgroupPath("/a/b/snap.foo.foo.service/"), DeepEquals, mustParseTag("snap.foo.foo"))
+}
+
+func (s *scanningSuite) writePids(c *C, dir string, pids []int) {
+	var buf bytes.Buffer
+	for _, pid := range pids {
+		fmt.Fprintf(&buf, "%d\n", pid)
+	}
+
+	var path string
+	ver, err := cgroup.Version()
+	c.Assert(err, IsNil)
+	c.Assert(ver == cgroup.V1 || ver == cgroup.V2, Equals, true)
+	switch ver {
+	case cgroup.V1:
+		path = filepath.Join(s.rootDir, "/sys/fs/cgroup/systemd", dir)
+	case cgroup.V2:
+		path = filepath.Join(s.rootDir, "/sys/fs/cgroup", dir)
+	}
+
+	c.Assert(os.MkdirAll(path, 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(path, "cgroup.procs"), buf.Bytes(), 0644), IsNil)
+}
+
+func (s *scanningSuite) TestPidsOfSnapEmpty(c *C) {
+	restore := cgroup.MockVersion(cgroup.V1, nil)
+	defer restore()
+
+	// Not having any cgroup directories is not an error.
+	pids, err := cgroup.PidsOfSnap("pkg")
+	c.Assert(err, IsNil)
+	c.Check(pids, HasLen, 0)
+}
+
+func (s *scanningSuite) TestPidsOfSnapUnrelatedStuff(c *C) {
+	for _, ver := range []int{cgroup.V2, cgroup.V1} {
+		comment := Commentf("cgroup version %v", ver)
+		restore := cgroup.MockVersion(ver, nil)
+		defer restore()
+
+		// Things that are not related to the snap are not being picked up.
+		s.writePids(c, "udisks2.service", []int{100})
+		s.writePids(c, "snap..service", []int{101})
+		s.writePids(c, "snap..scope", []int{102})
+		s.writePids(c, "snap.*.service", []int{103})
+		s.writePids(c, "snap.*.scope", []int{104})
+		s.writePids(c, "snapd.service", []int{105})
+		s.writePids(c, "snap-spotify-35.mount", []int{106})
+
+		pids, err := cgroup.PidsOfSnap("pkg")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, HasLen, 0, comment)
+	}
+}
+
+func (s *scanningSuite) TestPidsOfSnapSecurityTags(c *C) {
+	for _, ver := range []int{cgroup.V2, cgroup.V1} {
+		comment := Commentf("cgroup version %v", ver)
+		restore := cgroup.MockVersion(ver, nil)
+		defer restore()
+
+		// Pids are collected and assigned to bins by security tag
+		s.writePids(c, "system.slice/snap.pkg.hook.configure.$RANDOM.scope", []int{1})
+		s.writePids(c, "system.slice/snap.pkg.daemon.service", []int{2})
+
+		pids, err := cgroup.PidsOfSnap("pkg")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, DeepEquals, map[string][]int{
+			"snap.pkg.hook.configure": {1},
+			"snap.pkg.daemon":         {2},
+		}, comment)
+	}
+}
+
+func (s *scanningSuite) TestPidsOfInstances(c *C) {
+	for _, ver := range []int{cgroup.V2, cgroup.V1} {
+		comment := Commentf("cgroup version %v", ver)
+		restore := cgroup.MockVersion(ver, nil)
+		defer restore()
+
+		// Instances are not confused between themselves and between the non-instance version.
+		s.writePids(c, "system.slice/snap.pkg_prod.daemon.service", []int{1})
+		s.writePids(c, "system.slice/snap.pkg_devel.daemon.service", []int{2})
+		s.writePids(c, "system.slice/snap.pkg.daemon.service", []int{3})
+
+		// The main one
+		pids, err := cgroup.PidsOfSnap("pkg")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, DeepEquals, map[string][]int{
+			"snap.pkg.daemon": {3},
+		}, comment)
+
+		// The development one
+		pids, err = cgroup.PidsOfSnap("pkg_devel")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, DeepEquals, map[string][]int{
+			"snap.pkg_devel.daemon": {2},
+		}, comment)
+
+		// The production one
+		pids, err = cgroup.PidsOfSnap("pkg_prod")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, DeepEquals, map[string][]int{
+			"snap.pkg_prod.daemon": {1},
+		}, comment)
+	}
+}
+
+func (s *scanningSuite) TestPidsOfAggregation(c *C) {
+	for _, ver := range []int{cgroup.V2, cgroup.V1} {
+		comment := Commentf("cgroup version %v", ver)
+		restore := cgroup.MockVersion(ver, nil)
+		defer restore()
+
+		// A single snap may be invoked by multiple users in different sessions.
+		// All of their PIDs are collected though.
+		s.writePids(c, "user.slice/user-1000.slice/user@1000.service/gnome-shell-wayland.service/snap.pkg.app.$RANDOM1.scope", []int{1}) // mock 1st invocation
+		s.writePids(c, "user.slice/user-1000.slice/user@1000.service/gnome-shell-wayland.service/snap.pkg.app.$RANDOM2.scope", []int{2}) // mock fork() by pid 1
+		s.writePids(c, "user.slice/user-1001.slice/user@1001.service/gnome-shell-wayland.service/snap.pkg.app.$RANDOM3.scope", []int{3}) // mock 2nd invocation
+		s.writePids(c, "user.slice/user-1001.slice/user@1001.service/gnome-shell-wayland.service/snap.pkg.app.$RANDOM4.scope", []int{4}) // mock fork() by pid 3
+
+		pids, err := cgroup.PidsOfSnap("pkg")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, DeepEquals, map[string][]int{
+			"snap.pkg.app": {1, 2, 3, 4},
+		}, comment)
+	}
+}
+
+func (s *scanningSuite) TestPidsOfSnapUnrelated(c *C) {
+	for _, ver := range []int{cgroup.V2, cgroup.V1} {
+		comment := Commentf("cgroup version %v", ver)
+		restore := cgroup.MockVersion(ver, nil)
+		defer restore()
+
+		// We are not confusing snaps with other snaps, instances of our snap, and
+		// with non-snap hierarchies.
+		s.writePids(c, "user.slice/.../snap.pkg.app.$RANDOM1.scope", []int{1})
+		s.writePids(c, "user.slice/.../snap.other.snap.$RANDOM2.scope", []int{2})
+		s.writePids(c, "user.slice/.../pkg.service", []int{3})
+		s.writePids(c, "user.slice/.../snap.pkg_instance.app.$RANDOM3.scope", []int{4})
+
+		// Write a file which is not cgroup.procs with the number 666 inside.
+		// We want to ensure this is not read by accident.
+		f := filepath.Join(s.rootDir, "/sys/fs/cgroup/unrelated.txt")
+		c.Assert(os.MkdirAll(filepath.Dir(f), 0755), IsNil)
+		c.Assert(ioutil.WriteFile(f, []byte("666"), 0644), IsNil)
+
+		pids, err := cgroup.PidsOfSnap("pkg")
+		c.Assert(err, IsNil, comment)
+		c.Check(pids, DeepEquals, map[string][]int{
+			"snap.pkg.app": {1},
+		}, comment)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/tracking.go snapd-2.48.3+20.04/sandbox/cgroup/tracking.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/tracking.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/tracking.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,319 @@
+package cgroup
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/godbus/dbus"
+
+	"github.com/snapcore/snapd/dbusutil"
+	"github.com/snapcore/snapd/features"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/randutil"
+)
+
+var osGetuid = os.Getuid
+var osGetpid = os.Getpid
+var cgroupProcessPathInTrackingCgroup = ProcessPathInTrackingCgroup
+
+var ErrCannotTrackProcess = errors.New("cannot track application process")
+
+// TrackingOptions control how tracking, based on systemd transient scope, operates.
+type TrackingOptions struct {
+	// AllowSessionBus controls if CreateTransientScopeForTracking will
+	// consider using the session bus for making the request.
+	AllowSessionBus bool
+}
+
+// CreateTransientScopeForTracking puts the current process in a transient scope.
+//
+// To quote systemd documentation about scope units:
+//
+// >> Scopes units manage a set of system processes. Unlike service units,
+// >> scope units manage externally created processes, and do not fork off
+// >> processes on its own.
+//
+// Scope names must be unique, a randomly generated UUID is appended to the
+// security tag, further suffixed with the string ".scope".
+func CreateTransientScopeForTracking(securityTag string, opts *TrackingOptions) error {
+	if !features.RefreshAppAwareness.IsEnabled() {
+		return nil
+	}
+	if opts == nil {
+		// Retain original semantics when not explicitly configured otherwise.
+		opts = &TrackingOptions{AllowSessionBus: true}
+	}
+	logger.Debugf("creating transient scope %s", securityTag)
+
+	// Session or system bus might be unavailable. To avoid being fragile
+	// ignore all errors when establishing session bus connection to avoid
+	// breaking user interactions. This is consistent with similar failure
+	// modes below, where other parts of the stack fail.
+	//
+	// Ideally we would check for a distinct error type but this is just an
+	// errors.New() in go-dbus code.
+	uid := osGetuid()
+	// Depending on options, we may use the session bus instead of the system
+	// bus. In addition, when uid == 0 we may fall back from using the session
+	// bus to the system bus.
+	var isSessionBus bool
+	var conn *dbus.Conn
+	var err error
+	if opts.AllowSessionBus {
+		isSessionBus, conn, err = sessionOrMaybeSystemBus(uid)
+		if err != nil {
+			return ErrCannotTrackProcess
+		}
+	} else {
+		isSessionBus = false
+		conn, err = dbusutil.SystemBus()
+		if err != nil {
+			return ErrCannotTrackProcess
+		}
+	}
+
+	// We ask the kernel for a random UUID. We need one because each transient
+	// scope needs a unique name. The unique name is composed of said UUID and
+	// the snap security tag.
+	uuid, err := randomUUID()
+	if err != nil {
+		return err
+	}
+
+	// Enforcing uniqueness is preferred to reusing an existing scope for
+	// simplicity since doing otherwise by joining an existing scope has
+	// limitations:
+	// - the originally started scope must be marked as a delegate, with all
+	//   consequences.
+	// - the method AttachProcessesToUnit is unavailable on Ubuntu 16.04
+	unitName := fmt.Sprintf("%s.%s.scope", securityTag, uuid)
+
+	pid := osGetpid()
+tryAgain:
+	// Create a transient scope by talking to systemd over DBus.
+	if err := doCreateTransientScope(conn, unitName, pid); err != nil {
+		switch err {
+		case errDBusUnknownMethod:
+			return ErrCannotTrackProcess
+		case errDBusSpawnChildExited:
+			fallthrough
+		case errDBusNameHasNoOwner:
+			if isSessionBus && uid == 0 {
+				// We cannot activate systemd --user for root,
+				// try the system bus as a fallback.
+				logger.Debugf("cannot activate systemd --user on session bus, falling back to system bus: %s", err)
+				isSessionBus = false
+				conn, err = dbusutil.SystemBus()
+				if err != nil {
+					logger.Debugf("system bus is not available: %s", err)
+					return ErrCannotTrackProcess
+				}
+				logger.Debugf("using system bus now, session bus could not activate systemd --user")
+				goto tryAgain
+			}
+			return ErrCannotTrackProcess
+		}
+		return err
+	}
+	// We may have created a transient scope but due to the constraints the
+	// kernel puts on process transitions on unprivileged users (and remember
+	// that systemd --user is unprivileged) the actual re-association with the
+	// scope cgroup may have silently failed - unfortunately some versions of
+	// systemd do not report an error in that case. Systemd 238 and newer
+	// detects the error correctly and uses privileged systemd running as pid 1
+	// to assist in the transition.
+	//
+	// For more details about the transition constraints refer to
+	// cgroup_procs_write_permission() as of linux 5.8 and
+	// unit_attach_pids_to_cgroup() as of systemd 245.
+	//
+	// Verify the effective tracking cgroup and check that our scope name is
+	// contained therein.
+	path, err := cgroupProcessPathInTrackingCgroup(pid)
+	if err != nil {
+		return err
+	}
+	if !strings.HasSuffix(path, unitName) {
+		logger.Debugf("systemd could not associate process %d with transient scope %s", pid, unitName)
+		return ErrCannotTrackProcess
+	}
+	return nil
+}
+
+// ConfirmSystemdServiceTracking checks if systemd tracks this process as a snap service.
+//
+// Systemd is placing started services, both user and system, into appropriate
+// tracking groups. Given a security tag we can confirm if the current process
+// belongs to such tracking group and thus could be identified by snapd as
+// belonging to a particular snap and application.
+//
+// If the application process is not tracked then ErrCannotTrackProcess is returned.
+func ConfirmSystemdServiceTracking(securityTag string) error {
+	pid := osGetpid()
+	path, err := cgroupProcessPathInTrackingCgroup(pid)
+	if err != nil {
+		return err
+	}
+	unitName := fmt.Sprintf("%s.service", securityTag)
+	if !strings.Contains(path, unitName) {
+		return ErrCannotTrackProcess
+	}
+	return nil
+}
+
+func sessionOrMaybeSystemBus(uid int) (isSessionBus bool, conn *dbus.Conn, err error) {
+	// The scope is created with a DBus call to systemd running either on
+	// system or session bus. We have a preference for session bus, as this is
+	// where applications normally go to. When a session bus is not available
+	// and the invoking user is root, we use the system bus instead.
+	//
+	// It is worth noting that hooks will not normally have a session bus to
+	// connect to, as they are invoked as descendants of snapd, and snapd is a
+	// service running outside of any session.
+	conn, err = dbusutil.SessionBus()
+	if err == nil {
+		logger.Debugf("using session bus")
+		return true, conn, nil
+	}
+	logger.Debugf("session bus is not available: %s", err)
+	if uid == 0 {
+		logger.Debugf("falling back to system bus")
+		conn, err = dbusutil.SystemBus()
+		if err != nil {
+			logger.Debugf("system bus is not available: %s", err)
+		} else {
+			logger.Debugf("using system bus now, session bus was not available")
+		}
+	}
+	return false, conn, err
+}
+
+type handledDBusError struct {
+	msg       string
+	dbusError string
+}
+
+func (e *handledDBusError) Error() string {
+	return fmt.Sprintf("%s [%s]", e.msg, e.dbusError)
+}
+
+var (
+	errDBusUnknownMethod    = &handledDBusError{msg: "unknown dbus object method", dbusError: "org.freedesktop.DBus.Error.UnknownMethod"}
+	errDBusNameHasNoOwner   = &handledDBusError{msg: "dbus name has no owner", dbusError: "org.freedesktop.DBus.Error.NameHasNoOwner"}
+	errDBusSpawnChildExited = &handledDBusError{msg: "dbus spawned child process exited", dbusError: "org.freedesktop.DBus.Error.Spawn.ChildExited"}
+)
+
+// doCreateTransientScope creates a systemd transient scope with specified properties.
+//
+// The scope is created by asking systemd via the specified DBus connection.
+// The unit name and the PID to attach are provided as well. The DBus method
+// call is performed outside confinement established by snap-confine.
+var doCreateTransientScope = func(conn *dbus.Conn, unitName string, pid int) error {
+	// Documentation of StartTransientUnit is available at
+	// https://www.freedesktop.org/wiki/Software/systemd/dbus/
+	//
+	// The property and auxUnit types are not well documented but can be traced
+	// from systemd source code. As of systemd 245 it can be found in src/core/dbus-manager.c,
+	// in a declaration containing SD_BUS_METHOD_WITH_NAMES("SD_BUS_METHOD_WITH_NAMES",...
+	// From there one can follow to method_start_transient_unit to understand
+	// how argument parsing is performed.
+	//
+	// Systemd defines the signature of StartTransientUnit as
+	// "ssa(sv)a(sa(sv))". The signature can be decomposed as follows:
+	//
+	// unitName string // name of the unit to start
+	// jobMode string  // corresponds to --job-mode= (see systemctl(1) manual page)
+	// properties []struct{
+	//   Name string
+	//   Value interface{}
+	// } // properties describe properties of the started unit
+	// auxUnits []struct {
+	//   Name string
+	//   Properties []struct{
+	//   	Name string
+	//   	Value interface{}
+	//	 }
+	// } // auxUnits describe any additional units to define.
+	type property struct {
+		Name  string
+		Value interface{}
+	}
+	type auxUnit struct {
+		Name  string
+		Props []property
+	}
+
+	// The mode string decides how the job is interacting with other systemd
+	// jobs on the system. The documentation of the systemd StartUnit() method
+	// describes the possible values and their properties:
+	//
+	// >> StartUnit() enqeues a start job, and possibly depending jobs. Takes
+	// >> the unit to activate, plus a mode string. The mode needs to be one of
+	// >> replace, fail, isolate, ignore-dependencies, ignore-requirements. If
+	// >> "replace" the call will start the unit and its dependencies, possibly
+	// >> replacing already queued jobs that conflict with this. If "fail" the
+	// >> call will start the unit and its dependencies, but will fail if this
+	// >> would change an already queued job. If "isolate" the call will start
+	// >> the unit in question and terminate all units that aren't dependencies
+	// >> of it. If "ignore-dependencies" it will start a unit but ignore all
+	// >> its dependencies. If "ignore-requirements" it will start a unit but
+	// >> only ignore the requirement dependencies. It is not recommended to
+	// >> make use of the latter two options. Returns the newly created job
+	// >> object.
+	//
+	// Here we choose "fail" to match systemd-run.
+	mode := "fail"
+	properties := []property{{"PIDs", []uint{uint(pid)}}}
+	aux := []auxUnit(nil)
+	systemd := conn.Object("org.freedesktop.systemd1", "/org/freedesktop/systemd1")
+	call := systemd.Call(
+		"org.freedesktop.systemd1.Manager.StartTransientUnit",
+		0,
+		unitName,
+		mode,
+		properties,
+		aux,
+	)
+	var job dbus.ObjectPath
+	if err := call.Store(&job); err != nil {
+		if dbusErr, ok := err.(dbus.Error); ok {
+			logger.Debugf("StartTransientUnit failed with %q: %v", dbusErr.Name, dbusErr.Body)
+			// Some specific DBus errors have distinct handling.
+			switch dbusErr.Name {
+			case "org.freedesktop.DBus.Error.NameHasNoOwner":
+				// Nothing is providing systemd bus name. This is, most likely,
+				// an Ubuntu 14.04 system with the special deputy systemd.
+				return errDBusNameHasNoOwner
+			case "org.freedesktop.DBus.Error.UnknownMethod":
+				// The DBus API is not supported on this system. This can happen on
+				// very old versions of Systemd, for instance on Ubuntu 14.04.
+				return errDBusUnknownMethod
+			case "org.freedesktop.DBus.Error.Spawn.ChildExited":
+				// We tried to socket-activate dbus-daemon or bus-activate
+				// systemd --user but it failed.
+				return errDBusSpawnChildExited
+			case "org.freedesktop.systemd1.UnitExists":
+				// Starting a scope with a name that already exists is an
+				// error. Normally this should never happen.
+				return fmt.Errorf("cannot create transient scope: scope %q clashed: %s", unitName, err)
+			default:
+				return fmt.Errorf("cannot create transient scope: DBus error %q: %v", dbusErr.Name, dbusErr.Body)
+			}
+		}
+		if err != nil {
+			return fmt.Errorf("cannot create transient scope: %s", err)
+		}
+	}
+	logger.Debugf("created transient scope as object: %s", job)
+	return nil
+}
+
+var randomUUID = func() (string, error) {
+	// The source of the bytes generated here is the same as that of
+	// /dev/urandom which doesn't block and is sufficient for our purposes
+	// of avoiding clashing UUIDs that are needed for all of the non-service
+	// commands that are started with the help of this UUID.
+	return randutil.RandomKernelUUID(), nil
+}
diff -Nru snapd-2.45.1+20.04.2/sandbox/cgroup/tracking_test.go snapd-2.48.3+20.04/sandbox/cgroup/tracking_test.go
--- snapd-2.45.1+20.04.2/sandbox/cgroup/tracking_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sandbox/cgroup/tracking_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,629 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package cgroup_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/godbus/dbus"
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dbusutil"
+	"github.com/snapcore/snapd/dbusutil/dbustest"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/features"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/sandbox/cgroup"
+	"github.com/snapcore/snapd/testutil"
+)
+
+func enableFeatures(c *C, ff ...features.SnapdFeature) {
+	c.Assert(os.MkdirAll(dirs.FeaturesDir, 0755), IsNil)
+	for _, f := range ff {
+		c.Assert(ioutil.WriteFile(f.ControlFile(), nil, 0755), IsNil)
+	}
+}
+
+type trackingSuite struct{}
+
+var _ = Suite(&trackingSuite{})
+
+func (s *trackingSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+}
+
+func (s *trackingSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("")
+}
+
+// CreateTransientScopeForTracking is a no-op when refresh app awareness is off
+func (s *trackingSuite) TestCreateTransientScopeForTrackingFeatureDisabled(c *C) {
+	noDBus := func() (*dbus.Conn, error) {
+		c.Error("test sequence violated")
+		return nil, fmt.Errorf("dbus should not have been used")
+	}
+	restore := dbusutil.MockConnections(noDBus, noDBus)
+	defer restore()
+
+	c.Assert(features.RefreshAppAwareness.IsEnabled(), Equals, false)
+	err := cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Check(err, IsNil)
+}
+
+// CreateTransientScopeForTracking does stuff when refresh app awareness is on
+func (s *trackingSuite) TestCreateTransientScopeForTrackingFeatureEnabled(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+	c.Assert(features.RefreshAppAwareness.IsEnabled(), Equals, true)
+	// Pretend we are a non-root user so that session bus is used.
+	restore := cgroup.MockOsGetuid(12345)
+	defer restore()
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+	// Rig the random UUID generator to return this value.
+	uuid := "cc98cd01-6a25-46bd-b71b-82069b71b770"
+	restore = cgroup.MockRandomUUID(uuid)
+	defer restore()
+	// Replace interactions with DBus so that only session bus is available and responds with our logic.
+	conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			return []*dbus.Message{checkAndRespondToStartTransientUnit(c, msg, "snap.pkg.app."+uuid+".scope", 312123)}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	c.Assert(err, IsNil)
+	restore = dbusutil.MockOnlySessionBusAvailable(conn)
+	defer restore()
+	// Replace the cgroup analyzer function
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		return "/user.slice/user-12345.slice/user@12345.service/snap.pkg.app." + uuid + ".scope", nil
+	})
+	defer restore()
+
+	err = cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Check(err, IsNil)
+}
+
+func (s *trackingSuite) TestCreateTransientScopeForTrackingUnhappyNotRootGeneric(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+
+	// Hand out stub connections to both the system and session bus.
+	// Neither is really used here but they must appear to be available.
+	restore := dbusutil.MockConnections(dbustest.StubConnection, dbustest.StubConnection)
+	defer restore()
+
+	// Pretend we are a non-root user so that session bus is used.
+	restore = cgroup.MockOsGetuid(12345)
+	defer restore()
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+
+	// Rig the cgroup analyzer to return an answer not related to the snap name.
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		return "foo", nil
+	})
+	defer restore()
+
+	// Pretend that attempting to create a transient scope fails with a canned error.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		return fmt.Errorf("cannot create transient scope for testing")
+	})
+	defer restore()
+
+	// Create a transient scope and see it fail according to how doCreateTransientScope is rigged.
+	err := cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, ErrorMatches, "cannot create transient scope for testing")
+
+	// Calling StartTransientUnit fails with org.freedesktop.DBus.UnknownMethod error.
+	// This is possible on old systemd or on deputy systemd.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		return cgroup.ErrDBusUnknownMethod
+	})
+	defer restore()
+
+	// Attempts to create a transient scope fail with a special error
+	// indicating that we cannot track application process.
+	err = cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, ErrorMatches, "cannot track application process")
+
+	// Calling StartTransientUnit fails with org.freedesktop.DBus.Spawn.ChildExited error.
+	// This is possible where we try to activate socket activate session bus
+	// but it's not available OR when we try to socket activate systemd --user.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		return cgroup.ErrDBusSpawnChildExited
+	})
+	defer restore()
+
+	// Attempts to create a transient scope fail with a special error
+	// indicating that we cannot track application process and because we are
+	// not root, we do not attempt to fall back to the system bus.
+	err = cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, ErrorMatches, "cannot track application process")
+}
+
+func (s *trackingSuite) TestCreateTransientScopeForTrackingUnhappyRootFallback(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+
+	// Hand out stub connections to both the system and session bus.
+	// Neither is really used here but they must appear to be available.
+	restore := dbusutil.MockConnections(dbustest.StubConnection, dbustest.StubConnection)
+	defer restore()
+
+	// Pretend we are a root user so that we attempt to use the system bus as fallback.
+	restore = cgroup.MockOsGetuid(0)
+	defer restore()
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+
+	// Rig the random UUID generator to return this value.
+	uuid := "cc98cd01-6a25-46bd-b71b-82069b71b770"
+	restore = cgroup.MockRandomUUID(uuid)
+	defer restore()
+
+	// Calling StartTransientUnit fails on the session and then works on the system bus.
+	// This test emulates a root user falling back from the session bus to the system bus.
+	n := 0
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		n++
+		switch n {
+		case 1:
+			// On first try we fail. This is when we used the session bus/
+			return cgroup.ErrDBusSpawnChildExited
+		case 2:
+			// On second try we succeed.
+			return nil
+		}
+		panic("expected to call doCreateTransientScope at most twice")
+	})
+	defer restore()
+
+	// Rig the cgroup analyzer to pretend that we got placed into the system slice.
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		c.Assert(pid, Equals, 312123)
+		return "/system.slice/snap.pkg.app." + uuid + ".scope", nil
+	})
+	defer restore()
+
+	// Attempts to create a transient scope fail with a special error
+	// indicating that we cannot track application process and but because we were
+	// root we attempted to fall back to the system bus.
+	err := cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, IsNil)
+}
+
+func (s *trackingSuite) TestCreateTransientScopeForTrackingUnhappyRootFailedFallback(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+
+	// Make it appear that session bus is there but system bus is not.
+	noSystemBus := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("system bus is not available for testing")
+	}
+	restore := dbusutil.MockConnections(noSystemBus, dbustest.StubConnection)
+	defer restore()
+
+	// Pretend we are a root user so that we attempt to use the system bus as fallback.
+	restore = cgroup.MockOsGetuid(0)
+	defer restore()
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+
+	// Rig the random UUID generator to return this value.
+	uuid := "cc98cd01-6a25-46bd-b71b-82069b71b770"
+	restore = cgroup.MockRandomUUID(uuid)
+	defer restore()
+
+	// Calling StartTransientUnit fails so that we try to use the system bus as fallback.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		return cgroup.ErrDBusSpawnChildExited
+	})
+	defer restore()
+
+	// Rig the cgroup analyzer to return an answer not related to the snap name.
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		return "foo", nil
+	})
+	defer restore()
+
+	// Attempts to create a transient scope fail with a special error
+	// indicating that we cannot track application process.
+	err := cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, ErrorMatches, "cannot track application process")
+}
+
+func (s *trackingSuite) TestCreateTransientScopeForTrackingUnhappyNoDBus(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+
+	// Make it appear that DBus is entirely unavailable.
+	noBus := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("dbus is not available for testing")
+	}
+	restore := dbusutil.MockConnections(noBus, noBus)
+	defer restore()
+
+	// Pretend we are a root user so that we attempt to use the system bus as fallback.
+	restore = cgroup.MockOsGetuid(0)
+	defer restore()
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+
+	// Rig the random UUID generator to return this value.
+	uuid := "cc98cd01-6a25-46bd-b71b-82069b71b770"
+	restore = cgroup.MockRandomUUID(uuid)
+	defer restore()
+
+	// Calling StartTransientUnit is not attempted without a DBus connection.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		c.Error("test sequence violated")
+		return fmt.Errorf("test was not expected to create a transient scope")
+	})
+	defer restore()
+
+	// Disable the cgroup analyzer function as we don't expect it to be used in this test.
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		c.Error("test sequence violated")
+		return "", fmt.Errorf("test was not expected to measure process path in the tracking cgroup")
+	})
+	defer restore()
+
+	// Attempts to create a transient scope fail with a special error
+	// indicating that we cannot track application process.
+	err := cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, ErrorMatches, "cannot track application process")
+}
+
+func (s *trackingSuite) TestCreateTransientScopeForTrackingSilentlyFails(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+
+	// Hand out stub connections to both the system and session bus.
+	// Neither is really used here but they must appear to be available.
+	restore := dbusutil.MockConnections(dbustest.StubConnection, dbustest.StubConnection)
+	defer restore()
+
+	// Pretend we are a non-root user.
+	restore = cgroup.MockOsGetuid(12345)
+	defer restore()
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+
+	// Rig the random UUID generator to return this value.
+	uuid := "cc98cd01-6a25-46bd-b71b-82069b71b770"
+	restore = cgroup.MockRandomUUID(uuid)
+	defer restore()
+
+	// Calling StartTransientUnit succeeds but in reality does not move our
+	// process to the new cgroup hierarchy. This can happen when systemd
+	// version is < 238 and when the calling user is in a hierarchy that is
+	// owned by another user. One example is a user logging in remotely over
+	// ssh.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		return nil
+	})
+	defer restore()
+
+	// Rig the cgroup analyzer to pretend that we are not placed in a snap-related slice.
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		c.Assert(pid, Equals, 312123)
+		return "/system.slice/foo.service", nil
+	})
+	defer restore()
+
+	// Attempts to create a transient scope fail with a special error
+	// indicating that we cannot track application process even though
+	// the DBus call has returned no error.
+	err := cgroup.CreateTransientScopeForTracking("snap.pkg.app", nil)
+	c.Assert(err, ErrorMatches, "cannot track application process")
+}
+
+func (s *trackingSuite) TestCreateTransientScopeForRootOnSystemBus(c *C) {
+	// Pretend that refresh app awareness is enabled
+	enableFeatures(c, features.RefreshAppAwareness)
+
+	// Hand out stub connections to both the system and session bus. Remember
+	// the identity of the system bus to that we can verify access later.
+	// Neither is really used here but they must appear to be available.
+	systemBus, err := dbustest.StubConnection()
+	c.Assert(err, IsNil)
+	restore := dbusutil.MockConnections(func() (*dbus.Conn, error) { return systemBus, nil }, dbustest.StubConnection)
+	defer restore()
+
+	// Pretend we are a root user. All hooks execute as root.
+	restore = cgroup.MockOsGetuid(0)
+	defer restore()
+
+	// Pretend our PID is this value.
+	restore = cgroup.MockOsGetpid(312123)
+	defer restore()
+
+	// Rig the random UUID generator to return this value.
+	uuid := "cc98cd01-6a25-46bd-b71b-82069b71b770"
+	restore = cgroup.MockRandomUUID(uuid)
+	defer restore()
+
+	// Pretend that attempting to create a transient scope succeeds.  Measure
+	// the bus used and the unit name provided by the caller.  Note that the
+	// call was made on the system bus, as requested by TrackingOptions below.
+	restore = cgroup.MockDoCreateTransientScope(func(conn *dbus.Conn, unitName string, pid int) error {
+		c.Assert(conn, Equals, systemBus)
+		c.Assert(unitName, Equals, "snap.pkg.app."+uuid+".scope")
+		return nil
+	})
+	defer restore()
+
+	// Rig the cgroup analyzer to indicate successful tracking.
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		return "snap.pkg.app." + uuid + ".scope", nil
+	})
+	defer restore()
+
+	// Create a transient scope and see it succeed.
+	err = cgroup.CreateTransientScopeForTracking("snap.pkg.app", &cgroup.TrackingOptions{AllowSessionBus: false})
+	c.Assert(err, IsNil)
+}
+
+func checkAndRespondToStartTransientUnit(c *C, msg *dbus.Message, scopeName string, pid int) *dbus.Message {
+	// XXX: Those types might live in a package somewhere
+	type Property struct {
+		Name  string
+		Value interface{}
+	}
+	type Unit struct {
+		Name  string
+		Props []Property
+	}
+	// Signature of StartTransientUnit, string, string, array of Property and array of Unit (see above).
+	requestSig := dbus.SignatureOf("", "", []Property{}, []Unit{})
+
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	c.Check(msg.Flags, Equals, dbus.Flags(0))
+	c.Check(msg.Headers, DeepEquals, map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldDestination: dbus.MakeVariant("org.freedesktop.systemd1"),
+		dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/systemd1")),
+		dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.systemd1.Manager"),
+		dbus.FieldMember:      dbus.MakeVariant("StartTransientUnit"),
+		dbus.FieldSignature:   dbus.MakeVariant(requestSig),
+	})
+	c.Check(msg.Body, DeepEquals, []interface{}{
+		scopeName,
+		"fail",
+		[][]interface{}{
+			{"PIDs", dbus.MakeVariant([]uint32{uint32(pid)})},
+		},
+		[][]interface{}{},
+	})
+
+	responseSig := dbus.SignatureOf(dbus.ObjectPath(""))
+	return &dbus.Message{
+		Type: dbus.TypeMethodReply,
+		Headers: map[dbus.HeaderField]dbus.Variant{
+			dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+			dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+			// dbus.FieldDestination is provided automatically by DBus test helper.
+			dbus.FieldSignature: dbus.MakeVariant(responseSig),
+		},
+		// The object path returned in the body is not used by snap run yet.
+		Body: []interface{}{dbus.ObjectPath("/org/freedesktop/systemd1/job/1462")},
+	}
+}
+
+func checkAndFailToStartTransientUnit(c *C, msg *dbus.Message, errMsg string) *dbus.Message {
+	c.Assert(msg.Type, Equals, dbus.TypeMethodCall)
+	// ignore the message and just produce an error response
+	return &dbus.Message{
+		Type: dbus.TypeError,
+		Headers: map[dbus.HeaderField]dbus.Variant{
+			dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+			dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+			// dbus.FieldDestination is provided automatically by DBus test helper.
+			dbus.FieldErrorName: dbus.MakeVariant(errMsg),
+		},
+	}
+}
+
+func (s *trackingSuite) TestDoCreateTransientScopeHappy(c *C) {
+	conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			return []*dbus.Message{checkAndRespondToStartTransientUnit(c, msg, "foo.scope", 312123)}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+
+	c.Assert(err, IsNil)
+	defer conn.Close()
+	err = cgroup.DoCreateTransientScope(conn, "foo.scope", 312123)
+	c.Assert(err, IsNil)
+}
+
+func (s *trackingSuite) TestDoCreateTransientScopeForwardedErrors(c *C) {
+	// Certain errors are forwarded and handled in the logic calling into
+	// DoCreateTransientScope. Those are tested here.
+	for _, t := range []struct {
+		dbusError, msg string
+	}{
+		{"org.freedesktop.DBus.Error.NameHasNoOwner", "dbus name has no owner"},
+		{"org.freedesktop.DBus.Error.UnknownMethod", "unknown dbus object method"},
+		{"org.freedesktop.DBus.Error.Spawn.ChildExited", "dbus spawned child process exited"},
+	} {
+		conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+			switch n {
+			case 0:
+				return []*dbus.Message{checkAndFailToStartTransientUnit(c, msg, t.dbusError)}, nil
+			}
+			return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+		})
+		c.Assert(err, IsNil)
+		defer conn.Close()
+		err = cgroup.DoCreateTransientScope(conn, "foo.scope", 312123)
+		c.Assert(strings.HasSuffix(err.Error(), fmt.Sprintf(" [%s]", t.dbusError)), Equals, true, Commentf("%q ~ %s", err, t.dbusError))
+		c.Check(err, ErrorMatches, t.msg+" .*")
+	}
+}
+
+func (s *trackingSuite) TestDoCreateTransientScopeClashingScopeName(c *C) {
+	// In case our UUID algorithm is bad and systemd reports that an unit with
+	// identical name already exists, we provide a special error handler for that.
+	errMsg := "org.freedesktop.systemd1.UnitExists"
+	conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			return []*dbus.Message{checkAndFailToStartTransientUnit(c, msg, errMsg)}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	c.Assert(err, IsNil)
+	defer conn.Close()
+	err = cgroup.DoCreateTransientScope(conn, "foo.scope", 312123)
+	c.Assert(err, ErrorMatches, "cannot create transient scope: scope .* clashed: .*")
+}
+
+func (s *trackingSuite) TestDoCreateTransientScopeOtherDBusErrors(c *C) {
+	// Other DBus errors are not special-cased and cause a generic failure handler.
+	errMsg := "org.example.BadHairDay"
+	conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		switch n {
+		case 0:
+			return []*dbus.Message{checkAndFailToStartTransientUnit(c, msg, errMsg)}, nil
+		}
+		return nil, fmt.Errorf("unexpected message #%d: %s", n, msg)
+	})
+	c.Assert(err, IsNil)
+	defer conn.Close()
+	err = cgroup.DoCreateTransientScope(conn, "foo.scope", 312123)
+	c.Assert(err, ErrorMatches, `cannot create transient scope: DBus error "org.example.BadHairDay": \[\]`)
+}
+
+func (s *trackingSuite) TestSessionOrMaybeSystemBusTotalFailureForRoot(c *C) {
+	system := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("system bus unavailable for testing")
+	}
+	session := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("session bus unavailable for testing")
+	}
+	restore := dbusutil.MockConnections(system, session)
+	defer restore()
+	logBuf, restore := logger.MockLogger()
+	defer restore()
+	os.Setenv("SNAPD_DEBUG", "true")
+	defer os.Unsetenv("SNAPD_DEBUG")
+
+	uid := 0
+	isSession, conn, err := cgroup.SessionOrMaybeSystemBus(uid)
+	c.Assert(err, ErrorMatches, "system bus unavailable for testing")
+	c.Check(conn, IsNil)
+	c.Check(isSession, Equals, false)
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: session bus is not available: session bus unavailable for testing\n")
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: falling back to system bus\n")
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: system bus is not available: system bus unavailable for testing\n")
+}
+
+func (s *trackingSuite) TestSessionOrMaybeSystemBusFallbackForRoot(c *C) {
+	system := func() (*dbus.Conn, error) {
+		return dbustest.StubConnection()
+	}
+	session := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("session bus unavailable for testing")
+	}
+	restore := dbusutil.MockConnections(system, session)
+	defer restore()
+	logBuf, restore := logger.MockLogger()
+	defer restore()
+	os.Setenv("SNAPD_DEBUG", "true")
+	defer os.Unsetenv("SNAPD_DEBUG")
+
+	uid := 0
+	isSession, conn, err := cgroup.SessionOrMaybeSystemBus(uid)
+	c.Assert(err, IsNil)
+	conn.Close()
+	c.Check(isSession, Equals, false)
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: session bus is not available: session bus unavailable for testing\n")
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: falling back to system bus\n")
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: using system bus now, session bus was not available\n")
+}
+
+func (s *trackingSuite) TestSessionOrMaybeSystemBusNonRootSessionFailure(c *C) {
+	system := func() (*dbus.Conn, error) {
+		return dbustest.StubConnection()
+	}
+	session := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("session bus unavailable for testing")
+	}
+	restore := dbusutil.MockConnections(system, session)
+	defer restore()
+	logBuf, restore := logger.MockLogger()
+	defer restore()
+	os.Setenv("SNAPD_DEBUG", "true")
+	defer os.Unsetenv("SNAPD_DEBUG")
+
+	uid := 12345
+	isSession, conn, err := cgroup.SessionOrMaybeSystemBus(uid)
+	c.Assert(err, ErrorMatches, "session bus unavailable for testing")
+	c.Check(conn, IsNil)
+	c.Check(isSession, Equals, false)
+	c.Check(logBuf.String(), testutil.Contains, "DEBUG: session bus is not available: session bus unavailable for testing\n")
+}
+
+func (s *trackingSuite) TestConfirmSystemdServiceTrackingHappy(c *C) {
+	// Pretend our PID is this value.
+	restore := cgroup.MockOsGetpid(312123)
+	defer restore()
+	// Replace the cgroup analyzer function
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		c.Assert(pid, Equals, 312123)
+		return "/user.slice/user-12345.slice/user@12345.service/snap.pkg.app.service", nil
+	})
+	defer restore()
+
+	// With the cgroup path faked as above, we are being tracked as the systemd
+	// service so no error is reported.
+	err := cgroup.ConfirmSystemdServiceTracking("snap.pkg.app")
+	c.Assert(err, IsNil)
+}
+
+func (s *trackingSuite) TestConfirmSystemdServiceTrackingSad(c *C) {
+	// Pretend our PID is this value.
+	restore := cgroup.MockOsGetpid(312123)
+	defer restore()
+	// Replace the cgroup analyzer function
+	restore = cgroup.MockCgroupProcessPathInTrackingCgroup(func(pid int) (string, error) {
+		c.Assert(pid, Equals, 312123)
+		// Tracking path of a gnome terminal helper process. Meant to illustrate a tracking but not related to a snap application.
+		return "user.slice/user-12345.slice/user@12345.service/apps.slice/apps-org.gnome.Terminal.slice/vte-spawn-e640104a-cddf-4bd8-ba4b-2c1baf0270c3.scope", nil
+	})
+	defer restore()
+
+	// With the cgroup path faked as above, tracking is not effective.
+	err := cgroup.ConfirmSystemdServiceTracking("snap.pkg.app")
+	c.Assert(err, Equals, cgroup.ErrCannotTrackProcess)
+}
diff -Nru snapd-2.45.1+20.04.2/sanity/squashfs.go snapd-2.48.3+20.04/sanity/squashfs.go
--- snapd-2.45.1+20.04.2/sanity/squashfs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sanity/squashfs.go	2021-02-02 08:21:12.000000000 +0000
@@ -108,10 +108,7 @@
 	}
 
 	// the fstype can be squashfs or fuse.{snap,squash}fuse
-	fstype, _, err := squashfs.FsType()
-	if err != nil {
-		return err
-	}
+	fstype, _ := squashfs.FsType()
 	options := []string{"-t", fstype}
 	if selinux.ProbedLevel() != selinux.Unsupported {
 		if ctx := selinux.SnapMountContext(); ctx != "" {
diff -Nru snapd-2.45.1+20.04.2/secboot/encrypt_dummy.go snapd-2.48.3+20.04/secboot/encrypt_dummy.go
--- snapd-2.45.1+20.04.2/secboot/encrypt_dummy.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/encrypt_dummy.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,25 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build nosecboot
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot
+
+func (k RecoveryKey) String() string {
+	return "not-implemented"
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/encrypt.go snapd-2.48.3+20.04/secboot/encrypt.go
--- snapd-2.45.1+20.04.2/secboot/encrypt.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/encrypt.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,101 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot
+
+import (
+	"crypto/rand"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+const (
+	// The encryption key size is set so it has the same entropy as the derived
+	// key.
+	encryptionKeySize = 64
+
+	// XXX: needs to be in sync with
+	//      github.com/snapcore/secboot/crypto.go:"type RecoveryKey"
+	// Size of the recovery key.
+	recoveryKeySize = 16
+)
+
+// EncryptionKey is the key used to encrypt the data partition.
+type EncryptionKey [encryptionKeySize]byte
+
+func NewEncryptionKey() (EncryptionKey, error) {
+	var key EncryptionKey
+	// rand.Read() is protected against short reads
+	_, err := rand.Read(key[:])
+	// On return, n == len(b) if and only if err == nil
+	return key, err
+}
+
+// Save writes the key in the location specified by filename.
+func (key EncryptionKey) Save(filename string) error {
+	if err := os.MkdirAll(filepath.Dir(filename), 0755); err != nil {
+		return err
+	}
+	return osutil.AtomicWriteFile(filename, key[:], 0600, 0)
+}
+
+// RecoveryKey is a key used to unlock the encrypted partition when
+// the encryption key can't be used, for example when unseal fails.
+type RecoveryKey [recoveryKeySize]byte
+
+func NewRecoveryKey() (RecoveryKey, error) {
+	var key RecoveryKey
+	// rand.Read() is protected against short reads
+	_, err := rand.Read(key[:])
+	// On return, n == len(b) if and only if err == nil
+	return key, err
+}
+
+// Save writes the recovery key in the location specified by filename.
+func (key RecoveryKey) Save(filename string) error {
+	if err := os.MkdirAll(filepath.Dir(filename), 0755); err != nil {
+		return err
+	}
+	return osutil.AtomicWriteFile(filename, key[:], 0600, 0)
+}
+
+func RecoveryKeyFromFile(recoveryKeyFile string) (*RecoveryKey, error) {
+	f, err := os.Open(recoveryKeyFile)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open recovery key: %v", err)
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("cannot stat recovery key: %v", err)
+	}
+	if st.Size() != int64(len(RecoveryKey{})) {
+		return nil, fmt.Errorf("cannot read recovery key: unexpected size %v for the recovery key file %s", st.Size(), recoveryKeyFile)
+	}
+
+	var rkey RecoveryKey
+	if _, err := io.ReadFull(f, rkey[:]); err != nil {
+		return nil, fmt.Errorf("cannot read recovery key: %v", err)
+	}
+	return &rkey, nil
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/encrypt_test.go snapd-2.48.3+20.04/secboot/encrypt_test.go
--- snapd-2.45.1+20.04.2/secboot/encrypt_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/encrypt_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,83 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot_test
+
+import (
+	"os"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type encryptSuite struct {
+	dir string
+}
+
+var _ = Suite(&encryptSuite{})
+
+func (s *encryptSuite) SetUpTest(c *C) {
+	s.dir = c.MkDir()
+}
+
+func (s *encryptSuite) TestRecoveryKeySave(c *C) {
+	kf := filepath.Join(s.dir, "test-key")
+	kfNested := filepath.Join(s.dir, "deeply/nested/test-key")
+
+	rkey := secboot.RecoveryKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 255}
+	err := rkey.Save(kf)
+	c.Assert(err, IsNil)
+	c.Assert(kf, testutil.FileEquals, rkey[:])
+
+	fileInfo, err := os.Stat(kf)
+	c.Assert(err, IsNil)
+	c.Assert(fileInfo.Mode(), Equals, os.FileMode(0600))
+
+	err = rkey.Save(kfNested)
+	c.Assert(err, IsNil)
+	c.Assert(kfNested, testutil.FileEquals, rkey[:])
+	di, err := os.Stat(filepath.Dir(kfNested))
+	c.Assert(err, IsNil)
+	c.Assert(di.Mode().Perm(), Equals, os.FileMode(0755))
+}
+
+func (s *encryptSuite) TestEncryptionKeySave(c *C) {
+	kf := filepath.Join(s.dir, "test-key")
+	kfNested := filepath.Join(s.dir, "deeply/nested/test-key")
+
+	ekey := secboot.EncryptionKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 255}
+	err := ekey.Save(kf)
+	c.Assert(err, IsNil)
+	c.Assert(kf, testutil.FileEquals, ekey[:])
+
+	fileInfo, err := os.Stat(kf)
+	c.Assert(err, IsNil)
+	c.Assert(fileInfo.Mode(), Equals, os.FileMode(0600))
+
+	err = ekey.Save(kfNested)
+	c.Assert(err, IsNil)
+	c.Assert(kfNested, testutil.FileEquals, ekey[:])
+	di, err := os.Stat(filepath.Dir(kfNested))
+	c.Assert(err, IsNil)
+	c.Assert(di.Mode().Perm(), Equals, os.FileMode(0755))
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/encrypt_tpm.go snapd-2.48.3+20.04/secboot/encrypt_tpm.go
--- snapd-2.45.1+20.04.2/secboot/encrypt_tpm.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/encrypt_tpm.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,57 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot
+
+import (
+	sb "github.com/snapcore/secboot"
+)
+
+var (
+	sbInitializeLUKS2Container       = sb.InitializeLUKS2Container
+	sbAddRecoveryKeyToLUKS2Container = sb.AddRecoveryKeyToLUKS2Container
+)
+
+const keyslotsAreaKiBSize = 2560 // 2.5MB
+const metadataKiBSize = 2048     // 2MB
+
+// FormatEncryptedDevice initializes an encrypted volume on the block device
+// given by node, setting the specified label. The key used to unlock the volume
+// is provided using the key argument.
+func FormatEncryptedDevice(key EncryptionKey, label, node string) error {
+	opts := &sb.InitializeLUKS2ContainerOptions{
+		// use a lower, but still reasonable size that should give us
+		// enough room
+		MetadataKiBSize:     metadataKiBSize,
+		KeyslotsAreaKiBSize: keyslotsAreaKiBSize,
+	}
+	return sbInitializeLUKS2Container(node, label, key[:], opts)
+}
+
+// AddRecoveryKey adds a fallback recovery key rkey to the existing encrypted
+// volume created with FormatEncryptedDevice on the block device given by node.
+// The existing key to the encrypted volume is provided in the key argument.
+func AddRecoveryKey(key EncryptionKey, rkey RecoveryKey, node string) error {
+	return sbAddRecoveryKeyToLUKS2Container(node, key[:], sb.RecoveryKey(rkey))
+}
+
+func (k RecoveryKey) String() string {
+	return sb.RecoveryKey(k).String()
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/encrypt_tpm_test.go snapd-2.48.3+20.04/secboot/encrypt_tpm_test.go
--- snapd-2.45.1+20.04.2/secboot/encrypt_tpm_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/encrypt_tpm_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,105 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !nosecboot
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot_test
+
+import (
+	"errors"
+
+	sb "github.com/snapcore/secboot"
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/secboot"
+)
+
+func (s *encryptSuite) TestFormatEncryptedDevice(c *C) {
+	for _, tc := range []struct {
+		initErr error
+		err     string
+	}{
+		{initErr: nil, err: ""},
+		{initErr: errors.New("some error"), err: "some error"},
+	} {
+		// create empty key to prevent blocking on lack of system entropy
+		myKey := secboot.EncryptionKey{}
+		for i := range myKey {
+			myKey[i] = byte(i)
+		}
+
+		calls := 0
+		restore := secboot.MockSbInitializeLUKS2Container(func(devicePath, label string, key []byte,
+			opts *sb.InitializeLUKS2ContainerOptions) error {
+			calls++
+			c.Assert(devicePath, Equals, "/dev/node")
+			c.Assert(label, Equals, "my label")
+			c.Assert(key, DeepEquals, myKey[:])
+			c.Assert(opts, DeepEquals, &sb.InitializeLUKS2ContainerOptions{
+				MetadataKiBSize:     2048,
+				KeyslotsAreaKiBSize: 2560,
+			})
+			return tc.initErr
+		})
+		defer restore()
+
+		err := secboot.FormatEncryptedDevice(myKey, "my label", "/dev/node")
+		c.Assert(calls, Equals, 1)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+	}
+}
+
+func (s *encryptSuite) TestAddRecoveryKey(c *C) {
+	for _, tc := range []struct {
+		addErr error
+		err    string
+	}{
+		{addErr: nil, err: ""},
+		{addErr: errors.New("some error"), err: "some error"},
+	} {
+		// create empty key to prevent blocking on lack of system entropy
+		myKey := secboot.EncryptionKey{}
+		for i := range myKey {
+			myKey[i] = byte(i)
+		}
+
+		myRecoveryKey := secboot.RecoveryKey{15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0}
+
+		calls := 0
+		restore := secboot.MockSbAddRecoveryKeyToLUKS2Container(func(devicePath string, key []byte, recoveryKey sb.RecoveryKey) error {
+			calls++
+			c.Assert(devicePath, Equals, "/dev/node")
+			c.Assert(recoveryKey[:], DeepEquals, myRecoveryKey[:])
+			c.Assert(key, DeepEquals, myKey[:])
+			return tc.addErr
+		})
+		defer restore()
+
+		err := secboot.AddRecoveryKey(myKey, myRecoveryKey, "/dev/node")
+		c.Assert(calls, Equals, 1)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/export_test.go snapd-2.48.3+20.04/secboot/export_test.go
--- snapd-2.45.1+20.04.2/secboot/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,10 +21,16 @@
 package secboot
 
 import (
+	"io"
+	"time"
+
 	sb "github.com/snapcore/secboot"
 )
 
-type TPMSupport = tpmSupport
+var (
+	EFIImageFromBootFile = efiImageFromBootFile
+	LockTPMSealedKeys    = lockTPMSealedKeys
+)
 
 func MockSbConnectToDefaultTPM(f func() (*sb.TPMConnection, error)) (restore func()) {
 	old := sbConnectToDefaultTPM
@@ -34,11 +40,11 @@
 	}
 }
 
-func MockSbProvisionTPM(f func(tpm *sb.TPMConnection, mode sb.ProvisionMode, newLockoutAuth []byte) error) (restore func()) {
-	old := sbProvisionTPM
-	sbProvisionTPM = f
+func MockProvisionTPM(f func(tpm *sb.TPMConnection, mode sb.ProvisionMode, newLockoutAuth []byte) error) (restore func()) {
+	old := provisionTPM
+	provisionTPM = f
 	return func() {
-		sbProvisionTPM = old
+		provisionTPM = old
 	}
 }
 
@@ -50,6 +56,14 @@
 	}
 }
 
+func MockSbAddEFIBootManagerProfile(f func(profile *sb.PCRProtectionProfile, params *sb.EFIBootManagerProfileParams) error) (restore func()) {
+	old := sbAddEFIBootManagerProfile
+	sbAddEFIBootManagerProfile = f
+	return func() {
+		sbAddEFIBootManagerProfile = old
+	}
+}
+
 func MockSbAddSystemdEFIStubProfile(f func(profile *sb.PCRProtectionProfile, params *sb.SystemdEFIStubProfileParams) error) (restore func()) {
 	old := sbAddSystemdEFIStubProfile
 	sbAddSystemdEFIStubProfile = f
@@ -66,10 +80,134 @@
 	}
 }
 
-func MockSbSealKeyToTPM(f func(tpm *sb.TPMConnection, key []byte, keyPath, policyUpdatePath string, params *sb.KeyCreationParams) error) (restore func()) {
-	old := sbSealKeyToTPM
-	sbSealKeyToTPM = f
+func MockSbSealKeyToTPMMultiple(f func(tpm *sb.TPMConnection, keys []*sb.SealKeyRequest, params *sb.KeyCreationParams) (sb.TPMPolicyAuthKey, error)) (restore func()) {
+	old := sbSealKeyToTPMMultiple
+	sbSealKeyToTPMMultiple = f
+	return func() {
+		sbSealKeyToTPMMultiple = old
+	}
+}
+
+func MockSbUpdateKeyPCRProtectionPolicyMultiple(f func(tpm *sb.TPMConnection, keyPaths []string, authKey sb.TPMPolicyAuthKey, pcrProfile *sb.PCRProtectionProfile) error) (restore func()) {
+	old := sbUpdateKeyPCRProtectionPolicyMultiple
+	sbUpdateKeyPCRProtectionPolicyMultiple = f
+	return func() {
+		sbUpdateKeyPCRProtectionPolicyMultiple = old
+	}
+}
+
+func MockSbBlockPCRProtectionPolicies(f func(tpm *sb.TPMConnection, pcrs []int) error) (restore func()) {
+	old := sbBlockPCRProtectionPolicies
+	sbBlockPCRProtectionPolicies = f
+	return func() {
+		sbBlockPCRProtectionPolicies = old
+	}
+}
+
+func MockSbActivateVolumeWithRecoveryKey(f func(volumeName, sourceDevicePath string,
+	keyReader io.Reader, options *sb.ActivateVolumeOptions) error) (restore func()) {
+	old := sbActivateVolumeWithRecoveryKey
+	sbActivateVolumeWithRecoveryKey = f
+	return func() {
+		sbActivateVolumeWithRecoveryKey = old
+	}
+}
+
+func MockSbActivateVolumeWithTPMSealedKey(f func(tpm *sb.TPMConnection, volumeName, sourceDevicePath, keyPath string,
+	pinReader io.Reader, options *sb.ActivateVolumeOptions) (bool, error)) (restore func()) {
+	old := sbActivateVolumeWithTPMSealedKey
+	sbActivateVolumeWithTPMSealedKey = f
+	return func() {
+		sbActivateVolumeWithTPMSealedKey = old
+	}
+}
+
+func MockSbActivateVolumeWithKey(f func(volumeName, sourceDevicePath string, key []byte,
+	options *sb.ActivateVolumeOptions) error) (restore func()) {
+	old := sbActivateVolumeWithKey
+	sbActivateVolumeWithKey = f
+	return func() {
+		sbActivateVolumeWithKey = old
+	}
+}
+
+func MockSbMeasureSnapSystemEpochToTPM(f func(tpm *sb.TPMConnection, pcrIndex int) error) (restore func()) {
+	old := sbMeasureSnapSystemEpochToTPM
+	sbMeasureSnapSystemEpochToTPM = f
+	return func() {
+		sbMeasureSnapSystemEpochToTPM = old
+	}
+}
+
+func MockSbMeasureSnapModelToTPM(f func(tpm *sb.TPMConnection, pcrIndex int, model sb.SnapModel) error) (restore func()) {
+	old := sbMeasureSnapModelToTPM
+	sbMeasureSnapModelToTPM = f
+	return func() {
+		sbMeasureSnapModelToTPM = old
+	}
+}
+
+func MockRandomKernelUUID(f func() string) (restore func()) {
+	old := randutilRandomKernelUUID
+	randutilRandomKernelUUID = f
+	return func() {
+		randutilRandomKernelUUID = old
+	}
+}
+
+func MockSbInitializeLUKS2Container(f func(devicePath, label string, key []byte,
+	opts *sb.InitializeLUKS2ContainerOptions) error) (restore func()) {
+	old := sbInitializeLUKS2Container
+	sbInitializeLUKS2Container = f
+	return func() {
+		sbInitializeLUKS2Container = old
+	}
+}
+
+func MockSbAddRecoveryKeyToLUKS2Container(f func(devicePath string, key []byte, recoveryKey sb.RecoveryKey) error) (restore func()) {
+	old := sbAddRecoveryKeyToLUKS2Container
+	sbAddRecoveryKeyToLUKS2Container = f
+	return func() {
+		sbAddRecoveryKeyToLUKS2Container = old
+	}
+}
+
+func MockIsTPMEnabled(f func(tpm *sb.TPMConnection) bool) (restore func()) {
+	old := isTPMEnabled
+	isTPMEnabled = f
+	return func() {
+		isTPMEnabled = old
+	}
+}
+
+func MockFDEHasRevealKey(f func() bool) (restore func()) {
+	old := FDEHasRevealKey
+	FDEHasRevealKey = f
+	return func() {
+		FDEHasRevealKey = old
+	}
+}
+
+func MockFdeRevealKeyCommandExtra(args []string) (restore func()) {
+	oldFdeRevealKeyCommandExtra := fdeRevealKeyCommandExtra
+	fdeRevealKeyCommandExtra = args
+	return func() {
+		fdeRevealKeyCommandExtra = oldFdeRevealKeyCommandExtra
+	}
+}
+
+func MockFdeRevealKeyRuntimeMax(d time.Duration) (restore func()) {
+	oldFdeRevealKeyRuntimeMax := fdeRevealKeyRuntimeMax
+	fdeRevealKeyRuntimeMax = d
+	return func() {
+		fdeRevealKeyRuntimeMax = oldFdeRevealKeyRuntimeMax
+	}
+}
+
+func MockFdeRevealKeyPollWaitParanoiaFactor(n int) (restore func()) {
+	oldFdeRevealKeyPollWaitParanoiaFactor := fdeRevealKeyPollWaitParanoiaFactor
+	fdeRevealKeyPollWaitParanoiaFactor = n
 	return func() {
-		sbSealKeyToTPM = old
+		fdeRevealKeyPollWaitParanoiaFactor = oldFdeRevealKeyPollWaitParanoiaFactor
 	}
 }
diff -Nru snapd-2.45.1+20.04.2/secboot/secboot_dummy.go snapd-2.48.3+20.04/secboot/secboot_dummy.go
--- snapd-2.45.1+20.04.2/secboot/secboot_dummy.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/secboot_dummy.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,3 +27,11 @@
 func CheckKeySealingSupported() error {
 	return fmt.Errorf("build without secboot support")
 }
+
+func SealKeys(keys []SealKeyRequest, params *SealKeysParams) error {
+	return fmt.Errorf("build without secboot support")
+}
+
+func ResealKeys(params *ResealKeysParams) error {
+	return fmt.Errorf("build without secboot support")
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/secboot.go snapd-2.48.3+20.04/secboot/secboot.go
--- snapd-2.45.1+20.04.2/secboot/secboot.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/secboot.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,3 +23,127 @@
 // the github.com/snapcore/secboot repository. That will ensure
 // it can be build as part of the debian build without secboot.
 // Debian does run "go list" without any support for passing -tags.
+
+import (
+	"crypto/ecdsa"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
+)
+
+const (
+	// Handles are in the block reserved for TPM owner objects (0x01800000 - 0x01bfffff)
+	RunObjectPCRPolicyCounterHandle      = 0x01880001
+	FallbackObjectPCRPolicyCounterHandle = 0x01880002
+)
+
+type LoadChain struct {
+	*bootloader.BootFile
+	// Next is a list of alternative chains that can be loaded
+	// following the boot file.
+	Next []*LoadChain
+}
+
+// NewLoadChain returns a LoadChain corresponding to loading the given
+// BootFile before any of the given next chains.
+func NewLoadChain(bf bootloader.BootFile, next ...*LoadChain) *LoadChain {
+	return &LoadChain{
+		BootFile: &bf,
+		Next:     next,
+	}
+}
+
+type SealKeyRequest struct {
+	// The key to seal
+	Key EncryptionKey
+	// The path to store the sealed key file
+	KeyFile string
+}
+
+type SealKeyModelParams struct {
+	// The snap model
+	Model *asserts.Model
+	// The set of EFI binary load chains for the current device
+	// configuration
+	EFILoadChains []*LoadChain
+	// The kernel command line
+	KernelCmdlines []string
+}
+
+type SealKeysParams struct {
+	// The parameters we're sealing the key to
+	ModelParams []*SealKeyModelParams
+	// The authorization policy update key file (only relevant for TPM)
+	TPMPolicyAuthKey *ecdsa.PrivateKey
+	// The path to the authorization policy update key file (only relevant for TPM,
+	// if empty the key will not be saved)
+	TPMPolicyAuthKeyFile string
+	// The path to the lockout authorization file (only relevant for TPM and only
+	// used if TPMProvision is set to true)
+	TPMLockoutAuthFile string
+	// Whether we should provision the TPM
+	TPMProvision bool
+	// The handle at which to create a NV index for dynamic authorization policy revocation support
+	PCRPolicyCounterHandle uint32
+}
+
+type ResealKeysParams struct {
+	// The snap model parameters
+	ModelParams []*SealKeyModelParams
+	// The path to the sealed key files
+	KeyFiles []string
+	// The path to the authorization policy update key file (only relevant for TPM)
+	TPMPolicyAuthKeyFile string
+}
+
+// UnlockVolumeUsingSealedKeyOptions contains options for unlocking encrypted
+// volumes using keys sealed to the TPM.
+type UnlockVolumeUsingSealedKeyOptions struct {
+	// AllowRecoveryKey when true indicates activation with the recovery key
+	// will be attempted if activation with the sealed key failed.
+	AllowRecoveryKey bool
+}
+
+// UnlockMethod is the method that was used to unlock a volume.
+type UnlockMethod int
+
+const (
+	// NotUnlocked indicates that the device was either not unlocked or is not
+	// an encrypted device.
+	NotUnlocked UnlockMethod = iota
+	// UnlockedWithSealedKey indicates that the device was unlocked with the
+	// provided sealed key object.
+	UnlockedWithSealedKey
+	// UnlockedWithRecoveryKey indicates that the device was unlocked by the
+	// user providing the recovery key at the prompt.
+	UnlockedWithRecoveryKey
+	// UnlockedWithKey indicates that the device was unlocked with the provided
+	// key, which is not sealed.
+	UnlockedWithKey
+	// UnlockStatusUnknown indicates that the unlock status of the device is not clear.
+	UnlockStatusUnknown
+)
+
+// UnlockResult is the result of trying to unlock a volume.
+type UnlockResult struct {
+	// FsDevice is the device with filesystem ready to mount.
+	// It is the activated device if encrypted or just
+	// the underlying device (same as PartDevice) if non-encrypted.
+	// FsDevice can be empty when none was found.
+	FsDevice string
+	// PartDevice is the underlying partition device.
+	// PartDevice can be empty when no device was found.
+	PartDevice string
+	// IsEncrypted indicates that PartDevice is encrypted.
+	IsEncrypted bool
+	// UnlockMethod is the method used to unlock the device. Valid values are
+	// - NotUnlocked
+	// - UnlockedWithRecoveryKey
+	// - UnlockedWithSealedKey
+	// - UnlockedWithKey
+	UnlockMethod UnlockMethod
+}
+
+// FDEHasReveal is setup by devicestate/fde to support device-specific
+// full disk encryption implementations.
+var FDEHasRevealKey = func() bool { return false }
diff -Nru snapd-2.45.1+20.04.2/secboot/secboot_tpm.go snapd-2.48.3+20.04/secboot/secboot_tpm.go
--- snapd-2.45.1+20.04.2/secboot/secboot_tpm.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/secboot_tpm.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,16 +21,60 @@
 package secboot
 
 import (
+	"bytes"
+	"crypto/rand"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
 
+	"github.com/canonical/go-tpm2"
 	sb "github.com/snapcore/secboot"
+	"golang.org/x/xerrors"
 
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/bootloader/efi"
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/disks"
+	"github.com/snapcore/snapd/randutil"
+	"github.com/snapcore/snapd/snap/snapfile"
 )
 
-var sbConnectToDefaultTPM = sb.ConnectToDefaultTPM
+const (
+	keyringPrefix = "ubuntu-fde"
+)
+
+var (
+	sbConnectToDefaultTPM                  = sb.ConnectToDefaultTPM
+	sbMeasureSnapSystemEpochToTPM          = sb.MeasureSnapSystemEpochToTPM
+	sbMeasureSnapModelToTPM                = sb.MeasureSnapModelToTPM
+	sbBlockPCRProtectionPolicies           = sb.BlockPCRProtectionPolicies
+	sbActivateVolumeWithTPMSealedKey       = sb.ActivateVolumeWithTPMSealedKey
+	sbActivateVolumeWithRecoveryKey        = sb.ActivateVolumeWithRecoveryKey
+	sbActivateVolumeWithKey                = sb.ActivateVolumeWithKey
+	sbAddEFISecureBootPolicyProfile        = sb.AddEFISecureBootPolicyProfile
+	sbAddEFIBootManagerProfile             = sb.AddEFIBootManagerProfile
+	sbAddSystemdEFIStubProfile             = sb.AddSystemdEFIStubProfile
+	sbAddSnapModelProfile                  = sb.AddSnapModelProfile
+	sbSealKeyToTPMMultiple                 = sb.SealKeyToTPMMultiple
+	sbUpdateKeyPCRProtectionPolicyMultiple = sb.UpdateKeyPCRProtectionPolicyMultiple
+
+	randutilRandomKernelUUID = randutil.RandomKernelUUID
+
+	isTPMEnabled = isTPMEnabledImpl
+	provisionTPM = provisionTPMImpl
+)
+
+func isTPMEnabledImpl(tpm *sb.TPMConnection) bool {
+	return tpm.IsEnabled()
+}
 
 func CheckKeySealingSupported() error {
 	logger.Noticef("checking if secure boot is enabled...")
@@ -41,14 +85,22 @@
 	logger.Noticef("secure boot is enabled")
 
 	logger.Noticef("checking if TPM device is available...")
-	tconn, err := sbConnectToDefaultTPM()
+	tpm, err := sbConnectToDefaultTPM()
 	if err != nil {
 		err = fmt.Errorf("cannot connect to TPM device: %v", err)
 		logger.Noticef("%v", err)
 		return err
 	}
-	logger.Noticef("TPM device detected")
-	return tconn.Close()
+	defer tpm.Close()
+
+	if !isTPMEnabled(tpm) {
+		logger.Noticef("TPM device detected but not enabled")
+		return fmt.Errorf("TPM device is not enabled")
+	}
+
+	logger.Noticef("TPM device detected and enabled")
+
+	return nil
 }
 
 func checkSecureBootEnabled() error {
@@ -69,3 +121,747 @@
 
 	return nil
 }
+
+// initramfsPCR is the TPM PCR that we reserve for the EFI image and use
+// for measurement from the initramfs.
+const initramfsPCR = 12
+
+func secureConnectToTPM(ekcfile string) (*sb.TPMConnection, error) {
+	ekCertReader, err := os.Open(ekcfile)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open endorsement key certificate file: %v", err)
+	}
+	defer ekCertReader.Close()
+
+	return sb.SecureConnectToDefaultTPM(ekCertReader, nil)
+}
+
+func insecureConnectToTPM() (*sb.TPMConnection, error) {
+	return sbConnectToDefaultTPM()
+}
+
+func measureWhenPossible(whatHow func(tpm *sb.TPMConnection) error) error {
+	// the model is ready, we're good to try measuring it now
+	tpm, err := insecureConnectToTPM()
+	if err != nil {
+		if xerrors.Is(err, sb.ErrNoTPM2Device) {
+			return nil
+		}
+		return fmt.Errorf("cannot open TPM connection: %v", err)
+	}
+	defer tpm.Close()
+
+	if !isTPMEnabled(tpm) {
+		return nil
+	}
+
+	return whatHow(tpm)
+}
+
+// MeasureSnapSystemEpochWhenPossible measures the snap system epoch only if the
+// TPM device is available. If there's no TPM device success is returned.
+func MeasureSnapSystemEpochWhenPossible() error {
+	measure := func(tpm *sb.TPMConnection) error {
+		return sbMeasureSnapSystemEpochToTPM(tpm, initramfsPCR)
+	}
+
+	if err := measureWhenPossible(measure); err != nil {
+		return fmt.Errorf("cannot measure snap system epoch: %v", err)
+	}
+
+	return nil
+}
+
+// MeasureSnapModelWhenPossible measures the snap model only if the TPM device is
+// available. If there's no TPM device success is returned.
+func MeasureSnapModelWhenPossible(findModel func() (*asserts.Model, error)) error {
+	measure := func(tpm *sb.TPMConnection) error {
+		model, err := findModel()
+		if err != nil {
+			return err
+		}
+		return sbMeasureSnapModelToTPM(tpm, initramfsPCR, model)
+	}
+
+	if err := measureWhenPossible(measure); err != nil {
+		return fmt.Errorf("cannot measure snap model: %v", err)
+	}
+
+	return nil
+}
+
+// LockSealedKeys manually locks access to the sealed keys. Meant to be
+// called in place of passing lockKeysOnFinish as true to
+// UnlockVolumeUsingSealedKeyIfEncrypted for cases where we don't know if a
+// given call is the last one to unlock a volume like in degraded recover mode.
+func LockSealedKeys() error {
+	if FDEHasRevealKey() {
+		return lockFDERevealSealedKeys()
+	}
+	return lockTPMSealedKeys()
+}
+
+func lockFDERevealSealedKeys() error {
+	buf, err := json.Marshal(FDERevealKeyRequest{
+		Op: "lock",
+	})
+	if err != nil {
+		return fmt.Errorf(`cannot build request for fde-reveal-key "lock": %v`, err)
+	}
+	if output, err := runFDERevealKeyCommand(buf); err != nil {
+		return fmt.Errorf(`cannot run fde-reveal-key "lock": %v`, osutil.OutputErr(output, err))
+	}
+
+	return nil
+}
+
+func lockTPMSealedKeys() error {
+	tpm, tpmErr := sbConnectToDefaultTPM()
+	if tpmErr != nil {
+		if xerrors.Is(tpmErr, sb.ErrNoTPM2Device) {
+			logger.Noticef("cannot open TPM connection: %v", tpmErr)
+			return nil
+		}
+		return fmt.Errorf("cannot lock TPM: %v", tpmErr)
+	}
+	defer tpm.Close()
+
+	// Lock access to the sealed keys. This should be called whenever there
+	// is a TPM device detected, regardless of whether secure boot is enabled
+	// or there is an encrypted volume to unlock. Note that snap-bootstrap can
+	// be called several times during initialization, and if there are multiple
+	// volumes to unlock we should lock access to the sealed keys only after
+	// the last encrypted volume is unlocked, in which case lockKeysOnFinish
+	// should be set to true.
+	//
+	// We should only touch the PCR that we've currently reserved for the kernel
+	// EFI image. Touching others will break the ability to perform any kind of
+	// attestation using the TPM because it will make the log inconsistent.
+	return sbBlockPCRProtectionPolicies(tpm, []int{initramfsPCR})
+}
+
+// UnlockVolumeUsingSealedKeyIfEncrypted verifies whether an encrypted volume
+// with the specified name exists and unlocks it using a sealed key in a file
+// with a corresponding name. The options control activation with the
+// recovery key will be attempted if a prior activation attempt with
+// the sealed key fails.
+//
+// Note that if the function proceeds to the point where it knows definitely
+// whether there is an encrypted device or not, IsEncrypted on the return
+// value will be true, even if error is non-nil. This is so that callers can be
+// robust and try unlocking using another method for example.
+func UnlockVolumeUsingSealedKeyIfEncrypted(disk disks.Disk, name string, sealedEncryptionKeyFile string, opts *UnlockVolumeUsingSealedKeyOptions) (UnlockResult, error) {
+	res := UnlockResult{}
+
+	// find the encrypted device using the disk we were provided - note that
+	// we do not specify IsDecryptedDevice in opts because here we are
+	// looking for the encrypted device to unlock, later on in the boot
+	// process we will look for the decrypted device to ensure it matches
+	// what we expected
+	partUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+	if err == nil {
+		res.IsEncrypted = true
+	} else {
+		var errNotFound disks.FilesystemLabelNotFoundError
+		if !xerrors.As(err, &errNotFound) {
+			// some other kind of catastrophic error searching
+			// TODO: need to defer the connection to the default TPM somehow
+			return res, fmt.Errorf("error enumerating partitions for disk to find encrypted device %q: %v", name, err)
+		}
+		// otherwise it is an error not found and we should search for the
+		// unencrypted device
+		partUUID, err = disk.FindMatchingPartitionUUID(name)
+		if err != nil {
+			return res, fmt.Errorf("error enumerating partitions for disk to find unencrypted device %q: %v", name, err)
+		}
+	}
+
+	partDevice := filepath.Join("/dev/disk/by-partuuid", partUUID)
+
+	if !res.IsEncrypted {
+		// if we didn't find an encrypted device just return, don't try to
+		// unlock it
+		// the filesystem device for the unencrypted case is the same as the
+		// partition device
+		res.PartDevice = partDevice
+		res.FsDevice = res.PartDevice
+		return res, nil
+	}
+
+	mapperName := name + "-" + randutilRandomKernelUUID()
+	sourceDevice := partDevice
+	targetDevice := filepath.Join("/dev/mapper", mapperName)
+
+	if FDEHasRevealKey() {
+		return unlockVolumeUsingSealedKeyFDERevealKey(name, sealedEncryptionKeyFile, sourceDevice, targetDevice, mapperName, opts)
+	} else {
+		return unlockVolumeUsingSealedKeySecboot(name, sealedEncryptionKeyFile, sourceDevice, targetDevice, mapperName, opts)
+	}
+}
+
+// FDERevealKeyRequest carries the operation and parameters for the
+// fde-reveal-key binary to support unsealing keys that were sealed
+// with the "fde-setup" hook.
+type FDERevealKeyRequest struct {
+	Op string `json:"op"`
+
+	SealedKey []byte `json:"sealed-key,omitempty"`
+	KeyName   string `json:"key-name,omitempty"`
+
+	// TODO: add VolumeName,SourceDevicePath later
+}
+
+// fdeRevealKeyRuntimeMax is the maximum runtime a fde-reveal-key can execute
+// XXX: what is a reasonable default here?
+var fdeRevealKeyRuntimeMax = 2 * time.Minute
+
+// 50 ms means we check at a frequency 20 Hz, fast enough to not hold
+// up boot, but not too fast that we are hogging the CPU from the
+// thing we are waiting to finish running
+var fdeRevealKeyPollWait = 50 * time.Millisecond
+
+// fdeRevealKeyPollWaitParanoiaFactor controls much longer we wait
+// then fdeRevealKeyRuntimeMax before stopping to poll for results
+var fdeRevealKeyPollWaitParanoiaFactor = 2
+
+// overridden in tests
+var fdeRevealKeyCommandExtra []string
+
+// runFDERevealKeyCommand returns the output of fde-reveal-key run
+// with systemd.
+//
+// Note that systemd-run in the initrd can only talk to the private
+// systemd bus so this cannot use "--pipe" or "--wait", see
+// https://github.com/snapcore/core-initrd/issues/13
+func runFDERevealKeyCommand(stdin []byte) (output []byte, err error) {
+	runDir := filepath.Join(dirs.GlobalRootDir, "/run/fde-reveal-key")
+	if err := os.MkdirAll(runDir, 0700); err != nil {
+		return nil, fmt.Errorf("cannot create tmp dir for fde-reveal-key: %v", err)
+	}
+
+	// delete and re-create the std{in,out,err} stream files that we use for the
+	// hook to be robust against bugs where the files are created with too
+	// permissive permissions or not properly deleted afterwards since the hook
+	// will be invoked multiple times during the initrd and we want to be really
+	// careful since the stdout file will contain the unsealed encryption key
+	for _, stream := range []string{"stdin", "stdout", "stderr"} {
+		streamFile := filepath.Join(runDir, "fde-reveal-key."+stream)
+		// we want to make sure that the file permissions for stdout are always
+		// 0600, so to ensure this is the case and be robust against bugs, we
+		// always delete the file and re-create it with 0600
+
+		// note that if the file already exists, WriteFile will not change the
+		// permissions, so deleting first is the right thing to do
+		os.Remove(streamFile)
+		if stream == "stdin" {
+			err = ioutil.WriteFile(streamFile, stdin, 0600)
+		} else {
+			err = ioutil.WriteFile(streamFile, nil, 0600)
+		}
+		if err != nil {
+			return nil, fmt.Errorf("cannot create %s for fde-reveal-key: %v", stream, err)
+		}
+	}
+
+	// TODO: put this into a new "systemd/run" package
+	cmd := exec.Command(
+		"systemd-run",
+		"--collect",
+		"--service-type=exec",
+		"--quiet",
+		// ensure we get some result from the hook within a
+		// reasonable timeout and output from systemd if
+		// things go wrong
+		fmt.Sprintf("--property=RuntimeMaxSec=%s", fdeRevealKeyRuntimeMax),
+		// Do not allow mounting, this ensures hooks in initrd
+		// can not mess around with ubuntu-data.
+		//
+		// Note that this is not about perfect confinement, more about
+		// making sure that people using the hook know that we do not
+		// want them to mess around outside of just providing unseal.
+		"--property=SystemCallFilter=~@mount",
+		// WORKAROUNDS
+		// workaround the lack of "--pipe"
+		fmt.Sprintf("--property=StandardInput=file:%s/fde-reveal-key.stdin", runDir),
+		// NOTE: these files are manually created above with 0600 because by
+		// default systemd will create them 0644 and we want to be paranoid here
+		fmt.Sprintf("--property=StandardOutput=file:%s/fde-reveal-key.stdout", runDir),
+		fmt.Sprintf("--property=StandardError=file:%s/fde-reveal-key.stderr", runDir),
+		// this ensures we get useful output for e.g. segfaults
+		fmt.Sprintf(`--property=ExecStopPost=/bin/sh -c 'if [ "$EXIT_STATUS" = 0 ]; then touch %[1]s/fde-reveal-key.success; else echo "service result: $SERVICE_RESULT" >%[1]s/fde-reveal-key.failed; fi'`, runDir),
+	)
+	if fdeRevealKeyCommandExtra != nil {
+		cmd.Args = append(cmd.Args, fdeRevealKeyCommandExtra...)
+	}
+	// fde-reveal-key is what we actually need to run
+	cmd.Args = append(cmd.Args, "fde-reveal-key")
+
+	// ensure we cleanup our tmp files
+	defer func() {
+		if err := os.RemoveAll(runDir); err != nil {
+			logger.Noticef("cannot remove tmp dir: %v", err)
+		}
+	}()
+
+	// run the command
+	output, err = cmd.CombinedOutput()
+	if err != nil {
+		return output, err
+	}
+
+	// This loop will be terminate by systemd-run, either because
+	// fde-reveal-key exists or it gets killed when it reaches the
+	// fdeRevealKeyRuntimeMax defined above.
+	//
+	// However we are paranoid and exit this loop if systemd
+	// did not terminate the process after twice the allocated
+	// runtime
+	maxLoops := int(fdeRevealKeyRuntimeMax/fdeRevealKeyPollWait) * fdeRevealKeyPollWaitParanoiaFactor
+	for i := 0; i < maxLoops; i++ {
+		switch {
+		case osutil.FileExists(filepath.Join(runDir, "fde-reveal-key.failed")):
+			stderr, _ := ioutil.ReadFile(filepath.Join(runDir, "fde-reveal-key.stderr"))
+			systemdErr, _ := ioutil.ReadFile(filepath.Join(runDir, "fde-reveal-key.failed"))
+			buf := bytes.NewBuffer(stderr)
+			buf.Write(systemdErr)
+			return buf.Bytes(), fmt.Errorf("fde-reveal-key failed")
+		case osutil.FileExists(filepath.Join(runDir, "fde-reveal-key.success")):
+			return ioutil.ReadFile(filepath.Join(runDir, "fde-reveal-key.stdout"))
+		default:
+			time.Sleep(fdeRevealKeyPollWait)
+		}
+	}
+
+	// this should never happen, the loop above should be terminated
+	// via systemd
+	return nil, fmt.Errorf("internal error: systemd-run did not honor RuntimeMax=%s setting", fdeRevealKeyRuntimeMax)
+}
+
+func unlockVolumeUsingSealedKeyFDERevealKey(name, sealedEncryptionKeyFile, sourceDevice, targetDevice, mapperName string, opts *UnlockVolumeUsingSealedKeyOptions) (UnlockResult, error) {
+	res := UnlockResult{IsEncrypted: true, PartDevice: sourceDevice}
+
+	sealedKey, err := ioutil.ReadFile(sealedEncryptionKeyFile)
+	if err != nil {
+		return res, fmt.Errorf("cannot read sealed key file: %v", err)
+	}
+	buf, err := json.Marshal(FDERevealKeyRequest{
+		Op:        "reveal",
+		SealedKey: sealedKey,
+		KeyName:   name,
+	})
+	if err != nil {
+		return res, fmt.Errorf("cannot build request for fde-reveal-key: %v", err)
+	}
+	output, err := runFDERevealKeyCommand(buf)
+	if err != nil {
+		return res, fmt.Errorf("cannot run fde-reveal-key: %v", osutil.OutputErr(output, err))
+	}
+
+	// the output of fde-reveal-key is the unsealed key
+	unsealedKey := output
+	if err := unlockEncryptedPartitionWithKey(mapperName, sourceDevice, unsealedKey); err != nil {
+		return res, fmt.Errorf("cannot unlock encrypted partition: %v", err)
+	}
+	res.FsDevice = targetDevice
+	res.UnlockMethod = UnlockedWithSealedKey
+	return res, nil
+}
+
+func unlockVolumeUsingSealedKeySecboot(name, sealedEncryptionKeyFile, sourceDevice, targetDevice, mapperName string, opts *UnlockVolumeUsingSealedKeyOptions) (UnlockResult, error) {
+	// TODO:UC20: use sb.SecureConnectToDefaultTPM() if we decide there's benefit in doing that or
+	//            we have a hard requirement for a valid EK cert chain for every boot (ie, panic
+	//            if there isn't one). But we can't do that as long as we need to download
+	//            intermediate certs from the manufacturer.
+
+	res := UnlockResult{IsEncrypted: true, PartDevice: sourceDevice}
+	// Obtain a TPM connection.
+	tpm, tpmErr := sbConnectToDefaultTPM()
+	if tpmErr != nil {
+		if !xerrors.Is(tpmErr, sb.ErrNoTPM2Device) {
+			return res, fmt.Errorf("cannot unlock encrypted device %q: %v", name, tpmErr)
+		}
+		logger.Noticef("cannot open TPM connection: %v", tpmErr)
+	} else {
+		defer tpm.Close()
+	}
+
+	// Also check if the TPM device is enabled. The platform firmware may disable the storage
+	// and endorsement hierarchies, but the device will remain visible to the operating system.
+	tpmDeviceAvailable := tpmErr == nil && isTPMEnabled(tpm)
+
+	// if we don't have a tpm, and we allow using a recovery key, do that
+	// directly
+	if !tpmDeviceAvailable && opts.AllowRecoveryKey {
+		if err := UnlockEncryptedVolumeWithRecoveryKey(mapperName, sourceDevice); err != nil {
+			return res, err
+		}
+		res.FsDevice = targetDevice
+		res.UnlockMethod = UnlockedWithRecoveryKey
+		return res, nil
+	}
+
+	// otherwise we have a tpm and we should use the sealed key first, but
+	// this method will fallback to using the recovery key if enabled
+	method, err := unlockEncryptedPartitionWithSealedKey(tpm, mapperName, sourceDevice, sealedEncryptionKeyFile, "", opts.AllowRecoveryKey)
+	res.UnlockMethod = method
+	if err == nil {
+		res.FsDevice = targetDevice
+	}
+	return res, err
+}
+
+// UnlockEncryptedVolumeUsingKey unlocks an existing volume using the provided key.
+func UnlockEncryptedVolumeUsingKey(disk disks.Disk, name string, key []byte) (UnlockResult, error) {
+	unlockRes := UnlockResult{
+		UnlockMethod: NotUnlocked,
+	}
+	// find the encrypted device using the disk we were provided - note that
+	// we do not specify IsDecryptedDevice in opts because here we are
+	// looking for the encrypted device to unlock, later on in the boot
+	// process we will look for the decrypted device to ensure it matches
+	// what we expected
+	partUUID, err := disk.FindMatchingPartitionUUID(name + "-enc")
+	if err != nil {
+		return unlockRes, err
+	}
+	unlockRes.IsEncrypted = true
+	// we have a device
+	encdev := filepath.Join("/dev/disk/by-partuuid", partUUID)
+	unlockRes.PartDevice = encdev
+	// make up a new name for the mapped device
+	mapperName := name + "-" + randutilRandomKernelUUID()
+	if err := unlockEncryptedPartitionWithKey(mapperName, encdev, key); err != nil {
+		return unlockRes, err
+	}
+
+	unlockRes.FsDevice = filepath.Join("/dev/mapper/", mapperName)
+	unlockRes.UnlockMethod = UnlockedWithKey
+	return unlockRes, nil
+}
+
+// UnlockEncryptedVolumeWithRecoveryKey prompts for the recovery key and uses it
+// to open an encrypted device.
+func UnlockEncryptedVolumeWithRecoveryKey(name, device string) error {
+	options := sb.ActivateVolumeOptions{
+		RecoveryKeyTries: 3,
+		KeyringPrefix:    keyringPrefix,
+	}
+
+	if err := sbActivateVolumeWithRecoveryKey(name, device, nil, &options); err != nil {
+		return fmt.Errorf("cannot unlock encrypted device %q: %v", device, err)
+	}
+
+	return nil
+}
+
+func isActivatedWithRecoveryKey(err error) bool {
+	if err == nil {
+		return false
+	}
+	// with non-nil err, we should check for err being ActivateWithTPMSealedKeyError
+	// and RecoveryKeyUsageErr inside that being nil - this indicates that the
+	// recovery key was used to unlock it
+	activateErr, ok := err.(*sb.ActivateWithTPMSealedKeyError)
+	if !ok {
+		return false
+	}
+	return activateErr.RecoveryKeyUsageErr == nil
+}
+
+// unlockEncryptedPartitionWithSealedKey unseals the keyfile and opens an encrypted
+// device. If activation with the sealed key fails, this function will attempt to
+// activate it with the fallback recovery key instead.
+func unlockEncryptedPartitionWithSealedKey(tpm *sb.TPMConnection, name, device, keyfile, pinfile string, allowRecovery bool) (UnlockMethod, error) {
+	options := sb.ActivateVolumeOptions{
+		PassphraseTries: 1,
+		// disable recovery key by default
+		RecoveryKeyTries: 0,
+		KeyringPrefix:    keyringPrefix,
+	}
+	if allowRecovery {
+		// enable recovery key only when explicitly allowed
+		options.RecoveryKeyTries = 3
+	}
+
+	// XXX: pinfile is currently not used
+	activated, err := sbActivateVolumeWithTPMSealedKey(tpm, name, device, keyfile, nil, &options)
+
+	if activated {
+		// non nil error may indicate the volume was unlocked using the
+		// recovery key
+		if err == nil {
+			logger.Noticef("successfully activated encrypted device %q with TPM", device)
+			return UnlockedWithSealedKey, nil
+		} else if isActivatedWithRecoveryKey(err) {
+			logger.Noticef("successfully activated encrypted device %q using a fallback activation method", device)
+			return UnlockedWithRecoveryKey, nil
+		}
+		// no other error is possible when activation succeeded
+		return UnlockStatusUnknown, fmt.Errorf("internal error: volume activated with unexpected error: %v", err)
+	}
+	// ActivateVolumeWithTPMSealedKey should always return an error if activated == false
+	return NotUnlocked, fmt.Errorf("cannot activate encrypted device %q: %v", device, err)
+}
+
+// unlockEncryptedPartitionWithKey unlocks encrypted partition with the provided
+// key.
+func unlockEncryptedPartitionWithKey(name, device string, key []byte) error {
+	// no special options set
+	options := sb.ActivateVolumeOptions{}
+	err := sbActivateVolumeWithKey(name, device, key, &options)
+	if err == nil {
+		logger.Noticef("successfully activated encrypted device %v using a key", device)
+	}
+	return err
+}
+
+// SealKeys provisions the TPM and seals the encryption keys according to the
+// specified parameters. If the TPM is already provisioned, or a sealed key already
+// exists, SealKeys will fail and return an error.
+func SealKeys(keys []SealKeyRequest, params *SealKeysParams) error {
+	numModels := len(params.ModelParams)
+	if numModels < 1 {
+		return fmt.Errorf("at least one set of model-specific parameters is required")
+	}
+
+	tpm, err := sbConnectToDefaultTPM()
+	if err != nil {
+		return fmt.Errorf("cannot connect to TPM: %v", err)
+	}
+	defer tpm.Close()
+	if !isTPMEnabled(tpm) {
+		return fmt.Errorf("TPM device is not enabled")
+	}
+
+	pcrProfile, err := buildPCRProtectionProfile(params.ModelParams)
+	if err != nil {
+		return err
+	}
+
+	if params.TPMProvision {
+		// Provision the TPM as late as possible
+		if err := tpmProvision(tpm, params.TPMLockoutAuthFile); err != nil {
+			return err
+		}
+	}
+
+	// Seal the provided keys to the TPM
+	creationParams := sb.KeyCreationParams{
+		PCRProfile:             pcrProfile,
+		PCRPolicyCounterHandle: tpm2.Handle(params.PCRPolicyCounterHandle),
+		AuthKey:                params.TPMPolicyAuthKey,
+	}
+
+	sbKeys := make([]*sb.SealKeyRequest, 0, len(keys))
+	for i := range keys {
+		sbKeys = append(sbKeys, &sb.SealKeyRequest{
+			Key:  keys[i].Key[:],
+			Path: keys[i].KeyFile,
+		})
+	}
+
+	authKey, err := sbSealKeyToTPMMultiple(tpm, sbKeys, &creationParams)
+	if err != nil {
+		return err
+	}
+	if params.TPMPolicyAuthKeyFile != "" {
+		if err := osutil.AtomicWriteFile(params.TPMPolicyAuthKeyFile, authKey, 0600, 0); err != nil {
+			return fmt.Errorf("cannot write the policy auth key file: %v", err)
+		}
+	}
+
+	return nil
+}
+
+// ResealKeys updates the PCR protection policy for the sealed encryption keys
+// according to the specified parameters.
+func ResealKeys(params *ResealKeysParams) error {
+	numModels := len(params.ModelParams)
+	if numModels < 1 {
+		return fmt.Errorf("at least one set of model-specific parameters is required")
+	}
+
+	tpm, err := sbConnectToDefaultTPM()
+	if err != nil {
+		return fmt.Errorf("cannot connect to TPM: %v", err)
+	}
+	defer tpm.Close()
+	if !isTPMEnabled(tpm) {
+		return fmt.Errorf("TPM device is not enabled")
+	}
+
+	pcrProfile, err := buildPCRProtectionProfile(params.ModelParams)
+	if err != nil {
+		return err
+	}
+
+	authKey, err := ioutil.ReadFile(params.TPMPolicyAuthKeyFile)
+	if err != nil {
+		return fmt.Errorf("cannot read the policy auth key file: %v", err)
+	}
+
+	return sbUpdateKeyPCRProtectionPolicyMultiple(tpm, params.KeyFiles, authKey, pcrProfile)
+}
+
+func buildPCRProtectionProfile(modelParams []*SealKeyModelParams) (*sb.PCRProtectionProfile, error) {
+	numModels := len(modelParams)
+	modelPCRProfiles := make([]*sb.PCRProtectionProfile, 0, numModels)
+
+	for _, mp := range modelParams {
+		modelProfile := sb.NewPCRProtectionProfile()
+
+		loadSequences, err := buildLoadSequences(mp.EFILoadChains)
+		if err != nil {
+			return nil, fmt.Errorf("cannot build EFI image load sequences: %v", err)
+		}
+
+		// Add EFI secure boot policy profile
+		policyParams := sb.EFISecureBootPolicyProfileParams{
+			PCRAlgorithm:  tpm2.HashAlgorithmSHA256,
+			LoadSequences: loadSequences,
+			// TODO:UC20: set SignatureDbUpdateKeystore to support applying forbidden
+			//            signature updates to blacklist signing keys (after rotating them).
+			//            This also requires integration of sbkeysync, and some work to
+			//            ensure that the PCR profile is updated before/after sbkeysync executes.
+		}
+
+		if err := sbAddEFISecureBootPolicyProfile(modelProfile, &policyParams); err != nil {
+			return nil, fmt.Errorf("cannot add EFI secure boot policy profile: %v", err)
+		}
+
+		// Add EFI boot manager profile
+		bootManagerParams := sb.EFIBootManagerProfileParams{
+			PCRAlgorithm:  tpm2.HashAlgorithmSHA256,
+			LoadSequences: loadSequences,
+		}
+		if err := sbAddEFIBootManagerProfile(modelProfile, &bootManagerParams); err != nil {
+			return nil, fmt.Errorf("cannot add EFI boot manager profile: %v", err)
+		}
+
+		// Add systemd EFI stub profile
+		if len(mp.KernelCmdlines) != 0 {
+			systemdStubParams := sb.SystemdEFIStubProfileParams{
+				PCRAlgorithm:   tpm2.HashAlgorithmSHA256,
+				PCRIndex:       initramfsPCR,
+				KernelCmdlines: mp.KernelCmdlines,
+			}
+			if err := sbAddSystemdEFIStubProfile(modelProfile, &systemdStubParams); err != nil {
+				return nil, fmt.Errorf("cannot add systemd EFI stub profile: %v", err)
+			}
+		}
+
+		// Add snap model profile
+		if mp.Model != nil {
+			snapModelParams := sb.SnapModelProfileParams{
+				PCRAlgorithm: tpm2.HashAlgorithmSHA256,
+				PCRIndex:     initramfsPCR,
+				Models:       []sb.SnapModel{mp.Model},
+			}
+			if err := sbAddSnapModelProfile(modelProfile, &snapModelParams); err != nil {
+				return nil, fmt.Errorf("cannot add snap model profile: %v", err)
+			}
+		}
+
+		modelPCRProfiles = append(modelPCRProfiles, modelProfile)
+	}
+
+	var pcrProfile *sb.PCRProtectionProfile
+	if numModels > 1 {
+		pcrProfile = sb.NewPCRProtectionProfile().AddProfileOR(modelPCRProfiles...)
+	} else {
+		pcrProfile = modelPCRProfiles[0]
+	}
+
+	logger.Debugf("PCR protection profile:\n%s", pcrProfile.String())
+
+	return pcrProfile, nil
+}
+
+func tpmProvision(tpm *sb.TPMConnection, lockoutAuthFile string) error {
+	// Create and save the lockout authorization file
+	lockoutAuth := make([]byte, 16)
+	// crypto rand is protected against short reads
+	_, err := rand.Read(lockoutAuth)
+	if err != nil {
+		return fmt.Errorf("cannot create lockout authorization: %v", err)
+	}
+	if err := osutil.AtomicWriteFile(lockoutAuthFile, lockoutAuth, 0600, 0); err != nil {
+		return fmt.Errorf("cannot write the lockout authorization file: %v", err)
+	}
+
+	// TODO:UC20: ideally we should ask the firmware to clear the TPM and then reboot
+	//            if the device has previously been provisioned, see
+	//            https://godoc.org/github.com/snapcore/secboot#RequestTPMClearUsingPPI
+	if err := provisionTPM(tpm, sb.ProvisionModeFull, lockoutAuth); err != nil {
+		logger.Noticef("TPM provisioning error: %v", err)
+		return fmt.Errorf("cannot provision TPM: %v", err)
+	}
+	return nil
+}
+
+func provisionTPMImpl(tpm *sb.TPMConnection, mode sb.ProvisionMode, lockoutAuth []byte) error {
+	return tpm.EnsureProvisioned(mode, lockoutAuth)
+}
+
+// buildLoadSequences builds EFI load image event trees from this package LoadChains
+func buildLoadSequences(chains []*LoadChain) (loadseqs []*sb.EFIImageLoadEvent, err error) {
+	// this will build load event trees for the current
+	// device configuration, e.g. something like:
+	//
+	// shim -> recovery grub -> recovery kernel 1
+	//                      |-> recovery kernel 2
+	//                      |-> recovery kernel ...
+	//                      |-> normal grub -> run kernel good
+	//                                     |-> run kernel try
+
+	for _, chain := range chains {
+		// root of load events has source Firmware
+		loadseq, err := chain.loadEvent(sb.Firmware)
+		if err != nil {
+			return nil, err
+		}
+		loadseqs = append(loadseqs, loadseq)
+	}
+	return loadseqs, nil
+}
+
+// loadEvent builds the corresponding load event and its tree
+func (lc *LoadChain) loadEvent(source sb.EFIImageLoadEventSource) (*sb.EFIImageLoadEvent, error) {
+	var next []*sb.EFIImageLoadEvent
+	for _, nextChain := range lc.Next {
+		// everything that is not the root has source shim
+		ev, err := nextChain.loadEvent(sb.Shim)
+		if err != nil {
+			return nil, err
+		}
+		next = append(next, ev)
+	}
+	image, err := efiImageFromBootFile(lc.BootFile)
+	if err != nil {
+		return nil, err
+	}
+	return &sb.EFIImageLoadEvent{
+		Source: source,
+		Image:  image,
+		Next:   next,
+	}, nil
+}
+
+func efiImageFromBootFile(b *bootloader.BootFile) (sb.EFIImage, error) {
+	if b.Snap == "" {
+		if !osutil.FileExists(b.Path) {
+			return nil, fmt.Errorf("file %s does not exist", b.Path)
+		}
+		return sb.FileEFIImage(b.Path), nil
+	}
+
+	snapf, err := snapfile.Open(b.Snap)
+	if err != nil {
+		return nil, err
+	}
+	return sb.SnapFileEFIImage{
+		Container: snapf,
+		Path:      b.Snap,
+		FileName:  b.Path,
+	}, nil
+}
diff -Nru snapd-2.45.1+20.04.2/secboot/secboot_tpm_test.go snapd-2.48.3+20.04/secboot/secboot_tpm_test.go
--- snapd-2.45.1+20.04.2/secboot/secboot_tpm_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/secboot_tpm_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,18 +21,32 @@
 package secboot_test
 
 import (
+	"crypto/ecdsa"
+	"encoding/base64"
 	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
 	"os"
+	"os/exec"
+	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/canonical/go-tpm2"
 	sb "github.com/snapcore/secboot"
-
 	. "gopkg.in/check.v1"
 
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/bootloader/efi"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/disks"
 	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snapfile"
+	"github.com/snapcore/snapd/snap/squashfs"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -45,7 +59,10 @@
 var _ = Suite(&secbootSuite{})
 
 func (s *secbootSuite) SetUpTest(c *C) {
-	dirs.SetRootDir(c.MkDir())
+	rootDir := c.MkDir()
+	err := os.MkdirAll(filepath.Join(rootDir, "/run"), 0755)
+	c.Assert(err, IsNil)
+	dirs.SetRootDir(rootDir)
 	s.AddCleanup(func() { dirs.SetRootDir("/") })
 }
 
@@ -54,48 +71,1377 @@
 	sbEnabled := []uint8{1}
 	sbDisabled := []uint8{0}
 	efiNotSupported := []uint8(nil)
+	tpmErr := errors.New("TPM error")
 
 	type testCase struct {
-		hasTPM bool
-		sbData []uint8
-		errStr string
-	}
-	for _, t := range []testCase{
-		{true, sbEnabled, ""},
-		{true, sbEmpty, "secure boot variable does not exist"},
-		{false, sbEmpty, "secure boot variable does not exist"},
-		{true, sbDisabled, "secure boot is disabled"},
-		{false, sbEnabled, "cannot connect to TPM device: TPM not available"},
-		{false, sbDisabled, "secure boot is disabled"},
-		{true, efiNotSupported, "not a supported EFI system"},
-	} {
-		c.Logf("t: %v %v %q", t.hasTPM, t.sbData, t.errStr)
-
-		restore := secboot.MockSbConnectToDefaultTPM(func() (*sb.TPMConnection, error) {
-			if !t.hasTPM {
-				return nil, errors.New("TPM not available")
-			}
-			tcti, err := os.Open("/dev/null")
-			c.Assert(err, IsNil)
-			tpm, err := tpm2.NewTPMContext(tcti)
-			c.Assert(err, IsNil)
-			mockTPM := &sb.TPMConnection{TPMContext: tpm}
-			return mockTPM, nil
+		tpmErr     error
+		tpmEnabled bool
+		sbData     []uint8
+		err        string
+	}
+	for i, tc := range []testCase{
+		// happy case
+		{tpmErr: nil, tpmEnabled: true, sbData: sbEnabled, err: ""},
+		// secure boot EFI var is empty
+		{tpmErr: nil, tpmEnabled: true, sbData: sbEmpty, err: "secure boot variable does not exist"},
+		// secure boot is disabled
+		{tpmErr: nil, tpmEnabled: true, sbData: sbDisabled, err: "secure boot is disabled"},
+		// EFI not supported
+		{tpmErr: nil, tpmEnabled: true, sbData: efiNotSupported, err: "not a supported EFI system"},
+		// TPM connection error
+		{tpmErr: tpmErr, sbData: sbEnabled, err: "cannot connect to TPM device: TPM error"},
+		// TPM was detected but it's not enabled
+		{tpmErr: nil, tpmEnabled: false, sbData: sbEnabled, err: "TPM device is not enabled"},
+		// No TPM device
+		{tpmErr: sb.ErrNoTPM2Device, sbData: sbEnabled, err: "cannot connect to TPM device: no TPM2 device is available"},
+	} {
+		c.Logf("%d: %v %v %v %q", i, tc.tpmErr, tc.tpmEnabled, tc.sbData, tc.err)
+
+		_, restore := mockSbTPMConnection(c, tc.tpmErr)
+		defer restore()
+
+		restore = secboot.MockIsTPMEnabled(func(tpm *sb.TPMConnection) bool {
+			return tc.tpmEnabled
 		})
 		defer restore()
 
 		var vars map[string][]byte
-		if t.sbData != nil {
-			vars = map[string][]byte{"SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c": t.sbData}
+		if tc.sbData != nil {
+			vars = map[string][]byte{"SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c": tc.sbData}
 		}
 		restoreEfiVars := efi.MockVars(vars, nil)
 		defer restoreEfiVars()
 
 		err := secboot.CheckKeySealingSupported()
-		if t.errStr == "" {
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+	}
+}
+
+func (s *secbootSuite) TestMeasureSnapSystemEpochWhenPossible(c *C) {
+	for _, tc := range []struct {
+		tpmErr     error
+		tpmEnabled bool
+		callNum    int
+		err        string
+	}{
+		{
+			// normal connection to the TPM device
+			tpmErr: nil, tpmEnabled: true, callNum: 1, err: "",
+		},
+		{
+			// TPM device exists but returns error
+			tpmErr: errors.New("tpm error"), callNum: 0,
+			err: "cannot measure snap system epoch: cannot open TPM connection: tpm error",
+		},
+		{
+			// TPM device exists but is disabled
+			tpmErr: nil, tpmEnabled: false,
+		},
+		{
+			// TPM device does not exist
+			tpmErr: sb.ErrNoTPM2Device,
+		},
+	} {
+		mockTpm, restore := mockSbTPMConnection(c, tc.tpmErr)
+		defer restore()
+
+		restore = secboot.MockIsTPMEnabled(func(tpm *sb.TPMConnection) bool {
+			return tc.tpmEnabled
+		})
+		defer restore()
+
+		calls := 0
+		restore = secboot.MockSbMeasureSnapSystemEpochToTPM(func(tpm *sb.TPMConnection, pcrIndex int) error {
+			calls++
+			c.Assert(tpm, Equals, mockTpm)
+			c.Assert(pcrIndex, Equals, 12)
+			return nil
+		})
+		defer restore()
+
+		err := secboot.MeasureSnapSystemEpochWhenPossible()
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+		c.Assert(calls, Equals, tc.callNum)
+	}
+}
+
+func (s *secbootSuite) TestMeasureSnapModelWhenPossible(c *C) {
+	for i, tc := range []struct {
+		tpmErr     error
+		tpmEnabled bool
+		modelErr   error
+		callNum    int
+		err        string
+	}{
+		{
+			// normal connection to the TPM device
+			tpmErr: nil, tpmEnabled: true, modelErr: nil, callNum: 1, err: "",
+		},
+		{
+			// normal connection to the TPM device with model error
+			tpmErr: nil, tpmEnabled: true, modelErr: errors.New("model error"), callNum: 0,
+			err: "cannot measure snap model: model error",
+		},
+		{
+			// TPM device exists but returns error
+			tpmErr: errors.New("tpm error"), callNum: 0,
+			err: "cannot measure snap model: cannot open TPM connection: tpm error",
+		},
+		{
+			// TPM device exists but is disabled
+			tpmErr: nil, tpmEnabled: false,
+		},
+		{
+			// TPM device does not exist
+			tpmErr: sb.ErrNoTPM2Device,
+		},
+	} {
+		c.Logf("%d: tpmErr:%v tpmEnabled:%v", i, tc.tpmErr, tc.tpmEnabled)
+		mockModel := &asserts.Model{}
+
+		mockTpm, restore := mockSbTPMConnection(c, tc.tpmErr)
+		defer restore()
+
+		restore = secboot.MockIsTPMEnabled(func(tpm *sb.TPMConnection) bool {
+			return tc.tpmEnabled
+		})
+		defer restore()
+
+		calls := 0
+		restore = secboot.MockSbMeasureSnapModelToTPM(func(tpm *sb.TPMConnection, pcrIndex int, model sb.SnapModel) error {
+			calls++
+			c.Assert(tpm, Equals, mockTpm)
+			c.Assert(model, Equals, mockModel)
+			c.Assert(pcrIndex, Equals, 12)
+			return nil
+		})
+		defer restore()
+
+		findModel := func() (*asserts.Model, error) {
+			if tc.modelErr != nil {
+				return nil, tc.modelErr
+			}
+			return mockModel, nil
+		}
+
+		err := secboot.MeasureSnapModelWhenPossible(findModel)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+		c.Assert(calls, Equals, tc.callNum)
+	}
+}
+
+func (s *secbootSuite) TestLockTPMSealedKeys(c *C) {
+	tt := []struct {
+		tpmErr     error
+		tpmEnabled bool
+		lockOk     bool
+		expError   string
+	}{
+		// can't connect to tpm
+		{
+			tpmErr:   fmt.Errorf("failed to connect to tpm"),
+			expError: "cannot lock TPM: failed to connect to tpm",
+		},
+		// no TPM2 device, shouldn't return an error
+		{
+			tpmErr: sb.ErrNoTPM2Device,
+		},
+		// tpm is not enabled but we can lock it
+		{
+			tpmEnabled: false,
+			lockOk:     true,
+		},
+		// can't lock pcr protection profile
+		{
+			tpmEnabled: true,
+			lockOk:     false,
+			expError:   "block failed",
+		},
+		// tpm enabled, we can lock it
+		{
+			tpmEnabled: true,
+			lockOk:     true,
+		},
+	}
+
+	for _, tc := range tt {
+		mockSbTPM, restoreConnect := mockSbTPMConnection(c, tc.tpmErr)
+		defer restoreConnect()
+
+		restore := secboot.MockIsTPMEnabled(func(tpm *sb.TPMConnection) bool {
+			return tc.tpmEnabled
+		})
+		defer restore()
+
+		sbBlockPCRProtectionPolicesCalls := 0
+		restore = secboot.MockSbBlockPCRProtectionPolicies(func(tpm *sb.TPMConnection, pcrs []int) error {
+			sbBlockPCRProtectionPolicesCalls++
+			c.Assert(tpm, Equals, mockSbTPM)
+			c.Assert(pcrs, DeepEquals, []int{12})
+			if tc.lockOk {
+				return nil
+			}
+			return errors.New("block failed")
+		})
+		defer restore()
+
+		err := secboot.LockTPMSealedKeys()
+		if tc.expError == "" {
+			c.Assert(err, IsNil)
+		} else {
+			c.Assert(err, ErrorMatches, tc.expError)
+		}
+		// if there was no TPM connection error, we should have tried to lock it
+		if tc.tpmErr == nil {
+			c.Assert(sbBlockPCRProtectionPolicesCalls, Equals, 1)
+		} else {
+			c.Assert(sbBlockPCRProtectionPolicesCalls, Equals, 0)
+		}
+	}
+}
+
+func (s *secbootSuite) TestUnlockVolumeUsingSealedKeyIfEncrypted(c *C) {
+
+	// setup mock disks to use for locating the partition
+	// restore := disks.MockMountPointDisksToPartitionMapping()
+	// defer restore()
+
+	mockDiskWithEncDev := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"name-enc": "enc-dev-partuuid",
+		},
+	}
+
+	mockDiskWithoutAnyDev := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{},
+	}
+
+	mockDiskWithUnencDev := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"name": "unenc-dev-partuuid",
+		},
+	}
+
+	for idx, tc := range []struct {
+		tpmErr              error
+		keyfile             string // the keyfile to be used to unseal
+		tpmEnabled          bool   // TPM storage and endorsement hierarchies disabled, only relevant if TPM available
+		hasEncdev           bool   // an encrypted device exists
+		rkAllow             bool   // allow recovery key activation
+		rkErr               error  // recovery key unlock error, only relevant if TPM not available
+		activated           bool   // the activation operation succeeded
+		activateErr         error  // the activation error
+		err                 string
+		skipDiskEnsureCheck bool // whether to check to ensure the mock disk contains the device label
+		expUnlockMethod     secboot.UnlockMethod
+		disk                *disks.MockDiskMapping
+	}{
+		{
+			// happy case with tpm and encrypted device
+			tpmEnabled: true, hasEncdev: true,
+			activated:       true,
+			disk:            mockDiskWithEncDev,
+			expUnlockMethod: secboot.UnlockedWithSealedKey,
+		}, {
+			// happy case with tpm and encrypted device
+			// with an alternative keyfile
+			tpmEnabled: true, hasEncdev: true,
+			activated:       true,
+			disk:            mockDiskWithEncDev,
+			keyfile:         "some-other-keyfile",
+			expUnlockMethod: secboot.UnlockedWithSealedKey,
+		}, {
+			// device activation fails
+			tpmEnabled: true, hasEncdev: true,
+			err:  "cannot activate encrypted device .*: activation error",
+			disk: mockDiskWithEncDev,
+		}, {
+			// device activation fails
+			tpmEnabled: true, hasEncdev: true,
+			err:  "cannot activate encrypted device .*: activation error",
+			disk: mockDiskWithEncDev,
+		}, {
+			// happy case without encrypted device
+			tpmEnabled: true,
+			disk:       mockDiskWithUnencDev,
+		}, {
+			// happy case with tpm and encrypted device, activation
+			// with recovery key
+			tpmEnabled: true, hasEncdev: true, activated: true,
+			activateErr: &sb.ActivateWithTPMSealedKeyError{
+				// activation error with nil recovery key error
+				// implies volume activated successfully using
+				// the recovery key,
+				RecoveryKeyUsageErr: nil,
+			},
+			disk:            mockDiskWithEncDev,
+			expUnlockMethod: secboot.UnlockedWithRecoveryKey,
+		}, {
+			// tpm and encrypted device, successful activation, but
+			// recovery key non-nil is an unexpected state
+			tpmEnabled: true, hasEncdev: true, activated: true,
+			activateErr: &sb.ActivateWithTPMSealedKeyError{
+				RecoveryKeyUsageErr: fmt.Errorf("unexpected"),
+			},
+			expUnlockMethod: secboot.UnlockStatusUnknown,
+			err:             `internal error: volume activated with unexpected error: .* \(unexpected\)`,
+			disk:            mockDiskWithEncDev,
+		}, {
+			// tpm error, no encrypted device
+			tpmErr: errors.New("tpm error"),
+			disk:   mockDiskWithUnencDev,
+		}, {
+			// tpm error, has encrypted device
+			tpmErr: errors.New("tpm error"), hasEncdev: true,
+			err:  `cannot unlock encrypted device "name": tpm error`,
+			disk: mockDiskWithEncDev,
+		}, {
+			// tpm disabled, no encrypted device
+			disk: mockDiskWithUnencDev,
+		}, {
+			// tpm disabled, has encrypted device, unlocked using the recovery key
+			hasEncdev:       true,
+			rkAllow:         true,
+			disk:            mockDiskWithEncDev,
+			expUnlockMethod: secboot.UnlockedWithRecoveryKey,
+		}, {
+			// tpm disabled, has encrypted device, recovery key unlocking fails
+			hasEncdev: true, rkErr: errors.New("cannot unlock with recovery key"),
+			rkAllow: true,
+			disk:    mockDiskWithEncDev,
+			err:     `cannot unlock encrypted device ".*/enc-dev-partuuid": cannot unlock with recovery key`,
+		}, {
+			// no tpm, has encrypted device, unlocked using the recovery key
+			tpmErr: sb.ErrNoTPM2Device, hasEncdev: true,
+			rkAllow:         true,
+			disk:            mockDiskWithEncDev,
+			expUnlockMethod: secboot.UnlockedWithRecoveryKey,
+		}, {
+			// no tpm, has encrypted device, unlocking with recovery key not allowed
+			tpmErr: sb.ErrNoTPM2Device, hasEncdev: true,
+			disk: mockDiskWithEncDev,
+			err:  `cannot activate encrypted device ".*/enc-dev-partuuid": activation error`,
+		}, {
+			// no tpm, has encrypted device, recovery key unlocking fails
+			rkErr:  errors.New("cannot unlock with recovery key"),
+			tpmErr: sb.ErrNoTPM2Device, hasEncdev: true,
+			rkAllow: true,
+			disk:    mockDiskWithEncDev,
+			err:     `cannot unlock encrypted device ".*/enc-dev-partuuid": cannot unlock with recovery key`,
+		}, {
+			// no tpm, no encrypted device
+			tpmErr: sb.ErrNoTPM2Device,
+			disk:   mockDiskWithUnencDev,
+		}, {
+			// no disks at all
+			disk:                mockDiskWithoutAnyDev,
+			skipDiskEnsureCheck: true,
+			// error is specifically for failing to find name, NOT name-enc, we
+			// will properly fall back to looking for name if we didn't find
+			// name-enc
+			err: "error enumerating partitions for disk to find unencrypted device \"name\": filesystem label \"name\" not found",
+		},
+	} {
+		randomUUID := fmt.Sprintf("random-uuid-for-test-%d", idx)
+		restore := secboot.MockRandomKernelUUID(func() string {
+			return randomUUID
+		})
+		defer restore()
+
+		c.Logf("tc %v: %+v", idx, tc)
+		_, restoreConnect := mockSbTPMConnection(c, tc.tpmErr)
+		defer restoreConnect()
+
+		restore = secboot.MockIsTPMEnabled(func(tpm *sb.TPMConnection) bool {
+			return tc.tpmEnabled
+		})
+		defer restore()
+
+		defaultDevice := "name"
+
+		fsLabel := defaultDevice
+		if tc.hasEncdev {
+			fsLabel += "-enc"
+		}
+		partuuid, ok := tc.disk.FilesystemLabelToPartUUID[fsLabel]
+		if !tc.skipDiskEnsureCheck {
+			c.Assert(ok, Equals, true)
+		}
+		devicePath := filepath.Join("/dev/disk/by-partuuid", partuuid)
+
+		expKeyPath := tc.keyfile
+		if expKeyPath == "" {
+			expKeyPath = "vanilla-keyfile"
+		}
+
+		restore = secboot.MockSbActivateVolumeWithTPMSealedKey(func(tpm *sb.TPMConnection, volumeName, sourceDevicePath,
+			keyPath string, pinReader io.Reader, options *sb.ActivateVolumeOptions) (bool, error) {
+			c.Assert(volumeName, Equals, "name-"+randomUUID)
+			c.Assert(sourceDevicePath, Equals, devicePath)
+			c.Assert(keyPath, Equals, expKeyPath)
+			if tc.rkAllow {
+				c.Assert(*options, DeepEquals, sb.ActivateVolumeOptions{
+					PassphraseTries:  1,
+					RecoveryKeyTries: 3,
+					KeyringPrefix:    "ubuntu-fde",
+				})
+			} else {
+				c.Assert(*options, DeepEquals, sb.ActivateVolumeOptions{
+					PassphraseTries: 1,
+					// activation with recovery key was disabled
+					RecoveryKeyTries: 0,
+					KeyringPrefix:    "ubuntu-fde",
+				})
+			}
+			if !tc.activated && tc.activateErr == nil {
+				return false, errors.New("activation error")
+			}
+			return tc.activated, tc.activateErr
+		})
+		defer restore()
+
+		restore = secboot.MockSbActivateVolumeWithRecoveryKey(func(name, device string, keyReader io.Reader,
+			options *sb.ActivateVolumeOptions) error {
+			if !tc.rkAllow {
+				c.Fatalf("unexpected attempt to activate with recovery key")
+				return fmt.Errorf("unexpected call")
+			}
+			return tc.rkErr
+		})
+		defer restore()
+
+		opts := &secboot.UnlockVolumeUsingSealedKeyOptions{
+			AllowRecoveryKey: tc.rkAllow,
+		}
+		unlockRes, err := secboot.UnlockVolumeUsingSealedKeyIfEncrypted(tc.disk, defaultDevice, expKeyPath, opts)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+			c.Assert(unlockRes.IsEncrypted, Equals, tc.hasEncdev)
+			c.Assert(unlockRes.PartDevice, Equals, devicePath)
+			if tc.hasEncdev {
+				c.Assert(unlockRes.FsDevice, Equals, filepath.Join("/dev/mapper", defaultDevice+"-"+randomUUID))
+			} else {
+				c.Assert(unlockRes.FsDevice, Equals, devicePath)
+			}
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+			// also check that the IsEncrypted value matches, this is
+			// important for robust callers to know whether they should try to
+			// unlock using a different method or not
+			// this is only skipped on some test cases where we get an error
+			// very early, like trying to connect to the tpm
+			c.Assert(unlockRes.IsEncrypted, Equals, tc.hasEncdev)
+			if tc.hasEncdev {
+				c.Check(unlockRes.PartDevice, Equals, devicePath)
+				c.Check(unlockRes.FsDevice, Equals, "")
+			} else {
+				c.Check(unlockRes.PartDevice, Equals, "")
+				c.Check(unlockRes.FsDevice, Equals, "")
+			}
+		}
+
+		c.Assert(unlockRes.UnlockMethod, Equals, tc.expUnlockMethod)
+	}
+}
+
+func (s *secbootSuite) TestEFIImageFromBootFile(c *C) {
+	tmpDir := c.MkDir()
+
+	// set up some test files
+	existingFile := filepath.Join(tmpDir, "foo")
+	err := ioutil.WriteFile(existingFile, nil, 0644)
+	c.Assert(err, IsNil)
+	missingFile := filepath.Join(tmpDir, "bar")
+	snapFile := filepath.Join(tmpDir, "test.snap")
+	snapf, err := createMockSnapFile(c.MkDir(), snapFile, "app")
+
+	for _, tc := range []struct {
+		bootFile bootloader.BootFile
+		efiImage sb.EFIImage
+		err      string
+	}{
+		{
+			// happy case for EFI image
+			bootFile: bootloader.NewBootFile("", existingFile, bootloader.RoleRecovery),
+			efiImage: sb.FileEFIImage(existingFile),
+		},
+		{
+			// missing EFI image
+			bootFile: bootloader.NewBootFile("", missingFile, bootloader.RoleRecovery),
+			err:      fmt.Sprintf("file %s/bar does not exist", tmpDir),
+		},
+		{
+			// happy case for snap file
+			bootFile: bootloader.NewBootFile(snapFile, "rel", bootloader.RoleRecovery),
+			efiImage: sb.SnapFileEFIImage{Container: snapf, Path: snapFile, FileName: "rel"},
+		},
+		{
+			// invalid snap file
+			bootFile: bootloader.NewBootFile(existingFile, "rel", bootloader.RoleRecovery),
+			err:      fmt.Sprintf(`"%s/foo" is not a snap or snapdir`, tmpDir),
+		},
+		{
+			// missing snap file
+			bootFile: bootloader.NewBootFile(missingFile, "rel", bootloader.RoleRecovery),
+			err:      fmt.Sprintf(`"%s/bar" is not a snap or snapdir`, tmpDir),
+		},
+	} {
+		o, err := secboot.EFIImageFromBootFile(&tc.bootFile)
+		if tc.err == "" {
+			c.Assert(err, IsNil)
+			c.Assert(o, DeepEquals, tc.efiImage)
+		} else {
+			c.Assert(err, ErrorMatches, tc.err)
+		}
+	}
+}
+
+func (s *secbootSuite) TestSealKey(c *C) {
+	mockErr := errors.New("some error")
+
+	for _, tc := range []struct {
+		tpmErr               error
+		tpmEnabled           bool
+		missingFile          bool
+		badSnapFile          bool
+		skipProvision        bool
+		addEFISbPolicyErr    error
+		addEFIBootManagerErr error
+		addSystemdEFIStubErr error
+		addSnapModelErr      error
+		provisioningErr      error
+		sealErr              error
+		provisioningCalls    int
+		sealCalls            int
+		expectedErr          string
+	}{
+		{tpmErr: mockErr, expectedErr: "cannot connect to TPM: some error"},
+		{tpmEnabled: false, expectedErr: "TPM device is not enabled"},
+		{tpmEnabled: true, missingFile: true, expectedErr: "cannot build EFI image load sequences: file /does/not/exist does not exist"},
+		{tpmEnabled: true, badSnapFile: true, expectedErr: `.*/kernel.snap" is not a snap or snapdir`},
+		{tpmEnabled: true, addEFISbPolicyErr: mockErr, expectedErr: "cannot add EFI secure boot policy profile: some error"},
+		{tpmEnabled: true, addEFIBootManagerErr: mockErr, expectedErr: "cannot add EFI boot manager profile: some error"},
+		{tpmEnabled: true, addSystemdEFIStubErr: mockErr, expectedErr: "cannot add systemd EFI stub profile: some error"},
+		{tpmEnabled: true, addSnapModelErr: mockErr, expectedErr: "cannot add snap model profile: some error"},
+		{tpmEnabled: true, provisioningErr: mockErr, provisioningCalls: 1, expectedErr: "cannot provision TPM: some error"},
+		{tpmEnabled: true, sealErr: mockErr, provisioningCalls: 1, sealCalls: 1, expectedErr: "some error"},
+		{tpmEnabled: true, skipProvision: true, provisioningCalls: 0, sealCalls: 1, expectedErr: ""},
+		{tpmEnabled: true, provisioningCalls: 1, sealCalls: 1, expectedErr: ""},
+	} {
+		tmpDir := c.MkDir()
+		var mockBF []bootloader.BootFile
+		for _, name := range []string{"a", "b", "c", "d"} {
+			mockFileName := filepath.Join(tmpDir, name)
+			err := ioutil.WriteFile(mockFileName, nil, 0644)
+			c.Assert(err, IsNil)
+			mockBF = append(mockBF, bootloader.NewBootFile("", mockFileName, bootloader.RoleRecovery))
+		}
+
+		if tc.missingFile {
+			mockBF[0].Path = "/does/not/exist"
+		}
+
+		var kernelSnap snap.Container
+		snapPath := filepath.Join(tmpDir, "kernel.snap")
+		if tc.badSnapFile {
+			err := ioutil.WriteFile(snapPath, nil, 0644)
+			c.Assert(err, IsNil)
+		} else {
+			var err error
+			kernelSnap, err = createMockSnapFile(c.MkDir(), snapPath, "kernel")
+			c.Assert(err, IsNil)
+		}
+
+		mockBF = append(mockBF, bootloader.NewBootFile(snapPath, "kernel.efi", bootloader.RoleRecovery))
+
+		myAuthKey := &ecdsa.PrivateKey{}
+
+		myParams := secboot.SealKeysParams{
+			ModelParams: []*secboot.SealKeyModelParams{
+				{
+					EFILoadChains: []*secboot.LoadChain{
+						secboot.NewLoadChain(mockBF[0],
+							secboot.NewLoadChain(mockBF[4])),
+					},
+					KernelCmdlines: []string{"cmdline1"},
+					Model:          &asserts.Model{},
+				},
+				{
+					EFILoadChains: []*secboot.LoadChain{
+						secboot.NewLoadChain(mockBF[0],
+							secboot.NewLoadChain(mockBF[2],
+								secboot.NewLoadChain(mockBF[4])),
+							secboot.NewLoadChain(mockBF[3],
+								secboot.NewLoadChain(mockBF[4]))),
+						secboot.NewLoadChain(mockBF[1],
+							secboot.NewLoadChain(mockBF[2],
+								secboot.NewLoadChain(mockBF[4])),
+							secboot.NewLoadChain(mockBF[3],
+								secboot.NewLoadChain(mockBF[4]))),
+					},
+					KernelCmdlines: []string{"cmdline2", "cmdline3"},
+					Model:          &asserts.Model{},
+				},
+			},
+			TPMPolicyAuthKey:       myAuthKey,
+			TPMPolicyAuthKeyFile:   filepath.Join(tmpDir, "policy-auth-key-file"),
+			TPMLockoutAuthFile:     filepath.Join(tmpDir, "lockout-auth-file"),
+			TPMProvision:           !tc.skipProvision,
+			PCRPolicyCounterHandle: 42,
+		}
+
+		myKey := secboot.EncryptionKey{}
+		myKey2 := secboot.EncryptionKey{}
+		for i := range myKey {
+			myKey[i] = byte(i)
+			myKey2[i] = byte(128 + i)
+		}
+
+		myKeys := []secboot.SealKeyRequest{
+			{
+				Key:     myKey,
+				KeyFile: "keyfile",
+			},
+			{
+				Key:     myKey2,
+				KeyFile: "keyfile2",
+			},
+		}
+
+		// events for
+		// a -> kernel
+		sequences1 := []*sb.EFIImageLoadEvent{
+			{
+				Source: sb.Firmware,
+				Image:  sb.FileEFIImage(mockBF[0].Path),
+				Next: []*sb.EFIImageLoadEvent{
+					{
+						Source: sb.Shim,
+						Image: sb.SnapFileEFIImage{
+							Container: kernelSnap,
+							Path:      mockBF[4].Snap,
+							FileName:  "kernel.efi",
+						},
+					},
+				},
+			},
+		}
+
+		// "cdk" events for
+		// c -> kernel OR
+		// d -> kernel
+		cdk := []*sb.EFIImageLoadEvent{
+			{
+				Source: sb.Shim,
+				Image:  sb.FileEFIImage(mockBF[2].Path),
+				Next: []*sb.EFIImageLoadEvent{
+					{
+						Source: sb.Shim,
+						Image: sb.SnapFileEFIImage{
+							Container: kernelSnap,
+							Path:      mockBF[4].Snap,
+							FileName:  "kernel.efi",
+						},
+					},
+				},
+			},
+			{
+				Source: sb.Shim,
+				Image:  sb.FileEFIImage(mockBF[3].Path),
+				Next: []*sb.EFIImageLoadEvent{
+					{
+						Source: sb.Shim,
+						Image: sb.SnapFileEFIImage{
+							Container: kernelSnap,
+							Path:      mockBF[4].Snap,
+							FileName:  "kernel.efi",
+						},
+					},
+				},
+			},
+		}
+
+		// events for
+		// a -> "cdk"
+		// b -> "cdk"
+		sequences2 := []*sb.EFIImageLoadEvent{
+			{
+				Source: sb.Firmware,
+				Image:  sb.FileEFIImage(mockBF[0].Path),
+				Next:   cdk,
+			},
+			{
+				Source: sb.Firmware,
+				Image:  sb.FileEFIImage(mockBF[1].Path),
+				Next:   cdk,
+			},
+		}
+
+		tpm, restore := mockSbTPMConnection(c, tc.tpmErr)
+		defer restore()
+
+		// mock adding EFI secure boot policy profile
+		var pcrProfile *sb.PCRProtectionProfile
+		addEFISbPolicyCalls := 0
+		restore = secboot.MockSbAddEFISecureBootPolicyProfile(func(profile *sb.PCRProtectionProfile, params *sb.EFISecureBootPolicyProfileParams) error {
+			addEFISbPolicyCalls++
+			pcrProfile = profile
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			switch addEFISbPolicyCalls {
+			case 1:
+				c.Assert(params.LoadSequences, DeepEquals, sequences1)
+			case 2:
+				c.Assert(params.LoadSequences, DeepEquals, sequences2)
+			default:
+				c.Error("AddEFISecureBootPolicyProfile shouldn't be called a third time")
+			}
+			return tc.addEFISbPolicyErr
+		})
+		defer restore()
+
+		// mock adding EFI boot manager profile
+		addEFIBootManagerCalls := 0
+		restore = secboot.MockSbAddEFIBootManagerProfile(func(profile *sb.PCRProtectionProfile, params *sb.EFIBootManagerProfileParams) error {
+			addEFIBootManagerCalls++
+			c.Assert(profile, Equals, pcrProfile)
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			switch addEFISbPolicyCalls {
+			case 1:
+				c.Assert(params.LoadSequences, DeepEquals, sequences1)
+			case 2:
+				c.Assert(params.LoadSequences, DeepEquals, sequences2)
+			default:
+				c.Error("AddEFIBootManagerProfile shouldn't be called a third time")
+			}
+			return tc.addEFIBootManagerErr
+		})
+		defer restore()
+
+		// mock adding systemd EFI stub profile
+		addSystemdEfiStubCalls := 0
+		restore = secboot.MockSbAddSystemdEFIStubProfile(func(profile *sb.PCRProtectionProfile, params *sb.SystemdEFIStubProfileParams) error {
+			addSystemdEfiStubCalls++
+			c.Assert(profile, Equals, pcrProfile)
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			c.Assert(params.PCRIndex, Equals, 12)
+			switch addSystemdEfiStubCalls {
+			case 1:
+				c.Assert(params.KernelCmdlines, DeepEquals, myParams.ModelParams[0].KernelCmdlines)
+			case 2:
+				c.Assert(params.KernelCmdlines, DeepEquals, myParams.ModelParams[1].KernelCmdlines)
+			default:
+				c.Error("AddSystemdEFIStubProfile shouldn't be called a third time")
+			}
+			return tc.addSystemdEFIStubErr
+		})
+		defer restore()
+
+		// mock adding snap model profile
+		addSnapModelCalls := 0
+		restore = secboot.MockSbAddSnapModelProfile(func(profile *sb.PCRProtectionProfile, params *sb.SnapModelProfileParams) error {
+			addSnapModelCalls++
+			c.Assert(profile, Equals, pcrProfile)
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			c.Assert(params.PCRIndex, Equals, 12)
+			switch addSnapModelCalls {
+			case 1:
+				c.Assert(params.Models[0], DeepEquals, myParams.ModelParams[0].Model)
+			case 2:
+				c.Assert(params.Models[0], DeepEquals, myParams.ModelParams[1].Model)
+			default:
+				c.Error("AddSnapModelProfile shouldn't be called a third time")
+			}
+			return tc.addSnapModelErr
+		})
+		defer restore()
+
+		// mock provisioning
+		provisioningCalls := 0
+		restore = secboot.MockProvisionTPM(func(t *sb.TPMConnection, mode sb.ProvisionMode, newLockoutAuth []byte) error {
+			provisioningCalls++
+			c.Assert(t, Equals, tpm)
+			c.Assert(mode, Equals, sb.ProvisionModeFull)
+			c.Assert(myParams.TPMLockoutAuthFile, testutil.FilePresent)
+			return tc.provisioningErr
+		})
+		defer restore()
+
+		// mock sealing
+		sealCalls := 0
+		restore = secboot.MockSbSealKeyToTPMMultiple(func(t *sb.TPMConnection, kr []*sb.SealKeyRequest, params *sb.KeyCreationParams) (sb.TPMPolicyAuthKey, error) {
+			sealCalls++
+			c.Assert(t, Equals, tpm)
+			c.Assert(kr, DeepEquals, []*sb.SealKeyRequest{{Key: myKey[:], Path: "keyfile"}, {Key: myKey2[:], Path: "keyfile2"}})
+			c.Assert(params.AuthKey, Equals, myAuthKey)
+			c.Assert(params.PCRPolicyCounterHandle, Equals, tpm2.Handle(42))
+			return sb.TPMPolicyAuthKey{}, tc.sealErr
+		})
+		defer restore()
+
+		// mock TPM enabled check
+		restore = secboot.MockIsTPMEnabled(func(t *sb.TPMConnection) bool {
+			return tc.tpmEnabled
+		})
+		defer restore()
+
+		err := secboot.SealKeys(myKeys, &myParams)
+		if tc.expectedErr == "" {
+			c.Assert(err, IsNil)
+			c.Assert(addEFISbPolicyCalls, Equals, 2)
+			c.Assert(addSystemdEfiStubCalls, Equals, 2)
+			c.Assert(addSnapModelCalls, Equals, 2)
+			c.Assert(osutil.FileExists(myParams.TPMPolicyAuthKeyFile), Equals, true)
+		} else {
+			c.Assert(err, ErrorMatches, tc.expectedErr)
+		}
+		c.Assert(provisioningCalls, Equals, tc.provisioningCalls)
+		c.Assert(sealCalls, Equals, tc.sealCalls)
+
+	}
+}
+
+func (s *secbootSuite) TestResealKey(c *C) {
+	mockErr := errors.New("some error")
+
+	for _, tc := range []struct {
+		tpmErr               error
+		tpmEnabled           bool
+		missingFile          bool
+		addEFISbPolicyErr    error
+		addEFIBootManagerErr error
+		addSystemdEFIStubErr error
+		addSnapModelErr      error
+		provisioningErr      error
+		resealErr            error
+		resealCalls          int
+		expectedErr          string
+	}{
+		{tpmErr: mockErr, expectedErr: "cannot connect to TPM: some error"},
+		{tpmEnabled: false, expectedErr: "TPM device is not enabled"},
+		{tpmEnabled: true, missingFile: true, expectedErr: "cannot build EFI image load sequences: file .*/file.efi does not exist"},
+		{tpmEnabled: true, addEFISbPolicyErr: mockErr, expectedErr: "cannot add EFI secure boot policy profile: some error"},
+		{tpmEnabled: true, addEFIBootManagerErr: mockErr, expectedErr: "cannot add EFI boot manager profile: some error"},
+		{tpmEnabled: true, addSystemdEFIStubErr: mockErr, expectedErr: "cannot add systemd EFI stub profile: some error"},
+		{tpmEnabled: true, addSnapModelErr: mockErr, expectedErr: "cannot add snap model profile: some error"},
+		{tpmEnabled: true, resealErr: mockErr, resealCalls: 1, expectedErr: "some error"},
+		{tpmEnabled: true, resealCalls: 1, expectedErr: ""},
+	} {
+		mockTPMPolicyAuthKey := []byte{1, 3, 3, 7}
+		mockTPMPolicyAuthKeyFile := filepath.Join(c.MkDir(), "policy-auth-key-file")
+		err := ioutil.WriteFile(mockTPMPolicyAuthKeyFile, mockTPMPolicyAuthKey, 0600)
+		c.Assert(err, IsNil)
+
+		mockEFI := bootloader.NewBootFile("", filepath.Join(c.MkDir(), "file.efi"), bootloader.RoleRecovery)
+		if !tc.missingFile {
+			err := ioutil.WriteFile(mockEFI.Path, nil, 0644)
 			c.Assert(err, IsNil)
+		}
+
+		myParams := &secboot.ResealKeysParams{
+			ModelParams: []*secboot.SealKeyModelParams{
+				{
+					EFILoadChains:  []*secboot.LoadChain{secboot.NewLoadChain(mockEFI)},
+					KernelCmdlines: []string{"cmdline"},
+					Model:          &asserts.Model{},
+				},
+			},
+			KeyFiles:             []string{"keyfile", "keyfile2"},
+			TPMPolicyAuthKeyFile: mockTPMPolicyAuthKeyFile,
+		}
+
+		sequences := []*sb.EFIImageLoadEvent{
+			{
+				Source: sb.Firmware,
+				Image:  sb.FileEFIImage(mockEFI.Path),
+			},
+		}
+
+		// mock TPM connection
+		tpm, restore := mockSbTPMConnection(c, tc.tpmErr)
+		defer restore()
+
+		// mock TPM enabled check
+		restore = secboot.MockIsTPMEnabled(func(t *sb.TPMConnection) bool {
+			return tc.tpmEnabled
+		})
+		defer restore()
+
+		// mock adding EFI secure boot policy profile
+		var pcrProfile *sb.PCRProtectionProfile
+		addEFISbPolicyCalls := 0
+		restore = secboot.MockSbAddEFISecureBootPolicyProfile(func(profile *sb.PCRProtectionProfile, params *sb.EFISecureBootPolicyProfileParams) error {
+			addEFISbPolicyCalls++
+			pcrProfile = profile
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			c.Assert(params.LoadSequences, DeepEquals, sequences)
+			return tc.addEFISbPolicyErr
+		})
+		defer restore()
+
+		// mock adding EFI boot manager profile
+		addEFIBootManagerCalls := 0
+		restore = secboot.MockSbAddEFIBootManagerProfile(func(profile *sb.PCRProtectionProfile, params *sb.EFIBootManagerProfileParams) error {
+			addEFIBootManagerCalls++
+			c.Assert(profile, Equals, pcrProfile)
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			c.Assert(params.LoadSequences, DeepEquals, sequences)
+			return tc.addEFIBootManagerErr
+		})
+		defer restore()
+
+		// mock adding systemd EFI stub profile
+		addSystemdEfiStubCalls := 0
+		restore = secboot.MockSbAddSystemdEFIStubProfile(func(profile *sb.PCRProtectionProfile, params *sb.SystemdEFIStubProfileParams) error {
+			addSystemdEfiStubCalls++
+			c.Assert(profile, Equals, pcrProfile)
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			c.Assert(params.PCRIndex, Equals, 12)
+			c.Assert(params.KernelCmdlines, DeepEquals, myParams.ModelParams[0].KernelCmdlines)
+			return tc.addSystemdEFIStubErr
+		})
+		defer restore()
+
+		// mock adding snap model profile
+		addSnapModelCalls := 0
+		restore = secboot.MockSbAddSnapModelProfile(func(profile *sb.PCRProtectionProfile, params *sb.SnapModelProfileParams) error {
+			addSnapModelCalls++
+			c.Assert(profile, Equals, pcrProfile)
+			c.Assert(params.PCRAlgorithm, Equals, tpm2.HashAlgorithmSHA256)
+			c.Assert(params.PCRIndex, Equals, 12)
+			c.Assert(params.Models[0], DeepEquals, myParams.ModelParams[0].Model)
+			return tc.addSnapModelErr
+		})
+		defer restore()
+
+		// mock PCR protection policy update
+		resealCalls := 0
+		restore = secboot.MockSbUpdateKeyPCRProtectionPolicyMultiple(func(t *sb.TPMConnection, keyPaths []string, authKey sb.TPMPolicyAuthKey, profile *sb.PCRProtectionProfile) error {
+			resealCalls++
+			c.Assert(t, Equals, tpm)
+			c.Assert(keyPaths, DeepEquals, []string{"keyfile", "keyfile2"})
+			c.Assert(authKey, DeepEquals, sb.TPMPolicyAuthKey(mockTPMPolicyAuthKey))
+			c.Assert(profile, Equals, pcrProfile)
+			return tc.resealErr
+		})
+		defer restore()
+
+		err = secboot.ResealKeys(myParams)
+		if tc.expectedErr == "" {
+			c.Assert(err, IsNil)
+			c.Assert(addEFISbPolicyCalls, Equals, 1)
+			c.Assert(addSystemdEfiStubCalls, Equals, 1)
+			c.Assert(addSnapModelCalls, Equals, 1)
 		} else {
-			c.Assert(err, ErrorMatches, t.errStr)
+			c.Assert(err, ErrorMatches, tc.expectedErr)
+		}
+		c.Assert(resealCalls, Equals, tc.resealCalls)
+	}
+}
+
+func (s *secbootSuite) TestSealKeyNoModelParams(c *C) {
+	myKeys := []secboot.SealKeyRequest{
+		{
+			Key:     secboot.EncryptionKey{},
+			KeyFile: "keyfile",
+		},
+	}
+	myParams := secboot.SealKeysParams{
+		TPMPolicyAuthKeyFile: "policy-auth-key-file",
+		TPMLockoutAuthFile:   "lockout-auth-file",
+	}
+
+	err := secboot.SealKeys(myKeys, &myParams)
+	c.Assert(err, ErrorMatches, "at least one set of model-specific parameters is required")
+}
+
+func createMockSnapFile(snapDir, snapPath, snapType string) (snap.Container, error) {
+	snapYamlPath := filepath.Join(snapDir, "meta/snap.yaml")
+	if err := os.MkdirAll(filepath.Dir(snapYamlPath), 0755); err != nil {
+		return nil, err
+	}
+	if err := ioutil.WriteFile(snapYamlPath, []byte("name: foo"), 0644); err != nil {
+		return nil, err
+	}
+	sqfs := squashfs.New(snapPath)
+	if err := sqfs.Build(snapDir, &squashfs.BuildOpts{SnapType: snapType}); err != nil {
+		return nil, err
+	}
+	return snapfile.Open(snapPath)
+}
+
+func mockSbTPMConnection(c *C, tpmErr error) (*sb.TPMConnection, func()) {
+	tcti, err := os.Open("/dev/null")
+	c.Assert(err, IsNil)
+	tpmctx, err := tpm2.NewTPMContext(tcti)
+	c.Assert(err, IsNil)
+	tpm := &sb.TPMConnection{TPMContext: tpmctx}
+	restore := secboot.MockSbConnectToDefaultTPM(func() (*sb.TPMConnection, error) {
+		if tpmErr != nil {
+			return nil, tpmErr
 		}
+		return tpm, nil
+	})
+	return tpm, restore
+}
+
+func (s *secbootSuite) TestUnlockEncryptedVolumeUsingKeyBadDisk(c *C) {
+	disk := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{},
+	}
+	unlockRes, err := secboot.UnlockEncryptedVolumeUsingKey(disk, "ubuntu-save", []byte("fooo"))
+	c.Assert(err, ErrorMatches, `filesystem label "ubuntu-save-enc" not found`)
+	c.Check(unlockRes, DeepEquals, secboot.UnlockResult{})
+}
+
+func (s *secbootSuite) TestUnlockEncryptedVolumeUsingKeyHappy(c *C) {
+	disk := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-save-enc": "123-123-123",
+		},
+	}
+	restore := secboot.MockRandomKernelUUID(func() string {
+		return "random-uuid-123-123"
+	})
+	defer restore()
+	restore = secboot.MockSbActivateVolumeWithKey(func(volumeName, sourceDevicePath string, key []byte,
+		options *sb.ActivateVolumeOptions) error {
+		c.Check(options, DeepEquals, &sb.ActivateVolumeOptions{})
+		c.Check(key, DeepEquals, []byte("fooo"))
+		c.Check(volumeName, Matches, "ubuntu-save-random-uuid-123-123")
+		c.Check(sourceDevicePath, Equals, "/dev/disk/by-partuuid/123-123-123")
+		return nil
+	})
+	defer restore()
+	unlockRes, err := secboot.UnlockEncryptedVolumeUsingKey(disk, "ubuntu-save", []byte("fooo"))
+	c.Assert(err, IsNil)
+	c.Check(unlockRes, DeepEquals, secboot.UnlockResult{
+		PartDevice:   "/dev/disk/by-partuuid/123-123-123",
+		FsDevice:     "/dev/mapper/ubuntu-save-random-uuid-123-123",
+		IsEncrypted:  true,
+		UnlockMethod: secboot.UnlockedWithKey,
+	})
+}
+
+func (s *secbootSuite) TestUnlockEncryptedVolumeUsingKeyErr(c *C) {
+	disk := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"ubuntu-save-enc": "123-123-123",
+		},
+	}
+	restore := secboot.MockRandomKernelUUID(func() string {
+		return "random-uuid-123-123"
+	})
+	defer restore()
+	restore = secboot.MockSbActivateVolumeWithKey(func(volumeName, sourceDevicePath string, key []byte,
+		options *sb.ActivateVolumeOptions) error {
+		return fmt.Errorf("failed")
+	})
+	defer restore()
+	unlockRes, err := secboot.UnlockEncryptedVolumeUsingKey(disk, "ubuntu-save", []byte("fooo"))
+	c.Assert(err, ErrorMatches, "failed")
+	// we would have at least identified that the device is a decrypted one
+	c.Check(unlockRes, DeepEquals, secboot.UnlockResult{
+		IsEncrypted: true,
+		PartDevice:  "/dev/disk/by-partuuid/123-123-123",
+		FsDevice:    "",
+	})
+}
+
+func (s *secbootSuite) TestUnlockVolumeUsingSealedKeyIfEncryptedFdeRevealKeyTruncatesStreamFiles(c *C) {
+	// this test uses a real systemd-run --user so check here if that
+	// actually works
+	if output, err := exec.Command("systemd-run", "--user", "--wait", "--collect", "true").CombinedOutput(); err != nil {
+		c.Skip(fmt.Sprintf("systemd-run not working: %v", osutil.OutputErr(output, err)))
+	}
+
+	// create the temporary output file streams with garbage data to ensure that
+	// by the time the hook runs the files are emptied and recreated with the
+	// right permissions
+	streamFiles := []string{}
+	for _, stream := range []string{"stdin", "stdout", "stderr"} {
+		streamFile := filepath.Join(dirs.GlobalRootDir, "/run/fde-reveal-key/fde-reveal-key."+stream)
+		streamFiles = append(streamFiles, streamFile)
+		// make the dir 0700
+		err := os.MkdirAll(filepath.Dir(streamFile), 0700)
+		c.Assert(err, IsNil)
+		// but make the file world-readable as it should be reset to 0600 before
+		// the hook is run
+		err = ioutil.WriteFile(streamFile, []byte("blah blah blah blah blah blah blah blah blah blah"), 0755)
+		c.Assert(err, IsNil)
+	}
+
+	restore := secboot.MockFDEHasRevealKey(func() bool {
+		return true
+	})
+	defer restore()
+
+	// the hook script only verifies that the stdout file is empty since we
+	// need to write to the stderr file for performing the test, but we still
+	// check the stderr file for correct permissions
+	mockSystemdRun := testutil.MockCommand(c, "fde-reveal-key", fmt.Sprintf(`
+# check that stdin has the right sealed key content 
+if [ "$(cat %[1]s)" != "{\"op\":\"reveal\",\"sealed-key\":\"AQIDBA==\",\"key-name\":\"name\"}" ]; then
+	echo "test failed: stdin file has wrong content: $(cat %[1]s)" 1>&2
+else
+	echo "stdin file has correct content" 1>&2
+fi
+
+# check that stdout is empty
+if [ -n "$(cat %[2]s)" ]; then
+	echo "test failed: stdout file is not empty: $(cat %[2]s)" 1>&2
+else
+	echo "stdout file is correctly empty" 1>&2
+fi
+
+# check that stdin has the right 600 perms
+if [ "$(stat --format=%%a %[1]s)" != "600" ]; then
+	echo "test failed: stdin file has wrong permissions: $(stat --format=%%a %[1]s)" 1>&2
+else 
+	echo "stdin file has correct 600 permissions" 1>&2
+fi
+
+# check that stdout has the right 600 perms
+if [ "$(stat --format=%%a %[2]s)" != "600" ]; then
+	echo "test failed: stdout file has wrong permissions: $(stat --format=%%a %[2]s)" 1>&2
+else 
+	echo "stdout file has correct 600 permissions" 1>&2
+fi
+
+# check that stderr has the right 600 perms
+if [ "$(stat --format=%%a %[3]s)" != "600" ]; then
+	echo "test failed: stderr file has wrong permissions: $(stat --format=%%a %[3]s)" 1>&2
+else 
+	echo "stderr file has correct 600 permissions" 1>&2
+fi
+
+echo "making the hook always fail for simpler test code" 1>&2
+
+# always make the hook exit 1 for simpler test code
+exit 1
+`, streamFiles[0], streamFiles[1], streamFiles[2]))
+	defer mockSystemdRun.Restore()
+	restore = secboot.MockFdeRevealKeyCommandExtra([]string{"--user"})
+	defer restore()
+
+	mockDiskWithEncDev := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"name-enc": "enc-dev-partuuid",
+		},
+	}
+	defaultDevice := "name"
+	mockSealedKeyFile := filepath.Join(c.MkDir(), "vanilla-keyfile")
+	err := ioutil.WriteFile(mockSealedKeyFile, []byte{1, 2, 3, 4}, 0600)
+	c.Assert(err, IsNil)
+
+	opts := &secboot.UnlockVolumeUsingSealedKeyOptions{}
+	_, err = secboot.UnlockVolumeUsingSealedKeyIfEncrypted(mockDiskWithEncDev, defaultDevice, mockSealedKeyFile, opts)
+	c.Assert(err, ErrorMatches, `(?s)cannot run fde-reveal-key: 
+-----
+stdin file has correct content
+stdout file is correctly empty
+stdin file has correct 600 permissions
+stdout file has correct 600 permissions
+stderr file has correct 600 permissions
+making the hook always fail for simpler test code
+service result: exit-code
+-----`)
+	// ensure no tmp files are left behind
+	c.Check(osutil.FileExists(filepath.Join(dirs.GlobalRootDir, "/run/fde-reveal-key")), Equals, false)
+}
+
+func (s *secbootSuite) TestUnlockVolumeUsingSealedKeyIfEncryptedFdeRevealKeyErr(c *C) {
+	// this test uses a real systemd-run --user so check here if that
+	// actually works
+	if output, err := exec.Command("systemd-run", "--user", "--wait", "--collect", "true").CombinedOutput(); err != nil {
+		c.Skip(fmt.Sprintf("systemd-run not working: %v", osutil.OutputErr(output, err)))
+	}
+
+	restore := secboot.MockFDEHasRevealKey(func() bool {
+		return true
+	})
+	defer restore()
+
+	mockSystemdRun := testutil.MockCommand(c, "fde-reveal-key", `echo failed 1>&2; false`)
+	defer mockSystemdRun.Restore()
+	restore = secboot.MockFdeRevealKeyCommandExtra([]string{"--user"})
+	defer restore()
+
+	mockDiskWithEncDev := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"name-enc": "enc-dev-partuuid",
+		},
 	}
+	defaultDevice := "name"
+	mockSealedKeyFile := filepath.Join(c.MkDir(), "vanilla-keyfile")
+	err := ioutil.WriteFile(mockSealedKeyFile, []byte{1, 2, 3, 4}, 0600)
+	c.Assert(err, IsNil)
+
+	opts := &secboot.UnlockVolumeUsingSealedKeyOptions{}
+	_, err = secboot.UnlockVolumeUsingSealedKeyIfEncrypted(mockDiskWithEncDev, defaultDevice, mockSealedKeyFile, opts)
+	c.Assert(err, ErrorMatches, `(?s)cannot run fde-reveal-key: 
+-----
+failed
+service result: exit-code
+-----`)
+	// ensure no tmp files are left behind
+	c.Check(osutil.FileExists(filepath.Join(dirs.GlobalRootDir, "/run/fde-reveal-key")), Equals, false)
+}
+
+func (s *secbootSuite) TestUnlockVolumeUsingSealedKeyIfEncryptedFdeRevealKey(c *C) {
+	// this test uses a real systemd-run --user so check here if that
+	// actually works
+	if output, err := exec.Command("systemd-run", "--user", "--wait", "--collect", "true").CombinedOutput(); err != nil {
+		c.Skip(fmt.Sprintf("systemd-run not working: %v", osutil.OutputErr(output, err)))
+	}
+
+	restore := secboot.MockFDEHasRevealKey(func() bool {
+		return true
+	})
+	defer restore()
+
+	restore = secboot.MockRandomKernelUUID(func() string {
+		return "random-uuid-for-test"
+	})
+	defer restore()
+
+	mockDiskWithEncDev := &disks.MockDiskMapping{
+		FilesystemLabelToPartUUID: map[string]string{
+			"name-enc": "enc-dev-partuuid",
+		},
+	}
+
+	restore = secboot.MockFdeRevealKeyCommandExtra([]string{"--user"})
+	defer restore()
+	fdeRevealKeyStdin := filepath.Join(c.MkDir(), "stdin")
+	mockSystemdRun := testutil.MockCommand(c, "fde-reveal-key", fmt.Sprintf(`
+cat - > %s
+printf "unsealed-key-from-hook"
+`, fdeRevealKeyStdin))
+	defer mockSystemdRun.Restore()
+
+	restore = secboot.MockSbActivateVolumeWithKey(func(volumeName, sourceDevicePath string, key []byte, options *sb.ActivateVolumeOptions) error {
+		c.Check(string(key), Equals, "unsealed-key-from-hook")
+		return nil
+	})
+	defer restore()
+
+	defaultDevice := "name"
+	mockSealedKeyFile := filepath.Join(c.MkDir(), "vanilla-keyfile")
+	err := ioutil.WriteFile(mockSealedKeyFile, []byte("sealed-key"), 0600)
+	c.Assert(err, IsNil)
+
+	opts := &secboot.UnlockVolumeUsingSealedKeyOptions{}
+	res, err := secboot.UnlockVolumeUsingSealedKeyIfEncrypted(mockDiskWithEncDev, defaultDevice, mockSealedKeyFile, opts)
+	c.Assert(err, IsNil)
+	c.Check(res, DeepEquals, secboot.UnlockResult{
+		UnlockMethod: secboot.UnlockedWithSealedKey,
+		IsEncrypted:  true,
+		PartDevice:   "/dev/disk/by-partuuid/enc-dev-partuuid",
+		FsDevice:     "/dev/mapper/name-random-uuid-for-test",
+	})
+	c.Check(mockSystemdRun.Calls(), DeepEquals, [][]string{
+		{"fde-reveal-key"},
+	})
+	c.Check(fdeRevealKeyStdin, testutil.FileEquals, fmt.Sprintf(`{"op":"reveal","sealed-key":%q,"key-name":"name"}`, base64.StdEncoding.EncodeToString([]byte("sealed-key"))))
+
+	// ensure no tmp files are left behind
+	c.Check(osutil.FileExists(filepath.Join(dirs.GlobalRootDir, "/run/fde-reveal-key")), Equals, false)
+}
+
+func (s *secbootSuite) TestLockSealedKeysCallsFdeReveal(c *C) {
+	// this test uses a real systemd-run --user so check here if that
+	// actually works
+	if output, err := exec.Command("systemd-run", "--user", "--wait", "--collect", "true").CombinedOutput(); err != nil {
+		c.Skip(fmt.Sprintf("systemd-run not working: %v", osutil.OutputErr(output, err)))
+	}
+
+	restore := secboot.MockFDEHasRevealKey(func() bool {
+		return true
+	})
+	defer restore()
+
+	restore = secboot.MockFdeRevealKeyCommandExtra([]string{"--user"})
+	defer restore()
+	fdeRevealKeyStdin := filepath.Join(c.MkDir(), "stdin")
+	mockSystemdRun := testutil.MockCommand(c, "fde-reveal-key", fmt.Sprintf(`
+cat - > %s
+`, fdeRevealKeyStdin))
+	defer mockSystemdRun.Restore()
+
+	err := secboot.LockSealedKeys()
+	c.Assert(err, IsNil)
+	c.Check(mockSystemdRun.Calls(), DeepEquals, [][]string{
+		{"fde-reveal-key"},
+	})
+	c.Check(fdeRevealKeyStdin, testutil.FileEquals, `{"op":"lock"}`)
+
+	// ensure no tmp files are left behind
+	c.Check(osutil.FileExists(filepath.Join(dirs.GlobalRootDir, "/run/fde-reveal-key")), Equals, false)
+}
+
+func (s *secbootSuite) TestLockSealedKeysHonorsRuntimeMax(c *C) {
+	// this test uses a real systemd-run --user so check here if that
+	// actually works
+	if output, err := exec.Command("systemd-run", "--user", "--wait", "--collect", "true").CombinedOutput(); err != nil {
+		c.Skip(fmt.Sprintf("systemd-run not working: %v", osutil.OutputErr(output, err)))
+	}
+
+	restore := secboot.MockFDEHasRevealKey(func() bool {
+		return true
+	})
+	defer restore()
+
+	restore = secboot.MockFdeRevealKeyCommandExtra([]string{"--user"})
+	defer restore()
+	mockSystemdRun := testutil.MockCommand(c, "fde-reveal-key", "sleep 60")
+	defer mockSystemdRun.Restore()
+
+	restore = secboot.MockFdeRevealKeyPollWaitParanoiaFactor(100)
+	defer restore()
+
+	restore = secboot.MockFdeRevealKeyRuntimeMax(100 * time.Millisecond)
+	defer restore()
+
+	err := secboot.LockSealedKeys()
+	c.Assert(err, ErrorMatches, `cannot run fde-reveal-key "lock": service result: timeout`)
+}
+
+func (s *secbootSuite) TestLockSealedKeysHonorsParanoia(c *C) {
+	// this test uses a real systemd-run --user so check here if that
+	// actually works
+	if output, err := exec.Command("systemd-run", "--user", "--wait", "--collect", "true").CombinedOutput(); err != nil {
+		c.Skip(fmt.Sprintf("systemd-run not working: %v", osutil.OutputErr(output, err)))
+	}
+
+	restore := secboot.MockFDEHasRevealKey(func() bool {
+		return true
+	})
+	defer restore()
+
+	restore = secboot.MockFdeRevealKeyCommandExtra([]string{"--user"})
+	defer restore()
+	mockSystemdRun := testutil.MockCommand(c, "fde-reveal-key", "sleep 60")
+	defer mockSystemdRun.Restore()
+
+	restore = secboot.MockFdeRevealKeyPollWaitParanoiaFactor(1)
+	defer restore()
+
+	// shorter than the fdeRevealKeyPollWait time
+	restore = secboot.MockFdeRevealKeyRuntimeMax(1 * time.Millisecond)
+	defer restore()
+
+	err := secboot.LockSealedKeys()
+	c.Assert(err, ErrorMatches, `cannot run fde-reveal-key "lock": internal error: systemd-run did not honor RuntimeMax=1ms setting`)
 }
diff -Nru snapd-2.45.1+20.04.2/secboot/tpm.go snapd-2.48.3+20.04/secboot/tpm.go
--- snapd-2.45.1+20.04.2/secboot/tpm.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/tpm.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,230 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build !nosecboot
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package secboot
-
-import (
-	"crypto/rand"
-	"fmt"
-
-	"github.com/canonical/go-tpm2"
-	sb "github.com/snapcore/secboot"
-
-	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/osutil"
-)
-
-const (
-	// Handles are in the block reserved for owner objects (0x01800000 - 0x01bfffff)
-	pinHandle = 0x01800000
-)
-
-type tpmSupport struct {
-	// Connection to the TPM device
-	tconn *sb.TPMConnection
-	// Lockout authorization
-	lockoutAuth []byte
-	// Paths to shim files
-	shimFiles []string
-	// Paths to bootloader files
-	bootloaderFiles []string
-	// Paths to kernel files
-	kernelFiles []string
-	// Kernel command lines
-	kernelCmdlines []string
-	// Snap models
-	models []*asserts.Model
-}
-
-func NewTPMSupport() (*tpmSupport, error) {
-	tconn, err := sb.ConnectToDefaultTPM()
-	if err != nil {
-		return nil, fmt.Errorf("cannot connect to default TPM: %v", err)
-	}
-
-	lockoutAuth := make([]byte, 16)
-	// crypto rand is protected against short reads
-	_, err = rand.Read(lockoutAuth)
-	if err != nil {
-		return nil, fmt.Errorf("cannot create lockout authorization: %v", err)
-	}
-
-	t := &tpmSupport{tconn: tconn, lockoutAuth: lockoutAuth}
-
-	return t, nil
-}
-
-// StoreLockoutAuth saves the lockout authorization data in a file at the
-// path specified by filename.
-func (t *tpmSupport) StoreLockoutAuth(filename string) error {
-	if err := osutil.AtomicWriteFile(filename, t.lockoutAuth, 0600, 0); err != nil {
-		return err
-	}
-	return nil
-}
-
-// SetShimFiles verifies and sets the list of shim binaries.
-func (t *tpmSupport) SetShimFiles(pathList ...string) error {
-	if err := checkFilesPresence(pathList); err != nil {
-		return err
-	}
-	t.shimFiles = pathList
-	return nil
-}
-
-// SetBootloaderFiles verifies and sets the list of bootloader binaries.
-func (t *tpmSupport) SetBootloaderFiles(pathList ...string) error {
-	if err := checkFilesPresence(pathList); err != nil {
-		return err
-	}
-	t.bootloaderFiles = pathList
-	return nil
-}
-
-// SetKernelFiles verifies and sets the list of kernel binaries.
-func (t *tpmSupport) SetKernelFiles(pathList ...string) error {
-	if err := checkFilesPresence(pathList); err != nil {
-		return err
-	}
-	t.kernelFiles = pathList
-	return nil
-}
-
-func checkFilesPresence(pathList []string) error {
-	for _, p := range pathList {
-		if !osutil.FileExists(p) {
-			return fmt.Errorf("file %s does not exist", p)
-		}
-	}
-	return nil
-}
-
-var (
-	sbProvisionTPM = sb.ProvisionTPM
-)
-
-// Provision provisions the TPM. This will fail on a device that has
-// previously been provisioned.
-func (t *tpmSupport) Provision() error {
-	if err := sbProvisionTPM(t.tconn, sb.ProvisionModeFull, t.lockoutAuth); err != nil {
-		return fmt.Errorf("cannot provision TPM: %v", err)
-	}
-
-	return nil
-}
-
-// Close closes the TPM connection.
-func (t *tpmSupport) Close() error {
-	if err := t.tconn.Close(); err != nil {
-		return fmt.Errorf("cannot close TPM connection: %v", err)
-	}
-	return nil
-}
-
-func (t *tpmSupport) SetKernelCmdlines(cmdlines []string) {
-	t.kernelCmdlines = cmdlines
-}
-
-func (t *tpmSupport) SetModels(models []*asserts.Model) {
-	t.models = models
-}
-
-var (
-	sbSealKeyToTPM                  = sb.SealKeyToTPM
-	sbAddEFISecureBootPolicyProfile = sb.AddEFISecureBootPolicyProfile
-	sbAddSystemdEFIStubProfile      = sb.AddSystemdEFIStubProfile
-	sbAddSnapModelProfile           = sb.AddSnapModelProfile
-)
-
-// Seal seals the given key to the TPM and writes the sealed object to a file at the
-// path specified by keyPath. Additional data required for updating the authorization
-// policy is written to a file at the path specified by policyUpdatePath. This file
-// must live inside an encrypted volume protected by this key.
-func (t *tpmSupport) Seal(key []byte, keyPath, policyUpdatePath string) error {
-	pcrProfile := sb.NewPCRProtectionProfile()
-
-	// Add EFI secure boot policy profile
-	policyParams := sb.EFISecureBootPolicyProfileParams{
-		PCRAlgorithm:  tpm2.HashAlgorithmSHA256,
-		LoadSequences: make([]*sb.EFIImageLoadEvent, 0, len(t.shimFiles)),
-		// TODO:UC20: set SignatureDbUpdateKeystore to support key rotation
-	}
-
-	for _, shim := range t.shimFiles {
-		s := &sb.EFIImageLoadEvent{
-			Source: sb.Firmware,
-			Image:  sb.FileEFIImage(shim),
-			Next:   make([]*sb.EFIImageLoadEvent, 0, len(t.bootloaderFiles)),
-		}
-		for _, bl := range t.bootloaderFiles {
-			g := &sb.EFIImageLoadEvent{
-				Source: sb.Shim,
-				Image:  sb.FileEFIImage(bl),
-				Next:   make([]*sb.EFIImageLoadEvent, 0, len(t.kernelFiles)),
-			}
-			for _, kernel := range t.kernelFiles {
-				k := &sb.EFIImageLoadEvent{
-					Source: sb.Shim,
-					Image:  sb.FileEFIImage(kernel),
-				}
-				g.Next = append(g.Next, k)
-			}
-			s.Next = append(s.Next, g)
-		}
-		policyParams.LoadSequences = append(policyParams.LoadSequences, s)
-	}
-
-	if err := sbAddEFISecureBootPolicyProfile(pcrProfile, &policyParams); err != nil {
-		return fmt.Errorf("cannot add EFI secure boot policy profile: %v", err)
-	}
-
-	// Add systemd EFI stub profile
-	systemdStubParams := sb.SystemdEFIStubProfileParams{
-		PCRAlgorithm:   tpm2.HashAlgorithmSHA256,
-		PCRIndex:       12,
-		KernelCmdlines: t.kernelCmdlines,
-	}
-	if err := sbAddSystemdEFIStubProfile(pcrProfile, &systemdStubParams); err != nil {
-		return fmt.Errorf("cannot add systemd EFI stub profile: %v", err)
-	}
-
-	// Add snap model profile
-	if len(t.models) != 0 {
-		snapModelParams := sb.SnapModelProfileParams{
-			PCRAlgorithm: tpm2.HashAlgorithmSHA256,
-			PCRIndex:     12,
-			Models:       t.models,
-		}
-		if err := sbAddSnapModelProfile(pcrProfile, &snapModelParams); err != nil {
-			return fmt.Errorf("cannot add snap model profile: %v", err)
-		}
-	}
-
-	// Seal key to the TPM
-	creationParams := sb.KeyCreationParams{
-		PCRProfile: pcrProfile,
-		PINHandle:  pinHandle,
-	}
-	if err := sbSealKeyToTPM(t.tconn, key, keyPath, policyUpdatePath, &creationParams); err != nil {
-		return fmt.Errorf("cannot seal data: %v", err)
-	}
-
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/secboot/tpm_test.go snapd-2.48.3+20.04/secboot/tpm_test.go
--- snapd-2.45.1+20.04.2/secboot/tpm_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/secboot/tpm_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,252 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-// +build !nosecboot
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package secboot_test
-
-import (
-	"io/ioutil"
-	"path/filepath"
-
-	"github.com/canonical/go-tpm2"
-	sb "github.com/snapcore/secboot"
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/asserts"
-	"github.com/snapcore/snapd/dirs"
-	"github.com/snapcore/snapd/secboot"
-	"github.com/snapcore/snapd/testutil"
-)
-
-type secbootTPMSuite struct {
-	testutil.BaseTest
-
-	dir string
-}
-
-var _ = Suite(&secbootTPMSuite{})
-
-func (s *secbootTPMSuite) SetUpTest(c *C) {
-	s.BaseTest.SetUpTest(c)
-
-	s.dir = c.MkDir()
-	dirs.SetRootDir(s.dir)
-	s.AddCleanup(func() { dirs.SetRootDir("/") })
-}
-
-func (s *secbootTPMSuite) TestProvision(c *C) {
-	n := 0
-	restore := secboot.MockSbProvisionTPM(func(tpm *sb.TPMConnection, mode sb.ProvisionMode, newLockoutAuth []byte) error {
-		c.Assert(mode, Equals, sb.ProvisionModeFull)
-		n++
-		return nil
-	})
-	defer restore()
-
-	t := secboot.TPMSupport{}
-	err := t.Provision()
-	c.Assert(err, IsNil)
-	c.Assert(n, Equals, 1)
-}
-
-func (s *secbootTPMSuite) TestSeal(c *C) {
-	myKey := []byte("528491")
-	myKeyPath := "keyFilename"
-	myPolicyUpdatePath := "policyUpdateFilename"
-
-	// dummy OS component files
-	shim1 := filepath.Join(s.dir, "shim1")
-	shim2 := filepath.Join(s.dir, "shim2")
-	grub1 := filepath.Join(s.dir, "grub1")
-	grub2 := filepath.Join(s.dir, "grub2")
-	kernel1 := filepath.Join(s.dir, "kernel1")
-	kernel2 := filepath.Join(s.dir, "kernel2")
-
-	shimFiles := []string{shim1, shim2}
-	grubFiles := []string{grub1, grub2}
-	kernelFiles := []string{kernel1, kernel2}
-
-	files := append(shimFiles, grubFiles...)
-	files = append(files, kernelFiles...)
-
-	for _, p := range files {
-		c.Assert(ioutil.WriteFile(p, nil, 0644), IsNil)
-	}
-
-	t := secboot.TPMSupport{}
-	c.Assert(t.SetShimFiles(shim1, shim2), IsNil)
-	c.Assert(t.SetBootloaderFiles(grub1, grub2), IsNil)
-	c.Assert(t.SetKernelFiles(kernel1, kernel2), IsNil)
-
-	cmdlines := []string{"cmdline1", "cmdline2"}
-	t.SetKernelCmdlines(cmdlines)
-
-	models := []*asserts.Model{{}, {}}
-	t.SetModels(models)
-
-	loadSequences := []*sb.EFIImageLoadEvent{
-		{
-			Source: sb.Firmware,
-			Image:  sb.FileEFIImage(shim1),
-			Next: []*sb.EFIImageLoadEvent{
-				{
-					Source: sb.Shim,
-					Image:  sb.FileEFIImage(grub1),
-					Next: []*sb.EFIImageLoadEvent{
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel1),
-						},
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel2),
-						},
-					},
-				},
-				{
-					Source: sb.Shim,
-					Image:  sb.FileEFIImage(grub2),
-					Next: []*sb.EFIImageLoadEvent{
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel1),
-						},
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel2),
-						},
-					},
-				},
-			},
-		},
-		{
-			Source: sb.Firmware,
-			Image:  sb.FileEFIImage(shim2),
-			Next: []*sb.EFIImageLoadEvent{
-				{
-					Source: sb.Shim,
-					Image:  sb.FileEFIImage(grub1),
-					Next: []*sb.EFIImageLoadEvent{
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel1),
-						},
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel2),
-						},
-					},
-				},
-				{
-					Source: sb.Shim,
-					Image:  sb.FileEFIImage(grub2),
-					Next: []*sb.EFIImageLoadEvent{
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel1),
-						},
-						{
-							Source: sb.Shim,
-							Image:  sb.FileEFIImage(kernel2),
-						},
-					},
-				},
-			},
-		},
-	}
-
-	sbRestore := secboot.MockSbAddEFISecureBootPolicyProfile(func(profile *sb.PCRProtectionProfile,
-		params *sb.EFISecureBootPolicyProfileParams) error {
-		c.Assert(*params, DeepEquals, sb.EFISecureBootPolicyProfileParams{
-			PCRAlgorithm:  tpm2.HashAlgorithmSHA256,
-			LoadSequences: loadSequences,
-		})
-		return nil
-	})
-	defer sbRestore()
-
-	stubRestore := secboot.MockSbAddSystemdEFIStubProfile(func(profile *sb.PCRProtectionProfile, params *sb.SystemdEFIStubProfileParams) error {
-		c.Assert(*params, DeepEquals, sb.SystemdEFIStubProfileParams{
-			PCRAlgorithm:   tpm2.HashAlgorithmSHA256,
-			PCRIndex:       12,
-			KernelCmdlines: cmdlines,
-		})
-		return nil
-	})
-	defer stubRestore()
-
-	var sbAddSnapModelProfileCalled int
-	modelProfileRestore := secboot.MockSbAddSnapModelProfile(func(profile *sb.PCRProtectionProfile, params *sb.SnapModelProfileParams) error {
-		c.Assert(*params, DeepEquals, sb.SnapModelProfileParams{
-			PCRAlgorithm: tpm2.HashAlgorithmSHA256,
-			PCRIndex:     12,
-			Models:       models,
-		})
-		sbAddSnapModelProfileCalled++
-		return nil
-	})
-	defer modelProfileRestore()
-
-	var sbSealKeyToTPMCalled int
-	sealRestore := secboot.MockSbSealKeyToTPM(func(tpm *sb.TPMConnection, key []byte, keyPath, policyUpdatePath string, params *sb.KeyCreationParams) error {
-		c.Assert(key, DeepEquals, myKey)
-		c.Assert(keyPath, Equals, myKeyPath)
-		c.Assert(policyUpdatePath, Equals, policyUpdatePath)
-		c.Assert(params.PINHandle, Equals, tpm2.Handle(0x01800000))
-		sbSealKeyToTPMCalled++
-		return nil
-	})
-	defer sealRestore()
-
-	err := t.Seal(myKey, myKeyPath, myPolicyUpdatePath)
-	c.Assert(err, IsNil)
-	c.Assert(sbSealKeyToTPMCalled, Equals, 1)
-	c.Assert(sbAddSnapModelProfileCalled, Equals, 1)
-}
-
-func (s *secbootTPMSuite) TestSetFiles(c *C) {
-	t := &secboot.TPMSupport{}
-
-	p1 := filepath.Join(s.dir, "f1")
-	c.Assert(ioutil.WriteFile(p1, nil, 0644), IsNil)
-
-	// set shim files
-	err := t.SetShimFiles("foo")
-	c.Assert(err, ErrorMatches, "file foo does not exist")
-	err = t.SetShimFiles(p1, "bar")
-	c.Assert(err, ErrorMatches, "file bar does not exist")
-	err = t.SetShimFiles(p1)
-	c.Assert(err, IsNil)
-
-	// set bootloader
-	err = t.SetBootloaderFiles("foo")
-	c.Assert(err, ErrorMatches, "file foo does not exist")
-	err = t.SetBootloaderFiles(p1, "bar")
-	c.Assert(err, ErrorMatches, "file bar does not exist")
-	err = t.SetBootloaderFiles(p1)
-	c.Assert(err, IsNil)
-
-	// set kernel files
-	err = t.SetKernelFiles("foo")
-	c.Assert(err, ErrorMatches, "file foo does not exist")
-	err = t.SetKernelFiles(p1, "bar")
-	c.Assert(err, ErrorMatches, "file bar does not exist")
-	err = t.SetKernelFiles(p1)
-	c.Assert(err, IsNil)
-}
diff -Nru snapd-2.45.1+20.04.2/seed/export_test.go snapd-2.48.3+20.04/seed/export_test.go
--- snapd-2.45.1+20.04.2/seed/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,6 +27,4 @@
 
 var (
 	LoadAssertions = loadAssertions
-
-	ValidateUC20SeedSystemLabel = validateUC20SeedSystemLabel
 )
diff -Nru snapd-2.45.1+20.04.2/seed/helpers.go snapd-2.48.3+20.04/seed/helpers.go
--- snapd-2.45.1+20.04.2/seed/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2016-2019 Canonical Ltd
+ * Copyright (C) 2016-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -142,12 +142,8 @@
 }
 
 func findBrand(seed Seed, db asserts.RODatabase) (*asserts.Account, error) {
-	model, err := seed.Model()
-	if err != nil {
-		return nil, err
-	}
 	a, err := db.Find(asserts.AccountType, map[string]string{
-		"account-id": model.BrandID(),
+		"account-id": seed.Model().BrandID(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("internal error: %v", err)
diff -Nru snapd-2.45.1+20.04.2/seed/internal/validate.go snapd-2.48.3+20.04/seed/internal/validate.go
--- snapd-2.45.1+20.04.2/seed/internal/validate.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/seed/internal/validate.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,41 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// validSeedSystemLabel is the regex describing a valid system label. Typically
+// system labels are expected to be date based, eg. 20201116, but for
+// completeness follow the same rule as model names (incl. one letter model
+// names and thus system labels), with the exception that uppercase letters are
+// not allowed, as the systems will often be stored in a FAT filesystem.
+var validSeedSystemLabel = regexp.MustCompile("^[a-z0-9](?:-?[a-z0-9])*$")
+
+// ValidateSeedSystemLabel checks whether the string is a valid UC20 seed system
+// label.
+func ValidateUC20SeedSystemLabel(label string) error {
+	if !validSeedSystemLabel.MatchString(label) {
+		return fmt.Errorf("invalid seed system label: %q", label)
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/seed/internal/validate_test.go snapd-2.48.3+20.04/seed/internal/validate_test.go
--- snapd-2.45.1+20.04.2/seed/internal/validate_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/seed/internal/validate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,68 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal_test
+
+import (
+	"fmt"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/seed/internal"
+)
+
+type validateSuite struct{}
+
+var _ = Suite(&validateSuite{})
+
+func (s *validateSuite) TestValidateSeedSystemLabel(c *C) {
+	valid := []string{
+		"a",
+		"ab",
+		"a-a",
+		"a-123",
+		"a-a-a",
+		"20191119",
+		"foobar",
+		"my-system",
+		"brand-system-date-1234",
+	}
+	for _, label := range valid {
+		c.Logf("trying valid label: %q", label)
+		err := internal.ValidateUC20SeedSystemLabel(label)
+		c.Check(err, IsNil)
+	}
+
+	invalid := []string{
+		"",
+		"/bin",
+		"../../bin/bar",
+		":invalid:",
+		"日本語",
+		"-invalid",
+		"invalid-",
+		"MYSYSTEM",
+		"mySystem",
+	}
+	for _, label := range invalid {
+		c.Logf("trying invalid label: %q", label)
+		err := internal.ValidateUC20SeedSystemLabel(label)
+		c.Check(err, ErrorMatches, fmt.Sprintf("invalid seed system label: %q", label))
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/seed/seed16.go snapd-2.48.3+20.04/seed/seed16.go
--- snapd-2.45.1+20.04.2/seed/seed16.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seed16.go	2021-02-02 08:21:12.000000000 +0000
@@ -105,11 +105,11 @@
 	return nil
 }
 
-func (s *seed16) Model() (*asserts.Model, error) {
+func (s *seed16) Model() *asserts.Model {
 	if s.model == nil {
-		return nil, fmt.Errorf("internal error: model assertion unset")
+		panic("internal error: model assertion unset (LoadAssertions not called)")
 	}
-	return s.model, nil
+	return s.model
 }
 
 func (s *seed16) Brand() (*asserts.Account, error) {
@@ -170,10 +170,7 @@
 }
 
 func (s *seed16) LoadMeta(tm timings.Measurer) error {
-	model, err := s.Model()
-	if err != nil {
-		return err
-	}
+	model := s.Model()
 
 	seedYamlFile := filepath.Join(s.seedDir, "seed.yaml")
 	if !osutil.FileExists(seedYamlFile) {
diff -Nru snapd-2.45.1+20.04.2/seed/seed16_test.go snapd-2.48.3+20.04/seed/seed16_test.go
--- snapd-2.45.1+20.04.2/seed/seed16_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seed16_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -156,8 +156,7 @@
 	err = s.seed16.LoadAssertions(s.db, s.commitTo)
 	c.Assert(err, IsNil)
 
-	model, err := s.seed16.Model()
-	c.Assert(err, IsNil)
+	model := s.seed16.Model()
 	c.Check(model.Model(), Equals, "my-model")
 
 	_, err = s.db.Find(asserts.ModelType, map[string]string{
@@ -186,8 +185,7 @@
 	err = s.seed16.LoadAssertions(nil, nil)
 	c.Assert(err, IsNil)
 
-	model, err := s.seed16.Model()
-	c.Assert(err, IsNil)
+	model := s.seed16.Model()
 	c.Check(model.Model(), Equals, "my-model")
 
 	brand, err := s.seed16.Brand()
@@ -196,17 +194,6 @@
 	c.Check(brand.DisplayName(), Equals, "My-brand")
 }
 
-func (s *seed16Suite) TestSkippedLoadAssertion(c *C) {
-	_, err := s.seed16.Model()
-	c.Check(err, ErrorMatches, "internal error: model assertion unset")
-
-	err = s.seed16.LoadMeta(s.perfTimings)
-	c.Check(err, ErrorMatches, "internal error: model assertion unset")
-
-	_, err = s.seed16.Brand()
-	c.Check(err, ErrorMatches, "internal error: model assertion unset")
-}
-
 func (s *seed16Suite) TestLoadMetaNoMeta(c *C) {
 	err := os.Mkdir(s.AssertsDir(), 0755)
 	c.Assert(err, IsNil)
diff -Nru snapd-2.45.1+20.04.2/seed/seed20.go snapd-2.48.3+20.04/seed/seed20.go
--- snapd-2.45.1+20.04.2/seed/seed20.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seed20.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2019 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -177,11 +177,11 @@
 	return nil
 }
 
-func (s *seed20) Model() (*asserts.Model, error) {
+func (s *seed20) Model() *asserts.Model {
 	if s.model == nil {
-		return nil, fmt.Errorf("internal error: model assertion unset")
+		panic("internal error: model assertion unset (LoadAssertions not called)")
 	}
-	return s.model, nil
+	return s.model
 }
 
 func (s *seed20) Brand() (*asserts.Account, error) {
@@ -213,7 +213,7 @@
 func (s *seed20) nextOptSnap(modSnap *asserts.ModelSnap) (optSnap *internal.Snap20, done bool) {
 	// we can merge model snaps and options snaps because
 	// both seed20.go and writer.go follow the order:
-	// system snap, model.AllSnaps()...
+	// system snap, model.EssentialSnaps(), model.SnapsWithoutEssential()
 	if s.optSnapsIdx == len(s.optSnaps) {
 		return nil, true
 	}
@@ -361,7 +361,7 @@
 
 func (s *seed20) addModelSnap(modelSnap *asserts.ModelSnap, essential bool, filter func(*asserts.ModelSnap) bool, tm timings.Measurer) (*Snap, error) {
 	optSnap, _ := s.nextOptSnap(modelSnap)
-	if !filter(modelSnap) {
+	if filter != nil && !filter(modelSnap) {
 		return nil, errFiltered
 	}
 	seedSnap, err := s.addSnap(modelSnap, optSnap, modelSnap.Modes, modelSnap.DefaultChannel, "../../snaps", tm)
@@ -380,7 +380,10 @@
 }
 
 func (s *seed20) LoadMeta(tm timings.Measurer) error {
-	if err := s.loadModelMeta(nil, tm); err != nil {
+	if err := s.loadEssentialMeta(nil, tm); err != nil {
+		return err
+	}
+	if err := s.loadModelRestMeta(tm); err != nil {
 		return err
 	}
 
@@ -404,7 +407,7 @@
 func (s *seed20) LoadEssentialMeta(essentialTypes []snap.Type, tm timings.Measurer) error {
 	filterEssential := essentialSnapTypesToModelFilter(essentialTypes)
 
-	if err := s.loadModelMeta(filterEssential, tm); err != nil {
+	if err := s.loadEssentialMeta(filterEssential, tm); err != nil {
 		return err
 	}
 
@@ -416,11 +419,8 @@
 	return nil
 }
 
-func (s *seed20) loadModelMeta(filterEssential func(*asserts.ModelSnap) bool, tm timings.Measurer) error {
-	model, err := s.Model()
-	if err != nil {
-		return err
-	}
+func (s *seed20) loadEssentialMeta(filterEssential func(*asserts.ModelSnap) bool, tm timings.Measurer) error {
+	model := s.Model()
 
 	if err := s.loadOptions(); err != nil {
 		return err
@@ -430,35 +430,23 @@
 		return err
 	}
 
-	essentialOnly := filterEssential != nil
-	filter := filterEssential
-	if !essentialOnly {
-		// no filtering
-		filter = func(*asserts.ModelSnap) bool {
-			return true
-		}
-	}
+	essSnaps := model.EssentialSnaps()
+	const essential = true
 
-	allSnaps := model.AllSnaps()
 	// an explicit snapd is the first of all of snaps
-	if allSnaps[0].SnapType != "snapd" {
+	if essSnaps[0].SnapType != "snapd" {
 		snapdSnap := internal.MakeSystemSnap("snapd", "latest/stable", []string{"run", "ephemeral"})
-		if _, err := s.addModelSnap(snapdSnap, true, filter, tm); err != nil && err != errFiltered {
+		if _, err := s.addModelSnap(snapdSnap, essential, filterEssential, tm); err != nil && err != errFiltered {
 			return err
 		}
 	}
 
-	essential := true
-	for _, modelSnap := range allSnaps {
-		seedSnap, err := s.addModelSnap(modelSnap, essential, filter, tm)
+	for _, modelSnap := range essSnaps {
+		seedSnap, err := s.addModelSnap(modelSnap, essential, filterEssential, tm)
 		if err != nil {
 			if err == errFiltered {
 				continue
 			}
-			if _, ok := err.(*noSnapDeclarationError); ok && modelSnap.Presence == "optional" {
-				// skipped optional snap is ok
-				continue
-			}
 			return err
 		}
 		if modelSnap.SnapType == "gadget" {
@@ -472,13 +460,24 @@
 			}
 			// TODO: when we allow extend models for classic
 			// we need to add the gadget base here
+		}
+	}
+
+	return nil
+}
+
+func (s *seed20) loadModelRestMeta(tm timings.Measurer) error {
+	model := s.Model()
 
-			// done with essential snaps, gadget is the last one
-			essential = false
-			if essentialOnly {
-				// will not find more
-				break
+	const notEssential = false
+	for _, modelSnap := range model.SnapsWithoutEssential() {
+		_, err := s.addModelSnap(modelSnap, notEssential, nil, tm)
+		if err != nil {
+			if _, ok := err.(*noSnapDeclarationError); ok && modelSnap.Presence == "optional" {
+				// skipped optional snap is ok
+				continue
 			}
+			return err
 		}
 	}
 
diff -Nru snapd-2.45.1+20.04.2/seed/seed20_test.go snapd-2.48.3+20.04/seed/seed20_test.go
--- snapd-2.45.1+20.04.2/seed/seed20_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seed20_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -224,8 +224,7 @@
 	err = seed20.LoadAssertions(nil, nil)
 	c.Assert(err, IsNil)
 
-	model, err := seed20.Model()
-	c.Assert(err, IsNil)
+	model := seed20.Model()
 	c.Check(model.Model(), Equals, "my-model")
 	c.Check(model.Base(), Equals, "core20")
 
@@ -700,11 +699,15 @@
 }
 
 func (s *seed20Suite) TestLoadEssentialMetaCore20(c *C) {
+	r := seed.MockTrusted(s.StoreSigning.Trusted)
+	defer r()
+
 	s.makeSnap(c, "snapd", "")
 	s.makeSnap(c, "core20", "")
 	s.makeSnap(c, "pc-kernel=20", "")
 	s.makeSnap(c, "pc=20", "")
-	s.makeSnap(c, "required20", "developerid")
+	s.makeSnap(c, "core18", "")
+	s.makeSnap(c, "required18", "developerid")
 
 	sysLabel := "20191018"
 	s.MakeSeed(c, sysLabel, "my-brand", "my-model", map[string]interface{}{
@@ -725,8 +728,13 @@
 				"default-channel": "20",
 			},
 			map[string]interface{}{
-				"name": "required20",
-				"id":   s.AssertedSnapID("required20"),
+				"name": "core18",
+				"id":   s.AssertedSnapID("core18"),
+				"type": "base",
+			},
+			map[string]interface{}{
+				"name": "required18",
+				"id":   s.AssertedSnapID("required18"),
 			}},
 	}, nil)
 
@@ -761,11 +769,16 @@
 		Required:      true,
 		Channel:       "20",
 	}
-	required20Snap := &seed.Snap{
-		Path: s.expectedPath("required20"),
+	core18Snap := &seed.Snap{
+		// no EssentialType, so it's always hidden, shouldn't matter
+		// because we should not look at it
+		Path: s.expectedPath("core18"),
+	}
+	required18Snap := &seed.Snap{
+		Path: s.expectedPath("required18"),
 	}
 
-	all := []*seed.Snap{snapdSnap, pcKernelSnap, core20Snap, pcSnap, required20Snap}
+	all := []*seed.Snap{snapdSnap, pcKernelSnap, core20Snap, pcSnap, core18Snap, required18Snap}
 
 	tests := []struct {
 		onlyTypes []snap.Type
@@ -793,7 +806,7 @@
 		essSeed20, ok := seed20.(seed.EssentialMetaLoaderSeed)
 		c.Assert(ok, Equals, true)
 
-		err = essSeed20.LoadAssertions(s.db, s.commitTo)
+		err = essSeed20.LoadAssertions(nil, nil)
 		c.Assert(err, IsNil)
 
 		err = essSeed20.LoadEssentialMeta(t.onlyTypes, s.perfTimings)
@@ -811,6 +824,14 @@
 		c.Check(runSnaps, HasLen, 0)
 
 		unhide()
+
+		// test short-cut helper as well
+		mod, essSnaps, err := seed.ReadSystemEssential(s.SeedDir, sysLabel, t.onlyTypes, s.perfTimings)
+		c.Assert(err, IsNil)
+		c.Check(mod.BrandID(), Equals, "my-brand")
+		c.Check(mod.Model(), Equals, "my-model")
+		c.Check(essSnaps, HasLen, len(t.expected))
+		c.Check(essSnaps, DeepEquals, t.expected)
 	}
 }
 
diff -Nru snapd-2.45.1+20.04.2/seed/seed.go snapd-2.48.3+20.04/seed/seed.go
--- snapd-2.45.1+20.04.2/seed/seed.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seed.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2019-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -22,9 +22,11 @@
 
 import (
 	"errors"
+	"fmt"
 	"path/filepath"
 
 	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/seed/internal"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/timings"
 )
@@ -78,19 +80,19 @@
 	// only on classic.
 	LoadAssertions(db asserts.RODatabase, commitTo func(*asserts.Batch) error) error
 
-	// Model returns the seed provided model assertion. It is an
-	// error to call Model before LoadAssertions.
-	Model() (*asserts.Model, error)
+	// Model returns the seed provided model assertion.
+	// It will panic if called before LoadAssertions.
+	Model() *asserts.Model
 
-	// Brand returns the brand information of the seed. It is an
-	// error to call Brand before LoadAssertions.
+	// Brand returns the brand information of the seed.
+	// It will panic if called before LoadAssertions.
 	Brand() (*asserts.Account, error)
 
 	// LoadMeta loads the seed and seed's snaps metadata while
 	// verifying the underlying snaps against assertions. It can
 	// return ErrNoMeta if there is no metadata nor snaps in the
-	// seed, this is legitimate only on classic. It is an error to
-	// call LoadMeta before LoadAssertions.
+	// seed, this is legitimate only on classic.
+	// It will panic if called before LoadAssertions.
 	LoadMeta(tm timings.Measurer) error
 
 	// UsesSnapdSnap returns whether the system as defined by the
@@ -115,8 +117,9 @@
 	// essential snaps with types in the essentialTypes set while
 	// verifying them against assertions. It can return ErrNoMeta
 	// if there is no metadata nor snaps in the seed, this is
-	// legitimate only on classic. It is an error to call LoadMeta
-	// before LoadAssertions or to mix it with LoadMeta.
+	// legitimate only on classic. It is an error to mix it with
+	// LoadMeta.
+	// It will panic if called before LoadAssertions.
 	LoadEssentialMeta(essentialTypes []snap.Type, tm timings.Measurer) error
 }
 
@@ -124,7 +127,7 @@
 // label if not empty is used to identify a Core 20 recovery system seed.
 func Open(seedDir, label string) (Seed, error) {
 	if label != "" {
-		if err := validateUC20SeedSystemLabel(label); err != nil {
+		if err := internal.ValidateUC20SeedSystemLabel(label); err != nil {
 			return nil, err
 		}
 		return &seed20{systemDir: filepath.Join(seedDir, "systems", label)}, nil
@@ -134,3 +137,33 @@
 	// highest label one?
 	return &seed16{seedDir: seedDir}, nil
 }
+
+// ReadSystemEssential retrieves in one go information about the model
+// and essential snaps of the given types for the Core 20 recovery
+// system seed specified by seedDir and label (which cannot be empty).
+func ReadSystemEssential(seedDir, label string, essentialTypes []snap.Type, tm timings.Measurer) (*asserts.Model, []*Snap, error) {
+	if label == "" {
+		return nil, nil, fmt.Errorf("system label cannot be empty")
+	}
+	seed, err := Open(seedDir, label)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	seed20, ok := seed.(EssentialMetaLoaderSeed)
+	if !ok {
+		return nil, nil, fmt.Errorf("internal error: UC20 seed must implement EssentialMetaLoaderSeed")
+	}
+
+	// load assertions into a temporary database
+	if err := seed20.LoadAssertions(nil, nil); err != nil {
+		return nil, nil, err
+	}
+
+	// load and verify info about essential snaps
+	if err := seed20.LoadEssentialMeta(essentialTypes, tm); err != nil {
+		return nil, nil, err
+	}
+
+	return seed20.Model(), seed20.EssentialSnaps(), nil
+}
diff -Nru snapd-2.45.1+20.04.2/seed/seedwriter/helpers.go snapd-2.48.3+20.04/seed/seedwriter/helpers.go
--- snapd-2.45.1+20.04.2/seed/seedwriter/helpers.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seedwriter/helpers.go	2021-02-02 08:21:12.000000000 +0000
@@ -107,15 +107,15 @@
 		// ModelSnap for Core 16/18 "required-snaps" have
 		// SnapType not set given the model assertion does not
 		// have the information
-		typ := sn.Info.GetType()
+		typ := sn.Info.Type()
 		if typ == snap.TypeKernel || typ == snap.TypeGadget {
 			return fmt.Errorf("snap %q has unexpected type: %s", sn.SnapName(), typ)
 		}
 		return nil
 	}
-	if sn.Info.GetType() != expectedType {
+	if sn.Info.Type() != expectedType {
 		what := whichModelSnap(sn.modelSnap, model)
-		return fmt.Errorf("%s has unexpected type: %s", what, sn.Info.GetType())
+		return fmt.Errorf("%s has unexpected type: %s", what, sn.Info.Type())
 	}
 	return nil
 }
@@ -125,7 +125,7 @@
 func (s seedSnapsByType) Len() int      { return len(s) }
 func (s seedSnapsByType) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
 func (s seedSnapsByType) Less(i, j int) bool {
-	return s[i].Info.GetType().SortsBefore(s[j].Info.GetType())
+	return s[i].Info.Type().SortsBefore(s[j].Info.Type())
 }
 
 // finderFromFetcher exposes an assertion Finder interface out of a Fetcher.
diff -Nru snapd-2.45.1+20.04.2/seed/seedwriter/seed16.go snapd-2.48.3+20.04/seed/seedwriter/seed16.go
--- snapd-2.45.1+20.04.2/seed/seedwriter/seed16.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seedwriter/seed16.go	2021-02-02 08:21:12.000000000 +0000
@@ -89,7 +89,7 @@
 func (pol *policy16) checkBase(info *snap.Info, availableSnaps *naming.SnapSet) error {
 	// snap needs no base (or it simply needs core which is never listed explicitly): nothing to do
 	if info.Base == "" {
-		if info.GetType() == snap.TypeGadget || info.GetType() == snap.TypeApp {
+		if info.Type() == snap.TypeGadget || info.Type() == snap.TypeApp {
 			// remember to make sure we have core installed
 			pol.needsCore = append(pol.needsCore, info.SnapName())
 		}
diff -Nru snapd-2.45.1+20.04.2/seed/seedwriter/seed20.go snapd-2.48.3+20.04/seed/seedwriter/seed20.go
--- snapd-2.45.1+20.04.2/seed/seedwriter/seed20.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seedwriter/seed20.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,7 +25,6 @@
 	"fmt"
 	"os"
 	"path/filepath"
-	"regexp"
 
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/seed/internal"
@@ -34,15 +33,6 @@
 	"github.com/snapcore/snapd/snap/naming"
 )
 
-var validSystemLabel = regexp.MustCompile("^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$")
-
-func validateSystemLabel(label string) error {
-	if !validSystemLabel.MatchString(label) {
-		return fmt.Errorf("system label contains invalid characters: %s", label)
-	}
-	return nil
-}
-
 type policy20 struct {
 	model *asserts.Model
 	opts  *Options
@@ -50,7 +40,7 @@
 	warningf func(format string, a ...interface{})
 }
 
-var errNotAllowedExceptForDangerous = errors.New("cannot override channels, add local snaps or extra snaps with a model of grade higher than dangerous")
+var errNotAllowedExceptForDangerous = errors.New("cannot override channels, add devmode snaps, local snaps, or extra snaps with a model of grade higher than dangerous")
 
 func (pol *policy20) checkAllowedDangerous() error {
 	if pol.model.Grade() != asserts.ModelDangerous {
@@ -94,7 +84,7 @@
 func (pol *policy20) checkBase(info *snap.Info, availableSnaps *naming.SnapSet) error {
 	base := info.Base
 	if base == "" {
-		if info.GetType() != snap.TypeGadget && info.GetType() != snap.TypeApp {
+		if info.Type() != snap.TypeGadget && info.Type() != snap.TypeApp {
 			return nil
 		}
 		base = "core"
diff -Nru snapd-2.45.1+20.04.2/seed/seedwriter/writer.go snapd-2.48.3+20.04/seed/seedwriter/writer.go
--- snapd-2.45.1+20.04.2/seed/seedwriter/writer.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seedwriter/writer.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,6 +28,7 @@
 	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/asserts/snapasserts"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/seed/internal"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/channel"
 	"github.com/snapcore/snapd/snap/naming"
@@ -235,7 +236,7 @@
 		if opts.Label == "" {
 			return nil, fmt.Errorf("internal error: cannot write Core 20 seed without Options.Label set")
 		}
-		if err := validateSystemLabel(opts.Label); err != nil {
+		if err := internal.ValidateUC20SeedSystemLabel(opts.Label); err != nil {
 			return nil, err
 		}
 		pol = &policy20{model: model, opts: opts, warningf: w.warningf}
@@ -536,7 +537,13 @@
 // SetInfo sets Info of the SeedSnap and possibly computes its
 // destination Path.
 func (w *Writer) SetInfo(sn *SeedSnap, info *snap.Info) error {
+	if info.Confinement == snap.DevModeConfinement {
+		if err := w.policy.allowsDangerousFeatures(); err != nil {
+			return err
+		}
+	}
 	sn.Info = info
+
 	if sn.local {
 		// nothing more to do
 		return nil
@@ -546,7 +553,6 @@
 	if err != nil {
 		return err
 	}
-
 	sn.Path = p
 	return nil
 }
@@ -645,7 +651,11 @@
 }
 
 func (w *Writer) modSnaps() ([]*asserts.ModelSnap, error) {
-	modSnaps := w.model.AllSnaps()
+	// model snaps are accumulated/processed in the order
+	//  * system snap if implicit
+	//  * essential snaps (in Model.EssentialSnaps order)
+	//  * not essential snaps
+	modSnaps := append([]*asserts.ModelSnap{}, w.model.EssentialSnaps()...)
 	if systemSnap := w.policy.systemSnap(); systemSnap != nil {
 		prepend := true
 		for _, modSnap := range modSnaps {
@@ -668,6 +678,7 @@
 			modSnaps = append([]*asserts.ModelSnap{systemSnap}, modSnaps...)
 		}
 	}
+	modSnaps = append(modSnaps, w.model.SnapsWithoutEssential()...)
 	return modSnaps, nil
 }
 
@@ -813,7 +824,7 @@
 	// Sanity check, note that we could support this case
 	// if we have a use-case but it requires changes in the
 	// devicestate/firstboot.go ordering code.
-	if info.GetType() == snap.TypeGadget && !w.model.Classic() && info.Base != w.model.Base() {
+	if info.Type() == snap.TypeGadget && !w.model.Classic() && info.Base != w.model.Base() {
 		return fmt.Errorf("cannot use gadget snap because its base %q is different from model base %q", info.Base, w.model.Base())
 	}
 
@@ -958,7 +969,7 @@
 	}
 	info := sn.Info
 	var kind string
-	switch info.GetType() {
+	switch info.Type() {
 	case snap.TypeKernel:
 		kind = "kernel"
 	case snap.TypeGadget:
@@ -1089,7 +1100,7 @@
 	var bootSnaps []*SeedSnap
 	for _, sn := range w.snapsFromModel {
 		bootSnaps = append(bootSnaps, sn)
-		if sn.Info.GetType() == snap.TypeGadget {
+		if sn.Info.Type() == snap.TypeGadget {
 			break
 
 		}
diff -Nru snapd-2.45.1+20.04.2/seed/seedwriter/writer_test.go snapd-2.48.3+20.04/seed/seedwriter/writer_test.go
--- snapd-2.45.1+20.04.2/seed/seedwriter/writer_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/seedwriter/writer_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -146,6 +146,11 @@
 base: core16
 version: 1.0
 `,
+	"my-devmode": `name: my-devmode
+type: app
+version: 1
+confinement: devmode
+`,
 })
 
 const pcGadgetYaml = `
@@ -712,7 +717,7 @@
 
 		_, _, err := s.upToDownloaded(c, model, s.fillMetaDownloadedSnap)
 
-		expErr := fmt.Sprintf("%s %q has unexpected type: %v", t.what, t.wrongTypeSnap, s.AssertedSnapInfo(t.wrongTypeSnap).GetType())
+		expErr := fmt.Sprintf("%s %q has unexpected type: %v", t.what, t.wrongTypeSnap, s.AssertedSnapInfo(t.wrongTypeSnap).Type())
 		c.Check(err, ErrorMatches, expErr)
 	}
 }
@@ -1977,7 +1982,7 @@
 		s.opts.Label = inv
 		w, err := seedwriter.New(model, s.opts)
 		c.Assert(w, IsNil)
-		c.Check(err, ErrorMatches, `system label contains invalid characters:.*`)
+		c.Check(err, ErrorMatches, fmt.Sprintf(`invalid seed system label: %q`, inv))
 	}
 }
 
@@ -2092,7 +2097,10 @@
 	}
 }
 
-func (s *writerSuite) TestCore20NonDangerousNoChannelOverride(c *C) {
+func (s *writerSuite) TestCore20NonDangerousDisallowedDevmodeSnaps(c *C) {
+
+	s.makeSnap(c, "my-devmode", "canonical")
+
 	model := s.Brands.Model("my-brand", "my-model", map[string]interface{}{
 		"display-name": "my model",
 		"architecture": "amd64",
@@ -2111,14 +2119,40 @@
 				"type":            "gadget",
 				"default-channel": "20",
 			},
+			map[string]interface{}{
+				"name": "my-devmode",
+				"id":   s.AssertedSnapID("my-devmode"),
+				"type": "app",
+			},
 		},
 	})
 
-	s.opts.DefaultChannel = "stable"
 	s.opts.Label = "20191107"
+
+	const expectedErr = `cannot override channels, add local snaps or extra snaps with a model of grade higher than dangerous`
+
 	w, err := seedwriter.New(model, s.opts)
-	c.Assert(w, IsNil)
-	c.Check(err, ErrorMatches, `cannot override channels, add local snaps or extra snaps with a model of grade higher than dangerous`)
+	c.Assert(err, IsNil)
+
+	_, err = w.Start(s.db, s.newFetcher)
+	c.Assert(err, IsNil)
+
+	localSnaps, err := w.LocalSnaps()
+	c.Assert(err, IsNil)
+	c.Assert(localSnaps, HasLen, 0)
+
+	snaps, err := w.SnapsToDownload()
+	c.Check(err, IsNil)
+	c.Assert(snaps, HasLen, 5)
+
+	c.Assert(snaps[4].SnapName(), Equals, "my-devmode")
+	sn := snaps[4]
+
+	info := s.AssertedSnapInfo(sn.SnapName())
+	c.Assert(info, NotNil, Commentf("%s not defined", sn.SnapName()))
+	err = w.SetInfo(sn, info)
+	c.Assert(err, ErrorMatches, "cannot override channels, add devmode snaps, local snaps, or extra snaps with a model of grade higher than dangerous")
+	c.Check(sn.Info, Not(Equals), info)
 }
 
 func (s *writerSuite) TestCore20NonDangerousDisallowedOptionsSnaps(c *C) {
@@ -2155,7 +2189,7 @@
 		{&seedwriter.OptionsSnap{Name: "pc", Channel: "edge"}},
 	}
 
-	const expectedErr = `cannot override channels, add local snaps or extra snaps with a model of grade higher than dangerous`
+	const expectedErr = `cannot override channels, add devmode snaps, local snaps, or extra snaps with a model of grade higher than dangerous`
 
 	for _, t := range tests {
 		w, err := seedwriter.New(model, s.opts)
@@ -2198,6 +2232,35 @@
 	}
 }
 
+func (s *writerSuite) TestCore20NonDangerousNoChannelOverride(c *C) {
+	model := s.Brands.Model("my-brand", "my-model", map[string]interface{}{
+		"display-name": "my model",
+		"architecture": "amd64",
+		"store":        "my-store",
+		"base":         "core20",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":            "pc-kernel",
+				"id":              s.AssertedSnapID("pc-kernel"),
+				"type":            "kernel",
+				"default-channel": "20",
+			},
+			map[string]interface{}{
+				"name":            "pc",
+				"id":              s.AssertedSnapID("pc"),
+				"type":            "gadget",
+				"default-channel": "20",
+			},
+		},
+	})
+
+	s.opts.DefaultChannel = "stable"
+	s.opts.Label = "20191107"
+	w, err := seedwriter.New(model, s.opts)
+	c.Assert(w, IsNil)
+	c.Check(err, ErrorMatches, `cannot override channels, add devmode snaps, local snaps, or extra snaps with a model of grade higher than dangerous`)
+}
+
 func (s *writerSuite) TestSeedSnapsWriteMetaCore20LocalSnaps(c *C) {
 	// add store assertion
 	storeAs, err := s.StoreSigning.Sign(asserts.StoreType, map[string]interface{}{
@@ -2890,3 +2953,104 @@
 		},
 	})
 }
+
+func (s *writerSuite) TestSeedSnapsWriteMetaCore20SignedLocalAssertedSnaps(c *C) {
+	model := s.Brands.Model("my-brand", "my-model", map[string]interface{}{
+		"display-name": "my model",
+		"architecture": "amd64",
+		"base":         "core20",
+		"grade":        "signed",
+		"snaps": []interface{}{
+			map[string]interface{}{
+				"name":            "pc-kernel",
+				"id":              s.AssertedSnapID("pc-kernel"),
+				"type":            "kernel",
+				"default-channel": "20",
+			},
+			map[string]interface{}{
+				"name":            "pc",
+				"id":              s.AssertedSnapID("pc"),
+				"type":            "gadget",
+				"default-channel": "20",
+			}},
+	})
+
+	// soundness
+	c.Assert(model.Grade(), Equals, asserts.ModelSigned)
+
+	s.makeSnap(c, "snapd", "")
+	s.makeSnap(c, "core20", "")
+	s.makeSnap(c, "pc-kernel=20", "")
+	s.makeSnap(c, "pc=20", "")
+
+	s.opts.Label = "20191122"
+	w, err := seedwriter.New(model, s.opts)
+	c.Assert(err, IsNil)
+
+	// use a local asserted snap with signed, which is supported
+	err = w.SetOptionsSnaps([]*seedwriter.OptionsSnap{{Path: s.AssertedSnap("pc")}})
+	c.Assert(err, IsNil)
+
+	tf, err := w.Start(s.db, s.newFetcher)
+	c.Assert(err, IsNil)
+
+	localSnaps, err := w.LocalSnaps()
+	c.Assert(err, IsNil)
+	c.Assert(localSnaps, HasLen, 1)
+
+	for _, sn := range localSnaps {
+		si, aRefs, err := seedwriter.DeriveSideInfo(sn.Path, tf, s.db)
+		c.Assert(err, IsNil)
+		f, err := snapfile.Open(sn.Path)
+		c.Assert(err, IsNil)
+		info, err := snap.ReadInfoFromSnapFile(f, si)
+		c.Assert(err, IsNil)
+		w.SetInfo(sn, info)
+		sn.ARefs = aRefs
+	}
+
+	err = w.InfoDerived()
+	c.Assert(err, IsNil)
+
+	snaps, err := w.SnapsToDownload()
+	c.Assert(err, IsNil)
+	c.Check(snaps, HasLen, 3)
+
+	for _, sn := range snaps {
+		channel := "latest/stable"
+		switch sn.SnapName() {
+		case "pc", "pc-kernel":
+			channel = "20"
+		}
+		c.Check(sn.Channel, Equals, channel)
+		s.fillDownloadedSnap(c, w, sn)
+	}
+
+	complete, err := w.Downloaded()
+	c.Assert(err, IsNil)
+	c.Check(complete, Equals, true)
+
+	copySnap := func(name, src, dst string) error {
+		return osutil.CopyFile(src, dst, 0)
+	}
+
+	err = w.SeedSnaps(copySnap)
+	c.Assert(err, IsNil)
+
+	err = w.WriteMeta()
+	c.Assert(err, IsNil)
+
+	// check seed
+	systemDir := filepath.Join(s.opts.SeedDir, "systems", s.opts.Label)
+	c.Check(systemDir, testutil.FilePresent)
+
+	l, err := ioutil.ReadDir(filepath.Join(s.opts.SeedDir, "snaps"))
+	c.Assert(err, IsNil)
+	c.Check(l, HasLen, 4)
+
+	// local asserted model snap was put in /snaps
+	c.Check(filepath.Join(s.opts.SeedDir, "snaps", "pc_1.snap"), testutil.FilePresent)
+
+	// no options file was created
+	c.Check(filepath.Join(systemDir, "options.yaml"), testutil.FileAbsent)
+}
diff -Nru snapd-2.45.1+20.04.2/seed/validate.go snapd-2.48.3+20.04/seed/validate.go
--- snapd-2.45.1+20.04.2/seed/validate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/validate.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,7 +23,6 @@
 	"bytes"
 	"fmt"
 	"path/filepath"
-	"regexp"
 	"sort"
 
 	"github.com/snapcore/snapd/snap"
@@ -99,9 +98,7 @@
 	tm := timings.New(nil)
 	if err := seed.LoadMeta(tm); err != nil {
 		if missingErr, ok := err.(*essentialSnapMissingError); ok {
-			// Model always succeed after LoadAssertions
-			mod, _ := seed.Model()
-			if mod.Classic() && missingErr.SnapName == "core" {
+			if seed.Model().Classic() && missingErr.SnapName == "core" {
 				err = fmt.Errorf("essential snap core or snapd must be part of the seed")
 			}
 		}
@@ -138,16 +135,3 @@
 
 	return nil
 }
-
-// TODO:UC20: move these to internal, use also in seedwriter
-
-var validSeedSystemLabel = regexp.MustCompile("^[a-zA-Z0-9](?:-?[a-zA-Z0-9])+$")
-
-// validateSeedSystemLabel checks whether the string is a valid UC20 seed system
-// label.
-func validateUC20SeedSystemLabel(label string) error {
-	if !validSeedSystemLabel.MatchString(label) {
-		return fmt.Errorf("invalid seed system label: %q", label)
-	}
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/seed/validate_test.go snapd-2.48.3+20.04/seed/validate_test.go
--- snapd-2.45.1+20.04.2/seed/validate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/seed/validate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -403,36 +403,3 @@
 	c.Assert(err, ErrorMatches, `cannot validate seed:
  - cannot read seed yaml: empty element in seed`)
 }
-
-func (s *validateSuite) TestValidateSeedSystemLabel(c *C) {
-	valid := []string{
-		"ab",
-		"20191119",
-		"foobar",
-		"MYSYSTEM",
-		"mySystem",
-		"my-system",
-		"brand-system-date-1234",
-	}
-	for _, label := range valid {
-		c.Logf("trying valid label: %q", label)
-		err := seed.ValidateUC20SeedSystemLabel(label)
-		c.Check(err, IsNil)
-	}
-
-	invalid := []string{
-		"",
-		"a", // too short
-		"/bin",
-		"../../bin/bar",
-		":invalid:",
-		"日本語",
-		"-invalid",
-		"invalid-",
-	}
-	for _, label := range invalid {
-		c.Logf("trying invalid label: %q", label)
-		err := seed.ValidateUC20SeedSystemLabel(label)
-		c.Check(err, ErrorMatches, fmt.Sprintf("invalid seed system label: %q", label))
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/snap/broken.go snapd-2.48.3+20.04/snap/broken.go
--- snapd-2.45.1+20.04.2/snap/broken.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/broken.go	2021-02-02 08:21:12.000000000 +0000
@@ -62,9 +62,21 @@
 	for _, m := range matches {
 		appname := strings.Split(m, ".")[2]
 		out[appname] = &AppInfo{
-			Snap:   info,
-			Name:   appname,
-			Daemon: "simple",
+			Snap:        info,
+			Name:        appname,
+			Daemon:      "simple",
+			DaemonScope: SystemDaemon,
+		}
+	}
+	// guess the user services next
+	matches, _ = filepath.Glob(filepath.Join(dirs.SnapUserServicesDir, fmt.Sprintf("snap.%s.*.service", name)))
+	for _, m := range matches {
+		appname := strings.Split(m, ".")[2]
+		out[appname] = &AppInfo{
+			Snap:        info,
+			Name:        appname,
+			Daemon:      "simple",
+			DaemonScope: UserDaemon,
 		}
 	}
 
@@ -78,7 +90,7 @@
 // was not validated before.  To avoid a flag day and any potential issues,
 // transparently rename the two clashing plugs by appending the "-plug" suffix.
 func (info *Info) renameClashingCorePlugs() {
-	if info.InstanceName() == "core" && info.GetType() == TypeOS {
+	if info.InstanceName() == "core" && info.Type() == TypeOS {
 		for _, plugName := range []string{"network-bind", "core-support"} {
 			info.forceRenamePlug(plugName, plugName+"-plug")
 		}
diff -Nru snapd-2.45.1+20.04.2/snap/broken_test.go snapd-2.48.3+20.04/snap/broken_test.go
--- snapd-2.45.1+20.04.2/snap/broken_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/broken_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -78,14 +78,33 @@
 	info := &snap.Info{SuggestedName: "foo"}
 	apps := snap.GuessAppsForBroken(info)
 	c.Check(apps, HasLen, 2)
-	c.Check(apps["foo"], DeepEquals, &snap.AppInfo{Snap: info, Name: "foo", Daemon: "simple"})
-	c.Check(apps["bar"], DeepEquals, &snap.AppInfo{Snap: info, Name: "bar", Daemon: "simple"})
+	c.Check(apps["foo"], DeepEquals, &snap.AppInfo{Snap: info, Name: "foo", Daemon: "simple", DaemonScope: snap.SystemDaemon})
+	c.Check(apps["bar"], DeepEquals, &snap.AppInfo{Snap: info, Name: "bar", Daemon: "simple", DaemonScope: snap.SystemDaemon})
 
 	info = &snap.Info{SuggestedName: "foo", InstanceKey: "instance"}
 	apps = snap.GuessAppsForBroken(info)
 	c.Check(apps, HasLen, 2)
-	c.Check(apps["foo"], DeepEquals, &snap.AppInfo{Snap: info, Name: "foo", Daemon: "simple"})
-	c.Check(apps["baz"], DeepEquals, &snap.AppInfo{Snap: info, Name: "baz", Daemon: "simple"})
+	c.Check(apps["foo"], DeepEquals, &snap.AppInfo{Snap: info, Name: "foo", Daemon: "simple", DaemonScope: snap.SystemDaemon})
+	c.Check(apps["baz"], DeepEquals, &snap.AppInfo{Snap: info, Name: "baz", Daemon: "simple", DaemonScope: snap.SystemDaemon})
+}
+
+func (s *brokenSuite) TestGuessAppsForBrokenUserServices(c *C) {
+	touch(c, filepath.Join(dirs.SnapUserServicesDir, "snap.foo.foo.service"))
+	touch(c, filepath.Join(dirs.SnapUserServicesDir, "snap.foo.bar.service"))
+	touch(c, filepath.Join(dirs.SnapUserServicesDir, "snap.foo_instance.foo.service"))
+	touch(c, filepath.Join(dirs.SnapUserServicesDir, "snap.foo_instance.baz.service"))
+
+	info := &snap.Info{SuggestedName: "foo"}
+	apps := snap.GuessAppsForBroken(info)
+	c.Check(apps, HasLen, 2)
+	c.Check(apps["foo"], DeepEquals, &snap.AppInfo{Snap: info, Name: "foo", Daemon: "simple", DaemonScope: snap.UserDaemon})
+	c.Check(apps["bar"], DeepEquals, &snap.AppInfo{Snap: info, Name: "bar", Daemon: "simple", DaemonScope: snap.UserDaemon})
+
+	info = &snap.Info{SuggestedName: "foo", InstanceKey: "instance"}
+	apps = snap.GuessAppsForBroken(info)
+	c.Check(apps, HasLen, 2)
+	c.Check(apps["foo"], DeepEquals, &snap.AppInfo{Snap: info, Name: "foo", Daemon: "simple", DaemonScope: snap.UserDaemon})
+	c.Check(apps["baz"], DeepEquals, &snap.AppInfo{Snap: info, Name: "baz", Daemon: "simple", DaemonScope: snap.UserDaemon})
 }
 
 func (s *brokenSuite) TestForceRenamePlug(c *C) {
diff -Nru snapd-2.45.1+20.04.2/snap/container.go snapd-2.48.3+20.04/snap/container.go
--- snapd-2.45.1+20.04.2/snap/container.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/container.go	2021-02-02 08:21:12.000000000 +0000
@@ -33,10 +33,12 @@
 	Size() (int64, error)
 
 	// RandomAccessFile returns an implementation to read at any
-	// given location for a single file inside the snap.
+	// given location for a single file inside the snap plus
+	// information about the file size.
 	RandomAccessFile(relative string) (interface {
 		io.ReaderAt
 		io.Closer
+		Size() int64
 	}, error)
 
 	// ReadFile returns the content of a single file from the snap.
diff -Nru snapd-2.45.1+20.04.2/snap/hooktypes.go snapd-2.48.3+20.04/snap/hooktypes.go
--- snapd-2.45.1+20.04.2/snap/hooktypes.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/hooktypes.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,6 +35,7 @@
 	NewHookType(regexp.MustCompile("^connect-(?:plug|slot)-[-a-z0-9]+$")),
 	NewHookType(regexp.MustCompile("^disconnect-(?:plug|slot)-[-a-z0-9]+$")),
 	NewHookType(regexp.MustCompile("^check-health$")),
+	NewHookType(regexp.MustCompile("^fde-setup$")),
 }
 
 // HookType represents a pattern of supported hook names.
diff -Nru snapd-2.45.1+20.04.2/snap/info.go snapd-2.48.3+20.04/snap/info.go
--- snapd-2.45.1+20.04.2/snap/info.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/info.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2016 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -433,9 +433,9 @@
 	return s.OriginalDescription
 }
 
-// GetType returns the type of the snap, including additional snap ID check
+// Type returns the type of the snap, including additional snap ID check
 // for the legacy snapd snap definitions.
-func (s *Info) GetType() Type {
+func (s *Info) Type() Type {
 	if s.SnapType == TypeApp && IsSnapd(s.SnapID) {
 		return TypeSnapd
 	}
@@ -596,6 +596,21 @@
 	return strings.TrimSuffix(buf.String(), "; ")
 }
 
+// DesktopPrefix returns the prefix string for the desktop files that
+// belongs to the given snapInstance. We need to do something custom
+// here because a) we need to be compatible with the world before we had
+// parallel installs b) we can't just use the usual "_" parallel installs
+// separator because that is already used as the separator between snap
+// and desktop filename.
+func (s *Info) DesktopPrefix() string {
+	if s.InstanceKey == "" {
+		return s.SnapName()
+	}
+	// we cannot use the usual "_" separator because that is also used
+	// to separate "$snap_$desktopfile"
+	return fmt.Sprintf("%s+%s", s.SnapName(), s.InstanceKey)
+}
+
 // DownloadInfo contains the information to download a snap.
 // It can be marshalled.
 type DownloadInfo struct {
@@ -838,6 +853,7 @@
 	CommonID      string
 
 	Daemon          string
+	DaemonScope     DaemonScope
 	StopTimeout     timeout.Timeout
 	StartTimeout    timeout.Timeout
 	WatchdogTimeout timeout.Timeout
@@ -853,7 +869,8 @@
 	// TODO: this should go away once we have more plumbing and can change
 	// things vs refactor
 	// https://github.com/snapcore/snapd/pull/794#discussion_r58688496
-	BusName string
+	BusName     string
+	ActivatesOn []*SlotInfo
 
 	Plugs   map[string]*PlugInfo
 	Slots   map[string]*SlotInfo
@@ -928,12 +945,12 @@
 
 // File returns the path to the *.socket file
 func (socket *SocketInfo) File() string {
-	return filepath.Join(dirs.SnapServicesDir, socket.App.SecurityTag()+"."+socket.Name+".socket")
+	return filepath.Join(socket.App.serviceDir(), socket.App.SecurityTag()+"."+socket.Name+".socket")
 }
 
 // File returns the path to the *.timer file
 func (timer *TimerInfo) File() string {
-	return filepath.Join(dirs.SnapServicesDir, timer.App.SecurityTag()+".timer")
+	return filepath.Join(timer.App.serviceDir(), timer.App.SecurityTag()+".timer")
 }
 
 func (app *AppInfo) String() string {
@@ -951,7 +968,7 @@
 // DesktopFile returns the path to the installed optional desktop file for the
 // application.
 func (app *AppInfo) DesktopFile() string {
-	return filepath.Join(dirs.SnapDesktopFilesDir, fmt.Sprintf("%s_%s.desktop", app.Snap.InstanceName(), app.Name))
+	return filepath.Join(dirs.SnapDesktopFilesDir, fmt.Sprintf("%s_%s.desktop", app.Snap.DesktopPrefix(), app.Name))
 }
 
 // WrapperPath returns the path to wrapper invoking the app binary.
@@ -1006,9 +1023,20 @@
 	return app.SecurityTag() + ".service"
 }
 
+func (app *AppInfo) serviceDir() string {
+	switch app.DaemonScope {
+	case SystemDaemon:
+		return dirs.SnapServicesDir
+	case UserDaemon:
+		return dirs.SnapUserServicesDir
+	default:
+		panic("unknown daemon scope")
+	}
+}
+
 // ServiceFile returns the systemd service file path for the daemon app.
 func (app *AppInfo) ServiceFile() string {
-	return filepath.Join(dirs.SnapServicesDir, app.ServiceName())
+	return filepath.Join(app.serviceDir(), app.ServiceName())
 }
 
 // IsService returns whether app represents a daemon/service.
@@ -1271,7 +1299,7 @@
 func (r ByType) Len() int      { return len(r) }
 func (r ByType) Swap(i, j int) { r[i], r[j] = r[j], r[i] }
 func (r ByType) Less(i, j int) bool {
-	return r[i].GetType().SortsBefore(r[j].GetType())
+	return r[i].Type().SortsBefore(r[j].Type())
 }
 
 // SortServices sorts the apps based on their Before and After specs, such that
@@ -1342,3 +1370,18 @@
 	}
 	return sorted, nil
 }
+
+// AppInfoBySnapApp supports sorting the given slice of app infos by
+// (instance name, app name).
+type AppInfoBySnapApp []*AppInfo
+
+func (a AppInfoBySnapApp) Len() int      { return len(a) }
+func (a AppInfoBySnapApp) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
+func (a AppInfoBySnapApp) Less(i, j int) bool {
+	iName := a[i].Snap.InstanceName()
+	jName := a[j].Snap.InstanceName()
+	if iName == jName {
+		return a[i].Name < a[j].Name
+	}
+	return iName < jName
+}
diff -Nru snapd-2.45.1+20.04.2/snap/info_snap_yaml.go snapd-2.48.3+20.04/snap/info_snap_yaml.go
--- snapd-2.45.1+20.04.2/snap/info_snap_yaml.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/info_snap_yaml.go	2021-02-02 08:21:12.000000000 +0000
@@ -72,7 +72,8 @@
 	Command      string   `yaml:"command"`
 	CommandChain []string `yaml:"command-chain,omitempty"`
 
-	Daemon string `yaml:"daemon"`
+	Daemon      string      `yaml:"daemon"`
+	DaemonScope DaemonScope `yaml:"daemon-scope"`
 
 	StopCommand     string          `yaml:"stop-command,omitempty"`
 	ReloadCommand   string          `yaml:"reload-command,omitempty"`
@@ -89,8 +90,9 @@
 	SlotNames    []string         `yaml:"slots,omitempty"`
 	PlugNames    []string         `yaml:"plugs,omitempty"`
 
-	BusName  string `yaml:"bus-name,omitempty"`
-	CommonID string `yaml:"common-id,omitempty"`
+	BusName     string   `yaml:"bus-name,omitempty"`
+	ActivatesOn []string `yaml:"activates-on,omitempty"`
+	CommonID    string   `yaml:"common-id,omitempty"`
 
 	Environment strutil.OrderedMap `yaml:"environment,omitempty"`
 
@@ -349,6 +351,7 @@
 			CommandChain:    yApp.CommandChain,
 			StartTimeout:    yApp.StartTimeout,
 			Daemon:          yApp.Daemon,
+			DaemonScope:     yApp.DaemonScope,
 			StopTimeout:     yApp.StopTimeout,
 			StopCommand:     yApp.StopCommand,
 			ReloadCommand:   yApp.ReloadCommand,
@@ -375,6 +378,13 @@
 		if len(yApp.Sockets) > 0 {
 			app.Sockets = make(map[string]*SocketInfo, len(yApp.Sockets))
 		}
+		if len(yApp.ActivatesOn) > 0 {
+			app.ActivatesOn = make([]*SlotInfo, 0, len(yApp.ActivatesOn))
+		}
+		// Daemons default to being system daemons
+		if app.Daemon != "" && app.DaemonScope == "" {
+			app.DaemonScope = SystemDaemon
+		}
 
 		snap.Apps[appName] = app
 		for _, alias := range app.LegacyAliases {
@@ -416,6 +426,17 @@
 			strk.markSlot(slot)
 			app.Slots[slotName] = slot
 			slot.Apps[appName] = app
+		}
+		for _, slotName := range yApp.ActivatesOn {
+			slot, ok := snap.Slots[slotName]
+			if !ok {
+				return fmt.Errorf("invalid activates-on value %q on app %q: slot not found", slotName, appName)
+			}
+			app.ActivatesOn = append(app.ActivatesOn, slot)
+			// Implicitly add the slot to the app
+			strk.markSlot(slot)
+			app.Slots[slotName] = slot
+			slot.Apps[appName] = app
 		}
 		for name, data := range yApp.Sockets {
 			app.Sockets[name] = &SocketInfo{
diff -Nru snapd-2.45.1+20.04.2/snap/info_snap_yaml_test.go snapd-2.48.3+20.04/snap/info_snap_yaml_test.go
--- snapd-2.45.1+20.04.2/snap/info_snap_yaml_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/info_snap_yaml_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -61,7 +61,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(info.InstanceName(), Equals, "foo")
 	c.Assert(info.Version, Equals, "1.0")
-	c.Assert(info.GetType(), Equals, snap.TypeApp)
+	c.Assert(info.Type(), Equals, snap.TypeApp)
 	c.Assert(info.Epoch, DeepEquals, snap.E("0"))
 }
 
@@ -71,7 +71,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(info.InstanceName(), Equals, "snapd")
 	c.Assert(info.Version, Equals, "1.0")
-	c.Assert(info.GetType(), Equals, snap.TypeSnapd)
+	c.Assert(info.Type(), Equals, snap.TypeSnapd)
 }
 
 func (s *InfoSnapYamlTestSuite) TestFail(c *C) {
@@ -1225,7 +1225,7 @@
 	c.Assert(err, IsNil)
 	c.Check(info.InstanceName(), Equals, "foo")
 	c.Check(info.Version, Equals, "1.2")
-	c.Check(info.GetType(), Equals, snap.TypeApp)
+	c.Check(info.Type(), Equals, snap.TypeApp)
 	c.Check(info.Epoch, DeepEquals, snap.E("1*"))
 	c.Check(info.Confinement, Equals, snap.DevModeConfinement)
 	c.Check(info.Title(), Equals, "Foo")
@@ -1350,6 +1350,64 @@
 		app1.Name: app1, app2.Name: app2})
 }
 
+func (s *YamlSuite) TestUnmarshalActivatesOn(c *C) {
+	info, err := snap.InfoFromSnapYaml([]byte(`
+name: snap
+slots:
+    test-slot1:
+    test-slot2:
+apps:
+    daemon:
+        activates-on: ["test-slot1", "test-slot2"]
+    foo:
+`))
+	c.Assert(err, IsNil)
+	c.Check(info.InstanceName(), Equals, "snap")
+	c.Check(info.Plugs, HasLen, 0)
+	c.Check(info.Slots, HasLen, 2)
+	c.Check(info.Apps, HasLen, 2)
+	c.Check(info.Hooks, HasLen, 0)
+
+	app1 := info.Apps["daemon"]
+	app2 := info.Apps["foo"]
+	slot1 := info.Slots["test-slot1"]
+	slot2 := info.Slots["test-slot2"]
+
+	c.Assert(app1, Not(IsNil))
+	c.Check(app1.Name, Equals, "daemon")
+	c.Check(app1.ActivatesOn, DeepEquals, []*snap.SlotInfo{slot1, slot2})
+	// activates-on slots are implicitly added to the app
+	c.Check(app1.Slots, DeepEquals, map[string]*snap.SlotInfo{
+		slot1.Name: slot1, slot2.Name: slot2})
+
+	c.Assert(app2, Not(IsNil))
+	c.Check(app2.Name, Equals, "foo")
+	c.Check(app2.ActivatesOn, HasLen, 0)
+	// As slot has been bound to app1, it isn't implicitly applied here
+	c.Check(app2.Slots, HasLen, 0)
+
+	c.Assert(slot1, Not(IsNil))
+	c.Check(slot1.Name, Equals, "test-slot1")
+	c.Check(slot1.Apps, DeepEquals, map[string]*snap.AppInfo{
+		app1.Name: app1})
+
+	c.Assert(slot2, Not(IsNil))
+	c.Check(slot2.Name, Equals, "test-slot2")
+	c.Check(slot2.Apps, DeepEquals, map[string]*snap.AppInfo{
+		app1.Name: app1})
+}
+
+func (s *YamlSuite) TestUnmarshalActivatesOnUnknownSlot(c *C) {
+	info, err := snap.InfoFromSnapYaml([]byte(`
+name: snap
+apps:
+    daemon:
+        activates-on: ["test-slot"]
+`))
+	c.Check(info, IsNil)
+	c.Check(err, ErrorMatches, `invalid activates-on value "test-slot" on app "daemon": slot not found`)
+}
+
 // type and architectures
 
 func (s *YamlSuite) TestSnapYamlTypeDefault(c *C) {
@@ -1358,7 +1416,7 @@
 `)
 	info, err := snap.InfoFromSnapYaml(y)
 	c.Assert(err, IsNil)
-	c.Assert(info.GetType(), Equals, snap.TypeApp)
+	c.Assert(info.Type(), Equals, snap.TypeApp)
 }
 
 func (s *YamlSuite) TestSnapYamlEpochDefault(c *C) {
@@ -1459,6 +1517,7 @@
    stop-timeout: 25s
    start-timeout: 42m
    daemon: forking
+   daemon-scope: system
    stop-command: stop-cmd
    post-stop-command: post-stop-cmd
    restart-condition: on-abnormal
@@ -1476,6 +1535,7 @@
 		Name:            "svc",
 		Command:         "svc1",
 		Daemon:          "forking",
+		DaemonScope:     snap.SystemDaemon,
 		RestartCond:     snap.RestartOnAbnormal,
 		StopTimeout:     timeout.Timeout(25 * time.Second),
 		StartTimeout:    timeout.Timeout(42 * time.Minute),
@@ -1495,6 +1555,35 @@
 	c.Check(info.Apps, DeepEquals, map[string]*snap.AppInfo{"svc": &app})
 }
 
+func (s *YamlSuite) TestDaemonUserDaemon(c *C) {
+	y := []byte(`name: wat
+version: 42
+apps:
+ svc:
+   command: svc1
+   daemon: simple
+   daemon-scope: user
+`)
+	info, err := snap.InfoFromSnapYaml(y)
+	c.Assert(err, IsNil)
+	c.Check(info.Apps["svc"].DaemonScope, Equals, snap.UserDaemon)
+}
+
+func (s *YamlSuite) TestDaemonNoDaemonScope(c *C) {
+	y := []byte(`name: wat
+version: 42
+apps:
+ svc:
+   command: svc1
+   daemon: simple
+`)
+	info, err := snap.InfoFromSnapYaml(y)
+	c.Assert(err, IsNil)
+
+	// If daemon-scope is unset, default to system scope
+	c.Check(info.Apps["svc"].DaemonScope, Equals, snap.SystemDaemon)
+}
+
 func (s *YamlSuite) TestDaemonListenStreamAsInteger(c *C) {
 	y := []byte(`name: wat
 version: 42
@@ -1542,6 +1631,18 @@
 		"  line 9: cannot unmarshal !!str `asdfasdf` into os.FileMode")
 }
 
+func (s *YamlSuite) TestDaemonInvalidDaemonScope(c *C) {
+	y := []byte(`name: wat
+version: 42
+apps:
+ svc:
+   command: svc
+   daemon-scope: invalid
+`)
+	_, err := snap.InfoFromSnapYaml(y)
+	c.Check(err.Error(), Equals, "cannot parse snap.yaml: invalid daemon scope: \"invalid\"")
+}
+
 func (s *YamlSuite) TestSnapYamlGlobalEnvironment(c *C) {
 	y := []byte(`
 name: foo
diff -Nru snapd-2.45.1+20.04.2/snap/info_test.go snapd-2.48.3+20.04/snap/info_test.go
--- snapd-2.45.1+20.04.2/snap/info_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/info_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2016 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -403,7 +403,7 @@
 	c.Assert(err, IsNil)
 	c.Check(info.InstanceName(), Equals, "foo")
 	c.Check(info.Version, Equals, "1.0")
-	c.Check(info.GetType(), Equals, snap.TypeApp)
+	c.Check(info.Type(), Equals, snap.TypeApp)
 	c.Check(info.Revision, Equals, snap.R(0))
 	c.Check(info.Epoch.String(), Equals, "1*")
 	c.Check(info.Confinement, Equals, snap.DevModeConfinement)
@@ -425,7 +425,7 @@
 	c.Assert(err, IsNil)
 	c.Check(info.InstanceName(), Equals, "foo")
 	c.Check(info.Version, Equals, "1.0")
-	c.Check(info.GetType(), Equals, snap.TypeApp)
+	c.Check(info.Type(), Equals, snap.TypeApp)
 	c.Check(info.Revision, Equals, snap.R(0))
 	c.Check(info.Confinement, Equals, snap.ClassicConfinement)
 	c.Check(info.NeedsDevMode(), Equals, false)
@@ -445,7 +445,7 @@
 	c.Assert(err, IsNil)
 	c.Check(info.InstanceName(), Equals, "foo")
 	c.Check(info.Version, Equals, "1.0")
-	c.Check(info.GetType(), Equals, snap.TypeApp)
+	c.Check(info.Type(), Equals, snap.TypeApp)
 	c.Check(info.Revision, Equals, snap.R(0))
 	c.Check(info.Epoch.String(), Equals, "0") // Defaults to 0
 	c.Check(info.Confinement, Equals, snap.StrictConfinement)
@@ -468,7 +468,7 @@
 	c.Assert(err, IsNil)
 	c.Check(info.InstanceName(), Equals, "baz")
 	c.Check(info.Version, Equals, "1.0")
-	c.Check(info.GetType(), Equals, snap.TypeApp)
+	c.Check(info.Type(), Equals, snap.TypeApp)
 	c.Check(info.Revision, Equals, snap.R(42))
 }
 
@@ -1105,12 +1105,14 @@
 	c.Check(snapInfo.InstanceName(), Equals, "sample")
 	c.Check(snapInfo.Apps["app"].DesktopFile(), Matches, `.*/var/lib/snapd/desktop/applications/sample_app.desktop`)
 	c.Check(snapInfo.Apps["sample"].DesktopFile(), Matches, `.*/var/lib/snapd/desktop/applications/sample_sample.desktop`)
+	c.Check(snapInfo.DesktopPrefix(), Equals, "sample")
 
 	// snap with instance key
 	snapInfo.InstanceKey = "instance"
 	c.Check(snapInfo.InstanceName(), Equals, "sample_instance")
-	c.Check(snapInfo.Apps["app"].DesktopFile(), Matches, `.*/var/lib/snapd/desktop/applications/sample_instance_app.desktop`)
-	c.Check(snapInfo.Apps["sample"].DesktopFile(), Matches, `.*/var/lib/snapd/desktop/applications/sample_instance_sample.desktop`)
+	c.Check(snapInfo.Apps["app"].DesktopFile(), Matches, `.*/var/lib/snapd/desktop/applications/sample\+instance_app.desktop`)
+	c.Check(snapInfo.Apps["sample"].DesktopFile(), Matches, `.*/var/lib/snapd/desktop/applications/sample\+instance_sample.desktop`)
+	c.Check(snapInfo.DesktopPrefix(), Equals, "sample+instance")
 }
 
 const coreSnapYaml = `name: core
@@ -1200,6 +1202,9 @@
     daemon: potato
   svc2:
     daemon: no
+  svc3:
+    daemon: simple
+    daemon-scope: user
   app1:
   app2:
 `))
@@ -1207,10 +1212,16 @@
 
 	svc := info.Apps["svc1"]
 	c.Check(svc.IsService(), Equals, true)
+	c.Check(svc.DaemonScope, Equals, snap.SystemDaemon)
 	c.Check(svc.ServiceName(), Equals, "snap.pans.svc1.service")
 	c.Check(svc.ServiceFile(), Equals, dirs.GlobalRootDir+"/etc/systemd/system/snap.pans.svc1.service")
 
 	c.Check(info.Apps["svc2"].IsService(), Equals, true)
+	userSvc := info.Apps["svc3"]
+	c.Check(userSvc.IsService(), Equals, true)
+	c.Check(userSvc.DaemonScope, Equals, snap.UserDaemon)
+	c.Check(userSvc.ServiceName(), Equals, "snap.pans.svc3.service")
+	c.Check(userSvc.ServiceFile(), Equals, dirs.GlobalRootDir+"/etc/systemd/user/snap.pans.svc3.service")
 	c.Check(info.Apps["app1"].IsService(), Equals, false)
 	c.Check(info.Apps["app1"].IsService(), Equals, false)
 
@@ -1218,6 +1229,8 @@
 	info.InstanceKey = "instance"
 	c.Check(svc.ServiceName(), Equals, "snap.pans_instance.svc1.service")
 	c.Check(svc.ServiceFile(), Equals, dirs.GlobalRootDir+"/etc/systemd/system/snap.pans_instance.svc1.service")
+	c.Check(userSvc.ServiceName(), Equals, "snap.pans_instance.svc3.service")
+	c.Check(userSvc.ServiceFile(), Equals, dirs.GlobalRootDir+"/etc/systemd/user/snap.pans_instance.svc3.service")
 }
 
 func (s *infoSuite) TestAppInfoStringer(c *C) {
@@ -1555,14 +1568,14 @@
 	c.Check(info2.IsActive(), Equals, false)
 }
 
-func (s *infoSuite) TestGetTypeSnapdBackwardCompatibility(c *C) {
+func (s *infoSuite) TestInfoTypeSnapdBackwardCompatibility(c *C) {
 	const snapdYaml = `
 name: snapd
 type: app
 version: 1
 `
 	snapInfo := snaptest.MockSnap(c, sampleYaml, &snap.SideInfo{Revision: snap.R(1), SnapID: "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4"})
-	c.Check(snapInfo.GetType(), Equals, snap.TypeSnapd)
+	c.Check(snapInfo.Type(), Equals, snap.TypeSnapd)
 }
 
 func (s *infoSuite) TestDirAndFileHelpers(c *C) {
@@ -1729,3 +1742,22 @@
 		}
 	}
 }
+
+func (s *infoSuite) TestSortAppInfoBySnapApp(c *C) {
+	snap1 := &snap.Info{SuggestedName: "snapa"}
+	snap2 := &snap.Info{SuggestedName: "snapb"}
+	infos := []*snap.AppInfo{
+		{Snap: snap1, Name: "b"},
+		{Snap: snap2, Name: "b"},
+		{Snap: snap1, Name: "a"},
+		{Snap: snap2, Name: "a"},
+	}
+	sort.Stable(snap.AppInfoBySnapApp(infos))
+
+	c.Check(infos, DeepEquals, []*snap.AppInfo{
+		{Snap: snap1, Name: "a"},
+		{Snap: snap1, Name: "b"},
+		{Snap: snap2, Name: "a"},
+		{Snap: snap2, Name: "b"},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/snap/internal/file.go snapd-2.48.3+20.04/snap/internal/file.go
--- snapd-2.45.1+20.04.2/snap/internal/file.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snap/internal/file.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package internal
+
+import (
+	"os"
+)
+
+// SizedFile holds an os.File plus its (initial) size.
+type SizedFile struct {
+	*os.File
+	size int64
+}
+
+func NewSizedFile(f *os.File) (*SizedFile, error) {
+	fi, err := f.Stat()
+	if err != nil {
+		return nil, err
+	}
+	return &SizedFile{File: f, size: fi.Size()}, nil
+}
+
+func (f *SizedFile) Size() int64 {
+	return f.size
+}
diff -Nru snapd-2.45.1+20.04.2/snap/naming/snapref.go snapd-2.48.3+20.04/snap/naming/snapref.go
--- snapd-2.45.1+20.04.2/snap/naming/snapref.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/snapref.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2019 Canonical Ltd
+ * Copyright (C) 2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -69,6 +69,8 @@
 type SnapSet struct {
 	byID   map[string]SnapRef
 	byName map[string]SnapRef
+
+	n int
 }
 
 // NewSnapSet builds a snap set with the given references.
@@ -86,7 +88,12 @@
 
 // Empty returns whether the snap set is empty.
 func (s *SnapSet) Empty() bool {
-	return len(s.byID) == 0 && len(s.byName) == 0
+	return s.n == 0
+}
+
+// Size returns the number of snaps in the snap set.
+func (s *SnapSet) Size() int {
+	return s.n
 }
 
 // Lookup finds the reference in the set matching the given one if any.
@@ -118,10 +125,14 @@
 		// nothing to do
 		return
 	}
+	inc := 0
 	if id := ref.ID(); id != "" {
 		s.byID[id] = ref
+		inc = 1
 	}
 	if name := ref.SnapName(); name != "" {
 		s.byName[name] = ref
+		inc = 1
 	}
+	s.n += inc
 }
diff -Nru snapd-2.45.1+20.04.2/snap/naming/snapref_test.go snapd-2.48.3+20.04/snap/naming/snapref_test.go
--- snapd-2.45.1+20.04.2/snap/naming/snapref_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/snapref_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -64,13 +64,16 @@
 func (s *snapRefSuite) TestSnapSet(c *C) {
 	ss := naming.NewSnapSet(nil)
 	c.Check(ss.Empty(), Equals, true)
+	c.Check(ss.Size(), Equals, 0)
 
 	fooRef := naming.NewSnapRef("foo", "foo-id")
 	fooNameOnlyRef := naming.Snap("foo")
 
 	ss.Add(fooRef)
 	c.Check(ss.Empty(), Equals, false)
+	c.Check(ss.Size(), Equals, 1)
 	ss.Add(fooNameOnlyRef)
+	c.Check(ss.Size(), Equals, 1)
 
 	altFooRef := naming.NewSnapRef("foo-proj", "foo-id")
 	c.Check(ss.Lookup(fooRef), Equals, fooRef)
@@ -85,7 +88,9 @@
 	// weaker behavior but expected
 	ss1 := naming.NewSnapSet([]naming.SnapRef{fooNameOnlyRef})
 	c.Check(ss.Empty(), Equals, false)
+	c.Check(ss.Size(), Equals, 1)
 	ss1.Add(fooRef)
+	c.Check(ss.Size(), Equals, 1)
 	c.Check(ss1.Lookup(fooRef), Equals, fooNameOnlyRef)
 	c.Check(ss1.Lookup(altFooRef), Equals, nil)
 	c.Check(ss1.Lookup(barNameOnylRef), Equals, nil)
diff -Nru snapd-2.45.1+20.04.2/snap/naming/tag.go snapd-2.48.3+20.04/snap/naming/tag.go
--- snapd-2.45.1+20.04.2/snap/naming/tag.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/tag.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,149 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package naming
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+var errInvalidSecurityTag = errors.New("invalid security tag")
+
+// SecurityTag exposes details of a validated snap security tag.
+type SecurityTag interface {
+	// String returns the entire security tag.
+	String() string
+
+	// InstanceName returns the snap name and instance key.
+	InstanceName() string
+}
+
+// AppSecurityTag exposes details of a validated snap application security tag.
+type AppSecurityTag interface {
+	SecurityTag
+	// AppName returns the name of the application.
+	AppName() string
+}
+
+type appSecurityTag struct {
+	instanceName string
+	appName      string
+}
+
+func (t appSecurityTag) String() string {
+	return fmt.Sprintf("snap.%s.%s", t.instanceName, t.appName)
+}
+
+func (t appSecurityTag) InstanceName() string {
+	return t.instanceName
+}
+
+func (t appSecurityTag) AppName() string {
+	return t.appName
+}
+
+// HookSecurityTag exposes details of a validated snap hook security tag.
+type HookSecurityTag interface {
+	SecurityTag
+	// HookName returns the name of the hook.
+	HookName() string
+}
+
+type hookSecurityTag struct {
+	instanceName string
+	hookName     string
+}
+
+func (t hookSecurityTag) String() string {
+	return fmt.Sprintf("snap.%s.hook.%s", t.instanceName, t.hookName)
+}
+
+func (t hookSecurityTag) InstanceName() string {
+	return t.instanceName
+}
+
+func (t hookSecurityTag) HookName() string {
+	return t.hookName
+}
+
+// ParseSecurityTag parses a snap security tag and returns a parsed representation or an error.
+//
+// Further type assertions can be used to described the particular form, either
+// describing an application or a hook specific security tag.
+func ParseSecurityTag(tag string) (SecurityTag, error) {
+	// We expect at most four parts. Split with up to five parts so that the
+	// len(parts) test catches invalid format tags very early.
+	parts := strings.SplitN(tag, ".", 5)
+	// We expect either three or four components.
+	if len(parts) != 3 && len(parts) != 4 {
+		return nil, errInvalidSecurityTag
+	}
+	// We expect "snap" and the snap instance name as first two fields.
+	snapLiteral, snapName := parts[0], parts[1]
+	if snapLiteral != "snap" {
+		return nil, errInvalidSecurityTag
+	}
+	if err := ValidateInstance(snapName); err != nil {
+		return nil, errInvalidSecurityTag
+	}
+	// Depending on the type of the tag we either expect application name or
+	// the "hook" literal and the hook name.
+	if len(parts) == 3 {
+		appName := parts[2]
+		if err := ValidateApp(appName); err != nil {
+			return nil, errInvalidSecurityTag
+		}
+		return &appSecurityTag{instanceName: snapName, appName: appName}, nil
+	} else {
+		hookLiteral, hookName := parts[2], parts[3]
+		if hookLiteral != "hook" {
+			return nil, errInvalidSecurityTag
+		}
+		if err := ValidateHook(hookName); err != nil {
+			return nil, errInvalidSecurityTag
+		}
+		return &hookSecurityTag{instanceName: snapName, hookName: hookName}, nil
+	}
+}
+
+// ParseAppSecurityTag parses an app security tag.
+func ParseAppSecurityTag(tag string) (AppSecurityTag, error) {
+	parsedTag, err := ParseSecurityTag(tag)
+	if err != nil {
+		return nil, err
+	}
+	if parsedAppTag, ok := parsedTag.(AppSecurityTag); ok {
+		return parsedAppTag, nil
+	}
+	return nil, fmt.Errorf("%q is not an app security tag", tag)
+}
+
+// ParseHookSecurityTag parses a hook security tag.
+func ParseHookSecurityTag(tag string) (HookSecurityTag, error) {
+	parsedTag, err := ParseSecurityTag(tag)
+	if err != nil {
+		return nil, err
+	}
+	if parsedHookTag, ok := parsedTag.(HookSecurityTag); ok {
+		return parsedHookTag, nil
+	}
+	return nil, fmt.Errorf("%q is not a hook security tag", tag)
+}
diff -Nru snapd-2.45.1+20.04.2/snap/naming/tag_test.go snapd-2.48.3+20.04/snap/naming/tag_test.go
--- snapd-2.45.1+20.04.2/snap/naming/tag_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/tag_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,130 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package naming_test
+
+import (
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/snap/naming"
+)
+
+type tagSuite struct{}
+
+var _ = Suite(&tagSuite{})
+
+func (s *tagSuite) TestParseSecurityTag(c *C) {
+	// valid snap names, snap instances, app names and hook names are accepted.
+	tag, err := naming.ParseSecurityTag("snap.pkg.app")
+	c.Assert(err, IsNil)
+	c.Check(tag.String(), Equals, "snap.pkg.app")
+	c.Check(tag.InstanceName(), Equals, "pkg")
+	c.Check(tag.(naming.AppSecurityTag).AppName(), Equals, "app")
+
+	tag, err = naming.ParseSecurityTag("snap.pkg_key.app")
+	c.Assert(err, IsNil)
+	c.Check(tag.String(), Equals, "snap.pkg_key.app")
+	c.Check(tag.InstanceName(), Equals, "pkg_key")
+	c.Check(tag.(naming.AppSecurityTag).AppName(), Equals, "app")
+
+	tag, err = naming.ParseSecurityTag("snap.pkg.hook.configure")
+	c.Assert(err, IsNil)
+	c.Check(tag.String(), Equals, "snap.pkg.hook.configure")
+	c.Check(tag.InstanceName(), Equals, "pkg")
+	c.Check(tag.(naming.HookSecurityTag).HookName(), Equals, "configure")
+
+	tag, err = naming.ParseSecurityTag("snap.pkg_key.hook.configure")
+	c.Assert(err, IsNil)
+	c.Check(tag.String(), Equals, "snap.pkg_key.hook.configure")
+	c.Check(tag.InstanceName(), Equals, "pkg_key")
+	c.Check(tag.(naming.HookSecurityTag).HookName(), Equals, "configure")
+
+	// invalid format is rejected
+	_, err = naming.ParseSecurityTag("snap.pkg.app.surprise")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap.pkg_key.app.surprise")
+	c.Check(err, ErrorMatches, "invalid security tag")
+
+	// invalid snap and app names are rejected.
+	_, err = naming.ParseSecurityTag("snap._.app")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap.pkg._")
+	c.Check(err, ErrorMatches, "invalid security tag")
+
+	// invalid number of components are rejected.
+	_, err = naming.ParseSecurityTag("snap.pkg.hook.surprise.")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap.pkg.hook.")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	tag, err = naming.ParseSecurityTag("snap.pkg.hook")
+	c.Assert(err, IsNil) // Perhaps somewhat unexpectedly, this tag is valid.
+	c.Check(tag.(naming.AppSecurityTag).AppName(), Equals, "hook")
+	_, err = naming.ParseSecurityTag("snap.pkg.app.surprise")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap.pkg.")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap.pkg")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap.")
+	c.Check(err, ErrorMatches, "invalid security tag")
+	_, err = naming.ParseSecurityTag("snap")
+	c.Check(err, ErrorMatches, "invalid security tag")
+
+	// things that are not snap.* tags
+	_, err = naming.ParseSecurityTag("foo.bar.froz")
+	c.Check(err, ErrorMatches, "invalid security tag")
+}
+
+func (s *tagSuite) TestParseAppSecurityTag(c *C) {
+	// Invalid security tags cannot be parsed.
+	tag, err := naming.ParseAppSecurityTag("potato")
+	c.Assert(err, ErrorMatches, "invalid security tag")
+	c.Assert(tag, IsNil)
+
+	// App security tags can be parsed.
+	tag, err = naming.ParseAppSecurityTag("snap.pkg.app")
+	c.Assert(err, IsNil)
+	c.Check(tag.String(), Equals, "snap.pkg.app")
+	c.Check(tag.InstanceName(), Equals, "pkg")
+	c.Check(tag.AppName(), Equals, "app")
+
+	// Hook security tags are not app security tags.
+	tag, err = naming.ParseAppSecurityTag("snap.pkg.hook.configure")
+	c.Assert(err, ErrorMatches, `"snap.pkg.hook.configure" is not an app security tag`)
+	c.Assert(tag, IsNil)
+}
+
+func (s *tagSuite) TestParseHookSecurityTag(c *C) {
+	// Invalid security tags cannot be parsed.
+	tag, err := naming.ParseHookSecurityTag("potato")
+	c.Assert(err, ErrorMatches, "invalid security tag")
+	c.Assert(tag, IsNil)
+
+	// Hook security tags can be parsed.
+	tag, err = naming.ParseHookSecurityTag("snap.pkg.hook.configure")
+	c.Assert(err, IsNil)
+	c.Check(tag.String(), Equals, "snap.pkg.hook.configure")
+	c.Check(tag.InstanceName(), Equals, "pkg")
+	c.Check(tag.HookName(), Equals, "configure")
+
+	// App security tags are not hook security tags.
+	tag, err = naming.ParseHookSecurityTag("snap.pkg.app")
+	c.Assert(err, ErrorMatches, `"snap.pkg.app" is not a hook security tag`)
+	c.Assert(tag, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/snap/naming/validate.go snapd-2.48.3+20.04/snap/naming/validate.go
--- snapd-2.45.1+20.04.2/snap/naming/validate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/validate.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,7 +21,6 @@
 package naming
 
 import (
-	"errors"
 	"fmt"
 	"regexp"
 	"strings"
@@ -176,8 +175,6 @@
 	return nil
 }
 
-var errInvalidSecurityTag = errors.New("invalid security tag")
-
 // ValidateSecurityTag validates known variants of snap security tag.
 //
 // Two forms are recognised, one for apps and one for hooks. Other forms
@@ -185,39 +182,6 @@
 //
 // TODO: handle the weird udev variant.
 func ValidateSecurityTag(tag string) error {
-	// We expect at most four parts. Split with up to five parts so that the
-	// len(parts) test catches invalid format tags very early.
-	parts := strings.SplitN(tag, ".", 5)
-	// We expect either three or four components.
-	if len(parts) != 3 && len(parts) != 4 {
-		return errInvalidSecurityTag
-	}
-	// We expect "snap" and the snap instance name as first two fields.
-	snapLiteral, snapName := parts[0], parts[1]
-	if snapLiteral != "snap" {
-		return errInvalidSecurityTag
-	}
-	if err := ValidateInstance(snapName); err != nil {
-		return errInvalidSecurityTag
-	}
-	// Depending on the type of the tag we either expect application name or
-	// the "hook" literal and the hook name.
-	switch len(parts) {
-	case 3:
-		appName := parts[2]
-		if err := ValidateApp(appName); err != nil {
-			return errInvalidSecurityTag
-		}
-		return nil
-	case 4:
-		hookLiteral, hookName := parts[2], parts[3]
-		if hookLiteral != "hook" {
-			return errInvalidSecurityTag
-		}
-		if err := ValidateHook(hookName); err != nil {
-			return errInvalidSecurityTag
-		}
-		return nil
-	}
-	return errInvalidSecurityTag
+	_, err := ParseSecurityTag(tag)
+	return err
 }
diff -Nru snapd-2.45.1+20.04.2/snap/naming/validate_test.go snapd-2.48.3+20.04/snap/naming/validate_test.go
--- snapd-2.45.1+20.04.2/snap/naming/validate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/validate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -306,6 +306,7 @@
 	c.Check(naming.ValidateSecurityTag("snap.pkg_key.app"), IsNil)
 	c.Check(naming.ValidateSecurityTag("snap.pkg_key.hook.configure"), IsNil)
 
+	// invalid format is rejected
 	c.Check(naming.ValidateSecurityTag("snap.pkg_key.app.surprise"), ErrorMatches, "invalid security tag")
 	c.Check(naming.ValidateSecurityTag("snap.pkg_key.hook.configure.surprise"), ErrorMatches, "invalid security tag")
 
diff -Nru snapd-2.45.1+20.04.2/snap/naming/wellknown.go snapd-2.48.3+20.04/snap/naming/wellknown.go
--- snapd-2.45.1+20.04.2/snap/naming/wellknown.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/naming/wellknown.go	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,7 @@
 		"core":   "xMNMpEm0COPZy7jq9YRwWVLCD9q5peow",
 		"snapd":  "Z44rtQD1v4r1LXGPCDZAJO3AOw1EDGqy",
 		"core18": "NhSvwckvNdvgdiVGlsO1vYmi3FPdTZ9U",
-		// XXX no core20 uploaded to staging yet
+		// TODO:UC20 no core20 uploaded to staging yet
 		"core20": "",
 	}
 )
diff -Nru snapd-2.45.1+20.04.2/snap/pack/pack.go snapd-2.48.3+20.04/snap/pack/pack.go
--- snapd-2.45.1+20.04.2/snap/pack/pack.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/pack/pack.go	2021-02-02 08:21:12.000000000 +0000
@@ -27,6 +27,7 @@
 	"path/filepath"
 
 	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/kernel"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snapdir"
@@ -125,10 +126,19 @@
 	}
 
 	if info.SnapType == snap.TypeGadget {
-		if err := gadget.Validate(sourceDir, nil); err != nil {
+		// TODO:UC20: optionally pass model
+		// TODO:UC20: pass validation constraints which indicate intent
+		//            to have data encrypted
+		if err := gadget.Validate(sourceDir, nil, nil); err != nil {
 			return nil, err
 		}
 	}
+	if info.SnapType == snap.TypeKernel {
+		if err := kernel.Validate(sourceDir); err != nil {
+			return nil, err
+		}
+	}
+
 	return info, nil
 }
 
@@ -220,7 +230,7 @@
 	snapName := snapPath(info, opts.TargetDir, opts.SnapName)
 	d := squashfs.New(snapName)
 	if err = d.Build(sourceDir, &squashfs.BuildOpts{
-		SnapType:     string(info.GetType()),
+		SnapType:     string(info.Type()),
 		Compression:  opts.Compression,
 		ExcludeFiles: []string{excludes},
 	}); err != nil {
diff -Nru snapd-2.45.1+20.04.2/snap/snapdir/snapdir.go snapd-2.48.3+20.04/snap/snapdir/snapdir.go
--- snapd-2.45.1+20.04.2/snap/snapdir/snapdir.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snapdir/snapdir.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,6 +28,7 @@
 
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/internal"
 )
 
 func IsSnapDir(path string) bool {
@@ -74,8 +75,13 @@
 func (s *SnapDir) RandomAccessFile(file string) (interface {
 	io.ReaderAt
 	io.Closer
+	Size() int64
 }, error) {
-	return os.Open(filepath.Join(s.path, file))
+	f, err := os.Open(filepath.Join(s.path, file))
+	if err != nil {
+		return nil, err
+	}
+	return internal.NewSizedFile(f)
 }
 
 func (s *SnapDir) ReadFile(file string) (content []byte, err error) {
diff -Nru snapd-2.45.1+20.04.2/snap/snapdir/snapdir_test.go snapd-2.48.3+20.04/snap/snapdir/snapdir_test.go
--- snapd-2.45.1+20.04.2/snap/snapdir/snapdir_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snapdir/snapdir_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -43,6 +43,22 @@
 
 var _ = Suite(&SnapdirTestSuite{})
 
+func (s *SnapdirTestSuite) TestIsSnapDir(c *C) {
+	d := c.MkDir()
+	err := os.MkdirAll(filepath.Join(d, "meta"), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(d, "meta/snap.yaml"), nil, 0644)
+	c.Assert(err, IsNil)
+
+	c.Check(snapdir.IsSnapDir(d), Equals, true)
+}
+
+func (s *SnapdirTestSuite) TestNotIsSnapDir(c *C) {
+	c.Check(snapdir.IsSnapDir("/not-existent"), Equals, false)
+	c.Check(snapdir.IsSnapDir("/dev/null"), Equals, false)
+	c.Check(snapdir.IsSnapDir(c.MkDir()), Equals, false)
+}
+
 func (s *SnapdirTestSuite) TestReadFile(c *C) {
 	d := c.MkDir()
 	needle := []byte(`stuff`)
@@ -66,6 +82,8 @@
 	c.Assert(err, IsNil)
 	defer r.Close()
 
+	c.Assert(r.Size(), Equals, int64(5))
+
 	b := make([]byte, 2)
 	n, err := r.ReadAt(b, 2)
 	c.Assert(err, IsNil)
diff -Nru snapd-2.45.1+20.04.2/snap/snapenv/snapenv.go snapd-2.48.3+20.04/snap/snapenv/snapenv.go
--- snapd-2.45.1+20.04.2/snap/snapenv/snapenv.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snapenv/snapenv.go	2021-02-02 08:21:12.000000000 +0000
@@ -118,5 +118,7 @@
 		env["HOME"] = info.UserDataDir(home)
 		env["XDG_RUNTIME_DIR"] = info.UserXdgRuntimeDir(sys.Geteuid())
 	}
+	// Provide the location of the real home directory.
+	env["SNAP_REAL_HOME"] = home
 	return env
 }
diff -Nru snapd-2.45.1+20.04.2/snap/snapenv/snapenv_test.go snapd-2.48.3+20.04/snap/snapenv/snapenv_test.go
--- snapd-2.45.1+20.04.2/snap/snapenv/snapenv_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snapenv/snapenv_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -103,6 +103,7 @@
 		"SNAP_USER_DATA":   "/root/snap/foo/17",
 		"HOME":             "/root/snap/foo/17",
 		"XDG_RUNTIME_DIR":  fmt.Sprintf("/run/user/%d/snap.foo", sys.Geteuid()),
+		"SNAP_REAL_HOME":   "/root",
 	})
 }
 
@@ -119,6 +120,7 @@
 		"SNAP_USER_COMMON": "/root/snap/foo/common",
 		"SNAP_USER_DATA":   "/root/snap/foo/17",
 		"XDG_RUNTIME_DIR":  fmt.Sprintf(dirs.GlobalRootDir+"/run/user/%d/snap.foo", sys.Geteuid()),
+		"SNAP_REAL_HOME":   "/root",
 	})
 
 	// With the classic-preserves-xdg-runtime-dir feature enabled the snap
@@ -130,6 +132,7 @@
 		// NOTE: Both HOME and XDG_RUNTIME_DIR are not defined here.
 		"SNAP_USER_COMMON": "/root/snap/foo/common",
 		"SNAP_USER_DATA":   "/root/snap/foo/17",
+		"SNAP_REAL_HOME":   "/root",
 	})
 }
 
@@ -166,6 +169,7 @@
 			"SNAP_USER_DATA":     fmt.Sprintf("%s/snap/snapname/42", usr.HomeDir),
 			"HOME":               fmt.Sprintf("%s/snap/snapname/42", usr.HomeDir),
 			"XDG_RUNTIME_DIR":    fmt.Sprintf("/run/user/%d/snap.snapname", sys.Geteuid()),
+			"SNAP_REAL_HOME":     usr.HomeDir,
 		})
 	}
 }
@@ -210,6 +214,7 @@
 			"SNAP_USER_DATA":   fmt.Sprintf("%s/snap/snapname_foo/42", usr.HomeDir),
 			"HOME":             fmt.Sprintf("%s/snap/snapname_foo/42", usr.HomeDir),
 			"XDG_RUNTIME_DIR":  fmt.Sprintf("/run/user/%d/snap.snapname_foo", sys.Geteuid()),
+			"SNAP_REAL_HOME":   usr.HomeDir,
 		})
 	}
 }
@@ -224,6 +229,7 @@
 		"SNAP_USER_DATA":   "/root/snap/foo_bar/17",
 		"HOME":             "/root/snap/foo_bar/17",
 		"XDG_RUNTIME_DIR":  fmt.Sprintf("/run/user/%d/snap.foo_bar", sys.Geteuid()),
+		"SNAP_REAL_HOME":   "/root",
 	})
 }
 
@@ -242,6 +248,7 @@
 		"SNAP_USER_COMMON": "/root/snap/foo_bar/common",
 		"SNAP_USER_DATA":   "/root/snap/foo_bar/17",
 		"XDG_RUNTIME_DIR":  fmt.Sprintf(dirs.GlobalRootDir+"/run/user/%d/snap.foo_bar", sys.Geteuid()),
+		"SNAP_REAL_HOME":   "/root",
 	})
 
 	// With the classic-preserves-xdg-runtime-dir feature enabled the snap
@@ -253,6 +260,7 @@
 		// NOTE, Both HOME and XDG_RUNTIME_DIR are not defined here.
 		"SNAP_USER_COMMON": "/root/snap/foo_bar/common",
 		"SNAP_USER_DATA":   "/root/snap/foo_bar/17",
+		"SNAP_REAL_HOME":   "/root",
 	})
 }
 
diff -Nru snapd-2.45.1+20.04.2/snap/snapfile/snapfile.go snapd-2.48.3+20.04/snap/snapfile/snapfile.go
--- snapd-2.45.1+20.04.2/snap/snapfile/snapfile.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snapfile/snapfile.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,12 +36,12 @@
 	// standard squashfs snap file format
 	{
 		squashfs.FileHasSquashfsHeader,
-		func(fn string) (snap.Container, error) { return squashfs.New(fn), nil },
+		func(p string) (snap.Container, error) { return squashfs.New(p), nil },
 	},
 	// snap directory format, i.e. snap try <dir>
 	{
 		snapdir.IsSnapDir,
-		func(fn string) (snap.Container, error) { return snapdir.New(fn), nil },
+		func(p string) (snap.Container, error) { return snapdir.New(p), nil },
 	},
 }
 
diff -Nru snapd-2.45.1+20.04.2/snap/snaptest/snaptest.go snapd-2.48.3+20.04/snap/snaptest/snaptest.go
--- snapd-2.45.1+20.04.2/snap/snaptest/snaptest.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snaptest/snaptest.go	2021-02-02 08:21:12.000000000 +0000
@@ -131,6 +131,13 @@
 	defer restoreSanitize()
 	snapInfo, err := snap.InfoFromSnapYaml([]byte(yamlText))
 	c.Assert(err, check.IsNil)
+	if snapInfo.InstanceName() == "core" && snapInfo.Type() != snap.TypeOS {
+		panic("core snap must use type: os")
+	}
+	if snapInfo.InstanceName() == "snapd" && snapInfo.Type() != snap.TypeSnapd {
+		panic("snapd snap must use type: snapd")
+	}
+
 	snapInfo.SideInfo = *sideInfo
 	err = snap.Validate(snapInfo)
 	c.Assert(err, check.IsNil)
diff -Nru snapd-2.45.1+20.04.2/snap/snaptest/snaptest_test.go snapd-2.48.3+20.04/snap/snaptest/snaptest_test.go
--- snapd-2.45.1+20.04.2/snap/snaptest/snaptest_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/snaptest/snaptest_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -153,6 +153,7 @@
 
 func (s *snapTestSuite) TestRenameSlot(c *C) {
 	snapInfo := snaptest.MockInfo(c, `name: core
+type: os
 version: 0
 slots:
   old:
diff -Nru snapd-2.45.1+20.04.2/snap/squashfs/export_test.go snapd-2.48.3+20.04/snap/squashfs/export_test.go
--- snapd-2.45.1+20.04.2/snap/squashfs/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/squashfs/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,7 +32,10 @@
 	NewUnsquashfsStderrWriter = newUnsquashfsStderrWriter
 )
 
-const MaxErrPaths = maxErrPaths
+const (
+	SuperblockSize = superblockSize
+	MaxErrPaths    = maxErrPaths
+)
 
 func (s stat) User() string  { return s.user }
 func (s stat) Group() string { return s.group }
@@ -46,10 +49,10 @@
 }
 
 func MockCommandFromSystemSnap(f func(string, ...string) (*exec.Cmd, error)) (restore func()) {
-	oldCommandFromSystemSnap := cmdutilCommandFromSystemSnap
-	cmdutilCommandFromSystemSnap = f
+	oldCommandFromSystemSnap := snapdtoolCommandFromSystemSnap
+	snapdtoolCommandFromSystemSnap = f
 	return func() {
-		cmdutilCommandFromSystemSnap = oldCommandFromSystemSnap
+		snapdtoolCommandFromSystemSnap = oldCommandFromSystemSnap
 	}
 }
 
diff -Nru snapd-2.45.1+20.04.2/snap/squashfs/squashfs.go snapd-2.48.3+20.04/snap/squashfs/squashfs.go
--- snapd-2.45.1+20.04.2/snap/squashfs/squashfs.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/squashfs/squashfs.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,14 +34,20 @@
 	"syscall"
 	"time"
 
-	"github.com/snapcore/snapd/cmd/cmdutil"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/internal"
+	"github.com/snapcore/snapd/snapdtool"
 	"github.com/snapcore/snapd/strutil"
 )
 
+const (
+	// https://github.com/plougher/squashfs-tools/blob/master/squashfs-tools/squashfs_fs.h#L289
+	superblockSize = 96
+)
+
 var (
 	// magic is the magic prefix of squashfs snap files.
 	magic = []byte{'h', 's', 'q', 's'}
@@ -57,7 +63,8 @@
 	}
 	defer f.Close()
 
-	header := make([]byte, 20)
+	// a squashfs file would contain at least the superblock + some data
+	header := make([]byte, superblockSize+1)
 	if _, err := f.ReadAt(header, 0); err != nil {
 		return false
 	}
@@ -81,7 +88,7 @@
 }
 
 var osLink = os.Link
-var cmdutilCommandFromSystemSnap = cmdutil.CommandFromSystemSnap
+var snapdtoolCommandFromSystemSnap = snapdtool.CommandFromSystemSnap
 
 // Install installs a squashfs snap file through an appropriate method.
 func (s *Snap) Install(targetPath, mountDir string, opts *snap.InstallOptions) (bool, error) {
@@ -231,11 +238,13 @@
 	return f(filepath.Join(unpackDir, filePath))
 }
 
-// RandomAccessFile returns an implementation to read at any given location
-// for a single file inside the squashfs snap.
+// RandomAccessFile returns an implementation to read at any given
+// location for a single file inside the squashfs snap plus
+// information about the file size.
 func (s *Snap) RandomAccessFile(filePath string) (interface {
 	io.ReaderAt
 	io.Closer
+	Size() int64
 }, error) {
 	var f *os.File
 	err := s.withUnpackedFile(filePath, func(p string) (err error) {
@@ -245,7 +254,7 @@
 	if err != nil {
 		return nil, err
 	}
-	return f, nil
+	return internal.NewSizedFile(f)
 }
 
 // ReadFile returns the content of a single file inside a squashfs snap.
@@ -466,6 +475,14 @@
 	return errPaths.asErr()
 }
 
+type MksquashfsError struct {
+	msg string
+}
+
+func (m MksquashfsError) Error() string {
+	return m.msg
+}
+
 type BuildOpts struct {
 	SnapType     string
 	Compression  string
@@ -493,7 +510,7 @@
 		// https://forum.snapcraft.io/t/squashfs-performance-effect-on-snap-startup-time/13920
 		compression = "xz"
 	}
-	cmd, err := cmdutilCommandFromSystemSnap("/usr/bin/mksquashfs")
+	cmd, err := snapdtoolCommandFromSystemSnap("/usr/bin/mksquashfs")
 	if err != nil {
 		cmd = exec.Command("mksquashfs")
 	}
@@ -518,7 +535,7 @@
 	return osutil.ChDir(sourceDir, func() error {
 		output, err := cmd.CombinedOutput()
 		if err != nil {
-			return fmt.Errorf("mksquashfs call failed: %s", osutil.OutputErr(output, err))
+			return MksquashfsError{fmt.Sprintf("mksquashfs call failed: %s", osutil.OutputErr(output, err))}
 		}
 
 		return nil
diff -Nru snapd-2.45.1+20.04.2/snap/squashfs/squashfs_test.go snapd-2.48.3+20.04/snap/squashfs/squashfs_test.go
--- snapd-2.45.1+20.04.2/snap/squashfs/squashfs_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/squashfs/squashfs_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -132,6 +132,28 @@
 	c.Check(string(outbuf), Equals, "")
 }
 
+func (s *SquashfsTestSuite) TestFileHasSquashfsHeader(c *C) {
+	sn := makeSnap(c, "name: test", "")
+	c.Check(squashfs.FileHasSquashfsHeader(sn.Path()), Equals, true)
+}
+
+func (s *SquashfsTestSuite) TestNotFileHasSquashfsHeader(c *C) {
+	data := []string{
+		"hsqs",
+		"hsqs\x00",
+		"hsqs" + strings.Repeat("\x00", squashfs.SuperblockSize-4),
+		"hsqt" + strings.Repeat("\x00", squashfs.SuperblockSize-4+1),
+		"not a snap",
+	}
+
+	for _, d := range data {
+		err := ioutil.WriteFile("not-a-snap", []byte(d), 0644)
+		c.Assert(err, IsNil)
+
+		c.Check(squashfs.FileHasSquashfsHeader("not-a-snap"), Equals, false)
+	}
+}
+
 func (s *SquashfsTestSuite) TestInstallSimpleNoCp(c *C) {
 	// mock cp but still cp
 	cmd := testutil.MockCommand(c, "cp", `#!/bin/sh
@@ -306,6 +328,8 @@
 	c.Assert(err, IsNil)
 	defer r.Close()
 
+	c.Assert(r.Size(), Equals, int64(9))
+
 	b := make([]byte, 4)
 	n, err := r.ReadAt(b, 4)
 	c.Assert(err, IsNil)
diff -Nru snapd-2.45.1+20.04.2/snap/types.go snapd-2.48.3+20.04/snap/types.go
--- snapd-2.45.1+20.04.2/snap/types.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/types.go	2021-02-02 08:21:12.000000000 +0000
@@ -142,4 +142,43 @@
 	StopReasonRefresh ServiceStopReason = "refresh"
 	StopReasonRemove  ServiceStopReason = "remove"
 	StopReasonDisable ServiceStopReason = "disable"
+	StopReasonOther   ServiceStopReason = ""
 )
+
+// DaemonScope represents the scope of the daemon running under systemd
+type DaemonScope string
+
+const (
+	SystemDaemon DaemonScope = "system"
+	UserDaemon   DaemonScope = "user"
+)
+
+// UnmarshalJSON sets *daemonScope to a copy of data, assuming validation passes
+func (daemonScope *DaemonScope) UnmarshalJSON(data []byte) error {
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return err
+	}
+
+	return daemonScope.fromString(s)
+}
+
+// UnmarshalYAML so DaemonScope implements yaml's Unmarshaler interface
+func (daemonScope *DaemonScope) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var s string
+	if err := unmarshal(&s); err != nil {
+		return err
+	}
+
+	return daemonScope.fromString(s)
+}
+
+func (daemonScope *DaemonScope) fromString(str string) error {
+	d := DaemonScope(str)
+	if d != SystemDaemon && d != UserDaemon {
+		return fmt.Errorf("invalid daemon scope: %q", str)
+	}
+
+	*daemonScope = d
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/snap/types_test.go snapd-2.48.3+20.04/snap/types_test.go
--- snapd-2.45.1+20.04.2/snap/types_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/types_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -226,3 +226,67 @@
 		c.Assert(err, NotNil, Commentf("Expected '%s' to be an invalid confinement type", thisConfinementType))
 	}
 }
+
+func (s *typeSuite) TestYamlMarshalDaemonScopes(c *C) {
+	out, err := yaml.Marshal(SystemDaemon)
+	c.Assert(err, IsNil)
+	c.Check(string(out), Equals, "system\n")
+
+	out, err = yaml.Marshal(UserDaemon)
+	c.Assert(err, IsNil)
+	c.Check(string(out), Equals, "user\n")
+}
+
+func (s *typeSuite) TestYamlUnmarshalDaemonScopes(c *C) {
+	var daemonScope DaemonScope
+	err := yaml.Unmarshal([]byte("system"), &daemonScope)
+	c.Assert(err, IsNil)
+	c.Check(daemonScope, Equals, SystemDaemon)
+
+	err = yaml.Unmarshal([]byte("user"), &daemonScope)
+	c.Assert(err, IsNil)
+	c.Check(daemonScope, Equals, UserDaemon)
+}
+
+func (s *typeSuite) TestYamlUnmarshalInvalidDaemonScopes(c *C) {
+	var invalidDaemonScopes = []string{
+		"foo", "system-", "_user",
+	}
+	var daemonScope DaemonScope
+	for _, thisDaemonScope := range invalidDaemonScopes {
+		err := yaml.Unmarshal([]byte(thisDaemonScope), &daemonScope)
+		c.Assert(err, NotNil, Commentf("Expected '%s' to be an invalid daemon scope", thisDaemonScope))
+	}
+}
+
+func (s *typeSuite) TestJsonMarshalDaemonScopes(c *C) {
+	out, err := json.Marshal(SystemDaemon)
+	c.Assert(err, IsNil)
+	c.Check(string(out), Equals, "\"system\"")
+
+	out, err = json.Marshal(UserDaemon)
+	c.Assert(err, IsNil)
+	c.Check(string(out), Equals, "\"user\"")
+}
+
+func (s *typeSuite) TestJsonUnmarshalDaemonScopes(c *C) {
+	var daemonScope DaemonScope
+	err := json.Unmarshal([]byte("\"system\""), &daemonScope)
+	c.Assert(err, IsNil)
+	c.Check(daemonScope, Equals, SystemDaemon)
+
+	err = json.Unmarshal([]byte("\"user\""), &daemonScope)
+	c.Assert(err, IsNil)
+	c.Check(daemonScope, Equals, UserDaemon)
+}
+
+func (s *typeSuite) TestJsonUnmarshalInvalidDaemonScopes(c *C) {
+	var invalidDaemonScopes = []string{
+		"foo", "system-", "_user",
+	}
+	var daemonScope DaemonScope
+	for _, thisDaemonScope := range invalidDaemonScopes {
+		err := json.Unmarshal([]byte(fmt.Sprintf("%q", thisDaemonScope)), &daemonScope)
+		c.Assert(err, NotNil, Commentf("Expected '%s' to be an invalid daemon scope", thisDaemonScope))
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/snap/validate.go snapd-2.48.3+20.04/snap/validate.go
--- snapd-2.45.1+20.04.2/snap/validate.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/validate.go	2021-02-02 08:21:12.000000000 +0000
@@ -48,6 +48,25 @@
 	return naming.ValidateSnap(name)
 }
 
+// ValidateDesktopPrefix checks if a string can be used as a desktop file
+// prefix. A desktop prefix should be of the form 'snapname' or
+// 'snapname+instance'.
+func ValidateDesktopPrefix(prefix string) bool {
+	tokens := strings.Split(prefix, "+")
+	if len(tokens) == 0 || len(tokens) > 2 {
+		return false
+	}
+	if err := ValidateName(tokens[0]); err != nil {
+		return false
+	}
+	if len(tokens) == 2 {
+		if err := ValidateInstanceName(tokens[1]); err != nil {
+			return false
+		}
+	}
+	return true
+}
+
 // ValidatePlugName checks if a string can be used as a slot name.
 //
 // Slot names and plug names within one snap must have unique names.
@@ -198,9 +217,19 @@
 		return fmt.Errorf("invalid %q: %q should be written as %q", fieldName, path, clean)
 	}
 
-	if !(strings.HasPrefix(path, "$SNAP_DATA/") || strings.HasPrefix(path, "$SNAP_COMMON/") || strings.HasPrefix(path, "$XDG_RUNTIME_DIR/")) {
-		return fmt.Errorf(
-			"invalid %q: must have a prefix of $SNAP_DATA, $SNAP_COMMON or $XDG_RUNTIME_DIR", fieldName)
+	switch socket.App.DaemonScope {
+	case SystemDaemon:
+		if !(strings.HasPrefix(path, "$SNAP_DATA/") || strings.HasPrefix(path, "$SNAP_COMMON/") || strings.HasPrefix(path, "$XDG_RUNTIME_DIR/")) {
+			return fmt.Errorf(
+				"invalid %q: system daemon sockets must have a prefix of $SNAP_DATA, $SNAP_COMMON or $XDG_RUNTIME_DIR", fieldName)
+		}
+	case UserDaemon:
+		if !(strings.HasPrefix(path, "$SNAP_USER_DATA/") || strings.HasPrefix(path, "$SNAP_USER_COMMON/") || strings.HasPrefix(path, "$XDG_RUNTIME_DIR/")) {
+			return fmt.Errorf(
+				"invalid %q: user daemon sockets must have a prefix of $SNAP_USER_DATA, $SNAP_USER_COMMON, or $XDG_RUNTIME_DIR", fieldName)
+		}
+	default:
+		return fmt.Errorf("invalid %q: cannot validate sockets for daemon-scope %q", fieldName, socket.App.DaemonScope)
 	}
 
 	return nil
@@ -360,9 +389,9 @@
 // ValidateBase validates the base field.
 func ValidateBase(info *Info) error {
 	// validate that bases do not have base fields
-	if info.GetType() == TypeOS || info.GetType() == TypeBase {
+	if info.Type() == TypeOS || info.Type() == TypeBase {
 		if info.Base != "" && info.Base != "none" {
-			return fmt.Errorf(`cannot have "base" field on %q snap %q`, info.GetType(), info.InstanceName())
+			return fmt.Errorf(`cannot have "base" field on %q snap %q`, info.Type(), info.InstanceName())
 		}
 	}
 
@@ -390,6 +419,38 @@
 	}
 	sort.Strings(paths)
 
+	// Validate that each source path is not a new top-level directory
+	for _, layout := range info.Layout {
+		cleanPathSrc := info.ExpandSnapVariables(filepath.Clean(layout.Path))
+		elems := strings.SplitN(cleanPathSrc, string(os.PathSeparator), 3)
+		switch len(elems) {
+		// len(1) is either relative path or empty string, will be validated
+		// elsewhere
+		case 2, 3:
+			// if the first string is the empty string, then we have a top-level
+			// directory to check
+			if elems[0] != "" {
+				// not the empty string which means this was a relative
+				// specification, i.e. usr/src/doc
+				return fmt.Errorf("layout %q is a relative filename", layout.Path)
+			}
+			if elems[1] != "" {
+				// verify that the top-level directory is a supported one
+				// we can't create new top-level directories because that would
+				// require creating a mimic on top of "/" which we don't
+				// currently support
+				switch elems[1] {
+				// this list was produced by taking all of the top level
+				// directories in the core snap and removing the explicitly
+				// denied top-level directories
+				case "bin", "etc", "lib", "lib64", "meta", "mnt", "opt", "root", "sbin", "snap", "srv", "usr", "var", "writable":
+				default:
+					return fmt.Errorf("layout %q defines a new top-level directory %q", layout.Path, "/"+elems[1])
+				}
+			}
+		}
+	}
+
 	// Validate that each source path is used consistently as a file or as a directory.
 	sourceKindMap := make(map[string]string)
 	for _, path := range paths {
@@ -510,6 +571,10 @@
 		if !other.IsService() {
 			return fmt.Errorf("before/after references a non-service application %q", dep)
 		}
+
+		if app.DaemonScope != other.DaemonScope {
+			return fmt.Errorf("before/after references service with different daemon-scope %q", dep)
+		}
 	}
 	return nil
 }
@@ -578,6 +643,43 @@
 	return nil
 }
 
+func validateAppActivatesOn(app *AppInfo) error {
+	if len(app.ActivatesOn) == 0 {
+		return nil
+	}
+
+	if !app.IsService() {
+		return errors.New("activates-on is only applicable to services")
+	}
+
+	for _, slot := range app.ActivatesOn {
+		// ActivatesOn slots must use the "dbus" interface
+		if slot.Interface != "dbus" {
+			return fmt.Errorf("invalid activates-on value %q: slot does not use dbus interface", slot.Name)
+		}
+
+		// D-Bus slots must match the daemon scope
+		bus := slot.Attrs["bus"]
+		if app.DaemonScope == SystemDaemon && bus != "system" || app.DaemonScope == UserDaemon && bus != "session" {
+			return fmt.Errorf("invalid activates-on value %q: bus %q does not match daemon-scope %q", slot.Name, bus, app.DaemonScope)
+		}
+
+		// Slots must only be activatable on a single app
+		for _, otherApp := range slot.Apps {
+			if otherApp == app {
+				continue
+			}
+			for _, otherSlot := range otherApp.ActivatesOn {
+				if otherSlot == slot {
+					return fmt.Errorf("invalid activates-on value %q: slot is also activatable on app %q", slot.Name, otherApp.Name)
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
 // appContentWhitelist is the whitelist of legal chars in the "apps"
 // section of snap.yaml. Do not allow any of [',",`] here or snap-exec
 // will get confused. chainContentWhitelist is the same, but for the
@@ -599,6 +701,19 @@
 		return fmt.Errorf(`"daemon" field contains invalid value %q`, app.Daemon)
 	}
 
+	switch app.DaemonScope {
+	case "":
+		if app.Daemon != "" {
+			return fmt.Errorf(`"daemon-scope" must be set for daemons`)
+		}
+	case SystemDaemon, UserDaemon:
+		if app.Daemon == "" {
+			return fmt.Errorf(`"daemon-scope" can only be set for daemons`)
+		}
+	default:
+		return fmt.Errorf(`invalid "daemon-scope": %q`, app.DaemonScope)
+	}
+
 	// Validate app name
 	if !ValidAppName(app.Name) {
 		return fmt.Errorf("cannot have %q as app name - use letters, digits, and dash as separator", app.Name)
@@ -639,6 +754,10 @@
 		}
 	}
 
+	if err := validateAppActivatesOn(app); err != nil {
+		return err
+	}
+
 	if err := validateAppRestart(app); err != nil {
 		return err
 	}
diff -Nru snapd-2.45.1+20.04.2/snap/validate_test.go snapd-2.48.3+20.04/snap/validate_test.go
--- snapd-2.45.1+20.04.2/snap/validate_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snap/validate_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -50,8 +50,10 @@
 				Revision: R(20),
 			},
 		},
-		Name:  "foo",
-		Plugs: map[string]*PlugInfo{"network-bind": {}},
+		Name:        "foo",
+		Daemon:      "simple",
+		DaemonScope: SystemDaemon,
+		Plugs:       map[string]*PlugInfo{"network-bind": {}},
 		Sockets: map[string]*SocketInfo{
 			"sock": socket,
 		},
@@ -244,12 +246,15 @@
 		// socket paths out of the snap dirs
 		"/some/path/my.socket",
 		"/var/snap/mysnap/20/my.socket", // path is correct but has hardcoded prefix
+		// Variables only valid for user mode services
+		"$SNAP_USER_DATA/my.socket",
+		"$SNAP_USER_COMMON/my.socket",
 	}
 	socket := app.Sockets["sock"]
 	for _, invalidAddress := range invalidListenAddresses {
 		socket.ListenStream = invalidAddress
 		err := ValidateApp(app)
-		c.Assert(err, ErrorMatches, `invalid definition of socket "sock": invalid "listen-stream": must have a prefix of .*`)
+		c.Assert(err, ErrorMatches, `invalid definition of socket "sock": invalid "listen-stream": system daemon sockets must have a prefix of .*`)
 	}
 }
 
@@ -274,7 +279,7 @@
 		err := ValidateApp(app)
 		c.Assert(
 			err, ErrorMatches,
-			`invalid definition of socket "sock": invalid "listen-stream": must have a prefix of \$SNAP_DATA, \$SNAP_COMMON or \$XDG_RUNTIME_DIR`)
+			`invalid definition of socket "sock": invalid "listen-stream": system daemon sockets must have a prefix of \$SNAP_DATA, \$SNAP_COMMON or \$XDG_RUNTIME_DIR`)
 	}
 }
 
@@ -297,6 +302,8 @@
 
 func (s *ValidateSuite) TestValidateAppSocketsInvalidListenStreamAddress(c *C) {
 	app := createSampleApp()
+	app.Daemon = "simple"
+	app.DaemonScope = SystemDaemon
 	invalidListenAddresses := []string{
 		"10.0.1.1:8080",
 		"[fafa::baba]:8080",
@@ -331,6 +338,90 @@
 	}
 }
 
+func (s *ValidateSuite) TestValidateAppUserSocketsValidListenStreamAddresses(c *C) {
+	app := createSampleApp()
+	app.DaemonScope = UserDaemon
+	validListenAddresses := []string{
+		// socket paths using variables as prefix
+		"$SNAP_USER_DATA/my.socket",
+		"$SNAP_USER_COMMON/my.socket",
+		"$XDG_RUNTIME_DIR/my.socket",
+		// abstract sockets
+		"@snap.mysnap.my.socket",
+		// addresses and ports
+		"1",
+		"1023",
+		"1024",
+		"65535",
+		"127.0.0.1:8080",
+		"[::]:8080",
+		"[::1]:8080",
+	}
+	socket := app.Sockets["sock"]
+	for _, validAddress := range validListenAddresses {
+		socket.ListenStream = validAddress
+		err := ValidateApp(app)
+		c.Check(err, IsNil, Commentf(validAddress))
+	}
+}
+
+func (s *ValidateSuite) TestValidateAppUserSocketsInvalidListenStreamPath(c *C) {
+	app := createSampleApp()
+	app.DaemonScope = UserDaemon
+	invalidListenAddresses := []string{
+		// socket paths out of the snap dirs
+		"/some/path/my.socket",
+		// Variables only valid for system mode services
+		"$SNAP_DATA/my.socket",
+		"$SNAP_COMMON/my.socket",
+	}
+	socket := app.Sockets["sock"]
+	for _, invalidAddress := range invalidListenAddresses {
+		socket.ListenStream = invalidAddress
+		err := ValidateApp(app)
+		c.Check(err, ErrorMatches, `invalid definition of socket "sock": invalid "listen-stream": user daemon sockets must have a prefix of .*`)
+	}
+}
+
+func (s *ValidateSuite) TestValidateAppUserSocketsInvalidListenStreamAbstractSocket(c *C) {
+	app := createSampleApp()
+	app.DaemonScope = UserDaemon
+	invalidListenAddresses := []string{
+		"@snap.mysnap",
+		"@snap.mysnap\000.foo",
+		"@snap.notmysnap.my.socket",
+		"@some.other.name",
+		"@snap.myappiswrong.foo",
+	}
+	socket := app.Sockets["sock"]
+	for _, invalidAddress := range invalidListenAddresses {
+		socket.ListenStream = invalidAddress
+		err := ValidateApp(app)
+		c.Assert(err, ErrorMatches, `invalid definition of socket "sock": path for "listen-stream" must be prefixed with.*`)
+	}
+}
+
+func (s *ValidateSuite) TestValidateAppUserSocketsInvalidListenStreamPort(c *C) {
+	app := createSampleApp()
+	app.DaemonScope = UserDaemon
+	invalidListenAddresses := []string{
+		"0",
+		"66536",
+		"-8080",
+		"12312345345",
+		"[::]:-123",
+		"[::1]:3452345234",
+		"invalid",
+		"[::]:invalid",
+	}
+	socket := app.Sockets["sock"]
+	for _, invalidAddress := range invalidListenAddresses {
+		socket.ListenStream = invalidAddress
+		err := ValidateApp(app)
+		c.Check(err, ErrorMatches, `invalid definition of socket "sock": invalid "listen-stream" port number .*`)
+	}
+}
+
 func (s *ValidateSuite) TestAppWhitelistSimple(c *C) {
 	c.Check(ValidateApp(&AppInfo{Name: "foo", Command: "foo"}), IsNil)
 	c.Check(ValidateApp(&AppInfo{Name: "foo", StopCommand: "foo"}), IsNil)
@@ -370,10 +461,44 @@
 		// bad
 		{"invalid-thing", false},
 	} {
+		var daemonScope DaemonScope
+		if t.daemon != "" {
+			daemonScope = SystemDaemon
+		}
 		if t.ok {
-			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: t.daemon}), IsNil)
+			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: t.daemon, DaemonScope: daemonScope}), IsNil)
 		} else {
-			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: t.daemon}), ErrorMatches, fmt.Sprintf(`"daemon" field contains invalid value %q`, t.daemon))
+			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: t.daemon, DaemonScope: daemonScope}), ErrorMatches, fmt.Sprintf(`"daemon" field contains invalid value %q`, t.daemon))
+		}
+	}
+}
+
+func (s *ValidateSuite) TestAppDaemonScopeValue(c *C) {
+	for _, t := range []struct {
+		daemon      string
+		daemonScope DaemonScope
+		ok          bool
+	}{
+		// good
+		{"", "", true},
+		{"simple", SystemDaemon, true},
+		{"simple", UserDaemon, true},
+		// bad
+		{"simple", "", false},
+		{"", SystemDaemon, false},
+		{"", UserDaemon, false},
+		{"simple", "invalid-mode", false},
+	} {
+		app := &AppInfo{Name: "foo", Daemon: t.daemon, DaemonScope: t.daemonScope}
+		err := ValidateApp(app)
+		if t.ok {
+			c.Check(err, IsNil)
+		} else if t.daemon == "" {
+			c.Check(err, ErrorMatches, `"daemon-scope" can only be set for daemons`)
+		} else if t.daemonScope == "" {
+			c.Check(err, ErrorMatches, `"daemon-scope" must be set for daemons`)
+		} else {
+			c.Check(err, ErrorMatches, fmt.Sprintf(`invalid "daemon-scope": %q`, t.daemonScope))
 		}
 	}
 }
@@ -398,9 +523,9 @@
 		{"invalid-thing", false},
 	} {
 		if t.ok {
-			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", StopMode: t.stopMode}), IsNil)
+			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", DaemonScope: SystemDaemon, StopMode: t.stopMode}), IsNil)
 		} else {
-			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", StopMode: t.stopMode}), ErrorMatches, fmt.Sprintf(`"stop-mode" field contains invalid value %q`, t.stopMode))
+			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", DaemonScope: SystemDaemon, StopMode: t.stopMode}), ErrorMatches, fmt.Sprintf(`"stop-mode" field contains invalid value %q`, t.stopMode))
 		}
 	}
 
@@ -422,10 +547,11 @@
 		// bad
 		{"invalid-thing", false},
 	} {
+		err := ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", DaemonScope: SystemDaemon, RefreshMode: t.refreshMode})
 		if t.ok {
-			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", RefreshMode: t.refreshMode}), IsNil)
+			c.Check(err, IsNil)
 		} else {
-			c.Check(ValidateApp(&AppInfo{Name: "foo", Daemon: "simple", RefreshMode: t.refreshMode}), ErrorMatches, fmt.Sprintf(`"refresh-mode" field contains invalid value %q`, t.refreshMode))
+			c.Check(err, ErrorMatches, fmt.Sprintf(`"refresh-mode" field contains invalid value %q`, t.refreshMode))
 		}
 	}
 
@@ -440,6 +566,104 @@
 	c.Check(err.Error(), Equals, `app description field 'command' contains illegal "x\n" (legal: '^[A-Za-z0-9/. _#:$-]*$')`)
 }
 
+func (s *ValidateSuite) TestAppActivatesOn(c *C) {
+	info, err := InfoFromSnapYaml([]byte(`name: foo
+version: 1.0
+slots:
+  dbus-slot:
+    interface: dbus
+    bus: system
+apps:
+  server:
+    daemon: simple
+    activates-on: [dbus-slot]
+`))
+	c.Assert(err, IsNil)
+	app := info.Apps["server"]
+	c.Check(ValidateApp(app), IsNil)
+}
+
+func (s *ValidateSuite) TestAppActivatesOnNotDaemon(c *C) {
+	info, err := InfoFromSnapYaml([]byte(`name: foo
+version: 1.0
+slots:
+  dbus-slot:
+apps:
+  server:
+    activates-on: [dbus-slot]
+`))
+	c.Assert(err, IsNil)
+	app := info.Apps["server"]
+	c.Check(ValidateApp(app), ErrorMatches, `activates-on is only applicable to services`)
+}
+
+func (s *ValidateSuite) TestAppActivatesOnSlotNotDbus(c *C) {
+	info, err := InfoFromSnapYaml([]byte(`name: foo
+version: 1.0
+apps:
+  server:
+    daemon: simple
+    slots: [network-bind]
+    activates-on: [network-bind]
+`))
+	c.Assert(err, IsNil)
+	app := info.Apps["server"]
+	c.Check(ValidateApp(app), ErrorMatches, `invalid activates-on value "network-bind": slot does not use dbus interface`)
+}
+
+func (s *ValidateSuite) TestAppActivatesOnDaemonScopeMismatch(c *C) {
+	info, err := InfoFromSnapYaml([]byte(`name: foo
+version: 1.0
+slots:
+  dbus-slot:
+    interface: dbus
+    bus: session
+apps:
+  server:
+    daemon: simple
+    activates-on: [dbus-slot]
+`))
+	c.Assert(err, IsNil)
+	app := info.Apps["server"]
+	c.Check(ValidateApp(app), ErrorMatches, `invalid activates-on value "dbus-slot": bus "session" does not match daemon-scope "system"`)
+
+	info, err = InfoFromSnapYaml([]byte(`name: foo
+version: 1.0
+slots:
+  dbus-slot:
+    interface: dbus
+    bus: system
+apps:
+  server:
+    daemon: simple
+    daemon-scope: user
+    activates-on: [dbus-slot]
+`))
+	c.Assert(err, IsNil)
+	app = info.Apps["server"]
+	c.Check(ValidateApp(app), ErrorMatches, `invalid activates-on value "dbus-slot": bus "system" does not match daemon-scope "user"`)
+}
+
+func (s *ValidateSuite) TestAppActivatesOnDuplicateApp(c *C) {
+	info, err := InfoFromSnapYaml([]byte(`name: foo
+version: 1.0
+slots:
+  dbus-slot:
+    interface: dbus
+    bus: system
+apps:
+  server:
+    daemon: simple
+    activates-on: [dbus-slot]
+  dup:
+    daemon: simple
+    activates-on: [dbus-slot]
+`))
+	c.Assert(err, IsNil)
+	app := info.Apps["server"]
+	c.Check(ValidateApp(app), ErrorMatches, `invalid activates-on value "dbus-slot": slot is also activatable on app "dup"`)
+}
+
 // Validate
 
 func (s *ValidateSuite) TestDetectIllegalYamlBinaries(c *C) {
@@ -986,7 +1210,7 @@
 	err = ValidateLayoutAll(info)
 	c.Assert(err, IsNil)
 
-	// Layout replacing files in another snap's mount p oit
+	// Layout replacing files in another snap's mount point
 	const yaml12 = `
 name: this-snap
 layout:
@@ -1000,6 +1224,47 @@
 	c.Assert(info.Layout, HasLen, 1)
 	err = ValidateLayoutAll(info)
 	c.Assert(err, ErrorMatches, `layout "/snap/that-snap/current/stuff" defines a layout in space belonging to another snap`)
+
+	const yaml13 = `
+name: this-snap
+layout:
+  $SNAP/relative:
+    symlink: $SNAP/existent-dir
+`
+
+	// Layout using $SNAP/... as source
+	strk = NewScopedTracker()
+	info, err = InfoFromSnapYamlWithSideInfo([]byte(yaml13), &SideInfo{Revision: R(42)}, strk)
+	c.Assert(err, IsNil)
+	c.Assert(info.Layout, HasLen, 1)
+	err = ValidateLayoutAll(info)
+	c.Assert(err, IsNil)
+
+	var yaml14Pattern = `
+name: this-snap
+layout:
+  %s:
+    symlink: $SNAP/existent-dir
+`
+
+	for _, testCase := range []struct {
+		str         string
+		topLevelDir string
+	}{
+		{"/nonexistent-dir", "/nonexistent-dir"},
+		{"/nonexistent-dir/subdir", "/nonexistent-dir"},
+		{"///////unclean-absolute-dir", "/unclean-absolute-dir"},
+	} {
+		// Layout adding a new top-level directory
+		strk = NewScopedTracker()
+		yaml14 := fmt.Sprintf(yaml14Pattern, testCase.str)
+		info, err = InfoFromSnapYamlWithSideInfo([]byte(yaml14), &SideInfo{Revision: R(42)}, strk)
+		c.Assert(err, IsNil)
+		c.Assert(info.Layout, HasLen, 1)
+		err = ValidateLayoutAll(info)
+		c.Assert(err, ErrorMatches, fmt.Sprintf(`layout %q defines a new top-level directory %q`, testCase.str, testCase.topLevelDir))
+	}
+
 }
 
 func (s *YamlSuite) TestValidateAppStartupOrder(c *C) {
@@ -1114,6 +1379,15 @@
    daemon: dbus
    after: [foo, bar, baz]
 `)
+	mixedSystemUserDaemons := []byte(`
+apps:
+ foo:
+   daemon: simple
+ bar:
+   daemon: simple
+   daemon-scope: user
+   after: [foo]
+`)
 
 	tcs := []struct {
 		name string
@@ -1156,8 +1430,12 @@
 	}, {
 		name: "self cycle",
 		desc: fooSelfCycle,
-		err:  `applications are part of a before/after cycle: foo`},
-	}
+		err:  `applications are part of a before/after cycle: foo`,
+	}, {
+		name: "user daemon wants system daemon",
+		desc: mixedSystemUserDaemons,
+		err:  `invalid definition of application "bar": before/after references service with different daemon-scope "foo"`,
+	}}
 	for _, tc := range tcs {
 		c.Logf("trying %q", tc.name)
 		info, err := InfoFromSnapYaml(append(meta, tc.desc...))
@@ -1689,3 +1967,27 @@
 	errors := ValidateBasesAndProviders(infos)
 	c.Assert(errors, IsNil)
 }
+
+func (s *validateSuite) TestValidateDesktopPrefix(c *C) {
+	// these are extensively tested elsewhere, so just try some common ones
+	for i, tc := range []struct {
+		prefix string
+		exp    bool
+	}{
+		{"good", true},
+		{"also-good", true},
+		{"also-good+instance", true},
+		{"", false},
+		{"+", false},
+		{"@", false},
+		{"+good", false},
+		{"good+", false},
+		{"good+@", false},
+		{"old-style_instance", false},
+		{"bad+bad+bad", false},
+	} {
+		c.Logf("tc #%v", i)
+		res := ValidateDesktopPrefix(tc.prefix)
+		c.Check(res, Equals, tc.exp)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/snapdenv/snapdenv.go snapd-2.48.3+20.04/snapdenv/snapdenv.go
--- snapd-2.45.1+20.04.2/snapdenv/snapdenv.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/snapdenv/snapdenv.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,7 +32,7 @@
 // is this a testing binary? (see withtestkeys.go)
 var testingBinary = false
 
-// Testing returns whether snapd compontents are under testing.
+// Testing returns whether snapd components are under testing.
 func Testing() bool {
 	if mockTesting != nil {
 		return *mockTesting
diff -Nru snapd-2.45.1+20.04.2/snapdtool/cmdutil.go snapd-2.48.3+20.04/snapdtool/cmdutil.go
--- snapd-2.45.1+20.04.2/snapdtool/cmdutil.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/cmdutil.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,140 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool
+
+import (
+	"bufio"
+	"bytes"
+	"debug/elf"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+)
+
+func elfInterp(cmd string) (string, error) {
+	el, err := elf.Open(cmd)
+	if err != nil {
+		return "", err
+	}
+	defer el.Close()
+
+	for _, prog := range el.Progs {
+		if prog.Type == elf.PT_INTERP {
+			r := prog.Open()
+			interp, err := ioutil.ReadAll(r)
+			if err != nil {
+				return "", nil
+			}
+
+			return string(bytes.Trim(interp, "\x00")), nil
+		}
+	}
+
+	return "", fmt.Errorf("cannot find PT_INTERP header")
+}
+
+func parseLdSoConf(root string, confPath string) []string {
+	f, err := os.Open(filepath.Join(root, confPath))
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+
+	var out []string
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		switch {
+		case strings.HasPrefix(line, "#"):
+			// nothing
+		case strings.TrimSpace(line) == "":
+			// nothing
+		case strings.HasPrefix(line, "include "):
+			l := strings.SplitN(line, "include ", 2)
+			files, err := filepath.Glob(filepath.Join(root, l[1]))
+			if err != nil {
+				return nil
+			}
+			for _, f := range files {
+				out = append(out, parseLdSoConf(root, f[len(root):])...)
+			}
+		default:
+			out = append(out, filepath.Join(root, line))
+		}
+
+	}
+	if err := scanner.Err(); err != nil {
+		return nil
+	}
+
+	return out
+}
+
+// CommandFromSystemSnap runs a command from the snapd/core snap
+// using the proper interpreter and library paths.
+//
+// At the moment it can only run ELF files, expects a standard ld.so
+// interpreter, and can't handle RPATH.
+func CommandFromSystemSnap(name string, cmdArgs ...string) (*exec.Cmd, error) {
+	from := "snapd"
+	root := filepath.Join(dirs.SnapMountDir, "/snapd/current")
+	if !osutil.FileExists(root) {
+		from = "core"
+		root = filepath.Join(dirs.SnapMountDir, "/core/current")
+	}
+
+	cmdPath := filepath.Join(root, name)
+	interp, err := elfInterp(cmdPath)
+	if err != nil {
+		return nil, err
+	}
+	coreLdSo := filepath.Join(root, interp)
+	// we cannot use EvalSymlink here because we need to resolve
+	// relative and an absolute symlinks differently. A absolute
+	// symlink is relative to root of the snapd/core snap.
+	seen := map[string]bool{}
+	for osutil.IsSymlink(coreLdSo) {
+		link, err := os.Readlink(coreLdSo)
+		if err != nil {
+			return nil, err
+		}
+		if filepath.IsAbs(link) {
+			coreLdSo = filepath.Join(root, link)
+		} else {
+			coreLdSo = filepath.Join(filepath.Dir(coreLdSo), link)
+		}
+		if seen[coreLdSo] {
+			return nil, fmt.Errorf("cannot run command from %s: symlink cycle found", from)
+		}
+		seen[coreLdSo] = true
+	}
+
+	ldLibraryPathForCore := parseLdSoConf(root, "/etc/ld.so.conf")
+
+	ldSoArgs := []string{"--library-path", strings.Join(ldLibraryPathForCore, ":"), cmdPath}
+	allArgs := append(ldSoArgs, cmdArgs...)
+	return exec.Command(coreLdSo, allArgs...), nil
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/cmdutil_test.go snapd-2.48.3+20.04/snapdtool/cmdutil_test.go
--- snapd-2.45.1+20.04.2/snapdtool/cmdutil_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/cmdutil_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,114 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snapdtool"
+)
+
+var truePath = osutil.LookPathDefault("true", "/bin/true")
+
+type cmdutilSuite struct{}
+
+var _ = Suite(&cmdutilSuite{})
+
+func (s *cmdutilSuite) SetUpTest(c *C) {
+	dirs.SetRootDir(c.MkDir())
+}
+
+func (s *cmdutilSuite) TearDownTest(c *C) {
+	dirs.SetRootDir("")
+}
+
+func (s *cmdutilSuite) makeMockLdSoConf(c *C, root string) {
+	ldSoConf := filepath.Join(root, "/etc/ld.so.conf")
+	ldSoConfD := ldSoConf + ".d"
+
+	err := os.MkdirAll(filepath.Dir(ldSoConf), 0755)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(ldSoConfD, 0755)
+	c.Assert(err, IsNil)
+
+	err = ioutil.WriteFile(ldSoConf, []byte("include /etc/ld.so.conf.d/*.conf"), 0644)
+	c.Assert(err, IsNil)
+
+	ldSoConf1 := filepath.Join(ldSoConfD, "x86_64-linux-gnu.conf")
+
+	err = ioutil.WriteFile(ldSoConf1, []byte(`
+# Multiarch support
+/lib/x86_64-linux-gnu
+/usr/lib/x86_64-linux-gnu`), 0644)
+	c.Assert(err, IsNil)
+}
+
+func (s *cmdutilSuite) TestCommandFromSystemSnap(c *C) {
+	for _, snap := range []string{"core", "snapd"} {
+
+		root := filepath.Join(dirs.SnapMountDir, snap, "current")
+		s.makeMockLdSoConf(c, root)
+
+		os.MkdirAll(filepath.Join(root, "/usr/bin"), 0755)
+		osutil.CopyFile(truePath, filepath.Join(root, "/usr/bin/xdelta3"), 0)
+		cmd, err := snapdtool.CommandFromSystemSnap("/usr/bin/xdelta3", "--some-xdelta-arg")
+		c.Assert(err, IsNil)
+
+		out, err := exec.Command("/bin/sh", "-c", fmt.Sprintf("readelf -l %s |grep interpreter:|cut -f2 -d:|cut -f1 -d]", truePath)).Output()
+		c.Assert(err, IsNil)
+		interp := strings.TrimSpace(string(out))
+
+		c.Check(cmd.Args, DeepEquals, []string{
+			filepath.Join(root, interp),
+			"--library-path",
+			fmt.Sprintf("%s/lib/x86_64-linux-gnu:%s/usr/lib/x86_64-linux-gnu", root, root),
+			filepath.Join(root, "/usr/bin/xdelta3"),
+			"--some-xdelta-arg",
+		})
+	}
+}
+
+func (s *cmdutilSuite) TestCommandFromCoreSymlinkCycle(c *C) {
+	root := filepath.Join(dirs.SnapMountDir, "/core/current")
+	s.makeMockLdSoConf(c, root)
+
+	os.MkdirAll(filepath.Join(root, "/usr/bin"), 0755)
+	osutil.CopyFile(truePath, filepath.Join(root, "/usr/bin/xdelta3"), 0)
+
+	out, err := exec.Command("/bin/sh", "-c", "readelf -l /bin/true |grep interpreter:|cut -f2 -d:|cut -f1 -d]").Output()
+	c.Assert(err, IsNil)
+	interp := strings.TrimSpace(string(out))
+
+	coreInterp := filepath.Join(root, interp)
+	c.Assert(os.MkdirAll(filepath.Dir(coreInterp), 0755), IsNil)
+	c.Assert(os.Symlink(filepath.Base(coreInterp), coreInterp), IsNil)
+
+	_, err = snapdtool.CommandFromSystemSnap("/usr/bin/xdelta3", "--some-xdelta-arg")
+	c.Assert(err, ErrorMatches, "cannot run command from core: symlink cycle found")
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/export_test.go snapd-2.48.3+20.04/snapdtool/export_test.go
--- snapd-2.45.1+20.04.2/snapdtool/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,52 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool
+
+var (
+	DistroSupportsReExec = distroSupportsReExec
+	CoreSupportsReExec   = coreSupportsReExec
+)
+
+func MockCoreSnapdPaths(newCoreSnap, newSnapdSnap string) func() {
+	oldOldCore := coreSnap
+	oldNewCore := snapdSnap
+	snapdSnap = newSnapdSnap
+	coreSnap = newCoreSnap
+	return func() {
+		snapdSnap = oldNewCore
+		coreSnap = oldOldCore
+	}
+}
+
+func MockSelfExe(newSelfExe string) func() {
+	oldSelfExe := selfExe
+	selfExe = newSelfExe
+	return func() {
+		selfExe = oldSelfExe
+	}
+}
+
+func MockSyscallExec(f func(argv0 string, argv []string, envv []string) (err error)) func() {
+	oldSyscallExec := syscallExec
+	syscallExec = f
+	return func() {
+		syscallExec = oldSyscallExec
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/info_file.go snapd-2.48.3+20.04/snapdtool/info_file.go
--- snapd-2.45.1+20.04.2/snapdtool/info_file.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/info_file.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,53 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+)
+
+// SnapdVersionFromInfoFile returns snapd version read for the
+// given info" file, pointed by infoPath.
+// The format of the "info" file is a single line with "VERSION=..."
+// in it. The file is produced by mkversion.sh and normally installed
+// along snapd binary in /usr/lib/snapd.
+func SnapdVersionFromInfoFile(infoPath string) (string, error) {
+	content, err := ioutil.ReadFile(infoPath)
+	if err != nil {
+		return "", fmt.Errorf("cannot open snapd info file %q: %s", infoPath, err)
+	}
+
+	if !bytes.HasPrefix(content, []byte("VERSION=")) {
+		idx := bytes.Index(content, []byte("\nVERSION="))
+		if idx < 0 {
+			return "", fmt.Errorf("cannot find snapd version information in %q", content)
+		}
+		content = content[idx+1:]
+	}
+	content = content[8:]
+	idx := bytes.IndexByte(content, '\n')
+	if idx > -1 {
+		content = content[:idx]
+	}
+
+	return string(content), nil
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/info_file_test.go snapd-2.48.3+20.04/snapdtool/info_file_test.go
--- snapd-2.45.1+20.04.2/snapdtool/info_file_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/info_file_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,57 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool_test
+
+import (
+	"io/ioutil"
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/snapdtool"
+)
+
+type infoFileSuite struct{}
+
+var _ = Suite(&infoFileSuite{})
+
+func (s *infoFileSuite) TestNoVersionFile(c *C) {
+	_, err := snapdtool.SnapdVersionFromInfoFile("/non-existing-file")
+	c.Assert(err, ErrorMatches, `cannot open snapd info file "/non-existing-file":.*`)
+}
+
+func (s *infoFileSuite) TestNoVersionData(c *C) {
+	top := c.MkDir()
+	infoFile := filepath.Join(top, "info")
+	c.Assert(ioutil.WriteFile(infoFile, []byte("foo"), 0644), IsNil)
+
+	_, err := snapdtool.SnapdVersionFromInfoFile(infoFile)
+	c.Assert(err, ErrorMatches, `cannot find snapd version information in "foo"`)
+}
+
+func (s *infoFileSuite) TestVersionHappy(c *C) {
+	top := c.MkDir()
+	infoFile := filepath.Join(top, "info")
+	c.Assert(ioutil.WriteFile(infoFile, []byte("VERSION=1.2.3"), 0644), IsNil)
+
+	ver, err := snapdtool.SnapdVersionFromInfoFile(infoFile)
+	c.Assert(err, IsNil)
+	c.Check(ver, Equals, "1.2.3")
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/tool_linux.go snapd-2.48.3+20.04/snapdtool/tool_linux.go
--- snapd-2.45.1+20.04.2/snapdtool/tool_linux.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/tool_linux.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,227 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool
+
+import (
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/strutil"
+)
+
+// The SNAP_REEXEC environment variable controls whether the command
+// will attempt to re-exec itself from inside an ubuntu-core snap
+// present on the system. If not present in the environ it's assumed
+// to be set to 1 (do re-exec); that is: set it to 0 to disable.
+const reExecKey = "SNAP_REEXEC"
+
+var (
+	// snapdSnap is the place to look for the snapd snap; we will re-exec
+	// here
+	snapdSnap = "/snap/snapd/current"
+
+	// coreSnap is the place to look for the core snap; we will re-exec
+	// here if there is no snapd snap
+	coreSnap = "/snap/core/current"
+
+	// selfExe is the path to a symlink pointing to the current executable
+	selfExe = "/proc/self/exe"
+
+	syscallExec = syscall.Exec
+	osReadlink  = os.Readlink
+)
+
+// distroSupportsReExec returns true if the distribution we are running on can use re-exec.
+//
+// This is true by default except for a "core/all" snap system where it makes
+// no sense and in certain distributions that we don't want to enable re-exec
+// yet because of missing validation or other issues.
+func distroSupportsReExec() bool {
+	if !release.OnClassic {
+		return false
+	}
+	if !release.DistroLike("debian", "ubuntu") {
+		logger.Debugf("re-exec not supported on distro %q yet", release.ReleaseInfo.ID)
+		return false
+	}
+	return true
+}
+
+// coreSupportsReExec returns true if the given core/snapd snap should be used as re-exec target.
+//
+// Ensure we do not use older version of snapd, look for info file and ignore
+// version of core that do not yet have it.
+func coreSupportsReExec(coreOrSnapdPath string) bool {
+	infoPath := filepath.Join(coreOrSnapdPath, filepath.Join(dirs.CoreLibExecDir, "info"))
+	ver, err := SnapdVersionFromInfoFile(infoPath)
+	if err != nil {
+		logger.Noticef("%v", err)
+		return false
+	}
+
+	// > 0 means our Version is bigger than the version of snapd in core
+	res, err := strutil.VersionCompare(Version, ver)
+	if err != nil {
+		logger.Debugf("cannot version compare %q and %q: %v", Version, ver, err)
+		return false
+	}
+	if res > 0 {
+		logger.Debugf("snap (at %q) is older (%q) than distribution package (%q)", coreOrSnapdPath, ver, Version)
+		return false
+	}
+	return true
+}
+
+// InternalToolPath returns the path of an internal snapd tool. The tool
+// *must* be located inside the same tree as the current binary.
+//
+// The return value is either the path of the tool in the current distribution
+// or in the core/snapd snap (or the ubuntu-core snap) if the current binary is
+// ran from that location.
+func InternalToolPath(tool string) (string, error) {
+	distroTool := filepath.Join(dirs.DistroLibExecDir, tool)
+
+	// find the internal path relative to the running snapd, this
+	// ensure we don't rely on the state of the system (like
+	// having a valid "current" symlink).
+	exe, err := osReadlink("/proc/self/exe")
+	if err != nil {
+		return "", err
+	}
+
+	if !strings.HasPrefix(exe, dirs.DistroLibExecDir) {
+		// either running from mounted location or /usr/bin/snap*
+
+		// find the local prefix to the snap:
+		// /snap/snapd/123/usr/bin/snap       -> /snap/snapd/123
+		// /snap/core/234/usr/lib/snapd/snapd -> /snap/core/234
+		idx := strings.LastIndex(exe, "/usr/")
+		if idx > 0 {
+			// only assume mounted location when path contains
+			// /usr/, but does not start with one
+			prefix := exe[:idx]
+			return filepath.Join(prefix, "/usr/lib/snapd", tool), nil
+		}
+		if idx == -1 {
+			// or perhaps some other random location, make sure the tool
+			// exists there and is an executable
+			maybeTool := filepath.Join(filepath.Dir(exe), tool)
+			if osutil.IsExecutable(maybeTool) {
+				return maybeTool, nil
+			}
+		}
+	}
+
+	// fallback to distro tool
+	return distroTool, nil
+}
+
+// mustUnsetenv will unset the given environment key or panic if it
+// cannot do that
+func mustUnsetenv(key string) {
+	if err := os.Unsetenv(key); err != nil {
+		log.Panicf("cannot unset %s: %s", key, err)
+	}
+}
+
+// ExecInSnapdOrCoreSnap makes sure you're executing the binary that ships in
+// the snapd/core snap.
+func ExecInSnapdOrCoreSnap() {
+	// Which executable are we?
+	exe, err := os.Readlink(selfExe)
+	if err != nil {
+		logger.Noticef("cannot read /proc/self/exe: %v", err)
+		return
+	}
+
+	// Special case for snapd re-execing from 2.21. In this
+	// version of snap/snapd we did set SNAP_REEXEC=0 when we
+	// re-execed. In this case we need to unset the reExecKey to
+	// ensure that subsequent run of snap/snapd (e.g. when using
+	// classic confinement) will *not* prevented from re-execing.
+	if strings.HasPrefix(exe, dirs.SnapMountDir) && !osutil.GetenvBool(reExecKey, true) {
+		mustUnsetenv(reExecKey)
+		return
+	}
+
+	// If we are asked not to re-execute use distribution packages. This is
+	// "spiritual" re-exec so use the same environment variable to decide.
+	if !osutil.GetenvBool(reExecKey, true) {
+		logger.Debugf("re-exec disabled by user")
+		return
+	}
+
+	// Did we already re-exec?
+	if strings.HasPrefix(exe, dirs.SnapMountDir) {
+		return
+	}
+
+	// If the distribution doesn't support re-exec or run-from-core then don't do it.
+	if !distroSupportsReExec() {
+		return
+	}
+
+	// Is this executable in the core snap too?
+	coreOrSnapdPath := snapdSnap
+	full := filepath.Join(snapdSnap, exe)
+	if !osutil.FileExists(full) {
+		coreOrSnapdPath = coreSnap
+		full = filepath.Join(coreSnap, exe)
+		if !osutil.FileExists(full) {
+			return
+		}
+	}
+
+	// If the core snap doesn't support re-exec or run-from-core then don't do it.
+	if !coreSupportsReExec(coreOrSnapdPath) {
+		return
+	}
+
+	logger.Debugf("restarting into %q", full)
+	panic(syscallExec(full, os.Args, os.Environ()))
+}
+
+// IsReexecd returns true when the current process binary is running from a snap.
+func IsReexecd() (bool, error) {
+	exe, err := osReadlink(selfExe)
+	if err != nil {
+		return false, err
+	}
+	if strings.HasPrefix(exe, dirs.SnapMountDir) {
+		return true, nil
+	}
+	return false, nil
+}
+
+// MockOsReadlink is for use in tests
+func MockOsReadlink(f func(string) (string, error)) func() {
+	realOsReadlink := osReadlink
+	osReadlink = f
+	return func() {
+		osReadlink = realOsReadlink
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/tool_linux_test.go snapd-2.48.3+20.04/snapdtool/tool_linux_test.go
--- snapd-2.45.1+20.04.2/snapdtool/tool_linux_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/tool_linux_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,118 @@
+package snapdtool_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/snapdtool"
+)
+
+const dataOK = `one line
+another line
+yadda yadda
+VERSION=42
+potatoes
+`
+
+const dataNOK = `a line
+another
+this is a very long line
+that wasn't long what are you talking about long lines are like, so long you need to add things like commas to them for them to even make sense
+a short one
+and another
+what is this
+why
+no
+stop
+`
+
+const dataHuge = `Lorem ipsum dolor sit amet, consectetur adipiscing elit.
+Quisque euismod ac elit ac auctor.
+Proin malesuada diam ac tellus maximus aliquam.
+Aenean tincidunt mi et tortor bibendum fringilla.
+Phasellus finibus, urna id convallis vestibulum, metus metus venenatis massa, et efficitur nisi elit in massa.
+Mauris at nisl leo.
+Nulla ullamcorper risus venenatis massa venenatis, ac finibus lacus aliquam.
+Nunc tempor convallis cursus.
+Maecenas id rhoncus orci, eget pretium eros.
+
+Donec et consectetur lacus.
+Nam nec mattis elit, id sollicitudin magna.
+Aenean sit amet diam vitae tellus finibus tristique.
+Duis et pharetra tortor, id pharetra erat.
+Suspendisse commodo venenatis blandit.
+Morbi tellus est, iaculis et tincidunt nec, semper ut ipsum.
+Mauris quis condimentum risus.
+Lorem ipsum dolor sit amet, consectetur adipiscing elit.
+Mauris gravida turpis ut urna laoreet, sit amet tempor odio porttitor.
+
+Aliquam nibh libero, venenatis ac vehicula at, blandit id odio.
+Etiam malesuada consectetur porta.
+Fusce consectetur ligula et metus interdum sollicitudin.
+Pellentesque odio neque, pharetra et gravida non, vestibulum nec lorem.
+Sed condimentum velit ex, sit amet viverra lectus aliquet quis.
+Aliquam tincidunt eu elit at condimentum.
+Donec feugiat urna tortor, pellentesque tincidunt quam congue eu.
+
+Phasellus vel libero molestie, semper erat at, suscipit nisi.
+Nullam euismod neque ut turpis molestie, eu fringilla elit volutpat.
+Phasellus maximus, urna eget porta congue, diam enim volutpat diam, nec ultrices lorem risus ac metus.
+Vivamus convallis eros non nunc pretium bibendum.
+Maecenas consectetur metus metus.
+Morbi scelerisque urna at arcu tristique feugiat.
+Vestibulum condimentum odio sed tortor vulputate, eget hendrerit mi consequat.
+Integer egestas finibus augue, ac scelerisque ex pretium aliquam.
+Aliquam erat volutpat.
+Suspendisse a nulla ultrices, porttitor tellus ut, bibendum diam.
+In nibh dui, tempus eget vestibulum in, euismod in ex.
+In tempus felis lectus.
+
+Maecenas suscipit turpis eget velit molestie, quis luctus nibh placerat.
+Nulla semper eleifend nisi ut dignissim.
+Donec eu massa maximus, blandit massa ac, lobortis risus.
+Donec id condimentum libero, vel fringilla diam.
+Praesent ultrices, ante congue sollicitudin sagittis, orci ex maximus ipsum, at convallis nunc nisl nec lorem.
+Duis iaculis finibus fermentum.
+Curabitur quis pharetra metus.
+Donec nisl ipsum, faucibus vitae odio sed, mattis feugiat nisl.
+Pellentesque nec justo in magna volutpat accumsan.
+Pellentesque porttitor justo non velit porta rhoncus.
+Nulla ut lectus quis lectus rutrum dignissim.
+Pellentesque posuere sagittis felis, quis varius purus pharetra eu.
+Nam blandit diam ullamcorper, auctor massa at, aliquet dui.
+Aliquam erat volutpat.
+Nullam sit amet augue nec diam sollicitudin ullamcorper a vitae neque.
+VERSION=42
+`
+
+func benchmarkCSRE(b *testing.B, data string) {
+	tempdir, err := ioutil.TempDir("", "")
+	if err != nil {
+		b.Fatalf("tempdir: %v", err)
+	}
+	defer os.RemoveAll(tempdir)
+	if err = os.MkdirAll(filepath.Join(tempdir, dirs.CoreLibExecDir), 0755); err != nil {
+		b.Fatalf("mkdirall: %v", err)
+	}
+
+	if err = ioutil.WriteFile(filepath.Join(tempdir, dirs.CoreLibExecDir, "info"), []byte(data), 0600); err != nil {
+		b.Fatalf("%v", err)
+	}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		snapdtool.CoreSupportsReExec(tempdir)
+	}
+}
+
+func BenchmarkCSRE_fakeOK(b *testing.B)   { benchmarkCSRE(b, dataOK) }
+func BenchmarkCSRE_fakeNOK(b *testing.B)  { benchmarkCSRE(b, dataNOK) }
+func BenchmarkCSRE_fakeHuge(b *testing.B) { benchmarkCSRE(b, dataHuge) }
+
+func BenchmarkCSRE_real(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		snapdtool.CoreSupportsReExec("/snap/core/current")
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/tool_other.go snapd-2.48.3+20.04/snapdtool/tool_other.go
--- snapd-2.45.1+20.04.2/snapdtool/tool_other.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/tool_other.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,49 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+// +build !linux
+
+/*
+ * Copyright (C) 2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool
+
+import (
+	"errors"
+)
+
+var errUnsupported = errors.New("unsupported on non-Linux systems")
+
+// ExecInSnapdOrCoreSnap makes sure you're executing the binary that ships in
+// the snapd/core snap.
+// On this OS this is a stub.
+func ExecInSnapdOrCoreSnap() {
+	return
+}
+
+// InternalToolPath returns the path of an internal snapd tool. The tool
+// *must* be located inside the same tree as the current binary.
+//
+// On this OS this is a stub and always returns an error.
+func InternalToolPath(tool string) (string, error) {
+	return "", errUnsupported
+}
+
+// IsReexecd returns true when the current process binary is running from a snap.
+//
+// On this OS this is a stub and always returns an error.
+func IsReexecd() (bool, error) {
+	return false, errUnsupported
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/tool_test.go snapd-2.48.3+20.04/snapdtool/tool_test.go
--- snapd-2.45.1+20.04.2/snapdtool/tool_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/tool_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,451 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package snapdtool_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/snapdtool"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type toolSuite struct {
+	restoreExec   func()
+	restoreLogger func()
+	execCalled    int
+	lastExecArgv0 string
+	lastExecArgv  []string
+	lastExecEnvv  []string
+	fakeroot      string
+	snapdPath     string
+	corePath      string
+}
+
+var _ = Suite(&toolSuite{})
+
+func (s *toolSuite) SetUpTest(c *C) {
+	s.restoreExec = snapdtool.MockSyscallExec(s.syscallExec)
+	_, s.restoreLogger = logger.MockLogger()
+	s.execCalled = 0
+	s.lastExecArgv0 = ""
+	s.lastExecArgv = nil
+	s.lastExecEnvv = nil
+	s.fakeroot = c.MkDir()
+	dirs.SetRootDir(s.fakeroot)
+	s.snapdPath = filepath.Join(dirs.SnapMountDir, "/snapd/42")
+	s.corePath = filepath.Join(dirs.SnapMountDir, "/core/21")
+	c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, "proc/self"), 0755), IsNil)
+}
+
+func (s *toolSuite) TearDownTest(c *C) {
+	s.restoreExec()
+	s.restoreLogger()
+}
+
+func (s *toolSuite) syscallExec(argv0 string, argv []string, envv []string) (err error) {
+	s.execCalled++
+	s.lastExecArgv0 = argv0
+	s.lastExecArgv = argv
+	s.lastExecEnvv = envv
+	return fmt.Errorf(">exec of %q in tests<", argv0)
+}
+
+func (s *toolSuite) fakeCoreVersion(c *C, coreDir, version string) {
+	p := filepath.Join(coreDir, "/usr/lib/snapd")
+	c.Assert(os.MkdirAll(p, 0755), IsNil)
+	c.Assert(ioutil.WriteFile(filepath.Join(p, "info"), []byte("VERSION="+version), 0644), IsNil)
+}
+
+func (s *toolSuite) fakeInternalTool(c *C, coreDir, toolName string) string {
+	s.fakeCoreVersion(c, coreDir, "42")
+	p := filepath.Join(coreDir, "/usr/lib/snapd", toolName)
+	c.Assert(ioutil.WriteFile(p, nil, 0755), IsNil)
+
+	return p
+}
+
+func (s *toolSuite) mockReExecingEnv() func() {
+	restore := []func(){
+		release.MockOnClassic(true),
+		release.MockReleaseInfo(&release.OS{ID: "ubuntu"}),
+		snapdtool.MockCoreSnapdPaths(s.corePath, s.snapdPath),
+		snapdtool.MockVersion("2"),
+	}
+
+	return func() {
+		for i := len(restore) - 1; i >= 0; i-- {
+			restore[i]()
+		}
+	}
+}
+
+func (s *toolSuite) mockReExecFor(c *C, coreDir, toolName string) func() {
+	selfExe := filepath.Join(s.fakeroot, "proc/self/exe")
+	restore := []func(){
+		s.mockReExecingEnv(),
+		snapdtool.MockSelfExe(selfExe),
+	}
+	s.fakeInternalTool(c, coreDir, toolName)
+	c.Assert(os.Symlink(filepath.Join("/usr/lib/snapd", toolName), selfExe), IsNil)
+
+	return func() {
+		for i := len(restore) - 1; i >= 0; i-- {
+			restore[i]()
+		}
+	}
+}
+
+func (s *toolSuite) TestDistroSupportsReExec(c *C) {
+	restore := release.MockOnClassic(true)
+	defer restore()
+
+	// Some distributions don't support re-execution yet.
+	for _, id := range []string{"fedora", "centos", "rhel", "opensuse", "suse", "poky"} {
+		restore = release.MockReleaseInfo(&release.OS{ID: id})
+		defer restore()
+		c.Check(snapdtool.DistroSupportsReExec(), Equals, false, Commentf("ID: %q", id))
+	}
+
+	// While others do.
+	for _, id := range []string{"debian", "ubuntu"} {
+		restore = release.MockReleaseInfo(&release.OS{ID: id})
+		defer restore()
+		c.Check(snapdtool.DistroSupportsReExec(), Equals, true, Commentf("ID: %q", id))
+	}
+}
+
+func (s *toolSuite) TestNonClassicDistroNoSupportsReExec(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	// no distro supports re-exec when not on classic :-)
+	for _, id := range []string{
+		"fedora", "centos", "rhel", "opensuse", "suse", "poky",
+		"debian", "ubuntu", "arch", "archlinux",
+	} {
+		restore = release.MockReleaseInfo(&release.OS{ID: id})
+		defer restore()
+		c.Check(snapdtool.DistroSupportsReExec(), Equals, false, Commentf("ID: %q", id))
+	}
+}
+
+func (s *toolSuite) TestCoreSupportsReExecNoInfo(c *C) {
+	// there's no snapd/info in a just-created tmpdir :-p
+	c.Check(snapdtool.CoreSupportsReExec(c.MkDir()), Equals, false)
+}
+
+func (s *toolSuite) TestCoreSupportsReExecBadInfo(c *C) {
+	// can't read snapd/info if it's a directory
+	p := s.snapdPath + "/usr/lib/snapd/info"
+	c.Assert(os.MkdirAll(p, 0755), IsNil)
+
+	c.Check(snapdtool.CoreSupportsReExec(s.snapdPath), Equals, false)
+}
+
+func (s *toolSuite) TestCoreSupportsReExecBadInfoContent(c *C) {
+	// can't understand snapd/info if all it holds are potatoes
+	p := s.snapdPath + "/usr/lib/snapd"
+	c.Assert(os.MkdirAll(p, 0755), IsNil)
+	c.Assert(ioutil.WriteFile(p+"/info", []byte("potatoes"), 0644), IsNil)
+
+	c.Check(snapdtool.CoreSupportsReExec(s.snapdPath), Equals, false)
+}
+
+func (s *toolSuite) TestCoreSupportsReExecBadVersion(c *C) {
+	// can't understand snapd/info if all its version is gibberish
+	s.fakeCoreVersion(c, s.snapdPath, "0:")
+
+	c.Check(snapdtool.CoreSupportsReExec(s.snapdPath), Equals, false)
+}
+
+func (s *toolSuite) TestCoreSupportsReExecOldVersion(c *C) {
+	// can't re-exec if core version is too old
+	defer snapdtool.MockVersion("2")()
+	s.fakeCoreVersion(c, s.snapdPath, "0")
+
+	c.Check(snapdtool.CoreSupportsReExec(s.snapdPath), Equals, false)
+}
+
+func (s *toolSuite) TestCoreSupportsReExec(c *C) {
+	defer snapdtool.MockVersion("2")()
+	s.fakeCoreVersion(c, s.snapdPath, "9999")
+
+	c.Check(snapdtool.CoreSupportsReExec(s.snapdPath), Equals, true)
+}
+
+func (s *toolSuite) TestInternalToolPathNoReexec(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.DistroLibExecDir, "snapd"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, filepath.Join(dirs.DistroLibExecDir, "potato"))
+}
+
+func (s *toolSuite) TestInternalToolPathWithReexec(c *C) {
+	s.fakeInternalTool(c, s.snapdPath, "potato")
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(s.snapdPath, "/usr/lib/snapd/snapd"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, filepath.Join(dirs.SnapMountDir, "snapd/42/usr/lib/snapd/potato"))
+}
+
+func (s *toolSuite) TestInternalToolPathWithOtherLocation(c *C) {
+	s.fakeInternalTool(c, s.snapdPath, "potato")
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join("/tmp/tmp.foo_1234/usr/lib/snapd/snapd"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, "/tmp/tmp.foo_1234/usr/lib/snapd/potato")
+}
+
+func (s *toolSuite) TestInternalToolSnapPathWithOtherLocation(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join("/tmp/tmp.foo_1234/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, "/tmp/tmp.foo_1234/usr/lib/snapd/potato")
+}
+
+func (s *toolSuite) TestInternalToolPathWithOtherCrazyLocation(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join("/usr/foo/usr/tmp/tmp.foo_1234/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, "/usr/foo/usr/tmp/tmp.foo_1234/usr/lib/snapd/potato")
+}
+
+func (s *toolSuite) TestInternalToolPathWithDevLocationFallback(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join("/home/dev/snapd/snapd"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, filepath.Join(dirs.DistroLibExecDir, "potato"))
+}
+
+func (s *toolSuite) TestInternalToolPathWithOtherDevLocationWhenExecutable(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.GlobalRootDir, "/tmp/snapd"), nil
+	})
+	defer restore()
+
+	devTool := filepath.Join(dirs.GlobalRootDir, "/tmp/potato")
+	err := os.MkdirAll(filepath.Dir(devTool), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(devTool, []byte(""), 0755)
+	c.Assert(err, IsNil)
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, filepath.Join(dirs.GlobalRootDir, "/tmp/potato"))
+}
+
+func (s *toolSuite) TestInternalToolPathWithOtherDevLocationNonExecutable(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.GlobalRootDir, "/tmp/snapd"), nil
+	})
+	defer restore()
+
+	devTool := filepath.Join(dirs.GlobalRootDir, "/tmp/non-executable-potato")
+	err := os.MkdirAll(filepath.Dir(devTool), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(devTool, []byte(""), 0644)
+	c.Assert(err, IsNil)
+
+	path, err := snapdtool.InternalToolPath("non-executable-potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, filepath.Join(dirs.DistroLibExecDir, "non-executable-potato"))
+}
+
+func (s *toolSuite) TestInternalToolPathSnapdPathReexec(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.SnapMountDir, "core/111/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	p, err := snapdtool.InternalToolPath("snapd")
+	c.Assert(err, IsNil)
+	c.Check(p, Equals, filepath.Join(dirs.SnapMountDir, "/core/111/usr/lib/snapd/snapd"))
+}
+
+func (s *toolSuite) TestInternalToolPathSnapdSnap(c *C) {
+	restore := snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join(dirs.SnapMountDir, "snapd/22/usr/bin/snap"), nil
+	})
+	defer restore()
+	p, err := snapdtool.InternalToolPath("snapd")
+	c.Assert(err, IsNil)
+	c.Check(p, Equals, filepath.Join(dirs.SnapMountDir, "/snapd/22/usr/lib/snapd/snapd"))
+}
+
+func (s *toolSuite) TestInternalToolPathWithLibexecdirLocation(c *C) {
+	defer dirs.SetRootDir(s.fakeroot)
+	restore := release.MockReleaseInfo(&release.OS{ID: "fedora"})
+	defer restore()
+	// reload directory paths
+	dirs.SetRootDir("/")
+
+	restore = snapdtool.MockOsReadlink(func(string) (string, error) {
+		return filepath.Join("/usr/bin/snap"), nil
+	})
+	defer restore()
+
+	path, err := snapdtool.InternalToolPath("potato")
+	c.Check(err, IsNil)
+	c.Check(path, Equals, filepath.Join("/usr/libexec/snapd/potato"))
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnap(c *C) {
+	defer s.mockReExecFor(c, s.snapdPath, "potato")()
+
+	c.Check(snapdtool.ExecInSnapdOrCoreSnap, PanicMatches, `>exec of "[^"]+/potato" in tests<`)
+	c.Check(s.execCalled, Equals, 1)
+	c.Check(s.lastExecArgv0, Equals, filepath.Join(s.snapdPath, "/usr/lib/snapd/potato"))
+	c.Check(s.lastExecArgv, DeepEquals, os.Args)
+}
+
+func (s *toolSuite) TestExecInOldCoreSnap(c *C) {
+	defer s.mockReExecFor(c, s.corePath, "potato")()
+
+	c.Check(snapdtool.ExecInSnapdOrCoreSnap, PanicMatches, `>exec of "[^"]+/potato" in tests<`)
+	c.Check(s.execCalled, Equals, 1)
+	c.Check(s.lastExecArgv0, Equals, filepath.Join(s.corePath, "/usr/lib/snapd/potato"))
+	c.Check(s.lastExecArgv, DeepEquals, os.Args)
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnapBailsNoCoreSupport(c *C) {
+	defer s.mockReExecFor(c, s.snapdPath, "potato")()
+
+	// no "info" -> no core support:
+	c.Assert(os.Remove(filepath.Join(s.snapdPath, "/usr/lib/snapd/info")), IsNil)
+
+	snapdtool.ExecInSnapdOrCoreSnap()
+	c.Check(s.execCalled, Equals, 0)
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnapMissingExe(c *C) {
+	defer s.mockReExecFor(c, s.snapdPath, "potato")()
+
+	// missing exe:
+	c.Assert(os.Remove(filepath.Join(s.snapdPath, "/usr/lib/snapd/potato")), IsNil)
+
+	snapdtool.ExecInSnapdOrCoreSnap()
+	c.Check(s.execCalled, Equals, 0)
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnapBadSelfExe(c *C) {
+	defer s.mockReExecFor(c, s.snapdPath, "potato")()
+
+	// missing self/exe:
+	c.Assert(os.Remove(filepath.Join(s.fakeroot, "proc/self/exe")), IsNil)
+
+	snapdtool.ExecInSnapdOrCoreSnap()
+	c.Check(s.execCalled, Equals, 0)
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnapBailsNoDistroSupport(c *C) {
+	defer s.mockReExecFor(c, s.snapdPath, "potato")()
+
+	// no distro support:
+	defer release.MockOnClassic(false)()
+
+	snapdtool.ExecInSnapdOrCoreSnap()
+	c.Check(s.execCalled, Equals, 0)
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnapNoDouble(c *C) {
+	selfExe := filepath.Join(s.fakeroot, "proc/self/exe")
+	err := os.Symlink(filepath.Join(s.fakeroot, "/snap/core/42/usr/lib/snapd"), selfExe)
+	c.Assert(err, IsNil)
+	snapdtool.MockSelfExe(selfExe)
+
+	snapdtool.ExecInSnapdOrCoreSnap()
+	c.Check(s.execCalled, Equals, 0)
+}
+
+func (s *toolSuite) TestExecInSnapdOrCoreSnapDisabled(c *C) {
+	defer s.mockReExecFor(c, s.snapdPath, "potato")()
+
+	os.Setenv("SNAP_REEXEC", "0")
+	defer os.Unsetenv("SNAP_REEXEC")
+
+	snapdtool.ExecInSnapdOrCoreSnap()
+	c.Check(s.execCalled, Equals, 0)
+}
+
+func (s *toolSuite) TestIsReexecd(c *C) {
+	mockedSelfExe := filepath.Join(s.fakeroot, "proc/self/exe")
+	restore := snapdtool.MockSelfExe(mockedSelfExe)
+	defer restore()
+
+	// pretend the binary reexecd from snap mount location
+	err := os.Symlink(filepath.Join(s.snapdPath, "usr/lib/snapd/snapd"), mockedSelfExe)
+	c.Assert(err, IsNil)
+
+	is, err := snapdtool.IsReexecd()
+	c.Assert(err, IsNil)
+	c.Assert(is, Equals, true)
+
+	err = os.Remove(mockedSelfExe)
+	c.Assert(err, IsNil)
+	// now it's not
+	err = os.Symlink(filepath.Join(dirs.DistroLibExecDir, "snapd"), mockedSelfExe)
+	c.Assert(err, IsNil)
+
+	is, err = snapdtool.IsReexecd()
+	c.Assert(err, IsNil)
+	c.Assert(is, Equals, false)
+
+	// trouble reading the symlink
+	err = os.Remove(mockedSelfExe)
+	c.Assert(err, IsNil)
+
+	is, err = snapdtool.IsReexecd()
+	c.Assert(err, ErrorMatches, ".*/proc/self/exe: no such file or directory")
+	c.Assert(is, Equals, false)
+}
diff -Nru snapd-2.45.1+20.04.2/snapdtool/version.go snapd-2.48.3+20.04/snapdtool/version.go
--- snapd-2.45.1+20.04.2/snapdtool/version.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/snapdtool/version.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Package snapdtool exposes version and related information, supports
+// re-execution and inter-tool lookup/execution across all snapd
+// tools.
+package snapdtool
+
+//go:generate mkversion.sh
+
+// Version will be overwritten at build-time via mkversion.sh
+var Version = "unknown"
+
+func MockVersion(version string) (restore func()) {
+	old := Version
+	Version = version
+	return func() { Version = old }
+}
diff -Nru snapd-2.45.1+20.04.2/spread-shellcheck snapd-2.48.3+20.04/spread-shellcheck
--- snapd-2.45.1+20.04.2/spread-shellcheck	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/spread-shellcheck	2021-02-02 08:21:12.000000000 +0000
@@ -18,6 +18,7 @@
 import os
 import subprocess
 import argparse
+import itertools
 from concurrent.futures import ThreadPoolExecutor
 from multiprocessing import cpu_count
 from typing import Dict
@@ -107,6 +108,7 @@
     # shellcheck knows about that
     script_data = []
     script_data.append('set -e')
+
     for key, value in env.items():
         value = str(value)
         # Unpack the special "$(HOST: ...) syntax and tell shellcheck not to
@@ -129,12 +131,12 @@
                             stdout=subprocess.PIPE,
                             stdin=subprocess.PIPE,
                             shell=True)
-    stdout, _ = proc.communicate(input='\n'.join(script_data).encode('utf-8'), timeout=10)
+    stdout, _ = proc.communicate(input='\n'.join(script_data).encode('utf-8'), timeout=30)
     if proc.returncode != 0:
         raise ShellcheckRunError(stdout)
 
 
-def checkfile(path):
+def checkfile(path, executor):
     logging.debug("checking file %s", path)
     with open(path) as inf:
         data = yaml.load(inf, Loader=yaml.CSafeLoader)
@@ -160,54 +162,58 @@
 
     if path.endswith('spread.yaml') and 'suites' in data:
         # check suites
+        suites_sections_and_futures = []
         for suite in data['suites'].keys():
             for section in SECTIONS:
                 if section not in data['suites'][suite]:
                     continue
-                try:
-                    logging.debug("%s (suite %s): checking section %s", path, suite, section)
-                    checksection(data['suites'][suite][section], env)
-                except ShellcheckRunError as serr:
-                    errors.addfailure('suites/' + suite + '/' + section,
-                                      serr.stderr.decode('utf-8'))
+                logging.debug("%s (suite %s): checking section %s", path, suite, section)
+                future = executor.submit(checksection, data['suites'][suite][section], env)
+                suites_sections_and_futures.append((suite, section, future))
+        for item in suites_sections_and_futures:
+            suite, section, future = item
+            try:
+                future.result()
+            except ShellcheckRunError as serr:
+                errors.addfailure('suites/' + suite + '/' + section,
+                                serr.stderr.decode('utf-8'))
 
     if errors:
         raise errors
 
 
-def findfiles(indir):
-    for root, _, files in os.walk(indir, topdown=True):
-        for name in files:
-            if name in ['spread.yaml', 'task.yaml']:
-                yield os.path.join(root, name)
+def findfiles(locations):
+    for loc in locations:
+        if os.path.isdir(loc):
+            for root, _, files in os.walk(loc, topdown=True):
+                for name in files:
+                    if name in ['spread.yaml', 'task.yaml']:
+                        yield os.path.join(root, name)
+        else:
+            yield loc
 
 
-def checkpath(loc, max_workers):
-    if os.path.isdir(loc):
-        # setup iterator
-        locations = findfiles(loc)
-    else:
-        locations = [loc]
+def check1path(path, executor):
+    try:
+        checkfile(path, executor)
+    except ShellcheckError as err:
+        return err
+    return None
 
-    failed = []
 
-    def check1path(path):
-        try:
-            checkfile(path)
-        except ShellcheckError as err:
-            return err
-        return None
-
-    with ThreadPoolExecutor(max_workers=max_workers) as executor:
-        for serr in executor.map(check1path, locations):
-            if serr is None:
-                continue
-            logging.error(('shellcheck failed for file %s in sections: '
-                           '%s; error log follows'),
-                          serr.path, ', '.join(serr.sectionerrors.keys()))
-            for section, error in serr.sectionerrors.items():
-                logging.error("%s: section '%s':\n%s", serr.path, section, error)
-            failed.append(serr.path)
+def checkpaths(locs, executor):
+    # setup iterator
+    locations = findfiles(locs)
+    failed = []
+    for serr in executor.map(check1path, locations, itertools.repeat(executor)):
+        if serr is None:
+            continue
+        logging.error(('shellcheck failed for file %s in sections: '
+                       '%s; error log follows'),
+                      serr.path, ', '.join(serr.sectionerrors.keys()))
+        for section, error in serr.sectionerrors.items():
+            logging.error("%s: section '%s':\n%s", serr.path, section, error)
+        failed.append(serr.path)
 
     if failed:
         raise ShellcheckFailures(failures=failed)
@@ -225,9 +231,9 @@
 def main(opts):
     paths = opts.paths or ['.']
     failures = ShellcheckFailures()
-    for pth in paths:
+    with ThreadPoolExecutor(max_workers=opts.max_procs) as executor:
         try:
-            checkpath(pth, opts.max_procs)
+            checkpaths(paths, executor)
         except ShellcheckFailures as sf:
             failures.merge(sf)
 
@@ -277,4 +283,10 @@
     if NO_FAIL:
         opts.no_errors = True
 
+    if opts.max_procs == 1:
+        # TODO: temporary workaround for a deadlock when running with a single
+        # worker
+        opts.max_procs += 1
+        logging.warning('workers count bumped to 2 to workaround a deadlock')
+
     main(opts)
diff -Nru snapd-2.45.1+20.04.2/spread.yaml snapd-2.48.3+20.04/spread.yaml
--- snapd-2.45.1+20.04.2/spread.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/spread.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,12 +3,13 @@
 environment:
     GOHOME: /home/gopath
     GOPATH: $GOHOME
-    REUSE_PROJECT: "$(HOST: echo \"$REUSE_PROJECT\")"
+    REUSE_PROJECT: '$(HOST: echo "$REUSE_PROJECT")'
     PROJECT_PATH: $GOHOME/src/github.com/snapcore/snapd
     # /usr/lib/go-1.6/bin for trusty (needs to be last as we use
     # a different go in gccgo tests)
-    PATH: $GOHOME/bin:/snap/bin:$PATH:/usr/lib/go-1.6/bin:/var/lib/snapd/snap/bin:$PROJECT_PATH/tests/lib/bin
+    PATH: $GOHOME/bin:/snap/bin:$PATH:/usr/lib/go-1.6/bin:/var/lib/snapd/snap/bin:$PROJECT_PATH/tests/bin
     TESTSLIB: $PROJECT_PATH/tests/lib
+    TESTSTOOLS: $PROJECT_PATH/tests/lib/tools
     SNAPPY_TESTING: 1
     # we run the entire suite with re-exec on (the default) and modify
     # the core snap so that it contains our new code.  So we run new
@@ -36,8 +37,9 @@
     SNAPD_CHANNEL: '$(HOST: echo "${SPREAD_SNAPD_CHANNEL:-edge}")'
     REMOTE_STORE: '$(HOST: echo "${SPREAD_REMOTE_STORE:-production}")'
     SNAPPY_USE_STAGING_STORE: '$(HOST: if [ "$SPREAD_REMOTE_STORE" = staging ]; then echo 1; else echo 0; fi)'
-    DELTA_REF: 2.44
+    DELTA_REF: 2.46
     DELTA_PREFIX: snapd-$DELTA_REF/
+    REPACK_KEEP_VENDOR: '$(HOST: echo "${REPACK_KEEP_VENDOR:-n}")'
     SNAPD_PUBLISHED_VERSION: '$(HOST: echo "$SPREAD_SNAPD_PUBLISHED_VERSION")'
     HTTP_PROXY: '$(HOST: echo "$SPREAD_HTTP_PROXY")'
     HTTPS_PROXY: '$(HOST: echo "$SPREAD_HTTPS_PROXY")'
@@ -50,8 +52,23 @@
     # always skip removing the rsync snap
     SKIP_REMOVE_SNAPS: '$(HOST: echo "${SPREAD_SKIP_REMOVE_SNAPS:-}") test-snapd-rsync test-snapd-rsync-core18 test-snapd-rsync-core20'
     # Use the installed snapd and reset the systems without removing snapd
-    REUSE_SNAPD: "$(HOST: echo \"${SPREAD_REUSE_SNAPD:-0}\")"
-    PROFILE_SNAPS: "$(HOST: echo \"${SPREAD_PROFILE_SNAPS:-0}\")"
+    REUSE_SNAPD: '$(HOST: echo "${SPREAD_REUSE_SNAPD:-0}")'
+    PROFILE_SNAPS: '$(HOST: echo "${SPREAD_PROFILE_SNAPS:-0}")'
+
+    # Directory where the nested images and test assets are stored
+    NESTED_WORK_DIR: '$(HOST: echo "${NESTED_WORK_DIR:-/tmp/work-dir}")'
+    # Channel used to create the nested vm
+    NESTED_CORE_CHANNEL: '$(HOST: echo "${NESTED_CORE_CHANNEL:-edge}")'
+    # Use cloud init to make initial system configuration instead of user assertion
+    NESTED_CORE_REFRESH_CHANNEL: '$(HOST: echo "${NESTED_CORE_REFRESH_CHANNEL:-edge}")'
+    # Use cloud init to make initial system configuration instead of user assertion
+    NESTED_USE_CLOUD_INIT: '$(HOST: echo "${NESTED_USE_CLOUD_INIT:-true}")'
+    # Build and use snapd from current branch
+    NESTED_BUILD_SNAPD_FROM_CURRENT: '$(HOST: echo "${NESTED_BUILD_SNAPD_FROM_CURRENT:-true}")'
+    # Download and use an custom image from this url
+    NESTED_CUSTOM_IMAGE_URL: '$(HOST: echo "${NESTED_CUSTOM_IMAGE_URL:-}")'
+    # Configure nested images to be reused on the following tests
+    NESTED_CONFIGURE_IMAGES: '$(HOST: echo "${NESTED_CONFIGURE_IMAGES:-false}")'
 
 backends:
     google:
@@ -60,75 +77,70 @@
         halt-timeout: 2h
         systems:
             - ubuntu-14.04-64:
-                workers: 6
+                  workers: 6
             - ubuntu-16.04-32:
-                workers: 6
+                  workers: 6
             - ubuntu-16.04-64:
-                workers: 8
+                  workers: 8
             - ubuntu-18.04-64:
-                workers: 8
-            - ubuntu-19.10-64:
-                workers: 6
+                  workers: 8
             - ubuntu-20.04-64:
-                workers: 8
+                  workers: 8
             - ubuntu-core-16-64:
-                image: ubuntu-16.04-64
-                workers: 6
+                  image: ubuntu-16.04-64
+                  workers: 6
             - ubuntu-core-18-64:
-                image: ubuntu-16.04-64
-                workers: 6
+                  image: ubuntu-16.04-64
+                  workers: 6
             - ubuntu-core-20-64:
-                image: ubuntu-2004-64-virt-enabled
-                workers: 6
-                storage: 20G
+                  image: ubuntu-2004-64-virt-enabled
+                  workers: 6
+                  storage: 20G
+            - ubuntu-secboot-20.04-64:
+                  image: ubuntu-20.04-64
+                  workers: 1
+                  secure-boot: true
+                  # XXX: old name, remove once new spread is deployed
+                  secureboot: true
+            - ubuntu-20.10-64:
+                  workers: 8
+                  image: ubuntu-20.10-64
 
             - debian-9-64:
-                workers: 6
+                  workers: 6
             - debian-sid-64:
-                workers: 6
+                  workers: 6
 
-            - fedora-28-64:
-                workers: 4
-                manual: true
-            - fedora-29-64:
-                workers: 6
-                manual: true
             - fedora-30-64:
-                workers: 6
+                  workers: 6
+                  manual: true
             - fedora-31-64:
-                workers: 6
-            - opensuse-15.0-64:
-                workers: 6
-                manual: true
-            - arch-linux-64:
-                workers: 6
+                  workers: 6
+            - fedora-32-64:
+                  workers: 6
 
+            - arch-linux-64:
+                  workers: 6
             - amazon-linux-2-64:
-                workers: 6
-                storage: preserve-size
+                  workers: 6
+                  storage: preserve-size
+
             - centos-7-64:
-                workers: 6
-                storage: preserve-size
-                image: centos-7-64
-
-    # TODO: spread is really unhappy when it sees a backend without any systems,
-    # so this block is intentially kept commented out, until we need to add
-    # systems to it
-    #
-    google-unstable:
-       type: google
-       key: '$(HOST: echo "$SPREAD_GOOGLE_KEY")'
-       location: computeengine/us-east1-b
-       halt-timeout: 2h
-       systems:
+                  workers: 6
+                  storage: preserve-size
+                  image: centos-7-64
+            # unstable systems below
             - opensuse-15.1-64:
-                workers: 6
+                  workers: 6
+            - opensuse-15.2-64:
+                  workers: 6
             - opensuse-tumbleweed-64:
-                workers: 6
+                  workers: 6
+                  manual: true
             - centos-8-64:
-                workers: 4
-                storage: preserve-size
-                image: centos-8-64
+                  workers: 4
+                  storage: preserve-size
+                  image: centos-8-64
 
     google-sru:
         type: google
@@ -137,13 +149,13 @@
         halt-timeout: 2h
         systems:
             - ubuntu-16.04-64:
-                workers: 6
+                  workers: 6
             - ubuntu-18.04-64:
-                workers: 6
-            - ubuntu-19.04-64:
-                workers: 6
-            - ubuntu-19.10-64:
-                workers: 6
+                  workers: 6
+            - ubuntu-20.04-64:
+                  workers: 6
+            - ubuntu-20.10-64:
+                  workers: 6
 
     google-nested:
         type: google
@@ -153,105 +165,97 @@
         halt-timeout: 2h
         systems:
             - ubuntu-16.04-64:
-                image: ubuntu-1604-64-virt-enabled
-                storage: 20G
-                workers: 1
+                  image: ubuntu-1604-64-virt-enabled
+                  storage: 20G
+                  workers: 3
+            - ubuntu-18.04-64:
+                  image: ubuntu-1804-64-virt-enabled
+                  storage: 20G
+                  workers: 3
+            - ubuntu-20.04-64:
+                  image: ubuntu-2004-64-virt-enabled
+                  storage: 20G
+                  workers: 6
+
+    qemu-nested:
+        memory: 4G
+        type: qemu
+        systems:
+            - ubuntu-16.04-64:
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-64:
-                image: ubuntu-1804-64-virt-enabled
-                storage: 20G
-                workers: 1
-            - ubuntu-19.10-64:
-                image: ubuntu-1910-64-virt-enabled
-                storage: 20G
-                workers: 1
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-64:
-                image: ubuntu-2004-64-virt-enabled
-                storage: 20G
-                workers: 1
+                  username: ubuntu
+                  password: ubuntu
 
     qemu:
         # TODO:UC20: uc20 needs 2G or grub will not loopback the kernel snap
         memory: 2G
         systems:
             - ubuntu-14.04-32:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-14.04-64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-16.04-32:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-16.04-64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-core-16-64:
-                image: ubuntu-16.04-64
-                username: ubuntu
-                password: ubuntu
+                  image: ubuntu-16.04-64
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-core-18-64:
-                image: ubuntu-16.04-64
-                username: ubuntu
-                password: ubuntu
+                  image: ubuntu-16.04-64
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-core-20-64:
-                image: ubuntu-20.04-64
-                username: ubuntu
-                password: ubuntu
-                flags: [virtio]
-            - ubuntu-17.10-64:
-                username: ubuntu
-                password: ubuntu
+                  image: ubuntu-20.04-64
+                  username: ubuntu
+                  password: ubuntu
+                  flags: [virtio]
             - ubuntu-18.04-64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-32:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-64:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-32:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-64:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-32:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-64:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-32:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-32:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
+            - ubuntu-20.10-64:
+                  username: ubuntu
+                  password: ubuntu
             - debian-sid-64:
-                username: debian
-                password: debian
+                  username: debian
+                  password: debian
             - debian-9-64:
-                username: debian
-                password: debian
+                  username: debian
+                  password: debian
             - debian-sid-64:
-                username: debian
-                password: debian
-            - fedora-27-64:
-                username: fedora
-                password: fedora
-            - fedora-28-64:
-                username: fedora
-                password: fedora
-            - fedora-29-64:
-                username: fedora
-                password: fedora
+                  username: debian
+                  password: debian
             - centos-7-64:
-                username: centos
-                password: centos
+                  username: centos
+                  password: centos
+            - amazon-linux-2-64:
+                  username: ec2-user
+                  password: ec2-user
+            - opensuse-15.2-64:
+                  username: opensuse
+                  password: opensuse
+            - opensuse-tumbleweed-64:
+                  username: opensuse
+                  password: opensuse
     autopkgtest:
         type: adhoc
         allocate: |
@@ -267,138 +271,81 @@
         systems:
             # Trusty
             - ubuntu-14.04-amd64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-14.04-i386:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             # Xenial
             - ubuntu-16.04-amd64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-16.04-i386:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-16.04-ppc64el:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-16.04-armhf:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-16.04-s390x:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             # Artful
             - ubuntu-17.10-amd64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-17.10-i386:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-17.10-ppc64el:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-17.10-armhf:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-17.10-s390x:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             # Bionic
             - ubuntu-18.04-amd64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-i386:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-ppc64el:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-armhf:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-s390x:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-18.04-arm64:
-                username: ubuntu
-                password: ubuntu
-            # Cosmic
-            - ubuntu-18.10-amd64:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-i386:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-ppc64el:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-armhf:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-s390x:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-18.10-arm64:
-                username: ubuntu
-                password: ubuntu
-            # Disco
-            - ubuntu-19.04-amd64:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-i386:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-ppc64el:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-armhf:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-s390x:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.04-arm64:
-                username: ubuntu
-                password: ubuntu
-            # Eoan
-            - ubuntu-19.10-amd64:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-i386:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-ppc64el:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-armhf:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-s390x:
-                username: ubuntu
-                password: ubuntu
-            - ubuntu-19.10-arm64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             # Focal
             - ubuntu-20.04-amd64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-i386:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-ppc64el:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-armhf:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-s390x:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
             - ubuntu-20.04-arm64:
-                username: ubuntu
-                password: ubuntu
+                  username: ubuntu
+                  password: ubuntu
 
     external:
         type: adhoc
@@ -410,41 +357,41 @@
             ADDRESS $SPREAD_EXTERNAL_ADDRESS
         systems:
             - ubuntu-core-16-64:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-16-32:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-16-arm-64:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-16-arm-32:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-18-64:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-18-32:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-18-arm-64:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-18-arm-32:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-20-64:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-20-32:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-20-arm-64:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
             - ubuntu-core-20-arm-32:
-                username: external
-                password: ubuntu
+                  username: external
+                  password: ubuntu
 
 path: /home/gopath/src/github.com/snapcore/snapd
 
@@ -463,13 +410,33 @@
 
 debug-each: |
     if [ "$SPREAD_DEBUG_EACH" = 1 ]; then
-        # shellcheck source=tests/lib/journalctl.sh
-        . "$TESTSLIB/journalctl.sh"
         #shellcheck source=tests/lib/state.sh
         . "$TESTSLIB/state.sh"
+        #shellcheck source=tests/lib/nested.sh
+        . "$TESTSLIB/nested.sh"
+
+        echo '# System information'
+        cat /etc/os-release || true
+
+        echo '# Kernel information'
+        uname -a
+
+        echo '# Go information'
+        go version || true
+
+        if nested_is_nested_system; then
+            echo '# nested VM status'
+            systemctl status nested-vm || true
+            journalctl --no-pager -u nested-vm || true
+            nested_print_serial_log
+                # add another echo in case the serial log is missing a newline
+                echo
+
+            nested_exec sudo journalctl --no-pager -u snapd || true
+        fi
 
         echo '# journal messages for snapd'
-        get_journalctl_log -u snapd
+        "$TESTSTOOLS"/journal-state get-log -u snapd
         case "$SPREAD_SYSTEM" in
             fedora-*|centos-*|amazon-*)
                 if [ -e "$RUNTIME_STATE_PATH/audit-stamp" ]; then
@@ -483,10 +450,14 @@
                 ) | grep -v snappy_home_t || true
                 find /var/snap -printf '%Z\t%H/%P\n' | grep -v snappy_var_t || true
                 ;;
+            opensuse-*)
+                echo '# apparmor denials logged by auditd'
+                ausearch -m AVC | grep DENIED || true
+                ;;
             *)
-               echo '# apparmor denials '
-               dmesg --ctime | grep DENIED || true
-               ;;
+                echo '# apparmor denials '
+                dmesg --ctime | grep DENIED || true
+                ;;
         esac
         echo '# seccomp denials (kills) '
         dmesg --ctime | grep type=1326 || true
@@ -499,6 +470,10 @@
         echo '# mounts'
         # use ascii output to prevent travis from messing up the encoding
         findmnt --ascii -o+PROPAGATION || true
+        echo "# processes"
+        ps aux
+        echo "# /var/lib/snapd"
+        find /var/lib/snapd/ -not -path '/var/lib/snapd/snap/*' -ls || true
     fi
 
 rename:
@@ -516,9 +491,20 @@
     elif ! git show-ref "$DELTA_REF" > /dev/null; then
         cat <&3 >&4
     else
-        trap "rm -f delta-ref.tar current.delta" EXIT
+        tmpdir="$(mktemp -d)"
+        #shellcheck disable=SC2064
+        trap "rm -rf delta-ref.tar current.delta repacked-current.tar $tmpdir" EXIT
+        if [ "$REPACK_KEEP_VENDOR" = "n" ]; then
+            tar -C "$tmpdir" -xvf - <&3
+            find "$tmpdir/$DELTA_PREFIX/vendor/" ! -wholename "$tmpdir/$DELTA_PREFIX/vendor/" \
+                ! -wholename "$tmpdir/$DELTA_PREFIX/vendor/vendor.json" \
+                -delete
+            tar -C "$tmpdir" -c "$DELTA_PREFIX" > repacked-current.tar
+        else
+            cat <&3 > repacked-current.tar
+        fi
         git archive -o delta-ref.tar --format=tar --prefix="$DELTA_PREFIX" "$DELTA_REF"
-        xdelta3 -S none -s delta-ref.tar <&3 > current.delta
+        xdelta3 -S none -s delta-ref.tar repacked-current.tar > current.delta
         tar c current.delta >&4
     fi
 
@@ -625,7 +611,7 @@
         esac
         rm -f "$tf"
         curl -sS -o - "https://codeload.github.com/snapcore/snapd/tar.gz/$DELTA_REF" | gunzip > delta-ref.tar
-        xdelta3 -q -d -s delta-ref.tar current.delta | tar x --strip-components=1
+        xdelta3 -q -c -d -s delta-ref.tar current.delta | tar x --strip-components=1
         rm -f delta-ref.tar current.delta
     elif [ -d "$DELTA_PREFIX" ]; then
         find "$DELTA_PREFIX" -mindepth 1 -maxdepth 1 -exec mv {} . \;
@@ -641,22 +627,11 @@
     # context.
     type MATCH | tail -n +2 > "$TESTSLIB"/spread-funcs.sh
     unset MATCH
+    type NOMATCH | tail -n +2 >> "$TESTSLIB"/spread-funcs.sh
+    unset NOMATCH
     type REBOOT | tail -n +2 >> "$TESTSLIB"/spread-funcs.sh
     unset REBOOT
 
-    if [ -e /etc/profile.d/go.sh ]; then
-        # Up until recently openSUSE golang packaging injected environment
-        # variables into the global shell profile. This caused issues across
-        # updates and was, in fact, entirely useless. As such, if we are
-        # working against an older image that still has that file, we can
-        # remove it and unset certain variables to avoid the problem.
-        unset GOBIN
-        unset GOARCH
-        unset GOROOT
-        unset GOOS
-        rm -f /etc/profile.d/go.sh
-    fi
-
     # NOTE: At this stage the source tree is available and no more special
     # considerations apply.
     "$TESTSLIB"/prepare-restore.sh --prepare-project
@@ -667,6 +642,12 @@
 restore-each: |
     "$TESTSLIB"/prepare-restore.sh --restore-project-each
 suites:
+    tests/lib/tools/suite/:
+        summary: Tests for tests/lib/tools tools
+        prepare-each: |
+            "$TESTSLIB"/prepare-restore.sh --prepare-suite-each-minimal-no-snaps
+        restore-each: |
+            "$TESTSLIB"/prepare-restore.sh --restore-suite-each-minimal-no-snaps
     # The essential tests designed to run inside the autopkgtest
     # environment on each platform. On autopkgtest we cannot run all tests
     # as this is very slow and we run into timeouts.
@@ -686,6 +667,7 @@
     # All other tests run now and will heavily modify the system.
     tests/main/:
         summary: Full-system tests for snapd
+        systems: [-ubuntu-secboot-*]
         prepare: |
             "$TESTSLIB"/prepare-restore.sh --prepare-suite
         prepare-each: |
@@ -713,7 +695,7 @@
     tests/completion/:
         summary: completion tests
         # ppc64el disabled because of https://bugs.launchpad.net/snappy/+bug/1655594
-        systems: [-ubuntu-core-*, -ubuntu-*-ppc64el]
+        systems: [-ubuntu-core-*, -ubuntu-*-ppc64el, -ubuntu-secboot-*]
         prepare: |
             "$TESTSLIB"/prepare-restore.sh --prepare-suite
         prepare-each: |
@@ -723,23 +705,24 @@
         restore: |
             "$TESTSLIB"/prepare-restore.sh --restore-suite
         environment:
-          _/plain: _
-          _/plain_plusdirs: _
-          _/funky: _
-          _/files: _
-          # dirs fails on indirection because of (mis)handling of trailing
-          # slashes. This might be configuration-dependent.
-          # _/dirs: _
-          _/hosts: _
-          _/hosts_n_dirs: _
-          # twisted fails in travis (but not regular spread).
-          # _/twisted: _
-          _/func: _
-          _/funkyfunc: _
-          _/funcarg: _
+            _/plain: _
+            _/plain_plusdirs: _
+            _/funky: _
+            _/files: _
+            # dirs fails on indirection because of (mis)handling of trailing
+            # slashes. This might be configuration-dependent.
+            # _/dirs: _
+            _/hosts: _
+            _/hosts_n_dirs: _
+            # twisted fails in travis (but not regular spread).
+            # _/twisted: _
+            _/func: _
+            _/funkyfunc: _
+            _/funcarg: _
 
     tests/regression/:
         summary: Regression tests for snapd
+        systems: [-ubuntu-secboot-*]
         prepare: |
             "$TESTSLIB"/prepare-restore.sh --prepare-suite
         prepare-each: |
@@ -754,7 +737,7 @@
         # Test cases are not yet ported to openSUSE that is why we keep
         # it disabled. A later PR will enable most tests and
         # drop this blacklist.
-        systems: [-ubuntu-core-*, -opensuse-*]
+        systems: [-ubuntu-core-*, -opensuse-*, -ubuntu-secboot-*]
         prepare-each: |
             # FIXME: this should really use prepare-restore.sh --prepare-suite-each
             # like other suites, needs more investigation
@@ -787,7 +770,16 @@
         # Test cases are not yet ported to Fedora/openSUSE/Arch that is why
         # we keep them disabled. A later PR will enable most tests and
         # drop this blacklist.
-        systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*]
+        systems:
+            [
+                -ubuntu-core-*,
+                -fedora-*,
+                -opensuse-*,
+                -arch-*,
+                -amazon-*,
+                -centos-*,
+                -ubuntu-secboot-*,
+            ]
         # unittests are run as part of the autopkgtest build already
         backends: [-autopkgtest]
         environment:
@@ -843,176 +835,172 @@
 
     tests/nested/manual/:
         summary: Tests for nested images controlled manually from the tests
-        backends: [google-nested]
-        systems: [ubuntu-19.10-64, ubuntu-20.04-64]
+        backends: [google-nested, qemu-nested]
+        systems:
+            - ubuntu-16.04-64
+            - ubuntu-18.04-64
+            - ubuntu-20.04-64
         environment:
             NESTED_TYPE: "classic"
-            # Channel used to create the nested vm
-            CORE_CHANNEL: '$(HOST: echo "${SPREAD_CORE_CHANNEL:-stable}")'
-            # Channel used to refresh when testing refresh and revert
-            CORE_REFRESH_CHANNEL: '$(HOST: echo "${SPREAD_CORE_REFRESH_CHANNEL:-edge}")'
-            # Channel used to update the core/snapd snaps on some tests
-            NEW_CORE_CHANNEL: '$(HOST: echo "${SPREAD_NEW_CORE_CHANNEL:-edge}")'
-            # Use cloud init to make initial system configuration instead of user assertion
-            USE_CLOUD_INIT: '$(HOST: echo "${SPREAD_USE_CLOUD_INIT:-true}")'
+            # Enable kvm in the qemu command line
+            NESTED_ENABLE_KVM: '$(HOST: echo "${NESTED_ENABLE_KVM:-true}")'
             # Enable tpm in the nested vm in case it is supported
-            ENABLE_TPM: '$(HOST: echo "${SPREAD_ENABLE_TPM:-false}")'
+            NESTED_ENABLE_TPM: '$(HOST: echo "${NESTED_ENABLE_TPM:-false}")'
             # Enable secure boot in the nested vm in case it is supported
-            ENABLE_SECURE_BOOT: '$(HOST: echo "${SPREAD_ENABLE_SECURE_BOOT:-false}")'
-            # Build and use snapd from current branch
-            BUILD_FROM_CURRENT: '$(HOST: echo "${SPREAD_BUILD_FROM_CURRENT:-false}")'
+            NESTED_ENABLE_SECURE_BOOT: '$(HOST: echo "${NESTED_ENABLE_SECURE_BOOT:-false}")'
         manual: true
+        warn-timeout: 10m
+        kill-timeout: 60m
+        debug: |
+            #shellcheck source=tests/lib/nested.sh
+            . "$TESTSLIB/nested.sh"
+            nested_print_serial_log
         prepare: |
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
             distro_update_package_db
-            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx
+            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx xz-utils
             snap install ubuntu-image --classic
 
+            # Install the snapd built
+            dpkg -i "$SPREAD_PATH"/../snapd_*.deb
+        prepare-each: |
+            tests.backup prepare
+            "$TESTSTOOLS"/nested-state prepare
+        restore-each: |
+            "$TESTSTOOLS"/nested-state remove-vm
+            "$TESTSTOOLS"/nested-state restore
+            tests.backup restore
         restore: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            cleanup_nested_env
-
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
-            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils
+            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils xz-utils
 
     tests/nested/classic/:
         summary: Tests for nested images
-        backends: [google-nested]
+        backends: [google-nested, qemu-nested]
         systems: [ubuntu-16.04-64, ubuntu-18.04-64, ubuntu-20.04-64]
         environment:
             NESTED_TYPE: "classic"
             # Channel used to create the nested vm
-            CORE_CHANNEL: '$(HOST: echo "${SPREAD_CORE_CHANNEL:-stable}")'
-            # Channel used to refresh when testing refresh and revert
-            CORE_REFRESH_CHANNEL: '$(HOST: echo "${SPREAD_CORE_REFRESH_CHANNEL:-edge}")'
-            # Channel used to update the core/snapd snaps on some tests
-            NEW_CORE_CHANNEL: '$(HOST: echo "${SPREAD_NEW_CORE_CHANNEL:-edge}")'
-            # Use cloud init to make initial system configuration instead of user assertion
-            USE_CLOUD_INIT: '$(HOST: echo "${SPREAD_USE_CLOUD_INIT:-true}")'
+            NESTED_ENABLE_KVM: '$(HOST: echo "${NESTED_ENABLE_KVM:-true}")'
             # Enable tpm in the nested vm in case it is supported
-            ENABLE_TPM: '$(HOST: echo "${SPREAD_ENABLE_TPM:-false}")'
+            NESTED_ENABLE_TPM: '$(HOST: echo "${NESTED_ENABLE_TPM:-false}")'
             # Enable secure boot in the nested vm in case it is supported
-            ENABLE_SECURE_BOOT: '$(HOST: echo "${SPREAD_ENABLE_SECURE_BOOT:-false}")'
-            # Build and use snapd from current branch
-            BUILD_FROM_CURRENT: '$(HOST: echo "${SPREAD_BUILD_FROM_CURRENT:-false}")'
+            NESTED_ENABLE_SECURE_BOOT: '$(HOST: echo "${NESTED_ENABLE_SECURE_BOOT:-false}")'
         manual: true
+        debug: |
+            #shellcheck source=tests/lib/nested.sh
+            . "$TESTSLIB/nested.sh"
+            nested_print_serial_log
         prepare: |
-            "$TESTSLIB"/prepare-restore.sh --prepare-suite
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
             distro_update_package_db
-            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx
+            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx xz-utils
             snap install ubuntu-image --classic
 
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            create_nested_classic_vm
+            # Install the snapd built
+            dpkg -i "$SPREAD_PATH"/../snapd_*.deb
+
+            "$TESTSTOOLS"/nested-state prepare
+            "$TESTSTOOLS"/nested-state build-image classic
         prepare-each: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            start_nested_classic_vm
+            tests.backup prepare
+            "$TESTSTOOLS"/nested-state create-vm classic
         restore-each: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            destroy_nested_vm
+            "$TESTSTOOLS"/nested-state remove-vm
+            tests.backup restore
         restore: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            cleanup_nested_env
+            "$TESTSTOOLS"/nested-state restore
 
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
-            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils
+            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils xz-utils
 
     tests/nested/core/:
         summary: Tests for nested images
-        backends: [google-nested]
+        backends: [google-nested, qemu-nested]
         systems: [ubuntu-16.04-64, ubuntu-18.04-64]
         environment:
             NESTED_TYPE: "core"
-            # Channel used to create the nested vm
-            CORE_CHANNEL: '$(HOST: echo "${SPREAD_CORE_CHANNEL:-stable}")'
-            # Channel used to refresh when testing refresh and revert
-            CORE_REFRESH_CHANNEL: '$(HOST: echo "${SPREAD_CORE_REFRESH_CHANNEL:-edge}")'
-            # Channel used to update the core/snapd snaps on some tests
-            NEW_CORE_CHANNEL: '$(HOST: echo "${SPREAD_NEW_CORE_CHANNEL:-edge}")'
-            # Use cloud init to make initial system configuration instead of user assertion
-            USE_CLOUD_INIT: '$(HOST: echo "${SPREAD_USE_CLOUD_INIT:-true}")'
+            # Enable kvm in the qemu command line
+            NESTED_ENABLE_KVM: '$(HOST: echo "${NESTED_ENABLE_KVM:-true}")'
             # Enable tpm in the nested vm in case it is supported
-            ENABLE_TPM: '$(HOST: echo "${SPREAD_ENABLE_TPM:-false}")'
+            NESTED_ENABLE_TPM: '$(HOST: echo "${NESTED_ENABLE_TPM:-false}")'
             # Enable secure boot in the nested vm in case it is supported
-            ENABLE_SECURE_BOOT: '$(HOST: echo "${SPREAD_ENABLE_SECURE_BOOT:-false}")'
-            # Build and use snapd from current branch
-            BUILD_FROM_CURRENT: '$(HOST: echo "${SPREAD_BUILD_FROM_CURRENT:-false}")'
+            NESTED_ENABLE_SECURE_BOOT: '$(HOST: echo "${NESTED_ENABLE_SECURE_BOOT:-false}")'
         manual: true
+        debug: |
+            #shellcheck source=tests/lib/nested.sh
+            . "$TESTSLIB/nested.sh"
+            nested_print_serial_log
         prepare: |
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
             distro_update_package_db
-            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx
+            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx xz-utils
             snap install ubuntu-image --classic
 
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            create_nested_core_vm
+            # Install the snapd built
+            dpkg -i "$SPREAD_PATH"/../snapd_*.deb
+
+            "$TESTSTOOLS"/nested-state prepare
+            "$TESTSTOOLS"/nested-state build-image core
         prepare-each: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            start_nested_core_vm
+            tests.backup prepare
+            "$TESTSTOOLS"/nested-state create-vm core
         restore-each: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            destroy_nested_vm
+            "$TESTSTOOLS"/nested-state remove-vm
+            tests.backup restore
         restore: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            cleanup_nested_env
+            "$TESTSTOOLS"/nested-state restore
 
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
-            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils
+            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils xz-utils
 
     tests/nested/core20/:
         summary: Tests for nested uc20 images
-        backends: [google-nested]
+        backends: [google-nested, qemu-nested]
         systems: [ubuntu-20.04-64]
         environment:
             NESTED_TYPE: "core"
-            # Channel used to create the nested vm
-            CORE_CHANNEL: '$(HOST: echo "${SPREAD_CORE_CHANNEL:-edge}")'
-            # Use cloud init to make initial system configuration instead of user assertion
-            USE_CLOUD_INIT: '$(HOST: echo "${SPREAD_USE_CLOUD_INIT:-true}")'
-            # Enable tpm in the nested vm in case it is supported
-            ENABLE_TPM: '$(HOST: echo "${SPREAD_ENABLE_TPM:-true}")'
+            # Enable kvm in the qemu command line
+            NESTED_ENABLE_KVM: '$(HOST: echo "${NESTED_ENABLE_KVM:-true}")'
             # Enable secure boot in the nested vm in case it is supported
-            ENABLE_SECURE_BOOT: '$(HOST: echo "${SPREAD_ENABLE_SECURE_BOOT:-true}")'
-            # Build and use snapd from current branch
-            BUILD_FROM_CURRENT: '$(HOST: echo "${SPREAD_BUILD_FROM_CURRENT:-true}")'
+            NESTED_ENABLE_TPM: '$(HOST: echo "${NESTED_ENABLE_TPM:-true}")'
+            # Enable secure boot in the nested vm in case it is supported
+            NESTED_ENABLE_SECURE_BOOT: '$(HOST: echo "${NESTED_ENABLE_SECURE_BOOT:-true}")'
         manual: true
+        debug: |
+            #shellcheck source=tests/lib/nested.sh
+            . "$TESTSLIB/nested.sh"
+            nested_print_serial_log
+        warn-timeout: 10m
+        kill-timeout: 60m
         prepare: |
-            "$TESTSLIB"/prepare-restore.sh --prepare-suite
-
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
             distro_update_package_db
-            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx
+            distro_install_package snapd qemu qemu-utils genisoimage sshpass qemu-kvm cloud-image-utils ovmf kpartx xz-utils haveged
             snap install ubuntu-image --classic
 
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            create_nested_core_vm
-            start_nested_core_vm
-        restore: |
-            #shellcheck source=tests/lib/nested.sh
-            . "$TESTSLIB/nested.sh"
-            destroy_nested_vm
-            cleanup_nested_env
+            # Install the snapd built
+            dpkg -i "$SPREAD_PATH"/../snapd_*.deb
 
+            "$TESTSTOOLS"/nested-state prepare
+            "$TESTSTOOLS"/nested-state build-image core
+        prepare-each: |
+            tests.backup prepare
+            "$TESTSTOOLS"/nested-state create-vm core
+        restore-each: |
+            "$TESTSTOOLS"/nested-state remove-vm
+            tests.backup restore
+        restore: |
+            "$TESTSTOOLS"/nested-state restore
             #shellcheck source=tests/lib/pkgdb.sh
             . "$TESTSLIB"/pkgdb.sh
-            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils
+            distro_purge_package qemu genisoimage sshpass qemu-kvm cloud-image-utils xz-utils
 
 # vim:ts=4:sw=4:et
diff -Nru snapd-2.45.1+20.04.2/store/errors.go snapd-2.48.3+20.04/store/errors.go
--- snapd-2.45.1+20.04.2/store/errors.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/errors.go	2021-02-02 08:21:12.000000000 +0000
@@ -128,7 +128,7 @@
 
 // SnapActionError conveys errors that were reported on otherwise overall successful snap action (install/refresh) request.
 type SnapActionError struct {
-	// NoResults is set if the there were no results in the response
+	// NoResults is set if there were no results in the response
 	NoResults bool
 	// Refresh errors by snap name.
 	Refresh map[string]error
diff -Nru snapd-2.45.1+20.04.2/store/export_test.go snapd-2.48.3+20.04/store/export_test.go
--- snapd-2.45.1+20.04.2/store/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -195,3 +195,10 @@
 		ratelimitReader = oldRatelimitReader
 	}
 }
+
+type (
+	ErrorListEntryJSON   = errorListEntry
+	SnapActionResultJSON = snapActionResult
+)
+
+var ReportFetchAssertionsError = reportFetchAssertionsError
diff -Nru snapd-2.45.1+20.04.2/store/store_action_fetch_assertions_test.go snapd-2.48.3+20.04/store/store_action_fetch_assertions_test.go
--- snapd-2.45.1+20.04.2/store/store_action_fetch_assertions_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/store/store_action_fetch_assertions_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,442 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package store_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/release"
+	"github.com/snapcore/snapd/store"
+)
+
+type storeActionFetchAssertionsSuite struct {
+	baseStoreSuite
+}
+
+var _ = Suite(&storeActionFetchAssertionsSuite{})
+
+type testAssertQuery struct {
+	toResolve map[asserts.Grouping][]*asserts.AtRevision
+	errors    map[string]error
+}
+
+func (q *testAssertQuery) ToResolve() (map[asserts.Grouping][]*asserts.AtRevision, error) {
+	return q.toResolve, nil
+}
+
+func (q *testAssertQuery) addError(e error, u string) {
+	if q.errors == nil {
+		q.errors = make(map[string]error)
+	}
+	q.errors[u] = e
+}
+
+func (q *testAssertQuery) AddError(e error, ref *asserts.Ref) error {
+	q.addError(e, ref.Unique())
+	return nil
+}
+
+func (q *testAssertQuery) AddGroupingError(e error, grouping asserts.Grouping) error {
+	q.addError(e, fmt.Sprintf("{%s}", grouping))
+	return nil
+}
+
+func (s *storeActionFetchAssertionsSuite) TestFetch(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "POST", snapActionPath)
+		// check device authorization is set, implicitly checking doRequest was used
+		c.Check(r.Header.Get("Snap-Device-Authorization"), Equals, `Macaroon root="device-macaroon"`)
+
+		jsonReq, err := ioutil.ReadAll(r.Body)
+		c.Assert(err, IsNil)
+		var req struct {
+			Context []map[string]interface{} `json:"context"`
+			Actions []map[string]interface{} `json:"actions"`
+
+			AssertionMaxFormats map[string]int `json:"assertion-max-formats"`
+		}
+
+		err = json.Unmarshal(jsonReq, &req)
+		c.Assert(err, IsNil)
+
+		c.Assert(req.Context, HasLen, 0)
+		c.Assert(req.Actions, HasLen, 1)
+		expectedAction := map[string]interface{}{
+			"action": "fetch-assertions",
+			"key":    "g1",
+			"assertions": []interface{}{
+				map[string]interface{}{
+					"type": "snap-declaration",
+					"primary-key": []interface{}{
+						"16",
+						"iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+					},
+				},
+			},
+		}
+		c.Assert(req.Actions[0], DeepEquals, expectedAction)
+
+		c.Assert(req.AssertionMaxFormats, DeepEquals, asserts.MaxSupportedFormats(1))
+
+		fmt.Fprintf(w, `{
+  "results": [{
+     "result": "fetch-assertions",
+     "key": "g1",
+     "assertion-stream-urls": [
+        "https://api.snapcraft.io/api/v1/snaps/assertions/snap-declaration/16/iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5"
+      ]
+     }
+   ]
+}`)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	assertq := &testAssertQuery{
+		toResolve: map[asserts.Grouping][]*asserts.AtRevision{
+			asserts.Grouping("g1"): {{
+				Ref: asserts.Ref{
+					Type: asserts.SnapDeclarationType,
+					PrimaryKey: []string{
+						"16",
+						"iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+					},
+				},
+				Revision: asserts.RevisionNotKnown,
+			}},
+		},
+	}
+
+	results, aresults, err := sto.SnapAction(s.ctx, nil,
+		nil, assertq, nil, nil)
+	c.Assert(err, IsNil)
+	c.Check(results, HasLen, 0)
+	c.Check(aresults, HasLen, 1)
+	c.Check(aresults[0].Grouping, Equals, asserts.Grouping("g1"))
+	c.Check(aresults[0].StreamURLs, DeepEquals, []string{
+		"https://api.snapcraft.io/api/v1/snaps/assertions/snap-declaration/16/iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+	})
+}
+
+func (s *storeActionFetchAssertionsSuite) TestUpdateIfNewerThan(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "POST", snapActionPath)
+		// check device authorization is set, implicitly checking doRequest was used
+		c.Check(r.Header.Get("Snap-Device-Authorization"), Equals, `Macaroon root="device-macaroon"`)
+
+		jsonReq, err := ioutil.ReadAll(r.Body)
+		c.Assert(err, IsNil)
+		var req struct {
+			Context []map[string]interface{} `json:"context"`
+			Actions []map[string]interface{} `json:"actions"`
+
+			AssertionMaxFormats map[string]int `json:"assertion-max-formats"`
+		}
+
+		err = json.Unmarshal(jsonReq, &req)
+		c.Assert(err, IsNil)
+
+		c.Assert(req.Context, HasLen, 0)
+		c.Assert(req.Actions, HasLen, 2)
+		expectedAction1 := map[string]interface{}{
+			"action": "fetch-assertions",
+			"key":    "g1",
+			"assertions": []interface{}{
+				map[string]interface{}{
+					"type": "snap-declaration",
+					"primary-key": []interface{}{
+						"16",
+						"iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+					},
+					"if-newer-than": float64(0),
+				},
+			},
+		}
+		expectedAction2 := map[string]interface{}{
+			"action": "fetch-assertions",
+			"key":    "g2",
+			"assertions": []interface{}{
+				map[string]interface{}{
+					"type": "snap-declaration",
+					"primary-key": []interface{}{
+						"16",
+						"CSO04Jhav2yK0uz97cr0ipQRyqg0qQL6",
+					},
+					"if-newer-than": float64(1),
+				},
+			},
+		}
+		expectedActions := []map[string]interface{}{expectedAction1, expectedAction2}
+		if req.Actions[0]["key"] != "g1" {
+			expectedActions = []map[string]interface{}{expectedAction2, expectedAction1}
+		}
+		c.Assert(req.Actions, DeepEquals, expectedActions)
+
+		c.Assert(req.AssertionMaxFormats, DeepEquals, asserts.MaxSupportedFormats(1))
+
+		fmt.Fprintf(w, `{
+  "results": [{
+     "result": "fetch-assertions",
+     "key": "g1",
+     "assertion-stream-urls": [
+        "https://api.snapcraft.io/api/v1/snaps/assertions/snap-declaration/16/iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5"
+      ]
+     }, {
+     "result": "fetch-assertions",
+     "key": "g2",
+     "assertion-stream-urls": []
+     }
+   ]
+}`)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	assertq := &testAssertQuery{
+		toResolve: map[asserts.Grouping][]*asserts.AtRevision{
+			asserts.Grouping("g1"): {{
+				Ref: asserts.Ref{
+					Type: asserts.SnapDeclarationType,
+					PrimaryKey: []string{
+						"16",
+						"iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+					},
+				},
+				Revision: 0,
+			}},
+			asserts.Grouping("g2"): {{
+				Ref: asserts.Ref{
+					Type: asserts.SnapDeclarationType,
+					PrimaryKey: []string{
+						"16",
+						"CSO04Jhav2yK0uz97cr0ipQRyqg0qQL6",
+					},
+				},
+				Revision: 1,
+			}},
+		},
+	}
+
+	results, aresults, err := sto.SnapAction(s.ctx, nil,
+		nil, assertq, nil, nil)
+	c.Assert(err, IsNil)
+	c.Check(results, HasLen, 0)
+	c.Check(aresults, HasLen, 2)
+	seen := 0
+	for _, aresult := range aresults {
+		if aresult.Grouping == asserts.Grouping("g1") {
+			seen++
+			c.Check(aresult.StreamURLs, DeepEquals, []string{
+				"https://api.snapcraft.io/api/v1/snaps/assertions/snap-declaration/16/iEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+			})
+		} else {
+			seen++
+			c.Check(aresult.Grouping, Equals, asserts.Grouping("g2"))
+			c.Check(aresult.StreamURLs, HasLen, 0)
+		}
+	}
+	c.Check(seen, Equals, 2)
+}
+
+func (s *storeActionFetchAssertionsSuite) TestFetchNotFound(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "POST", snapActionPath)
+		// check device authorization is set, implicitly checking doRequest was used
+		c.Check(r.Header.Get("Snap-Device-Authorization"), Equals, `Macaroon root="device-macaroon"`)
+
+		jsonReq, err := ioutil.ReadAll(r.Body)
+		c.Assert(err, IsNil)
+		var req struct {
+			Context []map[string]interface{} `json:"context"`
+			Actions []map[string]interface{} `json:"actions"`
+		}
+
+		err = json.Unmarshal(jsonReq, &req)
+		c.Assert(err, IsNil)
+
+		c.Assert(req.Context, HasLen, 0)
+		c.Assert(req.Actions, HasLen, 1)
+		expectedAction := map[string]interface{}{
+			"action": "fetch-assertions",
+			"key":    "g1",
+			"assertions": []interface{}{
+				map[string]interface{}{
+					"type": "snap-declaration",
+					"primary-key": []interface{}{
+						"16",
+						"xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+					},
+				},
+			},
+		}
+		c.Assert(req.Actions[0], DeepEquals, expectedAction)
+
+		fmt.Fprintf(w, `{
+  "results": [{
+     "result": "fetch-assertions",
+     "key": "g1",
+     "assertion-stream-urls": [],
+     "error-list": [
+        {
+          "code": "not-found",
+          "message": "not found: no assertion with type \"snap-declaration\" and key {\"series\":\"16\",\"snap-id\":\"xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5\"}",
+          "primary-key": [
+            "16",
+            "xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5"
+          ],
+          "type": "snap-declaration"
+        }
+     ]
+     }
+   ]
+}`)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	assertq := &testAssertQuery{
+		toResolve: map[asserts.Grouping][]*asserts.AtRevision{
+			asserts.Grouping("g1"): {{
+				Ref: asserts.Ref{
+					Type: asserts.SnapDeclarationType,
+					PrimaryKey: []string{
+						"16",
+						"xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+					},
+				},
+				Revision: asserts.RevisionNotKnown,
+			}},
+		},
+	}
+
+	results, aresults, err := sto.SnapAction(s.ctx, nil,
+		nil, assertq, nil, nil)
+	c.Assert(err, IsNil)
+	c.Check(results, HasLen, 0)
+	c.Check(aresults, HasLen, 0)
+
+	c.Check(assertq.errors, DeepEquals, map[string]error{
+		"snap-declaration/16/xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5": &asserts.NotFoundError{
+			Type:    asserts.SnapDeclarationType,
+			Headers: map[string]string{"series": "16", "snap-id": "xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5"}},
+	})
+}
+
+func (s *storeActionFetchAssertionsSuite) TestReportFetchAssertionsError(c *C) {
+	notFound := store.ErrorListEntryJSON{
+		Code: "not-found",
+		Type: "snap-declaration",
+		PrimaryKey: []string{
+			"16",
+			"xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+		},
+		Message: `not found: no assertion with type "snap-declaration" and key {"series":"16","snap-id":"xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5"}`,
+	}
+	invalidRequest := store.ErrorListEntryJSON{
+		Code:       "invalid-request",
+		Type:       "snap-declaration",
+		PrimaryKey: []string{},
+		Message:    `invalid request: invalid key, should be "{series}/{snap-id}"`,
+	}
+	// not a realistic error, but for completeness
+	otherRefError := store.ErrorListEntryJSON{
+		Code: "other-ref-error",
+		Type: "snap-declaration",
+		PrimaryKey: []string{
+			"16",
+			"xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5",
+		},
+		Message: "other ref error",
+	}
+
+	tests := []struct {
+		errorList []store.ErrorListEntryJSON
+		errkey    string
+		err       string
+	}{
+		{[]store.ErrorListEntryJSON{notFound}, "snap-declaration/16/xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5", "snap-declaration.*not found"},
+		{[]store.ErrorListEntryJSON{otherRefError}, "snap-declaration/16/xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5", "other ref error"},
+		{[]store.ErrorListEntryJSON{otherRefError, notFound}, "snap-declaration/16/xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5", "other ref error"},
+		{[]store.ErrorListEntryJSON{notFound, otherRefError}, "snap-declaration/16/xEr2EpvaIaqrXxoM2JyHOmuXQYvSzUt5", "other ref error"},
+		{[]store.ErrorListEntryJSON{invalidRequest}, "{g1}", "invalid request: invalid key.*"},
+		{[]store.ErrorListEntryJSON{invalidRequest, otherRefError}, "{g1}", "invalid request: invalid key.*"},
+		{[]store.ErrorListEntryJSON{invalidRequest, notFound}, "{g1}", "invalid request: invalid key.*"},
+		{[]store.ErrorListEntryJSON{notFound, invalidRequest, otherRefError}, "{g1}", "invalid request: invalid key.*"},
+	}
+
+	for _, t := range tests {
+		assertq := &testAssertQuery{}
+
+		res := &store.SnapActionResultJSON{
+			Key:       "g1",
+			ErrorList: t.errorList,
+		}
+
+		err := store.ReportFetchAssertionsError(res, assertq)
+		c.Assert(err, IsNil)
+
+		c.Check(assertq.errors, HasLen, 1)
+		for k, e := range assertq.errors {
+			c.Check(k, Equals, t.errkey)
+			c.Check(e, ErrorMatches, t.err)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/store/store_action.go snapd-2.48.3+20.04/store/store_action.go
--- snapd-2.45.1+20.04.2/store/store_action.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/store_action.go	2021-02-02 08:21:12.000000000 +0000
@@ -28,6 +28,7 @@
 	"fmt"
 	"time"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/jsonutil"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/auth"
@@ -57,6 +58,13 @@
 	CohortKey        string
 }
 
+type AssertionQuery interface {
+	ToResolve() (map[asserts.Grouping][]*asserts.AtRevision, error)
+
+	AddError(e error, ref *asserts.Ref) error
+	AddGroupingError(e error, grouping asserts.Grouping) error
+}
+
 type currentSnapV2JSON struct {
 	SnapID           string     `json:"snap-id"`
 	InstanceKey      string     `json:"instance-key"`
@@ -96,8 +104,9 @@
 }
 
 type snapActionJSON struct {
-	Action           string `json:"action"`
-	InstanceKey      string `json:"instance-key"`
+	Action string `json:"action"`
+	// For snap
+	InstanceKey      string `json:"instance-key,omitempty"`
 	Name             string `json:"name,omitempty"`
 	SnapID           string `json:"snap-id,omitempty"`
 	Channel          string `json:"channel,omitempty"`
@@ -112,6 +121,15 @@
 	// and then setting it to a (possibly nil) epoch for install and download. As a
 	// nil epoch is not an empty interface{}, you'll get the null in the json.
 	Epoch interface{} `json:"epoch,omitempty"`
+	// For assertions
+	Key        string         `json:"key,omitempty"`
+	Assertions []assertAtJSON `json:"assertions,omitempty"`
+}
+
+type assertAtJSON struct {
+	Type        string   `json:"type"`
+	PrimaryKey  []string `json:"primary-key"`
+	IfNewerThan *int     `json:"if-newer-than,omitempty"`
 }
 
 type snapRelease struct {
@@ -119,8 +137,17 @@
 	Channel      string `json:"channel"`
 }
 
+type errorListEntry struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+	// for assertions
+	Type       string   `json:"type"`
+	PrimaryKey []string `json:"primary-key"`
+}
+
 type snapActionResult struct {
-	Result           string    `json:"result"`
+	Result string `json:"result"`
+	// For snap
 	InstanceKey      string    `json:"instance-key"`
 	SnapID           string    `json:"snap-id,omitempy"`
 	Name             string    `json:"name,omitempty"`
@@ -134,20 +161,22 @@
 			Releases []snapRelease `json:"releases"`
 		} `json:"extra"`
 	} `json:"error"`
+	// For assertions
+	Key                 string           `json:"key"`
+	AssertionStreamURLs []string         `json:"assertion-stream-urls"`
+	ErrorList           []errorListEntry `json:"error-list"`
 }
 
 type snapActionRequest struct {
-	Context []*currentSnapV2JSON `json:"context"`
-	Actions []*snapActionJSON    `json:"actions"`
-	Fields  []string             `json:"fields"`
+	Context             []*currentSnapV2JSON `json:"context"`
+	Actions             []*snapActionJSON    `json:"actions"`
+	Fields              []string             `json:"fields"`
+	AssertionMaxFormats map[string]int       `json:"assertion-max-formats,omitempty"`
 }
 
 type snapActionResultList struct {
 	Results   []*snapActionResult `json:"results"`
-	ErrorList []struct {
-		Code    string `json:"code"`
-		Message string `json:"message"`
-	} `json:"error-list"`
+	ErrorList []errorListEntry    `json:"error-list"`
 }
 
 var snapActionFields = jsonutil.StructFields((*storeSnap)(nil))
@@ -157,19 +186,32 @@
 // current installed snaps in currentSnaps. If the request was overall
 // successul (200) but there were reported errors it will return both
 // the snap infos and an SnapActionError.
-func (s *Store) SnapAction(ctx context.Context, currentSnaps []*CurrentSnap, actions []*SnapAction, user *auth.UserState, opts *RefreshOptions) ([]SnapActionResult, error) {
+// Orthogonally and at the same time it can be used to fetch or update
+// assertions by passing an AssertionQuery whose ToResolve specifies
+// the assertions and revisions to consider. Assertion related errors
+// are reported via the AssertionQuery Add*Error methods.
+func (s *Store) SnapAction(ctx context.Context, currentSnaps []*CurrentSnap, actions []*SnapAction, assertQuery AssertionQuery, user *auth.UserState, opts *RefreshOptions) ([]SnapActionResult, []AssertionResult, error) {
 	if opts == nil {
 		opts = &RefreshOptions{}
 	}
 
-	if len(currentSnaps) == 0 && len(actions) == 0 {
+	var toResolve map[asserts.Grouping][]*asserts.AtRevision
+	if assertQuery != nil {
+		var err error
+		toResolve, err = assertQuery.ToResolve()
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	if len(currentSnaps) == 0 && len(actions) == 0 && len(toResolve) == 0 {
 		// nothing to do
-		return nil, &SnapActionError{NoResults: true}
+		return nil, nil, &SnapActionError{NoResults: true}
 	}
 
 	authRefreshes := 0
 	for {
-		sars, err := s.snapAction(ctx, currentSnaps, actions, user, opts)
+		sars, ars, err := s.snapAction(ctx, currentSnaps, actions, assertQuery, toResolve, user, opts)
 
 		if saErr, ok := err.(*SnapActionError); ok && authRefreshes < 2 && len(saErr.Other) > 0 {
 			// do we need to try to refresh auths?, 2 tries
@@ -197,7 +239,7 @@
 			}
 		}
 
-		return sars, err
+		return sars, ars, err
 	}
 }
 
@@ -229,12 +271,14 @@
 	RedirectChannel string
 }
 
-func (s *Store) snapAction(ctx context.Context, currentSnaps []*CurrentSnap, actions []*SnapAction, user *auth.UserState, opts *RefreshOptions) ([]SnapActionResult, error) {
-
-	// TODO: the store already requires instance-key but doesn't
-	// yet support repeating in context or sending actions for the
-	// same snap-id, for now we keep instance-key handling internal
+// AssertionResult encapsulates the non-error result for one assertion
+// grouping fetch action.
+type AssertionResult struct {
+	Grouping   asserts.Grouping
+	StreamURLs []string
+}
 
+func (s *Store) snapAction(ctx context.Context, currentSnaps []*CurrentSnap, actions []*SnapAction, assertQuery AssertionQuery, toResolve map[asserts.Grouping][]*asserts.AtRevision, user *auth.UserState, opts *RefreshOptions) ([]SnapActionResult, []AssertionResult, error) {
 	requestSalt := ""
 	if opts != nil {
 		requestSalt = opts.PrivacyKey
@@ -244,11 +288,11 @@
 	instanceNameToKey := make(map[string]string, len(currentSnaps))
 	for i, curSnap := range currentSnaps {
 		if curSnap.SnapID == "" || curSnap.InstanceName == "" || curSnap.Revision.Unset() {
-			return nil, fmt.Errorf("internal error: invalid current snap information")
+			return nil, nil, fmt.Errorf("internal error: invalid current snap information")
 		}
 		instanceKey, err := genInstanceKey(curSnap, requestSalt)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		curSnaps[instanceKey] = curSnap
 		instanceNameToKey[curSnap.InstanceName] = instanceKey
@@ -273,18 +317,20 @@
 		}
 	}
 
+	actionJSONs := make([]*snapActionJSON, len(actions)+len(toResolve))
+
+	// snaps
 	downloadNum := 0
 	installNum := 0
 	installs := make(map[string]*SnapAction, len(actions))
 	downloads := make(map[string]*SnapAction, len(actions))
 	refreshes := make(map[string]*SnapAction, len(actions))
-	actionJSONs := make([]*snapActionJSON, len(actions))
 	for i, a := range actions {
 		if !isValidAction(a.Action) {
-			return nil, fmt.Errorf("internal error: unsupported action %q", a.Action)
+			return nil, nil, fmt.Errorf("internal error: unsupported action %q", a.Action)
 		}
 		if a.InstanceName == "" {
-			return nil, fmt.Errorf("internal error: action without instance name")
+			return nil, nil, fmt.Errorf("internal error: action without instance name")
 		}
 		var ignoreValidation *bool
 		if a.Flags&SnapActionIgnoreValidation != 0 {
@@ -317,7 +363,7 @@
 			instanceKey = fmt.Sprintf("download-%d", downloadNum)
 			downloads[instanceKey] = a
 			if _, key := snap.SplitInstanceName(a.InstanceName); key != "" {
-				return nil, fmt.Errorf("internal error: unsupported download with instance name %q", a.InstanceName)
+				return nil, nil, fmt.Errorf("internal error: unsupported download with instance name %q", a.InstanceName)
 			}
 		} else {
 			instanceKey = instanceNameToKey[a.InstanceName]
@@ -342,14 +388,39 @@
 		actionJSONs[i] = aJSON
 	}
 
+	// assertions
+	var assertMaxFormats map[string]int
+	if len(toResolve) > 0 {
+		i := len(actionJSONs) - len(toResolve)
+		for grp, ats := range toResolve {
+			aJSON := &snapActionJSON{
+				Action: "fetch-assertions",
+				Key:    string(grp),
+			}
+			aJSON.Assertions = make([]assertAtJSON, len(ats))
+			for j, at := range ats {
+				aJSON.Assertions[j].Type = at.Type.Name
+				aJSON.Assertions[j].PrimaryKey = at.PrimaryKey
+				rev := at.Revision
+				if rev != asserts.RevisionNotKnown {
+					aJSON.Assertions[j].IfNewerThan = &rev
+				}
+			}
+			actionJSONs[i] = aJSON
+			i++
+		}
+		assertMaxFormats = asserts.MaxSupportedFormats(1)
+	}
+
 	// build input for the install/refresh endpoint
 	jsonData, err := json.Marshal(snapActionRequest{
-		Context: curSnapJSONs,
-		Actions: actionJSONs,
-		Fields:  snapActionFields,
+		Context:             curSnapJSONs,
+		Actions:             actionJSONs,
+		Fields:              snapActionFields,
+		AssertionMaxFormats: assertMaxFormats,
 	})
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	reqOptions := &requestOptions{
@@ -377,11 +448,11 @@
 	var results snapActionResultList
 	resp, err := s.retryRequestDecodeJSON(ctx, reqOptions, user, &results, nil)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	if resp.StatusCode != 200 {
-		return nil, respToError(resp, "query the store for updates")
+		return nil, nil, respToError(resp, "query the store for updates")
 	}
 
 	s.extractSuggestedCurrency(resp)
@@ -392,7 +463,21 @@
 	var otherErrors []error
 
 	var sars []SnapActionResult
+	var ars []AssertionResult
 	for _, res := range results.Results {
+		if res.Result == "fetch-assertions" {
+			if len(res.ErrorList) != 0 {
+				if err := reportFetchAssertionsError(res, assertQuery); err != nil {
+					return nil, nil, fmt.Errorf("internal error: %v", err)
+				}
+				continue
+			}
+			ars = append(ars, AssertionResult{
+				Grouping:   asserts.Grouping(res.Key),
+				StreamURLs: res.AssertionStreamURLs,
+			})
+			continue
+		}
 		if res.Result == "error" {
 			if a := installs[res.InstanceKey]; a != nil {
 				if res.Name != "" {
@@ -426,7 +511,7 @@
 		}
 		snapInfo, err := infoFromStoreSnap(&res.Snap)
 		if err != nil {
-			return nil, fmt.Errorf("unexpected invalid install/refresh API result: %v", err)
+			return nil, nil, fmt.Errorf("unexpected invalid install/refresh API result: %v", err)
 		}
 
 		snapInfo.Channel = res.EffectiveChannel
@@ -435,7 +520,7 @@
 		if res.Result == "refresh" {
 			cur := curSnaps[res.InstanceKey]
 			if cur == nil {
-				return nil, fmt.Errorf("unexpected invalid install/refresh API result: unexpected refresh")
+				return nil, nil, fmt.Errorf("unexpected invalid install/refresh API result: unexpected refresh")
 			}
 			rrev := snap.R(res.Snap.Revision)
 			if rrev == cur.Revision || findRev(rrev, cur.Block) {
@@ -450,7 +535,7 @@
 		}
 
 		if res.Result != "download" && instanceName == "" {
-			return nil, fmt.Errorf("unexpected invalid install/refresh API result: unexpected instance-key %q", res.InstanceKey)
+			return nil, nil, fmt.Errorf("unexpected invalid install/refresh API result: unexpected instance-key %q", res.InstanceKey)
 		}
 
 		_, instanceKey := snap.SplitInstanceName(instanceName)
@@ -474,7 +559,7 @@
 		if len(downloadErrors) == 0 {
 			downloadErrors = nil
 		}
-		return sars, &SnapActionError{
+		return sars, ars, &SnapActionError{
 			NoResults: len(results.Results) == 0,
 			Refresh:   refreshErrors,
 			Install:   installErrors,
@@ -483,7 +568,7 @@
 		}
 	}
 
-	return sars, nil
+	return sars, ars, nil
 }
 
 func findRev(needle snap.Revision, haystack []snap.Revision) bool {
@@ -494,3 +579,56 @@
 	}
 	return false
 }
+
+func reportFetchAssertionsError(res *snapActionResult, assertq AssertionQuery) error {
+	// prefer to report the most unexpected error:
+	// * errors not referring to an assertion (no valid type/primary-key)
+	// are more unexpected than
+	// * errors referring to a precise assertion that are not not-found
+	// themselves more unexpected than
+	// * not-found errors
+	errIdx := -1
+	errl := res.ErrorList
+	carryingRef := func(ent *errorListEntry) bool {
+		aType := asserts.Type(ent.Type)
+		return aType != nil && len(ent.PrimaryKey) == len(aType.PrimaryKey)
+	}
+	prio := func(ent *errorListEntry) int {
+		if !carryingRef(ent) {
+			return 2
+		}
+		if ent.Code != "not-found" {
+			return 1
+		}
+		return 0
+	}
+	for i, ent := range errl {
+		if errIdx == -1 {
+			errIdx = i
+			continue
+		}
+		prioOther := prio(&errl[errIdx])
+		prioThis := prio(&ent)
+		if prioThis > prioOther {
+			errIdx = i
+		}
+	}
+	rep := errl[errIdx]
+	if carryingRef(&rep) {
+		ref := &asserts.Ref{Type: asserts.Type(rep.Type), PrimaryKey: rep.PrimaryKey}
+		var err error
+		if rep.Code == "not-found" {
+			headers, _ := asserts.HeadersFromPrimaryKey(ref.Type, ref.PrimaryKey)
+			err = &asserts.NotFoundError{
+				Type:    ref.Type,
+				Headers: headers,
+			}
+
+		} else {
+			err = fmt.Errorf("%s", rep.Message)
+		}
+		return assertq.AddError(err, ref)
+	}
+
+	return assertq.AddGroupingError(fmt.Errorf("%s", rep.Message), asserts.Grouping(res.Key))
+}
diff -Nru snapd-2.45.1+20.04.2/store/store_action_test.go snapd-2.48.3+20.04/store/store_action_test.go
--- snapd-2.45.1+20.04.2/store/store_action_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/store_action_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -154,7 +154,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, aresults, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -169,8 +169,9 @@
 			InstanceName: "hello-world",
 			CohortKey:    helloCohortKey,
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
+	c.Assert(aresults, HasLen, 0)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
 	c.Assert(results[0].Revision, Equals, snap.R(26))
@@ -263,7 +264,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -278,7 +279,7 @@
 			SnapID:       helloWorldSnapID,
 			InstanceName: "hello-world",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -336,7 +337,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -344,12 +345,12 @@
 			Revision:        snap.R(1),
 			RefreshedDate:   helloRefreshedDate,
 		},
-	}, nil, nil, nil)
+	}, nil, nil, nil, nil)
 	c.Check(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{NoResults: true})
 
 	// local no-op
-	results, err = sto.SnapAction(s.ctx, nil, nil, nil, nil)
+	results, _, err = sto.SnapAction(s.ctx, nil, nil, nil, nil, nil)
 	c.Check(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{NoResults: true})
 
@@ -400,14 +401,14 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
 			TrackingChannel: "beta",
 			Revision:        snap.R(1),
 		},
-	}, nil, nil, nil)
+	}, nil, nil, nil, nil)
 	c.Check(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{NoResults: true})
 }
@@ -476,7 +477,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -492,7 +493,7 @@
 			InstanceName: "hello-world",
 			Channel:      "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{
 		Refresh: map[string]error{
@@ -565,7 +566,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -580,7 +581,7 @@
 			InstanceName: "hello-world",
 			Channel:      "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{
 		Refresh: map[string]error{
@@ -641,7 +642,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -655,7 +656,7 @@
 			InstanceName: "hello-world",
 			Channel:      "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(n, Equals, 4)
 	c.Assert(results, HasLen, 1)
@@ -728,7 +729,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:     "hello-world",
 			SnapID:           helloWorldSnapID,
@@ -745,7 +746,7 @@
 			Channel:      "stable",
 			Flags:        store.SnapActionEnforceValidation,
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -795,7 +796,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -809,7 +810,7 @@
 			SnapID:       helloWorldSnapID,
 			InstanceName: "hello-world",
 		},
-	}, nil, &store.RefreshOptions{IsAutoRefresh: true})
+	}, nil, nil, &store.RefreshOptions{IsAutoRefresh: true})
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 }
@@ -877,7 +878,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:  "hello-world",
 			SnapID:        helloWorldSnapID,
@@ -890,7 +891,7 @@
 			SnapID:       helloWorldSnapID,
 			InstanceName: "hello-world",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -973,7 +974,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -987,7 +988,7 @@
 			SnapID:       helloWorldSnapID,
 			InstanceName: "hello-world",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -1066,7 +1067,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -1080,7 +1081,7 @@
 			SnapID:       helloWorldSnapID,
 			InstanceName: "hello-world",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -1153,7 +1154,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -1168,7 +1169,7 @@
 			InstanceName: "hello-world",
 			Channel:      "stable",
 		},
-	}, nil, &store.RefreshOptions{RefreshManaged: true})
+	}, nil, nil, &store.RefreshOptions{RefreshManaged: true})
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -1270,7 +1271,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, nil,
+	results, _, err := sto.SnapAction(s.ctx, nil,
 		[]*store.SnapAction{
 			{
 				Action:       action,
@@ -1278,7 +1279,7 @@
 				Channel:      "beta",
 				CohortKey:    cohort,
 			},
-		}, nil, nil)
+		}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -1364,7 +1365,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, nil,
+	results, _, err := sto.SnapAction(s.ctx, nil,
 		[]*store.SnapAction{
 			{
 				Action:       "install",
@@ -1372,7 +1373,7 @@
 				Channel:      "beta",
 				Epoch:        snap.E("1*"),
 			},
-		}, nil, nil)
+		}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -1418,7 +1419,7 @@
 	c.Assert(err, IsNil)
 	ctx := store.WithClientUserAgent(s.ctx, r)
 
-	results, err := sto.SnapAction(ctx, nil, []*store.SnapAction{{Action: "install", InstanceName: "some-snap"}}, nil, nil)
+	results, _, err := sto.SnapAction(ctx, nil, []*store.SnapAction{{Action: "install", InstanceName: "some-snap"}}, nil, nil, nil)
 	c.Check(serverCalls, Equals, 1)
 	c.Check(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{NoResults: true})
@@ -1443,14 +1444,14 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	_, err := sto.SnapAction(s.ctx, nil,
+	_, _, err := sto.SnapAction(s.ctx, nil,
 		[]*store.SnapAction{
 			{
 				Action:       "download",
 				InstanceName: "hello-world_foo",
 				Channel:      "beta",
 			},
-		}, nil, nil)
+		}, nil, nil, nil)
 	c.Assert(err, ErrorMatches, `internal error: unsupported download with instance name "hello-world_foo"`)
 }
 
@@ -1533,14 +1534,14 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, nil,
+	results, _, err := sto.SnapAction(s.ctx, nil,
 		[]*store.SnapAction{
 			{
 				Action:       action,
 				InstanceName: "hello-world",
 				Revision:     snap.R(28),
 			},
-		}, nil, nil)
+		}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -1668,7 +1669,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -1702,7 +1703,7 @@
 			InstanceName: "bar",
 			Revision:     snap.R(42),
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{
 		Refresh: map[string]error{
@@ -1820,7 +1821,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -1843,7 +1844,7 @@
 			InstanceName: "bar",
 			Revision:     snap.R(42),
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{
 		Refresh: map[string]error{
@@ -1908,13 +1909,13 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, nil, []*store.SnapAction{
+	results, _, err := sto.SnapAction(s.ctx, nil, []*store.SnapAction{
 		{
 			Action:       "install",
 			InstanceName: "foo",
 			Channel:      "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{
 		Other: []error{
@@ -1942,13 +1943,13 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, nil,
+	results, _, err := sto.SnapAction(s.ctx, nil,
 		[]*store.SnapAction{
 			{
 				Action:       "something unexpected",
 				InstanceName: "hello-world",
 			},
-		}, nil, nil)
+		}, nil, nil, nil)
 	c.Assert(err, ErrorMatches, `.* unsupported action .*`)
 	c.Assert(results, IsNil)
 }
@@ -2249,7 +2250,7 @@
 		StoreBaseURL: mockServerURL,
 	}, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2263,7 +2264,7 @@
 			SnapID:       helloWorldSnapID,
 			InstanceName: "hello-world",
 		},
-	}, s.user, nil)
+	}, nil, s.user, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world")
@@ -2344,7 +2345,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2365,7 +2366,7 @@
 			Channel:      "stable",
 			InstanceName: "hello-world_foo",
 		},
-	}, nil, &store.RefreshOptions{PrivacyKey: "123"})
+	}, nil, nil, &store.RefreshOptions{PrivacyKey: "123"})
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].SnapName(), Equals, "hello-world")
@@ -2473,7 +2474,7 @@
 			InstanceName: "hello-world_foo",
 		},
 	}
-	results, err := sto.SnapAction(s.ctx, currentSnaps, action, nil, opts)
+	results, _, err := sto.SnapAction(s.ctx, currentSnaps, action, nil, nil, opts)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].SnapName(), Equals, "hello-world")
@@ -2481,7 +2482,7 @@
 	c.Assert(results[0].Revision, Equals, snap.R(26))
 
 	// another request with the same seed, gives same result
-	resultsAgain, err := sto.SnapAction(s.ctx, currentSnaps, action, nil, opts)
+	resultsAgain, _, err := sto.SnapAction(s.ctx, currentSnaps, action, nil, nil, opts)
 	c.Assert(err, IsNil)
 	c.Assert(resultsAgain, DeepEquals, results)
 }
@@ -2581,7 +2582,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2610,7 +2611,7 @@
 			InstanceName: "other_foo",
 			Channel:      "stable",
 		},
-	}, nil, &store.RefreshOptions{PrivacyKey: "123"})
+	}, nil, nil, &store.RefreshOptions{PrivacyKey: "123"})
 	c.Assert(results, HasLen, 0)
 	c.Check(err, DeepEquals, &store.SnapActionError{
 		Refresh: map[string]error{
@@ -2697,7 +2698,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2711,7 +2712,7 @@
 			InstanceName: "hello-world_foo",
 			Channel:      "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, IsNil)
 	c.Assert(results, HasLen, 1)
 	c.Assert(results[0].InstanceName(), Equals, "hello-world_foo")
@@ -2728,7 +2729,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&store.Config{}, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2741,7 +2742,7 @@
 			Action:  "install",
 			Channel: "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, ErrorMatches, "internal error: action without instance name")
 	c.Assert(results, IsNil)
 }
@@ -2811,7 +2812,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2825,7 +2826,7 @@
 			InstanceName: "hello-world_foo",
 			Channel:      "stable",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, ErrorMatches, `unexpected invalid install/refresh API result: unexpected instance-key "foo-2"`)
 	c.Assert(results, IsNil)
 }
@@ -2894,7 +2895,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -2909,7 +2910,7 @@
 			Channel:      "stable",
 			InstanceName: "hello-world",
 		},
-	}, nil, nil)
+	}, nil, nil, nil)
 	c.Assert(err, ErrorMatches, `unexpected invalid install/refresh API result: unexpected refresh`)
 	c.Assert(results, IsNil)
 }
@@ -2996,7 +2997,7 @@
 	dauthCtx := &testDauthContext{c: c, device: s.device}
 	sto := store.New(&cfg, dauthCtx)
 
-	results, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
+	results, _, err := sto.SnapAction(s.ctx, []*store.CurrentSnap{
 		{
 			InstanceName:    "hello-world",
 			SnapID:          helloWorldSnapID,
@@ -3015,7 +3016,7 @@
 			Action:       "install",
 			InstanceName: "foo-2",
 		},
-	}, nil, &store.RefreshOptions{PrivacyKey: "123"})
+	}, nil, nil, &store.RefreshOptions{PrivacyKey: "123"})
 	c.Assert(err, DeepEquals, &store.SnapActionError{
 		Other: []error{fmt.Errorf(`snap "hello-world_foo": The Snap is present more than once in the request.`)},
 	})
@@ -3023,3 +3024,59 @@
 	c.Assert(results[0].InstanceName(), Equals, "foo-2")
 	c.Assert(results[0].SnapID, Equals, "foo-2-id")
 }
+
+func (s *storeActionSuite) TestSnapAction500(c *C) {
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "POST", snapActionPath)
+		// check device authorization is set, implicitly checking doRequest was used
+		w.WriteHeader(500)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	results, _, err := sto.SnapAction(s.ctx, nil, []*store.SnapAction{
+		{
+			Action:       "install",
+			InstanceName: "foo",
+		},
+	}, nil, nil, nil)
+	c.Assert(err, ErrorMatches, `cannot query the store for updates: got unexpected HTTP status code 500 via POST to "http://127\.0\.0\.1:.*/v2/snaps/refresh"`)
+	c.Check(err, FitsTypeOf, &store.UnexpectedHTTPStatusError{})
+	c.Check(results, HasLen, 0)
+}
+
+func (s *storeActionSuite) TestSnapAction400(c *C) {
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "POST", snapActionPath)
+		// check device authorization is set, implicitly checking doRequest was used
+		w.WriteHeader(400)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	results, _, err := sto.SnapAction(s.ctx, nil, []*store.SnapAction{
+		{
+			Action:       "install",
+			InstanceName: "foo",
+		},
+	}, nil, nil, nil)
+	c.Assert(err, ErrorMatches, `cannot query the store for updates: got unexpected HTTP status code 400 via POST to "http://127\.0\.0\.1:.*/v2/snaps/refresh"`)
+	c.Check(err, FitsTypeOf, &store.UnexpectedHTTPStatusError{})
+	c.Check(results, HasLen, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/store/store_asserts.go snapd-2.48.3+20.04/store/store_asserts.go
--- snapd-2.45.1+20.04.2/store/store_asserts.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/store_asserts.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
 	"path"
@@ -44,34 +45,81 @@
 }
 
 type assertionSvcError struct {
+	// v1 error fields
+	// XXX: remove once switched to v2 API request.
 	Status int    `json:"status"`
 	Type   string `json:"type"`
 	Title  string `json:"title"`
 	Detail string `json:"detail"`
+
+	// v2 error list - the only field included in v2 error response.
+	// XXX: there is an overlap with searchV2Results (and partially with
+	// errorListEntry), we could share the definition.
+	ErrorList []struct {
+		Code    string `json:"code"`
+		Message string `json:"message"`
+	} `json:"error-list"`
+}
+
+func (e *assertionSvcError) isNotFound() bool {
+	return (len(e.ErrorList) > 0 && e.ErrorList[0].Code == "not-found" /* v2 error */) || e.Status == 404
 }
 
-// Assertion retrivies the assertion for the given type and primary key.
+func (e *assertionSvcError) toError() error {
+	// is it v2 error?
+	if len(e.ErrorList) > 0 {
+		return fmt.Errorf("assertion service error: %q", e.ErrorList[0].Message)
+	}
+	// v1 error
+	return fmt.Errorf("assertion service error: [%s] %q", e.Title, e.Detail)
+}
+
+// Assertion retrieves the assertion for the given type and primary key.
 func (s *Store) Assertion(assertType *asserts.AssertionType, primaryKey []string, user *auth.UserState) (asserts.Assertion, error) {
 	v := url.Values{}
 	v.Set("max-format", strconv.Itoa(assertType.MaxSupportedFormat()))
 	u := s.assertionsEndpointURL(path.Join(assertType.Name, path.Join(primaryKey...)), v)
 
+	var asrt asserts.Assertion
+
+	err := s.downloadAssertions(u, func(r io.Reader) error {
+		// decode assertion
+		dec := asserts.NewDecoder(r)
+		var e error
+		asrt, e = dec.Decode()
+		return e
+	}, func(svcErr *assertionSvcError) error {
+		// error-list indicates v2 error response.
+		if svcErr.isNotFound() {
+			// best-effort
+			headers, _ := asserts.HeadersFromPrimaryKey(assertType, primaryKey)
+			return &asserts.NotFoundError{
+				Type:    assertType,
+				Headers: headers,
+			}
+		}
+		// default error
+		return nil
+	}, "fetch assertion", user)
+	if err != nil {
+		return nil, err
+	}
+	return asrt, nil
+}
+
+func (s *Store) downloadAssertions(u *url.URL, decodeBody func(io.Reader) error, handleSvcErr func(*assertionSvcError) error, what string, user *auth.UserState) error {
 	reqOptions := &requestOptions{
 		Method: "GET",
 		URL:    u,
 		Accept: asserts.MediaType,
 	}
 
-	var asrt asserts.Assertion
-
 	resp, err := httputil.RetryRequest(reqOptions.URL.String(), func() (*http.Response, error) {
 		return s.doRequest(context.TODO(), s.client, reqOptions, user)
 	}, func(resp *http.Response) error {
 		var e error
 		if resp.StatusCode == 200 {
-			// decode assertion
-			dec := asserts.NewDecoder(resp.Body)
-			asrt, e = dec.Decode()
+			e = decodeBody(resp.Body)
 		} else {
 			contentType := resp.Header.Get("Content-Type")
 			if contentType == jsonContentType || contentType == "application/problem+json" {
@@ -80,27 +128,47 @@
 				if e = dec.Decode(&svcErr); e != nil {
 					return fmt.Errorf("cannot decode assertion service error with HTTP status code %d: %v", resp.StatusCode, e)
 				}
-				if svcErr.Status == 404 {
-					// best-effort
-					headers, _ := asserts.HeadersFromPrimaryKey(assertType, primaryKey)
-					return &asserts.NotFoundError{
-						Type:    assertType,
-						Headers: headers,
+				if handleSvcErr != nil {
+					if e := handleSvcErr(&svcErr); e != nil {
+						return e
 					}
 				}
-				return fmt.Errorf("assertion service error: [%s] %q", svcErr.Title, svcErr.Detail)
+				// default error handling
+				return svcErr.toError()
 			}
 		}
 		return e
 	}, defaultRetryStrategy)
 
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	if resp.StatusCode != 200 {
-		return nil, respToError(resp, "fetch assertion")
+		return respToError(resp, what)
 	}
 
-	return asrt, err
+	return nil
+}
+
+// DownloadAssertions download the assertion streams at the given URLs
+// and adds their assertions to the given asserts.Batch.
+func (s *Store) DownloadAssertions(streamURLs []string, b *asserts.Batch, user *auth.UserState) error {
+	for _, ustr := range streamURLs {
+		u, err := url.Parse(ustr)
+		if err != nil {
+			return fmt.Errorf("invalid assertions stream URL: %v", err)
+		}
+
+		err = s.downloadAssertions(u, func(r io.Reader) error {
+			// decode stream
+			_, e := b.AddStream(r)
+			return e
+		}, nil, "download assertion stream", user)
+		if err != nil {
+			return err
+		}
+
+	}
+	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/store/store_asserts_test.go snapd-2.48.3+20.04/store/store_asserts_test.go
--- snapd-2.45.1+20.04.2/store/store_asserts_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/store_asserts_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,23 +20,58 @@
 package store_test
 
 import (
+	"bytes"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"time"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/assertstest"
 	"github.com/snapcore/snapd/store"
 )
 
 type storeAssertsSuite struct {
 	baseStoreSuite
+
+	storeSigning *assertstest.StoreStack
+	dev1Acct     *asserts.Account
+	decl1        *asserts.SnapDeclaration
+
+	db *asserts.Database
 }
 
 var _ = Suite(&storeAssertsSuite{})
 
+func (s *storeAssertsSuite) SetUpTest(c *C) {
+	s.baseStoreSuite.SetUpTest(c)
+
+	s.storeSigning = assertstest.NewStoreStack("can0nical", nil)
+	s.dev1Acct = assertstest.NewAccount(s.storeSigning, "developer1", map[string]interface{}{
+		"account-id": "developer1",
+	}, "")
+
+	a, err := s.storeSigning.Sign(asserts.SnapDeclarationType, map[string]interface{}{
+		"series":       "16",
+		"snap-id":      "asnapid",
+		"snap-name":    "asnap",
+		"publisher-id": "developer1",
+		"timestamp":    time.Now().UTC().Format(time.RFC3339),
+	}, nil, "")
+	c.Assert(err, IsNil)
+	s.decl1 = a.(*asserts.SnapDeclaration)
+
+	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
+		Backstore: asserts.NewMemoryBackstore(),
+		Trusted:   s.storeSigning.Trusted,
+	})
+	c.Assert(err, IsNil)
+	s.db = db
+}
+
 var testAssertion = `type: snap-declaration
 authority-id: super
 series: 16
@@ -150,6 +185,37 @@
 	})
 }
 
+func (s *storeAssertsSuite) TestAssertionNotFoundV2(c *C) {
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// XXX: update to v2 request
+		assertRequest(c, r, "GET", "/api/v1/snaps/assertions/.*")
+		c.Check(r.Header.Get("Accept"), Equals, "application/x.ubuntu.assertion")
+		c.Check(r.URL.Path, Matches, ".*/snap-declaration/16/snapidfoo")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(404)
+		io.WriteString(w, `{"error-list":[{"code":"not-found","message":"not found: no ..."}]}`)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		AssertionsBaseURL: mockServerURL,
+	}
+	sto := store.New(&cfg, nil)
+
+	_, err := sto.Assertion(asserts.SnapDeclarationType, []string{"16", "snapidfoo"}, nil)
+	c.Check(asserts.IsNotFound(err), Equals, true)
+	c.Check(err, DeepEquals, &asserts.NotFoundError{
+		Type: asserts.SnapDeclarationType,
+		Headers: map[string]string{
+			"series":  "16",
+			"snap-id": "snapidfoo",
+		},
+	})
+}
+
 func (s *storeAssertsSuite) TestAssertion500(c *C) {
 	var n = 0
 	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -171,3 +237,192 @@
 	c.Assert(err, ErrorMatches, `cannot fetch assertion: got unexpected HTTP status code 500 via .+`)
 	c.Assert(n, Equals, 5)
 }
+
+func (s *storeAssertsSuite) TestDownloadAssertionsSimple(c *C) {
+	assertstest.AddMany(s.db, s.storeSigning.StoreAccountKey(""), s.dev1Acct)
+
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "GET", "/assertions/.*")
+		// check device authorization is set, implicitly checking doRequest was used
+		c.Check(r.Header.Get("X-Device-Authorization"), Equals, `Macaroon root="device-macaroon"`)
+
+		c.Check(r.Header.Get("Accept"), Equals, "application/x.ubuntu.assertion")
+		c.Check(r.URL.Path, Matches, ".*/snap-declaration/16/asnapid")
+		c.Check(r.URL.Query().Get("max-format"), Equals, "88")
+		w.Write(asserts.Encode(s.decl1))
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	streamURL, err := mockServerURL.Parse("/assertions/snap-declaration/16/asnapid")
+	c.Assert(err, IsNil)
+	urls := []string{streamURL.String() + "?max-format=88"}
+
+	b := asserts.NewBatch(nil)
+	err = sto.DownloadAssertions(urls, b, nil)
+	c.Assert(err, IsNil)
+
+	c.Assert(b.CommitTo(s.db, nil), IsNil)
+
+	// added
+	_, err = s.decl1.Ref().Resolve(s.db.Find)
+	c.Check(err, IsNil)
+}
+
+func (s *storeAssertsSuite) TestDownloadAssertionsWithStreams(c *C) {
+	stream1 := append(asserts.Encode(s.decl1), "\n"...)
+	stream1 = append(stream1, asserts.Encode(s.dev1Acct)...)
+	stream2 := asserts.Encode(s.storeSigning.StoreAccountKey(""))
+
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "GET", "/assertions/.*")
+
+		c.Check(r.Header.Get("Accept"), Equals, "application/x.ubuntu.assertion")
+		var stream []byte
+		switch r.URL.Path {
+		case "/assertions/stream1":
+			stream = stream1
+		case "/assertions/stream2":
+			stream = stream2
+		default:
+			c.Fatal("unexpected stream url")
+		}
+
+		w.Write(stream)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	stream1URL, err := mockServerURL.Parse("/assertions/stream1")
+	c.Assert(err, IsNil)
+	stream2URL, err := mockServerURL.Parse("/assertions/stream2")
+	c.Assert(err, IsNil)
+
+	urls := []string{stream1URL.String(), stream2URL.String()}
+
+	b := asserts.NewBatch(nil)
+	err = sto.DownloadAssertions(urls, b, nil)
+	c.Assert(err, IsNil)
+
+	c.Assert(b.CommitTo(s.db, nil), IsNil)
+
+	// added
+	_, err = s.decl1.Ref().Resolve(s.db.Find)
+	c.Check(err, IsNil)
+}
+
+func (s *storeAssertsSuite) TestDownloadAssertionsBrokenStream(c *C) {
+	stream1 := append(asserts.Encode(s.decl1), "\n"...)
+	stream1 = append(stream1, asserts.Encode(s.dev1Acct)...)
+
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "GET", "/assertions/stream1")
+
+		c.Check(r.Header.Get("Accept"), Equals, "application/x.ubuntu.assertion")
+
+		breakAt := bytes.Index(stream1, []byte("account-id"))
+		w.Write(stream1[:breakAt])
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	stream1URL, err := mockServerURL.Parse("/assertions/stream1")
+	c.Assert(err, IsNil)
+
+	urls := []string{stream1URL.String()}
+
+	b := asserts.NewBatch(nil)
+	err = sto.DownloadAssertions(urls, b, nil)
+	c.Assert(err, Equals, io.ErrUnexpectedEOF)
+}
+
+func (s *storeAssertsSuite) TestDownloadAssertions500(c *C) {
+	n := 0
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "GET", "/assertions/stream1")
+
+		c.Check(r.Header.Get("Accept"), Equals, "application/x.ubuntu.assertion")
+
+		n++
+		w.WriteHeader(500)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	stream1URL, err := mockServerURL.Parse("/assertions/stream1")
+	c.Assert(err, IsNil)
+
+	urls := []string{stream1URL.String()}
+
+	b := asserts.NewBatch(nil)
+	err = sto.DownloadAssertions(urls, b, nil)
+	c.Assert(err, ErrorMatches, `cannot download assertion stream: got unexpected HTTP status code 500 via .+`)
+	c.Check(n, Equals, 5)
+}
+
+func (s *storeAssertsSuite) TestDownloadAssertionsStreamNotFound(c *C) {
+	mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assertRequest(c, r, "GET", "/assertions/stream1")
+
+		c.Check(r.Header.Get("Accept"), Equals, "application/x.ubuntu.assertion")
+		w.Header().Set("Content-Type", "application/problem+json")
+		w.WriteHeader(404)
+		io.WriteString(w, `{"status": 404,"title": "not found"}`)
+	}))
+
+	c.Assert(mockServer, NotNil)
+	defer mockServer.Close()
+
+	mockServerURL, _ := url.Parse(mockServer.URL)
+	cfg := store.Config{
+		StoreBaseURL: mockServerURL,
+	}
+
+	dauthCtx := &testDauthContext{c: c, device: s.device}
+	sto := store.New(&cfg, dauthCtx)
+
+	stream1URL, err := mockServerURL.Parse("/assertions/stream1")
+	c.Assert(err, IsNil)
+
+	urls := []string{stream1URL.String()}
+
+	b := asserts.NewBatch(nil)
+	err = sto.DownloadAssertions(urls, b, nil)
+	c.Assert(err, ErrorMatches, `assertion service error: \[not found\].*`)
+}
diff -Nru snapd-2.45.1+20.04.2/store/store_download.go snapd-2.48.3+20.04/store/store_download.go
--- snapd-2.45.1+20.04.2/store/store_download.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/store_download.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,7 +37,6 @@
 	"github.com/juju/ratelimit"
 	"gopkg.in/retry.v1"
 
-	"github.com/snapcore/snapd/cmd/cmdutil"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/httputil"
 	"github.com/snapcore/snapd/i18n"
@@ -46,6 +45,7 @@
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snapdtool"
 )
 
 var downloadRetryStrategy = retry.LimitCount(7, retry.LimitTime(90*time.Second,
@@ -479,7 +479,7 @@
 	if osutil.ExecutableExists("xdelta3") {
 		return exec.Command("xdelta3", args...), nil
 	}
-	return cmdutil.CommandFromSystemSnap("/usr/bin/xdelta3", args...)
+	return snapdtool.CommandFromSystemSnap("/usr/bin/xdelta3", args...)
 }
 
 // applyDelta generates a target snap from a previously downloaded snap and a downloaded delta.
diff -Nru snapd-2.45.1+20.04.2/store/store.go snapd-2.48.3+20.04/store/store.go
--- snapd-2.45.1+20.04.2/store/store.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/store.go	2021-02-02 08:21:12.000000000 +0000
@@ -69,7 +69,7 @@
 // Timeout value
 var defaultRetryStrategy = retry.LimitCount(6, retry.LimitTime(38*time.Second,
 	retry.Exponential{
-		Initial: 350 * time.Millisecond,
+		Initial: 500 * time.Millisecond,
 		Factor:  2.5,
 	},
 ))
@@ -160,18 +160,39 @@
 
 var ErrTooManyRequests = errors.New("too many requests")
 
-func respToError(resp *http.Response, msg string) error {
-	if resp.StatusCode == 429 {
-		return ErrTooManyRequests
-	}
+// UnexpectedHTTPStatusError represents an error where the store
+// returned an unexpected HTTP status code, i.e. a status code that
+// doesn't represent success nor an expected error condition with
+// known handling (e.g. a 404 when instead presence is always
+// expected).
+type UnexpectedHTTPStatusError struct {
+	OpSummary  string
+	StatusCode int
+	Method     string
+	URL        *url.URL
+	OopsID     string
+}
 
+func (e *UnexpectedHTTPStatusError) Error() string {
 	tpl := "cannot %s: got unexpected HTTP status code %d via %s to %q"
-	if oops := resp.Header.Get("X-Oops-Id"); oops != "" {
+	if e.OopsID != "" {
 		tpl += " [%s]"
-		return fmt.Errorf(tpl, msg, resp.StatusCode, resp.Request.Method, resp.Request.URL, oops)
+		return fmt.Sprintf(tpl, e.OpSummary, e.StatusCode, e.Method, e.URL, e.OopsID)
 	}
+	return fmt.Sprintf(tpl, e.OpSummary, e.StatusCode, e.Method, e.URL)
+}
 
-	return fmt.Errorf(tpl, msg, resp.StatusCode, resp.Request.Method, resp.Request.URL)
+func respToError(resp *http.Response, opSummary string) error {
+	if resp.StatusCode == 429 {
+		return ErrTooManyRequests
+	}
+	return &UnexpectedHTTPStatusError{
+		OpSummary:  opSummary,
+		StatusCode: resp.StatusCode,
+		Method:     resp.Request.Method,
+		URL:        resp.Request.URL,
+		OopsID:     resp.Header.Get("X-Oops-Id"),
+	}
 }
 
 // endpointURL clones a base URL and updates it with optional path and query.
diff -Nru snapd-2.45.1+20.04.2/store/storetest/storetest.go snapd-2.48.3+20.04/store/storetest/storetest.go
--- snapd-2.45.1+20.04.2/store/storetest/storetest.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/store/storetest/storetest.go	2021-02-02 08:21:12.000000000 +0000
@@ -53,7 +53,7 @@
 	panic("Store.Find not expected")
 }
 
-func (Store) SnapAction(context.Context, []*store.CurrentSnap, []*store.SnapAction, *auth.UserState, *store.RefreshOptions) ([]store.SnapActionResult, error) {
+func (Store) SnapAction(context.Context, []*store.CurrentSnap, []*store.SnapAction, store.AssertionQuery, *auth.UserState, *store.RefreshOptions) ([]store.SnapActionResult, []store.AssertionResult, error) {
 	panic("Store.SnapAction not expected")
 }
 
@@ -85,6 +85,10 @@
 	panic("Store.Assertion not expected")
 }
 
+func (Store) DownloadAssertions([]string, *asserts.Batch, *auth.UserState) error {
+	panic("Store.DownloadAssertions not expected")
+}
+
 func (Store) WriteCatalogs(context.Context, io.Writer, store.SnapAdder) error {
 	panic("fakeStore.WriteCatalogs not expected")
 }
diff -Nru snapd-2.45.1+20.04.2/strutil/pathiter.go snapd-2.48.3+20.04/strutil/pathiter.go
--- snapd-2.45.1+20.04.2/strutil/pathiter.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/strutil/pathiter.go	2021-02-02 08:21:12.000000000 +0000
@@ -135,7 +135,7 @@
 	return true
 }
 
-// Rewind returns the iterator the the initial state, allowing the path to be traversed again.
+// Rewind returns the iterator to the initial state, allowing the path to be traversed again.
 func (iter *PathIterator) Rewind() {
 	iter.left = 0
 	iter.right = 0
diff -Nru snapd-2.45.1+20.04.2/strutil/strutil.go snapd-2.48.3+20.04/strutil/strutil.go
--- snapd-2.45.1+20.04.2/strutil/strutil.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/strutil/strutil.go	2021-02-02 08:21:12.000000000 +0000
@@ -71,6 +71,49 @@
 	return list[i] == str
 }
 
+// SortedListsUniqueMerge merges the two given sorted lists of strings,
+// repeated values will appear once in the result.
+func SortedListsUniqueMerge(sl1, sl2 []string) []string {
+	n1 := len(sl1)
+	n2 := len(sl2)
+	sz := n1
+	if n2 > sz {
+		sz = n2
+	}
+	if sz == 0 {
+		return nil
+	}
+	m := make([]string, 0, sz)
+	appendUnique := func(s string) {
+		if l := len(m); l > 0 && m[l-1] == s {
+			return
+		}
+		m = append(m, s)
+	}
+	i, j := 0, 0
+	for i < n1 && j < n2 {
+		var s string
+		if sl1[i] < sl2[j] {
+			s = sl1[i]
+			i++
+		} else {
+			s = sl2[j]
+			j++
+		}
+		appendUnique(s)
+	}
+	if i < n1 {
+		for ; i < n1; i++ {
+			appendUnique(sl1[i])
+		}
+	} else if j < n2 {
+		for ; j < n2; j++ {
+			appendUnique(sl2[j])
+		}
+	}
+	return m
+}
+
 // TruncateOutput truncates input data by maxLines, imposing maxBytes limit (total) for them.
 // The maxLines may be 0 to avoid the constraint on number of lines.
 func TruncateOutput(data []byte, maxLines, maxBytes int) []byte {
diff -Nru snapd-2.45.1+20.04.2/strutil/strutil_test.go snapd-2.48.3+20.04/strutil/strutil_test.go
--- snapd-2.45.1+20.04.2/strutil/strutil_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/strutil/strutil_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2014-2015 Canonical Ltd
+ * Copyright (C) 2014-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -225,3 +225,27 @@
 		c.Check(strutil.ElliptLeft(t.in, t.n), check.Equals, t.left, check.Commentf("%q[-%d:] -> %q", t.in, t.n, t.left))
 	}
 }
+
+func (strutilSuite) TestSortedListsUniqueMerge(c *check.C) {
+	l1 := []string{"a", "a", "c", "d", "e", "f", "h", "h"}
+	l2 := []string{"b", "c", "d", "d", "g"}
+	l3 := []string{"a", "b", "c", "d", "e", "f", "g", "h"}
+
+	tests := []struct {
+		sl1 []string
+		sl2 []string
+		res []string
+	}{
+		{nil, nil, nil},
+		{nil, []string{"a", "a", "b"}, []string{"a", "b"}},
+		{[]string{"a", "a", "b"}, nil, []string{"a", "b"}},
+		{l1, l2, l3},
+		{l2, l1, l3},
+		{l3, l3, l3},
+	}
+
+	for _, t := range tests {
+		res := strutil.SortedListsUniqueMerge(t.sl1, t.sl2)
+		c.Check(res, check.DeepEquals, t.res)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/sysconfig/cloudinit.go snapd-2.48.3+20.04/sysconfig/cloudinit.go
--- snapd-2.45.1+20.04.2/sysconfig/cloudinit.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sysconfig/cloudinit.go	2021-02-02 08:21:12.000000000 +0000
@@ -20,16 +20,37 @@
 package sysconfig
 
 import (
+	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"regexp"
 
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/strutil"
 )
 
-func DisableCloudInit(targetdir string) error {
-	ubuntuDataCloud := filepath.Join(targetdir, "etc/cloud/")
+// HasGadgetCloudConf takes a gadget directory and returns whether there is
+// cloud-init config in the form of a cloud.conf file in the gadget.
+func HasGadgetCloudConf(gadgetDir string) bool {
+	return osutil.FileExists(filepath.Join(gadgetDir, "cloud.conf"))
+}
+
+func ubuntuDataCloudDir(rootdir string) string {
+	return filepath.Join(rootdir, "etc/cloud/")
+}
+
+// DisableCloudInit will disable cloud-init permanently by writing a
+// cloud-init.disabled config file in etc/cloud under the target dir, which
+// instructs cloud-init-generator to not trigger new cloud-init invocations.
+// Note that even with this disabled file, a root user could still manually run
+// cloud-init, but this capability is not provided to any strictly confined
+// snap.
+func DisableCloudInit(rootDir string) error {
+	ubuntuDataCloud := ubuntuDataCloudDir(rootDir)
 	if err := os.MkdirAll(ubuntuDataCloud, 0755); err != nil {
 		return fmt.Errorf("cannot make cloud config dir: %v", err)
 	}
@@ -40,7 +61,11 @@
 	return nil
 }
 
-func installCloudInitCfg(src, targetdir string) error {
+// installCloudInitCfgDir installs glob cfg files from the source directory to
+// the cloud config dir. For installing single files from anywhere with any
+// name, use installUnifiedCloudInitCfg
+func installCloudInitCfgDir(src, targetdir string) error {
+	// TODO:UC20: enforce patterns on the glob files and their suffix ranges
 	ccl, err := filepath.Glob(filepath.Join(src, "*.cfg"))
 	if err != nil {
 		return err
@@ -49,7 +74,7 @@
 		return nil
 	}
 
-	ubuntuDataCloudCfgDir := filepath.Join(targetdir, "etc/cloud/cloud.cfg.d/")
+	ubuntuDataCloudCfgDir := filepath.Join(ubuntuDataCloudDir(targetdir), "cloud.cfg.d/")
 	if err := os.MkdirAll(ubuntuDataCloudCfgDir, 0755); err != nil {
 		return fmt.Errorf("cannot make cloud config dir: %v", err)
 	}
@@ -62,19 +87,302 @@
 	return nil
 }
 
-// TODO:UC20: - allow cloud.conf coming from the gadget
-//            - think about if/what cloud-init means on "secured" models
+// installGadgetCloudInitCfg installs a single cloud-init config file from the
+// gadget snap to the /etc/cloud config dir as "80_device_gadget.cfg".
+func installGadgetCloudInitCfg(src, targetdir string) error {
+	ubuntuDataCloudCfgDir := filepath.Join(ubuntuDataCloudDir(targetdir), "cloud.cfg.d/")
+	if err := os.MkdirAll(ubuntuDataCloudCfgDir, 0755); err != nil {
+		return fmt.Errorf("cannot make cloud config dir: %v", err)
+	}
+
+	configFile := filepath.Join(ubuntuDataCloudCfgDir, "80_device_gadget.cfg")
+	return osutil.CopyFile(src, configFile, 0)
+}
+
 func configureCloudInit(opts *Options) (err error) {
 	if opts.TargetRootDir == "" {
 		return fmt.Errorf("unable to configure cloud-init, missing target dir")
 	}
 
-	switch opts.CloudInitSrcDir {
-	case "":
-		// disable cloud-init by default (as it's not confined)
-		err = DisableCloudInit(opts.TargetRootDir)
+	// first check if cloud-init should be disallowed entirely
+	if !opts.AllowCloudInit {
+		return DisableCloudInit(WritableDefaultsDir(opts.TargetRootDir))
+	}
+
+	// next check if there is a gadget cloud.conf to install
+	if HasGadgetCloudConf(opts.GadgetDir) {
+		// then copy / install the gadget config and return without considering
+		// CloudInitSrcDir
+		// TODO:UC20: we may eventually want to consider both CloudInitSrcDir
+		// and the gadget cloud.conf so returning here may be wrong
+		gadgetCloudConf := filepath.Join(opts.GadgetDir, "cloud.conf")
+		return installGadgetCloudInitCfg(gadgetCloudConf, WritableDefaultsDir(opts.TargetRootDir))
+	}
+
+	// TODO:UC20: implement filtering of files from src when specified via a
+	//            specific Options for i.e. signed grade and MAAS, etc.
+
+	// finally check if there is a cloud-init src dir we should copy config
+	// files from
+
+	if opts.CloudInitSrcDir != "" {
+		return installCloudInitCfgDir(opts.CloudInitSrcDir, WritableDefaultsDir(opts.TargetRootDir))
+	}
+
+	// it's valid to allow cloud-init, but not set CloudInitSrcDir and not have
+	// a gadget cloud.conf, in this case cloud-init may pick up dynamic metadata
+	// and userdata from NoCloud sources such as a CD-ROM drive with label
+	// CIDATA, etc. during first-boot
+
+	return nil
+}
+
+// CloudInitState represents the various cloud-init states
+type CloudInitState int
+
+var (
+	// the (?m) is needed since cloud-init output will have newlines
+	cloudInitStatusRe = regexp.MustCompile(`(?m)^status: (.*)$`)
+	datasourceRe      = regexp.MustCompile(`DataSource([a-zA-Z0-9]+).*`)
+
+	cloudInitSnapdRestrictFile = "/etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
+	cloudInitDisabledFile      = "/etc/cloud/cloud-init.disabled"
+
+	// for NoCloud datasource, we need to specify "manual_cache_clean: true"
+	// because the default is false, and this key being true essentially informs
+	// cloud-init that it should always trust the instance-id it has cached in
+	// the image, and shouldn't assume that there is a new one on every boot, as
+	// otherwise we have bugs like https://bugs.launchpad.net/snapd/+bug/1905983
+	// where subsequent boots after cloud-init runs and gets restricted it will
+	// try to detect the instance_id by reading from the NoCloud datasource
+	// fs_label, but we set that to "null" so it fails to read anything and thus
+	// can't detect the effective instance_id and assumes it is different and
+	// applies default config which can overwrite valid config from the initial
+	// boot if that is not the default config
+	// see also https://cloudinit.readthedocs.io/en/latest/topics/boot.html?highlight=manual_cache_clean#first-boot-determination
+	nocloudRestrictYaml = []byte(`datasource_list: [NoCloud]
+datasource:
+  NoCloud:
+    fs_label: null
+manual_cache_clean: true
+`)
+
+	// don't use manual_cache_clean for real cloud datasources, the setting is
+	// used with ubuntu core only for sources where we can only get the
+	// instance_id through the fs_label for NoCloud and None (since we disable
+	// importing using the fs_label after the initial run).
+	genericCloudRestrictYamlPattern = `datasource_list: [%s]
+`
+
+	localDatasources = []string{"NoCloud", "None"}
+)
+
+const (
+	// CloudInitDisabledPermanently is when cloud-init is disabled as per the
+	// cloud-init.disabled file.
+	CloudInitDisabledPermanently CloudInitState = iota
+	// CloudInitRestrictedBySnapd is when cloud-init has been restricted by
+	// snapd with a specific config file.
+	CloudInitRestrictedBySnapd
+	// CloudInitUntriggered is when cloud-init is disabled because nothing has
+	// triggered it to run, but it could still be run.
+	CloudInitUntriggered
+	// CloudInitDone is when cloud-init has been run on this boot.
+	CloudInitDone
+	// CloudInitEnabled is when cloud-init is active, but not necessarily
+	// finished. This matches the "running" and "not run" states from cloud-init
+	// as well as any other state that does not match any of the other defined
+	// states, as we are conservative in assuming that cloud-init is doing
+	// something.
+	CloudInitEnabled
+	// CloudInitErrored is when cloud-init tried to run, but failed or had invalid
+	// configuration.
+	CloudInitErrored
+)
+
+// CloudInitStatus returns the current status of cloud-init. Note that it will
+// first check for static file-based statuses first through the snapd
+// restriction file and the disabled file before consulting
+// cloud-init directly through the status command.
+// Also note that in unknown situations we are conservative in assuming that
+// cloud-init may be doing something and will return CloudInitEnabled when we
+// do not recognize the state returned by the cloud-init status command.
+func CloudInitStatus() (CloudInitState, error) {
+	// if cloud-init has been restricted by snapd, check that first
+	snapdRestrictingFile := filepath.Join(dirs.GlobalRootDir, cloudInitSnapdRestrictFile)
+	if osutil.FileExists(snapdRestrictingFile) {
+		return CloudInitRestrictedBySnapd, nil
+	}
+
+	// if it was explicitly disabled via the cloud-init disable file, then
+	// return special status for that
+	disabledFile := filepath.Join(dirs.GlobalRootDir, cloudInitDisabledFile)
+	if osutil.FileExists(disabledFile) {
+		return CloudInitDisabledPermanently, nil
+	}
+
+	out, err := exec.Command("cloud-init", "status").CombinedOutput()
+	if err != nil {
+		return CloudInitErrored, osutil.OutputErr(out, err)
+	}
+	// output should just be "status: <state>"
+	match := cloudInitStatusRe.FindSubmatch(out)
+	if len(match) != 2 {
+		return CloudInitErrored, fmt.Errorf("invalid cloud-init output: %v", osutil.OutputErr(out, err))
+	}
+	switch string(match[1]) {
+	case "disabled":
+		// here since we weren't disabled by the file, we are in "disabled but
+		// could be enabled" state - arguably this should be a different state
+		// than "disabled", see
+		// https://bugs.launchpad.net/cloud-init/+bug/1883124 and
+		// https://bugs.launchpad.net/cloud-init/+bug/1883122
+		return CloudInitUntriggered, nil
+	case "error":
+		return CloudInitErrored, nil
+	case "done":
+		return CloudInitDone, nil
+	// "running" and "not run" are considered Enabled, see doc-comment
+	case "running", "not run":
+		fallthrough
+	default:
+		// these states are all
+		return CloudInitEnabled, nil
+	}
+}
+
+// these structs are externally defined by cloud-init
+type v1Data struct {
+	DataSource string `json:"datasource"`
+}
+
+type cloudInitStatus struct {
+	V1 v1Data `json:"v1"`
+}
+
+// CloudInitRestrictionResult is the result of calling RestrictCloudInit. The
+// values for Action are "disable" or "restrict", and the Datasource will be set
+// to the restricted datasource if Action is "restrict".
+type CloudInitRestrictionResult struct {
+	Action     string
+	DataSource string
+}
+
+// CloudInitRestrictOptions are options for how to restrict cloud-init with
+// RestrictCloudInit.
+type CloudInitRestrictOptions struct {
+	// ForceDisable will force disabling cloud-init even if it is
+	// in an active/running or errored state.
+	ForceDisable bool
+
+	// DisableAfterLocalDatasourcesRun modifies RestrictCloudInit to disable
+	// cloud-init after it has run on first-boot if the datasource detected is
+	// a local source such as NoCloud or None. If the datasource detected is not
+	// a local source, such as GCE or AWS EC2 it is merely restricted as
+	// described in the doc-comment on RestrictCloudInit.
+	DisableAfterLocalDatasourcesRun bool
+}
+
+// RestrictCloudInit will limit the operations of cloud-init on subsequent boots
+// by either disabling cloud-init in the untriggered state, or restrict
+// cloud-init to only use a specific datasource (additionally if the currently
+// detected datasource for this boot was NoCloud, it will disable the automatic
+// import of filesystems with labels such as CIDATA (or cidata) as datasources).
+// This is expected to be run when cloud-init is in a "steady" state such as
+// done or disabled (untriggered). If called in other states such as errored, it
+// will return an error, but it can be forced to disable cloud-init anyways in
+// these states with the opts parameter and the ForceDisable field.
+// This function is meant to protect against CVE-2020-11933.
+func RestrictCloudInit(state CloudInitState, opts *CloudInitRestrictOptions) (CloudInitRestrictionResult, error) {
+	res := CloudInitRestrictionResult{}
+
+	if opts == nil {
+		opts = &CloudInitRestrictOptions{}
+	}
+
+	switch state {
+	case CloudInitDone:
+		// handled below
+		break
+	case CloudInitRestrictedBySnapd:
+		return res, fmt.Errorf("cannot restrict cloud-init: already restricted")
+	case CloudInitDisabledPermanently:
+		return res, fmt.Errorf("cannot restrict cloud-init: already disabled")
+	case CloudInitErrored, CloudInitEnabled:
+		// if we are not forcing a disable, return error as these states are
+		// where cloud-init could still be running doing things
+		if !opts.ForceDisable {
+			return res, fmt.Errorf("cannot restrict cloud-init in error or enabled state")
+		}
+		fallthrough
+	case CloudInitUntriggered:
+		fallthrough
 	default:
-		err = installCloudInitCfg(opts.CloudInitSrcDir, opts.TargetRootDir)
+		res.Action = "disable"
+		return res, DisableCloudInit(dirs.GlobalRootDir)
 	}
-	return err
+
+	// from here on out, we are taking the "restrict" action
+	res.Action = "restrict"
+
+	// first get the cloud-init data-source that was used from /
+	resultsFile := filepath.Join(dirs.GlobalRootDir, "/run/cloud-init/status.json")
+
+	f, err := os.Open(resultsFile)
+	if err != nil {
+		return res, err
+	}
+	defer f.Close()
+
+	var stat cloudInitStatus
+	err = json.NewDecoder(f).Decode(&stat)
+	if err != nil {
+		return res, err
+	}
+
+	// if the datasource was empty then cloud-init did something wrong or
+	// perhaps it incorrectly reported that it ran but something else deleted
+	// the file
+	datasourceRaw := stat.V1.DataSource
+	if datasourceRaw == "" {
+		return res, fmt.Errorf("cloud-init error: missing datasource from status.json")
+	}
+
+	// for some datasources there is additional data in this item, i.e. for
+	// NoCloud we will also see:
+	// "DataSourceNoCloud [seed=/dev/sr0][dsmode=net]"
+	// so hence we use a regexp to parse out just the name of the datasource
+	datasourceMatches := datasourceRe.FindStringSubmatch(datasourceRaw)
+	if len(datasourceMatches) != 2 {
+		return res, fmt.Errorf("cloud-init error: unexpected datasource format %q", datasourceRaw)
+	}
+	res.DataSource = datasourceMatches[1]
+
+	cloudInitRestrictFile := filepath.Join(dirs.GlobalRootDir, cloudInitSnapdRestrictFile)
+
+	switch {
+	case opts.DisableAfterLocalDatasourcesRun && strutil.ListContains(localDatasources, res.DataSource):
+		// On UC20, DisableAfterLocalDatasourcesRun will be set, where we want
+		// to disable local sources like NoCloud and None after first-boot
+		// instead of just restricting them like we do below for UC16 and UC18.
+
+		// as such, change the action taken to disable and disable cloud-init
+		res.Action = "disable"
+		err = DisableCloudInit(dirs.GlobalRootDir)
+	case res.DataSource == "NoCloud":
+		// With the NoCloud datasource (which is one of the local datasources),
+		// we also need to restrict/disable the import of arbitrary filesystem
+		// labels to use as datasources, i.e. a USB drive inserted by an
+		// attacker with label CIDATA will defeat security measures on Ubuntu
+		// Core, so with the additional fs_label spec, we disable that import.
+		err = ioutil.WriteFile(cloudInitRestrictFile, nocloudRestrictYaml, 0644)
+	default:
+		// all other cases are either not local on UC20, or not NoCloud and as
+		// such we simply restrict cloud-init to the specific datasource used so
+		// that an attack via NoCloud is protected against
+		yaml := []byte(fmt.Sprintf(genericCloudRestrictYamlPattern, res.DataSource))
+		err = ioutil.WriteFile(cloudInitRestrictFile, yaml, 0644)
+	}
+
+	return res, err
 }
diff -Nru snapd-2.45.1+20.04.2/sysconfig/cloudinit_test.go snapd-2.48.3+20.04/sysconfig/cloudinit_test.go
--- snapd-2.45.1+20.04.2/sysconfig/cloudinit_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sysconfig/cloudinit_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,7 @@
 import (
 	"fmt"
 	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -52,31 +53,526 @@
 	s.AddCleanup(func() { dirs.SetRootDir("/") })
 }
 
-func (s *sysconfigSuite) TestCloudInitDisablesByDefault(c *C) {
-	err := sysconfig.ConfigureRunSystem(&sysconfig.Options{
+func (s *sysconfigSuite) makeCloudCfgSrcDirFiles(c *C) string {
+	cloudCfgSrcDir := c.MkDir()
+	for _, mockCfg := range []string{"foo.cfg", "bar.cfg"} {
+		err := ioutil.WriteFile(filepath.Join(cloudCfgSrcDir, mockCfg), []byte(fmt.Sprintf("%s config", mockCfg)), 0644)
+		c.Assert(err, IsNil)
+	}
+	return cloudCfgSrcDir
+}
+
+func (s *sysconfigSuite) makeGadgetCloudConfFile(c *C) string {
+	gadgetDir := c.MkDir()
+	gadgetCloudConf := filepath.Join(gadgetDir, "cloud.conf")
+	err := ioutil.WriteFile(gadgetCloudConf, []byte("gadget cloud config"), 0644)
+	c.Assert(err, IsNil)
+
+	return gadgetDir
+}
+
+func (s *sysconfigSuite) TestHasGadgetCloudConf(c *C) {
+	// no cloud.conf is false
+	c.Assert(sysconfig.HasGadgetCloudConf("non-existent-dir-place"), Equals, false)
+
+	// the dir is not enough
+	gadgetDir := c.MkDir()
+	c.Assert(sysconfig.HasGadgetCloudConf(gadgetDir), Equals, false)
+
+	// creating one now is true
+	gadgetCloudConf := filepath.Join(gadgetDir, "cloud.conf")
+	err := ioutil.WriteFile(gadgetCloudConf, []byte("gadget cloud config"), 0644)
+	c.Assert(err, IsNil)
+
+	c.Assert(sysconfig.HasGadgetCloudConf(gadgetDir), Equals, true)
+}
+
+// this test is for initramfs calls that disable cloud-init for the ephemeral
+// writable partition that is used while running during install or recover mode
+func (s *sysconfigSuite) TestEphemeralModeInitramfsCloudInitDisables(c *C) {
+	writableDefaultsDir := sysconfig.WritableDefaultsDir(boot.InitramfsWritableDir)
+	err := sysconfig.DisableCloudInit(writableDefaultsDir)
+	c.Assert(err, IsNil)
+
+	ubuntuDataCloudDisabled := filepath.Join(boot.InitramfsWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
+	c.Check(ubuntuDataCloudDisabled, testutil.FilePresent)
+}
+
+func (s *sysconfigSuite) TestInstallModeCloudInitDisablesByDefaultRunMode(c *C) {
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
 		TargetRootDir: boot.InstallHostWritableDir,
 	})
 	c.Assert(err, IsNil)
 
-	ubuntuDataCloudDisabled := filepath.Join(boot.InstallHostWritableDir, "etc/cloud/cloud-init.disabled/")
+	ubuntuDataCloudDisabled := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
 	c.Check(ubuntuDataCloudDisabled, testutil.FilePresent)
 }
 
-func (s *sysconfigSuite) TestCloudInitInstalls(c *C) {
-	cloudCfgSrcDir := c.MkDir()
-	for _, mockCfg := range []string{"foo.cfg", "bar.cfg"} {
-		err := ioutil.WriteFile(filepath.Join(cloudCfgSrcDir, mockCfg), []byte(fmt.Sprintf("%s config", mockCfg)), 0644)
-		c.Assert(err, IsNil)
-	}
+func (s *sysconfigSuite) TestInstallModeCloudInitDisallowedIgnoresOtherOptions(c *C) {
+	cloudCfgSrcDir := s.makeCloudCfgSrcDirFiles(c)
+	gadgetDir := s.makeGadgetCloudConfFile(c)
 
-	err := sysconfig.ConfigureRunSystem(&sysconfig.Options{
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		AllowCloudInit:  false,
+		CloudInitSrcDir: cloudCfgSrcDir,
+		GadgetDir:       gadgetDir,
+		TargetRootDir:   boot.InstallHostWritableDir,
+	})
+	c.Assert(err, IsNil)
+
+	ubuntuDataCloudDisabled := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
+	c.Check(ubuntuDataCloudDisabled, testutil.FilePresent)
+
+	// did not copy ubuntu-seed src files
+	ubuntuDataCloudCfg := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud.cfg.d/")
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "foo.cfg"), testutil.FileAbsent)
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "bar.cfg"), testutil.FileAbsent)
+
+	// also did not copy gadget cloud.conf
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "80_device_gadget.cfg"), testutil.FileAbsent)
+}
+
+func (s *sysconfigSuite) TestInstallModeCloudInitAllowedDoesNotDisable(c *C) {
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		AllowCloudInit: true,
+		TargetRootDir:  boot.InstallHostWritableDir,
+	})
+	c.Assert(err, IsNil)
+
+	ubuntuDataCloudDisabled := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud-init.disabled")
+	c.Check(ubuntuDataCloudDisabled, testutil.FileAbsent)
+}
+
+// this test is the same as the logic from install mode devicestate, where we
+// want to install cloud-init configuration not onto the running, ephemeral
+// writable, but rather the host writable partition that will be used upon
+// reboot into run mode
+func (s *sysconfigSuite) TestInstallModeCloudInitInstallsOntoHostRunMode(c *C) {
+	cloudCfgSrcDir := s.makeCloudCfgSrcDirFiles(c)
+
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		AllowCloudInit:  true,
 		CloudInitSrcDir: cloudCfgSrcDir,
 		TargetRootDir:   boot.InstallHostWritableDir,
 	})
 	c.Assert(err, IsNil)
 
 	// and did copy the cloud-init files
-	ubuntuDataCloudCfg := filepath.Join(boot.InstallHostWritableDir, "etc/cloud/cloud.cfg.d/")
+	ubuntuDataCloudCfg := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud.cfg.d/")
 	c.Check(filepath.Join(ubuntuDataCloudCfg, "foo.cfg"), testutil.FileEquals, "foo.cfg config")
 	c.Check(filepath.Join(ubuntuDataCloudCfg, "bar.cfg"), testutil.FileEquals, "bar.cfg config")
 }
+
+func (s *sysconfigSuite) TestInstallModeCloudInitInstallsOntoHostRunModeWithGadgetCloudConf(c *C) {
+	gadgetDir := s.makeGadgetCloudConfFile(c)
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		AllowCloudInit: true,
+		GadgetDir:      gadgetDir,
+		TargetRootDir:  boot.InstallHostWritableDir,
+	})
+	c.Assert(err, IsNil)
+
+	// and did copy the gadget cloud-init file
+	ubuntuDataCloudCfg := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud.cfg.d/")
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "80_device_gadget.cfg"), testutil.FileEquals, "gadget cloud config")
+}
+
+func (s *sysconfigSuite) TestInstallModeCloudInitInstallsOntoHostRunModeWithGadgetCloudConfIgnoresUbuntuSeedConfig(c *C) {
+	cloudCfgSrcDir := s.makeCloudCfgSrcDirFiles(c)
+	gadgetDir := s.makeGadgetCloudConfFile(c)
+
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		AllowCloudInit:  true,
+		CloudInitSrcDir: cloudCfgSrcDir,
+		GadgetDir:       gadgetDir,
+		TargetRootDir:   boot.InstallHostWritableDir,
+	})
+	c.Assert(err, IsNil)
+
+	// and did copy the gadget cloud-init file
+	ubuntuDataCloudCfg := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/cloud/cloud.cfg.d/")
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "80_device_gadget.cfg"), testutil.FileEquals, "gadget cloud config")
+
+	// but did not copy the ubuntu-seed files
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "foo.cfg"), testutil.FileAbsent)
+	c.Check(filepath.Join(ubuntuDataCloudCfg, "bar.cfg"), testutil.FileAbsent)
+}
+
+func (s *sysconfigSuite) TestCloudInitStatusUnhappy(c *C) {
+	cmd := testutil.MockCommand(c, "cloud-init", `
+echo cloud-init borken
+exit 1
+`)
+
+	status, err := sysconfig.CloudInitStatus()
+	c.Assert(err, ErrorMatches, "cloud-init borken")
+	c.Assert(status, Equals, sysconfig.CloudInitErrored)
+	c.Assert(cmd.Calls(), DeepEquals, [][]string{
+		{"cloud-init", "status"},
+	})
+}
+
+func (s *sysconfigSuite) TestCloudInitStatus(c *C) {
+	tt := []struct {
+		comment         string
+		cloudInitOutput string
+		exp             sysconfig.CloudInitState
+		restrictedFile  bool
+		disabledFile    bool
+		expError        string
+	}{
+		{
+			comment:         "done",
+			cloudInitOutput: "status: done",
+			exp:             sysconfig.CloudInitDone,
+		},
+		{
+			comment:         "running",
+			cloudInitOutput: "status: running",
+			exp:             sysconfig.CloudInitEnabled,
+		},
+		{
+			comment:         "not run",
+			cloudInitOutput: "status: not run",
+			exp:             sysconfig.CloudInitEnabled,
+		},
+		{
+			comment:         "new unrecognized state",
+			cloudInitOutput: "status: newfangledstatus",
+			exp:             sysconfig.CloudInitEnabled,
+		},
+		{
+			comment:        "restricted by snapd",
+			restrictedFile: true,
+			exp:            sysconfig.CloudInitRestrictedBySnapd,
+		},
+		{
+			comment:         "disabled temporarily",
+			cloudInitOutput: "status: disabled",
+			exp:             sysconfig.CloudInitUntriggered,
+		},
+		{
+			comment:      "disabled permanently via file",
+			disabledFile: true,
+			exp:          sysconfig.CloudInitDisabledPermanently,
+		},
+		{
+			comment:         "errored",
+			cloudInitOutput: "status: error",
+			exp:             sysconfig.CloudInitErrored,
+		},
+		{
+			comment:         "broken cloud-init output",
+			cloudInitOutput: "broken cloud-init output",
+			expError:        "invalid cloud-init output: broken cloud-init output",
+		},
+	}
+
+	for _, t := range tt {
+		old := dirs.GlobalRootDir
+		dirs.SetRootDir(c.MkDir())
+		defer func() { dirs.SetRootDir(old) }()
+		cmd := testutil.MockCommand(c, "cloud-init", fmt.Sprintf(`
+if [ "$1" = "status" ]; then
+	echo '%s'
+else 
+	echo "unexpected args, $"
+	exit 1
+fi
+		`, t.cloudInitOutput))
+
+		if t.disabledFile {
+			cloudDir := filepath.Join(dirs.GlobalRootDir, "etc/cloud")
+			err := os.MkdirAll(cloudDir, 0755)
+			c.Assert(err, IsNil)
+			err = ioutil.WriteFile(filepath.Join(cloudDir, "cloud-init.disabled"), nil, 0644)
+			c.Assert(err, IsNil)
+		}
+
+		if t.restrictedFile {
+			cloudDir := filepath.Join(dirs.GlobalRootDir, "etc/cloud/cloud.cfg.d")
+			err := os.MkdirAll(cloudDir, 0755)
+			c.Assert(err, IsNil)
+			err = ioutil.WriteFile(filepath.Join(cloudDir, "zzzz_snapd.cfg"), nil, 0644)
+			c.Assert(err, IsNil)
+		}
+
+		status, err := sysconfig.CloudInitStatus()
+		if t.expError != "" {
+			c.Assert(err, ErrorMatches, t.expError, Commentf(t.comment))
+		} else {
+			c.Assert(err, IsNil)
+			c.Assert(status, Equals, t.exp, Commentf(t.comment))
+		}
+
+		// if the restricted file was there we don't call cloud-init status
+		var expCalls [][]string
+		if !t.restrictedFile && !t.disabledFile {
+			expCalls = [][]string{
+				{"cloud-init", "status"},
+			}
+		}
+
+		c.Assert(cmd.Calls(), DeepEquals, expCalls, Commentf(t.comment))
+		cmd.Restore()
+	}
+}
+
+var gceCloudInitStatusJSON = `{
+	"v1": {
+	 "datasource": "DataSourceGCE",
+	 "init": {
+	  "errors": [],
+	  "finished": 1591751113.4536479,
+	  "start": 1591751112.130069
+	 },
+	 "stage": null
+	}
+}
+`
+
+var multipassNoCloudCloudInitStatusJSON = `{
+ "v1": {
+  "datasource": "DataSourceNoCloud [seed=/dev/sr0][dsmode=net]",
+  "init": {
+   "errors": [],
+   "finished": 1591788514.4656117,
+   "start": 1591788514.2607572
+  },
+  "stage": null
+ }
+}`
+
+var localNoneCloudInitStatusJSON = `{
+ "v1": {
+  "datasource": "DataSourceNone",
+  "init": {
+   "errors": [],
+   "finished": 1591788514.4656117,
+   "start": 1591788514.2607572
+  },
+  "stage": null
+ }
+}`
+
+var lxdNoCloudCloudInitStatusJSON = `{
+ "v1": {
+  "datasource": "DataSourceNoCloud [seed=/var/lib/cloud/seed/nocloud-net][dsmode=net]",
+  "init": {
+   "errors": [],
+   "finished": 1591788737.3982718,
+   "start": 1591788736.9015596
+  },
+  "stage": null
+ }
+}`
+
+var restrictNoCloudYaml = `datasource_list: [NoCloud]
+datasource:
+  NoCloud:
+    fs_label: null
+manual_cache_clean: true
+`
+
+func (s *sysconfigSuite) TestRestrictCloudInit(c *C) {
+	tt := []struct {
+		comment                string
+		state                  sysconfig.CloudInitState
+		sysconfOpts            *sysconfig.CloudInitRestrictOptions
+		cloudInitStatusJSON    string
+		expError               string
+		expRestrictYamlWritten string
+		expDatasource          string
+		expAction              string
+		expDisableFile         bool
+	}{
+		{
+			comment:  "already disabled",
+			state:    sysconfig.CloudInitDisabledPermanently,
+			expError: "cannot restrict cloud-init: already disabled",
+		},
+		{
+			comment:  "already restricted",
+			state:    sysconfig.CloudInitRestrictedBySnapd,
+			expError: "cannot restrict cloud-init: already restricted",
+		},
+		{
+			comment:  "errored",
+			state:    sysconfig.CloudInitErrored,
+			expError: "cannot restrict cloud-init in error or enabled state",
+		},
+		{
+			comment:  "enable (not running)",
+			state:    sysconfig.CloudInitEnabled,
+			expError: "cannot restrict cloud-init in error or enabled state",
+		},
+		{
+			comment: "errored w/ force disable",
+			state:   sysconfig.CloudInitErrored,
+			sysconfOpts: &sysconfig.CloudInitRestrictOptions{
+				ForceDisable: true,
+			},
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+		{
+			comment: "enable (not running) w/ force disable",
+			state:   sysconfig.CloudInitEnabled,
+			sysconfOpts: &sysconfig.CloudInitRestrictOptions{
+				ForceDisable: true,
+			},
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+		{
+			comment:        "untriggered",
+			state:          sysconfig.CloudInitUntriggered,
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+		{
+			comment:        "unknown status",
+			state:          -1,
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+		{
+			comment:             "gce done",
+			state:               sysconfig.CloudInitDone,
+			cloudInitStatusJSON: gceCloudInitStatusJSON,
+			expDatasource:       "GCE",
+			expAction:           "restrict",
+			expRestrictYamlWritten: `datasource_list: [GCE]
+`,
+		},
+		{
+			comment:                "nocloud done",
+			state:                  sysconfig.CloudInitDone,
+			cloudInitStatusJSON:    multipassNoCloudCloudInitStatusJSON,
+			expDatasource:          "NoCloud",
+			expAction:              "restrict",
+			expRestrictYamlWritten: restrictNoCloudYaml,
+		},
+		{
+			comment:             "nocloud uc20 done",
+			state:               sysconfig.CloudInitDone,
+			cloudInitStatusJSON: multipassNoCloudCloudInitStatusJSON,
+			sysconfOpts: &sysconfig.CloudInitRestrictOptions{
+				DisableAfterLocalDatasourcesRun: true,
+			},
+			expDatasource:  "NoCloud",
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+		{
+			comment:             "none uc20 done",
+			state:               sysconfig.CloudInitDone,
+			cloudInitStatusJSON: localNoneCloudInitStatusJSON,
+			sysconfOpts: &sysconfig.CloudInitRestrictOptions{
+				DisableAfterLocalDatasourcesRun: true,
+			},
+			expDatasource:  "None",
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+
+		// the two cases for lxd and multipass are effectively the same, but as
+		// the largest known users of cloud-init w/ UC, we leave them as
+		// separate test cases for their different cloud-init status.json
+		// content
+		{
+			comment:                "nocloud multipass done",
+			state:                  sysconfig.CloudInitDone,
+			cloudInitStatusJSON:    multipassNoCloudCloudInitStatusJSON,
+			expDatasource:          "NoCloud",
+			expAction:              "restrict",
+			expRestrictYamlWritten: restrictNoCloudYaml,
+		},
+		{
+			comment:                "nocloud seed lxd done",
+			state:                  sysconfig.CloudInitDone,
+			cloudInitStatusJSON:    lxdNoCloudCloudInitStatusJSON,
+			expDatasource:          "NoCloud",
+			expAction:              "restrict",
+			expRestrictYamlWritten: restrictNoCloudYaml,
+		},
+		{
+			comment:             "nocloud uc20 multipass done",
+			state:               sysconfig.CloudInitDone,
+			cloudInitStatusJSON: multipassNoCloudCloudInitStatusJSON,
+			sysconfOpts: &sysconfig.CloudInitRestrictOptions{
+				DisableAfterLocalDatasourcesRun: true,
+			},
+			expDatasource:  "NoCloud",
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+		{
+			comment:             "nocloud uc20 seed lxd done",
+			state:               sysconfig.CloudInitDone,
+			cloudInitStatusJSON: lxdNoCloudCloudInitStatusJSON,
+			sysconfOpts: &sysconfig.CloudInitRestrictOptions{
+				DisableAfterLocalDatasourcesRun: true,
+			},
+			expDatasource:  "NoCloud",
+			expAction:      "disable",
+			expDisableFile: true,
+		},
+	}
+
+	for _, t := range tt {
+		comment := Commentf("%s", t.comment)
+		// setup status.json
+		old := dirs.GlobalRootDir
+		dirs.SetRootDir(c.MkDir())
+		defer func() { dirs.SetRootDir(old) }()
+		statusJSONFile := filepath.Join(dirs.GlobalRootDir, "/run/cloud-init/status.json")
+		if t.cloudInitStatusJSON != "" {
+			err := os.MkdirAll(filepath.Dir(statusJSONFile), 0755)
+			c.Assert(err, IsNil, comment)
+			err = ioutil.WriteFile(statusJSONFile, []byte(t.cloudInitStatusJSON), 0644)
+			c.Assert(err, IsNil, comment)
+		}
+
+		// if we expect snapd to write a yaml config file for cloud-init, ensure
+		// the dir exists before hand
+		if t.expRestrictYamlWritten != "" {
+			err := os.MkdirAll(filepath.Join(dirs.GlobalRootDir, "/etc/cloud/cloud.cfg.d"), 0755)
+			c.Assert(err, IsNil, comment)
+		}
+
+		res, err := sysconfig.RestrictCloudInit(t.state, t.sysconfOpts)
+		if t.expError == "" {
+			c.Assert(err, IsNil, comment)
+			c.Assert(res.DataSource, Equals, t.expDatasource, comment)
+			c.Assert(res.Action, Equals, t.expAction, comment)
+			if t.expRestrictYamlWritten != "" {
+				// check the snapd restrict yaml file that should have been written
+				c.Assert(
+					filepath.Join(dirs.GlobalRootDir, "/etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"),
+					testutil.FileEquals,
+					t.expRestrictYamlWritten,
+					comment,
+				)
+			}
+
+			// if we expect the disable file to be written then check for it
+			// otherwise ensure it was not written accidentally
+			var fileCheck Checker
+			if t.expDisableFile {
+				fileCheck = testutil.FilePresent
+			} else {
+				fileCheck = testutil.FileAbsent
+			}
+
+			c.Assert(
+				filepath.Join(dirs.GlobalRootDir, "/etc/cloud/cloud-init.disabled"),
+				fileCheck,
+				comment,
+			)
+
+		} else {
+			c.Assert(err, ErrorMatches, t.expError, comment)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/sysconfig/gadget_defaults_test.go snapd-2.48.3+20.04/sysconfig/gadget_defaults_test.go
--- snapd-2.45.1+20.04.2/sysconfig/gadget_defaults_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/sysconfig/gadget_defaults_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,157 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package sysconfig_test
+
+import (
+	"path/filepath"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/osutil"
+
+	// to set ApplyFilesystemOnlyDefaults hook
+	_ "github.com/snapcore/snapd/overlord/configstate/configcore"
+
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/snap/snaptest"
+	"github.com/snapcore/snapd/snap/squashfs"
+	"github.com/snapcore/snapd/sysconfig"
+	"github.com/snapcore/snapd/systemd"
+)
+
+var gadgetYaml = `
+volumes:
+  pc:
+    bootloader: grub
+`
+
+func (s *sysconfigSuite) TestGadgetDefaults(c *C) {
+	const gadgetDefaultsYaml = `
+defaults:
+  system:
+    service:
+      rsyslog.disable: true
+      ssh.disable: true
+    journal.persistent: true
+`
+	si := &snap.SideInfo{
+		RealName: "pc",
+		Revision: snap.R(1),
+		SnapID:   "idid",
+	}
+	snapInfo := snaptest.MockSnapWithFiles(c, "name: pc\ntype: gadget", si, [][]string{
+		{"meta/gadget.yaml", gadgetYaml + gadgetDefaultsYaml},
+	})
+
+	var sysctlArgs [][]string
+	systemctlRestorer := systemd.MockSystemctl(func(args ...string) (buf []byte, err error) {
+		sysctlArgs = append(sysctlArgs, args)
+		return nil, nil
+	})
+	defer systemctlRestorer()
+
+	journalPath := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/var/log/journal")
+	sshDontRunFile := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/ssh/sshd_not_to_be_run")
+
+	// sanity
+	c.Check(osutil.FileExists(sshDontRunFile), Equals, false)
+	exists, _, _ := osutil.DirExists(journalPath)
+	c.Check(exists, Equals, false)
+
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		TargetRootDir: boot.InstallHostWritableDir,
+		GadgetDir:     snapInfo.MountDir(),
+	})
+	c.Assert(err, IsNil)
+
+	c.Check(osutil.FileExists(sshDontRunFile), Equals, true)
+	exists, _, _ = osutil.DirExists(journalPath)
+	c.Check(exists, Equals, true)
+
+	c.Check(sysctlArgs, DeepEquals, [][]string{{"--root", filepath.Join(boot.InstallHostWritableDir, "_writable_defaults"), "mask", "rsyslog.service"}})
+}
+
+func (s *sysconfigSuite) TestInstallModeEarlyDefaultsFromGadgetInvalid(c *C) {
+	const gadgetDefaultsYaml = `
+defaults:
+  system:
+    service:
+      rsyslog:
+        disable: foo
+`
+	si := &snap.SideInfo{
+		RealName: "pc",
+		Revision: snap.R(1),
+		SnapID:   "idid",
+	}
+	snapInfo := snaptest.MockSnapWithFiles(c, "name: pc\ntype: gadget", si, [][]string{
+		{"meta/gadget.yaml", gadgetYaml + gadgetDefaultsYaml},
+	})
+
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		TargetRootDir: boot.InstallHostWritableDir,
+		GadgetDir:     snapInfo.MountDir(),
+	})
+	c.Check(err, ErrorMatches, `option "service.rsyslog.disable" has invalid value "foo"`)
+}
+
+func (s *sysconfigSuite) TestInstallModeEarlyDefaultsFromGadgetSeedSnap(c *C) {
+	const gadgetDefaultsYaml = `
+defaults:
+  system:
+    service:
+      rsyslog.disable: true
+      ssh.disable: true
+    journal.persistent: true
+`
+	snapFile := snaptest.MakeTestSnapWithFiles(c, "name: pc\ntype: gadget\nversion: 1", [][]string{
+		{"meta/gadget.yaml", gadgetYaml + gadgetDefaultsYaml},
+	})
+
+	snapContainer := squashfs.New(snapFile)
+
+	var sysctlArgs [][]string
+	systemctlRestorer := systemd.MockSystemctl(func(args ...string) (buf []byte, err error) {
+		sysctlArgs = append(sysctlArgs, args)
+		return nil, nil
+	})
+	defer systemctlRestorer()
+
+	journalPath := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/var/log/journal")
+	sshDontRunFile := filepath.Join(boot.InstallHostWritableDir, "_writable_defaults/etc/ssh/sshd_not_to_be_run")
+
+	// sanity
+	c.Check(osutil.FileExists(sshDontRunFile), Equals, false)
+	exists, _, _ := osutil.DirExists(journalPath)
+	c.Check(exists, Equals, false)
+
+	err := sysconfig.ConfigureTargetSystem(&sysconfig.Options{
+		TargetRootDir: boot.InstallHostWritableDir,
+		GadgetSnap:    snapContainer,
+	})
+	c.Assert(err, IsNil)
+
+	c.Check(osutil.FileExists(sshDontRunFile), Equals, true)
+	exists, _, _ = osutil.DirExists(journalPath)
+	c.Check(exists, Equals, true)
+
+	c.Check(sysctlArgs, DeepEquals, [][]string{{"--root", filepath.Join(boot.InstallHostWritableDir, "_writable_defaults"), "mask", "rsyslog.service"}})
+}
diff -Nru snapd-2.45.1+20.04.2/sysconfig/sysconfig.go snapd-2.48.3+20.04/sysconfig/sysconfig.go
--- snapd-2.45.1+20.04.2/sysconfig/sysconfig.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/sysconfig/sysconfig.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,6 +19,16 @@
 
 package sysconfig
 
+import (
+	"path/filepath"
+
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/snap"
+)
+
+// See https://github.com/snapcore/core20/pull/46
+const writableDefaultsDir = "_writable_defaults"
+
 // Options is the set of options used to configure the run system
 type Options struct {
 	// CloudInitSrcDir is where to find the cloud-init data when installing it,
@@ -30,14 +40,80 @@
 	// data, i.e. for cloud-init during the initramfs it will be something like
 	// boot.InstallHostWritableDir
 	TargetRootDir string
+
+	// AllowCloudInit is whether to allow cloud-init to run or not in the
+	// TargetRootDir.
+	AllowCloudInit bool
+
+	// GadgetDir is the path of the mounted gadget snap.
+	GadgetDir string
+
+	// GadgetSnap is a snap.Container of the gadget snap. This is used in
+	// priority over GadgetDir if set.
+	GadgetSnap snap.Container
 }
 
-// ConfigureRunSystem configures the ubuntu-data partition with any
-// configuration needed from e.g. the gadget or for cloud-init.
-func ConfigureRunSystem(opts *Options) error {
+// FilesystemOnlyApplyOptions is the set of options for
+// ApplyFilesystemOnlyDefaults.
+type FilesystemOnlyApplyOptions struct {
+	// Classic is true when the system in rootdir is a classic system
+	Classic bool
+}
+
+// ApplyFilesystemOnlyDefaultsImpl is initialized by init() of configcore.
+var ApplyFilesystemOnlyDefaultsImpl = func(rootDir string, defaults map[string]interface{}, options *FilesystemOnlyApplyOptions) error {
+	panic("ApplyFilesystemOnlyDefaultsImpl is unset, import overlord/configstate/configcore")
+}
+
+// ApplyFilesystemOnlyDefaults applies (via configcore.filesystemOnlyApply())
+// filesystem modifications under rootDir, according to the defaults.
+// This is a subset of core config options that is important
+// early during boot, before all the configuration is applied as part of
+// normal execution of configure hook.
+func ApplyFilesystemOnlyDefaults(rootDir string, defaults map[string]interface{}, options *FilesystemOnlyApplyOptions) error {
+	return ApplyFilesystemOnlyDefaultsImpl(rootDir, defaults, options)
+}
+
+// ConfigureTargetSystem configures the ubuntu-data partition with
+// any configuration needed from e.g. the gadget or for cloud-init (and also for
+// cloud-init from the gadget).
+// It is okay to use both from install mode for run mode, as well as from the
+// initramfs for recover mode.
+func ConfigureTargetSystem(opts *Options) error {
 	if err := configureCloudInit(opts); err != nil {
 		return err
 	}
 
+	var gadgetInfo *gadget.Info
+	var err error
+	switch {
+	case opts.GadgetSnap != nil:
+		gadgetInfo, err = gadget.ReadInfoFromSnapFile(opts.GadgetSnap, nil)
+	case opts.GadgetDir != "":
+		gadgetInfo, err = gadget.ReadInfo(opts.GadgetDir, nil)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	if gadgetInfo != nil {
+		defaults := gadget.SystemDefaults(gadgetInfo.Defaults)
+		if len(defaults) > 0 {
+			// options are nil which implies core system
+			var options *FilesystemOnlyApplyOptions
+			if err := ApplyFilesystemOnlyDefaults(WritableDefaultsDir(opts.TargetRootDir), defaults, options); err != nil {
+				return err
+			}
+		}
+	}
+
 	return nil
 }
+
+// WritableDefaultsDir returns the full path of the joined subdir under the
+// subtree for default content for system data living at rootdir,
+// i.e. rootdir/_writable_defaults/subdir...
+func WritableDefaultsDir(rootdir string, subdir ...string) string {
+	return filepath.Join(rootdir, writableDefaultsDir, filepath.Join(subdir...))
+}
diff -Nru snapd-2.45.1+20.04.2/systemd/emulation.go snapd-2.48.3+20.04/systemd/emulation.go
--- snapd-2.45.1+20.04.2/systemd/emulation.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/emulation.go	2021-02-02 08:21:12.000000000 +0000
@@ -31,6 +31,7 @@
 
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/osutil/squashfs"
 )
 
 type emulation struct {
@@ -43,6 +44,10 @@
 	return errNotImplemented
 }
 
+func (s *emulation) DaemonReexec() error {
+	return errNotImplemented
+}
+
 func (s *emulation) Enable(service string) error {
 	_, err := systemctlCmd("--root", s.rootDir, "enable", service)
 	return err
@@ -73,6 +78,14 @@
 	return errNotImplemented
 }
 
+func (s *emulation) ReloadOrRestart(service string) error {
+	return errNotImplemented
+}
+
+func (s *emulation) RestartAll(service string) error {
+	return errNotImplemented
+}
+
 func (s *emulation) Status(units ...string) ([]*UnitStatus, error) {
 	return nil, errNotImplemented
 }
@@ -94,14 +107,20 @@
 		return "", fmt.Errorf("bind-mounted directory is not supported in emulation mode")
 	}
 
-	mountUnitName, actualFsType, options, err := writeMountUnitFile(snapName, revision, what, where, fstype)
+	// In emulation mode hostFsType is the fs we want to use to manually mount
+	// the snap below, but fstype is used for the created mount unit.
+	// This means that when preseeding in a lxd container, the snap will be
+	// mounted with fuse, but mount unit will use squashfs.
+	mountUnitOptions := append(fsMountOptions(fstype), squashfs.StandardOptions()...)
+	mountUnitName, err := writeMountUnitFile(snapName, revision, what, where, fstype, mountUnitOptions)
 	if err != nil {
 		return "", err
 	}
 
-	cmd := exec.Command("mount", "-t", actualFsType, what, where, "-o", strings.Join(options, ","))
+	hostFsType, actualOptions := hostFsTypeAndMountOptions(fstype)
+	cmd := exec.Command("mount", "-t", hostFsType, what, where, "-o", strings.Join(actualOptions, ","))
 	if out, err := cmd.CombinedOutput(); err != nil {
-		return "", fmt.Errorf("cannot mount %s (%s) at %s in preseed mode: %s; %s", what, actualFsType, where, err, string(out))
+		return "", fmt.Errorf("cannot mount %s (%s) at %s in preseed mode: %s; %s", what, hostFsType, where, err, string(out))
 	}
 
 	multiUserTargetWantsDir := filepath.Join(dirs.SnapServicesDir, "multi-user.target.wants")
@@ -157,3 +176,11 @@
 	_, err := systemctlCmd("--root", s.rootDir, "unmask", service)
 	return err
 }
+
+func (s *emulation) Mount(what, where string, options ...string) error {
+	return errNotImplemented
+}
+
+func (s *emulation) Umount(whatOrWhere string) error {
+	return errNotImplemented
+}
diff -Nru snapd-2.45.1+20.04.2/systemd/escape.go snapd-2.48.3+20.04/systemd/escape.go
--- snapd-2.45.1+20.04.2/systemd/escape.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/escape.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,6 +34,11 @@
 //
 //        But thats not in the archive and it won't work with go1.3
 func EscapeUnitNamePath(in string) string {
+	// "" is the same as "/" which is escaped to "-"
+	// the filepath.Clean will turn "" into "." and make this incorrect
+	if len(in) == 0 {
+		return "-"
+	}
 	buf := bytes.NewBuffer(nil)
 
 	// clean and trim leading/trailing "/"
@@ -58,7 +63,7 @@
 		} else if strings.IndexByte(allowed, c) >= 0 {
 			buf.WriteByte(c)
 		} else {
-			fmt.Fprintf(buf, `\x%x`, in[i])
+			fmt.Fprintf(buf, `\x%x`, []byte{in[i]})
 		}
 	}
 
diff -Nru snapd-2.45.1+20.04.2/systemd/escape_test.go snapd-2.48.3+20.04/systemd/escape_test.go
--- snapd-2.45.1+20.04.2/systemd/escape_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/escape_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,16 +22,133 @@
 import (
 	. "gopkg.in/check.v1"
 
-	. "github.com/snapcore/snapd/systemd"
+	"github.com/snapcore/snapd/systemd"
 )
 
-func (s *SystemdTestSuite) TestEscape(c *C) {
-	c.Check(EscapeUnitNamePath("Hallöchen, Meister"), Equals, `Hall\xc3\xb6chen\x2c\x20Meister`)
+func (ts *SystemdTestSuite) TestEscapePath(c *C) {
+	tt := []struct {
+		in      string
+		out     string
+		comment string
+	}{
+		{
+			`Hallöchen, Meister`,
+			`Hall\xc3\xb6chen\x2c\x20Meister`,
+			`utf-8 char and spaces`,
+		},
+		{
+			`/tmp//waldi/foobar/`,
+			`tmp-waldi-foobar`,
+			`unclean path`,
+		},
+		{
+			`/.foo/.bar`,
+			`\x2efoo-.bar`,
+			`leading dot escaped differently`,
+		},
+		{
+			`.foo/.bar`,
+			`\x2efoo-.bar`,
+			`leading dot escaped differently (without leading slash)`,
+		},
+		{
+			// TODO: this case shouldn't work it should cause an error to be
+			// fully compatible with systemd-escape(1), but it's not documented
+			// how or why systemd-escape considers this kind of path to be
+			// invalid, so for now we just process it in an expected and
+			// deterministic way
+			`/top_level_1/../top_level_2/`,
+			`top_level_2`,
+			`invalid path`,
+		},
+		{
+			``,
+			`-`,
+			`empty string`,
+		},
+		{
+			`/`,
+			`-`,
+			`root /`,
+		},
+		{
+			`////////`,
+			`-`,
+			`root / unclean`,
+		},
+		{
+			`-`,
+			`\x2d`,
+			`just dash`,
+		},
+		{
+			`/run/ubuntu------data`,
+			`run-ubuntu\x2d\x2d\x2d\x2d\x2d\x2ddata`,
+			`consecutive dashes`,
+		},
+		{
+			`/path-with-forward-slash\`,
+			`path\x2dwith\x2dforward\x2dslash\x5c`,
+			`forward slash in path element`,
+		},
+		{
+			`/run/1000/numbers`,
+			`run-1000-numbers`,
+			`numbers`,
+		},
+		{
+			`/silly/path/,!@#$%^&*()`,
+			`silly-path-\x2c\x21\x40\x23\x24\x25\x5e\x26\x2a\x28\x29`,
+			`ascii punctuation`,
+		},
+		{
+			`/run/mnt/data`,
+			`run-mnt-data`,
+			`typical data initramfs mount`,
+		},
+		{
+			`run/mnt/data`,
+			`run-mnt-data`,
+			`typical data initramfs mount w/o leading slash`,
+		},
+		{
+			`/run/mnt/ubuntu-seed`,
+			`run-mnt-ubuntu\x2dseed`,
+			`typical ubuntu-seed initramfs mount`,
+		},
+		{
+			`/run/mnt/ubuntu data`,
+			`run-mnt-ubuntu\x20data`,
+			`path with space in it`,
+		},
+		{
+			`/run/mnt/ubuntu_data`,
+			`run-mnt-ubuntu_data`,
+			`path with underscore in it`,
+		},
+		{
+			` `,
+			`\x20`,
+			"space character",
+		},
+		{
+			`	`,
+			`\x09`,
+			`tab character`,
+		},
+		{
+			`/home/日本語`,
+			`home-\xe6\x97\xa5\xe6\x9c\xac\xe8\xaa\x9e`,
+			`utf-8 characters`,
+		},
+		{
+			`/path⌘place-of-interest/hello`,
+			`path\xe2\x8c\x98place\x2dof\x2dinterest-hello`,
+			`utf-8 character embedded in ascii path element`,
+		},
+	}
 
-	c.Check(EscapeUnitNamePath("/tmp//waldi/foobar/"), Equals, `tmp-waldi-foobar`)
-	c.Check(EscapeUnitNamePath("/.foo/.bar"), Equals, `\x2efoo-.bar`)
-	c.Check(EscapeUnitNamePath("////"), Equals, `-`)
-	c.Check(EscapeUnitNamePath("."), Equals, `\x2e`)
-	c.Check(EscapeUnitNamePath("/foo/bar-baz"), Equals, `foo-bar\x2dbaz`)
-	c.Check(EscapeUnitNamePath("/foo/bar--baz"), Equals, `foo-bar\x2d\x2dbaz`)
+	for _, t := range tt {
+		c.Assert(systemd.EscapeUnitNamePath(t.in), Equals, t.out, Commentf(t.comment+" (with input %q)", t.in))
+	}
 }
diff -Nru snapd-2.45.1+20.04.2/systemd/export_test.go snapd-2.48.3+20.04/systemd/export_test.go
--- snapd-2.45.1+20.04.2/systemd/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -55,7 +55,7 @@
 	}
 }
 
-func MockSquashFsType(f func() (string, []string, error)) func() {
+func MockSquashFsType(f func() (string, []string)) func() {
 	old := squashfsFsType
 	squashfsFsType = f
 	return func() {
@@ -63,6 +63,14 @@
 	}
 }
 
+func MockSystemdSysctlPath(p string) (restore func()) {
+	old := systemdSysctlPath
+	systemdSysctlPath = p
+	return func() {
+		systemdSysctlPath = old
+	}
+}
+
 func (e *Error) SetExitCode(i int) {
 	e.exitCode = i
 }
diff -Nru snapd-2.45.1+20.04.2/systemd/sysctl.go snapd-2.48.3+20.04/systemd/sysctl.go
--- snapd-2.45.1+20.04.2/systemd/sysctl.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/sysctl.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,61 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package systemd
+
+import (
+	"fmt"
+	"os/exec"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+var (
+	systemdSysctlPath = "/lib/systemd/systemd-sysctl"
+)
+
+var systemdSysctlCmd = func(args ...string) error {
+	bs, err := exec.Command(systemdSysctlPath, args...).CombinedOutput()
+	if err != nil {
+		exitCode, _ := osutil.ExitCode(err)
+		return fmt.Errorf("%s invoked with %v failed with exit status %d: %s", systemdSysctlPath, args, exitCode, bs)
+	}
+	return nil
+}
+
+// Sysctl invokes systemd-sysctl to configure sysctl(8) kernel parameters
+// from disk configuration. A set of prefixes can be passed to limit
+// which settings are (re)configured.
+func Sysctl(prefixes []string) error {
+	args := []string{}
+	for _, p := range prefixes {
+		args = append(args, "--prefix", p)
+	}
+	return systemdSysctlCmd(args...)
+}
+
+// MockSystemdSysctl lets mock and intercept calls to systemd-sysctl
+// from the package.
+func MockSystemdSysctl(f func(args ...string) error) func() {
+	oldsystemdSysctlCmd := systemdSysctlCmd
+	systemdSysctlCmd = f
+	return func() {
+		systemdSysctlCmd = oldsystemdSysctlCmd
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/systemd/sysctl_test.go snapd-2.48.3+20.04/systemd/sysctl_test.go
--- snapd-2.45.1+20.04.2/systemd/sysctl_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/sysctl_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,89 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package systemd_test
+
+import (
+	"errors"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/systemd"
+	"github.com/snapcore/snapd/testutil"
+)
+
+type sysctlSuite struct {
+	testutil.BaseTest
+}
+
+var _ = Suite(&sysctlSuite{})
+
+func (s *sysctlSuite) TestSysctl(c *C) {
+	defer systemd.MockSystemdSysctlPath("systemd-sysctl")()
+
+	systemdSysctl := testutil.MockCommand(c, "systemd-sysctl", "")
+	defer systemdSysctl.Restore()
+
+	err := systemd.Sysctl(nil)
+	c.Assert(err, IsNil)
+
+	err = systemd.Sysctl([]string{"kernel.printk", "net"})
+	c.Assert(err, IsNil)
+
+	c.Check(systemdSysctl.Calls(), DeepEquals, [][]string{
+		{"systemd-sysctl"},
+		{"systemd-sysctl", "--prefix", "kernel.printk", "--prefix", "net"},
+	})
+}
+
+func (s *sysctlSuite) TestSysctlError(c *C) {
+	defer systemd.MockSystemdSysctlPath("systemd-sysctl")()
+
+	systemdSysctl := testutil.MockCommand(c, "systemd-sysctl", `
+echo foo >&2
+exit 1
+`)
+	defer systemdSysctl.Restore()
+
+	err := systemd.Sysctl(nil)
+	c.Assert(err, ErrorMatches, `(?m)systemd-sysctl invoked with \[\] failed with exit status 1: foo`)
+
+	err = systemd.Sysctl([]string{"net"})
+	c.Assert(err, ErrorMatches, `(?m)systemd-sysctl invoked with \[--prefix net\] failed with exit status 1: foo`)
+}
+
+func (s *sysctlSuite) TestMockSystemdSysctl(c *C) {
+	var capturedArgs []string
+	var sysctlErr error
+	r := systemd.MockSystemdSysctl(func(args ...string) error {
+		capturedArgs = args
+		return sysctlErr
+	})
+	defer r()
+
+	err := systemd.Sysctl([]string{"kernel.printk", "net"})
+	c.Assert(err, IsNil)
+
+	c.Check(capturedArgs, DeepEquals, []string{"--prefix", "kernel.printk", "--prefix", "net"})
+
+	sysctlErr = errors.New("boom")
+	err = systemd.Sysctl(nil)
+	c.Check(err, Equals, sysctlErr)
+	c.Check(capturedArgs, HasLen, 0)
+}
diff -Nru snapd-2.45.1+20.04.2/systemd/systemd.go snapd-2.48.3+20.04/systemd/systemd.go
--- snapd-2.45.1+20.04.2/systemd/systemd.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/systemd.go	2021-02-02 08:21:12.000000000 +0000
@@ -204,6 +204,10 @@
 type Systemd interface {
 	// DaemonReload reloads systemd's configuration.
 	DaemonReload() error
+	// DaemonRexec reexecutes systemd's system manager, should be
+	// only necessary to apply manager's configuration like
+	// watchdog.
+	DaemonReexec() error
 	// Enable the given service.
 	Enable(service string) error
 	// Disable the given service.
@@ -218,6 +222,10 @@
 	Kill(service, signal, who string) error
 	// Restart the service, waiting for it to stop before starting it again.
 	Restart(service string, timeout time.Duration) error
+	// Reload or restart the service via 'systemctl reload-or-restart'
+	ReloadOrRestart(service string) error
+	// RestartAll restarts the given service using systemctl restart --all
+	RestartAll(service string) error
 	// Status fetches the status of given units. Statuses are
 	// returned in the same order as unit names passed in
 	// argument.
@@ -236,6 +244,10 @@
 	Mask(service string) error
 	// Unmask the given service.
 	Unmask(service string) error
+	// Mount requests a mount of what under where with options.
+	Mount(what, where string, options ...string) error
+	// Umount requests a mount from what or at where to be unmounted.
+	Umount(whatOrWhere string) error
 }
 
 // A Log is a single entry in the systemd journal
@@ -253,14 +265,23 @@
 
 	// the default target for systemd timer units that we generate
 	TimersTarget = "timers.target"
+
+	// the target for systemd user session units that we generate
+	UserServicesTarget = "default.target"
 )
 
 type reporter interface {
 	Notify(string)
 }
 
-// New returns a Systemd that uses the given rootDir
-func New(rootDir string, mode InstanceMode, rep reporter) Systemd {
+// New returns a Systemd that uses the default root directory and omits
+// --root argument when executing systemctl.
+func New(mode InstanceMode, rep reporter) Systemd {
+	return &systemd{mode: mode, reporter: rep}
+}
+
+// NewUnderRoot returns a Systemd that operates on the given rootdir.
+func NewUnderRoot(rootDir string, mode InstanceMode, rep reporter) Systemd {
 	return &systemd{rootDir: rootDir, mode: mode, reporter: rep}
 }
 
@@ -279,7 +300,7 @@
 // InstanceMode determines which instance of systemd to control.
 //
 // SystemMode refers to the system instance (i.e. pid 1).  UserMode
-// refers to the the instance launched to manage the user's desktop
+// refers to the instance launched to manage the user's desktop
 // session.  GlobalUserMode controls configuration respected by all
 // user instances on the system.
 //
@@ -330,23 +351,54 @@
 	return err
 }
 
+func (s *systemd) DaemonReexec() error {
+	if s.mode == GlobalUserMode {
+		panic("cannot call daemon-reexec with GlobalUserMode")
+	}
+	daemonReloadLock.Lock()
+	defer daemonReloadLock.Unlock()
+
+	_, err := s.systemctl("daemon-reexec")
+	return err
+}
+
 func (s *systemd) Enable(serviceName string) error {
-	_, err := s.systemctl("--root", s.rootDir, "enable", serviceName)
+	var err error
+	if s.rootDir != "" {
+		_, err = s.systemctl("--root", s.rootDir, "enable", serviceName)
+	} else {
+		_, err = s.systemctl("enable", serviceName)
+	}
 	return err
 }
 
 func (s *systemd) Unmask(serviceName string) error {
-	_, err := s.systemctl("--root", s.rootDir, "unmask", serviceName)
+	var err error
+	if s.rootDir != "" {
+		_, err = s.systemctl("--root", s.rootDir, "unmask", serviceName)
+	} else {
+		_, err = s.systemctl("unmask", serviceName)
+	}
 	return err
 }
 
 func (s *systemd) Disable(serviceName string) error {
-	_, err := s.systemctl("--root", s.rootDir, "disable", serviceName)
+	var err error
+	if s.rootDir != "" {
+		_, err = s.systemctl("--root", s.rootDir, "disable", serviceName)
+	} else {
+		_, err = s.systemctl("disable", serviceName)
+	}
 	return err
 }
 
 func (s *systemd) Mask(serviceName string) error {
-	_, err := s.systemctl("--root", s.rootDir, "mask", serviceName)
+	var err error
+	if s.rootDir != "" {
+		_, err = s.systemctl("--root", s.rootDir, "mask", serviceName)
+	} else {
+		_, err = s.systemctl("mask", serviceName)
+	}
 	return err
 }
 
@@ -522,10 +574,12 @@
 }
 
 func (s *systemd) IsEnabled(serviceName string) (bool, error) {
-	if s.mode == GlobalUserMode {
-		panic("cannot call is-enabled with GlobalUserMode")
+	var err error
+	if s.rootDir != "" {
+		_, err = s.systemctl("--root", s.rootDir, "is-enabled", serviceName)
+	} else {
+		_, err = s.systemctl("is-enabled", serviceName)
 	}
-	_, err := s.systemctl("--root", s.rootDir, "is-enabled", serviceName)
 	if err == nil {
 		return true, nil
 	}
@@ -542,7 +596,12 @@
 	if s.mode == GlobalUserMode {
 		panic("cannot call is-active with GlobalUserMode")
 	}
-	_, err := s.systemctl("--root", s.rootDir, "is-active", serviceName)
+	var err error
+	if s.rootDir != "" {
+		_, err = s.systemctl("--root", s.rootDir, "is-active", serviceName)
+	} else {
+		_, err = s.systemctl("is-active", serviceName)
+	}
 	if err == nil {
 		return true, nil
 	}
@@ -623,6 +682,14 @@
 	return s.Start(serviceName)
 }
 
+func (s *systemd) RestartAll(serviceName string) error {
+	if s.mode == GlobalUserMode {
+		panic("cannot call restart with GlobalUserMode")
+	}
+	_, err := s.systemctl("restart", serviceName, "--all")
+	return err
+}
+
 type systemctlError interface {
 	Msg() []byte
 	ExitCode() int
@@ -718,28 +785,7 @@
 
 var squashfsFsType = squashfs.FsType
 
-func writeMountUnitFile(snapName, revision, what, where, fstype string) (mountUnitName, actualFsType string, options []string, err error) {
-	options = []string{"nodev"}
-	actualFsType = fstype
-	if fstype == "squashfs" {
-		newFsType, newOptions, err := squashfsFsType()
-		if err != nil {
-			return "", "", nil, err
-		}
-		options = append(options, newOptions...)
-		actualFsType = newFsType
-		if selinux.ProbedLevel() != selinux.Unsupported {
-			if mountCtx := selinux.SnapMountContext(); mountCtx != "" {
-				options = append(options, "context="+mountCtx)
-			}
-		}
-	}
-	if osutil.IsDirectory(what) {
-		options = append(options, "bind")
-		actualFsType = "none"
-	}
-
-	c := fmt.Sprintf(`[Unit]
+var mountUnitTemplate = `[Unit]
 Description=Mount unit for %s, revision %s
 Before=snapd.service
 
@@ -752,25 +798,58 @@
 
 [Install]
 WantedBy=multi-user.target
-`, snapName, revision, what, where, actualFsType, strings.Join(options, ","))
+`
 
+func writeMountUnitFile(snapName, revision, what, where, fstype string, options []string) (mountUnitName string, err error) {
+	content := fmt.Sprintf(mountUnitTemplate, snapName, revision, what, where, fstype, strings.Join(options, ","))
 	mu := MountUnitPath(where)
-	mountUnitName, err = filepath.Base(mu), osutil.AtomicWriteFile(mu, []byte(c), 0644, 0)
+	mountUnitName, err = filepath.Base(mu), osutil.AtomicWriteFile(mu, []byte(content), 0644, 0)
 	if err != nil {
-		return "", "", nil, err
+		return "", err
+	}
+	return mountUnitName, nil
+}
+
+func fsMountOptions(fstype string) []string {
+	options := []string{"nodev"}
+	if fstype == "squashfs" {
+		if selinux.ProbedLevel() != selinux.Unsupported {
+			if mountCtx := selinux.SnapMountContext(); mountCtx != "" {
+				options = append(options, "context="+mountCtx)
+			}
+		}
 	}
+	return options
+}
 
-	return mountUnitName, actualFsType, options, err
+// hostFsTypeAndMountOptions returns filesystem type and options to actually
+// mount the given fstype at runtime, i.e. it determines if fuse should be used
+// for squashfs.
+func hostFsTypeAndMountOptions(fstype string) (hostFsType string, options []string) {
+	options = fsMountOptions(fstype)
+	hostFsType = fstype
+	if fstype == "squashfs" {
+		newFsType, newOptions := squashfsFsType()
+		options = append(options, newOptions...)
+		hostFsType = newFsType
+	}
+	return hostFsType, options
 }
 
 func (s *systemd) AddMountUnitFile(snapName, revision, what, where, fstype string) (string, error) {
 	daemonReloadLock.Lock()
 	defer daemonReloadLock.Unlock()
 
-	mountUnitName, _, _, err := writeMountUnitFile(snapName, revision, what, where, fstype)
+	hostFsType, options := hostFsTypeAndMountOptions(fstype)
+	if osutil.IsDirectory(what) {
+		options = append(options, "bind")
+		hostFsType = "none"
+	}
+	mountUnitName, err := writeMountUnitFile(snapName, revision, what, where, hostFsType, options)
 	if err != nil {
 		return "", err
 	}
+
 	// we need to do a daemon-reload here to ensure that systemd really
 	// knows about this new mount unit file
 	if err := s.daemonReloadNoLock(); err != nil {
@@ -827,3 +906,30 @@
 
 	return nil
 }
+
+func (s *systemd) ReloadOrRestart(serviceName string) error {
+	if s.mode == GlobalUserMode {
+		panic("cannot call restart with GlobalUserMode")
+	}
+	_, err := s.systemctl("reload-or-restart", serviceName)
+	return err
+}
+
+func (s *systemd) Mount(what, where string, options ...string) error {
+	args := make([]string, 0, 2+len(options))
+	if len(options) > 0 {
+		args = append(args, options...)
+	}
+	args = append(args, what, where)
+	if output, err := exec.Command("systemd-mount", args...).CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
+
+func (s *systemd) Umount(whatOrWhere string) error {
+	if output, err := exec.Command("systemd-mount", "--umount", whatOrWhere).CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/systemd/systemd_test.go snapd-2.48.3+20.04/systemd/systemd_test.go
--- snapd-2.45.1+20.04.2/systemd/systemd_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/systemd/systemd_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -145,19 +145,25 @@
 }
 
 func (s *SystemdTestSuite) TestDaemonReload(c *C) {
-	err := New("", SystemMode, s.rep).DaemonReload()
+	err := New(SystemMode, s.rep).DaemonReload()
 	c.Assert(err, IsNil)
 	c.Assert(s.argses, DeepEquals, [][]string{{"daemon-reload"}})
 }
 
+func (s *SystemdTestSuite) TestDaemonReexec(c *C) {
+	err := New(SystemMode, s.rep).DaemonReexec()
+	c.Assert(err, IsNil)
+	c.Assert(s.argses, DeepEquals, [][]string{{"daemon-reexec"}})
+}
+
 func (s *SystemdTestSuite) TestStart(c *C) {
-	err := New("", SystemMode, s.rep).Start("foo")
+	err := New(SystemMode, s.rep).Start("foo")
 	c.Assert(err, IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"start", "foo"}})
 }
 
 func (s *SystemdTestSuite) TestStartMany(c *C) {
-	err := New("", SystemMode, s.rep).Start("foo", "bar", "baz")
+	err := New(SystemMode, s.rep).Start("foo", "bar", "baz")
 	c.Assert(err, IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"start", "foo", "bar", "baz"}})
 }
@@ -172,7 +178,7 @@
 		[]byte("ActiveState=inactive\n"),
 	}
 	s.errors = []error{nil, nil, nil, nil, &Timeout{}}
-	err := New("", SystemMode, s.rep).Stop("foo", 1*time.Second)
+	err := New(SystemMode, s.rep).Stop("foo", 1*time.Second)
 	c.Assert(err, IsNil)
 	c.Assert(s.argses, HasLen, 4)
 	c.Check(s.argses[0], DeepEquals, []string{"stop", "foo"})
@@ -210,7 +216,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service", "bar.service", "baz.service", "some.timer", "other.socket")
+	out, err := New(SystemMode, s.rep).Status("foo.service", "bar.service", "baz.service", "some.timer", "other.socket")
 	c.Assert(err, IsNil)
 	c.Check(out, DeepEquals, []*UnitStatus{
 		{
@@ -260,7 +266,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Check(err, ErrorMatches, "cannot get unit status: expected 1 results, got 2")
 	c.Check(out, IsNil)
 	c.Check(s.rep.msgs, IsNil)
@@ -277,7 +283,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Assert(err, ErrorMatches, `.* bad line "Potatoes" .*`)
 	c.Check(out, IsNil)
 }
@@ -292,7 +298,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Assert(err, ErrorMatches, `.* queried status of "foo.service" but got status of "bar.service"`)
 	c.Check(out, IsNil)
 }
@@ -308,7 +314,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Assert(err, ErrorMatches, `.* unexpected field "Potatoes" .*`)
 	c.Check(out, IsNil)
 }
@@ -321,7 +327,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Assert(err, ErrorMatches, `.* missing UnitFileState, Type .*`)
 	c.Check(out, IsNil)
 }
@@ -334,7 +340,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.timer")
+	out, err := New(SystemMode, s.rep).Status("foo.timer")
 	c.Assert(err, ErrorMatches, `.* missing UnitFileState .*`)
 	c.Check(out, IsNil)
 }
@@ -350,7 +356,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Assert(err, ErrorMatches, `.* duplicate field "ActiveState" .*`)
 	c.Check(out, IsNil)
 }
@@ -365,7 +371,7 @@
 `[1:]),
 	}
 	s.errors = []error{nil}
-	out, err := New("", SystemMode, s.rep).Status("foo.service")
+	out, err := New(SystemMode, s.rep).Status("foo.service")
 	c.Assert(err, ErrorMatches, `.* empty field "Id" .*`)
 	c.Check(out, IsNil)
 }
@@ -373,14 +379,20 @@
 func (s *SystemdTestSuite) TestStopTimeout(c *C) {
 	restore := MockStopDelays(time.Millisecond, 25*time.Second)
 	defer restore()
-	err := New("", SystemMode, s.rep).Stop("foo", 10*time.Millisecond)
+	err := New(SystemMode, s.rep).Stop("foo", 10*time.Millisecond)
 	c.Assert(err, FitsTypeOf, &Timeout{})
 	c.Assert(len(s.rep.msgs) > 0, Equals, true)
 	c.Check(s.rep.msgs[0], Equals, "Waiting for foo to stop.")
 }
 
 func (s *SystemdTestSuite) TestDisable(c *C) {
-	err := New("xyzzy", SystemMode, s.rep).Disable("foo")
+	err := New(SystemMode, s.rep).Disable("foo")
+	c.Assert(err, IsNil)
+	c.Check(s.argses, DeepEquals, [][]string{{"disable", "foo"}})
+}
+
+func (s *SystemdTestSuite) TestUnderRootDisable(c *C) {
+	err := NewUnderRoot("xyzzy", SystemMode, s.rep).Disable("foo")
 	c.Assert(err, IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "disable", "foo"}})
 }
@@ -428,19 +440,37 @@
 }
 
 func (s *SystemdTestSuite) TestEnable(c *C) {
-	err := New("xyzzy", SystemMode, s.rep).Enable("foo")
+	err := New(SystemMode, s.rep).Enable("foo")
+	c.Assert(err, IsNil)
+	c.Check(s.argses, DeepEquals, [][]string{{"enable", "foo"}})
+}
+
+func (s *SystemdTestSuite) TestEnableUnderRoot(c *C) {
+	err := NewUnderRoot("xyzzy", SystemMode, s.rep).Enable("foo")
 	c.Assert(err, IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "enable", "foo"}})
 }
 
 func (s *SystemdTestSuite) TestMask(c *C) {
-	err := New("xyzzy", SystemMode, s.rep).Mask("foo")
+	err := New(SystemMode, s.rep).Mask("foo")
+	c.Assert(err, IsNil)
+	c.Check(s.argses, DeepEquals, [][]string{{"mask", "foo"}})
+}
+
+func (s *SystemdTestSuite) TestMaskUnderRoot(c *C) {
+	err := NewUnderRoot("xyzzy", SystemMode, s.rep).Mask("foo")
 	c.Assert(err, IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "mask", "foo"}})
 }
 
 func (s *SystemdTestSuite) TestUnmask(c *C) {
-	err := New("xyzzy", SystemMode, s.rep).Unmask("foo")
+	err := New(SystemMode, s.rep).Unmask("foo")
+	c.Assert(err, IsNil)
+	c.Check(s.argses, DeepEquals, [][]string{{"unmask", "foo"}})
+}
+
+func (s *SystemdTestSuite) TestUnmaskUnderRoot(c *C) {
+	err := NewUnderRoot("xyzzy", SystemMode, s.rep).Unmask("foo")
 	c.Assert(err, IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "unmask", "foo"}})
 }
@@ -454,7 +484,7 @@
 		nil, // for the "start"
 	}
 	s.errors = []error{nil, nil, nil, nil, &Timeout{}}
-	err := New("", SystemMode, s.rep).Restart("foo", 100*time.Millisecond)
+	err := New(SystemMode, s.rep).Restart("foo", 100*time.Millisecond)
 	c.Assert(err, IsNil)
 	c.Check(s.argses, HasLen, 3)
 	c.Check(s.argses[0], DeepEquals, []string{"stop", "foo"})
@@ -463,7 +493,7 @@
 }
 
 func (s *SystemdTestSuite) TestKill(c *C) {
-	c.Assert(New("", SystemMode, s.rep).Kill("foo", "HUP", ""), IsNil)
+	c.Assert(New(SystemMode, s.rep).Kill("foo", "HUP", ""), IsNil)
 	c.Check(s.argses, DeepEquals, [][]string{{"kill", "foo", "-s", "HUP", "--kill-who=all"}})
 }
 
@@ -475,7 +505,7 @@
 func (s *SystemdTestSuite) TestLogErrJctl(c *C) {
 	s.jerrs = []error{&Timeout{}}
 
-	reader, err := New("", SystemMode, s.rep).LogReader([]string{"foo"}, 24, false)
+	reader, err := New(SystemMode, s.rep).LogReader([]string{"foo"}, 24, false)
 	c.Check(err, NotNil)
 	c.Check(reader, IsNil)
 	c.Check(s.jns, DeepEquals, []string{"24"})
@@ -490,7 +520,7 @@
 `
 	s.jouts = [][]byte{[]byte(expected)}
 
-	reader, err := New("", SystemMode, s.rep).LogReader([]string{"foo"}, 24, false)
+	reader, err := New(SystemMode, s.rep).LogReader([]string{"foo"}, 24, false)
 	c.Check(err, IsNil)
 	logs, err := ioutil.ReadAll(reader)
 	c.Assert(err, IsNil)
@@ -548,7 +578,7 @@
 	mockSnapPath := filepath.Join(c.MkDir(), "/var/lib/snappy/snaps/foo_1.0.snap")
 	makeMockFile(c, mockSnapPath)
 
-	mountUnitName, err := New(rootDir, SystemMode, nil).AddMountUnitFile("foo", "42", mockSnapPath, "/snap/snapname/123", "squashfs")
+	mountUnitName, err := NewUnderRoot(rootDir, SystemMode, nil).AddMountUnitFile("foo", "42", mockSnapPath, "/snap/snapname/123", "squashfs")
 	c.Assert(err, IsNil)
 	defer os.Remove(mountUnitName)
 
@@ -581,7 +611,7 @@
 
 	// a directory instead of a file produces a different output
 	snapDir := c.MkDir()
-	mountUnitName, err := New("", SystemMode, nil).AddMountUnitFile("foodir", "x1", snapDir, "/snap/snapname/x1", "squashfs")
+	mountUnitName, err := New(SystemMode, nil).AddMountUnitFile("foodir", "x1", snapDir, "/snap/snapname/x1", "squashfs")
 	c.Assert(err, IsNil)
 	defer os.Remove(mountUnitName)
 
@@ -603,7 +633,7 @@
 
 	c.Assert(s.argses, DeepEquals, [][]string{
 		{"daemon-reload"},
-		{"--root", "", "enable", "snap-snapname-x1.mount"},
+		{"enable", "snap-snapname-x1.mount"},
 		{"start", "snap-snapname-x1.mount"},
 	})
 }
@@ -622,7 +652,7 @@
 	err = ioutil.WriteFile(mockSnapPath, nil, 0644)
 	c.Assert(err, IsNil)
 
-	mountUnitName, err := New("", SystemMode, nil).AddMountUnitFile("foo", "42", mockSnapPath, "/snap/snapname/123", "squashfs")
+	mountUnitName, err := New(SystemMode, nil).AddMountUnitFile("foo", "42", mockSnapPath, "/snap/snapname/123", "squashfs")
 	c.Assert(err, IsNil)
 	defer os.Remove(mountUnitName)
 
@@ -635,7 +665,7 @@
 What=%s
 Where=/snap/snapname/123
 Type=squashfs
-Options=nodev,ro,x-gdu.hide,context=system_u:object_r:snappy_snap_t:s0
+Options=nodev,context=system_u:object_r:snappy_snap_t:s0,ro,x-gdu.hide
 LazyUnmount=yes
 
 [Install]
@@ -665,7 +695,7 @@
 	err = ioutil.WriteFile(mockSnapPath, nil, 0644)
 	c.Assert(err, IsNil)
 
-	mountUnitName, err := New("", SystemMode, nil).AddMountUnitFile("foo", "x1", mockSnapPath, "/snap/snapname/123", "squashfs")
+	mountUnitName, err := New(SystemMode, nil).AddMountUnitFile("foo", "x1", mockSnapPath, "/snap/snapname/123", "squashfs")
 	c.Assert(err, IsNil)
 	defer os.Remove(mountUnitName)
 
@@ -704,7 +734,7 @@
 	err = ioutil.WriteFile(mockSnapPath, nil, 0644)
 	c.Assert(err, IsNil)
 
-	mountUnitName, err := New("", SystemMode, nil).AddMountUnitFile("foo", "x1", mockSnapPath, "/snap/snapname/123", "squashfs")
+	mountUnitName, err := New(SystemMode, nil).AddMountUnitFile("foo", "x1", mockSnapPath, "/snap/snapname/123", "squashfs")
 	c.Assert(err, IsNil)
 	defer os.Remove(mountUnitName)
 
@@ -745,6 +775,19 @@
 	c.Check(args, DeepEquals, []string{"-o", "json", "--no-pager", "--no-tail", "-u", "foo", "-u", "bar"})
 }
 
+func (s *SystemdTestSuite) TestIsActiveUnderRoot(c *C) {
+	sysErr := &Error{}
+	// manpage states that systemctl returns exit code 3 for inactive
+	// services, however we should check any non-0 exit status
+	sysErr.SetExitCode(1)
+	sysErr.SetMsg([]byte("inactive\n"))
+	s.errors = []error{sysErr}
+
+	_, err := NewUnderRoot("xyzzy", SystemMode, s.rep).IsActive("foo")
+	c.Assert(err, IsNil)
+	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "is-active", "foo"}})
+}
+
 func (s *SystemdTestSuite) TestIsActiveIsInactive(c *C) {
 	sysErr := &Error{}
 	// manpage states that systemctl returns exit code 3 for inactive
@@ -753,10 +796,10 @@
 	sysErr.SetMsg([]byte("inactive\n"))
 	s.errors = []error{sysErr}
 
-	active, err := New("xyzzy", SystemMode, s.rep).IsActive("foo")
+	active, err := New(SystemMode, s.rep).IsActive("foo")
 	c.Assert(active, Equals, false)
 	c.Assert(err, IsNil)
-	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "is-active", "foo"}})
+	c.Check(s.argses, DeepEquals, [][]string{{"is-active", "foo"}})
 }
 
 func (s *SystemdTestSuite) TestIsActiveIsFailed(c *C) {
@@ -766,19 +809,19 @@
 	sysErr.SetMsg([]byte("failed\n"))
 	s.errors = []error{sysErr}
 
-	active, err := New("xyzzy", SystemMode, s.rep).IsActive("foo")
+	active, err := New(SystemMode, s.rep).IsActive("foo")
 	c.Assert(active, Equals, false)
 	c.Assert(err, IsNil)
-	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "is-active", "foo"}})
+	c.Check(s.argses, DeepEquals, [][]string{{"is-active", "foo"}})
 }
 
 func (s *SystemdTestSuite) TestIsActiveIsActive(c *C) {
 	s.errors = []error{nil}
 
-	active, err := New("xyzzy", SystemMode, s.rep).IsActive("foo")
+	active, err := New(SystemMode, s.rep).IsActive("foo")
 	c.Assert(active, Equals, true)
 	c.Assert(err, IsNil)
-	c.Check(s.argses, DeepEquals, [][]string{{"--root", "xyzzy", "is-active", "foo"}})
+	c.Check(s.argses, DeepEquals, [][]string{{"is-active", "foo"}})
 }
 
 func (s *SystemdTestSuite) TestIsActiveUnexpectedErr(c *C) {
@@ -787,7 +830,7 @@
 	sysErr.SetMsg([]byte("random-failure\n"))
 	s.errors = []error{sysErr}
 
-	active, err := New("xyzzy", SystemMode, s.rep).IsActive("foo")
+	active, err := NewUnderRoot("xyzzy", SystemMode, s.rep).IsActive("foo")
 	c.Assert(active, Equals, false)
 	c.Assert(err, ErrorMatches, ".* failed with exit status 1: random-failure\n")
 }
@@ -808,7 +851,7 @@
 
 	mountDir := rootDir + "/snap/foo/42"
 	mountUnit := makeMockMountUnit(c, mountDir)
-	err := New(rootDir, SystemMode, nil).RemoveMountUnitFile(mountDir)
+	err := NewUnderRoot(rootDir, SystemMode, nil).RemoveMountUnitFile(mountDir)
 
 	c.Assert(err, IsNil)
 	// the file is gone
@@ -821,8 +864,12 @@
 }
 
 func (s *SystemdTestSuite) TestDaemonReloadMutex(c *C) {
+	s.testDaemonReloadMutex(c, Systemd.DaemonReload)
+}
+
+func (s *SystemdTestSuite) testDaemonReloadMutex(c *C, reload func(Systemd) error) {
 	rootDir := dirs.GlobalRootDir
-	sysd := New(rootDir, SystemMode, nil)
+	sysd := NewUnderRoot(rootDir, SystemMode, nil)
 
 	mockSnapPath := filepath.Join(c.MkDir(), "/var/lib/snappy/snaps/foo_1.0.snap")
 	makeMockFile(c, mockSnapPath)
@@ -853,9 +900,13 @@
 	<-stoppedCh
 }
 
+func (s *SystemdTestSuite) TestDaemonReexecMutex(c *C) {
+	s.testDaemonReloadMutex(c, Systemd.DaemonReexec)
+}
+
 func (s *SystemdTestSuite) TestUserMode(c *C) {
 	rootDir := dirs.GlobalRootDir
-	sysd := New(rootDir, UserMode, nil)
+	sysd := NewUnderRoot(rootDir, UserMode, nil)
 
 	c.Assert(sysd.Enable("foo"), IsNil)
 	c.Check(s.argses[0], DeepEquals, []string{"--user", "--root", rootDir, "enable", "foo"})
@@ -865,7 +916,7 @@
 
 func (s *SystemdTestSuite) TestGlobalUserMode(c *C) {
 	rootDir := dirs.GlobalRootDir
-	sysd := New(rootDir, GlobalUserMode, nil)
+	sysd := NewUnderRoot(rootDir, GlobalUserMode, nil)
 
 	c.Assert(sysd.Enable("foo"), IsNil)
 	c.Check(s.argses[0], DeepEquals, []string{"--user", "--global", "--root", rootDir, "enable", "foo"})
@@ -875,16 +926,19 @@
 	c.Check(s.argses[2], DeepEquals, []string{"--user", "--global", "--root", rootDir, "mask", "foo"})
 	c.Assert(sysd.Unmask("foo"), IsNil)
 	c.Check(s.argses[3], DeepEquals, []string{"--user", "--global", "--root", rootDir, "unmask", "foo"})
+	_, err := sysd.IsEnabled("foo")
+	c.Check(err, IsNil)
+	c.Check(s.argses[4], DeepEquals, []string{"--user", "--global", "--root", rootDir, "is-enabled", "foo"})
 
 	// Commands that don't make sense for GlobalUserMode panic
 	c.Check(sysd.DaemonReload, Panics, "cannot call daemon-reload with GlobalUserMode")
+	c.Check(sysd.DaemonReexec, Panics, "cannot call daemon-reexec with GlobalUserMode")
 	c.Check(func() { sysd.Start("foo") }, Panics, "cannot call start with GlobalUserMode")
 	c.Check(func() { sysd.StartNoBlock("foo") }, Panics, "cannot call start with GlobalUserMode")
 	c.Check(func() { sysd.Stop("foo", 0) }, Panics, "cannot call stop with GlobalUserMode")
 	c.Check(func() { sysd.Restart("foo", 0) }, Panics, "cannot call restart with GlobalUserMode")
 	c.Check(func() { sysd.Kill("foo", "HUP", "") }, Panics, "cannot call kill with GlobalUserMode")
 	c.Check(func() { sysd.Status("foo") }, Panics, "cannot call status with GlobalUserMode")
-	c.Check(func() { sysd.IsEnabled("foo") }, Panics, "cannot call is-enabled with GlobalUserMode")
 	c.Check(func() { sysd.IsActive("foo") }, Panics, "cannot call is-active with GlobalUserMode")
 }
 
@@ -932,7 +986,7 @@
 func (s *SystemdTestSuite) TestPreseedModeAddMountUnitWithFuse(c *C) {
 	sysd := NewEmulationMode(dirs.GlobalRootDir)
 
-	restore := MockSquashFsType(func() (string, []string, error) { return "fuse.squashfuse", []string{"a,b,c"}, nil })
+	restore := MockSquashFsType(func() (string, []string) { return "fuse.squashfuse", []string{"a,b,c"} })
 	defer restore()
 
 	mockMountCmd := testutil.MockCommand(c, "mount", "")
@@ -946,7 +1000,7 @@
 	defer os.Remove(mountUnitName)
 
 	c.Check(mockMountCmd.Calls()[0], DeepEquals, []string{"mount", "-t", "fuse.squashfuse", mockSnapPath, "/snap/snapname/123", "-o", "nodev,a,b,c"})
-	c.Check(filepath.Join(dirs.SnapServicesDir, mountUnitName), testutil.FileEquals, fmt.Sprintf(unitTemplate[1:], mockSnapPath, "fuse.squashfuse", "nodev,a,b,c"))
+	c.Check(filepath.Join(dirs.SnapServicesDir, mountUnitName), testutil.FileEquals, fmt.Sprintf(unitTemplate[1:], mockSnapPath, "squashfs", "nodev,ro,x-gdu.hide"))
 }
 
 func (s *SystemdTestSuite) TestPreseedModeMountError(c *C) {
@@ -1069,3 +1123,58 @@
 	c.Check(s.argses, DeepEquals, [][]string{
 		{"--root", "/path", "unmask", "foo"}})
 }
+
+func (s *SystemdTestSuite) TestMountHappy(c *C) {
+	sysd := New(SystemMode, nil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "")
+	defer cmd.Restore()
+
+	c.Assert(sysd.Mount("foo", "bar"), IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "foo", "bar"},
+	})
+	cmd.ForgetCalls()
+	c.Assert(sysd.Mount("foo", "bar", "-o", "bind"), IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "-o", "bind", "foo", "bar"},
+	})
+}
+
+func (s *SystemdTestSuite) TestMountErr(c *C) {
+	sysd := New(SystemMode, nil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", `echo "failed"; exit 111`)
+	defer cmd.Restore()
+
+	err := sysd.Mount("foo", "bar")
+	c.Assert(err, ErrorMatches, "failed")
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "foo", "bar"},
+	})
+}
+
+func (s *SystemdTestSuite) TestUmountHappy(c *C) {
+	sysd := New(SystemMode, nil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", "")
+	defer cmd.Restore()
+
+	c.Assert(sysd.Umount("bar"), IsNil)
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "--umount", "bar"},
+	})
+}
+
+func (s *SystemdTestSuite) TestUmountErr(c *C) {
+	sysd := New(SystemMode, nil)
+
+	cmd := testutil.MockCommand(c, "systemd-mount", `echo "failed"; exit 111`)
+	defer cmd.Restore()
+
+	err := sysd.Umount("bar")
+	c.Assert(err, ErrorMatches, "failed")
+	c.Check(cmd.Calls(), DeepEquals, [][]string{
+		{"systemd-mount", "--umount", "bar"},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/tests/bin/any-python snapd-2.48.3+20.04/tests/bin/any-python
--- snapd-2.45.1+20.04.2/tests/bin/any-python	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/any-python	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Use any-python as interpreter in portable Python scripts.
+# Instead of /usr/bin/env python use /usr/bin/env any-python
+# The preferred choices are: Python 3, Python 2, anything called "python"
+py3="$(command -v python3)"
+py2="$(command -v python2)"
+py_dunno="$(command -v python)"
+if [ -n "$py3" ]; then
+    exec "$py3" "$@"
+elif [ -n "$py2" ]; then
+	exec "$py2" "$@"
+elif [ -n "$py_dunno" ]; then
+	exec "$py_dunno" "$@"
+else
+	echo "cannot find any Python installation" >&2
+	exit 1
+fi
diff -Nru snapd-2.45.1+20.04.2/tests/bin/MATCH snapd-2.48.3+20.04/tests/bin/MATCH
--- snapd-2.45.1+20.04.2/tests/bin/MATCH	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/MATCH	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Source spread-funcs.sh which, at runtime, contains the real definition of
+# MATCH and execute it.
+
+# shellcheck source=tests/lib/spread-funcs.sh 
+. "$TESTSLIB/spread-funcs.sh"
+
+MATCH "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/mountinfo.query snapd-2.48.3+20.04/tests/bin/mountinfo.query
--- snapd-2.45.1+20.04.2/tests/bin/mountinfo.query	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/mountinfo.query	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1325 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+from argparse import Action, ArgumentParser, FileType, RawTextHelpFormatter, SUPPRESS
+import re
+import sys
+import unittest
+
+# PY2 is true when we're running under Python 2.x It is used for appropriate
+# return value selection of __str__ and __repr_ methods, which must both
+# return str, not unicode (in Python 2) and str (in Python 3). In both cases
+# the return type annotation is exactly the same, but due to unicode_literals
+# being in effect, and the fact we often use a format string (which is an
+# unicode string in Python 2), we must encode the it to byte string when
+# running under Python 2.
+PY2 = sys.version_info[0] == 2
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import Any, Dict, List, Text, Tuple, Match, Optional, Union, Sequence
+    from argparse import Namespace
+
+
+class sint(int):
+    """sint is an integer that always renders with sign."""
+
+    def __str__(self):
+        # type: () -> str
+        result = "{:+}".format(int(self))
+        if PY2:
+            return result.encode()
+        return result
+
+    def __repr__(self):
+        # type: () -> str
+        result = "sint({:+})".format(int(self))
+        if PY2:
+            return result.encode()
+        return result
+
+
+class SintTests(unittest.TestCase):
+    def test_smoke(self):
+        # type: () -> None
+        self.assertEqual(sint(1), 1)
+        self.assertEqual(sint(-1), -1)
+        self.assertEqual(hash(sint(1)), hash(1))
+
+    def test_str(self):
+        # type: () -> None
+        self.assertEqual("{}".format(sint(1)), "+1")
+        self.assertEqual("{}".format(sint(-1)), "-1")
+
+    def test_repor(self):
+        # type: () -> None
+        self.assertEqual("{!r}".format(sint(1)), "sint(+1)")
+        self.assertEqual("{!r}".format(sint(-1)), "sint(-1)")
+
+
+class Device(object):
+    """Device is a device number with major and minor components."""
+
+    def __init__(self, major, minor):
+        # type: (int, int) -> None
+        self.major = major
+        self.minor = minor
+
+    def __hash__(self):
+        # type: () -> int
+        return hash((self.major, self.minor))
+
+    def __eq__(self, other):
+        # type: (object) -> Union[NotImplemented, bool]
+        if not isinstance(other, Device):
+            return NotImplemented
+        return self.major == other.major and self.minor == other.minor
+
+    def __str__(self):
+        # type: () -> str
+        result = "{}:{}".format(self.major, self.minor)
+        if PY2:
+            return result.encode()
+        return result
+
+    def __repr__(self):
+        # type: () -> str
+        result = "Device({}, {})".format(self.major, self.minor)
+        if PY2:
+            return result.encode()
+        return result
+
+    @classmethod
+    def differentiate(cls, a, b):
+        # type: (Device, Device) -> Device
+        return cls(sint(a.major - b.major), sint(a.minor - b.minor))
+
+
+def _format_opt_fields(fields):
+    # type: (List[Text]) -> str
+    """_format_opt_fields returns the special formatting of optional fields."""
+    if len(fields):
+        result = " ".join(fields) + " -"
+    else:
+        result = "-"
+    if PY2:
+        return result.encode()
+    return result
+
+
+def _diff_opt_fields(a, b):
+    # type: (List[Text], List[Text]) -> List[Text]
+    if len(a) != len(b):
+        return a
+    diff = []  # type: List[Text]
+    for elem_a, elem_b in zip(a, b):
+        key_a, value_a = elem_a.split(":", 1)
+        key_b, value_b = elem_b.split(":", 1)
+        if key_a != key_b:
+            return a
+        try:
+            value_a_int = int(value_a)
+            value_b_int = int(value_b)
+        except ValueError:
+            return a
+        diff.append("{}:{}".format(key_a, sint(value_a_int - value_b_int)))
+    return diff
+
+
+class DifferntiateOptionalFieldsTest(unittest.TestCase):
+    def test_ok(self):
+        # type: () -> None
+        a = OptionalFields(["master:6"])
+        b = OptionalFields(["master:5"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:+1"]))
+
+    def test_ok_many(self):
+        # type: () -> None
+        a = OptionalFields(["master:6", "shared:10"])
+        b = OptionalFields(["master:5", "shared:7"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:+1", "shared:+3"]))
+
+    def test_different_lengths(self):
+        # type: () -> None
+        a = OptionalFields(["master:6", "shared:2"])
+        b = OptionalFields(["shared:7"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:6", "shared:2"]))
+
+    def test_different_keys(self):
+        # type: () -> None
+        a = OptionalFields(["master:6"])
+        b = OptionalFields(["shared:7"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:6"]))
+
+    def test_non_numeric_value(self):
+        # type: () -> None
+        a = OptionalFields(["master:9"])
+        b = OptionalFields(["master:nan"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:9"]))
+
+
+# OptionalFields is a specialization of List[Text] but because of some Python 2
+# distributions lacking the typing module, we must define a variant for mypy
+# and one for without mypy. In both cases the customized formatting logic is
+# implemented by _format_opt_fields().
+if MYPY:
+
+    class OptionalFields(List[Text]):
+        def __str__(self):
+            # type: () -> str
+            return _format_opt_fields(self)
+
+        @classmethod
+        def differentiate(cls, a, b):
+            # type: (OptionalFields, OptionalFields) -> OptionalFields
+            return cls(_diff_opt_fields(a, b))
+
+
+else:
+
+    class OptionalFields(list):
+        def __str__(self):
+            # type: () -> str
+            return _format_opt_fields(self)
+
+        @classmethod
+        def differentiate(cls, a, b):
+            # type: (OptionalFields, OptionalFields) -> OptionalFields
+            return cls(_diff_opt_fields(a, b))
+
+
+class OptionalFieldsTests(unittest.TestCase):
+    def test_str(self):
+        # type: () -> None
+        fields = OptionalFields()
+        self.assertEqual("{}".format(fields), "-")
+        fields.append("master:123")
+        self.assertEqual("{}".format(fields), "master:123 -")
+
+
+class MountInfoEntry(object):
+    """Single entry in /proc/pid/mointinfo, see proc(5)"""
+
+    known_attrs = {
+        "mount_id": int,
+        "parent_id": int,
+        "dev": Device,
+        "root_dir": str,
+        "mount_point": str,
+        "mount_opts": str,
+        "opt_fields": list,
+        "fs_type": str,
+        "mount_source": str,
+        "sb_opts": str,
+    }
+
+    def __init__(self):
+        # type: () -> None
+        self.mount_id = 0
+        self.parent_id = 0
+        self.dev = Device(0, 0)
+        self.root_dir = ""
+        self.mount_point = ""
+        self.mount_opts = ""
+        self.opt_fields = OptionalFields()  # type: OptionalFields
+        self.fs_type = ""
+        self.mount_source = ""
+        self.sb_opts = ""
+        # Attributes beyond this line do not represent kernel state.
+        # Marker for an entry being matched by a filter.
+        self.matched = False
+
+    @classmethod
+    def differentiate(cls, a, b):
+        # type: (MountInfoEntry, MountInfoEntry) -> MountInfoEntry
+        diff = MountInfoEntry()
+        diff.matched = a.matched
+        # Diff all the attributes that it makes sense to diff
+        diff.mount_id = sint(a.mount_id - b.mount_id)
+        diff.parent_id = sint(a.parent_id - b.parent_id)
+        diff.dev = Device.differentiate(a.dev, b.dev)
+        diff.root_dir = a.root_dir
+        diff.mount_point = a.mount_point
+        diff.mount_opts = a.mount_opts
+        diff.opt_fields = OptionalFields.differentiate(a.opt_fields, b.opt_fields)
+        diff.fs_type = a.fs_type
+        diff.mount_source = a.mount_source
+        diff.sb_opts = a.sb_opts
+        return diff
+
+    def __eq__(self, other):
+        # type: (object) -> Union[NotImplemented, bool]
+        if not isinstance(other, MountInfoEntry):
+            return NotImplemented
+        return (
+            self.mount_id == other.mount_id
+            and self.parent_id == other.parent_id
+            and self.dev == other.dev
+            and self.root_dir == other.root_dir
+            and self.mount_point == other.mount_point
+            and self.mount_opts == other.mount_opts
+            and self.opt_fields == other.opt_fields
+            and self.fs_type == other.fs_type
+            and self.mount_source == other.mount_source
+            and self.sb_opts == other.sb_opts
+        )
+
+    @classmethod
+    def parse(cls, line):
+        # type: (Text) -> MountInfoEntry
+        it = iter(line.split())
+        self = cls()
+        self.mount_id = int(next(it))
+        self.parent_id = int(next(it))
+        dev_maj, dev_min = map(int, next(it).split(":"))
+        self.dev = Device(dev_maj, dev_min)
+        self.root_dir = next(it)
+        self.mount_point = next(it)
+        self.mount_opts = next(it)
+        self.opt_fields = OptionalFields()
+        for opt_field in it:
+            if opt_field == "-":
+                break
+            self.opt_fields.append(opt_field)
+        self.fs_type = next(it)
+        self.mount_source = next(it)
+        self.sb_opts = next(it)
+        try:
+            next(it)
+        except StopIteration:
+            pass
+        else:
+            raise ValueError("leftovers after parsing {!r}".format(line))
+        return self
+
+    def __str__(self):
+        # type: () -> str
+        result = (
+            "{0.mount_id} {0.parent_id} {0.dev} {0.root_dir}"
+            " {0.mount_point} {0.mount_opts} {0.opt_fields} {0.fs_type}"
+            " {0.mount_source} {0.sb_opts}"
+        ).format(self)
+        if PY2:
+            return result.encode()
+        return result
+
+    def __repr__(self):
+        # type: () -> str
+        result = "MountInfoEntry.parse({!r})".format(str(self))
+        if PY2:
+            return result.encode()
+        return result
+
+    @property
+    def dev_maj(self):
+        # type: () -> int
+        return self.dev.major
+
+    @property
+    def dev_min(self):
+        # type: () -> int
+        return self.dev.minor
+
+
+class FilterExpr(object):
+    """FilterExpr is the interface for filtering mount entries."""
+
+    def __contains__(self, entry):
+        # type: (MountInfoEntry) -> bool
+        """__contains__ returns true if a mount entry matches the filter."""
+
+
+class AttrFilter(FilterExpr):
+    """AttrFilter performs equality test against a given attribute."""
+
+    def __init__(self, attr, value):
+        # type: (Text, Any) -> None
+        self.attr = attr
+        self.value = value
+
+    def __contains__(self, entry):
+        # type: (MountInfoEntry) -> bool
+        value = getattr(entry, self.attr)
+        return bool(value == self.value)
+
+
+class AttrPrefixFilter(FilterExpr):
+    """AttrPrefixFilter performs prefix test against a given attribute."""
+
+    def __init__(self, attr, value):
+        # type: (Text, Text) -> None
+        self.attr = attr
+        self.value = value
+
+    def __contains__(self, entry):
+        # type: (MountInfoEntry) -> bool
+        value = str(getattr(entry, self.attr))
+        return value.startswith(self.value)
+
+
+def parse_filter(expr):
+    # type: (Text) -> FilterExpr
+    """parse_filter parses one of the known filter expressions."""
+    if "=" in expr:
+        # Accept both .attr=value and attr=value as exact attribute match.
+        if expr.startswith("."):
+            expr = expr.lstrip(".")
+        attr, value = expr.split("=", 1)
+        try:
+            typ = MountInfoEntry.known_attrs[attr]
+        except KeyError:
+            raise ValueError("invalid filter expression {!r}".format(expr))
+        else:
+            return AttrFilter(attr, typ(value))
+    elif expr.endswith("..."):
+        # Treat /path/... as prefix match on mount_point.
+        return AttrPrefixFilter("mount_point", expr.rstrip("..."))
+    else:
+        # Treat /path as exact match on mount_point.
+        return AttrFilter("mount_point", expr)
+
+
+def parse_attr(expr):
+    # type: (Text) -> Text
+    """parse_attr parses attribute references (for display)."""
+    known = sorted(MountInfoEntry.known_attrs)
+    if expr.lstrip(".") in known:
+        return expr.lstrip(".")
+    raise ValueError(
+        "invalid attribute selector {!r}" " (known: {})".format(expr, known)
+    )
+
+
+def parse_exprs(exprs):
+    # type: (List[Text]) -> Tuple[List[FilterExpr], List[Text]]
+    """parse_exprs parses filter expressions and attribute references."""
+    # Filters are either .attr=value, /path, /path...
+    filters = [
+        parse_filter(expr) for expr in exprs if "=" in expr or not expr.startswith(".")
+    ]
+    # Attributes are always .attr
+    attrs = [
+        parse_attr(expr) for expr in exprs if expr.startswith(".") and "=" not in expr
+    ]
+    return filters, attrs
+
+
+def matches(entry, filters):
+    # type: (MountInfoEntry, List[FilterExpr]) -> bool
+    """
+    matches checks if a mount entry matches a list of filter expressions.
+    Filter expressions are ANDed together.
+    """
+    for f in filters:
+        if entry not in f:
+            return False
+    return True
+
+
+def renumber_snap_revision(entry, seen):
+    # type: (MountInfoEntry, Dict[Tuple[Text, Text], int]) -> None
+    """renumber_snap_revisions re-numbers snap revision numbers in paths."""
+
+    def compose_preferred(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:3] + ["{}".format(n)] + parts[4:]
+
+    def compose_alternate(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:6] + ["{}".format(n)] + parts[7:]
+
+    def compose_hostfs_preferred(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:7] + ["{}".format(n)] + parts[8:]
+
+    def compose_hostfs_alternate(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:10] + ["{}".format(n)] + parts[11:]
+
+    def compose_writable(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:5] + ["{}".format(n)] + parts[6:]
+
+    def compose_hostfs_writable(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:9] + ["{}".format(n)] + parts[10:]
+
+    def alloc_n(snap_name, snap_rev):
+        # type: (Text, Text) -> int
+        key = (snap_name, snap_rev)
+        try:
+            return seen[key]
+        except KeyError:
+            n = len([name for (name, rev) in seen if name == snap_name]) + 1
+            seen[key] = n
+            return n
+
+    parts = entry.mount_point.split("/")
+    if len(parts) >= 4 and parts[:2] == ["", "snap"]:
+        snap_name = parts[2]
+        snap_rev = parts[3]
+        compose = compose_preferred
+    elif len(parts) >= 7 and parts[:5] == ["", "var", "lib", "snapd", "snap"]:
+        snap_name = parts[5]
+        snap_rev = parts[6]
+        compose = compose_alternate
+    elif len(parts) >= 6 and parts[:4] == ["", "writable", "system-data", "snap"]:
+        snap_name = parts[4]
+        snap_rev = parts[5]
+        compose = compose_writable
+    elif len(parts) >= 8 and parts[:6] == ["", "var", "lib", "snapd", "hostfs", "snap"]:
+        snap_name = parts[6]
+        snap_rev = parts[7]
+        compose = compose_hostfs_preferred
+    elif len(parts) >= 11 and parts[:9] == [
+        "",
+        "var",
+        "lib",
+        "snapd",
+        "hostfs",
+        "var",
+        "lib",
+        "snapd",
+        "snap",
+    ]:
+        snap_name = parts[9]
+        snap_rev = parts[10]
+        compose = compose_hostfs_alternate
+    elif len(parts) >= 10 and parts[:8] == [
+        "",  # 0
+        "var",  # 1
+        "lib",  # 2
+        "snapd",  # 3
+        "hostfs",  # 4
+        "writable",  # 5
+        "system-data",  # 6
+        "snap",  # 7
+    ]:
+        snap_name = parts[8]
+        snap_rev = parts[9]
+        compose = compose_hostfs_writable
+    else:
+        return
+    n = alloc_n(snap_name, snap_rev)
+    entry.mount_point = "/".join(compose(parts, n))
+
+
+def renumber_opt_fields(entry, seen, base_n):
+    # type: (MountInfoEntry, Dict[int, int], int) -> None
+    """renumber_opt_fields re-numbers peer group in optional fields."""
+
+    def alloc_n(peer_group):
+        # type: (int) -> int
+        key = peer_group
+        try:
+            return seen[key]
+        except KeyError:
+            n = (
+                len({orig for orig, renumbered in seen.items() if renumbered >= base_n})
+                + base_n
+                + 1
+            )
+            seen[key] = n
+            return n
+
+    def fn(m):
+        # type: (Match[Text]) -> Text
+        return "{}".format(alloc_n(int(m.group(1))))
+
+    entry.opt_fields = OptionalFields(
+        [re.sub("(\\d+)", fn, opt) for opt in entry.opt_fields]
+    )
+
+
+def renumber_loop_devices(entry, seen):
+    # type: (MountInfoEntry, Dict[int, int]) -> None
+    """renumber_loop_devices re-numbers loop device numbers."""
+
+    def alloc_n(loop_nr):
+        # type: (int) -> int
+        key = loop_nr
+        try:
+            return seen[key]
+        except KeyError:
+            n = len(seen)
+            seen[key] = n
+            return n
+
+    def fn(m):
+        # type: (Match[Text]) -> Text
+        return "loop{}".format(alloc_n(int(m.group(1))))
+
+    entry.mount_source = re.sub("loop(\\d+)", fn, entry.mount_source)
+
+
+def renumber_mount_ids(entry, seen, base_n):
+    # type: (MountInfoEntry, Dict[int, int], int) -> None
+    """renumber_mount_ids re-numbers mount and parent mount IDs."""
+
+    def alloc_n(mount_id):
+        # type: (int) -> int
+        key = mount_id
+        try:
+            return seen[key]
+        except KeyError:
+            n = (
+                len({orig for orig, renumbered in seen.items() if renumbered >= base_n})
+                + base_n
+            )
+            seen[key] = n
+            return n
+
+    # NOTE: renumber the parent ahead of the mount to get more
+    # expected relationship between them.
+    entry.parent_id = alloc_n(entry.parent_id)
+    entry.mount_id = alloc_n(entry.mount_id)
+
+
+def renumber_devices(entry, seen):
+    # type: (MountInfoEntry, Dict[Device, Device]) -> None
+    """renumber_devices re-numbers major:minor device numbers."""
+
+    def alloc_n(dev):
+        # type: (Device) -> Device
+        key = dev
+        try:
+            return seen[key]
+        except KeyError:
+            # We haven't seen the major:minor pair precisely but perhaps we've
+            # seen the major number already? Check if this major is already
+            # remapped, if so reuse that value. If not just allocate the next
+            # one based on cardinality of the set of major numbers we've seen.
+            major = 0
+            for orig, remapped in seen.items():
+                if orig.major == dev.major:
+                    major = remapped.major
+                    break
+            else:
+                major = len({orig.major for orig in seen})
+            # Allocate the next minor number based on the cardinality of the
+            # set of minor numbers matching the major number.
+            minor = len({orig.minor for orig in seen if orig.major == dev.major})
+            n = Device(major, minor)
+            seen[key] = n
+            return n
+
+    entry.dev = alloc_n(entry.dev)
+
+
+def renumber_ns(entry, seen):
+    # type: (MountInfoEntry, Dict[Tuple[Text, int], int]) -> None
+    """renumber_mount_ns re-numbers mount namespace ID from .root_dir property."""
+
+    def alloc_n(ns_type, ns_id):
+        # type: (Text, int) -> int
+        key = (ns_type, ns_id)
+        try:
+            return seen[key]
+        except KeyError:
+            n = len(seen)
+            seen[key] = n
+            return n
+
+    if entry.fs_type != "nsfs":
+        return
+    match = re.match(r"^([a-z_]+):\[(\d+)\]$", entry.root_dir)
+    if match:
+        ns_type = match.group(1)
+        ns_id = int(match.group(2))
+        entry.root_dir = "{}:[{}]".format(ns_type, alloc_n(ns_type, ns_id))
+
+
+def renumber_mount_option(opt, seen):
+    # type: (Text, Dict[Tuple[Text, Text], int]) -> Text
+    """renumber_mount_option re-numbers various numbers in mount options."""
+
+    def alloc_n(mount_opt_key, mount_opt_value):
+        # type: (Text, Text) -> int
+        key = (mount_opt_key, mount_opt_value)
+        try:
+            return seen[key]
+        except KeyError:
+            n = len(
+                {
+                    opt_value
+                    for opt_key, opt_value in seen.keys()
+                    if opt_key == mount_opt_key
+                }
+            )
+            seen[key] = n
+            return n
+
+    if "=" in opt:
+        mount_opt_key, mount_opt_value = opt.split("=", 1)
+        # size, nr_inode: used by tmpfs
+        # fd, pipe_ino: used by binfmtmisc
+        if mount_opt_key == "size":
+            return "size=VARIABLE"
+        if mount_opt_key in {"nr_inodes", "fd", "pipe_ino"}:
+            return "{}={}".format(
+                mount_opt_key, alloc_n(mount_opt_key, mount_opt_value)
+            )
+    return opt
+
+
+def renumber_mount_opts(entry, seen):
+    # type: (MountInfoEntry, Dict[Tuple[Text, Text], int]) -> None
+    """renumber_mount_opts alters numbers in mount options."""
+    entry.mount_opts = ",".join(
+        renumber_mount_option(opt, seen) for opt in entry.mount_opts.split(",")
+    )
+    entry.sb_opts = ",".join(
+        renumber_mount_option(opt, seen) for opt in entry.sb_opts.split(",")
+    )
+
+
+class RewriteState(object):
+    """RewriteState holds state used in rewriting mount entries."""
+
+    def __init__(self):
+        # type: () -> None
+        self.seen_opt_fields = {}  # type: Dict[int, int]
+        self.seen_loops = {}  # type: Dict[int, int]
+        self.seen_snap_revs = {}  # type: Dict[Tuple[Text, Text], int]
+        self.seen_mount_ids = {}  # type: Dict[int, int]
+        self.seen_devices = {}  # type: Dict[Device, Device]
+        self.seen_ns = {}  # type: Dict[Tuple[Text, int], int]
+        # NOTE: The type of the dictionary key is Tuple[Text, Text] because
+        # while generally "numeric" the values may include suffixes like
+        # "1024k" and it is just  easier to handle this way.
+        self.seen_mount_opts = {}  # type: Dict[Tuple[Text, Text], int]
+
+
+def rewrite_renumber(entries, order, rs, base_n=0):
+    # type: (List[MountInfoEntry], List[int], RewriteState, int) -> None
+    """rewrite_renumber applies all re-numbering helpers to a single entry."""
+    for i in range(len(entries)):
+        entry = entries[order[i]]
+        renumber_mount_ids(entry, rs.seen_mount_ids, base_n)
+        renumber_devices(entry, rs.seen_devices)
+        renumber_snap_revision(entry, rs.seen_snap_revs)
+        renumber_opt_fields(entry, rs.seen_opt_fields, base_n)
+        renumber_loop_devices(entry, rs.seen_loops)
+        renumber_ns(entry, rs.seen_ns)
+        renumber_mount_opts(entry, rs.seen_mount_opts)
+
+
+def rewrite_rename(entries, order, rs):
+    # type: (List[MountInfoEntry], List[int], RewriteState) -> None
+    """rewrite_rename applies all re-naming helpers to a single entry."""
+    # TODO: allocate devices like everything else above.
+    for i in range(len(entries)):
+        entry = entries[order[i]]
+        entry.mount_source = re.sub(
+            "/dev/[sv]d([a-z])", "/dev/sd\\1", entry.mount_source
+        )
+
+
+class _UnitTestAction(Action):
+    def __init__(
+        self,
+        option_strings,
+        dest=SUPPRESS,
+        default=SUPPRESS,
+        help="run program's unit test suite and exit",
+    ):
+        # type: (Text, Text, Text, Text) -> None
+        super(_UnitTestAction, self).__init__(
+            option_strings=option_strings,
+            dest=dest,
+            default=default,
+            nargs="...",
+            help=help,
+        )
+
+    def __call__(self, parser, ns, values, option_string=None):
+        # type: (ArgumentParser, Namespace, Union[str, Sequence[Any], None], Optional[Text]) -> None
+        # We allow the caller to provide the test to invoke by giving
+        # --run-unit-tests a set of arguments.
+        argv = [sys.argv[0]]
+        if isinstance(values, list):
+            argv += values
+        unittest.main(argv=argv)
+        parser.exit()
+
+
+def main():
+    # type: () -> None
+    parser = ArgumentParser(
+        epilog="""
+Expressions are ANDed together and have one of the following forms:
+
+    .ATTR=VALUE     mount entry attribute ATTR is equal to VALUE
+    PATH            mount point is equal to PATH
+    PATH...         mount point starts with PATH
+
+In addition .ATTR syntax can be used to limit display to only certain
+attributes. By default the output is identical to raw mountinfo.
+Known attributes, applicable for both filtering and display.
+
+    mount_point:    path where mount is attached in the file system
+    mount_source:   path of the mounted device or bind-mount origin
+    fs_type:        filesystem type
+    mount_opts:     options applying to the mount point only
+    sb_opts:        options applying to the mounted filesystem
+    opt_fields:     optional fields, used for propagation information
+    mount_id:       mount point identifier
+    parent_id:      identifier of parent mount point
+    dev:            major:minor numbers of the mounted device
+    root_dir:       subtree of the mounted filesystem exposed at mount_point
+
+The exit code indicates if any mount point matched the query.
+    """,
+        formatter_class=RawTextHelpFormatter,
+    )
+    parser.register("action", "unit-test", _UnitTestAction)
+    parser.add_argument("-v", "--version", action="version", version="1.0")
+    parser.add_argument("--run-unit-tests", action="unit-test")
+    parser.add_argument(
+        "-f",
+        metavar="MOUNTINFO",
+        dest="file",
+        type=FileType(),
+        default="/proc/self/mountinfo",
+        help="parse specified mountinfo file",
+    )
+    parser.add_argument(
+        "--ref",
+        dest="refs",
+        metavar="MOUNTINFO",
+        type=FileType(),
+        action="append",
+        default=[],
+        help="refer to another table while rewriting, makes output comparable across namespaces",
+    )
+    parser.add_argument(
+        "--ref-x1000",
+        dest="ref_x1000",
+        action="store_true",
+        default=False,
+        help="start mount point IDs and peer groups at multiple of 1000, once for each ref",
+    )
+    parser.add_argument(
+        "--one", default=False, action="store_true", help="expect exactly one match"
+    )
+    parser.add_argument(
+        "--rewrite-order",
+        metavar="FIELD",
+        action="append",
+        default=[],
+        choices=MountInfoEntry.known_attrs.keys(),
+        help="rewrite entries in the order determined by given fields",
+    )
+    parser.add_argument(
+        "--display-order",
+        metavar="FIELD",
+        action="append",
+        default=[],
+        choices=MountInfoEntry.known_attrs.keys(),
+        help="display entries in the order determined by given fields",
+    )
+    parser.add_argument(
+        "exprs",
+        metavar="EXPRESSION",
+        nargs="*",
+        help="filter or display expression (see below)",
+    )
+    group = parser.add_argument_group("Rewriting rules")
+    group.add_argument(
+        "--renumber",
+        action="store_true",
+        help="Reassign mount IDs, device numbers, snap revisions"
+        " and loopback devices",
+    )
+    group.add_argument(
+        "--rename", action="store_true", help="Reassign block device names"
+    )
+    group.add_argument(
+        "--differential",
+        action="store_true",
+        help="Display numeric values as delta from previous item",
+    )
+    opts = parser.parse_args()
+    try:
+        filters, attrs = parse_exprs(opts.exprs)
+    except ValueError as exc:
+        raise SystemExit(exc)
+    entries = [MountInfoEntry.parse(line) for line in opts.file]
+
+    # Apply entry filtering ahead of any renumbering.
+    num_matched = 0
+    for e in entries:
+        if matches(e, filters):
+            e.matched = True
+            num_matched += 1
+
+    # Build rewrite state based on reference tables. This way the entries
+    # we will display can be correlated to other tables.
+    rs = RewriteState()
+    for i, ref in enumerate(opts.refs):
+        ref_entries = [MountInfoEntry.parse(line) for line in ref]
+        ref_rewrite_order = list(range(len(ref_entries)))
+        if opts.rewrite_order:
+
+            def ref_rewrite_key_fn(i):
+                # type: (int) -> Tuple[Any, ...]
+                return tuple(
+                    getattr(ref_entries[i], field) for field in opts.rewrite_order
+                )
+
+        ref_rewrite_order.sort(key=ref_rewrite_key_fn)
+        if opts.renumber:
+            rewrite_renumber(
+                ref_entries, ref_rewrite_order, rs, 1000 * i if opts.ref_x1000 else 0
+            )
+        if opts.rename:
+            rewrite_rename(ref_entries, ref_rewrite_order, rs)
+
+    # Apply entry renumbering and renaming, perhaps using reordering as well.
+    rewrite_order = list(range(len(entries)))
+    if opts.rewrite_order:
+
+        def rewrite_key_fn(i):
+            # type: (int) -> Tuple[Any, ...]
+            return tuple(getattr(entries[i], field) for field in opts.rewrite_order)
+
+        rewrite_order.sort(key=rewrite_key_fn)
+    if opts.renumber:
+        rewrite_renumber(
+            entries, rewrite_order, rs, 1000 * len(opts.refs) if opts.ref_x1000 else 0
+        )
+    if opts.rename:
+        rewrite_rename(entries, rewrite_order, rs)
+
+    # Apply entry reordering for display.
+    if opts.display_order:
+
+        def display_key_fn(entry):
+            # type: (MountInfoEntry) -> Tuple[Any, ...]
+            return tuple(getattr(entry, field) for field in opts.display_order)
+
+        entries.sort(key=display_key_fn)
+
+    # Display and differentiate
+    prev = None  # type: Optional[MountInfoEntry]
+    for e in entries:
+        if not e.matched:
+            prev = e
+            continue
+        if prev is not None and opts.differential:
+            e_display = MountInfoEntry.differentiate(e, prev)
+        else:
+            e_display = e
+        if attrs:
+            print(*[getattr(e_display, attr) for attr in attrs])
+        else:
+            print(e_display)
+        prev = e
+    if opts.one and num_matched != 1:
+        raise SystemExit(
+            "--one requires exactly one match, found {}".format(num_matched)
+        )
+    # Return with an exit code indicating if anything matched.
+    # This allows mountinfo.query to be used in scripts.
+    if num_matched == 0:
+        raise SystemExit(1)
+
+
+class MountInfoEntryTests(unittest.TestCase):
+
+    non_zero_values = {
+        "mount_id": 1,
+        "parent_id": 2,
+        "dev": Device(3, 4),
+        "root_dir": "/root-dir",
+        "mount_point": "/mount-point",
+        "mount_opts": "mount-opts",
+        "opt_fields": OptionalFields(["opt:1", "fields:2"]),
+        "fs_type": "fs-type",
+        "mount_source": "mount-source",
+        "sb_opts": "sb-opts",
+    }  # Dict[Text, Any]
+
+    def test_init(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        self.assertEqual(e.mount_id, 0)
+        self.assertEqual(e.parent_id, 0)
+        self.assertEqual(e.dev, Device(0, 0))
+        self.assertEqual(e.root_dir, "")
+        self.assertEqual(e.mount_point, "")
+        self.assertEqual(e.mount_opts, "")
+        self.assertEqual(e.opt_fields, [])
+        self.assertEqual(e.fs_type, "")
+        self.assertEqual(e.mount_source, "")
+        self.assertEqual(e.sb_opts, "")
+
+    def test_parse(self):
+        # type: () -> None
+        e = MountInfoEntry.parse(
+            "2079 2266 0:3 mnt:[4026532791] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw"
+        )
+        self.assertEqual(e.mount_id, 2079)
+        self.assertEqual(e.parent_id, 2266)
+        self.assertEqual(e.dev, Device(0, 3))
+        self.assertEqual(e.root_dir, "mnt:[4026532791]")
+        self.assertEqual(e.mount_point, "/run/snapd/ns/test-snapd-mountinfo.mnt")
+        self.assertEqual(e.mount_opts, "rw")
+        self.assertEqual(e.opt_fields, [])
+        self.assertEqual(e.fs_type, "nsfs")
+        self.assertEqual(e.mount_source, "nsfs")
+        self.assertEqual(e.sb_opts, "rw")
+
+    def test_eq(self):
+        # type: () -> None
+        e0 = MountInfoEntry()
+        e1 = MountInfoEntry()
+        self.assertEqual(e0, e1)
+        for field, value in self.non_zero_values.items():
+            self.assertEqual(e0, e1)
+            old_value = getattr(e1, field)
+            setattr(e1, field, value)
+            self.assertNotEqual(e0, e1)
+            setattr(e1, field, old_value)
+            self.assertEqual(e0, e1)
+
+    def test_str(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        for field, value in self.non_zero_values.items():
+            setattr(e, field, value)
+        self.assertEqual(
+            str(e),
+            "1 2 3:4 /root-dir /mount-point mount-opts opt:1 fields:2 - fs-type mount-source sb-opts",
+        )
+
+    def test_repr(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        for field, value in self.non_zero_values.items():
+            setattr(e, field, value)
+        self.assertEqual(
+            repr(e),
+            "MountInfoEntry.parse('1 2 3:4 /root-dir /mount-point mount-opts opt:1 fields:2 - fs-type mount-source sb-opts')",
+        )
+
+    def test_dev_maj_min(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        e.dev = Device(1, 2)
+        self.assertEqual(e.dev_min, 2)
+        self.assertEqual(e.dev_maj, 1)
+
+
+class RenumberSnapRevisionTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.entry = MountInfoEntry()
+        self.seen = {}  # type: Dict[Tuple[Text, Text], int]
+
+    def test_renumbering_allocation(self):
+        # type: () -> None
+        self.entry.mount_point = "/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/1")
+
+        self.entry.mount_point = "/snap/core/7080"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/2")
+
+        self.entry.mount_point = "/snap/snapd/x1"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/snapd/1")
+
+        self.assertEqual(
+            self.seen, {("core", "7079"): 1, ("core", "7080"): 2, ("snapd", "x1"): 1}
+        )
+
+    def test_preferred(self):
+        # type: () -> None
+        self.entry.mount_point = "/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/1")
+
+        self.entry.mount_point = "/snap/core/7079/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/1/subdir")
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_alternate(self):
+        # type: () -> None
+        self.entry.mount_point = "/var/lib/snapd/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/snap/core/1")
+
+        self.entry.mount_point = "/var/lib/snapd/snap/core/7079/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/snap/core/1/subdir")
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_preferred_via_hostfs(self):
+        # type: () -> None
+        self.entry.mount_point = "/var/lib/snapd/hostfs/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/hostfs/snap/core/1")
+
+        self.entry.mount_point = "/var/lib/snapd/hostfs/snap/core/7079/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point, "/var/lib/snapd/hostfs/snap/core/1/subdir"
+        )
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_alternate_via_hostfs(self):
+        # type: () -> None
+        self.entry.mount_point = "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point, "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/1"
+        )
+
+        self.entry.mount_point = (
+            "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/7079/subdir"
+        )
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point,
+            "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/1/subdir",
+        )
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_writable(self):
+        # type: () -> None
+        self.entry.mount_point = "/writable/system-data/snap/core18/1055"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/writable/system-data/snap/core18/1")
+
+        self.entry.mount_point = "/writable/system-data/snap/core18/1055/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point, "/writable/system-data/snap/core18/1/subdir"
+        )
+
+        self.assertEqual(self.seen, {("core18", "1055"): 1})
+
+    def test_writable_via_hostfs(self):
+        # type: () -> None
+        self.entry.mount_point = (
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1055"
+        )
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point,
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1",
+        )
+
+        self.entry.mount_point = (
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1055/subdir"
+        )
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point,
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1/subdir",
+        )
+
+        self.assertEqual(self.seen, {("core18", "1055"): 1})
+
+
+class RenumberMountNsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.entry = MountInfoEntry()
+        self.entry.fs_type = "nsfs"
+        self.seen = {}  # type: Dict[Tuple[Text, int], int]
+
+    def test_renumbering_allocation(self):
+        # type: () -> None
+        self.entry.root_dir = "mnt:[4026532909]"
+        renumber_ns(self.entry, self.seen)
+        self.assertEqual(self.entry.root_dir, "mnt:[0]")
+
+        self.entry.root_dir = "mnt:[4026532791]"
+        renumber_ns(self.entry, self.seen)
+        self.assertEqual(self.entry.root_dir, "mnt:[1]")
+
+        self.entry.root_dir = "pid:[4026531836]"
+        renumber_ns(self.entry, self.seen)
+        self.assertEqual(self.entry.root_dir, "pid:[2]")
+
+        self.assertEqual(
+            self.seen,
+            {("mnt", 4026532909): 0, ("mnt", 4026532791): 1, ("pid", 4026531836): 2},
+        )
+
+
+class RenumberMountOptionsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.seen = {}  # type: Dict[Tuple[Text, Text], int]
+
+    def test_renumber_allocation(self):
+        # type: () -> None
+        """
+        numbers are allocated from subsets matching the key, this reduces delta.
+        """
+        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
+        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
+        self.assertEqual(renumber_mount_option("pipe_ino=200", self.seen), "pipe_ino=1")
+        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
+        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
+        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
+        self.assertEqual(renumber_mount_option("fd=45", self.seen), "fd=1")
+        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
+
+    def test_renumber_size_variable(self):
+        # type: () -> None
+        """
+        size is special-cased and always rewritten to the same value because it is prone to fluctuations
+        """
+        self.assertEqual(renumber_mount_option("size=100", self.seen), "size=VARIABLE")
+        self.assertEqual(renumber_mount_option("size=200", self.seen), "size=VARIABLE")
+
+    def test_renumber_devtmpfs_opts(self):
+        # type: () -> None
+        """
+        certain devtmpfs options are renumbered.
+
+            23 98 0:6 / /dev rw,nosuid shared:21 - devtmpfs devtmpfs rw,size=4057388k,nr_inodes=1014347,mode=755
+
+        Here the size and nr_inodes options are not deterministic and need to
+        be rewritten.  The size quantity is very susceptible to free memory
+        fluctuations and is treated specially.
+        """
+        # Options size= and nr_inodes= are renumbered.
+        self.assertEqual(
+            renumber_mount_option("size=4057388k", self.seen), "size=VARIABLE"
+        )
+        self.assertEqual(
+            renumber_mount_option("nr_inodes=1014347", self.seen), "nr_inodes=0"
+        )
+        # Option mode= is not renumbered.
+        self.assertEqual(renumber_mount_option("mode=755", self.seen), "mode=755")
+        self.assertEqual(self.seen, {("nr_inodes", "1014347"): 0})
+
+    def test_renumber_binfmt_misc_opts(self):
+        # type: () -> None
+        """
+        certain binfmt_misc options are renumbered.
+
+            47 22 0:42 / /proc/sys/fs/binfmt_misc rw,relatime shared:28 - autofs systemd-1 rw,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16610
+
+        Here the fd and pipe_ino options are not deterministic and need to be rewritten.
+        """
+        self.assertEqual(renumber_mount_option("fd=40", self.seen), "fd=0")
+        self.assertEqual(
+            renumber_mount_option("pipe_ino=16610", self.seen), "pipe_ino=0"
+        )
+        self.assertEqual(self.seen, {("fd", "40"): 0, ("pipe_ino", "16610"): 0})
+
+
+class RenumberMountIdsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.seen = {}  # type: Dict[int, int]
+
+    def test_smoke(self):
+        # type: () -> None
+        # Renumber the first mount entry, from the "initial" mount namespace,
+        # with the initial, zero multiple.
+        entry = MountInfoEntry()
+        entry.mount_id = 12
+        entry.parent_id = 5
+        renumber_mount_ids(entry, self.seen, 0)
+        self.assertEqual(entry.parent_id, 0)
+        self.assertEqual(entry.mount_id, 1)
+
+        # Renumber another entry, now in a separate mount namespace, with a
+        # different multiplier. The parent ID stays in the < 1000 range.  NOTE:
+        # in reality mount namespaces never share mount IDs but that's fine.
+        # The test just checks the renumber logic.
+        entry = MountInfoEntry()
+        entry.mount_id = 13
+        entry.parent_id = 5
+        renumber_mount_ids(entry, self.seen, 1000)
+        self.assertEqual(entry.parent_id, 0)
+        self.assertEqual(entry.mount_id, 1000)
+
+
+class RenumberOptFieldsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.seen = {}  # type: Dict[int, int]
+
+    def test_smoke(self):
+        # type: () -> None
+        # Renumber the first mount entry, from the "initial" mount namespace,
+        # with the initial, zero multiple.
+        entry = MountInfoEntry()
+        entry.opt_fields = OptionalFields(["shared:12"])
+        renumber_opt_fields(entry, self.seen, 0)
+        self.assertEqual(entry.opt_fields, ["shared:1"])
+
+        # Renumber the second entry, now in a separate mount namespace, with a
+        # different multiplier. Given that the peer group number was not seen
+        # before it gets allocated into the 1000-1999 range.
+        entry = MountInfoEntry()
+        entry.opt_fields = OptionalFields(["shared:13"])
+        renumber_opt_fields(entry, self.seen, 1000)
+        self.assertEqual(entry.opt_fields, ["shared:1001"])
+
+        # Renumber the third entry, in the same mount namespace as the second
+        # one.  Given that the peer group number was seen in the initial mount
+        # namespace it is renumbered the same was as the original was, even
+        # though the actual sharing mode is different.
+        entry = MountInfoEntry()
+        entry.opt_fields = OptionalFields(["master:12"])
+        renumber_opt_fields(entry, self.seen, 1000)
+        self.assertEqual(entry.opt_fields, ["master:1"])
+
+
+class RewriteTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.entries = [
+            MountInfoEntry.parse(line)
+            for line in (
+                "2079 2266 0:3 mnt:[4026532791] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw",
+                "23 98 0:6 / /dev rw,nosuid shared:21 - devtmpfs devtmpfs rw,size=4057388k,nr_inodes=1014347,mode=755",
+                "47 22 0:42 / /proc/sys/fs/binfmt_misc rw,relatime shared:28 - autofs systemd-1 rw,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16610",
+            )
+        ]
+        self.order = list(range(len(self.entries)))
+        self.rs = RewriteState()
+
+    def test_rewrite_renumber(self):
+        # type: () -> None
+        rewrite_renumber(self.entries, self.order, self.rs)
+        self.assertEqual(
+            self.entries,
+            [
+                MountInfoEntry.parse(line)
+                for line in (
+                    "1 0 0:0 mnt:[0] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw",
+                    "3 2 0:1 / /dev rw,nosuid shared:1 - devtmpfs devtmpfs rw,size=VARIABLE,nr_inodes=0,mode=755",
+                    "5 4 0:2 / /proc/sys/fs/binfmt_misc rw,relatime shared:2 - autofs systemd-1 rw,fd=0,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=0",
+                )
+            ],
+        )
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/bin/NOMATCH snapd-2.48.3+20.04/tests/bin/NOMATCH
--- snapd-2.45.1+20.04.2/tests/bin/NOMATCH	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/NOMATCH	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Source spread-funcs.sh which, at runtime, contains the real definition of
+# NOMATCH and execute it.
+
+# shellcheck source=tests/lib/spread-funcs.sh 
+. "$TESTSLIB/spread-funcs.sh"
+
+NOMATCH "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/not snapd-2.48.3+20.04/tests/bin/not
--- snapd-2.45.1+20.04.2/tests/bin/not	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/not	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh
+# This script executes whatever is given as argument and inverts the return
+# value. It is meant as a workaround for shellcheck discovery
+# https://github.com/koalaman/shellcheck/wiki/SC2251 where shell scripts using
+# "set -e" are not failing with a trivial code like "! true"
+! "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/os.query snapd-2.48.3+20.04/tests/bin/os.query
--- snapd-2.45.1+20.04.2/tests/bin/os.query	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/os.query	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,84 @@
+#!/bin/bash
+
+show_help() {
+    echo "usage: is-core"
+    echo "       is-core16"
+    echo "       is-core18"
+    echo "       is-core20"
+    echo "       is-classic"
+    echo "       is-trusty"
+    echo "       is-xenial"
+    echo "       is-bionic"
+    echo "       is-focal"
+    echo ""
+    echo "Get general information about the current system"
+}
+
+is_core() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-* ]]
+}
+
+is_core16() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-16-* ]]
+}
+
+is_core18() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-18-* ]]
+}
+
+is_core20() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-20-* ]]
+}
+
+is_classic() {
+    ! is_core
+}
+
+is_trusty() {
+    grep -qFx 'ID=ubuntu' /etc/os-release && grep -qFx 'VERSION_ID="14.04"' /etc/os-release
+}
+
+is_xenial() {
+    grep -qFx 'UBUNTU_CODENAME=xenial' /etc/os-release
+}
+
+is_bionic() {
+    grep -qFx 'UBUNTU_CODENAME=bionic' /etc/os-release
+}
+
+is_focal() {
+    grep -qFx 'UBUNTU_CODENAME=focal' /etc/os-release
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    local subcommand="$1"
+    local action=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -h|--help)
+                show_help
+                exit 0
+                ;;
+            *)
+                action=$(echo "$subcommand" | tr '-' '_')
+                shift
+                break
+                ;;
+        esac
+    done
+
+    if [ -z "$(declare -f "$action")" ]; then
+        echo "os.query: no such command: $subcommand" >&2
+        show_help
+        exit 1
+    fi
+
+    "$action" "$@"
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/README snapd-2.48.3+20.04/tests/bin/README
--- snapd-2.45.1+20.04.2/tests/bin/README	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/README	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+This directory contains symlinks to tools in tests/lib/tools that are
+frequently used and we want accessible over PATH by spread tests.
+
+See tests/lib/tools/README.
diff -Nru snapd-2.45.1+20.04.2/tests/bin/REBOOT snapd-2.48.3+20.04/tests/bin/REBOOT
--- snapd-2.45.1+20.04.2/tests/bin/REBOOT	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/REBOOT	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Source spread-funcs.sh which, at runtime, contains the real definition of
+# REBOOT and execute it.
+
+# shellcheck source=tests/lib/spread-funcs.sh 
+. "$TESTSLIB/spread-funcs.sh"
+
+REBOOT "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/retry snapd-2.48.3+20.04/tests/bin/retry
--- snapd-2.45.1+20.04.2/tests/bin/retry	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/retry	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,133 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+import argparse
+import itertools
+import subprocess
+import sys
+import time
+
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import List, Text
+
+
+def _make_parser():
+    # type: () -> argparse.ArgumentParser
+    parser = argparse.ArgumentParser(
+        description="""
+Retry executes COMMAND at most N times, waiting for SECONDS between each
+attempt. On failure the exit code from the final attempt is returned.
+"""
+    )
+    parser.add_argument(
+        "-n",
+        "--attempts",
+        metavar="N",
+        type=int,
+        default=3,
+        help="number of attempts (default %(default)s)",
+    )
+    parser.add_argument(
+        "--wait",
+        metavar="SECONDS",
+        type=float,
+        default=1,
+        help="grace period between attempts (default %(default)ss)",
+    )
+    parser.add_argument(
+        "--maxmins",
+        metavar="MINUTES",
+        type=float,
+        default=0,
+        help="number of minutes after which to give up (no default, if set attempts is ignored)",
+    )
+    parser.add_argument(
+        "--quiet",
+        dest="verbose",
+        action="store_false",
+        default=True,
+        help="refrain from printing any output",
+    )
+    parser.add_argument(
+        "cmd", metavar="COMMAND", nargs="...", help="command to execute"
+    )
+    return parser
+
+
+def run_cmd(cmd, n, wait, maxmins, verbose):
+    # type: (List[Text], int, float, float, bool) -> int
+    if maxmins != 0:
+        attempts = itertools.count(1)
+        t0 = time.time()
+        after = "{} minutes".format(maxmins)
+        of_attempts_suffix = ""
+    else:
+        attempts = range(1, n + 1)
+        after = "{} attempts".format(n)
+        of_attempts_suffix = " of {}".format(n)
+    retcode = 0
+    i = 0
+    for i in attempts:
+        retcode = subprocess.call(cmd)
+        if retcode == 0:
+            return 0
+        if verbose:
+            print(
+                "retry: command {} failed with code {}".format(" ".join(cmd), retcode),
+                file=sys.stderr,
+            )
+        if maxmins != 0:
+            elapsed = (time.time()-t0)/60
+            if elapsed > maxmins:
+                break
+        if i < n or maxmins != 0:
+            if verbose:
+                print(
+                    "retry: next attempt in {} second(s) (attempt {}{})".format(
+                        wait, i, of_attempts_suffix
+                    ),
+                    file=sys.stderr,
+                )
+            time.sleep(wait)
+
+    if verbose and i > 1:
+        print(
+            "retry: command {} keeps failing after {}".format(
+                " ".join(cmd), after
+                ),
+                file=sys.stderr,
+            )
+    return retcode
+
+
+def main():
+    # type: () -> None
+    parser = _make_parser()
+    ns = parser.parse_args()
+    # The command cannot be empty but it is difficult to express in argparse itself.
+    if len(ns.cmd) == 0:
+        parser.print_usage()
+        parser.exit(0)
+    # Return the last exit code as the exit code of this process.
+    try:
+        retcode = run_cmd(ns.cmd, ns.attempts, ns.wait, ns.maxmins, ns.verbose)
+    except OSError as exc:
+        if ns.verbose:
+            print(
+                "retry: cannot execute command {}: {}".format(" ".join(ns.cmd), exc),
+                file=sys.stderr,
+            )
+        raise SystemExit(1)
+    else:
+        raise SystemExit(retcode)
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/bin/snapd.tool snapd-2.48.3+20.04/tests/bin/snapd.tool
--- snapd-2.45.1+20.04.2/tests/bin/snapd.tool	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/snapd.tool	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+show_usage() {
+	echo "usage: snapd.tool [OPTIONS] exec <TOOL> [ARGS]"
+}
+
+show_help() {
+	show_usage
+	echo
+	echo "Available options:"
+	echo "	-h --help	show this help message."
+	echo
+	echo "The snapd.tool program simplifies running internal tools,"
+	echo "like snap-discard-ns, which are not on PATH and whose"
+	echo "location varies from one distribution to another"
+}
+
+tool=""
+while [ $# -gt 0 ]; do
+	case "${1:-}" in
+		-h|--help)
+			show_help
+			exit 0
+			;;
+		exec)
+			shift
+			tool="${1:-}"  # empty value checked below
+			shift
+			break
+			;;
+		--)
+			shift
+			break
+			;;
+		-*)
+			echo "snapd.tool: unsupported argument $1" >&2
+			show_usage
+			exit 1
+			;;
+		*)
+			echo "snapd.tool: unsupported argument $1" >&2
+			show_usage
+			exit 1
+			;;
+	esac
+done
+
+if [ "$tool" = "" ]; then
+	show_usage
+	exit 1
+fi
+
+# shellcheck source=tests/lib/dirs.sh
+. "$TESTSLIB/dirs.sh"
+exec "$LIBEXECDIR/snapd/$tool" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/tests.backup snapd-2.48.3+20.04/tests/bin/tests.backup
--- snapd-2.45.1+20.04.2/tests/bin/tests.backup	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/tests.backup	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,69 @@
+#!/bin/bash -e
+# Tool used to backup/restore a specific directory
+# It is used by the test tool to make sure each test
+# leaves the test directory as was initially
+
+show_help() {
+    echo "usage: tests.backup prepare [PATH]"
+    echo "       tests.backup restore [PATH]"
+}
+
+cmd_prepare() {
+    local BACKUP_PATH=$1
+
+    if [ ! -d "$BACKUP_PATH" ]; then
+        echo "tests.backup: cannot backup $BACKUP_PATH, not a directory" >&2
+        exit 1
+    fi
+    tar cf "${BACKUP_PATH}.tar" "$BACKUP_PATH"
+}
+
+cmd_restore() {
+    local BACKUP_PATH=$1
+    if [ -f "${BACKUP_PATH}.tar" ]; then
+        # Find all the files in the path $BACKUP_PATH and delete them
+        # This command deletes also the hidden files
+        find "${BACKUP_PATH}" -maxdepth 1 -mindepth 1 -exec rm -rf {} \;
+        tar -C/ -xf "${BACKUP_PATH}.tar"
+        rm "${BACKUP_PATH}.tar"
+    else
+        echo "tests.backup: cannot restore ${BACKUP_PATH}.tar, the file does not exist" >&2
+        exit 1
+    fi
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -h|--help)
+                show_help
+                exit
+                ;;
+            prepare)
+                local BACKUP_PATH="${2:-$(pwd)}"
+                cmd_prepare "$BACKUP_PATH"
+                exit
+                ;;
+            restore)
+                local BACKUP_PATH="${2:-$(pwd)}"
+                cmd_restore "$BACKUP_PATH"
+                exit
+                ;;
+            -*)
+                echo "tests.backup: unknown option $1" >&2
+                exit 1
+                ;;
+            *)
+                echo "tests.backup: unknown command $1" >&2
+                exit 1
+                ;;
+        esac
+    done
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/bin/tests.cleanup snapd-2.48.3+20.04/tests/bin/tests.cleanup
--- snapd-2.45.1+20.04.2/tests/bin/tests.cleanup	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/tests.cleanup	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,111 @@
+#!/bin/sh -e
+
+show_help() {
+    echo "usage: tests.cleanup prepare"
+    echo "       tests.cleanup defer <cmd> [args]"
+    echo "       tests.cleanup pop"
+    echo "       tests.cleanup restore"
+    echo
+    echo "COMMANDS:"
+    echo "  prepare: establishes a cleanup stack"
+    echo "  restore: invokes all cleanup commands in reverse order"
+    echo "  defer: pushes a command onto the cleanup stack"
+    echo "  pop: invoke the most recently deferred command, discarding it"
+    echo
+    echo "The defer and pop commands can be to establish temporary"
+    echo "cleanup handler and remove it, in the case of success"
+}
+
+cmd_prepare() {
+    if [ -e defer.sh ]; then
+        echo "tests.cleanup: cannot prepare, already prepared" >&2
+        exit 1
+    fi
+    truncate --size=0 defer.sh
+    chmod +x defer.sh
+}
+
+cmd_defer() {
+    if [ ! -e defer.sh ]; then
+        echo "tests.cleanup: cannot defer, must call tests.cleanup prepare first" >&2
+        exit 1
+    fi
+    echo "$*" >> defer.sh
+}
+
+run_one_cmd() {
+    CMD="$1"
+    set +e
+    sh -ec "$CMD"
+    RET=$?
+    set -e
+    if [ $RET -ne 0 ]; then
+        echo "tests.cleanup: deferred command \"$CMD\" failed with exit code $RET"
+        exit $RET
+    fi
+}
+
+cmd_pop() {
+    if [ ! -s defer.sh ]; then
+        echo "tests.cleanup: cannot pop, cleanup stack is empty" >&2
+        exit 1
+    fi
+    head -n-1 defer.sh >defer.sh.pop
+    trap "mv defer.sh.pop defer.sh" EXIT
+    tail -n-1 defer.sh | while read -r CMD; do
+        run_one_cmd "$CMD"
+    done
+}
+
+cmd_restore() {
+    if [ ! -e defer.sh ]; then
+        echo "tests.cleanup: cannot restore, must call tests.cleanup prepare first" >&2
+        exit 1
+    fi
+    tac defer.sh | while read -r CMD; do
+        run_one_cmd "$CMD"
+    done
+    rm -f defer.sh
+}
+
+if [ $# -eq 0 ]; then
+    show_help
+    exit
+fi
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -h|--help)
+            show_help
+            exit
+            ;;
+        prepare)
+            shift
+            cmd_prepare
+            exit
+            ;;
+        defer)
+            shift
+            cmd_defer "$@"
+            exit
+            ;;
+        pop)
+            shift
+            cmd_pop "$@"
+            exit
+            ;;
+        restore)
+            shift
+            cmd_restore
+            exit
+            ;;
+        -*)
+            echo "tests.cleanup: unknown option $1" >&2
+            exit 1
+            ;;
+        *)
+            echo "tests.cleanup: unknown command $1" >&2
+            exit 1
+            ;;
+    esac
+done
diff -Nru snapd-2.45.1+20.04.2/tests/bin/tests.invariant snapd-2.48.3+20.04/tests/bin/tests.invariant
--- snapd-2.45.1+20.04.2/tests/bin/tests.invariant	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/tests.invariant	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,170 @@
+#!/bin/sh
+
+show_help() {
+	echo "usage: tests.invariant check [INVARIANT...]"
+	echo
+	echo "Supported invariants:"
+	echo "    root-files-in-home: most of /home/* does not contain root-owned files"
+	echo "    crashed-snap-confine: /tmp/snap.rootfs_* does not exist"
+	echo "    lxcfs-mounted: /var/lib/lxcfs is a mount point"
+	echo "    stray-dbus-daemon: at most one dbus-daemon is running"
+	echo "    leftover-defer-sh: defer.sh must not be left over by tests"
+}
+
+if [ $# -eq 0 ]; then
+	show_help
+	exit 1
+fi
+
+action=
+while [ $# -gt 0 ]; do
+	case "$1" in
+		-h|--help)
+			show_help
+			exit 0
+			;;
+		--)
+			shift
+			break
+			;;
+		check)
+			action=check
+			shift
+			;;
+		-*)
+			echo "tests.invariant: unsupported argument $1" >&2
+			exit 1
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+check_root_files_in_home() {
+	n="$1" # invariant name
+	# This find expression looks for root owned file in /home with the following exceptions:
+	# - The /home/ubuntu directory is root owned but is not used by the tests so we ignore it
+	# - The /home/gopath and everything inside it comes from spread.yaml and is too inconvenient to change
+	# As a note, the working theory for the origin of /home/ubuntu is cloud-init and data from GCE.
+	find /home -mindepth 1 -user root -a ! -path "/home/ubuntu" -a ! -path "$GOHOME" -a ! -path "$GOHOME/*" 2>/dev/null >"/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: the following files should not be owned by root" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_crashed_snap_confine() {
+	n="$1" # invariant name
+	find /tmp -name 'snap.rootfs_*' > "/tmp/tests.invariant.$n"
+	# NOTE: it may be a mount point but we are not checking that here.
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: it seems snap-confine has crashed" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_lxcfs_mounted() {
+	n="$1" # invariant name
+	"$TESTSTOOLS"/mountinfo.query /var/lib/lxcfs > "/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: it seems lxcfs is mounted" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_stray_dbus_daemon() {
+	n="$1" # invariant name
+	(
+		skipped_system=0
+		for pid in $(pgrep dbus-daemon); do
+			cmdline="$(tr '\0' ' ' < "/proc/$pid/cmdline")"
+			# Ignore one dbus-daemon responsible for the system bus.
+			if echo "$cmdline" | grep -q 'dbus-daemon --system' && [ "$skipped_system" -eq 0 ]; then
+				skipped_system=1
+				continue
+			fi
+			# Ignore dbus-daemon running the session of the "external" user.
+			# This may happen when testing a core device using the ad-hoc
+			# backend. This user is never used by tests explicitly.
+			if [ "$(stat -c %U "/proc/$pid")" = "external" ]; then
+				continue
+			fi
+			# Report stray dbus-daemon.
+			echo "pid:$pid cmdline:$cmdline"
+		done
+	) > "/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: more than one dbus-daemon running" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_leftover_defer_sh() {
+	n="$1" # invariant name
+	(
+		find "$PROJECT_PATH" -name defer.sh > "/tmp/tests.invariant.$n"
+	) > "/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: leftover defer.sh script" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_invariant() {
+	case "$1" in
+		root-files-in-home)
+			check_root_files_in_home "$1"
+			;;
+		crashed-snap-confine)
+			check_crashed_snap_confine "$1"
+			;;
+		lxcfs-mounted)
+			check_lxcfs_mounted "$1"
+			;;
+		stray-dbus-daemon)
+			check_stray_dbus_daemon "$1"
+			;;
+		leftover-defer-sh)
+			check_leftover_defer_sh "$1"
+			;;
+		*)
+			echo "tests.invariant: unknown invariant $1" >&2
+			exit 1
+			;;
+	esac
+}
+
+ALL_INVARIANTS="root-files-in-home crashed-snap-confine lxcfs-mounted stray-dbus-daemon leftover-defer-sh"
+
+case "$action" in
+	check)
+		ok=1
+		if [ $# -gt 0 ]; then
+			INV_LIST="$*"
+		else
+			INV_LIST="$ALL_INVARIANTS"
+		fi
+		for inv in $INV_LIST; do
+			if check_invariant "$inv"; then
+				echo "tests.invariant: $inv ok"
+			else
+				echo "tests.invariant: $inv not-ok" >&2
+				ok=0
+			fi
+		done
+		if [ $ok -eq 0 ]; then
+			echo "tests.invariant: system is corrupted" >&2
+			exit 1
+		fi
+		;;
+	*)
+		echo "tests.invariant: unknown action $action" >&2
+		exit 1
+		;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/bin/tests.session snapd-2.48.3+20.04/tests/bin/tests.session
--- snapd-2.45.1+20.04.2/tests/bin/tests.session	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/bin/tests.session	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,386 @@
+#!/bin/bash -e
+show_help() {
+	echo "usage: tests.session exec [-u USER] [-p PID_FILE] [--] <CMD>"
+	echo "usage: tests.session prepare | restore [-u USER | -u USER1,USER2,...]"
+	echo "usage: tests.session kill-leaked"
+	echo "usage: tests.session dump"
+	echo "usage: tests.session has-system-systemd-and-dbus"
+	echo "usage: tests.session has-session-systemd-and-dbus"
+}
+
+if [ $# -eq 0 ]; then
+	show_help
+	exit 1
+fi
+user=root
+pid_file=
+action=
+while [ $# -gt 0 ]; do
+	case "$1" in
+		-h)
+			shift
+			show_help
+			exit 0
+			;;
+		-p)
+			if [ $# -eq 1 ]; then
+				echo "tests.session: option -p requires an argument" >&2
+				exit 1
+			fi
+			pid_file="$2"
+			shift 2
+			;;
+		--)
+			shift
+			break
+			;;
+		kill-leaked)
+			action=kill-leaked
+			shift
+			;;
+		prepare)
+			action=prepare
+			shift
+			;;
+		restore)
+			action=restore
+			shift
+			;;
+		dump)
+			action=dump
+			shift
+			;;
+		has-system-systemd-and-dbus)
+			action=has-system-systemd-and-dbus
+			shift
+			;;
+		has-session-systemd-and-dbus)
+			action=has-session-systemd-and-dbus
+			shift
+			;;
+		exec)
+			action="exec"
+			shift
+			# remaining arguments are the command to execute
+			break
+			;;
+		-u)
+			if [ $# -eq 1 ]; then
+				echo "tests.session: option -u requires an argument" >&2
+				exit 1
+			fi
+			user="$2"
+			shift 2
+			;;
+		-*)
+			echo "tests.session: unsupported argument $1" >&2
+			exit 1
+			;;
+		*)
+			echo "tests.session: unsupported action $1" >&2
+			exit 1
+			;;
+	esac
+done
+
+if [ "$(id -u)" -ne 0 ]; then
+	echo "tests.session needs to be invoked as root" >&2
+	exit 1
+fi
+
+case "$action" in
+	kill-leaked)
+		# Work around a bug in older versions of logind that leak closing session
+		# without a process inhabiting it anymore. In the case we've observed there's a
+		# session that is being closed with a missing process.
+		for session_id in $(loginctl --no-legend | awk '{ print $1 }'); do
+			# It would be easier to use "loginctl show-session --value" but we cannot rely on it.
+			if [ "$(loginctl show-session "$session_id" --property=State | cut -d = -f 2-)" = closing ]; then
+				leader=$(loginctl show-session "$session_id" --property=Leader | cut -d = -f 2-)
+				if [ ! -e "/proc/$leader" ]; then
+					loginctl kill-session "$session_id"
+				fi
+			fi
+		done
+
+		exit 0
+		;;
+	prepare)
+		# Try to enable linger for the selected user(s).
+		for u in $(echo "$user" | tr ',' ' '); do
+			if ! loginctl enable-linger "$u"; then
+				echo "tests.session requires external fix for //github.com/systemd/systemd/issues/12401" >&2
+				exit 1
+			fi
+		done
+
+		for u in $(echo "$user" | tr ',' ' '); do
+			# We've enabled linger, now let's explicitly start the
+			# default.target. This ensures that test code does not need to pay
+			# extra attention to synchronization.
+			#
+			# Because some systems do not support systemd --user (see
+			# tests/main/tests.session-support for details), check if this is
+			# expected to work ahead of trying.
+			if tests.session -u "$u" exec systemctl --user is-enabled default.target >/dev/null; then
+				tests.session -u "$u" exec systemctl --user start default.target
+			fi
+		done
+
+		exit 0
+		;;
+	restore)
+		# Disable linger for the selected user(s).
+		for u in $(echo "$user" | tr ',' ' '); do
+
+			loginctl disable-linger "$u"
+			# If the user is not root, also stop their user slice and ensure
+			# their XDG_RUNTIME_DIR goes away. Currently doing this for root is
+			# impossible, because spread logs into a test system over ssh and
+			# gets a root user slice, at minimum.
+			#
+			# If spread ever changes, so that the tests are executed as system
+			# services, then there this condition could be removed.
+			if [ "$u" != root ]; then
+				uid="$(id -u "$u")"
+
+				# Unmount gvfs-fuse and the document portal explicitly.  FUSE
+				# file-systems can stay mounted in a broken state even if their
+				# corresponding process goes away. This can happen if we stop
+				# the slice and the cleanup is not perfectly graceful.
+				umount "/run/user/$uid/gvfs" || true
+				umount "/run/user/$uid/doc" || true
+
+				# See user@.service(5) for discussion about user-UID.slice and
+				# user@UID.service and why both are used. Here we stop the
+				# slice as that encompasses both user@UID.service and any
+				# existing sessions of that user.
+				systemctl stop "user-$uid.slice"
+
+				# On Ubuntu 16.04 and Debian 9 stopping the slice above is
+				# insufficient to stop the service responsible for
+				# /run/user/UID *immediately*. This seems to be related to
+				# *absence* of user-session-dir@.service (template service)
+				# which is responsible for this operation later on (and where
+				# it works more reliably).
+				#
+				# Give the system some time to clean things up.
+				retry -n 3 --wait 3 test ! -e "/run/user/$uid"
+				if [ -e "/run/user/$uid" ]; then
+					echo "tests.session: /run/user/$uid still exists" >&2
+					exit 1
+				fi
+			fi
+		done
+
+		if [ -e /run/tests.session-core16.workaround ]; then
+			rm  /run/tests.session-core16.workaround
+			# Undo changes to make /var/lib/systemd/ writable.
+			umount -l /var/lib/systemd
+		fi
+
+		exit 0
+		;;
+	dump)
+		echo "Active sessions:"
+		for session_id in $(loginctl list-sessions --no-legend | awk '{ print($1) }'); do
+			echo "Details of session $session_id"
+			loginctl show-session "$session_id"
+		done
+		exit 0
+		;;
+	has-system-systemd-and-dbus)
+		#  Ubuntu 14.04 with deputy systemd does not connect to DBus
+		#  and systemd-shim is really responding to "systemd" requests.
+		test -n "$(command -v busctl)"         			|| ( echo "no busctl"; exit 1 )
+		# 		/lib										   /usr/lib									   (if present) dbus-broker.service variant
+		test -f /lib/systemd/system/default.target	|| test -f /usr/lib/systemd/system/default.target	|| ( echo "no system default.target"; exit 1 )
+		test -f /lib/systemd/system/dbus.socket  	|| test -f /usr/lib/systemd/system/dbus.socket		|| ( echo "no system dbus.socket"; exit 1 )
+		test -f /lib/systemd/system/dbus.service	|| test -f /usr/lib/systemd/system/dbus.service		|| test -f /lib/systemd/system/dbus-broker.service || ( echo "no system dbus{,-broker}.service"; exit 1 )
+		echo "ok"
+		exit 0
+		;;
+	has-session-systemd-and-dbus)
+		#  CentOS 7 and derivatives disabled systemd --user
+		#  https://bugs.centos.org/view.php?id=8767
+		test -n "$(command -v busctl)"         			|| ( echo "no busctl"; exit 1 )
+		# 		/lib										   /usr/lib									   (if present) dbus-broker.service variant
+		test -f /lib/systemd/user/default.target 	|| test -f /usr/lib/systemd/user/default.target		|| ( echo "no user default.target"; exit 1)
+		test -f /lib/systemd/user/dbus.socket 		|| test -f /usr/lib/systemd/user/dbus.socket 		|| ( echo "no user dbus.socket"; exit 1 )
+		test -f /lib/systemd/user/dbus.service		|| test -f /usr/lib/systemd/user/dbus.service		|| test -f /lib/systemd/user/dbus-broker.service || ( echo "no system dbus{,-broker}.service"; exit 1 )
+		echo "ok"
+		exit 0
+		;;
+esac
+
+if [ -z "$(command -v busctl)" ]; then
+	echo "tests.session requires busctl" >&2
+	exit 1
+fi
+
+# This fixes a bug in some older Debian systems where /root/.profile contains
+# unconditional invocation of mesg, which on non-tty shells prints "mesg
+# ttyname failed inappropriate ioctl for device" which pollutes output from
+# invoked programs.
+# TODO: move this to spread wide project setup.
+test -f /root/.profile && sed -i -e 's/mesg n .*true/tty -s \&\& mesg n/g' /root/.profile
+
+read -r uuid < /proc/sys/kernel/random/uuid
+unit_name="tests.session-$uuid.service"
+tmp_dir="/tmp/tests.session-$uuid"
+mkdir "$tmp_dir"
+mkfifo -m 0666 "$tmp_dir/dbus-monitor.pipe" "$tmp_dir/ready.pipe" "$tmp_dir/result.pipe" "$tmp_dir/stdin.pipe" "$tmp_dir/stdout.pipe" "$tmp_dir/stderr.pipe"
+trap 'rm -rf $tmp_dir' EXIT
+
+# Run dbus-monitor waiting for systemd JobRemoved signal. Process the output
+# with awk, forwarding the result of the service to a fifo.
+monitor_expr="type='signal', sender='org.freedesktop.systemd1', interface='org.freedesktop.systemd1.Manager', path='/org/freedesktop/systemd1', member='JobRemoved'"
+stdbuf -oL dbus-monitor --system --monitor "$monitor_expr" > "$tmp_dir/dbus-monitor.pipe" 2>"$tmp_dir/dbus-monitor.stderr" &
+dbus_monitor_pid=$!
+
+awk_expr="
+BEGIN {
+	found=0;
+	ready=0;
+}
+
+# Once we get the NameAcquired message we are sure dbus-monitor is connected
+# and will receive JobRemoved once it is sent. The reason we are getting this
+# message despite the filter we establish above is that it is sent directly to
+# us, which bypasses DBus filter expressions.
+/member=NameAcquired/ {
+	if (!ready) {
+		ready=1;
+		print ready > \"$tmp_dir/ready.pipe\";
+		close(\"$tmp_dir/ready.pipe\");
+	}
+}
+
+# This part matches an argument to JobRemoved that contains the name of the
+# tests.session-xxx.service name we picked earlier. Once we see this we are sure
+# the job is gone.
+/   string \"$unit_name\"/ {
+	found=1;
+	print \"found service file\";
+	fflush();
+	next;
+}
+
+# This matches any string argument but only takes effect once we found our
+# JobRemoved message. The order of arguments to JobRemoved is such that the
+# immediate successor of the service name is the result word. This is
+# translated to a pass / fail exit code from tests.session. Scanning this part
+# terminates awk.
+/string \".*\"/ {
+	if (found==1) {
+		print \"found result\";
+		print \$2 > \"$tmp_dir/result.pipe\";
+		fflush(\"\");
+		close(\"$tmp_dir/result.pipe\");
+		exit;
+	}
+}
+"
+awk -W interactive "$awk_expr" <"$tmp_dir/dbus-monitor.pipe" >"$tmp_dir/awk.log" 2>&1 &
+awk_pid=$!
+
+# Wait for dbus-monitor to start.
+cat "$tmp_dir/ready.pipe" >/dev/null
+
+# Use busctl to spawn a command. The command is wrapped in shell, runuser -l
+# and redirects to capture output. Sadly busctl doesn't support passing file
+# descriptors https://github.com/systemd/systemd/issues/14954 As a workaround
+# we pass a set of pipes. This is good for non-interactive work.
+# NOTE: /dev/stdin is provided explicitly to trigger special behavior in bash,
+# as otherwise background tasks are started with /dev/null for stdin.
+cat </dev/stdin >"$tmp_dir/stdin.pipe" &
+cat_stdin_pid=$!
+cat <"$tmp_dir/stdout.pipe" >&1 &
+cat_stdout_pid=$!
+cat <"$tmp_dir/stderr.pipe" >&2 &
+cat_stderr_pid=$!
+
+(
+	echo "#!/bin/sh"
+	test -n "$pid_file" && echo "echo \$$ >\"$pid_file\""
+	printf "exec "
+	for arg in "$@"; do
+		printf '%q ' "$arg"
+	done
+	echo
+)>"$tmp_dir/exec"
+chmod +x "$tmp_dir/exec"
+
+# We want to provide a SELinuxContext but systemd in older SELinux-using distributions
+# does not recognize this attribute. See https://github.com/systemd/systemd/blob/master/NEWS#L6402
+# The typical user context as reported by id -Z is: unconfined_u:unconfined_r:unconfined_t:s0
+selinux_context_arg=
+case $SPREAD_SYSTEM in
+	fedora-*|centos-*)
+		if [ "$(systemctl --version | head -n 1 | awk '{ print $2 }')" -gt 219 ]; then
+			selinux_context_arg="SELinuxContext s unconfined_u:unconfined_r:unconfined_t:s0"
+		fi
+		;;
+esac
+
+# NOTE: This shellcheck directive is for the $selinux_context_arg expansion below.
+# shellcheck disable=SC2086
+busctl \
+	--allow-interactive-authorization=no --quiet \
+	--system \
+	-- \
+	call \
+	 org.freedesktop.systemd1 \
+	/org/freedesktop/systemd1 \
+	 org.freedesktop.systemd1.Manager \
+	StartTransientUnit "ssa(sv)a(sa(sv))" \
+	"$unit_name" fail $(( 4 + $(test -n "$selinux_context_arg" && echo 1 || echo 0))) \
+		Description s "tests.session running $* as $user" \
+		Type s oneshot \
+		Environment as 1 TERM=xterm-256color \
+		$selinux_context_arg \
+		ExecStart "a(sasb)" 1 \
+			"$(command -v runuser)" 6 "$(command -v runuser)" -l "$user" - -c "SNAPD_DEBUG=$SNAPD_DEBUG SNAP_CONFINE_DEBUG=$SNAP_CONFINE_DEBUG exec $tmp_dir/exec <$tmp_dir/stdin.pipe >$tmp_dir/stdout.pipe 2>$tmp_dir/stderr.pipe" false \
+	0
+# This is done so that we can configure file redirects. Once Ubuntu 16.04 is no
+# longer supported we can use Standard{Input,Output,Error}=file:path property
+# of systemd, or perhaps even StandardInputFileDescriptor and pass a file
+# descriptor to the FIFOs we open in the script above.
+
+# Wait for the service to terminate. The trigger is a successful read
+# from the result FIFO. In case we are signaled in one of the familiar
+# ways, kill the started service with the same signal. The reading occurs
+# in a loop as the signal will first interrupt the read process, which will
+# fail and return nothing.
+trap 'systemctl kill --signal=INT $unit_name' INT
+trap 'systemctl kill --signal=TERM $unit_name' TERM
+trap 'systemctl kill --signal=QUIT $unit_name' QUIT
+result=""
+for sig in INT TERM QUIT; do
+	result=$(cat "$tmp_dir/result.pipe" 2>/dev/null) && break
+	trap - "$sig"
+done
+trap - INT TERM QUIT
+
+# Kill dbus-monitor that otherwise runs until it notices the pipe is no longer
+# connected, which happens after a longer while. Redirect stderr to /dev/null
+# to avoid upsetting tests which are sensitive to stderr, e.g. tests/main/document-portal-activation
+kill $dbus_monitor_pid 2>/dev/null || true
+wait $dbus_monitor_pid 2>/dev/null || true
+wait $awk_pid
+
+wait "$cat_stdin_pid"
+wait "$cat_stdout_pid"
+wait "$cat_stderr_pid"
+
+# Prevent accumulation of failed sessions.
+
+if [ "$result" != '"done"' ]; then
+	systemctl reset-failed "$unit_name"
+fi
+
+case "$result" in
+	'"done"') exit 0; ;;
+	'"failed"') exit 1; ;;
+	'"canceled"') exit 1; ;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/core/apt/task.yaml snapd-2.48.3+20.04/tests/core/apt/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/apt/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/apt/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,24 +1,14 @@
-summary: Ensure that the apt output on UC16 is correct
-
+summary: Ensure that the core systems have a special apt placeholder
+systems: [ubuntu-core-*]
 execute: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
-    if is_core16_system; then
-        # UC16 has apt-get output a message
-        expected="Ubuntu Core does not use apt-get, see 'snap --help'!"
-        if apt-get update > output.txt; then
-            echo "apt should exit 1 but did not"
-            exit 1
-        fi
-        if [ "$(cat output.txt)" != "$expected" ]; then
-            echo "Unexpected apt output: $(cat output.txt)"
-            exit 1
-        fi
-    else 
-        # UC18+ does not have apt-get at all
-        if command -v apt-get; then
-            echo "apt-get command exists on Ubuntu Core, but should not!"
-            exit 1
-        fi
-    fi
+  case "$SPREAD_SYSTEM" in
+    # Some core systems have the fake apt-get script.
+    ubuntu-core-16-*|ubuntu-core-18-*)
+      apt-get | MATCH "Ubuntu Core does not use apt-get, see 'snap --help'!"
+      not apt-get
+      ;;
+    # Other systems do not.
+    ubuntu-core-*)
+      test "$(command -v apt-get)" = ""
+      ;;
+  esac
diff -Nru snapd-2.45.1+20.04.2/tests/core/backlight/task.yaml snapd-2.48.3+20.04/tests/core/backlight/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/backlight/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/backlight/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,21 @@
+summary: Test system.disable-backlight-service core config option
+
+environment:
+    MASKFILE: /etc/systemd/system/systemd-backlight@.service
+
+execute: |
+    echo "Backlight is not masked by default"
+    systemctl status systemd-backlight@foo | MATCH "Loaded: loaded"
+
+    echo "Check that backlight service can be disabled"
+    snap set core system.disable-backlight-service=true
+
+    systemctl status systemd-backlight@foo | MATCH "Loaded: masked"
+    test -L "$MASKFILE"
+    [ "$(readlink $MASKFILE)" = "/dev/null" ]
+        
+    echo "Check that backlight service can be enabled"
+    snap set core system.disable-backlight-service=false
+
+    systemctl status systemd-backlight@foo | MATCH "Loaded: loaded"
+    not test -e "$MASKFILE"
diff -Nru snapd-2.45.1+20.04.2/tests/core/basic20/task.yaml snapd-2.48.3+20.04/tests/core/basic20/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/basic20/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/basic20/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,9 +15,8 @@
     snap changes | MATCH "Done.*Initialize system state"
 
     echo "Check that a simple shell snap"
-    # TODO:UC20: add test-snapd-sh-core20
-    snap install test-snapd-sh-core18
-    test-snapd-sh-core18.sh -c 'echo hello' | MATCH hello
+    snap install test-snapd-sh-core20
+    test-snapd-sh-core20.sh -c 'echo hello' | MATCH hello
 
     if python3 -m json.tool < /var/lib/snapd/system-key | grep '"build-id": ""'; then
         echo "The build-id of snapd must not be empty."
@@ -25,15 +24,43 @@
     fi
 
     echo "Ensure passwd/group is available for snaps"
-    test-snapd-sh-core18.sh -c 'cat /var/lib/extrausers/passwd' | MATCH test
+    test-snapd-sh-core20.sh -c 'cat /var/lib/extrausers/passwd' | MATCH test
 
-    echo "Ensure extracted kernel.efi exists"
-    test -e /boot/grub/pc-kernel*/kernel.efi
-    test -e /boot/grub/kernel.efi
+    #shellcheck source=tests/lib/names.sh
+    . "$TESTSLIB"/names.sh
+
+    if [[ "$SPREAD_SYSTEM" = ubuntu-core-20-64 ]]; then
+        echo "Ensure extracted kernel.efi exists"
+        test -e /boot/grub/"$kernel_name"*/kernel.efi
+
+        echo "Ensure kernel.efi is a symlink"
+        test -L /boot/grub/kernel.efi
+
+        echo "Ensure we are using managed boot assets"
+        MATCH '# Snapd-Boot-Config-Edition: [0-9]+' < /boot/grub/grub.cfg
+        MATCH '# Snapd-Boot-Config-Edition: [0-9]+' < /run/mnt/ubuntu-seed/EFI/ubuntu/grub.cfg
+    else
+        echo "Ensure extracted {kernel,initrd}.img exists"
+        test -e /run/mnt/ubuntu-seed/systems/*/kernel/kernel.img
+        test -e /run/mnt/ubuntu-seed/systems/*/kernel/initrd.img
+    fi
+
+    echo "Ensure that model was written to ubuntu-boot"
+    test -e /run/mnt/ubuntu-boot/device/model
 
     # ensure that our the-tool (and thus our snap-bootstrap ran)
+    # for external backend the initramfs is not rebuilt
     echo "Check that we booted with the rebuilt initramfs in the kernel snap"
-    test -e /writable/system-data/the-tool-ran
+    if [ "$SPREAD_BACKEND" != "external" ]; then
+        test -e /writable/system-data/the-tool-ran
+    fi
+
+    # ensure we handled cloud-init, either we have:
+    # a) cloud init is disabled
+    # b) there was a cloud.cfg.d override (e.g. MAAS), then we must have more
+    #    files in writable than in the core20 snap. The core20 content and the
+    #    extra config will be merged
+    test -e /writable/system-data/etc/cloud/cloud-init.disabled || [ "$(find /writable/system-data/etc/cloud/cloud.cfg.d/ | wc -l)" -gt "$(find /snap/core20/current/etc/cloud/cloud.cfg.d/ | wc -l)" ]
 
     # ensure that we have no symlinks from /var/lib/snapd/snaps to
     # /var/lib/snapd/seed
@@ -44,12 +71,10 @@
         fi
     done
 
-    # TODO:UC20: move to the nested test
-    #if [ -e /dev/tpm0 ]; then
-    #    echo "The recovery key is available"
-    #    test -e /var/lib/snapd/device/fde/recovery-key
-    #    echo "... and has the expected size"
-    #    test "$(stat --printf=%s /var/lib/snapd/device/fde/recovery-key)" = "16"
-    #    echo "... and has the expected owner and permissions"
-    #    test "$(stat --printf='%u:%g %a' /var/lib/snapd/device/fde/recovery-key)" = "0:0 600"
-    #fi
+    # ensure the "snap recovery" command works
+    MODEL="$(snap model --verbose | grep '^model' | awk '{ print $2 }')"
+    BRAND_ID="$(snap model --verbose | grep '^brand-id:' | awk '{print $2}')"
+    if [ "$(snap known account "username=$BRAND_ID" | grep '^validation:' | awk '{print $2}')" != "unproven" ]; then
+        BRAND_ID="$BRAND_ID\*"
+    fi
+    snap recovery --unicode=never | MATCH "[0-9]+ +$BRAND_ID +$MODEL +current"
diff -Nru snapd-2.45.1+20.04.2/tests/core/classic-snap16/task.yaml snapd-2.48.3+20.04/tests/core/classic-snap16/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/classic-snap16/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/classic-snap16/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,7 +18,7 @@
     rm -f /etc/sudoers.d/create-test
     # Undo the change done by the classic snap.
     # FIXME: https://github.com/snapcore/classic-snap/issues/32
-    if [ "$(mountinfo-tool /dev/pts .sb_opts)" = "rw,mode=666,ptmxmode=666" ]; then
+    if [ "$(mountinfo.query /dev/pts .sb_opts)" = "rw,mode=666,ptmxmode=666" ]; then
         mount devpts -t devpts /dev/pts -o remount,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000
     fi
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/config-defaults-once/manip_seed.py snapd-2.48.3+20.04/tests/core/config-defaults-once/manip_seed.py
--- snapd-2.45.1+20.04.2/tests/core/config-defaults-once/manip_seed.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/config-defaults-once/manip_seed.py	1970-01-01 00:00:00.000000000 +0000
@@ -1,22 +0,0 @@
-import sys
-import yaml
-from os import path
-
-with open(sys.argv[1]) as f:
-    seed = yaml.load(f)
-
-i = 0
-snaps = seed["snaps"]
-while i < len(snaps):
-    entry = snaps[i]
-    if entry["name"] == "pc":
-        snaps[i] = {
-            "name": "pc",
-            "unasserted": True,
-            "file": "pc_x1.snap",
-        }
-        break
-    i += 1
-
-with open(sys.argv[1], "w") as f:
-    yaml.dump(seed, stream=f, indent=2, default_flow_style=False)
diff -Nru snapd-2.45.1+20.04.2/tests/core/config-defaults-once/task.yaml snapd-2.48.3+20.04/tests/core/config-defaults-once/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/config-defaults-once/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/config-defaults-once/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -14,44 +14,48 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
 
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    unsquashfs -no-progress /var/lib/snapd/snaps/pc_*.snap
+    clean_snapd_lib
+
+    # Configure the pc snap
+    unpack_pc_snap
 
     # Update the gadget config file
     cat "$GADGET_FILE" >> squashfs-root/meta/gadget.yaml
 
-    mksquashfs squashfs-root pc_x1.snap -comp xz -no-fragments -no-progress
-    rm -rf squashfs-root
-    cp pc_x1.snap /var/lib/snapd/seed/snaps/
-    cp /var/lib/snapd/seed/seed.yaml seed.yaml.bak
-    python3 ./manip_seed.py /var/lib/snapd/seed/seed.yaml
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+    pack_pc_snap
+
+    # Generic setup for test account
+    # shellcheck disable=SC2119
+    prepare_and_manip_seed
+    prepare_test_account developer1
+    prepare_testrootorg_store
 
     # kick first boot again
     systemctl start snapd.service snapd.socket
 
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
 
     # XXX: this should work once it is possible to install snapd on core
     SNAP=snapd
     SERVICES="ssh rsyslog"
-    if is_core18_system; then
+    if os.query is-core18; then
         # a core18 already has a snapd snap, verify whether installation of core
         # does not break the configuration
         SNAP=core
@@ -66,21 +70,11 @@
         systemctl start "$service.service" || true
     done
 
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-
-    if systemctl status snap-pc-x1.mount ; then
-       systemctl stop snap-pc-x1.mount
-       rm -f /etc/systemd/system/snap-pc-x1.mount
-       rm -f /etc/systemd/system/multi-user.target.wants/snap-pc-x1.mount
-       rm -f /var/lib/snapd/snaps/pc_x1.snap
-       systemctl daemon-reload
-    fi
-    rm /var/lib/snapd/seed/snaps/pc_x1.snap
+    clean_snapd_lib
+
+    # Restore pc snap configuration
+    restore_pc_snap
 
     REVNO="$(readlink /snap/$SNAP/current)"
     sysp=$(systemd-escape --path "/snap/$SNAP/$REVNO.mount")
@@ -95,36 +89,33 @@
     rm -f "/var/lib/snapd/seed/snaps/${SNAP}"_*.snap
     rm -f "/var/lib/snapd/seed/assertions/${SNAP}"_*.assert
 
-    cp seed.yaml.bak /var/lib/snapd/seed/seed.yaml
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
+    # Generic restore for test account
+    restore_updated_seed
+    restore_test_account developer1
+    restore_testrootorg_store
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    retry-tool -n 60 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
+    wait_for_first_boot_change
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
 
     # XXX: this should work once it is possible to install snapd on core
     SNAP=snapd
     SERVICES="ssh rsyslog"
-    if is_core18_system; then
+    if os.query is-core18; then
         # a core18 already has a snapd snap, verify whether installation of core
         # does not break the configuration
         SNAP=core
         SERVICES=ssh
     fi
 
-    if [ "$TRUST_TEST_KEYS" = "false" ]; then
-        echo "This test needs test keys to be trusted"
-        exit
-    fi
-    echo "Wait for first boot to be done"
-    retry-tool -n 60 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
-
     echo "The defaults are applied"
     for service in $SERVICES; do
         snap get system "service.$service.disable" | MATCH true
@@ -146,6 +137,6 @@
     test ! -e /etc/ssh/sshd_not_to_be_run
 
     # Unmask rsyslog service on core18
-    if is_core18_system; then
+    if os.query is-core18; then
         systemctl unmask rsyslog
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/core-to-snapd-failover16/task.yaml snapd-2.48.3+20.04/tests/core/core-to-snapd-failover16/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/core-to-snapd-failover16/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/core-to-snapd-failover16/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,12 +6,17 @@
 prepare: |
   # shellcheck source=tests/lib/snaps.sh
   . "$TESTSLIB/snaps.sh"
-  repack_core_snap_into_snapd_snap
+  repack_installed_core_snap_into_snapd_snap
 
-execute: |
-  # shellcheck source=tests/lib/journalctl.sh
-  . "$TESTSLIB/journalctl.sh"
+restore: |
+  rm -f /etc/systemd/user/snapd.session-agent.service
+  rm -f /etc/systemd/user/snapd.session-agent.socket
+  rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+  systemctl --user daemon-reload
+  rm -f /etc/dbus-1/session.d/snapd.session-services.conf
+  rm -f /etc/dbus-1/system.d/snapd.system-services.conf
 
+execute: |
   echo "Re-pack snapd with broken snapd"
   unsquashfs -d ./snapd-broken snapd-from-core.snap
   echo "" > ./snapd-broken/usr/lib/snapd/snapd
@@ -25,7 +30,7 @@
   for _ in $(seq 1 2); do
     # get the number of times that snapd.failure was started before we do 
     # anything
-    started_before="$(get_journalctl_log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
+    started_before="$("$TESTSTOOLS"/journal-state get-log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
 
     echo "Now install the broken snapd"
     if snap install --dangerous ./snapd-broken/snapd_*.snap; then
@@ -37,7 +42,7 @@
     #shellcheck disable=SC2165
     for _ in $(seq 60); do
         # get the number of times that snapd.failure was started
-        started_after="$(get_journalctl_log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
+        started_after="$("$TESTSTOOLS"/journal-state get-log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
         if [ "$started_after" -gt "$started_before" ] ; then
             break
         fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/create-user/task.yaml snapd-2.48.3+20.04/tests/core/create-user/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/create-user/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/create-user/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,6 @@
 summary: Ensure that snap create-user works in ubuntu-core
 # FIXME: combine this test with tests/core/create-user-2?
 
-# TODO:UC20: enable for UC20
-systems: [ubuntu-core-1*]
-
 environment:
     USER_EMAIL: mvo@ubuntu.com
     USER_NAME: mvo
diff -Nru snapd-2.45.1+20.04.2/tests/core/create-user-2/task.yaml snapd-2.48.3+20.04/tests/core/create-user-2/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/create-user-2/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/create-user-2/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,5 @@
 summary: Ensure create-user functionality
 
-# TODO:UC20: enable on UC20
-systems: [ubuntu-core-1*]
-
 environment:
     USER_EMAIL: mvo@ubuntu.com
     USER_NAME: mvo
diff -Nru snapd-2.45.1+20.04.2/tests/core/custom-device-reg/manip_seed.py snapd-2.48.3+20.04/tests/core/custom-device-reg/manip_seed.py
--- snapd-2.45.1+20.04.2/tests/core/custom-device-reg/manip_seed.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/custom-device-reg/manip_seed.py	1970-01-01 00:00:00.000000000 +0000
@@ -1,21 +0,0 @@
-import sys
-import yaml
-
-with open(sys.argv[1]) as f:
-    seed = yaml.load(f)
-
-i = 0
-snaps = seed["snaps"]
-while i < len(snaps):
-    entry = snaps[i]
-    if entry["name"] == "pc":
-        snaps[i] = {
-            "name": "pc",
-            "unasserted": True,
-            "file": "pc_x1.snap",
-        }
-        break
-    i += 1
-
-with open(sys.argv[1], "w") as f:
-    yaml.dump(seed, stream=f, indent=2, default_flow_style=False)
diff -Nru snapd-2.45.1+20.04.2/tests/core/custom-device-reg/task.yaml snapd-2.48.3+20.04/tests/core/custom-device-reg/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/custom-device-reg/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/custom-device-reg/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,77 +11,71 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
 
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    unsquashfs -no-progress /var/lib/snapd/snaps/pc_*.snap
+    clean_snapd_lib
+
+    # Configure the pc snap
+    unpack_pc_snap
+
     mkdir -p squashfs-root/meta/hooks
     cp prepare-device squashfs-root/meta/hooks
-    mksquashfs squashfs-root pc_x1.snap -comp xz -no-fragments -no-progress
-    rm -rf squashfs-root
-    cp pc_x1.snap /var/lib/snapd/seed/snaps/
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp /var/lib/snapd/seed/seed.yaml seed.yaml.bak
-    python3 ./manip_seed.py /var/lib/snapd/seed/seed.yaml
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    if is_core18_system; then
-        cp "$TESTSLIB"/assertions/developer1-pc-18.model /var/lib/snapd/seed/assertions/developer1-pc.model
-    else
-        cp "$TESTSLIB"/assertions/developer1-pc.model /var/lib/snapd/seed/assertions
-    fi
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+
+    pack_pc_snap
+
+    # Generic setup for test account
+    prepare_core_model
+    # shellcheck disable=SC2119
+    prepare_and_manip_seed
+    prepare_test_account developer1
+    prepare_test_model developer1-pc
+    prepare_testrootorg_store
+
     # start fake device svc
-    systemd_create_and_start_unit fakedevicesvc "$(command -v fakedevicesvc) localhost:11029"
+    #shellcheck disable=SC2148
+    systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
 
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+
+    systemctl stop snapd.service snapd.socket fakedevicesvc
+    clean_snapd_lib
+
+    # Restore pc snap configuration
+    restore_pc_snap
+
+    # Generic restore for test account
+    restore_updated_seed
+    restore_test_account developer1
+    restore_test_model developer1-pc
+    restore_testrootorg_store
+    restore_core_model
 
-    systemctl stop snapd.service snapd.socket
-    systemd_stop_and_destroy_unit fakedevicesvc
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    if systemctl status snap-pc-x1.mount ; then
-       systemctl stop snap-pc-x1.mount
-       rm -f /etc/systemd/system/snap-pc-x1.mount
-       rm -f /etc/systemd/system/multi-user.target.wants/snap-pc-x1.mount
-       rm -f /var/lib/snapd/snaps/pc_x1.snap
-       systemctl daemon-reload
-    fi
-    rm -f /var/lib/snapd/seed/snaps/pc_x1.snap
-    cp seed.yaml.bak /var/lib/snapd/seed/seed.yaml
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/developer1-pc.model
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
-    cp model.bak /var/lib/snapd/seed/assertions/model
-    rm -f ./*.bak
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+    wait_for_first_boot_change
 
 execute: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-    echo "Wait for first boot to be done"
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+
     echo "We have a model assertion"
     snap model --verbose|MATCH "model:\s* my-model"
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/custom-device-reg-extras/manip_seed.py snapd-2.48.3+20.04/tests/core/custom-device-reg-extras/manip_seed.py
--- snapd-2.45.1+20.04.2/tests/core/custom-device-reg-extras/manip_seed.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/custom-device-reg-extras/manip_seed.py	1970-01-01 00:00:00.000000000 +0000
@@ -1,21 +0,0 @@
-import sys
-import yaml
-
-with open(sys.argv[1]) as f:
-    seed = yaml.load(f)
-
-i = 0
-snaps = seed["snaps"]
-while i < len(snaps):
-    entry = snaps[i]
-    if entry["name"] == "pc":
-        snaps[i] = {
-            "name": "pc",
-            "unasserted": True,
-            "file": "pc_x1.snap",
-        }
-        break
-    i += 1
-
-with open(sys.argv[1], "w") as f:
-    yaml.dump(seed, stream=f, indent=2, default_flow_style=False)
diff -Nru snapd-2.45.1+20.04.2/tests/core/custom-device-reg-extras/task.yaml snapd-2.48.3+20.04/tests/core/custom-device-reg-extras/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/custom-device-reg-extras/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/custom-device-reg-extras/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -12,67 +12,63 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
 
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    unsquashfs -no-progress /var/lib/snapd/snaps/pc_*.snap
+    clean_snapd_lib
+
+    # Configure the pc snap
+    unpack_pc_snap
+
     mkdir -p squashfs-root/meta/hooks
     cp prepare-device squashfs-root/meta/hooks
-    mksquashfs squashfs-root pc_x1.snap -comp xz -no-fragments -no-progress
-    rm -rf squashfs-root
-    cp pc_x1.snap /var/lib/snapd/seed/snaps/
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp /var/lib/snapd/seed/seed.yaml seed.yaml.bak
-    python3 ./manip_seed.py /var/lib/snapd/seed/seed.yaml
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    if is_core18_system; then
-        cp "$TESTSLIB"/assertions/developer1-pc-18.model /var/lib/snapd/seed/assertions/developer1-pc.model
-    else
-        cp "$TESTSLIB"/assertions/developer1-pc.model /var/lib/snapd/seed/assertions
-    fi
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+
+    pack_pc_snap
+
+    # Generic setup for test account
+    prepare_core_model
+    # shellcheck disable=SC2119
+    prepare_and_manip_seed
+    prepare_test_account developer1
+    prepare_test_model developer1-pc
+    prepare_testrootorg_store
+
     # start fake device svc
-    systemd_create_and_start_unit fakedevicesvc "$(command -v fakedevicesvc) localhost:11029"
+    #shellcheck disable=SC2148
+    systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
 
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
-    systemctl stop snapd.service snapd.socket
-    systemd_stop_and_destroy_unit fakedevicesvc
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    if systemctl status snap-pc-x1.mount ; then
-       systemctl stop snap-pc-x1.mount
-       rm -f /etc/systemd/system/snap-pc-x1.mount
-       rm -f /etc/systemd/system/multi-user.target.wants/snap-pc-x1.mount
-       rm -f /var/lib/snapd/snaps/pc_x1.snap
-       systemctl daemon-reload
-    fi
-    rm -f /var/lib/snapd/seed/snaps/pc_x1.snap
-    cp seed.yaml.bak /var/lib/snapd/seed/seed.yaml
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/developer1-pc.model
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
-    cp model.bak /var/lib/snapd/seed/assertions/model
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+    systemctl stop snapd.service snapd.socket fakedevicesvc
+    clean_snapd_lib
+
+    # Restore pc snap configuration
+    restore_pc_snap
+
+    # Generic restore for test account
+    restore_updated_seed
+    restore_test_account developer1
+    restore_test_model developer1-pc
+    restore_testrootorg_store
+    restore_core_model
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+    wait_for_first_boot_change
 
 execute: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/core/device-reg/task.yaml snapd-2.48.3+20.04/tests/core/device-reg/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/device-reg/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/device-reg/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,14 +2,9 @@
     Ensure after device initialisation registration worked and
     we have a serial and can acquire a session macaroon
 
-# TODO:UC20: enable on arm when we have the model names for these devices
-systems: [-ubuntu-core-20-arm*]
-
 execute: |
     #shellcheck source=tests/lib/names.sh
     . "$TESTSLIB"/names.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
 
     echo "Wait for first boot to be done"
     while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
@@ -32,6 +27,9 @@
         ubuntu-core-20-64)
             snap model --serial --assertion | MATCH "model: ubuntu-core-20-amd64"
             ;;
+        ubuntu-core-20-arm-*)
+            snap model --serial --assertion | MATCH "model: ubuntu-core-20-$gadget_name"
+            ;;
         ubuntu-core-18-64)
             snap model --serial --assertion | MATCH "model: ubuntu-core-18-amd64"
             ;;
diff -Nru snapd-2.45.1+20.04.2/tests/core/enable-disable-units-gpio/task.yaml snapd-2.48.3+20.04/tests/core/enable-disable-units-gpio/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/enable-disable-units-gpio/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/enable-disable-units-gpio/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,8 +10,7 @@
     a reboot the systemd service tries to regenerate the gpio device node if it does not
     find it.
 
-# TODO:UC20: enable for UC20
-systems: [ubuntu-core-1*-64]
+systems: [ubuntu-core-*-64]
 
 prepare: |
     # Core image that were created using spread will have a fake "gpio-pin".
@@ -25,12 +24,10 @@
     # shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB/systemd.sh"
     echo "Create/enable fake gpio"
-    systemd_create_and_start_persistent_unit fake-gpio "$TESTSLIB/fakegpio/fake-gpio.py" "[Unit]\\nBefore=snap.core.interface.gpio-100.service\\n[Service]\\nType=notify"
+    systemd_create_and_start_unit fake-gpio "$TESTSLIB/fakegpio/fake-gpio.py" "[Unit]\\nBefore=snap.core.interface.gpio-100.service\\n[Service]\\nType=notify"
 
     echo "Given a snap declaring a plug on gpio is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local gpio-consumer
+    "$TESTSTOOLS"/snaps-state install-local gpio-consumer
 
     echo "And the gpio plug is connected"
     snap connect gpio-consumer:gpio :gpio-pin
@@ -46,7 +43,7 @@
 
     # shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB/systemd.sh"
-    system_stop_and_remove_persistent_unit fake-gpio
+    systemd_stop_and_remove_unit fake-gpio
     umount /sys/class/gpio || true
 
 execute: |
@@ -58,13 +55,10 @@
         exit 0
     fi
 
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "Then the snap service units concerning the gpio device must be run before and after a reboot"
     expected="Unit snap.core.interface.gpio-100.service has finished starting up"
-    for i in $(seq 120); do
-        get_journalctl_log -xe --no-pager | MATCH "$expected"
+    for _ in $(seq 120); do
+        "$TESTSTOOLS"/journal-state get-log -xe --no-pager | MATCH "$expected"
         sleep 0.5
     done
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/failover/task.yaml snapd-2.48.3+20.04/tests/core/failover/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/failover/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/failover/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -68,8 +68,6 @@
     . "$TESTSLIB"/names.sh
     #shellcheck source=tests/lib/boot.sh
     . "$TESTSLIB"/boot.sh
-    #shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB"/journalctl.sh
     #shellcheck source=tests/lib/snaps.sh
     . "$TESTSLIB"/snaps.sh
 
@@ -93,7 +91,7 @@
         mksnap_fast "$BUILD_DIR/unpack" failing.snap
 
         # use journalctl wrapper to grep only the logs collected while the test is running
-        if get_journalctl_log | MATCH "Waiting for system reboot"; then
+        if "$TESTSTOOLS"/journal-state get-log | MATCH "Waiting for system reboot"; then
             echo "Already waiting for system reboot, exiting..."
             exit 1
         fi
@@ -104,13 +102,13 @@
         # use journalctl wrapper to grep only the logs collected while the test is running
         # waiting up to 100s to reach waiting for reboot
         for _ in $(seq 50); do
-            if check_journalctl_log "Waiting for system reboot"; then
+            if "$TESTSTOOLS"/journal-state match-log "Waiting for system reboot"; then
                  break
             fi
             sleep 2
         done
 
-        if ! check_journalctl_log "Waiting for system reboot"; then
+        if ! "$TESTSTOOLS"/journal-state match-log "Waiting for system reboot"; then
             echo "Taking too long to reach waiting for reboot"
             exit 1
         fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/fsck-on-boot/task.yaml snapd-2.48.3+20.04/tests/core/fsck-on-boot/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/fsck-on-boot/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/fsck-on-boot/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,88 @@
+summary: the boot base provides essential fsck programs
+details: |
+  Snapd uses vfat on certain essential boot partitions, due to external
+  requirements imposed by the bootloader architecture. This test verifies that
+  the boot process is capable of detecting unclean vfat and fixing it before
+  such file system is mounted. This is an essential property to ensure
+  longevity of devices that rely on write to vfat to operate.
+prepare: |
+  tests.cleanup prepare
+execute: |
+  unmount_vfat() {
+    if os.query is-core16; then
+      # Refer to the core 16 PC gadget for details:
+      # https://github.com/snapcore/pc-amd64-gadget/blob/16/gadget.yaml
+      umount /boot/efi
+      umount /boot/grub
+    elif os.query is-core18; then
+      # Refer to the core 18 PC gadget for details:
+      # https://github.com/snapcore/pc-amd64-gadget/blob/18/gadget.yaml
+      umount /boot/efi
+      umount /boot/grub
+    elif os.query is-core20; then
+      # TODO:UC20 The property of having to keep a mounted vfat at all time
+      # is not the most fortunate. Any power loss will result in a dirty
+      # filesystem. Could ubuntu-seed be re-mounted read-only at some point
+      # during the start-up process?  Power loss on read-only vfat is
+      # harmless in comparison.
+
+      # The snapd snap from the recovery system will only be mounted if we are
+      # on the first boot - subsequent boots do not mount it, because we will
+      # unset RecoverySystem in the modeenv, and it's not necessary for
+      # seeding anymore
+      if mountpoint /run/mnt/snapd >/dev/null; then
+        umount /run/mnt/ubuntu-seed/systems/*/snaps/snapd_*.snap
+      fi
+      umount /var/lib/snapd/seed
+      umount /run/mnt/ubuntu-seed
+      umount /boot/efi
+    else
+      echo "Please adjust the test to support this core system"
+      false
+    fi
+  }
+
+  case "$SPREAD_REBOOT" in
+    0)
+      echo "We can corrupt the boot partition"
+      # FAT uses a specific byte to effectively indicate that the file system is
+      # dirty. The precise details as to how this byte is used by each system vary,
+      # but Linux sets it on a non-read-only mount, and clears it on unmount. We
+      # can set it manually, verify it when the image is mounted and observe fsck
+      # clearing it. Note that larger block devices use FAT32 and the offset
+      # differs. FAT12 and FAT16 uses 37 while FAT32 uses 65.
+      unmount_vfat
+      # Use offset 65 as FAT32 kicks in for devices larger than 32MB
+      printf "\x01" > one
+      tests.cleanup defer rm -f one
+      dd if=one of=/dev/sda2 seek=65 bs=1 count=1 conv=notrunc
+      tests.cleanup pop
+
+      # Reboot to give the early boot process a chance to fix the corruption.
+      REBOOT
+      ;;
+    1)
+      echo "On the next boot, we should not see the dirty flag anymore"
+      # Note that we cannot read the dirty byte from the filesystem as it is
+      # automatically set by the kernel when vfat is mounted. We must resort
+      # to observing the kernel ring buffer. Should this message ever change, the
+      # sister fsck-vfat test does a controlled experiment in mounting a dirty
+      # vfat, to ensure that we are aware of such changes.
+      dmesg -c > dmesg-on-boot.log
+      NOMATCH "Volume was not properly unmounted. Some data may be corrupt. Please run fsck." < dmesg-on-boot.log
+
+      # Unmount vfat again and read the dirty flag manually. The kernel doesn't
+      # clean the dirty flag on unmount, if it was present on mount. This method is
+      # less sensitive to kernel log messages being preserved in the early boot
+      # chain.
+      unmount_vfat
+      cat /proc/self/mountinfo >boot1-after-umount.log
+      dd if=/dev/sda2 of=dirty skip=65 bs=1 count=1 conv=notrunc
+      test "$(od -t x1 -A n dirty)" = " 00"  # NOTE: the leading space is relevant
+
+      # Reboot to restore mount points.
+      REBOOT
+      ;;
+  esac
+restore: |
+  tests.cleanup restore
diff -Nru snapd-2.45.1+20.04.2/tests/core/fsck-vfat/task.yaml snapd-2.48.3+20.04/tests/core/fsck-vfat/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/fsck-vfat/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/fsck-vfat/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,67 @@
+summary: the boot base provides essential fsck programs
+details: |
+  Snapd uses vfat on certain essential boot partitions, due to external
+  requirements imposed by the bootloader architecture. This test verifies
+  that fsck.vfat is shipped in the image, and that it can correctly clean
+  the dirty bit that is artificially set by this test.
+
+  A separate test examines how fsck is automatically invoked during the boot
+  process. This is not verified here.
+prepare: |
+  tests.cleanup prepare
+execute: |
+  echo "Essential fsck programs are in the boot base"
+  test -n "$(command -v fsck.vfat)"
+  test -n "$(command -v fsck.fat)"
+  test -n "$(command -v fsck.ext2)"
+  test -n "$(command -v fsck.ext3)"
+  test -n "$(command -v fsck.ext4)"
+
+  echo "mkfs.vfat can create a FAT 12 filesystem"
+  dd if=/dev/zero of=fat.img bs=1M count=1
+  mkfs.vfat fat.img > mkfs.vfat.log
+
+  echo "fsck.fat reports all-ok on such filesystem"
+  fsck.vfat fat.img > fsck.vfat.vanilla.log
+  MATCH 'fat.img: 0 files, 0/502 clusters' <fsck.vfat.vanilla.log
+
+  echo "We can simulate uncleanly unmounted FAT"
+  # FAT uses a specific byte to effectively indicate that the file system is
+  # dirty. The precise details as to how this byte is used by each system vary,
+  # but Linux sets it on a non-read-only mount, and clears it on unmount. We
+  # can set it manually, verify it when the image is mounted and observe fsck
+  # clearing it. Note that larger block devices use FAT32 and the offset
+  # differs. FAT12 and FAT16 uses 37 while FAT32 uses 65.
+  printf "\x01" > one
+  tests.cleanup defer rm -f one
+  dd if=one of=fat.img seek=37 bs=1 count=1 conv=notrunc
+
+  echo "Mounting dirty FAT generated a kernel message"
+  mount fat.img /mnt
+  tests.cleanup defer umount /mnt
+  # If this ever fails because the kernel log message has changed, please
+  # adjust the fsck-on-boot tests as well. It relies on absence of this exact
+  # message.
+  dmesg -c | MATCH "Volume was not properly unmounted. Some data may be corrupt. Please run fsck."
+  tests.cleanup pop # unmount
+
+  echo "fsck.fat can fix such corruption"
+  set +e
+  fsck.vfat -v -a fat.img > fsck.vfat.dirty.log
+  retval=$?
+  set -e
+  test "$retval" -eq 1  # see fsck.vfat(8) for details
+  MATCH '0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt.' < fsck.vfat.dirty.log
+  MATCH 'Automatically removing dirty bit.' < fsck.vfat.dirty.log
+
+  echo "fsck.fat reports the file system as clean"
+  fsck.vfat -v -a fat.img > fsck.vfat.cleaned.log
+  not MATCH '0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt.' < fsck.vfat.cleaned.log
+
+  echo "Cleaned FAT mounts without warnings"
+  mount fat.img /mnt
+  tests.cleanup defer umount /mnt
+  dmesg -c | not MATCH "Volume was not properly unmounted. Some data may be corrupt. Please run fsck."
+  tests.cleanup pop # unmount
+restore: |
+  tests.cleanup restore
diff -Nru snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults/manip_seed.py snapd-2.48.3+20.04/tests/core/gadget-config-defaults/manip_seed.py
--- snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults/manip_seed.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/gadget-config-defaults/manip_seed.py	1970-01-01 00:00:00.000000000 +0000
@@ -1,28 +0,0 @@
-import sys
-import yaml
-from os import path
-
-with open(sys.argv[1]) as f:
-    seed = yaml.load(f)
-
-i = 0
-snaps = seed["snaps"]
-while i < len(snaps):
-    entry = snaps[i]
-    if entry["name"] == "pc":
-        snaps[i] = {
-            "name": "pc",
-            "unasserted": True,
-            "file": "pc_x1.snap",
-        }
-        break
-    i += 1
-
-# test-snapd-with-configure_123.snap -> test-snapd-configure
-snapname = path.basename(sys.argv[2]).split("_")[0]
-snaps.append(
-    {"name": snapname, "channel": "edge", "file": sys.argv[2],}
-)
-
-with open(sys.argv[1], "w") as f:
-    yaml.dump(seed, stream=f, indent=2, default_flow_style=False)
diff -Nru snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults/task.yaml snapd-2.48.3+20.04/tests/core/gadget-config-defaults/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/gadget-config-defaults/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -20,31 +20,26 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
 
-    if [ "$SERVICE" = "rsyslog" ] && is_core18_system; then
+    if [ "$SERVICE" = "rsyslog" ] && os.query is-core18; then
         echo "The service to test does not exist in the core18 system, skipping..."
         touch "${SERVICE}.skip"
         exit
     fi
 
-    SUFFIX=
-    MODEL=developer1-pc-w-config.model
-    if is_core18_system; then
-        SUFFIX=-core18
-        MODEL=developer1-pc-18-w-config.model
-    fi
+    SUFFIX="$(get_test_snap_suffix)"
 
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
+    clean_snapd_lib
+
     snap download --edge "test-snapd-with-configure${SUFFIX}"
-    unsquashfs -no-progress /var/lib/snapd/snaps/pc_*.snap
+
+    # Configure the pc snap
+    unpack_pc_snap
 
     # fill in defaults
     TEST_SNAP_ID=
@@ -52,7 +47,7 @@
         # test-snapd-with-configure
         TEST_SNAP_ID=jHxWQxtGqu7tHwiq7F8Ojk5qazcEeslT
 
-        if is_core18_system; then
+        if os.query is-core18; then
             # test-snapd-with-configure-core18
             TEST_SNAP_ID=jHxWQxtGqu7tHwiq7F8Ojk5qazcEeslT
         fi
@@ -60,7 +55,7 @@
         # test-snapd-with-configure
         TEST_SNAP_ID=aLcJorEJZgJNUGL2GMb3WR9SoVyHUNAd
 
-        if is_core18_system; then
+        if os.query is-core18; then
             # test-snapd-with-configure-core18
             TEST_SNAP_ID=BzMG26hwO2ccNBzV5BxK4DZgulJ2AXsa
         fi
@@ -70,22 +65,25 @@
     cat "$GADGET_FILE" >> squashfs-root/meta/gadget.yaml
     sed -i -e "s/TEST_SNAP_ID/$TEST_SNAP_ID/" squashfs-root/meta/gadget.yaml
 
-    mksquashfs squashfs-root pc_x1.snap -comp xz -no-fragments -no-progress
-    rm -rf squashfs-root
-    cp pc_x1.snap /var/lib/snapd/seed/snaps/
+    pack_pc_snap
+
     cp "test-snapd-with-configure${SUFFIX}"_*.snap /var/lib/snapd/seed/snaps/
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp /var/lib/snapd/seed/seed.yaml seed.yaml.bak
-    python3 ./manip_seed.py /var/lib/snapd/seed/seed.yaml "test-snapd-with-configure${SUFFIX}"_*.snap
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB/assertions/$MODEL" /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+    
+    # Generic setup for test account
+    prepare_core_model
+    prepare_and_manip_seed "test-snapd-with-configure${SUFFIX}"_*.snap
+    prepare_test_account developer1
+    prepare_test_model developer1-pc-w-config
+    prepare_testrootorg_store
+
     cp "test-snapd-with-configure${SUFFIX}"_*.assert /var/lib/snapd/seed/assertions
 
     # kick first boot again
     systemctl start snapd.service snapd.socket
 
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
@@ -96,16 +94,12 @@
         echo "The service to test does not exist in the system, skipping..."
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
 
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
-    SUFFIX=
-    MODEL=developer1-pc-w-config.model
-    if is_core18_system; then
-        SUFFIX=-core18
-        MODEL=developer1-pc-18-w-config.model
-    fi
+    SUFFIX="$(get_test_snap_suffix)"
 
     echo "Undo the service disable"
     if [ "$SERVICE" = ssh ]; then
@@ -116,21 +110,11 @@
     systemctl enable "$SERVICE.service" || true
     systemctl start "$SERVICE.service" || true
 
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-
-    if systemctl status snap-pc-x1.mount ; then
-       systemctl stop snap-pc-x1.mount
-       rm -f /etc/systemd/system/snap-pc-x1.mount
-       rm -f /etc/systemd/system/multi-user.target.wants/snap-pc-x1.mount
-       rm -f /var/lib/snapd/snaps/pc_x1.snap
-       systemctl daemon-reload
-    fi
-    rm /var/lib/snapd/seed/snaps/pc_x1.snap
+    clean_snapd_lib
+
+    # Restore pc snap configuration
+    restore_pc_snap
 
     TEST_REVNO=$(awk "/^snap-revision: / {print \$2}" "test-snapd-with-configure${SUFFIX}"_*.assert)
     if systemctl status "$(systemd-escape --path "/snap/test-snapd-with-configure${SUFFIX}/$TEST_REVNO.mount")"; then
@@ -142,38 +126,35 @@
     fi
     rm "/var/lib/snapd/seed/snaps/test-snapd-with-configure${SUFFIX}"_*.snap
 
-    cp seed.yaml.bak /var/lib/snapd/seed/seed.yaml
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f "/var/lib/snapd/seed/assertions/$MODEL"
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
+    # Generic restore for test account
+    restore_updated_seed
+    restore_test_account developer1
+    restore_test_model developer1-pc-w-config
+    restore_testrootorg_store
+    restore_core_model
+
     rm -f "/var/lib/snapd/seed/assertions/test-snapd-with-configure${SUFFIX}"_*.assert
-    cp model.bak /var/lib/snapd/seed/assertions/model
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+    wait_for_first_boot_change
 
 execute: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
     if [ -f "${SERVICE}.skip" ]; then
         echo "The service to test does not exist in the system, skipping..."
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
 
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
-    SUFFIX=
-    if is_core18_system; then
-        SUFFIX=-core18
-    fi
+    SUFFIX="$(get_test_snap_suffix)"
 
-    if [ "$TRUST_TEST_KEYS" = "false" ]; then
-        echo "This test needs test keys to be trusted"
-        exit
-    fi
-    echo "Wait for first boot to be done"
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
     echo "We have a model assertion"
     snap model --verbose|MATCH "model:\s* my-model-w-config"
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults-vitality/gadget-vitality-hint.yaml snapd-2.48.3+20.04/tests/core/gadget-config-defaults-vitality/gadget-vitality-hint.yaml
--- snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults-vitality/gadget-vitality-hint.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/gadget-config-defaults-vitality/gadget-vitality-hint.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+defaults:
+   system:
+     resilience:
+       vitality-hint: "unrelated-snap,pc,test-snapd-with-configure,test-snapd-with-configure-core18"
diff -Nru snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults-vitality/task.yaml snapd-2.48.3+20.04/tests/core/gadget-config-defaults-vitality/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/gadget-config-defaults-vitality/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/gadget-config-defaults-vitality/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,139 @@
+summary: |
+   Test that vitality defaults specified in the gadget are picked up
+   for first boot snaps
+
+# the test is only meaningful on core devices
+# TODO:UC20: enable for UC20, it assumes /var/lib/snapd/seed/assertions/model
+#            which we don't have currently
+systems: [ubuntu-core-1*]
+
+environment:
+    GADGET_FILE/vitality_hint: gadget-vitality-hint.yaml
+
+prepare: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
+
+    # Stop snapd and remove existing state, modify and repack gadget
+    # snap and provide developer assertions in order to force first
+    # boot again.
+    #
+    # TODO: find common pattern and extract code from the various tests
+    #       that use similar code to simulate a first-boot
+    systemctl stop snapd.service snapd.socket
+    clean_snapd_lib
+
+    SUFFIX="$(get_test_snap_suffix)"
+    snap download --edge "test-snapd-with-configure${SUFFIX}"
+    
+    # Configure the pc snap
+    unpack_pc_snap
+
+    # Update the gadget config file
+    cat "$GADGET_FILE" >> squashfs-root/meta/gadget.yaml
+    # add service to the gadget
+    cat <<EOF >> squashfs-root/meta/snap.yaml
+    apps:
+     other:
+      command: service
+      daemon: simple
+    EOF
+    cat <<EOF >> squashfs-root/service
+    #!/bin/sh
+    echo other service
+    exec sleep infinity
+    EOF
+    chmod +x squashfs-root/service
+
+    pack_pc_snap
+
+    cp "test-snapd-with-configure${SUFFIX}"_*.snap /var/lib/snapd/seed/snaps/
+    prepare_core_model
+    prepare_and_manip_seed "test-snapd-with-configure${SUFFIX}"_*.snap
+    
+    prepare_test_account developer1
+    prepare_test_model developer1-pc-w-config
+    prepare_testrootorg_store
+    cp "test-snapd-with-configure${SUFFIX}"_*.assert /var/lib/snapd/seed/assertions
+
+    # kick first boot again
+    systemctl start snapd.service snapd.socket
+
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
+restore: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+
+    SUFFIX="$(get_test_snap_suffix)"
+
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
+    systemctl stop snapd.service snapd.socket
+    clean_snapd_lib
+
+    # Restore pc snap configuration
+    restore_pc_snap
+
+    TEST_REVNO=$(awk "/^snap-revision: / {print \$2}" "test-snapd-with-configure${SUFFIX}"_*.assert)
+    if systemctl status "$(systemd-escape --path "/snap/test-snapd-with-configure${SUFFIX}/$TEST_REVNO.mount")"; then
+       systemctl stop "$(systemd-escape --path "/snap/test-snapd-with-configure${SUFFIX}/$TEST_REVNO.mount")"
+       rm -f "/etc/systemd/system/snap-test-snapd-with-configure${SUFFIX}-${TEST_REVNO}.mount"
+       rm -f "/etc/systemd/system/multi-user.target.wants/snap-test-snapd-with-configure${SUFFIX}-${TEST_REVNO}.mount"
+       rm -f "/var/lib/snapd/snaps/test-snapd-with-configure${SUFFIX}"_*.snap
+       systemctl daemon-reload
+    fi
+    rm "/var/lib/snapd/seed/snaps/test-snapd-with-configure${SUFFIX}"_*.snap
+
+    # Generic restore for test account
+    restore_updated_seed
+    restore_test_account developer1
+    restore_test_model developer1-pc-w-config
+    restore_testrootorg_store
+    restore_core_model
+
+    rm -f "/var/lib/snapd/seed/assertions/test-snapd-with-configure${SUFFIX}"_*.assert
+
+    # kick first boot again
+    systemctl start snapd.service snapd.socket
+
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
+execute: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+
+    SUFFIX="$(get_test_snap_suffix)"
+
+    echo "We have a model assertion"
+    snap model --verbose|MATCH "model:\s* my-model-w-config"
+
+    echo "The configurable snap was installed"
+    snap list|MATCH "test-snapd-with-configure${SUFFIX}"
+
+    echo "The configuration for the service is applied"
+    systemctl show snap.pc.other.service |MATCH "OOMScoreAdjust=-898"
+    if [ "$SUFFIX" = "" ]; then
+        systemctl show "snap.test-snapd-with-configure${SUFFIX}.some.service" | MATCH "OOMScoreAdjust=-897"
+    elif [ "$SUFFIX" = -"core18" ]; then
+        systemctl show "snap.test-snapd-with-configure${SUFFIX}.some.service" | MATCH "OOMScoreAdjust=-896"
+    else
+        echo "Unknown suffix $SUFFIX"
+        exit 1
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/gadget-update-pc/generate.py snapd-2.48.3+20.04/tests/core/gadget-update-pc/generate.py
--- snapd-2.45.1+20.04.2/tests/core/gadget-update-pc/generate.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/gadget-update-pc/generate.py	2021-02-02 08:21:12.000000000 +0000
@@ -11,26 +11,61 @@
         description="pc gadget yaml variant generator for test"
     )
     parser.add_argument(
+        "--system-seed", action="store_true", help="also modify system-seed"
+    )
+
+    parser.add_argument(
         "gadgetyaml", type=argparse.FileType("r"), help="path to gadget.yaml input file"
     )
     parser.add_argument("variant", help="test data variant", choices=["v1", "v2"])
     return parser.parse_args()
 
 
-def must_find_struct(structs, structure_type):
-    structs = [s for s in structs if s["type"] == structure_type]
-    if len(structs) != 1:
-        raise RuntimeError("unexpected number of structures: {}".format(cans))
-    return structs[0]
+def match_name(name):
+    return lambda struct: struct.get("name", "") == name
+
+
+def match_role_with_fallback(role):
+    def match(struct):
+        if "role" in struct:
+            struct_role = struct["role"]
+        elif "filesystem-label" in struct:
+            # fallback to filesystem-label
+            struct_role = struct["filesystem-label"]
+        else:
+            return False
+        return role == struct_role
+
+    return match
+
+
+def must_find_struct(structs, matcher):
+    found = [s for s in structs if matcher(s)]
+    if len(found) != 1:
+        raise RuntimeError("found {} matches among: {}".format(len(found), structs))
+    return found[0]
+
+
+def bump_update_edition(update):
+    if update is None:
+        return {"edition": 1}
+    if "edition" not in update:
+        update["edition"] = 1
+    else:
+        update["edition"] += 1
+    return update
 
 
-def make_v1(doc):
+def make_v1(doc, system_seed):
     # add new files to 'EFI System' partition, add new image file to 'BIOS
     # Boot', bump update edition for both
     structs = doc["volumes"]["pc"]["structure"]
-    efisystem = must_find_struct(structs, "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B")
-    biosboot = must_find_struct(structs, "DA,21686148-6449-6E6F-744E-656564454649")
+    # "EFI System" in UC16/UC18, or just system-boot in UC20
+    efisystem = must_find_struct(structs, match_role_with_fallback("system-boot"))
+    biosboot = must_find_struct(structs, match_name("BIOS Boot"))
 
+    # from UC16/UC18 gadgets:
+    #
     # - name: EFI System
     #   (not)type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     #   filesystem: vfat
@@ -51,7 +86,8 @@
     #  update:
     #      edition: 1
     efisystem["content"].append({"source": "foo.cfg", "target": "foo.cfg"})
-    efisystem["update"] = {"edition": 1}
+    efisystem["update"] = bump_update_edition(efisystem.get("update"))
+
     # - name: BIOS Boot
     #   (not)type: DA,21686148-6449-6E6F-744E-656564454649
     #   size: 1M
@@ -64,19 +100,44 @@
     #   update:
     #       edition: 1
     biosboot["content"].append({"image": "foo.img"})
-    biosboot["update"] = {"edition": 1}
+    biosboot["update"] = bump_update_edition(biosboot.get("update"))
+
+    if system_seed:
+        # from UC20 gadget:
+        #
+        # - name: ubuntu-seed
+        #   role: system-seed
+        #   filesystem: vfat
+        #   # UEFI will boot the ESP partition by default first
+        #   (not)type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+        #   size: 1200M
+        #   update:
+        #     edition: 2
+        #   content:
+        #     - source: grubx64.efi
+        #       target: EFI/boot/grubx64.efi
+        #     - source: shim.efi.signed
+        #       target: EFI/boot/bootx64.efi
+        #     - source: grub-recovery.conf
+        #       target: EFI/ubuntu/grub.cfg
+        systemseed = must_find_struct(structs, match_role_with_fallback("system-seed"))
+        systemseed["content"].append(
+            {"source": "foo-seed.cfg", "target": "foo-seed.cfg"}
+        )
+        systemseed["update"] = bump_update_edition(systemseed.get("update"))
+
     return doc
 
 
-def make_v2(doc):
+def make_v2(doc, system_seed):
     # appply v1, add more new files to 'EFI System' partition, preserve one of
     # the updated files, to 'BIOS Boot', bump update edition for both
 
-    doc = make_v1(doc)
+    doc = make_v1(doc, system_seed)
 
     structs = doc["volumes"]["pc"]["structure"]
-    efisystem = must_find_struct(structs, "EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B")
-    biosboot = must_find_struct(structs, "DA,21686148-6449-6E6F-744E-656564454649")
+    efisystem = must_find_struct(structs, match_role_with_fallback("system-boot"))
+    biosboot = must_find_struct(structs, match_name("BIOS Boot"))
     # - name: EFI System
     #   (not)type: EF,C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     #   filesystem: vfat
@@ -100,10 +161,11 @@
     #      edition: 2
     #      preserve: [foo.cfg, bar.cfg]
     efisystem["content"].append({"source": "bar.cfg", "target": "bar.cfg"})
-    efisystem["update"] = {
-        "edition": 2,
-        "preserve": ["foo.cfg", "bar.cfg"],
-    }
+    efisystem["update"] = bump_update_edition(efisystem.get("update"))
+    efisystem["update"]["preserve"] = efisystem["update"].get("preserve", []) + [
+        "foo.cfg",
+        "bar.cfg",
+    ]
     # - name: BIOS Boot
     #   (not)type: DA,21686148-6449-6E6F-744E-656564454649
     #   size: 1M
@@ -115,7 +177,14 @@
     #     - image: foo.img
     #   update:
     #       edition: 2
-    biosboot["update"] = {"edition": 2}
+    biosboot["update"] = bump_update_edition(biosboot.get("update"))
+
+    if system_seed:
+        # only in UC20 gadgets
+        systemseed = must_find_struct(structs, match_role_with_fallback("system-seed"))
+        # we already appended foo-boot.cfg, bump the edition so that it gets
+        # updated
+        systemseed["update"] = bump_update_edition(systemseed.get("update"))
 
     return doc
 
@@ -124,9 +193,9 @@
     doc = yaml.safe_load(opts.gadgetyaml)
 
     if opts.variant == "v1":
-        make_v1(doc)
+        make_v1(doc, opts.system_seed)
     elif opts.variant == "v2":
-        make_v2(doc)
+        make_v2(doc, opts.system_seed)
 
     yaml.dump(doc, sys.stdout)
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/gadget-update-pc/task.yaml snapd-2.48.3+20.04/tests/core/gadget-update-pc/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/gadget-update-pc/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/gadget-update-pc/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,8 +7,7 @@
     START_REVISION: 1000
 
 # the test is only meaningful on core devices
-# TODO:UC20: enable for UC20
-systems: [ubuntu-core-1*]
+systems: [ubuntu-core-*]
 
 prepare: |
     # external backends do not enable test keys
@@ -56,11 +55,19 @@
 
     cp pc-snap/meta/gadget.yaml gadget.yaml.orig
 
+    system_seed=""
+    if os.query is-core20 ; then
+        system_seed="--system-seed"
+    fi
+
     # prepare first update
-    python3 ./generate.py ./gadget.yaml.orig v1 > pc-snap/meta/gadget.yaml
+    python3 ./generate.py ./gadget.yaml.orig v1 $system_seed > pc-snap/meta/gadget.yaml
     echo 'this is foo-x2' > foo-x2.img
     cp foo-x2.img pc-snap/foo.img
     echo 'this is foo.cfg' > pc-snap/foo.cfg
+    if os.query is-core20; then
+        echo 'this is foo-seed.cfg' > pc-snap/foo-seed.cfg
+    fi
     sed -i -e 's/^version: \(.*\)-1/version: \1-2/' pc-snap/meta/snap.yaml
     snap pack pc-snap --filename=pc_x2.snap
     cat <<EOF > rev-headers-2.json
@@ -68,10 +75,13 @@
     EOF
 
     # prepare second update
-    python3 ./generate.py ./gadget.yaml.orig v2 > pc-snap/meta/gadget.yaml
+    python3 ./generate.py ./gadget.yaml.orig v2 $system_seed > pc-snap/meta/gadget.yaml
     echo 'this is updated foo-x3' > foo-x3.img
     cp foo-x3.img pc-snap/foo.img
     echo 'this is updated foo.cfg' > pc-snap/foo.cfg
+    if os.query is-core20; then
+        echo 'this is updated foo-seed.cfg' > pc-snap/foo-seed.cfg
+    fi
     echo 'this is bar.cfg' > pc-snap/bar.cfg
     sed -i -e 's/^version: \(.*\)-2/version: \1-3/' pc-snap/meta/snap.yaml
     snap pack pc-snap --filename=pc_x3.snap
@@ -126,6 +136,12 @@
     # - 'BIOS Boot' and 'EFI System' are modified during the update
     # - 'EFI System' is mounted at /boot/efi
 
+    bootdir=/boot/efi
+    if os.query is-core20; then
+        # /boot/efi is not mounted on UC20, so use the /run/mnt hierarchy
+        bootdir=/run/mnt/ubuntu-boot
+    fi
+
     if [[ "$SPREAD_REBOOT" == 0 ]]; then
 
         new_snap_declaration "$BLOB_DIR" pc_x2.snap --snap-decl-json decl-headers.json
@@ -143,7 +159,7 @@
         # verify the update
 
         # a filesystem structure entry was copied to the right place
-        test "$(cat /boot/efi/foo.cfg)" = 'this is foo.cfg'
+        test "$(cat "$bootdir"/foo.cfg)" = 'this is foo.cfg'
 
         szimg=$(stat -c '%s' /snap/pc/current/pc-core.img)
         # using foo.img from x2
@@ -152,6 +168,15 @@
         dd if='/dev/disk/by-partlabel/BIOS\x20Boot' skip="$szimg" bs=1 count="$szfoo" of=foo-written.img
         test "$(cat foo-written.img)" = 'this is foo-x2'
 
+        if os.query is-core20; then
+            # a filesystem structure entry was copied to the right place
+            test "$(cat /run/mnt/ubuntu-seed/foo-seed.cfg)" = 'this is foo-seed.cfg'
+
+            # managed boot config was preserved for boot and seed partitions
+            MATCH '# Snapd-Boot-Config-Edition: [0-9]+' < /boot/grub/grub.cfg
+            MATCH '# Snapd-Boot-Config-Edition: [0-9]+' < /run/mnt/ubuntu-seed/EFI/ubuntu/grub.cfg
+        fi
+
         # prepare & install the next update
         new_snap_declaration "$BLOB_DIR" pc_x3.snap --snap-decl-json decl-headers.json
         new_snap_revision "$BLOB_DIR" pc_x3.snap --snap-rev-json rev-headers-3.json
@@ -168,9 +193,9 @@
         # verify the update
 
         # a new filesystem structure entry was copied to the right place
-        test "$(cat /boot/efi/bar.cfg)" = 'this is bar.cfg'
+        test "$(cat "$bootdir"/bar.cfg)" = 'this is bar.cfg'
         # this one was preserved
-        test "$(cat /boot/efi/foo.cfg)" = 'this is foo.cfg'
+        test "$(cat "$bootdir"/foo.cfg)" = 'this is foo.cfg'
 
         # raw content was updated
         szimg=$(stat -c '%s' /snap/pc/current/pc-core.img)
@@ -180,4 +205,12 @@
         dd if='/dev/disk/by-partlabel/BIOS\x20Boot' skip="$szimg" bs=1 count="$szfoo" of=foo-updated-written.img
         test "$(cat foo-updated-written.img)" = 'this is updated foo-x3'
 
+        if os.query is-core20; then
+            # a filesystem structure entry was copied to the right place
+            test "$(cat /run/mnt/ubuntu-seed/foo-seed.cfg)" = 'this is updated foo-seed.cfg'
+
+            # managed boot config was preserved for boot and seed partitions
+            MATCH '# Snapd-Boot-Config-Edition: [0-9]+' < /boot/grub/grub.cfg
+            MATCH '# Snapd-Boot-Config-Edition: [0-9]+' < /run/mnt/ubuntu-seed/EFI/ubuntu/grub.cfg
+        fi
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/generic-device-reg/task.yaml snapd-2.48.3+20.04/tests/core/generic-device-reg/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/generic-device-reg/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/generic-device-reg/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,66 @@
+summary: |
+    Test that device initialisation and registration work with the model
+    specifying serial-authority: [generic]
+
+# TODO:UC20: enable for UC20, it assumes /var/lib/snapd/seed/assertions/model
+#            which we don't have currently
+systems: [ubuntu-core-18*]
+
+prepare: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+
+    systemctl stop snapd.service snapd.socket
+    rm -rf /var/lib/snapd/assertions/*
+    rm -rf /var/lib/snapd/device
+    rm -rf /var/lib/snapd/state.json
+    mv /var/lib/snapd/seed/assertions/model model.bak
+    # get the account and signing account-key of the
+    # pc-18-amd64-accept-generic.model's signer (pedronis)
+    snap known --remote account account-id=CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez > /var/lib/snapd/seed/assertions/pedronis.account
+    snap known --remote account-key public-key-sha3-384=x1Tnl94nkgb-rMDs_l63gvgkLYGjXKfpkCCIQZwJ72-LR6X6OrSvNS9z2WS1lAGz > /var/lib/snapd/seed/assertions/test-models.account-key
+    cp "$TESTSLIB"/assertions/pc-18-amd64-accept-generic.model /var/lib/snapd/seed/assertions/
+
+    # kick first boot again
+    systemctl start snapd.service snapd.socket
+
+restore: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+
+    systemctl stop snapd.service snapd.socket
+    rm -rf /var/lib/snapd/assertions/*
+    rm -rf /var/lib/snapd/device
+    rm -rf /var/lib/snapd/state.json
+    rm -f /var/lib/snapd/seed/assertions/pedronis.account
+    rm -f /var/lib/snapd/seed/assertions/test-models.account-key
+    rm -f /var/lib/snapd/seed/assertions/pc-18-amd64-accept-generic.model
+    cp model.bak /var/lib/snapd/seed/assertions/model
+    # kick first boot again
+    systemctl start snapd.service snapd.socket
+    # wait for first boot to be done
+    retry --maxmins 2 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
+
+execute: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+    echo "Wait for first boot to be done"
+    retry --maxmins 2 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
+
+    echo "We have a model assertion"
+    snap model --verbose|MATCH "model:\s* pc-18-amd64-accept-generic"
+
+    echo "Wait for device initialisation to be done"
+    retry --maxmins 2 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize device"'
+
+    echo "Check we have a serial with authority-id: generic"
+    snap model --serial --assertion|MATCH "authority-id: generic"
+    snap model --serial --assertion|MATCH "brand-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez"
+    snap model --serial --assertion|MATCH "model: pc-18-amd64-accept-generic"
+
diff -Nru snapd-2.45.1+20.04.2/tests/core/iio/task.yaml snapd-2.48.3+20.04/tests/core/iio/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/iio/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/iio/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,48 @@
+summary: Check that IIO device nodes are accessible through an interface
+
+details: |
+    This test makes sure that a snap using the IIO interface can access
+    devices nodes exposed by a slot properly.
+
+    It modifies the core snap to provide a iio slot. The actual iio device
+    node is served as a plain file with static text content. The test expects
+    that, after a snap declared a iio plug is installed and connected, it can
+    access the node and read/write its content.
+
+systems: [ubuntu-core-16-64]
+
+prepare: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+
+    # Mock IIO device node and give it some content we can verify
+    # the test snap can read.
+    echo "iio-0" > /dev/iio:device0
+
+    echo "Given a snap declaring a plug on iio is installed"
+    "$TESTSTOOLS"/snaps-state install-local iio-consumer
+
+    echo "And the iio plug is connected"
+    snap connect iio-consumer:iio core:iio0
+
+restore: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+    rm -f /dev/iio:device0
+
+execute: |
+    #shellcheck source=tests/lib/dirs.sh
+    . "$TESTSLIB"/dirs.sh
+
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+    test "$($SNAP_MOUNT_DIR/bin/iio-consumer.read)" = "iio-0"
+
+    $SNAP_MOUNT_DIR/bin/iio-consumer.write "hello"
+    test "$($SNAP_MOUNT_DIR/bin/iio-consumer.read)" = "hello"
diff -Nru snapd-2.45.1+20.04.2/tests/core/kernel-ver/task.yaml snapd-2.48.3+20.04/tests/core/kernel-ver/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/kernel-ver/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/kernel-ver/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,15 +4,12 @@
 systems: [ubuntu-core-*-64]
 
 execute: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     echo "Check kernel version"
-    if is_core16_system; then
+    if os.query is-core16; then
         VER="^4.4"
-    elif is_core18_system; then
+    elif os.query is-core18; then
         VER="^4.15"
-    elif is_core20_system; then
+    elif os.query is-core20; then
         VER="^5.4"
     fi
     uname -r | MATCH $VER
diff -Nru snapd-2.45.1+20.04.2/tests/core/netplan/task.yaml snapd-2.48.3+20.04/tests/core/netplan/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/netplan/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/netplan/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,21 +6,26 @@
 environment:
     NETPLAN: io.netplan.Netplan
 
-# the test is only meaningful on core devices
 # TODO:UC20: enable, fails right now with: "The permission of the
-#            setuid helper is not correct"
-systems: [ubuntu-core-1*]
+#            setuid helper is not correct", the issue is with the permissions of
+#            /usr/lib/dbus-1.0/dbus-daemon-launch-helper - it shows up as not
+#            being in the right group because the /etc/group from the classic
+#            host that we use to prepare the core system has a different group
+#            defined for gid 103 (which on core is messagebus, but on classic is
+#            systemd-network), and thus the dbus daemon thinks it has the wrong
+#            permissions (well basically speaking it does)
+
+# TODO: re-enable this on ubuntu-core-16-* when network-setup-control is updated
+# to allow running netplan directly from the base snap and we can update this
+# test to just using a simple shell script snap instead of building netplan from
+# source, as currently that is broken on xenial with test-snapd-netplan-apply
+# for some reason, see https://github.com/anonymouse64/test-snapd-netplan-apply/issues/1
+systems: [ubuntu-core-18-*]
 
 prepare: |
     snap install test-snapd-netplan-apply --edge
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     echo "The interface is disconnected by default"
     snap connections test-snapd-netplan-apply | MATCH 'network-setup-control +test-snapd-netplan-apply:network-setup-control +- +-'
 
@@ -31,8 +36,8 @@
     fi
 
     echo "Count how many network service restarts happened before calling netplan apply"
-    stopped_before="$(get_journalctl_log -u systemd-networkd | grep -c 'Stopped Network Service.' || true)"
-    started_before="$(get_journalctl_log -u systemd-networkd | grep -c 'Started Network Service.' || true)"
+    stopped_before="$("$TESTSTOOLS"/journal-state get-log -u systemd-networkd | grep -c 'Stopped Network Service.' || true)"
+    started_before="$("$TESTSTOOLS"/journal-state get-log -u systemd-networkd | grep -c 'Started Network Service.' || true)"
 
     echo "When the interface is connected"
     snap connect test-snapd-netplan-apply:network-setup-control
@@ -45,8 +50,8 @@
 
     echo "Ensure that network config was stopped and restarted from netplan"
     for _ in $(seq 60); do
-        stopped_after="$(get_journalctl_log -u systemd-networkd | grep -c 'Stopped Network Service.' || true)"
-        started_after="$(get_journalctl_log -u systemd-networkd | grep -c 'Started Network Service.' || true)"
+        stopped_after="$("$TESTSTOOLS"/journal-state get-log -u systemd-networkd | grep -c 'Stopped Network Service.' || true)"
+        started_after="$("$TESTSTOOLS"/journal-state get-log -u systemd-networkd | grep -c 'Started Network Service.' || true)"
         if [ "$stopped_after" -gt "$stopped_before" ] && \
            [ "$started_after" -gt "$started_before" ] ; then
             break
@@ -57,7 +62,7 @@
     echo "Ensure that the number of network restarts is greater after netplan apply was run"
     [ "$stopped_after" -gt "$stopped_before" ] && [ "$started_after" -gt "$started_before" ]
 
-    if is_core16_system; then
+    if os.query is-core16; then
         echo "Skipping Ubuntu Core 16 which does not have Info D-Bus method"
         exit 0
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/os-release/task.yaml snapd-2.48.3+20.04/tests/core/os-release/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/os-release/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/os-release/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,14 +4,11 @@
     cat /etc/lsb-release
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
-    if is_core16_system; then
+    if os.query is-core16; then
         MATCH "DISTRIB_RELEASE=16" < /etc/lsb-release
-    elif is_core18_system; then
+    elif os.query is-core18; then
         MATCH "DISTRIB_RELEASE=18" < /etc/lsb-release
-    elif is_core20_system; then
+    elif os.query is-core20; then
         MATCH "DISTRIB_RELEASE=20" < /etc/lsb-release
     else
         echo "Unknown Ubuntu Core system!"
diff -Nru snapd-2.45.1+20.04.2/tests/core/persistent-journal/task.yaml snapd-2.48.3+20.04/tests/core/persistent-journal/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/persistent-journal/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/persistent-journal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,53 @@
+summary: Test journal.persistent core config option
+
+prepare: |
+    systemctl status snapd > before.txt
+
+restore: |
+    rm before.txt
+    # disable persistent journal
+    rm -rf /var/log/journal
+    systemctl kill --signal=SIGUSR1 systemd-journald
+
+debug: |
+    journalctl -u snapd
+    echo "snapd status before the test:"
+    cat before.txt
+    echo "snapd status after the test:"
+    systemctl status snapd
+
+execute: |
+    echo "Wait for first boot to be done"
+    snap wait system seed.loaded
+
+    echo "Sanity check, persistent journal is not available by default"
+    not test -e /var/log/journal
+
+    echo "Check that persistent journal can be enabled"
+    snap set core journal.persistent=true
+    test -e /var/log/journal/
+    test -e /var/log/journal/.snapd-created
+
+    # on core16 journald is not reloaded, so changes are not visible until
+    # rebooted.
+    if [[ ! "$SPREAD_SYSTEM" = ubuntu-core-16-* ]]; then
+        # this check relies on *anything* getting logged; enabling persistent
+        # journal writes an entry about journal size, which should be sufficient.
+        MACHINE_ID=$(cat /etc/machine-id)
+        retry -n30 --wait 1 test -e "/var/log/journal/$MACHINE_ID"
+    fi
+
+    echo "Check that persistent journal can be disabled"
+    snap set core journal.persistent=false
+    not test -e /var/log/journal
+
+    echo "Check that journal log is not removed if managed manually"
+    mkdir /var/log/journal
+    snap set core journal.persistent=true
+    not test -e /var/log/journal/.snapd-created
+
+    # NOTE: Since this is failing early, before we do anything to the journal, there is no need to use retry.
+    snap set core journal.persistent=false 2>&1 | MATCH "the /var/log/journal directory was not created by snapd"
+    # the journal dir was not removed
+    test -e /var/log/journal/
+    not test -e /var/log/journal/.snapd-created
diff -Nru snapd-2.45.1+20.04.2/tests/core/reboot/task.yaml snapd-2.48.3+20.04/tests/core/reboot/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/reboot/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/reboot/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,10 +4,8 @@
 priority: 100
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-tools
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
 execute: |
     echo "Ensure snaps are (still) there."
diff -Nru snapd-2.45.1+20.04.2/tests/core/remodel/task.yaml snapd-2.48.3+20.04/tests/core/remodel/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/remodel/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/remodel/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,55 +9,53 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
 
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions    
-    if is_core18_system; then
-        cp "$TESTSLIB"/assertions/developer1-pc-18.model /var/lib/snapd/seed/assertions/developer1-pc.model
-        cp "$TESTSLIB"/assertions/developer1-pc-18-revno2.model developer1-pc-revno2.model
-        cp "$TESTSLIB"/assertions/developer1-pc-18-revno3.model developer1-pc-revno3.model
-    else
-        cp "$TESTSLIB"/assertions/developer1-pc.model /var/lib/snapd/seed/assertions
-        cp "$TESTSLIB"/assertions/developer1-pc-revno2.model .
-        cp "$TESTSLIB"/assertions/developer1-pc-revno3.model .
-    fi
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+    clean_snapd_lib
+
+    # Generic setup for test account
+    prepare_core_model
+    prepare_test_account developer1
+    prepare_test_model developer1-pc
+    prepare_testrootorg_store
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
 
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
+
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/developer1-pc.model
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
+    clean_snapd_lib
+
+    # Generic restore for test account
+    restore_test_account developer1
+    restore_test_model developer1-pc
+    restore_testrootorg_store
+    restore_core_model
+
     rm -f /var/lib/snapd/seed/assertions/test-snapd-with-configure_*.assert
-    cp model.bak /var/lib/snapd/seed/assertions/model
-    rm -f ./*.bak
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+    wait_for_first_boot_change
+
     # extra paranoia because failure to cleanup earlier took us a long time
     # to find
     if [ -e /var/snap/test-snapd-tools/current ]; then
@@ -72,9 +70,11 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systems.sh
     . "$TESTSLIB"/systems.sh
+
     SNAP="$(get_snap_for_system test-snapd-tools)"
 
     # sanity check
@@ -86,7 +86,8 @@
     snap debug model|MATCH "model: my-model"
 
     echo "Now we remodel"
-    snap remodel developer1-pc-revno2.model
+    MODEL="$(get_test_model developer1-pc-revno2)"
+    snap remodel "${TESTSLIB}/assertions/${MODEL}"
 
     echo "and we got the new required snap"
     snap list "$SNAP"
@@ -99,7 +100,8 @@
     not snap remove --purge "$SNAP"
 
     echo "And we can remodel again this time test-snapd-tools is no longer required"
-    snap remodel developer1-pc-revno3.model
+    MODEL="$(get_test_model developer1-pc-revno3)"
+    snap remodel "${TESTSLIB}/assertions/${MODEL}"
     snap debug model|MATCH "revision: 3"
     snap changes | MATCH "Refresh model assertion from revision 2 to 3"
     echo "and $SNAP is still available"
diff -Nru snapd-2.45.1+20.04.2/tests/core/remodel-base/task.yaml snapd-2.48.3+20.04/tests/core/remodel-base/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/remodel-base/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/remodel-base/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,43 +11,50 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1-pc-18.model /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+
+    # Generic setup for test account
+    clean_snapd_lib
+    prepare_core_model
+    prepare_test_account developer1
+    prepare_test_model developer1-pc
+    prepare_testrootorg_store
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
-    retry-tool -n 60 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
+
+    # wait for first boot to be done
+    wait_for_first_boot_change
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
+
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/developer1-pc-18.model
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
-    mv model.bak /var/lib/snapd/seed/assertions/model
-    rm -f ./*.bak
+    clean_snapd_lib
+
+    # Generic restore for test account
+    restore_test_account developer1
+    restore_test_model developer1-pc
+    restore_testrootorg_store
+    restore_core_model
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    snap wait system seed.loaded
-    retry-tool -n 60 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'    
+    wait_for_first_boot_change
+
     # extra paranoia because failure to cleanup earlier took us a long time
     # to find
     if [ -e /var/snap/$NEW_BASE/current ]; then
@@ -58,6 +65,7 @@
         find /var/snap
         exit 1
     fi
+
 execute: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
@@ -65,6 +73,9 @@
     fi
     #shellcheck source=tests/lib/boot.sh
     . "$TESTSLIB"/boot.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+
     wait_change_done() {
         chg_summary="$1"
         for _ in $(seq 10); do
@@ -86,12 +97,14 @@
         echo "We have the right model assertion"
         snap debug model|MATCH "model: my-model"
         echo "Now we remodel"
-        snap remodel "$TESTSLIB"/assertions/developer1-pc-18-new-base.model
+        MODEL="$(get_test_model developer1-pc-new-base)"
+        snap remodel "${TESTSLIB}/assertions/${MODEL}"
         echo "Double check that we boot into the right base"
         MATCH "snap_try_core=$NEW_BASE" < /boot/grub/grubenv
         echo "reboot to finish the change"
         REBOOT
     fi
+
     # first boot with the new model base
     if [ "$SPREAD_REBOOT" = 1 ]; then
         echo "and we have the new base snap installed"
@@ -107,9 +120,11 @@
         # TODO: test when keeping the old base, test removing the old base
         #       (not possible here as the pc gadget uses core18 as its base)
         echo "And we can remodel again and remove the new base"
-        snap remodel "$TESTSLIB"/assertions/developer1-pc-18-revno3.model
+        MODEL="$(get_test_model developer1-pc-revno3)"
+        snap remodel "${TESTSLIB}/assertions/${MODEL}"
         REBOOT
     fi
+
     # reboot from new model to undo the new model again (to not pollute tests)
     if [ "$SPREAD_REBOOT" = 2 ]; then
         wait_core_post_boot
diff -Nru snapd-2.45.1+20.04.2/tests/core/remodel-gadget/task.yaml snapd-2.48.3+20.04/tests/core/remodel-gadget/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/remodel-gadget/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/remodel-gadget/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,45 +11,56 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1-pc-18.model /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+    clean_snapd_lib
+
+    # Generic setup for test account
+    prepare_core_model
+    prepare_test_account developer1
+    prepare_test_model developer1-pc
+    prepare_testrootorg_store
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
-    retry-tool -n 60 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
+
+    # wait for first boot to be done
+    wait_for_first_boot_change
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
+
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/developer1-pc-18.model
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
-    mv model.bak /var/lib/snapd/seed/assertions/model
-    rm -f ./*.bak
+    clean_snapd_lib
+
+    # Generic restore for test account
+    restore_test_account developer1
+    restore_test_model developer1-pc
+    restore_testrootorg_store
+    restore_core_model
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
     snap wait system seed.loaded
+
     # cleanup the canary file
     rm -f /boot/efi/canary.txt
-    retry-tool -n 60 --wait 5 sh -c 'snap changes | grep -q "Done.*Initialize system state"'
+
+    # wait for first boot to be done
+    wait_for_first_boot_change
+
     # extra paranoia because failure to cleanup earlier took us a long time
     # to find
     if [ -e /var/snap/$NEW_GADGET/current ]; then
@@ -67,6 +78,9 @@
     fi
     #shellcheck source=tests/lib/boot.sh
     . "$TESTSLIB"/boot.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+
     wait_change_done() {
         chg_summary="$1"
         for _ in $(seq 10); do
@@ -80,6 +94,7 @@
         done
         snap changes | MATCH "[0-9]+\\ +Done\\ +.* $chg_summary"
     }
+
     # initial boot with the current model
     if [ "$SPREAD_REBOOT" = 0 ]; then
         # sanity check
@@ -87,13 +102,17 @@
 
         echo "We have the right model assertion"
         snap debug model|MATCH "model: my-model"
+
         echo "Now we remodel"
-        snap remodel "$TESTSLIB"/assertions/developer1-pc-18-new-gadget.model
+        MODEL="$(get_test_model developer1-pc-new-gadget)"
+        snap remodel "${TESTSLIB}/assertions/${MODEL}"
+
         echo "Double check that new gadget was installed"
         test "$(cat /boot/efi/canary.txt)" = "this is test-snapd-pc gadget"
         echo "reboot to finish the change"
         REBOOT
     fi
+
     # first boot with the new gadget
     if [ "$SPREAD_REBOOT" = 1 ]; then
         echo "and we have the new gadget snap installed"
@@ -109,10 +128,14 @@
         not snap remove --purge "$NEW_GADGET"
         echo "but we can remove the old gadget"
         snap remove --purge "$OLD_GADGET"
+
         echo "And we can remodel again and remove the new gadget"
-        snap remodel "$TESTSLIB"/assertions/developer1-pc-18-revno3.model
+        MODEL="$(get_test_model developer1-pc-revno3)"
+        snap remodel "${TESTSLIB}/assertions/${MODEL}"
+
         REBOOT
     fi
+
     # reboot from new model to undo the new model again (to not pollute tests)
     if [ "$SPREAD_REBOOT" = 2 ]; then
         wait_core_post_boot
diff -Nru snapd-2.45.1+20.04.2/tests/core/remodel-kernel/task.yaml snapd-2.48.3+20.04/tests/core/remodel-kernel/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/remodel-kernel/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/remodel-kernel/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -14,30 +14,38 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
 
     # Save the revision of the pc-kernel snap.
     readlink /snap/pc-kernel/current > original-revision.txt
 
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-    mv /var/lib/snapd/seed/assertions/model model.bak
-    cp "$TESTSLIB"/assertions/developer1.account /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1.account-key /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/developer1-pc.model /var/lib/snapd/seed/assertions
-    cp "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+    clean_snapd_lib
+
+    # Generic setup for test account
+    prepare_core_model
+    prepare_test_account developer1
+    prepare_test_model developer1-pc
+    prepare_testrootorg_store
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+
+    # wait for first boot to be done
+    wait_for_first_boot_change
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
 
     # Wait for the final refresh to complete.
     snap watch --last=refresh
@@ -51,24 +59,21 @@
         snap remove pc-kernel --revision="$revno"
     done
 
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
     systemctl stop snapd.service snapd.socket
-    rm -rf /var/lib/snapd/assertions/*
-    rm -rf /var/lib/snapd/device
-    rm -rf /var/lib/snapd/state.json
-
-    rm -f /var/lib/snapd/seed/assertions/developer1.account
-    rm -f /var/lib/snapd/seed/assertions/developer1.account-key
-    rm -f /var/lib/snapd/seed/assertions/developer1-pc.model
-    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
-    cp model.bak /var/lib/snapd/seed/assertions/model
-    rm -f ./*.bak
+    clean_snapd_lib
+
+    # Generic restore for test account
+    restore_test_account developer1
+    restore_test_model developer1-pc
+    restore_testrootorg_store
+    restore_core_model
+
     # kick first boot again
     systemctl start snapd.service snapd.socket
+
     # wait for first boot to be done
-    snap wait system seed.loaded
-    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+    wait_for_first_boot_change
+
     # extra paranoia because failure to cleanup earlier took us a long time
     # to find
     if [ -e /var/snap/$NEW_KERNEL/current ]; then
@@ -85,9 +90,10 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-
     #shellcheck source=tests/lib/boot.sh
     . "$TESTSLIB"/boot.sh
+    #shellcheck source=tests/lib/core-config.sh
+    . "$TESTSLIB"/core-config.sh
 
     wait_change_done() {
         chg_summary="$1"
@@ -112,7 +118,8 @@
         snap debug model|MATCH "model: my-model"
 
         echo "Now we remodel"
-        snap remodel "$TESTSLIB"/assertions/developer1-pc-new-kernel.model
+        MODEL="$(get_test_model developer1-pc-new-kernel)"
+        snap remodel "${TESTSLIB}/assertions/${MODEL}"
 
         echo "Double check that we boot into the right kernel"
         grub-editenv list | MATCH "snap_try_kernel=$NEW_KERNEL"
@@ -142,7 +149,8 @@
         snap remove --purge "$OLD_KERNEL"
 
         echo "And we can remodel again and remove the new kernel"
-        snap remodel "$TESTSLIB"/assertions/developer1-pc-revno3.model
+        MODEL="$(get_test_model developer1-pc-revno3)"
+        snap remodel "${TESTSLIB}/assertions/${MODEL}"
         REBOOT
     fi
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/remove/task.yaml snapd-2.48.3+20.04/tests/core/remove/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/remove/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/remove/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,18 +4,15 @@
 systems: [-ubuntu-core-16-*]
 
 execute: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     echo "Ensure snapd cannot be removed"
     if snap remove --purge snapd; then
         echo "The snapd snap should not be removable"
         exit 1
     fi
 
-    if is_core18_system; then
+    if os.query is-core18; then
         base=core18
-    elif is_core20_system; then
+    elif os.query is-core20; then
         base=core20
     fi
     echo "Ensure $base cannot be removed"
diff -Nru snapd-2.45.1+20.04.2/tests/core/remove-user/task.yaml snapd-2.48.3+20.04/tests/core/remove-user/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/remove-user/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/remove-user/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,78 @@
+summary: Ensure remove-user functionality
+
+systems: [ubuntu-core-*]
+
+environment:
+    # Note that any valid sso account will work for this test
+    USER_EMAIL: mvo@ubuntu.com
+    USER_NAME: mvo
+
+prepare: |
+    # Note: make this test work with the user already created in the device
+    if [ "$(snap managed)" = "true" ]; then
+        # Leave a file indicating the device was initially managed
+        touch managed.device
+
+        exit 0
+    fi
+    snap create-user --sudoer "$USER_EMAIL"
+
+restore: |
+    if [ -e managed.device ]; then
+        exit 0
+    fi
+    userdel --extrausers -r "$USER_NAME" || true
+    rm -rf "/etc/sudoers.d/create-user-$USER_NAME"
+
+execute: |
+    if [ -e managed.device ]; then
+        exit 0
+    fi
+
+    echo "sanity check: user in passwd"
+    id "$USER_NAME"
+    echo "sanity check: has sudoer file"
+    test -f "/etc/sudoers.d/create-user-$USER_NAME"
+    echo "sanity check: user has a home" 
+    test -d "/home/$USER_NAME"
+
+    echo "snap remove-user fails when run as non-root user without sudo"
+    expected="error: access denied (try with sudo)"
+    if obtained=$(su - test /bin/sh -c "snap remove-user $USER_NAME 2>&1"); then
+        echo "remove-user command should have failed"
+    fi
+    [ "$obtained" = "$expected" ]
+
+    echo "snap remove-user needs root and snap login is not enough"
+    if [ -n "$SPREAD_STORE_USER" ] && [ -n "$SPREAD_STORE_PASSWORD" ]; then
+        echo "Checking successful login"
+        expect -d -f "$TESTSLIB"/successful_login.exp
+
+        expected="error: access denied (try with sudo)"
+        if obtained=$(su - test /bin/sh -c "snap remove-user $USER_NAME 2>&1"); then
+            echo "remove-user command should have failed"
+        fi
+        [ "$obtained" = "$expected" ]
+    fi
+
+    echo "snap remove-user succeeds when run as non-root user with sudo"
+    expected="removed user \"$USER_NAME\""
+    obtained=$(su - test /bin/sh -c "sudo snap remove-user $USER_NAME 2>&1")
+    [ "$obtained" = "$expected" ]
+
+    echo "user no longer in passwd"
+    not id "$USER_NAME"
+    echo "user no longer has sudoer file"
+    test ! -f "/etc/sudoers.d/create-user-$USER_NAME"
+    echo "user no longer has a home"
+    test ! -d "/home/$USER_NAME"
+
+    echo "user is no longer managed by snapd"
+    [ "$(snap managed)" = "false" ]
+
+    echo "snap remove-user cannot remove arbitrary users"
+    expected="error: user \"root\" is not known"
+    if obtained=$(su - test /bin/sh -c "sudo snap remove-user root 2>&1"); then
+        echo "remove-user command should have failed"
+    fi
+    [ "$obtained" = "$expected" ]
diff -Nru snapd-2.45.1+20.04.2/tests/core/seed-base-symlinks/task.yaml snapd-2.48.3+20.04/tests/core/seed-base-symlinks/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/seed-base-symlinks/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/seed-base-symlinks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,7 +10,7 @@
     . "$TESTSLIB/systems.sh"
 
     TARGET_SNAP=core
-    if is_core18_system; then
+    if os.query is-core18; then
         TARGET_SNAP=core18
     fi
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/snap-auto-mount/task.yaml snapd-2.48.3+20.04/tests/core/snap-auto-mount/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/snap-auto-mount/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/snap-auto-mount/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,16 +1,12 @@
 summary: Check that `snap auto-import` works as expected
 
-# TODO:UC20: fix for UC20 and enable, currently fails because mkfs.vfat is not
-#            available on UC20
-systems: [ubuntu-core-1*-64]
+systems: [ubuntu-core-*-64]
 
 prepare: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
 
     echo "Install dmsetup"
     snap install --devmode --edge dmsetup
@@ -28,7 +24,7 @@
 
     # We use different filesystems to cover both: fat and ext. fat is the most
     # common fs used and we also use ext3 because fat is not available on ubuntu core 18
-    if is_core18_system; then
+    if os.query is-core18; then
         mkfs.ext3 /dev/ram0
     else
         mkfs.vfat /dev/ram0
@@ -49,6 +45,7 @@
     # Jun 28 09:18:34 localhost kernel: [   36.434686] device-mapper: ioctl: error adding target to table
     udevadm settle
     dmsetup -v --noudevsync --noudevrules create dm-ram0 --table "0 $(blockdev --getsize /dev/ram0) linear /dev/ram0 0"
+    udevadm settle
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -58,7 +55,7 @@
     dmsetup -v --noudevsync --noudevrules  remove dm-ram0
 
 debug: |
-    tail -n 20 /var/log/syslog
+    journalctl -b | tail -100
 
 execute: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -66,4 +63,4 @@
         exit
     fi
     echo "The auto-mount magic has given us the assertion"
-    snap known account-key | MATCH "name: test-store"
+    retry -n 5 sh -c 'snap known account-key | MATCH "name: test-store"'
diff -Nru snapd-2.45.1+20.04.2/tests/core/snapd16/task.yaml snapd-2.48.3+20.04/tests/core/snapd16/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/snapd16/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/snapd16/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,7 +6,7 @@
 prepare: |
     # shellcheck source=tests/lib/snaps.sh
     . "$TESTSLIB/snaps.sh"
-    repack_core_snap_into_snapd_snap
+    repack_installed_core_snap_into_snapd_snap
 
 execute: |
     if [ "$SPREAD_REBOOT" = 0 ]; then
@@ -67,3 +67,9 @@
     rsync --help
 restore: |
     not test -d /snap/snapd
+    rm -f /etc/systemd/user/snapd.session-agent.service
+    rm -f /etc/systemd/user/snapd.session-agent.socket
+    rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+    systemctl --user daemon-reload
+    rm -f /etc/dbus-1/session.d/snapd.session-services.conf
+    rm -f /etc/dbus-1/system.d/snapd.system-services.conf
diff -Nru snapd-2.45.1+20.04.2/tests/core/snap-debug-bootvars/task.yaml snapd-2.48.3+20.04/tests/core/snap-debug-bootvars/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/snap-debug-bootvars/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/snap-debug-bootvars/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,38 @@
+summary: Ensure `snap debug bootvars` command works
+
+debug: |
+    cat default.out || true
+    cat uc20.out || true
+    cat run.out || true
+    cat recovery.out || true
+
+restore: |
+    rm -f default.out uc20.out run.out recovery.out
+
+execute: |
+    # does not outright fail
+    snap debug boot-vars  > default.out
+
+    if os.query is-core20; then
+        # boot-vars default output is for the run mode bootloader, make sure its
+        # output looks sane (though we don't expect any of the variables to be
+        # set)
+        MATCH 'kernel_status=$' < default.out
+
+        snap debug boot-vars --uc20 > uc20.out
+        snap debug boot-vars --root-dir /run/mnt/ubuntu-boot > run.out
+        # the no-parameters output and explicit --uc20 should be the same
+        diff -up default.out uc20.out
+        # default shows a run mode bootloader variables, so the output shall be
+        # identical again
+        diff -up default.out run.out
+
+        # try the recovery bootloader now
+        snap debug boot-vars --root-dir /run/mnt/ubuntu-seed > recovery.out
+        MATCH 'snapd_recovery_mode=run' < recovery.out
+    else
+        MATCH 'snap_core=core.*\.snap' < default.out
+        MATCH 'snap_kernel=pc-kernel.*\.snap' < default.out
+        # relevant snaps are not being updated, so snap_mode is unset
+        MATCH 'snap_mode=$' < default.out
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/snapd-failover/task.yaml snapd-2.48.3+20.04/tests/core/snapd-failover/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/snapd-failover/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/snapd-failover/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,6 @@
 summary: Check that snapd failure handling works
 
 prepare: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     # shellcheck source=tests/lib/snaps.sh
     . "$TESTSLIB/snaps.sh"
 
@@ -11,9 +8,9 @@
     # test because it by default uses the core snap
     # there is a different test for the transition between the core snap and the
     # snapd snap
-    if is_core16_system; then
+    if os.query is-core16; then
         # rebuild the core snap into the snapd snap and install it
-        repack_core_snap_into_snapd_snap
+        repack_installed_core_snap_into_snapd_snap
         snap install --dangerous snapd-from-core.snap
     fi
     # ensure we are in snapd snap world
@@ -21,13 +18,10 @@
     ls -l /snap/snapd/
 
 debug: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     # dump failure data
     journalctl -u snapd.failure.service
     journalctl -u snapd.socket || true
-    if is_core16_system; then
+    if os.query is-core16; then
         # might be useful to know what's up with the core snap too on uc16
         ls -l /snap/core/
     fi
@@ -39,23 +33,20 @@
     /snap/snapd/x1/usr/bin/snap debug state --change="$(/snap/snapd/x1/usr/bin/snap debug state /var/lib/snapd/state.json|tail -n1|awk '{print $1}')" /var/lib/snapd/state.json || true
 
 restore: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
-    if is_core16_system; then
+    if os.query is-core16; then
         echo "ensuring we reverted fully to core snap system"
         not test -d /snap/snapd
         # cleanup the snapd-from-core snap we built
         rm -f snapd-from-core.snap
+        rm -f /etc/systemd/user/snapd.session-agent.service
+        rm -f /etc/systemd/user/snapd.session-agent.socket
+        rm -f /etc/systemd/user/sockets.target.wants/snapd.session-agent.socket
+        systemctl --user daemon-reload
+        rm -f /etc/dbus-1/session.d/snapd.session-services.conf
+        rm -f /etc/dbus-1/system.d/snapd.system-services.conf
     fi
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     if [ "$SPREAD_REBOOT" = 0 ]; then
         echo "Testing failover handling of the snapd snap"
 
@@ -64,7 +55,7 @@
 
         # get the number of times that snapd.failure was started before we do 
         # anything
-        started_before="$(get_journalctl_log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
+        started_before="$("$TESTSTOOLS"/journal-state get-log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
 
         # test that random signals don't trigger snapd-failure
         current=$(readlink /snap/snapd/current)
@@ -73,7 +64,7 @@
         echo "and snapd is just restarted"
         systemctl kill --signal=SIGSEGV snapd.service
 
-        started_after_rand_sig="$(get_journalctl_log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
+        started_after_rand_sig="$("$TESTSTOOLS"/journal-state get-log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
 
         if [ "$started_after_rand_sig" -gt "$started_before" ] ; then
             echo "snapd.failure inadvertently started with a random signal!"
@@ -95,7 +86,7 @@
         # it will be able to revert and fallback as many times as needed
         #shellcheck disable=SC2167
         for _ in $(seq 1 2); do
-            started_before="$(get_journalctl_log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
+            started_before="$("$TESTSTOOLS"/journal-state get-log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
 
             echo "Install the broken snapd"
             if snap install --dangerous ./snapd-broken/snapd_*.snap; then
@@ -107,7 +98,7 @@
             #shellcheck disable=SC2165
             for _ in $(seq 60); do
                 # get the number of times that snapd.failure was started
-                started_after="$(get_journalctl_log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
+                started_after="$("$TESTSTOOLS"/journal-state get-log -u snapd.failure | grep -c 'Started Failure handling of the snapd snap.' || true)"
                 if [ "$started_after" -gt "$started_before" ] ; then
                     break
                 fi
@@ -117,7 +108,7 @@
             # just because snapd.failure.service is active doesn't mean that we are 
             # fully ready; we should wait until the snap command shows up again
             echo "And verify that snap commands still work and snapd is reverted"
-            retry-tool --maxmins 5.5 bash -c "snap list | MATCH '^snapd .* $current .*'"
+            retry --maxmins 5.5 bash -c "snap list | MATCH '^snapd .* $current .*'"
 
             echo "Verify we got the expected error message"
             snap change --last=install|MATCH "there was a snapd rollback across the restart"
@@ -138,7 +129,7 @@
         # do that restoration here
         # TODO: move this to restore section when spread is fixed
         # see https://github.com/snapcore/spread/pull/85
-        if is_core16_system; then
+        if os.query is-core16; then
             echo "Manually uninstall the snapd snap on UC16"
             systemctl stop snapd.service snapd.socket snapd.autoimport.service snapd.snap-repair.service snapd.snap-repair.timer
             umount "/snap/snapd/$(readlink /snap/snapd/current)"
@@ -160,7 +151,7 @@
     else # "$SPREAD_REBOOT" != 0
         # technically this check is unnecessary because we only reboot during
         # the test's execution on uc16, but just be extra safe
-        if is_core16_system; then
+        if os.query is-core16; then
             # now remove the snapd snap since we booted with the core snap
             snap list
             # this only succeeds because we reverted back to having the core 
diff -Nru snapd-2.45.1+20.04.2/tests/core/snap-set-core-config/task.yaml snapd-2.48.3+20.04/tests/core/snap-set-core-config/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/snap-set-core-config/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/snap-set-core-config/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,6 @@
 summary: Ensure "snap set core" works
 
-# TODO:UC20: enable for UC20
-systems: [ubuntu-core-1*]
+systems: [ubuntu-core-*]
 
 # TODO: use `snap set system` instead of `snap set core`
 
@@ -11,11 +10,10 @@
     if [ $rc = 4 ]; then
         # systemctl(1) exit code 4: no such unit
 
-        #shellcheck source=tests/lib/systemd.sh
-        . "$TESTSLIB"/systemd.sh
-
         # start fake rsyslog service
-        systemd_create_and_start_unit rsyslog "/bin/sleep 2h"
+        printf '[Unit]\nDescription=test %s\n[Service]\nType=simple\nExecStart=%s\n' "${SPREAD_JOB:-unknown}" "/bin/sleep 2h" > /run/systemd/system/rsyslog.service
+        systemctl daemon-reload
+        systemctl start rsyslog
 
         # create a flag to indicate the ryslog service is fake
         touch rsyslog.fake
@@ -23,14 +21,17 @@
 
 restore: |
     if [ -f rsyslog.fake ]; then
-        #shellcheck source=tests/lib/systemd.sh
-        . "$TESTSLIB"/systemd.sh
-        systemd_stop_and_destroy_unit rsyslog
+        systemctl stop rsyslog
+        rm /run/systemd/system/rsyslog.service
+        systemctl daemon-reload
     else
         systemctl enable rsyslog.service
         systemctl start rsyslog.service
     fi
-
+    if [ -e current-timezone ]; then
+        timedatectl set-timezone "$(cat current-timezone)"
+    fi
+ 
     rm -f /etc/systemd/login.conf.d/00-snap-core.conf
 
 execute: |
@@ -89,3 +90,41 @@
         cat /etc/environment
         exit 1
     fi
+
+    echo "Changing 'service.console-conf.disable' at runtime does not work"
+    console_conf_disabled="false"
+    if [ -e /var/lib/console-conf/complete ]; then
+        console_conf_disabled="true"
+    fi
+    if [ "$console_conf_disabled" = "true" ]; then
+        not snap set system service.console-conf.disable=false 2>stderr
+        MATCH "cannot toggle console-conf at runtime, but only initially via gadget defaults" < stderr
+        # and the console-conf complete file is unchanged
+        test -e /var/lib/console-conf/complete
+        # but setting to again (without changing) is fine
+        snap set system service.console-conf.disable=true
+    elif [ "$console_conf_disabled" = "false" ]; then
+        not snap set system service.console-conf.disable=true 2>stderr
+        MATCH "cannot toggle console-conf at runtime, but only initially via gadget defaults" < stderr
+        # and the console-conf complete file is unchanged
+        not test -e /var/lib/console-conf/complete
+        # but setting to again (without changing) is fine
+        snap set system service.console-conf.disable=false
+    else
+        echo "internal error: $console_conf_disabled var has unexpected setting"
+    fi
+
+    echo "Check that 'system.kernel.printk.console-loglevel' handling works"
+    snap set system system.kernel.printk.console-loglevel=7
+    test -e /etc/sysctl.d/99-snapd.conf
+    sysctl -n kernel.printk|MATCH "^7\s+"
+
+    snap unset system system.kernel.printk.console-loglevel
+    not test -e /etc/sysctl.d/99-snapd.conf
+    sysctl -n kernel.printk|MATCH "^4\s+"
+
+    echo "setting the timezone works"
+    cat /etc/timezone > current-timezone
+    snap set system system.timezone=Europe/Malta
+    MATCH "Europe/Malta" /etc/timezone
+    test "$(readlink -f /etc/localtime)" = "/usr/share/zoneinfo/Europe/Malta"
diff -Nru snapd-2.45.1+20.04.2/tests/core/swapfiles/task.yaml snapd-2.48.3+20.04/tests/core/swapfiles/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/swapfiles/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/swapfiles/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -27,4 +27,4 @@
   . /etc/default/swapfile
 
   echo "Check that the swap file exists"
-  retry-tool -n 60 --wait 1 bash -c "cat /proc/swaps | MATCH '$FILE\s+file\s+204796'"
+  retry -n 60 --wait 1 bash -c "cat /proc/swaps | MATCH '$FILE\s+file\s+204796'"
diff -Nru snapd-2.45.1+20.04.2/tests/core/system-settings/task.yaml snapd-2.48.3+20.04/tests/core/system-settings/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/system-settings/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/system-settings/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,22 @@
+summary: System settings work
+
+prepare: |
+    hostname > hostname.bak
+    cp /etc/timezone timezone.bak
+
+restore: |
+    hostnamectl set-hostname "$(cat hostname.bak)" || true
+    timedatectl set-timezone "$(cat timezone.bak)" || true
+
+execute: |
+    echo "Check that setting the hostname works"
+    hostnamectl set-hostname coole-kiste
+    MATCH coole-kiste < /etc/hostname
+    hostname | MATCH coole-kiste
+
+    echo "Check that setting the timezone works"
+    timedatectl set-timezone "Europe/Berlin"
+    date +"%Z" | MATCH 'CE[S]?T'
+    timedatectl | MATCH "Time zone: Europe/Berlin"
+    MATCH "Europe/Berlin" < /etc/timezone
+    test "$(readlink -f /etc/localtime)" = "/usr/share/zoneinfo/Europe/Berlin"
diff -Nru snapd-2.45.1+20.04.2/tests/core/system-snap-refresh/task.yaml snapd-2.48.3+20.04/tests/core/system-snap-refresh/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/system-snap-refresh/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/system-snap-refresh/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,17 +5,14 @@
     a reboot is triggered and the command would exit after the first phase of the installation
     reporting "snapd is about to reboot the system"
 
-# the test is only meaningful on core devices
-# TODO:UC20: enable for UC20
-systems: [ubuntu-core-1*]
-
+systems: [ubuntu-core-*]
 
 restore: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
     TARGET_SNAP_NAME=core
-    if is_core18_system; then
+    if os.query is-core18; then
         TARGET_SNAP_NAME=core18
+    elif os.query is-core20; then
+        TARGET_SNAP_NAME=core20
     fi
 
     if not snap remove "$TARGET_SNAP_NAME" --revision=x2; then
@@ -24,14 +21,11 @@
     fi
 
 execute: |
-    #shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB"/journalctl.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     TARGET_SNAP_NAME=core
-    if is_core18_system; then
+    if os.query is-core18; then
         TARGET_SNAP_NAME=core18
+    elif os.query is-core20; then
+        TARGET_SNAP_NAME=core20
     fi    
 
     # After installing a new version of the core/core18 snap the system is rebooted
@@ -40,7 +34,7 @@
         echo "$currRev" > initialRev
 
         # use journalctl wrapper to grep only the logs collected while the test is running
-        if get_journalctl_log | MATCH "Waiting for system reboot"; then
+        if "$TESTSTOOLS"/journal-state get-log | MATCH "Waiting for system reboot"; then
             echo "Already waiting for system reboot, exiting..."
             exit 1
         fi
@@ -52,13 +46,13 @@
 
         # Detect in the logs when the reboot can been triggered
         for _ in $(seq 50); do
-            if check_journalctl_log "Waiting for system reboot"; then
+            if "$TESTSTOOLS"/journal-state match-log "Waiting for system reboot"; then
                  break
             fi
             sleep 2
         done
 
-        if ! check_journalctl_log "Waiting for system reboot"; then
+        if ! "$TESTSTOOLS"/journal-state match-log "Waiting for system reboot"; then
             echo "Taking too long to reach waiting for reboot"
             exit 1
         fi
@@ -78,13 +72,13 @@
 
         # Detect in the logs when the reboot can been triggered
         for _ in $(seq 50); do
-            if check_journalctl_log "Waiting for system reboot" -b; then
+            if "$TESTSTOOLS"/journal-state match-log "Waiting for system reboot" -b; then
                  break
             fi
             sleep 2
         done
 
-        if ! check_journalctl_log "Waiting for system reboot" -b; then
+        if ! "$TESTSTOOLS"/journal-state match-log "Waiting for system reboot" -b; then
             echo "Taking too long to reach waiting for reboot"
             exit 1
         fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/uc20-recovery/mock-shutdown snapd-2.48.3+20.04/tests/core/uc20-recovery/mock-shutdown
--- snapd-2.45.1+20.04.2/tests/core/uc20-recovery/mock-shutdown	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/uc20-recovery/mock-shutdown	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+# only save calls with "-r" for actual shutdowns, because on uc20, shutdown is a
+# symlink to systemctl, so we also see calls like `systemctl stop serial-getty@ttyS0`
+# that would show up in the mock-shutdown.calls and confuse the test
+if [ "$1" = "-r" ]; then
+    echo "$*" >> /tmp/mock-shutdown.calls
+fi
+
+exit 0
\ No newline at end of file
diff -Nru snapd-2.45.1+20.04.2/tests/core/uc20-recovery/task.yaml snapd-2.48.3+20.04/tests/core/uc20-recovery/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/uc20-recovery/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/uc20-recovery/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,207 @@
+summary: verify booting into recovery mode on UC20 systems
+
+systems: [ubuntu-core-20-*]
+
+restore: |
+    rm -f /writable/systems.json.run
+    rm -f /writable/systems.label
+
+    if mountpoint /usr/sbin/shutdown; then
+        umount /usr/sbin/shutdown
+    fi
+
+debug: |
+    if [ -e systems.json ]; then
+        cat systems.json
+    fi
+    if [ -e system-info ]; then
+        cat system-info
+    fi
+    if [ -e /tmp/mock-shutdown.calls ]; then
+        cat /tmp/mock-shutdown.calls
+    fi
+
+execute: |
+    transition_to_recover_mode(){
+        local label=$1
+
+        # redirect shutdown command to our mock to observe calls and avoid racing
+        # with spread
+        mount -o bind "$PWD/mock-shutdown" /usr/sbin/shutdown
+
+        # reboot to recovery mode
+        echo "Request rebooting into recovery mode"
+        snap reboot --recover "$label" | MATCH 'Reboot into ".*" "recover" mode'
+
+        # snapd schedules a slow timeout and an immediate one, however it is
+        # scheduled asynchronously, try to keep the check simple
+        # shellcheck disable=SC2016
+        retry -n 30 --wait 1 sh -c 'test "$(wc -l < /tmp/mock-shutdown.calls)" = "2"'
+        # a reboot in 10 minutes should have been scheduled
+        MATCH -- '-r \+10' < /tmp/mock-shutdown.calls
+        # and an immediate reboot should have been scheduled
+        MATCH -- '-r \+0' < /tmp/mock-shutdown.calls
+
+        # restore shutdown so that spread can reboot the host
+        umount /usr/sbin/shutdown
+
+        # with the external backend, we do not have the special snapd snap with
+        # the first-boot run mode tweaks as created from $TESTLIB/prepare.sh's 
+        # repack_snapd_snap_with_deb_content_and_run_mode_firstboot_tweaks func
+        # so instead to get the spread gopath and other data needed to continue
+        # the test, we need to add a .ssh/rc script which copies all of the data
+        # from /host/ubuntu-data in recover mode to the tmpfs /home, see
+        # sshd(8) for details on the ~/.ssh/rc script
+        if [ "$SPREAD_BACKEND" = "external" ]; then
+            mkdir -p /home/external/.ssh
+            chown external:external /home/external/.ssh
+            touch /home/external/.ssh/rc
+            chown external:external /home/external/.ssh/rc
+            # See the "sshrc" section in sshd(8)
+            cat <<-EOF > /home/external/.ssh/rc
+    #!/bin/sh
+    # added by spread tests
+    if grep -q 'snapd_recovery_mode=recover' /proc/cmdline; then
+        # use as sudo for proper permissions, assumes that the external user is
+        # a sudo user, which it must be by definition of it being the login user
+        # that spread uses
+        # silence the output so that nothing is output to a ssh command,
+        # potentially confusing spread
+        sudo mkdir /home/gopath > /dev/null
+        sudo mount --bind /host/ubuntu-data/user-data/gopath /home/gopath > /dev/null
+    fi
+    EOF
+        fi
+
+        # XXX: is this a race between spread seeing REBOOT and machine rebooting?
+        REBOOT
+    }
+
+    prepare_recover_mode() {
+        # the system is seeding and snap command may not be available yet
+        # shellcheck disable=SC2016
+        retry -n 60 --wait 1 sh -c 'test "$(command -v snap)" = /usr/bin/snap'
+
+        # wait till the system seeding is finished
+        snap wait system seed.loaded
+
+        # we're running in an ephemeral system and thus have to re-install snaps
+        snap install --edge jq
+        snap install test-snapd-curl --devmode --edge
+
+        MATCH 'snapd_recovery_mode=recover' < /proc/cmdline
+        # verify we are in recovery mode via the API
+        test-snapd-curl.curl -s --unix-socket /run/snapd.socket http://localhost/v2/system-info > system-info
+        jq -r '.result["system-mode"]' < system-info | MATCH 'recover'
+    }
+
+    if [ "$SPREAD_REBOOT" == "0" ]; then
+        echo "In run mode"
+
+        snap install --edge jq
+        # devmode as the snap does not have snapd-control
+        snap install test-snapd-curl --devmode --edge
+
+        MATCH 'snapd_recovery_mode=run' < /proc/cmdline
+        # verify we are in run mode via the API
+        test-snapd-curl.curl -s --unix-socket /run/snapd.socket http://localhost/v2/system-info > system-info
+        jq -r '.result["system-mode"]' < system-info | MATCH 'run'
+
+        echo "Obtain available systems"
+        test-snapd-curl.curl -s --unix-socket /run/snapd.socket http://localhost/v2/systems > systems.json
+        # TODO:UC20: there is only one system for now
+        jq .result.systems[0].current < systems.json | MATCH 'true'
+        label="$(jq -r .result.systems[0].label < systems.json)"
+        test -n "$label"
+        # make sure that the seed exists
+        test -d "/var/lib/snapd/seed/systems/$label"
+        jq -r .result.systems[0].actions[].mode < systems.json | sort | tr '\n' ' ' | MATCH 'install recover run'
+
+        # keep a copy of the systems dump for later reference
+        cp systems.json /writable/systems.json.run
+        echo "$label" > /writable/systems.label
+
+        transition_to_recover_mode "$label"
+
+    elif [ "$SPREAD_REBOOT" == "1" ]; then
+        echo "In recovery mode"
+
+        prepare_recover_mode
+
+        # host data should be accessible
+        test -e /host/ubuntu-data/systems.json.run
+
+        test-snapd-curl.curl -s --unix-socket /run/snapd.socket http://localhost/v2/systems > systems.json
+        jq -r .result.systems[0].actions[].mode < systems.json | sort | tr '\n' ' ' | MATCH 'install run'
+
+        label="$(cat /host/ubuntu-data/systems.label)"
+        test -n "$label"
+        # seed in mounted in recover mode too
+        test -d "/var/lib/snapd/seed/systems/$label"
+
+        MATCH "snapd_recovery_system=$label" < /proc/cmdline
+
+        # see earlier note
+        mount -o bind "$PWD/mock-shutdown" /usr/sbin/shutdown
+
+        # request going back to run mode
+        snap reboot --run "$label" | MATCH 'Reboot into ".*" "run" mode.'
+        # XXX: is this a race between spread seeing REBOOT and machine rebooting?
+
+        # see earlier note about shutdown
+        # shellcheck disable=SC2016
+        retry -n 30 --wait 1 sh -c 'test "$(wc -l < /tmp/mock-shutdown.calls)" = "2"'
+        # a reboot in 10 minutes should have been scheduled
+        MATCH -- '-r \+10' < /tmp/mock-shutdown.calls
+        # and an immediate reboot should have been scheduled
+        MATCH -- '-r \+0' < /tmp/mock-shutdown.calls
+
+        umount /usr/sbin/shutdown
+
+        # if we are using the external backend, remove the .ssh/rc hack we used
+        # to copy data around, it's not necessary going back to run mode, and it
+        # somehow interferes with spread re-connecting over ssh, causing
+        # spread to timeout trying to reconnect after the reboot with an error
+        # message like this:
+        # ssh: unexpected packet in response to channel open: <nil>
+        if [ "$SPREAD_BACKEND" = "external" ]; then
+            # TODO:UC20: if/when /host is mounted ro, then we will need to 
+            # either remount it rw or do some other hack to fix this
+            rm -f /host/ubuntu-data/user-data/external/.ssh/rc
+        fi
+
+        REBOOT
+
+    elif [ "$SPREAD_REBOOT" == "2" ]; then
+        echo "In run mode again"
+        test-snapd-curl.curl -s --unix-socket /run/snapd.socket http://localhost/v2/system-info > system-info
+        jq -r '.result["system-mode"]' < system-info | MATCH 'run'
+
+        # now go back to recover mode so we can test that a simple reboot 
+        # works to transition us back to run mode
+        label="$(jq -r .result.systems[0].label < systems.json)"
+        transition_to_recover_mode "$label"
+    elif [ "$SPREAD_REBOOT" == "3" ]; then
+        echo "In recover mode again"
+        
+        prepare_recover_mode
+
+        # if we are using the external backend, remove the .ssh/rc hack we used
+        # to copy data around, it's not necessary going back to run mode, and it
+        # somehow interferes with spread re-connecting over ssh, causing
+        # spread to timeout trying to reconnect after the reboot with an error
+        # message like this:
+        # ssh: unexpected packet in response to channel open: <nil>
+        if [ "$SPREAD_BACKEND" = "external" ]; then
+            # TODO:UC20: if/when /host is mounted ro, then we will need to 
+            # either remount it rw or do some other hack to fix this
+            rm -f /host/ubuntu-data/user-data/external/.ssh/rc
+        fi
+
+        # do a simple reboot to verify that we go back to run mode
+        REBOOT
+    elif [ "$SPREAD_REBOOT" == "4" ]; then
+        echo "In run mode again again"
+        test-snapd-curl.curl -s --unix-socket /run/snapd.socket http://localhost/v2/system-info > system-info
+        jq -r '.result["system-mode"]' < system-info | MATCH 'run'
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/core/upgrade/task.yaml snapd-2.48.3+20.04/tests/core/upgrade/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/upgrade/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/upgrade/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -27,11 +27,8 @@
     snap remove core --revision=x3
 
 prepare: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     TARGET_SNAP=core
-    if is_core18_system; then
+    if os.query is-core18; then
         TARGET_SNAP=core18
     fi
 
@@ -41,11 +38,9 @@
 execute: |
     #shellcheck source=tests/lib/boot.sh
     . "$TESTSLIB"/boot.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
 
     TARGET_SNAP=core
-    if is_core18_system; then
+    if os.query is-core18; then
         TARGET_SNAP=core18
     fi
 
diff -Nru snapd-2.45.1+20.04.2/tests/core/watchdog/task.yaml snapd-2.48.3+20.04/tests/core/watchdog/task.yaml
--- snapd-2.45.1+20.04.2/tests/core/watchdog/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/core/watchdog/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -13,12 +13,20 @@
     rm -f "$WATCHDOG_FILE"
 
 execute: |
+    systemd_ver="$(systemctl --version|head -1|cut -d ' ' -f2)"
+    REBOOT_WATCHDOG_PROP=RebootWatchdogUSec
+    if [ "${systemd_ver}" -lt 243 ]; then
+        REBOOT_WATCHDOG_PROP=ShutdownWatchdogUSec
+    fi
+
     echo "Ensure snap service watchdog works"
     snap set core watchdog.runtime-timeout=1m
     MATCH RuntimeWatchdogSec=60 < "$WATCHDOG_FILE"
+    systemctl show -p RuntimeWatchdogUSec|MATCH RuntimeWatchdogUSec=1m
 
     snap set core watchdog.shutdown-timeout=1h
     MATCH ShutdownWatchdogSec=3600 <  "$WATCHDOG_FILE"
+    systemctl show -p "$REBOOT_WATCHDOG_PROP"|MATCH "${REBOOT_WATCHDOG_PROP}=1h"
 
     echo "Unsetting removes the file"
     snap set core watchdog.runtime-timeout=
@@ -27,3 +35,8 @@
         echo "Empty watchdog config should remove config file but did not"
         exit 1
     fi
+
+    # check we are back to the default values
+    systemctl show -p RuntimeWatchdogUSec|MATCH RuntimeWatchdogUSec=0
+    systemctl show -p "$REBOOT_WATCHDOG_PROP"|MATCH "${REBOOT_WATCHDOG_PROP}=10m"
+
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/auto-import.assert snapd-2.48.3+20.04/tests/lib/assertions/auto-import.assert
--- snapd-2.45.1+20.04.2/tests/lib/assertions/auto-import.assert	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/auto-import.assert	2021-02-02 08:21:12.000000000 +0000
@@ -1,3 +1,54 @@
+type: account
+authority-id: canonical
+account-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
+display-name: Sergio Cazzolato
+timestamp: 2016-12-14T18:39:30.465695Z
+username: cachio
+validation: unproven
+sign-key-sha3-384: BWDEoaqyr25nF5SNCvEv2v7QnM9QsfCc0PBMYD_i2NGSQ32EF2d4D0hqUel3m8ul
+
+AcLBUgQAAQoABgUCWFGR4gAAKuYQAKkiD/CMc8yWZnkPpEbE1wqoCEIYtgZGt5YpADyZ+q/5QCWM
+Lo5QUxRRJ8VWQD1dmluEfbW1B/nPRlqpWArUOQve05B2Z5Iz+D87NJbTMbRN2MlQZ2lXRahgMP9/
+iPbYXVeQqtfKchVF3Jsj0mBZuT4l9XKNQRAv+mh/keG2ZxW13RwIS8XIP4rILdVAeDFMM0MQl6e0
+Q9gOjCB4eEdIBAhn8DRS+z4KsFE78xpUu2QS+gqF456DnfAkkj2gYC+r3Z1KPimZG6K4q8kzP85y
+9x5rb0WjTEkIgQCdEjyPKGm1OjPeHkkjZH1h9lYXf/rY5uxy6qACH9gIdpT3KZqYhG9G8ZZ1P+U4
+TZSxNShSblKdgRyzknSodV0HEcRqh9lbmRwGS/4H/wPS/Mqwq1bmj+LwD39nEKYG/vLGIs6h3wAT
+SvKWFpr8+Z9Dp8pR3iy701+oLQJyICj9sS6+iFnqKta5dRHTKT4575DV30j5erlUiH/W0t0f9weC
+82y7h6sW+dxkasJgpkdiEA4xyvmH4u9hzoI3cUuyNCl0A1VmGZOhpXXnKS5Nsgg9UH4GTkGEGEbu
+iMUGfwAF1xgbmYhJvuE5Ei9YsipEDRYYfusUoH7xXZgjuheQXdBDBjBRcASIYm1PvQIXMZKPUmj+
+fAF+l/naSJlKdU29hA7b5J65J98z
+
+type: account-key
+authority-id: canonical
+public-key-sha3-384: 0u-IKZyVlTxwiBVOv7oT1FNKdfkKJyOSwbEWJPurlvtaGZxX6VrMHSESnIPeaNMC
+account-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
+name: testkey
+since: 2019-05-16T18:06:04Z
+body-length: 717
+sign-key-sha3-384: BWDEoaqyr25nF5SNCvEv2v7QnM9QsfCc0PBMYD_i2NGSQ32EF2d4D0hqUel3m8ul
+
+AcbBTQRWhcGAARAAtyO1uc1hcicukfCg6HECJn1OXpUWXVYeTPIgpogBMfOAeL+SH8/4rIIJIipg
+Xkcjb26wk8eiaH9Foe88CEQy5RjZSKaAhIvirOA0USMCSMtxZdrVTWl1geN8bC6fPkfKtGHciPrJ
+EZI1uxWa4lUTiuwO9pSN5sYdKnMTeiklwnk9MxweINo5mJyiMCYyv7KAafeH+K/3NEkVtj9oEQni
+SMS8/640G04so7emioABuSRSagZk4jIK8nhJZG0ZuM8iPY0p/JilTdBhfL/pJcA5re+f72zSCe9d
+IMf7vvpyx/qMApr4ZwiOTZkxsHPSp77kB/Dy+D71edjqC1qrvyUC0vAvDXpMSofOxsA2QHrty2Nm
+7CLyYirphmSHGNeFgyY7LfvTxrvkK5Vwsw52hwybQKY0GgCCuWvg4gWl2p74odu7MxyUuqeDQ7iU
+2uOrMao8vQS0ULQZR7m8f7ojzaYiY9RdIOx+6pexfQm/7isHgihR94AsbrOP7ZYNDWSqGHQyK4vp
+04sWl/6Oxh+MpvoAAHYf0bgThFAiCIYZ05aQYnb/T/mjCopsH2WWSdGc9BhbcoRjChdU8qxw4WwB
+/VSM0pfKKUl9HKioXzjM/j3PVNOivrkolugBfPfbzgJrCJInpOBGm32W3XqlakUHRojHjzkMN46J
+3LaeTLYrRH/AoMMAEQEAAQ==
+
+AcLBUgQAAQoABgUCXN2mkAAAJHMQADVUSQ7qEIzic//BxsA2xbidm6G+O80OBSaQEUPCnIQTd3xE
+7dGEnal5Oa8OGhlKROqRRFCUd8mUYmTJdxRR7wumGmJSx2bUCmEBWAwyvNyQgVpBk9e+Gb9skHPA
+CrywNcJCZa9R7JWaEK/hwJjMYgPKgUOlBRdQDbWo3O8SSFRg8ipqKXn0kWpJ2y0DDX+dDfBPJZvN
+mIQO6DYFS1sV+/Qlq+hnuEJEIn2dorW+4qqW5DDr+n44MLGkDcW0X9o/WLlWM1dvsxTPpL84YvQM
+VOk8W08hsuJH3gNI0LwXqJ6kjlT54ck/uP5DsEhqpC54sy9goZowYO4yDQS8TdHQADY5HndGkbqV
+O460K5+vBl1yamX2qhUE4ePbwwniv3aTSWIk8f9HKFKvMcqUgjeNzjgU8OcjGDbynIYL34MzzGHx
+kT9kPtLj5/ByMdMUXhVEjbuOOpc5/0Cv74MRNhJITaABzRga/okFmolbKljO9zN26EyXaey945Ia
+YPQiXekI+N/OOUW7EDFanXZefzrW7Z7h7sqJu7D3zaUbYHZc2Qv7K0STBBWwDdvOU7CvaH/rJU4r
+a8SGQHOwEdf0bHf8Bt0VciNDEGmx2WDWqVvcUVr/leipGFGox2ueAOGH8PMkAMVekpApRUTJcAOB
+Mp7IstzOaiDQd1iY908FqwW9rVLO
+
 type: system-user
 authority-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
 brand-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
@@ -10,18 +61,18 @@
 password: $6$o5er943Y$cngsJHutSgACVbR65WAnhaUPC9.vENj8locb50hvMdMRMK8cQ3Zbu6WPh5Al2JrnHzpR63osPCwE/IFG/2s6K1
 series:
   - 16
-since: 2019-05-16T18:06:04+00:00
-until: 2020-05-16T18:06:04+00:00
+since: 2020-05-16T18:06:04+00:00
+until: 2064-05-16T18:06:04+00:00
 username: user1
 sign-key-sha3-384: 0u-IKZyVlTxwiBVOv7oT1FNKdfkKJyOSwbEWJPurlvtaGZxX6VrMHSESnIPeaNMC
 
-AcLBcwQAAQoAHRYhBMWWVcwwFvQaEaz9YITG74Zv2rilBQJc3blKAAoJEITG74Zv2ril1f0P/jT+
-Z7PVRNwWNmp7lUr+QpePQVPS1fL+ELs9gaWg/720PHZrdK3jzb8jVzzsRDuBpprLKfno6fq33PQJ
-f1j2d0IIZs7c7RCG6r451X2ZI+WSLCi1dhSMNuv1ryqUIrvMkTFJZKr4m9NgaxQKTUblEtqa0Ys7
-iUKmvyU+0GXfX//QbeCBKAQQjcobu+fZvBMKSmwE7x5Hj5Yk/dwypE4m5xvd9TzMxfrHSQL9JRZF
-2eWsKmh1uOJvkw9VF0NYGOE2vmJHrWePCBhH+mFHgrjIeIhPrFrRB70/JRaybjhCV9U7EJjmFiza
-hMFScIB1aZZTGbmvEaS0zoLShgVZltAbgnMf9ttV53dFFPIEYvRSD1uZfUwaJjHgWR/w7E8N7/X8
-poNeFOFRb+1ZShGbFC8lbWFv34ipX2pCSF5Pbq9naPeT15eLeXYbC5Wcw41bdfMoDt+OgizbKcwT
-gDaZycSCjywxjNlC91w2eAm94Mx9CkBi4VmL69CBvDAmOCbbiRrup4nz3JCb+7EGZBxSmkJ/RNQE
-IWblNKeoFvnsKw7ia9OC7qXvCM/bZiSEClcXooxnTdb4qBnPVL5oYIoEJX19nF57KqEcjH0fKKDf
-ZWBUc2i8FbeQrVSkogJ8iD58vn6NUTL0ZZ7VB+2yc8IyjuEbpJGWRPzqZCM4PigkapJa+nPR
+AcLBcwQAAQoAHRYhBMWWVcwwFvQaEaz9YITG74Zv2rilBQJe8hI3AAoJEITG74Zv2ril1l4QAJPQ
+XN98K+M2pV3uCupKv2A0CbdzuG41DKhRWjK15gdjL91CHnN3bWR6K5snlO1+TtXIMeP0zifz4LDV
+yvOw+QPxVduTolISMm2HpS/s3w2oq8neiHj4Bj8mehhTq4adie0tfNVm5+Y46p2GrjRxiRjJydgP
+QX4RT2zh2bmZ//KzUYPwa3Qh9BTnCZORgSVATod8aTZKmG378AlLLZFduP1afTqGk+ZcraXD5nV0
+WgeE9xP6lXYoRMkdtqRE5WtXeEVSMlPnf4+ThhPisHOCSQHBAtXsHXkJt/PZflO6/fdIxVLQJYtW
+ripaLepmKcUEmhtRTKVuAi4mehnSyR4L5WnbLu6bOeviFUCN9AAmX81yIrrGWkowsPprUzoPwCPY
+3il368sM8TVwtfzeoAi3yFmrSVgsxP6SV4op05jdbdh994NBCtlHN/jzBeFOAPvS16eN+7dFfegM
+P5qRvVDScr+Z3RoSMQoaFF/9oJJZAAJCq28clHWb91kjTUyS32B1VD9JxIvPiLH0GKDdTpl27ryx
+eVAZvRr4hW778hQCOrRphXXY8lovi+TMq4qXGJEFTFuBo7eFb3vifnwdaH7D8PLVft++TIDcr/vF
+Aw83OiMKsr6kBRLZsVA32FJxR0xeWoiIj5NUrVfleZvSwWoYedGe+ATtpe1uplzT4kjAdtJD
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/auto-import.assert.json snapd-2.48.3+20.04/tests/lib/assertions/auto-import.assert.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/auto-import.assert.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/auto-import.assert.json	2021-02-02 08:21:12.000000000 +0000
@@ -8,6 +8,6 @@
     "name": "user1",
     "username": "user1",
     "password": "$6$o5er943Y$cngsJHutSgACVbR65WAnhaUPC9.vENj8locb50hvMdMRMK8cQ3Zbu6WPh5Al2JrnHzpR63osPCwE/IFG/2s6K1",
-    "since": "2019-05-16T18:06:04+00:00",
-    "until": "2020-05-16T18:06:04+00:00"
+    "since": "2020-05-16T18:06:04+00:00",
+    "until": "2064-05-16T18:06:04+00:00"
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert snapd-2.48.3+20.04/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert
--- snapd-2.45.1+20.04.2/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,76 @@
+type: account
+authority-id: canonical
+account-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
+display-name: Samuele Pedroni
+timestamp: 2017-01-04T10:39:56.778769Z
+username: pedronis
+validation: unproven
+sign-key-sha3-384: BWDEoaqyr25nF5SNCvEv2v7QnM9QsfCc0PBMYD_i2NGSQ32EF2d4D0hqUel3m8ul
+
+AcLBUgQAAQoABgUCWGzQ/AAAhcwQAMj39rHTIyoxKCwu/riw/2ynWlIAeunUXr7vocaJFr22i6RD
+3FR2viAREN8ljgWklE9l+1ZCX7gtz65V0Zv2efK9Fo/49A49VDecdWVWvMgGySG45l7Sq0ssgtYk
+Zs1tGu69eNOosp2ZjX3Yq3gPeEeuVwssAmmPXgb+JoevIqT4Rj9KMnn7vwsgzOm8nVJVSGq6sovf
+4SUq1QdiYU+/FqRB9/10LnwL/4PU2THh1Omw2eCUTzM5fE0gAlBzbcg35ryW6mQTE1gif9/EN/XT
+kmcmI1mrVoSXRAxq032BkNjthRX1wfEXYtvdl72pr84PhbboVB4MWjch6cRNn0VOuCOsP+Yjqf5o
+Pwz/WWOFzAkyLptWIaAFziT6OqvKxO+EEDKvbg0DHbiUiodMv1TJvbcEam/V5EVNee8ik8BZpWzT
+VFNMriHxwZaMCcKJIpxEImH6xLNWXi6zklZIut4+zB+s51Z6NGtVV2KQmesEd1r3NOCjHoUV5VcM
+hv817R4JTAk9pPPjr9yPylnvm1PPTvnkJnWEurfXIKZ1nhUbtKhvLK83bvoLMeUuqPcyjSve9w7D
+5Ouv2h/48yl9AVZNOwj1M80XKZGJ4UGV54UIYIiGH23ewao3LlrMSNhtA1MO4ksddUZLVLqr4JJQ
+YX6TIPBI36CeCa64IMYe5x5t3ard
+
+type: account-key
+authority-id: canonical
+public-key-sha3-384: x1Tnl94nkgb-rMDs_l63gvgkLYGjXKfpkCCIQZwJ72-LR6X6OrSvNS9z2WS1lAGz
+account-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
+name: test-models
+since: 2020-05-11T19:07:32Z
+body-length: 717
+sign-key-sha3-384: BWDEoaqyr25nF5SNCvEv2v7QnM9QsfCc0PBMYD_i2NGSQ32EF2d4D0hqUel3m8ul
+
+AcbBTQRWhcGAARAA0erwxWsJGPcfwaba/pb9cfISsVVdkZTEOjf1yMMSkGExIQwADoIKh1H66tXp
+6vKaH9Js4KAIdek5ApvEsp5dD8VULrIBXdYoRAdcP41+puDM4GXHh+ly5ZJx37rVrmUM4/1TNBgZ
+pEtDkvUqoGUduEt6oi1d9lqO9nPnIg0Vb7x6KmdI4sFwFi/1E22kZ4JPyoZMJ8ohI2yIXuGARMDu
+MuAuvAxhy001c4T5NDko4Og40GE6gJFYyjGevzDo7ZnmBM8/8fTxkFgmo5aNcmRj/xteOSdW56I9
+DYECluu3iRa9g5jcpkQn42UTVlIFpSz0pByOXSZhPi4vNfs2rLQAW83U03PZTPCu9vWddahXtJYb
+TXOG0nIkhHI+RzGEChZtFBt+YKAsVsmN92ATFK81O2wiiznV1mLeWJLw89Nzu+ROE5TcEpcqYAsH
+8pVmH6SH3zcInLZYZdDMIFMaUpRpzflie8Xqo4cdTlhlDqZKzJdvtO97HB6YVGEVNvzRVMfHC+wU
+Y/twfRDDTKSM7qtaoe28053tEl53V9bWHcMTKbqfTfXteqyG/CMNaT1voHxa+xHdFMSGr2mCpmre
+mEIKTPk73WE1YTciimVSCxZzbbRU3PNG3JbCTHaZE5dWFohfep55Aq58Wb0RZKWXUNDuu2dWKEZA
+pr57T/9ZbwwaF1kAEQEAAQ==
+
+AcLBUgQAAQoABgUCXrmiewAAecUQAAhrXWrbQD18k58cbBjUMnnwosFO3NwBJkKF0jreLODuiGCN
+2xvdHfO9Li08uRmF8Plt39OH1w3d282W5dGHL+AAMFNpaJhzaXBfQnTTDfi6ow13sQieo7sLcxtt
+T8ZiU8LKAtj+GgRLVEelkvVdIh2fBzVgZQlMMbre4319j6eQWkIS7GxO1fsTUZliLW9fP3mS9G3z
+lUGsazVSUxAwnOSLm1mO9+uk1navsbWPufVr1onAHQ7Kqqr+ovB4N5GhcqpitGGHfijnH+7sMMR2
+XLjFQP5JkoqISgHgRcS3PDYyqigV44OBYiJOl+MwVQQ+uGtW/s9QJSTZlCEdIwVmFvtACH8Y3qPs
+ttLVhklWqDah47BBPTQAUIa9I298bEpwCB3Yurnke1/iLv0kdv0CVNXnurOFja5gN3QEh47kp+aX
+UQ2YCs8gyFtWvlxuMtcE6cUntPEDEtWpj0j8fjpnRLAcr42rG6YzGfS/vTW56j1L/lw9NrIDjTYL
+GpSwEMPo6fNZi7i5WWVn+Rno54Rrrtxf/K0ZTaRAZGyVa43u+4vvRDXq0fmIZ+jaULZ43qdwOaS9
+gnriPJm1OLx/eyekYFJANDTQtto4afQbgXKBriCXALzrw8jwznZQuaFqVBwfFbNvKLKT9PFmQrMz
+sVmgIjncklPz4r4e9diWGdHWbBiC
+
+type: system-user
+authority-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
+brand-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
+email: snappy-dev@lists.launchpad.net
+models:
+  - pc
+name: user1
+password: $6$o5er943Y$cngsJHutSgACVbR65WAnhaUPC9.vENj8locb50hvMdMRMK8cQ3Zbu6WPh5Al2JrnHzpR63osPCwE/IFG/2s6K1
+series:
+  - 16
+since: 2020-11-30T11:45:00+00:00
+until: 2030-11-30T11:45:00+00:00
+username: user1
+sign-key-sha3-384: x1Tnl94nkgb-rMDs_l63gvgkLYGjXKfpkCCIQZwJ72-LR6X6OrSvNS9z2WS1lAGz
+
+AcLBcwQAAQoAHRYhBJABFPajYkcbyArNXdOZThAVY89JBQJfxNykAAoJENOZThAVY89JFOEP/j5+
+sEDuXx2ys/Oy9MsAbW8rje7GkR9G4h1K5H/dgu4EZE76VEiFyWdGIO/Llb9fihBygBNjdVFFs7CS
+pihsl/dFQq+p/Q9DklM1g2t0BhhgE5+Kt3ArltWntP6uMFCq0cYzscFHnUNAZVJpHYMOIucq58Ag
+LmbKWGpUjF6t1x/fjQ4Z86j6adWvD05G83MreFGVWbIwVf4bvPNwPrMSDN7dMJbi9kyZSbVAlZDe
+ciywAr45SzyXjmFX7TA49oIMTrJc2NQrNmfh88VKTRtSRAc7jis8o0laCm95xDhtdqcZp5Q8y/bT
+chHAndQZysfOxV8pW3y1GsTp6f3Z8/JoqgjdYfvF29abaCM1ztfaL+XS2Gx+1IGBGSCsswc550fB
+YWvE93lReCLL2e/5r7qY83ddp+mvQ3UhZiFcxIzhxHeTDEHsOUBYmJb161CX6LLEiyZ00NZUhrjF
+HblVioPYjnNbG2b0CH1mmFSOIn8lhSjDGqIni0tgi9K/LpNe7wzTuyP1yoZCCbM/B/k83mXEBXY8
+hSmDHIKPxGKNXj5cJoOvONG8yjhpB4a/4ec2Lf7R52X4GI/UT1P82eWRmR1/v8++U3Dv1yhPwS/V
++kd8J4nWBiK1BJsAISJsGO9YIVBDHAr5HBIhyVPdl6VAgBFKxfTJ40IphUAKaUwUUsS7exZx
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert.json snapd-2.48.3+20.04/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez.auto-import.assert.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,13 @@
+{
+    "type": "system-user",
+    "authority-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
+    "series": ["16"],
+    "brand-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
+    "email": "snappy-dev@lists.launchpad.net",
+    "models": ["pc"],
+    "name": "user1",
+    "username": "user1",
+    "password": "$6$o5er943Y$cngsJHutSgACVbR65WAnhaUPC9.vENj8locb50hvMdMRMK8cQ3Zbu6WPh5Al2JrnHzpR63osPCwE/IFG/2s6K1",
+    "since": "2020-11-30T11:45:00+00:00",
+    "until": "2030-11-30T11:45:00+00:00"
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-secured.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-secured.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-secured.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-secured.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,40 @@
+{
+    "type": "model",
+    "authority-id": "developer1",
+    "series": "16",
+    "brand-id": "developer1",
+    "model": "testkeys-snapd-secured-core-20-amd64",
+    "architecture": "amd64",
+    "timestamp": "2018-09-11T22:00:00+00:00",
+    "grade": "secured",
+    "base": "core20",
+    "serial-authority": [
+        "generic"
+    ],
+    "snaps": [
+        {
+            "default-channel": "20/edge",
+            "id": "UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH",
+            "name": "pc",
+            "type": "gadget"
+        },
+        {
+            "default-channel": "20/edge",
+            "id": "pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza",
+            "name": "pc-kernel",
+            "type": "kernel"
+        },
+        {
+            "default-channel": "latest/stable",
+            "id": "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q",
+            "name": "core20",
+            "type": "base"
+        },
+        {
+            "default-channel": "latest/stable",
+            "id": "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4",
+            "name": "snapd",
+            "type": "snapd"
+        }
+    ]
+}
\ No newline at end of file
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-secured.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-secured.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-secured.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-secured.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,44 @@
+type: model
+authority-id: developer1
+series: 16
+brand-id: developer1
+model: testkeys-snapd-secured-core-20-amd64
+architecture: amd64
+base: core20
+grade: secured
+serial-authority:
+  - generic
+snaps:
+  -
+    default-channel: 20/edge
+    id: UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH
+    name: pc
+    type: gadget
+  -
+    default-channel: 20/edge
+    id: pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza
+    name: pc-kernel
+    type: kernel
+  -
+    default-channel: latest/stable
+    id: DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q
+    name: core20
+    type: base
+  -
+    default-channel: latest/stable
+    id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
+    name: snapd
+    type: snapd
+timestamp: 2018-09-11T22:00:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCX1u6/gAAiM0QAKZibjwRmgiMGSNtZiTlqu6wQsFY+8gETYTem9S4pyDlg3mY
+r+Ij8E7b0QmhG5yO4b5zXaNy0z2VvyJoZupUUR6yB2E3O9iyDA4hzQAIXwROxq6szZt7j3KJJxez
++EPXf4gfGB20ImPCvkLFd4MkZgDlW8xrWVOTppUBpMdBQiUhuszl1Wc0ZxvgTVMVghn1y19kUFYD
+TYIQ4czF26h4Wk4F1ZOxNQmFWDjvzgCVO2dPgo9J4/pW+WXluIEgzxG0yUt9hCbCf1K9U6Pt/27l
+OZ7SxByPJnJWPuMUJSBpgVdwQeLIs3EeU2f6xPSwt186aHh5RL19t/HHi/yr5t5ijZnAhLXqIyhw
+HmgpdxsnFCXW71IYTtcMMTMNJKqCgC49vVic5NKtCTcG3HXZIskO7OMPBz/L2GpN3gDSxa30qxRh
+xrZp3SBGjVn6fU1uUV0VZkjLwLeOUam9aJ571aNY0/85hjLtI0FX67QwvXxUn0ikuEUzJx1R92BX
+EhW9YuriSeewHVWBiuHcTQEJHiE+XmWvqC2HYGCEppGzMH4WqkABHokiYJlKC++h8BeWyhWiXcp4
+umVahzY1L0QYF6ajwG2MeF09E9S3PiqTTS+CBDk9zTZli3o7PP4lwS6lB5m2usf/0GFToC9WeOpl
+BbqMScaWHSrUk/ArC2VW0VFLtEiR
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-signed.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-signed.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-signed.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-signed.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,40 @@
+{
+    "type": "model",
+    "authority-id": "developer1",
+    "series": "16",
+    "brand-id": "developer1",
+    "model": "testkeys-snapd-signed-core-20-amd64",
+    "architecture": "amd64",
+    "timestamp": "2018-09-11T22:00:00+00:00",
+    "grade": "signed",
+    "base": "core20",
+    "serial-authority": [
+        "generic"
+    ],
+    "snaps": [
+        {
+            "default-channel": "20/edge",
+            "id": "UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH",
+            "name": "pc",
+            "type": "gadget"
+        },
+        {
+            "default-channel": "20/edge",
+            "id": "pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza",
+            "name": "pc-kernel",
+            "type": "kernel"
+        },
+        {
+            "default-channel": "latest/stable",
+            "id": "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q",
+            "name": "core20",
+            "type": "base"
+        },
+        {
+            "default-channel": "latest/stable",
+            "id": "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4",
+            "name": "snapd",
+            "type": "snapd"
+        }
+    ]
+}
\ No newline at end of file
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-signed.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-signed.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-signed.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-signed.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,44 @@
+type: model
+authority-id: developer1
+series: 16
+brand-id: developer1
+model: testkeys-snapd-signed-core-20-amd64
+architecture: amd64
+base: core20
+grade: signed
+serial-authority:
+  - generic
+snaps:
+  -
+    default-channel: 20/edge
+    id: UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH
+    name: pc
+    type: gadget
+  -
+    default-channel: 20/edge
+    id: pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza
+    name: pc-kernel
+    type: kernel
+  -
+    default-channel: latest/stable
+    id: DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q
+    name: core20
+    type: base
+  -
+    default-channel: latest/stable
+    id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
+    name: snapd
+    type: snapd
+timestamp: 2018-09-11T22:00:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCX1g+UAAA8SIQAAoiN45nQ1KtELyHrrgumYPD0XpJs7BDzgxXJsIStP8sZYgB
+nCOEXw+wA/xwFzAMaXKEe3DcjvcjsRXRTEm8IQdbxS4SHi0jV0NXasGvyoQLyTsXU3p+/LF6CZQx
+piIYj1fIsJe9Zk7lpHdMJ40mOX4F04X7ESaVBmhlcUcbEFKJ/rHN6tEZv/Pxn5dQ5SdcYkZdc7Mq
+hKFnD1ItaG3euH7lPhyuLaVD8k4GRavH6VXD6/8llz15FG+dODJUnLl4gSnAKlwrY9QOapxYGt2E
+oa/9WJyzBiwqajVCM27PjPBXBO+NuG6yRNF6y32WltW33wYh82OIRAKBdtmAN6uLwnq17k/Kl9GJ
+7KNnzasLnoBe2Vyf7+1znZXNgU2LZs0JN3W54oZTdKGhIUyleHy9swaiZUzA1AsKxLijNP83nFnN
+n5PA+JkuR68qWRmpmxe/g+ohkTJd1kuaXvSSXsLo/ii9wcTm1cfXyZwKvCsVHTsrsg9bNFKxdiET
+oktmBI+IC3YxY8IFC957IbIwjbRSL6o48+IM9JC3W/HsmqSOa0azOh6jmHqRHU+gTUVZ5zs1x6Jp
+UZcgZPXg9NMADPSPwK4w2/yvVc7TRDCJXQfFajETJhYdXQlSzpk22GuUcqAJzfejLow14+I3tU7i
+75T4JsoE09R+HrMNXqwi9fhhN1Qb
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,41 @@
+{
+    "type": "model",
+    "authority-id": "developer1",
+    "series": "16",
+    "brand-id": "developer1",
+    "model": "testkeys-snapd-signed-core-20-amd64",
+    "architecture": "amd64",
+    "timestamp": "2020-11-17T22:00:00+00:00",
+    "grade": "dangerous",
+    "storage-safety": "prefer-unencrypted",
+    "base": "core20",
+    "serial-authority": [
+        "generic"
+    ],
+    "snaps": [
+        {
+            "default-channel": "20/edge",
+            "id": "UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH",
+            "name": "pc",
+            "type": "gadget"
+        },
+        {
+            "default-channel": "20/edge",
+            "id": "pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza",
+            "name": "pc-kernel",
+            "type": "kernel"
+        },
+        {
+            "default-channel": "latest/stable",
+            "id": "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q",
+            "name": "core20",
+            "type": "base"
+        },
+        {
+            "default-channel": "latest/stable",
+            "id": "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4",
+            "name": "snapd",
+            "type": "snapd"
+        }
+    ]
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-20-storage-safety-prefer-unencrypted.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,45 @@
+type: model
+authority-id: developer1
+series: 16
+brand-id: developer1
+model: testkeys-snapd-signed-core-20-amd64
+architecture: amd64
+base: core20
+grade: dangerous
+serial-authority:
+  - generic
+snaps:
+  -
+    default-channel: 20/edge
+    id: UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH
+    name: pc
+    type: gadget
+  -
+    default-channel: 20/edge
+    id: pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza
+    name: pc-kernel
+    type: kernel
+  -
+    default-channel: latest/stable
+    id: DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q
+    name: core20
+    type: base
+  -
+    default-channel: latest/stable
+    id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
+    name: snapd
+    type: snapd
+storage-safety: prefer-unencrypted
+timestamp: 2020-11-17T22:00:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCX7OZLQAA184QAKhwE9DuDhsgyOhAxernDIqHAEOuyI/57qPKDeVWLZLKB9/Y
+5BDwR65G3tYL/3ZinnSPmshJYxk/S233JosglguGF+Wykqdhic+FknIy58X1ELVaTvPbn9UgiJBj
+5LqUDa/wm0hMTE48UcQuR59qOhTr2sBRjK3ZUfAqHPYGhUgSBa2P2wgAWkRjTI1C58pU/RXgG9Ov
+DR8dvZlxPk7G7TwZXr2Q8gT/bEOePiGBD3rE574R8xgRWRYVpEUJQDSTCtS2ZK24DcHt5dO6Y7fj
+cxKZae0ySm63TP9pXB5blESj1f9QTLH5lG1NAsKyC3A0yG4s0g2z4LKj23wLuV6GkQmXsLPBI7OT
+kUvFq3XxaZnPKF12hYLXc0SLH3pAZruOXtzVW39YwXzCRDZ5g71K19JHjGaKO9PG8YAFC7dNocld
+OEFpxFtSIq0SlYXlrDujeQ/LCx89NpD8602By93ZBeYBGVV2WGAE1ccwqDf7yAJ0aWk014c2Ox3h
+gqDrMlLdkAyXDMnTVCr9q1Yc+zO3t4ZET/6jb8vdOThX4wfgHUk7RiP3Kfge8CT+piGO9hTDVUdX
+b7byA1Ayqgd0/eOc6eKv6uH20BApK9iw1qj/FQFSmnU+cvI1iKfO6dNaReuQkuV3QA4moMQfC7R7
++BG6unTYovptwY2h5E47bhC76dgj
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-auto-import.assert snapd-2.48.3+20.04/tests/lib/assertions/developer1-auto-import.assert
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-auto-import.assert	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-auto-import.assert	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,77 @@
+type: account
+authority-id: testrootorg
+account-id: developer1
+display-name: Developer1
+timestamp: 2020-09-11T11:43:46-05:00
+username: developer1
+validation: unproven
+sign-key-sha3-384: hIedp1AvrWlcDI4uS_qjoFLzjKl5enu4G2FYJpgB3Pj-tUzGlTQBxMBsBmi-tnJR
+
+AcLBUgQAAQoABgUCX1upQgAAa6sQALM/XTz+4h0t9G/eHTrPYCVCztPugC9ZyTLtqRgdvv2JIl4p
+oBK7/bByBE8K6Qhp8koAcXQ/PVzjMFrW1bs2g6BODPvoy9g0DKMgDZRxMXT7F9Uv006qBWED0D2g
+utsUeYYpCBDOAV843rvwaXYDtTvNQngTaQQ2EGO6XODtGUkRVyjFS3KG+EfbRVtf9gx6VvkrbBLR
+FSAtd22uKmfD35FUZuUHFszZ/mRZ0OwF40V74vl1EXTWnRxuqzSH47FiWfOYYYcODPDLzPRxyP6T
+vKqoRQ4vPr+GhrmtLoTInuC9KAoLF2CHto9NUAoPX79/RF967Utv9URpmKZsBQItdWnx83bmLVYc
+soA3wLS74W/VHfYNFJi1F6Nw2yKewVfyVfq/Cd2IcFO0B/+Rk05+1H3d0JWKj4nDSSVgIN7DdhBQ
+5iIxhEZb5G9taLMFE8xfMS1+Ss5MMoMs/VPoojlJhJimNmgcatj58ygQNaX07pJ+mcMYT6XAQ9gx
+9SwNOoDXqf6lf6khtJk1zBQwLCc0Yslb7f/CwCDBVht1ycwyZvnLMDw2Ohlj/tQ9KSJAVflqCFDm
+ccH4uhHFMgD8SNRASS10LU2GIH+8Rqw5wkj6VXEkoMIHERAqnwR7/9ByCHLiDs1QUTL7ncRWuEq5
+eYCJRESnQP9guEFOoUmOO+gkDpCo
+
+type: account-key
+authority-id: testrootorg
+public-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+account-id: developer1
+name: default
+since: 2020-09-11T11:47:45-05:00
+body-length: 717
+sign-key-sha3-384: hIedp1AvrWlcDI4uS_qjoFLzjKl5enu4G2FYJpgB3Pj-tUzGlTQBxMBsBmi-tnJR
+
+AcbBTQRWhcGAARAAtJGIguK7FhSyRxL/6jvdy0zAgGCjC1xVNFzeF76p5G8BXNEEHZUHK+z8Gr2J
+inVrpvhJhllf5Ob2dIMH2YQbC9jE1kjbzvuauQGDqk6tNQm0i3KDeHCSPgVN+PFXPwKIiLrh66Po
+AC7OfR1rFUgCqu0jch0H6Nue0ynvEPiY4dPeXq7mCdpDr5QIAM41L+3hg0OdzvO8HMIGZQpdF6jP
+7fkkVMROYvHUOJ8kknpKE7FiaNNpH7jK1qNxOYhLeiioX0LYrdmTvdTWHrSKZc82ZmlDjpKc4hUx
+VtTXMAysw7CzIdREPom/vJklnKLvZt+Wk5AEF5V5YKnuT3pY+fjVMZ56GtTEeO/Er/oLk/n2xUK5
+fD5DAyW/9z0ygzwTbY5IuWXyDfYneL4nXwWOEgg37Z4+8mTH+ftTz2dl1x1KIlIR2xo0kxf9t8K+
+jlr13vwF1+QReMCSUycUsZ2Eep5XhjI+LG7G1bMSGqodZTIOXLkIy6+3iJ8Z/feIHlJ0ELBDyFbl
+Yy04Sf9LI148vJMsYenonkoWejWdMi8iCUTeaZydHJEUBU/RbNFLjCWa6NIUe9bfZgLiOOZkps54
++/AL078ri/tGjo/5UGvezSmwrEoWJyqrJt2M69N2oVDLJcHeo2bUYPtFC2Kfb2je58JrJ+llifdg
+rAsxbnHXiXyVimUAEQEAAQ==
+
+AcLBUgQAAQoABgUCX1uqMQAAZZ0QACLpYbT+5zRcluR6I4IPyGrVgTM19L7x4rxlOIU5wdRdM6xi
+Dnl49fj7XaC8hNNsZ+lKe8VvjZU44gMFtvooBY6nsub5wiaG3PwR4Oed9J4p6Xv5DrrFTLUy62sV
+/ApfcQwcTgZPt9PHAvr4nWKrl0ierxfIdgdPBV5w+mEOPHSCx/JyX8b6BhDHgH07NEGvFWj0by9I
+g1VCmxNceH+a0loYizU1S3LJnBGD89W0UMq1HRO8stBIH5VC4VeaOppnj8MnnVUriF90lK26YzGR
+fFZsg/f5S4CC0lHCh+6jvIAjOFinmCg8ouI5ja2c54nWQ/D1ZHjNqvEC8fVNWf3VYYZUIrKDMdCz
+WNvtfk44bBp9mHKIPiS3Sn5xNK8pwZ/ldmAiLMZSovIYzocHqeIUAos7M8lth1lLrGo29Iwv6lof
+tfpJT8QKkrKU63tCOuvw6W1pmfU/LU91cEuq4dVE+77GpDiOo66LsSHZzLMQb+fkjOnK79swJ6Bw
+AqHJYdx/mNU1/N9FeUbzgESjSY6OydjWhAB6F/T5S8O/K8SExF2+wQIOw+A+D80QbrpbcsL5Yzcb
+gqS5rFAxK1vPvMUk/t7pXpcoR9t+KGqsNhMiG0AsFqckZi0A2F5XzUztF2MtDLUdNaxmEC7ZITB/
+tgWXS3ChGQqx9v3dl0VqKP/Pkad/
+
+type: system-user
+authority-id: developer1
+brand-id: developer1
+email: snappy-dev@lists.launchpad.net
+models:
+  - testkeys-snapd-signed-core-20-amd64
+  - testkeys-snapd-secured-core-20-amd64
+name: user1
+password: $6$o5er943Y$cngsJHutSgACVbR65WAnhaUPC9.vENj8locb50hvMdMRMK8cQ3Zbu6WPh5Al2JrnHzpR63osPCwE/IFG/2s6K1
+series:
+  - 16
+since: 2020-05-16T18:06:04+00:00
+until: 2064-05-16T18:06:04+00:00
+username: user1
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCX1unlAAANoYQAIyFE0DFBdH22v8LhUvuhZopLd32wKaXdVY+XjSoLB58/kim
+lD9ipdbxLrQR/tePp06AQqSvbGwjXpujVQ1/hpqHVOdePhvuTi6BqRIz+7M/bcUXq95TL7MuqKam
+2l6Q5h+s8gWz7U75kTZqaHODPb/412P8cPY/dZr7SLg6CQlkczAVEaAFw3hgVAxAzb82VGZzlCof
+6LMG5ceJPoMmDjn9wh/RlTS2WbXA3PTNHNDsOhHlMnCBu+hmVPrGYcXLeNR6EIlVf7adaUtqrQ1P
+FoqHQcfzTNXVKN2ao+ByqqAptV8trNIoP2UtZjeukntWGhl+cYRDb1IG0CnAjZnPgnXmjVtYD30N
+yAg6egkAa5TwH8NZ/JyGX3SavzDGiDXUJVLFNfrsKo8wdkutgNqpftF+Nalgr3z8gilNHzv+fSBt
+NdDKgzk3YDzWF0CJUfrF3Aw/5y3+0eRRAC5kv/d7F1P5kOzEzeMfhOfLhsa8Q7tV49dPIrMVqSqz
+vf/EPp9AVYTpLTsbqYWYe610PrTWDt6WNwUugUDp65uS47lpsaVzTAbIuJTaVlHD/34TIRpSyjFQ
+Hn8JEOTj4XTQEh25SBcxp7sBJJ/LwCf9jchy6abmmZlOMc3tU5Xl8tBEOHO71uJh5iU7bXhcIuC3
+FHN+U4XpI5/dPGKkhGHBnqvQ5lAd
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-auto-import.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-auto-import.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-auto-import.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-auto-import.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,18 @@
+{
+    "type": "system-user",
+    "authority-id": "developer1",
+    "series": [
+        "16"
+    ],
+    "brand-id": "developer1",
+    "email": "snappy-dev@lists.launchpad.net",
+    "models": [
+        "testkeys-snapd-signed-core-20-amd64",
+        "testkeys-snapd-secured-core-20-amd64"
+    ],
+    "name": "user1",
+    "username": "user1",
+    "password": "$6$o5er943Y$cngsJHutSgACVbR65WAnhaUPC9.vENj8locb50hvMdMRMK8cQ3Zbu6WPh5Al2JrnHzpR63osPCwE/IFG/2s6K1",
+    "since": "2020-05-16T18:06:04+00:00",
+    "until": "2064-05-16T18:06:04+00:00"
+}
\ No newline at end of file
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-new-base.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-new-base.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-new-base.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-new-base.model	1970-01-01 00:00:00.000000000 +0000
@@ -1,23 +0,0 @@
-type: model
-authority-id: developer1
-revision: 2
-series: 16
-brand-id: developer1
-model: my-model
-architecture: amd64
-base: test-snapd-core18
-gadget: pc=18
-kernel: pc-kernel=18
-timestamp: 2017-05-28T19:40:00+00:00
-sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
-
-AcLBUgQAAQoABgUCXXkbOAAACgsQAF7CSfowmuUnv5R1QMrGtzFGJurjQvgLVHc9olSygOZl2H/m
-Gmb8whFKbUsWjQFO6S2BMUQ+L3C5BUsVLnHclNTq9RrkaLDsPMNuso7uqCcVSk83r+N/ptXXzZhm
-wEL2WLu6F5WUBxdwIljlorwuw9V4uP+1gdQ+jEEIJ9Hl0RRdAt1Pm39/5+nWRMKSy6TBH3E8y70I
-B5Qu0K4HCG1Tz11XZGIf541rIGa7mBzeuJ7FWcCsdvcKcvFsQXYq6FV1qzBwT0gM+Aqg3rgdVE7y
-V4b8UUv1CBDNn5lvkXGDV3Kbl5odX4sbmCqTTT5jFoWyhDXISpg31f+UIMXcg5EUjSfBP22F3NjI
-fdpMY9CBYpecHmVhsBpbtDjI2bfDuuAFMKWkeKFySjbhRrcpTm4iEfq8ezrpRJrusUzWPb6jTB7S
-cb7Dp9Hq8FzFi2GrV2w4NVQCGihwS3HuQAvQ5ZxDtgS1Nv+5oTRSiqkZRGr8h9LA8PPUDvIrBAg0
-TrZgbql7Qwjo4PkjtZPQBNzyOcHFC38mKVq9r1b5ZGkF6yGvPK76a2Oe7vmWPw+EyQKDc+5+UYiU
-vYXFbqWwtAkF0fkMis2TiSqd6FfBWRM64OE+8/n/UrEgbS69i4/XXjm34iscc8umbmZ1w5Z/hsC0
-sDZUfqBALcc31dvgi1ClJUTEnotw
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-new-gadget.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-new-gadget.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-new-gadget.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-new-gadget.model	1970-01-01 00:00:00.000000000 +0000
@@ -1,23 +0,0 @@
-type: model
-authority-id: developer1
-revision: 2
-series: 16
-brand-id: developer1
-model: my-model
-architecture: amd64
-base: core18
-gadget: test-snapd-pc
-kernel: pc-kernel=18
-timestamp: 2018-09-11T22:00:00+00:00
-sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
-
-AcLBUgQAAQoABgUCXbBcrAAAEnsQABIv573DoVzl30EAjAXW56l3RbG8Jd8nNu4sBjelngE/PiWt
-zZqL7pNheCHCIFNWBPULq++e3jppvB+fKSmTq9xRYF+l/+Vqv9xzHJAJYSH+TWJV1xSvg98MyPBh
-jxLKrwL7JZc0KKUH+mQ2mNdoCo567qysJzkqFZIBN/IN68juWZwCcSoSSTIc0O6vLo5Md6SdHfPU
-Ndmex/vt8WQYVXo7CGonBlho8LowKSfV0R/5d2Yu/FgePUgUvowLo8dmh+mVToZohNC1fYYYnHNB
-lpf2yMlWwrTPVnHSfjQLHAQ9DaJ+VivbYMzOIfnHXrMheSdr0oMTvduL5IJk/3vY/wT4ec8Z8q8g
-aUH3g5MqTvfYDQttiiHoFy7IyIzfoNDuBeaDAmNH4wB0Nfq0HdEiGUGyvSuc1mNpFkPVzcsSzWT6
-0wfcJ0nIFGIgnJcnt/NYAo+Q/iUXJgY5HfmudvH+/HzO7iIczp+oal3cqCvlKHDecSscH+6rSOJW
-5H8h3kp4FIxZ8I53kHPWFRFO1L/9T/B153tWyr4uPQGjj2v5RTQAqMgJUSjmp1OJ5w4QyvwUqyM4
-bCoYm5Btuyj/W7ckuAI6Nwr1j6VL78/OCPH6ZLgPPYEWqX643nmOL7cnMOskqwo4YogssNbNSOXv
-qLqsd5En1ICT3ATUluYYKml4qqsi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-new-gadget.model.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-new-gadget.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-new-gadget.model.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-new-gadget.model.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-{
-    "type": "model",
-    "series": "16",
-    "brand-id": "developer1",
-    "model": "my-model",
-    "architecture": "amd64",
-    "gadget": "test-snapd-pc",
-    "base": "core18",
-    "kernel": "pc-kernel=18",
-    "revision": "2",
-    "timestamp": "2018-09-11T22:00:00+00:00"
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-revno2.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-revno2.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-revno2.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-revno2.model	1970-01-01 00:00:00.000000000 +0000
@@ -1,25 +0,0 @@
-type: model
-authority-id: developer1
-revision: 2
-series: 16
-brand-id: developer1
-model: my-model
-architecture: amd64
-base: core18
-gadget: pc=18
-kernel: pc-kernel=18
-required-snaps:
-  - test-snapd-tools-core18
-timestamp: 2019-01-18T08:00:00+00:00
-sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
-
-AcLBUgQAAQoABgUCXS+D/gAA+/YQAIvdKF52yhf7K6bSPVKGaDQ5c95WI+w0NnPb37u6RXv6wrr+
-zbs8kVsJWw2lDxjoiEAvbr47miF5egBcynUkjjLYLgwjhgz8eqogKpF0nvGgjfn8IzEoJj+sV5Wb
-zKzZ6XtOuA7rzMqBBwpGQpYv41bajvaCNv3f6libzAS+hQZCZLkKCcLAuPk/JzfvTggivgrBGX1k
-vtsPWSpPfD4L5/tTwXitrLHO5nyjrfljzSA6EDloBbOl+TZSg9oo3MEvQTNQrxRN15C7wuiHTFjQ
-qzbBlbypIDdIh+VQgtzI9ksi5HX7uf/FJi0J7APQmlUuLDZzJSW0FuZcP4S9bPdPRWFC4Blcw9J+
-eyJEx57uiDtX6iULM9hEXdJ4iS7jJ7UH7S4q9GniEMGCz1SHc0962iySdrDdj3UaqmvRwfJv34sR
-aeFBcBRVHoVo1Y4ERJ0jY0B9GektCyFM1DP+sfqGdz2Fb8EYeUOc3/BmBAzllptseWWfHuVeO4Ux
-bfw5FcGiGoeG0plyiWGI3GKIkSPCeaEpHdyuJP19O0wairprF79ivcE0/map5ZIUgRmewvqt89+a
-/9Tt9W3UnkjgKlTMIfxzZut5jsLm2u80GuxooOZLVVriDfybobkegVLBmSIEI3hCiiDtMuHfDQ0+
-WMcijT7tu1txEe/7hyBi84oiK3lR
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-revno3.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-revno3.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-revno3.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-revno3.model	1970-01-01 00:00:00.000000000 +0000
@@ -1,23 +0,0 @@
-type: model
-authority-id: developer1
-revision: 3
-series: 16
-brand-id: developer1
-model: my-model
-architecture: amd64
-base: core18
-gadget: pc=18
-kernel: pc-kernel=18
-timestamp: 2019-03-20T09:11:00+00:00
-sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
-
-AcLBUgQAAQoABgUCXS+EegAAHt0QAGE4g8j/cqT0zoBrbm2Aq04CFJ23kOotp4Mti9na8twKwsHz
-5xM+fnTHLGh5ONyCl9/NpV0SSM9FG1BFGBlGTKaxGeu69uBKNIR61G9RXfzQl3Dep0UvG7nCnZdO
-Cd+pJH6KAiL9kKQDxIeG6myw6ais85n71sF+TgBSJb31gE4YjjH1oyxMw25+UIcPcBzpC8W8JCL2
-yA+7Ym+bcV3Avu+jATKj5SsnuOM+zzNxS1cs0Qy5qPv2UqN0ePEWaG1yawWJzxcV3hP6RiuwQYGc
-gbZpA1QQnHOGYrZG9JqRSFXYLVKvVQfQfzW3FRFLMTdGp8U5ihAj0Fk+EDKc5kBDRwbhO/r1CFmr
-+kLjmWEiMjlyEiyyzBUTyfq5TiqS7GacuCOLZoOILPWXyu/VbbegcrM2AjHxDohNhBkiWo59PtCy
-/BSVNHLFd5OglDHg8LIX4CKGM9ezjnvxe9btT3EUch8OpD5sKD1Ryrg05cebBqGmCQvEINFkU2pv
-RmhYzHb1NnPsZwBhaxUxEbbj9Brn1QDS5XdNYeMgvMZLL9HyFFHfmTluaPY04xcGQPT0rOkLo+Jc
-/VN2+0bSyUgKqqdjXq5JWbndD1Wwy8Pj/biEBHFAQX02u+YKrmnnSf7g3XQ6uS+lyniN15tEVRMB
-0uEF761PHhG4cvFnTbSlpeacHYL5
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-w-config.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-w-config.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-w-config.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-w-config.model	1970-01-01 00:00:00.000000000 +0000
@@ -1,24 +0,0 @@
-type: model
-authority-id: developer1
-series: 16
-brand-id: developer1
-model: my-model-w-config-18
-architecture: amd64
-base: core18
-gadget: pc=18
-kernel: pc-kernel=18
-required-snaps:
-  - test-snapd-with-configure-core18
-timestamp: 2019-11-26T09:42:00+00:00
-sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
-
-AcLBUgQAAQoABgUCXdzmtgAANuQQAAAhKcYThYCAvCbGwFdhAs8JELgWv6jSNDvYEMXG1ZVfjL7C
-DxKpeJhiEJ5fKkbRIAZJ7cEhISv9k6ht266B9DsCgcWx65yGksg8bRDAPoy5N68EWMGM0Xxz+kzR
-96I+qCLqR1BrnCPuZmjsiPYwG/R6aS1vSo7tEiy3v/Z0E5CeLjP1p2RXqqqcTBA2jh+OjzGIPY2w
-K9Py1L7gBl0XiAnBtbp9ikxB+8g/2L0FbjcsJLNxw0fUosmlgkwZWoJ3W0ys3gydyXR4J3UZRD6v
-iL3pVIjMzRRwrNUAS30UmSGkp3yK6CQ335/mlB7KIXuOBtf5iufBdHK26j/4ltyiPPpWLcXfI5q6
-/Qljki3XC5r4kqZLDsvuQKE8AnkzgLPP/C1uanJA83s/DkNlUncLefbkVgBerY+ueD/P9U4ovQl7
-YXMSgbS7WpXQvI7BISrYl7fut6HP8mHWdWPqdsXDGFDzQULLAG17l1nqmoZ8eXM1SUuZuhlL+Muu
-75timOX62cEydEEb4zf4HNuhYx/a++LircrQl7WNZT9dzqCpDq3ewOMO2isjvHtF2rWWptG6FJhf
-Fbmi6eGvwu+xy8pzH2IvdyQ9n/Z9mZh+QiwooVNs40FnKbZHtBgobjZnGBvxXiBeKOUfqmp1VwUE
-UVwevw1Rgpq36YUc/WkTIvtomfRi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-w-config.model.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-w-config.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-18-w-config.model.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-18-w-config.model.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-{
-    "type": "model",
-    "series": "16",
-    "brand-id": "developer1",
-    "model": "my-model-w-config-18",
-    "architecture": "amd64",
-    "base": "core18",
-    "gadget": "pc=18",
-    "kernel": "pc-kernel=18",
-    "required-snaps": ["test-snapd-with-configure-core18"],
-    "timestamp": "2019-11-26T09:42:00+00:00"
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-new-base-18.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-new-base-18.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-new-base-18.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-new-base-18.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,23 @@
+type: model
+authority-id: developer1
+revision: 2
+series: 16
+brand-id: developer1
+model: my-model
+architecture: amd64
+base: test-snapd-core18
+gadget: pc=18
+kernel: pc-kernel=18
+timestamp: 2017-05-28T19:40:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCXXkbOAAACgsQAF7CSfowmuUnv5R1QMrGtzFGJurjQvgLVHc9olSygOZl2H/m
+Gmb8whFKbUsWjQFO6S2BMUQ+L3C5BUsVLnHclNTq9RrkaLDsPMNuso7uqCcVSk83r+N/ptXXzZhm
+wEL2WLu6F5WUBxdwIljlorwuw9V4uP+1gdQ+jEEIJ9Hl0RRdAt1Pm39/5+nWRMKSy6TBH3E8y70I
+B5Qu0K4HCG1Tz11XZGIf541rIGa7mBzeuJ7FWcCsdvcKcvFsQXYq6FV1qzBwT0gM+Aqg3rgdVE7y
+V4b8UUv1CBDNn5lvkXGDV3Kbl5odX4sbmCqTTT5jFoWyhDXISpg31f+UIMXcg5EUjSfBP22F3NjI
+fdpMY9CBYpecHmVhsBpbtDjI2bfDuuAFMKWkeKFySjbhRrcpTm4iEfq8ezrpRJrusUzWPb6jTB7S
+cb7Dp9Hq8FzFi2GrV2w4NVQCGihwS3HuQAvQ5ZxDtgS1Nv+5oTRSiqkZRGr8h9LA8PPUDvIrBAg0
+TrZgbql7Qwjo4PkjtZPQBNzyOcHFC38mKVq9r1b5ZGkF6yGvPK76a2Oe7vmWPw+EyQKDc+5+UYiU
+vYXFbqWwtAkF0fkMis2TiSqd6FfBWRM64OE+8/n/UrEgbS69i4/XXjm34iscc8umbmZ1w5Z/hsC0
+sDZUfqBALcc31dvgi1ClJUTEnotw
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-new-gadget-18.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-new-gadget-18.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-new-gadget-18.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-new-gadget-18.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,23 @@
+type: model
+authority-id: developer1
+revision: 2
+series: 16
+brand-id: developer1
+model: my-model
+architecture: amd64
+base: core18
+gadget: test-snapd-pc
+kernel: pc-kernel=18
+timestamp: 2018-09-11T22:00:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCXbBcrAAAEnsQABIv573DoVzl30EAjAXW56l3RbG8Jd8nNu4sBjelngE/PiWt
+zZqL7pNheCHCIFNWBPULq++e3jppvB+fKSmTq9xRYF+l/+Vqv9xzHJAJYSH+TWJV1xSvg98MyPBh
+jxLKrwL7JZc0KKUH+mQ2mNdoCo567qysJzkqFZIBN/IN68juWZwCcSoSSTIc0O6vLo5Md6SdHfPU
+Ndmex/vt8WQYVXo7CGonBlho8LowKSfV0R/5d2Yu/FgePUgUvowLo8dmh+mVToZohNC1fYYYnHNB
+lpf2yMlWwrTPVnHSfjQLHAQ9DaJ+VivbYMzOIfnHXrMheSdr0oMTvduL5IJk/3vY/wT4ec8Z8q8g
+aUH3g5MqTvfYDQttiiHoFy7IyIzfoNDuBeaDAmNH4wB0Nfq0HdEiGUGyvSuc1mNpFkPVzcsSzWT6
+0wfcJ0nIFGIgnJcnt/NYAo+Q/iUXJgY5HfmudvH+/HzO7iIczp+oal3cqCvlKHDecSscH+6rSOJW
+5H8h3kp4FIxZ8I53kHPWFRFO1L/9T/B153tWyr4uPQGjj2v5RTQAqMgJUSjmp1OJ5w4QyvwUqyM4
+bCoYm5Btuyj/W7ckuAI6Nwr1j6VL78/OCPH6ZLgPPYEWqX643nmOL7cnMOskqwo4YogssNbNSOXv
+qLqsd5En1ICT3ATUluYYKml4qqsi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-new-gadget-18.model.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-new-gadget-18.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-new-gadget-18.model.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-new-gadget-18.model.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,12 @@
+{
+    "type": "model",
+    "series": "16",
+    "brand-id": "developer1",
+    "model": "my-model",
+    "architecture": "amd64",
+    "gadget": "test-snapd-pc",
+    "base": "core18",
+    "kernel": "pc-kernel=18",
+    "revision": "2",
+    "timestamp": "2018-09-11T22:00:00+00:00"
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-revno2-18.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-revno2-18.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-revno2-18.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-revno2-18.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,25 @@
+type: model
+authority-id: developer1
+revision: 2
+series: 16
+brand-id: developer1
+model: my-model
+architecture: amd64
+base: core18
+gadget: pc=18
+kernel: pc-kernel=18
+required-snaps:
+  - test-snapd-tools-core18
+timestamp: 2019-01-18T08:00:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCXS+D/gAA+/YQAIvdKF52yhf7K6bSPVKGaDQ5c95WI+w0NnPb37u6RXv6wrr+
+zbs8kVsJWw2lDxjoiEAvbr47miF5egBcynUkjjLYLgwjhgz8eqogKpF0nvGgjfn8IzEoJj+sV5Wb
+zKzZ6XtOuA7rzMqBBwpGQpYv41bajvaCNv3f6libzAS+hQZCZLkKCcLAuPk/JzfvTggivgrBGX1k
+vtsPWSpPfD4L5/tTwXitrLHO5nyjrfljzSA6EDloBbOl+TZSg9oo3MEvQTNQrxRN15C7wuiHTFjQ
+qzbBlbypIDdIh+VQgtzI9ksi5HX7uf/FJi0J7APQmlUuLDZzJSW0FuZcP4S9bPdPRWFC4Blcw9J+
+eyJEx57uiDtX6iULM9hEXdJ4iS7jJ7UH7S4q9GniEMGCz1SHc0962iySdrDdj3UaqmvRwfJv34sR
+aeFBcBRVHoVo1Y4ERJ0jY0B9GektCyFM1DP+sfqGdz2Fb8EYeUOc3/BmBAzllptseWWfHuVeO4Ux
+bfw5FcGiGoeG0plyiWGI3GKIkSPCeaEpHdyuJP19O0wairprF79ivcE0/map5ZIUgRmewvqt89+a
+/9Tt9W3UnkjgKlTMIfxzZut5jsLm2u80GuxooOZLVVriDfybobkegVLBmSIEI3hCiiDtMuHfDQ0+
+WMcijT7tu1txEe/7hyBi84oiK3lR
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-revno3-18.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-revno3-18.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-revno3-18.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-revno3-18.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,23 @@
+type: model
+authority-id: developer1
+revision: 3
+series: 16
+brand-id: developer1
+model: my-model
+architecture: amd64
+base: core18
+gadget: pc=18
+kernel: pc-kernel=18
+timestamp: 2019-03-20T09:11:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCXS+EegAAHt0QAGE4g8j/cqT0zoBrbm2Aq04CFJ23kOotp4Mti9na8twKwsHz
+5xM+fnTHLGh5ONyCl9/NpV0SSM9FG1BFGBlGTKaxGeu69uBKNIR61G9RXfzQl3Dep0UvG7nCnZdO
+Cd+pJH6KAiL9kKQDxIeG6myw6ais85n71sF+TgBSJb31gE4YjjH1oyxMw25+UIcPcBzpC8W8JCL2
+yA+7Ym+bcV3Avu+jATKj5SsnuOM+zzNxS1cs0Qy5qPv2UqN0ePEWaG1yawWJzxcV3hP6RiuwQYGc
+gbZpA1QQnHOGYrZG9JqRSFXYLVKvVQfQfzW3FRFLMTdGp8U5ihAj0Fk+EDKc5kBDRwbhO/r1CFmr
++kLjmWEiMjlyEiyyzBUTyfq5TiqS7GacuCOLZoOILPWXyu/VbbegcrM2AjHxDohNhBkiWo59PtCy
+/BSVNHLFd5OglDHg8LIX4CKGM9ezjnvxe9btT3EUch8OpD5sKD1Ryrg05cebBqGmCQvEINFkU2pv
+RmhYzHb1NnPsZwBhaxUxEbbj9Brn1QDS5XdNYeMgvMZLL9HyFFHfmTluaPY04xcGQPT0rOkLo+Jc
+/VN2+0bSyUgKqqdjXq5JWbndD1Wwy8Pj/biEBHFAQX02u+YKrmnnSf7g3XQ6uS+lyniN15tEVRMB
+0uEF761PHhG4cvFnTbSlpeacHYL5
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-w-config-18.model snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-w-config-18.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-w-config-18.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-w-config-18.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,24 @@
+type: model
+authority-id: developer1
+series: 16
+brand-id: developer1
+model: my-model-w-config-18
+architecture: amd64
+base: core18
+gadget: pc=18
+kernel: pc-kernel=18
+required-snaps:
+  - test-snapd-with-configure-core18
+timestamp: 2019-11-26T09:42:00+00:00
+sign-key-sha3-384: EAD4DbLxK_kn0gzNCXOs3kd6DeMU3f-L6BEsSEuJGBqCORR0gXkdDxMbOm11mRFu
+
+AcLBUgQAAQoABgUCXdzmtgAANuQQAAAhKcYThYCAvCbGwFdhAs8JELgWv6jSNDvYEMXG1ZVfjL7C
+DxKpeJhiEJ5fKkbRIAZJ7cEhISv9k6ht266B9DsCgcWx65yGksg8bRDAPoy5N68EWMGM0Xxz+kzR
+96I+qCLqR1BrnCPuZmjsiPYwG/R6aS1vSo7tEiy3v/Z0E5CeLjP1p2RXqqqcTBA2jh+OjzGIPY2w
+K9Py1L7gBl0XiAnBtbp9ikxB+8g/2L0FbjcsJLNxw0fUosmlgkwZWoJ3W0ys3gydyXR4J3UZRD6v
+iL3pVIjMzRRwrNUAS30UmSGkp3yK6CQ335/mlB7KIXuOBtf5iufBdHK26j/4ltyiPPpWLcXfI5q6
+/Qljki3XC5r4kqZLDsvuQKE8AnkzgLPP/C1uanJA83s/DkNlUncLefbkVgBerY+ueD/P9U4ovQl7
+YXMSgbS7WpXQvI7BISrYl7fut6HP8mHWdWPqdsXDGFDzQULLAG17l1nqmoZ8eXM1SUuZuhlL+Muu
+75timOX62cEydEEb4zf4HNuhYx/a++LircrQl7WNZT9dzqCpDq3ewOMO2isjvHtF2rWWptG6FJhf
+Fbmi6eGvwu+xy8pzH2IvdyQ9n/Z9mZh+QiwooVNs40FnKbZHtBgobjZnGBvxXiBeKOUfqmp1VwUE
+UVwevw1Rgpq36YUc/WkTIvtomfRi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-w-config-18.model.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-w-config-18.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pc-w-config-18.model.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pc-w-config-18.model.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,12 @@
+{
+    "type": "model",
+    "series": "16",
+    "brand-id": "developer1",
+    "model": "my-model-w-config-18",
+    "architecture": "amd64",
+    "base": "core18",
+    "gadget": "pc=18",
+    "kernel": "pc-kernel=18",
+    "required-snaps": ["test-snapd-with-configure-core18"],
+    "timestamp": "2019-11-26T09:42:00+00:00"
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pi-20.model.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-pi-20.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pi-20.model.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pi-20.model.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+{
+    "type": "model",
+    "authority-id": "developer1",
+    "series": "16",
+    "brand-id": "developer1",
+    "model": "test-snapd-core-20-pi-arm64",
+    "architecture": "arm64",
+    "timestamp": "2018-09-11T22:00:00+00:00",
+    "grade": "dangerous",
+    "base": "core20",
+    "snaps": [
+        {
+            "default-channel": "20/edge",
+            "id": "YbGa9O3dAXl88YLI6Y1bGG74pwBxZyKg",
+            "name": "pi",
+            "type": "gadget"
+        }, {
+            "default-channel": "20/edge",
+            "id": "jeIuP6tfFrvAdic8DMWqHmoaoukAPNbJ",
+            "name": "pi-kernel",
+            "type": "kernel"
+        }, {
+            "default-channel": "latest/stable",
+            "id": "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q",
+            "name": "core20",
+            "type": "base"
+        }, {
+            "default-channel": "latest/stable",
+            "id": "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4",
+            "name": "snapd",
+            "type": "snapd"
+        }
+    ]
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pi-uc20.model.json snapd-2.48.3+20.04/tests/lib/assertions/developer1-pi-uc20.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/developer1-pi-uc20.model.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/developer1-pi-uc20.model.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,34 +0,0 @@
-{
-    "type": "model",
-    "authority-id": "developer1",
-    "series": "16",
-    "brand-id": "developer1",
-    "model": "test-snapd-core-20-pi-arm64",
-    "architecture": "arm64",
-    "timestamp": "2018-09-11T22:00:00+00:00",
-    "grade": "dangerous",
-    "base": "core20",
-    "snaps": [
-        {
-            "default-channel": "20/edge",
-            "id": "YbGa9O3dAXl88YLI6Y1bGG74pwBxZyKg",
-            "name": "pi",
-            "type": "gadget"
-        }, {
-            "default-channel": "20/edge",
-            "id": "jeIuP6tfFrvAdic8DMWqHmoaoukAPNbJ",
-            "name": "pi-kernel",
-            "type": "kernel"
-        }, {
-            "default-channel": "latest/stable",
-            "id": "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q",
-            "name": "core20",
-            "type": "base"
-        }, {
-            "default-channel": "latest/stable",
-            "id": "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4",
-            "name": "snapd",
-            "type": "snapd"
-        }
-    ]
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/nested-18-amd64.model snapd-2.48.3+20.04/tests/lib/assertions/nested-18-amd64.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/nested-18-amd64.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/nested-18-amd64.model	2021-02-02 08:21:12.000000000 +0000
@@ -1,22 +1,24 @@
 type: model
-authority-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
+authority-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
 series: 16
-brand-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
+brand-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
 model: pc
 architecture: amd64
 base: core18
 gadget: pc=18
 kernel: pc-kernel=18
-timestamp: 2019-05-16T18:06:04+00:00
-sign-key-sha3-384: 0u-IKZyVlTxwiBVOv7oT1FNKdfkKJyOSwbEWJPurlvtaGZxX6VrMHSESnIPeaNMC
+serial-authority:
+  - generic
+timestamp: 2020-11-27T15:30:00Z
+sign-key-sha3-384: x1Tnl94nkgb-rMDs_l63gvgkLYGjXKfpkCCIQZwJ72-LR6X6OrSvNS9z2WS1lAGz
 
-AcLBcwQAAQoAHRYhBMWWVcwwFvQaEaz9YITG74Zv2rilBQJc3blHAAoJEITG74Zv2rildiMP/1aJ
-hXu/kOqDIwatCOgrdRzoesXI2WL4P8cU62wLSITONn4z8TMp4gx5oKnw7HsYEXbNDU2baZBzrUmj
-nB4RHtpnhbBBOUs/tx/lGBAUUr0o8+aOl/UMydVxBy8b/IxHABABAKx2/0cr0THv/0ZKdRvTVQLi
-PZyKDtHqB6l14OwTWUE5tFQf60BwVXE58OEclAAsrtRvWUVDeL774Tpou2TjXhN1SwEdJPVV1I4i
-2fEh3vUZHyuct68W9HODe77XvfRcY5FiEY7G3rd+Xl6DnodCMpjnkPTjcoVgOobny+WGDxtSNxq6
-U4YceYuUguxXfgmGj6QZBvBRdbqVSIfzPif3fe4QvfYeZ1v3paiuuzSPDY5zjd4qbEIwgI/vGm8M
-vuletW5IJlJHBErNmSxd7LCkK1ViSCkblNcMit0CdqWJvl74PpbM/mWY/iMTBtA5N9PqPCKh4WC+
-QDYkdnaSxRuZo4zI3lhmJhmcOaehouj5bN3tmUX4zb8jW09hZyQhCGCL480cjwrdf+MtqKb1r076
-H8S8LM43hGNhoArmerXt25/RG8jGaLhqvxwyf+nKGQFc6ZxVVRIfqHA80bmfKuhzh/544VKirFuS
-duY/wq6YFprCA4ArSFMHG/3hTKNld5uxGSzCkx2BrddmHkKNVLooLAsYgYvuTjM6Q/Q3F/va
+AcLBcwQAAQoAHRYhBJABFPajYkcbyArNXdOZThAVY89JBQJfwRyXAAoJENOZThAVY89JgsMP/jtG
+PAG/vdHrg25TAt8T4SSkSW4YGCeOrzn6xddOifRCiBvuc/aYyI4ZAo0E3C5TKDBeDwIyY5ZOuhY0
+C7UNB4xFhJXkmqvkkEg17sOdK9akYijQ0Kb/Kj12KS0xE/8bxkTTbTKiuxxgQZIFB6HpBwU6hYl5
+C6brdurJ+WUsXPUz60NFM6fLirL27i4EOT9iwrdrqFTIKX6tfTZ3j4oWzTdM8OrLA+FkiUFzpxel
+3oWGJY2L7ntaFCsaYFTni1oNY5jzSw0xId2twokf4R/n3hqQ6RNA0AkQTVZmEPW9+rszrC+nvLu+
+cQviyhapcp3URZ8E3lFwOognERXOVlebp/0zf6q4Kg/FO/2rBpcu1jGwpo8LdBbL2SOx09uSR0fs
+Xpzxk0zul6aVnfC0jB3Jvw5CZPspaxwvtYPVwtMNyXweOYB/0A8NTKhPxNiFhTrXIqW4+Bfa/gLl
+2SYkuC6eBcH+na/ENEtBJUVdDvgrVqYXSQOwAwoDhmjM/IBd7xTQZZ9fAHCMjDDpRL8Egq+GMymT
+MQ5WowvUebQ9CZWguURaxpzdkiMdcyT7tKUzsLTL+kQeEffvWnLdsshqNfpJo+2m+Z5+kuizlTQ3
+rtIiuPLGm9JKbJPSg0GLX4CizW4K+/Kg9L1DYDQOIErWk5UY21b3f7YYPjx115O7E6JROR06
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/nested-18-amd64.model.json snapd-2.48.3+20.04/tests/lib/assertions/nested-18-amd64.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/nested-18-amd64.model.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/nested-18-amd64.model.json	2021-02-02 08:21:12.000000000 +0000
@@ -1,12 +1,13 @@
 {
     "type": "model",
-    "authority-id": "BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz",
+    "authority-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
     "series": "16",
-    "brand-id": "BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz",
+    "brand-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
     "model": "pc",
     "architecture": "amd64",
     "gadget": "pc=18",
     "base": "core18",
     "kernel": "pc-kernel=18",
-    "timestamp": "2019-05-16T18:06:04+00:00"
-}
\ No newline at end of file
+    "serial-authority": ["generic"],
+    "timestamp": "2020-11-27T15:30:00Z"
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/nested-20-amd64.model snapd-2.48.3+20.04/tests/lib/assertions/nested-20-amd64.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/nested-20-amd64.model	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/nested-20-amd64.model	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,13 @@
 type: model
-authority-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
+authority-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
 series: 16
-brand-id: BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz
+brand-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
 model: pc
 architecture: amd64
 base: core20
 grade: dangerous
+serial-authority:
+  - generic
 snaps:
   -
     default-channel: 20/edge
@@ -27,16 +29,16 @@
     id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
     name: snapd
     type: snapd
-timestamp: 2019-05-16T18:06:04+00:00
-sign-key-sha3-384: 0u-IKZyVlTxwiBVOv7oT1FNKdfkKJyOSwbEWJPurlvtaGZxX6VrMHSESnIPeaNMC
+timestamp: 2020-11-27T15:30:00Z
+sign-key-sha3-384: x1Tnl94nkgb-rMDs_l63gvgkLYGjXKfpkCCIQZwJ72-LR6X6OrSvNS9z2WS1lAGz
 
-AcLBcwQAAQoAHRYhBMWWVcwwFvQaEaz9YITG74Zv2rilBQJecjoSAAoJEITG74Zv2rilrnoQAKGx
-xl13XVBJ1iW1k2W9gLJOakMFL3+xgzJU1rHEdk9b0Rcs7+QXqkodA2D8CAVnUnynHcgEWy6y2/DD
-j3ffOx/w/I7zDQHOM6jEzEPsAjyhJ/Chei/auj1mLV8sVcdxBxgmPmVSiidCbd0GClU5690wiF81
-Maxn1QoiAt4l3unHN7Jke6SZ1p9uL1XnO0lIRL+QXsfkQ34df+EIxvp+AE5zfEG8N3AGjul73Nwo
-iJWX1dFChpcRFcaIBL8ZQoaUGe2HhGrIklQH/EIgIwya4uEop1qSbkF7CIL8yGnkfQKUH03IQa8O
-lE5iZJdRwsKV0Z/SfN2Mw2uLlY1jl6HL4wNO6xLXKUXeyx2h3u104fL+i3e0Bin0ERijhnXqZxtv
-tA10r6mPBGJ+1/znWS8Gyf7pDIghO6pY0uX7YvwEdo2QRdjHWRQnSsq5iFtHopVH0kkVQTWB80Az
-TSEI9y9LMWdUk4dnpGrXffIIgcN9o3bX8t3myvPWZINB+l3RcjCjAEAOAA7FTbwzpdlPO5++hcNY
-LMQR2RI+D8GhclR3IhVzQBRf/7SbkenOV6LPjrD9A35c1+2+RoyA/N96QPxV+KJzN3FqDf/TzhTc
-LpHr++yZoMgvfmjBH0nlLYPl+P1YUvZA9s9IjjMMcVF5dqSl8BtmlK/Uh7/uYKBSkh9DPqiR
+AcLBcwQAAQoAHRYhBJABFPajYkcbyArNXdOZThAVY89JBQJfwRyeAAoJENOZThAVY89JWx4QAMxA
+XuEJiU2DAAXa1pl6w7tmBDf7kQ8jMVSNKW6DXAV58yBAUh7oUjS67duLwgaQoF9uPj6qPt5kEONU
+s6Mc0DAjQt3bT4KNsfclT/4rN944KNV0m1fDJu7ogZVeGt0xFG8OKV6jVc1SII0A7tkT14rfDeDi
+AfeyRMviXQPOjugr8KAR9dG5eHC5yfC1gcN7q89foEH1/l12LQBcyb9GDsNq3Z3mCUMG4l2IrzYy
+vAe49QyaagPBMNmPAx+zdRZQd4YX9xhQqwQeYZwsJWGZWx9omWF41EKYMiD1InJwOtTpYDJvCmRc
+hkriaBdI3WIL9u39Mm1+ZfZ/BY2RftxBMFOUDJwfzts7Z6ceUsPUXwDa2QiI7mxHMI4luLIUDb0w
+Y0pGJR47ZDSrx8ehdpXxYjoNYwRIjwhpzIAUR2tklwFs9gwroq4TOUlx3fBEipAu2QLaVZx9JjTA
+oP6oiQ9vX6pw0hsEqsR8PECO+9cjxymr0vslGkucNvcnp16v0ili6oUTkaXDmrtiBjgGLLXXkHJF
+jD5ln5TCSqWMbWupqHUa6fxOaBnFlSDMwid3UDxkjAoOaO7McrxYgGYb5miqP4fE4+hZVmP7OVu1
+uzSE7tBqCqXHyUUNcy8d4gN0AlLW+H1EtYD+/PEoODt6FPczIwKrj+DwXOhG+zLmDf992I3J
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/nested-20-amd64.model.json snapd-2.48.3+20.04/tests/lib/assertions/nested-20-amd64.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/nested-20-amd64.model.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/nested-20-amd64.model.json	2021-02-02 08:21:12.000000000 +0000
@@ -1,17 +1,18 @@
 {
     "type": "model",
-    "authority-id": "BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz",
+    "authority-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
     "series": "16",
-    "brand-id": "BhgbYoDtThegqVkEU7oiZP8GQwCoUIxz",
+    "brand-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
     "model": "pc",
     "architecture": "amd64",
     "base": "core20",
     "grade": "dangerous",
-    "timestamp": "2019-05-16T18:06:04+00:00",
+    "serial-authority": ["generic"],
+    "timestamp": "2020-11-27T15:30:00Z",
     "snaps": [
         {"default-channel": "20/edge", "id": "UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH", "name": "pc", "type": "gadget"},
         {"default-channel": "latest/edge", "id": "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q", "name": "core20", "type": "base"},
         {"default-channel": "20/edge", "id": "pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza", "name": "pc-kernel", "type": "kernel"},
         {"default-channel": "latest/edge", "id": "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4", "name": "snapd", "type": "snapd"}
     ]
-}
\ No newline at end of file
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/pc-18-amd64-accept-generic.model snapd-2.48.3+20.04/tests/lib/assertions/pc-18-amd64-accept-generic.model
--- snapd-2.45.1+20.04.2/tests/lib/assertions/pc-18-amd64-accept-generic.model	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/pc-18-amd64-accept-generic.model	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,24 @@
+type: model
+authority-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
+series: 16
+brand-id: CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez
+model: pc-18-amd64-accept-generic
+architecture: amd64
+base: core18
+gadget: pc=18
+kernel: pc-kernel=18
+serial-authority:
+  - generic
+timestamp: 2020-05-11T19:09:35Z
+sign-key-sha3-384: x1Tnl94nkgb-rMDs_l63gvgkLYGjXKfpkCCIQZwJ72-LR6X6OrSvNS9z2WS1lAGz
+
+AcLBcwQAAQoAHRYhBJABFPajYkcbyArNXdOZThAVY89JBQJeuaPJAAoJENOZThAVY89JtoAP/1Ao
+4Vr/ZLkJUCDAwLdQPMFsV70juYK3Iam9Ug5pSsVHAqa8RHRJLWzX2QPQnLbWa67gM9g+MJYD5JRZ
+GuaNTuAiKq0GMuqm8h1kUtwerG59+nYyA92+bELbNH39ODpnGJ5FWnsOn9Tto5kpb533REqpJ1xF
+CDSvALj3nLIunVwcrMeW9L8nRD1EUlvU2RO8TW79lvTzBn8FWD7ESzRU/WNfhhvdBYLTFHQ5ntYv
+Wlo9Jiht83CJ5s5fEecJK5qzI7uiffg/IY7QUO/I0eoTvoPbONSEAL4PxHJvJWeBTOrqOsbRfb85
+dKsbjcinLkYOwZp1y1EvP2S1J8FN2Ly7VqvWVAyxEBidIupLiF7OviCrj9rWSvUKTxpM7ZTx1wpY
+s+wTtcDrJNRcjLfSxXupc5TR2/skqtBFVLVf9jow8/LTmXU0vEbA7V/dPq4jDgx6/LL9oVnyUjvG
+ZrMfn79HoYp0ugU39urkVEW8QHO9+2bbX7q5AbK8qu19JD0V8oAlRJ7LJ0eJLwDJdOY5td47e9+w
+EvOu+DYhF40Qgp2lplksmvs83yBNPjrKv7lEv0J6jgadR4shmmX1k8UuTLTK7j2TBnVpvJfBuclB
+pIANyiTMKW/2XiuEyOxSnD3D4FxFy10HN5Ne1OE4geefXYCD4DWuVnyC+YRtaINkogl6RdLL
diff -Nru snapd-2.45.1+20.04.2/tests/lib/assertions/pc-18-amd64-accept-generic.model.json snapd-2.48.3+20.04/tests/lib/assertions/pc-18-amd64-accept-generic.model.json
--- snapd-2.45.1+20.04.2/tests/lib/assertions/pc-18-amd64-accept-generic.model.json	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/assertions/pc-18-amd64-accept-generic.model.json	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,13 @@
+{
+    "type": "model",
+    "authority-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
+    "series": "16",
+    "brand-id": "CA5GLZgNQWPhspDQK63Er46Uxz2SO7ez",
+    "model": "pc-18-amd64-accept-generic",
+    "architecture": "amd64",
+    "gadget": "pc=18",
+    "base": "core18",
+    "kernel": "pc-kernel=18",
+    "serial-authority": ["generic"],
+    "timestamp": "2020-05-11T19:09:35Z"
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/any-python snapd-2.48.3+20.04/tests/lib/bin/any-python
--- snapd-2.45.1+20.04.2/tests/lib/bin/any-python	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/any-python	1970-01-01 00:00:00.000000000 +0000
@@ -1,17 +0,0 @@
-#!/bin/sh
-# Use any-python as interpreter in portable Python scripts.
-# Instead of /usr/bin/env python use /usr/bin/env any-python
-# The preferred choices are: Python 3, Python 2, anything called "python"
-py3="$(command -v python3)"
-py2="$(command -v python2)"
-py_dunno="$(command -v python)"
-if [ -n "$py3" ]; then
-    exec "$py3" "$@"
-elif [ -n "$py2" ]; then
-	exec "$py2" "$@"
-elif [ -n "$py_dunno" ]; then
-	exec "$py_dunno" "$@"
-else
-	echo "cannot find any Python installation" >&2
-	exit 1
-fi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/apt-tool snapd-2.48.3+20.04/tests/lib/bin/apt-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/apt-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/apt-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,36 +0,0 @@
-#!/usr/bin/python3
-
-import sys
-
-import apt
-
-
-def checkpoint():
-    pkgs = set()
-    cache = apt.Cache()
-    for pkg in cache:
-        if pkg.is_installed:
-            pkgs.add(pkg.name)
-    for name in sorted(pkgs):
-        print(name)
-
-
-def restore(fname):
-    desired = set([line.strip() for line in open(fname)])
-            
-    cache = apt.Cache()
-    for pkg in cache:
-        if pkg.is_installed and not pkg.name in desired:
-            print("removing", pkg)
-            pkg.mark_delete(auto_fix=False)
-        if not pkg.is_installed and pkg.name in desired:
-            print("installing", pkg)
-            pkg.mark_install(auto_fix=False, auto_install=False)
-    cache.commit()
-
-
-if __name__ == "__main__":
-    if sys.argv[1] == "checkpoint":
-        checkpoint()
-    elif sys.argv[1] == "restore":
-        restore(sys.argv[2])
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/lxd-tool snapd-2.48.3+20.04/tests/lib/bin/lxd-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/lxd-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/lxd-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,35 +0,0 @@
-#!/bin/sh -e
-case "${1:-}" in
-    undo-lxd-mount-changes)
-        # Vanilla systems have /sys/fs/cgroup/cpuset without clone_children option.
-        # Using LXD to create a container enables this option, as can be seen here:
-        #
-        # -37 32 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:15 - cgroup cgroup rw,cpuset
-        # +37 32 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:15 - cgroup cgroup rw,cpuset,clone_children
-        #
-        # To restore vanilla state, disable the option now.
-        if [ "$(mountinfo-tool /sys/fs/cgroup/cpuset .fs_type)" = cgroup ]; then
-            echo 0 > /sys/fs/cgroup/cpuset/cgroup.clone_children
-        fi
-
-        # Vanilla system have /sys/fs/cgroup/unified mounted with the nsdelegate
-        # option which is available since kernel 4.13 Using LXD to create a
-        # container disables this options, as can be seen here:
-        #
-        # -32 31 0:27 / /sys/fs/cgroup/unified rw,nosuid,nodev,noexec,relatime shared:10 - cgroup2 cgroup rw,nsdelegate
-        # +32 31 0:27 / /sys/fs/cgroup/unified rw,nosuid,nodev,noexec,relatime shared:10 - cgroup2 cgroup rw
-        #
-        # To restore vanilla state, enable the option now, but only if the kernel supports that.
-        # https://lore.kernel.org/patchwork/patch/803265/
-        # https://github.com/systemd/systemd/commit/4095205ecccdfddb822ee8fdc44d11f2ded9be24
-        # The kernel version must be made compatible with the strict version
-        # comparison. I chose to cut at the "-" and take the stuff before it.
-        if [ "$(mountinfo-tool /sys/fs/cgroup/unified .fs_type)" = cgroup2 ] && version-tool --strict "$(uname -r | cut -d- -f 1)" -ge 4.13; then
-            mount -o remount,nsdelegate /sys/fs/cgroup/unified
-        fi
-        ;;
-    *)
-        echo "lxd-tool: unknown command $*" >&2
-        exit 1
-        ;;
-esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/MATCH snapd-2.48.3+20.04/tests/lib/bin/MATCH
--- snapd-2.45.1+20.04.2/tests/lib/bin/MATCH	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/MATCH	1970-01-01 00:00:00.000000000 +0000
@@ -1,8 +0,0 @@
-#!/bin/bash
-# Source spread-funcs.sh which, at runtime, contains the real definition of
-# MATCH and execute it.
-
-# shellcheck source=tests/lib/spread-funcs.sh 
-. "$TESTSLIB/spread-funcs.sh"
-
-MATCH "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/memory-tool snapd-2.48.3+20.04/tests/lib/bin/memory-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/memory-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/memory-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,84 +0,0 @@
-#!/usr/bin/env any-python
-from __future__ import print_function, absolute_import, unicode_literals
-
-import os
-import argparse
-
-
-# Define MYPY as False and use it as a conditional for typing import. Despite
-# this declaration mypy will really treat MYPY as True when type-checking.
-# This is required so that we can import typing on Python 2.x without the
-# typing module installed. For more details see:
-# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
-MYPY = False
-if MYPY:
-    from typing import List, Tuple, Text
-
-
-def invoke(cmd):
-    # type: (List[Text]) -> Tuple[int, int]
-    """
-    invoke invokes command and returns the pair (result, max_rss)
-
-    For normal termination result is >= 0 and conveys the exit code.
-    For abnormal termination result is < 0 and conveys the signal number.
-    """
-    pid = os.fork()
-    if pid == 0:
-        # child
-        os.execvpe(cmd[0], cmd, os.environ)
-        os.exit(127)
-    else:
-        # parent
-        _, wait_status, rusage = os.wait4(pid, 0)
-        if os.WIFEXITED(wait_status):
-            exit_code = os.WEXITSTATUS(wait_status)
-            return exit_code, rusage.ru_maxrss
-        elif os.WIFSIGNALED(wait_status):
-            sig_num = os.WTERMSIG(wait_status)
-            return -sig_num, rusage.ru_maxrss
-        else:
-            raise OSError("unexpected wait status {}".format(wait_status))
-
-
-def _make_parser():
-    # type: () -> argparse.ArgumentParser
-    parser = argparse.ArgumentParser(
-        description="""
-Memory-tool executes COMMAND and stores the maximum size of RSS
-into the specified file. The exit status of COMMAND is preserved.
-"""
-    )
-    parser.add_argument(
-        "-o", dest="output",
-        metavar="RSS-FILE",
-        type=argparse.FileType(mode="w"),
-        help="write maximum RSS size to given file",
-    )
-    parser.add_argument(
-        "cmd", metavar="COMMAND", nargs="...", help="command to execute"
-    )
-    return parser
-
-
-def main():
-    # type: () -> None
-    parser = _make_parser()
-    ns = parser.parse_args()
-    # The command cannot be empty but it is difficult to express in argparse
-    # itself.
-    if len(ns.cmd) == 0:
-        parser.print_usage()
-        parser.exit(0)
-    try:
-        result, max_rss = invoke(ns.cmd)
-        if ns.output is not None:
-            ns.output.write("{}\n".format(max_rss))
-            ns.output.close()
-        raise SystemExit(result)
-    except OSError as exc:
-        raise SystemExit(exc)
-
-
-if __name__ == "__main__":
-    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/mountinfo-tool snapd-2.48.3+20.04/tests/lib/bin/mountinfo-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/mountinfo-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/mountinfo-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,1325 +0,0 @@
-#!/usr/bin/env any-python
-from __future__ import print_function, absolute_import, unicode_literals
-
-from argparse import Action, ArgumentParser, FileType, RawTextHelpFormatter, SUPPRESS
-import re
-import sys
-import unittest
-
-# PY2 is true when we're running under Python 2.x It is used for appropriate
-# return value selection of __str__ and __repr_ methods, which must both
-# return str, not unicode (in Python 2) and str (in Python 3). In both cases
-# the return type annotation is exactly the same, but due to unicode_literals
-# being in effect, and the fact we often use a format string (which is an
-# unicode string in Python 2), we must encode the it to byte string when
-# running under Python 2.
-PY2 = sys.version_info[0] == 2
-
-# Define MYPY as False and use it as a conditional for typing import. Despite
-# this declaration mypy will really treat MYPY as True when type-checking.
-# This is required so that we can import typing on Python 2.x without the
-# typing module installed. For more details see:
-# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
-MYPY = False
-if MYPY:
-    from typing import Any, Dict, List, Text, Tuple, Match, Optional, Union, Sequence
-    from argparse import Namespace
-
-
-class sint(int):
-    """sint is an integer that always renders with sign."""
-
-    def __str__(self):
-        # type: () -> str
-        result = "{:+}".format(int(self))
-        if PY2:
-            return result.encode()
-        return result
-
-    def __repr__(self):
-        # type: () -> str
-        result = "sint({:+})".format(int(self))
-        if PY2:
-            return result.encode()
-        return result
-
-
-class SintTests(unittest.TestCase):
-    def test_smoke(self):
-        # type: () -> None
-        self.assertEqual(sint(1), 1)
-        self.assertEqual(sint(-1), -1)
-        self.assertEqual(hash(sint(1)), hash(1))
-
-    def test_str(self):
-        # type: () -> None
-        self.assertEqual("{}".format(sint(1)), "+1")
-        self.assertEqual("{}".format(sint(-1)), "-1")
-
-    def test_repor(self):
-        # type: () -> None
-        self.assertEqual("{!r}".format(sint(1)), "sint(+1)")
-        self.assertEqual("{!r}".format(sint(-1)), "sint(-1)")
-
-
-class Device(object):
-    """Device is a device number with major and minor components."""
-
-    def __init__(self, major, minor):
-        # type: (int, int) -> None
-        self.major = major
-        self.minor = minor
-
-    def __hash__(self):
-        # type: () -> int
-        return hash((self.major, self.minor))
-
-    def __eq__(self, other):
-        # type: (object) -> Union[NotImplemented, bool]
-        if not isinstance(other, Device):
-            return NotImplemented
-        return self.major == other.major and self.minor == other.minor
-
-    def __str__(self):
-        # type: () -> str
-        result = "{}:{}".format(self.major, self.minor)
-        if PY2:
-            return result.encode()
-        return result
-
-    def __repr__(self):
-        # type: () -> str
-        result = "Device({}, {})".format(self.major, self.minor)
-        if PY2:
-            return result.encode()
-        return result
-
-    @classmethod
-    def differentiate(cls, a, b):
-        # type: (Device, Device) -> Device
-        return cls(sint(a.major - b.major), sint(a.minor - b.minor))
-
-
-def _format_opt_fields(fields):
-    # type: (List[Text]) -> str
-    """_format_opt_fields returns the special formatting of optional fields."""
-    if len(fields):
-        result = " ".join(fields) + " -"
-    else:
-        result = "-"
-    if PY2:
-        return result.encode()
-    return result
-
-
-def _diff_opt_fields(a, b):
-    # type: (List[Text], List[Text]) -> List[Text]
-    if len(a) != len(b):
-        return a
-    diff = []  # type: List[Text]
-    for elem_a, elem_b in zip(a, b):
-        key_a, value_a = elem_a.split(":", 1)
-        key_b, value_b = elem_b.split(":", 1)
-        if key_a != key_b:
-            return a
-        try:
-            value_a_int = int(value_a)
-            value_b_int = int(value_b)
-        except ValueError:
-            return a
-        diff.append("{}:{}".format(key_a, sint(value_a_int - value_b_int)))
-    return diff
-
-
-class DifferntiateOptionalFieldsTest(unittest.TestCase):
-    def test_ok(self):
-        # type: () -> None
-        a = OptionalFields(["master:6"])
-        b = OptionalFields(["master:5"])
-        aDelta = OptionalFields.differentiate(a, b)
-        self.assertEqual(aDelta, OptionalFields(["master:+1"]))
-
-    def test_ok_many(self):
-        # type: () -> None
-        a = OptionalFields(["master:6", "shared:10"])
-        b = OptionalFields(["master:5", "shared:7"])
-        aDelta = OptionalFields.differentiate(a, b)
-        self.assertEqual(aDelta, OptionalFields(["master:+1", "shared:+3"]))
-
-    def test_different_lengths(self):
-        # type: () -> None
-        a = OptionalFields(["master:6", "shared:2"])
-        b = OptionalFields(["shared:7"])
-        aDelta = OptionalFields.differentiate(a, b)
-        self.assertEqual(aDelta, OptionalFields(["master:6", "shared:2"]))
-
-    def test_different_keys(self):
-        # type: () -> None
-        a = OptionalFields(["master:6"])
-        b = OptionalFields(["shared:7"])
-        aDelta = OptionalFields.differentiate(a, b)
-        self.assertEqual(aDelta, OptionalFields(["master:6"]))
-
-    def test_non_numeric_value(self):
-        # type: () -> None
-        a = OptionalFields(["master:9"])
-        b = OptionalFields(["master:nan"])
-        aDelta = OptionalFields.differentiate(a, b)
-        self.assertEqual(aDelta, OptionalFields(["master:9"]))
-
-
-# OptionalFields is a specialization of List[Text] but because of some Python 2
-# distributions lacking the typing module, we must define a variant for mypy
-# and one for without mypy. In both cases the customized formatting logic is
-# implemented by _format_opt_fields().
-if MYPY:
-
-    class OptionalFields(List[Text]):
-        def __str__(self):
-            # type: () -> str
-            return _format_opt_fields(self)
-
-        @classmethod
-        def differentiate(cls, a, b):
-            # type: (OptionalFields, OptionalFields) -> OptionalFields
-            return cls(_diff_opt_fields(a, b))
-
-
-else:
-
-    class OptionalFields(list):
-        def __str__(self):
-            # type: () -> str
-            return _format_opt_fields(self)
-
-        @classmethod
-        def differentiate(cls, a, b):
-            # type: (OptionalFields, OptionalFields) -> OptionalFields
-            return cls(_diff_opt_fields(a, b))
-
-
-class OptionalFieldsTests(unittest.TestCase):
-    def test_str(self):
-        # type: () -> None
-        fields = OptionalFields()
-        self.assertEqual("{}".format(fields), "-")
-        fields.append("master:123")
-        self.assertEqual("{}".format(fields), "master:123 -")
-
-
-class MountInfoEntry(object):
-    """Single entry in /proc/pid/mointinfo, see proc(5)"""
-
-    known_attrs = {
-        "mount_id": int,
-        "parent_id": int,
-        "dev": Device,
-        "root_dir": str,
-        "mount_point": str,
-        "mount_opts": str,
-        "opt_fields": list,
-        "fs_type": str,
-        "mount_source": str,
-        "sb_opts": str,
-    }
-
-    def __init__(self):
-        # type: () -> None
-        self.mount_id = 0
-        self.parent_id = 0
-        self.dev = Device(0, 0)
-        self.root_dir = ""
-        self.mount_point = ""
-        self.mount_opts = ""
-        self.opt_fields = OptionalFields()  # type: OptionalFields
-        self.fs_type = ""
-        self.mount_source = ""
-        self.sb_opts = ""
-        # Attributes beyond this line do not represent kernel state.
-        # Marker for an entry being matched by a filter.
-        self.matched = False
-
-    @classmethod
-    def differentiate(cls, a, b):
-        # type: (MountInfoEntry, MountInfoEntry) -> MountInfoEntry
-        diff = MountInfoEntry()
-        diff.matched = a.matched
-        # Diff all the attributes that it makes sense to diff
-        diff.mount_id = sint(a.mount_id - b.mount_id)
-        diff.parent_id = sint(a.parent_id - b.parent_id)
-        diff.dev = Device.differentiate(a.dev, b.dev)
-        diff.root_dir = a.root_dir
-        diff.mount_point = a.mount_point
-        diff.mount_opts = a.mount_opts
-        diff.opt_fields = OptionalFields.differentiate(a.opt_fields, b.opt_fields)
-        diff.fs_type = a.fs_type
-        diff.mount_source = a.mount_source
-        diff.sb_opts = a.sb_opts
-        return diff
-
-    def __eq__(self, other):
-        # type: (object) -> Union[NotImplemented, bool]
-        if not isinstance(other, MountInfoEntry):
-            return NotImplemented
-        return (
-            self.mount_id == other.mount_id
-            and self.parent_id == other.parent_id
-            and self.dev == other.dev
-            and self.root_dir == other.root_dir
-            and self.mount_point == other.mount_point
-            and self.mount_opts == other.mount_opts
-            and self.opt_fields == other.opt_fields
-            and self.fs_type == other.fs_type
-            and self.mount_source == other.mount_source
-            and self.sb_opts == other.sb_opts
-        )
-
-    @classmethod
-    def parse(cls, line):
-        # type: (Text) -> MountInfoEntry
-        it = iter(line.split())
-        self = cls()
-        self.mount_id = int(next(it))
-        self.parent_id = int(next(it))
-        dev_maj, dev_min = map(int, next(it).split(":"))
-        self.dev = Device(dev_maj, dev_min)
-        self.root_dir = next(it)
-        self.mount_point = next(it)
-        self.mount_opts = next(it)
-        self.opt_fields = OptionalFields()
-        for opt_field in it:
-            if opt_field == "-":
-                break
-            self.opt_fields.append(opt_field)
-        self.fs_type = next(it)
-        self.mount_source = next(it)
-        self.sb_opts = next(it)
-        try:
-            next(it)
-        except StopIteration:
-            pass
-        else:
-            raise ValueError("leftovers after parsing {!r}".format(line))
-        return self
-
-    def __str__(self):
-        # type: () -> str
-        result = (
-            "{0.mount_id} {0.parent_id} {0.dev} {0.root_dir}"
-            " {0.mount_point} {0.mount_opts} {0.opt_fields} {0.fs_type}"
-            " {0.mount_source} {0.sb_opts}"
-        ).format(self)
-        if PY2:
-            return result.encode()
-        return result
-
-    def __repr__(self):
-        # type: () -> str
-        result = "MountInfoEntry.parse({!r})".format(str(self))
-        if PY2:
-            return result.encode()
-        return result
-
-    @property
-    def dev_maj(self):
-        # type: () -> int
-        return self.dev.major
-
-    @property
-    def dev_min(self):
-        # type: () -> int
-        return self.dev.minor
-
-
-class FilterExpr(object):
-    """FilterExpr is the interface for filtering mount entries."""
-
-    def __contains__(self, entry):
-        # type: (MountInfoEntry) -> bool
-        """__contains__ returns true if a mount entry matches the filter."""
-
-
-class AttrFilter(FilterExpr):
-    """AttrFilter performs equality test against a given attribute."""
-
-    def __init__(self, attr, value):
-        # type: (Text, Any) -> None
-        self.attr = attr
-        self.value = value
-
-    def __contains__(self, entry):
-        # type: (MountInfoEntry) -> bool
-        value = getattr(entry, self.attr)
-        return bool(value == self.value)
-
-
-class AttrPrefixFilter(FilterExpr):
-    """AttrPrefixFilter performs prefix test against a given attribute."""
-
-    def __init__(self, attr, value):
-        # type: (Text, Text) -> None
-        self.attr = attr
-        self.value = value
-
-    def __contains__(self, entry):
-        # type: (MountInfoEntry) -> bool
-        value = str(getattr(entry, self.attr))
-        return value.startswith(self.value)
-
-
-def parse_filter(expr):
-    # type: (Text) -> FilterExpr
-    """parse_filter parses one of the known filter expressions."""
-    if "=" in expr:
-        # Accept both .attr=value and attr=value as exact attribute match.
-        if expr.startswith("."):
-            expr = expr.lstrip(".")
-        attr, value = expr.split("=", 1)
-        try:
-            typ = MountInfoEntry.known_attrs[attr]
-        except KeyError:
-            raise ValueError("invalid filter expression {!r}".format(expr))
-        else:
-            return AttrFilter(attr, typ(value))
-    elif expr.endswith("..."):
-        # Treat /path/... as prefix match on mount_point.
-        return AttrPrefixFilter("mount_point", expr.rstrip("..."))
-    else:
-        # Treat /path as exact match on mount_point.
-        return AttrFilter("mount_point", expr)
-
-
-def parse_attr(expr):
-    # type: (Text) -> Text
-    """parse_attr parses attribute references (for display)."""
-    known = sorted(MountInfoEntry.known_attrs)
-    if expr.lstrip(".") in known:
-        return expr.lstrip(".")
-    raise ValueError(
-        "invalid attribute selector {!r}" " (known: {})".format(expr, known)
-    )
-
-
-def parse_exprs(exprs):
-    # type: (List[Text]) -> Tuple[List[FilterExpr], List[Text]]
-    """parse_exprs parses filter expressions and attribute references."""
-    # Filters are either .attr=value, /path, /path...
-    filters = [
-        parse_filter(expr) for expr in exprs if "=" in expr or not expr.startswith(".")
-    ]
-    # Attributes are always .attr
-    attrs = [
-        parse_attr(expr) for expr in exprs if expr.startswith(".") and "=" not in expr
-    ]
-    return filters, attrs
-
-
-def matches(entry, filters):
-    # type: (MountInfoEntry, List[FilterExpr]) -> bool
-    """
-    matches checks if a mount entry matches a list of filter expressions.
-    Filter expressions are ANDed together.
-    """
-    for f in filters:
-        if entry not in f:
-            return False
-    return True
-
-
-def renumber_snap_revision(entry, seen):
-    # type: (MountInfoEntry, Dict[Tuple[Text, Text], int]) -> None
-    """renumber_snap_revisions re-numbers snap revision numbers in paths."""
-
-    def compose_preferred(parts, n):
-        # type: (List[Text], int) -> List[Text]
-        return parts[:3] + ["{}".format(n)] + parts[4:]
-
-    def compose_alternate(parts, n):
-        # type: (List[Text], int) -> List[Text]
-        return parts[:6] + ["{}".format(n)] + parts[7:]
-
-    def compose_hostfs_preferred(parts, n):
-        # type: (List[Text], int) -> List[Text]
-        return parts[:7] + ["{}".format(n)] + parts[8:]
-
-    def compose_hostfs_alternate(parts, n):
-        # type: (List[Text], int) -> List[Text]
-        return parts[:10] + ["{}".format(n)] + parts[11:]
-
-    def compose_writable(parts, n):
-        # type: (List[Text], int) -> List[Text]
-        return parts[:5] + ["{}".format(n)] + parts[6:]
-
-    def compose_hostfs_writable(parts, n):
-        # type: (List[Text], int) -> List[Text]
-        return parts[:9] + ["{}".format(n)] + parts[10:]
-
-    def alloc_n(snap_name, snap_rev):
-        # type: (Text, Text) -> int
-        key = (snap_name, snap_rev)
-        try:
-            return seen[key]
-        except KeyError:
-            n = len([name for (name, rev) in seen if name == snap_name]) + 1
-            seen[key] = n
-            return n
-
-    parts = entry.mount_point.split("/")
-    if len(parts) >= 4 and parts[:2] == ["", "snap"]:
-        snap_name = parts[2]
-        snap_rev = parts[3]
-        compose = compose_preferred
-    elif len(parts) >= 7 and parts[:5] == ["", "var", "lib", "snapd", "snap"]:
-        snap_name = parts[5]
-        snap_rev = parts[6]
-        compose = compose_alternate
-    elif len(parts) >= 6 and parts[:4] == ["", "writable", "system-data", "snap"]:
-        snap_name = parts[4]
-        snap_rev = parts[5]
-        compose = compose_writable
-    elif len(parts) >= 8 and parts[:6] == ["", "var", "lib", "snapd", "hostfs", "snap"]:
-        snap_name = parts[6]
-        snap_rev = parts[7]
-        compose = compose_hostfs_preferred
-    elif len(parts) >= 11 and parts[:9] == [
-        "",
-        "var",
-        "lib",
-        "snapd",
-        "hostfs",
-        "var",
-        "lib",
-        "snapd",
-        "snap",
-    ]:
-        snap_name = parts[9]
-        snap_rev = parts[10]
-        compose = compose_hostfs_alternate
-    elif len(parts) >= 10 and parts[:8] == [
-        "",  # 0
-        "var",  # 1
-        "lib",  # 2
-        "snapd",  # 3
-        "hostfs",  # 4
-        "writable",  # 5
-        "system-data",  # 6
-        "snap",  # 7
-    ]:
-        snap_name = parts[8]
-        snap_rev = parts[9]
-        compose = compose_hostfs_writable
-    else:
-        return
-    n = alloc_n(snap_name, snap_rev)
-    entry.mount_point = "/".join(compose(parts, n))
-
-
-def renumber_opt_fields(entry, seen, base_n):
-    # type: (MountInfoEntry, Dict[int, int], int) -> None
-    """renumber_opt_fields re-numbers peer group in optional fields."""
-
-    def alloc_n(peer_group):
-        # type: (int) -> int
-        key = peer_group
-        try:
-            return seen[key]
-        except KeyError:
-            n = (
-                len({orig for orig, renumbered in seen.items() if renumbered >= base_n})
-                + base_n
-                + 1
-            )
-            seen[key] = n
-            return n
-
-    def fn(m):
-        # type: (Match[Text]) -> Text
-        return "{}".format(alloc_n(int(m.group(1))))
-
-    entry.opt_fields = OptionalFields(
-        [re.sub("(\\d+)", fn, opt) for opt in entry.opt_fields]
-    )
-
-
-def renumber_loop_devices(entry, seen):
-    # type: (MountInfoEntry, Dict[int, int]) -> None
-    """renumber_loop_devices re-numbers loop device numbers."""
-
-    def alloc_n(loop_nr):
-        # type: (int) -> int
-        key = loop_nr
-        try:
-            return seen[key]
-        except KeyError:
-            n = len(seen)
-            seen[key] = n
-            return n
-
-    def fn(m):
-        # type: (Match[Text]) -> Text
-        return "loop{}".format(alloc_n(int(m.group(1))))
-
-    entry.mount_source = re.sub("loop(\\d+)", fn, entry.mount_source)
-
-
-def renumber_mount_ids(entry, seen, base_n):
-    # type: (MountInfoEntry, Dict[int, int], int) -> None
-    """renumber_mount_ids re-numbers mount and parent mount IDs."""
-
-    def alloc_n(mount_id):
-        # type: (int) -> int
-        key = mount_id
-        try:
-            return seen[key]
-        except KeyError:
-            n = (
-                len({orig for orig, renumbered in seen.items() if renumbered >= base_n})
-                + base_n
-            )
-            seen[key] = n
-            return n
-
-    # NOTE: renumber the parent ahead of the mount to get more
-    # expected relationship between them.
-    entry.parent_id = alloc_n(entry.parent_id)
-    entry.mount_id = alloc_n(entry.mount_id)
-
-
-def renumber_devices(entry, seen):
-    # type: (MountInfoEntry, Dict[Device, Device]) -> None
-    """renumber_devices re-numbers major:minor device numbers."""
-
-    def alloc_n(dev):
-        # type: (Device) -> Device
-        key = dev
-        try:
-            return seen[key]
-        except KeyError:
-            # We haven't seen the major:minor pair precisely but perhaps we've
-            # seen the major number already? Check if this major is already
-            # remapped, if so reuse that value. If not just allocate the next
-            # one based on cardinality of the set of major numbers we've seen.
-            major = 0
-            for orig, remapped in seen.items():
-                if orig.major == dev.major:
-                    major = remapped.major
-                    break
-            else:
-                major = len({orig.major for orig in seen})
-            # Allocate the next minor number based on the cardinality of the
-            # set of minor numbers matching the major number.
-            minor = len({orig.minor for orig in seen if orig.major == dev.major})
-            n = Device(major, minor)
-            seen[key] = n
-            return n
-
-    entry.dev = alloc_n(entry.dev)
-
-
-def renumber_ns(entry, seen):
-    # type: (MountInfoEntry, Dict[Tuple[Text, int], int]) -> None
-    """renumber_mount_ns re-numbers mount namespace ID from .root_dir property."""
-
-    def alloc_n(ns_type, ns_id):
-        # type: (Text, int) -> int
-        key = (ns_type, ns_id)
-        try:
-            return seen[key]
-        except KeyError:
-            n = len(seen)
-            seen[key] = n
-            return n
-
-    if entry.fs_type != "nsfs":
-        return
-    match = re.match(r"^([a-z_]+):\[(\d+)\]$", entry.root_dir)
-    if match:
-        ns_type = match.group(1)
-        ns_id = int(match.group(2))
-        entry.root_dir = "{}:[{}]".format(ns_type, alloc_n(ns_type, ns_id))
-
-
-def renumber_mount_option(opt, seen):
-    # type: (Text, Dict[Tuple[Text, Text], int]) -> Text
-    """renumber_mount_option re-numbers various numbers in mount options."""
-
-    def alloc_n(mount_opt_key, mount_opt_value):
-        # type: (Text, Text) -> int
-        key = (mount_opt_key, mount_opt_value)
-        try:
-            return seen[key]
-        except KeyError:
-            n = len(
-                {
-                    opt_value
-                    for opt_key, opt_value in seen.keys()
-                    if opt_key == mount_opt_key
-                }
-            )
-            seen[key] = n
-            return n
-
-    if "=" in opt:
-        mount_opt_key, mount_opt_value = opt.split("=", 1)
-        # size, nr_inode: used by tmpfs
-        # fd, pipe_ino: used by binfmtmisc
-        if mount_opt_key == "size":
-            return "size=VARIABLE"
-        if mount_opt_key in {"nr_inodes", "fd", "pipe_ino"}:
-            return "{}={}".format(
-                mount_opt_key, alloc_n(mount_opt_key, mount_opt_value)
-            )
-    return opt
-
-
-def renumber_mount_opts(entry, seen):
-    # type: (MountInfoEntry, Dict[Tuple[Text, Text], int]) -> None
-    """renumber_mount_opts alters numbers in mount options."""
-    entry.mount_opts = ",".join(
-        renumber_mount_option(opt, seen) for opt in entry.mount_opts.split(",")
-    )
-    entry.sb_opts = ",".join(
-        renumber_mount_option(opt, seen) for opt in entry.sb_opts.split(",")
-    )
-
-
-class RewriteState(object):
-    """RewriteState holds state used in rewriting mount entries."""
-
-    def __init__(self):
-        # type: () -> None
-        self.seen_opt_fields = {}  # type: Dict[int, int]
-        self.seen_loops = {}  # type: Dict[int, int]
-        self.seen_snap_revs = {}  # type: Dict[Tuple[Text, Text], int]
-        self.seen_mount_ids = {}  # type: Dict[int, int]
-        self.seen_devices = {}  # type: Dict[Device, Device]
-        self.seen_ns = {}  # type: Dict[Tuple[Text, int], int]
-        # NOTE: The type of the dictionary key is Tuple[Text, Text] because
-        # while generally "numeric" the values may include suffixes like
-        # "1024k" and it is just  easier to handle this way.
-        self.seen_mount_opts = {}  # type: Dict[Tuple[Text, Text], int]
-
-
-def rewrite_renumber(entries, order, rs, base_n=0):
-    # type: (List[MountInfoEntry], List[int], RewriteState, int) -> None
-    """rewrite_renumber applies all re-numbering helpers to a single entry."""
-    for i in range(len(entries)):
-        entry = entries[order[i]]
-        renumber_mount_ids(entry, rs.seen_mount_ids, base_n)
-        renumber_devices(entry, rs.seen_devices)
-        renumber_snap_revision(entry, rs.seen_snap_revs)
-        renumber_opt_fields(entry, rs.seen_opt_fields, base_n)
-        renumber_loop_devices(entry, rs.seen_loops)
-        renumber_ns(entry, rs.seen_ns)
-        renumber_mount_opts(entry, rs.seen_mount_opts)
-
-
-def rewrite_rename(entries, order, rs):
-    # type: (List[MountInfoEntry], List[int], RewriteState) -> None
-    """rewrite_rename applies all re-naming helpers to a single entry."""
-    # TODO: allocate devices like everything else above.
-    for i in range(len(entries)):
-        entry = entries[order[i]]
-        entry.mount_source = re.sub(
-            "/dev/[sv]d([a-z])", "/dev/sd\\1", entry.mount_source
-        )
-
-
-class _UnitTestAction(Action):
-    def __init__(
-        self,
-        option_strings,
-        dest=SUPPRESS,
-        default=SUPPRESS,
-        help="run program's unit test suite and exit",
-    ):
-        # type: (Text, Text, Text, Text) -> None
-        super(_UnitTestAction, self).__init__(
-            option_strings=option_strings,
-            dest=dest,
-            default=default,
-            nargs="...",
-            help=help,
-        )
-
-    def __call__(self, parser, ns, values, option_string=None):
-        # type: (ArgumentParser, Namespace, Union[str, Sequence[Any], None], Optional[Text]) -> None
-        # We allow the caller to provide the test to invoke by giving
-        # --run-unit-tests a set of arguments.
-        argv = [sys.argv[0]]
-        if isinstance(values, list):
-            argv += values
-        unittest.main(argv=argv)
-        parser.exit()
-
-
-def main():
-    # type: () -> None
-    parser = ArgumentParser(
-        epilog="""
-Expressions are ANDed together and have one of the following forms:
-
-    .ATTR=VALUE     mount entry attribute ATTR is equal to VALUE
-    PATH            mount point is equal to PATH
-    PATH...         mount point starts with PATH
-
-In addition .ATTR syntax can be used to limit display to only certain
-attributes. By default the output is identical to raw mountinfo.
-Known attributes, applicable for both filtering and display.
-
-    mount_point:    path where mount is attached in the file system
-    mount_source:   path of the mounted device or bind-mount origin
-    fs_type:        filesystem type
-    mount_opts:     options applying to the mount point only
-    sb_opts:        options applying to the mounted filesystem
-    opt_fields:     optional fields, used for propagation information
-    mount_id:       mount point identifier
-    parent_id:      identifier of parent mount point
-    dev:            major:minor numbers of the mounted device
-    root_dir:       subtree of the mounted filesystem exposed at mount_point
-
-The exit code indicates if any mount point matched the query.
-    """,
-        formatter_class=RawTextHelpFormatter,
-    )
-    parser.register("action", "unit-test", _UnitTestAction)
-    parser.add_argument("-v", "--version", action="version", version="1.0")
-    parser.add_argument("--run-unit-tests", action="unit-test")
-    parser.add_argument(
-        "-f",
-        metavar="MOUNTINFO",
-        dest="file",
-        type=FileType(),
-        default="/proc/self/mountinfo",
-        help="parse specified mountinfo file",
-    )
-    parser.add_argument(
-        "--ref",
-        dest="refs",
-        metavar="MOUNTINFO",
-        type=FileType(),
-        action="append",
-        default=[],
-        help="refer to another table while rewriting, makes output comparable across namespaces",
-    )
-    parser.add_argument(
-        "--ref-x1000",
-        dest="ref_x1000",
-        action="store_true",
-        default=False,
-        help="start mount point IDs and peer groups at multiple of 1000, once for each ref",
-    )
-    parser.add_argument(
-        "--one", default=False, action="store_true", help="expect exactly one match"
-    )
-    parser.add_argument(
-        "--rewrite-order",
-        metavar="FIELD",
-        action="append",
-        default=[],
-        choices=MountInfoEntry.known_attrs.keys(),
-        help="rewrite entries in the order determined by given fields",
-    )
-    parser.add_argument(
-        "--display-order",
-        metavar="FIELD",
-        action="append",
-        default=[],
-        choices=MountInfoEntry.known_attrs.keys(),
-        help="display entries in the order determined by given fields",
-    )
-    parser.add_argument(
-        "exprs",
-        metavar="EXPRESSION",
-        nargs="*",
-        help="filter or display expression (see below)",
-    )
-    group = parser.add_argument_group("Rewriting rules")
-    group.add_argument(
-        "--renumber",
-        action="store_true",
-        help="Reassign mount IDs, device numbers, snap revisions"
-        " and loopback devices",
-    )
-    group.add_argument(
-        "--rename", action="store_true", help="Reassign block device names"
-    )
-    group.add_argument(
-        "--differential",
-        action="store_true",
-        help="Display numeric values as delta from previous item",
-    )
-    opts = parser.parse_args()
-    try:
-        filters, attrs = parse_exprs(opts.exprs)
-    except ValueError as exc:
-        raise SystemExit(exc)
-    entries = [MountInfoEntry.parse(line) for line in opts.file]
-
-    # Apply entry filtering ahead of any renumbering.
-    num_matched = 0
-    for e in entries:
-        if matches(e, filters):
-            e.matched = True
-            num_matched += 1
-
-    # Build rewrite state based on reference tables. This way the entries
-    # we will display can be correlated to other tables.
-    rs = RewriteState()
-    for i, ref in enumerate(opts.refs):
-        ref_entries = [MountInfoEntry.parse(line) for line in ref]
-        ref_rewrite_order = list(range(len(ref_entries)))
-        if opts.rewrite_order:
-
-            def ref_rewrite_key_fn(i):
-                # type: (int) -> Tuple[Any, ...]
-                return tuple(
-                    getattr(ref_entries[i], field) for field in opts.rewrite_order
-                )
-
-        ref_rewrite_order.sort(key=ref_rewrite_key_fn)
-        if opts.renumber:
-            rewrite_renumber(
-                ref_entries, ref_rewrite_order, rs, 1000 * i if opts.ref_x1000 else 0
-            )
-        if opts.rename:
-            rewrite_rename(ref_entries, ref_rewrite_order, rs)
-
-    # Apply entry renumbering and renaming, perhaps using reordering as well.
-    rewrite_order = list(range(len(entries)))
-    if opts.rewrite_order:
-
-        def rewrite_key_fn(i):
-            # type: (int) -> Tuple[Any, ...]
-            return tuple(getattr(entries[i], field) for field in opts.rewrite_order)
-
-        rewrite_order.sort(key=rewrite_key_fn)
-    if opts.renumber:
-        rewrite_renumber(
-            entries, rewrite_order, rs, 1000 * len(opts.refs) if opts.ref_x1000 else 0
-        )
-    if opts.rename:
-        rewrite_rename(entries, rewrite_order, rs)
-
-    # Apply entry reordering for display.
-    if opts.display_order:
-
-        def display_key_fn(entry):
-            # type: (MountInfoEntry) -> Tuple[Any, ...]
-            return tuple(getattr(entry, field) for field in opts.display_order)
-
-        entries.sort(key=display_key_fn)
-
-    # Display and differentiate
-    prev = None  # type: Optional[MountInfoEntry]
-    for e in entries:
-        if not e.matched:
-            prev = e
-            continue
-        if prev is not None and opts.differential:
-            e_display = MountInfoEntry.differentiate(e, prev)
-        else:
-            e_display = e
-        if attrs:
-            print(*[getattr(e_display, attr) for attr in attrs])
-        else:
-            print(e_display)
-        prev = e
-    if opts.one and num_matched != 1:
-        raise SystemExit(
-            "--one requires exactly one match, found {}".format(num_matched)
-        )
-    # Return with an exit code indicating if anything matched.
-    # This allows mountinfo-tool to be used in scripts.
-    if num_matched == 0:
-        raise SystemExit(1)
-
-
-class MountInfoEntryTests(unittest.TestCase):
-
-    non_zero_values = {
-        "mount_id": 1,
-        "parent_id": 2,
-        "dev": Device(3, 4),
-        "root_dir": "/root-dir",
-        "mount_point": "/mount-point",
-        "mount_opts": "mount-opts",
-        "opt_fields": OptionalFields(["opt:1", "fields:2"]),
-        "fs_type": "fs-type",
-        "mount_source": "mount-source",
-        "sb_opts": "sb-opts",
-    }  # Dict[Text, Any]
-
-    def test_init(self):
-        # type: () -> None
-        e = MountInfoEntry()
-        self.assertEqual(e.mount_id, 0)
-        self.assertEqual(e.parent_id, 0)
-        self.assertEqual(e.dev, Device(0, 0))
-        self.assertEqual(e.root_dir, "")
-        self.assertEqual(e.mount_point, "")
-        self.assertEqual(e.mount_opts, "")
-        self.assertEqual(e.opt_fields, [])
-        self.assertEqual(e.fs_type, "")
-        self.assertEqual(e.mount_source, "")
-        self.assertEqual(e.sb_opts, "")
-
-    def test_parse(self):
-        # type: () -> None
-        e = MountInfoEntry.parse(
-            "2079 2266 0:3 mnt:[4026532791] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw"
-        )
-        self.assertEqual(e.mount_id, 2079)
-        self.assertEqual(e.parent_id, 2266)
-        self.assertEqual(e.dev, Device(0, 3))
-        self.assertEqual(e.root_dir, "mnt:[4026532791]")
-        self.assertEqual(e.mount_point, "/run/snapd/ns/test-snapd-mountinfo.mnt")
-        self.assertEqual(e.mount_opts, "rw")
-        self.assertEqual(e.opt_fields, [])
-        self.assertEqual(e.fs_type, "nsfs")
-        self.assertEqual(e.mount_source, "nsfs")
-        self.assertEqual(e.sb_opts, "rw")
-
-    def test_eq(self):
-        # type: () -> None
-        e0 = MountInfoEntry()
-        e1 = MountInfoEntry()
-        self.assertEqual(e0, e1)
-        for field, value in self.non_zero_values.items():
-            self.assertEqual(e0, e1)
-            old_value = getattr(e1, field)
-            setattr(e1, field, value)
-            self.assertNotEqual(e0, e1)
-            setattr(e1, field, old_value)
-            self.assertEqual(e0, e1)
-
-    def test_str(self):
-        # type: () -> None
-        e = MountInfoEntry()
-        for field, value in self.non_zero_values.items():
-            setattr(e, field, value)
-        self.assertEqual(
-            str(e),
-            "1 2 3:4 /root-dir /mount-point mount-opts opt:1 fields:2 - fs-type mount-source sb-opts",
-        )
-
-    def test_repr(self):
-        # type: () -> None
-        e = MountInfoEntry()
-        for field, value in self.non_zero_values.items():
-            setattr(e, field, value)
-        self.assertEqual(
-            repr(e),
-            "MountInfoEntry.parse('1 2 3:4 /root-dir /mount-point mount-opts opt:1 fields:2 - fs-type mount-source sb-opts')",
-        )
-
-    def test_dev_maj_min(self):
-        # type: () -> None
-        e = MountInfoEntry()
-        e.dev = Device(1, 2)
-        self.assertEqual(e.dev_min, 2)
-        self.assertEqual(e.dev_maj, 1)
-
-
-class RenumberSnapRevisionTests(unittest.TestCase):
-    def setUp(self):
-        # type: () -> None
-        self.entry = MountInfoEntry()
-        self.seen = {}  # type: Dict[Tuple[Text, Text], int]
-
-    def test_renumbering_allocation(self):
-        # type: () -> None
-        self.entry.mount_point = "/snap/core/7079"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/snap/core/1")
-
-        self.entry.mount_point = "/snap/core/7080"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/snap/core/2")
-
-        self.entry.mount_point = "/snap/snapd/x1"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/snap/snapd/1")
-
-        self.assertEqual(
-            self.seen, {("core", "7079"): 1, ("core", "7080"): 2, ("snapd", "x1"): 1}
-        )
-
-    def test_preferred(self):
-        # type: () -> None
-        self.entry.mount_point = "/snap/core/7079"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/snap/core/1")
-
-        self.entry.mount_point = "/snap/core/7079/subdir"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/snap/core/1/subdir")
-
-        self.assertEqual(self.seen, {("core", "7079"): 1})
-
-    def test_alternate(self):
-        # type: () -> None
-        self.entry.mount_point = "/var/lib/snapd/snap/core/7079"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/snap/core/1")
-
-        self.entry.mount_point = "/var/lib/snapd/snap/core/7079/subdir"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/snap/core/1/subdir")
-
-        self.assertEqual(self.seen, {("core", "7079"): 1})
-
-    def test_preferred_via_hostfs(self):
-        # type: () -> None
-        self.entry.mount_point = "/var/lib/snapd/hostfs/snap/core/7079"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/hostfs/snap/core/1")
-
-        self.entry.mount_point = "/var/lib/snapd/hostfs/snap/core/7079/subdir"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(
-            self.entry.mount_point, "/var/lib/snapd/hostfs/snap/core/1/subdir"
-        )
-
-        self.assertEqual(self.seen, {("core", "7079"): 1})
-
-    def test_alternate_via_hostfs(self):
-        # type: () -> None
-        self.entry.mount_point = "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/7079"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(
-            self.entry.mount_point, "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/1"
-        )
-
-        self.entry.mount_point = (
-            "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/7079/subdir"
-        )
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(
-            self.entry.mount_point,
-            "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/1/subdir",
-        )
-
-        self.assertEqual(self.seen, {("core", "7079"): 1})
-
-    def test_writable(self):
-        # type: () -> None
-        self.entry.mount_point = "/writable/system-data/snap/core18/1055"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(self.entry.mount_point, "/writable/system-data/snap/core18/1")
-
-        self.entry.mount_point = "/writable/system-data/snap/core18/1055/subdir"
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(
-            self.entry.mount_point, "/writable/system-data/snap/core18/1/subdir"
-        )
-
-        self.assertEqual(self.seen, {("core18", "1055"): 1})
-
-    def test_writable_via_hostfs(self):
-        # type: () -> None
-        self.entry.mount_point = (
-            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1055"
-        )
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(
-            self.entry.mount_point,
-            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1",
-        )
-
-        self.entry.mount_point = (
-            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1055/subdir"
-        )
-        renumber_snap_revision(self.entry, self.seen)
-        self.assertEqual(
-            self.entry.mount_point,
-            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1/subdir",
-        )
-
-        self.assertEqual(self.seen, {("core18", "1055"): 1})
-
-
-class RenumberMountNsTests(unittest.TestCase):
-    def setUp(self):
-        # type: () -> None
-        self.entry = MountInfoEntry()
-        self.entry.fs_type = "nsfs"
-        self.seen = {}  # type: Dict[Tuple[Text, int], int]
-
-    def test_renumbering_allocation(self):
-        # type: () -> None
-        self.entry.root_dir = "mnt:[4026532909]"
-        renumber_ns(self.entry, self.seen)
-        self.assertEqual(self.entry.root_dir, "mnt:[0]")
-
-        self.entry.root_dir = "mnt:[4026532791]"
-        renumber_ns(self.entry, self.seen)
-        self.assertEqual(self.entry.root_dir, "mnt:[1]")
-
-        self.entry.root_dir = "pid:[4026531836]"
-        renumber_ns(self.entry, self.seen)
-        self.assertEqual(self.entry.root_dir, "pid:[2]")
-
-        self.assertEqual(
-            self.seen,
-            {("mnt", 4026532909): 0, ("mnt", 4026532791): 1, ("pid", 4026531836): 2},
-        )
-
-
-class RenumberMountOptionsTests(unittest.TestCase):
-    def setUp(self):
-        # type: () -> None
-        self.seen = {}  # type: Dict[Tuple[Text, Text], int]
-
-    def test_renumber_allocation(self):
-        # type: () -> None
-        """
-        numbers are allocated from subsets matching the key, this reduces delta.
-        """
-        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
-        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
-        self.assertEqual(renumber_mount_option("pipe_ino=200", self.seen), "pipe_ino=1")
-        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
-        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
-        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
-        self.assertEqual(renumber_mount_option("fd=45", self.seen), "fd=1")
-        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
-
-    def test_renumber_size_variable(self):
-        # type: () -> None
-        """
-        size is special-cased and always rewritten to the same value because it is prone to fluctuations
-        """
-        self.assertEqual(renumber_mount_option("size=100", self.seen), "size=VARIABLE")
-        self.assertEqual(renumber_mount_option("size=200", self.seen), "size=VARIABLE")
-
-    def test_renumber_devtmpfs_opts(self):
-        # type: () -> None
-        """
-        certain devtmpfs options are renumbered.
-
-            23 98 0:6 / /dev rw,nosuid shared:21 - devtmpfs devtmpfs rw,size=4057388k,nr_inodes=1014347,mode=755
-
-        Here the size and nr_inodes options are not deterministic and need to
-        be rewritten.  The size quantity is very susceptible to free memory
-        fluctuations and is treated specially.
-        """
-        # Options size= and nr_inodes= are renumbered.
-        self.assertEqual(
-            renumber_mount_option("size=4057388k", self.seen), "size=VARIABLE"
-        )
-        self.assertEqual(
-            renumber_mount_option("nr_inodes=1014347", self.seen), "nr_inodes=0"
-        )
-        # Option mode= is not renumbered.
-        self.assertEqual(renumber_mount_option("mode=755", self.seen), "mode=755")
-        self.assertEqual(self.seen, {("nr_inodes", "1014347"): 0})
-
-    def test_renumber_binfmt_misc_opts(self):
-        # type: () -> None
-        """
-        certain binfmt_misc options are renumbered.
-
-            47 22 0:42 / /proc/sys/fs/binfmt_misc rw,relatime shared:28 - autofs systemd-1 rw,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16610
-
-        Here the fd and pipe_ino options are not deterministic and need to be rewritten.
-        """
-        self.assertEqual(renumber_mount_option("fd=40", self.seen), "fd=0")
-        self.assertEqual(
-            renumber_mount_option("pipe_ino=16610", self.seen), "pipe_ino=0"
-        )
-        self.assertEqual(self.seen, {("fd", "40"): 0, ("pipe_ino", "16610"): 0})
-
-
-class RenumberMountIdsTests(unittest.TestCase):
-    def setUp(self):
-        # type: () -> None
-        self.seen = {}  # type: Dict[int, int]
-
-    def test_smoke(self):
-        # type: () -> None
-        # Renumber the first mount entry, from the "initial" mount namespace,
-        # with the initial, zero multiple.
-        entry = MountInfoEntry()
-        entry.mount_id = 12
-        entry.parent_id = 5
-        renumber_mount_ids(entry, self.seen, 0)
-        self.assertEqual(entry.parent_id, 0)
-        self.assertEqual(entry.mount_id, 1)
-
-        # Renumber another entry, now in a separate mount namespace, with a
-        # different multiplier. The parent ID stays in the < 1000 range.  NOTE:
-        # in reality mount namespaces never share mount IDs but that's fine.
-        # The test just checks the renumber logic.
-        entry = MountInfoEntry()
-        entry.mount_id = 13
-        entry.parent_id = 5
-        renumber_mount_ids(entry, self.seen, 1000)
-        self.assertEqual(entry.parent_id, 0)
-        self.assertEqual(entry.mount_id, 1000)
-
-
-class RenumberOptFieldsTests(unittest.TestCase):
-    def setUp(self):
-        # type: () -> None
-        self.seen = {}  # type: Dict[int, int]
-
-    def test_smoke(self):
-        # type: () -> None
-        # Renumber the first mount entry, from the "initial" mount namespace,
-        # with the initial, zero multiple.
-        entry = MountInfoEntry()
-        entry.opt_fields = OptionalFields(["shared:12"])
-        renumber_opt_fields(entry, self.seen, 0)
-        self.assertEqual(entry.opt_fields, ["shared:1"])
-
-        # Renumber the second entry, now in a separate mount namespace, with a
-        # different multiplier. Given that the peer group number was not seen
-        # before it gets allocated into the 1000-1999 range.
-        entry = MountInfoEntry()
-        entry.opt_fields = OptionalFields(["shared:13"])
-        renumber_opt_fields(entry, self.seen, 1000)
-        self.assertEqual(entry.opt_fields, ["shared:1001"])
-
-        # Renumber the third entry, in the same mount namespace as the second
-        # one.  Given that the peer group number was seen in the initial mount
-        # namespace it is renumbered the same was as the original was, even
-        # though the actual sharing mode is different.
-        entry = MountInfoEntry()
-        entry.opt_fields = OptionalFields(["master:12"])
-        renumber_opt_fields(entry, self.seen, 1000)
-        self.assertEqual(entry.opt_fields, ["master:1"])
-
-
-class RewriteTests(unittest.TestCase):
-    def setUp(self):
-        # type: () -> None
-        self.entries = [
-            MountInfoEntry.parse(line)
-            for line in (
-                "2079 2266 0:3 mnt:[4026532791] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw",
-                "23 98 0:6 / /dev rw,nosuid shared:21 - devtmpfs devtmpfs rw,size=4057388k,nr_inodes=1014347,mode=755",
-                "47 22 0:42 / /proc/sys/fs/binfmt_misc rw,relatime shared:28 - autofs systemd-1 rw,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16610",
-            )
-        ]
-        self.order = list(range(len(self.entries)))
-        self.rs = RewriteState()
-
-    def test_rewrite_renumber(self):
-        # type: () -> None
-        rewrite_renumber(self.entries, self.order, self.rs)
-        self.assertEqual(
-            self.entries,
-            [
-                MountInfoEntry.parse(line)
-                for line in (
-                    "1 0 0:0 mnt:[0] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw",
-                    "3 2 0:1 / /dev rw,nosuid shared:1 - devtmpfs devtmpfs rw,size=VARIABLE,nr_inodes=0,mode=755",
-                    "5 4 0:2 / /proc/sys/fs/binfmt_misc rw,relatime shared:2 - autofs systemd-1 rw,fd=0,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=0",
-                )
-            ],
-        )
-
-
-if __name__ == "__main__":
-    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/not snapd-2.48.3+20.04/tests/lib/bin/not
--- snapd-2.45.1+20.04.2/tests/lib/bin/not	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/not	1970-01-01 00:00:00.000000000 +0000
@@ -1,6 +0,0 @@
-#!/bin/sh
-# This script executes whatever is given as argument and inverts the return
-# value. It is meant as a workaround for shellcheck discovery
-# https://github.com/koalaman/shellcheck/wiki/SC2251 where shell scripts using
-# "set -e" are not failing with a trivial code like "! true"
-! "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/REBOOT snapd-2.48.3+20.04/tests/lib/bin/REBOOT
--- snapd-2.45.1+20.04.2/tests/lib/bin/REBOOT	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/REBOOT	1970-01-01 00:00:00.000000000 +0000
@@ -1,8 +0,0 @@
-#!/bin/bash
-# Source spread-funcs.sh which, at runtime, contains the real definition of
-# REBOOT and execute it.
-
-# shellcheck source=tests/lib/spread-funcs.sh 
-. "$TESTSLIB/spread-funcs.sh"
-
-REBOOT "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/retry-tool snapd-2.48.3+20.04/tests/lib/bin/retry-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/retry-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/retry-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,133 +0,0 @@
-#!/usr/bin/env any-python
-from __future__ import print_function, absolute_import, unicode_literals
-
-import argparse
-import itertools
-import subprocess
-import sys
-import time
-
-
-# Define MYPY as False and use it as a conditional for typing import. Despite
-# this declaration mypy will really treat MYPY as True when type-checking.
-# This is required so that we can import typing on Python 2.x without the
-# typing module installed. For more details see:
-# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
-MYPY = False
-if MYPY:
-    from typing import List, Text
-
-
-def _make_parser():
-    # type: () -> argparse.ArgumentParser
-    parser = argparse.ArgumentParser(
-        description="""
-Retry executes COMMAND at most N times, waiting for SECONDS between each
-attempt. On failure the exit code from the final attempt is returned.
-"""
-    )
-    parser.add_argument(
-        "-n",
-        "--attempts",
-        metavar="N",
-        type=int,
-        default=3,
-        help="number of attempts (default %(default)s)",
-    )
-    parser.add_argument(
-        "--wait",
-        metavar="SECONDS",
-        type=float,
-        default=1,
-        help="grace period between attempts (default %(default)ss)",
-    )
-    parser.add_argument(
-        "--maxmins",
-        metavar="MINUTES",
-        type=float,
-        default=0,
-        help="number of minutes after which to give up (no default, if set attempts is ignored)",
-    )
-    parser.add_argument(
-        "--quiet",
-        dest="verbose",
-        action="store_false",
-        default=True,
-        help="refrain from printing any output",
-    )
-    parser.add_argument(
-        "cmd", metavar="COMMAND", nargs="...", help="command to execute"
-    )
-    return parser
-
-
-def run_cmd(cmd, n, wait, maxmins, verbose):
-    # type: (List[Text], int, float, float, bool) -> int
-    if maxmins != 0:
-        attempts = itertools.count(1)
-        t0 = time.time()
-        after = "{} minutes".format(maxmins)
-        of_attempts_suffix = ""
-    else:
-        attempts = range(1, n + 1)
-        after = "{} attempts".format(n)
-        of_attempts_suffix = " of {}".format(n)
-    retcode = 0
-    i = 0
-    for i in attempts:
-        retcode = subprocess.call(cmd)
-        if retcode == 0:
-            return 0
-        if verbose:
-            print(
-                "retry: command {} failed with code {}".format(" ".join(cmd), retcode),
-                file=sys.stderr,
-            )
-        if maxmins != 0:
-            elapsed = (time.time()-t0)/60
-            if elapsed > maxmins:
-                break
-        if i < n or maxmins != 0:
-            if verbose:
-                print(
-                    "retry: next attempt in {} second(s) (attempt {}{})".format(
-                        wait, i, of_attempts_suffix
-                    ),
-                    file=sys.stderr,
-                )
-            time.sleep(wait)
-
-    if verbose and i > 1:
-        print(
-            "retry: command {} keeps failing after {}".format(
-                " ".join(cmd), after
-                ),
-                file=sys.stderr,
-            )
-    return retcode
-
-
-def main():
-    # type: () -> None
-    parser = _make_parser()
-    ns = parser.parse_args()
-    # The command cannot be empty but it is difficult to express in argparse itself.
-    if len(ns.cmd) == 0:
-        parser.print_usage()
-        parser.exit(0)
-    # Return the last exit code as the exit code of this process.
-    try:
-        retcode = run_cmd(ns.cmd, ns.attempts, ns.wait, ns.maxmins, ns.verbose)
-    except OSError as exc:
-        if ns.verbose:
-            print(
-                "retry: cannot execute command {}: {}".format(" ".join(ns.cmd), exc),
-                file=sys.stderr,
-            )
-        raise SystemExit(1)
-    else:
-        raise SystemExit(retcode)
-
-
-if __name__ == "__main__":
-    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/session-tool snapd-2.48.3+20.04/tests/lib/bin/session-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/session-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/session-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,318 +0,0 @@
-#!/bin/bash -e
-if [ $# -eq 0 ]; then
-	echo "usage: session-tool [-u USER] [-p PID_FILE] [--] <CMD>"
-	echo "usage: session-tool --prepare | --restore [-u USER]"
-	echo "usage: session-tool --kill-leaked"
-	echo "usage: session-tool --dump"
-	exit 1
-fi
-if [ "$(id -u)" -ne 0 ]; then
-    echo "session-tool needs to be invoked as root" >&2
-    exit 1
-fi
-if [ -z "$(command -v busctl)" ]; then
-    echo "session-tool requires busctl" >&2
-    exit 1
-fi
-user=root
-pid_file=
-action=
-while [ $# -gt 0 ]; do
-	case "$1" in
-		--)
-			shift
-			break
-			;;
-		-p)
-			if [ $# -eq 1 ]; then
-				echo "session-tool: option -p requires an argument" >&2
-				exit 1
-			fi
-			pid_file="$2"
-			shift 2
-			;;
-		--kill-leaked)
-			action=kill-leaked
-			shift
-			;;
-		--prepare)
-			action=prepare
-			shift
-			;;
-		--restore)
-			action=restore
-			shift
-			;;
-		--dump)
-			action=dump
-			shift
-			;;
-		-u)
-			if [ $# -eq 1 ]; then
-				echo "session-tool: option -u requires an argument" >&2
-				exit 1
-			fi
-			user="$2"
-			shift 2
-			;;
-		-*)
-			echo "session-tool: unsupported argument $1" >&2
-			exit 1
-			;;
-		*)
-			break
-			;;
-	esac
-done
-
-case "$action" in
-	kill-leaked)
-		# Work around a bug in older versions of logind that leak closing session
-		# without a process inhabiting it anymore. In the case we've observed there's a
-		# session that is being closed with a missing process.
-		for session_id in $(loginctl --no-legend | awk '{ print $1 }'); do
-			# It would be easier to use "loginctl show-session --value" but we cannot rely on it.
-			if [ "$(loginctl show-session "$session_id" --property=State | cut -d = -f 2-)" = closing ]; then
-				leader=$(loginctl show-session "$session_id" --property=Leader | cut -d = -f 2-)
-				if [ ! -e "/proc/$leader" ]; then
-					loginctl kill-session "$session_id"
-				fi
-			fi
-		done
-
-		exit 0
-		;;
-	prepare)
-		# Make /var/lib/systemd writable so that we can get linger enabled.
-		# This only applies to Ubuntu Core 16 where individual directories were
-		# writable. In Core 18 and beyod all of /var/lib/systemd is writable.
-		case "$SPREAD_SYSTEM" in
-			ubuntu-core-16-*)
-				mount tmpfs -t tmpfs /var/lib/systemd/
-				mkdir /var/lib/systemd/{catalog,coredump,deb-systemd-helper-enabled,rfkill}
-				touch /var/lib/systemd/random-seed
-				mount --bind /writable/system-data/var/lib/systemd/rfkill /var/lib/systemd/rfkill
-				mount --bind /writable/system-data/var/lib/systemd/random-seed /var/lib/systemd/random-seed
-
-				touch /run/session-tool-core16.workaround
-				;;
-		esac
-
-		# Work around https://github.com/systemd/systemd/issues/12401 fixed
-		# in systemd v243.
-		if systemctl cat systemd-logind.service | not grep -q StateDirectory; then
-			mkdir -p /etc/systemd/system/systemd-logind.service.d
-			(
-				echo "[Service]"
-				echo "StateDirectory=systemd/linger"
-			) > /etc/systemd/system/systemd-logind.service.d/linger.conf
-			mkdir -p /var/lib/systemd/linger
-			test "$(command -v restorecon)" != "" && restorecon /var/lib/systemd/linger
-
-			systemctl daemon-reload
-			systemctl restart systemd-logind.service
-
-			touch /run/session-tool-systemd-issue-12401.workaround
-		fi
-
-		# Enable linger for the selected user.
-		loginctl enable-linger "$user"
-
-		exit 0
-		;;
-	restore)
-		# Disable linger for the selected user.
-		loginctl disable-linger "$user"
-
-		if [ -e /run/session-tool-core16.workaround ]; then
-			rm  /run/session-tool-core16.workaround
-			# Undo changes to make /var/lib/systemd/ writable.
-			umount -l /var/lib/systemd
-		fi
-
-		if [ -e /run/session-tool-systemd-issue-12401.workaround ]; then
-			rm  /run/session-tool-systemd-issue-12401.workaround
-
-			# Remove the logind customizations we (may have) done above.
-			rm -rf /etc/systemd/system/systemd-logind.service.d
-
-			# Reload systemd and restart logind.
-			systemctl daemon-reload
-			systemctl restart systemd-logind.service
-		fi
-
-		exit 0
-		;;
-	dump)
-		echo "Active sessions:"
-		for session_id in $(loginctl list-sessions --no-legend | awk '{ print($1) }'); do
-			echo "Details of session $session_id"
-			loginctl show-session "$session_id"
-		done
-		exit 0
-		;;
-esac
-
-# This fixes a bug in some older Debian systems where /root/.profile contains
-# unconditional invocation of mesg, which on non-tty shells prints "mesg
-# ttyname failed inappropriate ioctl for device" which pollutes output from
-# invoked programs.
-# TODO: move this to spread wide project setup.
-test -f /root/.profile && sed -i -e 's/mesg n .*true/tty -s \&\& mesg n/g' /root/.profile
-
-read -r uuid < /proc/sys/kernel/random/uuid
-unit_name="session-tool-$uuid.service"
-tmp_dir="/tmp/session-tool-$uuid"
-mkdir "$tmp_dir"
-mkfifo -m 0666 "$tmp_dir/dbus-monitor.pipe" "$tmp_dir/ready.pipe" "$tmp_dir/result.pipe" "$tmp_dir/stdin.pipe" "$tmp_dir/stdout.pipe" "$tmp_dir/stderr.pipe"
-trap 'rm -rf $tmp_dir' EXIT
-
-# Run dbus-monitor waiting for systemd JobRemoved signal. Process the output
-# with awk, forwarding the result of the service to a fifo.
-monitor_expr="type='signal', sender='org.freedesktop.systemd1', interface='org.freedesktop.systemd1.Manager', path='/org/freedesktop/systemd1', member='JobRemoved'"
-stdbuf -oL dbus-monitor --system --monitor "$monitor_expr" > "$tmp_dir/dbus-monitor.pipe" &
-dbus_monitor_pid=$!
-
-awk_expr="
-BEGIN {
-	found=0;
-	ready=0;
-}
-
-# Once we get the NameAcquired message we are sure dbus-monitor is connected
-# and will receive JobRemoved once it is sent. The reason we are getting this
-# message despite the filter we establish above is that it is sent directly to
-# us, which bypasses DBus filter expressions.
-/member=NameAcquired/ {
-	if (!ready) {
-		ready=1;
-		print ready > \"$tmp_dir/ready.pipe\";
-		close(\"$tmp_dir/ready.pipe\");
-	}
-}
-
-# This part matches an argument to JobRemoved that contains the name of the
-# session-tool-xxx.service name we picked earlier. Once we see this we are sure
-# the job is gone.
-/   string \"$unit_name\"/ {
-	found=1;
-	print \"found service file\";
-	fflush();
-	next;
-}
-
-# This matches any string argument but only takes effect once we found our
-# JobRemoved message. The order of arguments to JobRemoved is such that the
-# immediate successor of the service name is the result word. This is
-# translated to a pass / fail exit code from session-tool. Scanning this part
-# terminates awk.
-/string \".*\"/ {
-	if (found==1) {
-		print \"found result\";
-		print \$2 > \"$tmp_dir/result.pipe\";
-		fflush(\"\");
-		close(\"$tmp_dir/result.pipe\");
-		exit;
-	}
-}
-"
-awk -W interactive "$awk_expr" <"$tmp_dir/dbus-monitor.pipe" >"$tmp_dir/awk.log" 2>&1 &
-awk_pid=$!
-
-# Wait for dbus-monitor to start.
-cat "$tmp_dir/ready.pipe" >/dev/null
-
-# Use busctl to spawn a command. The command is wrapped in shell, runuser -l
-# and redirects to capture output. Sadly busctl doesn't support passing file
-# descriptors https://github.com/systemd/systemd/issues/14954 As a workaround
-# we pass a set of pipes. This is good for non-interactive work.
-cat >"$tmp_dir/stdin.pipe" &
-cat_stdin_pid=$!
-cat <"$tmp_dir/stdout.pipe" >&1 &
-cat_stdout_pid=$!
-cat <"$tmp_dir/stderr.pipe" >&2 &
-cat_stderr_pid=$!
-
-(
-	echo "#!/bin/sh"
-	test -n "$pid_file" && echo "echo \$$ >\"$pid_file\""
-	printf "exec "
-	for arg in "$@"; do
-		printf '%q ' "$arg"
-	done
-	echo
-)>"$tmp_dir/exec"
-chmod +x "$tmp_dir/exec"
-
-# We want to provide a SELinuxContext but systemd in older SELinux-using distributions
-# does not recognize this attribute. See https://github.com/systemd/systemd/blob/master/NEWS#L6402
-# The typical user context as reported by id -Z is: unconfined_u:unconfined_r:unconfined_t:s0
-selinux_context_arg=
-case $SPREAD_SYSTEM in
-	fedora-*|centos-*)
-		if [ "$(systemctl --version | head -n 1 | awk '{ print $2 }')" -gt 219 ]; then
-			selinux_context_arg="SELinuxContext s unconfined_u:unconfined_r:unconfined_t:s0"
-		fi
-		;;
-esac
-
-# NOTE: This shellcheck directive is for the $selinux_context_arg expansion below.
-# shellcheck disable=SC2086
-busctl \
-	--allow-interactive-authorization=no --quiet \
-	--system \
-	-- \
-	call \
-	 org.freedesktop.systemd1 \
-	/org/freedesktop/systemd1 \
-	 org.freedesktop.systemd1.Manager \
-	StartTransientUnit "ssa(sv)a(sa(sv))" \
-	"$unit_name" fail $(( 4 + $(test -n "$selinux_context_arg" && echo 1 || echo 0))) \
-		Description s "session-tool running $* as $user" \
-		Type s oneshot \
-		Environment as 1 TERM=xterm-256color \
-		$selinux_context_arg \
-		ExecStart "a(sasb)" 1 \
-			"$(command -v runuser)" 6 "$(command -v runuser)" -l "$user" - -c "exec $tmp_dir/exec <$tmp_dir/stdin.pipe >$tmp_dir/stdout.pipe 2>$tmp_dir/stderr.pipe" false \
-	0
-# This is done so that we can configure file redirects. Once Ubuntu 16.04 is no
-# longer supported we can use Standard{Input,Output,Error}=file:path property
-# of systemd, or perhaps even StandardInputFileDescriptor and pass a file
-# descriptor to the FIFOs we open in the script above.
-
-# Wait for the service to terminate. The trigger is a successful read
-# from the result FIFO. In case we are signaled in one of the familiar
-# ways, kill the started service with the same signal. The reading occurs
-# in a loop as the signal will first interrupt the read process, which will
-# fail and return nothing.
-trap 'systemctl kill --signal=INT $unit_name' INT
-trap 'systemctl kill --signal=TERM $unit_name' TERM
-trap 'systemctl kill --signal=QUIT $unit_name' QUIT
-result=""
-for sig in INT TERM QUIT; do
-	result=$(cat "$tmp_dir/result.pipe" 2>/dev/null) && break
-	trap - "$sig"
-done
-trap - INT TERM QUIT
-
-# Kill dbus-monitor that otherwise runs until it notices the pipe is no longer
-# connected, which happens after a longer while.
-kill $dbus_monitor_pid || true
-wait $dbus_monitor_pid 2>/dev/null || true
-wait $awk_pid
-
-wait "$cat_stdin_pid"
-wait "$cat_stdout_pid"
-wait "$cat_stderr_pid"
-
-# Prevent accumulation of failed sessions.
-
-if [ "$result" != '"done"' ]; then
-	systemctl reset-failed "$unit_name"
-fi
-
-case "$result" in
-	'"done"') exit 0; ;;
-	'"failed"') exit 1; ;;
-	'"canceled"') exit 1; ;;
-esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/snap-tool snapd-2.48.3+20.04/tests/lib/bin/snap-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/snap-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/snap-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,19 +0,0 @@
-#!/bin/sh
-
-# shellcheck source=tests/lib/dirs.sh
-. "$TESTSLIB/dirs.sh"
-
-case "${1:-}" in
-	'')
-		echo "usage: snap-tool <tool> [ARGS]"
-		echo
-		echo "The snap-tool program simplifies running internal tools"
-		echo "like snap-discard-ns, which are not on PATH and whose"
-		echo "location varies from one distribution to another"
-		;;
-	*)
-		tool="$1"
-		shift
-		exec "$LIBEXECDIR/snapd/$tool" "$@"
-		;;
-esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/user-tool snapd-2.48.3+20.04/tests/lib/bin/user-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/user-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/user-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,55 +0,0 @@
-#!/usr/bin/env any-python
-from __future__ import print_function, absolute_import, unicode_literals
-
-import argparse
-import os
-import subprocess
-
-# Define MYPY as False and use it as a conditional for typing import. Despite
-# this declaration mypy will really treat MYPY as True when type-checking.
-# This is required so that we can import typing on Python 2.x without the
-# typing module installed. For more details see:
-# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
-MYPY = False
-if MYPY:
-    from typing import Text
-
-
-def remove_user_with_group(user_name):
-    # type: (Text) -> None
-    """remove the user and group with the same name, if present."""
-    if os.path.exists("/var/lib/extrausers/passwd"):
-        subprocess.call(["userdel", "--extrausers", "--force", "--remove", user_name])
-    else:
-        subprocess.call(["userdel", "--force", "--remove", user_name])
-        # Some systems do not set "USERGROUPS_ENAB yes" so we need to cleanup
-        # the group manually. Use "-f" (force) when available, older versions
-        # do not have it.
-        proc = subprocess.Popen(["groupdel", "-h"], stdout=subprocess.PIPE)
-        out, _ = proc.communicate()
-        if b"force" in out:
-            subprocess.call(["groupdel", "-f", user_name])
-        else:
-            subprocess.call(["groupdel", user_name])
-    # Ensure the user user really got deleted
-    if subprocess.call(["getent", "passwd", user_name]) == 0:
-        raise SystemExit("user exists after removal?")
-    if subprocess.call(["getent", "group", user_name]) == 0:
-        raise SystemExit("group exists after removal?")
-
-
-def main():
-    # type: () -> None
-    parser = argparse.ArgumentParser()
-    sub = parser.add_subparsers()
-    cmd = sub.add_parser(
-        "remove-with-group", description="Remove system user and group, if present"
-    )
-    cmd.set_defaults(func=lambda ns: remove_user_with_group(ns.user))
-    cmd.add_argument("user", help="name of the user and group to remove")
-    ns = parser.parse_args()
-    ns.func(ns)
-
-
-if __name__ == "__main__":
-    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/bin/version-tool snapd-2.48.3+20.04/tests/lib/bin/version-tool
--- snapd-2.45.1+20.04.2/tests/lib/bin/version-tool	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/bin/version-tool	1970-01-01 00:00:00.000000000 +0000
@@ -1,308 +0,0 @@
-#!/usr/bin/env any-python
-from __future__ import print_function, absolute_import, unicode_literals
-
-from argparse import Action, ArgumentParser, RawTextHelpFormatter, SUPPRESS
-import itertools
-import re
-import sys
-import sys
-import unittest
-
-# PY2 is true when we're running under Python 2.x It is used for appropriate
-# return value selection of __str__ and __repr_ methods, which must both
-# return str, not unicode (in Python 2) and str (in Python 3). In both cases
-# the return type annotation is exactly the same, but due to unicode_literals
-# being in effect, and the fact we often use a format string (which is an
-# unicode string in Python 2), we must encode the it to byte string when
-# running under Python 2.
-PY2 = sys.version_info[0] == 2
-
-# Define MYPY as False and use it as a conditional for typing import. Despite
-# this declaration mypy will really treat MYPY as True when type-checking.
-# This is required so that we can import typing on Python 2.x without the
-# typing module installed. For more details see:
-# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
-MYPY = False
-if MYPY:
-    from typing import Any, Text, Tuple, Optional, Union, Sequence
-    from argparse import Namespace
-
-
-class _UnitTestAction(Action):
-    def __init__(
-        self,
-        option_strings,
-        dest=SUPPRESS,
-        default=SUPPRESS,
-        help="run program's unit test suite and exit",
-    ):
-        # type: (Text, Text, Text, Text) -> None
-        super(_UnitTestAction, self).__init__(
-            option_strings=option_strings,
-            dest=dest,
-            default=default,
-            nargs="...",
-            help=help,
-        )
-
-    def __call__(self, parser, ns, values, option_string=None):
-        # type: (ArgumentParser, Namespace, Union[str, Sequence[Any], None], Optional[Text]) -> None
-        # We allow the caller to provide the test to invoke by giving
-        # --run-unit-tests a set of arguments.
-        argv = [sys.argv[0]]
-        if isinstance(values, list):
-            argv += values
-        unittest.main(argv=argv)
-        parser.exit()
-
-
-def consistent_relation(rel_op, delta):
-    # type: (Text, int) -> bool
-    """
-    consistent_relation returns true if the relation is consistent with delta.
-
-    The relation operator is one of ==, !=, <, <=, > or >=.
-    Delta is either 0, a positive or a negative number.
-    """
-    if rel_op == "==":
-        return delta == 0
-    elif rel_op == "!=":
-        return delta != 0
-    elif rel_op == ">":
-        return delta > 0
-    elif rel_op == ">=":
-        return delta >= 0
-    elif rel_op == "<":
-        return delta < 0
-    elif rel_op == "<=":
-        return delta <= 0
-    raise ValueError("unexpected relational operator " + rel_op)
-
-
-class ConsistentRelationTests(unittest.TestCase):
-    def test_eq(self):
-        # type: () -> None
-        self.assertFalse(consistent_relation("==", -1))
-        self.assertTrue(consistent_relation("==", 0))
-        self.assertFalse(consistent_relation("==", +1))
-
-    def test_ne(self):
-        # type: () -> None
-        self.assertTrue(consistent_relation("!=", -1))
-        self.assertFalse(consistent_relation("!=", 0))
-        self.assertTrue(consistent_relation("!=", +1))
-
-    def test_gt(self):
-        # type: () -> None
-        self.assertFalse(consistent_relation(">", -1))
-        self.assertFalse(consistent_relation(">", 0))
-        self.assertTrue(consistent_relation(">", +1))
-
-    def test_ge(self):
-        # type: () -> None
-        self.assertFalse(consistent_relation(">=", -1))
-        self.assertTrue(consistent_relation(">=", 0))
-        self.assertTrue(consistent_relation(">=", +1))
-
-    def test_lt(self):
-        # type: () -> None
-        self.assertTrue(consistent_relation("<", -1))
-        self.assertFalse(consistent_relation("<", 0))
-        self.assertFalse(consistent_relation("<", +1))
-
-    def test_le(self):
-        # type: () -> None
-        self.assertTrue(consistent_relation("<=", -1))
-        self.assertTrue(consistent_relation("<=", 0))
-        self.assertFalse(consistent_relation("<=", +1))
-
-    def test_unknown(self):
-        # type: () -> None
-        with self.assertRaises(ValueError):
-            consistent_relation("???", 0)
-
-
-def strict_version_cmp(a, b):
-    # type: (Text, Text) -> int
-    """
-    strictly_version_cmp compares two version numbers without leeway.
-
-    The algorithm considers each version to be a tuple of integers. Non,
-    integer elements or element fragments are regarded as an error and raised
-    as ValueError.
-
-    Comparison is performed on by considering the leftmost element in each
-    tuple. First pair of numbers that are not equal determine the result of the
-    comparison. Tuples have unequal length then missing elements are
-    substituted with zero.
-
-    The return value is 0 if the version strings are equal, -1 if version a is
-    smaller or +1 if version b is smaller.
-    """
-    try:
-        a_items = [int(item, 10) for item in a.split(".")]
-    except ValueError:
-        raise ValueError("version {} is not purely numeric".format(a))
-    try:
-        b_items = [int(item, 10) for item in b.split(".")]
-    except ValueError:
-        raise ValueError("version {} is not purely numeric".format(b))
-    if PY2:
-        zip_longest_fn = itertools.izip_longest
-    else:
-        zip_longest_fn = itertools.zip_longest
-    for a_val, b_val in zip_longest_fn(a_items, b_items, fillvalue=0):
-        delta = a_val - b_val
-        if delta != 0:
-            return 1 if delta > 0 else -1
-    return 0
-
-
-class StrictVersionCmpTests(unittest.TestCase):
-    def test_simple(self):
-        # type: () -> None
-        self.assertEqual(strict_version_cmp("10", "10"), 0)
-        self.assertEqual(strict_version_cmp("10", "20"), -1)
-        self.assertEqual(strict_version_cmp("20", "10"), +1)
-
-    def test_many_segments(self):
-        # type: () -> None
-        self.assertEqual(strict_version_cmp("1.2.3", "1.2.3"), 0)
-        self.assertEqual(strict_version_cmp("1.2.3", "1.3.4"), -1)
-        self.assertEqual(strict_version_cmp("1.4.3", "1.2.3"), +1)
-        self.assertEqual(strict_version_cmp("1.0.0", "1.1.0"), -1)
-        self.assertEqual(strict_version_cmp("0.1.2", "1.1.2"), -1)
-
-    def test_unequal_length(self):
-        # type: () -> None
-        self.assertEqual(strict_version_cmp("1", "1.0"), 0)
-        self.assertEqual(strict_version_cmp("1", "1.2"), -1)
-        self.assertEqual(strict_version_cmp("1.2", "1"), +1)
-        self.assertEqual(strict_version_cmp("1", "1.0.1"), -1)
-        self.assertEqual(strict_version_cmp("1.1", "1.0.1"), +1)
-
-    def test_version_with_text(self):
-        # type: () -> None
-        with self.assertRaises(ValueError) as cm:
-            strict_version_cmp("1-foo", "1")
-        self.assertEqual(cm.exception.args, ("version 1-foo is not purely numeric",))
-        with self.assertRaises(ValueError) as cm:
-            strict_version_cmp("1.2-foo", "1.2")
-        self.assertEqual(cm.exception.args, ("version 1.2-foo is not purely numeric",))
-
-
-def _make_parser():
-    # type: () -> ArgumentParser
-    parser = ArgumentParser(
-        epilog="""
-Relational operator is one of:
-
-    -eq -ne -gt -ge -lt -le
-
-Version comparison is performed using the selected algorithm.
-
-strict:
-    The algorithm considers each version to be a tuple of integers.
-    Non-integer elements are considered to be invalid version.
-
-    Comparison is performed on by considering the leftmost element in each
-    tuple. First pair of numbers that are not equal determine the result of the
-    comparison. Tuples have unequal length then missing elements are
-    substituted with zero.
-    """,
-        formatter_class=RawTextHelpFormatter,
-    )
-    parser.register("action", "unit-test", _UnitTestAction)
-    parser.add_argument("-v", "--version", action="version", version="1.0")
-    parser.add_argument(
-        "--verbose", action="store_true", help="describe comparison process"
-    )
-
-    parser.add_argument("version_a", metavar="VERSION-A")
-    parser.add_argument("version_b", metavar="VERSION-B")
-
-    # algorithm selection
-    alg_grp = parser.add_mutually_exclusive_group(required=True)
-    alg_grp.add_argument(
-        "--strict",
-        dest="algorithm",
-        action="store_const",
-        const=strict_version_cmp,
-        help="select the strict version comparison",
-    )
-    # relation selection
-    rel_op_grp = parser.add_mutually_exclusive_group(required=True)
-    rel_op_grp.add_argument(
-        "-eq",
-        action="store_const",
-        const="==",
-        dest="rel_op",
-        help="test that versions are equal",
-    )
-    rel_op_grp.add_argument(
-        "-ne",
-        action="store_const",
-        const="!=",
-        dest="rel_op",
-        help="test that versions are not equal",
-    )
-    rel_op_grp.add_argument(
-        "-gt",
-        action="store_const",
-        const=">",
-        dest="rel_op",
-        help="test that version-a is greater than version-b",
-    )
-    rel_op_grp.add_argument(
-        "-ge",
-        action="store_const",
-        const=">=",
-        dest="rel_op",
-        help="test that version-a is greater than or equal to version-b",
-    )
-    rel_op_grp.add_argument(
-        "-lt",
-        action="store_const",
-        const="<",
-        dest="rel_op",
-        help="test that version-a is less than version-b",
-    )
-    rel_op_grp.add_argument(
-        "-le",
-        action="store_const",
-        const="<=",
-        dest="rel_op",
-        help="test that version-a is less than or equal to version-b",
-    )
-
-    # maintenance commands
-    maint_grp = parser.add_argument_group("maintenance commands")
-    maint_grp.add_argument("--run-unit-tests", action="unit-test", help=SUPPRESS)
-    return parser
-
-
-def main():
-    # type: () -> None
-    opts = _make_parser().parse_args()
-    try:
-        delta = opts.algorithm(opts.version_a, opts.version_b)
-    except ValueError as exc:
-        print("error: {}".format(exc), file=sys.stderr)
-        raise SystemExit(2)
-    else:
-        is_consistent = consistent_relation(opts.rel_op, delta)
-        if opts.verbose:
-            print(
-                "delta between {} and {} is: {}".format(
-                    opts.version_a, opts.version_b, delta
-                )
-            )
-            if is_consistent:
-                print("delta {} is consistent with {}".format(delta, opts.rel_op))
-            else:
-                print("delta {} is inconsistent with {}".format(delta, opts.rel_op))
-        raise SystemExit(0 if is_consistent else 1)
-
-
-if __name__ == "__main__":
-    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/cla_check.py snapd-2.48.3+20.04/tests/lib/cla_check.py
--- snapd-2.45.1+20.04.2/tests/lib/cla_check.py	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/cla_check.py	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 from __future__ import print_function
 
@@ -7,47 +7,26 @@
 import os
 import re
 import sys
+import argparse
 from subprocess import check_call, check_output
 
 
 try:
     from launchpadlib.launchpad import Launchpad
 except ImportError:
-    sys.exit("Install launchpadlib: sudo apt install python-launchpadlib")
+    sys.exit(
+        "Install launchpadlib: sudo apt install python-launchpadlib python3-launchpadlib"
+    )
 
-shortlog_email_rx = re.compile("^\s*\d+\s+.*<(\S+)>$", re.M)
+shortlog_email_rx = re.compile(r"^\s*\d+\s+.*<(\S+)>$", re.M)
 
 
 is_travis = os.getenv("TRAVIS", "") == "true"
 is_github_actions = os.getenv("GITHUB_ACTIONS", "") == "true"
 
 
-def get_commit_range():
-    # Sanity check to ensure we are running from a pull request check job
-    if is_travis:
-        if os.getenv("TRAVIS_PULL_REQUEST", "false") == "false":
-            raise RuntimeError("called from a non-pull request Travis job")
-    elif is_github_actions:
-        if os.getenv("GITHUB_EVENT_NAME", "") != "pull_request":
-            raise RuntimeError("called from a non-pull request Github Actions job")
-    else:
-        raise RuntimeError("unknown CI system.")
-
-    # The head revision is a synthesised merge commit, merging the
-    # proposed branch into the destination branch.  So the first
-    # parent is our destination, and the second is our proposal.
-    lines = check_output(["git", "cat-file", "-p", "@"]).splitlines()
-    parents = [line[len("parent "):].strip() for line in lines
-               if line.startswith("parent ")]
-    if len(parents) != 2:
-        raise RuntimeError("expected two parents, but got {}".format(parents))
-    dest, proposed = parents
-
-    return dest, proposed
-
-
 def get_emails_for_range(r):
-    output = check_output(["git", "shortlog", "-se", r])
+    output = check_output(["git", "shortlog", "-se", r]).decode("utf-8")
     return set(m.group(1) for m in shortlog_email_rx.finditer(output))
 
 
@@ -65,15 +44,16 @@
     clear = ""
 
 if is_travis:
-    fold_start = 'travis_fold:start:{{tag}}\r{}{}{{message}}{}'.format(
-        clear, yellow, reset)
-    fold_end = 'travis_fold:end:{{tag}}\r{}'.format(clear)
+    fold_start = "travis_fold:start:{{tag}}\r{}{}{{message}}{}".format(
+        clear, yellow, reset
+    )
+    fold_end = "travis_fold:end:{{tag}}\r{}".format(clear)
 elif is_github_actions:
-    fold_start = '::group::{message}'
-    fold_end = '::endgroup::'
+    fold_start = "::group::{message}"
+    fold_end = "::endgroup::"
 else:
-    fold_start = '{}{{message}}{}'.format(yellow, reset)
-    fold_end = ''
+    fold_start = "{}{{message}}{}".format(yellow, reset)
+    fold_end = ""
 
 
 def static_email_check(email, master_emails, width):
@@ -96,7 +76,7 @@
                 yellow, reset, email, width
             )
         )
-        return True
+        return False
     return False
 
 
@@ -137,14 +117,14 @@
 
 
 def main():
-    try:
-        master, proposed = get_commit_range()
-    except Exception as exc:
-        sys.exit("Could not determine commit range: {}".format(exc))
-    commit_range = "{}..{}".format(master, proposed)
-    print_checkout_info(commit_range)
-
-    emails = get_emails_for_range(commit_range)
+    parser = argparse.ArgumentParser(description="")
+    parser.add_argument(
+        "commit_range", help="Commit range in format <upstream-head>..<fork-head>"
+    )
+    opts = parser.parse_args()
+    master, _ = opts.commit_range.split("..")
+    print_checkout_info(opts.commit_range)
+    emails = get_emails_for_range(opts.commit_range)
     if len(emails) == 0:
         sys.exit("No emails found in in the given commit range.")
 
diff -Nru snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/attacker-user/meta-data snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/attacker-user/meta-data
--- snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/attacker-user/meta-data	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/attacker-user/meta-data	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+instance-id: iid-local02
+local-hostname: cloudimg
diff -Nru snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/attacker-user/user-data snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/attacker-user/user-data
--- snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/attacker-user/user-data	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/attacker-user/user-data	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,7 @@
+#cloud-config
+users:
+  - default
+  - name: attacker-user
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    lock_passwd: false
+    passwd: $6$rounds=4096$PCrfo.ggdf4ubP$REjyaoY2tUWH2vjFJjvLs3rDxVTszGR9P7mhH9sHb2MsELfc53uV/v15jDDOJU/9WInfjjTKJPlD5URhX5Mix0
diff -Nru snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/normal-user/meta-data snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/normal-user/meta-data
--- snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/normal-user/meta-data	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/normal-user/meta-data	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+instance-id: iid-local01
+local-hostname: cloudimg
diff -Nru snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/normal-user/user-data snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/normal-user/user-data
--- snapd-2.45.1+20.04.2/tests/lib/cloud-init-seeds/normal-user/user-data	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/cloud-init-seeds/normal-user/user-data	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,7 @@
+#cloud-config
+users:
+  - default
+  - name: normal-user
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    lock_passwd: false
+    passwd: $6$rounds=4096$PCrfo.ggdf4ubP$REjyaoY2tUWH2vjFJjvLs3rDxVTszGR9P7mhH9sHb2MsELfc53uV/v15jDDOJU/9WInfjjTKJPlD5URhX5Mix0
diff -Nru snapd-2.45.1+20.04.2/tests/lib/core-config.sh snapd-2.48.3+20.04/tests/lib/core-config.sh
--- snapd-2.45.1+20.04.2/tests/lib/core-config.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/core-config.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+clean_snapd_lib() {
+    rm -rf /var/lib/snapd/assertions/*
+    rm -rf /var/lib/snapd/device
+    rm -rf /var/lib/snapd/state.json
+}
+
+prepare_core_model(){
+    mv /var/lib/snapd/seed/assertions/model model.bak
+}
+
+restore_core_model(){
+    mv model.bak /var/lib/snapd/seed/assertions/model
+}
+
+prepare_and_manip_seed(){
+    cp /var/lib/snapd/seed/seed.yaml seed.yaml.bak
+    python3 "$TESTSLIB"/manip_seed.py /var/lib/snapd/seed/seed.yaml "$@"
+}
+
+restore_updated_seed(){
+    mv seed.yaml.bak /var/lib/snapd/seed/seed.yaml
+}
+
+prepare_testrootorg_store(){
+    cp -f "$TESTSLIB"/assertions/testrootorg-store.account-key /var/lib/snapd/seed/assertions
+}
+
+restore_testrootorg_store(){
+    rm -f /var/lib/snapd/seed/assertions/testrootorg-store.account-key
+}
+
+prepare_test_account(){
+    local ACCOUNT_NAME=$1
+    cp -f "$TESTSLIB/assertions/${ACCOUNT_NAME}.account" /var/lib/snapd/seed/assertions
+    cp -f "$TESTSLIB/assertions/${ACCOUNT_NAME}.account-key" /var/lib/snapd/seed/assertions
+}
+
+restore_test_account(){
+    local ACCOUNT_NAME=$1
+    rm -f "/var/lib/snapd/seed/assertions/${ACCOUNT_NAME}.account"
+    rm -f "/var/lib/snapd/seed/assertions/${ACCOUNT_NAME}.account-key"
+}
+
+prepare_test_model(){
+    local MODEL_NAME=$1
+    local MODEL_FINAL
+    MODEL_FINAL=$(get_test_model "$MODEL_NAME")
+    cp -f "${TESTSLIB}/assertions/${MODEL_FINAL}" "/var/lib/snapd/seed/assertions/${MODEL_NAME}.model"
+}
+
+restore_test_model(){
+    local MODEL_NAME=$1
+    rm -f "/var/lib/snapd/seed/assertions/${MODEL_NAME}.model"
+}
+
+unpack_pc_snap(){
+    unsquashfs -no-progress /var/lib/snapd/snaps/pc_*.snap
+}
+
+pack_pc_snap(){
+    mksquashfs squashfs-root pc_x1.snap -comp xz -no-fragments -no-progress
+    rm -rf squashfs-root
+    cp pc_x1.snap /var/lib/snapd/seed/snaps/
+}
+
+restore_pc_snap(){
+    if systemctl status snap-pc-x1.mount ; then
+       systemctl stop snap-pc-x1.mount
+       rm -f /etc/systemd/system/snap-pc-x1.mount
+       rm -f /etc/systemd/system/multi-user.target.wants/snap-pc-x1.mount
+       rm -f /var/lib/snapd/snaps/pc_x1.snap
+       systemctl daemon-reload
+    fi
+    rm -f /var/lib/snapd/seed/snaps/pc_x1.snap
+}
+
+get_test_model(){
+    local MODEL_NAME=$1
+    if os.query is-core18; then
+        echo "${MODEL_NAME}-18.model"
+    elif os.query is-core20; then
+        echo "${MODEL_NAME}-20.model"
+    else
+        echo "${MODEL_NAME}.model"
+    fi
+}
+
+get_test_snap_suffix(){
+    if os.query is-core18; then
+        echo "-core18"
+    elif os.query is-core20; then
+        echo "-core20"
+    fi
+}
+
+wait_for_first_boot_change(){
+    while ! snap changes | grep -q "Done.*Initialize system state"; do sleep 1; done
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/dbus.sh snapd-2.48.3+20.04/tests/lib/dbus.sh
--- snapd-2.45.1+20.04.2/tests/lib/dbus.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/dbus.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,35 +0,0 @@
-#!/bin/bash
-
-start_dbus_unit(){
-    local executable="$1"
-
-    dbus-launch > dbus.env
-    # shellcheck disable=SC2046
-    export $(cat dbus.env)
-    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
-        cat <<EOF > /etc/init/dbus-provider.conf
-env DBUS_SESSION_BUS_ADDRESS="$DBUS_SESSION_BUS_ADDRESS"
-env DBUS_SESSION_BUS_PID="$DBUS_SESSION_BUS_PID"
-script
-    $executable
-end script
-EOF
-        initctl reload-configuration
-        start dbus-provider
-    else
-        systemd-run --unit dbus-provider \
-                    --setenv=DBUS_SESSION_BUS_ADDRESS="$DBUS_SESSION_BUS_ADDRESS" \
-                    --setenv=DBUS_SESSION_BUS_PID="$DBUS_SESSION_BUS_PID" \
-                    "$executable"
-    fi
-}
-
-stop_dbus_unit(){
-    rm -f dbus.env
-    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
-        stop dbus-provider
-        rm -f /etc/init/dbus-provider.conf
-    else
-        systemctl stop dbus-provider || true
-    fi
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/desktop-portal.sh snapd-2.48.3+20.04/tests/lib/desktop-portal.sh
--- snapd-2.45.1+20.04.2/tests/lib/desktop-portal.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/desktop-portal.sh	2021-02-02 08:21:12.000000000 +0000
@@ -3,9 +3,6 @@
 #shellcheck source=tests/lib/pkgdb.sh
 . "$TESTSLIB"/pkgdb.sh
 
-#shellcheck source=tests/lib/user.sh
-. "$TESTSLIB"/user.sh
-
 setup_portals() {
     # Install xdg-desktop-portal and configure service activation for
     # fake portal UI.
@@ -39,13 +36,10 @@
 UseIn=spread
 EOF
 
-    start_user_session
-    as_user systemctl --user set-environment XDG_CURRENT_DESKTOP=spread
+    tests.session -u test exec systemctl --user set-environment XDG_CURRENT_DESKTOP=spread
 }
 
 teardown_portals() {
-    stop_user_session
-
     rm -f /usr/share/dbus-1/services/org.freedesktop.impl.portal.spread.service
     rm -f /usr/lib/systemd/user/spread-portal-ui.service
     rm -f /usr/share/xdg-desktop-portal/portals/spread.portal
@@ -59,6 +53,4 @@
 
     distro_purge_package xdg-desktop-portal
     distro_auto_remove_packages
-
-    purge_user_session_data
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/dirs.sh snapd-2.48.3+20.04/tests/lib/dirs.sh
--- snapd-2.45.1+20.04.2/tests/lib/dirs.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/dirs.sh	2021-02-02 08:21:12.000000000 +0000
@@ -17,6 +17,10 @@
     opensuse-*)
         export SNAP_MOUNT_DIR=/snap
         export MEDIA_DIR=/run/media
+        if [ "$( . /etc/os-release ; echo "$ID")" = "opensuse-tumbleweed" ]; then
+            # Tumbleweed since snapshot 20200827 is using /usr/libexec as libexecdir
+            export LIBEXECDIR=/usr/libexec
+        fi
         ;;
     *)
         ;;
diff -Nru snapd-2.45.1+20.04.2/tests/lib/ensure_ubuntu_save.py snapd-2.48.3+20.04/tests/lib/ensure_ubuntu_save.py
--- snapd-2.45.1+20.04.2/tests/lib/ensure_ubuntu_save.py	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/ensure_ubuntu_save.py	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+
+import argparse
+import logging
+import yaml
+import sys
+
+
+def parse_arguments():
+    parser = argparse.ArgumentParser(description="ensure pc gadget has ubuntu-save")
+    parser.add_argument(
+        "gadgetyaml", type=argparse.FileType("r"), help="path to gadget.yaml input file"
+    )
+    return parser.parse_args()
+
+
+def main(opts):
+    gadget_yaml = yaml.safe_load(opts.gadgetyaml)
+
+    structs = gadget_yaml["volumes"]["pc"]["structure"]
+    save_idx = -1
+    for idx, s in enumerate(structs):
+        role = s.get("role", "")
+        if role == "system-save":
+            logging.info("system-save structure already present")
+            # already has ubuntu-save
+            return
+        if role == "system-data":
+            # ubuntu-save precedes ubuntu-data
+            save_idx = idx
+            break
+    if save_idx == -1:
+        raise RuntimeError("cannot find a suitable place to insert ubuntu-save")
+
+    ubuntu_save = {
+        "name": "ubuntu-save",
+        "role": "system-save",
+        # TODO:UC20: update when pc-amd64-gadget changes
+        "size": "16M",
+        "filesystem": "ext4",
+        "type": "83,0FC63DAF-8483-4772-8E79-3D69D8477DE4",
+    }
+    structs.insert(save_idx, ubuntu_save)
+    yaml.dump(gadget_yaml, stream=sys.stdout, indent=2, default_flow_style=False)
+
+
+if __name__ == "__main__":
+    logging.basicConfig(level=logging.DEBUG)
+    opts = parse_arguments()
+    main(opts)
diff -Nru snapd-2.45.1+20.04.2/tests/lib/fakestore/store/store.go snapd-2.48.3+20.04/tests/lib/fakestore/store/store.go
--- snapd-2.45.1+20.04.2/tests/lib/fakestore/store/store.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/fakestore/store/store.go	2021-02-02 08:21:12.000000000 +0000
@@ -229,7 +229,7 @@
 		Digest:      snapDigest,
 		Size:        size,
 		Confinement: string(info.Confinement),
-		Type:        string(info.GetType()),
+		Type:        string(info.Type()),
 	}, nil
 }
 
diff -Nru snapd-2.45.1+20.04.2/tests/lib/fde-setup-hook/fde-setup.go snapd-2.48.3+20.04/tests/lib/fde-setup-hook/fde-setup.go
--- snapd-2.45.1+20.04.2/tests/lib/fde-setup-hook/fde-setup.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/fde-setup-hook/fde-setup.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,112 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/snapcore/snapd/osutil"
+)
+
+// super secure crypto
+func xor13(bs []byte) []byte {
+	out := make([]byte, len(bs))
+	for i := range bs {
+		out[i] = bs[i] ^ 0x13
+	}
+	return out
+}
+
+// Note that this does not import the snapd structs to ensure we don't
+// accidentally break something in the contract and miss that we broke
+// it because we use the internal thing "externally" here
+type fdeSetupJSON struct {
+	Op string `json:"op"`
+
+	Key     []byte `json:"key,omitempty"`
+	KeyName string `json:"key-name,omitempty"`
+
+	Models []map[string]string `json:"models,omitempty"`
+}
+
+func runFdeSetup() error {
+	output, err := exec.Command("snapctl", "fde-setup-request").CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("cannot run snapctl fde-setup-request: %v", osutil.OutputErr(output, err))
+	}
+	var js fdeSetupJSON
+	if err := json.Unmarshal(output, &js); err != nil {
+		return err
+	}
+
+	var fdeSetupResult []byte
+	switch js.Op {
+	case "features":
+		// no special features supported by this hook
+		fdeSetupResult = []byte(`{"features":[]}`)
+	case "initial-setup":
+		// "seal"
+		fdeSetupResult = xor13(js.Key)
+	default:
+		return fmt.Errorf("unsupported op %q", js.Op)
+	}
+	cmd := exec.Command("snapctl", "fde-setup-result")
+	cmd.Stdin = bytes.NewBuffer(fdeSetupResult)
+	output, err = cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("cannot run snapctl fde-setup-result for op %q: %v", js.Op, osutil.OutputErr(output, err))
+	}
+	return nil
+}
+
+type fdeRevealJSON struct {
+	Op string `json:"op"`
+
+	SealedKey []byte `json:"sealed-key"`
+}
+
+func runFdeRevealKey() error {
+	var js fdeRevealJSON
+
+	if err := json.NewDecoder(os.Stdin).Decode(&js); err != nil {
+		return err
+	}
+
+	switch js.Op {
+	case "reveal":
+		// "unseal"
+		unsealedKey := xor13(js.SealedKey)
+		fmt.Fprintf(os.Stdout, "%s", unsealedKey)
+	case "lock":
+		// nothing right now
+	case "features":
+		// XXX: Not used right now but might in the future?
+		fmt.Fprintf(os.Stdout, `{"features":[]}`)
+	default:
+		return fmt.Errorf(`unsupported operations %q`, js.Op)
+	}
+
+	return nil
+}
+
+func main() {
+	var err error
+
+	switch filepath.Base(os.Args[0]) {
+	case "fde-setup":
+		// run as regular hook
+		err = runFdeSetup()
+	case "fde-reveal-key":
+		// run from initrd
+		err = runFdeRevealKey()
+	default:
+		err = fmt.Errorf("binary needs to be called as fde-setup or fde-reveal-key")
+	}
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/files.sh snapd-2.48.3+20.04/tests/lib/files.sh
--- snapd-2.45.1+20.04.2/tests/lib/files.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/files.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,74 +0,0 @@
-#!/bin/bash
-
-wait_for_file() {
-    the_file="$1"
-    iters="$2"
-    sleep_time="$3"
-
-    for _ in $(seq "$iters"); do
-        if [ -e "$the_file" ]; then
-            return 0
-        fi
-        sleep "$sleep_time"
-    done
-    return 1
-}
-
-ensure_dir_exists() {
-    dir="$1"
-    if ! [ -d "$dir" ]; then
-        mkdir -p "$dir"
-        touch "$dir.fake"
-    fi
-}
-
-ensure_dir_exists_backup_real() {
-    dir="$1"
-    if [ -d "$dir" ]; then
-        mv "$dir" "$dir.back"
-    fi
-    mkdir -p "$dir"
-    touch "$dir.fake"
-}
-
-clean_dir() {
-    dir="$1"
-    if [ -f "$dir.fake" ]; then
-        rm -rf "$dir"
-        rm -f "$dir.fake"
-    fi
-    if [ -d "$dir.back" ]; then
-        mv "$dir.back" "$dir"
-    fi
-}
-
-ensure_file_exists() {
-    file="$1"
-    if ! [ -e "$file" ]; then
-        echo "content for $file" > "$file"
-        echo "content for fake $file" > "$file.fake"
-    fi
-}
-
-ensure_file_exists_backup_real() {
-    file="$1"
-    if [ -e "$file" ]; then
-        mv "$file" "$file.back"
-    fi
-    # ensure the parent dir is available
-    if [ ! -d "$(dirname "$file")" ]; then
-        mkdir -p "$(dirname "$file")"
-    fi
-    ensure_file_exists "$file"
-}
-
-clean_file() {
-    file="$1"
-    if [ -e "$file.fake" ]; then
-        rm -f "$file"
-        rm -f "$file.fake"
-    fi
-    if [ -e "$file.back" ]; then
-        mv "$file.back" "$file"
-    fi
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/hotplug.sh snapd-2.48.3+20.04/tests/lib/hotplug.sh
--- snapd-2.45.1+20.04.2/tests/lib/hotplug.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/hotplug.sh	2021-02-02 08:21:12.000000000 +0000
@@ -5,23 +5,23 @@
 
 
 hotplug_add_dev1() {
-    add_tty_chardev my-chardev1 /tmp/serialport1
-    add_usb_serial_device my-usb-serial my-chardev1 1234
+    nested_add_tty_chardev my-chardev1 /tmp/serialport1
+    nested_add_usb_serial_device my-usb-serial my-chardev1 1234
 }
 
 hotplug_del_dev1() {
-    del_device my-usb-serial
-    remove_chardev my-chardev1
+    nested_del_device my-usb-serial
+    nested_remove_chardev my-chardev1
 }
 
 hotplug_add_dev2() {
-    add_tty_chardev my-chardev2 /tmp/serialport2
-    add_usb_serial_device my-usb-serial2 my-chardev2 5678
+    nested_add_tty_chardev my-chardev2 /tmp/serialport2
+    nested_add_usb_serial_device my-usb-serial2 my-chardev2 5678
 }
 
 hotplug_del_dev2() {
-    del_device my-usb-serial2
-    remove_chardev my-chardev2
+    nested_del_device my-usb-serial2
+    nested_remove_chardev my-chardev2
 }
 
 # Check that given slot is not present in 'snap connections' output
@@ -29,12 +29,12 @@
 check_slot_not_present() {
     SLOT_NAME="$1"
     for _ in $(seq 10); do
-        if ! execute_remote "snap connections system" | MATCH ":$SLOT_NAME"; then
+        if ! nested_exec "snap connections system" | MATCH ":$SLOT_NAME"; then
             break
         fi
         sleep 1
     done
-    if execute_remote "snap connections system" | MATCH ":$SLOT_NAME "; then
+    if nested_exec "snap connections system" | MATCH ":$SLOT_NAME "; then
         echo "slot $SLOT_NAME shouldn't be present anymore"
         exit 1
     fi
@@ -44,65 +44,65 @@
 check_slot_present() {
     SLOT_NAME="$1"
     for _ in $(seq 10); do
-        if execute_remote "snap connections system" | MATCH "serial-port .* - .* :$SLOT_NAME"; then
+        if nested_exec "snap connections system" | MATCH "serial-port .* - .* :$SLOT_NAME"; then
             break
         fi
         sleep 1
     done
-    execute_remote "snap connections system" | MATCH "serial-port .* - .* :$SLOT_NAME"
+    nested_exec "snap connections system" | MATCH "serial-port .* - .* :$SLOT_NAME"
 }
 
 # Check that given slot has hotplug-gone=true, meaning the device was unplugged but there are connections remembered for it
 check_slot_gone() {
     SLOT_NAME="$1"
-    execute_remote 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"][\"hotplug-gone\"]" /var/lib/snapd/state.json' | MATCH "true"
+    nested_exec 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"][\"hotplug-gone\"]" /var/lib/snapd/state.json' | MATCH "true"
 }
 
 # Check that given slot has hotplug-gone=false, meaning the device is plugged
 check_slot_not_gone() {
     SLOT_NAME="$1"
-    execute_remote 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"][\"hotplug-gone\"]" /var/lib/snapd/state.json' | MATCH "false"
+    nested_exec 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"][\"hotplug-gone\"]" /var/lib/snapd/state.json' | MATCH "false"
 }
 
 # Check that given slot has no record in "hotplug-slots" map in the state
 check_slot_not_present_in_state() {
     SLOT_NAME="$1"
-    execute_remote 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"] // \"missing\"" /var/lib/snapd/state.json' | MATCH "missing"
+    nested_exec 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"] // \"missing\"" /var/lib/snapd/state.json' | MATCH "missing"
 }
 
 check_slot_device_path() {
     SLOT_NAME="$1"
     DEVICE_PATH="$2"
-    execute_remote 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"][\"static-attrs\"].path" /var/lib/snapd/state.json' | MATCH "$DEVICE_PATH"
+    nested_exec 'sudo jq -r ".data[\"hotplug-slots\"][\"'"$SLOT_NAME"'\"][\"static-attrs\"].path" /var/lib/snapd/state.json' | MATCH "$DEVICE_PATH"
 }
 
 # Check that given slot is connected to the serial-port-hotplug snap, per 'snap connections' output
 check_slot_connected() {
     SLOT_NAME="$1"
     for _ in $(seq 10); do
-        if execute_remote "snap connections" | MATCH "serial-port .*serial-port-hotplug:serial-port .*$SLOT_NAME"; then
+        if nested_exec "snap connections" | MATCH "serial-port .*serial-port-hotplug:serial-port .*$SLOT_NAME"; then
             break
         fi
         sleep 1
     done
-    execute_remote "snap connections" | MATCH "serial-port .*serial-port-hotplug:serial-port .*$SLOT_NAME"
+    nested_exec "snap connections" | MATCH "serial-port .*serial-port-hotplug:serial-port .*$SLOT_NAME"
 }
 
 # Check that apparmor profile allows rw access to given device path.
 verify_apparmor_profile() {
     DEVPATH=$1
     for _ in $(seq 10); do
-        if execute_remote "cat /var/lib/snapd/apparmor/profiles/snap.serial-port-hotplug.consumer" | MATCH "$DEVPATH rwk,"; then
+        if nested_exec "cat /var/lib/snapd/apparmor/profiles/snap.serial-port-hotplug.consumer" | MATCH "$DEVPATH rwk,"; then
             break
         fi
         sleep 1
     done
-    execute_remote "cat /var/lib/snapd/apparmor/profiles/snap.serial-port-hotplug.consumer" | MATCH "$DEVPATH rwk,"
+    nested_exec "cat /var/lib/snapd/apparmor/profiles/snap.serial-port-hotplug.consumer" | MATCH "$DEVPATH rwk,"
 }
 
 wait_for_all_changes() {
     for _ in $(seq 10); do
-        if ! execute_remote "snap changes" | MATCH "Doing"; then
+        if ! nested_exec "snap changes" | MATCH "Doing"; then
             break
         fi
         sleep 1
diff -Nru snapd-2.45.1+20.04.2/tests/lib/journalctl.sh snapd-2.48.3+20.04/tests/lib/journalctl.sh
--- snapd-2.45.1+20.04.2/tests/lib/journalctl.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/journalctl.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,79 +0,0 @@
-#!/bin/bash
-
-# shellcheck source=tests/lib/state.sh
-. "$TESTSLIB/state.sh"
-
-# This file contains all the cursors used for the different tests
-JOURNALCTL_CURSOR_FILE="$RUNTIME_STATE_PATH"/journalctl_cursor
-
-get_last_journalctl_cursor(){
-    journalctl --output=export -n1 | grep --binary-files=text -o '__CURSOR=.*' | sed -e 's/^__CURSOR=//'
-}
-
-start_new_journalctl_log(){
-    sync_journalctl_log
-    echo "New test starts here - $SPREAD_JOB" | systemd-cat -t snapd-test
-    cursor=$(get_last_journalctl_cursor)
-    if [ -z "$cursor" ]; then
-        echo "Empty journalctl cursor, exiting..."
-        exit 1
-    else
-        echo "$SPREAD_JOB " >> "$JOURNALCTL_CURSOR_FILE"
-        echo "$cursor" >> "$JOURNALCTL_CURSOR_FILE"
-    fi
-}
-
-check_journalctl_ready(){
-    marker="test-${RANDOM}${RANDOM}"
-    echo "Running test: $marker" | systemd-cat -t snapd-test
-    if check_journalctl_log "$marker"; then
-        return 0
-    fi
-    echo "Test id not found in journalctl, exiting..."
-    exit 1
-}
-
-check_journalctl_log(){
-    expression=$1
-    shift
-    for _ in $(seq 10); do
-        # forcibly silence this particular bit because it produces GOBS of 
-        # output and we really don't need to see all the output when we are 
-        # checking the output for an expression, as if it is missing we want to 
-        # check the journal once at the end of this loop, likely in the debug 
-        # section
-        set +x
-        log=$(get_journalctl_log "$@")
-        if echo "$log" | grep -q -E "$expression"; then
-            return 0
-        fi
-        set -x
-        echo "Match for \"$expression\" failed, retrying"
-        sleep 1
-    done
-    return 1
-}
-
-get_journalctl_log(){
-    cursor=""
-    if [ -f "$JOURNALCTL_CURSOR_FILE" ]; then
-        cursor=$(tail -n1 "$JOURNALCTL_CURSOR_FILE")
-    fi
-    sync_journalctl_log
-    get_journalctl_log_from_cursor "$cursor" "$@"
-}
-
-get_journalctl_log_from_cursor(){
-    cursor=$1
-    shift
-    if [ -z "$cursor" ]; then
-        journalctl "$@"
-    else
-        journalctl "$@" --cursor "$cursor"
-    fi
-}
-
-sync_journalctl_log(){
-    journalctl --flush || true
-    journalctl --sync || true
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/manip_seed.py snapd-2.48.3+20.04/tests/lib/manip_seed.py
--- snapd-2.45.1+20.04.2/tests/lib/manip_seed.py	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/manip_seed.py	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,29 @@
+import sys
+import yaml
+from os import path
+
+with open(sys.argv[1]) as f:
+    seed = yaml.load(f)
+
+i = 0
+snaps = seed["snaps"]
+while i < len(snaps):
+    entry = snaps[i]
+    if entry["name"] == "pc":
+        snaps[i] = {
+            "name": "pc",
+            "unasserted": True,
+            "file": "pc_x1.snap",
+        }
+        break
+    i += 1
+
+for snap in sys.argv[2:]:
+    # test-snapd-with-configure_123.snap -> test-snapd-configure
+    snapname = path.basename(snap).split("_")[0]
+    snaps.append(
+        {"name": snapname, "channel": "edge", "file": snap,}
+    )
+
+with open(sys.argv[1], "w") as f:
+    yaml.dump(seed, stream=f, indent=2, default_flow_style=False)
diff -Nru snapd-2.45.1+20.04.2/tests/lib/nested.sh snapd-2.48.3+20.04/tests/lib/nested.sh
--- snapd-2.45.1+20.04.2/tests/lib/nested.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/nested.sh	2021-02-02 08:21:12.000000000 +0000
@@ -3,55 +3,163 @@
 # shellcheck source=tests/lib/systemd.sh
 . "$TESTSLIB"/systemd.sh
 
-WORK_DIR=/tmp/work-dir
+# shellcheck source=tests/lib/store.sh
+. "$TESTSLIB"/store.sh
+
+NESTED_WORK_DIR="${NESTED_WORK_DIR:-/tmp/work-dir}"
+NESTED_IMAGES_DIR="$NESTED_WORK_DIR/images"
+NESTED_RUNTIME_DIR="$NESTED_WORK_DIR/runtime"
+NESTED_ASSETS_DIR="$NESTED_WORK_DIR/assets"
+NESTED_LOGS_DIR="$NESTED_WORK_DIR/logs"
+
+
 NESTED_VM=nested-vm
-SSH_PORT=8022
-MON_PORT=8888
+NESTED_SSH_PORT=8022
+NESTED_MON_PORT=8888
+
+NESTED_CUSTOM_MODEL="${NESTED_CUSTOM_MODEL:-}"
+NESTED_CUSTOM_AUTO_IMPORT_ASSERTION="${NESTED_CUSTOM_AUTO_IMPORT_ASSERTION:-}"
+NESTED_FAKESTORE_BLOB_DIR="${NESTED_FAKESTORE_BLOB_DIR:-$NESTED_WORK_DIR/fakestore/blobs}"
+NESTED_SIGN_SNAPS_FAKESTORE="${NESTED_SIGN_SNAPS_FAKESTORE:-false}"
+NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL="${NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL:-}"
+
+nested_wait_for_ssh() {
+    # TODO:UC20: the retry count should be lowered to something more reasonable.
+    nested_retry_until_success 800 1 "true"
+}
+
+nested_wait_for_no_ssh() {
+    nested_retry_while_success 200 1 "true"
+}
+
+nested_wait_for_snap_command() {
+    nested_retry_until_success 200 1 command -v snap
+}
+
+nested_get_boot_id() {
+    nested_exec "cat /proc/sys/kernel/random/boot_id"
+}
+
+nested_wait_for_reboot() {
+    local initial_boot_id="$1"
+    local last_boot_id="$initial_boot_id"
+    local retry=150
+    local wait=5
 
-wait_for_ssh(){
-    retry=300
-    wait=1
-    while ! execute_remote true; do
+    while [ $retry -ge 0 ]; do
         retry=$(( retry - 1 ))
-        if [ $retry -le 0 ]; then
-            echo "Timed out waiting for ssh. Aborting!"
-            return 1
+        # The get_boot_id could fail because the connection is broken due to the reboot
+        last_boot_id="$(nested_get_boot_id)" || true
+        if [[ "$last_boot_id" =~ .*-.*-.*-.*-.* ]] && [ "$last_boot_id" != "$initial_boot_id" ]; then
+            break
         fi
         sleep "$wait"
     done
+
+    [ "$last_boot_id" != "$initial_boot_id" ]
 }
 
-wait_for_no_ssh(){
-    retry=150
-    wait=1
-    while execute_remote true; do
+nested_uc20_transition_to_system_mode() {
+    local recovery_system="$1"
+    local mode="$2"
+    local current_boot_id
+    current_boot_id=$(nested_get_boot_id)
+    nested_exec "sudo snap reboot --$mode $recovery_system"
+    nested_wait_for_reboot "$current_boot_id"
+
+    # verify we are now in the requested mode
+    if ! nested_exec "cat /proc/cmdline" | MATCH "snapd_recovery_mode=$mode"; then
+        return 1
+    fi
+}
+
+nested_retry_while_success() {
+    local retry="$1"
+    local wait="$2"
+    shift 2
+
+    while nested_exec "$@"; do
         retry=$(( retry - 1 ))
         if [ $retry -le 0 ]; then
-            echo "Timed out waiting for no ssh. Aborting!"
+            echo "Timed out waiting for command '$*' to fail. Aborting!"
             return 1
         fi
         sleep "$wait"
     done
 }
 
-test_ssh(){
-    sshpass -p ubuntu ssh -p 8022 -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user1@localhost true
-}
+nested_retry_until_success() {
+    local retry="$1"
+    local wait="$2"
+    shift 2
 
-prepare_ssh(){
-    execute_remote "sudo adduser --extrausers --quiet --disabled-password --gecos '' test"
-    execute_remote "echo test:ubuntu | sudo chpasswd"
-    execute_remote "echo 'test ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/test-user"
+    until nested_exec "$@"; do
+        retry=$(( retry - 1 ))
+        if [ $retry -le 0 ]; then
+            echo "Timed out waiting for command '$*' to succeed. Aborting!"
+            return 1
+        fi
+        sleep "$wait"
+    done
 }
 
-create_assertions_disk(){
-    mkdir -p "$WORK_DIR"
-    dd if=/dev/null of="$WORK_DIR/assertions.disk" bs=1M seek=1
-    mkfs.ext4 -F "$WORK_DIR/assertions.disk"
-    debugfs -w -R "write $TESTSLIB/assertions/auto-import.assert auto-import.assert" "$WORK_DIR/assertions.disk"
+nested_prepare_ssh() {
+    nested_exec "sudo adduser --uid 12345 --extrausers --quiet --disabled-password --gecos '' test"
+    nested_exec "echo test:ubuntu | sudo chpasswd"
+    nested_exec "echo 'test ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/create-user-test"
+    # Check we can connect with the new test user and make sudo
+    nested_exec_as test ubuntu "sudo true"
+
+    nested_exec "sudo adduser --extrausers --quiet --disabled-password --gecos '' external"
+    nested_exec "echo external:ubuntu | sudo chpasswd"
+    nested_exec "echo 'external ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/create-user-external"
+    # Check we can connect with the new external user and make sudo
+    nested_exec_as external ubuntu "sudo true"
+}
+
+nested_create_assertions_disk() {
+    mkdir -p "$NESTED_ASSETS_DIR"
+    local ASSERTIONS_DISK LOOP_DEV
+    ASSERTIONS_DISK="$NESTED_ASSETS_DIR/assertions.disk"
+
+    # make an image
+    dd if=/dev/null of="$ASSERTIONS_DISK" bs=1M seek=1
+    # format it as dos with a vfat partition
+    # TODO: can we do this more programmatically without printing into fdisk ?
+    printf 'o\nn\np\n1\n\n\nt\nc\nw\n' | fdisk "$ASSERTIONS_DISK"
+    # mount the disk image
+    kpartx -av "$ASSERTIONS_DISK"
+    # find the loopback device for the partition
+    LOOP_DEV=$(losetup --list | grep "$ASSERTIONS_DISK" | awk '{print $1}' | grep -Po "/dev/loop\K([0-9]*)")
+    # wait for the loop device to show up
+    retry -n 3 --wait 1 test -e "/dev/mapper/loop${LOOP_DEV}p1"
+    # make a vfat partition
+    mkfs.vfat -n SYSUSER "/dev/mapper/loop${LOOP_DEV}p1"
+    # mount the partition and copy the files 
+    mkdir -p "$NESTED_ASSETS_DIR/sys-user-partition"
+    mount "/dev/mapper/loop${LOOP_DEV}p1" "$NESTED_ASSETS_DIR/sys-user-partition"
+    
+    # use custom assertion if set
+    local AUTO_IMPORT_ASSERT
+    if [ -n "$NESTED_CUSTOM_AUTO_IMPORT_ASSERTION" ]; then
+        AUTO_IMPORT_ASSERT=$NESTED_CUSTOM_AUTO_IMPORT_ASSERTION
+    else
+        local per_model_auto
+        per_model_auto="$(nested_model_authority).auto-import.assert"
+        if [ -e "$TESTSLIB/assertions/${per_model_auto}" ]; then
+            AUTO_IMPORT_ASSERT="$TESTSLIB/assertions/${per_model_auto}"
+        else
+            AUTO_IMPORT_ASSERT="$TESTSLIB/assertions/auto-import.assert"
+        fi
+    fi
+    cp "$AUTO_IMPORT_ASSERT" "$NESTED_ASSETS_DIR/sys-user-partition/auto-import.assert"
+
+    # unmount the partition and the image disk
+    sudo umount "$NESTED_ASSETS_DIR/sys-user-partition"
+    sudo kpartx -d "$ASSERTIONS_DISK"
 }
 
-get_qemu_for_nested_vm(){
+nested_qemu_name() {
     case "${NESTED_ARCHITECTURE:-amd64}" in
     amd64)
         command -v qemu-system-x86_64
@@ -66,19 +174,20 @@
     esac
 }
 
-get_google_image_url_for_nested_vm(){
-    case "$SPREAD_SYSTEM" in
+# shellcheck disable=SC2120
+nested_get_google_image_url_for_vm() {
+    case "${1:-$SPREAD_SYSTEM}" in
         ubuntu-16.04-64)
-            echo "https://storage.googleapis.com/spread-snapd-tests/images/xenial-server-cloudimg-amd64-disk1.img"
+            echo "https://storage.googleapis.com/spread-snapd-tests/images/cloudimg/xenial-server-cloudimg-amd64-disk1.img"
             ;;
         ubuntu-18.04-64)
-            echo "https://storage.googleapis.com/spread-snapd-tests/images/bionic-server-cloudimg-amd64.img"
-            ;;
-        ubuntu-19.10-64)
-            echo "https://storage.googleapis.com/spread-snapd-tests/images/eoan-server-cloudimg-amd64.img"
+            echo "https://storage.googleapis.com/spread-snapd-tests/images/cloudimg/bionic-server-cloudimg-amd64.img"
             ;;
         ubuntu-20.04-64)
-            echo "https://storage.googleapis.com/spread-snapd-tests/images/focal-server-cloudimg-amd64.img"
+            echo "https://storage.googleapis.com/spread-snapd-tests/images/cloudimg/focal-server-cloudimg-amd64.img"
+            ;;
+        ubuntu-20.10-64*)
+            echo "https://storage.googleapis.com/spread-snapd-tests/images/cloudimg/groovy-server-cloudimg-amd64.img"
             ;;
         *)
             echo "unsupported system"
@@ -87,20 +196,21 @@
         esac
 }
 
-get_ubuntu_image_url_for_nested_vm(){
-    case "$SPREAD_SYSTEM" in
-        ubuntu-16.04-64)
+# shellcheck disable=SC2120
+nested_get_ubuntu_image_url_for_vm() {
+    case "${1:-$SPREAD_SYSTEM}" in
+        ubuntu-16.04-64*)
             echo "https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-amd64-disk1.img"
             ;;
-        ubuntu-18.04-64)
+        ubuntu-18.04-64*)
             echo "https://cloud-images.ubuntu.com/bionic/current/bionic-server-cloudimg-amd64.img"
             ;;
-        ubuntu-19.10-64)
-            echo "https://cloud-images.ubuntu.com/eoan/current/eoan-server-cloudimg-amd64.img"
-            ;;
-        ubuntu-20.04-64)
+        ubuntu-20.04-64*)
             echo "https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img"
             ;;
+        ubuntu-20.10-64*)
+            echo "https://cloud-images.ubuntu.com/groovy/current/groovy-server-cloudimg-amd64.img"
+            ;;
         *)
             echo "unsupported system"
             exit 1
@@ -108,174 +218,436 @@
         esac
 }
 
-get_image_url_for_nested_vm(){
+# shellcheck disable=SC2120
+nested_get_image_url_for_vm() {
     if [[ "$SPREAD_BACKEND" == google* ]]; then
-        get_google_image_url_for_nested_vm
+        nested_get_google_image_url_for_vm "$@"
     else
-        get_ubuntu_image_url_for_nested_vm
+        nested_get_ubuntu_image_url_for_vm "$@"
     fi
 }
 
-is_core_nested_system(){
-    if [ -z "$NESTED_TYPE" ]; then
-        echo "Variable NESTED_TYPE not defined. Exiting..."
-        exit 1
+nested_get_cdimage_current_image_url() {
+    local VERSION=$1
+    local CHANNEL=$2
+    local ARCH=$3
+
+    echo "http://cdimage.ubuntu.com/ubuntu-core/$VERSION/$CHANNEL/current/ubuntu-core-$VERSION-$ARCH.img.xz"
+}
+
+nested_get_snap_rev_for_channel() {
+    local SNAP=$1
+    local CHANNEL=$2
+    # This should be executed on remote system but as nested architecture is the same than the
+    # host then the snap info is executed in the host
+    snap info "$SNAP" | grep "$CHANNEL" | awk '{ print $4 }' | sed 's/.*(\(.*\))/\1/' | tr -d '\n'
+}
+
+nested_is_nested_system() {
+    if nested_is_core_system || nested_is_classic_system ; then
+        return 0
+    else 
+        return 1
     fi
-
-    test "$NESTED_TYPE" = "core"
 }
 
-is_classic_nested_system(){
-    if [ -z "$NESTED_TYPE" ]; then
-        echo "Variable NESTED_TYPE not defined. Exiting..."
-        exit 1
+nested_is_core_system() {
+    if [ -z "${NESTED_TYPE:-}" ]; then
+        echo "Variable NESTED_TYPE not defined."
+        return 1
     fi
 
-    test "$NESTED_TYPE" = "classic"
-}
-
-is_focal_system(){
-    test "$(lsb_release -cs)" = focal
+    test "$NESTED_TYPE" = "core"
 }
 
-is_core_20_nested_system(){
-    is_focal_system
-}
+nested_is_classic_system() {
+    if [ -z "${NESTED_TYPE:-}" ]; then
+        echo "Variable NESTED_TYPE not defined."
+        return 1
+    fi
 
-is_bionic_system(){
-    test "$(lsb_release -cs)" = bionic
+    test "$NESTED_TYPE" = "classic"
 }
 
-is_core_18_nested_system(){
-    is_bionic_system
+nested_is_core_20_system() {
+    os.query is-focal
 }
 
-is_xenial_system(){
-    test "$(lsb_release -cs)" = xenial
+nested_is_core_18_system() {
+    os.query is-bionic
 }
 
-is_core_16_nested_system(){
-    is_xenial_system
+nested_is_core_16_system() {
+    os.query is-xenial
 }
 
-refresh_to_new_core(){
+nested_refresh_to_new_core() {
     local NEW_CHANNEL=$1
+    local CHANGE_ID
     if [ "$NEW_CHANNEL" = "" ]; then
         echo "Channel to refresh is not defined."
         exit 1
     else
         echo "Refreshing the core/snapd snap"
-        if is_classic_nested_system; then
-            execute_remote "sudo snap refresh core --${NEW_CHANNEL}"
-            execute_remote "snap info core" | grep -E "^tracking: +latest/${NEW_CHANNEL}"
+        if nested_is_classic_nested_system; then
+            nested_exec "sudo snap refresh core --${NEW_CHANNEL}"
+            nested_exec "snap info core" | grep -E "^tracking: +latest/${NEW_CHANNEL}"
         fi
 
-        if is_core_18_nested_system || is_core_20_nested_system; then
-            execute_remote "sudo snap refresh snapd --${NEW_CHANNEL}"
-            execute_remote "snap info snapd" | grep -E "^tracking: +latest/${NEW_CHANNEL}"
+        if nested_is_core_18_system || nested_is_core_20_system; then
+            nested_exec "sudo snap refresh snapd --${NEW_CHANNEL}"
+            nested_exec "snap info snapd" | grep -E "^tracking: +latest/${NEW_CHANNEL}"
         else
-            execute_remote "sudo snap refresh core --${NEW_CHANNEL}"
-            wait_for_no_ssh
-            wait_for_ssh
-            execute_remote "snap info core" | grep -E "^tracking: +latest/${NEW_CHANNEL}"
+            CHANGE_ID=$(nested_exec "sudo snap refresh core --${NEW_CHANNEL} --no-wait")
+            nested_wait_for_no_ssh
+            nested_wait_for_ssh
+            # wait for the refresh to be done before checking, if we check too
+            # quickly then operations on the core snap like reverting, etc. may
+            # fail because it will have refresh-snap change in progress
+            nested_exec "snap watch $CHANGE_ID"
+            nested_exec "snap info core" | grep -E "^tracking: +latest/${NEW_CHANNEL}"
         fi
     fi
 }
 
-cleanup_nested_env(){
-    rm -rf "$WORK_DIR"
+nested_get_snakeoil_key() {
+    local KEYNAME="PkKek-1-snakeoil"
+    wget https://raw.githubusercontent.com/snapcore/pc-amd64-gadget/20/snakeoil/$KEYNAME.key
+    wget https://raw.githubusercontent.com/snapcore/pc-amd64-gadget/20/snakeoil/$KEYNAME.pem
+    echo "$KEYNAME"
+}
+
+nested_secboot_sign_file() {
+    local FILE="$1"
+    local KEY="$2"
+    local CERT="$3"
+    sbattach --remove "$FILE"
+    sbsign --key "$KEY" --cert "$CERT" --output "$FILE" "$FILE"
+}
+
+nested_secboot_sign_gadget() {
+    local GADGET_DIR="$1"
+    local KEY="$2"
+    local CERT="$3"
+    nested_secboot_sign_file "$GADGET_DIR/shim.efi.signed" "$KEY" "$CERT"
+}
+
+nested_prepare_env() {
+    mkdir -p "$NESTED_IMAGES_DIR"
+    mkdir -p "$NESTED_RUNTIME_DIR"
+    mkdir -p "$NESTED_ASSETS_DIR"
+    mkdir -p "$NESTED_LOGS_DIR"
+}
+
+nested_cleanup_env() {
+    rm -rf "$NESTED_RUNTIME_DIR"
+    rm -rf "$NESTED_ASSETS_DIR"
+    rm -rf "$NESTED_LOGS_DIR"
+    rm -rf "$NESTED_IMAGES_DIR"/*.img
+    rm -rf "$(nested_get_extra_snaps_path)"
+}
+
+nested_get_image_name() {
+    local TYPE="$1"
+    local SOURCE="${NESTED_CORE_CHANNEL}"
+    local NAME="${NESTED_IMAGE_ID:-generic}"
+    local VERSION="16"
+
+    if nested_is_core_20_system; then
+        VERSION="20"
+    elif nested_is_core_18_system; then
+        VERSION="18"
+    fi
+
+    if [ "$NESTED_BUILD_SNAPD_FROM_CURRENT" = "true" ]; then
+        SOURCE="custom"
+    fi
+    if [ "$(nested_get_extra_snaps | wc -l)" != "0" ]; then
+        SOURCE="custom"
+    fi
+    echo "ubuntu-${TYPE}-${VERSION}-${SOURCE}-${NAME}.img"
+}
+
+nested_is_generic_image() {
+    test -z "${NESTED_IMAGE_ID:-}"
 }
 
-create_nested_core_vm(){
-    mkdir -p "$WORK_DIR/image"
-    if [ ! -f "$WORK_DIR/image/ubuntu-core.img" ]; then
-        local UBUNTU_IMAGE
-        UBUNTU_IMAGE=/snap/bin/ubuntu-image
+nested_get_extra_snaps_path() {
+    echo "${PWD}/extra-snaps"
+}
 
-        # create ubuntu-core image
-        local EXTRA_FUNDAMENTAL=""
-        local EXTRA_SNAPS=""
-        if [ -d "${PWD}/extra-snaps" ]; then
-            while IFS= read -r mysnap; do
-                EXTRA_SNAPS="$EXTRA_SNAPS --snap $mysnap"
-            done <   <(find extra-snaps -name '*.snap')
-        fi
+nested_get_extra_snaps() {
+    local EXTRA_SNAPS=""
+    local EXTRA_SNAPS_PATH
+    EXTRA_SNAPS_PATH="$(nested_get_extra_snaps_path)"
 
-        local NESTED_MODEL=""
-        case "$SPREAD_SYSTEM" in
+    if [ -d "$EXTRA_SNAPS_PATH" ]; then
+        while IFS= read -r mysnap; do
+            echo "$mysnap"
+        done < <(find "$EXTRA_SNAPS_PATH" -name '*.snap')
+    fi
+}
+
+nested_download_image() {
+    local IMAGE_URL=$1
+    local IMAGE_NAME=$2
+
+    curl -L -o "${NESTED_IMAGES_DIR}/${IMAGE_NAME}" "$IMAGE_URL"
+
+    if [[ "$IMAGE_URL" == *.img.xz ]]; then
+        mv "${NESTED_IMAGES_DIR}/${IMAGE_NAME}" "${NESTED_IMAGES_DIR}/${IMAGE_NAME}.xz"
+        unxz "${NESTED_IMAGES_DIR}/${IMAGE_NAME}.xz"
+    elif [[ "$IMAGE_URL" == *.img ]]; then
+        echo "Image doesn't need to be decompressed"
+    else
+        echo "Image extension not supported for image $IMAGE_URL, exiting..."
+        exit 1
+    fi
+}
+
+nested_get_model() {
+    # use custom model if defined
+    if [ -n "$NESTED_CUSTOM_MODEL" ]; then
+        echo "$NESTED_CUSTOM_MODEL"
+        return
+    fi
+    case "$SPREAD_SYSTEM" in
         ubuntu-16.04-64)
-            NESTED_MODEL="$TESTSLIB/assertions/nested-amd64.model"
+            echo "$TESTSLIB/assertions/nested-amd64.model"
             ;;
         ubuntu-18.04-64)
-            NESTED_MODEL="$TESTSLIB/assertions/nested-18-amd64.model"
+            echo "$TESTSLIB/assertions/nested-18-amd64.model"
             ;;
         ubuntu-20.04-64)
-            NESTED_MODEL="$TESTSLIB/assertions/nested-20-amd64.model"
-
-            # shellcheck source=tests/lib/prepare.sh
-            . "$TESTSLIB"/prepare.sh
-            snap download --basename=pc-kernel --channel="20/edge" pc-kernel
-            uc20_build_initramfs_kernel_snap "$PWD/pc-kernel.snap" "$WORK_DIR/image"
-
-            EXTRA_FUNDAMENTAL="--snap $WORK_DIR/image/pc-kernel_*.snap"
-            chmod 0600 "$WORK_DIR"/image/pc-kernel_*.snap
-            rm -f "$PWD/pc-kernel.snap"
+            echo "$TESTSLIB/assertions/nested-20-amd64.model"
             ;;
         *)
             echo "unsupported system"
             exit 1
             ;;
-        esac
+    esac
+}
+
+nested_model_authority() {
+    local model
+    model="$(nested_get_model)"
+    grep "authority-id:" "$model"|cut -d ' ' -f2
+}
 
-        if [ "$BUILD_FROM_CURRENT" = "true" ]; then
-            if is_core_16_nested_system; then
-                echo "Build from current branch is not supported yet for uc16"
-                exit 1
+nested_ensure_ubuntu_save() {
+    local GADGET_DIR="$1"
+    "$TESTSLIB"/ensure_ubuntu_save.py "$GADGET_DIR"/meta/gadget.yaml > /tmp/gadget-with-save.yaml
+    if [ "$(cat /tmp/gadget-with-save.yaml)" != "" ]; then
+        mv /tmp/gadget-with-save.yaml "$GADGET_DIR"/meta/gadget.yaml
+    else
+        rm -f /tmp/gadget-with-save.yaml
+    fi
+}
+
+nested_create_core_vm() {
+    # shellcheck source=tests/lib/prepare.sh
+    . "$TESTSLIB"/prepare.sh
+    # shellcheck source=tests/lib/snaps.sh
+    . "$TESTSLIB"/snaps.sh
+
+    local IMAGE_NAME
+    IMAGE_NAME="$(nested_get_image_name core)"
+
+    mkdir -p "$NESTED_IMAGES_DIR"
+
+    if [ -f "$NESTED_IMAGES_DIR/$IMAGE_NAME".xz ]; then
+        nested_uncompress_image "$IMAGE_NAME"
+    elif [ ! -f "$NESTED_IMAGES_DIR/$IMAGE_NAME" ]; then
+
+        if [ -n "$NESTED_CUSTOM_IMAGE_URL" ]; then
+            # download the ubuntu-core image from $CUSTOM_IMAGE_URL
+            nested_download_image "$NESTED_CUSTOM_IMAGE_URL" "$IMAGE_NAME"
+        else
+            # create the ubuntu-core image
+            local UBUNTU_IMAGE=/snap/bin/ubuntu-image
+            local EXTRA_FUNDAMENTAL=""
+            local EXTRA_SNAPS=""
+            for mysnap in $(nested_get_extra_snaps); do
+                EXTRA_SNAPS="$EXTRA_SNAPS --snap $mysnap"
+            done
+
+            if [ "$NESTED_BUILD_SNAPD_FROM_CURRENT" = "true" ]; then
+                if nested_is_core_16_system; then
+                    repack_snapd_deb_into_core_snap "$NESTED_ASSETS_DIR"
+                    EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $NESTED_ASSETS_DIR/core-from-snapd-deb.snap"
+
+                elif nested_is_core_18_system; then
+                    repack_snapd_deb_into_snapd_snap "$NESTED_ASSETS_DIR"
+                    EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $NESTED_ASSETS_DIR/snapd-from-deb.snap"
+
+                    snap download --channel="$CORE_CHANNEL" --basename=core18 core18
+                    repack_core_snap_with_tweaks "core18.snap" "new-core18.snap"
+                    EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $PWD/new-core18.snap"
+
+                    repack_core_snap_with_tweaks "core18.snap" "new-core18.snap"
+
+                    if [ "$NESTED_SIGN_SNAPS_FAKESTORE" = "true" ]; then
+                        make_snap_installable_with_id "$NESTED_FAKESTORE_BLOB_DIR" "$PWD/new-core18.snap" "CSO04Jhav2yK0uz97cr0ipQRyqg0qQL6"
+                    fi
+
+                elif nested_is_core_20_system; then
+                    snap download --basename=pc-kernel --channel="20/edge" pc-kernel
+                    uc20_build_initramfs_kernel_snap "$PWD/pc-kernel.snap" "$NESTED_ASSETS_DIR"
+                    rm -f "$PWD/pc-kernel.snap"
+
+                    # Prepare the pc kernel snap
+                    KERNEL_SNAP=$(ls "$NESTED_ASSETS_DIR"/pc-kernel_*.snap)
+
+                    chmod 0600 "$KERNEL_SNAP"
+                    EXTRA_FUNDAMENTAL="--snap $KERNEL_SNAP"
+
+                    # sign the pc-kernel snap with fakestore if requested
+                    if [ "$NESTED_SIGN_SNAPS_FAKESTORE" = "true" ]; then
+                        make_snap_installable_with_id "$NESTED_FAKESTORE_BLOB_DIR" "$KERNEL_SNAP" "pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza"
+                    fi
+
+                    # Prepare the pc gadget snap (unless provided by extra-snaps)
+                    local GADGET_SNAP
+                    GADGET_SNAP=""
+                    if [ -d "$(nested_get_extra_snaps_path)" ]; then
+                        GADGET_SNAP=$(find extra-snaps -name 'pc_*.snap')
+                    fi
+                    # XXX: deal with [ "$NESTED_ENABLE_SECURE_BOOT" != "true" ] && [ "$NESTED_ENABLE_TPM" != "true" ]
+                    if [ -z "$GADGET_SNAP" ]; then
+                        # Get the snakeoil key and cert
+                        local KEY_NAME SNAKEOIL_KEY SNAKEOIL_CERT
+                        KEY_NAME=$(nested_get_snakeoil_key)
+                        SNAKEOIL_KEY="$PWD/$KEY_NAME.key"
+                        SNAKEOIL_CERT="$PWD/$KEY_NAME.pem"
+
+                        snap download --basename=pc --channel="20/edge" pc
+                        unsquashfs -d pc-gadget pc.snap
+                        nested_secboot_sign_gadget pc-gadget "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+                        # TODO:UC20: until https://github.com/snapcore/pc-amd64-gadget/pull/51/
+                        # lands there is no ubuntu-save in the gadget, make sure we have one
+                        nested_ensure_ubuntu_save pc-gadget
+
+                        # also make logging persistent for easier debugging of 
+                        # test failures, otherwise we have no way to see what 
+                        # happened during a failed nested VM boot where we 
+                        # weren't able to login to a device
+                        cat >> pc-gadget/meta/gadget.yaml << EOF
+defaults:
+  system:
+    journal:
+      persistent: true
+EOF
+                        snap pack pc-gadget/ "$NESTED_ASSETS_DIR"
+
+                        GADGET_SNAP=$(ls "$NESTED_ASSETS_DIR"/pc_*.snap)
+                        rm -f "$PWD/pc.snap" "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+                        EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $GADGET_SNAP"
+                    fi
+                    # sign the pc gadget snap with fakestore if requested
+                    if [ "$NESTED_SIGN_SNAPS_FAKESTORE" = "true" ]; then
+                        make_snap_installable_with_id "$NESTED_FAKESTORE_BLOB_DIR" "$GADGET_SNAP" "UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH"
+                    fi
+
+                    # repack the snapd snap
+                    snap download --channel="latest/edge" snapd
+                    repack_snapd_deb_into_snapd_snap "$PWD"
+                    EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $PWD/snapd-from-deb.snap"
+
+                    # sign the snapd snap with fakestore if requested
+                    if [ "$NESTED_SIGN_SNAPS_FAKESTORE" = "true" ]; then
+                        make_snap_installable_with_id "$NESTED_FAKESTORE_BLOB_DIR" "$PWD/snapd-from-deb.snap" "PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4"
+                    fi
+
+                    # which channel?
+                    snap download --channel="$CORE_CHANNEL" --basename=core20 core20
+                    repack_core_snap_with_tweaks "core20.snap" "new-core20.snap"
+                    EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $PWD/new-core20.snap"
+
+                    # sign the snapd snap with fakestore if requested
+                    if [ "$NESTED_SIGN_SNAPS_FAKESTORE" = "true" ]; then
+                        make_snap_installable_with_id "$NESTED_FAKESTORE_BLOB_DIR" "$PWD/new-core20.snap" "DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q"
+                    fi
+
+                else
+                    echo "unknown nested core system (host is $(lsb_release -cs) )"
+                    exit 1
+                fi
             fi
-            # shellcheck source=tests/lib/prepare.sh
-            . "$TESTSLIB"/prepare.sh
-            snap download --channel="latest/edge" snapd
-            repack_snapd_snap_with_deb_content_and_run_mode_firstboot_tweaks "$PWD/new-snapd" "false"
-            EXTRA_FUNDAMENTAL="$EXTRA_FUNDAMENTAL --snap $PWD/new-snapd/snapd_*.snap"
-        fi
-
-        "$UBUNTU_IMAGE" --image-size 10G "$NESTED_MODEL" \
-            --channel "$CORE_CHANNEL" \
-            --output "$WORK_DIR/image/ubuntu-core.img" \
-            "$EXTRA_FUNDAMENTAL" \
-            "$EXTRA_SNAPS"
-
-        if [ "$USE_CLOUD_INIT" = "true" ]; then
-            if is_core_20_nested_system; then
-                configure_cloud_init_nested_core_vm_uc20
-            else
-                configure_cloud_init_nested_core_vm
+
+            # Invoke ubuntu image
+            local NESTED_MODEL
+            NESTED_MODEL="$(nested_get_model)"
+            
+            # only set SNAPPY_FORCE_SAS_URL because we don't need it defined 
+            # anywhere else but here, where snap prepare-image as called by 
+            # ubuntu-image will look for assertions for the snaps we provide
+            # to it
+            SNAPPY_FORCE_SAS_URL="$NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL"
+            export SNAPPY_FORCE_SAS_URL
+            UBUNTU_IMAGE_SNAP_CMD=/usr/bin/snap
+            export UBUNTU_IMAGE_SNAP_CMD
+            if [ -n "$NESTED_CORE_CHANNEL" ]; then
+                UBUNTU_IMAGE_CHANNEL_ARG="--channel $NESTED_CORE_CHANNEL"
+            else 
+                UBUNTU_IMAGE_CHANNEL_ARG=""
             fi
-        else
-            create_assertions_disk
+            "$UBUNTU_IMAGE" snap --image-size 10G "$NESTED_MODEL" \
+                "$UBUNTU_IMAGE_CHANNEL_ARG" \
+                --output "$NESTED_IMAGES_DIR/$IMAGE_NAME" \
+                "$EXTRA_FUNDAMENTAL" \
+                "$EXTRA_SNAPS"
+            unset SNAPPY_FORCE_SAS_URL
+            unset UBUNTU_IMAGE_SNAP_CMD
         fi
     fi
-}
 
-configure_cloud_init_nested_core_vm(){
-    create_cloud_init_data "$WORK_DIR/user-data" "$WORK_DIR/meta-data"
+    # Configure the user for the vm
+    if [ "$NESTED_USE_CLOUD_INIT" = "true" ]; then
+        if nested_is_core_20_system; then
+            nested_configure_cloud_init_on_core20_vm "$NESTED_IMAGES_DIR/$IMAGE_NAME"
+        else
+            nested_configure_cloud_init_on_core_vm "$NESTED_IMAGES_DIR/$IMAGE_NAME"
+        fi
+    else
+        nested_create_assertions_disk
+    fi
 
-    loops=$(kpartx -avs "$WORK_DIR/image/ubuntu-core.img"  | cut -d' ' -f 3)
-    part=$(echo "$loops" | tail -1)
+    # Save a compressed copy of the image
+    # TODO: analyze if it is better to compress just when the image is generic
+    nested_compress_image "$IMAGE_NAME"
+}
+
+nested_configure_cloud_init_on_core_vm() {
+    local IMAGE=$1
+    nested_create_cloud_init_data "$NESTED_ASSETS_DIR/user-data" "$NESTED_ASSETS_DIR/meta-data"
+
+    local devloop writableDev tmp
+    # mount the image and find the loop device /dev/loop that is created for it
+    kpartx -avs "$IMAGE"
+    devloop=$(losetup --list --noheadings | grep "$IMAGE" | awk '{print $1}')
+    dev=$(basename "$devloop")
+    
+    # we add cloud-init data to the 3rd partition, which is writable
+    writableDev="/dev/mapper/${dev}p3"
+    
+    # wait for the loop device to show up
+    retry -n 3 --wait 1 test -e "$writableDev"
     tmp=$(mktemp -d)
-    mount "/dev/mapper/$part" "$tmp"
+    mount "$writableDev" "$tmp"
 
+    # use nocloud-net for the dir to copy data into
     mkdir -p "$tmp/system-data/var/lib/cloud/seed/nocloud-net/"
-    cp "$WORK_DIR/user-data" "$tmp/system-data/var/lib/cloud/seed/nocloud-net/"
-    cp "$WORK_DIR/meta-data" "$tmp/system-data/var/lib/cloud/seed/nocloud-net/"
+    cp "$NESTED_ASSETS_DIR/user-data" "$tmp/system-data/var/lib/cloud/seed/nocloud-net/"
+    cp "$NESTED_ASSETS_DIR/meta-data" "$tmp/system-data/var/lib/cloud/seed/nocloud-net/"
 
+    sync
     umount "$tmp"
-    kpartx -d "$WORK_DIR/image/ubuntu-core.img"
+    kpartx -d "$IMAGE"
 }
 
-create_cloud_init_data(){
-    USER_DATA=$1
-    META_DATA=$2
+nested_create_cloud_init_data() {
+    local USER_DATA=$1
+    local META_DATA=$2
     cat <<EOF > "$USER_DATA"
 #cloud-config
   ssh_pwauth: True
@@ -294,8 +666,10 @@
 EOF
 }
 
-create_cloud_init_config(){
-    CONFIG_PATH=$1
+# TODO: see if the uc20 config works for classic here too, that would be faster
+#       as the chpasswd module from cloud-init runs rather late in the boot
+nested_create_cloud_init_config() {
+    local CONFIG_PATH=$1
     cat <<EOF > "$CONFIG_PATH"
 #cloud-config
   ssh_pwauth: True
@@ -307,154 +681,446 @@
    list: |
     user1:ubuntu
    expire: False
-  datasource_list: [ "None"]
+  datasource_list: [ NoCloud ]
   datasource:
-    None:
+    NoCloud:
      userdata_raw: |
       #!/bin/bash
-      echo test
+      logger -t nested test running || true
 EOF
 }
 
-configure_cloud_init_nested_core_vm_uc20(){
-    create_cloud_init_config "$WORK_DIR/data.cfg"
+nested_create_cloud_init_uc20_config() {
+    local CONFIG_PATH=$1
+    cat << 'EOF' > "$CONFIG_PATH"
+#cloud-config
+datasource_list: [NoCloud]
+users:
+  - name: user1
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    lock_passwd: false
+    # passwd is just "ubuntu"
+    passwd: "$6$rounds=4096$PCrfo.ggdf4ubP$REjyaoY2tUWH2vjFJjvLs3rDxVTszGR9P7mhH9sHb2MsELfc53uV/v15jDDOJU/9WInfjjTKJPlD5URhX5Mix0"
+EOF
+}
 
-    loop=$(kpartx -avs "$WORK_DIR/image/ubuntu-core.img" | sed -n 2p | awk '{print $3}')
+nested_configure_cloud_init_on_core20_vm() {
+    local IMAGE=$1
+    nested_create_cloud_init_uc20_config "$NESTED_ASSETS_DIR/data.cfg"
+
+    local devloop dev ubuntuSeedDev tmp
+    # mount the image and find the loop device /dev/loop that is created for it
+    kpartx -avs "$IMAGE"
+    devloop=$(losetup --list --noheadings | grep "$IMAGE" | awk '{print $1}')
+    dev=$(basename "$devloop")
+    
+    # we add cloud-init data to the 2nd partition, which is ubuntu-seed
+    ubuntuSeedDev="/dev/mapper/${dev}p2"
+    
+    # wait for the loop device to show up
+    retry -n 3 --wait 1 test -e "$ubuntuSeedDev"
     tmp=$(mktemp -d)
-
-    mount "/dev/mapper/$loop" "$tmp"
+    mount "$ubuntuSeedDev" "$tmp"
     mkdir -p "$tmp/data/etc/cloud/cloud.cfg.d/"
-    cp -f "$WORK_DIR/data.cfg" "$tmp/data/etc/cloud/cloud.cfg.d/"
+    cp -f "$NESTED_ASSETS_DIR/data.cfg" "$tmp/data/etc/cloud/cloud.cfg.d/"
+    sync
     umount "$tmp"
+    kpartx -d "$IMAGE"
+}
+
+nested_save_serial_log() {
+    if [ -f "${NESTED_LOGS_DIR}/serial.log" ]; then
+        for i in $(seq 1 9); do
+            if [ ! -f "${NESTED_LOGS_DIR}/serial.log.${i}" ]; then
+                cp "${NESTED_LOGS_DIR}/serial.log" "${NESTED_LOGS_DIR}/serial.log.${i}"
+                break
+            fi
+        done
+        # make sure we start with clean log file
+        echo > "${NESTED_LOGS_DIR}/serial.log"
+    fi
+}
+
+nested_print_serial_log() {
+    if [ -f "${NESTED_LOGS_DIR}/serial.log.1" ]; then
+        # here we disable SC2045 because previously it is checked there is at least
+        # 1 file which matches. In this case ls command is needed because it is important
+        # to get the list in reverse order.
+        # shellcheck disable=SC2045
+        for logfile in $(ls "${NESTED_LOGS_DIR}"/serial.log.*); do
+            cat "$logfile"
+        done
+    fi
+    if [ -f "${NESTED_LOGS_DIR}/serial.log" ]; then
+        cat "${NESTED_LOGS_DIR}/serial.log"
+    fi
+}
+
+nested_force_stop_vm() {
+    systemctl stop nested-vm
+}
+
+nested_force_start_vm() {
+    # if the nested-vm is using a swtpm, we need to wait until the file exists
+    # because the file disappears temporarily after qemu exits
+    if systemctl show nested-vm -p ExecStart | grep -q swtpm-mvo; then
+        retry -n 10 --wait 1 test -S /var/snap/swtpm-mvo/current/swtpm-sock
+    fi
+    systemctl start nested-vm
 }
 
-start_nested_core_vm(){
-    local IMAGE QEMU
-    QEMU=$(get_qemu_for_nested_vm)
-    # As core18 systems use to fail to start the assetion disk when using the
-    # snapshot feature, we copy the original image and use that copy to start
-    # the VM.
-    IMAGE_FILE="$WORK_DIR/image/ubuntu-core-new.img"
-    cp -f "$WORK_DIR/image/ubuntu-core.img" "$IMAGE_FILE"
+nested_start_core_vm_unit() {
+    local QEMU CURRENT_IMAGE
+    CURRENT_IMAGE=$1
+    QEMU=$(nested_qemu_name)
 
     # Now qemu parameters are defined
-    # Increase the number of cpus used once the issue related to kvm and ovmf is fixed
-    # https://bugs.launchpad.net/ubuntu/+source/kvm/+bug/1872803
-    PARAM_CPU="-smp 1"
-    PARAM_MEM="-m 4096"
+
+    # use only 2G of RAM for qemu-nested
+    # the caller can override PARAM_MEM
+    local PARAM_MEM PARAM_SMP
+    if [ "$SPREAD_BACKEND" = "google-nested" ]; then
+        PARAM_MEM="${NESTED_PARAM_MEM:--m 4096}"
+        PARAM_SMP="-smp 2"
+    elif [ "$SPREAD_BACKEND" = "qemu-nested" ]; then
+        PARAM_MEM="${NESTED_PARAM_MEM:--m 2048}"
+        PARAM_SMP="-smp 1"
+    else
+        echo "unknown spread backend $SPREAD_BACKEND"
+        exit 1
+    fi
+
+    local PARAM_DISPLAY PARAM_NETWORK PARAM_MONITOR PARAM_USB PARAM_CD PARAM_RANDOM PARAM_CPU PARAM_TRACE PARAM_LOG PARAM_SERIAL
     PARAM_DISPLAY="-nographic"
-    PARAM_NETWORK="-net nic,model=virtio -net user,hostfwd=tcp::$SSH_PORT-:22"
-    PARAM_MONITOR="-monitor tcp:127.0.0.1:$MON_PORT,server,nowait -usb"
-    PARAM_MACHINE="-machine ubuntu,accel=kvm"
+    PARAM_NETWORK="-net nic,model=virtio -net user,hostfwd=tcp::$NESTED_SSH_PORT-:22"
+    PARAM_MONITOR="-monitor tcp:127.0.0.1:$NESTED_MON_PORT,server,nowait"
+    PARAM_USB="-usb"
+    PARAM_CD="${NESTED_PARAM_CD:-}"
+    PARAM_RANDOM="-object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0"
+    PARAM_CPU=""
+    PARAM_TRACE="-d cpu_reset"
+    PARAM_LOG="-D $NESTED_LOGS_DIR/qemu.log"
+    # Open port 7777 on the host so that failures in the nested VM (e.g. to
+    # create users) can be debugged interactively via
+    # "telnet localhost 7777". Also keeps the logs
+    #
+    # XXX: should serial just be logged to stdout so that we just need
+    #      to "journalctl -u nested-vm" to see what is going on ?
+    if "$QEMU" -version | grep '2\.5'; then
+        # XXX: remove once we no longer support xenial hosts
+        PARAM_SERIAL="-serial file:${NESTED_LOGS_DIR}/serial.log"
+    else
+        PARAM_SERIAL="-chardev socket,telnet,host=localhost,server,port=7777,nowait,id=char0,logfile=${NESTED_LOGS_DIR}/serial.log,logappend=on -serial chardev:char0"
+    fi
+
+    # save logs from previous runs
+    nested_save_serial_log
+
+    # Set kvm attribute
+    local ATTR_KVM
+    ATTR_KVM=""
+    if [ "$NESTED_ENABLE_KVM" = "true" ]; then
+        ATTR_KVM=",accel=kvm"
+        # CPU can be defined just when kvm is enabled
+        PARAM_CPU="-cpu host"
+    fi
+
+    local PARAM_MACHINE
+    if [ "$SPREAD_BACKEND" = "google-nested" ]; then
+        PARAM_MACHINE="-machine ubuntu${ATTR_KVM}"
+    elif [ "$SPREAD_BACKEND" = "qemu-nested" ]; then
+        # check if we have nested kvm
+        if [ "$(cat /sys/module/kvm_*/parameters/nested)" = "1" ]; then
+            PARAM_MACHINE="-machine ubuntu${ATTR_KVM}"
+        else
+            # and if not reset kvm related parameters
+            PARAM_MACHINE=""
+            PARAM_CPU=""
+            ATTR_KVM=""
+        fi
+    else
+        echo "unknown spread backend $SPREAD_BACKEND"
+        exit 1
+    fi
+    
+    local PARAM_ASSERTIONS PARAM_BIOS PARAM_TPM PARAM_IMAGE
     PARAM_ASSERTIONS=""
     PARAM_BIOS=""
     PARAM_TPM=""
-    if [ "$USE_CLOUD_INIT" != "true" ]; then
-        PARAM_ASSERTIONS="-drive file=$WORK_DIR/assertions.disk,cache=none,format=raw"
+    if [ "$NESTED_USE_CLOUD_INIT" != "true" ]; then
+        # TODO: fix using the old way of an ext4 formatted drive w/o partitions
+        #       as this used to work but has since regressed
+        
+        # this simulates a usb drive attached to the device, the removable=true
+        # is necessary otherwise snapd will not import it, as snapd only 
+        # considers removable devices for cold-plug first-boot runs
+        # the nec-usb-xhci device is necessary to create the bus we attach the
+        # storage to
+        PARAM_ASSERTIONS="-drive if=none,id=stick,format=raw,file=$NESTED_ASSETS_DIR/assertions.disk,cache=none,format=raw -device nec-usb-xhci,id=xhci -device usb-storage,bus=xhci.0,removable=true,drive=stick"
     fi
-    if is_core_20_nested_system; then
-        if ! is_focal_system; then
-            cp /etc/apt/sources.list /etc/apt/sources.list.back
-            echo "deb http://us-east1.gce.archive.ubuntu.com/ubuntu/ focal main restricted" >> /etc/apt/sources.list
-            apt update
-            apt install -y ovmf
-            mv /etc/apt/sources.list.back /etc/apt/sources.list
-            apt update
-        fi
-
-        if [ "$ENABLE_SECURE_BOOT" = "true" ]; then
-            cp -f /usr/share/OVMF/OVMF_VARS.snakeoil.fd "$WORK_DIR/image/OVMF_VARS.snakeoil.fd"
-            PARAM_BIOS="-drive file=/usr/share/OVMF/OVMF_CODE.secboot.fd,if=pflash,format=raw,unit=0,readonly=on -drive file=$WORK_DIR/image/OVMF_VARS.snakeoil.fd,if=pflash,format=raw,unit=1"
-            PARAM_MACHINE="-machine ubuntu-q35,accel=kvm -global ICH9-LPC.disable_s3=1 -global ICH9-LPC.disable_s4=1 -cpu host"
+    if nested_is_core_20_system; then
+        # use a bundle EFI bios by default
+        PARAM_BIOS="-bios /usr/share/ovmf/OVMF.fd"
+        local OVMF_CODE OVMF_VARS
+        OVMF_CODE="secboot"
+        OVMF_VARS="ms"
+        # In this case the kernel.efi is unsigned and signed with snaleoil certs
+        if [ "$NESTED_BUILD_SNAPD_FROM_CURRENT" = "true" ]; then
+            OVMF_VARS="snakeoil"
         fi
 
-        if [ "$ENABLE_TPM" = "true" ]; then
-            if ! snap list swtpm-mvo; then
+        if [ "${NESTED_ENABLE_OVMF:-}" = "true" ]; then
+            PARAM_BIOS="-bios /usr/share/OVMF/OVMF_CODE.fd"
+        fi
+        
+        if [ "$NESTED_ENABLE_SECURE_BOOT" = "true" ]; then
+            cp -f "/usr/share/OVMF/OVMF_VARS.$OVMF_VARS.fd" "$NESTED_ASSETS_DIR/OVMF_VARS.$OVMF_VARS.fd"
+            PARAM_BIOS="-drive file=/usr/share/OVMF/OVMF_CODE.$OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly -drive file=$NESTED_ASSETS_DIR/OVMF_VARS.$OVMF_VARS.fd,if=pflash,format=raw"
+            PARAM_MACHINE="-machine q35${ATTR_KVM} -global ICH9-LPC.disable_s3=1"
+        fi
+
+        if [ "$NESTED_ENABLE_TPM" = "true" ]; then
+            if snap list swtpm-mvo; then
+                # reset the tpm state
+                rm /var/snap/swtpm-mvo/current/tpm2-00.permall
+                snap restart swtpm-mvo
+            else
                 snap install swtpm-mvo --beta
             fi
+            # wait for the tpm sock file to exist
+            retry -n 10 --wait 1 test -S /var/snap/swtpm-mvo/current/swtpm-sock
             PARAM_TPM="-chardev socket,id=chrtpm,path=/var/snap/swtpm-mvo/current/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0"
         fi
-        PARAM_IMAGE="-drive file=$IMAGE_FILE,cache=none,format=raw,id=disk1,if=none -device virtio-blk-pci,drive=disk1,bootindex=1"
+        PARAM_IMAGE="-drive file=$CURRENT_IMAGE,cache=none,format=raw,id=disk1,if=none -device virtio-blk-pci,drive=disk1,bootindex=1"
     else
-        PARAM_IMAGE="-drive file=$IMAGE_FILE,cache=none,format=raw"
+        PARAM_IMAGE="-drive file=$CURRENT_IMAGE,cache=none,format=raw"
     fi
 
+    # ensure we have a log dir
+    mkdir -p "$NESTED_LOGS_DIR"
+    # make sure we start with clean log file
+    echo > "${NESTED_LOGS_DIR}/serial.log"
     # Systemd unit is created, it is important to respect the qemu parameters order
     systemd_create_and_start_unit "$NESTED_VM" "${QEMU} \
+        ${PARAM_SMP} \
         ${PARAM_CPU} \
         ${PARAM_MEM} \
+        ${PARAM_TRACE} \
+        ${PARAM_LOG} \
         ${PARAM_MACHINE} \
         ${PARAM_DISPLAY} \
         ${PARAM_NETWORK} \
         ${PARAM_BIOS} \
         ${PARAM_TPM} \
+        ${PARAM_RANDOM} \
         ${PARAM_IMAGE} \
         ${PARAM_ASSERTIONS} \
-        ${PARAM_MONITOR} "
+        ${PARAM_SERIAL} \
+        ${PARAM_MONITOR} \
+        ${PARAM_USB} \
+        ${PARAM_CD} "
+
+    # wait for the nested-vm service to appear active
+    wait_for_service "$NESTED_VM"
+
+    # Wait until ssh is ready
+    nested_wait_for_ssh
+    # Wait for the snap command to be available
+    nested_wait_for_snap_command
+    # Wait for snap seeding to be done
+    nested_exec "sudo snap wait system seed.loaded"
+    # Wait for cloud init to be done
+    nested_exec "cloud-init status --wait"
+}
+
+nested_get_current_image_name() {
+    echo "ubuntu-core-current.img"
+}
+
+nested_start_core_vm() {
+    local CURRENT_IMAGE CURRENT_NAME
+    CURRENT_NAME="$(nested_get_current_image_name)"
+    CURRENT_IMAGE="$NESTED_IMAGES_DIR/$CURRENT_NAME"
+
+    # In case the current image already exists, it needs to be reused and in that
+    # case is neither required to copy the base image nor prepare the ssh
+    if [ ! -f "$CURRENT_IMAGE" ]; then
+        # As core18 systems use to fail to start the assertion disk when using the
+        # snapshot feature, we copy the original image and use that copy to start
+        # the VM.
+        # Some tests however need to force stop and restart the VM with different
+        # options, so if that env var is set, we will reuse the existing file if it
+        # exists
+        local IMAGE_NAME
+        IMAGE_NAME="$(nested_get_image_name core)"
+        if ! [ -f "$NESTED_IMAGES_DIR/$IMAGE_NAME.xz" ] && ! [ -f "$NESTED_IMAGES_DIR/$IMAGE_NAME" ]; then
+            echo "No image found to be started"
+            exit 1
+        fi
+
+        # First time the image is used $IMAGE_NAME exists so it is used, otherwise
+        # the saved image from previous run is uncompressed
+        if ! [ -f "$NESTED_IMAGES_DIR/$IMAGE_NAME" ]; then
+            nested_uncompress_image "$IMAGE_NAME"
+        fi
+        mv "$NESTED_IMAGES_DIR/$IMAGE_NAME" "$CURRENT_IMAGE"
+
+        # Start the nested core vm
+        nested_start_core_vm_unit "$CURRENT_IMAGE"
+
+        if [ ! -f "$NESTED_IMAGES_DIR/$IMAGE_NAME.xz.configured" ]; then
+            # configure ssh for first time
+            nested_prepare_ssh
+            sync
+
+            # compress the current image if it is a generic image
+            if nested_is_generic_image && [ "$NESTED_CONFIGURE_IMAGES" = "true" ]; then
+                # Stop the current image and compress it
+                nested_shutdown
+                nested_compress_image "$CURRENT_NAME"
+
+                # Save the image with the name of the original image
+                mv "${CURRENT_IMAGE}.xz" "$NESTED_IMAGES_DIR/$IMAGE_NAME.xz"
+                touch "$NESTED_IMAGES_DIR/$IMAGE_NAME.xz.configured"
 
-    # Wait until ssh is ready and configure ssh
-    if wait_for_ssh; then
-        prepare_ssh
+                # Start the current image again and wait until it is ready
+                nested_start
+            fi
+        fi
     else
-        echo "ssh not established, exiting..."
-        exit 1
+        # Start the nested core vm
+        nested_start_core_vm_unit "$CURRENT_IMAGE"
+    fi
+}
+
+nested_shutdown() {
+    # we sometimes have bugs in nested vm's where files that were successfully
+    # written become empty all of a sudden, so doing a sync here in the VM, and
+    # another one in the host when done probably helps to avoid that, and at
+    # least can't hurt anything
+    nested_exec "sync"
+    nested_exec "sudo shutdown now" || true
+    nested_wait_for_no_ssh
+    nested_force_stop_vm
+    wait_for_service "$NESTED_VM" inactive
+    sync
+}
+
+nested_start() {
+    nested_save_serial_log
+    nested_force_start_vm
+    wait_for_service "$NESTED_VM" active
+    nested_wait_for_ssh
+}
+
+nested_compress_image() {
+    local IMAGE_NAME=$1
+    if [ ! -f "$NESTED_IMAGES_DIR/$IMAGE_NAME".xz ]; then
+        xz -k0 "$NESTED_IMAGES_DIR/$IMAGE_NAME"
     fi
 }
 
-create_nested_classic_vm(){
-    mkdir -p "$WORK_DIR/image"
-    IMAGE=$(ls $WORK_DIR/image/*.img || true)
-    if [ -z "$IMAGE" ]; then
+nested_uncompress_image() {
+    local IMAGE_NAME=$1
+    unxz -kf "$NESTED_IMAGES_DIR/$IMAGE_NAME".xz
+}
+
+nested_create_classic_vm() {
+    local IMAGE_NAME
+    IMAGE_NAME="$(nested_get_image_name classic)"
+
+    mkdir -p "$NESTED_IMAGES_DIR"
+    if [ ! -f "$NESTED_IMAGES_DIR/$IMAGE_NAME" ]; then
         # Get the cloud image
         local IMAGE_URL
-        IMAGE_URL=$(get_image_url_for_nested_vm)
-        wget -P "$WORK_DIR/image" "$IMAGE_URL"
-        # Check the image
-        local IMAGE
-        IMAGE=$(ls $WORK_DIR/image/*.img)
-        test "$(echo "$IMAGE" | wc -l)" = "1"
+        IMAGE_URL="$(nested_get_image_url_for_vm)"
+        wget -P "$NESTED_IMAGES_DIR" "$IMAGE_URL"
+        nested_download_image "$IMAGE_URL" "$IMAGE_NAME"
 
         # Prepare the cloud-init configuration and configure image
-        create_cloud_init_config "$WORK_DIR/seed"
-        cloud-localds -H "$(hostname)" "$WORK_DIR/seed.img" "$WORK_DIR/seed"
+        nested_create_cloud_init_config "$NESTED_ASSETS_DIR/seed"
+        cloud-localds -H "$(hostname)" "$NESTED_ASSETS_DIR/seed.img" "$NESTED_ASSETS_DIR/seed"
     fi
-}
 
-get_nested_classic_image_path() {
-    ls $WORK_DIR/image/*.img
+    # Save a compressed copy of the image
+    nested_compress_image "$IMAGE_NAME"
 }
 
-start_nested_classic_vm(){
-    local IMAGE QEMU
-    IMAGE=$(ls $WORK_DIR/image/*.img)
-    QEMU=$(get_qemu_for_nested_vm)
+nested_start_classic_vm() {
+    local IMAGE QEMU IMAGE_NAME
+    QEMU="$(nested_qemu_name)"
+    IMAGE_NAME="$(nested_get_image_name classic)"
+
+    if [ ! -f "$NESTED_IMAGES_DIR/$IMAGE_NAME" ] && [ -f "$NESTED_IMAGES_DIR/$IMAGE_NAME.xz" ]; then
+        nested_uncompress_image "$IMAGE_NAME"
+    fi
 
     # Now qemu parameters are defined
-    PARAM_CPU="-smp 1"
-    PARAM_MEM="-m 4096"
+    local PARAM_SMP PARAM_MEM
+    PARAM_SMP="-smp 1"
+    # use only 2G of RAM for qemu-nested
+    if [ "$SPREAD_BACKEND" = "google-nested" ]; then
+        PARAM_MEM="${NESTED_PARAM_MEM:--m 4096}"
+    elif [ "$SPREAD_BACKEND" = "qemu-nested" ]; then
+        PARAM_MEM="${NESTED_PARAM_MEM:--m 2048}"
+    else
+        echo "unknown spread backend $SPREAD_BACKEND"
+        exit 1
+    fi
+    local PARAM_DISPLAY PARAM_NETWORK PARAM_MONITOR PARAM_USB PARAM_CPU PARAM_CD PARAM_RANDOM PARAM_SNAPSHOT
     PARAM_DISPLAY="-nographic"
-    PARAM_NETWORK="-net nic,model=virtio -net user,hostfwd=tcp::$SSH_PORT-:22"
-    PARAM_MONITOR="-monitor tcp:127.0.0.1:$MON_PORT,server,nowait -usb"
+    PARAM_NETWORK="-net nic,model=virtio -net user,hostfwd=tcp::$NESTED_SSH_PORT-:22"
+    PARAM_MONITOR="-monitor tcp:127.0.0.1:$NESTED_MON_PORT,server,nowait"
+    PARAM_USB="-usb"
+    PARAM_CPU=""
+    PARAM_CD="${NESTED_PARAM_CD:-}"
+    PARAM_RANDOM="-object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0"
     PARAM_SNAPSHOT="-snapshot"
-    PARAM_MACHINE="-machine ubuntu,accel=kvm"
-    PARAM_IMAGE="-drive file=$IMAGE,if=virtio"
-    PARAM_SEED="-drive file=$WORK_DIR/seed.img,if=virtio"
+
+    local PARAM_MACHINE PARAM_IMAGE PARAM_SEED PARAM_SERIAL PARAM_BIOS PARAM_TPM
+    if [ "$SPREAD_BACKEND" = "google-nested" ]; then
+        PARAM_MACHINE="-machine ubuntu,accel=kvm"
+        PARAM_CPU="-cpu host"
+    elif [ "$SPREAD_BACKEND" = "qemu-nested" ]; then
+        # check if we have nested kvm
+        if [ "$(cat /sys/module/kvm_*/parameters/nested)" = "1" ]; then
+            PARAM_MACHINE="-machine ubuntu${ATTR_KVM}"
+        else
+            # and if not reset kvm related parameters
+            PARAM_MACHINE=""
+            PARAM_CPU=""
+            ATTR_KVM=""
+        fi
+    else
+        echo "unknown spread backend $SPREAD_BACKEND"
+        exit 1
+    fi
+
+    PARAM_IMAGE="-drive file=$NESTED_IMAGES_DIR/$IMAGE_NAME,if=virtio"
+    PARAM_SEED="-drive file=$NESTED_ASSETS_DIR/seed.img,if=virtio"
+    # Open port 7777 on the host so that failures in the nested VM (e.g. to
+    # create users) can be debugged interactively via
+    # "telnet localhost 7777". Also keeps the logs
+    #
+    # XXX: should serial just be logged to stdout so that we just need
+    #      to "journalctl -u nested-vm" to see what is going on ?
+    if "$QEMU" -version | grep '2\.5'; then
+        # XXX: remove once we no longer support xenial hosts
+        PARAM_SERIAL="-serial file:${NESTED_LOGS_DIR}/serial.log"
+    else
+        PARAM_SERIAL="-chardev socket,telnet,host=localhost,server,port=7777,nowait,id=char0,logfile=${NESTED_LOGS_DIR}/serial.log,logappend=on -serial chardev:char0"
+    fi
     PARAM_BIOS=""
     PARAM_TPM=""
 
-    if [ "$ENABLE_TPM" = "true" ] && is_focal_system; then
-        if ! snap list swtpm-mvo; then
-            snap install swtpm-mvo --beta
-        fi
-        PARAM_TPM="-chardev socket,id=chrtpm,path=/var/snap/swtpm-mvo/current/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0"
-    fi
-    if [ "$ENABLE_SECURE_BOOT" = "true" ] && is_focal_system; then
-        cp -f /usr/share/OVMF/OVMF_VARS.snakeoil.fd "$WORK_DIR/image/OVMF_VARS.snakeoil.fd"
-        PARAM_BIOS="-drive file=/usr/share/OVMF/OVMF_CODE.secboot.fd,if=pflash,format=raw,unit=0,readonly=on -drive file=$WORK_DIR/image/OVMF_VARS.snakeoil.fd,if=pflash,format=raw,unit=1"
-        PARAM_MACHINE="-machine ubuntu-q35,accel=kvm -global ICH9-LPC.disable_s3=1 -global ICH9-LPC.disable_s4=1 -cpu host"
-    fi
+    # ensure we have a log dir
+    mkdir -p "$NESTED_LOGS_DIR"
+    # save logs from previous runs
+    nested_save_serial_log
 
+    # Systemd unit is created, it is important to respect the qemu parameters order
     systemd_create_and_start_unit "$NESTED_VM" "${QEMU}  \
+        ${PARAM_SMP} \
         ${PARAM_CPU} \
         ${PARAM_MEM} \
         ${PARAM_SNAPSHOT} \
@@ -463,56 +1129,100 @@
         ${PARAM_NETWORK} \
         ${PARAM_BIOS} \
         ${PARAM_TPM} \
+        ${PARAM_RANDOM} \
         ${PARAM_IMAGE} \
         ${PARAM_SEED} \
-        ${PARAM_MONITOR} "
-    wait_for_ssh
+        ${PARAM_SERIAL} \
+        ${PARAM_MONITOR} \
+        ${PARAM_USB} \
+        ${PARAM_CD} "
+
+    nested_wait_for_ssh
 }
 
-destroy_nested_vm(){
-    systemd_stop_and_destroy_unit "$NESTED_VM"
+nested_destroy_vm() {
+    systemd_stop_and_remove_unit "$NESTED_VM"
+
+    local CURRENT_IMAGE
+    CURRENT_IMAGE="$NESTED_IMAGES_DIR/$(nested_get_current_image_name)" 
+    rm -f "$CURRENT_IMAGE"
+}
+
+nested_exec() {
+    sshpass -p ubuntu ssh -p "$NESTED_SSH_PORT" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user1@localhost "$@"
+}
+
+nested_exec_as() {
+    local USER="$1"
+    local PASSWD="$2"
+    shift 2
+    sshpass -p "$PASSWD" ssh -p "$NESTED_SSH_PORT" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$USER"@localhost "$@"
 }
 
-execute_remote(){
-    sshpass -p ubuntu ssh -p "$SSH_PORT" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user1@localhost "$*"
+nested_copy() {
+    sshpass -p ubuntu scp -P "$NESTED_SSH_PORT" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@" user1@localhost:~
 }
 
-copy_remote(){
-    sshpass -p ubuntu scp -P "$SSH_PORT" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@" user1@localhost:~
+nested_copy_from_remote() {
+    sshpass -p ubuntu scp -P "$SSH_PORT" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user1@localhost:"$1" "$2"
 }
 
-add_tty_chardev(){
+nested_add_tty_chardev() {
     local CHARDEV_ID=$1
     local CHARDEV_PATH=$2
-    echo "chardev-add file,path=$CHARDEV_PATH,id=$CHARDEV_ID" | nc -q 0 127.0.0.1 "$MON_PORT"
+    echo "chardev-add file,path=$CHARDEV_PATH,id=$CHARDEV_ID" | nc -q 0 127.0.0.1 "$NESTED_MON_PORT"
     echo "chardev added"
 }
 
-remove_chardev(){
+nested_remove_chardev() {
     local CHARDEV_ID=$1
-    echo "chardev-remove $CHARDEV_ID" | nc -q 0 127.0.0.1 "$MON_PORT"
+    echo "chardev-remove $CHARDEV_ID" | nc -q 0 127.0.0.1 "$NESTED_MON_PORT"
     echo "chardev added"
 }
 
-add_usb_serial_device(){
+nested_add_usb_serial_device() {
     local DEVICE_ID=$1
     local CHARDEV_ID=$2
     local SERIAL_NUM=$3
-    echo "device_add usb-serial,chardev=$CHARDEV_ID,id=$DEVICE_ID,serial=$SERIAL_NUM" | nc -q 0 127.0.0.1 "$MON_PORT"
+    echo "device_add usb-serial,chardev=$CHARDEV_ID,id=$DEVICE_ID,serial=$SERIAL_NUM" | nc -q 0 127.0.0.1 "$NESTED_MON_PORT"
     echo "device added"
 }
 
-del_device(){
+nested_del_device() {
     local DEVICE_ID=$1
-    echo "device_del $DEVICE_ID" | nc -q 0 127.0.0.1 "$MON_PORT"
+    echo "device_del $DEVICE_ID" | nc -q 0 127.0.0.1 "$NESTED_MON_PORT"
     echo "device deleted"
 }
 
-get_nested_core_revision_for_channel(){
+nested_get_core_revision_for_channel() {
     local CHANNEL=$1
-    execute_remote "snap info core" | awk "/${CHANNEL}: / {print(\$4)}" | sed -e 's/(\(.*\))/\1/'
+    nested_exec "snap info core" | awk "/${CHANNEL}: / {print(\$4)}" | sed -e 's/(\(.*\))/\1/'
+}
+
+nested_get_core_revision_installed() {
+    nested_exec "snap info core" | awk "/installed: / {print(\$3)}" | sed -e 's/(\(.*\))/\1/'
+}
+
+nested_fetch_spread() {
+    if [ ! -f "$NESTED_WORK_DIR/spread" ]; then
+        mkdir -p "$NESTED_WORK_DIR"
+        curl https://niemeyer.s3.amazonaws.com/spread-amd64.tar.gz | tar -xzv -C "$NESTED_WORK_DIR"
+        # make sure spread really exists
+        test -x "$NESTED_WORK_DIR/spread"
+        echo "$NESTED_WORK_DIR/spread"
+    fi
 }
 
-get_nested_core_revision_installed(){
-    execute_remote "snap info core" | awk "/installed: / {print(\$3)}" | sed -e 's/(\(.*\))/\1/'
+nested_build_seed_cdrom() {
+    local SEED_DIR="$1"
+    local SEED_NAME="$2"
+    local LABEL="$3"
+
+    shift 3
+
+    local ORIG_DIR=$PWD
+
+    pushd "$SEED_DIR" || return 1 
+    genisoimage -output "$ORIG_DIR/$SEED_NAME" -volid "$LABEL" -joliet -rock "$@"
+    popd || return 1 
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/network.sh snapd-2.48.3+20.04/tests/lib/network.sh
--- snapd-2.45.1+20.04.2/tests/lib/network.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/network.sh	2021-02-02 08:21:12.000000000 +0000
@@ -21,14 +21,8 @@
 
 make_network_service() {
     SERVICE_NAME="$1"
-    SERVICE_FILE="$2"
-    PORT="$3"
+    PORT="$2"
 
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
-
-    printf '#!/bin/sh -e\nwhile true; do printf '\''HTTP/1.1 200 OK\\n\\nok\\n'\'' |  nc -l -p %s -w 1; done' "$PORT" > "$SERVICE_FILE"
-    chmod a+x "$SERVICE_FILE"
-    systemd_create_and_start_unit "$SERVICE_NAME" "$(readlink -f "$SERVICE_FILE")"
+    systemd-run --unit "$SERVICE_NAME" sh -c "while true; do printf 'HTTP/1.1 200 OK\\n\\nok\\n' |  nc -l -p $PORT -w 1; done"
     wait_listen_port "$PORT"
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/pkgdb.sh snapd-2.48.3+20.04/tests/lib/pkgdb.sh
--- snapd-2.45.1+20.04.2/tests/lib/pkgdb.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/pkgdb.sh	2021-02-02 08:21:12.000000000 +0000
@@ -181,7 +181,7 @@
             quiet dnf -y install --setopt=install_weak_deps=False "$@"
             ;;
         opensuse-*)
-            quiet rpm -i --replacepkgs "$@"
+            quiet zypper in -y --no-recommends --allow-unsigned-rpm "$@"
             ;;
         arch-*)
             pacman -U --noconfirm "$@"
@@ -317,7 +317,9 @@
 
     case "$SPREAD_SYSTEM" in
         ubuntu-*|debian-*)
-            quiet eatmydata apt-get remove -y --purge -y "$@"
+            # TODO reenable quiet once we have dealt with files being left
+            # behind while purging in prepare
+            eatmydata apt-get remove -y --purge -y "$@"
             ;;
         amazon-*|centos-7-*)
             quiet yum -y remove "$@"
@@ -477,7 +479,7 @@
                 ;;
             arch-*)
                 # shellcheck disable=SC2125
-                packages="${GOHOME}"/snapd*.pkg.tar.xz
+                packages="${GOHOME}"/snapd*.pkg.tar.*
                 ;;
             *)
                 exit 1
@@ -518,6 +520,12 @@
             fi
         fi
 
+        if [[ "$SPREAD_SYSTEM" == opensuse-tumbleweed-* ]]; then
+            # Package installation applies vendor presets only, which leaves
+            # snapd.apparmor disabled.
+            systemctl enable --now snapd.apparmor.service
+        fi
+
         # On some distributions the snapd.socket is not yet automatically
         # enabled as we don't have a systemd present configuration approved
         # by the distribution for it in place yet.
@@ -602,6 +610,7 @@
             ;;
         ubuntu-16.04-32)
             echo "
+                dbus-user-session
                 gccgo-6
                 evolution-data-server
                 fwupd
@@ -612,6 +621,7 @@
             ;;
         ubuntu-16.04-64)
             echo "
+                dbus-user-session
                 evolution-data-server
                 fwupd
                 gccgo-6
@@ -627,25 +637,25 @@
             ;;
         ubuntu-18.04-64)
             echo "
+                dbus-user-session
                 gccgo-8
                 evolution-data-server
                 fwupd
                 packagekit
+                qemu-utils
                 "
             ;;
-        ubuntu-19.10-64)
+        ubuntu-20.04-64)
             echo "
                 evolution-data-server
-                fwupd
+                gccgo-9
                 packagekit
                 qemu-utils
+                shellcheck
                 "
             ;;
-        ubuntu-20.04-64)
+        ubuntu-20.10-64)
             echo "
-                evolution-data-server
-                gccgo-9
-                packagekit
                 qemu-utils
                 "
             ;;
@@ -656,13 +666,19 @@
             ;;
         debian-*)
             echo "
+                autopkgtest
+                debootstrap
+                dbus-user-session
                 eatmydata
                 evolution-data-server
                 fwupd
+                gcc-multilib
                 libc6-dev-i386
+                linux-libc-dev
                 net-tools
                 packagekit
                 sbuild
+                schroot
                 "
             ;;
     esac
@@ -845,7 +861,7 @@
 install_pkg_dependencies(){
     pkgs=$(pkg_dependencies)
     # shellcheck disable=SC2086
-    distro_install_package $pkgs
+    distro_install_package --no-install-recommends $pkgs
 }
 
 # upgrade distribution and indicate if reboot is needed by outputting 'reboot'
diff -Nru snapd-2.45.1+20.04.2/tests/lib/prepare-restore.sh snapd-2.48.3+20.04/tests/lib/prepare-restore.sh
--- snapd-2.45.1+20.04.2/tests/lib/prepare-restore.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/prepare-restore.sh	2021-02-02 08:21:12.000000000 +0000
@@ -22,15 +22,9 @@
 # shellcheck source=tests/lib/random.sh
 . "$TESTSLIB/random.sh"
 
-# shellcheck source=tests/lib/journalctl.sh
-. "$TESTSLIB/journalctl.sh"
-
 # shellcheck source=tests/lib/state.sh
 . "$TESTSLIB/state.sh"
 
-# shellcheck source=tests/lib/systems.sh
-. "$TESTSLIB/systems.sh"
-
 
 ###
 ### Utility functions reused below.
@@ -55,6 +49,12 @@
                 echo "ERROR: system $SPREAD_SYSTEM not yet supported!"
                 exit 1
         esac
+
+        # Allow the test user to access systemd journal.
+        if getent group systemd-journal >/dev/null; then
+            usermod -G systemd-journal -a test
+            id test | MATCH systemd-journal
+        fi
     fi
 
     owner=$( stat -c "%U:%G" /home/test )
@@ -64,6 +64,10 @@
     fi
     unset owner
 
+    # Add a new line first to prevent an error which happens when
+    # the file has not new line, and we see this:
+    # syntax error, unexpected WORD, expecting END or ':' or '\n'
+    echo >> /etc/sudoers
     echo 'test ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
 
     chown test.test -R "$SPREAD_PATH"
@@ -183,7 +187,9 @@
     chown -R test:test /tmp/pkg
     su -l -c "cd /tmp/pkg && WITH_TEST_KEYS=1 makepkg -f --nocheck" test
 
-    cp /tmp/pkg/snapd*.pkg.tar.xz "${GOPATH%%:*}"
+    # /etc/makepkg.conf defines PKGEXT which drives the compression alg and sets
+    # the package file name extension, keep it simple and try a glob instead
+    cp /tmp/pkg/snapd*.pkg.tar.* "${GOPATH%%:*}"
 }
 
 download_from_published(){
@@ -217,7 +223,7 @@
     if [[ "$SPREAD_SYSTEM" == ubuntu-* ]] && [[ "$SPREAD_SYSTEM" != ubuntu-core-* ]]; then
         apt-get remove --purge -y lxd lxcfs || true
         apt-get autoremove --purge -y
-        lxd-tool undo-lxd-mount-changes
+        "$TESTSTOOLS"/lxd-state undo-mount-changes
     fi
 
     # Check if running inside a container.
@@ -371,15 +377,97 @@
                 systemctl stop "$(basename "$f")" || true
                 rm -f "$f"
             done
+            # double check that purge really worked
+            if [ -d /var/lib/snapd ]; then
+                echo "# /var/lib/snapd"
+                ls -lR /var/lib/snapd || true
+                journalctl -b | tail -100 || true
+                cat /var/lib/snapd/state.json || true
+                exit 1
+            fi
             ;;
         *)
             # snapd state directory must not exist when the package is not
             # installed
-            test ! -d /var/lib/snapd
+            if [ -d /var/lib/snapd ]; then
+                echo "# /var/lib/snapd"
+                ls -lR /var/lib/snapd || true
+                exit 1
+            fi
             ;;
     esac
 
-    install_pkg_dependencies
+    restart_logind=
+    restart_networkd=
+    if [ "$(systemctl --version | awk '/systemd [0-9]+/ { print $2 }')" -lt 246 ]; then
+        restart_logind=maybe
+        restart_networkd=maybe
+    fi
+
+
+    # Try installing package dependencies. Because we pull in some systemd
+    # development packages we can easily pull in a whole systemd upgrade. Most
+    # of the time that's okay but, well, not always.
+    if ! install_pkg_dependencies; then
+        # If this failed, maybe systemd-networkd got busted during the 245-246
+        # upgrade? If so we can just restart it and try again.
+        # This is related to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966612
+        if [ "$restart_networkd" = maybe ]; then
+            systemctl reset-failed systemd-networkd.service
+            systemctl try-restart systemd-networkd.service
+            install_pkg_dependencies
+        fi
+    fi
+
+    if [ "$restart_logind" = maybe ]; then
+        if [ "$(systemctl --version | awk '/systemd [0-9]+/ { print $2 }')" -ge 246 ]; then
+            restart_logind=yes
+        else
+            restart_logind=
+        fi
+    fi
+
+    # Work around systemd / Debian bug interaction. We are installing
+    # libsystemd-dev which upgrades systemd to 246-2 (from 245-*) leaving
+    # behind systemd-logind.service from the old version. This is tracked as
+    # Debian bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919509 and
+    # it really affects Desktop systems where Wayland/X don't like logind from
+    # ever being restarted.
+    #
+    # As a workaround we tried to restart logind ourselves but this caused
+    # another issue.  Restarted logind, as of systemd v245, forgets about the
+    # root session and subsequent loginctl enable-linger root, loginctl
+    # disable-linger stops the running systemd --user for the root session,
+    # along with other services like session bus.
+    #
+    # In consequence all the code that restarts logind for one reason or
+    # another is coalesced below and ends with REBOOT. This ensures that after
+    # rebooting, we have an up-to-date, working logind and that the initial
+    # session used by spread is tracked.
+    if ! loginctl enable-linger test; then
+        if systemctl cat systemd-logind.service | not grep -q StateDirectory; then
+            mkdir -p /mnt/system-data/etc/systemd/system/systemd-logind.service.d
+            # NOTE: The here-doc below must use tabs for proper operation.
+            cat >/mnt/system-data/etc/systemd/system/systemd-logind.service.d/linger.conf <<-CONF
+	[Service]
+	StateDirectory=systemd/linger
+	CONF
+            mkdir -p /var/lib/systemd/linger
+            test "$(command -v restorecon)" != "" && restorecon /var/lib/systemd/linger
+            restart_logind=yes
+        fi
+    fi
+    loginctl disable-linger test || true
+
+    # FIXME: In an ideal world we'd just do this:
+    #   systemctl daemon-reload
+    #   systemctl restart systemd-logind.service
+    # But due to this issue, restarting systemd-logind is unsafe.
+    # https://github.com/systemd/systemd/issues/16685#issuecomment-671239737
+    if [ "$restart_logind" = yes ]; then
+        echo "logind upgraded, reboot required"
+        REBOOT
+    fi
 
     # We take a special case for Debian/Ubuntu where we install additional build deps
     # base on the packaging. In Fedora/Suse this is handled via mock/osc
@@ -457,7 +545,7 @@
 
     # On core systems, the journal service is configured once the final core system
     # is created and booted what is done during the first test suite preparation
-    if is_classic_system; then
+    if os.query is-classic; then
         # shellcheck source=tests/lib/prepare.sh
         . "$TESTSLIB"/prepare.sh
         disable_journald_rate_limiting
@@ -475,7 +563,7 @@
 prepare_suite() {
     # shellcheck source=tests/lib/prepare.sh
     . "$TESTSLIB"/prepare.sh
-    if is_core_system; then
+    if os.query is-core; then
         prepare_ubuntu_core
     else
         prepare_classic
@@ -494,8 +582,10 @@
 }
 
 prepare_suite_each() {
+    local variant="$1"
+
     # back test directory to be restored during the restore
-    tar cf "${PWD}.tar" "$PWD"
+    tests.backup prepare
 
     # WORKAROUND for memleak https://github.com/systemd/systemd/issues/11502
     if [[ "$SPREAD_SYSTEM" == debian-sid* ]]; then
@@ -504,45 +594,54 @@
 
     # save the job which is going to be executed in the system
     echo -n "$SPREAD_JOB " >> "$RUNTIME_STATE_PATH/runs"
-    # shellcheck source=tests/lib/reset.sh
-    "$TESTSLIB"/reset.sh --reuse-core
+    if [[ "$variant" = full ]]; then
+        # shellcheck source=tests/lib/reset.sh
+        "$TESTSLIB"/reset.sh --reuse-core
+    fi
     # Restart journal log and reset systemd journal cursor.
+    systemctl reset-failed systemd-journald.service
     if ! systemctl restart systemd-journald.service; then
         systemctl status systemd-journald.service || true
         echo "Failed to restart systemd-journald.service, exiting..."
         exit 1
     fi
-    start_new_journalctl_log
+    "$TESTSTOOLS"/journal-state start-new-log
 
-    echo "Install the snaps profiler snap"
-    install_snap_profiler
+    if [[ "$variant" = full ]]; then
+        echo "Install the snaps profiler snap"
+        install_snap_profiler
 
-    # shellcheck source=tests/lib/prepare.sh
-    . "$TESTSLIB"/prepare.sh
-    if is_classic_system; then
-        prepare_each_classic
+        # shellcheck source=tests/lib/prepare.sh
+        . "$TESTSLIB"/prepare.sh
+        if os.query is-classic; then
+            prepare_each_classic
+        fi
     fi
     # Check if journalctl is ready to run the test
-    check_journalctl_ready
+    "$TESTSTOOLS"/journal-state check-log-started
 
     case "$SPREAD_SYSTEM" in
         fedora-*|centos-*|amazon-*)
             ausearch -i -m AVC --checkpoint "$RUNTIME_STATE_PATH/audit-stamp" || true
             ;;
     esac
+
+    # Check for invariants late, in order to detect any bugs in the code above.
+    if [[ "$variant" = full ]]; then
+        "$TESTSTOOLS"/cleanup-state pre-invariant
+    fi
+    tests.invariant check
 }
 
 restore_suite_each() {
+    local variant="$1"
+
     rm -f "$RUNTIME_STATE_PATH/audit-stamp"
 
     # restore test directory saved during prepare
-    if [ -f "${PWD}.tar" ]; then
-        rm -rf "$PWD"
-        tar -C/ -xf "${PWD}.tar"
-        rm -rf "${PWD}.tar"
-    fi
+    tests.backup restore
 
-    if [ "$PROFILE_SNAPS" = 1 ]; then
+    if [[ "$variant" = full && "$PROFILE_SNAPS" = 1 ]]; then
         echo "Save snaps profiler log"
         local logs_id logs_dir logs_file
         logs_dir="$RUNTIME_STATE_PATH/logs"
@@ -555,7 +654,7 @@
         if [ -e "/var/snap/${profiler_snap}/common/profiler.log" ]; then
             cp -f "/var/snap/${profiler_snap}/common/profiler.log" "${logs_dir}/${logs_file}.profiler.log"
         fi
-        get_journalctl_log > "${logs_dir}/${logs_file}.journal.log"
+        "$TESTSTOOLS"/journal-state get-log > "${logs_dir}/${logs_file}.journal.log"
     fi
 
     # On Arch it seems that using sudo / su for working with the test user
@@ -564,21 +663,23 @@
     # random failures in the mount leak detector. Give it a moment but don't
     # clean it up ourselves, this should report actual test errors, if any.
     for i in $(seq 10); do
-        if not mountinfo-tool /run/user/12345 .fs_type=tmpfs; then
+        if not mountinfo.query /run/user/12345 .fs_type=tmpfs; then
             break
         fi
         sleep 1
     done
 
-    # reset the failed status of snapd, snapd.socket, and snapd.failure.socket
-    # to prevent hitting the system restart rate-limit for these services
-    systemctl reset-failed snapd.service snapd.socket snapd.failure.service
+    if [[ "$variant" = full ]]; then
+        # reset the failed status of snapd, snapd.socket, and snapd.failure.socket
+        # to prevent hitting the system restart rate-limit for these services
+        systemctl reset-failed snapd.service snapd.socket snapd.failure.service
+    fi
 }
 
 restore_suite() {
     # shellcheck source=tests/lib/reset.sh
     "$TESTSLIB"/reset.sh --store
-    if is_classic_system; then
+    if os.query is-classic; then
         # shellcheck source=tests/lib/pkgdb.sh
         . "$TESTSLIB"/pkgdb.sh
         distro_purge_package snapd
@@ -590,8 +691,15 @@
 }
 
 restore_project_each() {
+    "$TESTSTOOLS"/cleanup-state pre-invariant
+    # Check for invariants early, in order not to mask bugs in tests.
+    tests.invariant check
+    "$TESTSTOOLS"/cleanup-state post-invariant
+
+    # TODO: move this to tests.cleanup.
     restore_dev_random
 
+    # TODO: move this to tests.invariant.
     # Udev rules are notoriously hard to write and seemingly correct but subtly
     # wrong rules can pass review. Whenever that happens udev logs an error
     # message. As a last resort from lack of a better mechanism we can try to
@@ -601,6 +709,7 @@
         exit 1
     fi
 
+    # TODO: move this to tests.invariant.
     # Check if the OOM killer got invoked - if that is the case our tests
     # will most likely not function correctly anymore. It looks like this
     # happens with: https://forum.snapcraft.io/t/4101 and is a source of
@@ -614,6 +723,7 @@
         exit 1
     fi
 
+    # TODO: move this to tests.invariant.
     # check if there is a shutdown pending, no test should trigger this
     # and it leads to very confusing test failures
     if [ -e /run/systemd/shutdown/scheduled ]; then
@@ -622,6 +732,7 @@
         exit 1
     fi
 
+    # TODO: move this to tests.invariant.
     # Check for kernel oops during the tests
     if dmesg|grep "Oops: "; then
         echo "A kernel oops happened during the tests, test results will be unreliable"
@@ -630,6 +741,7 @@
         exit 1
     fi
 
+    # TODO: move this to tests.invariant.
     if getent passwd snap_daemon; then
         echo "Test left the snap_daemon user behind, this should not happen"
         exit 1
@@ -639,13 +751,16 @@
         exit 1
     fi
 
+    # TODO: move this to tests.invariant.
     # Something is hosing the filesystem so look for signs of that
     not grep -F "//deleted /etc" /proc/self/mountinfo
 
+    # TODO: move this to tests.invariant.
     if journalctl -u snapd.service | grep -F "signal: terminated"; then
         exit 1;
     fi
 
+    # TODO: move this to tests.invariant.
     case "$SPREAD_SYSTEM" in
         fedora-*|centos-*)
             # Make sure that we are not leaving behind incorrectly labeled snap
@@ -686,10 +801,16 @@
         prepare_suite
         ;;
     --prepare-suite-each)
-        prepare_suite_each
+        prepare_suite_each full
+        ;;
+    --prepare-suite-each-minimal-no-snaps)
+        prepare_suite_each minimal-no-snaps
         ;;
     --restore-suite-each)
-        restore_suite_each
+        restore_suite_each full
+        ;;
+    --restore-suite-each-minimal-no-snaps)
+        restore_suite_each minimal-no-snaps
         ;;
     --restore-suite)
         restore_suite
@@ -702,7 +823,7 @@
         ;;
     *)
         echo "unsupported argument: $1"
-        echo "try one of --{prepare,restore}-{project,suite}{,-each}"
+        echo "try one of --{prepare,restore}-{project,suite}{,-each} or --{prepare,restore}-suite-each-minimal-no-snaps"
         exit 1
         ;;
 esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/prepare.sh snapd-2.48.3+20.04/tests/lib/prepare.sh
--- snapd-2.45.1+20.04.2/tests/lib/prepare.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/prepare.sh	2021-02-02 08:21:12.000000000 +0000
@@ -12,8 +12,6 @@
 . "$TESTSLIB/boot.sh"
 # shellcheck source=tests/lib/state.sh
 . "$TESTSLIB/state.sh"
-# shellcheck source=tests/lib/systems.sh
-. "$TESTSLIB/systems.sh"
 
 
 disable_kernel_rate_limiting() {
@@ -29,7 +27,7 @@
     # Disable journald rate limiting
     mkdir -p /etc/systemd/journald.conf.d
     # The RateLimitIntervalSec key is not supported on some systemd versions causing
-    # the journal rate limit could be considered as not valid and discarded in concecuence.
+    # the journal rate limit could be considered as not valid and discarded in consequence.
     # RateLimitInterval key is supported in old systemd versions and in new ones as well,
     # maintaining backward compatibility.
     cat <<-EOF > /etc/systemd/journald.conf.d/no-rate-limit.conf
@@ -55,10 +53,10 @@
         return
     fi
 
-    if is_core18_system; then
+    if os.query is-core18; then
         snap install --devmode jq-core18
         snap alias jq-core18.jq jq
-    elif is_core20_system; then
+    elif os.query is-core20; then
         snap install --devmode --edge jq-core20
         snap alias jq-core20.jq jq
     else
@@ -81,7 +79,9 @@
     snap refresh --time --abs-time | MATCH "last: 2[0-9]{3}"
 
     echo "Ensure jq is gone"
-    snap remove --purge jq jq-core18 jq-core20
+    snap remove --purge jq
+    snap remove --purge jq-core18
+    snap remove --purge jq-core20
 }
 
 setup_systemd_snapd_overrides() {
@@ -176,7 +176,7 @@
     rm -rf squashfs-root
 
     # Now mount the new core snap, first discarding the old mount namespace
-    "$LIBEXECDIR/snapd/snap-discard-ns" core
+    snapd.tool exec snap-discard-ns core
     mount "$snap" "$core"
 
     check_file() {
@@ -228,9 +228,9 @@
         distro_query_package_info snapd
         exit 1
     fi
-    if "$LIBEXECDIR/snapd/snap-confine" --version | MATCH unknown; then
+    if snapd.tool exec snap-confine --version | MATCH unknown; then
         echo "Package build incorrect, 'snap-confine --version' mentions 'unknown'"
-        "$LIBEXECDIR/snapd/snap-confine" --version
+        snapd.tool exec snap-confine --version
         case "$SPREAD_SYSTEM" in
             ubuntu-*|debian-*)
                 apt-cache policy snapd
@@ -285,11 +285,15 @@
             cache_snaps test-snapd-profiler
         fi
 
-        snap list | not grep core || exit 1
-        # use parameterized core channel (defaults to edge) instead
+        # now use parameterized core channel (defaults to edge) instead
         # of a fixed one and close to stable in order to detect defects
         # earlier
-        snap install --"$CORE_CHANNEL" core
+        if snap list core ; then
+            snap refresh --"$CORE_CHANNEL" core
+        else
+            snap install --"$CORE_CHANNEL" core
+        fi
+
         snap list | grep core
 
         systemctl stop snapd.{service,socket}
@@ -334,14 +338,41 @@
     rm -f "$UNPACK_DIR"/etc/apparmor.d/*
 
     dpkg-deb -x "$SPREAD_PATH"/../snapd_*.deb "$UNPACK_DIR"
-    cp /usr/lib/snapd/info "$UNPACK_DIR"/usr/lib/
+    cp /usr/lib/snapd/info "$UNPACK_DIR"/usr/lib/snapd
     snap pack "$UNPACK_DIR" "$TARGET"
     rm -rf "$UNPACK_DIR"
 }
 
+repack_core_snap_with_tweaks() {
+    local CORESNAP="$1"
+    local TARGET="$2"
+
+    local UNPACK_DIR="/tmp/core-unpack"
+    unsquashfs -no-progress -d "$UNPACK_DIR" "$CORESNAP"
+
+    mkdir -p "$UNPACK_DIR"/etc/systemd/journald.conf.d
+    cat <<EOF > "$UNPACK_DIR"/etc/systemd/journald.conf.d/to-console.conf
+[Journal]
+ForwardToConsole=yes
+TTYPath=/dev/ttyS0
+MaxLevelConsole=debug
+EOF
+    mkdir -p "$UNPACK_DIR"/etc/systemd/system/snapd.service.d
+cat <<EOF > "$UNPACK_DIR"/etc/systemd/system/snapd.service.d/logging.conf
+[Service]
+Environment=SNAPD_DEBUG_HTTP=7 SNAPD_DEBUG=1 SNAPPY_TESTING=1 SNAPD_CONFIGURE_HOOK_TIMEOUT=30s
+StandardOutput=journal+console
+StandardError=journal+console
+EOF
+
+    snap pack --filename="$TARGET" "$UNPACK_DIR"
+
+    rm -rf "$UNPACK_DIR"
+}
+
+
 repack_snapd_snap_with_deb_content_and_run_mode_firstboot_tweaks() {
     local TARGET="$1"
-    local ENABLE_SSH="${2:-true}"
 
     local UNPACK_DIR="/tmp/snapd-unpack"
     unsquashfs -no-progress -d "$UNPACK_DIR" snapd_*.snap
@@ -352,11 +383,10 @@
     rm -f "$UNPACK_DIR"/etc/apparmor.d/*
 
     dpkg-deb -x "$SPREAD_PATH"/../snapd_*.deb "$UNPACK_DIR"
-    cp /usr/lib/snapd/info "$UNPACK_DIR"/usr/lib/
+    cp /usr/lib/snapd/info "$UNPACK_DIR"/usr/lib/snapd
 
-    if [ "$ENABLE_SSH" = "true" ]; then
-        # now install a unit that sets up enough so that we can connect
-        cat > "$UNPACK_DIR"/lib/systemd/system/snapd.spread-tests-run-mode-tweaks.service <<'EOF'
+    # now install a unit that sets up enough so that we can connect
+    cat > "$UNPACK_DIR"/lib/systemd/system/snapd.spread-tests-run-mode-tweaks.service <<'EOF'
 [Unit]
 Description=Tweaks to run mode for spread tests
 Before=snapd.service
@@ -370,13 +400,13 @@
 [Install]
 WantedBy=multi-user.target
 EOF
-        # XXX: this duplicates a lot of setup_test_user_by_modify_writable()
-        cat > "$UNPACK_DIR"/usr/lib/snapd/snapd.spread-tests-run-mode-tweaks.sh <<'EOF'
+    # XXX: this duplicates a lot of setup_test_user_by_modify_writable()
+    cat > "$UNPACK_DIR"/usr/lib/snapd/snapd.spread-tests-run-mode-tweaks.sh <<'EOF'
 #!/bin/sh
 set -e
 # ensure we don't enable ssh in install mode or spread will get confused
-if ! grep 'snapd_recovery_mode=run' /proc/cmdline; then
-    echo "not in run mode - script not running"
+if ! grep -E 'snapd_recovery_mode=(run|recover)' /proc/cmdline; then
+    echo "not in run or recovery mode - script not running"
     exit 0
 fi
 if [ -e /root/spread-setup-done ]; then
@@ -421,8 +451,7 @@
 
 touch /root/spread-setup-done
 EOF
-        chmod 0755 "$UNPACK_DIR"/usr/lib/snapd/snapd.spread-tests-run-mode-tweaks.sh
-    fi
+    chmod 0755 "$UNPACK_DIR"/usr/lib/snapd/snapd.spread-tests-run-mode-tweaks.sh
 
     snap pack "$UNPACK_DIR" "$TARGET"
     rm -rf "$UNPACK_DIR"
@@ -436,10 +465,17 @@
 
     local ORIG_SNAP="$1"
     local TARGET="$2"
+
+    local injectKernelPanic=false
+    injectKernelPanicArg=${3:-}
+    if [ "$injectKernelPanicArg" = "--inject-kernel-panic-in-initramfs" ]; then
+        injectKernelPanic=true
+    fi
     
     # kernel snap is huge, unpacking to current dir
     unsquashfs -d repacked-kernel "$ORIG_SNAP"
 
+
     # repack initrd magic, beware
     # assumptions: initrd is compressed with LZ4, cpio block size 512, microcode
     # at the beginning of initrd image
@@ -471,6 +507,16 @@
         echo "if test -d /run/mnt/data/system-data; then touch /run/mnt/data/system-data/the-tool-ran; fi" >> \
             "$skeletondir/main/usr/lib/the-tool"
 
+        if [ "$injectKernelPanic" = "true" ]; then
+            # add a kernel panic to the end of the-tool execution
+            echo "echo 'forcibly panicing'; echo c > /proc/sysrq-trigger" >> "$skeletondir/main/usr/lib/the-tool"
+        fi
+
+        # copy any extra files to the same location inside the initrd
+        if [ -d ../extra-initrd/ ]; then
+            cp -a ../extra-initrd/* "$skeletondir"/main
+        fi
+
         # XXX: need to be careful to build an initrd using the right kernel
         # modules from the unpacked initrd, rather than the host which may be
         # running a different kernel
@@ -537,7 +583,13 @@
         rm -rf fake
     )
 
+    # copy any extra files that tests may need for the kernel
+    if [ -d ./extra-kernel-snap/ ]; then
+        cp -a ./extra-kernel-snap/* ./repacked-kernel
+    fi
+    
     snap pack repacked-kernel "$TARGET"
+    rm -rf repacked-kernel
 }
 
 
@@ -614,6 +666,10 @@
         MATCH "^ubuntu:" </mnt/system-data/var/lib/extrausers/"$f"
     done
 
+    # Make sure systemd-journal group has the "test" user as a member. Due to the way we copy that from the host
+    # and merge it from the core snap this is done explicitly as a second step.
+    sed -r -i -e 's/^systemd-journal:x:([0-9]+):$/systemd-journal:x:\1:test/' /mnt/system-data/root/test-etc/group
+
     # ensure spread -reuse works in the core image as well
     if [ -e /.spread.yaml ]; then
         cp -av /.spread.yaml /mnt/system-data
@@ -629,9 +685,23 @@
     # the writeable-path sync-boot won't work
     mkdir -p /mnt/system-data/etc/systemd
 
-    # we do not need console-conf, so prevent it from running
     mkdir -p /mnt/system-data/var/lib/console-conf
-    touch /mnt/system-data/var/lib/console-conf/complete
+
+    # NOTE: The here-doc below must use tabs for proper operation.
+    cat >/mnt/system-data/etc/systemd/system/var-lib-systemd-linger.mount <<-UNIT
+	[Mount]
+	What=/writable/system-data/var/lib/systemd/linger
+	Where=/var/lib/systemd/linger
+	Options=bind
+	UNIT
+    ln -s /etc/systemd/system/var-lib-systemd-linger.mount /mnt/system-data/etc/systemd/system/multi-user.target.wants/var-lib-systemd-linger.mount
+
+    # NOTE: The here-doc below must use tabs for proper operation.
+    mkdir -p /mnt/system-data/etc/systemd/system/systemd-logind.service.d
+    cat >/mnt/system-data/etc/systemd/system/systemd-logind.service.d/linger.conf <<-CONF
+	[Service]
+	StateDirectory=systemd/linger
+	CONF
 
     (cd /tmp ; unsquashfs -no-progress -v  /var/lib/snapd/snaps/"$core_name"_*.snap etc/systemd/system)
     cp -avr /tmp/squashfs-root/etc/systemd/system /mnt/system-data/etc/systemd/
@@ -641,6 +711,15 @@
     # install the stuff we need
     distro_install_package kpartx busybox-static
 
+    # Ensure we don't have snapd already installed, sometimes
+    # on 20.04 purge seems to fail, catch that for further
+    # debugging
+    if [ -e /var/lib/snapd/state.json ]; then
+        echo "reflash image not pristine, snaps already installed"
+        python3 -m json.tool < /var/lib/snapd/state.json
+        exit 1
+    fi
+
     distro_install_local_package "$GOHOME"/snapd_*.deb
     distro_clean_package_cache
 
@@ -648,19 +727,27 @@
     snap wait system seed.loaded
 
     # download the snapd snap for all uc systems except uc16
-    if ! is_core16_system; then
+    if ! os.query is-core16; then
         snap download "--channel=${SNAPD_CHANNEL}" snapd
     fi
 
     # we cannot use "names.sh" here because no snaps are installed yet
     core_name="core"
-    if is_core18_system; then
+    if os.query is-core18; then
         core_name="core18"
-    elif is_core20_system; then        
+    elif os.query is-core20; then
         core_name="core20"
     fi
+    # XXX: we get "error: too early for operation, device not yet
+    # seeded or device model not acknowledged" here sometimes. To
+    # understand that better show some debug output.
+    snap changes
+    snap tasks --last=seed || true
+    journalctl -u snapd
+    snap model --verbose
+    # remove the above debug lines once the mentioned bug is fixed
     snap install "--channel=${CORE_CHANNEL}" "$core_name"
-    if is_core16_system || is_core18_system; then
+    if os.query is-core16 || os.query is-core18; then
         UNPACK_DIR="/tmp/$core_name-snap"
         unsquashfs -no-progress -d "$UNPACK_DIR" /var/lib/snapd/snaps/${core_name}_*.snap
     fi
@@ -680,12 +767,12 @@
     cp /usr/bin/snap "$IMAGE_HOME"
     export UBUNTU_IMAGE_SNAP_CMD="$IMAGE_HOME/snap"
 
-    if is_core18_system; then
+    if os.query is-core18; then
         repack_snapd_snap_with_deb_content "$IMAGE_HOME"
         # FIXME: fetch directly once its in the assertion service
         cp "$TESTSLIB/assertions/ubuntu-core-18-amd64.model" "$IMAGE_HOME/pc.model"
         IMAGE=core18-amd64.img
-    elif is_core20_system; then
+    elif os.query is-core20; then
         repack_snapd_snap_with_deb_content_and_run_mode_firstboot_tweaks "$IMAGE_HOME"
         cp "$TESTSLIB/assertions/ubuntu-core-20-amd64.model" "$IMAGE_HOME/pc.model"
         IMAGE=core20-amd64.img
@@ -713,6 +800,12 @@
         path: /dev/iio:device0
 EOF
 
+        # Make /var/lib/systemd writable so that we can get linger enabled.
+        # This only applies to Ubuntu Core 16 where individual directories were
+        # writable. In Core 18 and beyond all of /var/lib/systemd is writable.
+        mkdir -p $UNPACK_DIR/var/lib/systemd/{catalog,coredump,deb-systemd-helper-enabled,rfkill,linger}
+        touch "$UNPACK_DIR"/var/lib/systemd/random-seed
+
         # build new core snap for the image
         snap pack "$UNPACK_DIR" "$IMAGE_HOME"
 
@@ -737,7 +830,7 @@
         IMAGE_CHANNEL="$GADGET_CHANNEL"
     fi
 
-    if is_core20_system; then
+    if os.query is-core20; then
         snap download --basename=pc-kernel --channel="20/$KERNEL_CHANNEL" pc-kernel
         # make sure we have the snap
         test -e pc-kernel.snap
@@ -752,7 +845,7 @@
 
     # on core18 we need to use the modified snapd snap and on core16
     # it is the modified core that contains our freshly build snapd
-    if is_core18_system || is_core20_system; then
+    if os.query is-core18 || os.query is-core20; then
         extra_snap=("$IMAGE_HOME"/snapd_*.snap)
     else
         extra_snap=("$IMAGE_HOME"/core_*.snap)
@@ -771,6 +864,30 @@
                            --output "$IMAGE_HOME/$IMAGE"
     rm -f ./pc-kernel_*.{snap,assert} ./pc_*.{snap,assert} ./snapd_*.{snap,assert}
 
+    if os.query is-core20; then
+        # (ab)use ubuntu-seed
+        LOOP_PARTITION=2
+    else
+        LOOP_PARTITION=3
+    fi
+
+    # expand the uc16 and uc18 images a little bit (400M) as it currently will
+    # run out of space easily from local spread runs if there are extra files in
+    # the project not included in the git ignore and spread ignore, etc.
+    if ! os.query is-core20; then
+        # grow the image by 400M
+        truncate --size=+400M "$IMAGE_HOME/$IMAGE"
+        # fix the GPT table because old versions of parted complain about this 
+        # and refuse to properly run the next command unless the GPT table is 
+        # updated
+        # this command moves the backup gpt partition to the end of the disk,
+        # which is sensible since we've just resized the backing storage
+        sgdisk "$IMAGE_HOME/$IMAGE" -e
+
+        # resize the partition to go to the end of the disk
+        parted -s "$IMAGE_HOME/$IMAGE" resizepart ${LOOP_PARTITION} "100%"
+    fi
+
     # mount fresh image and add all our SPREAD_PROJECT data
     kpartx -avs "$IMAGE_HOME/$IMAGE"
     # losetup --list --noheadings returns:
@@ -779,19 +896,22 @@
     # /dev/loop19  0 0  1  1 /var/lib/snapd/snaps/test-snapd-netplan-apply_75.snap  0     512
     devloop=$(losetup --list --noheadings | grep "$IMAGE_HOME/$IMAGE" | awk '{print $1}')
     dev=$(basename "$devloop")
-    if is_core20_system; then
-        # (ab)use ubuntu-seed
-        mount "/dev/mapper/${dev}p2" /mnt
-    else
-        mount "/dev/mapper/${dev}p3" /mnt
+
+    # resize the 2nd partition from that loop device to fix the size
+    if ! os.query is-core20; then
+        resize2fs -p "/dev/mapper/${dev}p${LOOP_PARTITION}"
     fi
+
+    # mount it so we can use it now
+    mount "/dev/mapper/${dev}p${LOOP_PARTITION}" /mnt
+
     mkdir -p /mnt/user-data/
     # copy over everything from gopath to user-data, exclude:
     # - VCS files
     # - built debs
     # - golang archive files and built packages dir
     # - govendor .cache directory and the binary,
-    if is_core16_system || is_core18_system; then
+    if os.query is-core16 || os.query is-core18; then
         # we need to include "core" here because -C option says to ignore 
         # files the way CVS(?!) does, so it ignores files named "core" which
         # are core dumps, but we have a test suite named "core", so including 
@@ -805,7 +925,7 @@
           --exclude /gopath/pkg/ \
           --include core/ \
           /home/gopath /mnt/user-data/
-    elif is_core20_system; then
+    elif os.query is-core20; then
         # prepare passwd for run-mode-overlay-data
         mkdir -p /root/test-etc
         mkdir -p /var/lib/extrausers
@@ -822,6 +942,9 @@
             MATCH "^test:" </var/lib/extrausers/"$f"
             MATCH "^ubuntu:" </var/lib/extrausers/"$f"
         done
+        # Make sure systemd-journal group has the "test" user as a member. Due to the way we copy that from the host
+        # and merge it from the core snap this is done explicitly as a second step.
+        sed -r -i -e 's/^systemd-journal:x:([0-9]+):$/systemd-journal:x:\1:test/' /root/test-etc/group
         tar -c -z \
           --exclude '*.a' \
           --exclude '*.deb' \
@@ -833,7 +956,7 @@
     fi
 
     # now modify the image writable partition - only possible on uc16 / uc18
-    if is_core16_system || is_core18_system; then
+    if os.query is-core16 || os.query is-core18; then
         # modify the writable partition of "core" so that we have the
         # test user
         setup_core_for_testing_by_modify_writable "$UNPACK_DIR"
@@ -864,7 +987,7 @@
     chmod +x "$IMAGE_HOME/reflash.sh"
 
     DEVPREFIX=""
-    if is_core20_system; then
+    if os.query is-core20; then
         DEVPREFIX="/boot"
     fi
     # extract ROOT from /proc/cmdline
@@ -901,12 +1024,8 @@
 
     # Wait for the snap command to become available.
     if [ "$SPREAD_BACKEND" != "external" ]; then
-        for i in $(seq 120); do
-            if [ "$(command -v snap)" = "/usr/bin/snap" ] && snap version | grep -q 'snapd +1337.*'; then
-                break
-            fi
-            sleep 1
-        done
+        # shellcheck disable=SC2016
+        retry -n 120 --wait 1 sh -c 'test "$(command -v snap)" = /usr/bin/snap && snap version | grep -E -q "snapd +1337.*"'
     fi
 
     # Wait for seeding to finish.
@@ -925,7 +1044,7 @@
     done
 
     echo "Ensure the snapd snap is available"
-    if is_core18_system || is_core20_system; then
+    if os.query is-core18 || os.query is-core20; then
         if ! snap list snapd; then
             echo "snapd snap on core18 is missing"
             snap list
@@ -936,12 +1055,12 @@
     echo "Ensure rsync is available"
     if ! command -v rsync; then
         rsync_snap="test-snapd-rsync"
-        if is_core18_system; then
+        if os.query is-core18; then
             rsync_snap="test-snapd-rsync-core18"
-        elif is_core20_system; then
+        elif os.query is-core20; then
             rsync_snap="test-snapd-rsync-core20"
         fi
-        snap install --devmode "$rsync_snap"
+        snap install --devmode --edge "$rsync_snap"
         snap alias "$rsync_snap".rsync rsync
     fi
 
@@ -951,21 +1070,21 @@
 
     echo "Ensure the core snap is cached"
     # Cache snaps
-    if is_core18_system || is_core20_system; then
+    if os.query is-core18 || os.query is-core20; then
         if snap list core >& /dev/null; then
             echo "core snap on core18 should not be installed yet"
             snap list
             exit 1
         fi
         cache_snaps core
-        if is_core18_system; then
+        if os.query is-core18; then
             cache_snaps test-snapd-sh-core18
         fi
     fi
 
     echo "Cache the snaps profiler snap"
     if [ "$PROFILE_SNAPS" = 1 ]; then
-        if is_core18_system; then
+        if os.query is-core18; then
             cache_snaps test-snapd-profiler-core18
         else
             cache_snaps test-snapd-profiler
diff -Nru snapd-2.45.1+20.04.2/tests/lib/preseed.sh snapd-2.48.3+20.04/tests/lib/preseed.sh
--- snapd-2.45.1+20.04.2/tests/lib/preseed.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/preseed.sh	2021-02-02 08:21:12.000000000 +0000
@@ -3,8 +3,8 @@
 # mount ubuntu cloud image through qemu-nbd and mount
 # critical virtual filesystems (such as proc) under
 # the root of mounted image.
-# XXX: cannot be used in prepare: section of the tests
-# as the test gets stuck around qemu-nbd on 20.04.
+# The path of the image needs to be absolute as a systemd service
+# gets created for qemu-nbd.
 mount_ubuntu_image() {
     local CLOUD_IMAGE=$1
     local IMAGE_MOUNTPOINT=$2
@@ -13,9 +13,12 @@
         modprobe nbd
     fi
 
-    qemu-nbd -c /dev/nbd0 "$CLOUD_IMAGE"
+    # Run qemu-nbd as a service, so that it does not interact with ssh
+    # stdin/stdout it would otherwise inherit from the spread session.
+    systemd-run --system --service-type=forking --unit=qemu-nbd-preseed.service "$(command -v qemu-nbd)" --fork -c /dev/nbd0 "$CLOUD_IMAGE"
     # nbd0p1 may take a short while to become available
-    retry-tool -n 5 --wait 1 mount /dev/nbd0p1 "$IMAGE_MOUNTPOINT"
+    retry -n 5 --wait 1 test -e /dev/nbd0p1
+    mount /dev/nbd0p1 "$IMAGE_MOUNTPOINT"
     mount -t proc /proc "$IMAGE_MOUNTPOINT/proc"
     mount -t sysfs sysfs "$IMAGE_MOUNTPOINT/sys"
     mount -t devtmpfs udev "$IMAGE_MOUNTPOINT/dev"
@@ -33,27 +36,57 @@
 
     # qemu-nbd -d may sporadically fail when removing the device,
     # reporting it's still in use.
-    retry-tool -n 5 --wait 1 qemu-nbd -d /dev/nbd0
+    retry -n 5 --wait 1 qemu-nbd -d /dev/nbd0
 }
 
-# XXX inject new snapd into the core image in seed/snaps of the cloud image
-# and make core unasserted.
-# this will go away once snapd on the core is new enough to support
-# pre-seeding.
-setup_preseeding() {
+# inject_snap_info_seed adds a snap to the seed.yaml, and works for snaps not
+# already in the seed. It requires base snaps, default-providers, etc. to all be
+# worked out and manually added with additional invocations
+# the first argument is the mountpoint of the image, the second argument is the 
+# name of the snap, the snap file must be the same as the name with .snap as the
+# file extension in the current working directory
+# example:
+#   $ snap download --edge --basename=test-snapd-sh test-snapd-sh
+#   $ inject_snap_into_seeds "$IMAGE_MOUNTPOINT" test-snapd-sh
+inject_snap_into_seed() {
     local IMAGE_MOUNTPOINT=$1
-    local CORE_IMAGE
+    local SNAP_NAME=$2
+    local SNAP_FILE="$SNAP_NAME.snap"
+    local SEED_YAML="$IMAGE_MOUNTPOINT/var/lib/snapd/seed/seed.yaml"
+    local SEED_SNAPS_DIR="$IMAGE_MOUNTPOINT/var/lib/snapd/seed/snaps"
+
+    # need remarshal for going from json to yaml and back for seed manipulation
+    if ! command -v json2yaml || ! command -v yaml2json; then
+        snap install remarshal
+    fi
+
+    # XXX: this is very simplistic and will break easily, refactor to use the 
+    #      iterative seed modification prepare-image args when those exist
+
+    snapsWithName=$(yaml2json < "$SEED_YAML" | jq -r --arg NAME "$SNAP_NAME" '[.snaps[] | select(.name == $NAME)] | length')
+    if [ "$snapsWithName" != "0" ]; then
+        # get the snap file name so we can delete it from the seed
+        old_name=$(yaml2json < "$SEED_YAML" | \
+            jq -r --arg NAME "$SNAP_NAME" '.snaps[] | select(.name == $NAME) | .file')
+        rm "$SEED_SNAPS_DIR/$old_name"
+
+        # now drop the entry from the seed.yaml so we can add the new one easily
+        yaml2json < "$SEED_YAML" | \
+            jq --arg NAME "$SNAP_NAME" 'del(.snaps[] | select(.name == $NAME))' | \
+                json2yaml > "$SEED_YAML.tmp"
+        mv "$SEED_YAML.tmp" "$SEED_YAML"
+    fi
+
+    # now add the desired snap as an unasserted snap with some jq magic™
+    yaml2json < "$SEED_YAML"| \
+        jq --arg FILE "$SNAP_FILE" --arg NAME "$SNAP_NAME" \
+            '.snaps[.snaps| length] |= .  + {"channel":"stable","unasserted":true,"name":$NAME,"file":$FILE}' | \
+                json2yaml > "$SEED_YAML.tmp"
+    mv "$SEED_YAML.tmp" "$SEED_YAML"
+
+    # and remember to copy the new snap file to the seed
+    cp "$SNAP_FILE" "$SEED_SNAPS_DIR"
 
-    # TODO: on 20.04 there is no core_*.snap anymore, just snapd
-    CORE_IMAGE=$(find "$IMAGE_MOUNTPOINT/var/lib/snapd/seed/snaps/" -name "core_*.snap")
-    unsquashfs "$CORE_IMAGE"
-    cp /usr/lib/snapd/snapd squashfs-root/usr/lib/snapd/snapd
-    # XXX to satisfy version check; this will go away once preseeding
-    # is available in 2.44
-    echo "VERSION=2.44.0" > squashfs-root/usr/lib/snapd/info
-    rm "$CORE_IMAGE"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    mksnap_fast squashfs-root "$CORE_IMAGE"
-    sed -i "$IMAGE_MOUNTPOINT/var/lib/snapd/seed/seed.yaml" -E -e 's/^(\s+)name: core/\1name: core\n\1unasserted: true/'
+    # check that we didn't break things too badly
+    snap debug validate-seed "$SEED_YAML"
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/reset.sh snapd-2.48.3+20.04/tests/lib/reset.sh
--- snapd-2.45.1+20.04.2/tests/lib/reset.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/reset.sh	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,5 @@
 #!/bin/bash
 
-set -e -x
-
 # shellcheck source=tests/lib/dirs.sh
 . "$TESTSLIB/dirs.sh"
 # shellcheck source=tests/lib/state.sh
@@ -10,8 +8,6 @@
 # shellcheck source=tests/lib/systemd.sh
 . "$TESTSLIB/systemd.sh"
 
-#shellcheck source=tests/lib/systems.sh
-. "$TESTSLIB"/systems.sh
 
 reset_classic() {
     # Reload all service units as in some situations the unit might
@@ -99,6 +95,7 @@
                 EXTRA_NC_ARGS=""
                 ;;
         esac
+        # shellcheck disable=SC2086
         while ! printf 'GET / HTTP/1.0\r\n\r\n' | nc -U $EXTRA_NC_ARGS /run/snapd.socket; do sleep 0.5; done
     fi
 }
@@ -177,7 +174,7 @@
 # When the variable REUSE_SNAPD is set to 1, we don't remove and purge snapd.
 # In that case we just cleanup the environment by removing installed snaps as
 # it is done for core systems.
-if is_core_system || [ "$REUSE_SNAPD" = 1 ]; then
+if os.query is-core || [ "$REUSE_SNAPD" = 1 ]; then
     reset_all_snap "$@"
 else
     reset_classic "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/network-control-consumer/bin/cmd snapd-2.48.3+20.04/tests/lib/snaps/network-control-consumer/bin/cmd
--- snapd-2.45.1+20.04.2/tests/lib/snaps/network-control-consumer/bin/cmd	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/network-control-consumer/bin/cmd	2021-02-02 08:21:12.000000000 +0000
@@ -3,4 +3,4 @@
 command="$1"
 shift
 
-"$command" "$@"
+exec "$command" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/bin/sh snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/bin/sh
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/bin/sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/bin/sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+PS1='$ '
+exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,31 @@
+name: test-snapd-complex-layout
+version: 1.0
+apps:
+    sh:
+        command: bin/sh
+
+# taken from https://bugs.launchpad.net/snapd/+bug/1906821
+layout:
+  $SNAP/config:
+    bind: $SNAP_DATA/config
+  $SNAP/certs:
+    bind: $SNAP_DATA/certs
+  /usr/bin/python3.8:
+    symlink: $SNAP/usr/bin/python3.8
+  /usr/bin/python3.7:
+    # python3.7 lambdas will be redirected to python3.8
+    symlink: $SNAP/usr/bin/python3.8
+  $SNAP/usr/bin/python3:
+    symlink: $SNAP/usr/bin/python3.8
+  /usr/bin/python2.7:
+    symlink: $SNAP/usr/bin/python2.7
+  $SNAP/usr/bin/python:
+    symlink: $SNAP/usr/bin/python2.7
+  /usr/bin/nodejs12.x:
+    symlink: $SNAP/wrapper-scripts/exec-node.sh
+  /usr/bin/node:
+    symlink: $SNAP/node-v12.18.4-linux/bin/node
+  /usr/bin/java8:
+    symlink: $SNAP/usr/lib/jvm/java-8-openjdk-arch-symlink/jre/bin/java
+  /usr/bin/java:
+    symlink: $SNAP/usr/lib/jvm/java-8-openjdk-arch-symlink/jre/bin/java
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/node/bin/node snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/node/bin/node
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/node/bin/node	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/node/bin/node	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+dummy
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python2.7 snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python2.7
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python2.7	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python2.7	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+dummy
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python3.8 snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python3.8
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python3.8	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/usr/bin/python3.8	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+dummy
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/usr/lib/jvm/jre/bin/java snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/usr/lib/jvm/jre/bin/java
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/usr/lib/jvm/jre/bin/java	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/usr/lib/jvm/jre/bin/java	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+dummy
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/wrapper-scripts/exec-node.sh snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/wrapper-scripts/exec-node.sh
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-complex-layout/wrapper-scripts/exec-node.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-complex-layout/wrapper-scripts/exec-node.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1 @@
+dummy
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-desktop/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-desktop/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-desktop/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-desktop/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 name: test-snapd-desktop
 version: 1.0
 summary: Basic desktop interface test snap
-description: A basic snap to access dektop interface
+description: A basic snap to access desktop interface
 
 apps:
     check-files:
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-kvm/bin/sh snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-kvm/bin/sh
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-kvm/bin/sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-kvm/bin/sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+PS1='$ '
+exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-kvm/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-kvm/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-kvm/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-kvm/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+name: test-snapd-kvm
+summary: A no-strings-attached, no-fuss shell for writing tests
+version: 1.0
+
+apps:
+    with-kvm-plug:
+        command: bin/sh
+        plugs: [kvm]
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-policy-app-consumer/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-policy-app-consumer/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-policy-app-consumer/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-policy-app-consumer/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -74,6 +74,9 @@
   cpu-control:
     command: bin/run
     plugs: [ cpu-control ]
+  cups:
+    command: bin/run
+    plugs: [ cups ]
   cups-control:
     command: bin/run
     plugs: [ cups-control ]
@@ -128,6 +131,9 @@
   accounts-service:
     command: bin/run
     plugs: [ accounts-service ]
+  gconf:
+    command: bin/run
+    plugs: [ gconf ]
   gpg-keys:
     command: bin/run
     plugs: [ gpg-keys ]
@@ -158,9 +164,18 @@
   home:
     command: bin/run
     plugs: [ home ]
+  system-packages-doc:
+    command: bin/run
+    plugs: [ system-packages-doc ]
+  system-source-code:
+    command: bin/run
+    plugs: [ system-source-code ]
   hostname-control:
     command: bin/run
     plugs: [ hostname-control ]
+  hugepages-control:
+    command: bin/run
+    plugs: [ hugepages-control ]
   intel-mei:
     command: bin/run
     plugs: [ intel-mei ]
@@ -176,6 +191,9 @@
   juju-client-observe:
     command: bin/run
     plugs: [ juju-client-observe ]
+  kernel-crypto-api:
+    command: bin/run
+    plugs: [ kernel-crypto-api ]
   kernel-module-control:
     command: bin/run
     plugs: [ kernel-module-control ]
@@ -308,6 +326,9 @@
   process-control:
     command: bin/run
     plugs: [ process-control ]
+  ptp:
+    command: bin/run
+    plugs: [ ptp ]
   pulseaudio:
     command: bin/run
     plugs: [ pulseaudio ]
@@ -386,6 +407,9 @@
   uhid:
     command: bin/run
     plugs: [ uhid ]
+  uinput:
+    command: bin/run
+    plugs: [ uinput ]
   uio:
     command: bin/run
     plugs: [ uio ]
@@ -404,6 +428,9 @@
   upower-observe:
     command: bin/run
     plugs: [ upower-observe ]
+  vcio:
+    command: bin/run
+    plugs: [ vcio ]
   wayland:
     command: bin/run
     plugs: [ wayland ]
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-policy-app-provider-core/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-policy-app-provider-core/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-policy-app-provider-core/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-policy-app-provider-core/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,6 +15,8 @@
     content: test-content
     read:
     - $SNAP/content
+  cups: null
+  cups-control: null
   dbus-session:
     interface: dbus
     bus: session
@@ -67,6 +69,12 @@
   content-read:
     command: bin/run
     slots: [ content-read ]
+  cups:
+    command: bin/run
+    slots: [ cups ]
+  cups-control:
+    command: bin/run
+    slots: [ cups-control ]
   dbus-session:
     command: bin/run
     slots: [ dbus-session ]
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-sh/bin/cmd snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-sh/bin/cmd
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-sh/bin/cmd	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-sh/bin/cmd	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh
+PS1='$ '
+command="$1"
+shift
+
+exec "$command" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-sh/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-sh/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-sh/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-sh/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,3 +5,5 @@
 apps:
     sh:
         command: bin/sh
+    cmd:
+        command: bin/cmd
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-timedate-control-consumer/bin/date snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-timedate-control-consumer/bin/date
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-timedate-control-consumer/bin/date	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-timedate-control-consumer/bin/date	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /bin/date "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-timedate-control-consumer/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-timedate-control-consumer/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-timedate-control-consumer/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-timedate-control-consumer/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,3 +16,6 @@
     hwclock-time:
         command: bin/hwclock
         plugs: [time-control, netlink-audit]
+    date:
+        command: bin/date
+        plugs: [time-control]
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-tools/bin/cmd snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-tools/bin/cmd
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-tools/bin/cmd	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-tools/bin/cmd	2021-02-02 08:21:12.000000000 +0000
@@ -3,4 +3,4 @@
 command="$1"
 shift
 
-"$command" "$@"
+exec "$command" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-tools-core18/bin/cmd snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-tools-core18/bin/cmd
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-tools-core18/bin/cmd	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-tools-core18/bin/cmd	2021-02-02 08:21:12.000000000 +0000
@@ -3,4 +3,4 @@
 command="$1"
 shift
 
-"$command" "$@"
+exec "$command" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service/bin/start snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service/bin/start
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service/bin/start	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service/bin/start	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+while true; do
+    echo "running"
+    sleep 10
+done
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,7 @@
+name: test-snapd-user-service
+version: 1.0
+apps:
+    test-snapd-user-service:
+        command: bin/start
+        daemon: simple
+        daemon-scope: user
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-sockets/bin/start snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-sockets/bin/start
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-sockets/bin/start	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-sockets/bin/start	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,53 @@
+#!/usr/bin/python3
+
+import asyncio
+import os
+import socket
+import sys
+
+
+SD_LISTEN_FDS_START = 3
+
+def listen_sockets():
+    # Ignore environment variables if they were set for a different process
+    if os.getpid() != int(os.environ.get("LISTEN_PID", "0")):
+        return []
+
+    nfds = int(os.environ.get("LISTEN_FDS", "0"))
+    names = os.environ.get("LISTEN_FDNAMES", "").split(":")
+
+    fds = []
+    for i in range(nfds):
+        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM, 0, fileno=SD_LISTEN_FDS_START+i)
+        fds.append((names[i], sock))
+
+    return fds
+
+
+class SocketNameProtocol(asyncio.Protocol):
+    def __init__(self, socket_name):
+        self.socket_name = socket_name
+
+    def connection_made(self, transport):
+        message = "Connected to {}\n".format(self.socket_name)
+        transport.write(message.encode("ASCII"))
+        transport.close()
+
+
+def make_factory(socket_name):
+    return lambda: SocketNameProtocol(socket_name)
+
+
+def main():
+    loop = asyncio.get_event_loop()
+    coros = [loop.create_unix_server(make_factory(name), sock=sock)
+             for (name, sock) in listen_sockets()]
+    servers = loop.run_until_complete(asyncio.gather(*coros))
+    try:
+        loop.run_forever()
+    except KeyboardInterrupt:
+        pass
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-sockets/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-sockets/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-sockets/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-sockets/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,15 @@
+name: test-snapd-user-service-sockets
+version: 1.0
+apps:
+    test-snapd-user-service-sockets:
+        command: bin/start
+        daemon: simple
+        daemon-scope: user
+        plugs: [network-bind]
+        sockets:
+            common:
+                listen-stream: $SNAP_USER_COMMON/common.sock
+            data:
+                listen-stream: $SNAP_USER_DATA/data.sock
+            runtime:
+                listen-stream: $XDG_RUNTIME_DIR/run.sock
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-v2-bad/bin/bad snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-v2-bad/bin/bad
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-v2-bad/bin/bad	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-v2-bad/bin/bad	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo "service v2"
+exit 1
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-v2-bad/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-v2-bad/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-service-v2-bad/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-service-v2-bad/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+name: test-snapd-user-service
+version: 2.0
+apps:
+ service:
+  command: bin/bad
+  daemon: oneshot
+  daemon-scope: user
+  restart-condition: never
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-timer-service/bin/loop snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-timer-service/bin/loop
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-timer-service/bin/loop	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-timer-service/bin/loop	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+echo "called on $(date) as $1"
+
+for _ in $(seq 10); do
+    echo "looping"
+    sleep 0.5
+done
+
+echo "finishing on $(date)"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-timer-service/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-timer-service/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-user-timer-service/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-user-timer-service/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,29 @@
+name: test-snapd-user-timer-service
+version: 1.0
+apps:
+  regular-timer:
+    command: bin/loop regular-timer
+    daemon: simple
+    daemon-scope: user
+    # Run every 15 minutes
+    timer: 0:00-24:00/96
+  random-timer:
+    command: bin/loop random-timer
+    daemon: simple
+    daemon-scope: user
+    # Run roughly every 15 minutes, with (some) random distribution
+    timer: 0:00~24:00/96
+  range-timer:
+    command: bin/loop random-timer
+    daemon: simple
+    daemon-scope: user
+    # Run at random time between 0:00 and 10:00, from the second Monday to the
+    # following Friday, and at earliest time between 0:00 and 10:00 from the
+    # last Monday of the month to the following Friday
+    timer: mon2-fri,0:00~10:00,,mon5-fri,0:00-10:00
+  trivial-timer:
+    command: bin/loop trivial-timer
+    daemon: simple
+    daemon-scope: user
+    # Run on Mondays
+    timer: mon
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,3 +2,8 @@
 version: 1.0
 summary: Basic snap with a configure hook
 description: A basic snap with a passthrough configure hook
+
+apps:
+  some:
+    command: service
+    daemon: simple
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure/service snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure/service
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure/service	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure/service	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo "service running"
+exec sleep infinity
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure-core18/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure-core18/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure-core18/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure-core18/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,3 +3,8 @@
 summary: Basic snap with a configure hook for core18
 description: A basic snap with a passthrough configure hook for core18
 base: core18
+
+apps:
+  some:
+    command: service
+    daemon: simple
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure-core18/service snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure-core18/service
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-with-configure-core18/service	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-with-configure-core18/service	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo "service running"
+exec sleep infinity
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-xdg-settings/bin/set-default-web-browser snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-xdg-settings/bin/set-default-web-browser
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-xdg-settings/bin/set-default-web-browser	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-xdg-settings/bin/set-default-web-browser	1970-01-01 00:00:00.000000000 +0000
@@ -1,5 +0,0 @@
-#!/bin/sh
-
-set -e
-
-xdg-settings set default-web-browser "$1"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-xdg-settings/bin/xdg-settings-wrapper snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-xdg-settings/bin/xdg-settings-wrapper
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-xdg-settings/bin/xdg-settings-wrapper	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-xdg-settings/bin/xdg-settings-wrapper	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+#!/bin/bash
+set -e
+set -o pipefail
+# We need to add a "cut -b4-" everywhere because `dbus-send
+# --print-reply=literal` indents the output by 3 spaces (hard-coded in
+# dbus-print-message.c:print_iter).
+case "$1" in
+    get)
+        if [ $# -eq 3 ]; then
+            dbus-send --print-reply=literal --session --dest=io.snapcraft.Settings /io/snapcraft/Settings io.snapcraft.Settings.GetSub string:"$2" string:"$3" | cut -b4-
+        else
+            dbus-send --print-reply=literal --session --dest=io.snapcraft.Settings /io/snapcraft/Settings io.snapcraft.Settings.Get string:"$2" | cut -b4-
+        fi
+        ;;
+    set)
+        # Timeout of 300s to ensure the user has enough time to make a decision
+        if [ $# -eq 4 ]; then
+            dbus-send --reply-timeout=300000 --print-reply=literal --session --dest=io.snapcraft.Settings /io/snapcraft/Settings io.snapcraft.Settings.SetSub string:"$2" string:"$3" string:"$4" | cut -b4-
+        else
+            dbus-send --reply-timeout=300000 --print-reply=literal --session --dest=io.snapcraft.Settings /io/snapcraft/Settings io.snapcraft.Settings.Set string:"$2" string:"$3" | cut -b4-
+        fi
+        ;;
+    check)
+        if [ $# -eq 4 ]; then
+            dbus-send --print-reply=literal --session --dest=io.snapcraft.Settings /io/snapcraft/Settings io.snapcraft.Settings.CheckSub string:"$2" string:"$3" string:"$4" | cut -b4-
+        else
+            dbus-send --print-reply=literal --session --dest=io.snapcraft.Settings /io/snapcraft/Settings io.snapcraft.Settings.Check string:"$2" string:"$3" | cut -b4-
+        fi
+        ;;
+    *)
+        >&2 echo "unknown action $*"
+        exit 1
+        ;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-xdg-settings/meta/snap.yaml snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-xdg-settings/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/lib/snaps/test-snapd-xdg-settings/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps/test-snapd-xdg-settings/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,8 @@
 name: test-snapd-xdg-settings
 version: 1.0
 apps:
-  set-default-web-browser:
-    command: bin/set-default-web-browser
+  xdg-settings-wrapper:
+    command: bin/xdg-settings-wrapper
     plugs: [ desktop ]
   browser:
     command: bin/browser
diff -Nru snapd-2.45.1+20.04.2/tests/lib/snaps.sh snapd-2.48.3+20.04/tests/lib/snaps.sh
--- snapd-2.45.1+20.04.2/tests/lib/snaps.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/snaps.sh	2021-02-02 08:21:12.000000000 +0000
@@ -2,20 +2,26 @@
 
 make_snap() {
     local SNAP_NAME="$1"
-    local SNAP_DIR="$TESTSLIB/snaps/${SNAP_NAME}"
-    if [ $# -gt 1 ]; then
-        SNAP_DIR="$2"
+    local SNAP_DIR="${2:-$TESTSLIB/snaps/${SNAP_NAME}}"
+    local SNAP_VERSION="${3:-1.0}"
+
+    local META_FILE META_NAME SNAP_FILE
+    META_FILE="$SNAP_DIR/meta/snap.yaml"
+    if [ ! -f "$META_FILE" ]; then
+        echo "snap.yaml file not found for $SNAP_NAME snap"
+        return 1
     fi
-    local SNAP_FILE="${SNAP_DIR}/${SNAP_NAME}_1.0_all.snap"
+    META_NAME="$(grep '^name:' "$META_FILE" | awk '{ print $2 }' | tr -d ' ')"
+    SNAP_FILE="${SNAP_DIR}/${META_NAME}_${SNAP_VERSION}_all.snap"
     # assigned in a separate step to avoid hiding a failure
     if [ ! -f "$SNAP_FILE" ]; then
-        snap pack "$SNAP_DIR" "$SNAP_DIR" >/dev/null || return 1
+        snap pack "$SNAP_DIR" "$SNAP_DIR" >/dev/null
     fi
     # echo the snap name
     if [ -f "$SNAP_FILE" ]; then
         echo "$SNAP_FILE"
     else
-        find "$SNAP_DIR" -name '*.snap' | head -n1
+        find "$SNAP_DIR" -name "${META_NAME}_*.snap"| head -n1
     fi
 }
 
@@ -84,14 +90,50 @@
     return 1
 }
 
-# repack_core_snap_into_snapd_snap will re-pack the core snap as the snapd snap,
+# repack_snapd_deb_into_snapd_snap will re-pack a snapd snap using the assets 
+# from the snapd deb installed on the system
+repack_snapd_deb_into_snapd_snap() {
+    # use snapd from edge as a recent snap that should be close to what we will
+    # have in the snapd deb
+    snap download snapd --basename=snapd --edge
+    unsquashfs -d ./snapd-unpacked snapd.snap
+    
+    # extract all the files from the snapd deb
+    dpkg-deb -x "$SPREAD_PATH"/../snapd_*.deb ./snapd-unpacked
+
+    # repack into the target dir specified
+    snap pack --filename=snapd-from-deb.snap  snapd-unpacked "$1"
+
+    # cleanup
+    rm -rf snapd-unpacked
+}
+
+# repack_snapd_deb_into_core_snap will re-pack a core snap using the assets 
+# from the snapd deb installed on the system
+repack_snapd_deb_into_core_snap() {
+    # use snapd from edge as a recent snap that should be close to what we will
+    # have in the snapd deb
+    snap download core --basename=core --edge
+    unsquashfs -d ./core-unpacked core.snap
+    
+    # extract all the files from the snapd deb
+    dpkg-deb -x "$SPREAD_PATH"/../snapd_*.deb ./core-unpacked
+
+    # repack into the target dir specified
+    snap pack --filename=core-from-snapd-deb.snap  core-unpacked "$1"
+
+    # cleanup
+    rm -rf core-unpacked
+}
+
+# repack_installed_core_snap_into_snapd_snap will re-pack the core snap as the snapd snap,
 # using the snapd snap from edge as the set of files to use from the core snap.
 # This is primarily meant to be used in UC16 tests that need to use the snapd
-# snap because the snapd snap, nor the deb built for the spread run are seeded 
-# on the image
+# snap because neither the snapd snap, nor the snapd deb built for the spread
+# run are seeded on the image
 # The build snap is located in the current working directory at with the 
 # filename snapd-from-core.snap.
-repack_core_snap_into_snapd_snap() {
+repack_installed_core_snap_into_snapd_snap() {
   # FIXME: maybe build the snapd snap from the deb in prepare_ubuntu_core /
   # setup_reflash_magic and include it somewhere in the image so we don't need
   # to do this hack here?
diff -Nru snapd-2.45.1+20.04.2/tests/lib/state.sh snapd-2.48.3+20.04/tests/lib/state.sh
--- snapd-2.45.1+20.04.2/tests/lib/state.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/state.sh	2021-02-02 08:21:12.000000000 +0000
@@ -14,8 +14,6 @@
 # shellcheck source=tests/lib/systemd.sh
 . "$TESTSLIB/systemd.sh"
 
-# shellcheck source=tests/lib/systems.sh
-. "$TESTSLIB/systems.sh"
 
 delete_snapd_state() {
     rm -rf "$SNAPD_STATE_PATH"
@@ -26,9 +24,9 @@
 }
 
 is_snapd_state_saved() {
-    if is_core_system && [ -d "$SNAPD_STATE_PATH"/snapd-lib ]; then
+    if os.query is-core && [ -d "$SNAPD_STATE_PATH"/snapd-lib ]; then
         return 0
-    elif is_classic_system && [ -f "$SNAPD_STATE_FILE" ]; then
+    elif os.query is-classic && [ -f "$SNAPD_STATE_FILE" ]; then
         return 0
     else
         return 1
@@ -36,7 +34,7 @@
 }
 
 save_snapd_state() {
-    if is_core_system; then
+    if os.query is-core; then
         boot_path="$(get_boot_path)"
         test -n "$boot_path" || return 1
 
@@ -75,7 +73,7 @@
         core="$(readlink -f "$SNAP_MOUNT_DIR/core/current")"
         # on 14.04 it is possible that the core snap is still mounted at this point, unmount
         # to prevent errors starting the mount unit
-        if is_ubuntu_14_system && mount | grep -q "$core"; then
+        if os.query is-trusty && mount | grep -q "$core"; then
             umount "$core" || true
         fi
         for unit in $units; do
@@ -88,7 +86,7 @@
 }
 
 restore_snapd_state() {
-    if is_core_system; then
+    if os.query is-core; then
         # we need to ensure that we also restore the boot environment
         # fully for tests that break it
         boot_path="$(get_boot_path)"
@@ -128,6 +126,12 @@
     # Synchronize snaps, seed and cache directories. The this is done separately in order to avoid copying
     # the snap files due to it is a heavy task and take most of the time of the restore phase.
     rsync -av --delete "$SNAPD_STATE_PATH"/snapd-lib/snaps /var/lib/snapd
-    rsync -av --delete "$SNAPD_STATE_PATH"/snapd-lib/seed /var/lib/snapd
+    if os.query is-core20 ; then
+        # TODO:UC20: /var/lib/snapd/seed is a read only bind mount, use the rw
+        # mount or later mount seed as needed
+        rsync -av --delete "$SNAPD_STATE_PATH"/snapd-lib/seed/ /run/mnt/ubuntu-seed/
+    else
+        rsync -av --delete "$SNAPD_STATE_PATH"/snapd-lib/seed/ /var/lib/snapd/seed/
+    fi
     rsync -av --delete "$SNAPD_STATE_PATH"/snapd-lib/cache /var/lib/snapd
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/store.sh snapd-2.48.3+20.04/tests/lib/store.sh
--- snapd-2.45.1+20.04.2/tests/lib/store.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/store.sh	2021-02-02 08:21:12.000000000 +0000
@@ -5,9 +5,6 @@
 # shellcheck source=tests/lib/systemd.sh
 . "$TESTSLIB/systemd.sh"
 
-# shellcheck source=tests/lib/journalctl.sh
-. "$TESTSLIB/journalctl.sh"
-
 _configure_store_backends(){
     systemctl stop snapd.service snapd.socket
     mkdir -p "$(dirname $STORE_CONFIG)"
@@ -47,6 +44,51 @@
     new_snap_revision "$dir" "$snap_path"
 }
 
+make_snap_installable_with_id(){
+    local dir="$1"
+    local snap_path="$2"
+    local snap_id="$3"
+
+    if ! command -v yaml2json; then
+        snap install remarshal
+    fi
+    if ! command -v jq; then
+        #shellcheck source=tests/lib/core-config.sh
+        . "$TESTSLIB"/core-config.sh
+
+        SUFFIX="$(get_test_snap_suffix)"
+        snap install "jq$SUFFIX"
+    fi
+
+    # unsquash the snap to get it's name
+    unsquashfs -d /tmp/snap-squashfs "$snap_path" meta/snap.yaml
+    snap_name=$(yaml2json < /tmp/snap-squashfs/meta/snap.yaml | jq -r .name)
+    rm -rf /tmp/snap-squashfs
+
+
+    cat >> /tmp/snap-decl.json << EOF
+{
+    "type": "snap-declaration",
+    "snap-id": "${snap_id}",
+    "publisher-id": "developer1",
+    "snap-name": "${snap_name}"
+}
+EOF
+
+    cat >> /tmp/snap-rev.json << EOF
+{
+    "type": "snap-revision",
+    "snap-id": "${snap_id}"
+}
+EOF
+
+    fakestore new-snap-declaration --dir "$dir" --snap-decl-json=/tmp/snap-decl.json "$snap_path"
+    fakestore new-snap-revision --dir "$dir" --snap-rev-json=/tmp/snap-rev.json "$snap_path"
+
+    rm -rf /tmp/snap-decl.json
+    rm -rf /tmp/snap-rev.json
+}
+
 new_snap_declaration(){
     local dir="$1"
     local snap_path="$2"
@@ -83,7 +125,7 @@
 
     echo "Create fakestore at the given port"
     PORT="11028"
-    systemd_create_and_start_unit fakestore "$(command -v fakestore) run --dir $top_dir --addr localhost:$PORT --https-proxy=${https_proxy} --http-proxy=${http_proxy} --assert-fallback" "SNAPD_DEBUG=1 SNAPD_DEBUG_HTTP=7 SNAPPY_TESTING=1 SNAPPY_USE_STAGING_STORE=$SNAPPY_USE_STAGING_STORE"
+    systemd-run --unit fakestore --setenv SNAPD_DEBUG=1 --setenv SNAPD_DEBUG_HTTP=7 --setenv SNAPPY_TESTING=1 --setenv SNAPPY_USE_STAGING_STORE="$SNAPPY_USE_STAGING_STORE" fakestore run --dir "$top_dir" --addr "localhost:$PORT" --https-proxy="${https_proxy}" --http-proxy="${http_proxy}" --assert-fallback
 
     echo "And snapd is configured to use the controlled store"
     _configure_store_backends "SNAPPY_FORCE_API_URL=http://localhost:$PORT" "SNAPPY_USE_STAGING_STORE=$SNAPPY_USE_STAGING_STORE"
@@ -97,14 +139,17 @@
 
     echo "fakestore service not started properly"
     ss -ntlp | grep "127.0.0.1:$PORT" || true
-    get_journalctl_log -u fakestore || true
+    "$TESTSTOOLS"/journal-state get-log -u fakestore || true
     systemctl status fakestore || true
     exit 1
 }
 
 teardown_fake_store(){
     local top_dir=$1
-    systemd_stop_and_destroy_unit fakestore
+    systemctl stop fakestore || true
+    # when a unit fails, systemd may keep its status, resetting it allows to
+    # start the unit again with a clean slate
+    systemctl reset-failed fakestore || true
 
     if [ "$REMOTE_STORE" = "staging" ]; then
         setup_staging_store
diff -Nru snapd-2.45.1+20.04.2/tests/lib/strings.sh snapd-2.48.3+20.04/tests/lib/strings.sh
--- snapd-2.45.1+20.04.2/tests/lib/strings.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/strings.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,5 +0,0 @@
-#!/bin/bash
-
-str_to_one_line(){
-    echo "$1" | tr '\r\n' ' ' | tr -s ' '
-}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/systemd.sh snapd-2.48.3+20.04/tests/lib/systemd.sh
--- snapd-2.45.1+20.04.2/tests/lib/systemd.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/systemd.sh	2021-02-02 08:21:12.000000000 +0000
@@ -1,21 +1,11 @@
 #!/bin/bash
 
-# Use like systemd_create_and_start_unit(fakestore, "$(which fakestore) -start -dir $top_dir -addr localhost:11028 $@")
-systemd_create_and_start_unit() {
-    printf '[Unit]\nDescription=Support for test %s\n[Service]\nType=simple\nExecStart=%s\n' "${SPREAD_JOB:-unknown}" "$2" > "/run/systemd/system/$1.service"
-    if [ -n "${3:-}" ]; then
-        echo "Environment=$3" >> "/run/systemd/system/$1.service"
-    fi
-    systemctl daemon-reload
-    systemctl start "$1"
-}
-
 # Create and start a persistent systemd unit that survives reboots. Use as:
-#   systemd_create_and_start_persistent_unit "name" "my-service --args"
+#   systemd_create_and_start_unit "name" "my-service --args"
 # The third arg supports "overrides" which allow to customize the service
 # as needed, e.g.:
-#   systemd_create_and_start_persistent_unit "name" "start" "[Unit]\nAfter=foo"
-systemd_create_and_start_persistent_unit() {
+#   systemd_create_and_start_unit "name" "start" "[Unit]\nAfter=foo"
+systemd_create_and_start_unit() {
     printf '[Unit]\nDescription=Support for test %s\n[Service]\nType=simple\nExecStart=%s\n[Install]\nWantedBy=multi-user.target\n' "${SPREAD_JOB:-unknown}" "$2" > "/etc/systemd/system/$1.service"
     if [ -n "${3:-}" ]; then
         mkdir -p "/etc/systemd/system/$1.service.d"
@@ -28,19 +18,11 @@
     wait_for_service "$1"
 }
 
-system_stop_and_remove_persistent_unit() {
+systemd_stop_and_remove_unit() {
     systemctl stop "$1" || true
     systemctl disable "$1" || true
     rm -f "/etc/systemd/system/$1.service"
     rm -rf "/etc/systemd/system/$1.service.d"
-}
-
-# Use like systemd_stop_and_destroy_unit(fakestore)
-systemd_stop_and_destroy_unit() {
-    if systemctl is-active "$1"; then
-        systemctl stop "$1"
-    fi
-    rm -f "/run/systemd/system/$1.service"
     systemctl daemon-reload
 }
 
diff -Nru snapd-2.45.1+20.04.2/tests/lib/systems.sh snapd-2.48.3+20.04/tests/lib/systems.sh
--- snapd-2.45.1+20.04.2/tests/lib/systems.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/systems.sh	2021-02-02 08:21:12.000000000 +0000
@@ -1,48 +1,5 @@
 #!/bin/bash
 
-is_core_system(){
-    if [[ "$SPREAD_SYSTEM" == ubuntu-core-* ]]; then
-        return 0
-    fi
-    return 1
-}
-
-is_core16_system(){
-    if [[ "$SPREAD_SYSTEM" == ubuntu-core-16-* ]]; then
-        return 0
-    fi
-    return 1
-}
-
-is_core18_system(){
-    if [[ "$SPREAD_SYSTEM" == ubuntu-core-18-* ]]; then
-        return 0
-    fi
-    return 1
-}
-
-is_core20_system(){
-    if [[ "$SPREAD_SYSTEM" == ubuntu-core-20-* ]]; then
-        return 0
-    fi
-    return 1
-}
-
-is_classic_system(){
-    if [[ "$SPREAD_SYSTEM" != ubuntu-core-* ]]; then
-        return 0
-    fi
-    return 1
-}
-
-
-is_ubuntu_14_system(){
-    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
-        return 0
-    fi
-    return 1
-}
-
 get_snap_for_system(){
     local snap=$1
 
@@ -74,5 +31,5 @@
 }
 
 is_cgroupv2() {
-    [[ "$(stat -f -c '%T' /sys/fs/cgroup)" == "cgroup2fs" ]]
+    test "$(stat -f -c '%T' /sys/fs/cgroup)" = "cgroup2fs"
 }
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/any-python snapd-2.48.3+20.04/tests/lib/tools/any-python
--- snapd-2.45.1+20.04.2/tests/lib/tools/any-python	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/any-python	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Use any-python as interpreter in portable Python scripts.
+# Instead of /usr/bin/env python use /usr/bin/env any-python
+# The preferred choices are: Python 3, Python 2, anything called "python"
+py3="$(command -v python3)"
+py2="$(command -v python2)"
+py_dunno="$(command -v python)"
+if [ -n "$py3" ]; then
+    exec "$py3" "$@"
+elif [ -n "$py2" ]; then
+	exec "$py2" "$@"
+elif [ -n "$py_dunno" ]; then
+	exec "$py_dunno" "$@"
+else
+	echo "cannot find any Python installation" >&2
+	exit 1
+fi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/apt-state snapd-2.48.3+20.04/tests/lib/tools/apt-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/apt-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/apt-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,64 @@
+#!/usr/bin/python3
+
+import sys
+import argparse
+
+import apt
+
+
+def checkpoint() -> None:
+    pkgs = set()
+    cache = apt.Cache()
+    for pkg in cache:
+        if pkg.is_installed:
+            pkgs.add(pkg.name)
+    for name in sorted(pkgs):
+        print(name)
+
+
+def restore(fname: str) -> None:
+    desired = set([line.strip() for line in open(fname)])
+
+    cache = apt.Cache()
+    for pkg in cache:
+        if pkg.is_installed and not pkg.name in desired:
+            print("removing", pkg)
+            pkg.mark_delete(auto_fix=False)
+        if not pkg.is_installed and pkg.name in desired:
+            print("installing", pkg)
+            pkg.mark_install(auto_fix=False, auto_inst=False)
+    cache.commit()
+
+
+def _make_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser()
+    sub = parser.add_subparsers()
+    # TODO: make checkpoint and restore symmetric to use either stdin/stdout or
+    # FILE in both cases.
+    cmd = sub.add_parser(
+        "checkpoint",
+        help="preserve the set of installed packages",
+        description="Prints the set of installed installed packages.",
+    )
+    cmd.set_defaults(func=lambda ns: checkpoint())
+    cmd = sub.add_parser(
+        "restore",
+        help="restore the set of installed packages",
+        description="Adjusts the system retaining exactly the packages listed in FILE.",
+    )
+    cmd.add_argument("fname", metavar="FILE", help="preserved apt state")
+    cmd.set_defaults(func=lambda ns: restore(ns.fname))
+    return parser
+
+
+def main() -> None:
+    parser = _make_parser()
+    ns = parser.parse_args()
+    if hasattr(ns, "func"):
+        ns.func(ns)
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/boot-state snapd-2.48.3+20.04/tests/lib/tools/boot-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/boot-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/boot-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,197 @@
+#!/bin/bash
+
+show_help() {
+    echo "usage: boot-state bootenv show [var]"
+    echo "       boot-state bootenv set <var> <value>"
+    echo "       boot-state bootenv unset <var>"
+    echo "       boot-state boot-path"
+    echo "       boot-state wait-core-post-boot"
+    echo ""
+    echo "Get information and manages the boot loader for the current system"
+    echo ""
+    echo "COMMANDS:"
+    echo "  bootenv show:         prints the whole bootenv or just the variable passed as parameter"
+    echo "  bootenv set:          sets the given var and value on boot configuration"
+    echo "  bootenv unset:        unsets the given var from boot configuration"
+    echo "  boot-path:            prints the boot path"
+    echo "  wait-core-post-boot:  waits until the snap_mode bootenv var is empty"
+}
+
+get_grub_editenv() {
+    if [ -e /boot/grub2/grubenv ]; then
+        command -v grub2-editenv
+    elif [ -e /boot/grub/grubenv ]; then
+        command -v grub-editenv
+    fi
+}
+
+run_grub_editenv() {
+    "$(get_grub_editenv)" "$@"
+}
+
+get_grub_envfile() {
+    if [ -e /boot/grub2/grubenv ]; then
+        echo /boot/grub2/grubenv
+    elif [ -e /boot/grub/grubenv ]; then
+        echo /boot/grub/grubenv
+    else
+        echo ""
+    fi
+}
+
+bootenv() {
+    case "${1:-}" in
+        show)
+            shift
+            bootenv_show "$@"
+            exit
+            ;;
+        set)
+            shift
+            bootenv_set "$@"
+            exit
+            ;;
+        unset)
+            shift
+            bootenv_unset "$@"
+            exit
+            ;;
+        *)
+            echo "boot-state: unsupported bootenv sub-command $1" >&2
+            show_help
+            exit 1
+            ;;
+    esac
+}
+
+bootenv_show() {
+    local var="${1:-}"
+    local grubenv_file
+    grubenv_file="$(get_grub_envfile)"
+
+    if [ -z "$var" ]; then
+        if run_grub_editenv list; then
+            return
+        elif [ -s "$grubenv_file" ]; then
+            cat "$grubenv_file"
+        else
+            fw_printenv
+        fi
+    else
+        # TODO: fix that, it could be problematic if var ends up with regular expression
+        if run_grub_editenv list | grep "^$var"; then
+            return
+        elif [ -s "$grubenv_file" ]; then
+            grep "^$var" "$grubenv_file"
+        else
+            fw_printenv "$1"
+        fi | sed "s/^${var}=//"
+    fi
+}
+
+bootenv_set() {
+    local var="$1"
+    local value="$2"
+
+    if [ -z "$var" ] || [ -z "$value" ]; then
+        echo "boot-state: variable and value required to set in bootenv" >&2
+        show_help
+        exit 1
+    fi
+    local grubenv_file
+    grubenv_file="$(get_grub_envfile)"
+
+    if run_grub_editenv set "$var=$value"; then
+        return
+    elif [ -s "$grubenv_file" ]; then
+        sed -i "/^$var=/d" "$grubenv_file"
+        #The grubenv file could not have a new line at the end
+        if [ -n "$(tail -n 1 "$grubenv_file")" ]; then
+            echo "" >> "$grubenv_file"
+        fi
+        echo "$var=$value" >> "$grubenv_file"
+    else
+        fw_setenv "$var" "$value"
+    fi
+}
+
+bootenv_unset() {
+    local var="$1"
+
+    if [ -z "$var" ]; then
+        echo "boot-state: variable required to unset from bootenv" >&2
+        show_help
+        exit 1
+    fi
+    local grubenv_file
+    grubenv_file="$(get_grub_envfile)"
+
+    if run_grub_editenv "$grubenv_file" unset "$var"; then
+        return
+    elif [ -s "$grubenv_file" ]; then
+        sed -i "/^$var=/d" "$grubenv_file"
+    else
+        fw_setenv "$var"
+    fi
+}
+
+boot_path() {
+    if [ -f /boot/uboot/uboot.env ] || [ -f /boot/uboot/boot.sel ]; then
+        # uc16/uc18 have /boot/uboot/uboot.env
+        # uc20 has /boot/uboot/boot.sel
+        echo "/boot/uboot/"
+    elif [ -f /boot/grub/grubenv ]; then
+        echo "/boot/grub/"
+    elif [ -f /boot/grub2/grubenv ]; then
+        echo "/boot/grub2/"
+    else
+        echo "boot-state: cannot determine boot path" >&2
+        ls -alR /boot
+        exit 1
+    fi
+}
+
+wait_core_post_boot() {
+    for _ in $(seq 120); do
+        if [ "$(bootenv_show snap_mode)" = "" ]; then
+            return
+        fi
+        sleep 1
+    done
+    echo "boot-state: timeout reached waiting for core after boot" >&2
+    exit 1
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    case "$1" in
+        -h|--help)
+            show_help
+            exit
+            ;;
+        bootenv)
+            shift
+            bootenv "$@"
+            exit
+            ;;
+        boot-path)
+            boot_path
+            exit
+            ;;
+        wait-core-post-boot)
+            wait_core_post_boot
+            exit
+            ;;
+        *)
+            echo "boot-state: unsupported parameter $1" >&2
+            show_help
+            exit 1
+            ;;
+    esac
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/cleanup-state snapd-2.48.3+20.04/tests/lib/tools/cleanup-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/cleanup-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/cleanup-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,87 @@
+#!/bin/sh
+
+show_help() {
+	echo "usage: cleanup-state <pre-invariant|post-invariant>"
+	echo
+	echo "Runs cleanup actions of the selected class:"
+	echo "   pre-invariant:"
+	echo "      Clean state that is currently expected to leak from"
+	echo "      any test, due to imperfections in the code."
+	echo "   post-invariant:"
+	echo "      Clean state that is not expected to be restored by"
+	echo "      each test, that should not leak across tests."
+}
+
+if [ $# -eq 0 ]; then
+	show_help
+	exit 1
+fi
+
+action=
+while [ $# -gt 0 ]; do
+	case "$1" in
+		-h|--help)
+			show_help
+			exit 0
+			;;
+		--)
+			shift
+			break
+			;;
+		pre-invariant)
+			action=pre-invariant
+			shift
+			;;
+		post-invariant)
+			action=post-invariant
+			shift
+			;;
+		-*)
+			echo "cleanup-state: unsupported argument $1" >&2
+			exit 1
+			;;
+		*)
+			echo "cleanup-state: unknown action $1" >&2
+			exit 1
+			;;
+	esac
+done
+
+case "$action" in
+	pre-invariant)
+		# If the root user has a systemd --user instance then ask it to reload.
+		# This prevents tests from leaking user-session services that stay in
+		# memory but are not present on disk, or have been modified on disk, as is
+		# common with tests that use snaps with user services _or_ with tests that
+		# cause installation of the snapd.session-agent.service unit via re-exec
+		# machinery.
+		#
+		# This is done AHEAD of the invariant checks as it is very widespread
+		# and fixing it in each test is not a priority right now.
+		#
+		# Note that similar treatment is not required for the "test" user as
+		# correct usage of tests.session ensures that the session and all the
+		# processes of the "test" user are terminated.
+		if pgrep -u root --full "systemd --user"; then
+			systemctl --user daemon-reload
+			# Following that, check if there's a snapd.session-agent.socket and
+			# if one exists stop it and then start it, ignoring errors.  If the
+			# unit was removed, stopping it clears it from memory. This is
+			# different from restarting the unit, which doesn't do anything if
+			# the unit on disk is gone.
+			if systemctl --user is-active snapd.session-agent.socket; then
+				systemctl --user stop snapd.session-agent.socket
+			fi
+			# XXX: if there's a way to check if an unit exists but is stopped,
+			# use it here to avoid starting a non-existing unit.
+			systemctl --user start snapd.session-agent.socket || true
+		fi
+		;;
+	post-invariant)
+		true
+		;;
+	*)
+		echo "cleanup-state: unknown action $action" >&2
+		exit 1
+		;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/fs-state snapd-2.48.3+20.04/tests/lib/tools/fs-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/fs-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/fs-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+show_help() {
+    echo "usage: fs-state mock-dir [dirname]"
+    echo "       fs-state restore-dir [dirname]"
+    echo "       fs-state mock-file [filename]"
+    echo "       fs-state restore-file [filename]"
+}
+
+_mock_dir() {
+    local dir="$1"
+    if [ ! -d "$dir" ]; then
+        echo "fs-state: created mock directory: $dir"
+        mkdir -p "$dir"
+        touch "$dir.fake"
+    fi
+}
+
+mock_dir() {
+    local dir="$1"
+    if [ -d "$dir" ]; then
+        mv "$dir" "$dir.back"
+    fi
+    _mock_dir "$dir"
+}
+
+restore_dir() {
+    local dir="$1"
+
+    if [ -e "$dir.fake" ]; then
+        echo "fs-state: restoring mocked directory: $dir"
+        rm -rf "$dir"
+        rm -f "$dir.fake"
+    else
+        echo "fs-state: cannot restore non-mocked directory: $dir" >&2
+        exit 1
+    fi
+    if [ -d "$dir.back" ]; then
+        mv "$dir.back" "$dir"
+    fi
+}
+
+_mock_file() {
+    local file="$1"
+    if [ ! -e "$file" ]; then
+        echo "fs-state: creating file: $file"
+        echo "The file is a mock file used by fs-state." > "$file"
+        echo "The .fake file is a marker file used by fs-state." > "$file.fake"
+    fi
+}
+
+mock_file() {
+    local file="$1"
+    if [ -e "$file" ]; then
+        echo "fs-state: backing up original file: $file"
+        mv "$file" "$file.back"
+    fi
+    # ensure the parent dir is available
+    if [ ! -d "$(dirname "$file")" ]; then
+        mkdir -p "$(dirname "$file")"
+    fi
+    _mock_file "$file"
+}
+
+restore_file() {
+    local file="$1"
+    if [ -e "$file.fake" ]; then
+        echo "fs-state: restoring mocked file: $file"
+        rm -f "$file"
+        rm -f "$file.fake"
+    else
+        echo "fs-state: cannot restore non-mocked file: $file" >&2
+        exit 1
+    fi
+    if [ -e "$file.back" ]; then
+        mv "$file.back" "$file"
+    fi
+}
+
+if [ $# -eq 0 ]; then
+    show_help
+    exit 0
+fi
+
+action=
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -h|--help|'')
+            show_help
+            exit 0
+            ;;
+        *)
+            action=$(echo "$1" | tr '-' '_')
+            shift
+            break
+            ;;
+    esac
+done
+
+"$action" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/journal-state snapd-2.48.3+20.04/tests/lib/tools/journal-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/journal-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/journal-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# This file contains all the cursors used for the different tests
+JOURNALCTL_CURSOR_FILE="$SPREAD_PATH"/tests/runtime-state/journalctl_cursor
+
+show_help() {
+    echo "usage: journal-state start-new-log"
+    echo "       journal-state check-log-started"
+    echo "       journal-state get-last-cursor"
+    echo "       journal-state match-log [expression]"
+    echo "       journal-state get-log"
+    echo "       journal-state get-log-from-cursor"
+}
+
+get_last_cursor(){
+    journalctl --output=export -n1 | grep --binary-files=text -o '__CURSOR=.*' | sed -e 's/^__CURSOR=//'
+}
+
+start_new_log(){
+    _sync_log
+    echo "New test starts here - $SPREAD_JOB" | systemd-cat -t snapd-test
+    cursor=$(get_last_cursor)
+    if [ -z "$cursor" ]; then
+        echo "Empty journalctl cursor, exiting..."
+        exit 1
+    else
+        echo "$SPREAD_JOB " >> "$JOURNALCTL_CURSOR_FILE"
+        echo "$cursor" >> "$JOURNALCTL_CURSOR_FILE"
+    fi
+}
+
+check_log_started(){
+    marker="test-${RANDOM}${RANDOM}"
+    echo "Running test: $marker" | systemd-cat -t snapd-test
+    if match_log "$marker"; then
+        return 0
+    fi
+    echo "Test id not found in journalctl, exiting..."
+    exit 1
+}
+
+match_log(){
+    expression=$1
+    shift
+    for _ in $(seq 10); do
+        # forcibly silence this particular bit because it produces GOBS of 
+        # output and we really don't need to see all the output when we are 
+        # checking the output for an expression, as if it is missing we want to 
+        # check the journal once at the end of this loop, likely in the debug 
+        # section
+        set +x
+        log=$(get_log "$@")
+        if echo "$log" | grep -q -E "$expression"; then
+            return 0
+        fi
+        set -x
+        echo "Match for \"$expression\" failed, retrying"
+        sleep 1
+    done
+    return 1
+}
+
+get_log(){
+    cursor=""
+    if [ -f "$JOURNALCTL_CURSOR_FILE" ]; then
+        cursor=$(tail -n1 "$JOURNALCTL_CURSOR_FILE")
+    fi
+    _sync_log
+    get_log_from_cursor "$cursor" "$@"
+}
+
+get_log_from_cursor(){
+    cursor=$1
+    shift
+    if [ -z "$cursor" ]; then
+        journalctl "$@"
+    else
+        journalctl "$@" --cursor "$cursor"
+    fi
+}
+
+_sync_log(){
+    journalctl --flush || true
+    journalctl --sync || true
+}
+
+if [ $# -eq 0 ]; then
+    show_help
+    exit 0
+fi
+
+subcommand=$1
+action=
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -h|--help)
+            show_help
+            exit 0
+            ;;
+        *)
+            action=$(echo "$subcommand" | tr '-' '_')
+            shift
+            break
+            ;;
+    esac
+done
+
+if [ -z "$(declare -f "$action")" ]; then
+    echo "journal-state: no such command $subcommand" >&2
+    show_help
+    exit 1
+fi
+
+"$action" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/lxd-state snapd-2.48.3+20.04/tests/lib/tools/lxd-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/lxd-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/lxd-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,38 @@
+#!/bin/sh -e
+case "${1:-}" in
+    -h|--help|'')
+        echo "usage: lxd-state [-h] {undo-mount-changes} ..."
+        ;;
+    undo-mount-changes)
+        # Vanilla systems have /sys/fs/cgroup/cpuset without clone_children option.
+        # Using LXD to create a container enables this option, as can be seen here:
+        #
+        # -37 32 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:15 - cgroup cgroup rw,cpuset
+        # +37 32 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:15 - cgroup cgroup rw,cpuset,clone_children
+        #
+        # To restore vanilla state, disable the option now.
+        if [ "$(mountinfo.query /sys/fs/cgroup/cpuset .fs_type)" = cgroup ]; then
+            echo 0 > /sys/fs/cgroup/cpuset/cgroup.clone_children
+        fi
+
+        # Vanilla system have /sys/fs/cgroup/unified mounted with the nsdelegate
+        # option which is available since kernel 4.13 Using LXD to create a
+        # container disables this options, as can be seen here:
+        #
+        # -32 31 0:27 / /sys/fs/cgroup/unified rw,nosuid,nodev,noexec,relatime shared:10 - cgroup2 cgroup rw,nsdelegate
+        # +32 31 0:27 / /sys/fs/cgroup/unified rw,nosuid,nodev,noexec,relatime shared:10 - cgroup2 cgroup rw
+        #
+        # To restore vanilla state, enable the option now, but only if the kernel supports that.
+        # https://lore.kernel.org/patchwork/patch/803265/
+        # https://github.com/systemd/systemd/commit/4095205ecccdfddb822ee8fdc44d11f2ded9be24
+        # The kernel version must be made compatible with the strict version
+        # comparison. I chose to cut at the "-" and take the stuff before it.
+        if [ "$(mountinfo.query /sys/fs/cgroup/unified .fs_type)" = cgroup2 ] && "$TESTSTOOLS"/version-compare --strict "$(uname -r | cut -d- -f 1)" -ge 4.13; then
+            mount -o remount,nsdelegate /sys/fs/cgroup/unified
+        fi
+        ;;
+    *)
+        echo "lxd-state: unknown command $*" >&2
+        exit 1
+        ;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/MATCH snapd-2.48.3+20.04/tests/lib/tools/MATCH
--- snapd-2.45.1+20.04.2/tests/lib/tools/MATCH	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/MATCH	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Source spread-funcs.sh which, at runtime, contains the real definition of
+# MATCH and execute it.
+
+# shellcheck source=tests/lib/spread-funcs.sh 
+. "$TESTSLIB/spread-funcs.sh"
+
+MATCH "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/memory-observe-do snapd-2.48.3+20.04/tests/lib/tools/memory-observe-do
--- snapd-2.45.1+20.04.2/tests/lib/tools/memory-observe-do	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/memory-observe-do	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,84 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+import os
+import argparse
+
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import List, Tuple, Text
+
+
+def invoke(cmd):
+    # type: (List[Text]) -> Tuple[int, int]
+    """
+    invoke invokes command and returns the pair (result, max_rss)
+
+    For normal termination result is >= 0 and conveys the exit code.
+    For abnormal termination result is < 0 and conveys the signal number.
+    """
+    pid = os.fork()
+    if pid == 0:
+        # child
+        os.execvpe(cmd[0], cmd, os.environ)
+        os.exit(127)
+    else:
+        # parent
+        _, wait_status, rusage = os.wait4(pid, 0)
+        if os.WIFEXITED(wait_status):
+            exit_code = os.WEXITSTATUS(wait_status)
+            return exit_code, rusage.ru_maxrss
+        elif os.WIFSIGNALED(wait_status):
+            sig_num = os.WTERMSIG(wait_status)
+            return -sig_num, rusage.ru_maxrss
+        else:
+            raise OSError("unexpected wait status {}".format(wait_status))
+
+
+def _make_parser():
+    # type: () -> argparse.ArgumentParser
+    parser = argparse.ArgumentParser(
+        description="""
+This program executes COMMAND and stores the maximum size of RSS
+into the specified file. The exit status of COMMAND is preserved.
+"""
+    )
+    parser.add_argument(
+        "-o", dest="output",
+        metavar="RSS-FILE",
+        type=argparse.FileType(mode="w"),
+        help="write maximum RSS size to given file",
+    )
+    parser.add_argument(
+        "cmd", metavar="COMMAND", nargs="...", help="command to execute"
+    )
+    return parser
+
+
+def main():
+    # type: () -> None
+    parser = _make_parser()
+    ns = parser.parse_args()
+    # The command cannot be empty but it is difficult to express in argparse
+    # itself.
+    if len(ns.cmd) == 0:
+        parser.print_usage()
+        parser.exit(0)
+    try:
+        result, max_rss = invoke(ns.cmd)
+        if ns.output is not None:
+            ns.output.write("{}\n".format(max_rss))
+            ns.output.close()
+        raise SystemExit(result)
+    except OSError as exc:
+        raise SystemExit(exc)
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/mountinfo.query snapd-2.48.3+20.04/tests/lib/tools/mountinfo.query
--- snapd-2.45.1+20.04.2/tests/lib/tools/mountinfo.query	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/mountinfo.query	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,1325 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+from argparse import Action, ArgumentParser, FileType, RawTextHelpFormatter, SUPPRESS
+import re
+import sys
+import unittest
+
+# PY2 is true when we're running under Python 2.x It is used for appropriate
+# return value selection of __str__ and __repr_ methods, which must both
+# return str, not unicode (in Python 2) and str (in Python 3). In both cases
+# the return type annotation is exactly the same, but due to unicode_literals
+# being in effect, and the fact we often use a format string (which is an
+# unicode string in Python 2), we must encode the it to byte string when
+# running under Python 2.
+PY2 = sys.version_info[0] == 2
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import Any, Dict, List, Text, Tuple, Match, Optional, Union, Sequence
+    from argparse import Namespace
+
+
+class sint(int):
+    """sint is an integer that always renders with sign."""
+
+    def __str__(self):
+        # type: () -> str
+        result = "{:+}".format(int(self))
+        if PY2:
+            return result.encode()
+        return result
+
+    def __repr__(self):
+        # type: () -> str
+        result = "sint({:+})".format(int(self))
+        if PY2:
+            return result.encode()
+        return result
+
+
+class SintTests(unittest.TestCase):
+    def test_smoke(self):
+        # type: () -> None
+        self.assertEqual(sint(1), 1)
+        self.assertEqual(sint(-1), -1)
+        self.assertEqual(hash(sint(1)), hash(1))
+
+    def test_str(self):
+        # type: () -> None
+        self.assertEqual("{}".format(sint(1)), "+1")
+        self.assertEqual("{}".format(sint(-1)), "-1")
+
+    def test_repor(self):
+        # type: () -> None
+        self.assertEqual("{!r}".format(sint(1)), "sint(+1)")
+        self.assertEqual("{!r}".format(sint(-1)), "sint(-1)")
+
+
+class Device(object):
+    """Device is a device number with major and minor components."""
+
+    def __init__(self, major, minor):
+        # type: (int, int) -> None
+        self.major = major
+        self.minor = minor
+
+    def __hash__(self):
+        # type: () -> int
+        return hash((self.major, self.minor))
+
+    def __eq__(self, other):
+        # type: (object) -> Union[NotImplemented, bool]
+        if not isinstance(other, Device):
+            return NotImplemented
+        return self.major == other.major and self.minor == other.minor
+
+    def __str__(self):
+        # type: () -> str
+        result = "{}:{}".format(self.major, self.minor)
+        if PY2:
+            return result.encode()
+        return result
+
+    def __repr__(self):
+        # type: () -> str
+        result = "Device({}, {})".format(self.major, self.minor)
+        if PY2:
+            return result.encode()
+        return result
+
+    @classmethod
+    def differentiate(cls, a, b):
+        # type: (Device, Device) -> Device
+        return cls(sint(a.major - b.major), sint(a.minor - b.minor))
+
+
+def _format_opt_fields(fields):
+    # type: (List[Text]) -> str
+    """_format_opt_fields returns the special formatting of optional fields."""
+    if len(fields):
+        result = " ".join(fields) + " -"
+    else:
+        result = "-"
+    if PY2:
+        return result.encode()
+    return result
+
+
+def _diff_opt_fields(a, b):
+    # type: (List[Text], List[Text]) -> List[Text]
+    if len(a) != len(b):
+        return a
+    diff = []  # type: List[Text]
+    for elem_a, elem_b in zip(a, b):
+        key_a, value_a = elem_a.split(":", 1)
+        key_b, value_b = elem_b.split(":", 1)
+        if key_a != key_b:
+            return a
+        try:
+            value_a_int = int(value_a)
+            value_b_int = int(value_b)
+        except ValueError:
+            return a
+        diff.append("{}:{}".format(key_a, sint(value_a_int - value_b_int)))
+    return diff
+
+
+class DifferntiateOptionalFieldsTest(unittest.TestCase):
+    def test_ok(self):
+        # type: () -> None
+        a = OptionalFields(["master:6"])
+        b = OptionalFields(["master:5"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:+1"]))
+
+    def test_ok_many(self):
+        # type: () -> None
+        a = OptionalFields(["master:6", "shared:10"])
+        b = OptionalFields(["master:5", "shared:7"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:+1", "shared:+3"]))
+
+    def test_different_lengths(self):
+        # type: () -> None
+        a = OptionalFields(["master:6", "shared:2"])
+        b = OptionalFields(["shared:7"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:6", "shared:2"]))
+
+    def test_different_keys(self):
+        # type: () -> None
+        a = OptionalFields(["master:6"])
+        b = OptionalFields(["shared:7"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:6"]))
+
+    def test_non_numeric_value(self):
+        # type: () -> None
+        a = OptionalFields(["master:9"])
+        b = OptionalFields(["master:nan"])
+        aDelta = OptionalFields.differentiate(a, b)
+        self.assertEqual(aDelta, OptionalFields(["master:9"]))
+
+
+# OptionalFields is a specialization of List[Text] but because of some Python 2
+# distributions lacking the typing module, we must define a variant for mypy
+# and one for without mypy. In both cases the customized formatting logic is
+# implemented by _format_opt_fields().
+if MYPY:
+
+    class OptionalFields(List[Text]):
+        def __str__(self):
+            # type: () -> str
+            return _format_opt_fields(self)
+
+        @classmethod
+        def differentiate(cls, a, b):
+            # type: (OptionalFields, OptionalFields) -> OptionalFields
+            return cls(_diff_opt_fields(a, b))
+
+
+else:
+
+    class OptionalFields(list):
+        def __str__(self):
+            # type: () -> str
+            return _format_opt_fields(self)
+
+        @classmethod
+        def differentiate(cls, a, b):
+            # type: (OptionalFields, OptionalFields) -> OptionalFields
+            return cls(_diff_opt_fields(a, b))
+
+
+class OptionalFieldsTests(unittest.TestCase):
+    def test_str(self):
+        # type: () -> None
+        fields = OptionalFields()
+        self.assertEqual("{}".format(fields), "-")
+        fields.append("master:123")
+        self.assertEqual("{}".format(fields), "master:123 -")
+
+
+class MountInfoEntry(object):
+    """Single entry in /proc/pid/mointinfo, see proc(5)"""
+
+    known_attrs = {
+        "mount_id": int,
+        "parent_id": int,
+        "dev": Device,
+        "root_dir": str,
+        "mount_point": str,
+        "mount_opts": str,
+        "opt_fields": list,
+        "fs_type": str,
+        "mount_source": str,
+        "sb_opts": str,
+    }
+
+    def __init__(self):
+        # type: () -> None
+        self.mount_id = 0
+        self.parent_id = 0
+        self.dev = Device(0, 0)
+        self.root_dir = ""
+        self.mount_point = ""
+        self.mount_opts = ""
+        self.opt_fields = OptionalFields()  # type: OptionalFields
+        self.fs_type = ""
+        self.mount_source = ""
+        self.sb_opts = ""
+        # Attributes beyond this line do not represent kernel state.
+        # Marker for an entry being matched by a filter.
+        self.matched = False
+
+    @classmethod
+    def differentiate(cls, a, b):
+        # type: (MountInfoEntry, MountInfoEntry) -> MountInfoEntry
+        diff = MountInfoEntry()
+        diff.matched = a.matched
+        # Diff all the attributes that it makes sense to diff
+        diff.mount_id = sint(a.mount_id - b.mount_id)
+        diff.parent_id = sint(a.parent_id - b.parent_id)
+        diff.dev = Device.differentiate(a.dev, b.dev)
+        diff.root_dir = a.root_dir
+        diff.mount_point = a.mount_point
+        diff.mount_opts = a.mount_opts
+        diff.opt_fields = OptionalFields.differentiate(a.opt_fields, b.opt_fields)
+        diff.fs_type = a.fs_type
+        diff.mount_source = a.mount_source
+        diff.sb_opts = a.sb_opts
+        return diff
+
+    def __eq__(self, other):
+        # type: (object) -> Union[NotImplemented, bool]
+        if not isinstance(other, MountInfoEntry):
+            return NotImplemented
+        return (
+            self.mount_id == other.mount_id
+            and self.parent_id == other.parent_id
+            and self.dev == other.dev
+            and self.root_dir == other.root_dir
+            and self.mount_point == other.mount_point
+            and self.mount_opts == other.mount_opts
+            and self.opt_fields == other.opt_fields
+            and self.fs_type == other.fs_type
+            and self.mount_source == other.mount_source
+            and self.sb_opts == other.sb_opts
+        )
+
+    @classmethod
+    def parse(cls, line):
+        # type: (Text) -> MountInfoEntry
+        it = iter(line.split())
+        self = cls()
+        self.mount_id = int(next(it))
+        self.parent_id = int(next(it))
+        dev_maj, dev_min = map(int, next(it).split(":"))
+        self.dev = Device(dev_maj, dev_min)
+        self.root_dir = next(it)
+        self.mount_point = next(it)
+        self.mount_opts = next(it)
+        self.opt_fields = OptionalFields()
+        for opt_field in it:
+            if opt_field == "-":
+                break
+            self.opt_fields.append(opt_field)
+        self.fs_type = next(it)
+        self.mount_source = next(it)
+        self.sb_opts = next(it)
+        try:
+            next(it)
+        except StopIteration:
+            pass
+        else:
+            raise ValueError("leftovers after parsing {!r}".format(line))
+        return self
+
+    def __str__(self):
+        # type: () -> str
+        result = (
+            "{0.mount_id} {0.parent_id} {0.dev} {0.root_dir}"
+            " {0.mount_point} {0.mount_opts} {0.opt_fields} {0.fs_type}"
+            " {0.mount_source} {0.sb_opts}"
+        ).format(self)
+        if PY2:
+            return result.encode()
+        return result
+
+    def __repr__(self):
+        # type: () -> str
+        result = "MountInfoEntry.parse({!r})".format(str(self))
+        if PY2:
+            return result.encode()
+        return result
+
+    @property
+    def dev_maj(self):
+        # type: () -> int
+        return self.dev.major
+
+    @property
+    def dev_min(self):
+        # type: () -> int
+        return self.dev.minor
+
+
+class FilterExpr(object):
+    """FilterExpr is the interface for filtering mount entries."""
+
+    def __contains__(self, entry):
+        # type: (MountInfoEntry) -> bool
+        """__contains__ returns true if a mount entry matches the filter."""
+
+
+class AttrFilter(FilterExpr):
+    """AttrFilter performs equality test against a given attribute."""
+
+    def __init__(self, attr, value):
+        # type: (Text, Any) -> None
+        self.attr = attr
+        self.value = value
+
+    def __contains__(self, entry):
+        # type: (MountInfoEntry) -> bool
+        value = getattr(entry, self.attr)
+        return bool(value == self.value)
+
+
+class AttrPrefixFilter(FilterExpr):
+    """AttrPrefixFilter performs prefix test against a given attribute."""
+
+    def __init__(self, attr, value):
+        # type: (Text, Text) -> None
+        self.attr = attr
+        self.value = value
+
+    def __contains__(self, entry):
+        # type: (MountInfoEntry) -> bool
+        value = str(getattr(entry, self.attr))
+        return value.startswith(self.value)
+
+
+def parse_filter(expr):
+    # type: (Text) -> FilterExpr
+    """parse_filter parses one of the known filter expressions."""
+    if "=" in expr:
+        # Accept both .attr=value and attr=value as exact attribute match.
+        if expr.startswith("."):
+            expr = expr.lstrip(".")
+        attr, value = expr.split("=", 1)
+        try:
+            typ = MountInfoEntry.known_attrs[attr]
+        except KeyError:
+            raise ValueError("invalid filter expression {!r}".format(expr))
+        else:
+            return AttrFilter(attr, typ(value))
+    elif expr.endswith("..."):
+        # Treat /path/... as prefix match on mount_point.
+        return AttrPrefixFilter("mount_point", expr.rstrip("..."))
+    else:
+        # Treat /path as exact match on mount_point.
+        return AttrFilter("mount_point", expr)
+
+
+def parse_attr(expr):
+    # type: (Text) -> Text
+    """parse_attr parses attribute references (for display)."""
+    known = sorted(MountInfoEntry.known_attrs)
+    if expr.lstrip(".") in known:
+        return expr.lstrip(".")
+    raise ValueError(
+        "invalid attribute selector {!r}" " (known: {})".format(expr, known)
+    )
+
+
+def parse_exprs(exprs):
+    # type: (List[Text]) -> Tuple[List[FilterExpr], List[Text]]
+    """parse_exprs parses filter expressions and attribute references."""
+    # Filters are either .attr=value, /path, /path...
+    filters = [
+        parse_filter(expr) for expr in exprs if "=" in expr or not expr.startswith(".")
+    ]
+    # Attributes are always .attr
+    attrs = [
+        parse_attr(expr) for expr in exprs if expr.startswith(".") and "=" not in expr
+    ]
+    return filters, attrs
+
+
+def matches(entry, filters):
+    # type: (MountInfoEntry, List[FilterExpr]) -> bool
+    """
+    matches checks if a mount entry matches a list of filter expressions.
+    Filter expressions are ANDed together.
+    """
+    for f in filters:
+        if entry not in f:
+            return False
+    return True
+
+
+def renumber_snap_revision(entry, seen):
+    # type: (MountInfoEntry, Dict[Tuple[Text, Text], int]) -> None
+    """renumber_snap_revisions re-numbers snap revision numbers in paths."""
+
+    def compose_preferred(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:3] + ["{}".format(n)] + parts[4:]
+
+    def compose_alternate(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:6] + ["{}".format(n)] + parts[7:]
+
+    def compose_hostfs_preferred(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:7] + ["{}".format(n)] + parts[8:]
+
+    def compose_hostfs_alternate(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:10] + ["{}".format(n)] + parts[11:]
+
+    def compose_writable(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:5] + ["{}".format(n)] + parts[6:]
+
+    def compose_hostfs_writable(parts, n):
+        # type: (List[Text], int) -> List[Text]
+        return parts[:9] + ["{}".format(n)] + parts[10:]
+
+    def alloc_n(snap_name, snap_rev):
+        # type: (Text, Text) -> int
+        key = (snap_name, snap_rev)
+        try:
+            return seen[key]
+        except KeyError:
+            n = len([name for (name, rev) in seen if name == snap_name]) + 1
+            seen[key] = n
+            return n
+
+    parts = entry.mount_point.split("/")
+    if len(parts) >= 4 and parts[:2] == ["", "snap"]:
+        snap_name = parts[2]
+        snap_rev = parts[3]
+        compose = compose_preferred
+    elif len(parts) >= 7 and parts[:5] == ["", "var", "lib", "snapd", "snap"]:
+        snap_name = parts[5]
+        snap_rev = parts[6]
+        compose = compose_alternate
+    elif len(parts) >= 6 and parts[:4] == ["", "writable", "system-data", "snap"]:
+        snap_name = parts[4]
+        snap_rev = parts[5]
+        compose = compose_writable
+    elif len(parts) >= 8 and parts[:6] == ["", "var", "lib", "snapd", "hostfs", "snap"]:
+        snap_name = parts[6]
+        snap_rev = parts[7]
+        compose = compose_hostfs_preferred
+    elif len(parts) >= 11 and parts[:9] == [
+        "",
+        "var",
+        "lib",
+        "snapd",
+        "hostfs",
+        "var",
+        "lib",
+        "snapd",
+        "snap",
+    ]:
+        snap_name = parts[9]
+        snap_rev = parts[10]
+        compose = compose_hostfs_alternate
+    elif len(parts) >= 10 and parts[:8] == [
+        "",  # 0
+        "var",  # 1
+        "lib",  # 2
+        "snapd",  # 3
+        "hostfs",  # 4
+        "writable",  # 5
+        "system-data",  # 6
+        "snap",  # 7
+    ]:
+        snap_name = parts[8]
+        snap_rev = parts[9]
+        compose = compose_hostfs_writable
+    else:
+        return
+    n = alloc_n(snap_name, snap_rev)
+    entry.mount_point = "/".join(compose(parts, n))
+
+
+def renumber_opt_fields(entry, seen, base_n):
+    # type: (MountInfoEntry, Dict[int, int], int) -> None
+    """renumber_opt_fields re-numbers peer group in optional fields."""
+
+    def alloc_n(peer_group):
+        # type: (int) -> int
+        key = peer_group
+        try:
+            return seen[key]
+        except KeyError:
+            n = (
+                len({orig for orig, renumbered in seen.items() if renumbered >= base_n})
+                + base_n
+                + 1
+            )
+            seen[key] = n
+            return n
+
+    def fn(m):
+        # type: (Match[Text]) -> Text
+        return "{}".format(alloc_n(int(m.group(1))))
+
+    entry.opt_fields = OptionalFields(
+        [re.sub("(\\d+)", fn, opt) for opt in entry.opt_fields]
+    )
+
+
+def renumber_loop_devices(entry, seen):
+    # type: (MountInfoEntry, Dict[int, int]) -> None
+    """renumber_loop_devices re-numbers loop device numbers."""
+
+    def alloc_n(loop_nr):
+        # type: (int) -> int
+        key = loop_nr
+        try:
+            return seen[key]
+        except KeyError:
+            n = len(seen)
+            seen[key] = n
+            return n
+
+    def fn(m):
+        # type: (Match[Text]) -> Text
+        return "loop{}".format(alloc_n(int(m.group(1))))
+
+    entry.mount_source = re.sub("loop(\\d+)", fn, entry.mount_source)
+
+
+def renumber_mount_ids(entry, seen, base_n):
+    # type: (MountInfoEntry, Dict[int, int], int) -> None
+    """renumber_mount_ids re-numbers mount and parent mount IDs."""
+
+    def alloc_n(mount_id):
+        # type: (int) -> int
+        key = mount_id
+        try:
+            return seen[key]
+        except KeyError:
+            n = (
+                len({orig for orig, renumbered in seen.items() if renumbered >= base_n})
+                + base_n
+            )
+            seen[key] = n
+            return n
+
+    # NOTE: renumber the parent ahead of the mount to get more
+    # expected relationship between them.
+    entry.parent_id = alloc_n(entry.parent_id)
+    entry.mount_id = alloc_n(entry.mount_id)
+
+
+def renumber_devices(entry, seen):
+    # type: (MountInfoEntry, Dict[Device, Device]) -> None
+    """renumber_devices re-numbers major:minor device numbers."""
+
+    def alloc_n(dev):
+        # type: (Device) -> Device
+        key = dev
+        try:
+            return seen[key]
+        except KeyError:
+            # We haven't seen the major:minor pair precisely but perhaps we've
+            # seen the major number already? Check if this major is already
+            # remapped, if so reuse that value. If not just allocate the next
+            # one based on cardinality of the set of major numbers we've seen.
+            major = 0
+            for orig, remapped in seen.items():
+                if orig.major == dev.major:
+                    major = remapped.major
+                    break
+            else:
+                major = len({orig.major for orig in seen})
+            # Allocate the next minor number based on the cardinality of the
+            # set of minor numbers matching the major number.
+            minor = len({orig.minor for orig in seen if orig.major == dev.major})
+            n = Device(major, minor)
+            seen[key] = n
+            return n
+
+    entry.dev = alloc_n(entry.dev)
+
+
+def renumber_ns(entry, seen):
+    # type: (MountInfoEntry, Dict[Tuple[Text, int], int]) -> None
+    """renumber_mount_ns re-numbers mount namespace ID from .root_dir property."""
+
+    def alloc_n(ns_type, ns_id):
+        # type: (Text, int) -> int
+        key = (ns_type, ns_id)
+        try:
+            return seen[key]
+        except KeyError:
+            n = len(seen)
+            seen[key] = n
+            return n
+
+    if entry.fs_type != "nsfs":
+        return
+    match = re.match(r"^([a-z_]+):\[(\d+)\]$", entry.root_dir)
+    if match:
+        ns_type = match.group(1)
+        ns_id = int(match.group(2))
+        entry.root_dir = "{}:[{}]".format(ns_type, alloc_n(ns_type, ns_id))
+
+
+def renumber_mount_option(opt, seen):
+    # type: (Text, Dict[Tuple[Text, Text], int]) -> Text
+    """renumber_mount_option re-numbers various numbers in mount options."""
+
+    def alloc_n(mount_opt_key, mount_opt_value):
+        # type: (Text, Text) -> int
+        key = (mount_opt_key, mount_opt_value)
+        try:
+            return seen[key]
+        except KeyError:
+            n = len(
+                {
+                    opt_value
+                    for opt_key, opt_value in seen.keys()
+                    if opt_key == mount_opt_key
+                }
+            )
+            seen[key] = n
+            return n
+
+    if "=" in opt:
+        mount_opt_key, mount_opt_value = opt.split("=", 1)
+        # size, nr_inode: used by tmpfs
+        # fd, pipe_ino: used by binfmtmisc
+        if mount_opt_key == "size":
+            return "size=VARIABLE"
+        if mount_opt_key in {"nr_inodes", "fd", "pipe_ino"}:
+            return "{}={}".format(
+                mount_opt_key, alloc_n(mount_opt_key, mount_opt_value)
+            )
+    return opt
+
+
+def renumber_mount_opts(entry, seen):
+    # type: (MountInfoEntry, Dict[Tuple[Text, Text], int]) -> None
+    """renumber_mount_opts alters numbers in mount options."""
+    entry.mount_opts = ",".join(
+        renumber_mount_option(opt, seen) for opt in entry.mount_opts.split(",")
+    )
+    entry.sb_opts = ",".join(
+        renumber_mount_option(opt, seen) for opt in entry.sb_opts.split(",")
+    )
+
+
+class RewriteState(object):
+    """RewriteState holds state used in rewriting mount entries."""
+
+    def __init__(self):
+        # type: () -> None
+        self.seen_opt_fields = {}  # type: Dict[int, int]
+        self.seen_loops = {}  # type: Dict[int, int]
+        self.seen_snap_revs = {}  # type: Dict[Tuple[Text, Text], int]
+        self.seen_mount_ids = {}  # type: Dict[int, int]
+        self.seen_devices = {}  # type: Dict[Device, Device]
+        self.seen_ns = {}  # type: Dict[Tuple[Text, int], int]
+        # NOTE: The type of the dictionary key is Tuple[Text, Text] because
+        # while generally "numeric" the values may include suffixes like
+        # "1024k" and it is just  easier to handle this way.
+        self.seen_mount_opts = {}  # type: Dict[Tuple[Text, Text], int]
+
+
+def rewrite_renumber(entries, order, rs, base_n=0):
+    # type: (List[MountInfoEntry], List[int], RewriteState, int) -> None
+    """rewrite_renumber applies all re-numbering helpers to a single entry."""
+    for i in range(len(entries)):
+        entry = entries[order[i]]
+        renumber_mount_ids(entry, rs.seen_mount_ids, base_n)
+        renumber_devices(entry, rs.seen_devices)
+        renumber_snap_revision(entry, rs.seen_snap_revs)
+        renumber_opt_fields(entry, rs.seen_opt_fields, base_n)
+        renumber_loop_devices(entry, rs.seen_loops)
+        renumber_ns(entry, rs.seen_ns)
+        renumber_mount_opts(entry, rs.seen_mount_opts)
+
+
+def rewrite_rename(entries, order, rs):
+    # type: (List[MountInfoEntry], List[int], RewriteState) -> None
+    """rewrite_rename applies all re-naming helpers to a single entry."""
+    # TODO: allocate devices like everything else above.
+    for i in range(len(entries)):
+        entry = entries[order[i]]
+        entry.mount_source = re.sub(
+            "/dev/[sv]d([a-z])", "/dev/sd\\1", entry.mount_source
+        )
+
+
+class _UnitTestAction(Action):
+    def __init__(
+        self,
+        option_strings,
+        dest=SUPPRESS,
+        default=SUPPRESS,
+        help="run program's unit test suite and exit",
+    ):
+        # type: (Text, Text, Text, Text) -> None
+        super(_UnitTestAction, self).__init__(
+            option_strings=option_strings,
+            dest=dest,
+            default=default,
+            nargs="...",
+            help=help,
+        )
+
+    def __call__(self, parser, ns, values, option_string=None):
+        # type: (ArgumentParser, Namespace, Union[str, Sequence[Any], None], Optional[Text]) -> None
+        # We allow the caller to provide the test to invoke by giving
+        # --run-unit-tests a set of arguments.
+        argv = [sys.argv[0]]
+        if isinstance(values, list):
+            argv += values
+        unittest.main(argv=argv)
+        parser.exit()
+
+
+def main():
+    # type: () -> None
+    parser = ArgumentParser(
+        epilog="""
+Expressions are ANDed together and have one of the following forms:
+
+    .ATTR=VALUE     mount entry attribute ATTR is equal to VALUE
+    PATH            mount point is equal to PATH
+    PATH...         mount point starts with PATH
+
+In addition .ATTR syntax can be used to limit display to only certain
+attributes. By default the output is identical to raw mountinfo.
+Known attributes, applicable for both filtering and display.
+
+    mount_point:    path where mount is attached in the file system
+    mount_source:   path of the mounted device or bind-mount origin
+    fs_type:        filesystem type
+    mount_opts:     options applying to the mount point only
+    sb_opts:        options applying to the mounted filesystem
+    opt_fields:     optional fields, used for propagation information
+    mount_id:       mount point identifier
+    parent_id:      identifier of parent mount point
+    dev:            major:minor numbers of the mounted device
+    root_dir:       subtree of the mounted filesystem exposed at mount_point
+
+The exit code indicates if any mount point matched the query.
+    """,
+        formatter_class=RawTextHelpFormatter,
+    )
+    parser.register("action", "unit-test", _UnitTestAction)
+    parser.add_argument("-v", "--version", action="version", version="1.0")
+    parser.add_argument("--run-unit-tests", action="unit-test")
+    parser.add_argument(
+        "-f",
+        metavar="MOUNTINFO",
+        dest="file",
+        type=FileType(),
+        default="/proc/self/mountinfo",
+        help="parse specified mountinfo file",
+    )
+    parser.add_argument(
+        "--ref",
+        dest="refs",
+        metavar="MOUNTINFO",
+        type=FileType(),
+        action="append",
+        default=[],
+        help="refer to another table while rewriting, makes output comparable across namespaces",
+    )
+    parser.add_argument(
+        "--ref-x1000",
+        dest="ref_x1000",
+        action="store_true",
+        default=False,
+        help="start mount point IDs and peer groups at multiple of 1000, once for each ref",
+    )
+    parser.add_argument(
+        "--one", default=False, action="store_true", help="expect exactly one match"
+    )
+    parser.add_argument(
+        "--rewrite-order",
+        metavar="FIELD",
+        action="append",
+        default=[],
+        choices=MountInfoEntry.known_attrs.keys(),
+        help="rewrite entries in the order determined by given fields",
+    )
+    parser.add_argument(
+        "--display-order",
+        metavar="FIELD",
+        action="append",
+        default=[],
+        choices=MountInfoEntry.known_attrs.keys(),
+        help="display entries in the order determined by given fields",
+    )
+    parser.add_argument(
+        "exprs",
+        metavar="EXPRESSION",
+        nargs="*",
+        help="filter or display expression (see below)",
+    )
+    group = parser.add_argument_group("Rewriting rules")
+    group.add_argument(
+        "--renumber",
+        action="store_true",
+        help="Reassign mount IDs, device numbers, snap revisions"
+        " and loopback devices",
+    )
+    group.add_argument(
+        "--rename", action="store_true", help="Reassign block device names"
+    )
+    group.add_argument(
+        "--differential",
+        action="store_true",
+        help="Display numeric values as delta from previous item",
+    )
+    opts = parser.parse_args()
+    try:
+        filters, attrs = parse_exprs(opts.exprs)
+    except ValueError as exc:
+        raise SystemExit(exc)
+    entries = [MountInfoEntry.parse(line) for line in opts.file]
+
+    # Apply entry filtering ahead of any renumbering.
+    num_matched = 0
+    for e in entries:
+        if matches(e, filters):
+            e.matched = True
+            num_matched += 1
+
+    # Build rewrite state based on reference tables. This way the entries
+    # we will display can be correlated to other tables.
+    rs = RewriteState()
+    for i, ref in enumerate(opts.refs):
+        ref_entries = [MountInfoEntry.parse(line) for line in ref]
+        ref_rewrite_order = list(range(len(ref_entries)))
+        if opts.rewrite_order:
+
+            def ref_rewrite_key_fn(i):
+                # type: (int) -> Tuple[Any, ...]
+                return tuple(
+                    getattr(ref_entries[i], field) for field in opts.rewrite_order
+                )
+
+        ref_rewrite_order.sort(key=ref_rewrite_key_fn)
+        if opts.renumber:
+            rewrite_renumber(
+                ref_entries, ref_rewrite_order, rs, 1000 * i if opts.ref_x1000 else 0
+            )
+        if opts.rename:
+            rewrite_rename(ref_entries, ref_rewrite_order, rs)
+
+    # Apply entry renumbering and renaming, perhaps using reordering as well.
+    rewrite_order = list(range(len(entries)))
+    if opts.rewrite_order:
+
+        def rewrite_key_fn(i):
+            # type: (int) -> Tuple[Any, ...]
+            return tuple(getattr(entries[i], field) for field in opts.rewrite_order)
+
+        rewrite_order.sort(key=rewrite_key_fn)
+    if opts.renumber:
+        rewrite_renumber(
+            entries, rewrite_order, rs, 1000 * len(opts.refs) if opts.ref_x1000 else 0
+        )
+    if opts.rename:
+        rewrite_rename(entries, rewrite_order, rs)
+
+    # Apply entry reordering for display.
+    if opts.display_order:
+
+        def display_key_fn(entry):
+            # type: (MountInfoEntry) -> Tuple[Any, ...]
+            return tuple(getattr(entry, field) for field in opts.display_order)
+
+        entries.sort(key=display_key_fn)
+
+    # Display and differentiate
+    prev = None  # type: Optional[MountInfoEntry]
+    for e in entries:
+        if not e.matched:
+            prev = e
+            continue
+        if prev is not None and opts.differential:
+            e_display = MountInfoEntry.differentiate(e, prev)
+        else:
+            e_display = e
+        if attrs:
+            print(*[getattr(e_display, attr) for attr in attrs])
+        else:
+            print(e_display)
+        prev = e
+    if opts.one and num_matched != 1:
+        raise SystemExit(
+            "--one requires exactly one match, found {}".format(num_matched)
+        )
+    # Return with an exit code indicating if anything matched.
+    # This allows mountinfo.query to be used in scripts.
+    if num_matched == 0:
+        raise SystemExit(1)
+
+
+class MountInfoEntryTests(unittest.TestCase):
+
+    non_zero_values = {
+        "mount_id": 1,
+        "parent_id": 2,
+        "dev": Device(3, 4),
+        "root_dir": "/root-dir",
+        "mount_point": "/mount-point",
+        "mount_opts": "mount-opts",
+        "opt_fields": OptionalFields(["opt:1", "fields:2"]),
+        "fs_type": "fs-type",
+        "mount_source": "mount-source",
+        "sb_opts": "sb-opts",
+    }  # Dict[Text, Any]
+
+    def test_init(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        self.assertEqual(e.mount_id, 0)
+        self.assertEqual(e.parent_id, 0)
+        self.assertEqual(e.dev, Device(0, 0))
+        self.assertEqual(e.root_dir, "")
+        self.assertEqual(e.mount_point, "")
+        self.assertEqual(e.mount_opts, "")
+        self.assertEqual(e.opt_fields, [])
+        self.assertEqual(e.fs_type, "")
+        self.assertEqual(e.mount_source, "")
+        self.assertEqual(e.sb_opts, "")
+
+    def test_parse(self):
+        # type: () -> None
+        e = MountInfoEntry.parse(
+            "2079 2266 0:3 mnt:[4026532791] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw"
+        )
+        self.assertEqual(e.mount_id, 2079)
+        self.assertEqual(e.parent_id, 2266)
+        self.assertEqual(e.dev, Device(0, 3))
+        self.assertEqual(e.root_dir, "mnt:[4026532791]")
+        self.assertEqual(e.mount_point, "/run/snapd/ns/test-snapd-mountinfo.mnt")
+        self.assertEqual(e.mount_opts, "rw")
+        self.assertEqual(e.opt_fields, [])
+        self.assertEqual(e.fs_type, "nsfs")
+        self.assertEqual(e.mount_source, "nsfs")
+        self.assertEqual(e.sb_opts, "rw")
+
+    def test_eq(self):
+        # type: () -> None
+        e0 = MountInfoEntry()
+        e1 = MountInfoEntry()
+        self.assertEqual(e0, e1)
+        for field, value in self.non_zero_values.items():
+            self.assertEqual(e0, e1)
+            old_value = getattr(e1, field)
+            setattr(e1, field, value)
+            self.assertNotEqual(e0, e1)
+            setattr(e1, field, old_value)
+            self.assertEqual(e0, e1)
+
+    def test_str(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        for field, value in self.non_zero_values.items():
+            setattr(e, field, value)
+        self.assertEqual(
+            str(e),
+            "1 2 3:4 /root-dir /mount-point mount-opts opt:1 fields:2 - fs-type mount-source sb-opts",
+        )
+
+    def test_repr(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        for field, value in self.non_zero_values.items():
+            setattr(e, field, value)
+        self.assertEqual(
+            repr(e),
+            "MountInfoEntry.parse('1 2 3:4 /root-dir /mount-point mount-opts opt:1 fields:2 - fs-type mount-source sb-opts')",
+        )
+
+    def test_dev_maj_min(self):
+        # type: () -> None
+        e = MountInfoEntry()
+        e.dev = Device(1, 2)
+        self.assertEqual(e.dev_min, 2)
+        self.assertEqual(e.dev_maj, 1)
+
+
+class RenumberSnapRevisionTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.entry = MountInfoEntry()
+        self.seen = {}  # type: Dict[Tuple[Text, Text], int]
+
+    def test_renumbering_allocation(self):
+        # type: () -> None
+        self.entry.mount_point = "/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/1")
+
+        self.entry.mount_point = "/snap/core/7080"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/2")
+
+        self.entry.mount_point = "/snap/snapd/x1"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/snapd/1")
+
+        self.assertEqual(
+            self.seen, {("core", "7079"): 1, ("core", "7080"): 2, ("snapd", "x1"): 1}
+        )
+
+    def test_preferred(self):
+        # type: () -> None
+        self.entry.mount_point = "/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/1")
+
+        self.entry.mount_point = "/snap/core/7079/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/snap/core/1/subdir")
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_alternate(self):
+        # type: () -> None
+        self.entry.mount_point = "/var/lib/snapd/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/snap/core/1")
+
+        self.entry.mount_point = "/var/lib/snapd/snap/core/7079/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/snap/core/1/subdir")
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_preferred_via_hostfs(self):
+        # type: () -> None
+        self.entry.mount_point = "/var/lib/snapd/hostfs/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/var/lib/snapd/hostfs/snap/core/1")
+
+        self.entry.mount_point = "/var/lib/snapd/hostfs/snap/core/7079/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point, "/var/lib/snapd/hostfs/snap/core/1/subdir"
+        )
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_alternate_via_hostfs(self):
+        # type: () -> None
+        self.entry.mount_point = "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/7079"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point, "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/1"
+        )
+
+        self.entry.mount_point = (
+            "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/7079/subdir"
+        )
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point,
+            "/var/lib/snapd/hostfs/var/lib/snapd/snap/core/1/subdir",
+        )
+
+        self.assertEqual(self.seen, {("core", "7079"): 1})
+
+    def test_writable(self):
+        # type: () -> None
+        self.entry.mount_point = "/writable/system-data/snap/core18/1055"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(self.entry.mount_point, "/writable/system-data/snap/core18/1")
+
+        self.entry.mount_point = "/writable/system-data/snap/core18/1055/subdir"
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point, "/writable/system-data/snap/core18/1/subdir"
+        )
+
+        self.assertEqual(self.seen, {("core18", "1055"): 1})
+
+    def test_writable_via_hostfs(self):
+        # type: () -> None
+        self.entry.mount_point = (
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1055"
+        )
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point,
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1",
+        )
+
+        self.entry.mount_point = (
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1055/subdir"
+        )
+        renumber_snap_revision(self.entry, self.seen)
+        self.assertEqual(
+            self.entry.mount_point,
+            "/var/lib/snapd/hostfs/writable/system-data/snap/core18/1/subdir",
+        )
+
+        self.assertEqual(self.seen, {("core18", "1055"): 1})
+
+
+class RenumberMountNsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.entry = MountInfoEntry()
+        self.entry.fs_type = "nsfs"
+        self.seen = {}  # type: Dict[Tuple[Text, int], int]
+
+    def test_renumbering_allocation(self):
+        # type: () -> None
+        self.entry.root_dir = "mnt:[4026532909]"
+        renumber_ns(self.entry, self.seen)
+        self.assertEqual(self.entry.root_dir, "mnt:[0]")
+
+        self.entry.root_dir = "mnt:[4026532791]"
+        renumber_ns(self.entry, self.seen)
+        self.assertEqual(self.entry.root_dir, "mnt:[1]")
+
+        self.entry.root_dir = "pid:[4026531836]"
+        renumber_ns(self.entry, self.seen)
+        self.assertEqual(self.entry.root_dir, "pid:[2]")
+
+        self.assertEqual(
+            self.seen,
+            {("mnt", 4026532909): 0, ("mnt", 4026532791): 1, ("pid", 4026531836): 2},
+        )
+
+
+class RenumberMountOptionsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.seen = {}  # type: Dict[Tuple[Text, Text], int]
+
+    def test_renumber_allocation(self):
+        # type: () -> None
+        """
+        numbers are allocated from subsets matching the key, this reduces delta.
+        """
+        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
+        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
+        self.assertEqual(renumber_mount_option("pipe_ino=200", self.seen), "pipe_ino=1")
+        self.assertEqual(renumber_mount_option("pipe_ino=100", self.seen), "pipe_ino=0")
+        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
+        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
+        self.assertEqual(renumber_mount_option("fd=45", self.seen), "fd=1")
+        self.assertEqual(renumber_mount_option("fd=21", self.seen), "fd=0")
+
+    def test_renumber_size_variable(self):
+        # type: () -> None
+        """
+        size is special-cased and always rewritten to the same value because it is prone to fluctuations
+        """
+        self.assertEqual(renumber_mount_option("size=100", self.seen), "size=VARIABLE")
+        self.assertEqual(renumber_mount_option("size=200", self.seen), "size=VARIABLE")
+
+    def test_renumber_devtmpfs_opts(self):
+        # type: () -> None
+        """
+        certain devtmpfs options are renumbered.
+
+            23 98 0:6 / /dev rw,nosuid shared:21 - devtmpfs devtmpfs rw,size=4057388k,nr_inodes=1014347,mode=755
+
+        Here the size and nr_inodes options are not deterministic and need to
+        be rewritten.  The size quantity is very susceptible to free memory
+        fluctuations and is treated specially.
+        """
+        # Options size= and nr_inodes= are renumbered.
+        self.assertEqual(
+            renumber_mount_option("size=4057388k", self.seen), "size=VARIABLE"
+        )
+        self.assertEqual(
+            renumber_mount_option("nr_inodes=1014347", self.seen), "nr_inodes=0"
+        )
+        # Option mode= is not renumbered.
+        self.assertEqual(renumber_mount_option("mode=755", self.seen), "mode=755")
+        self.assertEqual(self.seen, {("nr_inodes", "1014347"): 0})
+
+    def test_renumber_binfmt_misc_opts(self):
+        # type: () -> None
+        """
+        certain binfmt_misc options are renumbered.
+
+            47 22 0:42 / /proc/sys/fs/binfmt_misc rw,relatime shared:28 - autofs systemd-1 rw,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16610
+
+        Here the fd and pipe_ino options are not deterministic and need to be rewritten.
+        """
+        self.assertEqual(renumber_mount_option("fd=40", self.seen), "fd=0")
+        self.assertEqual(
+            renumber_mount_option("pipe_ino=16610", self.seen), "pipe_ino=0"
+        )
+        self.assertEqual(self.seen, {("fd", "40"): 0, ("pipe_ino", "16610"): 0})
+
+
+class RenumberMountIdsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.seen = {}  # type: Dict[int, int]
+
+    def test_smoke(self):
+        # type: () -> None
+        # Renumber the first mount entry, from the "initial" mount namespace,
+        # with the initial, zero multiple.
+        entry = MountInfoEntry()
+        entry.mount_id = 12
+        entry.parent_id = 5
+        renumber_mount_ids(entry, self.seen, 0)
+        self.assertEqual(entry.parent_id, 0)
+        self.assertEqual(entry.mount_id, 1)
+
+        # Renumber another entry, now in a separate mount namespace, with a
+        # different multiplier. The parent ID stays in the < 1000 range.  NOTE:
+        # in reality mount namespaces never share mount IDs but that's fine.
+        # The test just checks the renumber logic.
+        entry = MountInfoEntry()
+        entry.mount_id = 13
+        entry.parent_id = 5
+        renumber_mount_ids(entry, self.seen, 1000)
+        self.assertEqual(entry.parent_id, 0)
+        self.assertEqual(entry.mount_id, 1000)
+
+
+class RenumberOptFieldsTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.seen = {}  # type: Dict[int, int]
+
+    def test_smoke(self):
+        # type: () -> None
+        # Renumber the first mount entry, from the "initial" mount namespace,
+        # with the initial, zero multiple.
+        entry = MountInfoEntry()
+        entry.opt_fields = OptionalFields(["shared:12"])
+        renumber_opt_fields(entry, self.seen, 0)
+        self.assertEqual(entry.opt_fields, ["shared:1"])
+
+        # Renumber the second entry, now in a separate mount namespace, with a
+        # different multiplier. Given that the peer group number was not seen
+        # before it gets allocated into the 1000-1999 range.
+        entry = MountInfoEntry()
+        entry.opt_fields = OptionalFields(["shared:13"])
+        renumber_opt_fields(entry, self.seen, 1000)
+        self.assertEqual(entry.opt_fields, ["shared:1001"])
+
+        # Renumber the third entry, in the same mount namespace as the second
+        # one.  Given that the peer group number was seen in the initial mount
+        # namespace it is renumbered the same was as the original was, even
+        # though the actual sharing mode is different.
+        entry = MountInfoEntry()
+        entry.opt_fields = OptionalFields(["master:12"])
+        renumber_opt_fields(entry, self.seen, 1000)
+        self.assertEqual(entry.opt_fields, ["master:1"])
+
+
+class RewriteTests(unittest.TestCase):
+    def setUp(self):
+        # type: () -> None
+        self.entries = [
+            MountInfoEntry.parse(line)
+            for line in (
+                "2079 2266 0:3 mnt:[4026532791] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw",
+                "23 98 0:6 / /dev rw,nosuid shared:21 - devtmpfs devtmpfs rw,size=4057388k,nr_inodes=1014347,mode=755",
+                "47 22 0:42 / /proc/sys/fs/binfmt_misc rw,relatime shared:28 - autofs systemd-1 rw,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16610",
+            )
+        ]
+        self.order = list(range(len(self.entries)))
+        self.rs = RewriteState()
+
+    def test_rewrite_renumber(self):
+        # type: () -> None
+        rewrite_renumber(self.entries, self.order, self.rs)
+        self.assertEqual(
+            self.entries,
+            [
+                MountInfoEntry.parse(line)
+                for line in (
+                    "1 0 0:0 mnt:[0] /run/snapd/ns/test-snapd-mountinfo.mnt rw - nsfs nsfs rw",
+                    "3 2 0:1 / /dev rw,nosuid shared:1 - devtmpfs devtmpfs rw,size=VARIABLE,nr_inodes=0,mode=755",
+                    "5 4 0:2 / /proc/sys/fs/binfmt_misc rw,relatime shared:2 - autofs systemd-1 rw,fd=0,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=0",
+                )
+            ],
+        )
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/nested-state snapd-2.48.3+20.04/tests/lib/tools/nested-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/nested-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/nested-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,148 @@
+#!/bin/bash -e
+
+show_help() {
+    echo "usage: prepare"
+    echo "       restore"
+    echo "       build-image IMAGE-TYPE"
+    echo "       create-vm IMAGE-TYPE [--param-cdrom PARAM] [--param-mem PARAM]"
+    echo "       start-vm"
+    echo "       stop-vm"
+    echo "       remove-vm"
+    echo ""
+    echo "Available options:"
+    echo "  -h --help   show this help message."
+    echo ""
+    echo "COMMANDS:"
+    echo "  prepare:     creates all the directories needed to run a nested test"
+    echo "  restore:     removes all the directories and data used by nested tests"
+    echo "  build-image: creates an image using ubuntu image tool"
+    echo "  create-vm:   creates new virtual machine and leave it running"
+    echo "  start-vm:    starts a stopped vm"
+    echo "  stop-vm:     shutdowns a running vm"
+    echo "  remove-vm:   removes a vm"
+    echo ""
+    echo "IMAGE-TYPES:"
+    echo "  core: work with a core image"
+    echo "  classic: work with a classic image"
+    echo ""
+}
+
+prepare() {
+    nested_prepare_env
+}
+
+restore() {
+    nested_cleanup_env
+}
+
+build_image() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 1
+    fi
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            classic)
+                nested_create_classic_vm
+                exit
+                ;;
+            core)
+                nested_create_core_vm
+                exit
+                ;;
+            *)
+                echo "nested-state: expected either classic or core as argument" >&2
+                exit 1
+                ;;
+        esac
+    done
+}
+
+create_vm() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 1
+    fi
+    local action=
+    case "$1" in
+        classic)
+            shift 1
+            action=nested_start_classic_vm
+            ;;
+        core)
+            shift 1
+            action=nested_start_core_vm
+            ;;
+        *)
+            echo "nested-state: unsupported parameter $1" >&2
+            exit 1
+            ;;
+    esac
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --param-cdrom)
+                export NESTED_PARAM_CD="$2"
+                shift 2
+                ;;
+            --param-mem)
+                export NESTED_PARAM_MEM="$2"
+                shift 2
+                ;;
+            *)
+                echo "nested-state: unsupported parameter $1" >&2
+                exit 1
+                ;;
+        esac
+    done
+
+    "$action"
+}
+
+
+start_vm() {
+    nested_start
+}
+
+stop_vm() {
+    nested_shutdown
+}
+
+remove_vm() {
+    nested_destroy_vm
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    local subcommand="$1"
+    local action=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -h|--help)
+                show_help
+                exit 0
+                ;;
+            *)
+                action=$(echo "$subcommand" | tr '-' '_')
+                shift
+                break
+                ;;
+        esac
+    done
+
+    if [ -z "$(declare -f "$action")" ]; then
+        echo "nested-state: no such command: $subcommand"
+        show_help
+        exit 1
+    fi
+
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    "$action" "$@"
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/not snapd-2.48.3+20.04/tests/lib/tools/not
--- snapd-2.45.1+20.04.2/tests/lib/tools/not	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/not	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh
+# This script executes whatever is given as argument and inverts the return
+# value. It is meant as a workaround for shellcheck discovery
+# https://github.com/koalaman/shellcheck/wiki/SC2251 where shell scripts using
+# "set -e" are not failing with a trivial code like "! true"
+! "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/os.query snapd-2.48.3+20.04/tests/lib/tools/os.query
--- snapd-2.45.1+20.04.2/tests/lib/tools/os.query	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/os.query	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,84 @@
+#!/bin/bash
+
+show_help() {
+    echo "usage: is-core"
+    echo "       is-core16"
+    echo "       is-core18"
+    echo "       is-core20"
+    echo "       is-classic"
+    echo "       is-trusty"
+    echo "       is-xenial"
+    echo "       is-bionic"
+    echo "       is-focal"
+    echo ""
+    echo "Get general information about the current system"
+}
+
+is_core() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-* ]]
+}
+
+is_core16() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-16-* ]]
+}
+
+is_core18() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-18-* ]]
+}
+
+is_core20() {
+    [[ "$SPREAD_SYSTEM" == ubuntu-core-20-* ]]
+}
+
+is_classic() {
+    ! is_core
+}
+
+is_trusty() {
+    grep -qFx 'ID=ubuntu' /etc/os-release && grep -qFx 'VERSION_ID="14.04"' /etc/os-release
+}
+
+is_xenial() {
+    grep -qFx 'UBUNTU_CODENAME=xenial' /etc/os-release
+}
+
+is_bionic() {
+    grep -qFx 'UBUNTU_CODENAME=bionic' /etc/os-release
+}
+
+is_focal() {
+    grep -qFx 'UBUNTU_CODENAME=focal' /etc/os-release
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    local subcommand="$1"
+    local action=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -h|--help)
+                show_help
+                exit 0
+                ;;
+            *)
+                action=$(echo "$subcommand" | tr '-' '_')
+                shift
+                break
+                ;;
+        esac
+    done
+
+    if [ -z "$(declare -f "$action")" ]; then
+        echo "os.query: no such command: $subcommand" >&2
+        show_help
+        exit 1
+    fi
+
+    "$action" "$@"
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/README snapd-2.48.3+20.04/tests/lib/tools/README
--- snapd-2.45.1+20.04.2/tests/lib/tools/README	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/README	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,116 @@
+ONCE THINGS ARE MADE UNIFORM THIS SHOULD BECOME A README WITHOUT THE TODO PART!
+
+This "tools" directory collects useful utility commands that can be
+used in our spread test suites. (They are separate from the shell
+function libraries *.sh in the level above.)
+
+Commands here should have names that clarify their purpose, longish
+names using '-' as word separator are expected. Commands that take
+themselves a full command to execute should usually end in '-do'.
+
+The commands might take one or multiple subcommands themselves if
+meaningful, subcommands should also use '-' as internal word
+separator.
+
+If a subcommand executes other commands it should usually be called
+"exec".
+
+All the commands invoked without arguments should either do something
+informative/non-destructive or print usage.
+
+All the commands should support at least a -h help option.
+
+To invoke a command here tests can do "$TESTSTOOLS"/cmd.
+
+Commands that are used very often or that are particularly useful to
+debug at a spread -debug shell prompt can be promoted to be on the
+PATH during tests, if an acceptable name can be found for them.
+
+This is done by putting symlinks to here from tests/bin which itself
+will be on the PATH.
+
+Commands expected to be on the PATH should follow more specific naming
+conventions, the name should either hint at testing or trade that off
+for brevity, but only when appropriate:
+
+* really frequently used commands can have short/pithy names (not, retry...)
+
+* commands that manage or deal with cross-test/cross-task state should be
+  prefixed with "tests." (tests.session)
+
+* otherwise the command should take some form of suffix like ".query", ".check"
+  that hints at observing, checking the system
+
+In general if none of these apply they should continue to be invoked
+via $TESTSTOOLS, or possibly have a tests/lib/*.sh wrapping them if
+appropriate.
+
+TODO:
+
+[done] rename tests/lib/bin to tests/lib/tools, define TESTSTOOLS in
+spread.yaml pointing at it
+
+[done] create tests/bin, have ultimately this on the PATH and not tools:
+  drop tests/lib/tools from PATH in spread.yaml and debian/tests/integrationtests
+
+symlinks and renames (plus fixes):
+
+[done] tests/bin/MATCH -> tests/lib/tools/MATCH
+[done] tests/bin/REBOOT -> tests/lib/tools/REBOOT
+[done] tests/bin/not -> tests/lib/tools/not
+[done] tests/bin/retry -> tests/lib/tools/retry (was retry-tool)
+
+[done] tests/bin/tests.session -> tests/lib/tools/tests.session (was session-tool)
+  [done] fix to have -h
+  [done] convert --ACTION into subcommands
+  [done] require "exec" subcommand to execute a command
+
+[done] tests/lib/tools/memory-observe-do (was memory-tool)
+[done] tests/lib/tools/version-compare (was version-tool)
+
+[done] tests/bin/mountinfo.query -> tests/lib/tools/mountinfo.query (was mountinfo-tool)
+  (we might not do this and keep just tests/lib/tools/mountinfo and call it the long way)
+
+[done] tests/bin/snapd.tool -> tests/lib/tools/snapd.tool (was snap-tool)
+  [done] fix no args
+  [done] fix to have -h
+  (we might not do this, this would be a special case, the name has
+   snapd in itself, it makes sense in /bin mostly for debugging,
+   otherwise it could stay just in tools as in itself it is not called
+   that often by tests, it would just become snapd-tool)
+
+We are then left with a mixture of commands with maybe one or a couple
+subcommands dealing with system state:
+
+* simple option rename them with a -state suffix in most cases:
+
+[done] user-tool -> test/lib/tools/user-state
+  [done] fix with no args
+  [done] fix -h help
+
+[done] apt-tool -> tests/lib/tools/apt-state
+  use any-python?
+  [done] fix no args
+  [done] fix to have -h
+
+[done] lxd-tool -> tests/lib/tools/lxd-state
+  [done] fix no args
+  [done] fix to have -h
+
+[done] invariant-tool -> tests/lib/tools/tests.invariant? then it could also live in /bin
+  [done] fix to have -h
+
+* more complicated option, have a tests.state trampoline command in tests/bin
+  that given `tests.state WHAT ARGS` invokes `tests/lib/tools/state-WHAT ARGS`
+
+  then we would have in tools:
+
+  state-apt (was apt-tool)
+  state-lxd-undo-mount-changes (was lxd-tool)
+  state-remove-user-with-group (was user-tool)
+
+  tests.state without arguments or with -h would invoke all the state-* commands
+  appropriately to show usage info
+
+  invariant-tool could possibly become `tests.state invariant` or be
+  dealt with separately
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/REBOOT snapd-2.48.3+20.04/tests/lib/tools/REBOOT
--- snapd-2.45.1+20.04.2/tests/lib/tools/REBOOT	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/REBOOT	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Source spread-funcs.sh which, at runtime, contains the real definition of
+# REBOOT and execute it.
+
+# shellcheck source=tests/lib/spread-funcs.sh 
+. "$TESTSLIB/spread-funcs.sh"
+
+REBOOT "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/retry snapd-2.48.3+20.04/tests/lib/tools/retry
--- snapd-2.45.1+20.04.2/tests/lib/tools/retry	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/retry	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,133 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+import argparse
+import itertools
+import subprocess
+import sys
+import time
+
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import List, Text
+
+
+def _make_parser():
+    # type: () -> argparse.ArgumentParser
+    parser = argparse.ArgumentParser(
+        description="""
+Retry executes COMMAND at most N times, waiting for SECONDS between each
+attempt. On failure the exit code from the final attempt is returned.
+"""
+    )
+    parser.add_argument(
+        "-n",
+        "--attempts",
+        metavar="N",
+        type=int,
+        default=3,
+        help="number of attempts (default %(default)s)",
+    )
+    parser.add_argument(
+        "--wait",
+        metavar="SECONDS",
+        type=float,
+        default=1,
+        help="grace period between attempts (default %(default)ss)",
+    )
+    parser.add_argument(
+        "--maxmins",
+        metavar="MINUTES",
+        type=float,
+        default=0,
+        help="number of minutes after which to give up (no default, if set attempts is ignored)",
+    )
+    parser.add_argument(
+        "--quiet",
+        dest="verbose",
+        action="store_false",
+        default=True,
+        help="refrain from printing any output",
+    )
+    parser.add_argument(
+        "cmd", metavar="COMMAND", nargs="...", help="command to execute"
+    )
+    return parser
+
+
+def run_cmd(cmd, n, wait, maxmins, verbose):
+    # type: (List[Text], int, float, float, bool) -> int
+    if maxmins != 0:
+        attempts = itertools.count(1)
+        t0 = time.time()
+        after = "{} minutes".format(maxmins)
+        of_attempts_suffix = ""
+    else:
+        attempts = range(1, n + 1)
+        after = "{} attempts".format(n)
+        of_attempts_suffix = " of {}".format(n)
+    retcode = 0
+    i = 0
+    for i in attempts:
+        retcode = subprocess.call(cmd)
+        if retcode == 0:
+            return 0
+        if verbose:
+            print(
+                "retry: command {} failed with code {}".format(" ".join(cmd), retcode),
+                file=sys.stderr,
+            )
+        if maxmins != 0:
+            elapsed = (time.time()-t0)/60
+            if elapsed > maxmins:
+                break
+        if i < n or maxmins != 0:
+            if verbose:
+                print(
+                    "retry: next attempt in {} second(s) (attempt {}{})".format(
+                        wait, i, of_attempts_suffix
+                    ),
+                    file=sys.stderr,
+                )
+            time.sleep(wait)
+
+    if verbose and i > 1:
+        print(
+            "retry: command {} keeps failing after {}".format(
+                " ".join(cmd), after
+                ),
+                file=sys.stderr,
+            )
+    return retcode
+
+
+def main():
+    # type: () -> None
+    parser = _make_parser()
+    ns = parser.parse_args()
+    # The command cannot be empty but it is difficult to express in argparse itself.
+    if len(ns.cmd) == 0:
+        parser.print_usage()
+        parser.exit(0)
+    # Return the last exit code as the exit code of this process.
+    try:
+        retcode = run_cmd(ns.cmd, ns.attempts, ns.wait, ns.maxmins, ns.verbose)
+    except OSError as exc:
+        if ns.verbose:
+            print(
+                "retry: cannot execute command {}: {}".format(" ".join(ns.cmd), exc),
+                file=sys.stderr,
+            )
+        raise SystemExit(1)
+    else:
+        raise SystemExit(retcode)
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/sha3-384 snapd-2.48.3+20.04/tests/lib/tools/sha3-384
--- snapd-2.45.1+20.04.2/tests/lib/tools/sha3-384	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/sha3-384	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,22 @@
+#!/usr/bin/python3
+
+import argparse
+import hashlib
+import sys
+
+def parse_arguments():
+    parser = argparse.ArgumentParser(description='calculate sha3-384 of stdin')
+    return parser.parse_args()
+
+def main():
+    h = hashlib.sha3_384()
+    while True:
+        d = sys.stdin.buffer.read(4096)
+        if len(d) == 0:
+            break
+        h.update(d)
+    print(h.hexdigest())
+
+if __name__ == '__main__':
+    parse_arguments()
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/snapd.tool snapd-2.48.3+20.04/tests/lib/tools/snapd.tool
--- snapd-2.45.1+20.04.2/tests/lib/tools/snapd.tool	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/snapd.tool	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+show_usage() {
+	echo "usage: snapd.tool [OPTIONS] exec <TOOL> [ARGS]"
+}
+
+show_help() {
+	show_usage
+	echo
+	echo "Available options:"
+	echo "	-h --help	show this help message."
+	echo
+	echo "The snapd.tool program simplifies running internal tools,"
+	echo "like snap-discard-ns, which are not on PATH and whose"
+	echo "location varies from one distribution to another"
+}
+
+tool=""
+while [ $# -gt 0 ]; do
+	case "${1:-}" in
+		-h|--help)
+			show_help
+			exit 0
+			;;
+		exec)
+			shift
+			tool="${1:-}"  # empty value checked below
+			shift
+			break
+			;;
+		--)
+			shift
+			break
+			;;
+		-*)
+			echo "snapd.tool: unsupported argument $1" >&2
+			show_usage
+			exit 1
+			;;
+		*)
+			echo "snapd.tool: unsupported argument $1" >&2
+			show_usage
+			exit 1
+			;;
+	esac
+done
+
+if [ "$tool" = "" ]; then
+	show_usage
+	exit 1
+fi
+
+# shellcheck source=tests/lib/dirs.sh
+. "$TESTSLIB/dirs.sh"
+exec "$LIBEXECDIR/snapd/$tool" "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/snaps-state snapd-2.48.3+20.04/tests/lib/tools/snaps-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/snaps-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/snaps-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,93 @@
+#!/bin/bash -e
+
+show_help() {
+    echo "usage: pack-local <snap-name>"
+    echo "       install-local <snap-name> [OPTIONS]"
+    echo "       install-local-as <snap-name> <dest-name> [OPTIONS]"
+    echo ""
+    echo "Available options:"
+    echo "  --devmode --jailmode --classic"
+    echo ""
+    echo "Pack and install commands save the packed snap for future uses,"
+    echo "which is reused on the following calls."
+    echo "The paths for locating the sources of the snaps to either pack or"
+    echo "install are the local path and then 'tests/lib/snaps/'"
+}
+
+pack_local() {
+    local SNAP_NAME="$1"
+    local SNAP_DIR="${2:-$TESTSLIB/snaps/${SNAP_NAME}}"
+    local SNAP_VERSION="${3:-1.0}"
+
+    local META_FILE META_NAME SNAP_FILE
+    META_FILE="$SNAP_DIR/meta/snap.yaml"
+    if [ ! -f "$META_FILE" ]; then
+        echo "snap.yaml file not found for $SNAP_NAME snap"
+        return 1
+    fi
+    META_NAME="$(grep '^name:' "$META_FILE" | awk '{ print $2 }' | tr -d ' ')"
+    SNAP_FILE="${SNAP_DIR}/${META_NAME}_${SNAP_VERSION}_all.snap"
+    # assigned in a separate step to avoid hiding a failure
+    if [ ! -f "$SNAP_FILE" ]; then
+        snap pack "$SNAP_DIR" "$SNAP_DIR" >/dev/null
+    fi
+    # echo the snap name
+    if [ -f "$SNAP_FILE" ]; then
+        echo "$SNAP_FILE"
+    else
+        find "$SNAP_DIR" -name "${META_NAME}_*.snap"| head -n1
+    fi
+}
+
+install_local() {
+    local SNAP_NAME="$1"
+    local SNAP_DIR="$TESTSLIB/snaps/${SNAP_NAME}"
+    shift
+
+    if [ -d "$SNAP_NAME" ]; then
+        SNAP_DIR="$PWD/$SNAP_NAME"
+    fi
+    SNAP_FILE=$(pack_local "$SNAP_NAME" "$SNAP_DIR")
+
+    snap install --dangerous "$@" "$SNAP_FILE"
+}
+
+install_local_as() {
+    local snap="$1"
+    local name="$2"
+    shift 2
+    install_local "$snap" --name "$name" "$@"
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    local subcommand="$1"
+    local action=
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -h|--help)
+                show_help
+                exit 0
+                ;;
+            *)
+                action=$(echo "$subcommand" | tr '-' '_')
+                shift
+                break
+                ;;
+        esac
+    done
+
+    if [ -z "$(declare -f "$action")" ]; then
+        echo "snaps-state: no such command: $subcommand"
+        show_help
+        exit 1
+    fi
+
+    "$action" "$@"
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/apt-state/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/apt-state/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/apt-state/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/apt-state/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+summary: integration tests for apt-state
+systems:
+    - ubuntu-16.04-*
+    - ubuntu-18.04-*
+    - ubuntu-20.04-*
+    - debian-*
+execute: |
+    "$TESTSTOOLS"/apt-state -h | grep -qFx "usage: apt-state [-h] {checkpoint,restore} ..."
+    "$TESTSTOOLS"/apt-state checkpoint -h | grep -qFx "usage: apt-state checkpoint [-h]"
+    "$TESTSTOOLS"/apt-state restore -h | grep -qFx "usage: apt-state restore [-h] FILE"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/fs-state/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/fs-state/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/fs-state/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/fs-state/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,80 @@
+summary: smoke test for the fs-state tool
+
+execute: |
+    # Check help
+    "$TESTSTOOLS"/fs-state -h | MATCH "usage: fs-state mock-dir"
+    "$TESTSTOOLS"/fs-state --help | MATCH "usage: fs-state mock-dir"
+    "$TESTSTOOLS"/fs-state | MATCH "usage: fs-state mock-dir"
+
+    # Mocking a non-existing directory creates that directory and in addition,
+    # creates a marker file with the .fake suffix. This marker file identifies
+    # mock objects.
+    not test -e new-dir
+    "$TESTSTOOLS"/fs-state mock-dir new-dir
+    test -d new-dir
+    test -f new-dir.fake
+    # There's no .back directory because the mocked directory did not replace
+    # any existing directory.
+    not test -d new-dir.back
+    # Mocked directory can be restored. When this happens the .fake marker file
+    # is removed and the mocked directory goes away.
+    "$TESTSTOOLS"/fs-state restore-dir new-dir
+    not test -d new-dir
+    not test -f new-dir.fake
+
+    # Mocking an existing directory not only creates the .fake marker file but
+    # also preserves the original with the suffix .back.
+    mkdir existing-dir
+    touch existing-dir/unrelated
+    "$TESTSTOOLS"/fs-state mock-dir existing-dir
+    test -d existing-dir
+    test -f existing-dir.fake
+    test -d existing-dir.back
+    # The newly created mock directory is entirely empty.
+    not test -f existing-dir/unrelated
+    # Restoring removes the mock directory and replaces it with the preserved
+    # .back directory.
+    "$TESTSTOOLS"/fs-state restore-dir existing-dir
+    test -d existing-dir
+    test -f existing-dir/unrelated
+    not test -f existing-dir.fake
+    rm -rf existing-dir
+
+    # Restoring a dir which is not mocked fails with an error message.
+    mkdir non-mocked-dir
+    not "$TESTSTOOLS"/fs-state restore-dir non-mocked-dir
+    "$TESTSTOOLS"/fs-state restore-dir non-mocked-dir 2>&1 | MATCH "fs-state: cannot restore non-mocked directory: non-mocked-dir"
+    rm -rf non-mocked-dir
+
+    # Mocking a non-existing file creates the file and creates a marker file
+    # with the .fake suffix. This marker file identifies mock objects.
+    "$TESTSTOOLS"/fs-state mock-file new-file
+    test -f new-file
+    test -f new-file.fake
+    test ! -f new-file.back
+    # Mocked file can be restored. When this happens the .fake marker file
+    # is removed and the mocked file goes away.
+    "$TESTSTOOLS"/fs-state restore-file new-file
+    test ! -f new-file
+    test ! -f new-file.fake
+    test ! -f new-file.back
+
+    # Mocking an existing file not only creates the .fake marker file but
+    # also preserves the original with the suffix .back.
+    echo content > existing-file
+    "$TESTSTOOLS"/fs-state mock-file existing-file
+    test -f existing-file
+    test -f existing-file.fake
+    test -f existing-file.back
+    not diff existing-file existing-file.back
+    # Restoring removes the mock file and replaces it with the preserved
+    # .back file.
+    "$TESTSTOOLS"/fs-state restore-file existing-file
+    test -f existing-file
+    test ! -f existing-file.fake
+    test ! -f existing-file.back
+
+    # Restoring a file which is not mocked fails with an error message.
+    touch non-mocked-file
+    not "$TESTSTOOLS"/fs-state restore-file non-mocked-file
+    "$TESTSTOOLS"/fs-state restore-file non-mocked-file 2>&1 | MATCH "fs-state: cannot restore non-mocked file: non-mocked-file"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/journal-state/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/journal-state/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/journal-state/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/journal-state/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,39 @@
+summary: smoke test for the journal-state tool
+
+execute: |
+    # Check help
+    "$TESTSTOOLS"/journal-state | MATCH "usage: journal-state start-new-log"
+    "$TESTSTOOLS"/journal-state -h | MATCH "usage: journal-state start-new-log"
+    "$TESTSTOOLS"/journal-state --help | MATCH "usage: journal-state start-new-log"
+
+    # Check that using the last cursor the lines saved during prepare are not considered
+    cursor1=$("$TESTSTOOLS"/journal-state get-last-cursor)
+    test "$(journalctl --cursor "$cursor1" | grep -c "$SPREAD_JOB")" -eq 0
+
+    # Check that the test is correctly started in the journal log
+    "$TESTSTOOLS"/journal-state start-new-log
+    echo "Add some extra logs" | systemd-cat -t snapd-test
+    # shellcheck disable=SC2016
+    retry --wait 1 --attempts 10 sh -c 'test $(journalctl --cursor '\'"$cursor1"\'' | grep -c '"$SPREAD_JOB"') -eq 1'
+
+    # Check that the subcommand check-log-started works
+    # The subcommand check-log-started could fail if the log does not contain the current SPREAD_JOB information
+    "$TESTSTOOLS"/journal-state check-log-started
+
+    # Check that the subcommand get-log works
+    echo "TEST-XX1" | systemd-cat -t snapd-test
+    # shellcheck disable=SC2016
+    retry --wait 1 --attempts 10 sh -c 'test "$("$TESTSTOOLS"/journal-state get-log | grep -c TEST-XX1)" -eq 1'
+
+    # Check that the subcommand get-last-cursor works
+    echo "TEST-XX2" | systemd-cat -t snapd-test
+    echo "Add some extra logs" | systemd-cat -t different-test
+    # shellcheck disable=SC2016
+    retry --wait 1 --attempts 10 sh -c 'test "$("$TESTSTOOLS"/journal-state get-log | grep -c TEST-XX2)" -eq 1'
+
+    cursor2=$("$TESTSTOOLS"/journal-state get-last-cursor)
+    test "$("$TESTSTOOLS"/journal-state get-log-from-cursor "$cursor2" | grep -c "TEST-XX1")" -eq 0
+
+    # Check that the subcommand match-log works
+    "$TESTSTOOLS"/journal-state match-log TEST-XX1
+    not "$TESTSTOOLS"/journal-state match-log TEST-XX1 -u testservice
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/mountinfo.query/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/mountinfo.query/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/mountinfo.query/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/mountinfo.query/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,5 @@
+summary: the mountinfo.query can be used in tests
+execute: |
+    # 2>&1 is required for some versions of python that chose
+    # to print the version to stderr, crazy!
+    mountinfo.query --version 2>&1 | MATCH 1.0
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/retry-tool/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/retry-tool/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/retry-tool/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/retry-tool/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,15 @@
+summary: smoke test for the retry test tool
+execute: |
+    # Retry runs the command that was passed as argument and returns the exit
+    # code of that command.
+    retry true
+    not retry -n 1 false
+    # If the command doesn't exist it is not re-tried multiple times.
+    ( not retry this-command-does-not-exist ) 2>&1 \
+        | grep -F 'retry: cannot execute command this-command-does-not-exist: [Errno 2] No such file or directory'
+    # On failure it tells us about it, showing progress.
+    retry -n 2 --wait 0.1 false 2>&1 | grep -F "retry: command false failed with code 1"
+    retry -n 2 --wait 0.1 false 2>&1 | grep -F "retry: next attempt in 0.1 second(s) (attempt 1 of 2)"
+    retry -n 2 --wait 0.1 false 2>&1 | grep -F "retry: command false keeps failing after 2 attempts"
+    # Though all output is removed with the --quiet switch.
+    test "$(retry -n 2 --wait 0.1 --quiet false 2>&1 | wc -l)" -eq 0
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.backup/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/tests.backup/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.backup/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/tests.backup/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,67 @@
+summary: tests for the tests.backup tool
+
+prepare: |
+    # It is needed to save the test backup "${PWD}.tar" which is created during
+    # the generic prepare phase.
+    mv "${PWD}.tar" "${PWD}.tar.back"
+
+restore: |
+    # The backup "${PWD}.tar.back" needs to be restored to the initial
+    # "${PWD}.tar" during the test restore phase.
+    mv "${PWD}.tar.back" "${PWD}.tar"
+
+execute: |
+    # Without any arguments a help message is printed.
+    tests.backup | MATCH "usage: tests.backup prepare"
+    tests.backup | MATCH "       tests.backup restore"
+
+    # Both -h and --help are recognized.
+    tests.backup --help | MATCH "usage: tests.backup"
+    tests.backup -h | MATCH "usage: tests.backup"
+
+    # Unknown commands and options are reported
+    tests.backup --foo 2>&1 | MATCH "tests.backup: unknown option --foo"
+    tests.backup foo 2>&1 | MATCH "tests.backup: unknown command foo"
+
+    # Create a file and a directory inside the current path
+    touch testfile-old
+    mkdir testdir-old
+
+    # Check prepare creates a backup for the current directory
+    test ! -f "${PWD}.tar"
+    tests.backup prepare
+    test -f "${PWD}.tar"
+
+    # Delete old data and create new data
+    rm "${PWD}/testfile-old"
+    rm -r testdir-old
+    touch testfile-new
+    mkdir testdir-new
+
+    # Restore the backup
+    tests.backup restore
+
+    # Check old files and directories are restored after restore
+    test -e testfile-old
+    test -e testdir-old
+
+    # Check new files and directories are gone after restore
+    test ! -e testfile-new
+    test ! -e testdir-new
+
+    # Check the backup file is gone
+    test ! -e "${PWD}.tar"
+
+    # Validate restore cannot be called if backup file does not exist
+    tests.backup restore 2>&1 | MATCH "tests.backup: cannot restore ${PWD}.tar, the file does not exist"
+
+    # Check the tool support a path to prepare and restore
+    TMP_DIR=$(mktemp -d)
+    tests.backup prepare "$TMP_DIR"
+    test -e "${TMP_DIR}.tar"
+    tests.backup restore "$TMP_DIR"
+    test ! -e "${TMP_DIR}.tar"
+
+    # Validate prepare cannot be called if backup dir does not exist
+    rm -rf "$TMP_DIR"
+    tests.backup prepare "$TMP_DIR" 2>&1 | MATCH "tests.backup: cannot backup $TMP_DIR, not a directory"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.cleanup/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/tests.cleanup/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.cleanup/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/tests.cleanup/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,98 @@
+summary: tests for the tests.cleanup tool
+systems: [ubuntu-16.04-64]
+prepare: |
+    apt-get install -y shellcheck
+restore: |
+    apt-get remove --purge -y shellcheck
+execute: |
+    # The script passes shellcheck.
+    shellcheck "$TESTSTOOLS"/tests.cleanup
+
+    # Without any arguments a help message is printed.
+    tests.cleanup | MATCH "usage: tests.cleanup prepare"
+    tests.cleanup | MATCH "       tests.cleanup defer <cmd> \[args\]"
+    tests.cleanup | MATCH "       tests.cleanup pop"
+    tests.cleanup | MATCH "       tests.cleanup restore"
+
+    # Both -h and --help are also recognized.
+    tests.cleanup --help | MATCH "usage: tests.cleanup"
+    tests.cleanup -h | MATCH "usage: tests.cleanup"
+
+    # Unknown commands and options are reported
+    tests.cleanup --foo 2>&1 | MATCH "tests.cleanup: unknown option --foo"
+    tests.cleanup foo 2>&1 | MATCH "tests.cleanup: unknown command foo"
+
+    # Normal usage consists of a sequence of prepare, defer+, restore
+    # Note that restore runs the deferred commands in the opposite order.
+    tests.cleanup prepare
+    tests.cleanup defer echo one
+    tests.cleanup defer echo two
+    tests.cleanup defer echo three
+    tests.cleanup restore > restore.log
+    diff -u restore.log - <<EXPECTED
+    three
+    two
+    one
+    EXPECTED
+
+    # Preparing twice is detected
+    tests.cleanup prepare
+    not tests.cleanup prepare
+    tests.cleanup prepare 2>&1 | MATCH "tests.cleanup: cannot prepare, already prepared"
+    tests.cleanup restore
+
+    # Restoring twice is detected
+    tests.cleanup prepare
+    tests.cleanup restore
+    not tests.cleanup restore
+    tests.cleanup restore 2>&1 | MATCH "tests.cleanup: cannot restore, must call tests.cleanup prepare first"
+
+    # Deferred commands are appended to defer.sh
+    tests.cleanup prepare
+    test -e defer.sh
+    tests.cleanup defer echo a b c
+    tests.cleanup defer echo 1 2 3
+    diff -u defer.sh - <<EXPECTED
+    echo a b c
+    echo 1 2 3
+    EXPECTED
+    tests.cleanup restore
+    test ! -e defer.sh
+
+    # Deferred commands can fail their exit code is retained and the defer
+    # stack is not purged.
+    tests.cleanup prepare
+    tests.cleanup defer false
+    not tests.cleanup restore
+    tests.cleanup restore 2>&1 | MATCH 'tests.cleanup: deferred command "false" failed with exit code 1'
+    test -e defer.sh
+
+    # Leftover defer.sh scripts are detected by the invariant checker.
+    # This also detects forgotten tests.cleanup calls.
+    not tests.invariant check leftover-defer-sh
+    tests.invariant check leftover-defer-sh 2>&1 | MATCH "tests.invariant: leftover defer.sh script"
+    rm -f defer.sh
+    tests.invariant check leftover-defer-sh
+
+    # Deferred commands can be popped and executed one by one. This is useful
+    # to ensure correctness in case of failure while still allowing precise
+    # resource management.
+    tests.cleanup prepare
+    tests.cleanup defer echo popped
+    tests.cleanup pop | MATCH popped
+
+    # Popping removes the last command from the stack
+    tests.cleanup defer echo cmd-a
+    tests.cleanup defer echo cmd-b
+    tests.cleanup defer echo cmd-c
+    tests.cleanup pop | MATCH cmd-c
+    diff -u defer.sh - <<EXPECTED
+    echo cmd-a
+    echo cmd-b
+    EXPECTED
+    tests.cleanup restore
+
+    # Popping a command when there isn't any fails with an appropriate message
+    tests.cleanup prepare
+    tests.cleanup pop 2>&1 | MATCH 'tests.cleanup: cannot pop, cleanup stack is empty'
+    not tests.cleanup pop
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.invariant/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/tests.invariant/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.invariant/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/tests.invariant/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,69 @@
+summary: tests.invariant is detecting problems
+prepare: |
+    tests.cleanup prepare
+restore: |
+    tests.cleanup restore
+execute: |
+    # Invariant tool presents the usage screen when invoked without arguments
+    # or with the -h or --help options.
+    tests.invariant | MATCH 'usage: tests.invariant check \[INVARIANT...\]'
+    tests.invariant -h | MATCH 'usage: tests.invariant check \[INVARIANT...\]'
+    tests.invariant --help | MATCH 'usage: tests.invariant check \[INVARIANT...\]'
+
+    # When invoked with "check" argument, it runs either all invariants
+    # or the specified set of invariants.
+    tests.invariant check | MATCH 'tests.invariant: root-files-in-home ok'
+    tests.invariant check root-files-in-home | MATCH 'tests.invariant: root-files-in-home ok'
+
+    # Unknown invariant names are reported.
+    tests.invariant check foo 2>&1 | MATCH 'tests.invariant: unknown invariant foo'
+    not tests.invariant check foo 2>/dev/null
+
+    # The root-files-in-home invariant detects files owned by root anywhere in /home/
+    tests.invariant check root-files-in-home | MATCH 'tests.invariant: root-files-in-home ok'
+    touch /home/test/invariant-canary
+    tests.cleanup defer rm -f /home/test/invariant-canary
+    chown root /home/test/invariant-canary
+    tests.invariant check root-files-in-home 2>&1 | MATCH 'tests.invariant: root-files-in-home not-ok'
+    tests.invariant check root-files-in-home 2>&1 | MATCH 'tests.invariant: the following files should not be owned by root'
+    tests.invariant check root-files-in-home 2>&1 | MATCH '/home/test/invariant-canary'
+    tests.invariant check root-files-in-home 2>&1 | MATCH 'tests.invariant: system is corrupted'
+    not tests.invariant check root-files-in-home 2>/dev/null
+
+    # Chown is the solution.
+    chown test /home/test/invariant-canary
+    tests.invariant check root-files-in-home | MATCH 'tests.invariant: root-files-in-home ok'
+
+    # The root-files-in-home invariant ignores /home/gopath which comes from spread.yaml
+    test -d /home/gopath
+    test "$(stat -c %u /home/gopath)" -eq 0
+
+    # The root-files-in-home invariant ignores /home/ubuntu which comes from
+    # GCE cloud-init data, but is sometimes root-owned for unknown reason.
+    if [ -d /home/ubuntu ]; then
+        old_uid="$(stat -c %u /home/ubuntu)"
+        chown root /home/ubuntu
+        tests.cleanup defer chown "$old_uid" /home/ubuntu
+    else
+        mkdir -p /home/ubuntu
+        tests.cleanup defer rmdir /home/ubuntu
+        chown root /home/ubuntu
+    fi
+    tests.invariant check root-files-in-home | MATCH 'tests.invariant: root-files-in-home ok'
+
+    # Invariant tool detects leftovers from crashed snap-confine.
+    mkdir /tmp/snap.rootfs_tests.invariant
+    tests.invariant check crashed-snap-confine 2>&1 | MATCH 'tests.invariant: crashed-snap-confine not-ok'
+    tests.invariant check crashed-snap-confine 2>&1 | MATCH 'tests.invariant: it seems snap-confine has crashed'
+    rmdir /tmp/snap.rootfs_tests.invariant
+
+    # This filters out 14.04 and ubuntu-core, respectively.
+    if [ "$(command -v systemd-run)" != "" ] && [ "$(command -v dbus-launch)" != "" ]; then
+        # Invariant tool detects leaked dbus-daemon.
+        systemd-run --service-type=forking --unit superfluous-dbus.service dbus-launch --sh-syntax
+        # shellcheck disable=SC2016
+        retry sh -c 'test "$(systemctl is-active superfluous-dbus.service)" = active'
+        tests.invariant check stray-dbus-daemon 2>&1 | MATCH 'tests.invariant: stray-dbus-daemon not-ok'
+        systemctl stop superfluous-dbus.service
+        tests.invariant check stray-dbus-daemon 2>&1 | MATCH 'tests.invariant: stray-dbus-daemon ok'
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.session/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/tests.session/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.session/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/tests.session/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,85 @@
+summary: tests for tests.session
+# Session-tool depends on busctl and doesn't work on 14.04
+systems: [-ubuntu-14.04-*]
+environment:
+    USER/root: root
+    USER/test: test
+prepare: |
+    truncate --size=0 defer.sh
+    chmod +x defer.sh
+
+    # Prevent anacron/cron from interfering with their background sessions, grr!
+    for unit in cron.service crond.service anacron.timer anacron.service; do
+        if [ "$(systemctl is-active "$unit")" = active ]; then
+            systemctl stop "$unit"
+            echo "systemctl start \"$unit\"" >> defer.sh
+        fi
+    done
+
+    # For whatever reason (what spawns it!?!) cron may be running in session 2.
+    # To remove any background activity, get rid of it.
+    if loginctl show-session 2 >/dev/null 2>&1 && loginctl show-session 2 | grep -q Service=crond; then
+        loginctl kill-session 2
+    fi
+
+    # Kill sessions that systemd has leaked earlier.
+    tests.session kill-leaked
+
+    # Remember details of sessions before we start.
+    tests.session dump > before.debug.txt
+
+    # Brief version of existing sessions to measure during "restore".
+    loginctl --no-legend list-sessions | sort > before.txt
+
+    # Prepare for using sessions as the given user
+    tests.session prepare -u "$USER"
+execute: |
+    # Check that stdin is forwarded correctly.
+    echo "it-works" | tests.session -u "$USER" exec cat | MATCH "it-works"
+
+    for n in $(seq 300); do
+        echo "ITERATION $(date) $n"
+        tests.session -u "$USER" exec id -u 2>/tmp/tests.session.log | MATCH "$(id -u "$USER")"
+        tests.session -u "$USER" exec env   2>/tmp/tests.session.log | MATCH "XDG_RUNTIME_DIR=/run/user/$(id -u "$USER")"
+        # We get a logind session
+        tests.session -u "$USER" exec loginctl list-sessions | grep "$USER"
+        # Exit code is forwarded
+        tests.session -u "$USER" exec true
+        not tests.session -u "$USER" exec false
+        # The -p option can be used to know the PID of the started program.
+        # This is different from the pid of tests.session as there's a session
+        # manager overlooking the termination of PAM stack (internally we use runuser).
+        tests.session -u "$USER" -p /tmp/outer.pid exec "$(command -v any-python)" -c 'from __future__ import print_function; import os; print(os.getpid())' >/tmp/inner.pid
+        test "$(cat /tmp/outer.pid)" = "$(cat /tmp/inner.pid)"
+    done
+restore: |
+    # Restore after using sessions as the given user
+    tests.session restore -u "$USER"
+
+    # Kill cron if it is running (check prepare for details).
+    if loginctl show-session 2 >/dev/null 2>&1 && loginctl show-session 2 | grep -q Service=crond; then
+        loginctl kill-session 2
+    fi
+
+    # Kill sessions that systemd has leaked over time.
+    tests.session kill-leaked
+
+    # NOTE: This part of the test is very flaky if you restart systemd-logind
+    # It *seems* that all new systems (Debian Sid, Arch, Tumbleweed and Ubuntu 20.04)
+    # Forget about the root session that was there to begin with.
+
+    # When we are done the sessions are exactly what we started with but this
+    # can take a moment as the termination process is asnychronous.
+    retry -n 10 --wait 1 sh -c 'loginctl --no-legend list-sessions | sort > after.txt && diff -u before.txt after.txt'
+    # Remove files we've created
+    rm -f /tmp/{inner,outer}.pid
+    rm -f {before,after}.txt
+
+    # Restart background stuff we stopped.
+    sh -xe defer.sh && rm -f defer.sh
+
+debug: |
+    tests.session dump > after.debug.txt
+    diff -u before.debug.txt after.debug.txt
+    echo "Active timers"
+    systemctl list-timers
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.session-support/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/tests.session-support/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/tests.session-support/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/tests.session-support/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,47 @@
+summary: check the session support status of various distributions
+execute: |
+    case "$SPREAD_SYSTEM/$USER" in
+        amazon-linux-2-*|centos-7-*)
+            tests.session has-system-systemd-and-dbus | MATCH 'ok'
+            tests.session has-system-systemd-and-dbus
+            # Amazon Linux 2 which is based on CentOS 7 both disable user
+            # session features of systemd as, at the time, this was a feature
+            # that was not certain to stay in systemd, and RedHat did not want
+            # to commit to supporting it.
+            tests.session has-session-systemd-and-dbus | MATCH 'no user dbus.socket'
+            not tests.session has-session-systemd-and-dbus
+            ;;
+        ubuntu-14.04-*)
+            # Ubuntu 14.04 does not use systemd. 
+            tests.session has-system-systemd-and-dbus | MATCH 'no busctl'
+            not tests.session has-system-systemd-and-dbus
+            tests.session has-session-systemd-and-dbus | MATCH 'no busctl'
+            not tests.session has-session-systemd-and-dbus
+            ;;
+        ubuntu-16.04-*)
+            tests.session has-system-systemd-and-dbus | MATCH 'ok'
+            tests.session has-system-systemd-and-dbus
+            # Ubuntu 16.04 does not use systemd for user sessions, and does not
+            # ship the package providing dbus.socket in systemd --user by
+            # default, but we install it in the project preparation phase.
+            tests.session has-session-systemd-and-dbus | MATCH 'ok'
+            tests.session has-session-systemd-and-dbus
+            ;;
+        ubuntu-core-1[68]-*)
+            tests.session has-system-systemd-and-dbus | MATCH 'ok'
+            tests.session has-system-systemd-and-dbus
+            # Ubuntu Core 16 and Ubuntu Core 18 did not support user sessions.
+            # Note that Ubuntu Core 20 is in the default case down below, and
+            # does support this feature.
+            tests.session has-session-systemd-and-dbus | MATCH 'no user dbus.socket'
+            not tests.session has-session-systemd-and-dbus
+            ;;
+        *)
+            # The list above contains just the exceptions.
+            # By default everything should work.
+            tests.session has-system-systemd-and-dbus | MATCH 'ok'
+            tests.session has-system-systemd-and-dbus
+            tests.session has-session-systemd-and-dbus | MATCH 'ok'
+            tests.session has-session-systemd-and-dbus
+            ;;
+    esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/to-one-line/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/to-one-line/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/to-one-line/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/to-one-line/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+summary: integration tests for str-tool
+
+execute: |
+    # Check help
+    "$TESTSTOOLS"/to-one-line | MATCH "usage: to-one-line \[string\]"
+    "$TESTSTOOLS"/to-one-line -h | MATCH "usage: to-one-line \[string\]"
+    "$TESTSTOOLS"/to-one-line --help | MATCH "usage: to-one-line \[string\]"
+
+    # Check to-one-line command
+    "$TESTSTOOLS"/to-one-line "$(echo -e 'test1 \n test2')" | MATCH "test1 test2"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/user-state/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/user-state/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/user-state/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/user-state/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,4 @@
+summary: help test for the user-state tool
+execute: |
+    "$TESTSTOOLS"/user-state --help | grep -qFx 'usage: user-state [-h] {remove-with-group} ...'
+    "$TESTSTOOLS"/user-state remove-with-group --help | grep -qFx 'usage: user-state remove-with-group [-h] user'
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/suite/version-compare/task.yaml snapd-2.48.3+20.04/tests/lib/tools/suite/version-compare/task.yaml
--- snapd-2.45.1+20.04.2/tests/lib/tools/suite/version-compare/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/suite/version-compare/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,43 @@
+summary: integration tests for "$TESTSTOOLS"/version-compare
+execute: |
+    # ==
+    "$TESTSTOOLS"/version-compare --strict 1 -eq 1
+    "$TESTSTOOLS"/version-compare --strict 1 -eq 1.0
+    "$TESTSTOOLS"/version-compare --strict 1.0 -eq 1
+    not "$TESTSTOOLS"/version-compare --strict 1 -eq 2
+
+    # !=
+    not "$TESTSTOOLS"/version-compare --strict 1.2 -ne  1.2
+    "$TESTSTOOLS"/version-compare --strict 1 -ne 2
+    "$TESTSTOOLS"/version-compare --strict 2 -ne 1
+
+    # < and <=
+    "$TESTSTOOLS"/version-compare --strict 1 -lt 2
+    not "$TESTSTOOLS"/version-compare --strict 2 -lt 1
+    "$TESTSTOOLS"/version-compare --strict 1 -le 2
+    "$TESTSTOOLS"/version-compare --strict 2 -le 2
+    not "$TESTSTOOLS"/version-compare --strict 2 -le 1
+
+    # > and >=
+    "$TESTSTOOLS"/version-compare --strict 2 -gt 1
+    not "$TESTSTOOLS"/version-compare --strict 1 -gt 2
+    "$TESTSTOOLS"/version-compare --strict 2 -ge 1
+    "$TESTSTOOLS"/version-compare --strict 2 -ge 2
+    not "$TESTSTOOLS"/version-compare --strict 1 -ge 2
+
+    # --verbose
+    "$TESTSTOOLS"/version-compare --verbose --strict 1 -eq 2 | MATCH 'delta between 1 and 2 is: -1'
+    "$TESTSTOOLS"/version-compare --verbose --strict 1 -eq 2 | MATCH 'delta -1 is inconsistent with =='
+
+    # --version
+    # NOTE: older python versions print the version string to stderr
+    "$TESTSTOOLS"/version-compare --version 2>&1 | MATCH 1.0
+
+    # Strict requires all version components to be integers.
+    "$TESTSTOOLS"/version-compare --strict 1.2 -eq 1.2-foo 2>&1 | MATCH 'error: version 1.2-foo is not purely numeric'
+    # Such invalid comparison also returns a distinct error code.
+    set +e
+    "$TESTSTOOLS"/version-compare --strict 1.2 -eq 1.2-foo
+    error_code=$?
+    set -e
+    test "$error_code" -eq 2
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/tests.backup snapd-2.48.3+20.04/tests/lib/tools/tests.backup
--- snapd-2.45.1+20.04.2/tests/lib/tools/tests.backup	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/tests.backup	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,69 @@
+#!/bin/bash -e
+# Tool used to backup/restore a specific directory
+# It is used by the test tool to make sure each test
+# leaves the test directory as was initially
+
+show_help() {
+    echo "usage: tests.backup prepare [PATH]"
+    echo "       tests.backup restore [PATH]"
+}
+
+cmd_prepare() {
+    local BACKUP_PATH=$1
+
+    if [ ! -d "$BACKUP_PATH" ]; then
+        echo "tests.backup: cannot backup $BACKUP_PATH, not a directory" >&2
+        exit 1
+    fi
+    tar cf "${BACKUP_PATH}.tar" "$BACKUP_PATH"
+}
+
+cmd_restore() {
+    local BACKUP_PATH=$1
+    if [ -f "${BACKUP_PATH}.tar" ]; then
+        # Find all the files in the path $BACKUP_PATH and delete them
+        # This command deletes also the hidden files
+        find "${BACKUP_PATH}" -maxdepth 1 -mindepth 1 -exec rm -rf {} \;
+        tar -C/ -xf "${BACKUP_PATH}.tar"
+        rm "${BACKUP_PATH}.tar"
+    else
+        echo "tests.backup: cannot restore ${BACKUP_PATH}.tar, the file does not exist" >&2
+        exit 1
+    fi
+}
+
+main() {
+    if [ $# -eq 0 ]; then
+        show_help
+        exit 0
+    fi
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -h|--help)
+                show_help
+                exit
+                ;;
+            prepare)
+                local BACKUP_PATH="${2:-$(pwd)}"
+                cmd_prepare "$BACKUP_PATH"
+                exit
+                ;;
+            restore)
+                local BACKUP_PATH="${2:-$(pwd)}"
+                cmd_restore "$BACKUP_PATH"
+                exit
+                ;;
+            -*)
+                echo "tests.backup: unknown option $1" >&2
+                exit 1
+                ;;
+            *)
+                echo "tests.backup: unknown command $1" >&2
+                exit 1
+                ;;
+        esac
+    done
+}
+
+main "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/tests.cleanup snapd-2.48.3+20.04/tests/lib/tools/tests.cleanup
--- snapd-2.45.1+20.04.2/tests/lib/tools/tests.cleanup	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/tests.cleanup	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,111 @@
+#!/bin/sh -e
+
+show_help() {
+    echo "usage: tests.cleanup prepare"
+    echo "       tests.cleanup defer <cmd> [args]"
+    echo "       tests.cleanup pop"
+    echo "       tests.cleanup restore"
+    echo
+    echo "COMMANDS:"
+    echo "  prepare: establishes a cleanup stack"
+    echo "  restore: invokes all cleanup commands in reverse order"
+    echo "  defer: pushes a command onto the cleanup stack"
+    echo "  pop: invoke the most recently deferred command, discarding it"
+    echo
+    echo "The defer and pop commands can be to establish temporary"
+    echo "cleanup handler and remove it, in the case of success"
+}
+
+cmd_prepare() {
+    if [ -e defer.sh ]; then
+        echo "tests.cleanup: cannot prepare, already prepared" >&2
+        exit 1
+    fi
+    truncate --size=0 defer.sh
+    chmod +x defer.sh
+}
+
+cmd_defer() {
+    if [ ! -e defer.sh ]; then
+        echo "tests.cleanup: cannot defer, must call tests.cleanup prepare first" >&2
+        exit 1
+    fi
+    echo "$*" >> defer.sh
+}
+
+run_one_cmd() {
+    CMD="$1"
+    set +e
+    sh -ec "$CMD"
+    RET=$?
+    set -e
+    if [ $RET -ne 0 ]; then
+        echo "tests.cleanup: deferred command \"$CMD\" failed with exit code $RET"
+        exit $RET
+    fi
+}
+
+cmd_pop() {
+    if [ ! -s defer.sh ]; then
+        echo "tests.cleanup: cannot pop, cleanup stack is empty" >&2
+        exit 1
+    fi
+    head -n-1 defer.sh >defer.sh.pop
+    trap "mv defer.sh.pop defer.sh" EXIT
+    tail -n-1 defer.sh | while read -r CMD; do
+        run_one_cmd "$CMD"
+    done
+}
+
+cmd_restore() {
+    if [ ! -e defer.sh ]; then
+        echo "tests.cleanup: cannot restore, must call tests.cleanup prepare first" >&2
+        exit 1
+    fi
+    tac defer.sh | while read -r CMD; do
+        run_one_cmd "$CMD"
+    done
+    rm -f defer.sh
+}
+
+if [ $# -eq 0 ]; then
+    show_help
+    exit
+fi
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -h|--help)
+            show_help
+            exit
+            ;;
+        prepare)
+            shift
+            cmd_prepare
+            exit
+            ;;
+        defer)
+            shift
+            cmd_defer "$@"
+            exit
+            ;;
+        pop)
+            shift
+            cmd_pop "$@"
+            exit
+            ;;
+        restore)
+            shift
+            cmd_restore
+            exit
+            ;;
+        -*)
+            echo "tests.cleanup: unknown option $1" >&2
+            exit 1
+            ;;
+        *)
+            echo "tests.cleanup: unknown command $1" >&2
+            exit 1
+            ;;
+    esac
+done
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/tests.invariant snapd-2.48.3+20.04/tests/lib/tools/tests.invariant
--- snapd-2.45.1+20.04.2/tests/lib/tools/tests.invariant	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/tests.invariant	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,170 @@
+#!/bin/sh
+
+show_help() {
+	echo "usage: tests.invariant check [INVARIANT...]"
+	echo
+	echo "Supported invariants:"
+	echo "    root-files-in-home: most of /home/* does not contain root-owned files"
+	echo "    crashed-snap-confine: /tmp/snap.rootfs_* does not exist"
+	echo "    lxcfs-mounted: /var/lib/lxcfs is a mount point"
+	echo "    stray-dbus-daemon: at most one dbus-daemon is running"
+	echo "    leftover-defer-sh: defer.sh must not be left over by tests"
+}
+
+if [ $# -eq 0 ]; then
+	show_help
+	exit 1
+fi
+
+action=
+while [ $# -gt 0 ]; do
+	case "$1" in
+		-h|--help)
+			show_help
+			exit 0
+			;;
+		--)
+			shift
+			break
+			;;
+		check)
+			action=check
+			shift
+			;;
+		-*)
+			echo "tests.invariant: unsupported argument $1" >&2
+			exit 1
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+check_root_files_in_home() {
+	n="$1" # invariant name
+	# This find expression looks for root owned file in /home with the following exceptions:
+	# - The /home/ubuntu directory is root owned but is not used by the tests so we ignore it
+	# - The /home/gopath and everything inside it comes from spread.yaml and is too inconvenient to change
+	# As a note, the working theory for the origin of /home/ubuntu is cloud-init and data from GCE.
+	find /home -mindepth 1 -user root -a ! -path "/home/ubuntu" -a ! -path "$GOHOME" -a ! -path "$GOHOME/*" 2>/dev/null >"/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: the following files should not be owned by root" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_crashed_snap_confine() {
+	n="$1" # invariant name
+	find /tmp -name 'snap.rootfs_*' > "/tmp/tests.invariant.$n"
+	# NOTE: it may be a mount point but we are not checking that here.
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: it seems snap-confine has crashed" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_lxcfs_mounted() {
+	n="$1" # invariant name
+	"$TESTSTOOLS"/mountinfo.query /var/lib/lxcfs > "/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: it seems lxcfs is mounted" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_stray_dbus_daemon() {
+	n="$1" # invariant name
+	(
+		skipped_system=0
+		for pid in $(pgrep dbus-daemon); do
+			cmdline="$(tr '\0' ' ' < "/proc/$pid/cmdline")"
+			# Ignore one dbus-daemon responsible for the system bus.
+			if echo "$cmdline" | grep -q 'dbus-daemon --system' && [ "$skipped_system" -eq 0 ]; then
+				skipped_system=1
+				continue
+			fi
+			# Ignore dbus-daemon running the session of the "external" user.
+			# This may happen when testing a core device using the ad-hoc
+			# backend. This user is never used by tests explicitly.
+			if [ "$(stat -c %U "/proc/$pid")" = "external" ]; then
+				continue
+			fi
+			# Report stray dbus-daemon.
+			echo "pid:$pid cmdline:$cmdline"
+		done
+	) > "/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: more than one dbus-daemon running" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_leftover_defer_sh() {
+	n="$1" # invariant name
+	(
+		find "$PROJECT_PATH" -name defer.sh > "/tmp/tests.invariant.$n"
+	) > "/tmp/tests.invariant.$n"
+	if [ -s "/tmp/tests.invariant.$n" ]; then
+		echo "tests.invariant: leftover defer.sh script" >&2
+		cat "/tmp/tests.invariant.$n" >&2
+		return 1
+	fi
+}
+
+check_invariant() {
+	case "$1" in
+		root-files-in-home)
+			check_root_files_in_home "$1"
+			;;
+		crashed-snap-confine)
+			check_crashed_snap_confine "$1"
+			;;
+		lxcfs-mounted)
+			check_lxcfs_mounted "$1"
+			;;
+		stray-dbus-daemon)
+			check_stray_dbus_daemon "$1"
+			;;
+		leftover-defer-sh)
+			check_leftover_defer_sh "$1"
+			;;
+		*)
+			echo "tests.invariant: unknown invariant $1" >&2
+			exit 1
+			;;
+	esac
+}
+
+ALL_INVARIANTS="root-files-in-home crashed-snap-confine lxcfs-mounted stray-dbus-daemon leftover-defer-sh"
+
+case "$action" in
+	check)
+		ok=1
+		if [ $# -gt 0 ]; then
+			INV_LIST="$*"
+		else
+			INV_LIST="$ALL_INVARIANTS"
+		fi
+		for inv in $INV_LIST; do
+			if check_invariant "$inv"; then
+				echo "tests.invariant: $inv ok"
+			else
+				echo "tests.invariant: $inv not-ok" >&2
+				ok=0
+			fi
+		done
+		if [ $ok -eq 0 ]; then
+			echo "tests.invariant: system is corrupted" >&2
+			exit 1
+		fi
+		;;
+	*)
+		echo "tests.invariant: unknown action $action" >&2
+		exit 1
+		;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/tests.session snapd-2.48.3+20.04/tests/lib/tools/tests.session
--- snapd-2.45.1+20.04.2/tests/lib/tools/tests.session	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/tests.session	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,386 @@
+#!/bin/bash -e
+show_help() {
+	echo "usage: tests.session exec [-u USER] [-p PID_FILE] [--] <CMD>"
+	echo "usage: tests.session prepare | restore [-u USER | -u USER1,USER2,...]"
+	echo "usage: tests.session kill-leaked"
+	echo "usage: tests.session dump"
+	echo "usage: tests.session has-system-systemd-and-dbus"
+	echo "usage: tests.session has-session-systemd-and-dbus"
+}
+
+if [ $# -eq 0 ]; then
+	show_help
+	exit 1
+fi
+user=root
+pid_file=
+action=
+while [ $# -gt 0 ]; do
+	case "$1" in
+		-h)
+			shift
+			show_help
+			exit 0
+			;;
+		-p)
+			if [ $# -eq 1 ]; then
+				echo "tests.session: option -p requires an argument" >&2
+				exit 1
+			fi
+			pid_file="$2"
+			shift 2
+			;;
+		--)
+			shift
+			break
+			;;
+		kill-leaked)
+			action=kill-leaked
+			shift
+			;;
+		prepare)
+			action=prepare
+			shift
+			;;
+		restore)
+			action=restore
+			shift
+			;;
+		dump)
+			action=dump
+			shift
+			;;
+		has-system-systemd-and-dbus)
+			action=has-system-systemd-and-dbus
+			shift
+			;;
+		has-session-systemd-and-dbus)
+			action=has-session-systemd-and-dbus
+			shift
+			;;
+		exec)
+			action="exec"
+			shift
+			# remaining arguments are the command to execute
+			break
+			;;
+		-u)
+			if [ $# -eq 1 ]; then
+				echo "tests.session: option -u requires an argument" >&2
+				exit 1
+			fi
+			user="$2"
+			shift 2
+			;;
+		-*)
+			echo "tests.session: unsupported argument $1" >&2
+			exit 1
+			;;
+		*)
+			echo "tests.session: unsupported action $1" >&2
+			exit 1
+			;;
+	esac
+done
+
+if [ "$(id -u)" -ne 0 ]; then
+	echo "tests.session needs to be invoked as root" >&2
+	exit 1
+fi
+
+case "$action" in
+	kill-leaked)
+		# Work around a bug in older versions of logind that leak closing session
+		# without a process inhabiting it anymore. In the case we've observed there's a
+		# session that is being closed with a missing process.
+		for session_id in $(loginctl --no-legend | awk '{ print $1 }'); do
+			# It would be easier to use "loginctl show-session --value" but we cannot rely on it.
+			if [ "$(loginctl show-session "$session_id" --property=State | cut -d = -f 2-)" = closing ]; then
+				leader=$(loginctl show-session "$session_id" --property=Leader | cut -d = -f 2-)
+				if [ ! -e "/proc/$leader" ]; then
+					loginctl kill-session "$session_id"
+				fi
+			fi
+		done
+
+		exit 0
+		;;
+	prepare)
+		# Try to enable linger for the selected user(s).
+		for u in $(echo "$user" | tr ',' ' '); do
+			if ! loginctl enable-linger "$u"; then
+				echo "tests.session requires external fix for //github.com/systemd/systemd/issues/12401" >&2
+				exit 1
+			fi
+		done
+
+		for u in $(echo "$user" | tr ',' ' '); do
+			# We've enabled linger, now let's explicitly start the
+			# default.target. This ensures that test code does not need to pay
+			# extra attention to synchronization.
+			#
+			# Because some systems do not support systemd --user (see
+			# tests/main/tests.session-support for details), check if this is
+			# expected to work ahead of trying.
+			if tests.session -u "$u" exec systemctl --user is-enabled default.target >/dev/null; then
+				tests.session -u "$u" exec systemctl --user start default.target
+			fi
+		done
+
+		exit 0
+		;;
+	restore)
+		# Disable linger for the selected user(s).
+		for u in $(echo "$user" | tr ',' ' '); do
+
+			loginctl disable-linger "$u"
+			# If the user is not root, also stop their user slice and ensure
+			# their XDG_RUNTIME_DIR goes away. Currently doing this for root is
+			# impossible, because spread logs into a test system over ssh and
+			# gets a root user slice, at minimum.
+			#
+			# If spread ever changes, so that the tests are executed as system
+			# services, then there this condition could be removed.
+			if [ "$u" != root ]; then
+				uid="$(id -u "$u")"
+
+				# Unmount gvfs-fuse and the document portal explicitly.  FUSE
+				# file-systems can stay mounted in a broken state even if their
+				# corresponding process goes away. This can happen if we stop
+				# the slice and the cleanup is not perfectly graceful.
+				umount "/run/user/$uid/gvfs" || true
+				umount "/run/user/$uid/doc" || true
+
+				# See user@.service(5) for discussion about user-UID.slice and
+				# user@UID.service and why both are used. Here we stop the
+				# slice as that encompasses both user@UID.service and any
+				# existing sessions of that user.
+				systemctl stop "user-$uid.slice"
+
+				# On Ubuntu 16.04 and Debian 9 stopping the slice above is
+				# insufficient to stop the service responsible for
+				# /run/user/UID *immediately*. This seems to be related to
+				# *absence* of user-session-dir@.service (template service)
+				# which is responsible for this operation later on (and where
+				# it works more reliably).
+				#
+				# Give the system some time to clean things up.
+				retry -n 3 --wait 3 test ! -e "/run/user/$uid"
+				if [ -e "/run/user/$uid" ]; then
+					echo "tests.session: /run/user/$uid still exists" >&2
+					exit 1
+				fi
+			fi
+		done
+
+		if [ -e /run/tests.session-core16.workaround ]; then
+			rm  /run/tests.session-core16.workaround
+			# Undo changes to make /var/lib/systemd/ writable.
+			umount -l /var/lib/systemd
+		fi
+
+		exit 0
+		;;
+	dump)
+		echo "Active sessions:"
+		for session_id in $(loginctl list-sessions --no-legend | awk '{ print($1) }'); do
+			echo "Details of session $session_id"
+			loginctl show-session "$session_id"
+		done
+		exit 0
+		;;
+	has-system-systemd-and-dbus)
+		#  Ubuntu 14.04 with deputy systemd does not connect to DBus
+		#  and systemd-shim is really responding to "systemd" requests.
+		test -n "$(command -v busctl)"         			|| ( echo "no busctl"; exit 1 )
+		# 		/lib										   /usr/lib									   (if present) dbus-broker.service variant
+		test -f /lib/systemd/system/default.target	|| test -f /usr/lib/systemd/system/default.target	|| ( echo "no system default.target"; exit 1 )
+		test -f /lib/systemd/system/dbus.socket  	|| test -f /usr/lib/systemd/system/dbus.socket		|| ( echo "no system dbus.socket"; exit 1 )
+		test -f /lib/systemd/system/dbus.service	|| test -f /usr/lib/systemd/system/dbus.service		|| test -f /lib/systemd/system/dbus-broker.service || ( echo "no system dbus{,-broker}.service"; exit 1 )
+		echo "ok"
+		exit 0
+		;;
+	has-session-systemd-and-dbus)
+		#  CentOS 7 and derivatives disabled systemd --user
+		#  https://bugs.centos.org/view.php?id=8767
+		test -n "$(command -v busctl)"         			|| ( echo "no busctl"; exit 1 )
+		# 		/lib										   /usr/lib									   (if present) dbus-broker.service variant
+		test -f /lib/systemd/user/default.target 	|| test -f /usr/lib/systemd/user/default.target		|| ( echo "no user default.target"; exit 1)
+		test -f /lib/systemd/user/dbus.socket 		|| test -f /usr/lib/systemd/user/dbus.socket 		|| ( echo "no user dbus.socket"; exit 1 )
+		test -f /lib/systemd/user/dbus.service		|| test -f /usr/lib/systemd/user/dbus.service		|| test -f /lib/systemd/user/dbus-broker.service || ( echo "no system dbus{,-broker}.service"; exit 1 )
+		echo "ok"
+		exit 0
+		;;
+esac
+
+if [ -z "$(command -v busctl)" ]; then
+	echo "tests.session requires busctl" >&2
+	exit 1
+fi
+
+# This fixes a bug in some older Debian systems where /root/.profile contains
+# unconditional invocation of mesg, which on non-tty shells prints "mesg
+# ttyname failed inappropriate ioctl for device" which pollutes output from
+# invoked programs.
+# TODO: move this to spread wide project setup.
+test -f /root/.profile && sed -i -e 's/mesg n .*true/tty -s \&\& mesg n/g' /root/.profile
+
+read -r uuid < /proc/sys/kernel/random/uuid
+unit_name="tests.session-$uuid.service"
+tmp_dir="/tmp/tests.session-$uuid"
+mkdir "$tmp_dir"
+mkfifo -m 0666 "$tmp_dir/dbus-monitor.pipe" "$tmp_dir/ready.pipe" "$tmp_dir/result.pipe" "$tmp_dir/stdin.pipe" "$tmp_dir/stdout.pipe" "$tmp_dir/stderr.pipe"
+trap 'rm -rf $tmp_dir' EXIT
+
+# Run dbus-monitor waiting for systemd JobRemoved signal. Process the output
+# with awk, forwarding the result of the service to a fifo.
+monitor_expr="type='signal', sender='org.freedesktop.systemd1', interface='org.freedesktop.systemd1.Manager', path='/org/freedesktop/systemd1', member='JobRemoved'"
+stdbuf -oL dbus-monitor --system --monitor "$monitor_expr" > "$tmp_dir/dbus-monitor.pipe" 2>"$tmp_dir/dbus-monitor.stderr" &
+dbus_monitor_pid=$!
+
+awk_expr="
+BEGIN {
+	found=0;
+	ready=0;
+}
+
+# Once we get the NameAcquired message we are sure dbus-monitor is connected
+# and will receive JobRemoved once it is sent. The reason we are getting this
+# message despite the filter we establish above is that it is sent directly to
+# us, which bypasses DBus filter expressions.
+/member=NameAcquired/ {
+	if (!ready) {
+		ready=1;
+		print ready > \"$tmp_dir/ready.pipe\";
+		close(\"$tmp_dir/ready.pipe\");
+	}
+}
+
+# This part matches an argument to JobRemoved that contains the name of the
+# tests.session-xxx.service name we picked earlier. Once we see this we are sure
+# the job is gone.
+/   string \"$unit_name\"/ {
+	found=1;
+	print \"found service file\";
+	fflush();
+	next;
+}
+
+# This matches any string argument but only takes effect once we found our
+# JobRemoved message. The order of arguments to JobRemoved is such that the
+# immediate successor of the service name is the result word. This is
+# translated to a pass / fail exit code from tests.session. Scanning this part
+# terminates awk.
+/string \".*\"/ {
+	if (found==1) {
+		print \"found result\";
+		print \$2 > \"$tmp_dir/result.pipe\";
+		fflush(\"\");
+		close(\"$tmp_dir/result.pipe\");
+		exit;
+	}
+}
+"
+awk -W interactive "$awk_expr" <"$tmp_dir/dbus-monitor.pipe" >"$tmp_dir/awk.log" 2>&1 &
+awk_pid=$!
+
+# Wait for dbus-monitor to start.
+cat "$tmp_dir/ready.pipe" >/dev/null
+
+# Use busctl to spawn a command. The command is wrapped in shell, runuser -l
+# and redirects to capture output. Sadly busctl doesn't support passing file
+# descriptors https://github.com/systemd/systemd/issues/14954 As a workaround
+# we pass a set of pipes. This is good for non-interactive work.
+# NOTE: /dev/stdin is provided explicitly to trigger special behavior in bash,
+# as otherwise background tasks are started with /dev/null for stdin.
+cat </dev/stdin >"$tmp_dir/stdin.pipe" &
+cat_stdin_pid=$!
+cat <"$tmp_dir/stdout.pipe" >&1 &
+cat_stdout_pid=$!
+cat <"$tmp_dir/stderr.pipe" >&2 &
+cat_stderr_pid=$!
+
+(
+	echo "#!/bin/sh"
+	test -n "$pid_file" && echo "echo \$$ >\"$pid_file\""
+	printf "exec "
+	for arg in "$@"; do
+		printf '%q ' "$arg"
+	done
+	echo
+)>"$tmp_dir/exec"
+chmod +x "$tmp_dir/exec"
+
+# We want to provide a SELinuxContext but systemd in older SELinux-using distributions
+# does not recognize this attribute. See https://github.com/systemd/systemd/blob/master/NEWS#L6402
+# The typical user context as reported by id -Z is: unconfined_u:unconfined_r:unconfined_t:s0
+selinux_context_arg=
+case $SPREAD_SYSTEM in
+	fedora-*|centos-*)
+		if [ "$(systemctl --version | head -n 1 | awk '{ print $2 }')" -gt 219 ]; then
+			selinux_context_arg="SELinuxContext s unconfined_u:unconfined_r:unconfined_t:s0"
+		fi
+		;;
+esac
+
+# NOTE: This shellcheck directive is for the $selinux_context_arg expansion below.
+# shellcheck disable=SC2086
+busctl \
+	--allow-interactive-authorization=no --quiet \
+	--system \
+	-- \
+	call \
+	 org.freedesktop.systemd1 \
+	/org/freedesktop/systemd1 \
+	 org.freedesktop.systemd1.Manager \
+	StartTransientUnit "ssa(sv)a(sa(sv))" \
+	"$unit_name" fail $(( 4 + $(test -n "$selinux_context_arg" && echo 1 || echo 0))) \
+		Description s "tests.session running $* as $user" \
+		Type s oneshot \
+		Environment as 1 TERM=xterm-256color \
+		$selinux_context_arg \
+		ExecStart "a(sasb)" 1 \
+			"$(command -v runuser)" 6 "$(command -v runuser)" -l "$user" - -c "SNAPD_DEBUG=$SNAPD_DEBUG SNAP_CONFINE_DEBUG=$SNAP_CONFINE_DEBUG exec $tmp_dir/exec <$tmp_dir/stdin.pipe >$tmp_dir/stdout.pipe 2>$tmp_dir/stderr.pipe" false \
+	0
+# This is done so that we can configure file redirects. Once Ubuntu 16.04 is no
+# longer supported we can use Standard{Input,Output,Error}=file:path property
+# of systemd, or perhaps even StandardInputFileDescriptor and pass a file
+# descriptor to the FIFOs we open in the script above.
+
+# Wait for the service to terminate. The trigger is a successful read
+# from the result FIFO. In case we are signaled in one of the familiar
+# ways, kill the started service with the same signal. The reading occurs
+# in a loop as the signal will first interrupt the read process, which will
+# fail and return nothing.
+trap 'systemctl kill --signal=INT $unit_name' INT
+trap 'systemctl kill --signal=TERM $unit_name' TERM
+trap 'systemctl kill --signal=QUIT $unit_name' QUIT
+result=""
+for sig in INT TERM QUIT; do
+	result=$(cat "$tmp_dir/result.pipe" 2>/dev/null) && break
+	trap - "$sig"
+done
+trap - INT TERM QUIT
+
+# Kill dbus-monitor that otherwise runs until it notices the pipe is no longer
+# connected, which happens after a longer while. Redirect stderr to /dev/null
+# to avoid upsetting tests which are sensitive to stderr, e.g. tests/main/document-portal-activation
+kill $dbus_monitor_pid 2>/dev/null || true
+wait $dbus_monitor_pid 2>/dev/null || true
+wait $awk_pid
+
+wait "$cat_stdin_pid"
+wait "$cat_stdout_pid"
+wait "$cat_stderr_pid"
+
+# Prevent accumulation of failed sessions.
+
+if [ "$result" != '"done"' ]; then
+	systemctl reset-failed "$unit_name"
+fi
+
+case "$result" in
+	'"done"') exit 0; ;;
+	'"failed"') exit 1; ;;
+	'"canceled"') exit 1; ;;
+esac
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/to-one-line snapd-2.48.3+20.04/tests/lib/tools/to-one-line
--- snapd-2.45.1+20.04.2/tests/lib/tools/to-one-line	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/to-one-line	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+show_help() {
+    echo "usage: to-one-line [string]"
+}
+
+to_one_line(){
+    echo "$1" | tr '\r\n' ' ' | tr -s ' '
+}
+
+if [ $# -eq 0 ]; then
+    show_help
+    exit
+fi
+
+if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
+    show_help
+else
+    to_one_line "$1"
+fi
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/user-state snapd-2.48.3+20.04/tests/lib/tools/user-state
--- snapd-2.45.1+20.04.2/tests/lib/tools/user-state	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/user-state	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,60 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+import argparse
+import os
+import subprocess
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import Text
+
+
+def remove_user_with_group(user_name):
+    # type: (Text) -> None
+    """remove the user and group with the same name, if present."""
+    if os.path.exists("/var/lib/extrausers/passwd"):
+        subprocess.call(["userdel", "--extrausers", "--force", "--remove", user_name])
+    else:
+        subprocess.call(["userdel", "--force", "--remove", user_name])
+        # Some systems do not set "USERGROUPS_ENAB yes" so we need to cleanup
+        # the group manually. Use "-f" (force) when available, older versions
+        # do not have it.
+        proc = subprocess.Popen(["groupdel", "-h"], stdout=subprocess.PIPE)
+        out, _ = proc.communicate()
+        if b"force" in out:
+            subprocess.call(["groupdel", "-f", user_name])
+        else:
+            subprocess.call(["groupdel", user_name])
+    # Ensure the user user really got deleted
+    if subprocess.call(["getent", "passwd", user_name]) == 0:
+        raise SystemExit("user exists after removal?")
+    if subprocess.call(["getent", "group", user_name]) == 0:
+        raise SystemExit("group exists after removal?")
+
+
+def main():
+    # type: () -> None
+    parser = argparse.ArgumentParser()
+    sub = parser.add_subparsers()
+    cmd = sub.add_parser(
+        "remove-with-group",
+        description="Remove system user and group, if present",
+        help="remove system user and group, if present",
+    )
+    cmd.set_defaults(func=lambda ns: remove_user_with_group(ns.user))
+    cmd.add_argument("user", help="name of the user and group to remove")
+    ns = parser.parse_args()
+    if hasattr(ns, "func"):
+        ns.func(ns)
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/tools/version-compare snapd-2.48.3+20.04/tests/lib/tools/version-compare
--- snapd-2.45.1+20.04.2/tests/lib/tools/version-compare	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/tools/version-compare	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,308 @@
+#!/usr/bin/env any-python
+from __future__ import print_function, absolute_import, unicode_literals
+
+from argparse import Action, ArgumentParser, RawTextHelpFormatter, SUPPRESS
+import itertools
+import re
+import sys
+import sys
+import unittest
+
+# PY2 is true when we're running under Python 2.x It is used for appropriate
+# return value selection of __str__ and __repr_ methods, which must both
+# return str, not unicode (in Python 2) and str (in Python 3). In both cases
+# the return type annotation is exactly the same, but due to unicode_literals
+# being in effect, and the fact we often use a format string (which is an
+# unicode string in Python 2), we must encode the it to byte string when
+# running under Python 2.
+PY2 = sys.version_info[0] == 2
+
+# Define MYPY as False and use it as a conditional for typing import. Despite
+# this declaration mypy will really treat MYPY as True when type-checking.
+# This is required so that we can import typing on Python 2.x without the
+# typing module installed. For more details see:
+# https://mypy.readthedocs.io/en/latest/common_issues.html#import-cycles
+MYPY = False
+if MYPY:
+    from typing import Any, Text, Tuple, Optional, Union, Sequence
+    from argparse import Namespace
+
+
+class _UnitTestAction(Action):
+    def __init__(
+        self,
+        option_strings,
+        dest=SUPPRESS,
+        default=SUPPRESS,
+        help="run program's unit test suite and exit",
+    ):
+        # type: (Text, Text, Text, Text) -> None
+        super(_UnitTestAction, self).__init__(
+            option_strings=option_strings,
+            dest=dest,
+            default=default,
+            nargs="...",
+            help=help,
+        )
+
+    def __call__(self, parser, ns, values, option_string=None):
+        # type: (ArgumentParser, Namespace, Union[str, Sequence[Any], None], Optional[Text]) -> None
+        # We allow the caller to provide the test to invoke by giving
+        # --run-unit-tests a set of arguments.
+        argv = [sys.argv[0]]
+        if isinstance(values, list):
+            argv += values
+        unittest.main(argv=argv)
+        parser.exit()
+
+
+def consistent_relation(rel_op, delta):
+    # type: (Text, int) -> bool
+    """
+    consistent_relation returns true if the relation is consistent with delta.
+
+    The relation operator is one of ==, !=, <, <=, > or >=.
+    Delta is either 0, a positive or a negative number.
+    """
+    if rel_op == "==":
+        return delta == 0
+    elif rel_op == "!=":
+        return delta != 0
+    elif rel_op == ">":
+        return delta > 0
+    elif rel_op == ">=":
+        return delta >= 0
+    elif rel_op == "<":
+        return delta < 0
+    elif rel_op == "<=":
+        return delta <= 0
+    raise ValueError("unexpected relational operator " + rel_op)
+
+
+class ConsistentRelationTests(unittest.TestCase):
+    def test_eq(self):
+        # type: () -> None
+        self.assertFalse(consistent_relation("==", -1))
+        self.assertTrue(consistent_relation("==", 0))
+        self.assertFalse(consistent_relation("==", +1))
+
+    def test_ne(self):
+        # type: () -> None
+        self.assertTrue(consistent_relation("!=", -1))
+        self.assertFalse(consistent_relation("!=", 0))
+        self.assertTrue(consistent_relation("!=", +1))
+
+    def test_gt(self):
+        # type: () -> None
+        self.assertFalse(consistent_relation(">", -1))
+        self.assertFalse(consistent_relation(">", 0))
+        self.assertTrue(consistent_relation(">", +1))
+
+    def test_ge(self):
+        # type: () -> None
+        self.assertFalse(consistent_relation(">=", -1))
+        self.assertTrue(consistent_relation(">=", 0))
+        self.assertTrue(consistent_relation(">=", +1))
+
+    def test_lt(self):
+        # type: () -> None
+        self.assertTrue(consistent_relation("<", -1))
+        self.assertFalse(consistent_relation("<", 0))
+        self.assertFalse(consistent_relation("<", +1))
+
+    def test_le(self):
+        # type: () -> None
+        self.assertTrue(consistent_relation("<=", -1))
+        self.assertTrue(consistent_relation("<=", 0))
+        self.assertFalse(consistent_relation("<=", +1))
+
+    def test_unknown(self):
+        # type: () -> None
+        with self.assertRaises(ValueError):
+            consistent_relation("???", 0)
+
+
+def strict_version_cmp(a, b):
+    # type: (Text, Text) -> int
+    """
+    strictly_version_cmp compares two version numbers without leeway.
+
+    The algorithm considers each version to be a tuple of integers. Non,
+    integer elements or element fragments are regarded as an error and raised
+    as ValueError.
+
+    Comparison is performed on by considering the leftmost element in each
+    tuple. First pair of numbers that are not equal determine the result of the
+    comparison. Tuples have unequal length then missing elements are
+    substituted with zero.
+
+    The return value is 0 if the version strings are equal, -1 if version a is
+    smaller or +1 if version b is smaller.
+    """
+    try:
+        a_items = [int(item, 10) for item in a.split(".")]
+    except ValueError:
+        raise ValueError("version {} is not purely numeric".format(a))
+    try:
+        b_items = [int(item, 10) for item in b.split(".")]
+    except ValueError:
+        raise ValueError("version {} is not purely numeric".format(b))
+    if PY2:
+        zip_longest_fn = itertools.izip_longest
+    else:
+        zip_longest_fn = itertools.zip_longest
+    for a_val, b_val in zip_longest_fn(a_items, b_items, fillvalue=0):
+        delta = a_val - b_val
+        if delta != 0:
+            return 1 if delta > 0 else -1
+    return 0
+
+
+class StrictVersionCmpTests(unittest.TestCase):
+    def test_simple(self):
+        # type: () -> None
+        self.assertEqual(strict_version_cmp("10", "10"), 0)
+        self.assertEqual(strict_version_cmp("10", "20"), -1)
+        self.assertEqual(strict_version_cmp("20", "10"), +1)
+
+    def test_many_segments(self):
+        # type: () -> None
+        self.assertEqual(strict_version_cmp("1.2.3", "1.2.3"), 0)
+        self.assertEqual(strict_version_cmp("1.2.3", "1.3.4"), -1)
+        self.assertEqual(strict_version_cmp("1.4.3", "1.2.3"), +1)
+        self.assertEqual(strict_version_cmp("1.0.0", "1.1.0"), -1)
+        self.assertEqual(strict_version_cmp("0.1.2", "1.1.2"), -1)
+
+    def test_unequal_length(self):
+        # type: () -> None
+        self.assertEqual(strict_version_cmp("1", "1.0"), 0)
+        self.assertEqual(strict_version_cmp("1", "1.2"), -1)
+        self.assertEqual(strict_version_cmp("1.2", "1"), +1)
+        self.assertEqual(strict_version_cmp("1", "1.0.1"), -1)
+        self.assertEqual(strict_version_cmp("1.1", "1.0.1"), +1)
+
+    def test_version_with_text(self):
+        # type: () -> None
+        with self.assertRaises(ValueError) as cm:
+            strict_version_cmp("1-foo", "1")
+        self.assertEqual(cm.exception.args, ("version 1-foo is not purely numeric",))
+        with self.assertRaises(ValueError) as cm:
+            strict_version_cmp("1.2-foo", "1.2")
+        self.assertEqual(cm.exception.args, ("version 1.2-foo is not purely numeric",))
+
+
+def _make_parser():
+    # type: () -> ArgumentParser
+    parser = ArgumentParser(
+        epilog="""
+Relational operator is one of:
+
+    -eq -ne -gt -ge -lt -le
+
+Version comparison is performed using the selected algorithm.
+
+strict:
+    The algorithm considers each version to be a tuple of integers.
+    Non-integer elements are considered to be invalid version.
+
+    Comparison is performed on by considering the leftmost element in each
+    tuple. First pair of numbers that are not equal determine the result of the
+    comparison. Tuples have unequal length then missing elements are
+    substituted with zero.
+    """,
+        formatter_class=RawTextHelpFormatter,
+    )
+    parser.register("action", "unit-test", _UnitTestAction)
+    parser.add_argument("-v", "--version", action="version", version="1.0")
+    parser.add_argument(
+        "--verbose", action="store_true", help="describe comparison process"
+    )
+
+    parser.add_argument("version_a", metavar="VERSION-A")
+    parser.add_argument("version_b", metavar="VERSION-B")
+
+    # algorithm selection
+    alg_grp = parser.add_mutually_exclusive_group(required=True)
+    alg_grp.add_argument(
+        "--strict",
+        dest="algorithm",
+        action="store_const",
+        const=strict_version_cmp,
+        help="select the strict version comparison",
+    )
+    # relation selection
+    rel_op_grp = parser.add_mutually_exclusive_group(required=True)
+    rel_op_grp.add_argument(
+        "-eq",
+        action="store_const",
+        const="==",
+        dest="rel_op",
+        help="test that versions are equal",
+    )
+    rel_op_grp.add_argument(
+        "-ne",
+        action="store_const",
+        const="!=",
+        dest="rel_op",
+        help="test that versions are not equal",
+    )
+    rel_op_grp.add_argument(
+        "-gt",
+        action="store_const",
+        const=">",
+        dest="rel_op",
+        help="test that version-a is greater than version-b",
+    )
+    rel_op_grp.add_argument(
+        "-ge",
+        action="store_const",
+        const=">=",
+        dest="rel_op",
+        help="test that version-a is greater than or equal to version-b",
+    )
+    rel_op_grp.add_argument(
+        "-lt",
+        action="store_const",
+        const="<",
+        dest="rel_op",
+        help="test that version-a is less than version-b",
+    )
+    rel_op_grp.add_argument(
+        "-le",
+        action="store_const",
+        const="<=",
+        dest="rel_op",
+        help="test that version-a is less than or equal to version-b",
+    )
+
+    # maintenance commands
+    maint_grp = parser.add_argument_group("maintenance commands")
+    maint_grp.add_argument("--run-unit-tests", action="unit-test", help=SUPPRESS)
+    return parser
+
+
+def main():
+    # type: () -> None
+    opts = _make_parser().parse_args()
+    try:
+        delta = opts.algorithm(opts.version_a, opts.version_b)
+    except ValueError as exc:
+        print("error: {}".format(exc), file=sys.stderr)
+        raise SystemExit(2)
+    else:
+        is_consistent = consistent_relation(opts.rel_op, delta)
+        if opts.verbose:
+            print(
+                "delta between {} and {} is: {}".format(
+                    opts.version_a, opts.version_b, delta
+                )
+            )
+            if is_consistent:
+                print("delta {} is consistent with {}".format(delta, opts.rel_op))
+            else:
+                print("delta {} is inconsistent with {}".format(delta, opts.rel_op))
+        raise SystemExit(0 if is_consistent else 1)
+
+
+if __name__ == "__main__":
+    main()
diff -Nru snapd-2.45.1+20.04.2/tests/lib/uc20-create-partitions/main.go snapd-2.48.3+20.04/tests/lib/uc20-create-partitions/main.go
--- snapd-2.45.1+20.04.2/tests/lib/uc20-create-partitions/main.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/uc20-create-partitions/main.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,114 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019-2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/jessevdk/go-flags"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/gadget"
+	"github.com/snapcore/snapd/gadget/install"
+	"github.com/snapcore/snapd/secboot"
+)
+
+var installRun = install.Run
+
+type cmdCreatePartitions struct {
+	Mount   bool `short:"m" long:"mount" description:"Also mount filesystems after creation"`
+	Encrypt bool `long:"encrypt" description:"Encrypt the data partition"`
+
+	Positional struct {
+		GadgetRoot string `positional-arg-name:"<gadget-root>"`
+		Device     string `positional-arg-name:"<device>"`
+	} `positional-args:"yes"`
+}
+
+const (
+	short = "Create missing partitions for the device"
+	long  = ""
+)
+
+type simpleObserver struct {
+	encryptionKey secboot.EncryptionKey
+}
+
+func (o *simpleObserver) Observe(op gadget.ContentOperation, affectedStruct *gadget.LaidOutStructure, root, dst string, data *gadget.ContentChange) (gadget.ContentChangeAction, error) {
+	return gadget.ChangeApply, nil
+}
+
+func (o *simpleObserver) ChosenEncryptionKey(key secboot.EncryptionKey) {
+	o.encryptionKey = key
+}
+
+func readModel(modelPath string) (*asserts.Model, error) {
+	f, err := os.Open(modelPath)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	a, err := asserts.NewDecoder(f).Decode()
+	if err != nil {
+		return nil, fmt.Errorf("cannot decode assertion: %v", err)
+	}
+	if a.Type() != asserts.ModelType {
+		return nil, fmt.Errorf("not a model assertion")
+	}
+	return a.(*asserts.Model), nil
+}
+
+func main() {
+	args := &cmdCreatePartitions{}
+	_, err := flags.ParseArgs(args, os.Args[1:])
+	if err != nil {
+		panic(err)
+	}
+
+	obs := &simpleObserver{}
+
+	options := install.Options{
+		Mount:   args.Mount,
+		Encrypt: args.Encrypt,
+	}
+	installSideData, err := installRun(args.Positional.GadgetRoot, args.Positional.Device, options, obs)
+	if err != nil {
+		panic(err)
+	}
+
+	if args.Encrypt {
+		if installSideData == nil || installSideData.KeysForRoles == nil {
+			panic("expected encryption keys")
+		}
+		dataKey := installSideData.KeysForRoles[gadget.SystemData]
+		if dataKey == nil {
+			panic("ubuntu-data encryption key is unset")
+		}
+		if err := ioutil.WriteFile("unsealed-key", dataKey.Key[:], 0644); err != nil {
+			panic(err)
+		}
+		if err := ioutil.WriteFile("recovery-key", dataKey.RecoveryKey[:], 0644); err != nil {
+			panic(err)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/tests/lib/user.sh snapd-2.48.3+20.04/tests/lib/user.sh
--- snapd-2.45.1+20.04.2/tests/lib/user.sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/lib/user.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,71 +0,0 @@
-#!/bin/bash
-
-TEST_USER="test"
-#shellcheck disable=SC2034
-TEST_USER_HOME=/home/test
-TEST_UID="$(id -u "$TEST_USER")"
-USER_RUNTIME_DIR="/run/user/${TEST_UID}"
-
-start_user_session() {
-    # Make sure the test user's XDG_RUNTIME_DIR exists
-    mkdir -p "$USER_RUNTIME_DIR"
-    chmod u=rwX,go= "$USER_RUNTIME_DIR"
-    chown "${TEST_USER}:${TEST_USER}" "$USER_RUNTIME_DIR"
-
-    if ! has_user_session_support ; then
-        # no session manager to start
-        return 0
-    fi
-
-    systemctl start "user@${TEST_UID}.service"
-    USER_DBUS_SESSION_BUS_ADDRESS="$(user_session_dbus_address)"
-}
-
-stop_user_session() {
-    if ! has_user_session_support ; then
-        # no session manager to kill
-        return 0
-    fi
-
-    systemctl stop "user@${TEST_UID}.service"
-    # The user-runtime-dir@.service unit did not exist before systemd
-    # 239, so ignore errors.
-    systemctl stop "user-runtime-dir@${TEST_UID}.service" || true
-}
-
-purge_user_session_data() {
-    if [ -n "$USER_RUNTIME_DIR" ] && [ -d "$USER_RUNTIME_DIR" ]; then
-        umount --lazy "${USER_RUNTIME_DIR}/doc" || :
-        rm -rf "${USER_RUNTIME_DIR:?}"/* "${USER_RUNTIME_DIR:?}"/.[!.]*
-    fi
-}
-
-has_user_session_support() {
-    # assuming user sessions support exists if the current user has a
-    # user-session systemd running
-    test -S "/run/user/$(id -u)/systemd/private"
-}
-
-user_session_dbus_address() {
-    as_user_simple "XDG_RUNTIME_DIR=\"${USER_RUNTIME_DIR}\" systemctl --user show-environment" | \
-        grep ^DBUS_SESSION_BUS_ADDRESS | \
-        cut -f2- -d=
-}
-
-USER_DBUS_SESSION_BUS_ADDRESS=
-as_user() {
-    if has_user_session_support && [ -z "$USER_DBUS_SESSION_BUS_ADDRESS" ]; then
-        USER_DBUS_SESSION_BUS_ADDRESS="$(user_session_dbus_address)"
-    fi
-    as_user_simple "XDG_RUNTIME_DIR=\"${USER_RUNTIME_DIR}\" DBUS_SESSION_BUS_ADDRESS=\"${USER_DBUS_SESSION_BUS_ADDRESS:-}\" $*"
-}
-
-as_user_simple() {
-    su -l -c "$@" "$TEST_USER"
-}
-
-as_given_user() {
-    local user="$1"
-    shift
-    su -l -c "$@" "$user"
-}
diff -Nru snapd-2.45.1+20.04.2/tests/main/abort/task.yaml snapd-2.48.3+20.04/tests/main/abort/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/abort/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/abort/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,9 +16,7 @@
     echo "Abort with valid id - error"
     subdirPath="$SNAP_MOUNT_DIR/$SNAP_NAME/current/foo"
     mkdir -p "$subdirPath"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    if install_local "$SNAP_NAME"; then
+    if "$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME"; then
         echo "install should fail when the target directory exists"
         exit 1
     fi
@@ -31,7 +29,7 @@
     rm -rf "$subdirPath"
 
     echo "Abort with valid id - done"
-    install_local "$SNAP_NAME"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME"
     idPattern="\\d+(?= +Done.*?Install \"$SNAP_NAME\" snap)"
     id=$(snap changes | grep -Pzo "$idPattern")
     if snap abort "$id"; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/alias/task.yaml snapd-2.48.3+20.04/tests/main/alias/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/alias/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/alias/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,7 @@
 summary: Check snap alias and snap unalias
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local aliases
+    "$TESTSTOOLS"/snaps-state install-local aliases
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/apparmor-batch-reload/task.yaml snapd-2.48.3+20.04/tests/main/apparmor-batch-reload/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/apparmor-batch-reload/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/apparmor-batch-reload/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -28,9 +28,7 @@
     rm -f profiles.out
 
 debug: |
-    #shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB"/journalctl.sh
-    get_journalctl_log -a | grep apparmor_parser.fake
+    "$TESTSTOOLS"/journal-state get-log -a | grep apparmor_parser.fake
 
 execute: |
     systemctl stop snapd.{service,socket}
@@ -90,12 +88,9 @@
         retry=$(( retry - 1 ))
     done
 
-    #shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB"/journalctl.sh
-
     echo "Check log notification about failed batch-reload"
     # grep by "fail" to reduce log/debug noise in case of a match failure below
-    log="$(get_journalctl_log -a -u snapd|grep -i fail)"
+    log="$("$TESTSTOOLS"/journal-state get-log -a -u snapd|grep -i fail)"
     echo "$log" | MATCH "failed to batch-reload $VARIANT profiles: cannot load apparmor profiles"
     # we're matching a single long log line (the invocation of apparmor_parser for batch-reload of
     # multiple profiles) where the order of arguments is not deterministic, therefore it's split
diff -Nru snapd-2.45.1+20.04.2/tests/main/appstream-id/task.yaml snapd-2.48.3+20.04/tests/main/appstream-id/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/appstream-id/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/appstream-id/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,15 +5,13 @@
 systems: [-ubuntu-14.04-*, -ubuntu-core*]
 
 prepare: |
-    snap install jq
+    snap install --edge jq
 
 restore: |
     rm -f response
 
 debug: |
-    if [ -e response ]; then
-        grep -n '' response
-    fi
+    test -e response && cat response
 
 execute: |
     echo "Verify that search results contain common-ids"
diff -Nru snapd-2.45.1+20.04.2/tests/main/apt-hooks/task.yaml snapd-2.48.3+20.04/tests/main/apt-hooks/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/apt-hooks/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/apt-hooks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,7 @@
 summary: Ensure apt hooks work
 
 # apt hook only available on 18.04+ and aws-cli only for amd64
-systems: [ubuntu-18.04-64, ubuntu-19.10-64, ubuntu-20.04-64]
-
-manual: true
+systems: [ubuntu-18.04-64, ubuntu-2*-64]
 
 debug: |
     ls -lh /var/cache/snapd
diff -Nru snapd-2.45.1+20.04.2/tests/main/auto-refresh/task.yaml snapd-2.48.3+20.04/tests/main/auto-refresh/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/auto-refresh/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/auto-refresh/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,5 @@
 summary: Check that auto-refresh works
 
-# TODO:UC20: enable once we have a real model assertion, currently fails with:
-#   v2/snaps/refresh -> "cannot set device session: no device serial yet"
-systems: [-ubuntu-core-20-*]
-
 environment:
     SNAP_NAME/regular: test-snapd-tools
     SNAP_NAME/parallel: test-snapd-tools_instance
@@ -23,16 +19,13 @@
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB/dirs.sh"
 
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     echo "Auto refresh information is shown"
     output=$(snap refresh --time)
     for expected in ^schedule: ^last: ^next:; do
         echo "$output" | MATCH "$expected"
     done
 
-    if is_core_system; then
+    if os.query is-core; then
         # no holding
         echo "$output" | not MATCH "^hold:"
     else
diff -Nru snapd-2.45.1+20.04.2/tests/main/auto-refresh-retry/task.yaml snapd-2.48.3+20.04/tests/main/auto-refresh-retry/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/auto-refresh-retry/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/auto-refresh-retry/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,6 @@
 summary: Check that auto-refresh is retried after a permanent network error
 
-# TODO:UC20: enable once we have a real model assertion, currently fails with:
-#   v2/snaps/refresh -> "cannot set device session: no device serial yet"
-systems: [-ubuntu-core-20-*, -ubuntu-14.04-*]
+systems: [-ubuntu-14.04-*]
 
 prepare: |
     snap install --devmode jq
@@ -18,9 +16,6 @@
     ip netns pids testns || true
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "Install a snap from stable"
     snap install test-snapd-tools
   
@@ -45,7 +40,7 @@
 
     echo "wait for auto-refresh to happen and fail"
     for _ in $(seq 120); do
-        if get_journalctl_log | MATCH "state ensure error: persistent network error"; then
+        if "$TESTSTOOLS"/journal-state get-log | MATCH "state ensure error: persistent network error"; then
             break
         fi
         echo "Ensure refresh"
@@ -53,7 +48,7 @@
         sleep 5
     done
 
-    get_journalctl_log | MATCH "state ensure error: persistent network error"
+    "$TESTSTOOLS"/journal-state get-log | MATCH "state ensure error: persistent network error"
 
     # restart snapd with network access back
     systemctl stop snapd.{service,socket}
diff -Nru snapd-2.45.1+20.04.2/tests/main/base-policy/task.yaml snapd-2.48.3+20.04/tests/main/base-policy/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/base-policy/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/base-policy/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,14 +2,12 @@
 
 prepare: |
     echo "Given basic snaps are installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh-core
-    install_local test-snapd-sh-core18
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh-core
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh-core18
 
     # test-snapd-core18 is only available on amd64
     if [ "$(uname -p)" = "x86_64" ]; then
-        install_local test-snapd-sh-other18
+        "$TESTSTOOLS"/snaps-state install-local test-snapd-sh-other18
     fi
 
 execute: |
diff -Nru snapd-2.45.1+20.04.2/tests/main/base-snaps/task.yaml snapd-2.48.3+20.04/tests/main/base-snaps/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/base-snaps/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/base-snaps/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,21 +3,18 @@
 systems: [-opensuse-*]
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Ensure a snap that requires a unavailable base snap can not be installed"
-    if install_local test-snapd-requires-base; then
+    if "$TESTSTOOLS"/snaps-state install-local test-snapd-requires-base; then
         echo "ERROR: test-snapd-requires-base should not be installable without test-snapd-base"
         exit 1
     fi
 
     echo "Ensure a base snap can be installed"
-    install_local test-snapd-base
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-base
     snap list | MATCH test-snapd-base
 
     echo "With test-snapd-base installed we now can install test-snapd-requires-base"
-    install_local test-snapd-requires-base
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-requires-base
     snap list | MATCH test-snapd-requires-base
 
     echo "Ensure the bare base works"
diff -Nru snapd-2.45.1+20.04.2/tests/main/boot-state/task.yaml snapd-2.48.3+20.04/tests/main/boot-state/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/boot-state/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/boot-state/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,78 @@
+summary: smoke test for the boot-state tool
+
+execute: |
+
+    # Check help
+    "$TESTSTOOLS"/boot-state | MATCH "usage: boot-state bootenv"
+    "$TESTSTOOLS"/boot-state -h | MATCH "usage: boot-state bootenv"
+    "$TESTSTOOLS"/boot-state --help | MATCH "usage: boot-state bootenv"
+
+    # check the bootenv command
+    case "$SPREAD_SYSTEM" in
+        ubuntu-core-16-*|ubuntu-core-18-*)
+            # check snap_core and snap_kernel vars are set in bootnev
+            "$TESTSTOOLS"/boot-state bootenv show | MATCH 'snap_core=core.*.snap'
+            "$TESTSTOOLS"/boot-state bootenv show | MATCH 'snap_kernel=.*-kernel_.*.snap'
+            ;;
+        ubuntu-core-20-*)
+            # check kernel_status var is set in bootnev
+            "$TESTSTOOLS"/boot-state bootenv show | MATCH 'kernel_status='
+            ;;
+        *)
+            # check bootnev command can be called
+            "$TESTSTOOLS"/boot-state bootenv show
+            ;; 
+    esac
+
+    # check the get-boot-path command
+    case "$SPREAD_SYSTEM" in
+        ubuntu-core-16-arm-*|ubuntu-core-18-arm-*|ubuntu-core-20-arm-*)
+            "$TESTSTOOLS"/boot-state boot-path | MATCH "/boot/uboot/"
+            ;;
+        fedora-*|opensuse-*|amazon-*|centos-*)
+            "$TESTSTOOLS"/boot-state boot-path | MATCH "/boot/grub2/"
+            ;;
+        *)
+            "$TESTSTOOLS"/boot-state boot-path | MATCH "/boot/grub/"
+            ;;
+    esac
+
+    # check a new var can be set in bootenv
+    "$TESTSTOOLS"/boot-state bootenv show | NOMATCH 'snap_test_1='
+    "$TESTSTOOLS"/boot-state bootenv set snap_test_1 test_1
+    "$TESTSTOOLS"/boot-state bootenv show | MATCH 'snap_test_1=test_1$'
+
+    # check a var can be showed in bootenv
+    "$TESTSTOOLS"/boot-state bootenv set snap_test_2 test_2
+    "$TESTSTOOLS"/boot-state bootenv show snap_test_1 | MATCH 'test_1'
+    "$TESTSTOOLS"/boot-state bootenv show snap_test_1 | NOMATCH 'test_2'
+
+    # check a var can be set even if it is already defined in bootenv
+    "$TESTSTOOLS"/boot-state bootenv set snap_test_1 test_3
+    "$TESTSTOOLS"/boot-state bootenv show snap_test_1 | MATCH 'test_3'
+    test "$("$TESTSTOOLS"/boot-state bootenv show | grep -c snap_test_1)" -eq 1
+
+    # check an existing var can be unset in bootenv
+    "$TESTSTOOLS"/boot-state bootenv unset snap_test_1
+    "$TESTSTOOLS"/boot-state bootenv show | NOMATCH 'snap_test_1='
+    "$TESTSTOOLS"/boot-state bootenv show | MATCH 'snap_test_2=test_2$'
+    "$TESTSTOOLS"/boot-state bootenv unset snap_test_2
+    "$TESTSTOOLS"/boot-state bootenv show | NOMATCH 'snap_test_2='
+
+    # check an inexistent var can be unset in bootenv
+    "$TESTSTOOLS"/boot-state bootenv unset snap_boot_no_exist
+
+    # wait-core-post-boot should finish inmediatly
+    "$TESTSTOOLS"/boot-state wait-core-post-boot
+    # TODO: Test the scenario when the core reaches the timeout running wait-core-post-boot
+
+    # check bootenv needs a subcommand
+    "$TESTSTOOLS"/boot-state bootenv 2>&1 | MATCH "boot-state: unsupported bootenv sub-command"
+    "$TESTSTOOLS"/boot-state bootenv noexist 2>&1 | MATCH "boot-state: unsupported bootenv sub-command noexist"
+
+    # check var and value are needed to call bootenv set
+    "$TESTSTOOLS"/boot-state bootenv set 2>&1 | MATCH "boot-state: variable and value required to set in bootenv"
+    "$TESTSTOOLS"/boot-state bootenv set justvar 2>&1 | MATCH "boot-state: variable and value required to set in bootenv"
+
+    # check var is needed to call bootenv unset
+    "$TESTSTOOLS"/boot-state bootenv unset 2>&1 | MATCH "boot-state: variable required to unset from bootenv"
diff -Nru snapd-2.45.1+20.04.2/tests/main/broken-seeding/task.yaml snapd-2.48.3+20.04/tests/main/broken-seeding/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/broken-seeding/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/broken-seeding/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -58,7 +58,7 @@
     systemctl start snapd.service
 
     echo "Ensure we get a warning message"
-    retry-tool -n 30 sh -c 'snap warnings | MATCH "seeding failed "'
+    retry -n 30 sh -c 'snap warnings | MATCH "seeding failed "'
 
     # the ubuntu postinst will fix broken seeds, see LP: 1868706
     if [[ "$SPREAD_SYSTEM" == ubuntu-* ]]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/canonical-livepatch-14.04/task.yaml snapd-2.48.3+20.04/tests/main/canonical-livepatch-14.04/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/canonical-livepatch-14.04/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/canonical-livepatch-14.04/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,7 @@
     snap install canonical-livepatch
 
     echo "Wait for it to respond"
-    retry-tool -n30 sh -c 'canonical-livepatch status 2>&1 | grep "Machine is not enabled"'
+    retry -n30 sh -c 'canonical-livepatch status 2>&1 | grep "Machine is not enabled"'
 
     echo "And ensure we get the expected status"
     canonical-livepatch status 2>&1 | MATCH "Machine is not enabled"
diff -Nru snapd-2.45.1+20.04.2/tests/main/catalog-update/task.yaml snapd-2.48.3+20.04/tests/main/catalog-update/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/catalog-update/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/catalog-update/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,17 +6,14 @@
     rm -f /var/cache/snapd/sections
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "We count how many catalog refreshes are logged before starting snapd"
-    refreshes_before="$(get_journalctl_log -u snapd | grep -c 'Catalog refresh' || true)"
+    refreshes_before="$("$TESTSTOOLS"/journal-state get-log -u snapd | grep -c 'Catalog refresh' || true)"
 
     systemctl restart snapd.{socket,service}
 
     echo "Ensure that catalog refresh happens on startup"
     for _ in $(seq 60); do
-        refreshes_after="$(get_journalctl_log -u snapd | grep -c 'Catalog refresh' || true)"
+        refreshes_after="$("$TESTSTOOLS"/journal-state get-log -u snapd | grep -c 'Catalog refresh' || true)"
         if [ "$refreshes_after" -gt "$refreshes_before" ]; then
             break
         fi
@@ -27,7 +24,7 @@
     [ "$refreshes_after" -gt "$refreshes_before" ]
 
     echo "Ensure that we don't log all catalog body data"
-    if get_journalctl_log -u snapd | MATCH "Tools for testing the snapd application"; then
+    if "$TESTSTOOLS"/journal-state get-log -u snapd | MATCH "Tools for testing the snapd application"; then
         echo "Catalog update is doing verbose http logging (it should not)."
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-devices/task.yaml snapd-2.48.3+20.04/tests/main/cgroup-devices/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cgroup-devices/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-devices/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: measuring basic properties of device cgroup
 # fedora-31: uses cgroupv2, which we don't support
-systems: [ -fedora-31-*]
+# fedora-32: uses cgroupv2, which we don't support
+systems: [ -fedora-31-*, -fedora-32-*]
 execute: ./task.sh
 restore: |
     rm -f test-snapd-service_1.0_all.snap
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-freezer/task.yaml snapd-2.48.3+20.04/tests/main/cgroup-freezer/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cgroup-freezer/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-freezer/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,15 +1,14 @@
 summary: Each snap process is moved to appropriate freezer cgroup
 # fedora-31: uses cgroupv2, which does not support a separate freezer controller
-systems: [ -fedora-31-*]
+# fedora-32: uses cgroupv2, which does not support a separate freezer controller
+systems: [ -fedora-31-*, -fedora-32-*]
 
 details: |
     This test creates a snap process that suspends itself and ensures that it
     placed into the appropriate hierarchy under the freezer cgroup.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 restore: |
     rmdir /sys/fs/cgroup/freezer/snap.test-snapd-sh || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-pids/task.yaml snapd-2.48.3+20.04/tests/main/cgroup-pids/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cgroup-pids/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-pids/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,86 +0,0 @@
-summary: Each snap app and hook is tracked in a pids cgroup
-# fedora-31: uses cgroupv2, which does not have a separate pids controller hierarchy
-systems: [ -fedora-31-*]
-
-details: |
-    This test creates a snap process that suspends itself and ensures that it
-    placed into the appropriate hierarchy under the pids cgroup.
-
-prepare: |
-    # This feature depends on the release-app-awareness feature
-    snap set core experimental.refresh-app-awareness=true
-
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
-
-restore: |
-    rmdir /sys/fs/cgroup/pids/snap.test-snapd-sh.sh || true
-
-    # TODO: There is currently no way to unset configuration options.
-    # Once this is fixed please uncomment this line:
-    # snap unset core experimental.refresh-app-awareness
-
-execute: |
-    trap 'killall test-snapd-sh || true' EXIT
-    # Start a "sleep" process in the background
-    #shellcheck disable=SC2016
-    test-snapd-sh.sh -c 'touch $SNAP_DATA/1.stamp && exec sleep 1h' &
-    pid1=$!
-    # Ensure that snap-confine has finished its task and that the snap process
-    # is active. Note that we don't want to wait forever either.
-    for _ in $(seq 30); do
-        test -e /var/snap/test-snapd-sh/current/1.stamp && break
-        sleep 0.1
-    done
-    # While the process is alive itselfs PID can be seen in the cgroup.procs file
-    # of the pid controller.
-    MATCH "$pid1" < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs
-
-    # Start a second process so that we can check adding tasks to an existing
-    # control group.
-    #shellcheck disable=SC2016
-    test-snapd-sh.sh -c 'touch $SNAP_DATA/2.stamp && exec sleep 1h' &
-    pid2=$!
-    for _ in $(seq 30); do
-        test -e /var/snap/test-snapd-sh/current/2.stamp && break
-        sleep 0.1
-    done
-    MATCH "$pid2" < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs
-
-    # When the process terminates the control group is updated and the task no
-    # longer registers there.
-    kill "$pid1"
-    wait "$pid1" || true  # wait returns the exit code and we kill the process
-    not MATCH "$pid1" < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs
-
-    kill "$pid2"
-    wait "$pid2" || true  # same as above
-    not MATCH "$pid2" < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs
-
-    # If a snap command forks a child process it is also tracked.
-    #shellcheck disable=SC2016
-    test-snapd-sh.sh -c 'touch $SNAP_DATA/3.stamp && sleep 1h' &
-    pid3=$!
-
-    # Ensure that snap-confine has finished its task and that the snap process
-    # is active. Note that we don't want to wait forever either.
-    for _ in $(seq 30); do
-        test -e /var/snap/test-snapd-sh/current/3.stamp && break
-        sleep 0.1
-    done
-    # While the process is alive its PID can be seen in the cgroup.procs file
-    # of the pid controller.
-    MATCH "$pid3" < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs
-
-    # Because the script above used "sleep 1h" instead of "exec sleep 1h" there
-    # are now two processes: the shell and sleep.
-    test "$(wc -l < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs)" -eq 2
-    kill "$pid3"
-    test "$(wc -l < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs)" -eq 1
-    # Kill the remaining cgroup process.
-    while read -r pid; do
-        kill "$pid"
-    done < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs
-    wait "$pid3" || true  # same as above
-    test "$(wc -l < /sys/fs/cgroup/pids/snap.test-snapd-sh.sh/cgroup.procs)" -eq 0
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/task.yaml snapd-2.48.3+20.04/tests/main/cgroup-tracking/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-tracking/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,173 @@
+summary: Each snap app and hook is tracked via cgroups
+systems:
+    # Ubuntu 14.04's special version of systemd doesn't have StartTransientUnit API.
+    # This is covered in more depth in the sister cgroup-tracking-failure test.
+    - -ubuntu-14.04-*
+
+details: |
+    This test creates a snap process that suspends itself and ensures that it
+    placed into the appropriate hierarchy.
+environment:
+    USER/root: root
+    USER/test: test
+prepare: |
+    tests.cleanup prepare
+
+    # This feature depends on the release-app-awareness feature
+    snap set core experimental.refresh-app-awareness=true
+    tests.cleanup defer snap unset core experimental.refresh-app-awareness
+
+    snap pack test-snapd-tracking
+    tests.cleanup defer rm -f test-snapd-tracking_1_all.snap
+
+    snap install --dangerous ./test-snapd-tracking_1_all.snap
+    tests.cleanup defer snap remove test-snapd-tracking
+
+    tests.session -u "$USER" prepare
+    tests.cleanup defer tests.session -u "$USER" restore
+
+restore: |
+    tests.cleanup restore
+
+    rm -f /tmp/*.pid /tmp/*.stamp
+
+    if [ "$USER" = root ]; then
+        systemctl --user stop dbus.service || true
+    fi
+
+debug: |
+    cat /proc/self/cgroup
+    systemctl --version || true
+    cat /proc/cmdline
+
+execute: |
+    # This test varies between Ubuntu 16.04, Ubuntu 18.04 and Fedora 31.
+    # This combination exercises each of the three cases below, namely:
+    # - pure cgroup v2 system, like Fedora 31
+    # - hybrid cgroup system, like Ubuntu 18.04
+    # - pure cgroup v1 system, like Ubuntu 16.04
+    echo "Find the path and id of the cgroup snapd uses for tracking."
+    if [ "$(stat -f --print=%T /sys/fs/cgroup)" = "cgroup2fs" ]; then
+        base_cg_path=/sys/fs/cgroup
+        base_cg_id=0
+    elif [ "$(stat -f --print=%T /sys/fs/cgroup/unified)" = "cgroup2fs" ]; then
+        base_cg_path=/sys/fs/cgroup/unified
+        base_cg_id=0
+    elif [ "$(stat -f --print=%T /sys/fs/cgroup/systemd)" = "cgroupfs" ]; then
+        base_cg_path=/sys/fs/cgroup/systemd
+        base_cg_id="$(grep -F 'name=systemd' < /proc/self/cgroup | cut -d : -f 1)"
+    else
+        echo "cannot find any tracking cgroup"
+        exit 1
+    fi
+    echo "Sanity check, base directory of selected cgroup exists."
+    test -d "$base_cg_path"
+
+    # The configure hook was executed and used a scope for tracking. The scope
+    # was attached to the system slice, as it is not associated with any user.
+    test -f /var/snap/test-snapd-tracking/common/configure.cgroup
+    hook_tracking_cg_path="$(grep -E "^$base_cg_id:" < /var/snap/test-snapd-tracking/common/configure.cgroup | cut -d : -f 3)"
+    echo "$hook_tracking_cg_path" | MATCH '/system\.slice/snap\.test-snapd-tracking\.hook\.configure\.[0-9a-f-]+\.scope'
+
+    # The nap service was executed and was tracked as a systemd service.
+    test -f /var/snap/test-snapd-tracking/common/nap.cgroup
+    service_tracking_cg_path="$(grep -E "^$base_cg_id:" < /var/snap/test-snapd-tracking/common/nap.cgroup | cut -d : -f 3)"
+    echo "$service_tracking_cg_path" | MATCH '/system\.slice/snap\.test-snapd-tracking\.nap\.service'
+
+    # The application tracking is tested below.
+    if [ "$USER" = test ] && "$TESTSTOOLS"/version-compare --strict "$(systemctl --version | head -n 1 | cut -d ' ' -f 2)" -lt 238; then
+        echo "Systemd running as user session manager cannot start transient units"
+        echo "that cross ownership boundary. This test effectively runs through root"
+        echo "that is using ssh to connect to a test machine. Crossing the boundary"
+        echo "of cgroup ownership is allowed by systemd 238 or newer, thanks to"
+        echo "org.freedesktop.systemd1.Manager.AttachProcessesToUnit method,"
+        echo "offered by systemd running as system manager, which allows"
+        echo "overcoming this kernel limitation".
+        echo "SKIP: systemd is too old to perform this test as user"
+
+        # This effectively can run starting with Ubuntu 19.10, Fedora 30,
+        # Debian 10 (but no version of openSUSE Leap yet) - older versions will
+        # not perform in this unique environment that spread provides for us.
+        # In typical desktop environment going all the way back to 16.04 should
+        # work fine, as far as the intended use-case is concerned.
+
+        exit 0
+    fi
+
+    if [ "$USER" = test ]; then
+        case "$SPREAD_SYSTEM" in
+            # XXX: this may now pass on core18+, verify that.
+            ubuntu-core-*)
+                echo "On core systems there is no session bus so the test variant does not make much sense"
+                echo "Please see the cgroup-tracking-failure test for more extensive analysis"
+                echo "SKIP: core systems don't have session services / session bus"
+                exit 0
+                ;;
+        esac
+    fi
+
+    echo "Start a \"sleep\" process in the background, in a new session"
+    # NOTE: tests.session handles PAM and that necessitates a management process
+    # that eventually performs PAM termination activities. The PID returned from
+    # invoking tests.session in the background will not be that of the invoked program
+    # but rather of the monitoring helper process.
+    tests.session -p /tmp/1.pid -u "$USER" exec snap run test-snapd-tracking.sh -c 'touch /tmp/1.stamp && exec sleep 3m' &
+    session1_pid=$!
+    trap "pkill sleep || true" EXIT
+    echo "Ensure that snap-confine has finished its task and that the snap process"
+    echo "is active. Note that we don't want to wait forever either."
+    retry -n 30 test -e /tmp/snap.test-snapd-tracking/tmp/1.stamp
+    pid1_sleep=$(cat /tmp/1.pid)
+
+    echo "During startup snap-run has asked systemd to move the process to a"
+    echo "new transient scope. The scope name is \"snap.\$random.test-snapd-tracking.sh\"."
+    echo "Let's verify that."
+    pid1_tracking_cg_path="$(grep -E "^$base_cg_id:" < "/proc/$pid1_sleep/cgroup" | cut -d : -f 3)"
+    echo "$pid1_tracking_cg_path" | MATCH '.*/snap\.test-snapd-tracking\.sh\.[0-9a-f-]+\.scope'
+
+    echo "Sanity check, cgroup associated with the scope exists."
+    test -d "${base_cg_path}${pid1_tracking_cg_path}"
+
+    echo "While the process is alive its PID can be seen in the cgroup.procs file."
+    MATCH "$pid1_sleep" < "${base_cg_path}${pid1_tracking_cg_path}/cgroup.procs"
+
+    echo "Start a second process so that we can check each scope is independent."
+    #shellcheck disable=SC2016
+    tests.session -p /tmp/2.pid -u "$USER" exec snap run test-snapd-tracking.sh -c 'touch /tmp/2.stamp && exec sleep 2m' &
+    session2_pid=$!
+    retry -n 30 test -e /tmp/snap.test-snapd-tracking/tmp/2.stamp
+    pid2_sleep=$(cat /tmp/2.pid)
+    pid2_tracking_cg_path="$(grep -E "^$base_cg_id:" < "/proc/$pid2_sleep/cgroup" | cut -d : -f 3)"
+    echo "$pid2_tracking_cg_path" | MATCH '.*/snap\.test-snapd-tracking\.sh\.[0-9a-f-]+\.scope'
+    MATCH "$pid2_sleep" < "${base_cg_path}${pid2_tracking_cg_path}/cgroup.procs"
+
+    echo "Each invocation uses a new transient scope and thus a new cgroup path."
+    test "$pid1_tracking_cg_path" != "$pid2_tracking_cg_path"
+
+    echo "When the process terminates, the control group it used to exist in is"
+    echo "automatically removed by systemd, though perhaps not instantly"
+    kill "$pid1_sleep"
+    wait "$session1_pid" || true  # wait returns the exit code and we kill the process
+    retry -n 10 test ! -e "${base_cg_path}${pid1_tracking_cg_path}"
+
+    kill "$pid2_sleep"
+    wait "$session2_pid" || true  # same as above
+    retry -n 10 test ! -e "${base_cg_path}${pid2_tracking_cg_path}"
+
+    echo "If a snap command forks a child process it is also tracked."
+    #shellcheck disable=SC2016
+    tests.session -p /tmp/3.pid -u "$USER" exec snap run test-snapd-tracking.sh -c 'touch /tmp/3.stamp && sleep 1m' &
+    session3_pid=$!
+    retry -n 30 test -e /tmp/snap.test-snapd-tracking/tmp/3.stamp
+    pid3_sh=$(cat /tmp/3.pid)
+    pid3_tracking_cg_path="$(grep -E "^$base_cg_id:" < "/proc/$pid3_sh/cgroup" | cut -d : -f 3)"
+    MATCH "$pid3_sh" < "${base_cg_path}${pid3_tracking_cg_path}/cgroup.procs"
+
+    echo "Because the script above used \"sleep 1m\" instead of \"exec sleep 1m\" there"
+    echo "are now two processes: the shell and sleep."
+    test "$(wc -l < "${base_cg_path}${pid3_tracking_cg_path}/cgroup.procs")" -eq 2
+    kill "$pid3_sh"
+    test "$(wc -l < "${base_cg_path}${pid3_tracking_cg_path}/cgroup.procs")" -eq 1
+    wait "$session3_pid" || true  # same as above
+
+    retry -n 10 test ! -e "${base_cg_path}${pid3_tracking_cg_path}"
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/bin/nap snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/bin/nap
--- snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/bin/nap	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/bin/nap	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+cat /proc/self/cgroup > "$SNAP_COMMON/nap.cgroup"
+exec sleep infinity
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/bin/sh snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/bin/sh
--- snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/bin/sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/bin/sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+PS1='$ '
+exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/meta/hooks/configure snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/meta/hooks/configure
--- snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/meta/hooks/configure	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/meta/hooks/configure	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec cat /proc/self/cgroup > "$SNAP_COMMON/configure.cgroup"
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/meta/snap.yaml snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/cgroup-tracking/test-snapd-tracking/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-tracking/test-snapd-tracking/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,12 @@
+name: test-snapd-tracking
+summary: A snap tailored for testing application tracking
+version: 1
+
+apps:
+    sh:
+        command: bin/sh
+    nap:
+        command: bin/nap
+        daemon: simple
+hooks:
+    configure:
diff -Nru snapd-2.45.1+20.04.2/tests/main/cgroup-tracking-failure/task.yaml snapd-2.48.3+20.04/tests/main/cgroup-tracking-failure/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cgroup-tracking-failure/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cgroup-tracking-failure/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,194 @@
+summary: cases where tracking applications and hooks with cgroups does not work
+details: |
+    Cgroup-based application process tracking is implemented using the systemd
+    DBus API org.freedesktop.systemd1.Manager.StartTransientUnit. While exactly
+    what we need in spirit, in practice there are limitations that have been
+    overcome only starting with systemd version 238, which can forward a
+    request from systemd --user to systemd pid one, to perform some cgroup
+    transitions that the kernel normally does not allow.
+systems:
+    - ubuntu-14.04-*
+    - ubuntu-16.04-*  # tracking works correctly, caveats apply
+    - ubuntu-18.04-*
+    - ubuntu-20.04-*  # tracking works correctly, for completeness
+    - ubuntu-core-16-*
+    - ubuntu-core-18-*
+    - ubuntu-core-20-*  # tracking works correctly, for completeness
+prepare: |
+    tests.cleanup prepare
+    # This feature depends on the release-app-awareness feature
+    snap set core experimental.refresh-app-awareness=true
+    tests.cleanup defer snap unset core experimental.refresh-app-awareness
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
+    tests.cleanup defer snap remove --purge test-snapd-sh
+restore: |
+    tests.cleanup restore
+    rm -f scenario.txt debug.txt cgroup.txt ps.txt run.txt
+    systemctl --user stop dbus.service || true
+execute: |
+    ## Scenario 1: user is root.
+    # Note that the images we are working with have the dbus-session-bus
+    # package pre-installed. To exercise the case that is similar to real
+    # systems, where snapd does not depend on this package and it is not
+    # pre-installed on standard images, we mask the dbus.socket for the user
+    # session. This is done for Ubuntu 16.04 and 18.04, because only 20.04
+    # started shipping dbus-user-session in all the images.
+    echo "run a snap app as a root user, without session bus" >scenario.txt
+    find /run/user/0 >run.txt
+    case "$SPREAD_SYSTEM" in
+        ubuntu-1[68].04-*)
+            systemctl --user stop dbus.{socket,service}
+            systemctl --user mask dbus.socket
+            SNAPD_DEBUG=1 snap run test-snapd-sh.sh -c 'exec cat /proc/self/cgroup' >cgroup.txt 2>debug.txt
+            systemctl --user unmask dbus.socket || true
+            systemctl --user start dbus.{socket,service}
+            ;;
+        *)
+            SNAPD_DEBUG=1 snap run test-snapd-sh.sh -c 'exec cat /proc/self/cgroup' >cgroup.txt 2>debug.txt
+            ;;
+    esac
+    case "$SPREAD_SYSTEM" in
+        ubuntu-14.04-*)
+            # On Ubuntu 14.04 there is no session bus, there is no systemd
+            # running as pid 1. We fall back to the system bus where we
+            # activate the systemd-shim, which provides various systemd DBus
+            # APIs through non-systemd implementation. The shim does not
+            # implement StartTransientUnit so we give up and carry on.
+            #
+            # Interestingly the deputy systemd does not seem to be connected to
+            # dbus at all.
+            /snap/core/current/usr/bin/busctl --system | MATCH 'org.freedesktop.systemd1 +[0-9]+ systemd-shim +root +:1.[0-9]+ +- +- +-'
+            ps aux | MATCH 'systemd --system'
+            MATCH 'DEBUG: session bus is not available: cannot find session bus' <debug.txt
+            MATCH 'DEBUG: using system bus now, session bus was not available' <debug.txt
+            # NOTE: the dots before and after StartTransientUnit represent single quotes, it's just easier to write this way.
+            MATCH 'DEBUG: StartTransientUnit failed with "org.freedesktop.DBus.Error.UnknownMethod": \[No such method .StartTransientUnit.\]' <debug.txt
+            MATCH 'DEBUG: snapd cannot track the started application' <debug.txt
+
+            # Interestingly there are two name= control groups, one for "systemd"
+            # and one for "dsystemd" (deputy) though it seems that the dsystemd
+            # group is not used.
+            MATCH '1:name=systemd:/user/0.user/1.session' <cgroup.txt
+            MATCH '2:name=dsystemd:/' <cgroup.txt
+            ;;
+        ubuntu-16.04-*)
+            # On Ubuntu 16.04 with systemd 229, without access to the session
+            # bus, we fall back to the system bus.
+            MATCH 'DEBUG: using system bus now, session bus was not available' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/system.slice/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+        ubuntu-18.04-*)
+            # On Ubuntu 18.04 with systemd 237, without access to the session
+            # bus, we fall back to the system bus.
+            MATCH 'DEBUG: using system bus now, session bus was not available' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/system.slice/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+        ubuntu-20.04-*)
+            # On Ubuntu 20.04 with systemd 245 everything works correctly.
+            # Note that on this system we no longer test the variant without
+            # session bus, as that is not considered a customization anymore.
+            MATCH 'DEBUG: using session bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/user.slice/user-0.slice/user@0.service/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+        ubuntu-core-16-*)
+            # On Ubuntu Core 16.04 with systemd 229 there is no session bus so we
+            # use the system bus. The request succeeds and works correctly.
+            MATCH 'DEBUG: session bus is not available: cannot find session bus' <debug.txt
+            MATCH 'DEBUG: falling back to system bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/system.slice/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+        ubuntu-core-18-*)
+            # On Ubuntu Core 18 behaves exactly the same as Ubuntu Core 16.
+            MATCH 'DEBUG: session bus is not available: cannot find session bus' <debug.txt
+            MATCH 'DEBUG: falling back to system bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/system.slice/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+        ubuntu-core-20-*)
+            # On Ubuntu Core 20 everything is correct.
+            MATCH 'DEBUG: using session bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/user.slice/user-0.slice/user@0.service/snap.test-snapd.sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+    esac
+
+    # Notably we still use the freezer control group. It can be used on all
+    # v1 systems to locate snaps, although it doesn't have the granularity
+    # required to identify particular applications.
+    MATCH '[0-9]+:freezer:/snap.test-snapd-sh' <cgroup.txt
+
+    if [ "$(command -v busctl)" == "" ]; then
+        # The remainder of the test relies on tests.session which requires
+        # busctl. This effectively cuts 14.04 support.
+        exit 0
+    fi
+
+    # The remaining tests require a dbus session bus. On Ubuntu Core systems
+    # that is available starting with Core 20 so bail out of the remainder of
+    # the test on those systems.
+    if [ ! -e /usr/lib/systemd/user/dbus.socket ] &&  [ -d /writable ]; then
+        case "$SPREAD_SYSTEM" in
+            ubuntu-core-1[68]-*)
+                exit 0
+                ;;
+        esac
+    fi
+
+    ## Scenario 2: user is root.
+    echo "run a snap app as a root user, with session bus" >scenario.txt
+    tests.session -u root prepare
+    test -S /run/user/0/bus
+    SNAPD_DEBUG=1 tests.session -u root exec snap run test-snapd-sh.sh -c 'exec cat /proc/self/cgroup' >cgroup.txt 2>debug.txt
+    tests.session -u root restore
+    MATCH 'DEBUG: using session bus' <debug.txt
+    MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+    MATCH '1:name=systemd:/user.slice/user-0.slice/user@0.service/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+
+    ## Scenario 3: user is non-root, dbus user session is installed
+    echo "run a snap app as a test user, having the session bus installed" >scenario.txt
+    tests.session -u test prepare
+    find /run/user/12345 >run.txt
+    ps -u test >ps.txt
+    test "$(wc -l <ps.txt)" -gt 1
+    test -S /run/user/12345/bus
+    SNAPD_DEBUG=1 tests.session -u test exec snap run test-snapd-sh.sh -c 'exec cat /proc/self/cgroup' >cgroup.txt 2>debug.txt
+    tests.session -u test restore
+    case "$SPREAD_SYSTEM" in
+        ubuntu-16.04-*)
+            # There is a session bus, we activate systemd --user and everything
+            # works.
+            MATCH 'DEBUG: using session bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/user.slice/user-12345.slice/user@12345.service/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+        ubuntu-18.04-*)
+            # There is a session bus, there is systemd --user but it doesn't
+            # implement the workaround for kernel cgroup transition policy so
+            # we don't get tracking.
+            MATCH 'DEBUG: using session bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH 'DEBUG: systemd could not associate process [0-9]+ with transient scope snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <debug.txt
+            MATCH 'DEBUG: snapd cannot track the started application' <debug.txt
+            MATCH '1:name=systemd:/user.slice/user-12345.slice/session-c[0-9]+.scope' <cgroup.txt
+            ;;
+        ubuntu-20.04-*)
+            # There is a session bus, there is systemd --user and it performs
+            # the cgroup transition with the help of systemd --system.
+            MATCH 'DEBUG: using session bus' <debug.txt
+            MATCH 'DEBUG: created transient scope as object: /org/freedesktop/systemd1/job/[0-9]+' <debug.txt
+            MATCH '1:name=systemd:/user.slice/user-12345.slice/user@12345.service/snap.test-snapd-sh.sh.[0-9a-f-]+.scope' <cgroup.txt
+            ;;
+    esac
+
+debug: |
+    set +e  # any of the files below may not exist and this causes the command to be indicated as failure
+    test -e scenario.txt && cat scenario.txt
+    test -e run.txt && cat run.txt
+    test -e debug.txt && head -n 10 debug.txt
+    test -e cgroup.txt && cat cgroup.txt
+    test -e ps.txt && cat ps.txt
+    set -e
diff -Nru snapd-2.45.1+20.04.2/tests/main/classic-confinement-not-supported/task.yaml snapd-2.48.3+20.04/tests/main/classic-confinement-not-supported/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/classic-confinement-not-supported/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/classic-confinement-not-supported/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -12,9 +12,6 @@
     snap pack "$TESTSLIB/snaps/$CLASSIC_SNAP/"
 
 execute: |
-    #shellcheck source=tests/lib/strings.sh
-    . "$TESTSLIB"/strings.sh
-
     echo "Check that classic snaps work only with --classic"
     if snap install --dangerous "${CLASSIC_SNAP}_1.0_all.snap"; then
         echo "snap install needs --classic to install local snaps with classic confinment"
@@ -31,10 +28,10 @@
     if [[ "$SPREAD_SYSTEM" = fedora-* ]]; then
         EXPECTED_TEXT="classic confinement requires snaps under /snap or symlink from /snap to /var/lib/snapd/snap"
     fi
-    str_to_one_line "$( snap install --dangerous --classic "${CLASSIC_SNAP}_1.0_all.snap" 2>&1 )" | MATCH "$EXPECTED_TEXT"
+    "$TESTSTOOLS"/to-one-line "$( snap install --dangerous --classic "${CLASSIC_SNAP}_1.0_all.snap" 2>&1 )" | MATCH "$EXPECTED_TEXT"
 
     echo "Not from the store either"
     if [[ "$SPREAD_SYSTEM" = fedora-* ]]; then
         EXPECTED_TEXT="cannot install \"$CLASSIC_SNAP\": classic confinement requires snaps under /snap or symlink from /snap to /var/lib/snapd/snap"
     fi
-    str_to_one_line "$( snap install --classic "$CLASSIC_SNAP" 2>&1 )" | MATCH "$EXPECTED_TEXT"
+    "$TESTSTOOLS"/to-one-line "$( snap install --classic "$CLASSIC_SNAP" 2>&1 )" | MATCH "$EXPECTED_TEXT"
diff -Nru snapd-2.45.1+20.04.2/tests/main/classic-custom-device-reg/task.yaml snapd-2.48.3+20.04/tests/main/classic-custom-device-reg/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/classic-custom-device-reg/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/classic-custom-device-reg/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,8 @@
 summary: |
     Test gadget customized device initialisation and registration also on classic
 
-systems: [-ubuntu-core-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -ubuntu-14.04*]
 
 environment:
     SEED_DIR: /var/lib/snapd/seed
@@ -13,8 +14,6 @@
         echo "This test needs test keys to be trusted"
         exit
     fi
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
 
     snap pack "$TESTSLIB/snaps/classic-gadget"
     snap download "--$CORE_CHANNEL" core
@@ -41,18 +40,17 @@
     echo "Copy the needed snaps to $SEED_DIR/snaps"
     cp ./core_*.snap "$SEED_DIR/snaps/core.snap"
     cp ./classic-gadget_1.0_all.snap "$SEED_DIR/snaps/classic-gadget.snap"
+
     # start fake device svc
-    systemd_create_and_start_unit fakedevicesvc "$(command -v fakedevicesvc) localhost:11029"
+    #shellcheck disable=SC2148
+    systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-    systemctl stop snapd.service snapd.socket
-    systemd_stop_and_destroy_unit fakedevicesvc
+    systemctl stop snapd.service snapd.socket fakedevicesvc
 
     rm -rf "$SEED_DIR"
     rm -f -- *.snap
diff -Nru snapd-2.45.1+20.04.2/tests/main/classic-firstboot/task.yaml snapd-2.48.3+20.04/tests/main/classic-firstboot/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/classic-firstboot/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/classic-firstboot/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -90,7 +90,7 @@
     # sanity check
     snap change 1 | MATCH "Mark system seeded"
     snap change 1 | MATCH "restart of .*test-snapd-service.test-snapd-other-service"
-    snap install jq
+    snap install --edge jq
     # extract task ids from state
     # XXX: snap change output cannot be used for that; ideally we would have some sort of 'snap debug ..' command.
     MARKSEEDED_WAIT=$(jq -r '.tasks[] | select (.kind == "mark-seeded") | ."wait-tasks"' < /var/lib/snapd/state.json)
diff -Nru snapd-2.45.1+20.04.2/tests/main/classic-prepare-image/task.yaml snapd-2.48.3+20.04/tests/main/classic-prepare-image/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/classic-prepare-image/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/classic-prepare-image/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Check that prepare-image --classic works.
 
-systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*, -ubuntu-14.04*]
 
 backends: [-autopkgtest]
 
@@ -40,18 +41,15 @@
     cp -ar "$ROOT/$SEED_DIR" "$SEED_DIR"
 
     # start fake device svc
-    systemd_create_and_start_unit fakedevicesvc "$(command -v fakedevicesvc) localhost:11029"
+    #shellcheck disable=SC2148
+    systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-    systemctl stop snapd.service snapd.socket
-    systemd_stop_and_destroy_unit fakedevicesvc
+    systemctl stop snapd.service snapd.socket fakedevicesvc
 
     rm -rf "$SEED_DIR"
     systemctl start snapd.socket snapd.service
@@ -90,3 +88,9 @@
     test -f "$SEED_DIR/snaps/basic_"*.snap
     snap list | MATCH "^classic-gadget"
     test -f "$SEED_DIR/snaps/classic-gadget_"*.snap
+
+    # test regression
+    if journalctl -u snapd | MATCH "missing file /snap/classic-gadget/unset/meta/snap.yaml"; then
+         echo "snapd is still reading the gadget too early"
+         exit 1
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/classic-prepare-image-no-core/task.yaml snapd-2.48.3+20.04/tests/main/classic-prepare-image-no-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/classic-prepare-image-no-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/classic-prepare-image-no-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Check that prepare-image --classic works.
 
-systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*, -ubuntu-14.04*]
 
 backends: [-autopkgtest]
 
@@ -40,18 +41,15 @@
     cp -ar "$ROOT/$SEED_DIR" "$SEED_DIR"
 
     # start fake device svc
-    systemd_create_and_start_unit fakedevicesvc "$(command -v fakedevicesvc) localhost:11029"
+    #shellcheck disable=SC2148
+    systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
     fi
-
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-    systemctl stop snapd.service snapd.socket
-    systemd_stop_and_destroy_unit fakedevicesvc
+    systemctl stop snapd.service snapd.socket fakedevicesvc
 
     rm -rf "$SEED_DIR"
     systemctl start snapd.socket snapd.service
diff -Nru snapd-2.45.1+20.04.2/tests/main/cloud-init/task.yaml snapd-2.48.3+20.04/tests/main/cloud-init/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cloud-init/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cloud-init/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -75,3 +75,15 @@
     cloud_region=$(get_conf region)
     snap_cloud_region=$(snap get core cloud.region)
     test "$cloud_region" = "$snap_cloud_region"
+
+    # if we are on UC16 / UC18, then also check that we wrote out a restricting
+    # cloud-init file
+    # TODO:UC20: adapt for UC20 when cloud-init is supported on UC20
+    if [[ "$SPREAD_SYSTEM" == ubuntu-core-1* ]]; then
+        # TODO: is there a race here with snapd restricting cloud-init and us
+        # checking that it was restricted?
+        echo "Test that cloud-init restrict file was written"
+        test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg
+        echo "Test that cloud-init restrict file does NOT have manual_cache_clean set"
+        NOMATCH "manual_cache_clean: true" < /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/cohorts/task.yaml snapd-2.48.3+20.04/tests/main/cohorts/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cohorts/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cohorts/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,13 +1,19 @@
 summary: Check that cohorts work
 
 prepare: |
-    snap install yq
-    snap connect yq:home
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
+
+debug: |
+    cat coh.yml || true
 
 execute: |
     echo "Test we can create chorts:"
     snap create-cohort test-snapd-tools > coh.yml
-    COHORT=$( yq r coh.yml cohorts.test-snapd-tools.cohort-key )
+    # the YAML looks like this:
+    # cohorts:
+    #   test-snapd-tools:
+    #     cohort-key: <key>
+    COHORT=$(test-snapd-sh.cmd python3 -c 'import sys, yaml; print(yaml.safe_load(sys.stdin)["cohorts"]["test-snapd-tools"]["cohort-key"])' < coh.yml)
     test -n "$COHORT"
 
     echo "Test we can install from there:"
diff -Nru snapd-2.45.1+20.04.2/tests/main/configure-hook-with-network-control/task.yaml snapd-2.48.3+20.04/tests/main/configure-hook-with-network-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/configure-hook-with-network-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/configure-hook-with-network-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,11 +4,8 @@
     Test for https://forum.snapcraft.io/t/9452
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install test snap with configure hook and network-control"
-    install_local test-snapd-with-configure-nc
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-with-configure-nc
 
     echo "Ensure configure was run fully"
     test -e /var/snap/test-snapd-with-configure-nc/common/configure-ran
diff -Nru snapd-2.45.1+20.04.2/tests/main/config-versions/task.yaml snapd-2.48.3+20.04/tests/main/config-versions/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/config-versions/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/config-versions/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,11 +16,8 @@
       fi
     }
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install test snap"
-    install_local config-versions
+    "$TESTSTOOLS"/snaps-state install-local config-versions
 
     # sanity
     snap get config-versions configure-marker | MATCH "executed-for-v1"
@@ -29,7 +26,7 @@
     snap set config-versions value=100
 
     echo "Install a new version of the test snap"
-    install_local config-versions-v2
+    "$TESTSTOOLS"/snaps-state install-local config-versions-v2
 
     # sanity
     snap get config-versions configure-marker | MATCH "executed-for-v2"
diff -Nru snapd-2.45.1+20.04.2/tests/main/connect-undo/task.yaml snapd-2.48.3+20.04/tests/main/connect-undo/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/connect-undo/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/connect-undo/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,47 @@
+summary: Test connect hook failures
+
+details: |
+  Test that failures of connect hook are handled gracefully and do not leave
+  snapd or snap in a broken state.
+
+# this test is sensitive to the version of netcat and needs strict confinement
+systems: [ubuntu-*]
+
+prepare: |
+    snap pack test-connect.v1
+    snap pack test-connect.v2
+
+execute: |
+    #shellcheck source=tests/lib/snaps.sh
+    . "$TESTSLIB/snaps.sh"
+
+    echo "Installing a revision with broken connect hook fails"
+    snap install --dangerous test-connect_2_all.snap 2>&1 | MATCH 'failure of connect hook'
+    snap list | not MATCH test-connect
+
+    echo "Installing a revision with no hook"
+    snap install --dangerous test-connect_1_all.snap
+
+    echo "Then the snap is able to use netcat"
+    test-connect.network-consumer
+
+    echo "Installing the broken revision without triggering connect hook"
+    # this works because an older revision was installed and we don't re-connect
+    # existing connections.
+    snap install --dangerous test-connect_2_all.snap
+
+    snap disconnect test-connect:network
+
+    echo "Then the snap is not able to use netcat with disconnected network"
+    test-connect.network-consumer 2>&1 | MATCH "nc: Permission denied"
+
+    echo "Triggering connect hook"
+    # this fails because of connect hook
+    snap connect test-connect:network 2>&1 | MATCH 'failure of connect hook'
+
+    echo "And the snap is still not able to use netcat"
+    test-connect.network-consumer 2>&1 | MATCH "nc: Permission denied"
+
+    echo "Removing the test snap"
+    snap remove test-connect
+
diff -Nru snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v1/bin/consumer snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v1/bin/consumer
--- snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v1/bin/consumer	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v1/bin/consumer	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec nc -h > /dev/null
diff -Nru snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v1/meta/snap.yaml snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v1/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v1/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v1/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+name: test-connect
+version: 1
+summary: Basic snap with a connect hook
+
+plugs:
+  network:
+
+apps:
+  network-consumer:
+    command: bin/consumer
diff -Nru snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v2/bin/consumer snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v2/bin/consumer
--- snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v2/bin/consumer	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v2/bin/consumer	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec nc -h > /dev/null
diff -Nru snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v2/meta/hooks/connect-plug-network snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v2/meta/hooks/connect-plug-network
--- snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v2/meta/hooks/connect-plug-network	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v2/meta/hooks/connect-plug-network	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "failure of connect hook"
+exit 1
diff -Nru snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v2/meta/snap.yaml snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v2/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/connect-undo/test-connect.v2/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/connect-undo/test-connect.v2/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+name: test-connect
+version: 2
+summary: Basic snap with a connect hook
+
+plugs:
+  network:
+
+apps:
+  network-consumer:
+    command: bin/consumer
diff -Nru snapd-2.45.1+20.04.2/tests/main/core16-base/task.yaml snapd-2.48.3+20.04/tests/main/core16-base/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core16-base/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core16-base/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,7 +5,5 @@
     snap install --edge core16
 
     echo "Ensure core16 is usable"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh-core16
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh-core16
     test-snapd-sh-core16.sh -c "echo hello" | MATCH hello
diff -Nru snapd-2.45.1+20.04.2/tests/main/core16-provided-by-core/task.yaml snapd-2.48.3+20.04/tests/main/core16-provided-by-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core16-provided-by-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core16-provided-by-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -20,9 +20,7 @@
         exit 1
     fi
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh-core16
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh-core16
 
     echo "and core16 was not pulled in"
     not snap list core16
diff -Nru snapd-2.45.1+20.04.2/tests/main/core18-configure-hook/task.yaml snapd-2.48.3+20.04/tests/main/core18-configure-hook/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core18-configure-hook/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core18-configure-hook/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,10 +6,8 @@
     echo "Ensure empty state"
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB/systemd.sh"
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
     echo "Ensure all snaps are gone"
-    $LIBEXECDIR/snapd/snap-mgmt --purge
+    snapd.tool exec snap-mgmt --purge
 
     systemd_stop_units snapd.service
     rm -f /var/lib/snapd/state.json
@@ -17,11 +15,8 @@
     snap wait system seed.loaded
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install test snap"
-    install_local test-snapd-with-configure-core18
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-with-configure-core18
 
     snap list | MATCH core18
     if snap list | grep -E -q "^core "; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/core18-with-hooks/task.yaml snapd-2.48.3+20.04/tests/main/core18-with-hooks/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core18-with-hooks/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core18-with-hooks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     # FIXME: we need at least beta of core18 for this to work
     snap install --beta core18
   
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-snapctl-core18
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-snapctl-core18
 
     journalctl -u test-snapd-snapctl-core18.service
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/core-backlight/task.yaml snapd-2.48.3+20.04/tests/main/core-backlight/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core-backlight/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core-backlight/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,23 +0,0 @@
-summary: Test system.disable-backlight-service core config option
-
-systems: [ubuntu-core-*]
-
-environment:
-    MASKFILE: /etc/systemd/system/systemd-backlight@.service
-
-execute: |
-    echo "Backlight is not masked by default"
-    systemctl status systemd-backlight@foo | MATCH "Loaded: loaded"
-
-    echo "Check that backlight service can be disabled"
-    snap set core system.disable-backlight-service=true
-
-    systemctl status systemd-backlight@foo | MATCH "Loaded: masked"
-    test -L "$MASKFILE"
-    [ "$(readlink $MASKFILE)" = "/dev/null" ]
-        
-    echo "Check that backlight service can be enabled"
-    snap set core system.disable-backlight-service=false
-
-    systemctl status systemd-backlight@foo | MATCH "Loaded: loaded"
-    not test -e "$MASKFILE"
diff -Nru snapd-2.45.1+20.04.2/tests/main/core-persistent-journal/task.yaml snapd-2.48.3+20.04/tests/main/core-persistent-journal/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core-persistent-journal/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core-persistent-journal/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,44 +0,0 @@
-summary: Test journal.persistent core config option
-
-systems: [ubuntu-core-*]
-
-restore: |
-    # disable persistent journal
-    rm -rf /var/log/journal
-    systemctl kill --signal=SIGUSR1 systemd-journald
-
-execute: |
-    echo "Wait for first boot to be done"
-    snap wait system seed.loaded
-
-    echo "Sanity check, persistent journal is not available by default"
-    not test -e /var/log/journal
-
-    echo "Check that persistent journal can be enabled"
-    snap set core journal.persistent=true
-    test -e /var/log/journal/
-    test -e /var/log/journal/.snapd-created
-
-    # on core16 journald is not reloaded, so changes are not visible until
-    # rebooted.
-    if [[ ! "$SPREAD_SYSTEM" = ubuntu-core-16-* ]]; then
-        # this check relies on *anything* getting logged; enabling persistent
-        # journal writes an entry about journal size, which should be sufficient.
-        MACHINE_ID=$(cat /etc/machine-id)
-        retry-tool -n30 --wait 1 test -e "/var/log/journal/$MACHINE_ID"
-    fi
-
-    echo "Check that persistent journal can be disabled"
-    snap set core journal.persistent=false
-    not test -e /var/log/journal
-
-    echo "Check that journal log is not removed if managed manually"
-    mkdir /var/log/journal
-    snap set core journal.persistent=true
-    not test -e /var/log/journal/.snapd-created
-
-    # NOTE: Since this is failing early, before we do anything to the journal, there is no need to use retry-tool.
-    snap set core journal.persistent=false 2>&1 | MATCH "the /var/log/journal directory was not created by snapd"
-    # the journal dir was not removed
-    test -e /var/log/journal/
-    not test -e /var/log/journal/.snapd-created
diff -Nru snapd-2.45.1+20.04.2/tests/main/core-snap-refresh/task.yaml snapd-2.48.3+20.04/tests/main/core-snap-refresh/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/core-snap-refresh/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/core-snap-refresh/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,9 +11,6 @@
     #shellcheck source=tests/lib/boot.sh
     . "$TESTSLIB"/boot.sh
 
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$SPREAD_REBOOT" = 0 ]; then
         # save current core revision
         snap list | awk "/^core / {print(\$3)}" > prevBoot
@@ -24,7 +21,7 @@
         # check boot env vars
         snap list | awk "/^core / {print(\$3)}" > nextBoot
 
-        if is_core_system; then
+        if os.query is-core; then
             test "$(bootenv snap_core)" = "core_$(cat prevBoot).snap"
             test "$(bootenv snap_try_core)" = "core_$(cat nextBoot).snap"
         fi
@@ -41,7 +38,7 @@
         sleep 1
     done
 
-    if is_core_system; then
+    if os.query is-core; then
         test "$(bootenv snap_core)" = "core_$(cat nextBoot).snap"
         test "$(bootenv snap_try_core)" = ""
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/cwd/task.yaml snapd-2.48.3+20.04/tests/main/cwd/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/cwd/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/cwd/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,9 +6,7 @@
     to the view inside the mount namespace. If the directory does not exist the
     special fallback /var/lib/snapd/void is used.
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 restore: |
     snap remove --purge test-snapd-sh
     rmdir /tmp/test || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/default-tracks/task.yaml snapd-2.48.3+20.04/tests/main/default-tracks/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/default-tracks/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/default-tracks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -23,7 +23,9 @@
 
     test "$( snap run  jq -r ".data.snaps.\"$A_SNAP\".channel" < /var/lib/snapd/state.json )" = "$A_TRACK/candidate"
 
-    snap remove --purge "$A_SNAP" http jq
+    snap remove --purge "$A_SNAP"
+    snap remove --purge http
+    snap remove --purge jq
 
     # now try a multi-install
     snap install "$A_SNAP" "jq"
diff -Nru snapd-2.45.1+20.04.2/tests/main/degraded/task.yaml snapd-2.48.3+20.04/tests/main/degraded/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/degraded/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/degraded/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,5 @@
 summary: Check that the system is not in "degraded" state
 
-# TODO:UC20: e2scrub_reap.service is failing on uc20 as of 20200109, enable
-#            once foundations fixes it
-systems: [-ubuntu-core-20-*]
-
 # run this early to ensure no test created failed units yet
 priority: 500
 
@@ -22,6 +18,13 @@
     . "$TESTSLIB"/systemd.sh
     wait_for_service "multi-user.target"
 
+    case "$SPREAD_SYSTEM" in
+        opensuse-tumbleweed-*)
+            systemctl mask systemd-vconsole-setup.service
+            systemctl reset-failed systemd-vconsole-setup.service
+            ;;
+    esac
+
     if systemctl status | grep "State: [d]egraded"; then
         echo "systemctl reports the system is in degraded mode"
         # add debug output
diff -Nru snapd-2.45.1+20.04.2/tests/main/desktop-portal-filechooser/task.yaml snapd-2.48.3+20.04/tests/main/desktop-portal-filechooser/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/desktop-portal-filechooser/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/desktop-portal-filechooser/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,15 +16,16 @@
 # Only enable the test on systems we know portals to function on.
 # Expand as needed.
 # ubuntu-18.04-*: Ships xdg-desktop-portal 0.11
-# ubuntu-19.10-*: Ships xdg-desktop-portal 1.2.0
-systems: [ubuntu-18.04-*, ubuntu-19.10-*, ubuntu-20.04-*]
+systems: [ubuntu-18.04-*, ubuntu-2*]
 
 prepare: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     setup_portals
+    tests.session -u test prepare
 
 restore: |
+    tests.session -u test restore
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     teardown_portals
@@ -32,9 +33,6 @@
     rm -f /tmp/file-to-write.txt
 
 execute: |
-    #shellcheck source=tests/lib/desktop-portal.sh
-    . "$TESTSLIB"/desktop-portal.sh
-
     echo "Install the portals test client"
     snap install --edge test-snapd-portal-client
 
@@ -43,7 +41,7 @@
     # file ownership is exposed through the document portal, and our
     # AppArmor policy uses the @owner restriction.
     chown test:test /tmp/file-to-read.txt
-    as_user test-snapd-portal-client open-file | MATCH "from-host-system"
+    tests.session -u test exec test-snapd-portal-client open-file | MATCH "from-host-system"
 
     echo "The confined application can write files via the portal"
     [ ! -f /tmp/file-to-write.txt ]
@@ -58,7 +56,7 @@
     touch /tmp/file-to-write.txt
     chown test:test /tmp/file-to-write.txt
 
-    as_user test-snapd-portal-client save-file "from-sandbox"
+    tests.session -u test exec test-snapd-portal-client save-file "from-sandbox"
 
     # TODO: another workaround for testing on 18.04
     # Retry checking until the file contains the written text. In particular on
@@ -68,13 +66,13 @@
     # backing file. It was observed that, even after client does close and the
     # corresponding *fuse_release() code completes on the portal side, the
     # contents are not visible in the destination file.
-    retry-tool -n 5 test -s /tmp/file-to-write.txt
+    retry -n 5 test -s /tmp/file-to-write.txt
     MATCH "from-sandbox" < /tmp/file-to-write.txt
 
 debug: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
 
-    ls -la "/run/user/$TEST_UID/" || true
+    ls -la "/run/user/$(id -u test)" || true
     #shellcheck disable=SC2009
     ps -ef | grep xdg || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/desktop-portal-open-file/task.yaml snapd-2.48.3+20.04/tests/main/desktop-portal-open-file/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/desktop-portal-open-file/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/desktop-portal-open-file/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,7 +9,7 @@
 
 # Only enable the test on systems we know portals to function on.
 # Expand as needed.
-systems: [ubuntu-18.04-*, ubuntu-19.10-*, ubuntu-20.04-*]
+systems: [ubuntu-18.04-*, ubuntu-2*]
 
 environment:
     EDITOR_HISTORY: /tmp/editor-history.txt
@@ -18,23 +18,26 @@
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     setup_portals
+    tests.session -u test prepare
 
     # Configure fake web browser
-    mkdir -p ~test/.local/share/applications
-    cat << EOF > ~test/.local/share/applications/test-editor.desktop
+    tests.session -u test exec mkdir -p ~test/.local/share/applications
+    tests.session -u test exec sh -c 'cat > ~test/.local/share/applications/test-editor.desktop' << EOF
     [Desktop Entry]
     Type=Application
     Name=Test Editor
     Exec=$(pwd)/editor.sh %f $EDITOR_HISTORY
     MimeType=text/plain;
     EOF
-    mkdir -p ~test/.config
-    cat << EOF > ~test/.config/mimeapps.list
+
+    tests.session -u test exec mkdir -p ~test/.config
+    tests.session -u test exec sh -c 'cat > ~test/.config/mimeapps.list' << EOF
     [Default Applications]
     text/plain=test-editor.desktop
     EOF
 
 restore: |
+    tests.session -u test restore
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     teardown_portals
@@ -44,11 +47,6 @@
     rm -f "$EDITOR_HISTORY"
 
 execute: |
-    #shellcheck source=tests/lib/desktop-portal.sh
-    . "$TESTSLIB"/desktop-portal.sh
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
-
     echo "Install the portals test client"
     snap install --edge test-snapd-portal-client
 
@@ -60,16 +58,16 @@
     chown -R test:test ~test/snap
 
     echo "The confined application can open URLs in the default browser"
-    as_user test-snapd-portal-client launch-file "$testfile"
+    tests.session -u test exec test-snapd-portal-client launch-file "$testfile"
 
     echo "The test-browser process was invoked with the URL"
-    wait_for_file "$EDITOR_HISTORY" 4 .5
+    retry -n 4 --wait 0.5 test -e "$EDITOR_HISTORY"
     MATCH "$testfile" < "$EDITOR_HISTORY"
 
 debug: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
 
-    ls -la "/run/user/$TEST_UID/" || true
+    ls -la "/run/user/$(id -u test)" || true
     #shellcheck disable=SC2009
     ps -ef | grep xdg || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/desktop-portal-open-uri/task.yaml snapd-2.48.3+20.04/tests/main/desktop-portal-open-uri/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/desktop-portal-open-uri/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/desktop-portal-open-uri/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,7 +6,7 @@
 
 # Only enable the test on systems we know portals to function on.
 # Expand as needed.
-systems: [ubuntu-18.04-*, ubuntu-19.10-*, ubuntu-20.04-*]
+systems: [ubuntu-18.04-*, ubuntu-2*]
 
 environment:
     BROWSER_HISTORY: /tmp/browser-history.txt
@@ -15,23 +15,26 @@
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     setup_portals
+    tests.session -u test prepare
 
     # Configure fake web browser
-    mkdir -p ~test/.local/share/applications
-    cat << EOF > ~test/.local/share/applications/test-browser.desktop
+    tests.session -u test exec mkdir -p ~test/.local/share/applications
+    tests.session -u test exec sh -c 'cat > ~test/.local/share/applications/test-browser.desktop' << EOF
     [Desktop Entry]
     Type=Application
     Name=Test Web Browser
     Exec=$(pwd)/web-browser.sh %u $BROWSER_HISTORY
     MimeType=x-scheme-handler/http;
     EOF
-    mkdir -p ~test/.config
-    cat << EOF > ~test/.config/mimeapps.list
+
+    tests.session -u test exec mkdir -p ~test/.config
+    tests.session -u test exec sh -c 'cat  > ~test/.config/mimeapps.list' << EOF
     [Default Applications]
     x-scheme-handler/http=test-browser.desktop
     EOF
 
 restore: |
+    tests.session -u test restore
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     teardown_portals
@@ -41,25 +44,20 @@
     rm -f "$BROWSER_HISTORY"
 
 execute: |
-    #shellcheck source=tests/lib/desktop-portal.sh
-    . "$TESTSLIB"/desktop-portal.sh
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
-
     echo "Install the portals test client"
     snap install --edge test-snapd-portal-client
 
     echo "The confined application can open URLs in the default browser"
-    as_user test-snapd-portal-client open-uri http://www.example.org
+    tests.session -u test exec test-snapd-portal-client open-uri http://www.example.org
 
     echo "The test-browser process was invoked with the URL"
-    wait_for_file "$BROWSER_HISTORY" 4 .5
+    retry -n 4 --wait 0.5 test -e "$BROWSER_HISTORY"
     MATCH http://www.example.org < "$BROWSER_HISTORY"
 
 debug: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
 
-    ls -la "/run/user/$TEST_UID/" || true
+    ls -la "/run/user/$(id -u test)" || true
     #shellcheck disable=SC2009
     ps -ef | grep xdg || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/desktop-portal-screenshot/task.yaml snapd-2.48.3+20.04/tests/main/desktop-portal-screenshot/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/desktop-portal-screenshot/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/desktop-portal-screenshot/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -20,23 +20,22 @@
 
 # Only enable the test on systems we know portals to function on.
 # Expand as needed.
-systems: [ubuntu-18.04-*, ubuntu-19.10-*, ubuntu-20.04-*]
+systems: [ubuntu-18.04-*, ubuntu-2*]
 
 prepare: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     setup_portals
+    tests.session -u test prepare
 
 restore: |
+    tests.session -u test restore
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     teardown_portals
     rm -f /tmp/screenshot.txt
 
 execute: |
-    #shellcheck source=tests/lib/desktop-portal.sh
-    . "$TESTSLIB"/desktop-portal.sh
-
     echo "Install the portals test client"
     snap install --edge test-snapd-portal-client
 
@@ -46,12 +45,12 @@
     # file ownership is exposed through the document portal, and our
     # AppArmor policy uses the @owner restriction.
     chown test:test /tmp/screenshot.txt
-    as_user test-snapd-portal-client screenshot | MATCH "my screenshot"
+    tests.session -u test exec test-snapd-portal-client screenshot | MATCH "my screenshot"
 
 debug: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
 
-    ls -la "/run/user/$TEST_UID/" || true
+    ls -la "/run/user/$(id -u test)" || true
     #shellcheck disable=SC2009
     ps -ef | grep xdg || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/dirs-not-shared-with-host/task.yaml snapd-2.48.3+20.04/tests/main/dirs-not-shared-with-host/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/dirs-not-shared-with-host/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/dirs-not-shared-with-host/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,9 +15,7 @@
 
 prepare: |
     echo "Having installed the test snap"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/disconnect-undo/task.yaml snapd-2.48.3+20.04/tests/main/disconnect-undo/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/disconnect-undo/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/disconnect-undo/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,33 @@
+summary: Test disconnect hook failure
+
+details: |
+  Test that failures of disconnect hook are handled gracefully and plug
+  remains connected.
+
+prepare: |
+  "$TESTSTOOLS"/snaps-state install-local test-disconnect
+
+restore: |
+  rm -f /var/snap/test-disconnect/common/do-not-fail
+
+execute: |
+  # sanity check, network is connected automatically
+  snap connections | MATCH "test-disconnect:network .*:network"
+
+  echo "Disconnect fails due to failing disconnect hook"
+  snap disconnect test-disconnect:network 2>&1 | MATCH "failure of disconnect hook"
+
+  echo "And network plug remains connected"
+  snap connections | MATCH "test-disconnect:network .*:network"
+
+  echo "Snap removal fails because of failing disconnect hook"
+  snap remove test-disconnect 2>&1 | MATCH "failure of disconnect hook"
+
+  echo "And the plug is still connected"
+  snap connections | MATCH "test-disconnect:network .*:network"
+
+  echo "Making disconnect hook happy"
+  touch /var/snap/test-disconnect/common/do-not-fail
+
+  echo "And removing the snap is now possible"
+  snap remove --purge test-disconnect
diff -Nru snapd-2.45.1+20.04.2/tests/main/disconnect-undo/test-disconnect/meta/hooks/disconnect-plug-network snapd-2.48.3+20.04/tests/main/disconnect-undo/test-disconnect/meta/hooks/disconnect-plug-network
--- snapd-2.45.1+20.04.2/tests/main/disconnect-undo/test-disconnect/meta/hooks/disconnect-plug-network	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/disconnect-undo/test-disconnect/meta/hooks/disconnect-plug-network	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh
+if [ -f "$SNAP_COMMON"/do-not-fail ]; then
+    exit 0
+fi
+echo "failure of disconnect hook"
+exit 1
diff -Nru snapd-2.45.1+20.04.2/tests/main/disconnect-undo/test-disconnect/meta/snap.yaml snapd-2.48.3+20.04/tests/main/disconnect-undo/test-disconnect/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/disconnect-undo/test-disconnect/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/disconnect-undo/test-disconnect/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+name: test-disconnect
+version: 1
+summary: Basic snap with a failing disconnect hook
+
+plugs:
+  network:
diff -Nru snapd-2.45.1+20.04.2/tests/main/disk-space-awareness/task.yaml snapd-2.48.3+20.04/tests/main/disk-space-awareness/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/disk-space-awareness/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/disk-space-awareness/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,109 @@
+summary: Check that basic snap operation are aware of low disk space.
+
+# this test is remounts /var/lib/snapd which is too intrusive for core.
+systems: [-ubuntu-core-*]
+
+description: |
+  Check that operations such as snap installation or snap removal (with an
+  automatic snapshot) error out early if there is not enough disk space.
+
+environment:
+  TMPFSMOUNT: /var/lib/snapd
+
+prepare: |
+  systemctl stop snapd.{socket,service}
+
+  # mount /var/lib/snapd on a tmpfs
+  mount -t tmpfs tmpfs -o size=150M,mode=0755 "$TMPFSMOUNT"
+
+  systemctl start snapd.{socket,service}
+
+restore: |
+  systemctl stop snapd.{socket,service}
+  umount -l "$TMPFSMOUNT"
+  systemctl start snapd.{socket,service}
+
+execute: |
+  resize() {
+    # remount can increase/decrease the size as long as it is enough for
+    # already stored data.
+    mount -o remount,size="$1",mode=0755 "$TMPFSMOUNT"
+  }
+
+  # disk usage, in MB
+  get_disk_usage() {
+    df -B1048576 "$TMPFSMOUNT" | tail -1 | awk '{print $3}'
+  }
+
+  echo "Enabling experimental disk space checks"
+  snap set system experimental.check-disk-space-install=true
+  snap set system experimental.check-disk-space-remove=true
+  snap set system experimental.check-disk-space-refresh=true
+
+  echo "Snap download fails with little disk space"
+  NEWSIZE=$(($(get_disk_usage) + 1))
+  resize "${NEWSIZE}M"
+  snap install hello-world 2>&1 | MATCH  "cannot install \"hello-world\" due to low disk space"
+
+  # note, installing hello-world also pulls core snap.
+  echo "And succeeds with enough space"
+  resize 150M
+  snap install hello-world
+
+  # run the snap once to have data dirs created
+  hello-world
+
+  # create 4M filler in common directory to inflate backup size
+  dd if=/dev/zero of=/var/snap/hello-world/common/filler bs=1024 count=4096
+
+  echo "Resizing the disk down with just 1MB extra"
+  NEWSIZE=$(($(get_disk_usage) + 1))
+  resize "${NEWSIZE}M"
+
+  if snap remove hello-world > error.txt 2>&1; then
+    echo "expected snap remove hello-world to fail"
+    exit 1
+  fi
+
+  MATCH "error: cannot remove \"hello-world\" due to low disk space" < error.txt
+  MATCH "use --purge to avoid creating a snapshot" < error.txt
+
+  echo "Removing the snap with --purge works despite of low disk space"
+  snap remove --purge hello-world
+
+  resize 150M
+  snap install hello-world test-snapd-sh
+
+  # create 4M filler in common directory to inflate backup size
+  dd if=/dev/zero of=/var/snap/hello-world/common/filler bs=1024 count=4096
+
+  echo "Resizing the disk down with just 1MB extra"
+  NEWSIZE=$(($(get_disk_usage) + 1))
+  resize "${NEWSIZE}M"
+
+  echo "Removing multiple snaps at once fails due to low disk space"
+  if snap remove hello-world test-snapd-sh > error.txt 2>&1; then
+    echo "expected snap remove hello-world test-snapd-sh to fail"
+    exit 1
+  fi
+  MATCH "error: cannot remove \"hello-world\", \"test-snapd-sh\" due to low disk space" < error.txt
+
+  snap remove --purge hello-world
+  snap remove --purge test-snapd-sh
+
+  resize 150M
+  snap install test-snapd-tools
+
+  echo "Refresh fails due to low disk space"
+  NEWSIZE=$(($(get_disk_usage) + 1))
+  resize "${NEWSIZE}M"
+  # create 4M filler in common directory
+  if snap refresh --edge test-snapd-tools > error.txt 2>&1; then
+    echo "expected snap refresh --edge test-snapd-tools to fail"
+    exit 1
+  fi
+  MATCH "error: cannot refresh \"test-snapd-tools\" due to low disk space" < error.txt
+
+  # succeeds with enough space
+  resize 150M
+  snap refresh --edge test-snapd-tools
diff -Nru snapd-2.45.1+20.04.2/tests/main/docker-smoke/task.yaml snapd-2.48.3+20.04/tests/main/docker-smoke/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/docker-smoke/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/docker-smoke/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,4 +1,4 @@
-summary: Check that the the docker snap works basically
+summary: Check that the docker snap works basically
 
 # only run on ubuntus for now, the docker snap has issues on non-ubuntu ATM
 # TODO:UC20: enable for UC20, fails with what looks like apparmor
@@ -14,4 +14,4 @@
     exit 1
   fi
 
-  retry-tool -n 30 --wait 1 docker run hello-world | MATCH "installation appears to be working correctly"
+  retry -n 30 --wait 1 docker run hello-world | MATCH "installation appears to be working correctly"
diff -Nru snapd-2.45.1+20.04.2/tests/main/document-portal-activation/task.yaml snapd-2.48.3+20.04/tests/main/document-portal-activation/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/document-portal-activation/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/document-portal-activation/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -17,56 +17,56 @@
 # Disabled on Ubuntu Core because it doesn't provide the "desktop"
 # slot, and Amazon Linux because it doesn't have the required Python 3
 # packages to run the test.
-systems: [ -ubuntu-core-*, -amazon-linux-2-*, -centos-* ]
-
-environment:
-    XDG_RUNTIME_DIR: /run/user/$(id -u)
+systems:
+    - -amazon-linux-2-*
+    - -centos-*
+    - -ubuntu-14.04-*
+    - -ubuntu-core-*
 
 prepare: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-desktop
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     rm -f /usr/share/dbus-1/services/fake-document-portal.service
-    mkdir -p "$XDG_RUNTIME_DIR"
-    rm -rf "${XDG_RUNTIME_DIR:?}/*" "${XDG_RUNTIME_DIR:?}/.[!.]*"
+    tests.session -u test prepare
+
+    # The fake portal writes to current working directory so let's give it permission to.
+    touch doc-portal.log
+    touch report-error.txt
+    chown test doc-portal.log
+    chown test report-error.txt
 
 restore: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
-    [ -f dbus-launch.pid ] && kill "$(cat dbus-launch.pid)"
     rm -f /usr/share/dbus-1/services/fake-document-portal.service
-    rm -rf "${XDG_RUNTIME_DIR:?}/*" "${XDG_RUNTIME_DIR:?}/.[!.]*"
+    rm -f doc-portal.log
+    rm -f report-error.txt
+    tests.session -u test restore
 
 execute: |
     #shellcheck source=tests/lib/systems.sh
     . "$TESTSLIB"/systems.sh
 
-    check_stderr() {
-        test -n "$1"
-        if is_cgroupv2; then
-            [ "$(cat "$1")" = "WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement" ]
-        else
-            [ "$(wc -c < "$1")" -eq 0 ]
-        fi
-    }
-    echo "No output on stderr when running without a session bus"
-    user_data="$HOME/snap/test-snapd-desktop/current"
-    test-snapd-desktop.check-dirs "$user_data" 2>stderr.log
-    check_stderr stderr.log
-
-    echo "Starting session bus"
-    eval "$(dbus-launch --sh-syntax)"
-    echo "$DBUS_SESSION_BUS_PID" > dbus-launch.pid
+    if is_cgroupv2; then
+        check_stderr() {
+            test -n "$1"
+            test "WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement" = "$(cat "$1")"
+        }
+    else
+        check_stderr() {
+            test -n "$1"
+            if [ -s "$1" ]; then
+                echo "stderr contains some messages"
+                cat "$1"
+                exit 1
+            fi
+        }
+    fi
 
     echo "No output on stderr when running with a session bus, when xdg-document-portal is not present."
-    test-snapd-desktop.check-dirs "$user_data" 2>stderr.log
+    tests.session -u test exec test-snapd-desktop.check-dirs /home/test/snap/test-snapd-desktop/current 2>stderr.log
     check_stderr stderr.log
 
     echo "The absence of the document portal service was recorded"
-    [ -f "$XDG_RUNTIME_DIR/.portals-unavailable" ]
+    test -f /run/user/12345/.portals-unavailable
 
     echo "Make the fake document portal activatable"
     cat << EOF > /usr/share/dbus-1/services/fake-document-portal.service
@@ -74,18 +74,16 @@
     Name=org.freedesktop.portal.Documents
     Exec=$(pwd)/fake-document-portal.py $(pwd)/doc-portal.log $(pwd)/report-error.txt
     EOF
-    : > doc-portal.log
-    : > report-error.txt
 
     echo "No attempt is made to activate the document portal due to the previous failure"
-    test-snapd-desktop.check-dirs "$user_data"
+    tests.session -u test exec test-snapd-desktop.check-dirs /home/test/snap/test-snapd-desktop/current
     not MATCH "GetMountPoint called" < doc-portal.log
 
     echo "Remove the .portals-unavailable file to force a recheck"
-    rm "$XDG_RUNTIME_DIR/.portals-unavailable"
+    rm /run/user/12345/.portals-unavailable
 
-    echo "No output on stderr when running with a session bus and xdg-document-portal is present".
-    test-snapd-desktop.check-dirs "$user_data" 2>stderr.log
+    echo "No output on stderr when running with a session bus and xdg-document-portal is present."
+    tests.session -u test exec test-snapd-desktop.check-dirs /home/test/snap/test-snapd-desktop/current 2>stderr.log
     MATCH "GetMountPoint called" < doc-portal.log
     check_stderr stderr.log
 
@@ -94,12 +92,19 @@
     : > doc-portal.log
 
     echo "Failures from a running xdg-document-portal are reported"
-    test-snapd-desktop.check-dirs "$user_data" 2>stderr.log
+    tests.session -u test exec test-snapd-desktop.check-dirs /home/test/snap/test-snapd-desktop/current 2>stderr.log
     MATCH "GetMountPoint called" < doc-portal.log
     MATCH "WARNING: cannot start document portal: failure" < stderr.log
 
     echo "Snaps not using the desktop interface will not try to contact the document portal"
     : > doc-portal.log
-    test-snapd-sh.sh -c 'true' 2>stderr.log
+    tests.session -u test exec test-snapd-sh.sh -c 'true' 2>stderr.log
+    check_stderr stderr.log
+    test "$(wc -c < doc-portal.log)" -eq 0
+
+    echo "No output on stderr when running without a session bus"
+    # NOTE: lack of session bus is emulated by unsetting DBUS_SESSION_BUS address
+    # and stopping dbus.socket
+    tests.session -u test exec systemctl --user stop dbus.socket
+    tests.session -u test exec sh -c "DBUS_SESSION_BUS_ADDRESS= test-snapd-desktop.check-dirs /home/test/snap/test-snapd-desktop/current" 2>stderr.log
     check_stderr stderr.log
-    [ "$(wc -c < doc-portal.log)" -eq 0 ]
diff -Nru snapd-2.45.1+20.04.2/tests/main/enable-disable/task.yaml snapd-2.48.3+20.04/tests/main/enable-disable/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/enable-disable/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/enable-disable/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,9 +2,7 @@
 
 prepare: |
     echo "Install test-snapd-sh and ensure it runs"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     test-snapd-sh.sh -c 'echo Hello' | MATCH Hello
 
 execute: |
diff -Nru snapd-2.45.1+20.04.2/tests/main/exitcodes/task.yaml snapd-2.48.3+20.04/tests/main/exitcodes/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/exitcodes/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/exitcodes/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,35 @@
+summary: Checks for snap exit codes
+
+systems: [ubuntu-1*, ubuntu-2*]
+
+prepare: |
+    tests.cleanup prepare
+
+execute: |
+    echo "snap command with unknown command return exit code 5"
+    set +e
+    snap unknown-command
+    RET=$?
+    set -e
+    test "$RET" -eq 64
+
+    echo "snap command with unknown flag return exit code 5"
+    set +e
+    snap pack --unknown-option
+    RET=$?
+    set -e
+    test "$RET" -eq 64
+
+    echo "snap command with broken mksquashfs returns exit code 20"
+    for b in /usr/bin/mksquashfs /snap/core/current/usr/bin/mksquashfs; do
+        mount -o bind /bin/false "$b"
+        tests.cleanup defer umount "$b"
+    done
+    set +e
+    snap pack "$TESTSLIB/snaps/test-snapd-sh"
+    RET=$?
+    set -e
+    test "$RET" -eq 20
+
+restore: |
+    tests.cleanup restore
diff -Nru snapd-2.45.1+20.04.2/tests/main/fake-netplan-apply/task.yaml snapd-2.48.3+20.04/tests/main/fake-netplan-apply/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/fake-netplan-apply/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/fake-netplan-apply/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,6 +18,12 @@
     - -arch-*
     - -amazon-*
     - -centos-*
+    # TODO: re-enable this when network-setup-control is updated to allow
+    # running netplan directly from the base snap and we can update this test to
+    # just using a simple shell script snap instead of building netplan from
+    # source, as currently that is broken on xenial with
+    # test-snapd-netplan-apply for some reason, see https://github.com/anonymouse64/test-snapd-netplan-apply/issues/1
+    - -ubuntu-16*
 
 prepare: |
     #shellcheck source=tests/lib/snaps.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/fakestore-install/task.yaml snapd-2.48.3+20.04/tests/main/fakestore-install/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/fakestore-install/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/fakestore-install/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,5 +1,8 @@
 summary: Ensure that the fakestore works
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
+
 environment:
   BLOB_DIR: $(pwd)/fake-store-blobdir
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/find-private/task.yaml snapd-2.48.3+20.04/tests/main/find-private/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/find-private/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/find-private/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,8 +16,6 @@
     snap logout || true
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
 
     echo "When a snap is private it doesn't show up in the find without login and without specifying private search"
     snap find test-snapd-private | not MATCH 'test-snapd-private +[0-9]+\.[0-9]+'
@@ -27,7 +25,7 @@
 
     echo "Given account store credentials are available"
     # we don't have expect available on ubuntu-core, so the authenticated check need to be skipped on those systems
-    if [ -n "$SPREAD_STORE_USER" ] && [ -n "$SPREAD_STORE_PASSWORD" ] && is_classic_system; then
+    if [ -n "$SPREAD_STORE_USER" ] && [ -n "$SPREAD_STORE_PASSWORD" ] && os.query is-classic; then
         echo "And the user has logged in"
         expect -f "$TESTSLIB"/successful_login.exp
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/health/task.yaml snapd-2.48.3+20.04/tests/main/health/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/health/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/health/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 summary: Check that health works
 
 prepare: |
-    snap install jq
+    snap install --edge jq
 
 execute: |
     echo "Test that 'try'ing a snap with a set-health hook sets health in state:"
diff -Nru snapd-2.45.1+20.04.2/tests/main/high-user-handling/task.yaml snapd-2.48.3+20.04/tests/main/high-user-handling/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/high-user-handling/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/high-user-handling/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,20 +1,24 @@
 summary: Check that the refresh data copy works.
 
-systems: [-ubuntu-core-*]
+systems:
+    - -ubuntu-14.04-*  # no support for tests.session
+    - -ubuntu-core-*  # no support for useradd
 
 environment:
     # an empty $topsrcdir/tests/go.mod seems to break importing or building go
     # packages referenced by their import paths while under the tests directory,
-    # need to disable go modules supportfor this test
+    # need to disable go modules support for this test
     GO111MODULE: off
 
 prepare: |
+    "$(command -v go)" build -o hightest test.go
     useradd --uid "$(( (1<<32)-2 ))" --shell /bin/sh hightest
+    tests.session -u hightest prepare
 
 restore: |
+    tests.session -u hightest restore
     userdel hightest
     rm -f hightest
 
 execute: |
-    "$(command -v go)" build -o hightest test.go
-    sudo -E -u hightest ./hightest
+    tests.session -u hightest exec "$(pwd)/hightest"
diff -Nru snapd-2.45.1+20.04.2/tests/main/hook-permissions/task.yaml snapd-2.48.3+20.04/tests/main/hook-permissions/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/hook-permissions/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/hook-permissions/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,19 +8,13 @@
     and enumerate upower devices.
 
 prepare: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-    if is_core_system; then
+    if os.query is-core; then
         snap install test-snapd-upower --edge
     fi
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snap
+    "$TESTSTOOLS"/snaps-state install-local test-snap
 
 execute: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-    if ! is_core_system; then
+    if ! os.query is-core; then
       # trigger upowerd to have the service started as AppArmor would deny to
       # start it in response to a dbus call from inside a snap (because the
       # service is not started yet and AppArmor doesn't know what confinement
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-cache/task.yaml snapd-2.48.3+20.04/tests/main/install-cache/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-cache/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-cache/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,10 +1,7 @@
 summary: Check that download caching works
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     snap install test-snapd-sh
     snap remove --purge test-snapd-sh
     snap install test-snapd-sh
-    check_journalctl_log 'using cache for .*/test-snapd-sh.*\.snap' -u snapd
+    "$TESTSTOOLS"/journal-state match-log 'using cache for .*/test-snapd-sh.*\.snap' -u snapd
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-errors/task.yaml snapd-2.48.3+20.04/tests/main/install-errors/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-errors/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-errors/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,9 +11,7 @@
 
 prepare: |
     echo "Given a snap with a failing command is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local "$SNAP_NAME"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME"
 
 execute: |
     echo "Install unexisting snap prints error"
@@ -79,8 +77,6 @@
 
     #shellcheck source=tests/lib/snaps.sh
     . "$TESTSLIB"/snaps.sh
-    #shellcheck source=tests/lib/strings.sh
-    . "$TESTSLIB"/strings.sh
 
     if is_classic_confinement_supported ; then
         echo "Installing a strict snap in classic works but --classic is ignored"
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-fontconfig-cache-gen/task.yaml snapd-2.48.3+20.04/tests/main/install-fontconfig-cache-gen/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-fontconfig-cache-gen/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-fontconfig-cache-gen/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,15 +2,45 @@
 
 # limiting to ubuntu because we need a known fonts package
 # to install so that actual caches get generated
-systems: [ubuntu-16.04-64, ubuntu-18.04-64]
+systems: [ubuntu-16.04-64, ubuntu-18.04-64, ubuntu-20.04-64]
+
+debug: |
+    ls -lah /var/cache/fontconfig/
+    dpkg-reconfigure fontconfig
+    ls -lah /var/cache/fontconfig/
 
 prepare: |
-    apt install -y fonts-kiloji
+    if [ "$SPREAD_SYSTEM" = ubuntu-16.04-64 ]; then
+        PKG=fonts-kiloji
+        NAME=kiloji
+    else
+        PKG=fonts-noto-color-emoji
+        NAME=NotoColorE
+    fi
+
+    echo "ensure the font is not already in the fontconfig cache before installing"
+    fc-cat /var/cache/fontconfig/* 2>/dev/null | not MATCH "$NAME"
+    apt update -yqq
+    apt install -y "$PKG"
+    echo "ensure the font is now in the cache"
+    fc-cat /var/cache/fontconfig/* 2>/dev/null | MATCH "$NAME"
 
 restore: |
-    apt autoremove -y fonts-kiloji
+    if [ "$SPREAD_SYSTEM" = ubuntu-16.04-64 ]; then
+        PKG=fonts-kiloji
+    else
+        PKG=fonts-noto-color-emoji
+    fi
+
+    apt autoremove -y "$PKG" || true
 
 execute: |
+    if [ "$SPREAD_SYSTEM" = ubuntu-16.04-64 ]; then
+        NAME=kiloji
+    else
+        NAME=NotoColorE
+    fi
+
     echo "With no fontconfig cache"
     rm /var/cache/fontconfig/*
 
@@ -18,3 +48,6 @@
     snap install test-snapd-sh
     ls /var/cache/fontconfig/*.cache-6
     ls /var/cache/fontconfig/*.cache-7
+
+    echo "and the user installed font is in the cache"
+    fc-cat /var/cache/fontconfig/* 2>/dev/null | MATCH "$NAME"
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-refresh-remove-hooks/task.yaml snapd-2.48.3+20.04/tests/main/install-refresh-remove-hooks/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-refresh-remove-hooks/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-refresh-remove-hooks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -26,10 +26,7 @@
     rm -f "$REMOVE_HOOK_FILE"
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    # shellcheck disable=SC2153
-    install_local_as snap-hooks "$NAME"
+    "$TESTSTOOLS"/snaps-state install-local-as snap-hooks "$NAME"
 
     echo "Verify configuration value with snap get"
     snap get "$NAME" installed | MATCH 1
@@ -49,7 +46,7 @@
 
     echo "Verify that install hook is run only once"
     snap set "$NAME" installed=2
-    install_local_as snap-hooks "$NAME"
+    "$TESTSTOOLS"/snaps-state install-local-as snap-hooks "$NAME"
     snap get "$NAME" installed | MATCH 2
 
     echo "Verify that pre-refresh hook was executed"
@@ -78,7 +75,7 @@
 
     echo "Installing a snap with hooks again"
     rm -f "$REMOVE_HOOK_FILE" > /dev/null 2>&1
-    install_local_as snap-hooks "$NAME"
+    "$TESTSTOOLS"/snaps-state install-local-as snap-hooks "$NAME"
     snap connect "$NAME:home"
 
     echo "Forcing remove script to fail"
@@ -91,7 +88,7 @@
     fi
 
     echo "Installing a snap with broken install hook aborts the installation"
-    if install_local snap-hook-broken; then
+    if "$TESTSTOOLS"/snaps-state install-local snap-hook-broken; then
         echo "Expected installation to fail"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-remove-multi/task.yaml snapd-2.48.3+20.04/tests/main/install-remove-multi/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-remove-multi/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-remove-multi/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,10 +11,8 @@
     not snap list test-snapd-sh
     not snap list test-snapd-control-consumer
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
     echo "Installing of a snap with a desktop file creates the desktop file"
-    install_local basic-desktop 
+    "$TESTSTOOLS"/snaps-state install-local basic-desktop
     test -e /var/lib/snapd/desktop/applications/basic-desktop_io.snapcraft.echoecho.desktop
     echo "Removing a snap with a desktop file removes the desktop file again"
     snap remove  basic-desktop
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-sideload/task.yaml snapd-2.48.3+20.04/tests/main/install-sideload/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-sideload/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-sideload/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -41,12 +41,9 @@
     	Exec=env BAMF_DESKTOP_FILE_HINT=/var/lib/snapd/desktop/applications/basic-desktop_echo.desktop $SNAP_MOUNT_DIR/bin/basic-desktop.echo
     EOF
 
-    #shellcheck source=tests/lib/strings.sh
-    . "$TESTSLIB"/strings.sh
-
     echo "Sideload devmode snap fails without flags"
     expected="requires devmode or confinement override"
-    str_to_one_line "$( snap install --dangerous ./test-snapd-devmode_1.0_all.snap 2>&1 )" | MATCH "$expected"
+    "$TESTSTOOLS"/to-one-line "$( snap install --dangerous ./test-snapd-devmode_1.0_all.snap 2>&1 )" | MATCH "$expected"
 
     echo "Sideload devmode snap succeeds with --devmode"
     expected="test-snapd-devmode 1.0 installed"
@@ -70,12 +67,10 @@
     snap install --dangerous ./test-snapd-tools_1.0_all.snap
     test-snapd-tools.success
 
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
     # TODO:UC20: fix to work on uc20 too
     # The "seed/" dir is on a FAT partition on uc20 so the permissions are
     # different here.
-    if ! is_core20_system; then
+    if ! os.query is-core20; then
         echo "All snap blobs are 0600"
         test "$( find /var/lib/snapd/{snaps,cache,seed/snaps}/ -type f -printf '%#m\n' | sort -u | xargs )" = "0600"
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/install-socket-activation/task.yaml snapd-2.48.3+20.04/tests/main/install-socket-activation/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/install-socket-activation/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/install-socket-activation/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     This installs a snap which define sockets for systemd socket activation.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local socket-activation
+    "$TESTSTOOLS"/snaps-state install-local socket-activation
 
 restore: |
     systemctl daemon-reload
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-account-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-account-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-account-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-account-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -12,9 +12,7 @@
 
 prepare: |
     echo "Given a snap declaring a plug on account-control is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local "$TSNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$TSNAP"
 
     echo "And the account-control plug is connected"
     snap connect "$TSNAP":account-control
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-accounts-service/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-accounts-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-accounts-service/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-accounts-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,61 +3,23 @@
 # Only test on classic systems with AppArmor DBus mediation
 # Don't test on ubuntu-14.04, since it's gnome-online-accounts daemon
 # seems to be incompatible.
-systems: [ ubuntu-16* ]
-
-environment:
-    XDG_CONFIG_HOME: $(pwd)/config
-    XDG_DATA_HOME: $(pwd)/share
-    XDG_CACHE_HOME: $(pwd)/cache
+systems:
+    - ubuntu-16.04-*
+    - ubuntu-18.04-*
+    - ubuntu-2*
 
 prepare: |
-    if pgrep goa-daemon; then
-        echo "precondtion failed, goa-daemon already running!"
-        exit 1
-    fi
+    # Not all the images have the same packages pre-installed.
+    apt-get install -y --no-install-recommends gnome-online-accounts
 
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
     snap install --edge test-snapd-accounts-service
-    mkdir -p "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME"
-
-restore: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
-    # this will also kill the "gdbus monitor" command
-    kill "$(cat dbus-launch.pid)"
-    rm -rf "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME"
-    # usually not needed, this should die when dbus goes down
-    kill "$(cat gdbus-monitor.pid)" || true
-    pkill goa-daemon || true
-debug: |
-    ps aux
-    cat gdbus.log || true
-    if [[ -f dbus.env ]]; then
-        #shellcheck disable=SC1091
-        source dbus.env
-        busctl --user status org.gnome.OnlineAccounts
-    fi
-
-execute: |
-    echo "Ensure things run"
-    dbus-launch --sh-syntax > dbus.env
-    #shellcheck disable=SC1091
-    source dbus.env
-    echo "$DBUS_SESSION_BUS_PID" > dbus-launch.pid
-
-    # the test failed often in the past, log all dbus activity to ease debugging
-    dbus-monitor --session >gdbus.log 2>&1 &
-    echo "$!" > gdbus-monitor.pid
-
-    eval "$(printf password|gnome-keyring-daemon --login)"
-    eval "$(gnome-keyring-daemon --start)"
+    tests.session -u test prepare
 
     echo "Creating account"
     # We set a long timeout here because goa-daemon will be activated
     # by the method call, and this can take a while on heavily loaded
-    # or IO constrianed VMs.
-    busctl call --verbose --user --timeout 300 \
+    # or IO constrained VMs.
+    tests.session -u test exec busctl call --verbose --user --timeout 300 \
       org.gnome.OnlineAccounts \
       /org/gnome/OnlineAccounts/Manager \
       org.gnome.OnlineAccounts.Manager AddAccount \
@@ -68,11 +30,22 @@
       0 \
       5 'Enabled' 'true' 'EmailAddress' 'test@example.com' 'Name' 'Test User' 'ImapHost' 'imap.example.com' 'SmtpHost': 'mail.example.com'
 
+restore: |
+    tests.session -u test restore
+
+    apt-get remove -y --purge gnome-online-accounts
+    apt-get autoremove --purge -y
+
+    # Ensure the file we are expecting to remove is there. This ought to catch
+    # future format changes.
+    test -e ~test/.config/goa-1.0/accounts.conf
+    rm -f ~test/.config/goa-1.0/accounts.conf
+
+execute: |
     echo "The interface is initially disconnected"
     snap interfaces -i accounts-service | MATCH '\- +test-snapd-accounts-service:accounts-service'
-    #shellcheck disable=SC2015
-    test-snapd-accounts-service.list-accounts && exit 1 || true
+    not tests.session -u test exec test-snapd-accounts-service.list-accounts
 
-    echo "When the plug is connected"
+    echo "When the plug is connected we can get the data"
     snap connect test-snapd-accounts-service:accounts-service
-    test-snapd-accounts-service.list-accounts | MATCH "Display Name at IMAP and SMTP"
+    tests.session -u test exec test-snapd-accounts-service.list-accounts | MATCH "Display Name at IMAP and SMTP"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-adb-support/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-adb-support/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-adb-support/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-adb-support/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     rules to the system. Before such connection is placed there are no
     wide-open, write-access rules present.
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-adb-support
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-adb-support
 execute: |
     # If there are any udev rules from existing snaps they are not granting
     # writable-to-all permission to anything. This part is conditional because
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-appstream-metadata/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-appstream-metadata/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-appstream-metadata/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-appstream-metadata/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -14,9 +14,7 @@
 systems: [-ubuntu-core-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-appstream-metadata
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-appstream-metadata
 
     # Set up some dummy Appstream metadata on the host system
     mkdir -p /usr/share/metainfo
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-audio-playback-record/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-audio-playback-record/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-audio-playback-record/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-audio-playback-record/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,8 @@
 summary: Ensure that the audio-playback/record interface works
 
-# Only classic Ubuntu has the pulseaudio mediation patches
-systems: [ ubuntu-1*-*64, ubuntu-2*-*64 ]
+# Only classic Ubuntu has the pulseaudio mediation patches. Ubuntu 14.04 is unsupported on the desktop.
+# TODO: extend tests.session and run this test on 14.04 as well.
+systems: [ubuntu-16.04-*, ubuntu-18.04-*, ubuntu-2*]
 
 environment:
     PLAY_FILE: "/snap/test-snapd-audio-record/current/usr/share/sounds/alsa/Noise.wav"
@@ -9,60 +10,103 @@
     EXFAIL: "ubuntu-14"
 
 prepare: |
-    # FIXME: This test is broken and should be ported to session-tool, systemd
-    # --user starts pulseaudio for us so we are always racing with it (whoever
-    # acquires the socket file wins).
-    #
-    # To prevent this from breaking this test mask pulseaudio.{socket,service}
-    # in all user sessions.
-    systemctl --user --global mask pulseaudio.{socket,service}
-
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
-    snap install --edge test-snapd-audio-record
+    tests.cleanup prepare
 
+    # Install pulseaudio.
     apt-get update
     apt-get install -y pulseaudio pulseaudio-utils
+    # Remove the package and reload systemd later, when we are restoring. This
+    # is important because of rtkit-daemon.service that gets pulled by
+    # pulseaudio and that is subsequently removed.
+    tests.cleanup defer systemctl daemon-reload
+    tests.cleanup defer apt-get autoremove --purge -y pulseaudio pulseaudio-utils
+
+    # Make sure the socket and the server is available in the user session.
+    if [ "$(systemctl --user --global is-enabled pulseaudio.socket)" != enabled ]; then
+        systemctl --user --global enable pulseaudio.socket
+        tests.cleanup defer systemctl --user --global disable pulseaudio.socket
+    fi
+    if [ "$(systemctl --user --global is-enabled pulseaudio.service)" != enabled ]; then
+        systemctl --user --global enable pulseaudio.service
+        tests.cleanup defer systemctl --user --global disable pulseaudio.service
+    fi
 
-    echo "Create XDG_RUNTIME_DIR=/run/user/12345"
-    # shellcheck disable=SC2174
-    mkdir -m 700 -p /run/user/12345 || true
-    chown test:test /run/user/12345
-
-    # ensure we have a clean pulse directory
-    test -d /home/test/.config && mv /home/test/.config /home/test/.config.spread
-    mkdir -m 700 /home/test/.config
-    mkdir -m 700 /home/test/.config/pulse
-    chown test:test /home/test/.config /home/test/.config/pulse
+    # Install a snap that uses the audio-playback/audio-record interfaces.
+    snap install --edge test-snapd-audio-record
+    tests.cleanup defer snap remove --purge test-snapd-audio-record
 
-restore: |
-    HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 su -p -c "pulseaudio --kill" test || true
-    snap remove --purge test-snapd-audio-record
-    apt-get autoremove --purge -y pulseaudio pulseaudio-utils
-    rm -rf /run/user/12345 /home/test/.config/pulse
-    if [ -d /home/test/.config.spread ]; then
-        rm -rf /home/test/.config
-        mv /home/test/.config.spread /home/test/.config
+    # TODO: move this to the test that is responsible for creating this data.
+    # Remove potentially large go build cache that makes the debug section more
+    # verbose.
+    rm -rf ~test/.cache/go-build
+
+    # TODO: fix the test causing this. Some test is making ~test/.config root-owned,
+    # making it impossible for pulseaudio to start and write the secure cookie file.
+    chown -R test ~test
+
+    # Prepare a session for the user.
+    tests.session -u test prepare
+    tests.cleanup defer tests.session -u test restore
+
+    # Ensure that the socket is active but do not check the service. In user
+    # mode pulseaudio is documented to quit when there are no active logind
+    # sessions.
+    #
+    # User session services do not posses a logind session session so
+    # pulseaudio immediately quits, and remains inactive outside of the moments
+    # we execute paplay through tests.session.
+    tests.session -u test exec systemctl --user is-active pulseaudio.socket | MATCH active
+
+    # Start pulseaudio to give it a chance to write the pulseaudio cookie file.
+    # Otherwise paplay invocation will race with pulse startup, and will race
+    # with cookie file being available.
+    if not tests.session -u test exec systemctl --user start pulseaudio.service; then
+        echo "cannot start pulseaudio server"
+        tests.session -u test exec systemctl --user status pulseaudio.service || true
+        tests.session -u test exec journalctl --user -u pulseaudio.service || true
+        exit 1
     fi
-    systemctl --user --global unmask pulseaudio.{socket,service}
-
-execute: |
-    # we need -p so that XDG_RUNTIME_DIR is honored, but that preserves HOME,
-    # so specify it too since pulseaudio fails to start otherwise
-    echo "Start pulseaudio"
-    HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 su -p -c "pulseaudio --exit-idle-time=30" test &
 
-    echo "Then wait for the socket to show up"
-    retry-tool -n 10 test -S /run/user/12345/pulse/native
+    # Ensure, that the cookie file is present.
+    test -e ~test/.config/pulse/cookie || test -e ~test/.config/pulse/.pulse-cookie
+    tests.cleanup defer rm -rf ~test/.config/pulse
+
+    # enable debug logging in pulseaudio
+    cp /etc/pulse/daemon.conf /etc/pulse/daemon.conf.backup
+    echo 'log-level = debug' >> /etc/pulse/daemon.conf
+    tests.cleanup defer mv /etc/pulse/daemon.conf.backup /etc/pulse/daemon.conf
+
+    # disable start limit checking for pulseaudio service
+    mkdir -p /etc/systemd/user/pulseaudio.service.d
+    cat <<-EOF > /etc/systemd/user/pulseaudio.service.d/no-start-limit.conf
+    [Unit]
+    StartLimitBurst=0
+    EOF
+    tests.cleanup defer rm /etc/systemd/user/pulseaudio.service.d/no-start-limit.conf
+    # reload user's systemd instance
+    tests.session -u test exec systemctl daemon-reload --user
+
+debug: |
+    echo "Files present in the test user's home directory"
+    test -d /home/test && find /home/test
+    echo "Files present in the test user's home directory, that are owned by root"
+    test -d /home/test && find /home/test -user root
+    echo "Files present in the test user's runtime directory"
+    test -d /home/user/12345 && find /run/user/12345
+    echo "Processes running as the test user"
+    ps -u test
+    echo "Pulseaudio log"
+    tests.session -u test exec journalctl --user -u pulseaudio.service || true
 
-    echo "Check pulseaudio"
-    HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 retry-tool -n 10 su -p -c "pulseaudio --check" test
+restore: |
+    tests.cleanup restore
 
+execute: |
     echo "The unconfined user can play audio"
-    HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 su -p -c "/usr/bin/paplay $PLAY_FILE" test
+    tests.session -u test exec /usr/bin/paplay "$PLAY_FILE"
 
     echo "The unconfined user can record audio"
-    HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 su -p -c "/snap/test-snapd-audio-record/current/bin/parec-simple" test
+    tests.session -u test exec /snap/test-snapd-audio-record/current/bin/parec-simple
 
     echo "The audio-playback interface is connected by default"
     snap connections test-snapd-audio-record | MATCH "audio-playback +test-snapd-audio-record:audio-playback +:audio-playback +-"
@@ -74,13 +118,13 @@
     snap connect test-snapd-audio-record:audio-playback
 
     echo "Then the snap can play audio"
-    su -l -c "test-snapd-audio-record.play $PLAY_FILE" test
+    tests.session -u test exec test-snapd-audio-record.play "$PLAY_FILE"
 
     echo "When the audio-record plug is connected"
     snap connect test-snapd-audio-record:audio-record
 
     echo "Then the snap can record audio"
-    su -l -c "test-snapd-audio-record.recsimple" test
+    tests.session -u test exec test-snapd-audio-record.recsimple
 
     echo "When the audio-record plug is disconnected"
     snap disconnect test-snapd-audio-record:audio-record
@@ -91,10 +135,10 @@
     fi
 
     echo "Then the snap command is not able to record audio"
-    if [ "$mediating_pa" = "no" ] && ! su -l -c "test-snapd-audio-record.recsimple" test ; then
+    if [ "$mediating_pa" = "no" ] && ! tests.session -u test exec test-snapd-audio-record.recsimple; then
         echo "Could not record audio. Does '$SPREAD_SYSTEM' have mediation patches?"
         exit 1
-    elif [ "$mediating_pa" = "yes" ] && su -l -c "test-snapd-audio-record.recsimple" test ; then
+    elif [ "$mediating_pa" = "yes" ] && tests.session -u test exec test-snapd-audio-record.recsimple; then
         echo "Could record audio even though '$SPREAD_SYSTEM' should have mediation patches"
         exit 1
     fi
@@ -107,7 +151,7 @@
     snap disconnect test-snapd-audio-record:audio-playback
 
     echo "Then the snap command is not able to connect to the pulseaudio socket"
-    if su -l -c "test-snapd-audio-record.play $PLAY_FILE" test ; then
+    if tests.session -u test exec test-snapd-audio-record.play "$PLAY_FILE"; then
         echo "Expected error with plug disconnected"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-autopilot-introspection/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-autopilot-introspection/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-autopilot-introspection/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-autopilot-introspection/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,62 +1,48 @@
 summary: Ensure that the autopilot-introspection interface works
 
 details: |
-    The autopilot-intrspection interface allows an application to be introspected
+    The autopilot-introspection interface allows an application to be introspected
     and export its ui status over DBus.
 
-    The test uses an snap that declares a plug on autopilot-intrsopection, it
+    The test uses an snap that declares a plug on autopilot-introspection, it
     needs to request a dbus name on start so that its state can be queried.
 
-systems: [-ubuntu-core-*]
+systems:
+    - -ubuntu-14.04-*  # no tests.session
+    - -ubuntu-core-*  # no session bus (except for core20+)
+    - -amazon-linux-2-*  # no session bus
+    - -centos-7-*  # no session bus
 
 prepare: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-
-    echo "Given a snap declaring an autopilot-intrspection plug in installed"
+    echo "Given a snap declaring an autopilot-introspection plug in installed"
     snap install --edge test-snapd-autopilot-consumer
 
+    tests.session -u test prepare
+
     echo "And the provider dbus loop is started"
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    start_dbus_unit $SNAP_MOUNT_DIR/bin/test-snapd-autopilot-consumer.provider
+    # XXX: The test snap doesn't run as a service so we must do it ourselves.
+    # The app requires a session bus connection to operate. The interface is
+    # defined for session bus only.
+    tests.session -u test exec systemd-run --user --unit test-snapd-autopilot-consumer-provider.service test-snapd-autopilot-consumer.provider
 
 restore: |
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    stop_dbus_unit
+    tests.session -u test exec systemctl --user stop test-snapd-autopilot-consumer-provider.service
+    tests.session -u test restore
 
 execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-
-    dbus_send(){
-        local method="$1"
-        dbus-send --print-reply --dest=com.canonical.Autopilot.Introspection /com/canonical/Autopilot/Introspection "com.canonical.Autopilot.Introspection.${method}"
-    }
-
-    #shellcheck disable=SC2046
-    export $(cat dbus.env)
-
     echo "Then the plug is disconnected by default"
     snap interfaces -i autopilot-introspection | MATCH '^\- +test-snapd-autopilot-consumer:autopilot-introspection'
 
     echo "When the plug is connected"
     snap connect test-snapd-autopilot-consumer:autopilot-introspection
 
-    echo "Then the dbus name is properly reserved and the snap app version can be introspected"
+    echo "Then the dbus name is properly reserved and the snap app version can be introspectd"
 
-    for _ in $(seq 10); do
-        if ! dbus_send GetVersion | MATCH "my-ap-version"; then
-            sleep 1
-        else
-            break
-        fi
-    done
-    $SNAP_MOUNT_DIR/bin/test-snapd-autopilot-consumer.consumer GetVersion | MATCH "my-ap-version"
+    retry -n 10 --wait 1 sh -c 'tests.session -u test exec dbus-send --print-reply --dest=com.canonical.Autopilot.Introspection /com/canonical/Autopilot/Introspection com.canonical.Autopilot.Introspection.GetVersion | MATCH "my-ap-version"'
+    tests.session -u test exec test-snapd-autopilot-consumer.consumer GetVersion | MATCH "my-ap-version"
 
-    echo "And the snap app state can be intrsopected"
-    $SNAP_MOUNT_DIR/bin/test-snapd-autopilot-consumer.consumer GetState | MATCH "my-ap-state"
+    echo "And the snap app state can be introspected"
+    tests.session -u test exec test-snapd-autopilot-consumer.consumer GetState | MATCH "my-ap-state"
 
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
@@ -66,14 +52,14 @@
     snap disconnect test-snapd-autopilot-consumer:autopilot-introspection
 
     echo "Then the snap version is not introspectable"
-    if $SNAP_MOUNT_DIR/bin/test-snapd-autopilot-consumer.consumer GetVersion 2> getversion.error ; then
+    if tests.session -u test exec test-snapd-autopilot-consumer.consumer GetVersion 2> getversion.error ; then
         echo "Expected permission error trying to introspect version with disconnected plug"
         exit 1
     fi
     MATCH "Permission denied" < getversion.error
 
     echo "And the snap state is not introspectable"
-    if $SNAP_MOUNT_DIR/bin/test-snapd-autopilot-consumer.consumer GetState 2> getstate.error; then
+    if tests.session -u test exec test-snapd-autopilot-consumer.consumer GetState 2> getstate.error; then
         echo "Expected permission error trying to introspect state with disconnected plug"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-bluez/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-bluez/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-bluez/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-bluez/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,7 +4,7 @@
     The bluez interface allows the bluez service to run and clients to
     communicate with it.
 
-    This test verifies the the bluez snap from the store installs and
+    This test verifies that the bluez snap from the store installs and
     we can connect its slot and plug.
 
 environment:
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-broadcom-asic-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-broadcom-asic-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-broadcom-asic-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-broadcom-asic-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,26 +11,20 @@
     The broadcom-asic-control interface allow access to broadcom asic kernel module.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
-
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
-    ensure_file_exists_backup_real /dev/linux-user-bde
-    ensure_file_exists_backup_real /dev/linux-kernel-bde
-    ensure_file_exists_backup_real /dev/linux-bcm-knet
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
-    ensure_file_exists /run/udev/data/+pci:0test
+    "$TESTSTOOLS"/fs-state mock-file /dev/linux-user-bde
+    "$TESTSTOOLS"/fs-state mock-file /dev/linux-kernel-bde
+    "$TESTSTOOLS"/fs-state mock-file /dev/linux-bcm-knet
+
+    "$TESTSTOOLS"/fs-state mock-file /run/udev/data/+pci:0test
 
 restore: |
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
-    clean_file /dev/linux-user-bde
-    clean_file /dev/linux-kernel-bde
-    clean_file /dev/linux-bcm-knet
+    "$TESTSTOOLS"/fs-state restore-file /dev/linux-user-bde
+    "$TESTSTOOLS"/fs-state restore-file /dev/linux-kernel-bde
+    "$TESTSTOOLS"/fs-state restore-file /dev/linux-bcm-knet
 
-    clean_file "/run/udev/data/+pci:0test"
+    "$TESTSTOOLS"/fs-state restore-file "/run/udev/data/+pci:0test"
 
 execute: |
     echo "When the interface is connected"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-calendar-service/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-calendar-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-calendar-service/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-calendar-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,10 +5,22 @@
 #
 # FIXME: disable opensuse-tumbleweed until
 # https://github.com/snapcore/snapd/pull/7230 is landed
-# ubuntu-19.10+: test-snapd-eds is incompatible with eds version shipped with the distro
+# ubuntu-20.04+: test-snapd-eds is incompatible with eds version shipped with the distro
 # arch-linux: test-snapd-eds is incompatible with eds version shipped with the distro
 # fedora-31: test-snapd-eds is incompatible with eds version shipped with the distro
-systems: [-ubuntu-core-*, -ubuntu-14.04-*, -amazon-*, -centos-*, -opensuse-tumbleweed-*, -ubuntu-19.10-*, -ubuntu-20.04-*, -arch-linux-*, -debian-sid-*, -fedora-31-*]
+# fedora-32: test-snapd-eds is incompatible with eds version shipped with the distro
+systems:
+    - -amazon-*  # no need to run this on amazon
+    - -arch-linux-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -centos-*
+    - -debian-sid-*
+    - -fedora-31-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -fedora-32-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -opensuse-15.2-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -opensuse-tumbleweed-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -ubuntu-14.04-*  # no tests.session support, eds is too old
+    - -ubuntu-2*  # test-snapd-eds is incompatible with eds shipped with the distro
+    - -ubuntu-core-*  # EDS is unsupported on core systems
 
 # fails in the autopkgtest env with:
 # [Wed Aug 15 16:34:12 2018] audit: type=1400
@@ -19,41 +31,24 @@
 # peer_addr="@/tmp/dbus-5FUilMiW8U" peer="unconfined"
 backends: [-autopkgtest]
 
-environment:
-    XDG: $(pwd)/xdg
-    XDG_CONFIG_HOME: $XDG/config
-    XDG_DATA_HOME: $XDG/share
-    XDG_CACHE_HOME: $XDG/cache
-
 prepare: |
+    tests.session -u test prepare
     snap install --edge test-snapd-eds
-    mkdir -p "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME"
 
 restore: |
-    kill "$(cat dbus-launch.pid)"
-
-    # In case the process gvfsd-metadata does not finish by itself, it is manually stopped
-    # The reason is that gvfsd-metadata locks the xdg/share/gvfs-metadata directory content
-    # producing an error when the xdg directory is removed.
-    if pid="$(pidof gvfsd-metadata)"; then
-        kill -9 "$pid" || true
-    fi
-    rm -rf "$XDG"
+    snap remove --purge test-snapd-eds
+    tests.session -u test restore
 
 execute: |
-    echo "Setting up D-Bus session bus"
-    eval "$(dbus-launch --sh-syntax)"
-    echo "$DBUS_SESSION_BUS_PID" > dbus-launch.pid
-
     echo "The interface is initially disconnected"
     snap interfaces -i calendar-service | MATCH -- '- +test-snapd-eds:calendar-service'
     if [ "$(snap debug confinement)" = strict ]; then
-      not test-snapd-eds.calendar list test-calendar
+      not tests.session -u test exec test-snapd-eds.calendar list test-calendar
     fi
 
     echo "When the plug is connected, we can add events to calendars"
     snap connect test-snapd-eds:calendar-service
-    test-snapd-eds.calendar load test-calendar << EOF
+    tests.session -u test exec test-snapd-eds.calendar load test-calendar << EOF
     BEGIN:VEVENT
     UID:19970610T172345Z-AF23B2@example.com
     DTSTAMP:19970610T172345Z
@@ -65,7 +60,7 @@
 
     echo "We can also retrieve those contacts"
     # Filter out creation/modification date fields, which are unpredictable
-    test-snapd-eds.calendar list test-calendar | sed -E 's/^(CREATED|LAST-MODIFIED):.*/\1:.../' > /tmp/calendar.ics
+    tests.session -u test exec test-snapd-eds.calendar list test-calendar | sed -E 's/^(CREATED|LAST-MODIFIED):.*/\1:.../' > /tmp/calendar.ics
     diff -uw - /tmp/calendar.ics << EOF
     BEGIN:VEVENT
     UID:19970610T172345Z-AF23B2@example.com
@@ -80,4 +75,4 @@
     EOF
 
     echo "Finally, remove the calendar we created"
-    test-snapd-eds.calendar remove test-calendar
+    tests.session -u test exec test-snapd-eds.calendar remove test-calendar
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cli/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-cli/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cli/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cli/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,11 +6,8 @@
     PLUG: network
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap with the $PLUG plug is installed"
-    install_local "$SNAP_NAME"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME"
 
 execute: |
     expected="(?s)Slot +Plug\\n\
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-contacts-service/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-contacts-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-contacts-service/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-contacts-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,13 +1,19 @@
 summary: Ensure that the contacts-service interface works
 
-# Only test on classic systems.  Don't test on Ubuntu 14.04, which
-# does not ship a new enough evolution-data-server.
-# amazon: no need to run this on amazon
-# ubuntu-19.10+: test-snapd-eds is incompatible with eds shipped with the distro
-# arch-linux: test-snapd-eds is incompatible with eds version shipped with the distro
-# opensuse-tumbleweed: test-snapd-eds is incompatible with eds version shipped with the distro
-# fedora-31: test-snapd-eds is incompatible with eds version shipped with the distro
-systems: [-ubuntu-core-*, -ubuntu-14.04-*, -amazon-*, -centos-*, -ubuntu-19.10-*, -ubuntu-20.04-*, -arch-linux-*, -debian-sid-*, -opensuse-tumbleweed-*, -fedora-31-*]
+# TODO: teach snapd about host's EDS support so that the interface can be
+# genuinely unsupported or versioned and tested appropriately.
+systems:
+    - -amazon-*  # no need to run this on amazon
+    - -arch-linux-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -centos-*
+    - -debian-sid-*
+    - -fedora-31-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -fedora-32-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -opensuse-15.2-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -opensuse-tumbleweed-*  # test-snapd-eds is incompatible with eds version shipped with the distro
+    - -ubuntu-14.04-*  # no tests.session support, eds is too old
+    - -ubuntu-2*  # test-snapd-eds is incompatible with eds shipped with the distro
+    - -ubuntu-core-*  # EDS is unsupported on core systems
 
 # fails in autopkgtest environment with:
 # [Wed Aug 15 16:08:23 2018] audit: type=1400
@@ -18,27 +24,11 @@
 # peer_addr="@/tmp/dbus-GZTRALrYYm" peer="unconfined"
 backends: [-autopkgtest]
 
-environment:
-    XDG: /tmp/xdg
-    XDG_CONFIG_HOME: $XDG/config
-    XDG_DATA_HOME: $XDG/share
-    XDG_CACHE_HOME: $XDG/cache
-
-debug: |
-    echo "Output process to see what might write to $XDG"
-    ps uafx
-    echo "Output dbus-session"
-    systemctl status dbus-session || true
-    echo "Show what is in $XDG"
-    ls -alR "$XDG"
-
+prepare: |
+    tests.session -u test prepare
 restore: |
-    echo "Stop dbus session bus and all its children"
-    if systemctl is-active dbus-session; then
-        systemctl stop dbus-session
-    fi
-    rm -rf "$XDG"
-
+    snap remove --purge test-snapd-eds
+    tests.session -u test restore
 execute: |
     if ! snap install --edge test-snapd-eds ; then
         if [ "$SPREAD_SYSTEM" = ubuntu-16.04-64 ]; then
@@ -48,22 +38,16 @@
         echo "SKIP: test-snapd-eds not available"
         exit 0
     fi
-    mkdir -p "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME"
-
-    echo "Setting up D-Bus session bus in a systemd unit"
-    systemd-run --unit=dbus-session --property=Type=forking -r /bin/sh -c "XDG_CONFIG_HOME=$XDG_CONFIG_HOME XDG_DATA_HOME=$XDG_DATA_HOME XDG_CACHE_HOME=$XDG_CACHE_HOME dbus-launch --sh-syntax > /tmp/dbus-sh"
-    retry-tool -n 20 test -e /tmp/dbus-sh
-    eval "$(cat /tmp/dbus-sh)"
 
     echo "The interface is initially disconnected"
     snap interfaces -i contacts-service | MATCH -- '- +test-snapd-eds:contacts-service'
     if [ "$(snap debug confinement)" = strict ]; then
-      not test-snapd-eds.contacts list test-address-book
+      not tests.session -u test exec test-snapd-eds.contacts list test-address-book
     fi
 
     echo "When the plug is connected, we can add contacts to address books"
     snap connect test-snapd-eds:contacts-service
-    test-snapd-eds.contacts load test-address-book << EOF
+    tests.session -u test exec test-snapd-eds.contacts load test-address-book << EOF
     BEGIN:VCARD
     VERSION:3.0
     FN:Fred Smith
@@ -74,7 +58,7 @@
 
     echo "We can also retrieve those contacts"
     # Filter out ID and revision, which are unpredictable
-    test-snapd-eds.contacts list test-address-book | sed -E 's/^(UID|REV):.*/\1:.../' > /tmp/contacts.vcf
+    tests.session -u test exec test-snapd-eds.contacts list test-address-book | sed -E 's/^(UID|REV):.*/\1:.../' > /tmp/contacts.vcf
     diff -uw - /tmp/contacts.vcf << EOF
     BEGIN:VCARD
     VERSION:3.0
@@ -87,4 +71,4 @@
     EOF
 
     echo "Finally, remove the address book we created"
-    test-snapd-eds.contacts remove test-address-book
+    tests.session -u test exec test-snapd-eds.contacts remove test-address-book
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-content-mimic/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-content-mimic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-content-mimic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-content-mimic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,10 +11,8 @@
     SLOT: test-snapd-content-mimic-slot:content
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-content-mimic-plug
-    install_local test-snapd-content-mimic-slot
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-mimic-plug
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-mimic-slot
 
 execute: |
     # Before the content interface is connected we expect to see certain files
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-content-mkdir-writable/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-content-mkdir-writable/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-content-mkdir-writable/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-content-mkdir-writable/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -23,17 +23,10 @@
 prepare: |
     # Install a pair of snaps that both have two content interfaces as
     # sub-directories of $SNAP_DATA and $SNAP_COMMON.
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-content-advanced-plug
-    install_local test-snapd-content-advanced-slot
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-advanced-plug
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-advanced-slot
 
 execute: |
-    # Put our internal tools on PATH so that we can call snap-discard-ns easily.
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB"/dirs.sh
-    PATH=$LIBEXECDIR/snapd:$PATH
-
     # Test that initially there are no mount points on the plug side (because
     # nothing is connected). All of the plug side target directories are
     # created dynamically when the corresponding content interface connects.
@@ -61,8 +54,8 @@
     # snap-update-ns is invoked from snapd is easier than the one when
     # snap-confine invokes it to do the initial setup. We are testing the
     # initial setup here.
-    snap-discard-ns test-snapd-content-advanced-plug
-    snap-discard-ns test-snapd-content-advanced-slot
+    snapd.tool exec snap-discard-ns test-snapd-content-advanced-plug
+    snapd.tool exec snap-discard-ns test-snapd-content-advanced-slot
 
     # Connect the plug to the slot. This should just write the mount profiles
     # to disk as we just have discarded the namespaces so there is nothing to
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cups/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-cups/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cups/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cups/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,66 @@
+summary: Ensure that the cups interfaces work with app providers
+
+systems: [ubuntu-*]
+
+details: |
+    A snap providing the cups-control and cups interfaces should be able to
+    create the control socket, with connecting consuming snaps able to use it.
+    This intentionally does not test the mediation properties of the cupsd
+    server.
+
+prepare: |
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-provider
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-consumer
+
+    if [ -e /run/cups ]; then
+        mv /run/cups /run/cups.orig
+    fi
+    mkdir -m 0755 /run/cups
+
+restore: |
+    snap remove --purge test-snapd-provider
+    rm -f ./test-snapd-provider_1_all.snap
+    snap remove --purge test-snapd-consumer
+    rm -f ./test-snapd-consumer_1_all.snap
+
+    rm -rf /run/cups
+    if [ -e /run/cups.orig ]; then
+        mv /run/cups.orig /run/cups
+    fi
+
+execute: |
+    # The provider can create the socket and any other files
+    test-snapd-provider.sh -c "echo slot > /run/cups/cups.sock"
+    test-snapd-provider.sh -c "echo slot > /run/cups/other"
+
+    # The consumer's interface is not auto-connected
+    not test-snapd-consumer.cups-control -c "head /run/cups/cups.sock"
+    not test-snapd-consumer.cups -c "head /run/cups/cups.sock"
+
+    # The cups-control interface works as expected
+    snap connect test-snapd-consumer:cups-control test-snapd-provider:cups-control
+    # plug can't access arbitrary files
+    not test-snapd-consumer.cups-control -c "head /run/cups/other"
+    # plug can write to the socket
+    test-snapd-consumer.cups-control -c "echo cups-control-plug > /run/cups/cups.sock"
+    test-snapd-provider.sh -c "cat /run/cups/cups.sock" | MATCH cups-control-plug
+    # plug can read from the socket
+    test-snapd-provider.sh -c "echo slot > /run/cups/cups.sock"
+    test-snapd-consumer.cups-control -c "cat /run/cups/cups.sock" | MATCH slot
+    # The cups-control interface can be disconnected
+    snap disconnect test-snapd-consumer:cups-control
+    not test-snapd-consumer.cups-control -c "head /run/cups/cups.sock"
+
+    # The cups interface works as expected
+    snap connect test-snapd-consumer:cups test-snapd-provider:cups
+    # plug can't access arbitrary files
+    not test-snapd-consumer.cups -c "head /run/cups/other"
+    # plug can write to the socket
+    test-snapd-consumer.cups -c "echo cups-plug > /run/cups/cups.sock"
+    test-snapd-provider.sh -c "cat /run/cups/cups.sock" | MATCH cups-plug
+    # plug can read from the socket
+    test-snapd-provider.sh -c "echo slot > /run/cups/cups.sock"
+    test-snapd-consumer.cups -c "cat /run/cups/cups.sock" | MATCH slot
+    # The cups interface can be disconnected
+    snap disconnect test-snapd-consumer:cups
+    not test-snapd-consumer.cups -c "head /run/cups/cups.sock"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-consumer/bin/sh snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-consumer/bin/sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-consumer/bin/sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-consumer/bin/sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+PS1='$ '
+exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-consumer/meta/snap.yaml snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-consumer/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-consumer/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-consumer/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,12 @@
+name: test-snapd-consumer
+version: 1
+architectures: [all]
+apps:
+  cups-control:
+    command: bin/sh
+    plugs:
+    - cups-control
+  cups:
+    command: bin/sh
+    plugs:
+    - cups
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-provider/bin/sh snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-provider/bin/sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-provider/bin/sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-provider/bin/sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+PS1='$ '
+exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-provider/meta/snap.yaml snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-provider/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cups/test-snapd-provider/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cups/test-snapd-provider/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,9 @@
+name: test-snapd-provider
+version: 1
+architectures: [all]
+apps:
+  sh:
+    command: bin/sh
+    slots:
+    - cups-control
+    - cups
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-cups-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-cups-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-cups-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-cups-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -42,11 +42,8 @@
     rm -rf "$HOME"/PDF "$TEST_FILE"
 
 debug: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     systemctl status cups || true
-    get_journalctl_log -u cpus || true
+    "$TESTSTOOLS"/journal-state get-log -u cpus || true
 
 execute: |
     echo "Then the plug is disconnected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-daemon-notify/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-daemon-notify/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-daemon-notify/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-daemon-notify/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,14 +10,9 @@
     to systemd through the notify socket
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-daemon-notify
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-daemon-notify
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "The interface is not connected by default"
     snap interfaces -i daemon-notify | MATCH -- "- +test-snapd-daemon-notify:daemon-notify"
 
@@ -27,11 +22,11 @@
     echo "And the service is stopped"
     snap stop test-snapd-daemon-notify.notify
 
-    denials_before="$(get_journalctl_log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
+    denials_before="$("$TESTSTOOLS"/journal-state get-log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
     echo "Then after we restart the service there are no denials"
     snap start test-snapd-daemon-notify.notify
     for _ in $(seq 10); do
-        denials_after="$(get_journalctl_log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
+        denials_after="$("$TESTSTOOLS"/journal-state get-log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
         if [ "$denials_before" -ne "$denials_after" ]; then
             break
         fi
@@ -50,10 +45,10 @@
     snap stop test-snapd-daemon-notify.notify
 
     echo "Then the snap is not able to send notification messages"
-    denials_before="$(get_journalctl_log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
+    denials_before="$("$TESTSTOOLS"/journal-state get-log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
     snap start test-snapd-daemon-notify.notify
     for _ in $(seq 10); do
-        denials_after="$(get_journalctl_log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
+        denials_after="$("$TESTSTOOLS"/journal-state get-log -u snap.test-snapd-daemon-notify.notify.service | grep -c 'Permission denied' || true)"
         if [ "$denials_before" -ne "$denials_after" ]; then
             break
         fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-dbus/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-dbus/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-dbus/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-dbus/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,46 +1,45 @@
-summary: Ensure that the dbus interface works
+summary: Ensure that the DBus interface works
 
 details: |
-    The dbus interface allows owning a name on DBus public bus.
+    The DBus interface allows owning a name on DBus public bus.
 
-    The test uses two snaps, a provider declaring a dbus slot and a consumer
+    The test uses two snaps, a provider declaring a DBus slot and a consumer
     with a plug with the same attributes as the slot. The provider requests
-    a dbus name and, when the plug is connected, the consumer can call the
+    a DBus name and, when the plug is connected, the consumer can call the
     method exposed by the provider.
 
-environment:
-    DISPLAY: :0
-
-systems: [-ubuntu-core-*]
+systems:
+    - -ubuntu-14.04-*  # no tests.session support
+    - -ubuntu-core-*  # dbus interface disallows unconfined access on core,
+                      # in addition, up until core20 session bus was not supported
+    - -amazon-linux-2-* # session bus is not supported
+    - -centos-7-*       # session bus is not supported
 
 prepare: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-
     echo "Give a snap declaring a dbus slot in installed"
     snap install --beta test-snapd-dbus-provider
 
     echo "And a snap declaring a matching dbus plug is installed"
     snap install --beta test-snapd-dbus-consumer
 
+    tests.session -u test prepare
+
+    # XXX: The pair of snaps in this test communicate over the session bus but
+    # are normal applications that require starting. Instead of using
+    # run-in-the-background hack, use systemd-run to start a session service
+    # wrapping the application. This ensures it has access to the session bus
+    # and that if it forks off any unexpected processes, those are cleaned up
+    # on shutdown.
     echo "And the provider dbus loop is started"
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    start_dbus_unit $SNAP_MOUNT_DIR/bin/test-snapd-dbus-provider.provider
+    tests.session -u test exec systemd-run --user --unit dbus-provider.service test-snapd-dbus-provider.provider
 
 restore: |
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    stop_dbus_unit || true
+    tests.session -u test exec systemctl --user stop dbus-provider.service
+    tests.session -u test restore
 
 execute: |
-    #shellcheck disable=SC2046
-    export $(cat dbus.env)
-
     echo "Then the dbus name is properly reserved by the provider and the method is accessible"
-    while ! dbus-send --print-reply --dest=com.dbustest.HelloWorld /com/dbustest/HelloWorld com.dbustest.HelloWorld.SayHello | MATCH "hello world"; do
-        sleep 1
-    done
+    retry -n 5 --wait 1 sh -c 'tests.session -u test exec dbus-send --print-reply --dest=com.dbustest.HelloWorld /com/dbustest/HelloWorld com.dbustest.HelloWorld.SayHello | MATCH "hello world"'
 
     echo "And plug is disconnected by default"
     snap interfaces -i dbus | MATCH '^- +test-snapd-dbus-consumer:dbus-test'
@@ -49,7 +48,7 @@
     snap connect test-snapd-dbus-consumer:dbus-test test-snapd-dbus-provider:dbus-test
 
     echo "Then the consumer is able to call the provided method"
-    test-snapd-dbus-consumer.dbus-consumer | MATCH "hello world"
+    tests.session -u test exec test-snapd-dbus-consumer.dbus-consumer | MATCH "hello world"
 
     if [ "$(snap debug confinement)" = partial ]; then
         exit 0
@@ -59,7 +58,7 @@
     snap disconnect test-snapd-dbus-consumer:dbus-test test-snapd-dbus-provider:dbus-test
 
     echo "The consumer is not able to access the provided method"
-    if test-snapd-dbus-consumer.dbus-consumer 2> call.error; then
+    if tests.session -u test exec test-snapd-dbus-consumer.dbus-consumer 2> call.error; then
         echo "Expected permission error calling dbus method with disconnected plug"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-desktop/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-desktop/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-desktop/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-desktop/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,11 +6,19 @@
     The test-snapd-desktop snap checks files and dirs are accessible through the
     desktop interface.
 
-systems: [-ubuntu-core-*]
+systems:
+    - -amazon-linux-2-*
+    - -centos-7-*
+    - -ubuntu-14.04-*
+    - -ubuntu-core-*
 
 prepare: |
     echo "Given the desktop snap is installed"
     snap try "$TESTSLIB"/snaps/test-snapd-desktop
+    tests.session -u test prepare
+
+restore: |
+    tests.session -u test restore
 
 execute: |
     dirs="/var/cache/fontconfig /usr/share/icons /usr/share/pixmaps"
@@ -21,9 +29,9 @@
 
     echo "Then the snap is able to desktop files and directories"
     # shellcheck disable=SC2086
-    test-snapd-desktop.check-files $files
+    tests.session -u test exec test-snapd-desktop.check-files $files
     # shellcheck disable=SC2086
-    test-snapd-desktop.check-dirs $dirs
+    tests.session -u test exec test-snapd-desktop.check-dirs $dirs
 
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
@@ -34,7 +42,7 @@
 
     echo "Then the snap is not able to access the desktop files"
     for file in $files; do
-        if test-snapd-desktop.check-files "$file" 2> call.error; then
+        if tests.session -u test exec test-snapd-desktop.check-files "$file" 2> call.error; then
             echo "Expected permission error calling desktop with disconnected plug"
             exit 1
         fi
@@ -43,7 +51,7 @@
 
     echo "Then the snap is not able to access the desktop dirs"
     for dir in $dirs; do
-        if test-snapd-desktop.check-dirs "$dir" 2> call.error; then
+        if tests.session -u test exec test-snapd-desktop.check-dirs "$dir" 2> call.error; then
             echo "Expected permission error calling desktop with disconnected plug"
             exit 1
         fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-desktop-document-portal/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-desktop-document-portal/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-desktop-document-portal/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-desktop-document-portal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,10 +10,7 @@
 systems: [-ubuntu-core-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
-    install_local test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
     snap disconnect test-snapd-desktop:desktop
 
 restore: |
@@ -21,9 +18,6 @@
     rm -f /tmp/check-doc-portal.sh
 
 execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB"/dirs.sh
-
     echo "Create XDG_RUNTIME_DIR for test user"
     USER_RUNTIME_DIR=/run/user/12345
     mkdir -p $USER_RUNTIME_DIR || true
@@ -51,13 +45,13 @@
       MATCH "Permission denied" < check.error
     fi
 
-    "$LIBEXECDIR"/snapd/snap-discard-ns test-snapd-desktop
+    snapd.tool exec snap-discard-ns test-snapd-desktop
 
     echo "With desktop connected, we see confined version"
     snap connect test-snapd-desktop:desktop
     su -l -c "sh /tmp/check-doc-portal.sh" test | MATCH is-confined
 
-    "$LIBEXECDIR"/snapd/snap-discard-ns test-snapd-desktop
+    snapd.tool exec snap-discard-ns test-snapd-desktop
 
     echo "It is not an error if the document portal is missing"
     rm -rf /run/user/12345/*
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-desktop-host-fonts/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-desktop-host-fonts/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-desktop-host-fonts/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-desktop-host-fonts/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,17 +5,24 @@
     covering the user's spoken language, the host system's fonts are
     bind mounted into the sandbox.
 
-systems: [-ubuntu-core-*]
+systems:
+    - -amazon-linux-2-*
+    - -centos-7-*
+    - -ubuntu-14.04-*
+    - -ubuntu-core-*
 
 restore: |
+    tests.session -u test restore
     rm -f /usr/share/fonts/dist-font.txt
     rm -f /usr/local/share/fonts/local-font.txt
-    rm -f "$HOME"/.fonts/user-font1.txt
-    rm -f "$HOME"/.local/share/fonts/user-font2.txt
+    rm -f /home/test/.fonts/user-font1.txt
+    rm -f /home/test/.local/share/fonts/user-font2.txt
     rm -f /var/cache/fontconfig/cache.txt
     rm -f /usr/lib/fontconfig/cache/cache.txt
 
-execute: |
+prepare: |
+    tests.session -u test prepare
+
     echo "Distribution font" > /usr/share/fonts/dist-font.txt
     # this may not exist across all distributions
     mkdir -p /usr/local/share/fonts
@@ -30,38 +37,40 @@
     mkdir -p "$cache_dir"
     echo "Cache file" > "$cache_dir"/cache.txt
 
-    mkdir -p "$HOME"/.fonts
-    echo "User font 1" > "$HOME"/.fonts/user-font1.txt
+    # User directories created via tests.session for correct ownership and SELinux context.
+    tests.session -u test exec mkdir -p /home/test/.fonts
+    echo "User font 1" | tests.session -u test exec tee /home/test/.fonts/user-font1.txt
 
-    mkdir -p "$HOME"/.local/share/fonts
-    echo "User font 2" > "$HOME"/.local/share/fonts/user-font2.txt
+    tests.session -u test exec mkdir -p /home/test/.local/share/fonts
+    echo "User font 2" | tests.session -u test exec tee /home/test/.local/share/fonts/user-font2.txt
 
     echo "Install the test-snapd-desktop snap"
     snap try "$TESTSLIB"/snaps/test-snapd-desktop
 
+execute: |
     echo "The plug is connected by default"
     snap interfaces -i desktop | MATCH ":desktop .*test-snapd-desktop"
 
     echo "Checking access to host /usr/share/fonts"
-    test-snapd-desktop.check-files /usr/share/fonts/dist-font.txt | MATCH "Distribution font"
+    tests.session -u test exec test-snapd-desktop.check-files /usr/share/fonts/dist-font.txt | MATCH "Distribution font"
 
     echo "Checking access to host /usr/local/share/fonts"
-    test-snapd-desktop.check-files /usr/local/share/fonts/local-font.txt | MATCH "Local font"
+    tests.session -u test exec test-snapd-desktop.check-files /usr/local/share/fonts/local-font.txt | MATCH "Local font"
 
-    echo "Checking access to host $cache_dir"
+    echo "Checking access to host cache dir"
     case "$SPREAD_SYSTEM" in
         fedora-*|centos-*|amazon-linux-*|arch-linux-*)
             # system fonts cache is inaccessible due to
             # https://bugs.launchpad.net/snapd/+bug/1877109
-            test-snapd-desktop.sh -c "test ! -e $cache_dir/cache.txt"
+            tests.session -u test exec test-snapd-desktop.sh -c "test ! -e /usr/lib/fontconfig/cache/cache.txt"
             ;;
         *)
-            test-snapd-desktop.check-files "$cache_dir"/cache.txt | MATCH "Cache file"
+            tests.session -u test exec test-snapd-desktop.check-files /var/cache/fontconfig/cache.txt | MATCH "Cache file"
             ;;
     esac
 
     echo "Checking access to host ~/.fonts"
-    test-snapd-desktop.check-files "$HOME"/.fonts/user-font1.txt | MATCH "User font 1"
+    tests.session -u test exec test-snapd-desktop.check-files /home/test/.fonts/user-font1.txt | MATCH "User font 1"
 
     echo "Checking access to host ~/.local/share/fonts"
-    test-snapd-desktop.check-files "$HOME"/.local/share/fonts/user-font2.txt | MATCH "User font 2"
+    tests.session -u test exec test-snapd-desktop.check-files /home/test/.local/share/fonts/user-font2.txt | MATCH "User font 2"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-device-buttons/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-device-buttons/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-device-buttons/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-device-buttons/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,25 +5,17 @@
     devices.
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
-
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     # Create device files which are going to be used so simulate a real device
     # and input data. In case the device already exists, it is going to be
     # backed up. Devices used following documentation:
     # the https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/devices.txt#L408
-    ensure_file_exists_backup_real /dev/input/event1
+    "$TESTSTOOLS"/fs-state mock-file /dev/input/event1
 
 restore: |
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
     # Delete the created device files and restore backed up files
-    clean_file /dev/input/event1
+    "$TESTSTOOLS"/fs-state restore-file /dev/input/event1
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-dvb/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-dvb/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-dvb/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-dvb/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,25 +4,17 @@
     The dvb interface allows access to all DVB (Digital Video Broadcasting) devices and APIs.
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
-    ensure_dir_exists_backup_real /dev/dvb/adapter9
-    ensure_file_exists_backup_real /dev/dvb/adapter9/video9
-    ensure_file_exists_backup_real /run/udev/data/c212:9
+    "$TESTSTOOLS"/fs-state mock-dir /dev/dvb/adapter9
+    "$TESTSTOOLS"/fs-state mock-file /dev/dvb/adapter9/video9
+    "$TESTSTOOLS"/fs-state mock-file /run/udev/data/c212:9
 
 restore: |
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
     # Delete the created device files and restore backed up files
-    clean_file /run/udev/data/c212:9
-    clean_file /dev/dvb/adapter9/video9
-    clean_dir /dev/dvb/adapter9
+    "$TESTSTOOLS"/fs-state restore-file /run/udev/data/c212:9
+    "$TESTSTOOLS"/fs-state restore-file /dev/dvb/adapter9/video9
+    "$TESTSTOOLS"/fs-state restore-dir /dev/dvb/adapter9
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-firewall-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-firewall-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-firewall-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-firewall-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Ensure that the firewall-control interface works.
 
-systems: [-fedora-*, -opensuse-*, -arch-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-fedora-*, -opensuse-*, -arch-*, -ubuntu-14.04*]
 
 details: |
     The firewall-control interface allows a snap to configure the firewall.
@@ -17,27 +18,18 @@
 
 environment:
     PORT: 8081
-    SERVICE_FILE: "./service.sh"
     SERVICE_NAME: "test-service"
     REQUEST_FILE: "./request.txt"
     DESTINATION_IP: "172.26.0.15"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
     echo "Given a snap declaring a plug on the firewall-control interface is installed"
-    install_local firewall-control-consumer
+    "$TESTSTOOLS"/snaps-state install-local firewall-control-consumer
 
     echo "And a service is listening"
-    printf '#!/bin/sh -e\nwhile true; do echo "HTTP/1.1 200 OK\n\nok\n" |  nc -l -p %s -w 1; done' "$PORT" > "$SERVICE_FILE"
-    chmod a+x "$SERVICE_FILE"
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-    #shellcheck disable=SC2153
-    systemd_create_and_start_unit "$SERVICE_NAME" "$(readlink -f "$SERVICE_FILE")"
     # shellcheck source=tests/lib/network.sh
     . "$TESTSLIB"/network.sh
-    wait_listen_port "$PORT"
+    make_network_service "$SERVICE_NAME" "$PORT"
 
     echo "And we store a basic HTTP request"
     cat > "$REQUEST_FILE" <<EOF
@@ -46,11 +38,8 @@
     EOF
 
 restore: |
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-    #shellcheck disable=SC2153
-    systemd_stop_and_destroy_unit "$SERVICE_NAME"
-    rm -f "$SERVICE_FILE" "$REQUEST_FILE"
+    systemctl stop "$SERVICE_NAME"
+    rm -f "$REQUEST_FILE"
 
 execute: |
     echo "Then the plug is disconnected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-fuse-support/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-fuse-support/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-fuse-support/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-fuse-support/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -24,7 +24,7 @@
     NAME/parallel: test-snapd-fuse-consumer_foo
 
 prepare: |
-    if not mountinfo-tool /sys/fs/fuse/connections .fs_type=fusectl; then
+    if not mountinfo.query /sys/fs/fuse/connections .fs_type=fusectl; then
         touch please-unmount-fuse-connections
     fi
 
@@ -50,7 +50,7 @@
         snap set system experimental.parallel-instances=null
     fi
     if [ -e please-unmount-fuse-connections ]; then
-        if mountinfo-tool /sys/fs/fuse/connections .fs_type=fusectl; then
+        if mountinfo.query /sys/fs/fuse/connections .fs_type=fusectl; then
             umount /sys/fs/fuse/connections
         fi
         rm -f please-unmount-fuse-connections
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-fwupd-classic/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-fwupd-classic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-fwupd-classic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-fwupd-classic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -14,11 +14,8 @@
 prepare: |
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install the test-snapd-fwupd" interface
-    install_local test-snapd-fwupd
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-fwupd
 
     echo "The fwupd plug is disconnected by default"
     snap connections test-snapd-fwupd | MATCH "fwupd +test-snapd-fwupd:fwupd +- +-"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-gpg-keys/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-gpg-keys/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-gpg-keys/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-gpg-keys/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -12,9 +12,7 @@
     TESTKEY: "$HOME/.gnupg/testkey"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     if [ -d "$KEYSDIR" ]; then
         cp -rf "$KEYSDIR" "$KEYSDIR".old
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-gpg-public-keys/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-gpg-public-keys/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-gpg-public-keys/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-gpg-public-keys/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -13,9 +13,7 @@
     CONFIG: "$HOME/.gnupg/gpg.conf"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     if [ -d "$KEYSDIR" ]; then
         cp -rf "$KEYSDIR" "$KEYSDIR".old
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-hardware-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-hardware-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-hardware-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-hardware-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,11 +10,8 @@
     A snap declaring a plug on this interface must be able to read files in /sys/{block,bus,class,devices}
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring a plug on the hardware-observe interface is installed"
-    install_local hardware-observe-consumer
+    "$TESTSTOOLS"/snaps-state install-local hardware-observe-consumer
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-hardware-random-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-hardware-random-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-hardware-random-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-hardware-random-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,11 +15,8 @@
 systems: [-debian-*, -arch-*, -amazon-*, -centos-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring a plug on the hardware-random-control interface is installed"
-    install_local test-snapd-hardware-random-control
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-hardware-random-control
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-hardware-random-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-hardware-random-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-hardware-random-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-hardware-random-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,11 +15,8 @@
 systems: [-debian-*, -arch-*, -amazon-*, -centos-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring a plug on the hardware-random-observe interface is installed"
-    install_local test-snapd-hardware-random-observe
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-hardware-random-observe
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-home/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-home/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-home/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-home/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -17,11 +17,8 @@
     HIDDEN_READABLE_FILE: "$HOME/.readable"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring the home plug is installed"
-    install_local home-consumer
+    "$TESTSTOOLS"/snaps-state install-local home-consumer
 
     echo "And there is a readable file in HOME"
     echo ok > "$READABLE_FILE"
@@ -36,10 +33,7 @@
     rm -f "$READABLE_FILE" "$WRITABLE_FILE" "$CREATABLE_FILE" "$HIDDEN_READABLE_FILE"
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
-    if is_core_system; then
+    if os.query is-core; then
         echo "The interface is not connected by default"
         snap interfaces -i home | MATCH '^- +home-consumer:home'
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-hooks/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-hooks/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-hooks/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-hooks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,13 +5,11 @@
     PRODUCER_DATA: /var/snap/basic-iface-hooks-producer/common
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
     snap install --devmode jq
 
     echo "Install test hooks snaps"
-    install_local basic-iface-hooks-consumer
-    install_local basic-iface-hooks-producer
+    "$TESTSTOOLS"/snaps-state install-local basic-iface-hooks-consumer
+    "$TESTSTOOLS"/snaps-state install-local basic-iface-hooks-producer
 
 restore: |
     rm -f "$CONSUMER_DATA/prepare-plug-consumer-done"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-hostname-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-hostname-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-hostname-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-hostname-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,14 +5,9 @@
 
 prepare: |
     echo "Install test hostname-control snap"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     hostname="$(hostname)"
 
     echo "The plug is disconnected by default"
@@ -26,7 +21,7 @@
     [ "$hostname" = "$snap_hostname" ]
 
     # On core systems /etc/hostname is not writable
-    if is_classic_system; then
+    if os.query is-classic; then
         echo "And the /etc/hostname file can be written"
         test-snapd-sh.with-hostname-control-plug -c "echo $hostname > /etc/hostname"
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-iio/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-iio/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-iio/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-iio/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,50 +0,0 @@
-summary: Check that IIO device nodes are accessible through an interface
-
-details: |
-    This test makes sure that a snap using the IIO interface can access
-    devices nodes exposed by a slot properly.
-
-    It modifies the core snap to provide a iio slot. The actual iio device
-    node is served as a plain file with static text content. The test expects
-    that, after a snap declared a iio plug is installed and connected, it can
-    access the node and read/write its content.
-
-systems: [ubuntu-core-16-64]
-
-prepare: |
-    if [ "$TRUST_TEST_KEYS" = "false" ]; then
-        echo "This test needs test keys to be trusted"
-        exit
-    fi
-
-    # Mock IIO device node and give it some content we can verify
-    # the test snap can read.
-    echo "iio-0" > /dev/iio:device0
-
-    echo "Given a snap declaring a plug on iio is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local iio-consumer
-
-    echo "And the iio plug is connected"
-    snap connect iio-consumer:iio core:iio0
-
-restore: |
-    if [ "$TRUST_TEST_KEYS" = "false" ]; then
-        echo "This test needs test keys to be trusted"
-        exit
-    fi
-    rm -f /dev/iio:device0
-
-execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB"/dirs.sh
-
-    if [ "$TRUST_TEST_KEYS" = "false" ]; then
-        echo "This test needs test keys to be trusted"
-        exit
-    fi
-    test "$($SNAP_MOUNT_DIR/bin/iio-consumer.read)" = "iio-0"
-
-    $SNAP_MOUNT_DIR/bin/iio-consumer.write "hello"
-    test "$($SNAP_MOUNT_DIR/bin/iio-consumer.read)" = "hello"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-joystick/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-joystick/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-joystick/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-joystick/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,31 +4,23 @@
     The joystick interface allows reading and writing to joystick devices.
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
-
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     # Create device files which are going to be used so simulate a real device and input data
     # In case the device already exists, it is going to be backed up
     # Devices used following documentation:
     # the https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/devices.txt#L408
-    ensure_file_exists_backup_real /dev/input/js31
-    ensure_file_exists_backup_real /run/udev/data/c13:31
-    ensure_file_exists_backup_real /run/udev/data/c13:67
-    ensure_file_exists_backup_real /dev/input/event67
+    "$TESTSTOOLS"/fs-state mock-file /dev/input/js31
+    "$TESTSTOOLS"/fs-state mock-file /run/udev/data/c13:31
+    "$TESTSTOOLS"/fs-state mock-file /run/udev/data/c13:67
+    "$TESTSTOOLS"/fs-state mock-file /dev/input/event67
 
 restore: |
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
     # Delete the created device files and restore backed up files
-    clean_file /dev/input/js31
-    clean_file /run/udev/data/c13:31
-    clean_file /run/udev/data/c13:67
-    clean_file /dev/input/event67
+    "$TESTSTOOLS"/fs-state restore-file /dev/input/js31
+    "$TESTSTOOLS"/fs-state restore-file /run/udev/data/c13:31
+    "$TESTSTOOLS"/fs-state restore-file /run/udev/data/c13:67
+    "$TESTSTOOLS"/fs-state restore-file /dev/input/event67
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-juju-client-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-juju-client-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-juju-client-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-juju-client-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,23 +7,15 @@
 systems: [-ubuntu-core-*]
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
-    ensure_dir_exists_backup_real "$HOME"/.local/share/juju
-    ensure_file_exists_backup_real "$HOME"/.local/share/juju/juju.conf
+    "$TESTSTOOLS"/fs-state mock-dir "$HOME"/.local/share/juju
+    "$TESTSTOOLS"/fs-state mock-file "$HOME"/.local/share/juju/juju.conf
 
 restore: |
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
     # Delete the created juju dir and configuration files
-    clean_file "$HOME"/.local/share/juju/juju.conf
-    clean_dir "$HOME"/.local/share/juju
+    "$TESTSTOOLS"/fs-state restore-file "$HOME"/.local/share/juju/juju.conf
+    "$TESTSTOOLS"/fs-state restore-dir "$HOME"/.local/share/juju
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-kvm/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-kvm/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-kvm/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-kvm/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     The kvm interface allows read/write access to kvm.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-kvm
 
     if [ -e /dev/kvm ]; then
         mv /dev/kvm /dev/kvm.bak
@@ -26,24 +24,27 @@
 
 execute: |
     echo "The interface is not connected by default"
-    snap interfaces -i kvm | MATCH '^- +test-snapd-sh:kvm'
+    snap interfaces -i kvm | MATCH '^- +test-snapd-kvm:kvm'
 
     echo "When the interface is connected"
-    snap connect test-snapd-sh:kvm
+    snap connect test-snapd-kvm:kvm
+
+    echo "The module file is present"
+    test -s /etc/modules-load.d/snap.test-snapd-kvm.conf
 
     echo "Then the snap is able to read/write on /dev/kvm"
-    test-snapd-sh.with-kvm-plug -c "cat /dev/kvm"
-    test-snapd-sh.with-kvm-plug -c "echo 'test' >> /dev/kvm"
+    test-snapd-kvm.with-kvm-plug -c "cat /dev/kvm"
+    test-snapd-kvm.with-kvm-plug -c "echo 'test' >> /dev/kvm"
 
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
     fi
 
     echo "When the plug is disconnected"
-    snap disconnect test-snapd-sh:kvm
+    snap disconnect test-snapd-kvm:kvm
 
     echo "Then the snap is not able to read the kvm device"
-    if test-snapd-sh.with-kvm-plug -c "cat /dev/kvm" 2> call.error; then
+    if test-snapd-kvm.with-kvm-plug -c "cat /dev/kvm" 2> call.error; then
         echo "Expected permission error accessing to kvm device"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-kvm/test-snapd-sh/bin/sh snapd-2.48.3+20.04/tests/main/interfaces-kvm/test-snapd-sh/bin/sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-kvm/test-snapd-sh/bin/sh	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-kvm/test-snapd-sh/bin/sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,3 +0,0 @@
-#!/bin/sh
-PS1='$ '
-exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-kvm/test-snapd-sh/meta/snap.yaml snapd-2.48.3+20.04/tests/main/interfaces-kvm/test-snapd-sh/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-kvm/test-snapd-sh/meta/snap.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-kvm/test-snapd-sh/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,8 +0,0 @@
-name: test-snapd-sh
-summary: A no-strings-attached, no-fuss shell for writing tests
-version: 1.0
-
-apps:
-    with-kvm-plug:
-        command: bin/sh
-        plugs: [kvm]
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-locale-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-locale-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-locale-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-locale-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -22,11 +22,8 @@
         fi
     fi
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring a plug on the locale-control interface is installed"
-    install_local locale-control-consumer
+    "$TESTSTOOLS"/snaps-state install-local locale-control-consumer
 
     mv /etc/default/locale locale.back
     cat > /etc/default/locale <<EOF
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-location-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-location-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-location-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-location-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,25 +8,28 @@
     reconnected.
     The snap is also declaring a plug on this interface must be able to ask for its properties.
 
-# dbus-launch not supported in ubuntu-core
 # s390x does not support locationd
-systems: [-ubuntu-core-*, -ubuntu-*-s390x]
+systems:
+    - -amazon-linux-2-* # no session services
+    - -centos-7-* # no session services
+    - -ubuntu-*-s390x # no support for locationd
+    - -ubuntu-14.04-* # no tests.session support
+    - -ubuntu-core-* # no session services (except for core20+)
 
 prepare: |
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
     echo "Given a snap declaring a plug on the location-control interface is installed"
     snap install test-snapd-location-control-provider
 
     echo "And the provider dbus loop is started"
-    start_dbus_unit $SNAP_MOUNT_DIR/bin/test-snapd-location-control-provider.provider
+    # XXX: The provider is not a service so we have to start it manually.  It
+    # attaches to the system bus so it just goes into a systemd service and not
+    # via tests.session.
+    systemd-run --unit test-snapd-location-control-provider.service test-snapd-location-control-provider.provider
+    tests.session -u test prepare
 
 restore: |
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    stop_dbus_unit
+    systemctl stop test-snapd-location-control-provider.service
+    tests.session -u test restore
 
 execute: |
     echo "The interface is not connected by default"
@@ -36,16 +39,10 @@
     snap connect test-snapd-location-control-provider:location-control test-snapd-location-control-provider:location-control-test
 
     echo "Then wait until the dbus name is properly reserved"
-    for _ in $(seq 10); do
-        if test-snapd-location-control-provider.consumer Get | MATCH "location-provider-added"; then
-            break
-        else
-            sleep 1
-        fi
-    done
+    retry -n 10 --wait 1 sh -c 'tests.session -u test exec test-snapd-location-control-provider.consumer Get | MATCH "location-provider-added"'
 
     echo "Check the location-control is working from the consumer app in the snap"
-    test-snapd-location-control-provider.consumer Get | MATCH "location-provider-added"
+    tests.session -u test exec test-snapd-location-control-provider.consumer Get | MATCH "location-provider-added"
 
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
@@ -55,7 +52,7 @@
     snap disconnect test-snapd-location-control-provider:location-control test-snapd-location-control-provider:location-control-test
 
     echo "And the location provider props cannot be accessed"
-    if test-snapd-location-control-provider.consumer Get 2> getprop.error; then
+    if tests.session -u test exec test-snapd-location-control-provider.consumer Get 2> getprop.error; then
         echo "Expected permission error trying to get props with disconnected plug"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-log-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-log-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-log-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-log-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -13,11 +13,8 @@
     PLUG: log-observe
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring the $PLUG plug is installed"
-    install_local log-observe-consumer
+    "$TESTSTOOLS"/snaps-state install-local log-observe-consumer
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-many-core-provided/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-many-core-provided/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-many-core-provided/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-many-core-provided/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -28,26 +28,26 @@
     CONSUMER_SNAP: test-snapd-policy-app-consumer
 
 debug: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     # get the full journal to see any out-of-memory errors
     # shellcheck disable=SC2119
-    get_journalctl_log
+    "$TESTSTOOLS"/journal-state get-log
+
+prepare: |
+    echo "Given a snap is installed"
+    "$TESTSTOOLS"/snaps-state install-local "$CONSUMER_SNAP"
+
+    # If possible, prepare a session for the test user. On many systems this
+    # will allow running all tests as the unprivileged user. This shields us
+    # from accidentally triggering any additional processes from run in the
+    # session of the root user and stay behind after this test terminates.
+    if tests.session has-session-systemd-and-dbus; then
+        tests.session -u test prepare
+    fi
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
 
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-    
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
-    echo "Given a snap is installed"
-    install_local "$CONSUMER_SNAP"
-
     echo "For each core-provided slot"
     for plugcmd in "$SNAP_MOUNT_DIR"/bin/"$CONSUMER_SNAP".* ; do
         plugcmd_bn=$(basename "$plugcmd")
@@ -82,9 +82,28 @@
         snap interfaces | MATCH "$CONNECTED_PATTERN"
 
         echo "Then $plugcmd should succeed"
-        "$plugcmd" | MATCH PASS
+        if tests.session has-session-systemd-and-dbus; then
+            tests.session -u test exec "$plugcmd" | MATCH PASS
+        else
+            # If we cannot run the plug command as the test user, in the
+            # relative safety of the user session which gets torn down, then
+            # run the test directly EXCEPT when testing the desktop interface.
+            #
+            # The desktop interface causes, at minimum, XDG document portal to
+            # activate in the root users's session, which is not cleaned up.
+            # Since that interface will only be used in a real session, leaving
+            # it out is acceptable.
+            if [ "$plugcmd" != "${CONSUMER_SNAP}.desktop" ]; then
+                "$plugcmd" | MATCH PASS
+            else
+                echo "skipping $plugcmd on an unsupported system"
+            fi
+        fi
     done
 
 restore: |
     # Remove the snaps to avoid timeout in next test
     snap remove --purge "$CONSUMER_SNAP"
+    if tests.session has-session-systemd-and-dbus; then
+        tests.session -u test restore
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-many-snap-provided/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-many-snap-provided/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-many-snap-provided/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-many-snap-provided/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -28,30 +28,22 @@
     CONSUMER_SNAP: test-snapd-policy-app-consumer
 
 debug: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     # get the full journal to see any out-of-memory errors
     # shellcheck disable=SC2119
-    get_journalctl_log
+    "$TESTSTOOLS"/journal-state get-log
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
 
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-
     PROVIDER_SNAP="test-snapd-policy-app-provider-classic"    
-    if is_core_system; then
+    if os.query is-core; then
         PROVIDER_SNAP="test-snapd-policy-app-provider-core"
     fi
 
     echo "Given a snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local "$PROVIDER_SNAP"
-    install_local "$CONSUMER_SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$PROVIDER_SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$CONSUMER_SNAP"
 
     echo "For each snap-provided slot from $PROVIDER_SNAP"
     for slotcmd in "$SNAP_MOUNT_DIR"/bin/"$PROVIDER_SNAP".* ; do
@@ -77,12 +69,9 @@
     done
 
 restore: |
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-    
     # Remove the snaps to avoid timeout in next test
     PROVIDER_SNAP="test-snapd-policy-app-provider-classic"    
-    if is_core_system; then
+    if os.query is-core; then
         PROVIDER_SNAP="test-snapd-policy-app-provider-core"
     fi
     snap remove --purge "$PROVIDER_SNAP"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-mount-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-mount-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-mount-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-mount-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -12,11 +12,8 @@
     is also shown when the plug is connected.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring a plug on the mount-observe interface is installed"
-    install_local mount-observe-consumer
+    "$TESTSTOOLS"/snaps-state install-local mount-observe-consumer
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
@@ -36,9 +33,7 @@
     snap connect mount-observe-consumer:mount-observe
 
     echo "And a new mount is created"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "Then the new mount info is reachable"
     expected="$SNAP_MOUNT_DIR/test-snapd-sh"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-netlink-audit/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-netlink-audit/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-netlink-audit/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-netlink-audit/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,11 +9,8 @@
 systems: [-ubuntu-14.04-*, -arch-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     # Install a snap declaring a plug on netlink-audit
-    install_local test-snapd-netlink-audit
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-netlink-audit
 
 execute: |
     echo "The interface is disconnected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-netlink-connector/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-netlink-connector/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-netlink-connector/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-netlink-connector/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,11 +6,8 @@
     The test-snapd-netlink-connector snap creates a netlink socket and binds it. 
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     # Install a snap declaring a plug on netlink-connector
-    install_local test-snapd-netlink-connector
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-netlink-connector
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,32 +10,25 @@
     A snap declaring a plug on this interface must be able to access network services.
 
 # amazon: uses nmap-netcat
-systems: [-fedora-*, -opensuse-*, -amazon-*, -centos-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-fedora-*, -opensuse-*, -amazon-*, -centos-*, -ubuntu-14.04*]
 
 environment:
     SNAP_NAME: network-consumer
     PORT: 8081
-    SERVICE_FILE: "./service.sh"
     SERVICE_NAME: "test-service"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
     echo "Given a snap declaring the network plug is installed"
-    install_local "$SNAP_NAME"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME"
 
     echo "And a service is listening"
     # shellcheck source=tests/lib/network.sh
     . "$TESTSLIB"/network.sh
-    make_network_service "$SERVICE_NAME" "$SERVICE_FILE" "$PORT"
+    make_network_service "$SERVICE_NAME" "$PORT"
 
 restore: |
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
-    #shellcheck disable=SC2153
-    systemd_stop_and_destroy_unit "$SERVICE_NAME"
+    systemctl stop "$SERVICE_NAME"
 
 execute: |
     echo "The interface is connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-bind/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-bind/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-bind/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-bind/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,11 +15,8 @@
     REQUEST_FILE: ./request.txt
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring the network-bind plug is installed"
-    install_local "$SNAP_NAME"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME"
 
     echo "Given the snap's service is listening"
     # shellcheck source=tests/lib/network.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Ensure that the network-control interface works.
 
-systems: [-fedora-*, -opensuse-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-fedora-*, -opensuse-*, -ubuntu-14.04*]
 
 details: |
     The network-control interface allows a snap to configure networking.
@@ -15,31 +16,23 @@
 
 environment:
     PORT: 8081
-    SERVICE_FILE: "./service.sh"
     SERVICE_NAME: "test-service"
     ARP_ENTRY_ADDR: "30.30.30.30"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
     echo "Given a snap declaring a plug on the network-control interface is installed"
-    install_local network-control-consumer
+    "$TESTSTOOLS"/snaps-state install-local network-control-consumer
 
     echo "And a network service is up"
     # shellcheck source=tests/lib/network.sh
     . "$TESTSLIB"/network.sh
-    make_network_service "$SERVICE_NAME" "$SERVICE_FILE" "$PORT"
+    make_network_service "$SERVICE_NAME" "$PORT"
 
 restore: |
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
     #shellcheck source=tests/lib/network.sh
     . "$TESTSLIB/network.sh"
 
-    #shellcheck disable=SC2153
-    systemd_stop_and_destroy_unit "$SERVICE_NAME"
+    systemctl stop "$SERVICE_NAME"
     arp -d "$ARP_ENTRY_ADDR" -i "$(get_default_iface)" || true
 
     ip netns delete test-ns || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-control-tuntap/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-control-tuntap/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-control-tuntap/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-control-tuntap/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,11 +18,8 @@
     DEV/tap: tap255
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Given a snap declaring a plug on the network-control interface is installed"
-    install_local test-snapd-tuntap
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tuntap
 
 execute: |
     #shellcheck source=tests/lib/network.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Ensure that the network-observe interface works
 
-systems: [-fedora-*, -opensuse-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-fedora-*, -opensuse-*, -ubuntu-14.04*]
 
 details: |
     The network-observe interface allows a snap to query the network status information.
@@ -14,29 +15,19 @@
 
 environment:
     PORT: 8081
-    SERVICE_FILE: "./service.sh"
     SERVICE_NAME: "test-service"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-
     echo "Given a snap declaring a plug on the network-observe interface is installed"
-    install_local network-observe-consumer
+    "$TESTSTOOLS"/snaps-state install-local network-observe-consumer
 
     echo "And a network service is up"
     # shellcheck source=tests/lib/network.sh
     . "$TESTSLIB"/network.sh
-    make_network_service "$SERVICE_NAME" "$SERVICE_FILE" "$PORT"
+    make_network_service "$SERVICE_NAME" "$PORT"
 
 restore: |
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB/systemd.sh"
-
-    #shellcheck disable=SC2153
-    systemd_stop_and_destroy_unit "$SERVICE_NAME"
+    systemctl stop "$SERVICE_NAME"
 
 execute: |
     echo "The interface is disconnected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-setup-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-setup-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-setup-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-setup-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,9 +7,7 @@
 systems: [-ubuntu-core-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 restore: |
     rm -f /etc/network/test001 /etc/network/test002
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-setup-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-setup-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-setup-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-setup-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,9 +5,7 @@
     configuration files.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
     dirs="/etc/netplan /etc/network"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-network-status-classic/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-network-status-classic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-network-status-classic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-network-status-classic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -17,32 +17,25 @@
   - -amazon-linux-2-*
 
 prepare: |
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-
     echo "Start the stub xdg-desktop-portal NetworkMonitor provider"
-    start_dbus_unit ./fake-portal-network-monitor.py
+    # The network-status interface is defined to operate on a session
+    # bus so for most realism, invoke it as the test user.
+    tests.session -u test prepare
+    tests.session -u test exec systemd-run --user --unit test-snapd-network-monitor.service "$(pwd)/fake-portal-network-monitor.py"
 
 restore: |
-    #shellcheck source=tests/lib/dbus.sh
-    . "$TESTSLIB/dbus.sh"
-    stop_dbus_unit
+    tests.session -u test exec systemctl --user stop test-snapd-network-monitor.service
+    tests.session -u test restore
 
 execute: |
-    #shellcheck disable=SC2046
-    export $(cat dbus.env)
-
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install a snap that plugs network-status"
-    install_local test-snapd-network-status-client
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-network-status-client
 
     echo "The network-status plug is connected by default"
     snap connections test-snapd-network-status-client | MATCH "network-status +test-snapd-network-status-client:network-status +:network-status +-"
 
     echo "The snap can access connectivity status"
-    test-snapd-network-status-client.connectivity | MATCH "uint32 4"
+    tests.session -u test exec test-snapd-network-status-client.connectivity | MATCH "uint32 4"
 
     if ! snap debug sandbox-features --required apparmor:kernel:dbus; then
         exit 0
@@ -52,4 +45,4 @@
     snap disconnect test-snapd-network-status-client:network-status
 
     echo "The connectivity status can no longer be accessed"
-    not test-snapd-network-status-client.connectivity
+    not tests.session -u test exec test-snapd-network-status-client.connectivity
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-opengl-nvidia/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-opengl-nvidia/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-opengl-nvidia/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-opengl-nvidia/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -94,10 +94,8 @@
 execute: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
 
-    install_local test-snapd-policy-app-consumer
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-policy-app-consumer
 
     echo "When the interface is connected"
     snap connect test-snapd-policy-app-consumer:opengl core:opengl
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-password-manager-service/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-password-manager-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-password-manager-service/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-password-manager-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,28 +1,20 @@
 summary: Ensure that the password-manager-service interface works
 
-# Only test on classic systems with AppArmor DBus mediation
-systems: [ ubuntu-1* ]
+systems:
+    - ubuntu-16.04-*
+    - ubuntu-18.04-*
+    - ubuntu-2*
 
 prepare: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
     echo "Ensure we have a working gnome-keyring"
     snap install --edge test-snapd-password-manager-consumer
 
+    tests.session -u test prepare
+
 restore: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
-    if [ -f dbus-launch.pid ]; then
-        kill "$(cat dbus-launch.pid)"
-    fi
+    tests.session -u test restore
 
 execute: |
-    echo "Ensure things run"
-    eval "$(dbus-launch --sh-syntax)"
-    eval "$(printf password|gnome-keyring-daemon --login)"
-    eval "$(gnome-keyring-daemon --start)"
-    echo "$DBUS_SESSION_BUS_PID" > dbus-launch.pid
-
     echo "The interface is disconnected by default"
     snap interfaces -i password-manager-service | MATCH -- '- +test-snapd-password-manager-consumer:password-manager-service'
 
@@ -30,7 +22,7 @@
     snap connect test-snapd-password-manager-consumer:password-manager-service
 
     echo "Then the snap command is able use the libsecret service"
-    test-snapd-password-manager-consumer.secret-tool clear foo bar
+    tests.session -u test exec test-snapd-password-manager-consumer.secret-tool clear foo bar
 
     if [ "$(snap debug confinement)" = "partial" ] ; then
         exit 0
@@ -40,7 +32,7 @@
     snap disconnect test-snapd-password-manager-consumer:password-manager-service
 
     echo "Then the snap command is not able to use the secret-tool"
-    if test-snapd-password-manager-consumer.secret-tool clear foo bar; then
+    if tests.session -u test exec test-snapd-password-manager-consumer.secret-tool clear foo bar; then
         echo "Expected error with plug disconnected"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-personal-files/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-personal-files/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-personal-files/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-personal-files/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,40 +4,32 @@
     The personal-files interface allows access specific personal files or directories.
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
-
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     # Fist layer of dirs and files
-    ensure_file_exists_backup_real /root/.testfile1
-    ensure_file_exists_backup_real /root/testfile1
-    ensure_dir_exists_backup_real /root/.testdir1
-    ensure_dir_exists_backup_real /root/testdir1
+    "$TESTSTOOLS"/fs-state mock-file /root/.testfile1
+    "$TESTSTOOLS"/fs-state mock-file /root/testfile1
+    "$TESTSTOOLS"/fs-state mock-dir /root/.testdir1
+    "$TESTSTOOLS"/fs-state mock-dir /root/testdir1
 
     # Second layer of dirs and files
-    ensure_file_exists_backup_real /root/.testdir1/.testfilé2
-    ensure_file_exists_backup_real "/root/.testdir1/test file2"
-    ensure_dir_exists_backup_real /root/.testdir1/.testdir2
+    "$TESTSTOOLS"/fs-state mock-file /root/.testdir1/.testfile2
+    "$TESTSTOOLS"/fs-state mock-file "/root/.testdir1/test file2"
+    "$TESTSTOOLS"/fs-state mock-dir /root/.testdir1/.testdir2
 
     # Not accessible dirs and files
-    ensure_dir_exists_backup_real /var/tmp/.testdir1
-    ensure_file_exists_backup_real /var/tmp/.testfile1
-    ensure_dir_exists_backup_real /var/tmp/root/
-    ensure_file_exists_backup_real /var/tmp/root/testfile2
-    ensure_file_exists_backup_real /var/tmp/root/.testfile2
+    "$TESTSTOOLS"/fs-state mock-dir /var/tmp/.testdir1
+    "$TESTSTOOLS"/fs-state mock-file /var/tmp/.testfile1
+    "$TESTSTOOLS"/fs-state mock-dir /var/tmp/root
+    "$TESTSTOOLS"/fs-state mock-file /var/tmp/root/testfile2
+    "$TESTSTOOLS"/fs-state mock-file /var/tmp/root/.testfile2
 
 restore: |
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
-    clean_file /root/.testfile1
-    clean_file /root/testfile1
-    clean_dir /root/.testdir1
-    clean_dir /root/testdir1
-    clean_dir /var/tmp/root
+    "$TESTSTOOLS"/fs-state restore-file /root/.testfile1
+    "$TESTSTOOLS"/fs-state restore-file /root/testfile1
+    "$TESTSTOOLS"/fs-state restore-dir /root/.testdir1
+    "$TESTSTOOLS"/fs-state restore-dir /root/testdir1
+    "$TESTSTOOLS"/fs-state restore-dir /var/tmp/root
 
 execute: |
     echo "The interface is not connected by default"
@@ -47,17 +39,17 @@
     snap connect test-snapd-sh:personal-files
 
     echo "Then the snap is able to access all the files and dirs in $HOME"
-    test-snapd-sh.with-personal-files-plug -c "cat /root/.testfile1" | MATCH "content for /root/.testfile1"
-    test-snapd-sh.with-personal-files-plug -c "cat /root/testfile1" | MATCH "content for /root/testfile1"
+    test-snapd-sh.with-personal-files-plug -c "cat /root/.testfile1" | MATCH "mock file"
+    test-snapd-sh.with-personal-files-plug -c "cat /root/testfile1" | MATCH "mock file"
     test-snapd-sh.with-personal-files-plug -c "ls /root/.testdir1"
     test-snapd-sh.with-personal-files-plug -c "ls /root/testdir1"
-    test-snapd-sh.with-personal-files-plug -c "cat /root/.testdir1/.testfilé2" | MATCH "content for /root/.testdir1/.testfilé2"
-    test-snapd-sh.with-personal-files-plug -c "cat '/root/.testdir1/test file2'" | MATCH "content for /root/.testdir1/test file2"
+    test-snapd-sh.with-personal-files-plug -c "cat /root/.testdir1/.testfile2" | MATCH "mock file"
+    test-snapd-sh.with-personal-files-plug -c "cat '/root/.testdir1/test file2'" | MATCH "mock file"
     test-snapd-sh.with-personal-files-plug -c "ls  /root/.testdir1/.testdir2/"
 
     echo "Then the snap is able to write on /root/.testdir1 and /root/.testfile1"
     test-snapd-sh.with-personal-files-plug -c "echo test >> /root/.testfile1"
-    test-snapd-sh.with-personal-files-plug -c "touch /root/.testdir1/testfilé2"
+    test-snapd-sh.with-personal-files-plug -c "touch /root/.testdir1/testfile2"
 
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-physical-memory-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-physical-memory-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-physical-memory-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-physical-memory-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,11 +11,8 @@
 systems: [-ubuntu-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given the physical-memory-observe snap is installed"
-    install_local test-snapd-physical-memory-observe
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-physical-memory-observe
 
 execute: |
     config="/boot/config-$(uname -r)"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-process-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-process-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-process-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-process-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,7 +5,7 @@
     and nice.
 
     A snap which defines the process-control plug must be shown in the interfaces list.
-    The plug must not be autoconnected on install and, as usual, must be able to be
+    The plug must not be auto-connected on install and, as usual, must be able to be
     reconnected.
 
     A snap declaring a plug on this interface must be able to kill other processes. Currently
@@ -13,11 +13,8 @@
     extended later.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a snap declaring a plug on the process-control interface is installed"
-    install_local process-control-consumer
+    "$TESTSTOOLS"/snaps-state install-local process-control-consumer
 
 execute: |
     echo "The interface is disconnected by default"
@@ -27,31 +24,27 @@
     snap connect process-control-consumer:process-control
 
     echo "Then the snap is able to kill an existing process"
-    while :; do sleep 1; done &
+    sleep 5m &
     pid=$!
-    #shellcheck disable=SC2009
-    ps ax | grep -Pq "^ *$pid"
-    process-control-consumer.signal "SIGTERM" $pid
-    #shellcheck disable=SC2009
-    ps ax | not grep -Pq "^ *$pid"
+    kill -s 0 "$pid"
+    process-control-consumer.signal SIGTERM "$pid"
+    not kill -s 0 "$pid"
 
     if [ "$(snap debug confinement)" = partial ] ; then
-        exit 0
+        exit
     fi
 
     echo "When the plug is disconnected"
     snap disconnect process-control-consumer:process-control
 
     echo "Then the snap is not able to kill an existing process"
-    while :; do sleep 1; done &
+    sleep 5m &
     pid=$!
-    if process-control-consumer.signal SIGTERM $pid 2> process-kill.error; then
+    if process-control-consumer.signal SIGTERM "$pid" 2> process-kill.error; then
         echo "Expected permission error accessing killing a process with disconnected plug"
         exit 1
     fi
     grep -q "Permission denied" process-kill.error
-    #shellcheck disable=SC2009
-    ps ax | grep -Pq "^ *$pid"
-    kill -9 $pid
-    #shellcheck disable=SC2009
-    ps ax | not grep -Pq "^ *$pid"
+    kill -s 0 "$pid"
+    kill "$pid"
+    not kill -s 0 "$pid"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-pulseaudio/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-pulseaudio/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-pulseaudio/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-pulseaudio/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,98 +1,110 @@
 summary: Ensure that the pulseaudio interface works
 
-# Classic Ubuntu is sufficient to test the feature
-systems: [ubuntu-1*-*64, ubuntu-2*-*64]
-
-kill-timeout: 3m
+# Only classic Ubuntu has the pulseaudio mediation patches. Ubuntu 14.04 is unsupported on the desktop.
+# TODO: extend tests.session and run this test on 14.04 as well.
+systems: [ubuntu-16.04-*, ubuntu-18.04-*, ubuntu-2*]
 
 environment:
     PLAY_FILE: "/snap/test-snapd-pulseaudio/current/usr/share/sounds/alsa/Noise.wav"
-    PA_TEST_LOG: /home/test/pulseaudio.log
 
 prepare: |
-    # FIXME: This test is broken and should be ported to session-tool, systemd
-    # --user starts pulseaudio for us so we are always racing with it (whoever
-    # acquires the socket file wins).
-    #
-    # To prevent this from breaking this test mask pulseaudio.{socket,service}
-    # in all user sessions.
-    systemctl --user --global mask pulseaudio.{socket,service}
-
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
-    snap install --edge test-snapd-pulseaudio
+    tests.cleanup prepare
 
+    # Install pulseaudio.
     apt-get update
     apt-get install -y pulseaudio pulseaudio-utils
-
-    echo "Create XDG_RUNTIME_DIR=/run/user/12345"
-    # shellcheck disable=SC2174
-    mkdir -m 700 -p /run/user/12345 || true
-    chown test:test /run/user/12345
-
-    # ensure we have a clean pulse directory
-    test -d /home/test/.config && mv /home/test/.config /home/test/.config.spread
-    mkdir -m 700 /home/test/.config
-    mkdir -m 700 /home/test/.config/pulse
-    chown test:test /home/test/.config /home/test/.config/pulse
-
-    # prepare the script for pulseaudio daemon
-    cat <<'EOF' > /home/test/pulse-test.pa
-    .fail
-    load-module module-null-sink sink_name=void
-    set-default-sink void
-    load-module module-native-protocol-unix
-    .ifexists module-snap-policy.so
-    load-module module-snap-policy
-    .endif
-    EOF
-    chown test:test /home/test/pulse-test.pa
-    # make sure there are no running pulseaudio processes owned by the test user
-    pkill -9 --uid 12345 pulseaudio || true
-    # make sure there is no socket
-    rm -f /run/user/12345/pulse/native
-
-restore: |
-    su -l -c "HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345  pulseaudio --kill" test || true
-    snap remove --purge test-snapd-pulseaudio
-    apt-get autoremove --purge -y pulseaudio pulseaudio-utils
-    rm -rf /run/user/12345 /home/test/.config/pulse
-    if [ -d /home/test/.config.spread ]; then
-        rm -rf /home/test/.config
-        mv /home/test/.config.spread /home/test/.config
+    # Remove the package and reload systemd later, when we are restoring. This
+    # is important because of rtkit-daemon.service that gets pulled by
+    # pulseaudio and that is subsequently removed.
+    tests.cleanup defer systemctl daemon-reload
+    tests.cleanup defer apt-get autoremove --purge -y pulseaudio pulseaudio-utils
+
+    # Make sure the socket and the server is available in the user session.
+    if [ "$(systemctl --user --global is-enabled pulseaudio.socket)" != enabled ]; then
+        systemctl --user --global enable pulseaudio.socket
+        tests.cleanup defer systemctl --user --global disable pulseaudio.socket
     fi
-    rm -f /home/test/pulse-test.pa
-    rm -f /run/user/12345/pulse/native
-    rm -f $PA_TEST_LOG
-
-    systemctl --user --global unmask pulseaudio.{socket,service}
-
-debug: |
-    if [ -f $PA_TEST_LOG ]; then
-        cat $PA_TEST_LOG
+    if [ "$(systemctl --user --global is-enabled pulseaudio.service)" != enabled ]; then
+        systemctl --user --global enable pulseaudio.service
+        tests.cleanup defer systemctl --user --global disable pulseaudio.service
     fi
 
-execute: |
-    as_user() {
-        su -l -c "HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 $*" test
-    }
+    # Install a snap that uses the pulseaudio interface.
+    snap install --edge test-snapd-pulseaudio
+    tests.cleanup defer snap remove --purge test-snapd-pulseaudio
 
+    # TODO: move this to the test that is responsible for creating this data.
+    # Remove potentially large go build cache that makes the debug section more
+    # verbose.
+    rm -rf ~test/.cache/go-build
+
+    # TODO: fix the test causing this. Some test is making ~test/.config root-owned,
+    # making it impossible for pulseaudio to start and write the secure cookie file.
+    chown -R test ~test
+
+    # Prepare a session for the user.
+    tests.session -u test prepare
+    tests.cleanup defer tests.session -u test restore
+
+    # Ensure that the socket is active but do not check the service. In user
+    # mode pulseaudio is documented to quit when there are no active logind
+    # sessions.
+    #
+    # User session services do not posses a logind session session so
+    # pulseaudio immediately quits, and remains inactive outside of the moments
+    # we execute paplay through tests.session.
+    tests.session -u test exec systemctl --user is-active pulseaudio.socket | MATCH active
+
+    # Start pulseaudio to give it a chance to write the pulseaudio cookie file.
+    # Otherwise paplay invocation will race with pulse startup, and will race
+    # with cookie file being available.
+    if not tests.session -u test exec systemctl --user start pulseaudio.service; then
+        echo "cannot start pulseaudio server"
+        tests.session -u test exec systemctl --user status pulseaudio.service || true
+        tests.session -u test exec journalctl --user -u pulseaudio.service || true
+        exit 1
+    fi
 
-    echo "Start pulseaudio"
-    as_user "pulseaudio --exit-idle-time=300 -n -F /home/test/pulse-test.pa --log-level=4 --verbose 2>&1 | tee $PA_TEST_LOG >/dev/null" &
-    papid=$!
+    # Ensure, that the cookie file is present.
+    test -e ~test/.config/pulse/cookie || test -e ~test/.config/pulse/.pulse-cookie
+    tests.cleanup defer rm -rf ~test/.config/pulse
+
+    # enable debug logging in pulseaudio
+    cp /etc/pulse/daemon.conf /etc/pulse/daemon.conf.backup
+    echo 'log-level = debug' >> /etc/pulse/daemon.conf
+    tests.cleanup defer mv /etc/pulse/daemon.conf.backup /etc/pulse/daemon.conf
+
+    # disable start limit checking for pulseaudio service
+    mkdir -p /etc/systemd/user/pulseaudio.service.d
+    cat <<-EOF > /etc/systemd/user/pulseaudio.service.d/no-start-limit.conf
+    [Unit]
+    StartLimitBurst=0
+    EOF
+    tests.cleanup defer rm /etc/systemd/user/pulseaudio.service.d/no-start-limit.conf
+    # reload user's systemd instance
+    tests.session -u test exec systemctl daemon-reload --user
 
-    echo "Then wait for the socket to show up"
-    retry-tool -n 10 test -S /run/user/12345/pulse/native
+debug: |
+    echo "Files present in the test user's home directory"
+    test -d /home/test && find /home/test
+    echo "Files present in the test user's home directory, that are owned by root"
+    test -d /home/test && find /home/test -user root
+    echo "Files present in the test user's runtime directory"
+    test -d /home/user/12345 && find /run/user/12345
+    echo "Processes running as the test user"
+    ps -u test
+    echo "Pulseaudio log"
+    tests.session -u test exec journalctl --user -u pulseaudio.service || true
 
-    echo "Check pulseaudio"
-    retry-tool -n 10 su -l -c "HOME=/home/test XDG_RUNTIME_DIR=/run/user/12345 pulseaudio --check" test
+restore: |
+    tests.cleanup restore
 
+execute: |
     echo "The unconfined user can play audio"
-    as_user "PULSE_LOG=4 /usr/bin/paplay $PLAY_FILE"
+    tests.session -u test exec /usr/bin/paplay "$PLAY_FILE"
 
     echo "The unconfined user can record audio"
-    as_user "PULSE_LOG=4 /snap/test-snapd-pulseaudio/current/bin/parec-simple"
+    tests.session -u test exec /snap/test-snapd-pulseaudio/current/bin/parec-simple
 
     echo "The interface is disconnected by default"
     snap connections test-snapd-pulseaudio | MATCH "pulseaudio +test-snapd-pulseaudio:pulseaudio +- +-"
@@ -101,13 +113,10 @@
     snap connect test-snapd-pulseaudio:pulseaudio
 
     echo "Then the snap can play audio"
-    as_user "test-snapd-pulseaudio.play $PLAY_FILE"
+    tests.session -u test exec test-snapd-pulseaudio.play "$PLAY_FILE"
 
     echo "Then the snap can record audio"
-    if ! as_user "test-snapd-pulseaudio.recsimple" ; then
-        echo "Could not record audio"
-        exit 1
-    fi
+    tests.session -u test exec test-snapd-pulseaudio.recsimple
 
     if [ "$(snap debug confinement)" = "partial" ] ; then
         exit 0
@@ -117,11 +126,7 @@
     snap disconnect test-snapd-pulseaudio:pulseaudio
 
     echo "Then the snap command is not able to connect to the pulseaudio socket"
-    if as_user "test-snapd-pulseaudio.play $PLAY_FILE" ; then
+    if tests.session -u test exec test-snapd-pulseaudio.play "$PLAY_FILE"; then
         echo "Expected error with plug disconnected"
         exit 1
     fi
-
-    # make sure it's killed otherwise spread ssh pty is kept busy
-    as_user "pulseaudio --kill" || true
-    kill -9 "$papid" || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-raw-usb/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-raw-usb/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-raw-usb/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-raw-usb/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     The raw-usb interface allows detection and grants access to all connected USB devices.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
     echo "The interface is not connected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-removable-media/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-removable-media/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-removable-media/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-removable-media/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     The removable-media interface allows to access to removable storage filesystems.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     if ! [ -d /media ]; then
         mkdir -p /media
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-shutdown-introspection/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-shutdown-introspection/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-shutdown-introspection/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-shutdown-introspection/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,11 +9,8 @@
     the Introspect method on org.freedesktop.login1.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Given a snap declaring a plug on the shutdown interface is installed"
-    install_local shutdown-introspection-consumer
+    "$TESTSTOOLS"/snaps-state install-local shutdown-introspection-consumer
 
 execute: |
     echo "The interface is disconnected by default"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-snapd-control-with-manage/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-snapd-control-with-manage/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-snapd-control-with-manage/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-snapd-control-with-manage/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 summary: Ensure that the snapd-control "refresh-schedule" attribute works.
 
-# TODO:UC20: enable once we use the canonical model assertion
-systems: [-ubuntu-core-20-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
 
 environment:
   BLOB_DIR: $(pwd)/fake-store-blobdir
@@ -60,9 +60,6 @@
     jq .data.auth.device /var/lib/snapd/state.json
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
         echo "This test needs test keys to be trusted"
         exit
@@ -81,7 +78,7 @@
 
     echo "Then the core refresh.schedule can be set to 'managed'"
     snap set core refresh.schedule=managed
-    if get_journalctl_log -u snapd |grep 'cannot parse "managed"'; then
+    if "$TESTSTOOLS"/journal-state get-log -u snapd |grep 'cannot parse "managed"'; then
         echo "refresh.schedule=managed was not accepted as it should be"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-ssh-keys/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-ssh-keys/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-ssh-keys/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-ssh-keys/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,9 +10,7 @@
     CONFDIR: "/etc/ssh/ssh_config.d/"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     if [ -d "$KEYSDIR" ]; then
         cp -rf "$KEYSDIR" "$KEYSDIR".old
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-ssh-public-keys/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-ssh-public-keys/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-ssh-public-keys/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-ssh-public-keys/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,10 +9,7 @@
     TESTKEY: "/$HOME/.ssh/testkey"
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     if [ -d "$KEYSDIR" ]; then
         cp -rf "$KEYSDIR" "$KEYSDIR".old
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-system-files/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-system-files/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-system-files/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-system-files/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,36 +8,28 @@
     TESTDIR: /mnt/testdir
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
-
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     # Fist layer of dirs and files
-    ensure_dir_exists_backup_real "$TESTDIR"
-    ensure_file_exists_backup_real "$TESTDIR"/.testfile1
-    ensure_file_exists_backup_real "$TESTDIR"/readonly_file1
-    ensure_dir_exists_backup_real "$TESTDIR"/.testdir1
-    ensure_dir_exists_backup_real "$TESTDIR"/testdir1
+    "$TESTSTOOLS"/fs-state mock-dir "$TESTDIR"
+    "$TESTSTOOLS"/fs-state mock-file "$TESTDIR"/.testfile1
+    "$TESTSTOOLS"/fs-state mock-file "$TESTDIR"/readonly_file1
+    "$TESTSTOOLS"/fs-state mock-dir "$TESTDIR"/.testdir1
+    "$TESTSTOOLS"/fs-state mock-dir "$TESTDIR"/testdir1
 
     # Second layer of dirs and files
-    ensure_file_exists_backup_real "$TESTDIR"/.testdir1/.testfilé2
-    ensure_file_exists_backup_real "$TESTDIR/.testdir1/test file2"
-    ensure_dir_exists_backup_real "$TESTDIR"/root
+    "$TESTSTOOLS"/fs-state mock-file "$TESTDIR"/.testdir1/.testfile2
+    "$TESTSTOOLS"/fs-state mock-file "$TESTDIR/.testdir1/test file2"
+    "$TESTSTOOLS"/fs-state mock-dir "$TESTDIR"/root
 
     # Not accessible dirs and files
-    ensure_dir_exists_backup_real /root/.testdir1
-    ensure_file_exists_backup_real /root/.testfile1
+    "$TESTSTOOLS"/fs-state mock-dir /root/.testdir1
+    "$TESTSTOOLS"/fs-state mock-file /root/.testfile1
 
 restore: |
-    # shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB/files.sh"
-
-    clean_dir "$TESTDIR"
-    clean_dir /root/.testdira1
-    clean_dir /root/.testfile1
+    "$TESTSTOOLS"/fs-state restore-dir "$TESTDIR"
+    "$TESTSTOOLS"/fs-state restore-dir /root/.testdir1
+    "$TESTSTOOLS"/fs-state restore-dir /root/.testfile1
 
 execute: |
     echo "The interface is not connected by default"
@@ -47,17 +39,17 @@
     snap connect test-snapd-sh:system-files
 
     echo "Then the snap is able to access all the files and dirs in /testdir"
-    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR/.testfile1" | MATCH "content for $TESTDIR/.testfile1"
-    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR/readonly_file1" MATCH "content for $TESTDIR/readonly_file1"
+    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR/.testfile1" | MATCH "mock file"
+    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR/readonly_file1" MATCH "mock file"
     test-snapd-sh.with-system-files-plug -c "ls $TESTDIR/.testdir1"
     test-snapd-sh.with-system-files-plug -c "ls $TESTDIR/testdir1"
-    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR/.testdir1/.testfilé2" | MATCH "content for $TESTDIR/.testdir1/.testfilé2"
-    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR'/.testdir1/test file2'" | MATCH "content for $TESTDIR/.testdir1/test file2"
+    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR/.testdir1/.testfile2" | MATCH "mock file"
+    test-snapd-sh.with-system-files-plug -c "cat $TESTDIR'/.testdir1/test file2'" | MATCH "mock file"
     test-snapd-sh.with-system-files-plug -c "ls $TESTDIR/root/"
 
     echo "Then the snap is able to write just $TESTDIR/.testdir1 and $TESTDIR/.testfile1"
     test-snapd-sh.with-system-files-plug -c "echo test >> $TESTDIR/.testfile1"
-    test-snapd-sh.with-system-files-plug -c "touch $TESTDIR/.testdir1/testfilé2"
+    test-snapd-sh.with-system-files-plug -c "touch $TESTDIR/.testdir1/testfile2"
 
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-system-packages-doc/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-system-packages-doc/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-system-packages-doc/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-system-packages-doc/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,22 @@
+summary: Ensure that the system-packages-doc interface works.
+systems: [-ubuntu-core-*]
+prepare: |
+    snap pack test-snapd-app
+    snap install --dangerous ./test-snapd-app_1_all.snap
+    mkdir -p /usr/share/doc/system-packages-doc-iface
+    echo text >/usr/share/doc/system-packages-doc-iface/content
+restore: |
+    snap remove --purge test-snapd-app
+    rm -f test-snapd-app_1_all.snap
+    rm -rf /usr/share/doc/system-packages-doc-iface
+execute: |
+    # The interface is not auto-connected
+    not test-snapd-app.sh -c 'test -e /usr/share/doc/system-packages-doc-iface/content'
+
+    # The interface works as expected
+    snap connect test-snapd-app:system-packages-doc
+    test-snapd-app.sh -c 'cat /usr/share/doc/system-packages-doc-iface/content' | MATCH text
+
+    # The interface can be disconnected
+    snap disconnect test-snapd-app:system-packages-doc
+    not test-snapd-app.sh -c 'test -e /usr/share/doc/system-packages-doc-iface/content'
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-system-packages-doc/test-snapd-app/bin/sh snapd-2.48.3+20.04/tests/main/interfaces-system-packages-doc/test-snapd-app/bin/sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-system-packages-doc/test-snapd-app/bin/sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-system-packages-doc/test-snapd-app/bin/sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+PS1='$ '
+exec /bin/sh "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-system-packages-doc/test-snapd-app/meta/snap.yaml snapd-2.48.3+20.04/tests/main/interfaces-system-packages-doc/test-snapd-app/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-system-packages-doc/test-snapd-app/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-system-packages-doc/test-snapd-app/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,7 @@
+name: test-snapd-app
+version: 1
+architectures: [all]
+apps:
+    sh:
+        command: bin/sh
+        plugs: [system-packages-doc]
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-time-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-time-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-time-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-time-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,11 +9,10 @@
 systems: [-opensuse-*,-fedora-*,-ubuntu-core-*,-ubuntu-14.04-*,-*-s390x,-arch-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     # Install a snap declaring a plug on time-control
-    install_local test-snapd-timedate-control-consumer
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-timedate-control-consumer
+
+    date +'%m%d%H%M.%y' > now.txt
 
 restore: |
     # Restore the initial rtc configuration
@@ -21,6 +20,8 @@
         timedatectl set-local-rtc "$(cat rtc.txt)"
     fi
 
+    date "$(cat now.txt)"
+
 execute: |
     # hwclock with libaudit (ie, core 16) also needs netlink-audit connected.
     # This interface is tested elsewhere, so simply connect it here so we can
@@ -51,6 +52,10 @@
     test-snapd-timedate-control-consumer.timedatectl-time set-local-rtc no
     [ "$(test-snapd-timedate-control-consumer.timedatectl-time status | grep -oP 'RTC in local TZ: \K(.*)')" = "no" ]
 
+    echo "And direct setting via date"
+    nice_when="$(date -d 'tomorrow' +'%m%d%H%M.%y')"
+    test-snapd-timedate-control-consumer.date "$nice_when"
+
     if [ "$(snap debug confinement)" = partial ] ; then
         exit 0
     fi
@@ -64,3 +69,8 @@
         exit 1
     fi
     MATCH "Permission denied" < call.error
+
+    now="$(cat now.txt)"
+    not test-snapd-timedate-control-consumer.date "$now" 2> call.error
+    # EPERM because date gets blocked by the seccomp profile
+    MATCH "cannot set date: Operation not permitted" < call.error
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-timeserver-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-timeserver-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-timeserver-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-timeserver-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,15 +5,14 @@
     can access timeserver information and update it.
 
 prepare: |
-    truncate --size=0 defer.sh
-    chmod +x defer.sh
+    tests.cleanup prepare
 
     # This test requires busctl but on 14.04 we don't have one.
     # Let's pick the one from the core snap in such case.
     if [ -z "$(command -v busctl 2>/dev/null)" ]; then
         ln -s /snap/core/current/usr/bin/busctl /usr/local/bin/busctl
         hash -r
-        echo "rm -f /usr/local/bin/busctl" >> defer.sh
+        tests.cleanup defer rm -f /usr/local/bin/busctl
     fi
 
     # Technically the interface may be implemented by many things but in
@@ -24,19 +23,15 @@
     case "$SPREAD_SYSTEM" in
         debian-sid-*)
             apt-get remove -y ntp
-            echo 'apt-get install -y ntp' >> defer.sh
-            ;;
-        ubuntu-19.10-*)
-            apt-get remove -y chrony
-            echo 'apt-get install -y chrony' >> defer.sh
+            tests.cleanup defer apt-get install -y ntp
             ;;
         *)
             case "$(busctl get-property org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 NTP)" in
                 "b true")
-                    echo "busctl call org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 SetNTP bb true false" >> defer.sh
+                    tests.cleanup defer busctl call org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 SetNTP bb true false
                     ;;
                 "b false")
-                    echo "busctl call org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 SetNTP bb false false" >> defer.sh
+                    tests.cleanup defer busctl call org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 SetNTP bb false false
                     ;;
                 *)
                     echo "Unexpected value of NTP property"
@@ -47,16 +42,11 @@
     esac
 
     # Install a snap declaring a plug on timeserver-control
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-timedate-control-consumer
-    echo "snap remove --purge test-snapd-timedate-control-consumer" >> defer.sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-timedate-control-consumer
+    tests.cleanup defer snap remove --purge test-snapd-timedate-control-consumer
 
 restore: |
-    # Restore system to the previous state by running deferred commands in
-    # reverse order.
-    tac defer.sh > refed.sh
-    sh -xe refed.sh && rm -f {defer,refed}.sh
+    tests.cleanup restore
 
 execute: |
     # If we cannot use network time protocol then the test is meaningless.
@@ -76,7 +66,7 @@
         test-snapd-timedate-control-consumer.timedatectl-timeserver set-ntp "$value"
         # Starting or stopping NTP takes non-zero time so give it some time to take effect.
         # shellcheck disable=SC2016
-        retry-tool --wait 5 sh -c 'test "$(busctl get-property org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 NTP)" = "b '"$value"'"'
+        retry --wait 5 sh -c 'test "$(busctl get-property org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 NTP)" = "b '"$value"'"'
     done
 
     if [ "$(snap debug confinement)" = partial ] ; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-timezone-control/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-timezone-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-timezone-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-timezone-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,11 +9,8 @@
     can access timezone information and update it.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     # Install a snap declaring a plug on timezone-control
-    install_local test-snapd-timedate-control-consumer
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-timedate-control-consumer
 
 restore: |
     # Restore the initial timezone
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-udev/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-udev/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-udev/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-udev/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,11 +11,8 @@
     more interfaces declare udev snippets.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Given a snap declaring a slot with associated udev rules is installed"
-    install_local modem-manager-consumer
+    "$TESTSTOOLS"/snaps-state install-local modem-manager-consumer
 
 execute: |
     echo "Then the udev rules files specific to it are created"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-udisks2/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-udisks2/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-udisks2/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-udisks2/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,8 +4,9 @@
     The udisks2 interface allows operating as or interacting with the UDisks2 service
 
 # Interfaces not defined for ubuntu core systems
-# FIXME: fails in debian-sid for unknown reasons
-systems: [-ubuntu-core-*, -debian-sid-*]
+# FIXME: `udisksctl mount -b  "$device"` fails on arch with:
+#   Object /org/freedesktop/UDisks2/block_devices/loop200 is not a mountable filesystem.
+systems: [-ubuntu-core-*, -arch-linux-*]
 
 prepare: |
     snap install test-snapd-udisks2
@@ -43,7 +44,7 @@
 
     # We retry because there is a race with the device becoming
     # registered by udisks2. The issue can be easily reproduced on ubuntu-20.04
-    retry-tool -n 3 --wait 1 sh -c "test-snapd-udisks2.udisksctl mount -b \"$device\" -t ext4 | MATCH 'Mounted /dev/'"
+    retry -n 3 --wait 1 sh -c "test-snapd-udisks2.udisksctl mount -b \"$device\" -t ext4 | MATCH 'Mounted /dev/'"
     test-snapd-udisks2.udisksctl unmount -b "$device" | MATCH "Unmounted /dev/"
 
     if [ "$(snap debug confinement)" = partial ] ; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-upower-observe/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-upower-observe/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-upower-observe/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-upower-observe/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -23,9 +23,7 @@
     echo "Given a snap declaring a plug on the upower-observe interface is installed"
     snap install --edge test-snapd-upower-observe-consumer
 
-    # shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB/systems.sh"
-    if is_core_system; then
+    if os.query is-core; then
         echo "And a snap providing a upower-observe slot is installed"
         snap install test-snapd-upower --edge
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-wayland/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-wayland/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-wayland/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-wayland/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,16 +1,22 @@
 summary: Ensure that the wayland interface works
 
 # Only test on classic Ubuntu amd64 systems that have wayland
-systems: [ ubuntu-1*-*64 ]
+# TODO: Expand this to Fedora and other systems.
+systems:
+    - ubuntu-16.04-64
+    - ubuntu-18.04-64
+    - ubuntu-2*-64
 
 prepare: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB"/pkgdb.sh
     snap install --edge test-snapd-wayland
+    tests.session -u test prepare
+    tests.session -u test exec systemd-run --user --unit headless-weston.service weston --backend=headless-backend.so
+    retry -n 10 --wait 1 test -S /run/user/12345/wayland-0
 
 restore: |
-    echo "Stop weston compositor"
-    pkill -SIGKILL weston || true
+    snap remove test-snapd-wayland
+    tests.session -u test exec systemctl --user stop headless-weston.service
+    tests.session -u test restore
 
 execute: |
     echo "The interface is connected by default"
@@ -23,38 +29,14 @@
         exit 0
     fi
 
-    echo "Create XDG_RUNTIME_DIR=/run/user/12345"
-    mkdir -p /run/user/12345 || true
-    chmod 700 /run/user/12345
-    chown test:test /run/user/12345
-
-    echo "Start weston compositor under test user"
-    XDG_RUNTIME_DIR=/run/user/12345 su -p -c "weston --backend=headless-backend.so" test &
-
-    echo "Then wait for the socket to show up"
-    count=0
-    while sleep 1 && [ ! -S /run/user/12345/wayland-0 ]; do
-        echo $count
-        count=$((count+1))
-        if [ "$count" -gt 10 ]; then
-           echo "Could not find wayland socket"
-           exit 1
-        fi
-    done
-
     echo "Then the snap command under the test user is able connect to the wayland socket"
-    XDG_RUNTIME_DIR=/run/user/12345 su -p -l -c test-snapd-wayland test | MATCH wl_compositor
+    tests.session -u test exec test-snapd-wayland | MATCH wl_compositor
 
     echo "When the plug is disconnected"
     snap disconnect test-snapd-wayland:wayland
 
     echo "Then the snap command is not able to connect to the wayland socket"
-    if XDG_RUNTIME_DIR=/run/user/12345 su -p -l -c test-snapd-wayland test; then
+    if tests.session -u test exec test-snapd-wayland; then
         echo "Expected error with plug disconnected"
         exit 1
     fi
-
-    # If this is in 'restore', execute doesn't exit and spread must timeout
-    # the test.
-    echo "Stop weston compositor"
-    pkill -SIGKILL weston || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/task.yaml snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,51 @@
+summary: ensure that the x11 interface shares UNIX domain sockets
+description: |
+    In addition to the abstract "@/tmp/.X11-unix/X?" socket an X
+    server listens on, it also listens on a regular UNIX domain socket
+    in /tmp/.X11-unix.
+
+    The x11 plug will bind mount the socket directory from the slot
+    providing it: either the host system's /tmp for the implicit
+    system:x11 slot, or an application snap's private /tmp if it is a
+    regular slot.
+
+restore: |
+    rm -f /tmp/.X11-unix/X0
+
+execute: |
+    echo "Install test snaps"
+    "$TESTSTOOLS"/snaps-state install-local x11-client
+    "$TESTSTOOLS"/snaps-state install-local x11-server
+
+    echo "Ensure x11 plug is not connected to implicit slot"
+    snap disconnect x11-client:x11
+
+    echo "Connect x11-client to x11-server"
+    snap connect x11-client:x11 x11-server:x11
+
+    echo "The snaps can communicate via the unix domain socket in /tmp"
+    x11-server &
+    retry -n 4 --wait 0.5 test -e /tmp/snap.x11-server/tmp/.X11-unix/X0
+    x11-client | MATCH "Hello from xserver"
+
+    echo "The client cannot remove the unix domain sockets shared with it"
+    not x11-client.rm -f /tmp/.X11-unix/X0
+
+    # Ubuntu Core does not have a system:x11 implicit slot
+    if [[ "$SPREAD_SYSTEM" = ubuntu-core-* ]]; then
+        exit 0
+    fi
+
+    echo "Connect the client snap to the implicit system slot"
+    snap disconnect x11-client:x11
+    snap connect x11-client:x11
+
+    echo "The client can communicate with the host system X socket"
+    mkdir -p /tmp/.X11-unix
+    rm -f /tmp/.X11-unix/X0
+    echo "Hello from host system" | nc -l -w 1 -U /tmp/.X11-unix/X0 &
+    retry -n 4 --wait 0.5 test -e /tmp/.X11-unix/X0
+    x11-client | MATCH "Hello from host system"
+
+    echo "The client cannot remove host system sockets either"
+    not x11-client.rm -f /tmp/.X11-unix/X0
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-client/bin/rm.sh snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-client/bin/rm.sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-client/bin/rm.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-client/bin/rm.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec rm "$@"
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-client/bin/xclient.sh snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-client/bin/xclient.sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-client/bin/xclient.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-client/bin/xclient.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec nc -w 30 -U /tmp/.X11-unix/X0
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-client/meta/snap.yaml snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-client/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-client/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-client/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,12 @@
+name: x11-client
+version: 1.0
+summary: Fake x11 client
+description: Fake x11 client
+
+apps:
+  x11-client:
+    command: bin/xclient.sh
+    plugs: [x11, network]
+  rm:
+    command: bin/rm.sh
+    plugs: [x11]
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-server/bin/xserver.sh snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-server/bin/xserver.sh
--- snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-server/bin/xserver.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-server/bin/xserver.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+mkdir -p /tmp/.X11-unix
+
+SOCKET=/tmp/.X11-unix/X0
+rm -f $SOCKET
+echo "Hello from xserver" | nc -l -w 1 -U $SOCKET
diff -Nru snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-server/meta/snap.yaml snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-server/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/interfaces-x11-unix-socket/x11-server/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/interfaces-x11-unix-socket/x11-server/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+name: x11-server
+version: 1.0
+summary: Fake x11 server
+description: Fake x11 server
+
+apps:
+  x11-server:
+    command: bin/xserver.sh
+    plugs: [network]
+    slots: [x11]
diff -Nru snapd-2.45.1+20.04.2/tests/main/layout/task.yaml snapd-2.48.3+20.04/tests/main/layout/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/layout/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/layout/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,9 +7,7 @@
     hooks get permissions to access those areas.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-layout
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-layout
 
 debug: |
     ls -ld /etc || :
@@ -18,12 +16,10 @@
     ls -ld /etc/demo.cfg || :
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     for i in $(seq 2); do
         if [ "$i" -eq 2 ]; then
             echo "The snap works across refreshes"
-            install_local test-snapd-layout
+            "$TESTSTOOLS"/snaps-state install-local test-snapd-layout
         fi
 
         echo "snap declaring layouts doesn't explode on startup"
diff -Nru snapd-2.45.1+20.04.2/tests/main/listing/task.yaml snapd-2.48.3+20.04/tests/main/listing/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/listing/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/listing/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,12 +1,10 @@
 summary: Check snap listings
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     snap set system experimental.parallel-instances=true
-    install_local_as test-snapd-sh test-snapd-sh_foo
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_foo
 
 restore: |
     snap set system experimental.parallel-instances=null
@@ -20,7 +18,7 @@
     # Expressions for version and revision
     NUMERIC_VERSION="[0-9]+(\.[0-9]+)*"
     CORE_GIT_VERSION="[0-9]{2}-[0-9.]+(~[a-z0-9]+)?(\\+git[0-9]+\\.[0-9a-f]+)?"
-    SNAPD_GIT_VERSION="+[0-9.]+(~[a-z0-9]+)?(\\+git[0-9]+\\.[0-9a-z]+)?"
+    SNAPD_GIT_VERSION="+[0-9.]+(~[a-z0-9]+)?(\\+git[0-9]+\\.[0-9a-z]+)?(-dirty)?"
     FINAL_VERSION="[0-9]{2}-[0-9.]+(~[a-z0-9]+)?(\\+[0-9]+\\.[0-9a-f]+)?"
     SIDELOAD_REV="x[0-9]+"
     NUMBER_REV="[0-9]+"
@@ -75,9 +73,7 @@
     snap list | MATCH "^test-snapd-sh_foo +$NUMERIC_VERSION +$SIDELOAD_REV +- +- +- *$"
 
     echo "Install test-snapd-sh again"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "And run snap list --all"
     output=$(snap list --all | grep 'test-snapd-sh ')
diff -Nru snapd-2.45.1+20.04.2/tests/main/lxd/prep-snapd-in-lxd.sh snapd-2.48.3+20.04/tests/main/lxd/prep-snapd-in-lxd.sh
--- snapd-2.45.1+20.04.2/tests/main/lxd/prep-snapd-in-lxd.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/lxd/prep-snapd-in-lxd.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -ex
+
+# XXX: remove once the "umount /snap" change in postrm has propagated all
+#      the way to the image
+if [ -e /var/lib/dpkg/info/snapd.postrm ]; then
+    # ensure we can umount /snap
+    sed -i 's#echo "Final directory cleanup"#umount /snap || true#' /var/lib/dpkg/info/snapd.postrm
+fi
+
+apt autoremove --purge -y snapd ubuntu-core-launcher
+apt update
+
+# requires the snapd deb to already have been "lxd file push"d into the 
+# container
+apt install -y /root/snapd_*.deb
+
+# reload to take effect of the proxy that may have been set before this script
+# XXX: systemctl daemon-reload times out in 16.04:my-nesting-lxd but every
+#      appears to be working normally
+systemctl daemon-reload || true
+systemctl restart snapd.service
+
+# wait for snapd to finish seeding
+snap wait system seed.loaded
+
+# for debugging
+cat /etc/environment
diff -Nru snapd-2.45.1+20.04.2/tests/main/lxd/task.yaml snapd-2.48.3+20.04/tests/main/lxd/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/lxd/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/lxd/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,9 +2,8 @@
 
 # Only run this on ubuntu 16+, lxd will not work on !ubuntu systems
 # currently nor on ubuntu 14.04
-# TODO:UC20: enable for UC20
 # TODO: enable for ubuntu-16-32 again
-systems: [ubuntu-16.04*64, ubuntu-18.04*, ubuntu-2*, ubuntu-core-1*]
+systems: [ubuntu-16*, ubuntu-18*, ubuntu-2*, ubuntu-core-*]
 
 # autopkgtest run only a subset of tests that deals with the integration
 # with the distro
@@ -16,6 +15,16 @@
 # Start before anything else as it can take a really long time.
 priority: 1000
 
+environment:
+    REFRESH_APP_AWARENESS_OUTER/snapd_cgroup_just_inside: false
+    REFRESH_APP_AWARENESS_INNER/snapd_cgroup_just_inside: true
+    REFRESH_APP_AWARENESS_OUTER/snapd_cgroup_just_outside: true
+    REFRESH_APP_AWARENESS_INNER/snapd_cgroup_just_outside: false
+    REFRESH_APP_AWARENESS_OUTER/snapd_cgroup_both: true
+    REFRESH_APP_AWARENESS_INNER/snapd_cgroup_both: true
+    REFRESH_APP_AWARENESS_OUTER/snapd_cgroup_neither: false
+    REFRESH_APP_AWARENESS_INNER/snapd_cgroup_neither: false
+
 prepare: |
     # using apt here is ok because this test only runs on ubuntu
     echo "Remove any installed debs (some images carry them) to ensure we test the snap"
@@ -23,6 +32,9 @@
     if command -v apt && apt -v; then
         apt autoremove -y lxd
     fi
+    # Depending on test variant, enable refresh-app-awareness outside to test
+    # the interaction between lxd and cgroup-based application tracking.
+    snap set system experimental.refresh-app-awareness=$REFRESH_APP_AWARENESS_OUTER
 
 restore: |
     if  [[ "$(find "$GOHOME" -name 'snapd_*.deb' | wc -l || echo 0)" -eq 0 ]]; then
@@ -30,18 +42,25 @@
     fi
 
     for cont_name in my-nesting-ubuntu my-ubuntu; do
-        lxd.lxc stop $cont_name --force
-        lxd.lxc delete $cont_name
+        lxd.lxc stop $cont_name --force || true
+        lxd.lxc delete $cont_name || true
     done
+    snap remove --purge lxd
+    snap remove --purge lxd-demo-server
 
-    lxd-tool undo-lxd-mount-changes
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
+    snap unset system experimental.refresh-app-awareness
+    # Stop the dbus.service of the user session of the root user. This test
+    # runs in several configurations, not all of which have this capability.
+    # Where supported the test code below causes socket activation, through the
+    # refresh-app-awareness application tracking mechanism built into snap
+    # run. This session-level dbus daemon is detected as spurious by the
+    # invariant checker.
+    systemctl --user stop dbus.service || true
 
 debug: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     # debug output from lxd
-    get_journalctl_log -u snap.lxd.daemon.service
+    "$TESTSTOOLS"/journal-state get-log -u snap.lxd.daemon.service
 
 execute: |
     if  [[ "$(find "$GOHOME" -name 'snapd_*.deb' | wc -l || echo 0)" -eq 0 ]]; then
@@ -67,19 +86,12 @@
 
     # The snapd package we build as part of the tests will only run on the
     # distro we build on. So we need to launch the right ubuntu version.
-    # prep two containers, the my-ubuntu normal container and the 
+    # prep two containers, the my-ubuntu normal container and the
     # my-nesting-ubuntu nesting container
 
-    (
-        . /etc/os-release
-        # TODO:2004: remove version check once the image for ubuntu 20.04 is published
-        if [ "$VERSION_ID" == 20.04 ]; then
-            # shellcheck disable=SC2031
-            VERSION_ID=19.10
-        fi
-        lxd.lxc launch --quiet "ubuntu:${VERSION_ID:-}" my-ubuntu
-        lxd.lxc launch --quiet "ubuntu:${VERSION_ID:-}" my-nesting-ubuntu -c security.nesting=true
-    )
+    VERSION_ID="$(. /etc/os-release && echo "$VERSION_ID" )"
+    lxd.lxc launch --quiet "ubuntu:$VERSION_ID" my-ubuntu
+    lxd.lxc launch --quiet "ubuntu:$VERSION_ID" my-nesting-ubuntu -c security.nesting=true
     if [ "$(uname -m)" = x86_64 ] && lxd.lxc info my-ubuntu | grep "Architecture: i686"; then
         echo "LXD spawned 32bit userspace container on a 64bit host, WAT?"
         snap info lxd
@@ -95,16 +107,9 @@
         echo "Ensure we can run things inside"
         lxd.lxc exec $cont_name echo hello | MATCH hello
 
-        echo "Cleanup container"
-        lxd.lxc exec $cont_name -- apt autoremove --purge -y snapd ubuntu-core-launcher
-
-        echo "Ensure apt is up-to-date"
-        lxd.lxc exec $cont_name -- apt update
-
-        echo "Install snapd"
-        lxd.lxc exec $cont_name -- mkdir -p "$GOHOME"
-        lxd.lxc file push --quiet "$GOHOME"/snapd_*.deb "$cont_name/$GOHOME/"
-        lxd.lxc exec $cont_name -- apt install -y "$GOHOME"/snapd_*.deb
+        echo "Push snapd into container"
+        lxd.lxc file push --quiet prep-snapd-in-lxd.sh "$cont_name/root/"
+        lxd.lxc file push --quiet "$GOHOME"/snapd_*.deb "$cont_name/root/"
 
         echo "Setting up proxy *inside* the container"
         if [ -n "${http_proxy:-}" ]; then
@@ -113,10 +118,10 @@
         if [ -n "${https_proxy:-}" ]; then
             lxd.lxc exec $cont_name -- sh -c "echo https_proxy=$https_proxy >> /etc/environment"
         fi
-        lxd.lxc exec $cont_name -- systemctl daemon-reload
-        lxd.lxc exec $cont_name -- systemctl restart snapd.service
-        lxd.lxc exec $cont_name -- snap wait system seed.loaded
-        lxd.lxc exec $cont_name -- cat /etc/environment
+
+        echo "Install snapd in container"
+        lxd.lxc exec $cont_name -- /root/prep-snapd-in-lxd.sh
+        lxd.lxc exec $cont_name -- snap set system experimental.refresh-app-awareness=$REFRESH_APP_AWARENESS_INNER
     done
 
     # FIXME: ensure that the kernel running is recent enough, this
@@ -124,14 +129,28 @@
 
     echo "Ensure we can use snapd inside lxd"
     lxd.lxc exec my-ubuntu snap install test-snapd-sh
-    echo "And we can run snaps as regular users"
-    lxd.lxc exec my-ubuntu -- su -c "/snap/bin/test-snapd-sh.sh -c 'echo from-the-inside'" ubuntu | MATCH from-the-inside
+    echo "And we can run snaps as regular users, assuming session bus is available"
+    lxd.lxc exec my-ubuntu -- apt-get update
+    lxd.lxc exec my-ubuntu -- apt-get install -y dbus-user-session
+    lxd.lxc exec my-ubuntu -- su -l ubuntu -c "systemctl --user enable dbus.socket"
+    lxd.lxc exec my-ubuntu -- su -l ubuntu -c "/snap/bin/test-snapd-sh.sh -c 'echo from-the-inside'" | MATCH from-the-inside
     echo "And as root"
     lxd.lxc exec my-ubuntu -- test-snapd-sh.sh -c 'echo from-the-inside' | MATCH from-the-inside
     echo "We can also remove snaps successfully"
     lxd.lxc exec my-ubuntu -- snap remove --purge test-snapd-sh
 
-    # Ensure that we can run snapd as a snap inside a nested container
+    echo "Sanity check that mount overrides were generated inside the container"
+    lxd.lxc exec my-ubuntu -- find /var/run/systemd/generator/ -name container.conf | MATCH "/var/run/systemd/generator/snap-core-.*mount.d/container.conf"
+    lxd.lxc exec my-ubuntu -- test -f /var/run/systemd/generator/snap.mount
+
+    # Ensure that we can run lxd as a snap inside a container to create a nested
+    # container
+
+    if [ "$SPREAD_SYSTEM" = "ubuntu-16.04-64" ]; then
+        # related bug: https://bugs.launchpad.net/snapd/+bug/1892468
+        echo "Not running old xenial combination which lacks proper patches"
+        exit 0
+    fi
 
     echo "Ensure we can use lxd as a snap inside lxd"
     lxd.lxc exec my-nesting-ubuntu -- apt autoremove -y lxd
@@ -141,17 +160,36 @@
     lxd.lxc exec my-nesting-ubuntu -- lxd waitready
     lxd.lxc exec my-nesting-ubuntu -- lxd init --auto
 
-    (
-        . /etc/os-release
-        # TODO:2004: remove version check once the image for ubuntu 20.04 is published
-        if [ "$VERSION_ID" == 20.04 ]; then
-            # shellcheck disable=SC2031
-            VERSION_ID=19.10
-        fi
-        lxd.lxc exec my-nesting-ubuntu -- lxd.lxc launch "ubuntu:${VERSION_ID:-}" my-inner-ubuntu
-    )
+    lxd.lxc exec my-nesting-ubuntu -- lxd.lxc launch "ubuntu:${VERSION_ID:-}" my-inner-ubuntu
     lxd.lxc exec my-nesting-ubuntu -- lxd.lxc exec my-inner-ubuntu -- echo "from-the-INSIDE-inside" | MATCH from-the-INSIDE-inside
 
+    # finally check that we can't run snapd inside a nested lxd container as
+    # current apparmor does not support this, so if this works it is probably a
+    # confinement bug
+    lxd.lxc exec my-nesting-ubuntu -- lxd.lxc file push --quiet prep-snapd-in-lxd.sh my-inner-ubuntu/root/
+    snapdDeb=$(lxd.lxc exec my-nesting-ubuntu -- sh -c 'ls snapd_*.deb')
+    lxd.lxc exec my-nesting-ubuntu -- lxd.lxc file push --quiet "$snapdDeb" my-inner-ubuntu/root/
+    echo "Setting up proxy for the *inside nested* container"
+    if [ -n "${http_proxy:-}" ]; then
+        lxd.lxc exec my-nesting-ubuntu -- \
+            lxd.lxc exec my-inner-ubuntu -- \
+                sh -c "echo http_proxy=$http_proxy >> /etc/environment"
+    fi
+    if [ -n "${https_proxy:-}" ]; then
+        lxd.lxc exec my-nesting-ubuntu -- \
+            lxd.lxc exec my-inner-ubuntu -- \
+                sh -c "echo https_proxy=$https_proxy >> /etc/environment"
+    fi
+    lxd.lxc exec my-nesting-ubuntu -- \
+        lxd.lxc exec my-inner-ubuntu -- \
+            /root/prep-snapd-in-lxd.sh
+
+    not lxd.lxc exec my-nesting-ubuntu -- \
+        lxd.lxc exec my-inner-ubuntu -- \
+            snap install test-snapd-sh 2>stderr.log
+    # replace newlines with spaces to get one long line
+    tr '\n' ' ' < stderr.log | MATCH "error:\s+system\s+does\s+not\s+fully\s+support\s+snapd:\s+apparmor\s+detected\s+but\s+insufficient\s+permissions\s+to\s+use\s+it"
+
     echo "Install lxd-demo server to exercise the lxd interface"
     snap install lxd-demo-server
     snap connect lxd-demo-server:lxd lxd:lxd
diff -Nru snapd-2.45.1+20.04.2/tests/main/lxd-mount-units/task.yaml snapd-2.48.3+20.04/tests/main/lxd-mount-units/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/lxd-mount-units/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/lxd-mount-units/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,38 @@
+summary: Test mount units generated for snaps inside lxd container are correct.
+
+details: |
+    Test that mount units generated by snapd-generator inside lxd container
+    are correct for snapfuse.
+
+# only 20.10+, we want lxd images that come with snaps preinstalled.
+systems: [ubuntu-20.10*]
+
+execute: |
+    echo "Install lxd"
+    snap install lxd
+
+    lxd waitready
+    lxd init --auto
+
+    VERSION_ID="$(. /etc/os-release && echo "$VERSION_ID" )"
+    lxd.lxc launch --quiet "ubuntu:$VERSION_ID" ubuntu
+
+    lxd.lxc file push --quiet "$GOHOME"/snapd_*.deb "ubuntu/root/"
+
+    DEB=$(basename "$GOHOME"/snapd_*.deb)
+    lxd.lxc exec ubuntu -- apt install -y /root/"$DEB"
+    lxd.lxc restart ubuntu
+
+    echo "Sanity check that mount overrides were generated inside the container"
+    lxd.lxc exec ubuntu -- find /var/run/systemd/generator/ -name container.conf | MATCH "/var/run/systemd/generator/snap-core18.*mount.d/container.conf"
+    lxd.lxc exec ubuntu -- test -f /var/run/systemd/generator/snap.mount
+
+    echo "Sanity check that core18 snap is mounted correctly"
+    # Make sure core18 is mounted and readable for a regular user
+    retry -n 5 --wait 1 sh -c 'lxd.lxc exec ubuntu -- sudo --user ubuntu --login ls /snap/core18/current'
+    retry -n 5 --wait 1 sh -c 'lxd.lxc exec ubuntu -- sudo --user ubuntu --login mount | grep core18| grep allow_other'
+
+restore: |
+    lxd.lxc stop ubuntu --force || true
+    lxd.lxc delete ubuntu || true
+    snap remove --purge lxd
diff -Nru snapd-2.45.1+20.04.2/tests/main/lxd-no-fuse/task.yaml snapd-2.48.3+20.04/tests/main/lxd-no-fuse/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/lxd-no-fuse/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/lxd-no-fuse/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -51,4 +51,6 @@
     MATCH 'The "fuse" filesystem is required' < err.txt
 
 restore: |
-    lxd-tool undo-lxd-mount-changes
+    lxc delete --force my-ubuntu
+    snap remove ---purge lxd
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
diff -Nru snapd-2.45.1+20.04.2/tests/main/lxd-services-smoke/task.yaml snapd-2.48.3+20.04/tests/main/lxd-services-smoke/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/lxd-services-smoke/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/lxd-services-smoke/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+summary: Ensure refreshing lxd snap after service commands works.
+
+details: |
+  Execute a set of operations on lxd snap that were known to render it unusable
+  due to a combination of three problems: remove hook of lxd snap didn't clean
+  its mountpoints properly in namespace of the host, causing error when removing
+  snap data; snapd wouldn't ignore errors on snap data removal, triggering undo
+  on remove; remove would fail completely on undo, leaving lxd snap in an
+  undefined state. With fixed lxd remove hook and snapd fixes related to
+  https://bugs.launchpad.net/snapd/+bug/1899614, this test should never fail on
+  any of the above.
+
+systems: [ubuntu-18.04*, ubuntu-20.04*]
+
+execute: |
+  echo "Installing lxd snap"
+  snap install lxd
+  snap stop lxd
+  snap start lxd
+
+  # This may fail if revision is same as stable
+  snap refresh --edge lxd || true
+
+  # Critical operation: depends on correct lxd remove hook that
+  # unmounts its mountpoints properly in the namespace of the host.
+  # If the hook is not doing the right thing, then remove should still
+  # succeed but we will fail with leftovers in /var/snap/lxd/common.
+  snap remove lxd --purge
+
+  # We would fail on restore of test suite anyway, but make it more explicit. 
+  if test -d /var/snap/lxd/common; then
+    echo "lxd snap wasn't fully removed"
+    exit 1
+  fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/lxd-snapfuse/task.yaml snapd-2.48.3+20.04/tests/main/lxd-snapfuse/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/lxd-snapfuse/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/lxd-snapfuse/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,7 +4,9 @@
 systems: [ubuntu-18.04-64]
 
 restore: |
-    lxd-tool undo-lxd-mount-changes
+    lxc delete --force my-ubuntu
+    snap remove ---purge lxd
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
 
 execute: |
     echo "Ensure we use the snap"
@@ -58,3 +60,13 @@
 
     echo "We can also remove snaps successfully"
     lxd.lxc exec my-ubuntu -- snap remove --purge test-snapd-sh
+
+    snap pack --compression=lzo "$TESTSLIB/snaps/test-snapd-sh" . --filename test-snapd-sh-lzo.snap
+    test -e test-snapd-sh-lzo.snap
+    unsquashfs -l test-snapd-sh-lzo.snap
+    unsquashfs -s test-snapd-sh-lzo.snap | MATCH "Compression lzo"
+
+    echo "lzo compressed snaps can be used normally inside the lxd container"    
+    lxd.lxc file push --quiet test-snapd-sh-lzo.snap "my-ubuntu/$GOHOME/test-snapd-sh-lzo.snap"
+    lxd.lxc exec my-ubuntu -- snap install --dangerous "$GOHOME/test-snapd-sh-lzo.snap"
+    lxd.lxc exec my-ubuntu -- test-snapd-sh.sh -c "echo hello-lzo" | MATCH "hello-lzo"
diff -Nru snapd-2.45.1+20.04.2/tests/main/media-sharing/task.yaml snapd-2.48.3+20.04/tests/main/media-sharing/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/media-sharing/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/media-sharing/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,11 +7,9 @@
     use /run/media path instead.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
-    install_local_devmode test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools --devmode
     mkdir -p ${MEDIA_DIR}/src
     mkdir -p ${MEDIA_DIR}/dst
     touch ${MEDIA_DIR}/src/canary
diff -Nru snapd-2.45.1+20.04.2/tests/main/mountinfo-tool/task.yaml snapd-2.48.3+20.04/tests/main/mountinfo-tool/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/mountinfo-tool/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mountinfo-tool/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,5 +0,0 @@
-summary: the mountinfo-tool can be used in tests
-execute: |
-    # 2>&1 is required for some versions of python that chose
-    # to print the version to stderr, crazy!
-    mountinfo-tool --version 2>&1 | MATCH 1.0
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -57,7 +57,6 @@
 +1:-34 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:17 - squashfs /dev/loop0 ro
 -1:+35 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw,data=ordered
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-SNAP-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -58,7 +58,6 @@
 +1:-33 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:18 - squashfs /dev/loop1 ro
 -1:+34 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw,data=ordered
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -57,7 +57,6 @@
 +1:-34 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:17 - squashfs /dev/loop0 ro
 -1:+35 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw,data=ordered
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw,data=ordered
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:1 - ext4 /dev/sda1 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-16.04-64/PER-USER-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -58,7 +58,6 @@
 +1:-33 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:18 - squashfs /dev/loop1 ro
 -1:+34 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw,data=ordered
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw,data=ordered
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw,data=ordered
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:1 - ext4 /dev/sda1 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -7,7 +7,9 @@
 +0:+30 / /dev/pts rw,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
 +0:-29 / /dev/shm rw,nosuid,nodev master:7 - tmpfs tmpfs rw
 -1:-4 /etc /etc rw,relatime master:-6 - ext4 /dev/sda1 rw
-+2:+0 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+14 - squashfs /dev/loop0 ro
++2:+0 /etc/apparmor /etc/apparmor ro,nodev,relatime master:+14 - squashfs /dev/loop0 ro
++0:+0 /etc/apparmor.d /etc/apparmor.d ro,nodev,relatime master:+0 - squashfs /dev/loop0 ro
++0:+0 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+0 - squashfs /dev/loop0 ro
 +0:+0 /etc/ssl /etc/ssl ro,nodev,relatime master:+0 - squashfs /dev/loop0 ro
 -2:+0 /home /home rw,relatime master:-14 - ext4 /dev/sda1 rw
 +0:+0 /lib/firmware /lib/firmware rw,relatime master:+0 - ext4 /dev/sda1 rw
@@ -57,7 +59,6 @@
 +1:-34 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:15 - squashfs /dev/loop0 ro
 -1:+35 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-SNAP-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -7,7 +7,9 @@
 +0:+30 / /dev/pts rw,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
 +0:-29 / /dev/shm rw,nosuid,nodev master:7 - tmpfs tmpfs rw
 -1:-4 /etc /etc rw,relatime master:-6 - ext4 /dev/sda1 rw
-+2:+1 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+15 - squashfs /dev/loop1 ro
++2:+1 /etc/apparmor /etc/apparmor ro,nodev,relatime master:+15 - squashfs /dev/loop1 ro
++0:+0 /etc/apparmor.d /etc/apparmor.d ro,nodev,relatime master:+0 - squashfs /dev/loop1 ro
++0:+0 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+0 - squashfs /dev/loop1 ro
 +0:+0 /etc/ssl /etc/ssl ro,nodev,relatime master:+0 - squashfs /dev/loop1 ro
 -2:-1 /home /home rw,relatime master:-15 - ext4 /dev/sda1 rw
 +0:+0 /lib/firmware /lib/firmware rw,relatime master:+0 - ext4 /dev/sda1 rw
@@ -58,7 +60,6 @@
 +1:-33 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:16 - squashfs /dev/loop1 ro
 -1:+34 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -7,7 +7,9 @@
 +0:+30 / /dev/pts rw,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
 +0:-29 / /dev/shm rw,nosuid,nodev master:7 - tmpfs tmpfs rw
 -1:-4 /etc /etc rw,relatime master:-6 - ext4 /dev/sda1 rw
-+2:+0 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+14 - squashfs /dev/loop0 ro
++2:+0 /etc/apparmor /etc/apparmor ro,nodev,relatime master:+14 - squashfs /dev/loop0 ro
++0:+0 /etc/apparmor.d /etc/apparmor.d ro,nodev,relatime master:+0 - squashfs /dev/loop0 ro
++0:+0 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+0 - squashfs /dev/loop0 ro
 +0:+0 /etc/ssl /etc/ssl ro,nodev,relatime master:+0 - squashfs /dev/loop0 ro
 -2:+0 /home /home rw,relatime master:-14 - ext4 /dev/sda1 rw
 +0:+0 /lib/firmware /lib/firmware rw,relatime master:+0 - ext4 /dev/sda1 rw
@@ -57,7 +59,6 @@
 +1:-34 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:15 - squashfs /dev/loop0 ro
 -1:+35 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:1 - ext4 /dev/sda1 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-18.04-64/PER-USER-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -7,7 +7,9 @@
 +0:+30 / /dev/pts rw,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
 +0:-29 / /dev/shm rw,nosuid,nodev master:7 - tmpfs tmpfs rw
 -1:-4 /etc /etc rw,relatime master:-6 - ext4 /dev/sda1 rw
-+2:+1 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+15 - squashfs /dev/loop1 ro
++2:+1 /etc/apparmor /etc/apparmor ro,nodev,relatime master:+15 - squashfs /dev/loop1 ro
++0:+0 /etc/apparmor.d /etc/apparmor.d ro,nodev,relatime master:+0 - squashfs /dev/loop1 ro
++0:+0 /etc/nsswitch.conf /etc/nsswitch.conf ro,nodev,relatime master:+0 - squashfs /dev/loop1 ro
 +0:+0 /etc/ssl /etc/ssl ro,nodev,relatime master:+0 - squashfs /dev/loop1 ro
 -2:-1 /home /home rw,relatime master:-15 - ext4 /dev/sda1 rw
 +0:+0 /lib/firmware /lib/firmware rw,relatime master:+0 - ext4 /dev/sda1 rw
@@ -58,7 +60,6 @@
 +1:-33 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:16 - squashfs /dev/loop1 ro
 -1:+34 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -1:-35 /usr/src /usr/src rw,relatime master:1 - ext4 /dev/sda1 rw
-+0:+0 /var/lib/dhcp /var/lib/dhcp rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda1 rw
 +0:+0 /var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda1 rw
 +0:+0 / /var/lib/snapd/hostfs rw,relatime master:1 - ext4 /dev/sda1 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-16-64/PER-SNAP-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-16-64/PER-SNAP-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-16-64/PER-SNAP-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-16-64/PER-SNAP-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -101,8 +101,7 @@
 -2:-31 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:63 - squashfs /dev/loop3 ro
 +2:+32 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-35 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+14 - ext4 /dev/sda3 rw,data=ordered
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+14 - ext4 /dev/sda3 rw,data=ordered
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-14 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda3 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-16-64/PER-USER-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-16-64/PER-USER-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-16-64/PER-USER-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-16-64/PER-USER-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -101,8 +101,7 @@
 -2:-31 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:63 - squashfs /dev/loop3 ro
 +2:+32 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-35 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+14 - ext4 /dev/sda3 rw,data=ordered
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+14 - ext4 /dev/sda3 rw,data=ordered
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-14 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda3 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -82,8 +82,7 @@
 -2:-34 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:39 - squashfs /dev/loop2 ro
 +2:+35 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-37 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-13 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda3 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-SNAP-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -82,8 +82,7 @@
 -2:-36 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:40 - squashfs /dev/loop0 ro
 +2:+37 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-37 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-13 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda3 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -82,8 +82,7 @@
 -2:-34 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:39 - squashfs /dev/loop2 ro
 +2:+35 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-37 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-13 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda3 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-18-64/PER-USER-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -82,8 +82,7 @@
 -2:-36 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:40 - squashfs /dev/loop0 ro
 +2:+37 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-37 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+13 - ext4 /dev/sda3 rw,data=ordered
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda3 rw,data=ordered
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-13 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda3 rw,data=ordered
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -86,8 +86,7 @@
 -2:-36 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:35 - squashfs /dev/loop1 ro
 +2:+37 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-38 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+12 - ext4 /dev/sda4 rw
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda4 rw
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+12 - ext4 /dev/sda4 rw
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda4 rw
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-12 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda4 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-SNAP-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -86,8 +86,7 @@
 -2:-35 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:36 - squashfs /dev/loop2 ro
 +2:+36 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-38 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+12 - ext4 /dev/sda4 rw
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda4 rw
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+12 - ext4 /dev/sda4 rw
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda4 rw
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-12 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda4 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-16.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-16.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-16.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-16.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -86,8 +86,7 @@
 -2:-36 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:35 - squashfs /dev/loop1 ro
 +2:+37 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-38 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+12 - ext4 /dev/sda4 rw
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda4 rw
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+12 - ext4 /dev/sda4 rw
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda4 rw
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-12 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda4 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-18.expected.txt snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-18.expected.txt
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-18.expected.txt	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/google.ubuntu-core-20-64/PER-USER-18.expected.txt	2021-02-02 08:21:12.000000000 +0000
@@ -86,8 +86,7 @@
 -2:-35 /usr/share/gdb/auto-load /usr/share/gdb/auto-load ro,nodev,relatime master:36 - squashfs /dev/loop2 ro
 +2:+36 / /usr/share/gdb/test rw,relatime - tmpfs tmpfs rw
 -2:-38 /usr/src /usr/src ro,relatime master:1 - squashfs /dev/loop0 ro
-+1:+1 /system-data/var/lib/dhcp /var/lib/dhcp rw,relatime master:+12 - ext4 /dev/sda4 rw
-+0:+0 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+0 - ext4 /dev/sda4 rw
++1:+1 /system-data/var/lib/extrausers /var/lib/extrausers rw,relatime master:+12 - ext4 /dev/sda4 rw
 +0:+0 /system-data/var/lib/snapd /var/lib/snapd rw,relatime master:+0 - ext4 /dev/sda4 rw
 -1:-1 / /var/lib/snapd/hostfs ro,relatime master:-12 - squashfs /dev/loop0 ro
 +1:+1 /system-data/var/lib/snapd/hostfs /var/lib/snapd/hostfs rw,relatime - ext4 /dev/sda4 rw
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-ns/task.yaml snapd-2.48.3+20.04/tests/main/mount-ns/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/mount-ns/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-ns/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,7 +18,7 @@
     simple snap using classic confinement.
 
     The mount tables are obtained from /proc/pid/mountinfo interface. They are
-    then fed to mountinfo-tool with various determinism adjustment options and
+    then fed to mountinfo.query with various determinism adjustment options and
     compared to stock tables created when the test was first made.
 
     Naturally occurring mount tables will differ from invocation to invocation
@@ -30,7 +30,7 @@
     created based on the amount of available memory. Some mount entries may
     contain numeric IDs that are allocated and are hard to predict. Block
     devices backing actual file systems may be on various disks, for instance
-    on /dev/vda or /dev/sdb. All of those are handled by mountinfo-tool
+    on /dev/vda or /dev/sdb. All of those are handled by mountinfo.query
     --rename and --renumber, along with sorting options that combat
     non-deterministic mount order.
 
@@ -68,7 +68,7 @@
             # and released this test can be allowed to run on bash 4.3. Without
             # the workaround for a bug in bash REBOOT causes the spread test to
             # fail instead of asking spread to reboot the machine.
-            if version-tool --strict "$(echo "$BASH_VERSION" | cut -d. -f 1-2)" -eq 4.3; then
+            if "$TESTSTOOLS"/version-compare --strict "$(echo "$BASH_VERSION" | cut -d. -f 1-2)" -eq 4.3; then
                 echo "SKIP: this test cannot operate on bash 4.3.x"
                 touch please-skip-this-test
                 exit 0
@@ -105,8 +105,8 @@
     # order is deterministic. The use of filesystem field is there so that
     # autofs mounted filesystems (like binfmt_misc) don't have random ordering
     # between the real thing and the automount entry.
-    deterministic-mountinfo-tool() {
-        mountinfo-tool \
+    deterministic-mountinfo-query() {
+        mountinfo.query \
             --renumber \
             --rename \
             --ref-x1000 \
@@ -141,7 +141,7 @@
 
     echo "Collect mountinfo from the host before running apps"
     # "make sure that persistent mount namespaces don't clobber the output"
-    if mountinfo-tool /run/snapd/ns; then
+    if mountinfo.query /run/snapd/ns; then
         umount /run/snapd/ns
     fi
     cat /proc/self/mountinfo >HOST.raw.txt
@@ -162,23 +162,23 @@
 
     echo "Collect mountinfo from the host after running apps"
     # "make sure that persistent mount namespaces don't clobber the output"
-    snap-tool snap-discard-ns test-snapd-mountinfo-classic
-    snap-tool snap-discard-ns test-snapd-mountinfo-core16
-    snap-tool snap-discard-ns test-snapd-mountinfo-core18
+    snapd.tool exec snap-discard-ns test-snapd-mountinfo-classic
+    snapd.tool exec snap-discard-ns test-snapd-mountinfo-core16
+    snapd.tool exec snap-discard-ns test-snapd-mountinfo-core18
     umount /run/snapd/ns
     cat /proc/self/mountinfo >HOST-AFTER.raw.txt
 
     echo "Transform mountinfo tables to make them deterministic"
-    deterministic-mountinfo-tool                                              -f HOST.raw.txt        >HOST.deterministic.txt
-    deterministic-mountinfo-tool --ref HOST.raw.txt                           -f PER-SNAP-16.raw.txt >PER-SNAP-16.deterministic.txt
-    deterministic-mountinfo-tool --ref HOST.raw.txt --ref PER-SNAP-16.raw.txt -f PER-USER-16.raw.txt >PER-USER-16.deterministic.txt
-    deterministic-mountinfo-tool --ref HOST.raw.txt                           -f PER-SNAP-18.raw.txt >PER-SNAP-18.deterministic.txt
-    deterministic-mountinfo-tool --ref HOST.raw.txt --ref PER-SNAP-18.raw.txt -f PER-USER-18.raw.txt >PER-USER-18.deterministic.txt
+    deterministic-mountinfo-query                                              -f HOST.raw.txt        >HOST.deterministic.txt
+    deterministic-mountinfo-query --ref HOST.raw.txt                           -f PER-SNAP-16.raw.txt >PER-SNAP-16.deterministic.txt
+    deterministic-mountinfo-query --ref HOST.raw.txt --ref PER-SNAP-16.raw.txt -f PER-USER-16.raw.txt >PER-USER-16.deterministic.txt
+    deterministic-mountinfo-query --ref HOST.raw.txt                           -f PER-SNAP-18.raw.txt >PER-SNAP-18.deterministic.txt
+    deterministic-mountinfo-query --ref HOST.raw.txt --ref PER-SNAP-18.raw.txt -f PER-USER-18.raw.txt >PER-USER-18.deterministic.txt
     if snap debug sandbox-features --required confinement-options:classic; then
-        deterministic-mountinfo-tool --ref HOST.raw.txt                           -f PER-SNAP-C7.raw.txt >PER-SNAP-C7.deterministic.txt
-        deterministic-mountinfo-tool --ref HOST.raw.txt --ref PER-SNAP-C7.raw.txt -f PER-USER-C7.raw.txt >PER-USER-C7.deterministic.txt
+        deterministic-mountinfo-query --ref HOST.raw.txt                           -f PER-SNAP-C7.raw.txt >PER-SNAP-C7.deterministic.txt
+        deterministic-mountinfo-query --ref HOST.raw.txt --ref PER-SNAP-C7.raw.txt -f PER-USER-C7.raw.txt >PER-USER-C7.deterministic.txt
     fi
-    deterministic-mountinfo-tool                                              -f HOST-AFTER.raw.txt  >HOST-AFTER.deterministic.txt
+    deterministic-mountinfo-query                                              -f HOST-AFTER.raw.txt  >HOST-AFTER.deterministic.txt
 
     if snap debug sandbox-features --required confinement-options:classic; then
         snap remove --purge test-snapd-mountinfo-classic
diff -Nru snapd-2.45.1+20.04.2/tests/main/mount-protocol-error/task.yaml snapd-2.48.3+20.04/tests/main/mount-protocol-error/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/mount-protocol-error/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/mount-protocol-error/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -24,5 +24,9 @@
     for i in $(seq 10); do
        echo "Install $i"
        snap install "${names[@]}"
-       snap remove --purge "${names[@]}"
+       # snap remove --purge doesn't support multiple snaps, need to run 
+       # sequentially
+       for n in $(seq 9); do
+          snap remove --purge "test-snapd-tools_$n"
+       done
     done
diff -Nru snapd-2.45.1+20.04.2/tests/main/network-retry/task.yaml snapd-2.48.3+20.04/tests/main/network-retry/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/network-retry/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/network-retry/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,5 @@
         exit 1
     fi
 
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
     echo "Ensure we tried to retry this operation"
-    check_journalctl_log 'Retrying because of temporary net error'
+    "$TESTSTOOLS"/journal-state match-log 'Retrying because of temporary net error'
diff -Nru snapd-2.45.1+20.04.2/tests/main/nfs-support/task.yaml snapd-2.48.3+20.04/tests/main/nfs-support/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/nfs-support/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/nfs-support/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,17 +15,15 @@
 backends: [-autopkgtest]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     # If /proc/fs/nfsd is not initially mounted then ask the test to unmount it later.
-    if not mountinfo-tool /proc/fs/nfsd .fs_type=nfsd; then
+    if not mountinfo.query /proc/fs/nfsd .fs_type=nfsd; then
         touch /tmp/please-unmount-nfsd
         echo "the test needs to unmount /proc/fs/nfsd if it becomes mounted"
     fi
     # If /var/lib/nfs/rpc_pipefs is not initially mounted then ask the test to unmount it later.
-    if not mountinfo-tool /var/lib/nfs/rpc_pipefs .fs_type=rpc_pipefs; then
+    if not mountinfo.query /var/lib/nfs/rpc_pipefs .fs_type=rpc_pipefs; then
         touch /tmp/please-unmount-rpc-pipefs
         echo "the test needs to unmount /var/lib/nfs/rpc_pipefs if it becomes mounted"
     fi
@@ -35,7 +33,7 @@
     . "$TESTSLIB/pkgdb.sh"
 
     # Unmount NFS mount over /home if one exists.
-    if mountinfo-tool /home; then
+    if mountinfo.query /home; then
         umount /home
     fi
 
@@ -75,13 +73,13 @@
             ;;
     esac
     if [ -e /tmp/please-unmount-nfsd ]; then
-        if mountinfo-tool /proc/fs/nfsd .fs_type=nfsd; then
+        if mountinfo.query /proc/fs/nfsd .fs_type=nfsd; then
             umount /proc/fs/nfsd
         fi
         rm -f /tmp/please-unmount-nfsd
     fi
     if [ -e /tmp/please-unmount-rpc-pipefs ]; then
-        if mountinfo-tool /var/lib/nfs/rpc_pipefs .fs_type=rpc_pipefs; then
+        if mountinfo.query /var/lib/nfs/rpc_pipefs .fs_type=rpc_pipefs; then
             umount /var/lib/nfs/rpc_pipefs
         fi
         rm -f /tmp/please-unmount-rpc-pipefs
@@ -183,9 +181,11 @@
     # Ensure that this removed the extra permissions.
     ensure_normal_perms
 
-    # Skip udp protocol on arch-linux because it is not supported
-    # Error displayed: mount.nfs: requested NFS version or transport protocol is not supported
-    if [[ ! "$SPREAD_SYSTEM" =~ arch-* ]]; then
+    # Skip udp protocol on arch-linux, debian-sid and ubuntu-20.10 because it is
+    # not supported. Error displayed:
+    # - arch: mount.nfs: requested NFS version or transport protocol is not supported
+    # - debian-sid, ubuntu-20.10: mount.nfs: an incorrect mount option was specified
+    if [[ "$SPREAD_SYSTEM" != arch-* && "$SPREAD_SYSTEM" != debian-sid-* && "$SPREAD_SYSTEM" != ubuntu-20.10-* ]]; then
         # Mount NFS-exported /home over real /home using NFSv3 and UDP transport
         mount -t nfs localhost:/home /home -o nfsvers=3,proto=udp
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/non-home/task.yaml snapd-2.48.3+20.04/tests/main/non-home/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/non-home/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/non-home/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -13,7 +13,7 @@
     adduser --home "$THOME" "$TUSER"
 
 restore: |
-    user-tool remove-with-group "$TUSER"
+    "$TESTSTOOLS"/user-state remove-with-group "$TUSER"
 
 execute: |
     echo "Install a snap"
diff -Nru snapd-2.45.1+20.04.2/tests/main/op-install-failed-undone/task.yaml snapd-2.48.3+20.04/tests/main/op-install-failed-undone/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/op-install-failed-undone/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/op-install-failed-undone/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,9 +21,7 @@
     mkdir -p $SNAP_MOUNT_DIR/test-snapd-sh/current/foo
 
     echo "And we try to install it"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    if install_local test-snapd-sh; then
+    if "$TESTSTOOLS"/snaps-state install-local test-snapd-sh; then
         echo "A snap shouldn't be installable if its mount point is busy"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/op-remove-retry/task.yaml snapd-2.48.3+20.04/tests/main/op-remove-retry/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/op-remove-retry/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/op-remove-retry/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,5 +1,8 @@
 summary: Check that a remove operation is working even if the mount point is busy.
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
+
 restore: |
     kill %1 || true
 
@@ -14,9 +17,7 @@
     . "$TESTSLIB"/systemd.sh
 
     echo "Given a snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools
 
     echo "And its mount point is kept busy"
     # we need a marker file, because just using systemd to figure out
@@ -25,7 +26,7 @@
     MARKER=/var/snap/test-snapd-tools/current/block-running
     rm -f $MARKER
 
-    systemd_create_and_start_unit unmount-blocker "$(command -v test-snapd-tools.block)"
+    systemd-run --unit unmount-blocker test-snapd-tools.block
 
     wait_for_service unmount-blocker active
     while [ ! -f $MARKER ]; do sleep 1; done
@@ -40,5 +41,4 @@
     while snap list | grep -q test-snapd-tools; do sleep 1; done
 
     # cleanup umount blocker
-    systemd_stop_and_destroy_unit unmount-blocker
-
+    systemctl stop unmount-blocker
diff -Nru snapd-2.45.1+20.04.2/tests/main/os.query/task.yaml snapd-2.48.3+20.04/tests/main/os.query/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/os.query/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/os.query/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,58 @@
+summary: smoke test for the system-state tool
+
+execute: |
+
+    # Check help
+    os.query | MATCH "usage: is-core"
+    os.query -h | MATCH "usage: is-core"
+    os.query --help | MATCH "usage: is-core"
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-core-16-*)
+            os.query is-core
+            os.query is-core16
+            not os.query is-core18
+            not os.query is-classic
+            ;;
+        ubuntu-core-18-*)
+            os.query is-core
+            os.query is-core18
+            not os.query is-core20
+            not os.query is-classic
+            ;;
+        ubuntu-core-20-*)
+            os.query is-core
+            os.query is-core20
+            not os.query is-core18
+            not os.query is-classic
+            ;;
+        ubuntu-14-*)
+            os.query is-classic
+            os.query is-trusty
+            not os.query is-bionic
+            not os.query is-core
+            ;;
+        ubuntu-16-*)
+            os.query is-classic
+            os.query is-xenial
+            not os.query is-bionic
+            not os.query is-core
+            ;;
+        ubuntu-18-*)
+            os.query is-classic
+            os.query is-bionic
+            not os.query is-focal
+            not os.query is-core
+            ;;
+        ubuntu-20.04-*)
+            os.query is-classic
+            os.query is-focal
+            not os.query is-xenial
+            not os.query is-core
+            ;;
+        *)
+            os.query is-classic
+            not os.query is-focal
+            not os.query is-core
+            ;;
+    esac
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-aliases/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-aliases/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-aliases/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-aliases/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,13 +1,10 @@
 summary: Check snap alias and snap unalias across different instances of the same snap
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     snap set system experimental.parallel-instances=true
 
-    install_local aliases
-    install_local_as aliases aliases_foo
+    "$TESTSTOOLS"/snaps-state install-local aliases
+    "$TESTSTOOLS"/snaps-state install-local-as aliases aliases_foo
 
 restore: |
     snap set system experimental.parallel-instances=null
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-basic/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-basic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-basic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-basic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,11 +8,8 @@
     snap set system experimental.parallel-instances=true
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
-    install_local test-snapd-sh
-    install_local_as test-snapd-sh test-snapd-sh_foo
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_foo
 
     su -l -c '! test -d ~/snap/test-snapd-sh' test
     su -l -c '! test -d ~/snap/test-snapd-sh_foo' test
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-classic/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-classic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-classic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-classic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -35,11 +35,8 @@
     esac
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
-    install_local test-snapd-classic-confinement --classic
-    install_local_as test-snapd-classic-confinement test-snapd-classic-confinement_foo --classic
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-classic-confinement test-snapd-classic-confinement_foo --classic
 
     su test -l -c '! test -d ~/snap/test-snapd-classic-confinement'
     su test -l -c '! test -d ~/snap/test-snapd-classic-confinement_foo'
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-common-dirs/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-common-dirs/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-common-dirs/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-common-dirs/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,13 +7,11 @@
     snap set system experimental.parallel-instances=true
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
 
     echo "Install a snap with instance key set"
-    install_local_as test-snapd-sh test-snapd-sh_foo
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_foo
 
     # foo instance directories are present
     test -d "$SNAP_MOUNT_DIR/test-snapd-sh_foo"
@@ -24,13 +22,13 @@
     test -d "/var/snap/test-snapd-sh"
 
     # get another revision of test-snapd-sh_foo
-    install_local_as test-snapd-sh test-snapd-sh_foo
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_foo
 
     # install instance-key-less snap
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     # and a bar instance
-    install_local_as test-snapd-sh test-snapd-sh_bar
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_bar
     # bar instance directories are present
     test -d "$SNAP_MOUNT_DIR/test-snapd-sh_bar"
     test -d "/var/snap/test-snapd-sh_bar"
@@ -71,9 +69,9 @@
     not test -d "/var/snap/test-snapd-sh"
 
     # make sure that the sole snap without instance key is handled correctly too
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     # another revision
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     test -d "$SNAP_MOUNT_DIR/test-snapd-sh"
     test -d "/var/snap/test-snapd-sh"
     snap remove --purge test-snapd-sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-desktop/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-desktop/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-desktop/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-desktop/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,8 @@
 summary: Checks for parallel installation of sideloaded snaps containing desktop applications
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Sideload the regular snap"
-    install_local basic-desktop
+    "$TESTSTOOLS"/snaps-state install-local basic-desktop
 
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
@@ -15,7 +12,7 @@
     for instance in foo longname; do
         echo "Sideload same snap as different instance named basic-desktop+$instance"
         expected="^basic-desktop_$instance 1.0 installed\$"
-        install_local_as basic-desktop "basic-desktop_$instance" | MATCH "$expected"
+        "$TESTSTOOLS"/snaps-state install-local-as basic-desktop "basic-desktop_$instance" | MATCH "$expected"
 
         diff -u <(head -n5 "/var/lib/snapd/desktop/applications/basic-desktop+${instance}_echo.desktop") - <<-EOF
     [Desktop Entry]
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-interfaces/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-interfaces/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-interfaces/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-interfaces/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,14 +4,11 @@
 backends: [-autopkgtest]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     snap set system experimental.parallel-instances=true
 
     echo "Install test snaps"
-    install_local home-consumer
-    install_local_as home-consumer home-consumer_foo
+    "$TESTSTOOLS"/snaps-state install-local home-consumer
+    "$TESTSTOOLS"/snaps-state install-local-as home-consumer home-consumer_foo
 
     # the home interface is not autoconnected on all-snap systems
     if [[ ! "$SPREAD_SYSTEM" == ubuntu-core-* ]]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-interfaces-content/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-interfaces-content/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-interfaces-content/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-interfaces-content/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -20,14 +20,11 @@
     snap set system experimental.parallel-instances=true
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-advanced-slot
 
-    install_local test-snapd-content-advanced-slot
-
-    install_local test-snapd-content-advanced-plug
-    install_local_as test-snapd-content-advanced-plug test-snapd-content-advanced-plug_foo
-    install_local_as test-snapd-content-advanced-plug test-snapd-content-advanced-plug_bar
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-advanced-plug
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-content-advanced-plug test-snapd-content-advanced-plug_foo
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-content-advanced-plug test-snapd-content-advanced-plug_bar
 
     test-snapd-content-advanced-plug.sh -c "$(printf 'test ! -e $%s/target' "$VAR")"
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-layout/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-layout/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-layout/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-layout/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,14 +10,11 @@
     snap set system experimental.parallel-instances=true
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install the regular snap"
-    install_local test-snapd-layout
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-layout
 
     echo "Sideload the parallel installed snap"
-    install_local_as test-snapd-layout test-snapd-layout_foo
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-layout test-snapd-layout_foo
 
     for name in test-snapd-layout test-snapd-layout_foo; do
         # workaround trespassing bug
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-local/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-local/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-local/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-local/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,17 +4,14 @@
     snap set system experimental.parallel-instances=null
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install the regular snap"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
 
-    if install_local_as test-snapd-sh test-snapd-sh_foo 2>run.err; then
-        echo "install_local_as was expected to fail"
+    if "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_foo 2>run.err; then
+        echo "install-local-as was expected to fail"
         exit 1
     fi
     MATCH 'experimental feature disabled' < run.err
@@ -24,7 +21,7 @@
     for instance in foo longname; do
         echo "Install snap instance named test-snapd-sh_$instance"
         expected="^test-snapd-sh_$instance 1.0 installed\$"
-        install_local_as test-snapd-sh "test-snapd-sh_$instance" | MATCH "$expected"
+        "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh "test-snapd-sh_$instance" | MATCH "$expected"
 
         test -d "$SNAP_MOUNT_DIR/test-snapd-sh_$instance/x1"
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-remove-after/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-remove-after/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-remove-after/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-remove-after/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -28,15 +28,10 @@
     esac
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     # install confined and classic snaps
-    install_local test-snapd-sh
-    if is_classic_system ; then
-        install_local test-snapd-classic-confinement --classic
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
+    if os.query is-classic ; then
+        "$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
     fi
 
     snap set system experimental.parallel-instances=true
@@ -44,33 +39,33 @@
     # regular instances work
     # shellcheck disable=SC2016
     test-snapd-sh.sh -c 'echo confined $SNAP_INSTANCE_NAME works'
-    if is_classic_system ; then
+    if os.query is-classic ; then
         # shellcheck disable=SC2016
         test-snapd-classic-confinement.sh -c 'echo classic $SNAP_INSTANCE_NAME works'
     fi
 
     # new instances of same snaps
-    install_local_as test-snapd-sh test-snapd-sh_foo
-    if is_classic_system ; then
-        install_local_as test-snapd-classic-confinement test-snapd-classic-confinement_foo --classic
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-sh test-snapd-sh_foo
+    if os.query is-classic ; then
+        "$TESTSTOOLS"/snaps-state install-local-as test-snapd-classic-confinement test-snapd-classic-confinement_foo --classic
     fi
 
     # parallel instances works
     # shellcheck disable=SC2016
     test-snapd-sh_foo.sh -c 'echo confined $SNAP_INSTANCE_NAME works'
-    if is_classic_system ; then
+    if os.query is-classic ; then
         # shellcheck disable=SC2016
         test-snapd-classic-confinement_foo.sh -c 'echo classic $SNAP_INSTANCE_NAME works'
     fi
 
     # removal of snaps should not fail
     snap remove --purge test-snapd-sh
-    if is_classic_system ; then
+    if os.query is-classic ; then
         snap remove --purge test-snapd-classic-confinement
     fi
 
     # neither should the removal of instances
     snap remove --purge test-snapd-sh_foo
-    if is_classic_system ; then
+    if os.query is-classic ; then
         snap remove --purge test-snapd-classic-confinement_foo
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-services/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-services/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-services/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-services/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,10 +10,7 @@
     snap set system experimental.parallel-instances=null
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
@@ -27,7 +24,7 @@
     for instance in foo longname; do
         echo "Install a snap as instance named test-snapd-service_$instance"
         expected="^test-snapd-service_$instance 1.0 installed\$"
-        install_local_as test-snapd-service "test-snapd-service_$instance" | MATCH "$expected"
+        "$TESTSTOOLS"/snaps-state install-local-as test-snapd-service "test-snapd-service_$instance" | MATCH "$expected"
 
         test -d "$SNAP_MOUNT_DIR/test-snapd-service_$instance/x1"
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/parallel-install-snap-icons/task.yaml snapd-2.48.3+20.04/tests/main/parallel-install-snap-icons/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/parallel-install-snap-icons/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/parallel-install-snap-icons/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,16 +4,13 @@
     snap unset system experimental.parallel-instances
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install a snap providing icons"
-    install_local test-snapd-icon-theme
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-icon-theme
 
     echo "Install additional instances of the snap"
     snap set system experimental.parallel-instances=true
-    install_local_as test-snapd-icon-theme test-snapd-icon-theme_longname
-    install_local_as test-snapd-icon-theme test-snapd-icon-theme_foo
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-icon-theme test-snapd-icon-theme_longname
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-icon-theme test-snapd-icon-theme_foo
 
     echo "Each instance provides its own icons"
     icondir=/var/lib/snapd/desktop/icons/hicolor/scalable/apps
diff -Nru snapd-2.45.1+20.04.2/tests/main/postrm-purge/task.yaml snapd-2.48.3+20.04/tests/main/postrm-purge/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/postrm-purge/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/postrm-purge/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,19 +11,45 @@
     fi
 
 prepare: |
+    # TODO: unify this with tests/main/snap-mgmt/task.yaml
     echo "When some snaps are installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-tools
-    # services shall be stopped, even when using stop-command
-    install_local test-snapd-service
-    # socket units shall be cleaned up
-    install_local socket-activation
-    # as well as timers
-    install_local test-snapd-timer-service
-    # regular snaps and aliases too
-    snap install test-snapd-control-consumer
-    snap install test-snapd-auto-aliases
+
+
+    snap set core experimental.user-daemons=true
+
+    # Install a number of snaps that contain various features that have
+    # representation in the file system.
+    for name in test-snapd-service test-snapd-timer-service socket-activation \
+            test-snapd-user-service test-snapd-user-service-sockets \
+            test-snapd-user-timer-service test-snapd-tools \
+            test-snapd-control-consumer test-snapd-auto-aliases \
+            test-snapd-kvm ; do
+        if echo "$name" | grep -q user && echo "$SPREAD_SYSTEM" | grep -qF ubuntu-14.04; then
+            # None of the "user" snaps work on 14.04
+            continue
+        fi
+        "$TESTSTOOLS"/snaps-state install-local "$name"
+        snap list | MATCH "$name"
+    done
+
+    # kvm interface needs manual connection
+    snap connect test-snapd-kvm:kvm
+
+    snap install --edge test-snapd-dbus-provider
+    snap list | MATCH test-snapd-dbus-provider
+
+    # expecting to find various files that snap installation produced
+    test "$(find /etc/udev/rules.d -name '*-snap.*.rules' | wc -l)" -gt 0
+    test "$(find /etc/dbus-1/system.d -name 'snap.*.conf' | wc -l)" -gt 0
+    test "$(find /etc/modules-load.d/ -name 'snap.*.conf' | wc -l)" -gt 0
+    test "$(find /etc/systemd/system -name 'snap.*.service' | wc -l)" -gt 0
+    test "$(find /etc/systemd/system -name 'snap.*.timer' | wc -l)" -gt 0
+    test "$(find /etc/systemd/system -name 'snap.*.socket' | wc -l)" -gt 0
+    if echo "$SPREAD_SYSTEM" | grep -vqF ubuntu-14.04; then
+        test "$(find /etc/systemd/user -name 'snap.*.service' | wc -l)" -gt 0
+        test "$(find /etc/systemd/user -name 'snap.*.timer' | wc -l)" -gt 0
+        test "$(find /etc/systemd/user -name 'snap.*.socket' | wc -l)" -gt 0
+    fi
 
 debug: |
     systemctl --no-legend --full | grep -E 'snap\..*\.(service|timer|socket)'
@@ -58,10 +84,32 @@
         systemctl reset-failed snap.test-snapd-service.test-snapd-service-refuses-to-stop.service
     fi
 
-    # XXX: use retry-tool instead
+    # XXX: use retry instead
     sleep 5
     systemctl --no-legend --full > output.txt
     if grep -E "snap\..*\.(service|timer|socket)" < output.txt; then
         echo "found unexpected leftovers"
         exit 1
     fi
+
+    echo "No dangling service symlinks are left behind"
+    test -z "$(find /etc/systemd/system/multi-user.target.wants/ -name 'snap.test-snapd-service.*')"
+    test -z "$(find /etc/systemd/system/sockets.target.wants/ -name 'snap.*')"
+    test -z "$(find /etc/systemd/system/timers.target.wants/ -name 'snap.*')"
+    if echo "$SPREAD_SYSTEM" | grep -vqF ubuntu-14.04; then
+        test -z "$(find /etc/systemd/user/default.target.wants/ -name 'snap.*')"
+        test -z "$(find /etc/systemd/user/sockets.target.wants/ -name 'snap.*')"
+        test -z "$(find /etc/systemd/user/timers.target.wants/ -name 'snap.*')"
+    fi
+
+    test "$(find /etc/udev/rules.d -name '*-snap.*.rules' | wc -l)" -eq 0
+    test "$(find /etc/dbus-1/system.d -name 'snap.*.conf' | wc -l)" -eq 0
+    test "$(find /etc/modules-load.d/ -name 'snap.*.conf' | wc -l)" -eq 0
+    test "$(find /etc/systemd/system -name 'snap.*.service' -a ! -name "snap.mount.service" | wc -l)" -eq 0
+    test "$(find /etc/systemd/system -name 'snap.*.timer' | wc -l)" -eq 0
+    test "$(find /etc/systemd/system -name 'snap.*.socket' | wc -l)" -eq 0
+    if echo "$SPREAD_SYSTEM" | grep -vqF ubuntu-14.04; then
+        test "$(find /etc/systemd/user -name 'snap.*.service' | wc -l)" -eq 0
+        test "$(find /etc/systemd/user -name 'snap.*.timer' | wc -l)" -eq 0
+        test "$(find /etc/systemd/user -name 'snap.*.socket' | wc -l)" -eq 0
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/prepare-image-grub/task.yaml snapd-2.48.3+20.04/tests/main/prepare-image-grub/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/prepare-image-grub/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/prepare-image-grub/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,6 +4,9 @@
 
 backends: [-autopkgtest]
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
+
 # TODO: use the real stores with proper assertions fully as well once possible
 environment:
     ROOT: /tmp/root
diff -Nru snapd-2.45.1+20.04.2/tests/main/prepare-image-uboot-uc20/task.yaml snapd-2.48.3+20.04/tests/main/prepare-image-uboot-uc20/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/prepare-image-uboot-uc20/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/prepare-image-uboot-uc20/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -24,7 +24,7 @@
     chown -R test:test "$ROOT"
 
     # sign the model assertion
-    gendeveloper1model < "$TESTSLIB"/assertions/developer1-pi-uc20.model.json > "$ROOT/model.assertion"
+    gendeveloper1model < "$TESTSLIB"/assertions/developer1-pi-20.model.json > "$ROOT/model.assertion"
 
 restore: |
     if [ "$TRUST_TEST_KEYS" = "false" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed/task.yaml snapd-2.48.3+20.04/tests/main/preseed/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/preseed/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,8 +4,7 @@
   command works, up to the point where the image is ready to be booted.
   The test assumes cloud image with a core and lxd snaps in its seeds/.
 
-# TODO: reenable for ubuntu-20.04-*, that now uses the snapd snap
-systems: [ubuntu-19.10-*]
+systems: [ubuntu-2*]
 
 environment:
   IMAGE_MOUNTPOINT: /mnt/cloudimg
@@ -15,25 +14,38 @@
   # a cloud image url matching current $SPREAD_SYSTEM.
   #shellcheck source=tests/lib/nested.sh
   . "$TESTSLIB/nested.sh"
-  wget "$(get_image_url_for_nested_vm)" -O cloudimg.img
+  #shellcheck source=tests/lib/snaps.sh
+  . "$TESTSLIB/snaps.sh"
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
+
+  wget "$(nested_get_image_url_for_vm)" -O cloudimg.img
   mkdir -p "$IMAGE_MOUNTPOINT"
 
-restore: |
-  # any of the restore commands can fail depending on where execute part stopped,
-  # account for that with ||true.
-  umount_ubuntu_image "$IMAGE_MOUNTPOINT" || true
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
+  mount_ubuntu_image "$(pwd)/cloudimg.img" "$IMAGE_MOUNTPOINT"
 
-execute: |
+  # add snapd from this branch into the seed
+  repack_snapd_deb_into_snapd_snap "$PWD"
+  mv snapd-from-deb.snap snapd.snap
+  inject_snap_into_seed "$IMAGE_MOUNTPOINT" snapd
+
+  # for images that are already preseeded, we need to undo the preseeding there
+  echo "Running preseed --reset for already preseeded cloud images"
+  SNAPD_DEBUG=1 /usr/lib/snapd/snap-preseed --reset "$IMAGE_MOUNTPOINT"
+
+restore: |
   #shellcheck source=tests/lib/preseed.sh
   . "$TESTSLIB/preseed.sh"
-  mount_ubuntu_image cloudimg.img "$IMAGE_MOUNTPOINT"
-  setup_preseeding "$IMAGE_MOUNTPOINT"
+  umount_ubuntu_image "$IMAGE_MOUNTPOINT" || true
 
+execute: |
   echo "Checking missing chroot path arg error"
   /usr/lib/snapd/snap-preseed 2>&1 | MATCH "error: need chroot path as argument"
 
-  echo "Running pre-seeeding"
-  /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT"
+  echo "Running pre-seeding"
+  SNAPD_DEBUG=1 /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT"
 
   # sanity, core snap mounted by snap-preseed got unmounted
   mount | not MATCH "snap-preseed"
@@ -42,15 +54,29 @@
 
   echo "Check that the tasks of preseeded snapd have expected statuses"
   # Note, these checks match statuses, but not the order
-  MATCH "Done .+ prerequisites +Ensure prerequisites for \"core\" are available" < tasks.log
-  MATCH "Done .+ prepare-snap +Prepare snap \"/var/lib/snapd/seed/snaps/core_[0-9]+.snap" < tasks.log
-  MATCH "Done .+ mount-snap +Mount snap \"core\"" < tasks.log
-  MATCH "Done .+ copy-snap-data +Copy snap \"core\" data" < tasks.log
-  MATCH "Done .+ setup-profiles +Setup snap \"core\" \(unset\) security profiles" < tasks.log
-  MATCH "Done .+ link-snap +Make snap \"core\" \(unset\) available to the system" < tasks.log
-  MATCH "Done .+ auto-connect +Automatically connect eligible plugs and slots of snap \"core\"" < tasks.log
-  MATCH "Done .+ set-auto-aliases +Set automatic aliases for snap \"core\"" < tasks.log
-  MATCH "Done .+ setup-aliases +Setup snap \"core\" aliases" < tasks.log
+  # mark-preseeded task is where snap-preseed stopped, therefore it's in Doing.
+  MATCH "Doing .+ mark-preseeded +Mark system pre-seeded" < tasks.log
+
+  MATCH "Done .+ prerequisites +Ensure prerequisites for \"snapd\" are available" < tasks.log
+  MATCH "Done .+ prepare-snap +Prepare snap \"/var/lib/snapd/seed/snaps/snapd.snap" < tasks.log
+  MATCH "Done .+ mount-snap +Mount snap \"snapd\" \(unset\)" < tasks.log
+  MATCH "Done .+ copy-snap-data +Copy snap \"snapd\" data" < tasks.log
+  MATCH "Done .+ setup-profiles +Setup snap \"snapd\" \(unset\) security profiles" < tasks.log
+  MATCH "Done .+ link-snap +Make snap \"snapd\" \(unset\) available to the system" < tasks.log
+  MATCH "Done .+ auto-connect +Automatically connect eligible plugs and slots of snap \"snapd\"" < tasks.log
+  MATCH "Done .+ set-auto-aliases +Set automatic aliases for snap \"snapd\"" < tasks.log
+  MATCH "Done .+ setup-aliases +Setup snap \"snapd\" aliases" < tasks.log
+
+  MATCH "Done .+ prerequisites +Ensure prerequisites for \"core18\" are available" < tasks.log
+  MATCH "Done .+ prepare-snap +Prepare snap \"/var/lib/snapd/seed/snaps/core18_[0-9]+.snap" < tasks.log
+  MATCH "Done .+ mount-snap +Mount snap \"core18\" \([0-9]+\)" < tasks.log
+  MATCH "Done .+ copy-snap-data +Copy snap \"core18\" data" < tasks.log
+  MATCH "Done .+ setup-profiles +Setup snap \"core18\" \([0-9]+\) security profiles" < tasks.log
+  MATCH "Done .+ link-snap +Make snap \"core18\" \([0-9]+\) available to the system" < tasks.log
+  MATCH "Done .+ auto-connect +Automatically connect eligible plugs and slots of snap \"core18\"" < tasks.log
+  MATCH "Done .+ set-auto-aliases +Set automatic aliases for snap \"core18\"" < tasks.log
+  MATCH "Done .+ setup-aliases +Setup snap \"core18\" aliases" < tasks.log
+
   MATCH "Done .+ prerequisites +Ensure prerequisites for \"lxd\" are available" < tasks.log
   MATCH "Done .+ prepare-snap +Prepare snap \"/var/lib/snapd/seed/snaps/lxd_[0-9]+.snap\" \([0-9]+\)" < tasks.log
   MATCH "Done .+ mount-snap +Mount snap \"lxd\" \([0-9]+\)" < tasks.log
@@ -58,56 +84,55 @@
   MATCH "Done .+ setup-profiles +Setup snap \"lxd\" \([0-9]+\) security profiles" < tasks.log
   MATCH "Done .+ link-snap +Make snap \"lxd\" \([0-9]+\) available to the system" < tasks.log
   MATCH "Done .+ auto-connect +Automatically connect eligible plugs and slots of snap \"lxd\"" < tasks.log
-  MATCH "Done .+ connect +Connect lxd:network to core:network" < tasks.log
-  MATCH "Done .+ connect +Connect lxd:lxd-support to core:lxd-support" < tasks.log
-  MATCH "Done .+ connect +Connect lxd:system-observe to core:system-observe" < tasks.log
-  MATCH "Done .+ connect +Connect lxd:network-bind to core:network-bind" < tasks.log
+  MATCH "Done .+ connect +Connect lxd:network to snapd:network" < tasks.log
+  MATCH "Done .+ connect +Connect lxd:lxd-support to snapd:lxd-support" < tasks.log
+  MATCH "Done .+ connect +Connect lxd:system-observe to snapd:system-observe" < tasks.log
+  MATCH "Done .+ connect +Connect lxd:network-bind to snapd:network-bind" < tasks.log
   MATCH "Done .+ setup-profiles +Setup snap \"lxd\" \([0-9]+\) security profiles for auto-connections" < tasks.log
   MATCH "Done .+ set-auto-aliases +Set automatic aliases for snap \"lxd\"" < tasks.log
   MATCH "Done .+ setup-aliases +Setup snap \"lxd\" aliases" < tasks.log
 
   echo "Checking that there were no other 'Done' tasks when preseeding"
-  [ "$(grep -c ' Done ' tasks.log)" = "23" ]
-
-  # mark-preseeded task is where snap-preseed stopped, therefore it's in Doing.
-  MATCH "Doing .+ mark-preseeded +Mark system pre-seeded" < tasks.log
+  [ "$(grep -c ' Done ' tasks.log)" = "32" ]
 
   # everything below is pending execution on first boot
-  MATCH "Do .+ run-hook +Run install hook of \"lxd\" snap if present" < tasks.log
-  MATCH "Do .+ start-snap-services  +Start snap \"lxd\" \([0-9]+\) services" < tasks.log
+  MATCH "Do .+ run-hook +Run install hook of \"core18\" snap if present" < tasks.log
+  MATCH "Do .+ start-snap-services +Start snap \"lxd\" \([0-9]+\) services" < tasks.log
   MATCH "Do .+ run-hook +Run configure hook of \"lxd\" snap if present" < tasks.log
-  MATCH "Do .+ run-hook +Run install hook of \"core\" snap if present" < tasks.log
-  MATCH "Do .+ start-snap-services +Start snap \"core\" \(unset\) services" < tasks.log
   MATCH "Do .+ run-hook +Run health check of \"lxd\" snap" < tasks.log
   MATCH "Do .+ mark-seeded +Mark system seeded" < tasks.log
+  MATCH "Do .+ run-hook +Run install hook of \"snapd\" snap if present" < tasks.log
+  MATCH "Do .+ start-snap-services +Start snap \"snapd\" \(unset\) services" < tasks.log
   MATCH "Do .+ run-hook +Run configure hook of \"core\" snap if present" < tasks.log
+  MATCH "Do .+ start-snap-services  +Start snap \"core18\" \([0-9]+\) services" < tasks.log
+  MATCH "Do .+ run-hook +Run health check of \"core18\" snap" < tasks.log
+  MATCH "Do .+ run-hook +Run install hook of \"lxd\" snap if present" < tasks.log
 
   echo "Checking that apparmor and seccomp profiles have been created on the target image"
   AA_PROFILES="$IMAGE_MOUNTPOINT"/var/lib/snapd/apparmor/profiles
   SECCOMP_PROFILES="$IMAGE_MOUNTPOINT"/var/lib/snapd/seccomp/bpf
-  test -f "$AA_PROFILES"/snap-confine.core.*
-  test -f "$AA_PROFILES"/snap-update-ns.core
+
+  test -f "$AA_PROFILES"/snap-confine.snapd.*
   test -f "$AA_PROFILES"/snap-update-ns.lxd
+
   # the list of expected profiles isn't exhaustive, we're just checking some critical ones
   for prof in snap.lxd.lxd snap.lxd.hook.install snap.lxd.hook.configure snap.lxd.daemon; do
     test -f "$AA_PROFILES/$prof"
     test -f "$SECCOMP_PROFILES/$prof.bin"
   done
 
-  echo "Checking that mount units have been created on the target image"
+  echo "Checking that mount units have been created and enabled on the target image"
   SYSTEMD_UNITS="$IMAGE_MOUNTPOINT"/etc/systemd
   test -f "$SYSTEMD_UNITS"/system/snap-lxd-*.mount
-  test -f "$SYSTEMD_UNITS"/system/snap-core-*.mount
+  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-lxd-*.mount
+  test -f "$SYSTEMD_UNITS"/system/snap-snapd-*.mount
+  test -f "$SYSTEMD_UNITS"/system/snap-core18-*.mount
+  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-core18-*.mount
+  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-snapd-*.mount
+
   for unit in snap.lxd.daemon.service snap.lxd.daemon.unix.socket snap.lxd.activate.service; do
     test -f "$SYSTEMD_UNITS/system/$unit"
   done
 
-  echo "Checking enabled systemd mount units"
-  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-lxd-*.mount
-  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-core-*.mount
   echo "LXD service shouldn't be enabled at this point"
   test ! -e "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap.lxd.activate.service
-
-  #shellcheck source=tests/lib/preseed.sh
-  . "$TESTSLIB/preseed.sh"
-  umount_ubuntu_image "$IMAGE_MOUNTPOINT"
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed-lxd/metadata.yaml snapd-2.48.3+20.04/tests/main/preseed-lxd/metadata.yaml
--- snapd-2.45.1+20.04.2/tests/main/preseed-lxd/metadata.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed-lxd/metadata.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,7 @@
+architecture: "x86_64"
+creation_date: 1597313423 # To get current date in Unix time, use `date +%s` command
+properties:
+  architecture: "x86_64"
+  description: "Ubuntu 20.04 preseeded for test"
+  os: "ubuntu"
+  release: "focal"
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed-lxd/preseed-prepare.sh snapd-2.48.3+20.04/tests/main/preseed-lxd/preseed-prepare.sh
--- snapd-2.45.1+20.04.2/tests/main/preseed-lxd/preseed-prepare.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed-lxd/preseed-prepare.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh
+IMAGE_MOUNTPOINT=$1
+mount --rbind /dev "$IMAGE_MOUNTPOINT/dev"
+mount --rbind /proc "$IMAGE_MOUNTPOINT/proc"
+mount --rbind /sys "$IMAGE_MOUNTPOINT/sys"
+
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed-lxd/task.yaml snapd-2.48.3+20.04/tests/main/preseed-lxd/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/preseed-lxd/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed-lxd/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,154 @@
+summary: Check that preseeding of current ubuntu cloud image works under lxd.
+description: |
+  This test checks that preseeding of Ubuntu cloud images with snap-preseed
+  command works in lxc container and that the resulting image can be run
+  in a container and seeding finishes successfully.
+
+# this test works only on 18.04 because it requires lxd from deb (lxd snap
+# as it wouldn't allow mount) and tries to replicate launchpad builder setup.
+systems: [ubuntu-18.04-*]
+
+environment:
+  IMAGE_MOUNTPOINT: /mnt/cloudimg
+
+prepare: |
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  #shellcheck source=tests/lib/snaps.sh
+  . "$TESTSLIB/snaps.sh"
+
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
+
+  IMGURL=$(nested_get_image_url_for_vm ubuntu-20.04-64)
+  wget --quiet "$IMGURL" -O cloudimg.img
+
+  modprobe nbd
+
+  # Run qemu-nbd as a service, so that it does not interact with ssh
+  # stdin/stdout it would otherwise inherit from the spread session.
+  systemd-run --system --service-type=forking --unit=qemu-nbd-preseed.service "$(command -v qemu-nbd)" --fork -c /dev/nbd0 "$(pwd)/cloudimg.img"
+  # nbd0p1 may take a short while to become available
+  retry -n 5 --wait 1 test -e /dev/nbd0p1
+  mkdir -p "$IMAGE_MOUNTPOINT"
+  mount /dev/nbd0p1 "$IMAGE_MOUNTPOINT"
+
+  # add snapd from this branch into the seed
+  repack_snapd_deb_into_snapd_snap "$PWD"
+  mv snapd-from-deb.snap snapd.snap
+  inject_snap_into_seed "$IMAGE_MOUNTPOINT" snapd
+
+  if [ ! -x /usr/bin/lxc ]; then
+    apt install -y lxd
+    touch remove-lxd
+  fi
+
+  # for images that are already preseeded, we need to undo the preseeding there
+  echo "Running preseed --reset for already preseeded cloud images"
+  SNAPD_DEBUG=1 /usr/lib/snapd/snap-preseed --reset "$IMAGE_MOUNTPOINT"
+
+restore: |
+  if [ -f remove-lxd ]; then
+    for container in my-ubuntu my-ubuntu-preseeded; do
+      lxc stop "$container" --force || true
+      lxc delete "$container" || true
+    done
+    apt purge -y lxd
+    apt autoremove --purge -y
+  fi
+
+  rm -f preseeded-rootfs.tar.gz
+  rm -f overrides.log
+
+  umount "$IMAGE_MOUNTPOINT"
+  rmdir "$IMAGE_MOUNTPOINT"
+
+  # qemu-nbd -d may sporadically fail when removing the device,
+  # reporting it's still in use.
+  retry -n 5 --wait 1 qemu-nbd -d /dev/nbd0
+
+  "$TESTSTOOLS"/lxd-state undo-mount-changes
+
+execute: |
+  echo "Create a trivial container using the lxd snap"
+  lxd waitready
+  lxd init --auto
+
+  lxc launch "ubuntu:20.04" my-ubuntu
+
+  # use a privileged and unconfined lxd container that is close to launchpad
+  # builders configuration; this is required for mounting inside the container.
+  # based on lxd config created by https://git.launchpad.net/launchpad-buildd/tree/lpbuildd/target/lxd.py
+  lxc config set my-ubuntu security.privileged true
+  lxc config set my-ubuntu security.nesting true
+  cat <<__LXC__ | lxc config set my-ubuntu raw.lxc -
+  lxc.apparmor.profile=unconfined
+  lxc.cap.drop=
+  lxc.cap.drop=sys_time sys_module
+  lxc.cgroup.devices.allow=
+  lxc.cgroup.devices.deny=
+  lxc.mount.auto=
+  lxc.mount.auto=proc:rw sys:rw
+  __LXC__
+  lxc config device add my-ubuntu mounted-ubuntu-image disk source="$IMAGE_MOUNTPOINT" path="$IMAGE_MOUNTPOINT"
+  lxc restart my-ubuntu
+
+  echo "Make latest snap-preseed command available in the lxd container"
+  lxc exec my-ubuntu -- mkdir -p "$GOHOME"
+  lxc file push /usr/lib/snapd/snap-preseed "my-ubuntu/$GOHOME/"
+  lxc file push cloudimg.img "my-ubuntu/$GOHOME/"
+  lxc file push preseed-prepare.sh "my-ubuntu/$GOHOME/"
+
+  echo "Running preseeding in the lxd container"
+  # mount /dev, /proc, /sys under mounted ubuntu image in the container.
+  lxc exec my-ubuntu -- "$GOHOME"/preseed-prepare.sh "$IMAGE_MOUNTPOINT"
+  lxc exec my-ubuntu -- "$GOHOME"/snap-preseed "$IMAGE_MOUNTPOINT"
+
+  echo "Sanity check of mount units"
+  # preseeded image is mounted on the host, so we can directly inspect
+  # preseeding artifacts.
+  MATCH "Type=squashfs$" < "$IMAGE_MOUNTPOINT"/etc/systemd/system/snap-lxd-*.mount
+  MATCH "Type=squashfs$" < "$IMAGE_MOUNTPOINT"/etc/systemd/system/snap-snapd-*.mount
+  MATCH "Type=squashfs$" < "$IMAGE_MOUNTPOINT"/etc/systemd/system/snap-core18-*.mount
+
+  snap debug state "$IMAGE_MOUNTPOINT"/var/lib/snapd/state.json --change=1 > tasks.log
+
+  echo "Checking preseeding tasks"
+  MATCH "Doing .+ mark-preseeded +Mark system pre-seeded" < tasks.log
+  MATCH "Do .+ mark-seeded +Mark system seeded" < tasks.log
+
+  echo "Importing resulting ubuntu image with lxd"
+  # see https://ubuntu.com/tutorials/create-custom-lxd-images#3-creating-basic-system-installation
+  # XXX: this is suboptimal, copy current snapd-generator from 18.04 build into 20.04
+  cp /lib/systemd/system-generators/snapd-generator "$IMAGE_MOUNTPOINT"/lib/systemd/system-generators/
+  sudo tar -cvzf preseeded-rootfs.tar.gz -C "$IMAGE_MOUNTPOINT" .
+  tar -cvzf metadata.tar.gz metadata.yaml
+  lxc image import metadata.tar.gz preseeded-rootfs.tar.gz --alias ubuntu-preseeded
+  rm preseeded-rootfs.tar.gz
+
+  echo "Checking that preseeded image runs with lxd"
+  lxc launch ubuntu-preseeded my-ubuntu-preseeded
+
+  # it takes quite a bit before snapd is ready
+  retry -n 50 --wait 5 sh -c 'lxc exec my-ubuntu-preseeded --  snap wait system seed.loaded'
+  # check for changes in error, those could get unnoticed if seeding succeeded
+  # after a retry.
+  if lxc exec my-ubuntu-preseeded --  snap changes | MATCH -i error; then
+    echo "Unexpected seed error:"
+    lxc exec my-ubuntu-preseeded --  snap changes
+    exit 1
+  fi
+  lxc exec my-ubuntu-preseeded -- snap debug seeding | MATCH "preseeded:\s+true"
+  lxc exec my-ubuntu-preseeded -- snap debug seeding | MATCH "seeded:\s+true"
+  if lxc exec my-ubuntu-preseeded -- snap debug seeding | MATCH "seed-error"; then
+    echo "Unexpected seed error:"
+    lxc exec my-ubuntu-preseeded -- snap debug seeding
+    exit 1
+  fi
+
+  echo "Sanity check that mount overrides were generated inside the container"
+  lxc exec my-ubuntu-preseeded -- find /var/run/systemd/generator/ -name container.conf > overrides.log
+  MATCH "/var/run/systemd/generator/snap-core18.*mount.d/container.conf" < overrides.log
+  MATCH "/var/run/systemd/generator/snap-snapd-.*mount.d/container.conf" < overrides.log
+  MATCH "/var/run/systemd/generator/snap-lxd-.*mount.d/container.conf" < overrides.log
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed-reset/task.yaml snapd-2.48.3+20.04/tests/main/preseed-reset/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/preseed-reset/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed-reset/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,8 +3,7 @@
   This test checks that preseeding of Ubuntu cloud images with snap-preseed
   can be undone with --reset flag.
 
-# TODO: reenable for ubuntu-20.04-*, that now uses the snapd snap
-systems: [ubuntu-19.10-*]
+systems: [ubuntu-2*]
 
 environment:
   IMAGE_MOUNTPOINT: /mnt/cloudimg
@@ -14,39 +13,36 @@
   # a cloud image url matching current $SPREAD_SYSTEM.
   #shellcheck source=tests/lib/nested.sh
   . "$TESTSLIB/nested.sh"
-  wget "$(get_image_url_for_nested_vm)" -O cloudimg.img
+  wget "$(nested_get_image_url_for_vm)" -O cloudimg.img
   mkdir -p "$IMAGE_MOUNTPOINT"
 
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
+  mount_ubuntu_image "$(pwd)/cloudimg.img" "$IMAGE_MOUNTPOINT"
+
+  # for images that are already preseeded, we need to undo the preseeding there
+  echo "Running preseed --reset for already preseeded cloud images"
+  SNAPD_DEBUG=1 /usr/lib/snapd/snap-preseed --reset "$IMAGE_MOUNTPOINT"
+
 restore: |
   rm -f before-preseeding.txt
   rm -f after-reset.txt
 
-  # any of the restore commands can fail depending on where execute part stopped,
-  # account for that with ||true.
-  umount_ubuntu_image "$IMAGE_MOUNTPOINT" || true
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
+  umount_ubuntu_image "$IMAGE_MOUNTPOINT"
 
 execute: |
   find_files() {
-    # ubuntu-19.10 doesn't have new snapd deb yet, so exclude applications dir for now
-    # TODO: remove after 2.44 is there.
-    if [[ "$SPREAD_SYSTEM" = ubuntu-19.10-64 ]]; then
-      find "$IMAGE_MOUNTPOINT/etc/" "$IMAGE_MOUNTPOINT/usr/" "$IMAGE_MOUNTPOINT/var/" | grep -v "/var/lib/snapd/desktop/applications"
-    else
-      find "$IMAGE_MOUNTPOINT/etc/" "$IMAGE_MOUNTPOINT/usr/" "$IMAGE_MOUNTPOINT/var/"
-    fi
+    find "$IMAGE_MOUNTPOINT/etc/" "$IMAGE_MOUNTPOINT/usr/" "$IMAGE_MOUNTPOINT/var/"
   }
 
-  #shellcheck source=tests/lib/preseed.sh
-  . "$TESTSLIB/preseed.sh"
-  mount_ubuntu_image cloudimg.img "$IMAGE_MOUNTPOINT"
-  setup_preseeding "$IMAGE_MOUNTPOINT"
-
   find_files > before-preseeding.txt
 
-  echo "Running pre-seeeding"
+  echo "Running pre-seeding"
   /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT"
 
-  echo "Running preseeeding again should fail"
+  echo "Running preseeding again should fail"
   if OUT=$(/usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT" 2>&1); then
     echo "Expected snap-preseed to fail"
     exit 1
@@ -65,9 +61,10 @@
     exit 1
   fi
 
-  echo "Running preseeeding again should succeed"
+  echo "Running preseeding again should succeed"
   /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT"
 
-  #shellcheck source=tests/lib/preseed.sh
-  . "$TESTSLIB/preseed.sh"
-  umount_ubuntu_image "$IMAGE_MOUNTPOINT"
+  echo "And running snap-preseed with a relative path works"
+  cd /mnt
+  /usr/lib/snapd/snap-preseed --reset cloudimg
+  /usr/lib/snapd/snap-preseed cloudimg
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed-snapd-snap/seed.yaml.in snapd-2.48.3+20.04/tests/main/preseed-snapd-snap/seed.yaml.in
--- snapd-2.45.1+20.04.2/tests/main/preseed-snapd-snap/seed.yaml.in	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed-snapd-snap/seed.yaml.in	1970-01-01 00:00:00.000000000 +0000
@@ -1,7 +0,0 @@
-snaps:
- - name: snapd
-   file: @SNAPD@
-   unasserted: true
- - name: core18
-   file: @CORE@
-   unasserted: true
diff -Nru snapd-2.45.1+20.04.2/tests/main/preseed-snapd-snap/task.yaml snapd-2.48.3+20.04/tests/main/preseed-snapd-snap/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/preseed-snapd-snap/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/preseed-snapd-snap/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,110 +0,0 @@
-summary: |
-  Check that preseeding of current ubuntu cloud image works with snapd
-  and core18.
-
-description: |
-  This test checks that preseeding of Ubuntu cloud images with snap-preseed
-  command works, up to the point where the image is ready to be booted.
-  The test assumes cloud image with a core and lxd snaps in its seeds/.
-
-systems: [ubuntu-19.10-*, ubuntu-20.04-*]
-
-environment:
-  IMAGE_MOUNTPOINT: /mnt/cloudimg
-
-prepare: |
-  # the get_image_url_for_nested_vm is a convenient helper that returns
-  # a cloud image url matching current $SPREAD_SYSTEM.
-  #shellcheck source=tests/lib/nested.sh
-  . "$TESTSLIB/nested.sh"
-  wget "$(get_image_url_for_nested_vm)" -O cloudimg.img
-  mkdir -p "$IMAGE_MOUNTPOINT"
-
-restore: |
-  #shellcheck source=tests/lib/preseed.sh
-  . "$TESTSLIB/preseed.sh"
-
-  # any of the restore commands can fail depending on where execute part stopped,
-  # account for that with ||true.
-  umount_ubuntu_image "$IMAGE_MOUNTPOINT" || true
-
-execute: |
-  setup_preseeding_core18() {
-    local IMAGE_MOUNTPOINT=$1
-    local SEEDS_DIR
-    SEEDS_DIR="$IMAGE_MOUNTPOINT/var/lib/snapd/seed/"
-    rm -f "$SEEDS_DIR"/snaps/*.snap
-    rm -f "$SEEDS_DIR"/seed.yaml
-
-    snap download --edge snapd
-    snap download --edge core18
-
-    CORE=$(ls core18*.snap)
-    SNAPD=$(ls snapd*.snap)
-    sed seed.yaml.in  -E -e "s/@CORE@/$CORE/" -e "s/@SNAPD@/$SNAPD/" > "$SEEDS_DIR"/seed.yaml
-
-    cp "$CORE" "$SNAPD" "$SEEDS_DIR"/snaps/
-  }
-
-  #shellcheck source=tests/lib/preseed.sh
-  . "$TESTSLIB/preseed.sh"
-  mount_ubuntu_image cloudimg.img "$IMAGE_MOUNTPOINT"
-  setup_preseeding_core18 "$IMAGE_MOUNTPOINT"
-
-  echo "Running pre-seeeding"
-  /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT"
-
-  # sanity, core snap mounted by snap-preseed got unmounted
-  mount | not MATCH "snap-preseed"
-
-  snap debug state "$IMAGE_MOUNTPOINT"/var/lib/snapd/state.json --change=1 > tasks.log
-
-  echo "Check that the tasks of preseeded snapd have expected statuses"
-  # Note, these checks match statuses, but not the order
-  MATCH "Done .+ prerequisites +Ensure prerequisites for \"snapd\" are available" < tasks.log
-  MATCH "Done .+ prepare-snap +Prepare snap \"/var/lib/snapd/seed/snaps/snapd_[0-9]+.snap" < tasks.log
-  MATCH "Done .+ mount-snap +Mount snap \"snapd\"" < tasks.log
-  MATCH "Done .+ copy-snap-data +Copy snap \"snapd\" data" < tasks.log
-  MATCH "Done .+ setup-profiles +Setup snap \"snapd\" \(unset\) security profiles" < tasks.log
-  MATCH "Done .+ link-snap +Make snap \"snapd\" \(unset\) available to the system" < tasks.log
-  MATCH "Done .+ auto-connect +Automatically connect eligible plugs and slots of snap \"snapd\"" < tasks.log
-  MATCH "Done .+ set-auto-aliases +Set automatic aliases for snap \"snapd\"" < tasks.log
-  MATCH "Done .+ setup-aliases +Setup snap \"snapd\" aliases" < tasks.log
-  MATCH "Done .+ prerequisites +Ensure prerequisites for \"core18\" are available" < tasks.log
-  MATCH "Done .+ prepare-snap +Prepare snap \"/var/lib/snapd/seed/snaps/core18_[0-9]+.snap\"" < tasks.log
-  MATCH "Done .+ mount-snap +Mount snap \"core18\" \(unset\)" < tasks.log
-  MATCH "Done .+ copy-snap-data +Copy snap \"core18\" data" < tasks.log
-  MATCH "Done .+ setup-profiles +Setup snap \"core18\" \(unset\) security profiles" < tasks.log
-  MATCH "Done .+ link-snap +Make snap \"core18\" \(unset\) available to the system" < tasks.log
-  MATCH "Done .+ auto-connect +Automatically connect eligible plugs and slots of snap \"core18\"" < tasks.log
-  MATCH "Done .+ setup-profiles +Setup snap \"core18\" \(unset\) security profiles" < tasks.log
-  MATCH "Done .+ set-auto-aliases +Set automatic aliases for snap \"core18\"" < tasks.log
-  MATCH "Done .+ setup-aliases +Setup snap \"core18\" aliases" < tasks.log
-
-  echo "Checking that there were no other 'Done' tasks when preseeding"
-  [ "$(grep -c ' Done ' tasks.log)" = "18" ]
-
-  # mark-preseeded task is where snap-preseed stopped, therefore it's in Doing.
-  MATCH "Doing .+ mark-preseeded +Mark system pre-seeded" < tasks.log
-
-  # everything below is pending execution on first boot
-  MATCH "Do .+ run-hook +Run install hook of \"snapd\" snap if present" < tasks.log
-  MATCH "Do .+ start-snap-services  +Start snap \"snapd\" \(unset\) services" < tasks.log
-  MATCH "Do .+ run-hook +Run configure hook of \"core\" snap if present" < tasks.log
-  MATCH "Do .+ run-hook +Run install hook of \"core18\" snap if present" < tasks.log
-  MATCH "Do .+ start-snap-services +Start snap \"core18\" \(unset\) services" < tasks.log
-  MATCH "Do .+ run-hook +Run health check of \"core18\" snap" < tasks.log
-  MATCH "Do .+ mark-seeded +Mark system seeded" < tasks.log
-
-  echo "Checking that mount units have been created on the target image"
-  SYSTEMD_UNITS="$IMAGE_MOUNTPOINT"/etc/systemd
-  test -f "$SYSTEMD_UNITS"/system/snap-snapd-*.mount
-  test -f "$SYSTEMD_UNITS"/system/snap-core18-*.mount
-
-  echo "Checking enabled systemd mount units"
-  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-snapd-*.mount
-  test -L "$SYSTEMD_UNITS"/system/multi-user.target.wants/snap-core18-*.mount
-
-  #shellcheck source=tests/lib/preseed.sh
-  . "$TESTSLIB/preseed.sh"
-  umount_ubuntu_image "$IMAGE_MOUNTPOINT"
diff -Nru snapd-2.45.1+20.04.2/tests/main/proxy/task.yaml snapd-2.48.3+20.04/tests/main/proxy/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/proxy/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/proxy/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -30,6 +30,4 @@
     snap find test-snapd-tools | MATCH test-snapd-tools
 
     # check unit output
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-    check_journalctl_log 'CONNECT api.snapcraft.io' -u tinyproxy
+    "$TESTSTOOLS"/journal-state match-log 'CONNECT api.snapcraft.io' -u tinyproxy
diff -Nru snapd-2.45.1+20.04.2/tests/main/proxy-no-core/task.yaml snapd-2.48.3+20.04/tests/main/proxy-no-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/proxy-no-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/proxy-no-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -50,6 +50,4 @@
     echo "Ensure that snap install works even without an installed core to install core"
     snap install core
 
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-    check_journalctl_log 'CONNECT (.*.cdn.snapcraft.io|.*.cdn.snapcraftcontent.com)' -u tinyproxy
+    "$TESTSTOOLS"/journal-state match-log 'CONNECT (.*.cdn.snapcraft.io|.*.cdn.snapcraftcontent.com)' -u tinyproxy
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh/task.yaml snapd-2.48.3+20.04/tests/main/refresh/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,6 +9,9 @@
     a given snap with an updatable version (version string like 2.0+fake1) in the
     edge channel.
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -ubuntu-14.04*]
+
 environment:
     SNAP_NAME/parallel_strict_fake,parallel_strict_remote: test-snapd-tools_instance
     SNAP_NAME/strict_fake,strict_remote: test-snapd-tools
@@ -19,11 +22,10 @@
     STORE_TYPE/parallel_strict_remote,strict_remote,classic_remote: ${REMOTE_STORE}
 
 prepare: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+    tests.cleanup prepare
 
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -61,11 +63,10 @@
     fi
 
 restore: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+    tests.cleanup restore
 
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -82,11 +83,8 @@
     fi
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -110,9 +108,43 @@
     #
     # echo "================================="
 
+    # Set refresh app awareness even on core systems, where we do not have
+    # inotify tools, so that we exercise that code path, even if it is not
+    # measured in the test.
+    snap set system experimental.refresh-app-awareness=true
+    tests.cleanup defer snap unset system experimental.refresh-app-awareness
+
+    #shellcheck source=tests/lib/pkgdb.sh
+    if os.query is-classic && ! os.query is-trusty && [ "$(. /etc/os-release && echo "$ID")" != amzn ]; then
+      . "$TESTSLIB/pkgdb.sh"
+      distro_install_package inotify-tools
+      # XXX: probably a bug in defer, this fails without ' ' quotes around the rest.
+      # shellcheck disable=SC2016
+      tests.cleanup defer 'bash -c ". $TESTSLIB/pkgdb.sh; distro_purge_package inotify-tools"'
+      systemd-run \
+        --unit test-snapd-watch-inhibit.service \
+        -- \
+        "$(command -v inotifywait)" \
+        --monitor \
+        --recursive \
+        --outfile /tmp/inhibit.events \
+        /var/lib/snapd/inhibit
+      tests.cleanup defer systemctl stop test-snapd-watch-inhibit.service
+    fi
+
     echo "When the snap is refreshed"
     snap refresh --channel=edge "$SNAP_NAME"
 
+    if [ -f /tmp/inhibit.events ]; then
+      echo "During the refresh process, the inhibition lock was established and released"
+      MATCH "/var/lib/snapd/inhibit/ OPEN $SNAP_NAME.lock" /tmp/inhibit.events
+      MATCH "/var/lib/snapd/inhibit/ MODIFY $SNAP_NAME.lock" /tmp/inhibit.events
+      MATCH "/var/lib/snapd/inhibit/ CLOSE_WRITE,CLOSE $SNAP_NAME.lock" /tmp/inhibit.events
+      tests.cleanup pop  # stop the inotifywait unit
+      tests.cleanup pop  # remove inotify-tools
+    fi
+    tests.cleanup pop  # unset refresh-app-awareness
+
     echo "Then the new version is listed"
     expected="$SNAP_NAME +$SNAP_VERSION_PATTERN"
     snap list | grep -Pzq "$expected"
@@ -124,9 +156,7 @@
     echo "classic snaps "
 
     echo "When multiple snaps have no update we have a good message"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local basic
+    "$TESTSTOOLS"/snaps-state install-local basic
     snap refresh "$SNAP_NAME" basic 2>&1 | MATCH "All snaps up to date."
 
     echo "When moving to stable"
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-all/task.yaml snapd-2.48.3+20.04/tests/main/refresh-all/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-all/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-all/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Check that more than one snap is refreshed.
 
-systems: [-ubuntu-core-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -ubuntu-14.04*]
 
 details: |
     We use only the fake store for this test because we currently
@@ -53,14 +54,12 @@
     snap refresh 2>&1 | MATCH "All snaps up to date."
 
     echo "When the store is configured to make them refreshable"
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
     #shellcheck source=tests/lib/store.sh
     . "$TESTSLIB"/store.sh
     init_fake_refreshes "$BLOB_DIR" test-snapd-tools
-    wait_for_file "$BLOB_DIR"/test-snapd-tools*fake1*.snap 4 .5
+    retry -n 4 --wait 0.5 test -e "$BLOB_DIR"/test-snapd-tools*fake1*.snap
     init_fake_refreshes  "$BLOB_DIR" test-snapd-python-webserver
-    wait_for_file "$BLOB_DIR"/test-snapd-python-webserver*fake1*.snap 4 .5
+    retry -n 4 --wait 0.5 test -e "$BLOB_DIR"/test-snapd-python-webserver*fake1*.snap
 
     echo "And a refresh is performed"
     snap refresh
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-all-undo/task.yaml snapd-2.48.3+20.04/tests/main/refresh-all-undo/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-all-undo/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-all-undo/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Check that undo for snap refresh works
 
-systems: [-ubuntu-core-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -ubuntu-14.04*]
 
 environment:
     BLOB_DIR: $(pwd)/fake-store-blobdir
@@ -45,14 +46,12 @@
     snap refresh 2>&1 | MATCH "All snaps up to date"
 
     echo "When the store is configured to make them refreshable"
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
     #shellcheck source=tests/lib/store.sh
     . "$TESTSLIB"/store.sh
     init_fake_refreshes "$BLOB_DIR" "$GOOD_SNAP"
-    wait_for_file "$BLOB_DIR/${GOOD_SNAP}"*fake1*.snap 4 .5
+    retry -n 4 --wait 0.5 test -e "$BLOB_DIR/${GOOD_SNAP}"*fake1*.snap
     init_fake_refreshes "$BLOB_DIR" "$BAD_SNAP"
-    wait_for_file "$BLOB_DIR/${BAD_SNAP}"*fake1*.snap 4 .5
+    retry -n 4 --wait 0.5 test -e "$BLOB_DIR/${BAD_SNAP}"*fake1*.snap
 
     echo "When a snap is broken"
     echo "i-am-broken-now" >> "$BLOB_DIR/${BAD_SNAP}"*fake1*.snap
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-app-awareness/task.yaml snapd-2.48.3+20.04/tests/main/refresh-app-awareness/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-app-awareness/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-app-awareness/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,6 @@
 summary: Ensure that foreground applications block app refresh.
-# fedora-31: uses cgroupv2, which we don't support
-systems: [ -fedora-31-*]
+# Ubuntu 14.04's special version of systemd doesn't have StartTransientUnit API.
+systems: [-ubuntu-14.04-*]
 details: |
     When the refresh-app-awareness feature is enabled running snap processes,
     mainly foreground applications, will block the refresh of said snap.
@@ -11,6 +11,7 @@
     sed -e "s/@CONFINEMENT@/$CONFINEMENT/g" <test-snapd-refresh.v2/meta/snap.yaml.in >test-snapd-refresh.v2/meta/snap.yaml
     snap pack test-snapd-refresh.v1
     snap pack test-snapd-refresh.v2
+    tests.session -u test prepare
 environment:
     CONFINEMENT/classic: classic
     CONFINEMENT/strict: strict
@@ -18,12 +19,16 @@
     snap remove --purge test-snapd-refresh
     rm -f test-snapd-refresh-{1,2}_all.snap
     rm -f test-snapd-refresh.*/meta/snap.yaml
-    rmdir /sys/fs/cgroup/pids/snap.test-snapd-refresh.sh || true
-    rmdir /sys/fs/cgroup/pids/snap.test-snapd-refresh.version || true
-    # TODO: There is currently no way to unset configuration options.
-    # Once this is fixed please uncomment this line:
-    # snap unset core experimental.refresh-app-awareness
+    snap unset core experimental.refresh-app-awareness
     rm -f install.log
+    # Stop the dbus.service of the user session of the root user. This test
+    # runs in several configurations, not all of which have this capability.
+    # Where supported the test code below causes socket activation, through the
+    # refresh-app-awareness application tracking mechanism built into snap
+    # run. This session-level dbus daemon is detected as spurious by the
+    # invariant checker.
+    systemctl --user stop dbus.service || true
+    tests.session -u test restore
 execute: |
     if ! snap debug sandbox-features --required "confinement-options:$CONFINEMENT"; then
         echo "SKIP: unsupported confinement variant"
@@ -40,6 +45,10 @@
     esac
     test-snapd-refresh.version | MATCH v1
 
+    # We can run "snap run" as a test user, which does not have the permission
+    # to create the run inhibition lock file.
+    tests.session -u test exec snap run test-snapd-refresh.version | MATCH v1
+
     # Run a sleeper app to keep the snap busy. The purpose of the stamp file is
     # to allow us to synchronize with the concurrently running program.
     #shellcheck disable=SC2016
@@ -47,9 +56,13 @@
     pid=$!
     trap 'kill '"$pid"' || true' EXIT
 
+    # While the sleeper app is running check that we can still run other
+    # processes. This checks if we can spawn a distinct scope.
+    test-snapd-refresh.version | MATCH v1
+
     # Ensure that snap-confine has finished its task and that the snap process
     # is active. Note that we don't want to wait forever either.
-    retry-tool -n 30 --wait 0.1 test -e /var/snap/test-snapd-refresh/current/stamp
+    retry -n 30 --wait 0.1 test -e /var/snap/test-snapd-refresh/current/stamp
 
     # Try to install v2, it should fail because v1 is running. Snapd is kind
     # enough to tell us what is preventing the install from working.
@@ -81,3 +94,7 @@
             ;;
     esac
     test-snapd-refresh.version | MATCH v2
+
+    # We can run "snap run" as a test user, which does not have the permission
+    # to open the run inhibition lock file for writing.
+    tests.session -u test exec snap run test-snapd-refresh.version | MATCH v2
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-classic/task.yaml snapd-2.48.3+20.04/tests/main/refresh-classic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-classic/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-classic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,38 @@
+summary: Check that refresh from classic->strict works
+
+# ubuntu-core does not support classic confinement
+systems: [-ubuntu-core-*]
+
+prepare: |
+    #shellcheck source=tests/lib/dirs.sh
+    . "$TESTSLIB"/dirs.sh
+
+    case "$SPREAD_SYSTEM" in
+        fedora-*|arch-*|centos-*)
+            # although classic snaps do not work out of the box on fedora,
+            # we still want to verify if the basics do work if the user
+            # symlinks /snap to $SNAP_MOUNT_DIR themselves
+            ln -sf $SNAP_MOUNT_DIR /snap
+            ;;
+    esac
+
+restore: |
+    case "$SPREAD_SYSTEM" in
+        fedora-*|arch-*|centos-*)
+            rm -f /snap
+            ;;
+    esac
+
+execute: |
+    echo "Install a snap that needs classic confinement"
+    snap install --classic --edge test-snapd-classic-confinement
+    snap list test-snapd-classic-confinement | MATCH '2.0\+fake1'
+
+    echo "Now switch to candidate that is strictly confined"
+    snap switch --candidate test-snapd-classic-confinement
+
+    echo "And validate that a refresh will go from classic->strict"
+    snap refresh
+
+    echo "Validate we got the new version"
+    snap list test-snapd-classic-confinement | MATCH '2.0\+now-strict'
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-delta/task.yaml snapd-2.48.3+20.04/tests/main/refresh-delta/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-delta/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-delta/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,11 +16,8 @@
     snap install --edge "$SNAP_NAME"
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "When the snap is refreshed"
     snap refresh --beta "$SNAP_NAME"
 
     echo "Then deltas are successfully applied"
-    check_journalctl_log "Successfully applied delta"
+    "$TESTSTOOLS"/journal-state match-log "Successfully applied delta"
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-delta-from-core/task.yaml snapd-2.48.3+20.04/tests/main/refresh-delta-from-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-delta-from-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-delta-from-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,10 +21,7 @@
     fi
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "When the snap is refreshed"
     snap refresh --beta "$SNAP_NAME"
     echo "Then deltas are successfully applied"
-    check_journalctl_log "Successfully applied delta"
+    "$TESTSTOOLS"/journal-state match-log "Successfully applied delta"
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-devmode/task.yaml snapd-2.48.3+20.04/tests/main/refresh-devmode/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-devmode/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-devmode/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,6 +9,9 @@
     a given snap with an updatable version (version string like 2.0+fake1) in the
     edge channel.
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
+
 environment:
     SNAP_NAME: test-snapd-tools
     SNAP_VERSION_PATTERN: \d+\.\d+\+fake1
@@ -17,11 +20,8 @@
     STORE_TYPE/remote: ${REMOTE_STORE}
 
 prepare: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -45,11 +45,8 @@
     fi
 
 restore: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -62,11 +59,8 @@
     fi
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/refresh-undo/task.yaml snapd-2.48.3+20.04/tests/main/refresh-undo/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/refresh-undo/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/refresh-undo/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -19,9 +19,7 @@
     snap pack "$TESTSLIB/snaps/$SNAP_NAME_BAD"
 
 debug: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB"/journalctl.sh
-    get_journalctl_log -u snap.test-snapd-service.service.service
+    "$TESTSTOOLS"/journal-state get-log -u snap.test-snapd-service.service.service
 
 execute: |
     wait_for_service_status() {
diff -Nru snapd-2.45.1+20.04.2/tests/main/regression-home-snap-root-owned/task.yaml snapd-2.48.3+20.04/tests/main/regression-home-snap-root-owned/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/regression-home-snap-root-owned/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/regression-home-snap-root-owned/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,19 +1,20 @@
 summary: Regression test that ensures that $HOME/snap is not root owned for sudo commands
-
+systems:
+    - -ubuntu-14.04-*  # no support for tests.session
 prepare: |
     # ensure we have no snap user data directory yet
     rm -rf /home/test/snap
     rm -rf /root/snap
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
-
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
+    tests.session -u test prepare
+restore: |
+    tests.session -u test restore
 execute: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
 
     # run a snap command via sudo
-    output=$(su -l -c "sudo $SNAP_MOUNT_DIR/bin/test-snapd-sh.sh -c 'env'" test)
+    output="$(tests.session -u test exec sudo "$SNAP_MOUNT_DIR/bin/test-snapd-sh.sh" -c env)"
 
     # ensure SNAP_USER_DATA points to the right place
     echo "$output" | MATCH SNAP_USER_DATA=/root/snap/test-snapd-sh/x[0-9]+
diff -Nru snapd-2.45.1+20.04.2/tests/main/remove-auto-connections/task.yaml snapd-2.48.3+20.04/tests/main/remove-auto-connections/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/remove-auto-connections/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/remove-auto-connections/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,7 +8,7 @@
 systems: [-ubuntu-core-*]
 
 prepare: |
-  snap install jq
+  snap install --edge jq
   snap pack simplesnap.v1
   snap pack simplesnap.v2
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/remove-errors/task.yaml snapd-2.48.3+20.04/tests/main/remove-errors/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/remove-errors/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/remove-errors/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,22 +1,18 @@
 summary: Check remove command errors
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
     #shellcheck source=tests/lib/names.sh
     . "$TESTSLIB/names.sh"
 
     BASE_SNAP=core
     TARGET_SNAP=test-snapd-tools
-    if is_core18_system; then
+    if os.query is-core18; then
         BASE_SNAP=core18
         TARGET_SNAP=test-snapd-tools-core18
     fi
 
     echo "Given a base snap, $BASE_SNAP, is installed"
-    install_local "$TARGET_SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$TARGET_SNAP"
 
     echo "Ensure the important snaps can not be removed"
     for sn in $BASE_SNAP $kernel_name $gadget_name; do
diff -Nru snapd-2.45.1+20.04.2/tests/main/remove-user/task.yaml snapd-2.48.3+20.04/tests/main/remove-user/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/remove-user/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/remove-user/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,80 +0,0 @@
-summary: Ensure remove-user functionality
-
-# TODO:UC20: enable for uc20, userdel --extrausers "$USER" is failing
-# right now with: "user $USER does not exist'
-systems: [ubuntu-core-1*]
-
-environment:
-    # Note that any valid sso account will work for this test
-    USER_EMAIL: mvo@ubuntu.com
-    USER_NAME: mvo
-
-prepare: |
-    # Note: make this test work with the user already created in the device
-    if [ "$(snap managed)" = "true" ]; then
-        # Leave a file indicating the device was initially managed
-        touch managed.device
-
-        exit 0
-    fi
-    snap create-user --sudoer "$USER_EMAIL"
-
-restore: |
-    if [ -e managed.device ]; then
-        exit 0
-    fi
-    userdel --extrausers -r "$USER_NAME" || true
-    rm -rf "/etc/sudoers.d/create-user-$USER_NAME"
-
-execute: |
-    if [ -e managed.device ]; then
-        exit 0
-    fi
-
-    echo "sanity check: user in passwd"
-    id "$USER_NAME"
-    echo "sanity check: has sudoer file"
-    test -f "/etc/sudoers.d/create-user-$USER_NAME"
-    echo "sanity check: user has a home" 
-    test -d "/home/$USER_NAME"
-
-    echo "snap remove-user fails when run as non-root user without sudo"
-    expected="error: access denied (try with sudo)"
-    if obtained=$(su - test /bin/sh -c "snap remove-user $USER_NAME 2>&1"); then
-        echo "remove-user command should have failed"
-    fi
-    [ "$obtained" = "$expected" ]
-
-    echo "snap remove-user needs root and snap login is not enough"
-    if [ -n "$SPREAD_STORE_USER" ] && [ -n "$SPREAD_STORE_PASSWORD" ]; then
-        echo "Checking successful login"
-        expect -d -f "$TESTSLIB"/successful_login.exp
-
-        expected="error: access denied (try with sudo)"
-        if obtained=$(su - test /bin/sh -c "snap remove-user $USER_NAME 2>&1"); then
-            echo "remove-user command should have failed"
-        fi
-        [ "$obtained" = "$expected" ]
-    fi
-
-    echo "snap remove-user succeeds when run as non-root user with sudo"
-    expected="removed user \"$USER_NAME\""
-    obtained=$(su - test /bin/sh -c "sudo snap remove-user $USER_NAME 2>&1")
-    [ "$obtained" = "$expected" ]
-
-    echo "user no longer in passwd"
-    not id "$USER_NAME"
-    echo "user no longer has sudoer file"
-    test ! -f "/etc/sudoers.d/create-user-$USER_NAME"
-    echo "user no longer has a home"
-    test ! -d "/home/$USER_NAME"
-
-    echo "user is no longer managed by snapd"
-    [ "$(snap managed)" = "false" ]
-
-    echo "snap remove-user cannot remove arbitrary users"
-    expected="error: user \"root\" is not known"
-    if obtained=$(su - test /bin/sh -c "sudo snap remove-user root 2>&1"); then
-        echo "remove-user command should have failed"
-    fi
-    [ "$obtained" = "$expected" ]
diff -Nru snapd-2.45.1+20.04.2/tests/main/retry-tool/task.yaml snapd-2.48.3+20.04/tests/main/retry-tool/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/retry-tool/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/retry-tool/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,15 +0,0 @@
-summary: smoke test for the retry test tool
-execute: |
-    # Retry runs the command that was passed as argument and returns the exit
-    # code of that command.
-    retry-tool true
-    not retry-tool -n 1 false
-    # If the command doesn't exist it is not re-tried multiple times.
-    ( not retry-tool this-command-does-not-exist ) 2>&1 \
-        | grep -F 'retry: cannot execute command this-command-does-not-exist: [Errno 2] No such file or directory'
-    # On failure it tells us about it, showing progress.
-    retry-tool -n 2 --wait 0.1 false 2>&1 | grep -F "retry: command false failed with code 1"
-    retry-tool -n 2 --wait 0.1 false 2>&1 | grep -F "retry: next attempt in 0.1 second(s) (attempt 1 of 2)"
-    retry-tool -n 2 --wait 0.1 false 2>&1 | grep -F "retry: command false keeps failing after 2 attempts"
-    # Though all output is removed with the --quiet switch.
-    test "$(retry-tool -n 2 --wait 0.1 --quiet false 2>&1 | wc -l)" -eq 0
diff -Nru snapd-2.45.1+20.04.2/tests/main/revert/task.yaml snapd-2.48.3+20.04/tests/main/revert/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/revert/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/revert/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,16 +1,16 @@
 summary: Check that revert works.
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
+
 environment:
     STORE_TYPE/fake: fake
     STORE_TYPE/remote: ${REMOTE_STORE}
     BLOB_DIR: $(pwd)/fake-store-blobdir
 
 prepare: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -34,11 +34,8 @@
     fi
 
 restore: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -51,11 +48,8 @@
     fi
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/revert-devmode/task.yaml snapd-2.48.3+20.04/tests/main/revert-devmode/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/revert-devmode/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/revert-devmode/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,17 +3,17 @@
 # slow in autopkgtest (>1m)
 backends: [-autopkgtest]
 
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-14.04*]
+
 environment:
     STORE_TYPE/fake: fake
     STORE_TYPE/remote: ${REMOTE_STORE}
     BLOB_DIR: $(pwd)/fake-store-blobdir
 
 prepare: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -37,11 +37,8 @@
     fi
 
 restore: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
@@ -54,11 +51,8 @@
     fi
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
     if [ "$STORE_TYPE" = "fake" ]; then
-        if is_core_system; then
+        if os.query is-core; then
             exit
         fi
         if [ "$TRUST_TEST_KEYS" = "false" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/searching/task.yaml snapd-2.48.3+20.04/tests/main/searching/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/searching/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/searching/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -49,7 +49,16 @@
     # TODO: discuss with the store how we can make this test stable, i.e.
     #       that section/snap changes do not break us
     if [ "$(uname -m)" = "x86_64" ]; then
-        snap find --section=photo-and-video vlc | MATCH vlc
+        set +e
+        snap find --section=photo-and-video vlc >vlc.log 2>&1
+        retval=$?
+        set -e
+
+        if [ "$retval" -eq 0 ]; then
+          MATCH vlc < vlc.log
+        else
+          MATCH 'error: cannot get snap sections: cannot sections: got unexpected HTTP status code 403 via GET to "https://api.snapcraft.io/api/v1/snaps/sections"' < vlc.log
+        fi
     else
         # actual output:
         # Name           Version  Publisher  Notes  Summary
diff -Nru snapd-2.45.1+20.04.2/tests/main/seccomp-statx/task.yaml snapd-2.48.3+20.04/tests/main/seccomp-statx/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/seccomp-statx/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/seccomp-statx/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,15 +5,12 @@
     available on each kernel but should not be blocked by seccomp
     when the kernel implements it
 
-# This test will only pass on Ubuntu 18.10 and on other systems with seccomp
-# 2.3.3 or newer. Eventually with some tricks we should be able to support all
-# systems but for the purpose of snapd 2.36 this is the best we can do.
-systems: [ubuntu-19.10-*, ubuntu-20.04-*]
+# This test will only pass on systems with seccomp 2.3.3 or newer which
+# is available on all Ubuntu LTS releases.
+systems: [ubuntu-16.04-*, ubuntu-18.04-*, ubuntu-2*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-statx
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-statx
 
 execute: |
     # Notably, this doesn't print statx: blocked anymore
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-apparmor/task.yaml snapd-2.48.3+20.04/tests/main/security-apparmor/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-apparmor/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-apparmor/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,9 +2,7 @@
 
 prepare: |
     echo "Given a basic snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
     if [ "$(snap debug confinement)" = partial ] ; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-device-cgroups/task.yaml snapd-2.48.3+20.04/tests/main/security-device-cgroups/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-device-cgroups/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-device-cgroups/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -77,9 +77,7 @@
     fi
 
     echo "Given a snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "Then the device is not assigned to that snap"
     udevadm info "$UDEVADM_PATH" | not MATCH "E: TAGS=.*snap_test-snapd-sh_sh"
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-classic/task.yaml snapd-2.48.3+20.04/tests/main/security-device-cgroups-classic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-classic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-device-cgroups-classic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,9 +18,7 @@
     fi
 
     echo "Given a snap declaring a plug on framebuffer is installed in classic"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local_classic test-classic-cgroup
+    "$TESTSTOOLS"/snaps-state install-local test-classic-cgroup --classic
 
 restore: |
     if [ -e /dev/fb0.spread ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-devmode/task.yaml snapd-2.48.3+20.04/tests/main/security-device-cgroups-devmode/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-devmode/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-device-cgroups-devmode/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -20,9 +20,7 @@
     fi
 
     echo "Given a snap declaring a plug on framebuffer is installed in devmode"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local_devmode test-devmode-cgroup
+    "$TESTSTOOLS"/snaps-state install-local test-devmode-cgroup --devmode
 
 restore: |
     if [ -e /dev/fb0.spread ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-jailmode/task.yaml snapd-2.48.3+20.04/tests/main/security-device-cgroups-jailmode/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-jailmode/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-device-cgroups-jailmode/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -23,9 +23,7 @@
     fi
 
     echo "Given a snap declaring a plug on framebuffer is installed in jailmode"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local_jailmode test-devmode-cgroup
+    "$TESTSTOOLS"/snaps-state install-local test-devmode-cgroup --jailmode
 
 restore: |
     if [ -e /dev/fb0.spread ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-serial-port/task.yaml snapd-2.48.3+20.04/tests/main/security-device-cgroups-serial-port/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-serial-port/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-device-cgroups-serial-port/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,9 +21,7 @@
 
 execute: |
     echo "Given a snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "Then the device is not assigned to that snap"
     if udevadm info /dev/ttyS4 > info.txt; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-strict/task.yaml snapd-2.48.3+20.04/tests/main/security-device-cgroups-strict/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-device-cgroups-strict/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-device-cgroups-strict/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,9 +16,7 @@
     fi
 
     echo "Given a snap declaring a plug on framebuffer is installed in strict"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-strict-cgroup
+    "$TESTSTOOLS"/snaps-state install-local test-strict-cgroup
 
 restore: |
     if [ -e /dev/fb0.spread ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-dev-input-event-denied/task.yaml snapd-2.48.3+20.04/tests/main/security-dev-input-event-denied/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-dev-input-event-denied/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-dev-input-event-denied/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -17,9 +17,7 @@
 
 prepare: |
     echo "Given the test-snapd-event snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-event
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-event
 
 execute: |
     if [ -z "$(find /dev/input/by-path -name '*-event-kbd')" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-devpts/task.yaml snapd-2.48.3+20.04/tests/main/security-devpts/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-devpts/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-devpts/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,9 +6,7 @@
     fi
 
     echo "Given a basic snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-devpts
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-devpts
 
     echo "When no plugs are not connected"
     if snap interfaces -i physical-memory-observe | MATCH ":physical-memory-observe .*test-snapd-devpts" ; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-private-tmp/task.yaml snapd-2.48.3+20.04/tests/main/security-private-tmp/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-private-tmp/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-private-tmp/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,9 +8,7 @@
 
 prepare: |
     echo "Given a basic snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "And another basic snap is installed"
     mkdir -p "$SNAP_INSTALL_DIR"
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-profiles/task.yaml snapd-2.48.3+20.04/tests/main/security-profiles/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-profiles/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-profiles/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,9 +11,7 @@
     seccomp_profile_directory="/var/lib/snapd/seccomp/bpf"
 
     echo "Security profiles are generated and loaded for apps"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools
     loaded_profiles=$(cat /sys/kernel/security/apparmor/profiles)
 
     for profile in snap.test-snapd-tools.block snap.test-snapd-tools.cat snap.test-snapd-tools.echo snap.test-snapd-tools.fail snap.test-snapd-tools.success
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-seccomp/task.yaml snapd-2.48.3+20.04/tests/main/security-seccomp/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-seccomp/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-seccomp/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -45,16 +45,13 @@
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB/dirs.sh"
     mv -f "$SRC".orig "$SRC"
-    "$LIBEXECDIR/snapd/snap-seccomp" compile "$SRC" "$BIN"
+    snapd.tool exec snap-seccomp compile "$SRC" "$BIN"
     if [ -f "$AAP".orig ]; then
         mv -f "$AAP".orig "$AAP"
         apparmor_parser -r "$AAP"
     fi
 
 execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-
     # other tests ensure seccomp is available so we can skip any systems that
     # don't have it
     if ! snap debug sandbox-features --required seccomp:bpf-argument-filtering ; then
@@ -63,7 +60,7 @@
 
     echo "Remove any setpriority rules from the filter"
     sed 's/^\(setpriority.*\)/#SPREAD: \1/g' "$SRC".orig > "$SRC"
-    "$LIBEXECDIR/snapd/snap-seccomp" compile "$SRC" "$BIN"
+    snapd.tool exec snap-seccomp compile "$SRC" "$BIN"
     echo "and check that positive nice fails"
     test-snapd-setpriority 10  | MATCH 'Operation not permitted \(EPERM\)'
     echo "and check that negative nice fails"
@@ -71,7 +68,7 @@
 
     echo "Use bare setpriority rule"
     sed 's/^\(setpriority.*\)/#SPREAD: \1\nsetpriority/g' "$SRC".orig > "$SRC"
-    "$LIBEXECDIR/snapd/snap-seccomp" compile "$SRC" "$BIN"
+    snapd.tool exec snap-seccomp compile "$SRC" "$BIN"
     echo "and check that positive nice succeeds"
     test-snapd-setpriority 10  | MATCH 'Successfully used setpriority\(PRIO_PROCESS, 0, 10\)'
     echo "and check that negative nice succeeds"
@@ -79,7 +76,7 @@
 
     echo "Use arg filtered setpriority rule"
     sed 's/^\(setpriority.*\)/#SPREAD: \1\nsetpriority PRIO_PROCESS 0 <=19/g' "$SRC".orig > "$SRC"
-    "$LIBEXECDIR/snapd/snap-seccomp" compile "$SRC" "$BIN"
+    snapd.tool exec snap-seccomp compile "$SRC" "$BIN"
     echo "and check that positive nice succeeds"
     test-snapd-setpriority 10  | MATCH 'Successfully used setpriority\(PRIO_PROCESS, 0, 10\)'
     echo "and check that negative nice fails"
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-setuid-root/task.yaml snapd-2.48.3+20.04/tests/main/security-setuid-root/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-setuid-root/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-setuid-root/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,9 +10,7 @@
 systems: [-debian-*, -fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     echo "Ensure the snap-confine profiles on core are not loaded"
     for p in /var/lib/snapd/apparmor/profiles/snap-confine.*; do
         apparmor_parser -R "$p"
diff -Nru snapd-2.45.1+20.04.2/tests/main/security-udev-input-subsystem/task.yaml snapd-2.48.3+20.04/tests/main/security-udev-input-subsystem/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/security-udev-input-subsystem/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/security-udev-input-subsystem/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -12,9 +12,7 @@
 
 prepare: |
     echo "Given the test-snapd-udev-input-subsystem is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-udev-input-subsystem
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-udev-input-subsystem
 
 execute: |
     if [ -z "$(find /dev/input/by-path -name '*-event-kbd')" ]; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/selinux-clean/task.yaml snapd-2.48.3+20.04/tests/main/selinux-clean/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/selinux-clean/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/selinux-clean/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -17,10 +17,10 @@
 
     getenforce > enforcing.mode
 
-    # NOTE: Enable linger (what effectively happens in session-tool --prepare)
+    # NOTE: Enable linger (what effectively happens in tests.session prepare)
     # before we enable enforcing mode, as otherwise the remote ssh session
     # won't have access to this.
-    session-tool -u test --prepare
+    tests.session -u test prepare
 
     # Enable enforcing mode, our policy is already marked as permissive, so we
     # will get audit entries but the program will not be stopped by SELinux
@@ -31,30 +31,51 @@
     setenforce "$(cat enforcing.mode)"
     rm -f stamp enforcing.mode
 
-    session-tool -u test --restore
+    tests.session -u test restore
+    # Stop dbus activated by test-snapd-desktop snap.
+    systemctl --user stop dbus.service || true
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
+    systemctl restart snapd.socket
+    ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
 
-    install_local test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
     test-snapd-desktop.sh -c echo 'hello world'
-    session-tool -u test test-snapd-desktop.sh -c 'echo hello world'
-    session-tool -u test test-snapd-desktop.sh -c 'mkdir /home/test/foo'
-    session-tool -u test test-snapd-desktop.sh -c 'echo foo >/home/test/foo/bar'
-    ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
+    tests.session -u test exec test-snapd-desktop.sh -c 'echo hello world'
+    tests.session -u test exec test-snapd-desktop.sh -c 'mkdir /home/test/foo'
+    tests.session -u test exec test-snapd-desktop.sh -c 'echo foo >/home/test/foo/bar'
+    # the way we set up linger makes systemd and SELinux unhappy and may trigger
+    # a denials like this:
+    # type=AVC msg=audit(07/27/20 14:52:25.845:3443) : avc: denied { setattr }
+    #     for pid=96609 comm=(d-logind) name=linger dev="sda2" ino=1437682
+    #     scontext=system_u:system_r:init_t:s0
+    #     tcontext=unconfined_u:object_r:systemd_logind_var_lib_t:s0 tclass=dir
+    #     permissive=1
+    # type=AVC msg=audit(07/27/20 14:52:25.845:3444) : avc: denied { read } for
+    #     pid=96609 comm=(d-logind) name=linger dev="sda2" ino=1437682
+    #     scontext=system_u:system_r:init_t:s0
+    #     tcontext=unconfined_u:object_r:systemd_logind_var_lib_t:s0 tclass=dir
+    #     permissive=1
+    #
+    # This is a first checkpoint after the session was started, so if denials
+    # were logged, they it will show up now, but not for subsequent checkpoints.
+    # XXX ausearch exits with 1 when there are denials
+    ausearch --checkpoint stamp --start checkpoint -m AVC > avc-after 2>&1 || true
+    grep -v -E 'avc:  denied  { (setattr|read) } .* name=linger .* scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:systemd_logind_var_lib_t:s0' < avc-after | \
+        not MATCH 'type=AVC'
+
     # another revision triggers copy of snap data
-    install_local test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
     # removal triggers cleanups
     snap remove test-snapd-desktop
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
 
-    install_local test-snapd-appstream-metadata
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-appstream-metadata
     snap connect test-snapd-appstream-metadata:appstream-metadata
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
 
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
     snap stop test-snapd-service
     snap start test-snapd-service
     # TODO: enable once there is a workaround for denials caused by journalctl
@@ -62,13 +83,13 @@
     snap remove test-snapd-service
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
 
-    install_local test-snapd-layout
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-layout
     test-snapd-layout.sh -c 'ls /'
     su test -c "test-snapd-layout.sh -c 'ls /'"
     snap remove test-snapd-layout
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
 
-    install_local socket-activation
+    "$TESTSTOOLS"/snaps-state install-local socket-activation
     [ -S /var/snap/socket-activation/common/socket ]
     snap remove socket-activation
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
@@ -77,7 +98,7 @@
     # is bind mounted into the mount namespace of a snap, thus the SELinux
     # contexts from the host appear inside, and the policy needs to allow
     # proper transitions with these labels
-    install_local test-snapd-snapctl-core18
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-snapctl-core18
     snap restart test-snapd-snapctl-core18
     snap remove test-snapd-snapctl-core18
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
@@ -86,7 +107,7 @@
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
     # we are likely running without a display, so this will likely fail,
     # hopefully triggering enough of earlier setup to catch any relevant denials
-    session-tool -u test snap run snap-store || true
+    tests.session -u test exec snap run snap-store || true
     # removal triggers cleanups
     snap remove snap-store
     ausearch -i --checkpoint stamp --start checkpoint -m AVC 2>&1 | MATCH 'no matches'
diff -Nru snapd-2.45.1+20.04.2/tests/main/selinux-data-context/task.yaml snapd-2.48.3+20.04/tests/main/selinux-data-context/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/selinux-data-context/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/selinux-data-context/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -38,11 +38,8 @@
     #shellcheck disable=SC2012
     ls -Zd /run/snapd | MATCH ':snappy_var_run_t:'
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     # install a snap that does some file manipulation
-    install_local test-snapd-service-writer
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service-writer
 
     ls -Zd /var/snap/test-snapd-service-writer/common \
            /var/snap/test-snapd-service-writer/common/by-hook \
@@ -72,7 +69,7 @@
     MATCH '^.*system_u:object_r:snappy_var_t:s0 /var/snap/test-snapd-service-writer/current/foo$'      < service-labels
     MATCH '^.*system_u:object_r:snappy_var_t:s0 /var/snap/test-snapd-service-writer/current/foo/bar$'  < service-labels
 
-    install_local socket-activation
+    "$TESTSTOOLS"/snaps-state install-local socket-activation
     [ -S /var/snap/socket-activation/common/socket ]
     #shellcheck disable=SC2012
     ls -Zd /var/snap/socket-activation/common/socket | MATCH ':snappy_var_t:'
diff -Nru snapd-2.45.1+20.04.2/tests/main/selinux-lxd/task.yaml snapd-2.48.3+20.04/tests/main/selinux-lxd/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/selinux-lxd/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/selinux-lxd/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,18 +16,18 @@
 
 restore: |
     # Restore nsdelegate mount option clobbered by LXD.
-    if mountinfo-tool /sys/fs/cgroup/unified; then
+    if mountinfo.query /sys/fs/cgroup/unified; then
         mount -o remount,nsdelegate /sys/fs/cgroup/unified
     fi
 
     setenforce "$(cat enforcing.mode)"
     rm -f stamp enforcing.mode
 
-    if mountinfo-tool /proc/sys/fs/binfmt_misc .fs_type=binfmt_misc; then
+    if mountinfo.query /proc/sys/fs/binfmt_misc .fs_type=binfmt_misc; then
         umount /proc/sys/fs/binfmt_misc
     fi
 
-    lxd-tool undo-lxd-mount-changes
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
 
     rm -f avc-after
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-after-before/task.yaml snapd-2.48.3+20.04/tests/main/services-after-before/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-after-before/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-after-before/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,12 +2,11 @@
 
 execute: |
     echo "When the service snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
+
     # we are using systemd-notify indicate the service is active, this is
     # currently not allowed by daemon-notify interface, so we may as well just
     # install in devmode
-    install_local test-snapd-after-before-service --devmode
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-after-before-service --devmode
 
     echo "We can see all services running"
     for service in before-middle middle after-middle; do
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-after-before-install/task.yaml snapd-2.48.3+20.04/tests/main/services-after-before-install/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-after-before-install/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-after-before-install/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,8 +18,6 @@
 
 execute: |
     echo "When the service snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
 
     get_prop() {
         prop=$(systemctl show -p "$1" "$2")
@@ -38,7 +36,7 @@
         # we are using systemd-notify indicate the service is active, this is
         # currently not allowed by daemon-notify interface, so we may as well
         # just install in devmode
-        install_local_as test-snapd-after-before-service "test-snapd-after-before-service_$INSTANCE" --devmode
+        "$TESTSTOOLS"/snaps-state install-local-as test-snapd-after-before-service "test-snapd-after-before-service_$INSTANCE" --devmode
 
         service_prefix="snap.test-snapd-after-before-service_$INSTANCE"
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-disabled-kept-happy/task.yaml snapd-2.48.3+20.04/tests/main/services-disabled-kept-happy/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-disabled-kept-happy/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-disabled-kept-happy/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -53,7 +53,7 @@
 #     => the new service is disabled
 
 prepare: |
-  snap install jq
+  snap install --edge jq
   # keep more revisions to simplify switching around between revisions in the 
   # test
   snap set system refresh.retain=5
@@ -115,7 +115,7 @@
   snap stop --disable disabled-svcs-kept.svc
 
   echo "Check that it was actually disabled"
-  retry-tool -n 10 --wait 1 snap services disabled-svcs-kept | MATCH "disabled-svcs-kept\\.svc\\s+disabled\\s+inactive"
+  retry -n 10 --wait 1 snap services disabled-svcs-kept | MATCH "disabled-svcs-kept\\.svc\\s+disabled\\s+inactive"
 
   echo "Check that state.json still doesn't contain last-active-disabled-services"
   check_state_json_no_disabled_svcs
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-disabled-kept-unhappy/task.yaml snapd-2.48.3+20.04/tests/main/services-disabled-kept-unhappy/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-disabled-kept-unhappy/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-disabled-kept-unhappy/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -35,7 +35,7 @@
 #    => state.json has the old service saved in last-active-disabled-services
 
 prepare: |
-  snap install jq
+  snap install --edge jq
   rm -f /root/disabled-svcs-kept-fail
   rm -rf disabled-svcs-kept*
 
@@ -93,7 +93,7 @@
   snap stop --disable disabled-svcs-kept.svc
 
   echo "Check that it was actually disabled"
-  retry-tool -n 10 --wait 1 snap services disabled-svcs-kept | MATCH "disabled-svcs-kept\\.svc\\s+disabled\\s+inactive"
+  retry -n 10 --wait 1 snap services disabled-svcs-kept | MATCH "disabled-svcs-kept\\.svc\\s+disabled\\s+inactive"
 
   echo "Trigger a failing configure hook"
   touch /root/disabled-svcs-kept-fail
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-disable-install-hook/task.yaml snapd-2.48.3+20.04/tests/main/services-disable-install-hook/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-disable-install-hook/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-disable-install-hook/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,7 @@
 summary: Check that `snapctl stop --disable` actually stops services on install
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-svcs-disable-install-hook
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-svcs-disable-install-hook
 
     for service in simple forking; do
         echo "Verify that the $service service isn't running"
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-disable-refresh-hook/task.yaml snapd-2.48.3+20.04/tests/main/services-disable-refresh-hook/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-disable-refresh-hook/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-disable-refresh-hook/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,11 +2,8 @@
   Check that `snapctl stop --disable` actually stops services on post-refresh
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Installing snap first time starts services"
-    install_local test-snapd-svcs-disable-refresh-hook
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-svcs-disable-refresh-hook
 
     echo "Services are running after install hook"
     for service in simple forking; do
@@ -15,7 +12,7 @@
     done
 
     echo "Refreshing the snap triggers post-refresh hook which disables the services"
-    install_local test-snapd-svcs-disable-refresh-hook
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-svcs-disable-refresh-hook
 
     echo "Services are now disabled"
     for service in simple forking; do
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/task.yaml snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,11 @@
+summary: Check that install hooks in snaps can start services
+
+execute: |
+  echo "Verify that the snap installs"
+  "$TESTSTOOLS"/snaps-state install-local test-snapd-install-hook-runs-svc
+
+  echo "Verify that the snap service is still disabled"
+  snap services | MATCH "test-snapd-install-hook-runs-svc\\.svc\\s+disabled\\s+inactive"
+
+  echo "Verify that the snap service ran and did something during the install hook"
+  MATCH snap-svc-did-this < /var/snap/test-snapd-install-hook-runs-svc/current/data
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/bin/svc.sh snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/bin/svc.sh
--- snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/bin/svc.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/bin/svc.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+echo "snap-svc-did-this" > "$SNAP_DATA/data"
+
+exec sleep infinity
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/hooks/install snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/hooks/install
--- snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/hooks/install	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/hooks/install	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,11 @@
+#!/bin/sh -e
+
+# start running
+snapctl start --enable "$SNAP_NAME.svc"
+
+# wait a bit, the service is only creating a file, so we don't need to bother
+# ourselves with waiting too long
+sleep 5
+
+# stop running
+snapctl stop --disable "$SNAP_NAME.svc"
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/snap.yaml snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-install-hook-can-run-svcs/test-snapd-install-hook-runs-svc/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,9 @@
+name: test-snapd-install-hook-runs-svc
+version: 1.0
+summary: A snap that momentarily starts a svc during the install hook
+description: A snap that momentarily starts a svc during the install hook
+
+apps:
+  svc:
+    command: bin/svc.sh
+    daemon: simple
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-multi-service-failing/task.yaml snapd-2.48.3+20.04/tests/main/services-multi-service-failing/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-multi-service-failing/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-multi-service-failing/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,10 +2,8 @@
   Check that `snap install` doesn't leave a service running when the install fails.
 
 execute: |
-  #shellcheck source=tests/lib/snaps.sh
-  . "$TESTSLIB"/snaps.sh
   echo "when a snap install fails"
-  not install_local test-snapd-multi-service
+  not "$TESTSTOOLS"/snaps-state install-local test-snapd-multi-service
 
   echo "we don't leave a service running"
   not systemctl is-active snap.test-snapd-multi-service.ok.service
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-refresh-mode/task.yaml snapd-2.48.3+20.04/tests/main/services-refresh-mode/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-refresh-mode/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-refresh-mode/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,20 +10,15 @@
     systemctl status snap.test-snapd-service.test-snapd-endure-service || true
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "When the service snap is installed"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
     echo "We can see it running"
     systemctl status snap.test-snapd-service.test-snapd-endure-service|MATCH "running"
     systemctl show -p MainPID snap.test-snapd-service.test-snapd-endure-service > old-main.pid
 
     echo "When it is re-installed"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
     echo "We can still see it running with the same PID"
     systemctl show -p MainPID snap.test-snapd-service.test-snapd-endure-service > new-main.pid
@@ -33,4 +28,4 @@
     echo "Once the snap is removed, the service is stopped"
     snap remove --purge test-snapd-service
     # shellcheck disable=SC2119
-    get_journalctl_log | MATCH "stop endure"
+    "$TESTSTOOLS"/journal-state get-log | MATCH "stop endure"
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-snapctl/task.yaml snapd-2.48.3+20.04/tests/main/services-snapctl/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-snapctl/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-snapctl/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -26,25 +26,8 @@
         done
     }
 
-    wait_for_file_change() {
-        retry=5
-        while ! MATCH "$2" < "$1"  ; do
-            retry=$(( retry - 1 ))
-            if [ $retry -le 0 ]; then
-                echo "Failed to match the content of file $1, expected: $2"
-                exit 1
-            fi
-            sleep 1
-        done
-    }
-
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "When the service snap is installed"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
     echo "We can see it running"
     _wait_for_service "test-snapd-service.test-snapd-service" " active"
@@ -77,13 +60,13 @@
     snap tasks --last=configure|MATCH -z "restart of .test-snapd-service.test-snapd-service.+restart of .test-snapd-service.test-snapd-other-service"
 
     echo "And service could get the new service-option set from the hook"
-    wait_for_file_change "$SERVICEOPTIONFILE" "^foo$"
+    retry -n 5 --wait 1 MATCH '^foo$' "$SERVICEOPTIONFILE"
 
     echo "Reinstalling the snap with configure hook calling snapctl restart works"
     snap set test-snapd-service command=restart
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
     # shellcheck disable=SC2119
-    if get_journalctl_log | MATCH "error running snapctl"; then
+    if "$TESTSTOOLS"/journal-state get-log | MATCH "error running snapctl"; then
         echo "snapctl should not report errors"
         exit 1
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-stop-mode/task.yaml snapd-2.48.3+20.04/tests/main/services-stop-mode/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-stop-mode/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-stop-mode/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -19,13 +19,8 @@
     done
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "When the service snap is installed"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
     # Because we cannot use daemon: notify easily yet just wait for a "ready"
     # file to show up.  The file is removed when the service is stopped. This
     # pattern repeats around the test without additional comments.
@@ -41,7 +36,7 @@
     done
 
     echo "When it is re-installed"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
     while ! test -f /var/snap/test-snapd-service/common/ready; do sleep 1; done
 
     # note that sigterm{,-all} is tested separately
@@ -55,7 +50,7 @@
     done
 
     echo "Regular services are restarted normally"
-    get_journalctl_log -u snap.test-snapd-service.test-snapd-service | MATCH "stop service"
+    "$TESTSTOOLS"/journal-state get-log -u snap.test-snapd-service.test-snapd-service | MATCH "stop service"
     systemctl show -p MainPID snap.test-snapd-service.test-snapd-service > new-main.pid
     test -e new-main.pid && test -e old-main.pid
     test "$(cat new-main.pid)" != "$(cat old-main.pid)"
@@ -63,7 +58,7 @@
     echo "Once the snap is removed, all services are stopped"
     snap remove --purge test-snapd-service
     for s in $stop_modes; do
-        get_journalctl_log | MATCH "stop ${s}"
+        "$TESTSTOOLS"/journal-state get-log | MATCH "stop ${s}"
     done
 
     rm -f /var/snap/test-snapd-service/common/*
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-stop-mode-sigkill/task.yaml snapd-2.48.3+20.04/tests/main/services-stop-mode-sigkill/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-stop-mode-sigkill/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-stop-mode-sigkill/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,9 +18,7 @@
     pkill sleep || true
 
     echo "When the service snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
     # Because we cannot use daemon: notify easily yet just wait for a "ready"
     # file to show up.  The file is removed when the service is stopped. This
     # pattern repeats around the test without additional comments.
@@ -36,7 +34,7 @@
     [ "$n" = "2" ]
 
     echo "When it is re-installed one process uses sigterm, the other sigterm-all"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
     while ! test -f /var/snap/test-snapd-service/common/ready; do sleep 1; done
 
     echo "After reinstall the sigterm-all service and all children got killed"
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-timer/task.yaml snapd-2.48.3+20.04/tests/main/services-timer/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-timer/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-timer/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,9 +2,7 @@
 
 execute: |
     echo "When the service snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-timer-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-timer-service
 
     echo "We can see the timers being active"
     for service in regular-timer random-timer range-timer trivial-timer; do
diff -Nru snapd-2.45.1+20.04.2/tests/main/services-watchdog/task.yaml snapd-2.48.3+20.04/tests/main/services-watchdog/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/services-watchdog/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/services-watchdog/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,13 +10,8 @@
     done
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB"/journalctl.sh
-
     echo "When the service snap  is installed"
-    install_local test-snapd-service-watchdog
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service-watchdog
 
     # the interface is disconnected by default
     snap connect test-snapd-service-watchdog:daemon-notify
@@ -59,4 +54,4 @@
     # reported differently by different systemd versions
     systemctl show -p Result snap.test-snapd-service-watchdog.$service | MATCH 'Result=(watchdog|signal|core-dump)'
 
-    check_journalctl_log "systemd.*: snap.test-snapd-service-watchdog.$service.service:? [Ww]atchdog timeout" -u snap.test-snapd-service-watchdog.$service
+    "$TESTSTOOLS"/journal-state match-log "systemd.*: snap.test-snapd-service-watchdog.$service.service:? [Ww]atchdog timeout" -u snap.test-snapd-service-watchdog.$service
diff -Nru snapd-2.45.1+20.04.2/tests/main/session-tool/task.yaml snapd-2.48.3+20.04/tests/main/session-tool/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/session-tool/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/session-tool/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,82 +0,0 @@
-summary: tests for session-tool
-# Session-tool depends on busctl and doesn't work on 14.04
-systems: [-ubuntu-14.04-*]
-environment:
-    USER/root: root
-    USER/test: test
-prepare: |
-    truncate --size=0 defer.sh
-    chmod +x defer.sh
-
-    # Prevent anacron/cron from interfering with their background sessions, grr!
-    for unit in cron.service crond.service anacron.timer anacron.service; do
-        if [ "$(systemctl is-active "$unit")" = active ]; then
-            systemctl stop "$unit"
-            echo "systemctl start \"$unit\"" >> defer.sh
-        fi
-    done
-
-    # For whatever reason (what spawns it!?!) cron may be running in session 2.
-    # To remove any background activity, get rid of it.
-    if loginctl show-session 2 >/dev/null 2>&1 && loginctl show-session 2 | grep -q Service=crond; then
-        loginctl kill-session 2
-    fi
-
-    # Kill sessions that systemd has leaked earlier.
-    session-tool --kill-leaked
-
-    # Remember details of sessions before we start.
-    session-tool --dump > before.debug.txt
-
-    # Brief version of existing sessions to measure during "restore".
-    loginctl --no-legend list-sessions | sort > before.txt
-
-    # Prepare for using sessions as the given user
-    session-tool --prepare -u "$USER"
-execute: |
-    for n in $(seq 300); do
-        echo "ITERATION $(date) $n"
-        session-tool -u "$USER" id -u  2>/tmp/session-tool.log | MATCH "$(id -u "$USER")"
-        session-tool -u "$USER" env    2>/tmp/session-tool.log | MATCH "XDG_RUNTIME_DIR=/run/user/$(id -u "$USER")"
-        # We get a logind session
-        session-tool -u "$USER" loginctl list-sessions | grep "$USER"
-        # Exit code is forwarded
-        session-tool -u "$USER" true
-        not session-tool -u "$USER" false
-        # The -p option can be used to know the PID of the started program.
-        # This is different from the pid of session-tool as there's a session
-        # manager overlooking the termination of PAM stack (internally we use runuser).
-        session-tool -u "$USER" -p /tmp/outer.pid "$(command -v any-python)" -c 'from __future__ import print_function; import os; print(os.getpid())' >/tmp/inner.pid
-        test "$(cat /tmp/outer.pid)" = "$(cat /tmp/inner.pid)"
-    done
-restore: |
-    # Restore after using sessions as the given user
-    session-tool --restore -u "$USER"
-
-    # Kill cron if it is running (check prepare for details).
-    if loginctl show-session 2 >/dev/null 2>&1 && loginctl show-session 2 | grep -q Service=crond; then
-        loginctl kill-session 2
-    fi
-
-    # Kill sessions that systemd has leaked over time.
-    session-tool --kill-leaked
-
-    # NOTE: This part of the test is very flaky if you restart systemd-logind
-    # It *seems* that all new systems (Debian Sid, Arch, Tumbleweed and Ubuntu 20.04)
-    # Forget about the root session that was there to begin with.
-
-    # When we are done the sessions are exactly what we started with but this
-    # can take a moment as the termination process is asnychronous.
-    retry-tool -n 10 --wait 1 sh -c 'loginctl --no-legend list-sessions | sort > after.txt && diff -u before.txt after.txt'
-    # Remove files we've created
-    rm -f /tmp/{inner,outer}.pid
-    rm -f {before,after}.txt
-
-    # Restart background stuff we stopped.
-    sh -xe defer.sh && rm -f defer.sh
-
-debug: |
-    session-tool --dump > after.debug.txt
-    diff -u before.debug.txt after.debug.txt
-    echo "Active timers"
-    systemctl list-timers
diff -Nru snapd-2.45.1+20.04.2/tests/main/set-proxy-store/task.yaml snapd-2.48.3+20.04/tests/main/set-proxy-store/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/set-proxy-store/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/set-proxy-store/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,7 @@
 summary: Check that the setting proxy.store config works
 
-systems: [-ubuntu-core-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -ubuntu-14.04*]
 
 environment:
     SNAP_NAME: test-snapd-tools
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-advise-command/task.yaml snapd-2.48.3+20.04/tests/main/snap-advise-command/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-advise-command/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-advise-command/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,15 @@
 summary: Ensure that `snap advise-snap` works
 
-# we need https://github.com/snapcore/core/pull/70 landed before
-# we can use this on ubuntu-core-*
-systems: [ubuntu-16*, ubuntu-18*]
+# advise-snap / command-not-found only works on ubuntu classic, and on uc16
+# on uc18+ we don't have the /usr/lib/command-not-found symlink so it's not
+# useful
+systems:
+    - ubuntu-1*
+    - ubuntu-2*
+    - ubuntu-core-16*
 
 prepare: |
-    if [ -e /usr/lib/command-not-found ]; then
+    if ! os.query is-core16 && [ -e /usr/lib/command-not-found ]; then
         mv /usr/lib/command-not-found /usr/lib/command-not-found.orig
     fi
 
@@ -15,10 +19,6 @@
     fi
 
 execute: |
-    # FIXME: remove this once the store is in good shape again
-    echo "the store is unhappy right now"
-    exit 0
-
     echo "wait for snapd to pull in the commands data"
     echo "(it will do that on startup)"
     for _ in $(seq 120); do
@@ -40,11 +40,14 @@
     snap advise-snap --command test-snapd-tools.echo | MATCH test-snapd-tools
 
     echo "Ensure 'advise-snap --command' works as command-not-found symlink"
-    ln -s /usr/bin/snap /usr/lib/command-not-found
+    # it's already this symlink on uc16, just use as-is there
+    if ! os.query is-core16; then
+        ln -s /usr/bin/snap /usr/lib/command-not-found    
+    fi
     /usr/lib/command-not-found test-snapd-tools.echo | MATCH test-snapd-tools
 
     echo "Ensure short names are found too"
-    snap advise-snap --command test_snapd_wellknown1 | MATCH 'The program ".*" can be found'
+    snap advise-snap --command test_snapd_wellknown1 | MATCH '"test_snapd_wellknown1" not found, but can be installed with'
 
     echo "Ensure advise-snap without a match returns exit code 1"
     if snap advise-snap --command no-such-command-for-any-snap; then
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-cli-no-managers/task.yaml snapd-2.48.3+20.04/tests/main/snap-cli-no-managers/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-cli-no-managers/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-cli-no-managers/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,22 @@
+summary: Check that snap binary does not inadvertently import snapstate.
+description: |
+  This test checks that snap binary does not import snapstate when built
+  with -tags nomanagers.
+
+systems: [-ubuntu-core-*]
+
+execute: |
+  check_imports() {
+    local BINFILE="$1"
+    if strings "$BINFILE" | MATCH "overlord/snapstate"; then
+      echo "$BINFILE binary should not import overlord/snapstate"
+      exit 1
+    fi
+  }
+
+  check_imports /usr/bin/snap
+
+  # snap-bootstrap is shipped only on ubuntu (except for 14.04)
+  if [[ "$SPREAD_SYSTEM" = ubuntu-2* ]] ||  [[ "$SPREAD_SYSTEM" = ubuntu-18.04-* ]] || [[ "$SPREAD_SYSTEM" = ubuntu-16.04-* ]]; then
+    check_imports /usr/lib/snapd/snap-bootstrap
+  fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-confine-drops-sys-admin/task.yaml snapd-2.48.3+20.04/tests/main/snap-confine-drops-sys-admin/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-confine-drops-sys-admin/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-confine-drops-sys-admin/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,11 +11,9 @@
 
 prepare: |
     echo "Install a helper snap with default confinement"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     # we only need devmode since this test is only about whether or not
     # snap-confine dropped CAP_SYS_ADMIN
-    install_local_devmode test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh --devmode
 
     echo "Compile and prepare the support program"
     # Because we use the snap data directory we don't need to clean it up
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-confine-from-core/task.yaml snapd-2.48.3+20.04/tests/main/snap-confine-from-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-confine-from-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-confine-from-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -14,8 +14,6 @@
     chmod 4755 /usr/lib/snapd/snap-confine
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
     # shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB/systemd.sh"
 
@@ -27,7 +25,7 @@
     echo "Ensure we re-exec by default"
     snap list
 
-    check_journalctl_log "DEBUG: restarting into"
+    "$TESTSTOOLS"/journal-state match-log "DEBUG: restarting into"
 
     echo "Ensure snap-confine from the core snap is run"
     test-snapd-sh.sh -c 'echo hello'
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-confine-privs/task.yaml snapd-2.48.3+20.04/tests/main/snap-confine-privs/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-confine-privs/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-confine-privs/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,9 +18,7 @@
 
 prepare: |
     echo "Install a helper snap (for confinement testing)"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "Compile and prepare the support program"
     # Because we use the snap data directory we don't need to clean it up
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-confine-undesired-mode-group/task.yaml snapd-2.48.3+20.04/tests/main/snap-confine-undesired-mode-group/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-confine-undesired-mode-group/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-confine-undesired-mode-group/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -18,14 +18,17 @@
     # the group of the calling user and did not manage that properly.
     for dname in /run/snapd /sys/fs/cgroup /tmp/snap.*; do
         # Filter out cgroups that are expected to be owned by the test user.
-        find "$dname" -user test ! -path '*/user@12345.service*' ! -path '*/user-12345.slice*' >> wrong-user.txt
-        find "$dname" -group test ! -path '*/user@12345.service*' ! -path '*/user-12345.slice*' >> wrong-group.txt
+        # Since we are a looking at sysfs, which is modified asynchronously,
+        # ignore errors of the kind where readdir and stat race with a
+        # concurrent mutator.
+        find "$dname" -ignore_readdir_race -user test ! -path '*/user@12345.service*' ! -path '*/user-12345.slice*' >> wrong-user.txt
+        find "$dname" -ignore_readdir_race -group test ! -path '*/user@12345.service*' ! -path '*/user-12345.slice*' >> wrong-group.txt
         # Filter out the following elements:
         # - sockets, we don't create any and there are some that are 777
         # - symbolic links, those are always 777
         # - the file cgroup.event_control which is ugo+w for some reason
         # - the per-snap tmp directory as it is meant to be world-writable
-        find "$dname" ! -type s ! -type l ! -name cgroup.event_control ! -path '/tmp/snap.*/tmp' -perm /o+w >> world-writable.txt
+        find "$dname" -ignore_readdir_race ! -type s ! -type l ! -name cgroup.event_control ! -path '/tmp/snap.*/tmp' -perm /o+w >> world-writable.txt
     done
 
     # The test fails if any such file is detected
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-connect/task.yaml snapd-2.48.3+20.04/tests/main/snap-connect/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-connect/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-connect/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,8 @@
 summary: Check that snap connect works
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install a test snap"
-    install_local home-consumer
+    "$TESTSTOOLS"/snaps-state install-local home-consumer
     # the home interface is not autoconnected on all-snap systems
     if [[ ! "$SPREAD_SYSTEM" == ubuntu-core-16-* ]]; then
         snap disconnect home-consumer:home
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-connections/task.yaml snapd-2.48.3+20.04/tests/main/snap-connections/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-connections/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-connections/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -11,9 +11,6 @@
     snap remove test-snapd-daemon-notify || true
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     snap connections > all.out 2>&1
     initial_connections="$(wc -l < all.out)"
 
@@ -36,7 +33,7 @@
     snap connections test-snapd-content-slot | MATCH "$expected"
 
     # :network is connected by default
-    install_local network-consumer
+    "$TESTSTOOLS"/snaps-state install-local network-consumer
     expected='network +network-consumer:network +:network +-'
     snap connections network-consumer | MATCH "$expected"
     # disconect it manually
@@ -45,7 +42,7 @@
     snap connections network-consumer 2>&1 | MATCH "$expected"
 
     # try with an interface which is not connected by default
-    install_local test-snapd-daemon-notify
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-daemon-notify
     expected='daemon-notify +test-snapd-daemon-notify:daemon-notify +- +-'
     snap connections test-snapd-daemon-notify | MATCH "$expected"
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapctl-from-snap/task.yaml snapd-2.48.3+20.04/tests/main/snapctl-from-snap/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapctl-from-snap/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapctl-from-snap/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -42,9 +42,7 @@
         snap install --edge core18
     fi
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local "$SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP"
 
     echo "Verify that cookie file exists and has proper permissions and size"
     check_cookie "$SNAP"
@@ -77,7 +75,7 @@
     snap get "$SNAP" foo | MATCH 123
 
     echo "Given two revisions of a snap have been installed"
-    install_local "$SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$SNAP"
     check_cookie "$SNAP"
 
     echo "And a single revision gets removed"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapctl-is-connected/task.yaml snapd-2.48.3+20.04/tests/main/snapctl-is-connected/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapctl-is-connected/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapctl-is-connected/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,7 +10,7 @@
 execute: |
   check_empty() {
     local OUT="$1"
-    if [[ "$SPREAD_SYSTEM" == fedora-31-* ]]; then
+    if [[ "$SPREAD_SYSTEM" == fedora-31-* ]] || [[ "$SPREAD_SYSTEM" == fedora-32-* ]]; then
       echo "$OUT" | MATCH '^WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement$'
     else
       if [ -n "$OUT" ]; then
@@ -35,6 +35,7 @@
   OUT=$(test-snap.checkconn network 2>&1 || true)
   check_empty "$OUT"
 
-  if test-snap.checkconn home; then
+  if OUT=$(test-snap.checkconn home 2>&1); then
     echo "home is not expected"
   fi
+  echo "$OUT" | MATCH "error running snapctl: snap \"test-snap\" has no plug or slot named \"home\""
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-debug-timings/task.yaml snapd-2.48.3+20.04/tests/main/snap-debug-timings/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-debug-timings/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-debug-timings/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,8 @@
 summary: Ensure `snap debug change-timings` works
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "When a snap gets installed"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     echo "There is timing data available for it"
     snap debug timings --last=install | MATCH 'Done +[0-9]+'
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-device-helper-nvme/task.yaml snapd-2.48.3+20.04/tests/main/snap-device-helper-nvme/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-device-helper-nvme/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-device-helper-nvme/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+summary: |
+  Check that snap-device-helper correctly handles nvme block and nvme char
+  devices by simulating how udev calls snap-device-helper with prototypical 
+  paths, including the various types of nvme devices.
+
+# fedora-31: uses cgroupv2, which we don't support
+# fedora-32: uses cgroupv2, which we don't support
+systems: [-fedora-31-*, -fedora-32-*]
+
+execute: |
+  # make a fake snap devices cgroup
+  mkdir /sys/fs/cgroup/devices/snap.test.me
+
+  # deny all devices by default
+  echo "a *.* rwm" > /sys/fs/cgroup/devices/snap.test.me/devices.deny
+
+  #shellcheck source=tests/lib/dirs.sh
+  . "$TESTSLIB"/dirs.sh
+  SNAP_DEVICE_HELPER="$LIBEXECDIR/snapd/snap-device-helper"
+
+  echo "Simulating devices being added to the device cgroup by udev by invoking snap-device-helper directly"
+  # add some example devices, including both char and block devs for nvme
+  count=0
+  for i in /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/host8/target8:0:0/8:0:0:0/block/sda/sda1 \
+    /devices/pci0000:00/0000:00:1d.0/0000:3c:00.0/nvme/nvme0/nvme0n1 \
+    /devices/pci0000:40/0000:40:01.1/0000:41:00.0/nvme/nvme0 \
+    /devices/virtual/mem/null; do 
+      count=$((count+1))
+      # assumes that the snapd deb is installed and that 
+      # /usr/lib/snapd/snap-device-helper on the system is from the PR being tested
+      "$SNAP_DEVICE_HELPER" add snap_test_me $i $count:$count
+  done
+
+  echo "All of the expected devices are added to the cgroup with the expected types"
+  # run MATCH multiple times to handle all the expected lines
+  MATCH "b 1:1 rwm" < /sys/fs/cgroup/devices/snap.test.me/devices.list # block device @ /dev/sda1
+  MATCH "b 2:2 rwm" < /sys/fs/cgroup/devices/snap.test.me/devices.list # block device @ /dev/nvme0n1
+  MATCH "c 3:3 rwm" < /sys/fs/cgroup/devices/snap.test.me/devices.list # char device @ /dev/nvme0
+  MATCH "c 4:4 rwm" < /sys/fs/cgroup/devices/snap.test.me/devices.list # char device @ /dev/null
+
+  # ensure we don't have any extra entries in the cgroup
+  wc -l < /sys/fs/cgroup/devices/snap.test.me/devices.list | MATCH 4
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-discard-ns/task.yaml snapd-2.48.3+20.04/tests/main/snap-discard-ns/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-discard-ns/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-discard-ns/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,24 +7,19 @@
     is not an error if it doesn't exist.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools
 
 execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-
     echo "We can try to discard a namespace before snap runs"
-    $LIBEXECDIR/snapd/snap-discard-ns test-snapd-tools
+    snapd.tool exec snap-discard-ns test-snapd-tools
 
     echo "We can try to discard a namespace before the .mnt file exits"
     mkdir -p /run/snapd/ns/
-    $LIBEXECDIR/snapd/snap-discard-ns test-snapd-tools
+    snapd.tool exec snap-discard-ns test-snapd-tools
 
     echo "We can try to discard a namespace before the .mnt file is mounted"
     touch /run/snapd/ns/test-snapd-tools.mnt
-    $LIBEXECDIR/snapd/snap-discard-ns test-snapd-tools
+    snapd.tool exec snap-discard-ns test-snapd-tools
 
     echo "We can discard the namespace after a snap runs"
     test-snapd-tools.success
@@ -39,7 +34,7 @@
     # proc is there because on older kernels /proc/*/ns/mnt is not on nsfs but still on procfs.
     stat -f -c %T /run/snapd/ns/test-snapd-tools.mnt | MATCH 'proc|nsfs|0x6e736673'
     stat -f -c %T /run/snapd/ns/test-snapd-tools.1000.mnt | MATCH 'proc|nsfs|0x6e736673'
-    $LIBEXECDIR/snapd/snap-discard-ns test-snapd-tools
+    snapd.tool exec snap-discard-ns test-snapd-tools
     test ! -e /run/snapd/ns/test-snapd-tools.mnt
     test ! -e /run/snapd/ns/test-snapd-tools.1000.mnt
     test ! -e /run/snapd/ns/snap.test-snapd-tools.info
@@ -48,6 +43,6 @@
     test-snapd-tools.success
     touch /run/snapd/ns/snap.test-snapd-tools.fstab
     touch /run/snapd/ns/snap.test-snapd-tools.1000.user-fstab
-    $LIBEXECDIR/snapd/snap-discard-ns test-snapd-tools
+    snapd.tool exec snap-discard-ns test-snapd-tools
     test ! -e /run/snapd/ns/snap.test-snapd-tools.fstab
     test ! -e /run/snapd/ns/snap.test-snapd-tools.1000.user-fstab
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-disconnect/task.yaml snapd-2.48.3+20.04/tests/main/snap-disconnect/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-disconnect/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-disconnect/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,18 +9,12 @@
     echo "Install a test snap"
     snap pack "$TESTSLIB"/snaps/home-consumer
     snap install --dangerous "$SNAP_FILE"
-    snap install jq
+    snap install --edge jq
 
 restore: |
     rm -f ./*.snap
 
 execute: |
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
-        #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     inspect_connection() {
       CONN="$1"
       # shellcheck disable=SC2002
@@ -65,7 +59,7 @@
 
 
     # these checks rely on automatic connection of home on non-core systems
-    if ! is_core_system; then
+    if ! os.query is-core; then
       echo "Checking that --forget forgets connection when auto-connected"
       snap remove --purge "$SNAP_FILE"
       snap install --dangerous "$SNAP_FILE"
@@ -88,12 +82,12 @@
     fi
 
     echo "Checking that a connection for missing plug can be forgotten"
-    install_local test-snap-producer
-    install_local test-snap-consumer.v1
+    "$TESTSTOOLS"/snaps-state install-local test-snap-producer
+    "$TESTSTOOLS"/snaps-state install-local test-snap-consumer.v1
     snap connect test-snap-consumer:shared-content-plug test-snap-producer:shared-content-slot
     snap connections test-snap-consumer | MATCH "content\[mylib\] *test-snap-consumer:shared-content-plug *test-snap-producer:shared-content-slot"
     # refresh to a newer version without content plug
-    install_local test-snap-consumer.v2
+    "$TESTSTOOLS"/snaps-state install-local test-snap-consumer.v2
     snap connections test-snap-consumer | not MATCH "content\[mylib\] *test-snap-consumer:shared-content-plug *test-snap-producer:shared-content-slot"
     inspect_connection "test-snap-consumer:shared-content-plug test-snap-producer:shared-content-slot" | MATCH "true"
     snap disconnect --forget test-snap-consumer:shared-content-plug test-snap-producer:shared-content-slot
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapd-notify/task.yaml snapd-2.48.3+20.04/tests/main/snapd-notify/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapd-notify/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapd-notify/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,9 +5,6 @@
 backends: [-external]
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "Check that snapd uses notifications"
     systemctl show -p Type snapd.service | MATCH Type=notify
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapd-reexec/task.yaml snapd-2.48.3+20.04/tests/main/snapd-reexec/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapd-reexec/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapd-reexec/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -38,8 +38,6 @@
 
     # shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB/dirs.sh"
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
 
     echo "Ensure that we do not re-exec into older versions"
     systemctl stop snapd.service snapd.socket
@@ -48,7 +46,7 @@
     mount --bind /tmp/old-info $SNAP_MOUNT_DIR/core/current/usr/lib/snapd/info
     systemctl start snapd.service snapd.socket
     snap list
-    check_journalctl_log 'snap \(at .*\) is older \(.*\) than distribution package'
+    "$TESTSTOOLS"/journal-state match-log 'snap \(at .*\) is older \(.*\) than distribution package'
 
     echo "Revert back to normal"
     systemctl stop snapd.service snapd.socket
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapd-reexec-snapd-snap/task.yaml snapd-2.48.3+20.04/tests/main/snapd-reexec-snapd-snap/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapd-reexec-snapd-snap/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapd-reexec-snapd-snap/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,16 +16,14 @@
     snap set core experimental.snapd-snap=true
     # give the state time to create the change and then start watching
     # it
-    retry-tool -n 30 snap watch --last=transition-to-snapd-snap
+    retry -n 30 snap watch --last=transition-to-snapd-snap
     snap list snapd
 
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
     # installing the snapd snap should result in a daemon restart so that
     # the snapd from the snap can be used. It won't be used in this test
     # because the version of the snapd from the store is lower than the
     # version of the installed snapd.
-    check_journalctl_log "Requested daemon restart."
+    "$TESTSTOOLS"/journal-state match-log "Requested daemon restart."
 
     # We need to pretend the version of snapd in the snapd snap is the same
     # as the installed one so that it re-execs. We use a higher version in
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapd-slow-startup/task.yaml snapd-2.48.3+20.04/tests/main/snapd-slow-startup/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapd-slow-startup/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapd-slow-startup/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,6 +1,6 @@
 summary: Test that snapd is not terminated by systemd on a slow startup
 
-systems: [ubuntu-18.04-64, ubuntu-19.10-64]
+systems: [ubuntu-18.04-64]
 
 restore: |
     # extra cleanup in case something in this test went wrong
@@ -25,9 +25,6 @@
         snap install --dangerous --name="basic_$i" basic_1.0_all.snap
     done
 
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "Simulate a slow startup"
     systemctl stop snapd.service snapd.socket
     cat > /etc/systemd/system/snapd.service.d/slow-startup.conf <<EOF
@@ -41,4 +38,4 @@
     # startup timeout will be adjusted by 30s + 7 * 5s and this will succeed
     systemctl start snapd.service snapd.socket
 
-    check_journalctl_log "adjusting startup timeout by 1m5s"
+    "$TESTSTOOLS"/journal-state match-log "adjusting startup timeout by 1m5s"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapd-snap-removal/task.yaml snapd-2.48.3+20.04/tests/main/snapd-snap-removal/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapd-snap-removal/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapd-snap-removal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,9 +5,7 @@
 execute: |
     echo "Ensure we have no core"
     systemctl stop snapd
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    $LIBEXECDIR/snapd/snap-mgmt --purge
+    snapd.tool exec snap-mgmt --purge
     systemctl start snapd
     snap wait system seed.loaded
     test "$(snap list | grep -v -c ^Name)" = 0
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapd-without-core/task.yaml snapd-2.48.3+20.04/tests/main/snapd-without-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapd-without-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapd-without-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -30,9 +30,7 @@
     snap set core experimental.snapd-snap=true
     snap install --dangerous /tmp/snapd_*.snap
     echo "Ensure we restarted into the snapd snap"
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-    check_journalctl_log  'restarting into "/snap/snapd/'
+    "$TESTSTOOLS"/journal-state match-log  'restarting into "/snap/snapd/'
 
     echo "Now install a core18 based snap and ensure it works"
     snap install test-snapd-sh-core18
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-env/task.yaml snapd-2.48.3+20.04/tests/main/snap-env/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-env/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-env/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,19 +2,15 @@
 
 environment:
     NAME/regular: test-snapd-tools
-    INSTANCE_KEY/regular:
+    INSTANCE_KEY/regular: ""
     NAME/parallel: test-snapd-tools_foo
     INSTANCE_KEY/parallel: foo
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     if [[ "$SPREAD_VARIANT" == "parallel" ]]; then
         snap set system experimental.parallel-instances=true
     fi
-    # shellcheck disable=SC2153
-    install_local_as test-snapd-tools "$NAME"
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-tools "$NAME"
 
 restore: |
     if [[ "$SPREAD_VARIANT" == "parallel" ]]; then
@@ -55,7 +51,8 @@
     MATCH "^SNAP_INSTANCE_NAME=$NAME$"                                    < snap-vars.txt
     # parallel-installs: empty if none is set
     MATCH "^SNAP_INSTANCE_KEY=$INSTANCE_KEY$"                             < snap-vars.txt
-    test "$(wc -l < snap-vars.txt)" -eq 14
+    MATCH "^SNAP_REAL_HOME=/root$"                                        < snap-vars.txt
+    test "$(wc -l < snap-vars.txt)" -eq 15
 
     echo "Enure that XDG environment variables are what we expect"
     # parallel-installs: xdg directory is instance specific
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-handle-link/task.yaml snapd-2.48.3+20.04/tests/main/snap-handle-link/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-handle-link/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-handle-link/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,33 +1,31 @@
 summary: Ensure the "snap handle-link" command works
 
-# We don't run on ubuntu-core, since we are testing the behaviour of
-# xdg-open on the host system.
-systems: [-ubuntu-core-*]
-
-# xdg-open doesn't seem to check desktop files if it doesn't think it
-# has a display.
-environment:
-    DISPLAY: :placeholder
+systems:
+    - -amazon-linux-2-*  # does not support systemd --user
+    - -centos-7-*  # does not support systemd --user
+    - -ubuntu-14.04-*  # not supported as desktop OS, systemd too old for tests.session
+    - -ubuntu-core-*  # test exercises regular xdg-open, not the custom one in ubuntu-core
 
 prepare: |
     touch /usr/bin/zenity
+    tests.session -u test prepare
+
+    # Make sure there is a default handler to open a snap package
+    tests.session -u test exec mkdir -p /home/test/.config
+    tests.session -u test exec mv /home/test/.config /home/test/.config.bak
+    tests.session -u test exec mkdir -p /home/test/.config
+    tests.session -u test exec xdg-mime default snap-handle-link.desktop x-scheme-handler/snap
 
 restore: |
     umount -f /usr/bin/zenity || :
+    tests.session -u test exec rm -rf /home/test/.config
+    tests.session -u test exec mv /home/test/.config.bak /home/test/.config
+    tests.session -u test restore
 
 execute: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
-    # Make sure there is a default handler to open a snap package
-    mkdir -p ~/.config
-    xdg-mime default snap-handle-link.desktop x-scheme-handler/snap
-
     echo "URI Handler fails if snap-store is not installed and user refuses to install it"
     mount --bind /bin/false /usr/bin/zenity
-    if snap handle-link snap://package 2>errors.log; then
+    if tests.session -u test exec snap handle-link snap://package 2>errors.log; then
         cat errors.log >&2
         echo "Expected URI handler to fail"
         exit 1
@@ -35,14 +33,9 @@
     MATCH "Snap Store required" < errors.log
 
     echo "Now with snap-store installed"
-    install_local snap-store
-    snap handle-link snap://package | MATCH "Fake snap got snap://package"
+    "$TESTSTOOLS"/snaps-state install-local snap-store
+    tests.session -u test exec snap handle-link snap://package | MATCH "Fake snap got snap://package"
 
-    if [[ "$SPREAD_SYSTEM" != ubuntu-1[46].04-* ]]; then
-        # Ubuntu 14.04 ships with an ancient xdg-open shell script
-        # that doesn't look up scheme handlers.  Other xdg-mime
-        # implementations on the system (e.g. GLib) should be fine
-        # though.
-        echo "The same should work with xdg-open"
-        xdg-open snap://package | MATCH "Fake snap got snap://package"
-    fi
+    echo "The same should work with xdg-open"
+    # xdg-open doesn't check desktop files if it thinks there is no display around
+    tests.session -u test exec env DISPLAY=:placeholder xdg-open snap://package | MATCH "Fake snap got snap://package"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-icons/task.yaml snapd-2.48.3+20.04/tests/main/snap-icons/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-icons/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-icons/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,8 @@
 summary: Snaps can install icon theme icons
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Install a snap providing icons"
-    install_local test-snapd-icon-theme
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-icon-theme
 
     echo "Icons provided by the snap are installed to a shared location"
     iconfile=/var/lib/snapd/desktop/icons/hicolor/scalable/apps/snap.test-snapd-icon-theme.foo.svg
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-info/task.yaml snapd-2.48.3+20.04/tests/main/snap-info/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-info/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-info/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -32,10 +32,8 @@
       > out
     PYTHONIOENCODING=utf8 python3 check.py < out
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     snap info --verbose "$TESTSLIB"/snaps/basic-desktop|MATCH "path: "
-    install_local basic-desktop
+    "$TESTSTOOLS"/snaps-state install-local basic-desktop
     snap info basic-desktop|MATCH "license:[ ]+GPL-3.0"
 
     snap info --verbose basic_1.0_all.snap|MATCH "sha3-384:"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-interface/task.yaml snapd-2.48.3+20.04/tests/main/snap-interface/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-interface/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-interface/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     The "snap interface" command displays a listing of used interfaces
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local network-consumer
+    "$TESTSTOOLS"/snaps-state install-local network-consumer
     snap interface | MATCH 'network\s+ allows access to the network'
     snap interface --all | MATCH 'classic-support\s+ special permissions for the classic snap'
     snap interface network > out.yaml
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-logs/task.yaml snapd-2.48.3+20.04/tests/main/snap-logs/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-logs/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-logs/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,9 +5,7 @@
     for all supported systems.
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
 execute: |
     echo "check the logs are displayed by service-name and service-name.app"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-mgmt/task.yaml snapd-2.48.3+20.04/tests/main/snap-mgmt/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-mgmt/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-mgmt/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,29 +7,33 @@
 backends: [-autopkgtest]
 
 prepare: |
+    # TODO: unify this with tests/main/postrm-purge/task.yaml
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
 
-    snap install test-snapd-sh
-    snap list | MATCH test-snapd-sh
+    snap set core experimental.user-daemons=true
 
-    # a snap with services
-    install_local test-snapd-service
-    snap list | MATCH test-snapd-service
+    # Install a number of snaps that contain various features that have
+    # representation in the file system.
+    for name in test-snapd-service test-snapd-timer-service socket-activation \
+            test-snapd-user-service test-snapd-user-service-sockets \
+            test-snapd-user-timer-service test-snapd-tools \
+            test-snapd-control-consumer test-snapd-auto-aliases \
+            test-snapd-kvm ; do
+        if echo "$name" | grep -q user && echo "$SPREAD_SYSTEM" | grep -qF ubuntu-14.04; then
+            # None of the "user" snaps work on 14.04
+            continue
+        fi
+        "$TESTSTOOLS"/snaps-state install-local "$name"
+        snap list | MATCH test-snapd-service
+    done
 
-    # a snap with timers
-    install_local test-snapd-timer-service
-    snap list | MATCH test-snapd-timer-service
+    # kvm interface needs manual connection
+    snap connect test-snapd-kvm:kvm
 
-    # a snap with DBus policy files
     snap install --edge test-snapd-dbus-provider
     snap list | MATCH test-snapd-dbus-provider
 
-    # with socket activation
-    install_local socket-activation
-
     before=$(find ${SNAP_MOUNT_DIR} -type d | wc -l)
     if [ "$before" -lt 2 ]; then
         echo "${SNAP_MOUNT_DIR} empty - test setup broken"
@@ -42,8 +46,15 @@
     # expecting to find various files that snap installation produced
     test "$(find /etc/udev/rules.d -name '*-snap.*.rules' | wc -l)" -gt 0
     test "$(find /etc/dbus-1/system.d -name 'snap.*.conf' | wc -l)" -gt 0
+    test "$(find /etc/modules-load.d/ -name 'snap.*.conf' | wc -l)" -gt 0
+    test "$(find /etc/systemd/system -name 'snap.*.service' | wc -l)" -gt 0
     test "$(find /etc/systemd/system -name 'snap.*.timer' | wc -l)" -gt 0
     test "$(find /etc/systemd/system -name 'snap.*.socket' | wc -l)" -gt 0
+    if echo "$SPREAD_SYSTEM" | grep -vqF ubuntu-14.04; then
+        test "$(find /etc/systemd/user -name 'snap.*.service' | wc -l)" -gt 0
+        test "$(find /etc/systemd/user -name 'snap.*.timer' | wc -l)" -gt 0
+        test "$(find /etc/systemd/user -name 'snap.*.socket' | wc -l)" -gt 0
+    fi
 
 execute: |
     echo "Stop snapd before purging"
@@ -53,7 +64,7 @@
     . "$TESTSLIB"/dirs.sh
 
     echo "A purge will really purge things"
-    $LIBEXECDIR/snapd/snap-mgmt --purge
+    snapd.tool exec snap-mgmt --purge
 
     echo "Data directories are empty"
     emptydirs="${SNAP_MOUNT_DIR} \
@@ -88,8 +99,22 @@
 
     echo "No dangling service symlinks are left behind"
     test -z "$(find /etc/systemd/system/multi-user.target.wants/ -name 'snap.test-snapd-service.*')"
+    test -z "$(find /etc/systemd/system/sockets.target.wants/ -name 'snap.*')"
+    test -z "$(find /etc/systemd/system/timers.target.wants/ -name 'snap.*')"
+    if echo "$SPREAD_SYSTEM" | grep -vqF ubuntu-14.04; then
+        test -z "$(find /etc/systemd/user/default.target.wants/ -name 'snap.*')"
+        test -z "$(find /etc/systemd/user/sockets.target.wants/ -name 'snap.*')"
+        test -z "$(find /etc/systemd/user/timers.target.wants/ -name 'snap.*')"
+    fi
 
     test "$(find /etc/udev/rules.d -name '*-snap.*.rules' | wc -l)" -eq 0
     test "$(find /etc/dbus-1/system.d -name 'snap.*.conf' | wc -l)" -eq 0
+    test "$(find /etc/modules-load.d/ -name 'snap.*.conf' | wc -l)" -eq 0
+    test "$(find /etc/systemd/system -name 'snap.*.service' -a ! -name "snap.mount.service" | wc -l)" -eq 0
     test "$(find /etc/systemd/system -name 'snap.*.timer' | wc -l)" -eq 0
     test "$(find /etc/systemd/system -name 'snap.*.socket' | wc -l)" -eq 0
+    if echo "$SPREAD_SYSTEM" | grep -vqF ubuntu-14.04; then
+        test "$(find /etc/systemd/user -name 'snap.*.service' | wc -l)" -eq 0
+        test "$(find /etc/systemd/user -name 'snap.*.timer' | wc -l)" -eq 0
+        test "$(find /etc/systemd/user -name 'snap.*.socket' | wc -l)" -eq 0
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-model/task.yaml snapd-2.48.3+20.04/tests/main/snap-model/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-model/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-model/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,5 @@
 summary: Check that snap model works
 
-# TODO:UC20: enable for UC20 once the real model is used
-systems: [-ubuntu-core-2*]
-
 execute: |
   knownCmdAssertion=$(snap known model)
   modelCmdAssertion=$(snap model --assertion)
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-pack/task.yaml snapd-2.48.3+20.04/tests/main/snap-pack/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-pack/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-pack/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,6 +3,9 @@
     Verify that snap pack creates squashfs files or fails in a predictable
     manner.
 
+restore: |
+    snap remove test-snapd-sh-lzo
+
 execute: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
@@ -29,3 +32,7 @@
     test -e test-snapd-sh-lzo.snap
     unsquashfs -l test-snapd-sh-lzo.snap
     unsquashfs -s test-snapd-sh-lzo.snap | MATCH "Compression lzo"
+
+    echo "The lzo snap can be used normally"
+    snap install --dangerous test-snapd-sh-lzo.snap
+    test-snapd-sh.sh -c "echo hello-lzo" | MATCH "hello-lzo"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-repair/task.yaml snapd-2.48.3+20.04/tests/main/snap-repair/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-repair/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-repair/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,16 +1,12 @@
 summary: Ensure that snap-repair is available
 
-# TODO:UC20: snap-repair fishes in /var/lib/snapd/seed/assertions for the model
-#            assertion - this no longer works on UC20
-systems: [-fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*, -debian-sid-*, -ubuntu-core-20-*]
+# snap-repair is not shipped on non-ubuntu
+systems: [-fedora-*, -opensuse-*, -arch-*, -amazon-*, -centos-*, -debian-sid-*]
 
 execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB"/dirs.sh
-
     if ! grep -q "ID=ubuntu-core" /etc/os-release; then
         echo "Ensure snap-repair is disabled on classic"
-        "${LIBEXECDIR}"/snapd/snap-repair 2>&1 | MATCH "cannot use snap-repair on a classic system"
+        snapd.tool exec snap-repair 2>&1 | MATCH "cannot use snap-repair on a classic system"
         exit 0
     fi
 
@@ -20,6 +16,4 @@
     systemctl list-timers | MATCH snapd.snap-repair.timer
 
     echo "Check that snap-repair can be run"
-    "${LIBEXECDIR}"/snapd/snap-repair run
-
-    
+    snapd.tool exec snap-repair run
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-routine-file-access/task.yaml snapd-2.48.3+20.04/tests/main/snap-routine-file-access/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-routine-file-access/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-routine-file-access/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,9 +21,7 @@
     access.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-file-access
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-file-access
 
     # Ensure interfaces are disconnected
     snap disconnect test-snapd-file-access:home
@@ -100,8 +98,6 @@
     if [[ "$SPREAD_SYSTEM" = ubuntu-core-* ]]; then
         exit 0
     fi
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-classic-confinement --classic
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
 
     snap routine file-access test-snapd-classic-confinement / | MATCH read-write
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-routine-portal-info/task.yaml snapd-2.48.3+20.04/tests/main/snap-routine-portal-info/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-routine-portal-info/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-routine-portal-info/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,29 +1,29 @@
 summary: The portal-info command provides information about a confined process
 
-# TODO: fedora-31: uses cgroupv2, which does not have a separate freezer
-# controller hierarchy
-systems: [ -fedora-31-*]
+systems:
+    - -ubuntu-14.04-*
+    - -fedora-31-*  # TODO: add support for cgroupv2 based tracking
+    - -fedora-32-*
+    - -amazon-linux-*
+    - -centos-7-*
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
+    tests.session -u test prepare
 
 restore: |
     rm -f output.txt
+    tests.session -u test exec systemctl --user stop test-snapd-desktop-sleep.service
+    tests.session -u test restore
 
 execute: |
     # Start a "sleep" process in the background
     #shellcheck disable=SC2016
-    test-snapd-desktop.cmd sh -c 'touch $SNAP_DATA/1.stamp && exec sleep 1h' &
-    pid1=$!
-    trap 'kill "$pid1" || true' EXIT
+    tests.session -u test exec systemd-run --user --unit test-snapd-desktop-sleep.service snap run test-snapd-desktop.cmd sh -c 'touch $SNAP_USER_DATA/1.stamp && exec sleep 1h'
     # Ensure that snap-confine has finished its task and that the snap process
     # is active. Note that we don't want to wait forever either.
-    for _ in $(seq 30); do
-        test -e /var/snap/test-snapd-desktop/current/1.stamp && break
-        sleep 0.1
-    done
+    retry -n 30 --wait 0.1 test -e /home/test/snap/test-snapd-desktop/current/1.stamp
+    pid1="$(tests.session -u test exec systemctl --user show --property=MainPID test-snapd-desktop-sleep.service | cut -d = -f 2)"
 
     snap routine portal-info "$pid1" > output.txt
     diff -u output.txt - << \EOF
@@ -33,6 +33,3 @@
     DesktopFile=test-snapd-desktop_cmd.desktop
     HasNetworkStatus=false
     EOF
-
-    kill "$pid1"
-    wait "$pid1" || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-run/task.yaml snapd-2.48.3+20.04/tests/main/snap-run/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-run/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-run/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,10 +5,8 @@
 systems: [-*-s390x]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local basic-run
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local basic-run
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 debug: |
     if [ -f stderr ]; then
@@ -16,6 +14,10 @@
     fi
 
 execute: |
+    echo "Running a trivial command causes no DENIED messages"
+    test-snapd-sh.sh -c 'echo hello'
+    dmesg | not grep DENIED
+
     echo "Test that snap run use environments"
     basic-run.echo-data | MATCH ^/var/snap
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-run-alias/task.yaml snapd-2.48.3+20.04/tests/main/snap-run-alias/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-run-alias/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-run-alias/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,9 +9,7 @@
     ALIAS/testsnapdtoolscat: test_cat
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools
 
 restore: |
     #shellcheck source=tests/lib/dirs.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-run-gdbserver/task.yaml snapd-2.48.3+20.04/tests/main/snap-run-gdbserver/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-run-gdbserver/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-run-gdbserver/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+summary: Check that `snap run --experimental-gdbserver` works
+
+# testing only here to avoid having to install gdb/gdbserver everywhere
+systems: [ubuntu-16.04-*, ubuntu-18.04-*, ubuntu-2*]
+
+prepare: |
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
+    apt install -y gdbserver gdb
+
+restore: |
+    apt autoremove -y gdbserver gdb
+
+execute: |
+    echo "Test snap run --experimental-gdbserver works"
+
+    # run the gdbserver command as a user
+    # XXX: use "systemd-run --user -p StandardOutput=file:$(pwd)/stdout"
+    # shellcheck disable=SC2016
+    su -c 'snap run --experimental-gdbserver test-snapd-sh.sh -c "echo hello-hello-hello uid:$UID"' test >stdout &
+
+    # wait for the instructions that gdb is ready to get attached
+    retry -n60 grep '^gdb -ex' stdout
+    # ensure that the actual program is *not* run yet
+    not grep hello-hello-hello < stdout
+
+    # now attach gdb as instructed via "snap run" and continue running the
+    # program
+    gdb_cmd="$(grep '^gdb -ex' stdout)"
+    # shellcheck disable=SC2086
+    echo c | eval $gdb_cmd
+
+    # ensure the program ran and was running as a user
+    MATCH hello-hello-hello < stdout
+    MATCH "uid:$(id -u test)" < stdout
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-run-hook/task.yaml snapd-2.48.3+20.04/tests/main/snap-run-hook/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-run-hook/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-run-hook/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,9 +8,7 @@
     ENVDUMP: /var/snap/basic-hooks/current/hooks-env
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local basic-hooks
+    "$TESTSTOOLS"/snaps-state install-local basic-hooks
 
 execute: |
     # Note that `snap run` doesn't exit non-zero if the hook is missing, so we
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-run-symlink/task.yaml snapd-2.48.3+20.04/tests/main/snap-run-symlink/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-run-symlink/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-run-symlink/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,9 +7,7 @@
     APP/testsnapdtoolscat: test-snapd-tools.cat
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-run-userdata-current/task.yaml snapd-2.48.3+20.04/tests/main/snap-run-userdata-current/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-run-userdata-current/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-run-userdata-current/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,9 +3,7 @@
 systems: [-ubuntu-core-*]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-service/task.yaml snapd-2.48.3+20.04/tests/main/snap-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-service/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
 
 execute: |
     echo "When the service snap is installed"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
     echo "We can see it running"
     systemctl status snap.test-snapd-service.test-snapd-service|MATCH "running"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-services/task.yaml snapd-2.48.3+20.04/tests/main/snap-services/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-services/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-services/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,11 +4,9 @@
     rm -f ./*.out
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-service
-    install_local socket-activation
-    install_local test-snapd-timer-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local socket-activation
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-timer-service
 
     snap services test-snapd-timer-service > timer-service.out
     MATCH '^test-snapd-timer-service.random-timer\s+ disabled\s+ (in)?active\s+ timer-activated$' < timer-service.out
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-session-agent-service-control/task.yaml snapd-2.48.3+20.04/tests/main/snap-session-agent-service-control/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-session-agent-service-control/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-session-agent-service-control/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -19,39 +19,24 @@
         touch agent-was-enabled
     fi
 
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    start_user_session
-    # Wait for sockets.target to finish starting so the session agent
-    # socket is available.
-    as_user systemctl --user start sockets.target
-
     # ensure curl is available (needed for e.g. core18)
     if ! command -v curl; then
         snap install --devmode --edge test-snapd-curl
         snap alias test-snapd-curl.curl curl
     fi
 
+    tests.session -u test prepare
+
 restore: |
+    tests.session -u test restore
     snap remove --purge test-snapd-curl
 
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    stop_user_session
-    purge_user_session_data
-
     if [ -f agent-was-enabled ]; then
         systemctl --user --global disable snapd.session-agent.socket
     fi
     rm -f /etc/systemd/user/snap.test-service.service
 
 execute: |
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    systemctl_user() {
-        as_user systemctl --user "$@"
-    }
-
     echo "Create a user mode service"
     cat << \EOF > /etc/systemd/user/snap.test-service.service
     [Unit]
@@ -62,29 +47,25 @@
     EOF
 
     echo "The session agent can reload the user mode systemd instance"
-    curl --unix-socket "${USER_RUNTIME_DIR}/snapd-session-agent.socket" \
+    curl --unix-socket /run/user/12345/snapd-session-agent.socket \
         -D- -X POST -H "Content-Type: application/json" \
         -d '{"action": "daemon-reload"}' \
         http://localhost/v1/service-control | MATCH "HTTP/1.1 200 OK"
 
     echo "The service is now visible but not active"
-    systemctl_user show --property=LoadState snap.test-service.service |
-        MATCH LoadState=loaded
-    systemctl_user show --property=ActiveState snap.test-service.service |
-        MATCH ActiveState=inactive
+    tests.session -u test exec systemctl --user show --property=LoadState snap.test-service.service | MATCH LoadState=loaded
+    tests.session -u test exec systemctl --user show --property=ActiveState snap.test-service.service | MATCH ActiveState=inactive
 
     echo "The session agent can start user mode services"
-    curl --unix-socket "${USER_RUNTIME_DIR}/snapd-session-agent.socket" \
+    curl --unix-socket /run/user/12345/snapd-session-agent.socket \
         -D- -X POST -H "Content-Type: application/json" \
         -d '{"action": "start", "services": ["snap.test-service.service"]}' \
         http://localhost/v1/service-control | MATCH "HTTP/1.1 200 OK"
-    systemctl_user show --property=ActiveState snap.test-service.service |
-        MATCH ActiveState=active
+    tests.session -u test exec systemctl --user show --property=ActiveState snap.test-service.service | MATCH ActiveState=active
 
     echo "The session agent can stop user mode services"
-    curl --unix-socket "${USER_RUNTIME_DIR}/snapd-session-agent.socket" \
+    curl --unix-socket /run/user/12345/snapd-session-agent.socket \
         -D- -X POST -H "Content-Type: application/json" \
         -d '{"action": "stop", "services": ["snap.test-service.service"]}' \
         http://localhost/v1/service-control | MATCH "HTTP/1.1 200 OK"
-    systemctl_user show --property=ActiveState snap.test-service.service |
-        MATCH ActiveState=inactive
+    tests.session -u test exec systemctl --user show --property=ActiveState snap.test-service.service | MATCH ActiveState=inactive
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-session-agent-socket-activation/task.yaml snapd-2.48.3+20.04/tests/main/snap-session-agent-socket-activation/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-session-agent-socket-activation/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-session-agent-socket-activation/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -19,64 +19,45 @@
         touch agent-was-enabled
     fi
 
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    start_user_session
-    # Wait for sockets.target to finish starting so the session agent
-    # socket is available.
-    as_user systemctl --user start sockets.target
-
     # ensure curl is available (needed for e.g. core18)
     if ! command -v curl; then
         snap install --devmode --edge test-snapd-curl
         snap alias test-snapd-curl.curl curl
     fi
 
+    tests.session -u test prepare
+
 restore: |
+    tests.session -u test restore
     snap remove test-snapd-curl
 
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    stop_user_session
-    purge_user_session_data
-
     if [ -f agent-was-enabled ]; then
         systemctl --user --global disable snapd.session-agent.socket
         rm agent-was-enabled
     fi
 
 execute: |
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    systemctl_user() {
-        as_user systemctl --user "$@"
-    }
-
     echo "Initially snap session-agent is not running"
-    if systemctl_user is-active snapd.session-agent.service; then
-        exit 1
-    fi
+    not tests.session -u test exec systemctl --user is-active snapd.session-agent.service
 
     echo "However its REST API socket exists"
-    test -S "${USER_RUNTIME_DIR}/snapd-session-agent.socket"
+    test -S /run/user/12345/snapd-session-agent.socket
 
     echo "We can issue queries to the socket as root"
-    curl --unix-socket "${USER_RUNTIME_DIR}/snapd-session-agent.socket" \
+    curl --unix-socket /run/user/12345/snapd-session-agent.socket \
         -D- http://localhost/v1/session-info | MATCH "HTTP/1.1 200 OK"
 
     echo "Now snap session-agent is running"
-    systemctl_user is-active snapd.session-agent.service
+    tests.session -u test exec systemctl --user is-active snapd.session-agent.service
 
     echo "If we stop session-agent, it can be restarted via socket activation"
-    systemctl_user stop snapd.session-agent.service
-    if systemctl_user is-active snapd.session-agent.service; then
-        exit 1
-    fi
+    tests.session -u test exec systemctl --user stop snapd.session-agent.service
+    not tests.session -u test exec systemctl --user is-active snapd.session-agent.service
 
-    curl --unix-socket "${USER_RUNTIME_DIR}/snapd-session-agent.socket" \
+    curl --unix-socket /run/user/12345/snapd-session-agent.socket \
         -D- http://localhost/v1/session-info | MATCH "HTTP/1.1 200 OK"
-    systemctl_user is-active snapd.session-agent.service
+    tests.session -u test exec systemctl --user is-active snapd.session-agent.service
 
     echo "The user running the session agent can also communicate with it"
-    su -l -c "curl --unix-socket \"${USER_RUNTIME_DIR}/snapd-session-agent.socket\" \
-        -D- http://localhost/v1/session-info" test | MATCH "HTTP/1.1 200 OK"
+    tests.session -u test exec curl --unix-socket /run/user/12345/snapd-session-agent.socket \
+        -D- http://localhost/v1/session-info | MATCH "HTTP/1.1 200 OK"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-session-agent-unavailable-to-snaps/task.yaml snapd-2.48.3+20.04/tests/main/snap-session-agent-unavailable-to-snaps/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-session-agent-unavailable-to-snaps/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-session-agent-unavailable-to-snaps/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -17,44 +17,33 @@
         touch agent-was-enabled
     fi
 
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    start_user_session
-    # Wait for sockets.target to finish starting so the session agent
-    # socket is available.
-    as_user systemctl --user start sockets.target
+    echo "Install the curl snap as a confined example client"
+    snap install --edge test-snapd-curl
 
-restore: |
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-    stop_user_session
-    purge_user_session_data
+    tests.session -u test prepare
 
+restore: |
+    tests.session -u test restore
+    snap remove test-snapd-curl
     if [ -f agent-was-enabled ]; then
         systemctl --user --global disable snapd.session-agent.socket
         rm agent-was-enabled
     fi
 
 execute: |
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-
     if [ "$(snap debug confinement)" != strict ]; then
         exit 0
     fi
 
-    echo "Install the curl snap as a confined example client"
-    snap install --edge test-snapd-curl
-
     echo "The snap session agent REST API socket exists"
-    test -S "${USER_RUNTIME_DIR}/snapd-session-agent.socket"
+    test -S "/run/user/12345/snapd-session-agent.socket"
 
     echo "But confined applications can not access it"
-    not su -l -c "test-snapd-curl.curl \
-        --unix-socket \"${USER_RUNTIME_DIR}/snapd-session-agent.socket\" \
-        -D- http://localhost/v1/session-info" test
+    not tests.session -u test exec test-snapd-curl.curl \
+        --unix-socket /run/user/12345/snapd-session-agent.socket \
+        -D- http://localhost/v1/session-info
 
     echo "Confined apps running as root also can not access it"
     not test-snapd-curl.curl \
-        --unix-socket "${USER_RUNTIME_DIR}/snapd-session-agent.socket" \
+        --unix-socket /run/user/12345/snapd-session-agent.socket \
         -D- http://localhost/v1/session-info
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-set/task.yaml snapd-2.48.3+20.04/tests/main/snap-set/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-set/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-set/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,17 +1,14 @@
 summary: Check that `snap set` runs configure hook.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Build basic test package (without hooks)"
-    install_local basic
+    "$TESTSTOOLS"/snaps-state install-local basic
 
     echo "Build failing hooks package"
     snap pack "$TESTSLIB"/snaps/failing-config-hooks
 
     echo "Build package with hook to run snapctl set"
-    install_local snapctl-hooks
+    "$TESTSTOOLS"/snaps-state install-local snapctl-hooks
 
 execute: |
     echo "Test that snap set fails without configure hook"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snapshot-basic/task.yaml snapd-2.48.3+20.04/tests/main/snapshot-basic/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snapshot-basic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snapshot-basic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,6 +3,10 @@
 prepare: |
     snap install test-snapd-sh
     snap install --edge test-snapd-just-edge
+    snap install --edge test-snapd-tools
+
+restore: |
+    rm -f /var/snap/test-snapd-tools/common/huge
 
 debug: |
     snap list || true
@@ -18,7 +22,7 @@
        echo "hello versioned $snap"  > ~/snap/$snap/current/canary.txt
        echo "hello common $snap" > ~/snap/$snap/common/canary.txt
     done
-    # create snapshot, grab its id
+    # create snapshot, grab its ID
     SET_ID=$( snap save test-snapd-sh test-snapd-just-edge | cut -d\  -f1 | tail -n1 )
 
     # check it includes both snaps
@@ -29,9 +33,33 @@
     # and is valid
     snap check-snapshot "$SET_ID"
 
+    # and is exportable
+    snap export-snapshot "$SET_ID" "${SET_ID}_export.snapshot"
+    test -e "${SET_ID}_export.snapshot"
+    test "$( tar -tvf "${SET_ID}_export.snapshot" | wc -l )" = "3"
+    # do it again and ensure it has the files have the same size
+    snap export-snapshot "$SET_ID" "${SET_ID}_export-2.snapshot"
+    test "$( tar -tvf "${SET_ID}_export-2.snapshot" | wc -l )" = "3"
+    s1="$(stat -c%s "${SET_ID}_export.snapshot" )"
+    s2="$(stat -c%s "${SET_ID}_export-2.snapshot" )"
+    test "$s1" = "$s2"
+    echo "and the same files are snapshoted"
+    f1="$(tar -tf "${SET_ID}_export.snapshot" )"
+    f2="$(tar -tf "${SET_ID}_export-2.snapshot" )"
+    test "$f1" = "$f2"
+
+    # and is importable
+    RESTORE_ID=$( snap import-snapshot "${SET_ID}_export.snapshot" | head -n1 | cut -f2 -d'#' )
+    # and is valid
+    snap check-snapshot "$RESTORE_ID"
+
     # remove the canaries
     rm ~/snap/*/{current,common}/canary.txt
 
+    # remove the exports and import
+    rm "${SET_ID}"_export*.snapshot
+    snap forget "$RESTORE_ID"
+
     # restore one of them
     snap restore "$SET_ID" test-snapd-sh
     test -e ~/snap/test-snapd-sh/current/canary.txt
@@ -78,9 +106,41 @@
         exit 1
     fi
 
-    # check validatation of the automatic snapshot expiration range
+    # check validation of the automatic snapshot expiration range
     (snap set core snapshots.automatic.retention=1s 2>&1 || true) | MATCH "must be"
 
     # check that expiration can be read back
     snap get core snapshots.automatic.retention | MATCH "30h"
     snap get core -d snapshots.automatic | MATCH '"retention"'
+
+    # check memory usage for larger snap snapshot data exporting
+    mkdir -p /var/snap/test-snapd-tools/common/
+    dd if=/dev/urandom of=/var/snap/test-snapd-tools/common/huge bs=1M count=100
+    # create snapshot, grab its ID
+    SET_ID=$( snap save test-snapd-tools | cut -d\  -f1 | tail -n1 )
+    snap saved --id="$SET_ID" | grep test-snapd-tools
+    snap check-snapshot "$SET_ID"
+    # export the large snap and record memory usage
+    "$TESTSTOOLS"/memory-observe-do -o memory-kb.txt snap export-snapshot \
+        "$SET_ID" "${SET_ID}_export.snapshot"
+    test -e "${SET_ID}_export.snapshot"
+    # Ensure our snapshot export file is at least 50MB. The data we created
+    # is 100MB of randomness so even with amazing compression we should never
+    # have a smaller file
+    test "$(stat -c%s "${SET_ID}_export.snapshot")" -gt 50000000
+    # the io.Copy uses a 32k buffer, so extra memory usage should be limited.
+    # The threshold in this test is set to about 40MB
+    test "$(cat memory-kb.txt)" -lt 40000
+
+    # check that snapshot set id from the filename has authority
+    snap install test-snapd-sh
+    snap save test-snapd-sh
+    SNAPSHOT_FILE=$(ls /var/lib/snapd/snapshots/*test-snapd-sh*.zip)
+    NEWSNAPSHOT_FILE=$(echo "$SNAPSHOT_FILE" | sed -e's/[1-9]\+_/123_/')
+    # rename the snapshot file to force a new set id.
+    mv "$SNAPSHOT_FILE" "$NEWSNAPSHOT_FILE"
+    snap saved | MATCH "123 +test-snapd-sh"
+    # make sure there is just one such snapshot
+    [[ $(snap saved | grep -c test-snapd-sh) == "1" ]]
+    snap saved --id=123 | MATCH "123 .+test-snapd-sh"
+    snap restore 123 test-snapd-sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/snaps-state/task.yaml snapd-2.48.3+20.04/tests/main/snaps-state/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snaps-state/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snaps-state/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,76 @@
+summary: smoke test for the snaps-state tool
+
+prepare: |
+    snap set system experimental.parallel-instances=true
+
+restore: |
+    snap set system experimental.parallel-instances=null
+
+execute: |
+    SNAP_NAME=test-snapd-tools
+    SNAP_CLASSIC=test-snapd-classic-confinement
+    SNAP_DEVMODE=test-snapd-devmode
+    SNAP_JAILMODE=test-devmode-cgroup
+
+    # Check help
+    "$TESTSTOOLS"/snaps-state | MATCH "usage: pack-local <snap-name>"
+    "$TESTSTOOLS"/snaps-state -h | MATCH "usage: pack-local <snap-name>"
+    "$TESTSTOOLS"/snaps-state --help | MATCH "usage: pack-local <snap-name>"
+
+    # Pack a local snap by using the pack-local subcommand
+    snap_path=$("$TESTSTOOLS"/snaps-state pack-local "$SNAP_NAME")
+    snap install --dangerous "${snap_path}"
+    test-snapd-tools.echo test123 | MATCH "test123"
+    snap remove "$SNAP_NAME"
+
+    # Check the local snap file is already created
+    test -f "$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_1.0_all.snap"
+    rm -f "$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_1.0_all.snap"
+
+    # Try to pack a local snap which does not exist
+    "$TESTSTOOLS"/snaps-state pack-local SNAP_NO_EXIST 2>&1 | MATCH "snap.yaml file not found for SNAP_NO_EXIST snap"
+
+    # Make and install a snap by using the install-local subcommand
+    snap_path=$("$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME")
+    test-snapd-tools.echo test123 | MATCH "test123"
+    snap remove "$SNAP_NAME"
+
+    # Check the local snap file is already created
+    test -f "$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_1.0_all.snap"
+
+    # Make and install a snap when snap file is already created
+    snap_path=$("$TESTSTOOLS"/snaps-state install-local "$SNAP_NAME")
+    test-snapd-tools.echo test123 | MATCH "test123"
+    snap remove "$SNAP_NAME"
+
+    # Check the local snap file is already created
+    test -f "$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_1.0_all.snap"
+    rm -f "$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_1.0_all.snap"
+
+    # Make and install a snap by using the install-local-as subcommand
+    snap_path=$("$TESTSTOOLS"/snaps-state install-local-as "$SNAP_NAME" "$SNAP_NAME"_test)
+    test-snapd-tools_test.echo test123 | MATCH "test123"
+    snap remove "$SNAP_NAME"_test
+    rm -f "$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_test_1.0_all.snap"
+
+    # Make and install a snap by using the install-local subcommand with --devmode
+    snap_path=$("$TESTSTOOLS"/snaps-state install-local "$SNAP_DEVMODE" --devmode)
+    snap list "$SNAP_DEVMODE"
+    snap remove "$SNAP_DEVMODE"
+    rm -f "$TESTSLIB/snaps/${SNAP_DEVMODE}/${SNAP_DEVMODE}_1.0_all.snap"
+
+    # Make and install a snap by using the install-local subcommand with --classic
+    if snap debug sandbox-features --required=confinement-options:classic; then
+        snap_path=$("$TESTSTOOLS"/snaps-state install-local "$SNAP_CLASSIC" --classic)
+        snap list "$SNAP_CLASSIC" | MATCH 'classic$'
+        snap remove "$SNAP_CLASSIC"
+        rm -f "$TESTSLIB/snaps/${SNAP_CLASSIC}/${SNAP_CLASSIC}_1.0_all.snap"
+    fi
+
+    # Make and install a snap by using the install-local subcommand with --jailmode
+    if [ "$(snap debug confinement)" = strict ] ; then
+        snap_path=$("$TESTSTOOLS"/snaps-state install-local "$SNAP_JAILMODE" --jailmode)
+        snap list "$SNAP_JAILMODE" | MATCH 'jailmode$'
+        snap remove "$SNAP_JAILMODE"
+        rm -f "$TESTSLIB/snaps/${SNAP_JAILMODE}/${SNAP_JAILMODE}_1.0_all.snap"
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-system-key/task.yaml snapd-2.48.3+20.04/tests/main/snap-system-key/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-system-key/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-system-key/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,6 +8,9 @@
     echo "Restore fstab copy"
     cp /tmp/fstab.save /etc/fstab
     rm -f /tmp/fstab.save
+    # Systemd detects changes to fstab and complains that the -.mount unit has
+    # changed on disk.
+    systemctl daemon-reload
 
 execute: |
     stop_snapd() {
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-unset/task.yaml snapd-2.48.3+20.04/tests/main/snap-unset/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-unset/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-unset/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,11 +1,8 @@
 summary: Check that `snap unset` works and removes config options.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-
     echo "Build basic test snap"
-    install_local basic-hooks
+    "$TESTSTOOLS"/snaps-state install-local basic-hooks
 
 execute: |
     echo "Setting up initial configuration"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-update-ns/task.yaml snapd-2.48.3+20.04/tests/main/snap-update-ns/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-update-ns/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-update-ns/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,20 +15,16 @@
     SLOT_SNAP: test-snapd-content-slot
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     # NOTE: those are installed locally so that they are not connected because
     # of missing assertions. We are installing the slot before the plug snap so
     # that there's no attempt to load the default provider. Just in case
     # something changes we're disconnecting them so that tests are predictable.
-    install_local "$SLOT_SNAP"
-    install_local "$PLUG_SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$SLOT_SNAP"
+    "$TESTSTOOLS"/snaps-state install-local "$PLUG_SNAP"
     snap disconnect "$PLUG_SNAP:shared-content-plug" || :
     # Ensure there is no preserved mount namespace of the -plug snap.
     # (This one gets created because by connect hooks).
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    $LIBEXECDIR/snapd/snap-discard-ns "$PLUG_SNAP"
+    snapd.tool exec snap-discard-ns "$PLUG_SNAP"
     rm -f "/run/snapd/ns/$PLUG_SNAP.mnt"
 
 execute: |
@@ -37,11 +33,8 @@
     # inert, as a way to provide content, but it does not execute and does not
     # need a namespace namespace.
 
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-
     # Check that update tool doesn't fail if there is no namespace yet.
-    $LIBEXECDIR/snapd/snap-update-ns "$PLUG_SNAP"
+    snapd.tool exec snap-update-ns "$PLUG_SNAP"
 
     # Run a trivial command to build and preserve a mount namespace.
     snap run --shell "$PLUG_SNAP.content-plug" -c 'true'
@@ -55,7 +48,7 @@
     # is exactly as it needs to be. The snap-confine program has just
     # constructed it according to the desired description.
     diff -Nu "/var/lib/snapd/mount/snap.$PLUG_SNAP.fstab" "/run/snapd/ns/snap.$PLUG_SNAP.fstab"
-    $LIBEXECDIR/snapd/snap-update-ns "$PLUG_SNAP"
+    snapd.tool exec snap-update-ns "$PLUG_SNAP"
     diff -Nu "/var/lib/snapd/mount/snap.$PLUG_SNAP.fstab" "/run/snapd/ns/snap.$PLUG_SNAP.fstab"
 
     # Connect the plug to the slot.
@@ -63,7 +56,7 @@
 
     # Run the update tool manually to see that it is idempotent.
     diff -Nu "/var/lib/snapd/mount/snap.$PLUG_SNAP.fstab" "/run/snapd/ns/snap.$PLUG_SNAP.fstab"
-    $LIBEXECDIR/snapd/snap-update-ns "$PLUG_SNAP"
+    snapd.tool exec snap-update-ns "$PLUG_SNAP"
     diff -Nu "/var/lib/snapd/mount/snap.$PLUG_SNAP.fstab" "/run/snapd/ns/snap.$PLUG_SNAP.fstab"
 
     # Check that the shared content is mounted.
@@ -75,7 +68,7 @@
 
     # Run the update tool manually to see that it is idempotent.
     diff -uN "/var/lib/snapd/mount/snap.$PLUG_SNAP.fstab" "/run/snapd/ns/snap.$PLUG_SNAP.fstab"
-    $LIBEXECDIR/snapd/snap-update-ns "$PLUG_SNAP"
+    snapd.tool exec snap-update-ns "$PLUG_SNAP"
     diff -uN "/var/lib/snapd/mount/snap.$PLUG_SNAP.fstab" "/run/snapd/ns/snap.$PLUG_SNAP.fstab"
 
     # Check that the shared content is not mounted.
@@ -83,5 +76,5 @@
     snap run --shell "$PLUG_SNAP.content-plug" -c 'test ! -e $SNAP/import/shared-content'
 
     # Discard the namespace so that update has nothing useful to do.
-    $LIBEXECDIR/snapd/snap-discard-ns "$PLUG_SNAP"
-    $LIBEXECDIR/snapd/snap-update-ns "$PLUG_SNAP"
+    snapd.tool exec snap-discard-ns "$PLUG_SNAP"
+    snapd.tool exec snap-update-ns "$PLUG_SNAP"
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-userd-desktop-app-autostart/task.yaml snapd-2.48.3+20.04/tests/main/snap-userd-desktop-app-autostart/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-userd-desktop-app-autostart/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-userd-desktop-app-autostart/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,13 +5,8 @@
     rm -f ~/snap/test-snapd-xdg-autostart/current/.config/autostart/foo.desktop
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "When the snap is installed"
-    install_local test-snapd-xdg-autostart
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-xdg-autostart
 
     # run the app directly, it will dump a *.desktop file
     snap run test-snapd-xdg-autostart.foo
@@ -22,7 +17,7 @@
     echo "Applications can be automatically started by snap userd --autostart"
 
     test ! -e ~/snap/test-xdg-snap-autostart/current/foo-autostarted
-    cursor=$(get_last_journalctl_cursor)
+    cursor=$("$TESTSTOOLS"/journal-state get-last-cursor)
     snap userd --autostart > autostart.log 2>&1
 
     # when app is autostarted it dumps a file at $SNAP_USER_DATA/foo-autostarted,
@@ -33,4 +28,4 @@
     done
     test -e ~/snap/test-snapd-xdg-autostart/current/foo-autostarted
 
-    test "$(get_journalctl_log_from_cursor "$cursor" | grep -c foo.desktop)" -gt 0
+    test "$("$TESTSTOOLS"/journal-state get-log-from-cursor "$cursor" | grep -c foo.desktop)" -gt 0
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-user-service/task.yaml snapd-2.48.3+20.04/tests/main/snap-user-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-user-service/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-user-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+summary: Check that snap user services are installed and started.
+
+systems:
+    # Ubuntu 14.04's systemd doesn't have user@.service
+    - -ubuntu-14.04-*
+    # Amazon Linux 2 gives error "Unit user@12345.service not loaded."
+    - -amazon-linux-2-*
+    # Centos 7 gives error "Unit user@12345.service not loaded."
+    - -centos-7-*
+
+kill-timeout: 5m
+
+prepare: |
+    snap set system experimental.user-daemons=true
+    tests.session kill-leaked
+
+restore: |
+    tests.session -u test restore
+    snap unset system experimental.user-daemons
+
+execute: |
+    echo "When the service snap is installed"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service
+
+    echo "And the user mode systemd instance is started"
+    tests.session -u test prepare
+
+    echo "We can see the service running"
+    tests.session -u test exec systemctl --user is-active snap.test-snapd-user-service.test-snapd-user-service
+
+debug: |
+    tests.session dump
+    tests.session -u test exec systemctl --user status snapd.session-agent.service || true
+    tests.session -u test exec journalctl --user || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-user-service-restart-on-upgrade/task.yaml snapd-2.48.3+20.04/tests/main/snap-user-service-restart-on-upgrade/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-user-service-restart-on-upgrade/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-user-service-restart-on-upgrade/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,57 @@
+summary: Snap user services are restarted when snaps are upgraded
+
+systems:
+    # Ubuntu 14.04's systemd doesn't have user@.service
+    - -ubuntu-14.04-*
+    # Amazon Linux 2 gives error "Unit user@12345.service not loaded."
+    - -amazon-linux-2-*
+    # Centos 7 gives error "Unit user@12345.service not loaded."
+    - -centos-7-*
+
+kill-timeout: 5m
+
+prepare: |
+    # Ensure that snapd.session-agent.socket is enabled.  This may not
+    # be the case on distributions where presets have been used to
+    # disable it.
+    if [ ! -L /usr/lib/systemd/user/sockets.target.wants/snapd.session-agent.socket ] &&
+            ! systemctl --user --global is-enabled snapd.session-agent.socket; then
+        systemctl --user --global enable snapd.session-agent.socket
+        touch agent-was-enabled
+    fi
+    snap set system experimental.user-daemons=true
+    tests.session kill-leaked
+    tests.session -u test prepare
+
+restore: |
+    tests.session -u test restore
+    snap unset system experimental.user-daemons
+    if [ -f agent-was-enabled ]; then
+        systemctl --user --global disable snapd.session-agent.socket
+        rm agent-was-enabled
+    fi
+
+execute: |
+    function systemctl_user() {
+      tests.session -u test exec systemctl --user "$@"
+    }
+
+    echo "Install the a snap with user services while a user session is active"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service
+
+    echo "We can see the service running"
+    systemctl_user is-active snap.test-snapd-user-service.test-snapd-user-service
+    systemctl_user show -p MainPID snap.test-snapd-user-service.test-snapd-user-service > old-main.pid
+
+    echo "When it is re-installed"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service
+
+    echo "We can see the service running with a new PID"
+    systemctl_user is-active snap.test-snapd-user-service.test-snapd-user-service
+    systemctl_user show -p MainPID snap.test-snapd-user-service.test-snapd-user-service > new-main.pid
+    test "$(cat new-main.pid)" != "$(cat old-main.pid)"
+
+debug: |
+    tests.session dump
+    tests.session -u test exec systemctl --user status snapd.session-agent.service || true
+    tests.session -u test exec journalctl --user || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-user-service-socket-activation/task.yaml snapd-2.48.3+20.04/tests/main/snap-user-service-socket-activation/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-user-service-socket-activation/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-user-service-socket-activation/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+summary: Check that sockets for user services are created correctly
+
+systems:
+    # Ubuntu 14.04's systemd doesn't have user@.service
+    - -ubuntu-14.04-*
+    # Amazon Linux 2 gives error "Unit user@12345.service not loaded."
+    - -amazon-linux-2-*
+    # Centos 7 gives error "Unit user@12345.service not loaded."
+    - -centos-7-*
+
+kill-timeout: 5m
+
+prepare: |
+    snap set system experimental.user-daemons=true
+    tests.session kill-leaked
+
+restore: |
+    tests.session -u test restore
+    snap unset system experimental.user-daemons
+
+execute: |
+    echo "When the service snap is installed"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service-sockets
+
+    echo "And the user mode systemd instance is started"
+    tests.session -u test prepare
+
+    echo "It's sockets are created in the test user's directories and activate the service"
+    [ -S ~test/snap/test-snapd-user-service-sockets/common/common.sock ]
+    nc -w 30 -U ~test/snap/test-snapd-user-service-sockets/common/common.sock | MATCH "Connected to common"
+
+    [ -S ~test/snap/test-snapd-user-service-sockets/x1/data.sock ]
+    nc -w 30 -U ~test/snap/test-snapd-user-service-sockets/x1/data.sock | MATCH "Connected to data"
+
+    USER_RUNTIME_DIR="/run/user/$(id -u test)"
+    [ -S "$USER_RUNTIME_DIR"/snap.test-snapd-user-service-sockets/run.sock ]
+    nc -w 30 -U "$USER_RUNTIME_DIR"/snap.test-snapd-user-service-sockets/run.sock | MATCH "Connected to runtime"
+
+debug: |
+    tests.session dump
+    tests.session -u test exec systemctl --user status snapd.session-agent.service || true
+    tests.session -u test exec journalctl --user || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-user-service-start-on-install/task.yaml snapd-2.48.3+20.04/tests/main/snap-user-service-start-on-install/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-user-service-start-on-install/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-user-service-start-on-install/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,57 @@
+summary: Check that snap user services are started on install in existing sessions
+
+systems:
+    # Ubuntu 14.04's systemd doesn't have user@.service
+    - -ubuntu-14.04-*
+    # Amazon Linux 2 gives error "Unit user@12345.service not loaded."
+    - -amazon-linux-2-*
+    # Centos 7 gives error "Unit user@12345.service not loaded."
+    - -centos-7-*
+
+kill-timeout: 5m
+
+prepare: |
+    # Ensure that snapd.session-agent.socket is enabled.  This may not
+    # be the case on distributions where presets have been used to
+    # disable it.
+    if [ ! -L /usr/lib/systemd/user/sockets.target.wants/snapd.session-agent.socket ] &&
+            ! systemctl --user --global is-enabled snapd.session-agent.socket; then
+        systemctl --user --global enable snapd.session-agent.socket
+        touch agent-was-enabled
+    fi
+    snap set system experimental.user-daemons=true
+    tests.session kill-leaked
+    tests.session -u test prepare
+
+restore: |
+    tests.session -u test restore
+    snap unset system experimental.user-daemons
+    if [ -f agent-was-enabled ]; then
+        systemctl --user --global disable snapd.session-agent.socket
+        rm agent-was-enabled
+    fi
+
+execute: |
+    function systemctl_user() {
+      tests.session -u test exec systemctl --user "$@"
+    }
+
+    echo "Install the a snap with user services while a user session is active"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service
+
+    echo "We can see the service running"
+    systemctl_user status snap.test-snapd-user-service.test-snapd-user-service
+    systemctl_user is-active snap.test-snapd-user-service.test-snapd-user-service
+
+    echo "Remove the snap"
+    snap remove test-snapd-user-service
+
+    echo "The service is stopped"
+    if systemctl_user is-active snap.test-snapd-user-service.test-snapd-user-service; then
+      exit 1
+    fi
+
+debug: |
+    tests.session dump
+    tests.session -u test exec systemctl --user status snapd.session-agent.service || true
+    tests.session -u test exec journalctl --user || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-user-service-upgrade-failure/task.yaml snapd-2.48.3+20.04/tests/main/snap-user-service-upgrade-failure/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-user-service-upgrade-failure/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-user-service-upgrade-failure/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,64 @@
+summary: On upgrade failures, user session daemons are restarted
+
+systems:
+    # Ubuntu 14.04's systemd doesn't have user@.service
+    - -ubuntu-14.04-*
+    # Amazon Linux 2 gives error "Unit user@12345.service not loaded."
+    - -amazon-linux-2-*
+    # Centos 7 gives error "Unit user@12345.service not loaded."
+    - -centos-7-*
+
+kill-timeout: 5m
+
+prepare: |
+    # Ensure that snapd.session-agent.socket is enabled.  This may not
+    # be the case on distributions where presets have been used to
+    # disable it.
+    if [ ! -L /usr/lib/systemd/user/sockets.target.wants/snapd.session-agent.socket ] &&
+            ! systemctl --user --global is-enabled snapd.session-agent.socket; then
+        systemctl --user --global enable snapd.session-agent.socket
+        touch agent-was-enabled
+    fi
+    snap set system experimental.user-daemons=true
+    tests.session kill-leaked
+    tests.session -u test prepare
+
+restore: |
+    tests.session -u test restore
+    snap unset system experimental.user-daemons
+    if [ -f agent-was-enabled ]; then
+        systemctl --user --global disable snapd.session-agent.socket
+        rm agent-was-enabled
+    fi
+
+execute: |
+    function systemctl_user() {
+      tests.session -u test exec systemctl --user "$@"
+    }
+
+    echo "Install the a snap with user services while a user session is active"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service
+    snap info test-snapd-user-service | MATCH '^installed:.* 1\.0 .*$'
+
+    echo "We can see the service running"
+    systemctl_user is-active snap.test-snapd-user-service.test-snapd-user-service
+    systemctl_user show -p MainPID snap.test-snapd-user-service.test-snapd-user-service > old-main.pid
+
+    echo "When it is re-installed"
+    if "$TESTSTOOLS"/snaps-state install-local test-snapd-user-service-v2-bad; then
+      echo "test-snapd-user-service v2 should not install cleanly, test broken"
+      exit 1
+    fi
+
+    echo "Version 1.0 of the snap is still installed"
+    snap info test-snapd-user-service | MATCH '^installed:.* 1\.0 .*$'
+
+    echo "We can see the service running with a new PID"
+    systemctl_user is-active snap.test-snapd-user-service.test-snapd-user-service
+    systemctl_user show -p MainPID snap.test-snapd-user-service.test-snapd-user-service > new-main.pid
+    test "$(cat new-main.pid)" != "$(cat old-main.pid)"
+
+debug: |
+    tests.session dump
+    tests.session -u test exec systemctl --user status snapd.session-agent.service || true
+    tests.session -u test exec journalctl --user || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/snap-wait/task.yaml snapd-2.48.3+20.04/tests/main/snap-wait/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/snap-wait/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/snap-wait/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,9 +3,7 @@
 kill-timeout: 5m
 
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local basic-hooks
+    "$TESTSTOOLS"/snaps-state install-local basic-hooks
 
 execute: |
     echo "Ensure snap wait for seeding works"
diff -Nru snapd-2.45.1+20.04.2/tests/main/special-home-can-run-classic-snaps/task.yaml snapd-2.48.3+20.04/tests/main/special-home-can-run-classic-snaps/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/special-home-can-run-classic-snaps/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/special-home-can-run-classic-snaps/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,16 +2,11 @@
 
 systems: [ubuntu-16.04-64]
 
-# XXX: disabled for now due to an issue with jenkins repo auth key
-manual: true
-
 environment:
     SPECIAL_USER_NAME/jenkins: jenkins
     SPECIAL_USER_NAME/postgres: postgres
 prepare: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local_classic test-snapd-classic-confinement
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
 
     # Install the corresponding package that brings the special user account.
     # Specialize the code as required for a particular user.
@@ -19,7 +14,7 @@
         jenkins)
             # Jenkins depends on java but not in the Debian sense.
             apt-get install -y default-jre-headless
-            wget -q -O - https://pkg.jenkins.io/debian/jenkins.io.key | apt-key add -
+            wget -q -O - https://pkg.jenkins.io/debian-stable/jenkins.io.key | apt-key add -
             echo 'deb http://pkg.jenkins.io/debian-stable binary/' > /etc/apt/sources.list.d/jenkins.list
             apt-get update
             apt-get install -y jenkins
diff -Nru snapd-2.45.1+20.04.2/tests/main/stale-base-snap/task.yaml snapd-2.48.3+20.04/tests/main/stale-base-snap/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/stale-base-snap/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/stale-base-snap/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -22,9 +22,7 @@
 prepare: |
     # We will need the Swiss-army-knife shell snap. We want to use it in
     # devmode so that we can look at /customized file which is non-standard.
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local_devmode test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh --devmode
 
     # We will also need to prepare a hacked core snap that just differs from
     # our own in some detail that we can measure.
@@ -32,6 +30,8 @@
     touch squashfs-root/customized
     sed -i -e 's/version: .*/version: customized/' squashfs-root/meta/snap.yaml
 
+    #shellcheck source=tests/lib/snaps.sh
+    . "$TESTSLIB"/snaps.sh
     mksnap_fast squashfs-root core-customized.snap
 
 restore: |
diff -Nru snapd-2.45.1+20.04.2/tests/main/sudo-env/task.yaml snapd-2.48.3+20.04/tests/main/sudo-env/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/sudo-env/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/sudo-env/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,51 @@
+summary: verify that snap binaries dir is present in PATH under sudo
+
+description: |
+    Some distributions set secure_path in /etc/sudoers which resets the PATH
+    under sudo to some predefined set of locations. Make sure to account for all
+    distros supported by snapd that have sudo set up this way.
+
+environment:
+    # list of regular expressions that match systems where sudo is set up to use
+    # secure_path without snap bindir
+    SECURE_PATH_SUDO_NO_SNAP: "centos-.* amazon-linux-2-64 opensuse-.* debian-.*"
+
+# ubuntu-14.04: no support for user sessions used by test helpers
+systems: [ -ubuntu-14.04-* ]
+
+debug: |
+    cat sudo.path || true
+    cat sudo-login.path || true
+
+prepare: |
+    tests.session -u test prepare
+
+restore: |
+    tests.session -u test restore
+
+execute: |
+    #shellcheck source=tests/lib/dirs.sh
+    . "$TESTSLIB/dirs.sh"
+
+    # run a snap command via sudo
+    # shellcheck disable=SC2016
+    tests.session -u test exec sudo sh -c 'echo :$PATH:' > sudo.path
+    # and again via sudo --login which should load /etc/profile
+    # shellcheck disable=SC2016
+    tests.session -u test exec sudo --login sh -c 'echo :$PATH:' > sudo-login.path
+
+    secure_path=no
+    for regex in $SECURE_PATH_SUDO_NO_SNAP ; do
+        if echo "$SPREAD_SYSTEM" | grep -Eq "$regex" ; then
+            secure_path=yes
+            break
+        fi
+    done
+
+    if [ "$secure_path" = "yes" ] ; then
+        not MATCH ":${SNAP_MOUNT_DIR}/bin:" < sudo.path
+    else
+        MATCH ":${SNAP_MOUNT_DIR}/bin:" < sudo.path
+    fi
+    # in either case, the location should be listed in a login shell
+    MATCH ":${SNAP_MOUNT_DIR}/bin:" < sudo-login.path
diff -Nru snapd-2.45.1+20.04.2/tests/main/systemd-service/task.yaml snapd-2.48.3+20.04/tests/main/systemd-service/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/systemd-service/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/systemd-service/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,11 +7,8 @@
     rm -f ./*.snap
 
 execute: |
-    # shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
     echo "Given a service snap is installed"
-    install_local test-snapd-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-service
 
     echo "When the service state is reported as active"
     while ! systemctl show -p ActiveState "$SERVICE_NAME" | grep -Pq "ActiveState=active"; do sleep 0.5; done
diff -Nru snapd-2.45.1+20.04.2/tests/main/system-usernames/task.yaml snapd-2.48.3+20.04/tests/main/system-usernames/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/system-usernames/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/system-usernames/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,7 +5,7 @@
 # -----
 # + snap remove --purge test-snapd-daemon-user
 # test-snapd-daemon-user removed
-# + user-tool remove-with-group snap_daemon
+# + user-state remove-with-group snap_daemon
 # userdel: user 'snap_daemon' does not exist
 # snap_daemon:x:584788:584788::/nonexistent:/usr/bin/false
 # user exists after removal?
@@ -23,9 +23,7 @@
 
 prepare: |
     echo "Install helper snaps with default confinement"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 restore: |
     # make sure this snap is removed in case it was installed
@@ -33,7 +31,7 @@
 
     # snapd will create this for us, but we'll remove it for consistency in
     # test runs
-    user-tool remove-with-group snap_daemon
+    "$TESTSTOOLS"/user-state remove-with-group snap_daemon
 
 execute: |
     # to accommodate different distros, we pick the LSB required 'daemon' user
diff -Nru snapd-2.45.1+20.04.2/tests/main/system-usernames-illegal/task.yaml snapd-2.48.3+20.04/tests/main/system-usernames-illegal/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/system-usernames-illegal/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/system-usernames-illegal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,7 +3,7 @@
 # List of expected snap install failures due to libseccomp/golang-seccomp being
 # too old. Since the illegal name check happens after verifying system support,
 # we can ignore these.
-systems: [-amazon-linux-2-*, -centos-7-*, -debian-9-*, -fedora-29-*, -fedora-30-*, -opensuse-15.0-*, -opensuse-15.1-*, -ubuntu-14.04-*]
+systems: [-amazon-linux-2-*, -centos-7-*, -debian-9-*, -fedora-29-*, -fedora-30-*, -opensuse-15.2-*, -opensuse-15.1-*, -ubuntu-14.04-*]
 
 execute: |
     #shellcheck source=tests/lib/snaps.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/system-usernames-install-twice/task.yaml snapd-2.48.3+20.04/tests/main/system-usernames-install-twice/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/system-usernames-install-twice/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/system-usernames-install-twice/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,7 +4,7 @@
 # too old. Since the illegal name check happens after verifying system support,
 # we can ignore these. Ignore ubuntu-core since groupdel doesn't support
 # --extrausers
-systems: [-amazon-linux-2-*, -centos-7-*, -debian-9-*, -fedora-29-*, -fedora-30-*, -opensuse-15.0-*, -opensuse-15.1-*, -ubuntu-14.04-*, -ubuntu-core-*]
+systems: [-amazon-linux-2-*, -centos-7-*, -debian-9-*, -fedora-29-*, -fedora-30-*, -opensuse-15.2-*, -opensuse-15.1-*, -ubuntu-14.04-*, -ubuntu-core-*]
 
 prepare: |
     snap install --edge test-snapd-daemon-user
@@ -14,7 +14,7 @@
 
     # snapd will create this for us, but we'll remove it for consistency in
     # test runs
-    user-tool remove-with-group snap_daemon
+    "$TESTSTOOLS"/user-state remove-with-group snap_daemon
 
 execute: |
     echo "When the snap is removed"
diff -Nru snapd-2.45.1+20.04.2/tests/main/system-usernames-missing-user/task.yaml snapd-2.48.3+20.04/tests/main/system-usernames-missing-user/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/system-usernames-missing-user/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/system-usernames-missing-user/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,7 +4,7 @@
 # too old. Since the illegal name check happens after verifying system support,
 # we can ignore these. Ignore ubuntu-core since groupdel doesn't support
 # --extrausers
-systems: [-amazon-linux-2-*, -centos-7-*, -debian-9-*, -fedora-29-*, -fedora-30-*, -opensuse-15.0-*, -opensuse-15.1-*, -ubuntu-14.04-*, -ubuntu-core-*]
+systems: [-amazon-linux-2-*, -centos-7-*, -debian-9-*, -fedora-29-*, -fedora-30-*, -opensuse-15.2-*, -opensuse-15.1-*, -ubuntu-14.04-*, -ubuntu-core-*]
 
 prepare: |
     groupadd --system snap_daemon
diff -Nru snapd-2.45.1+20.04.2/tests/main/try/task.yaml snapd-2.48.3+20.04/tests/main/try/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/try/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/try/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,25 +1,22 @@
 summary: Check that try command works
 
 # s390x does not have /dev/kmsg
-systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -ubuntu-*-s390x, -centos-*]
+# ubuntu-14.04: systemd-run not supported
+systems: [-ubuntu-core-*, -fedora-*, -opensuse-*, -arch-*, -ubuntu-*-s390x, -centos-*, -ubuntu-14.04*]
 
 environment:
     PORT: 8081
-    SERVICE_FILE: "./service.sh"
     READABLE_FILE: "/var/snap/test-snapd-tools/x1/file.txt"
     SERVICE_NAME: "test-service"
 
 prepare: |
     # shellcheck source=tests/lib/network.sh
     . "$TESTSLIB"/network.sh
-    make_network_service "$SERVICE_NAME" "$SERVICE_FILE" "$PORT"
+    make_network_service "$SERVICE_NAME" "$PORT"
 
 restore: |
-    #shellcheck source=tests/lib/systemd.sh
-    . "$TESTSLIB"/systemd.sh
-    #shellcheck disable=SC2153
-    systemd_stop_and_destroy_unit "$SERVICE_NAME"
-    rm -f "$SERVICE_FILE" "$READABLE_FILE"
+    systemctl stop "$SERVICE_NAME"
+    rm -f "$READABLE_FILE"
 
 execute: |
     echo "Given a buildable snap in a known directory"
diff -Nru snapd-2.45.1+20.04.2/tests/main/uc20-create-partitions/task.yaml snapd-2.48.3+20.04/tests/main/uc20-create-partitions/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/uc20-create-partitions/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/uc20-create-partitions/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,14 @@
-summary: Integration tests for the snap-bootstrap create-partitions
+summary: Integration tests for the bootstrap.Run
 
 # use the same system and tooling as uc20
 systems: [ubuntu-20.04-64]
 
+environment:
+    # an empty $topsrcdir/tests/go.mod seems to break importing or building go
+    # packages referenced by their import paths while under the tests directory,
+    # need to disable go modules support for this test
+    GO111MODULE: off
+
 debug: |
     cat /proc/partitions
 
@@ -12,6 +18,7 @@
         losetup -d "$LOOP"
         umount "${LOOP}p3"
         umount "${LOOP}p4"
+        umount "${LOOP}p5"
     fi
 
 prepare: |
@@ -30,6 +37,7 @@
     start=2048, size=2048, type=21686148-6449-6E6F-744E-656564454649, name="BIOS Boot"
     start=4096, size=2457600, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, name="ubuntu-seed"
     EOF
+    retry -n 3 --wait 1 test -e "${LOOP}p2"
     udevadm trigger --settle "${LOOP}p2"
     mkfs.vfat "${LOOP}p2"
     udevadm trigger --settle "${LOOP}p2"
@@ -45,23 +53,20 @@
     LOOP="$(cat loop.txt)"
 
     echo "Run the snap-bootstrap tool"
-    /usr/lib/snapd/snap-bootstrap create-partitions ./gadget-dir "$LOOP"
+    go get ../../lib/uc20-create-partitions
+    uc20-create-partitions ./gadget-dir "$LOOP"
 
     echo "And check that the partitions are created"
     sfdisk -l "$LOOP" | MATCH '750M Linux filesystem'
     sfdisk -l "$LOOP" | MATCH '16.7G Linux filesystem'
     file -s "${LOOP}p3" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-boot"'
-    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
-
-    echo "Check if attribute bits were set for new partitions"
-    sfdisk -d "$LOOP" | not MATCH "${LOOP}p1.*attrs=\"GUID:59\""
-    sfdisk -d "$LOOP" | not MATCH "${LOOP}p2.*attrs=\"GUID:59\""
-    sfdisk -d "$LOOP" | MATCH "${LOOP}p3.*attrs=\"GUID:59\""
-    sfdisk -d "$LOOP" | MATCH "${LOOP}p4.*attrs=\"GUID:59\""
+    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-save"'
+    file -s "${LOOP}p5" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
 
     echo "Check that the filesystems were not auto-mounted"
     mount | not MATCH /run/mnt/ubuntu-seed
     mount | not MATCH /run/mnt/ubuntu-boot
+    mount | not MATCH /run/mnt/ubuntu-save
     mount | not MATCH /run/mnt/ubuntu-data
 
     # we used "lsblk --fs" here but it was unreliable
@@ -82,11 +87,19 @@
     mount "${LOOP}p4" ./mnt
     df -T "${LOOP}p4" | MATCH ext4
     umount ./mnt
-    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
+    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-save"'
     # check metadata_csum
-    tune2fs -l "${LOOP}p3" | MATCH '^Filesystem features:.*metadata_csum'
+    tune2fs -l "${LOOP}p4" | MATCH '^Filesystem features:.*metadata_csum'
+
+    mkdir -p ./mnt
+    mount "${LOOP}p5" ./mnt
+    df -T "${LOOP}p5" | MATCH ext4
+    umount ./mnt
+    file -s "${LOOP}p5" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
+    # check metadata_csum
+    tune2fs -l "${LOOP}p5" | MATCH '^Filesystem features:.*metadata_csum'
     # size is reported in 512 blocks
-    sz="$(udevadm info -q property "${LOOP}p4" |grep "^ID_PART_ENTRY_SIZE=" | cut -f2 -d=)"
+    sz="$(udevadm info -q property "${LOOP}p5" |grep "^ID_PART_ENTRY_SIZE=" | cut -f2 -d=)"
     # the disk size is 20GB, 1GB in 512 blocks is 2097152, with auto grow, the
     # partition can be safely assumed to be > 10GB
     if [ "$sz" -lt "$((10 * 2097152))" ]; then
@@ -99,7 +112,6 @@
     mount "${LOOP}p3" ./mnt
     ls ./mnt/EFI/boot/grubx64.efi
     ls ./mnt/EFI/boot/bootx64.efi
-    ls ./mnt/EFI/ubuntu/grub.cfg
     # remove a file
     rm ./mnt/EFI/boot/grubx64.efi
     umount ./mnt
@@ -112,21 +124,23 @@
             filesystem-label: other-ext4
             size: 110M
     EOF
-    /usr/lib/snapd/snap-bootstrap create-partitions --mount ./gadget-dir "$LOOP"
+    uc20-create-partitions --mount ./gadget-dir "$LOOP"
     sfdisk -l "$LOOP" | MATCH "${LOOP}p1 .* 1M\s* BIOS boot"
     sfdisk -l "$LOOP" | MATCH "${LOOP}p2 .* 1.2G\s* EFI System"
     sfdisk -l "$LOOP" | MATCH "${LOOP}p3 .* 750M\s* Linux filesystem"
-    sfdisk -l "$LOOP" | MATCH "${LOOP}p4 .* 1G\s* Linux filesystem"
-    sfdisk -l "$LOOP" | MATCH "${LOOP}p5 .* 110M\s* Linux filesystem"
+    sfdisk -l "$LOOP" | MATCH "${LOOP}p4 .* 16M\s* Linux filesystem"
+    sfdisk -l "$LOOP" | MATCH "${LOOP}p5 .* 1G\s* Linux filesystem"
+    sfdisk -l "$LOOP" | MATCH "${LOOP}p6 .* 110M\s* Linux filesystem"
 
     echo "check that the filesystems are created and mounted"
     mount
 
     mount | MATCH /run/mnt/ubuntu-boot
+    mount | MATCH /run/mnt/ubuntu-save
     mount | MATCH /run/mnt/ubuntu-data
     mount | MATCH /run/mnt/other-ext4
-    df -T "${LOOP}p5" | MATCH ext4
-    file -s "${LOOP}p5" | MATCH 'volume name "other-ext4"'
+    df -T "${LOOP}p6" | MATCH ext4
+    file -s "${LOOP}p6" | MATCH 'volume name "other-ext4"'
     umount /run/mnt/other-ext4
 
     echo "Make sure the filesystem was redeployed"
diff -Nru snapd-2.45.1+20.04.2/tests/main/uc20-create-partitions-encrypt/task.yaml snapd-2.48.3+20.04/tests/main/uc20-create-partitions-encrypt/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/uc20-create-partitions-encrypt/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/uc20-create-partitions-encrypt/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,143 @@
+summary: Integration tests for the snap-bootstrap binary
+
+# use the same system and tooling as uc20
+systems: [ubuntu-20.04-64]
+
+environment:
+    # an empty $topsrcdir/tests/go.mod seems to break importing or building go
+    # packages referenced by their import paths while under the tests directory,
+    # need to disable go modules support for this test
+    GO111MODULE: off
+
+debug: |
+    cat /proc/partitions
+
+restore: |
+    if [[ -d ./mnt ]]; then
+        umount ./mnt || true
+    fi
+    umount /run/mnt/ubuntu-seed || true
+    umount /dev/mapper/ubuntu-save || true
+    umount /dev/mapper/ubuntu-data || true
+    umount /dev/mapper/test-udata || true
+
+    cryptsetup close /dev/mapper/ubuntu-save || true
+    cryptsetup close /dev/mapper/ubuntu-data || true
+    cryptsetup close /dev/mapper/test-udata || true
+
+    if [ -f loop.txt ]; then
+        losetup -d "$(cat loop.txt)"
+    fi
+    apt autoremove -y cryptsetup
+
+    rm -Rf /run/mnt
+
+prepare: |
+    echo "Create a fake block device image that looks like an image from u-i"
+    truncate --size=10GB fake.img
+
+    apt install -y cryptsetup
+
+    echo "Setup the image as a block device"
+    # use a script here as this code needs to be run on the next boot
+    cat > losetup.sh <<'EOF'
+    #!/bin/sh -e
+    echo "Setting up loop"
+    losetup -fP fake.img
+    losetup -a |grep fake.img|cut -f1 -d: > loop.txt
+    EOF
+    chmod +x ./losetup.sh
+    ./losetup.sh
+    LOOP="$(cat loop.txt)"
+
+    echo "Create a partition that looks like a uc20 image"
+    cat <<EOF | sfdisk "$LOOP"
+    label: gpt
+
+    start=2048, size=2048, type=21686148-6449-6E6F-744E-656564454649, name="BIOS Boot"
+    start=4096, size=2457600, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, name="ubuntu-seed"
+    EOF
+    retry -n 3 --wait 1 test -e "${LOOP}p2"
+    udevadm trigger --settle "${LOOP}p2"
+    mkfs.vfat "${LOOP}p2"
+    udevadm trigger --settle "${LOOP}p2"
+    echo "Double check that we got the expected partitions"
+    sfdisk -l "$LOOP" | MATCH 'BIOS boot'
+    sfdisk -l "$LOOP" | MATCH 'EFI System'
+
+    echo "Get the UC20 gadget"
+    snap download --channel=20/edge pc
+    unsquashfs -d gadget-dir pc_*.snap
+
+execute: |
+    # this test simulates a reinstall, to clear the TPM this requires
+    # a reboot so the losetup has to be redone
+    if [ "$SPREAD_REBOOT" = 1 ]; then
+        ./losetup.sh
+    fi
+    LOOP="$(cat loop.txt)"
+
+    echo "Setup simulated ubuntu-seed mount"
+    mkdir -p /run/mnt/ubuntu-seed
+    mount "${LOOP}"p2 /run/mnt/ubuntu-seed
+
+    echo "Install EFI binaries"
+    bootdir=/run/mnt/ubuntu-boot/EFI/boot
+    seedbootdir=/run/mnt/ubuntu-seed/EFI/boot
+    mkdir -p "$bootdir" "$seedbootdir"
+    cp /usr/lib/shim/shimx64.efi.signed "$seedbootdir"/bootx64.efi
+    cp /usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed "$seedbootdir"/grubx64.efi
+    cp /usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed "$bootdir"/grubx64.efi
+
+    sbverify --list "$seedbootdir"/bootx64.efi
+    sbverify --list "$seedbootdir"/grubx64.efi
+    sbverify --list "$bootdir"/grubx64.efi
+
+    echo "Run the snap-bootstrap tool"
+    go get ../../lib/uc20-create-partitions
+    uc20-create-partitions \
+        --encrypt \
+        ./gadget-dir "$LOOP"
+    # keep for later
+
+    echo "Check that the key file was created"
+    test "$(stat --printf=%s unsealed-key)" -eq 64
+    # recovery key is 16 bytes long
+    test "$(stat --printf=%s recovery-key)" -eq 16
+
+    echo "Check that the partitions are created"
+    sfdisk -d "$LOOP" | MATCH "^${LOOP}p1 .*size=\s*2048, type=21686148-6449-6E6F-744E-656564454649,.*BIOS Boot"
+    sfdisk -d "$LOOP" | MATCH "^${LOOP}p2 .*size=\s*2457600, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B,.*ubuntu-seed"
+    sfdisk -d "$LOOP" | MATCH "^${LOOP}p3 .*size=\s*1536000, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4,.*ubuntu-boot"
+    sfdisk -d "$LOOP" | MATCH "^${LOOP}p4 .*size=\s*32768, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4,.*ubuntu-save"
+    sfdisk -d "$LOOP" | MATCH "^${LOOP}p5 .*size=\s*15500753, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4,.*ubuntu-data"
+
+    not cryptsetup isLuks "${LOOP}p1"
+    not cryptsetup isLuks "${LOOP}p2"
+    not cryptsetup isLuks "${LOOP}p3"
+    cryptsetup isLuks "${LOOP}p4"
+    cryptsetup isLuks "${LOOP}p5"
+
+    cryptsetup luksDump "${LOOP}p4" | MATCH 'Label:\s*ubuntu-save-enc'
+    POSIXLY_CORRECT=1 file -s /dev/mapper/ubuntu-save | MATCH 'volume name "ubuntu-save"'
+
+    cryptsetup luksDump "${LOOP}p5" | MATCH 'Label:\s*ubuntu-data-enc'
+    POSIXLY_CORRECT=1 file -s /dev/mapper/ubuntu-data | MATCH 'volume name "ubuntu-data"'
+
+    cryptsetup close /dev/mapper/ubuntu-data
+
+    mkdir -p ./mnt
+
+    # Test the unsealed key
+    echo "Ensure that we can open the encrypted device using the unsealed key"
+    cryptsetup open --key-file unsealed-key "${LOOP}p5" test
+    mount /dev/mapper/test ./mnt
+    umount ./mnt
+    cryptsetup close /dev/mapper/test
+
+    # Test the recovery key
+    echo "Ensure that we can open the encrypted device using the recovery key"
+    cryptsetup open --key-file recovery-key "${LOOP}p5" test-recovery
+    mount /dev/mapper/test-recovery ./mnt
+    umount ./mnt
+    cryptsetup close /dev/mapper/test-recovery
diff -Nru snapd-2.45.1+20.04.2/tests/main/uc20-create-partitions-reinstall/task.yaml snapd-2.48.3+20.04/tests/main/uc20-create-partitions-reinstall/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/uc20-create-partitions-reinstall/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/uc20-create-partitions-reinstall/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,14 @@
-summary: Integration tests for the snap-bootstrap binary autodetect
+summary: Integration tests for the bootstrap.Run autodetect
 
 # use the same system and tooling as uc20
 systems: [ubuntu-20.04-64]
 
+environment:
+    # an empty $topsrcdir/tests/go.mod seems to break importing or building go
+    # packages referenced by their import paths while under the tests directory,
+    # need to disable go modules support for this test
+    GO111MODULE: off
+
 debug: |
     cat /proc/partitions
 
@@ -10,6 +16,10 @@
     if [ -f loop.txt ]; then
         losetup -d "$(cat loop.txt)"
     fi
+    umount ./ubuntu-seed || true
+    umount ./ubuntu-boot || true
+    umount ./ubuntu-save || true
+    umount ./ubuntu-data || true
 
 prepare: |
     echo "Create a fake block device image that looks like an image from u-i"
@@ -27,6 +37,7 @@
     start=2048, size=2048, type=21686148-6449-6E6F-744E-656564454649, name="BIOS Boot"
     start=4096, size=2457600, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, name="ubuntu-seed"
     EOF
+    retry -n 3 --wait 1 test -e "${LOOP}p2"
     udevadm trigger --settle "${LOOP}p2"
     mkfs.vfat "${LOOP}p2"
     udevadm trigger --settle "${LOOP}p2"
@@ -45,27 +56,47 @@
     udevadm info --query=property "${LOOP}p2" | grep ID_FS_TYPE ||:
 
     echo "Run the snap-bootstrap tool in auto-detect mode"
-    /usr/lib/snapd/snap-bootstrap create-partitions ./gadget-dir
+    go get ../../lib/uc20-create-partitions
+    uc20-create-partitions ./gadget-dir
 
     echo "And check that the partitions are created"
     sfdisk -l "$LOOP" | MATCH '750M Linux filesystem'
     sfdisk -l "$LOOP" | MATCH '16\.7G Linux filesystem'
     file -s "${LOOP}p3" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-boot"'
-    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
+    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-save"'
+    file -s "${LOOP}p5" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
 
-    echo "Check if attribute bits were set for new partitions"
-    sfdisk -d "$LOOP" | not MATCH "${LOOP}p1.*attrs=\"GUID:59\""
-    sfdisk -d "$LOOP" | not MATCH "${LOOP}p2.*attrs=\"GUID:59\""
-    sfdisk -d "$LOOP" | MATCH "${LOOP}p3.*attrs=\"GUID:59\""
-    sfdisk -d "$LOOP" | MATCH "${LOOP}p4.*attrs=\"GUID:59\""
+    echo "Create canary files on the ubuntu-{seed,boot,data} partitions"
+    mkdir ./ubuntu-seed ./ubuntu-boot ./ubuntu-save ./ubuntu-data
+    mount "${LOOP}p2" ./ubuntu-seed
+    mount "${LOOP}p3" ./ubuntu-boot
+    mount "${LOOP}p4" ./ubuntu-save
+    mount "${LOOP}p5" ./ubuntu-data
+    for label in ubuntu-seed ubuntu-boot ubuntu-save ubuntu-data; do
+        echo "$label" > ./"$label"/canary.txt
+        umount ./"$label"
+    done
 
     # re-create partitions on a new install attempt
     echo "Run the snap-bootstrap again"
-    /usr/lib/snapd/snap-bootstrap create-partitions ./gadget-dir
+    uc20-create-partitions ./gadget-dir
 
     echo "And check that the partitions are there"
     sfdisk -l "$LOOP" | MATCH '750M Linux filesystem'
     sfdisk -l "$LOOP" | MATCH '16\.7G Linux filesystem'
-    sfdisk -l "$LOOP" | not MATCH "${LOOP}p[56789]"
+    sfdisk -l "$LOOP" | NOMATCH "${LOOP}p[6789]"
     file -s "${LOOP}p3" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-boot"'
-    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
+    file -s "${LOOP}p4" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-save"'
+    file -s "${LOOP}p5" | MATCH 'ext4 filesystem data,.* volume name "ubuntu-data"'
+
+    echo "Mount partitions again"
+    mount "${LOOP}p2" ./ubuntu-seed
+    mount "${LOOP}p3" ./ubuntu-boot
+    mount "${LOOP}p4" ./ubuntu-save
+    mount "${LOOP}p5" ./ubuntu-data
+    echo "The ubuntu-seed partition is still there untouched"
+    test -e ./ubuntu-seed/canary.txt
+    echo "But ubuntu-{boot,save,data} got re-created"
+    not test -e ./ubuntu-boot/canary.txt
+    not test -e ./ubuntu-save/canary.txt
+    not test -e ./ubuntu-data/canary.txt
diff -Nru snapd-2.45.1+20.04.2/tests/main/umask/task.yaml snapd-2.48.3+20.04/tests/main/umask/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/umask/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/umask/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,9 +3,7 @@
     The setting of umask is inherited across the snap-{run,confine,exec} chain
     but does not hinder execution of snap-confine itself.
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 restore: |
     snap remove test-snapd-sh
     rm -rf ~/snap
diff -Nru snapd-2.45.1+20.04.2/tests/main/upgrade-from-2.15/task.yaml snapd-2.48.3+20.04/tests/main/upgrade-from-2.15/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/upgrade-from-2.15/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/upgrade-from-2.15/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,7 +3,7 @@
 systems: [ubuntu-16.04-64]
 
 prepare: |
-    apt-tool checkpoint > installed.pkgs
+    "$TESTSTOOLS"/apt-state checkpoint > installed.pkgs
     #shellcheck source=tests/lib/pkgdb.sh
     . "$TESTSLIB/pkgdb.sh"
     distro_purge_package snapd
@@ -17,9 +17,15 @@
     fi
     distro_install_build_snapd
 
-    apt-tool restore installed.pkgs
+    "$TESTSTOOLS"/apt-state restore installed.pkgs
     rm -f installed.pkgs
 
+    # snap-confine, in the old version of snapd, leaves behind junk in
+    # /tmp/snap.rootfs_* This is now detected by invariant detector, which uses
+    # it as a sign of possible snap-confine crash. To avoid the false positive,
+    # remove those leftovers.
+    rm -rf /tmp/snap.rootfs_*
+
 execute: |
     #shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB"/systemd.sh
diff -Nru snapd-2.45.1+20.04.2/tests/main/user-mounts/task.yaml snapd-2.48.3+20.04/tests/main/user-mounts/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/user-mounts/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/user-mounts/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,45 +9,34 @@
 # This test makes use of the user mount provided by the desktop
 # interface.  When we have an interface providing user mounts that is
 # available on core, we can switch to that.
-systems: [-ubuntu-core-*]
+# TODO: expand coverage to 14.04 with improved tests.session.
+systems:
+    - -ubuntu-core-*   # see above
+    - -ubuntu-14.04-*  # no tests.session
 
 prepare: |
-    snap try "$TESTSLIB"/snaps/test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
     snap disconnect test-snapd-desktop:desktop
 
+    tests.session -u test prepare
 restore: |
-    rm -rf /run/user/12345/*
-    rm -f /tmp/check-user-mount.sh
+    tests.session -u test restore
 
 execute: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB"/dirs.sh
-
-    echo "Create XDG_RUNTIME_DIR for test user"
-    USER_RUNTIME_DIR=/run/user/"$(id -u test)"
-    mkdir -p "$USER_RUNTIME_DIR" || true
-    #shellcheck disable=SC2115
-    rm -rf "$USER_RUNTIME_DIR"/*
-    chmod u=rwX,go= "$USER_RUNTIME_DIR"
-    chown test:test "$USER_RUNTIME_DIR"
-
     echo "Without desktop interface connected, there is no user-fstab file"
-    [ ! -f /var/lib/snapd/mount/snap.test-snapd-desktop.user-fstab ]
+    test ! -e /var/lib/snapd/mount/snap.test-snapd-desktop.user-fstab
 
     echo "With desktop interface connected, it is created"
     snap connect test-snapd-desktop:desktop
-    [ -f /var/lib/snapd/mount/snap.test-snapd-desktop.user-fstab ]
+    test -f /var/lib/snapd/mount/snap.test-snapd-desktop.user-fstab
     diff -u /var/lib/snapd/mount/snap.test-snapd-desktop.user-fstab - << \EOF
     $XDG_RUNTIME_DIR/doc/by-app/snap.test-snapd-desktop $XDG_RUNTIME_DIR/doc none bind,rw,x-snapd.ignore-missing 0 0
     EOF
 
-    "$LIBEXECDIR"/snapd/snap-discard-ns test-snapd-sh
+    snapd.tool exec snap-discard-ns test-snapd-sh
 
     echo "The user-fstab file is used to prepare the confinement sandbox"
-    cat << \EOF > /tmp/check-user-mount.sh
-    mkdir -p /run/user/12345/doc/by-app/snap.test-snapd-desktop
-    touch /run/user/12345/doc/by-app/snap.test-snapd-desktop/in-source
-    touch /run/user/12345/doc/in-target
-    test-snapd-desktop.check-dirs /run/user/12345/doc
-    EOF
-    su -l -c "sh /tmp/check-user-mount.sh" test | MATCH in-source
+    tests.session -u test exec mkdir -p /run/user/12345/doc/by-app/snap.test-snapd-desktop
+    tests.session -u test exec touch /run/user/12345/doc/by-app/snap.test-snapd-desktop/in-source
+    tests.session -u test exec touch /run/user/12345/doc/in-target
+    tests.session -u test exec test-snapd-desktop.check-dirs /run/user/12345/doc | MATCH in-source
diff -Nru snapd-2.45.1+20.04.2/tests/main/user-session-env/task.yaml snapd-2.48.3+20.04/tests/main/user-session-env/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/user-session-env/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/user-session-env/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,75 +7,48 @@
     inside the user session, no matter the shell they use.
 
 systems:
-   # cannot install zsh
-   - -ubuntu-core-*
+   - -ubuntu-core-*  # cannot install zsh
+   - -ubuntu-14.04-* # cannot use systemd
 
 environment:
     TEST_ZSH_USER: test-zsh
 
 prepare: |
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
-
-    echo "create a user with a different shell"
+    echo "Create a user with a different shell"
     useradd --create-home --user-group -s /bin/zsh "$TEST_ZSH_USER"
-
-    if ! has_user_session_support; then
-        echo "NOTE: no user session support, skipping session setup"
-        exit 0
-    fi
-
-    touch ./has-sessions
-
-    # setup for systems supporting user sessions
-    for uid in $(id -u test) $(id -u "$TEST_ZSH_USER"); do
-        mkdir -p "/run/user/$uid"
-        chown -R "$uid:$uid" "/run/user/$uid"
-        systemctl start "user@$uid.service"
-    done
+    tests.session prepare -u test,test-zsh
 
 restore: |
-    if [ -e has-sessions ]; then
-        for uid in $(id -u test) $(id -u "$TEST_ZSH_USER"); do
-            systemctl stop "user@$uid.service"
-            # The user-runtime-dir@.service unit did not exist before
-            # Systemd 239, so ignore errors.
-            systemctl stop "user-runtime-dir@$uid.service" || true
-        done
-    fi
-    rm -f ./has-sessions
-
+    tests.session restore -u test,test-zsh
     userdel -f -r "$TEST_ZSH_USER"
-
     rm -f test-profile-env test-profile-zsh-env test-session-env test-zsh-session-env
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB/dirs.sh"
-    #shellcheck source=tests/lib/user.sh
-    . "$TESTSLIB/user.sh"
 
     for user in test "$TEST_ZSH_USER"; do
-        if [ -e ./has-sessions ]; then
-            uid=$(id -u "$user")
-            # dump the environment set up by the user session manager
-            as_given_user "$user" "XDG_RUNTIME_DIR=/run/user/$uid systemctl --user show-environment" > "${user}-session-env"
+        # Dump the environment set up by the user session manager
+        if tests.session has-session-systemd-and-dbus; then
+            tests.session -u "$user" exec systemctl --user show-environment > "${user}-session-env"
         fi
-        as_given_user "$user" "env" > "${user}-profile-env"
+        tests.session -u "$user" exec env > "${user}-profile-env"
     done
 
     for user in test "$TEST_ZSH_USER"; do
-        # even though there's user session support, systemd may be too old and
-        # not support user-environment-generators (specifically systemd versions
-        # earlier than 233)
-        if [ -e ./has-sessions ] && [ -d /usr/lib/systemd/user-environment-generators ]; then
-            MATCH 'XDG_DATA_DIRS=.*[:]?/var/lib/snapd/desktop[:]?.*' < "${user}-session-env"
-            MATCH "PATH=.*[:]?${SNAP_MOUNT_DIR}/bin[:]?.*" < "${user}-session-env"
+        if [ -e "${user}-session-env" ]; then
+            # Even though there's user session support, systemd may be too old and
+            # not support user-environment-generators (specifically systemd versions
+            # earlier than 233).
+            if [ -d /usr/lib/systemd/user-environment-generators ]; then
+                MATCH 'XDG_DATA_DIRS=.*[:]?/var/lib/snapd/desktop[:]?.*' < "${user}-session-env"
+                MATCH "PATH=.*[:]?${SNAP_MOUNT_DIR}/bin[:]?.*" < "${user}-session-env"
+            fi
         fi
-        # profile should also be correctly set up
+        # Profile should also be correctly set up
         case "$user:$SPREAD_SYSTEM" in
             test-zsh:ubuntu-*|test-zsh:debian-*)
-                # due to https://bugs.launchpad.net/ubuntu/+source/zsh/+bug/1640514
+                # Due to https://bugs.launchpad.net/ubuntu/+source/zsh/+bug/1640514
                 not MATCH 'XDG_DATA_DIRS=.*[:]?/var/lib/snapd/desktop[:]?.*' < "${user}-profile-env"
                 not MATCH "PATH=.*[:]?${SNAP_MOUNT_DIR}/bin[:]?.*" < "${user}-profile-env"
                 ;;
diff -Nru snapd-2.45.1+20.04.2/tests/main/validate-container-failures/task.yaml snapd-2.48.3+20.04/tests/main/validate-container-failures/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/validate-container-failures/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/validate-container-failures/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,18 +15,15 @@
     chmod 0644 "$p/meta/hooks/what"
 
 execute: |
-    # shellcheck source=tests/lib/journalctl.sh
-    . "$TESTSLIB/journalctl.sh"
-
     echo "Snap refuses to install"
     not snap try "$TESTSLIB/snaps/$SNAP" 2>error.log
     echo "The error tells you to ask the dev"
     tr -s '\n ' ' ' < error.log | MATCH 'contact developer'
 
     echo "And the journal counts the ways"
-    check_journalctl_log '"comp.sh" should be world-readable' -u snapd
-    check_journalctl_log '"bin/bar" should be executable' -u snapd
-    check_journalctl_log '"bin/foo" should be world-readable and executable' -u snapd
-    check_journalctl_log '"meta/unreadable" should be world-readable' -u snapd
-    check_journalctl_log '"meta/hooks/what" should be executable' -u snapd
-    check_journalctl_log '"bin/stahp" does not exist' -u snapd
+    "$TESTSTOOLS"/journal-state match-log '"comp.sh" should be world-readable' -u snapd
+    "$TESTSTOOLS"/journal-state match-log '"bin/bar" should be executable' -u snapd
+    "$TESTSTOOLS"/journal-state match-log '"bin/foo" should be world-readable and executable' -u snapd
+    "$TESTSTOOLS"/journal-state match-log '"meta/unreadable" should be world-readable' -u snapd
+    "$TESTSTOOLS"/journal-state match-log '"meta/hooks/what" should be executable' -u snapd
+    "$TESTSTOOLS"/journal-state match-log '"bin/stahp" does not exist' -u snapd
diff -Nru snapd-2.45.1+20.04.2/tests/main/version-tool/task.yaml snapd-2.48.3+20.04/tests/main/version-tool/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/version-tool/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/version-tool/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,43 +0,0 @@
-summary: integration tests for version-tool
-execute: |
-    # ==
-    version-tool --strict 1 -eq 1
-    version-tool --strict 1 -eq 1.0
-    version-tool --strict 1.0 -eq 1
-    not version-tool --strict 1 -eq 2
-
-    # !=
-    not version-tool --strict 1.2 -ne  1.2
-    version-tool --strict 1 -ne 2
-    version-tool --strict 2 -ne 1
-
-    # < and <=
-    version-tool --strict 1 -lt 2
-    not version-tool --strict 2 -lt 1
-    version-tool --strict 1 -le 2
-    version-tool --strict 2 -le 2
-    not version-tool --strict 2 -le 1
-
-    # > and >=
-    version-tool --strict 2 -gt 1
-    not version-tool --strict 1 -gt 2
-    version-tool --strict 2 -ge 1
-    version-tool --strict 2 -ge 2
-    not version-tool --strict 1 -ge 2
-
-    # --verbose
-    version-tool --verbose --strict 1 -eq 2 | MATCH 'delta between 1 and 2 is: -1'
-    version-tool --verbose --strict 1 -eq 2 | MATCH 'delta -1 is inconsistent with =='
-
-    # --version
-    # NOTE: older python versions print the version string to stderr
-    version-tool --version 2>&1 | MATCH 1.0
-
-    # Strict requires all version components to be integers.
-    version-tool --strict 1.2 -eq 1.2-foo 2>&1 | MATCH 'error: version 1.2-foo is not purely numeric'
-    # Such invalid comparison also returns a distinct error code.
-    set +e
-    version-tool --strict 1.2 -eq 1.2-foo
-    error_code=$?
-    set -e
-    test "$error_code" -eq 2
diff -Nru snapd-2.45.1+20.04.2/tests/main/vitality/task.yaml snapd-2.48.3+20.04/tests/main/vitality/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/vitality/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/vitality/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,34 @@
+summary: Test that the snap vitality score works
+
+execute: |
+    echo "On install of a service the oom score is 0"
+    snap install test-snapd-go-webserver
+    systemctl show snap.test-snapd-go-webserver.webserver.service |MATCH "OOMScoreAdjust=0"
+    snap remove test-snapd-go-webserver
+
+    echo "When setting the vitality score before the snap is installed"
+    snap set core resilience.vitality-hint=test-snapd-go-webserver,unrelated-snap
+    snap install test-snapd-go-webserver
+
+    echo "then the oom score is set to 899"
+    systemctl show snap.test-snapd-go-webserver.webserver.service |MATCH "OOMScoreAdjust=-899"
+    snap remove test-snapd-go-webserver    
+
+    echo "When installing a snap without vitality-hint set"
+    snap unset core resilience.vitality-hint
+    snap install test-snapd-go-webserver
+    echo "then the oom adjust is unset"
+    systemctl show snap.test-snapd-go-webserver.webserver.service |MATCH "OOMScoreAdjust=0"
+    echo "When setting the vitality-hint of an installed snap"
+    snap set core resilience.vitality-hint=unrelated-snap,test-snapd-go-webserver
+    echo "then the score is adjusted immediately"
+    systemctl show snap.test-snapd-go-webserver.webserver.service |MATCH "OOMScoreAdjust=-898"
+
+    echo "When a service is disabled"
+    snap remove test-snapd-go-webserver
+    snap install test-snapd-go-webserver
+    systemctl is-enabled snap.test-snapd-go-webserver.webserver.service
+    snap stop --disable test-snapd-go-webserver.webserver
+    not systemctl is-enabled snap.test-snapd-go-webserver.webserver.service
+    snap set core resilience.vitality-hint=test-snapd-go-webserver
+    not systemctl is-enabled snap.test-snapd-go-webserver.webserver.service
diff -Nru snapd-2.45.1+20.04.2/tests/main/xdg-open/task.yaml snapd-2.48.3+20.04/tests/main/xdg-open/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/xdg-open/task.yaml	2020-07-07 12:11:37.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/xdg-open/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,57 +2,44 @@
 
 # Not supposed to work on Ubuntu Core systems as we don't have
 # a user session environment there
-systems: [-ubuntu-core-*]
+systems:
+    - -amazon-linux-2-*
+    - -centos-7-*
+    - -ubuntu-14.04-*
+    - -ubuntu-core-*
 
 environment:
+    # XXX: why is this here?
     DISPLAY: :0
 
-prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-desktop
-
 restore: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
-    umount -f /usr/bin/xdg-open || true
+    tests.session -u test restore
+
+    umount /usr/bin/xdg-open
     rm /usr/bin/xdg-open
     if [ -e /usr/bin/xdg-open.orig ]; then
         mv /usr/bin/xdg-open.orig /usr/bin/xdg-open
     fi
 
-execute: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
+prepare: |
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
 
-    dbus-launch > dbus.env
-    #shellcheck disable=SC2046
-    export $(xargs < dbus.env)
+    tests.session -u test prepare
 
     # wait for session to be ready
-    ping_launcher() {
-        dbus-send --session                                        \
-            --dest=io.snapcraft.Launcher                           \
-            --type=method_call                                     \
-            --print-reply                                          \
-            /                                                      \
+    tests.session -u test exec env "PATH=$PATH" retry -n 5 --wait 0.5 dbus-send \
+            --session                                         \
+            --dest=io.snapcraft.Launcher                      \
+            --type=method_call                                \
+            --print-reply                                     \
+            /                                                 \
             org.freedesktop.DBus.Peer.Ping
-    }
-    while ! ping_launcher ; do
-        sleep .5
-    done
 
     # Create a small helper which will tell us if snap passes
     # the URL correctly to the right handler
     cat << 'EOF' > /tmp/xdg-open
     #!/bin/sh
-    echo "$@" > /tmp/xdg-open-output
+    echo "$*" > /tmp/xdg-open-output
     EOF
     chmod +x /tmp/xdg-open
     if [ -e /usr/bin/xdg-open ]; then
@@ -61,25 +48,17 @@
     touch /usr/bin/xdg-open
     mount --bind /tmp/xdg-open /usr/bin/xdg-open
 
+execute: |
+    #shellcheck source=tests/lib/dirs.sh
+    . "$TESTSLIB/dirs.sh"
+
     ensure_xdg_open_output() {
         rm -f /tmp/xdg-open-output
-        export DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS
-        test-snapd-desktop.cmd /usr/bin/xdg-open "$1"
+        tests.session -u test exec test-snapd-desktop.cmd /usr/bin/xdg-open "$1"
         test -e /tmp/xdg-open-output
         test "$(head -1 /tmp/xdg-open-output)" = "$1"
     }
 
-    if is_cgroupv2 ; then
-        # we are expecting the test to fail on a cgroup v2 system
-        if ensure_xdg_open_output "http://smoke-test-cgroupv2.com" 2> stderr.log ; then
-            echo "expected failure, but none happened"
-            exit 1
-        fi
-        MATCH 'WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement' < stderr.log
-        MATCH 'cannot find snap for connection: not supported' < stderr.log
-        exit 0
-    fi
-
     # Ensure http, https, mailto, snap and help work
     ensure_xdg_open_output "https://snapcraft.io"
     ensure_xdg_open_output "http://snapcraft.io"
@@ -88,10 +67,12 @@
     ensure_xdg_open_output "help:snapcraft"
     ensure_xdg_open_output "apt:snapcraft"
     ensure_xdg_open_output "zoommtg://snapcraft.io"
+    ensure_xdg_open_output "slack://5NAPPY111/magic-login/bcaf81ee-07b1-4362-9c09-ff46bd6e1bb9"
+    ensure_xdg_open_output "msteams://snapcraft.io"
 
     # Ensure other schemes are not passed through
     rm /tmp/xdg-open-output
-    not test-snapd-desktop.cmd /usr/bin/xdg-open ftp://snapcraft.io
+    not tests.session -u test exec test-snapd-desktop.cmd /usr/bin/xdg-open ftp://snapcraft.io
     test ! -e /tmp/xdg-open-output
-    not test-snapd-desktop.cmd /usr/bin/xdg-open aabbcc
+    not tests.session -u test exec test-snapd-desktop.cmd /usr/bin/xdg-open aabbcc
     test ! -e /tmp/xdg-open-output
diff -Nru snapd-2.45.1+20.04.2/tests/main/xdg-open-compat/task.yaml snapd-2.48.3+20.04/tests/main/xdg-open-compat/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/xdg-open-compat/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/xdg-open-compat/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -15,30 +15,31 @@
     DISPLAY: :0
     XDG_OPEN_OUTPUT: /tmp/xdg-open-output
 
-prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-desktop
-
 restore: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
+    tests.session -u test restore
+
     rm -f /usr/bin/xdg-open
     rm -f "$XDG_OPEN_OUTPUT"
     dpkg -r snapd-xdg-open
     rm -f /usr/share/applications/defaults.list
     rm -f /usr/share/applications/xdg-open.desktop
 
-execute: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
+    # restore original xdg-open
+    if [ -e /usr/bin/xdg-open.orig ]; then
+        mv /usr/bin/xdg-open.orig /usr/bin/xdg-open
+    fi
+
+prepare: |
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
+
+    # make a backup of the original xdg-open
+    if [ -e /usr/bin/xdg-open ]; then
+        mv /usr/bin/xdg-open /usr/bin/xdg-open.orig
+    fi
 
     # download from LP, it is not available in the archive anymore
     wget https://launchpad.net/ubuntu/+source/snapd-xdg-open/0.0.0~16.04/+build/10503735/+files/snapd-xdg-open_0.0.0~16.04_amd64.deb
+
     # snapd breaks older version of snapd-xdg-open so we cannot
     # install them together. force things to work!
     dpkg -i --force-all snapd-xdg-open_*.deb
@@ -50,6 +51,7 @@
     x-scheme-handler/https=xdg-open.desktop
     x-scheme-handler/mailto=xdg-open.desktop
     EOF
+
     cat > /usr/share/applications/xdg-open.desktop <<EOF
     [Desktop Entry]
     Version=1.0
@@ -59,35 +61,31 @@
     MimeType=x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/mailto;
     Name=xdg-open
     EOF
-    
-    echo "Launch user dbus session"
-    dbus-launch > dbus.env
-    #shellcheck disable=SC2046
-    export $(xargs < dbus.env)
-
-    echo "Ensure snapd-xdg-open is available"
-    ping_launcher() {
-        dbus-send --session                                        \
-            --dest=com.canonical.SafeLauncher                      \
-            --type=method_call                                     \
-            --print-reply                                          \
-            /                                                      \
+
+    tests.session -u test prepare
+
+    # wait for session to be ready
+    tests.session -u test exec env "PATH=$PATH" retry -n 5 --wait 0.5 dbus-send \
+            --session                                         \
+            --dest=com.canonical.SafeLauncher                 \
+            --type=method_call                                \
+            --print-reply                                     \
+            /                                                 \
             org.freedesktop.DBus.Peer.Ping
-    }
-    while ! ping_launcher ; do
-        sleep .5
-    done
 
     # Create a small helper which will tell us if snap passes
     # the URL correctly to the right handler
     cat << 'EOF' > /usr/bin/xdg-open
     #!/bin/sh
-    echo "$@" > /tmp/xdg-open-output
+    echo "$*" > /tmp/xdg-open-output
     EOF
+
     chmod +x /usr/bin/xdg-open
 
+execute: |
     xdg_open_url() {
-        test-snapd-desktop.cmd /usr/bin/dbus-send --session \
+        tests.session -u test exec test-snapd-desktop.cmd /usr/bin/dbus-send \
+            --session                                       \
             --dest=com.canonical.SafeLauncher               \
             --type=method_call                              \
             --print-reply                                   \
@@ -97,16 +95,9 @@
     }
     ensure_xdg_open_output() {
         rm -f "$XDG_OPEN_OUTPUT"
-        export DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS
         xdg_open_url "$1"
         # xdg-open is async so we need to give it a little bit of time
-        for _ in $(seq 10); do
-            if [ -e "$XDG_OPEN_OUTPUT" ]; then
-                break
-            fi
-            sleep .5
-        done
-        test -e "$XDG_OPEN_OUTPUT"
+        retry -n 10 --wait 0.5 test -e "$XDG_OPEN_OUTPUT"
         test "$(cat "$XDG_OPEN_OUTPUT")" = "$1"
     }
 
diff -Nru snapd-2.45.1+20.04.2/tests/main/xdg-open-portal/task.yaml snapd-2.48.3+20.04/tests/main/xdg-open-portal/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/xdg-open-portal/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/xdg-open-portal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,14 +6,14 @@
   - arch-linux-*
   # Debian 9 ships xdg-desktop-portal 0.5, which seems to have trouble
   # with the test harness.  Debian 10 should be fine when we add it.
-  - debian-sid-*
+  # TODO:tests.session: port and re-enable
+  # - debian-sid-*
   - fedora-*
   # OpenSUSE 15.1 ships xdg-desktop-portal 0.10, which also seems to
   # be problematic.  OpenSUSE 15.2 will hopefully be fine.
   - opensuse-tumbleweed-*
   - ubuntu-18.04-*
-  - ubuntu-19.10-*
-  - ubuntu-20.04-*
+  - ubuntu-2*
 
 environment:
     BROWSER_HISTORY: /tmp/browser-history.txt
@@ -23,15 +23,13 @@
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     setup_portals
+    tests.session -u test prepare
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
-    install_local test-snapd-desktop
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
 
     # Configure fake web browser
-    mkdir -p ~test/.local/share/applications
-    cat << EOF > ~test/.local/share/applications/test-browser.desktop
+    tests.session -u test exec mkdir -p ~test/.local/share/applications
+    tests.session -u test exec sh -c 'cat > ~test/.local/share/applications/test-browser.desktop' << EOF
     [Desktop Entry]
     Type=Application
     Name=Test Web Browser
@@ -40,7 +38,7 @@
     EOF
 
     # Configure a fake editor
-    cat << EOF > ~test/.local/share/applications/test-editor.desktop
+    tests.session -u test exec sh -c 'cat > ~test/.local/share/applications/test-editor.desktop' << EOF
     [Desktop Entry]
     Type=Application
     Name=Test Editor
@@ -49,21 +47,21 @@
     EOF
 
     # Set up file type handlers
-    mkdir -p ~test/.config
-    cat << EOF > ~test/.config/mimeapps.list
+    tests.session -u test exec mkdir -p ~test/.config
+    tests.session -u test exec sh -c 'cat > ~test/.config/mimeapps.list' << EOF
     [Default Applications]
     x-scheme-handler/http=test-browser.desktop
     text/plain=test-editor.desktop
     EOF
 
     # Prepare test data for editor
-    commondir=~test/snap/test-snapd-desktop/common
-    testfile="$commondir/test.txt"
-    mkdir -p "$commondir"
-    echo "Hello World" > "$testfile"
-    chown -R test:test ~test/snap
+    tests.session -u test exec mkdir -p ~test/snap/test-snapd-desktop/common
+    tests.session -u test exec sh -c 'cat > ~test/snap/test-snapd-desktop/common/test.txt' << EOF
+    Hello World
+    EOF
 
 restore: |
+    tests.session -u test restore
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
     teardown_portals
@@ -77,31 +75,24 @@
 execute: |
     #shellcheck source=tests/lib/desktop-portal.sh
     . "$TESTSLIB"/desktop-portal.sh
-    #shellcheck source=tests/lib/files.sh
-    . "$TESTSLIB"/files.sh
 
     echo "Request is forwarded to the default browser"
-    as_user test-snapd-desktop.cmd xdg-open http://www.example.org
+    tests.session -u test exec test-snapd-desktop.cmd xdg-open http://www.example.org
 
     echo "The test-browser process was invoked with the URL"
-    wait_for_file "$BROWSER_HISTORY" 4 .5
+    retry -n 4 --wait 0.5 test -e "$BROWSER_HISTORY"
     MATCH http://www.example.org < "$BROWSER_HISTORY"
 
     echo "Access the file via URI handler"
-    as_user test-snapd-desktop.cmd xdg-open file:///home/test/snap/test-snapd-desktop/common/test.txt
-    wait_for_file "$EDITOR_HISTORY" 4 .5
+    tests.session -u test exec test-snapd-desktop.cmd xdg-open file:///home/test/snap/test-snapd-desktop/common/test.txt
+    retry -n 4 --wait 0.5 test -e "$EDITOR_HISTORY"
     MATCH /home/test/snap/test-snapd-desktop/common/test.txt < "$EDITOR_HISTORY"
     rm -f "$EDITOR_HISTORY"
 
     echo "Access the file directly"
-    as_user test-snapd-desktop.cmd xdg-open /home/test/snap/test-snapd-desktop/common/test.txt
-    wait_for_file "$EDITOR_HISTORY" 4 .5
+    tests.session -u test exec test-snapd-desktop.cmd xdg-open /home/test/snap/test-snapd-desktop/common/test.txt
+    retry -n 4 --wait 0.5 test -e "$EDITOR_HISTORY"
     MATCH /home/test/snap/test-snapd-desktop/common/test.txt < "$EDITOR_HISTORY"
 
 debug: |
-    #shellcheck source=tests/lib/desktop-portal.sh
-    . "$TESTSLIB"/desktop-portal.sh
-
-    ls -la "/run/user/$TEST_UID/" || true
-    #shellcheck disable=SC2009
-    ps -ef | grep xdg || true
+    ls -la /run/user/12345/ || true
diff -Nru snapd-2.45.1+20.04.2/tests/main/xdg-settings/task.yaml snapd-2.48.3+20.04/tests/main/xdg-settings/task.yaml
--- snapd-2.45.1+20.04.2/tests/main/xdg-settings/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/main/xdg-settings/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,49 +2,31 @@
 
 # Not supposed to work on Ubuntu Core systems as we don't have
 # a user session environment there
-systems: [-ubuntu-core-*]
-
-environment:
-    DISPLAY: :0
+systems:
+    - -amazon-linux-2-*  # does not support systemd --user
+    - -centos-7-*  # does not support systemd --user
+    - -ubuntu-14.04-*  # not supported as desktop OS, systemd too old for tests.session
+    - -ubuntu-core-*  # test exercises regular xdg-settings, not the custom one in ubuntu-core
 
 restore: |
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
+    tests.session -u test restore
     umount -f /usr/bin/xdg-settings || true
     umount -f /usr/bin/zenity || true
     rm -f stderr.log
 
-execute: |
-    #shellcheck source=tests/lib/pkgdb.sh
-    . "$TESTSLIB/pkgdb.sh"
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    #shellcheck source=tests/lib/systems.sh
-    . "$TESTSLIB"/systems.sh
-
-    install_local test-snapd-xdg-settings
+prepare: |
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-xdg-settings
 
-    # setup dbus
-    dbus-launch > dbus.env
-    #shellcheck disable=SC2046
-    export $(xargs < dbus.env)
+    tests.session -u test prepare
 
     # wait for session to be ready
-    ping_settings() {
-        dbus-send --session                                        \
-            --dest=io.snapcraft.Settings                           \
-            --type=method_call                                     \
-            --print-reply                                          \
-            /                                                      \
+    tests.session -u test exec env "PATH=$PATH" retry -n 5 --wait 0.5 dbus-send \
+            --session                                         \
+            --dest=io.snapcraft.Settings                      \
+            --type=method_call                                \
+            --print-reply                                     \
+            /                                                 \
             org.freedesktop.DBus.Peer.Ping
-    }
-    while ! ping_settings ; do
-        sleep .5
-    done
 
     # Create a small helper which will tell us if snap passes
     # the settings to the right handler
@@ -52,55 +34,87 @@
     #!/bin/sh
     echo "$@" > /tmp/xdg-settings-output
     EOF
+
     chmod +x /tmp/xdg-settings
     touch /usr/bin/xdg-settings
     mount --bind /tmp/xdg-settings /usr/bin/xdg-settings
 
+execute: |
+    #shellcheck source=tests/lib/systems.sh
+    . "$TESTSLIB"/systems.sh
+
     ensure_xdg_settings_output() {
         rm -f /tmp/xdg-settings-output
-        export DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS
 
         # run xdg-settings from inside the snap
-        test-snapd-xdg-settings.set-default-web-browser browser.desktop
+        tests.session -u test exec test-snapd-xdg-settings.xdg-settings-wrapper "$@"
+
+        if [ $# -eq 3 ]; then
+            # the dbus interface rewrites the final param to be <snap name>_<desktop file>
+            test_output="$1 $2 test-snapd-xdg-settings_$3"
+        elif [ $# -eq 4 ]; then
+            # the dbus interface rewrites the final param to be <snap name>_<desktop file>
+            test_output="$1 $2 $3 test-snapd-xdg-settings_$4"
+        else
+            return
+        fi
 
         # verify that the command was transmitted corrected via dbus
         test -e /tmp/xdg-settings-output
-        test "$(cat /tmp/xdg-settings-output)" = "set default-web-browser test-snapd-xdg-settings_browser.desktop"
+        test "$(cat /tmp/xdg-settings-output)" = "$test_output"
     }
 
-    # ensure zenity answers "yes"
-    touch /usr/bin/zenity
-    mount --bind /bin/true /usr/bin/zenity
+    ensure_error_no_xdg_settings_output() {
+        rm -f /tmp/xdg-settings-output
+
+        # run xdg-settings from inside the snap
+        not tests.session -u test exec test-snapd-xdg-settings.xdg-settings-wrapper "$@"
+
+        # verify that the output file doesn't exist
+        test ! -e /tmp/xdg-settings-output
+    }
 
+
+    # we are expecting the test to fail on a cgroup v2 system
     if is_cgroupv2 ; then
-        # we are expecting the test to fail on a cgroup v2 system
-        if ensure_xdg_settings_output "http://smoke-test-cgroupv2.com" 2> stderr.log ; then
-            echo "expected failure, but none happened"
-            exit 1
-        fi
+        ensure_error_no_xdg_settings_output "set" "default-web-browser" "smoke-test-cgroupv2.desktop" 2> stderr.log
         MATCH 'WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement' < stderr.log
         MATCH 'cannot find snap for connection: not supported' < stderr.log
+        # don't run further tests
         exit 0
     fi
 
+
+    # ensure zenity answers "yes"
+    touch /usr/bin/zenity
+    mount --bind /bin/true /usr/bin/zenity
+
+
+    # Test valid actions
     ensure_xdg_settings_output "set" "default-web-browser" "browser.desktop"
 
-    # Ensure settings whitelist for settings and values works
-    rm /tmp/xdg-settings-output
-    not $SNAP_MOUNT_DIR/core/current/usr/bin/xdg-settings set random-settting something
-    test ! -e /tmp/xdg-settings-output
-    not $SNAP_MOUNT_DIR/core/current/usr/bin/xdg-settings set default-web-browser inälid
-    test ! -e /tmp/xdg-settings-output
+    ensure_xdg_settings_output "set" "default-url-scheme-handler" "irc" "browser.desktop"
+
+
+    # Test unknown action
+    ensure_error_no_xdg_settings_output "unknown" 2> stderr.log
+    MATCH 'unknown action unknown' < stderr.log
+
 
+    # Ensure settings whitelist works
+    ensure_error_no_xdg_settings_output "set" "random-settting" "something" 2> stderr.log
+    MATCH 'invalid setting "random-settting"' < stderr.log
+
+
+    # Ensure settings value validation works
+    ensure_error_no_xdg_settings_output "set" "default-web-browser" "inälid" 2> stderr.log
+    MATCH 'cannot set "default-web-browser" setting to invalid value "inälid"' < stderr.log
+
+    ensure_error_no_xdg_settings_output "set" "default-url-scheme-handler" "irc" "inälid" 2> stderr.log
+    MATCH 'cannot set "default-url-scheme-handler" subproperty "irc" setting to invalid value "inälid"' < stderr.log
 
     # ensure zenity answers "no"
     umount /usr/bin/zenity
     mount --bind /bin/false /usr/bin/zenity
 
-    rm -f /tmp/xdg-settings-output
-    if test-snapd-xdg-settings.set-default-web-browser browser.desktop; then
-        echo "setting the browser should fails if zenity returns false"
-        echo "test broken"
-        exit 1
-    fi
-    test ! -e /tmp/xdg-settings-output
+    ensure_error_no_xdg_settings_output "set" "default-web-browser" "browser.desktop"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/classic/hotplug/task.yaml snapd-2.48.3+20.04/tests/nested/classic/hotplug/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/classic/hotplug/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/classic/hotplug/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,20 +4,20 @@
     #shellcheck source=tests/lib/nested.sh
     . "$TESTSLIB/nested.sh"
 
-    copy_remote "${GOHOME}"/snapd_*.deb
-    execute_remote "sudo apt update"
-    execute_remote "sudo apt install -y ./snapd_*.deb"
+    nested_copy "${GOHOME}"/snapd_*.deb
+    nested_exec "sudo apt update"
+    nested_exec "sudo apt install -y ./snapd_*.deb"
     #shellcheck disable=SC2016
-    execute_remote 'DEBIAN_FRONTEND=noninteractive sudo -E apt install -y "linux-image-extra-$(uname -r)"' || true
+    nested_exec 'DEBIAN_FRONTEND=noninteractive sudo -E apt install -y "linux-image-extra-$(uname -r)"' || true
     #shellcheck disable=SC2016
-    execute_remote 'DEBIAN_FRONTEND=noninteractive sudo -E apt install -y "linux-modules-extra-$(uname -r)"' || true
+    nested_exec 'DEBIAN_FRONTEND=noninteractive sudo -E apt install -y "linux-modules-extra-$(uname -r)"' || true
 
     snap pack "$TESTSLIB"/snaps/serial-port-hotplug
-    copy_remote serial-port-hotplug_1.0_all.snap
+    nested_copy serial-port-hotplug_1.0_all.snap
     # add test user to dialout group required for ttyUSB* devices
-    execute_remote "sudo usermod -a -G dialout user1"
+    nested_exec "sudo usermod -a -G dialout user1"
 
-    execute_remote "sudo snap install --devmode jq"
+    nested_exec "sudo snap install --devmode jq"
 
 restore: |
     rm -f /tmp/serialport{0,1}
@@ -27,10 +27,11 @@
     . "$TESTSLIB/nested.sh"
 
     set +e
-    execute_remote "snap connections --all"
-    execute_remote "snap list"
-    execute_remote "dmesg"
-    execute_remote 'sudo jq -r ".data[\"hotplug-slots\"]" /var/lib/snapd/state.json'
+    nested_exec "snap connections --all"
+    nested_exec "snap list"
+    nested_exec "dmesg"
+    nested_exec 'sudo jq -r ".data[\"hotplug-slots\"]" /var/lib/snapd/state.json'
+    set -e
 
 execute: |
     #shellcheck source=tests/lib/nested.sh
@@ -38,28 +39,28 @@
     #shellcheck source=tests/lib/hotplug.sh
     . "$TESTSLIB/hotplug.sh"
     
-    if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+    if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
         echo "USB serial already registered, exiting..."
         exit 1
     fi
 
-    execute_remote "sudo snap install hello-world"
+    nested_exec "sudo snap install hello-world"
 
     echo "Enabling hotplug"
-    execute_remote "sudo snap set core experimental.hotplug=true"
+    nested_exec "sudo snap set core experimental.hotplug=true"
 
     echo "Plugging the device"
     hotplug_add_dev1
 
     # sanity checks to make sure qemu setup is correct
     for _ in $(seq 5); do
-        if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+        if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
             break
         fi
         sleep 1
     done
 
-    execute_remote "ls /dev/tty*" | MATCH "ttyUSB0"
+    nested_exec "ls /dev/tty*" | MATCH "ttyUSB0"
 
     echo "Checking that qemuusbserial hotplug slot is present"
     check_slot_present qemuusbserial
@@ -71,13 +72,13 @@
 
     # sanity check to make sure qemu event was triggered correctly
     for _ in $(seq 5); do
-        if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+        if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
             sleep 1
         else
             break
         fi
     done
-    if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+    if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
         echo "USB serial should not be registered anymore, exiting..."
         exit 1
     fi
@@ -93,16 +94,16 @@
     check_slot_present qemuusbserial
 
     echo "Installing test snap with serial port plug"
-    execute_remote "sudo snap install --dangerous serial-port-hotplug_1.0_all.snap"
+    nested_exec "sudo snap install --dangerous serial-port-hotplug_1.0_all.snap"
 
     echo "Connecting hotplug slot of the first device"
-    execute_remote "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
+    nested_exec "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
     check_slot_connected qemuusbserial
 
     echo "Veryfing serial-port permissions of the snap"
     verify_apparmor_profile "/dev/ttyUSB0"
-    execute_remote "/snap/bin/serial-port-hotplug.consumer write-1" | MATCH "Access to /dev/ttyUSB0 ok"
-    execute_remote "/snap/bin/serial-port-hotplug.consumer write-2" | MATCH "Access to /dev/ttyUSB1 failed"
+    nested_exec "/snap/bin/serial-port-hotplug.consumer write-1" | MATCH "Access to /dev/ttyUSB0 ok"
+    nested_exec "/snap/bin/serial-port-hotplug.consumer write-2" | MATCH "Access to /dev/ttyUSB1 failed"
     MATCH "write-1 on /dev/ttyUSB0" < /tmp/serialport1
 
     echo "Unplugging the device"
@@ -138,23 +139,23 @@
     echo "Veryfing serial-port permissions of the snap, the first device is now expected on ttyUSB1"
     check_slot_device_path qemuusbserial "/dev/ttyUSB1"
     verify_apparmor_profile "/dev/ttyUSB1"
-    execute_remote "/snap/bin/serial-port-hotplug.consumer write-3" | MATCH "Access to /dev/ttyUSB0 failed"
-    execute_remote "/snap/bin/serial-port-hotplug.consumer write-4" | MATCH "Access to /dev/ttyUSB1 ok"
+    nested_exec "/snap/bin/serial-port-hotplug.consumer write-3" | MATCH "Access to /dev/ttyUSB0 failed"
+    nested_exec "/snap/bin/serial-port-hotplug.consumer write-4" | MATCH "Access to /dev/ttyUSB1 ok"
     MATCH "write-3 on /dev/ttyUSB1" < /tmp/serialport1
 
     echo "Restarting snapd should restore both hotplug slots since devices are still present"
-    execute_remote "sudo systemctl stop snapd.service snapd.socket"
-    execute_remote "sudo systemctl start snapd.service snapd.socket"
+    nested_exec "sudo systemctl stop snapd.service snapd.socket"
+    nested_exec "sudo systemctl start snapd.service snapd.socket"
     check_slot_connected qemuusbserial
     check_slot_not_gone qemuusbserial
     check_slot_present qemuusbserial-1
-    execute_remote "/snap/bin/serial-port-hotplug.consumer write-5" | MATCH "Access to /dev/ttyUSB1 ok"
+    nested_exec "/snap/bin/serial-port-hotplug.consumer write-5" | MATCH "Access to /dev/ttyUSB1 ok"
     MATCH "write-5 on /dev/ttyUSB1" < /tmp/serialport1
 
     echo "Unplugging first device while snapd is stopped and then starting snapd remembers the slot internally due to connection"
-    execute_remote "sudo systemctl stop snapd.service snapd.socket"
+    nested_exec "sudo systemctl stop snapd.service snapd.socket"
     hotplug_del_dev1
-    execute_remote "sudo systemctl start snapd.service snapd.socket"
+    nested_exec "sudo systemctl start snapd.service snapd.socket"
     check_slot_not_present qemuusbserial
     check_slot_gone qemuusbserial
 
@@ -166,7 +167,7 @@
     echo "Disconnecting first slot and then unplugging the device removes the slot completely"
     # manual snap disconnect doesn't implement retry and errors out if there are conflicting changes, so wait for hotplug changes to complete
     wait_for_all_changes
-    execute_remote "sudo snap disconnect serial-port-hotplug:serial-port :qemuusbserial"
+    nested_exec "sudo snap disconnect serial-port-hotplug:serial-port :qemuusbserial"
     check_slot_present qemuusbserial
     hotplug_del_dev1
     check_slot_not_present qemuusbserial
@@ -184,10 +185,10 @@
     check_slot_device_path qemuusbserial "/dev/ttyUSB0"
 
     echo "Connecting hotplug slot of the first device again"
-    execute_remote "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
+    nested_exec "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
     check_slot_connected qemuusbserial
 
     echo "Hotplug slot stays after removing the snap"
-    execute_remote "sudo snap remove serial-port-hotplug"
+    nested_exec "sudo snap remove serial-port-hotplug"
     check_slot_present qemuusbserial
     check_slot_not_gone qemuusbserial
diff -Nru snapd-2.45.1+20.04.2/tests/nested/classic/snapshots-with-core-refresh-revert/task.yaml snapd-2.48.3+20.04/tests/nested/classic/snapshots-with-core-refresh-revert/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/classic/snapshots-with-core-refresh-revert/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/classic/snapshots-with-core-refresh-revert/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,51 +6,51 @@
 
     # configure hosts file
     # shellcheck disable=SC2016
-    execute_remote 'echo "127.0.1.1 $HOSTNAME" | sudo tee /etc/hosts'
+    nested_exec 'echo "127.0.1.1 $HOSTNAME" | sudo tee /etc/hosts'
 
     # install snapd and snaps on nested vm
-    copy_remote "${GOHOME}"/snapd_*.deb
-    execute_remote "sudo apt update"
-    execute_remote "sudo apt install -y ./snapd_*.deb"
-    execute_remote "sudo snap install test-snapd-sh"
-    execute_remote "sudo snap install test-snapd-rsync"
+    nested_copy "${GOHOME}"/snapd_*.deb
+    nested_exec "sudo apt update"
+    nested_exec "sudo apt install -y ./snapd_*.deb"
+    nested_exec "sudo snap install test-snapd-sh"
+    nested_exec "sudo snap install test-snapd-rsync"
 
 execute: |
     #shellcheck source=tests/lib/nested.sh
     . "$TESTSLIB/nested.sh"
 
     # Make sure the core in the nested vm is the correct one
-    execute_remote "sudo snap refresh core --${CORE_CHANNEL}"
+    nested_exec "sudo snap refresh core --${NESTED_CORE_CHANNEL}"
 
     # use the snaps, so they create the dirs:
-    execute_remote "sudo test-snapd-sh.sh -c 'true'"
-    execute_remote "sudo test-snapd-rsync.rsync --version >/dev/null"
+    nested_exec "sudo test-snapd-sh.sh -c 'true'"
+    nested_exec "sudo test-snapd-rsync.rsync --version >/dev/null"
     for snap in test-snapd-sh test-snapd-rsync; do
-       execute_remote "echo "hello versioned $snap" | sudo tee /root/snap/$snap/current/canary.txt"
-       execute_remote "echo "hello common $snap" | sudo tee /root/snap/$snap/common/canary.txt"
+       nested_exec "echo "hello versioned $snap" | sudo tee /root/snap/$snap/current/canary.txt"
+       nested_exec "echo "hello common $snap" | sudo tee /root/snap/$snap/common/canary.txt"
     done
 
     # create snapshot, grab its id
-    SET_ID=$( execute_remote "sudo snap save test-snapd-sh test-snapd-rsync" | cut -d\  -f1 | tail -n1 )
+    SET_ID=$( nested_exec "sudo snap save test-snapd-sh test-snapd-rsync" | cut -d\  -f1 | tail -n1 )
 
     # delete the canary files
-    execute_remote "sudo rm /root/snap/test-snapd-sh/{current,common}/canary.txt"
-    execute_remote "sudo rm /root/snap/test-snapd-rsync/{current,common}/canary.txt"
+    nested_exec "sudo rm /root/snap/test-snapd-sh/{current,common}/canary.txt"
+    nested_exec "sudo rm /root/snap/test-snapd-rsync/{current,common}/canary.txt"
 
     # when the core is refreshed the snap snapshot can be restored"
-    execute_remote "sudo snap refresh core --${CORE_REFRESH_CHANNEL}"
-    execute_remote "sudo snap restore $SET_ID test-snapd-rsync"
-    test "$( execute_remote "sudo cat /root/snap/test-snapd-rsync/current/canary.txt" )" = "hello versioned test-snapd-rsync"
-    test "$( execute_remote "sudo cat /root/snap/test-snapd-rsync/common/canary.txt" )" = "hello common test-snapd-rsync"
-    execute_remote "sudo test ! -f /root/snap/test-snapd-sh/common/canary.txt"
-    execute_remote "sudo test ! -f /root/snap/test-snapd-sh/current/canary.txt"
+    nested_exec "sudo snap refresh core --${NESTED_CORE_REFRESH_CHANNEL}"
+    nested_exec "sudo snap restore $SET_ID test-snapd-rsync"
+    test "$( nested_exec "sudo cat /root/snap/test-snapd-rsync/current/canary.txt" )" = "hello versioned test-snapd-rsync"
+    test "$( nested_exec "sudo cat /root/snap/test-snapd-rsync/common/canary.txt" )" = "hello common test-snapd-rsync"
+    nested_exec "sudo test ! -f /root/snap/test-snapd-sh/common/canary.txt"
+    nested_exec "sudo test ! -f /root/snap/test-snapd-sh/current/canary.txt"
 
     # when the core is reverted the snap snapshot can be restored"
-    execute_remote "sudo snap revert core"
-    execute_remote "sudo snap restore $SET_ID test-snapd-sh"
-    test "$( execute_remote "sudo cat /root/snap/test-snapd-sh/current/canary.txt" )" = "hello versioned test-snapd-sh"
-    test "$( execute_remote "sudo cat /root/snap/test-snapd-sh/common/canary.txt" )" = "hello common test-snapd-sh"
+    nested_exec "sudo snap revert core"
+    nested_exec "sudo snap restore $SET_ID test-snapd-sh"
+    test "$( nested_exec "sudo cat /root/snap/test-snapd-sh/current/canary.txt" )" = "hello versioned test-snapd-sh"
+    test "$( nested_exec "sudo cat /root/snap/test-snapd-sh/common/canary.txt" )" = "hello common test-snapd-sh"
 
     echo "And the snapshot can be removed"
-    execute_remote "sudo snap forget $SET_ID"
-    execute_remote "sudo snap saved --id=$SET_ID" | MATCH "No snapshots found"
+    nested_exec "sudo snap forget $SET_ID"
+    nested_exec "sudo snap saved --id=$SET_ID" | MATCH "No snapshots found"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core/core-revert/task.yaml snapd-2.48.3+20.04/tests/nested/core/core-revert/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core/core-revert/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core/core-revert/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,7 +5,7 @@
 systems: [ubuntu-16.04-64]
 
 environment:
-    IMAGE_FILE: /tmp/work-dir/image/ubuntu-core-new.img
+    IMAGE_FILE: /tmp/work-dir/images/ubuntu-core-new.img
 
 debug: |
     systemctl stop nested-vm || true
@@ -28,32 +28,37 @@
     #shellcheck source=tests/lib/nested.sh
     . "$TESTSLIB/nested.sh"
 
-    execute_remote "snap info core" | MATCH "tracking: +latest/${CORE_CHANNEL}"
-    execute_remote "sudo snap refresh --${CORE_REFRESH_CHANNEL} core" || true
+    if [ "$NESTED_BUILD_SNAPD_FROM_CURRENT" = "true" ] || [ "$NESTED_CORE_CHANNEL" = "$NESTED_CORE_REFRESH_CHANNEL" ]; then
+        echo "This test need to start from beta/candidate/stable channel"
+        exit 0
+    fi
+
+    nested_exec "snap info core" | MATCH "tracking: +latest/${NESTED_CORE_CHANNEL}"
+    nested_exec "sudo snap refresh --${NESTED_CORE_REFRESH_CHANNEL} core" || true
 
-    if ! wait_for_ssh; then
+    if ! nested_wait_for_ssh; then
         echo "ssh not stablished, exiting..."
         exit 1
     fi
 
-    while ! execute_remote "snap changes" | MATCH "Done.*Refresh \"core\" snap from \"${CORE_REFRESH_CHANNEL}\" channel"; do
+    while ! nested_exec "snap changes" | MATCH "Done.*Refresh \"core\" snap from \"${NESTED_CORE_REFRESH_CHANNEL}\" channel"; do
         sleep 1
     done
-    execute_remote "snap info core" | MATCH "tracking: +latest/${CORE_REFRESH_CHANNEL}"
+    nested_exec "snap info core" | MATCH "tracking: +latest/${NESTED_CORE_REFRESH_CHANNEL}"
 
     # sanity check, no refresh should be done here but the command shouldn't fail
-    execute_remote "sudo snap refresh"
-    execute_remote "sudo snap revert core" || true
+    nested_exec "sudo snap refresh"
+    nested_exec "sudo snap revert core" || true
 
-    if ! wait_for_ssh; then
+    if ! nested_wait_for_ssh; then
         echo "ssh not stablished, exiting..."
         exit 1
     fi
 
-    while ! execute_remote "snap changes" | MATCH "Done.*Revert \"core\" snap"; do sleep 1 ; done
-    execute_remote "snap info core" | MATCH "tracking: +latest/${CORE_REFRESH_CHANNEL}"
-    execute_remote "ifconfig" | MATCH eth0
+    while ! nested_exec "snap changes" | MATCH "Done.*Revert \"core\" snap"; do sleep 1 ; done
+    nested_exec "snap info core" | MATCH "tracking: +latest/${NESTED_CORE_REFRESH_CHANNEL}"
+    nested_exec "ifconfig" | MATCH eth0
 
 
-    execute_remote "sudo snap refresh"
-    execute_remote "sudo cat /var/log/syslog" | not MATCH "hsearch_r failed for.* No such process"
+    nested_exec "sudo snap refresh"
+    nested_exec "sudo cat /var/log/syslog" | not MATCH "hsearch_r failed for.* No such process"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core/core-snap-refresh-on-core/task.yaml snapd-2.48.3+20.04/tests/nested/core/core-snap-refresh-on-core/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core/core-snap-refresh-on-core/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core/core-snap-refresh-on-core/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,7 +3,7 @@
 details: |
     This test checks that the core snap can be refreshed from an installed
     revision to a new one. It expects to find a new snap revision in the
-    channel pointed by the NEW_CORE_CHANNEL env var.
+    channel pointed by the NESTED_CORE_REFRESH_CHANNEL env var.
 
 systems: [ubuntu-16.04-64]
     
@@ -15,42 +15,47 @@
     #shellcheck source=tests/lib/nested.sh
     . "$TESTSLIB/nested.sh"
 
-    INITIAL_REV="$(get_nested_core_revision_for_channel "${CORE_CHANNEL}")"
-    NEW_REV="$(get_nested_core_revision_for_channel "${NEW_CORE_CHANNEL}")"
+    INITIAL_REV="$(nested_get_core_revision_for_channel "${NESTED_CORE_CHANNEL}")"
+    NEW_REV="$(nested_get_core_revision_for_channel "${NESTED_CORE_REFRESH_CHANNEL}")"
+
+    if [ "$INITIAL_REV" = "$NEW_REV" ]; then
+        echo "Initial and target revisions are the same, skipping..."
+        exit
+    fi
 
     # Install test snap
-    execute_remote "sudo snap install test-snapd-sh"
+    nested_exec "sudo snap install test-snapd-sh"
 
     # Ensure we have a good starting place
-    execute_remote "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
+    nested_exec "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
 
     # go to known good starting place
-    execute_remote "snap download core --${CORE_CHANNEL}"
-    execute_remote "sudo snap ack core_*.assert"
-    execute_remote "sudo snap install core_*.snap"
+    nested_exec "snap download core --${NESTED_CORE_CHANNEL}"
+    nested_exec "sudo snap ack core_*.assert"
+    nested_exec "sudo snap install core_*.snap"
 
     # Check the initial core is installed and snaps can be executed
     test "$(get_nested_core_revision_installed)" = "${INITIAL_REV}"
 
     # Ensure test-snapd-sh works
-    execute_remote "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
+    nested_exec "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
 
     # Refresh
-    refresh_to_new_core "$NEW_CORE_CHANNEL"
+    refresh_to_new_core "$NESTED_CORE_REFRESH_CHANNEL"
 
     # After refresh, check new core is installed  
     test "$(get_nested_core_revision_installed)" = "${NEW_REV}"
 
     # Ensure test-snapd-sh works
-    execute_remote "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
+    nested_exec "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
 
     # Revert core
-    execute_remote "sudo snap revert core" || true
-    wait_for_no_ssh
-    wait_for_ssh
+    nested_exec "sudo snap revert core" || true
+    nested_nested_wait_for_no_ssh
+    nested_nested_wait_for_ssh
 
     # After revert, check initial core is installed  
     test "$(get_nested_core_revision_installed)" = "${INITIAL_REV}"
 
     # Ensure test-snapd-sh works
-    execute_remote "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
+    nested_exec "test-snapd-sh.sh -c 'echo hello'" | MATCH hello
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core/extra-snaps-assertions/task.yaml snapd-2.48.3+20.04/tests/nested/core/extra-snaps-assertions/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core/extra-snaps-assertions/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core/extra-snaps-assertions/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,10 +7,15 @@
     . "$TESTSLIB/nested.sh"
 
     echo "Wait for first boot to be done"
-    while ! execute_remote "snap changes" | MATCH "Done.*Initialize system state"; do sleep 1; done
+    while ! nested_exec "snap changes" | MATCH "Done.*Initialize system state"; do sleep 1; done
 
     echo "We have a model assertion"
-    execute_remote "snap known model" | MATCH "series: 16"
+    nested_exec "snap known model" | MATCH "series: 16"
+
+    EXPRESSION="^core .* +latest/$NESTED_CORE_CHANNEL +canonical\\* +core"
+    if [ "$NESTED_BUILD_SNAPD_FROM_CURRENT" = "true" ]; then
+        EXPRESSION="^core .* +x1 .* core"
+    fi
 
     echo "Make sure core has an actual revision"
-    execute_remote "snap list --unicode=never" | MATCH "^core +[0-9]+\\-[0-9.]+ +[0-9]+ +latest/$CORE_CHANNEL +canonical\\* +core"
+    nested_exec "snap list --unicode=never" | MATCH "$EXPRESSION"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core/hotplug/task.yaml snapd-2.48.3+20.04/tests/nested/core/hotplug/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core/hotplug/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core/hotplug/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,13 +5,13 @@
     . "$TESTSLIB/nested.sh"
 
     snap pack "$TESTSLIB"/snaps/serial-port-hotplug
-    copy_remote serial-port-hotplug_1.0_all.snap
+    nested_copy serial-port-hotplug_1.0_all.snap
 
-    if is_core_18_nested_system; then
-        execute_remote "sudo snap install --devmode jq-core18"
-        execute_remote "sudo snap alias jq-core18.jq jq"
+    if nested_is_core_18_system; then
+        nested_exec "sudo snap install --devmode jq-core18"
+        nested_exec "sudo snap alias jq-core18.jq jq"
     else
-        execute_remote "sudo snap install --devmode jq"
+        nested_exec "sudo snap install --devmode jq"
     fi
 
 restore: |
@@ -22,10 +22,11 @@
     . "$TESTSLIB/nested.sh"
 
     set +e
-    execute_remote "snap connections --all"
-    execute_remote "snap list"
-    execute_remote "dmesg"
-    execute_remote 'sudo jq -r ".data[\"hotplug-slots\"]" /var/lib/snapd/state.json'
+    nested_exec "snap connections --all"
+    nested_exec "snap list"
+    nested_exec "dmesg"
+    nested_exec 'sudo jq -r ".data[\"hotplug-slots\"]" /var/lib/snapd/state.json'
+    set -e
 
 execute: |
     #shellcheck source=tests/lib/nested.sh
@@ -33,29 +34,31 @@
     #shellcheck source=tests/lib/hotplug.sh
     . "$TESTSLIB/hotplug.sh"
 
-    echo "Refresh core snap to desired channel"
-    refresh_to_new_core "$NEW_CORE_CHANNEL"
+    if [ "$NESTED_BUILD_SNAPD_FROM_CURRENT" != "true" ] && [ "$NESTED_CORE_REFRESH_CHANNEL" != "$NESTED_CORE_CHANNEL" ]; then
+        echo "Refresh core snap to desired channel"
+        refresh_to_new_core "$NESTED_CORE_REFRESH_CHANNEL"
+    fi
 
-    if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+    if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
         echo "USB serial already registered, exiting..."
         exit 1
     fi
 
     echo "Enabling hotplug"
-    execute_remote "sudo snap set core experimental.hotplug=true"
+    nested_exec "sudo snap set core experimental.hotplug=true"
 
     echo "Plugging the device"
     hotplug_add_dev1
 
     # sanity checks to make sure qemu setup is correct
     for _ in $(seq 5); do
-        if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+        if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
             break
         fi
         sleep 1
     done
 
-    execute_remote "ls /dev/tty*" | MATCH "ttyUSB0"
+    nested_exec "ls /dev/tty*" | MATCH "ttyUSB0"
 
     echo "Checking that qemuusbserial hotplug slot is present"
     check_slot_present qemuusbserial
@@ -67,13 +70,13 @@
 
     # sanity check to make sure qemu event was triggered correctly
     for _ in $(seq 5); do
-        if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+        if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
             sleep 1
         else
             break
         fi
     done
-    if execute_remote "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
+    if nested_exec "udevadm info -e" | MATCH "ID_MODEL=QEMU_USB_SERIAL"; then
         echo "USB serial should not be registered anymore, exiting..."
         exit 1
     fi
@@ -89,10 +92,10 @@
     check_slot_present qemuusbserial
 
     echo "Installing test snap with serial port plug"
-    execute_remote "sudo snap install --dangerous serial-port-hotplug_1.0_all.snap"
+    nested_exec "sudo snap install --dangerous serial-port-hotplug_1.0_all.snap"
 
     echo "Connecting hotplug slot of the first device"
-    execute_remote "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
+    nested_exec "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
     check_slot_connected qemuusbserial
 
     echo "Veryfing serial-port permissions of the snap"
@@ -133,16 +136,16 @@
     verify_apparmor_profile "/dev/ttyUSB1"
 
     echo "Restarting snapd should restore both hotplug slots since devices are still present"
-    execute_remote "sudo systemctl stop snapd.service snapd.socket"
-    execute_remote "sudo systemctl start snapd.service snapd.socket"
+    nested_exec "sudo systemctl stop snapd.service snapd.socket"
+    nested_exec "sudo systemctl start snapd.service snapd.socket"
     check_slot_connected qemuusbserial
     check_slot_not_gone qemuusbserial
     check_slot_present qemuusbserial-1
 
     echo "Unplugging first device while snapd is stopped and then starting snapd remembers the slot internally due to connection"
-    execute_remote "sudo systemctl stop snapd.service snapd.socket"
+    nested_exec "sudo systemctl stop snapd.service snapd.socket"
     hotplug_del_dev1
-    execute_remote "sudo systemctl start snapd.service snapd.socket"
+    nested_exec "sudo systemctl start snapd.service snapd.socket"
     check_slot_not_present qemuusbserial
     check_slot_gone qemuusbserial
 
@@ -154,7 +157,7 @@
     echo "Disconnecting first slot and then unplugging the device removes the slot completely"
     # manual snap disconnect doesn't implement retry and errors out if there are conflicting changes, so wait for hotplug changes to complete
     wait_for_all_changes
-    execute_remote "sudo snap disconnect serial-port-hotplug:serial-port :qemuusbserial"
+    nested_exec "sudo snap disconnect serial-port-hotplug:serial-port :qemuusbserial"
     check_slot_present qemuusbserial
     hotplug_del_dev1
     check_slot_not_present qemuusbserial
@@ -172,10 +175,10 @@
     check_slot_device_path qemuusbserial "/dev/ttyUSB0"
 
     echo "Connecting hotplug slot of the first device again"
-    execute_remote "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
+    nested_exec "sudo snap connect serial-port-hotplug:serial-port :qemuusbserial"
     check_slot_connected qemuusbserial
 
     echo "Hotplug slot stays after removing the snap"
-    execute_remote "sudo snap remove serial-port-hotplug"
+    nested_exec "sudo snap remove serial-port-hotplug"
     check_slot_present qemuusbserial
     check_slot_not_gone qemuusbserial
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core/image-build/task.yaml snapd-2.48.3+20.04/tests/nested/core/image-build/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core/image-build/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core/image-build/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,16 +2,17 @@
 
 systems: [ubuntu-16.04-64]
 
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    nested_fetch_spread
+
 execute: |
     cd "$SPREAD_PATH"
 
-    tmp=$(mktemp -d)
-    trap 'rm -rf $tmp' EXIT
-    curl -s -O https://niemeyer.s3.amazonaws.com/spread-amd64.tar.gz && tar xzvf spread-amd64.tar.gz && rm -f spread-amd64.tar.gz && mv spread "$tmp"
-
     set +x
     export SPREAD_EXTERNAL_ADDRESS=localhost:8022
-    "$tmp/spread" -v external:ubuntu-core-16-64:tests/main/ubuntu-core-reboot \
+    "$NESTED_WORK_DIR/spread" -v external:ubuntu-core-16-64:tests/main/ubuntu-core-reboot \
                             external:ubuntu-core-16-64:tests/main/install-store \
                             external:ubuntu-core-16-64:tests/main/interfaces-system-observe \
-                            external:ubuntu-core-16-64:tests/main/op-remove-retry | while read -r line; do echo "> $line"; done
+                            external:ubuntu-core-16-64:tests/main/op-remove-retry
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/basic/task.yaml snapd-2.48.3+20.04/tests/nested/core20/basic/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/basic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/basic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,30 +3,48 @@
 description: |
     This test checks basic snapd commands on UC20 with secure boot and encryption enabled
 
-systems: [ubuntu-20.04-*]
-
 execute: |
     #shellcheck source=tests/lib/nested.sh
     . "$TESTSLIB/nested.sh"
 
+    # wait for the system to be seeded first
+    nested_exec "sudo snap wait system seed.loaded"
+
     echo "Ensure 'snap install' works"
     # The install command could cause a ssh break, so || true is used
     # and then we check the installation was completed successfully
-    execute_remote "sudo snap install test-snapd-sh" || true
+    nested_exec "sudo snap install test-snapd-sh" || true
 
     echo "Ensure 'snap list' works and test-snapd-sh snap is installed"
-    execute_remote "snap list" | MATCH test-snapd-sh
+    nested_exec "snap list" | MATCH test-snapd-sh
 
     echo "Ensure 'snap find' works"
-    execute_remote "snap find test-snapd-sh" | MATCH ^test-snapd-sh
+    nested_exec "snap find test-snapd-sh" | MATCH ^test-snapd-sh
 
     echo "Ensure 'snap info' works"
-    execute_remote "snap info test-snapd-sh" | MATCH '^name:\ +test-snapd-sh'
+    nested_exec "snap info test-snapd-sh" | MATCH '^name:\ +test-snapd-sh'
 
     echo "Ensure 'snap remove' works"
     # The install command could cause a ssh break, so || true is used
     # and then we check the removal was completed successfully
-    execute_remote "sudo snap remove test-snapd-sh" || true
+    nested_exec "sudo snap remove test-snapd-sh" || true
 
     echo "Ensure 'snap list' works and test-snapd-sh snap is removed"
-    execute_remote "snap list" | NOMATCH test-snapd-sh
+    nested_exec "! snap list test-snapd-sh"
+
+    echo "Ensure 'snap debug show-keys' works as root"
+    nested_exec "sudo snap recovery --show-keys" | MATCH 'recovery:\s+[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}'
+    nested_exec "sudo snap recovery --show-keys" | MATCH 'reinstall:\s+[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}-[0-9]{5}'
+    echo "But not as user (normal file permissions prevent this)"
+    if nested_exec "snap recovery --show-key"; then
+        echo "snap recovery --show-key should not work as a user"
+        exit 1
+    fi
+
+    echo "Wait for device initialisation to be done"
+    while ! nested_exec snap changes | grep -q "Done.*Initialize device"; do sleep 1; done
+
+    echo "Check that the serial backed up to save is as expected"
+    nested_exec 'cat /var/lib/snapd/save/device/asserts-v0/serial/'"$(nested_model_authority)"'/pc/*/active' >serial.saved
+    nested_exec snap model --serial --assertion >serial
+    cmp serial serial.saved
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/degraded/task.yaml snapd-2.48.3+20.04/tests/nested/core20/degraded/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/degraded/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/degraded/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,49 @@
+summary: Transition to recover mode with things missing so we use degraded mode
+
+environment:
+  DEGRADED_JSON: /run/snapd/snap-bootstrap/degraded.json
+
+execute: |
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  # wait for the system to be seeded first
+
+  nested_wait_for_snap_command
+  nested_exec "sudo snap wait system seed.loaded"
+
+  echo "Install jq in the host environment"
+  snap install jq
+
+  echo "Move the run key for ubuntu-save out of the way so we use the fallback key to unlock ubuntu-save"
+  nested_exec "sudo mv /run/mnt/data/system-data/var/lib/snapd/device/fde/ubuntu-save.key /run/mnt/data/system-data/var/lib/snapd/device/fde/ubuntu-save.key.bk"
+
+  recoverySystem=$(nested_exec "sudo snap recovery | grep -v Notes | grep -Po '^[0-9]+'")
+
+  echo "Transition to recover mode"
+  nested_uc20_transition_to_system_mode "$recoverySystem" recover
+
+  nested_wait_for_snap_command
+  nested_exec "sudo snap wait system seed.loaded"
+
+  echo "Check degraded.json exists and has the unlock-key for ubuntu-save as the fallback key"
+  nested_exec "test -f $DEGRADED_JSON"
+  test "$(nested_exec "cat $DEGRADED_JSON" | jq -r '."ubuntu-save" | ."unlock-key"')" = fallback
+
+  echo "Move the run object key for ubuntu-save back and go back to run mode"
+  nested_exec "sudo mv /run/mnt/host/ubuntu-data/system-data/var/lib/snapd/device/fde/ubuntu-save.key.bk /run/mnt/host/ubuntu-data/system-data/var/lib/snapd/device/fde/ubuntu-save.key"
+  nested_uc20_transition_to_system_mode "$recoverySystem" run
+
+  nested_wait_for_snap_command
+  nested_exec "sudo snap wait system seed.loaded"
+
+  echo "Now move the run object key on ubuntu-boot out of the way so we use the fallback key to unlock ubuntu-data"
+  nested_exec "sudo mv /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key.bk"
+  nested_uc20_transition_to_system_mode "$recoverySystem" recover
+
+  nested_wait_for_snap_command
+  nested_exec "sudo snap wait system seed.loaded"
+
+  echo "Check degraded.json exists and has the unlock-key for ubuntu-data as the fallback key"
+  nested_exec "test -f $DEGRADED_JSON"
+  test "$(nested_exec "cat $DEGRADED_JSON" | jq -r '."ubuntu-data" | ."unlock-key"')" = fallback
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/gadget-reseal/manip_gadget.py snapd-2.48.3+20.04/tests/nested/core20/gadget-reseal/manip_gadget.py
--- snapd-2.45.1+20.04.2/tests/nested/core20/gadget-reseal/manip_gadget.py	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/gadget-reseal/manip_gadget.py	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,50 @@
+#!/usr/bin/python3
+
+import sys
+import argparse
+
+import yaml
+
+
+def parse_arguments():
+    parser = argparse.ArgumentParser(description="pc gadget yaml generator for test")
+    parser.add_argument(
+        "gadgetyaml", type=argparse.FileType("r"), help="path to gadget.yaml input file"
+    )
+    return parser.parse_args()
+
+
+def must_find_struct(structs, name):
+    found = [s for s in structs if s["name"] == name]
+    if len(found) != 1:
+        raise RuntimeError("no structure with name {} among: {}".format(name, structs))
+    return found[0]
+
+
+def bump_update_edition(update):
+    if update is None:
+        return {"edition": 1}
+    if "edition" not in update:
+        update["edition"] = 1
+    else:
+        update["edition"] += 1
+    return update
+
+
+def main(opts):
+    gadget_yaml = yaml.safe_load(opts.gadgetyaml)
+
+    structs = gadget_yaml["volumes"]["pc"]["structure"]
+    ubuntu_seed = must_find_struct(structs, "ubuntu-seed")
+    ubuntu_seed["update"] = bump_update_edition(ubuntu_seed.get("update"))
+
+    # trigger an update, so that device lookup is performed
+    mbr = must_find_struct(structs, "mbr")
+    mbr["update"] = bump_update_edition(mbr.get("update"))
+
+    yaml.dump(gadget_yaml, stream=sys.stdout, indent=2, default_flow_style=False)
+
+
+if __name__ == "__main__":
+    opts = parse_arguments()
+    main(opts)
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/gadget-reseal/task.yaml snapd-2.48.3+20.04/tests/nested/core20/gadget-reseal/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/gadget-reseal/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/gadget-reseal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,56 @@
+summary: Check that a gadget refresh reseals
+
+systems: [ubuntu-20.04-64]
+
+execute: |
+    # shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    SEALED_KEY_MTIME_1="$(nested_exec sudo stat --format="%Y" /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key)"
+    RESEAL_COUNT_1="$(nested_exec sudo cat /var/lib/snapd/device/fde/boot-chains | python3 -m json.tool | grep reseal-count|cut -f2 -d: | tr ',' ' ')"
+    # Install new (unasserted) gadget without changes and wait for change without reboot
+    boot_id="$( nested_get_boot_id )"
+    REMOTE_CHG_ID=$(nested_exec sudo snap install --dangerous /var/lib/snapd/snaps/pc_*.snap --no-wait)
+    # no reboot here, no gadget changes
+    nested_exec sudo snap watch "${REMOTE_CHG_ID}"
+  
+    # nothing in the gadget has changed so no reseal was needed
+    SEALED_KEY_MTIME_2="$(nested_exec sudo stat --format="%Y" /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key)"
+    test "$SEALED_KEY_MTIME_2" -eq "$SEALED_KEY_MTIME_1"
+    RESEAL_COUNT_2="$(nested_exec sudo cat /var/lib/snapd/device/fde/boot-chains | python3 -m json.tool | grep reseal-count|cut -f2 -d: | tr ',' ' ')"
+    test "$RESEAL_COUNT_2" = "$RESEAL_COUNT_1"
+
+    # create modified boot assets
+    KEY_NAME=$(nested_get_snakeoil_key)
+    SNAKEOIL_KEY="$PWD/$KEY_NAME.key"
+    SNAKEOIL_CERT="$PWD/$KEY_NAME.pem"
+    # ensure clean pc-gadget dir
+    rm -rf pc-gadget
+    GADGET_SNAP="$(ls "$NESTED_ASSETS_DIR"/pc_*.snap)"
+    unsquashfs -d pc-gadget "$GADGET_SNAP"
+    # change a few bytes in the compat header and ensure sed worked
+    sed -i 's/This program cannot be run in DOS mode/This program cannot be run in XXX mode/' pc-gadget/grubx64.efi
+    grep -q -a "This program cannot be run in XXX mode" pc-gadget/grubx64.efi
+
+    ./manip_gadget.py pc-gadget/meta/gadget.yaml > modified_gadget.yaml
+    mv modified_gadget.yaml pc-gadget/meta/gadget.yaml
+
+    # resign both assets
+    nested_secboot_sign_file pc-gadget/shim.efi.signed "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+    nested_secboot_sign_file pc-gadget/grubx64.efi "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+    rm -f "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+    snap pack pc-gadget/
+
+    # install newly created gadget (which will trigger a reboot)
+    nested_copy ./pc_*.snap
+    REMOTE_CHG_ID=$(nested_exec sudo snap install --dangerous ./pc_*.snap --no-wait)
+    nested_wait_for_reboot "${boot_id}"
+    nested_exec sudo snap watch "${REMOTE_CHG_ID}"
+
+    # sanity check that the gadget asset was changed
+    nested_exec sudo grep -q -a "This program cannot be run in XXX mode" /run/mnt/ubuntu-boot/EFI/boot/grubx64.efi
+
+    # the gadget has changed, we should see resealing
+    SEALED_KEY_MTIME_3="$(nested_exec sudo stat --format="%Y" /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key)"
+    test "$SEALED_KEY_MTIME_3" -gt "$SEALED_KEY_MTIME_2"
+    RESEAL_COUNT_3="$(nested_exec sudo cat /var/lib/snapd/device/fde/boot-chains | python3 -m json.tool | grep reseal-count|cut -f2 -d: | tr ',' ' ')"
+    test "$RESEAL_COUNT_3" -gt "1"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/kernel-failover/task.yaml snapd-2.48.3+20.04/tests/nested/core20/kernel-failover/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/kernel-failover/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/kernel-failover/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,90 @@
+summary: Check that a broken kernel snap automatically rolls itself back
+
+prepare: |
+  echo "Build a broken kernel snap where the initramfs panic's"
+
+  # shellcheck source=tests/lib/prepare.sh
+  . "$TESTSLIB/prepare.sh"
+
+  # shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  # use the kernel snap from the nested VM and repack it so that it panic's in
+  # the initramfs and rolls back to the original version
+  # TODO:UC20: this doesn't work for some reason when we copy it from the 
+  #            running system, we should look into that, but for now just 
+  #            re-download the snap
+  snap download pc-kernel --channel=20/edge --basename=pc-kernel
+  uc20_build_initramfs_kernel_snap pc-kernel.snap "$PWD" --inject-kernel-panic-in-initramfs
+  mv pc-kernel_*.snap panicking-initramfs-kernel.snap
+
+execute: |
+  # shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  # Copy the broken initramfs kernel snap to the UC20 VM
+  nested_copy panicking-initramfs-kernel.snap
+
+  # wait for snapd to be "available"
+  retry=120
+  wait=1
+  until nested_exec command -v snap; do
+      retry=$(( retry - 1 ))
+      if [ $retry -le 0 ]; then
+          echo "Timed out waiting for no snap command. Aborting!"
+          exit 1
+      fi
+      sleep "$wait"
+  done
+
+  # Wait for snapd to be seeded
+  nested_exec sudo snap wait system seed.loaded
+
+  # Get the current revision of the kernel snap
+  # TODO:UC20: enable for pi-kernel, etc. when used with external systems
+  startRevision=$(nested_exec sudo snap list pc-kernel | grep pc-kernel | awk '{print $3}')
+  if [ -z "${startRevision}" ]; then
+    echo "missing pc-kernel revision"
+    exit 1
+  fi
+
+  boot_id="$( nested_get_boot_id )"
+
+  # Install it and get the ID for the change
+  REMOTE_CHG_ID=$(nested_exec sudo snap install --dangerous panicking-initramfs-kernel.snap --no-wait)
+
+  # wait for a reboot
+  nested_wait_for_reboot "${boot_id}"
+
+  # Wait for the change to finish - note it will exit with non-zero since the 
+  # change will fail, so don't let that kill the test here
+  if nested_exec sudo snap watch "${REMOTE_CHG_ID}"; then 
+    echo "remote snap change ${REMOTE_CHG_ID} for broken kernel snap refresh should have failed!"
+    exit 1
+  fi
+
+  # Check that the refresh failed
+  nested_exec sudo snap changes | grep "${REMOTE_CHG_ID}" | MATCH Error
+  nested_exec sudo snap tasks "${REMOTE_CHG_ID}" | MATCH "cannot finish .* installation, there was a rollback across reboot"
+
+  # We should be on the same revision of the kernel snap
+  if [ "$(nested_exec sudo snap list pc-kernel | grep pc-kernel | awk '{print $3}')" != "${startRevision}" ]; then
+    echo "pc-kernel is on the wrong revision"
+    exit 1
+  fi
+
+  # Make sure we don't have leftover bootenv
+  nested_exec sudo snap debug boot-vars --uc20 | MATCH '^kernel_status=$'
+
+  # Make sure that we don't have extra assets in the ubuntu-boot dir and that
+  # the currently enabled kernel is the original kernel
+
+  # kernel.efi symlink should point to the original kernel
+  nested_exec readlink /run/mnt/ubuntu-boot/EFI/ubuntu/kernel.efi | MATCH "pc-kernel_${startRevision}.snap/kernel.efi"
+  # should still have pc-kernel_$rev.snap dir
+  nested_exec test -d "/run/mnt/ubuntu-boot/EFI/ubuntu/pc-kernel_${startRevision}.snap"
+  if [ "$(nested_exec ls /run/mnt/ubuntu-boot/EFI/ubuntu/pc-kernel_*.snap | wc -l)" != 1 ]; then
+    echo "Extra leftover pc-kernel assets in ubuntu-boot:"
+    nested_exec ls /run/mnt/ubuntu-boot/EFI/ubuntu/pc-kernel_*.snap
+    exit 1
+  fi
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/kernel-reseal/task.yaml snapd-2.48.3+20.04/tests/nested/core20/kernel-reseal/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/kernel-reseal/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/kernel-reseal/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,55 @@
+summary: Check that a kernel refresh reseals
+
+systems: [ubuntu-20.04-64]
+
+prepare: |
+  # shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  # we cannot use the kernel from store as it may have a version of
+  # snap-bootstrap that will not be able to unseal the keys and unlock the
+  # encrypted volumes, instead use the kernel we repacked when building the UC20
+  # image
+  KERNEL_SNAP="$(ls "$NESTED_ASSETS_DIR"/pc-kernel_*.snap)"
+  unsquashfs -d pc-kernel "$KERNEL_SNAP"
+  # ensure we really have the header we expect
+  grep -q -a "This program cannot be run in DOS mode" pc-kernel/kernel.efi
+  # modify the kernel so that the hash changes
+  sed -i 's/This program cannot be run in DOS mode/This program cannot be run in XXX mode/' pc-kernel/kernel.efi
+  grep -q -a "This program cannot be run in XXX mode" pc-kernel/kernel.efi
+
+  KEY_NAME=$(nested_get_snakeoil_key)
+  SNAKEOIL_KEY="$PWD/$KEY_NAME.key"
+  SNAKEOIL_CERT="$PWD/$KEY_NAME.pem"
+  nested_secboot_sign_file "$PWD/pc-kernel/kernel.efi" "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+
+  snap pack pc-kernel
+  rm -rf pc-kernel
+  mv pc-kernel_*.snap new-pc-kernel.snap
+  nested_copy new-pc-kernel.snap
+
+execute: |
+  # shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  SEALED_KEY_MTIME_1="$(nested_exec sudo stat --format="%Y" /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key)"
+  RESEAL_COUNT_1="$(nested_exec sudo cat /var/lib/snapd/device/fde/boot-chains | python3 -m json.tool | grep reseal-count|cut -f2 -d: | tr ',' ' ')"
+
+  # Install new (unasserted) kernel and wait for reboot/change finishing
+  boot_id="$( nested_get_boot_id )"
+  REMOTE_CHG_ID=$(nested_exec sudo snap install --dangerous new-pc-kernel.snap --no-wait)
+  nested_wait_for_reboot "${boot_id}"
+  nested_exec sudo snap watch "${REMOTE_CHG_ID}"
+
+  # sanity check that we are using the right kernel
+  nested_exec sudo grep -q -a "This program cannot be run in XXX mode" /boot/grub/kernel.efi
+
+  # ensure ubuntu-data.sealed-key mtime is newer
+  SEALED_KEY_MTIME_2="$(nested_exec sudo stat --format="%Y" /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key)"
+  test "$SEALED_KEY_MTIME_2" -gt "$SEALED_KEY_MTIME_1"
+
+  # check that we have boot chains
+  nested_exec sudo test -e /var/lib/snapd/device/fde/boot-chains
+
+  RESEAL_COUNT_2="$(nested_exec sudo cat /var/lib/snapd/device/fde/boot-chains | python3 -m json.tool | grep reseal-count|cut -f2 -d: | tr ',' ' ')"
+  test "$RESEAL_COUNT_2" -gt "$RESEAL_COUNT_1"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/save/task.yaml snapd-2.48.3+20.04/tests/nested/core20/save/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/save/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/save/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,41 @@
+summary: Check that ubuntu-save is set up in a UC20 device
+
+description: |
+    This test checks that ubuntu-save is preset and set up correctly in a UC20
+    device
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    # check that ubuntu-save is mounted and has a reasonable amount of free
+    # space, example df output:
+    # Filesystem                                                   1B-blocks  Used Available Use% Mounted on
+    # /dev/mapper/ubuntu-save-0bed13ef-f71f-418f-b046-b1ce32dd04a7   5079040 28672   4390912   1% /run/mnt/ubuntu-save
+    save_out="$(nested_exec "df -B1 /run/mnt/ubuntu-save | tail -1")"
+    echo "$save_out" | MATCH '^/dev/mapper/ubuntu-save-[0-9a-z-]+\s+'
+    save_size="$(echo "$save_out" | awk '{print $4}')"
+    echo "check  there is at least 6MB of free space available on ubuntu-save"
+    test "$save_size" -gt "$((6*1024*1024))"
+
+    # leave a canary
+    nested_exec "sudo touch /run/mnt/ubuntu-save/canary"
+
+    nested_exec mountpoint /var/lib/snapd/save
+    # we know that save is mounted using a systemd unit
+    nested_exec systemctl status var-lib-snapd-save.mount
+    # and a canary exists
+    nested_exec "test -f /var/lib/snapd/save/canary"
+
+    # transition to recovery mode and check again
+    boot_id="$(nested_get_boot_id)"
+    # shellcheck disable=SC2016
+    nested_exec 'sudo snap reboot --recover $(sudo snap recovery | grep -v Label | awk "{print \$1}")'
+    nested_wait_for_reboot "${boot_id}"
+    # verify in recover mode
+    nested_exec 'sudo cat /proc/cmdline' | MATCH snapd_recovery_mode=recover
+
+    recover_save_out="$(nested_exec "df -B1 /run/mnt/ubuntu-save | tail -1")"
+    echo "$recover_save_out" | MATCH '^/dev/mapper/ubuntu-save-[0-9a-z-]+\s+'
+    # and a canary exists
+    nested_exec "test -f /run/mnt/ubuntu-save/canary"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/core20/tpm/task.yaml snapd-2.48.3+20.04/tests/nested/core20/tpm/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/core20/tpm/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/core20/tpm/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -3,25 +3,52 @@
 description: |
     This test check UC20 can boot with secure boot successfully
 
-systems: [ubuntu-20.04-*]
-
-prepare: |
-    #shellcheck source=tests/lib/nested.sh
-    . "$TESTSLIB/nested.sh"
-
-    execute_remote "sudo snap install --beta --devmode test-snapd-mokutil" || true
-
-restore: |
-    #shellcheck source=tests/lib/nested.sh
-    . "$TESTSLIB/nested.sh"
-
-    execute_remote "sudo snap remove test-snapd-mokutil" || true
-
 execute: |
     #shellcheck source=tests/lib/nested.sh
     . "$TESTSLIB/nested.sh"
 
-    # Check tpm status on the nested vm
-    execute_remote "dmesg | grep -i tpm" | MATCH "efi: +SMBIOS=.* +TPMFinalLog=.*"
-    execute_remote "test -e /sys/kernel/security/tpm0/binary_bios_measurements"
-    execute_remote "test-snapd-mokutil --sb-state" | MATCH "SecureBoot enabled"
+    echo "Verifying tpm working on the nested vm"
+    nested_exec "dmesg | grep -i tpm" | MATCH "efi: +SMBIOS=.* +TPMFinalLog=.*"
+    nested_exec "test -e /sys/kernel/security/tpm0/binary_bios_measurements"
+
+    echo "and secure boot is enabled on the nested vm"
+    nested_exec "xxd /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" | MATCH "00000000: 0600 0000 01\s+....."
+
+    echo "and the recovery key is available"
+    nested_exec "test -e /var/lib/snapd/device/fde/recovery.key"
+    echo "and has the expected size"
+    nested_exec "stat --printf=%s /var/lib/snapd/device/fde/recovery.key" | MATCH '^16$'
+    echo "and has the expected owner and permissions"
+    nested_exec "stat --printf='%u:%g %a' /var/lib/snapd/device/fde/recovery.key" | MATCH '^0:0 600$'
+
+    echo "and the tpm-{policy-auth-key,lockout-auth} files are in ubuntu-save"
+    nested_exec "test -e /var/lib/snapd/save/device/fde/tpm-policy-auth-key"
+    nested_exec "test -e /var/lib/snapd/save/device/fde/tpm-lockout-auth"
+
+    # grab modeenv content
+    nested_exec "cat /var/lib/snapd/modeenv" > modeenv
+    # and checksums
+    boot_grub_sha3="$(nested_exec "cat /run/mnt/ubuntu-boot/EFI/boot/grubx64.efi" | "$TESTSLIB"/tools/sha3-384)"
+    seed_grub_sha3="$(nested_exec "cat /run/mnt/ubuntu-seed/EFI/boot/grubx64.efi" | "$TESTSLIB"/tools/sha3-384)"
+    seed_shim_sha3="$(nested_exec "cat /run/mnt/ubuntu-seed/EFI/boot/bootx64.efi" | "$TESTSLIB"/tools/sha3-384)"
+
+    # modeenv entries look like this:
+    # current_trusted_boot_assets={"grubx64.efi":["2e03571ce08de6cdde8a0ad80db8777c411af66073b795e514ad365da842920c9d50eaa0c3b45e878b9c8723cb22e0df"]}
+    # current_trusted_recovery_boot_assets={"bootx64.efi":["53298e526f5e073a4c60eb97f7af5eb016453efb8b813ce52b2c434d839a764767f1aeb0f39c745b15d045df8c35836c"],"grubx64.efi":["2e03571ce08de6cdde8a0ad80db8777c411af66073b795e514ad365da842920c9d50eaa0c3b45e878b9c8723cb22e0df"]}
+
+    # check that assets are listed in modeenv, for ubuntu-boot bootloader
+    grep current_trusted_boot_assets= < modeenv  | MATCH "\"grubx64.efi\":\[\"$boot_grub_sha3\"\]"
+    # and the recovery ubuntu-seed bootloader
+    grep current_trusted_recovery_boot_assets= < modeenv  | MATCH "\"grubx64.efi\":\[\"$seed_grub_sha3\"\]"
+    grep current_trusted_recovery_boot_assets= < modeenv  | MATCH "\"bootx64.efi\":\[\"$seed_shim_sha3\"\]"
+
+    # make sure that files exist too
+    nested_exec "cat /var/lib/snapd/boot-assets/grub/grubx64.efi-${boot_grub_sha3}" | \
+        "$TESTSLIB"/tools/sha3-384 | MATCH "^$boot_grub_sha3\$"
+    nested_exec "cat /var/lib/snapd/boot-assets/grub/grubx64.efi-${seed_grub_sha3}" | \
+        "$TESTSLIB"/tools/sha3-384 | MATCH "^$seed_grub_sha3\$"
+    nested_exec "cat /var/lib/snapd/boot-assets/grub/bootx64.efi-${seed_shim_sha3}" | \
+        "$TESTSLIB"/tools/sha3-384 | MATCH "^$seed_shim_sha3\$"
+
+    # check for sealed keys marker
+    nested_exec "test -f /var/lib/snapd/device/fde/sealed-keys"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/cloud-init-never-used-not-vuln/task.yaml snapd-2.48.3+20.04/tests/nested/manual/cloud-init-never-used-not-vuln/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/cloud-init-never-used-not-vuln/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/cloud-init-never-used-not-vuln/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,138 @@
+summary: |
+    Test that cloud-init is no longer vulnerable on Ubuntu Core with the fix for
+    CVE-2020-11933 in place.
+
+systems: [ubuntu-18.04-64, ubuntu-16.04-64]
+
+environment:
+    # this test ensures that existing images without the fix are no longer
+    # vulnerable after refreshing to a version of snapd with the fix
+    NESTED_BUILD_FROM_CURRENT/refresh: false
+    NESTED_BUILD_FROM_CURRENT/firstboot: true
+    NESTED_USE_CLOUD_INIT: false
+    NESTED_IMAGE_ID: cloud-init-never-$NESTED_BUILD_FROM_CURRENT
+
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    # build an unrelated empty cdrom drive to provide to first boot with no 
+    # real files on it to use as a placeholder in qemu args
+    nested_build_seed_cdrom "$TESTSLIB/cloud-init-seeds/emptykthxbai" seed.iso notcidata emptykthxbai
+
+    # build the attacker cloud-init NoCloud cdrom drive
+    nested_build_seed_cdrom "$TESTSLIB/cloud-init-seeds/attacker-user" seed2.iso cidata user-data meta-data
+
+    "$TESTSTOOLS"/nested-state build-image core 
+
+    # first boot will use seed1 which is empty, but the same file name will be 
+    # replace while the VM is shutdown to use the second attacker iso
+    "$TESTSTOOLS"/nested-state create-vm core --param-cdrom "-cdrom $(pwd)/seed.iso"
+
+debug: |
+    if [ -f snapd-before-reboot.logs ]; then
+        echo "logs before reboot"
+        cat snapd-before-reboot.logs
+    fi
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    echo "logs from current nested VM boot snapd"
+    nested_exec "sudo journalctl -e --no-pager -u snapd" || true
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    #shellcheck source=tests/lib/snaps.sh
+    . "$TESTSLIB/snaps.sh"
+
+    # the VM here will not ever had used cloud-init so snapd should disable 
+    # cloud-init when it is installed
+
+    # wait for done seeding
+    nested_exec "sudo snap wait system seed.loaded"
+
+    # if we are not building from current, then we need to prep the snapd snap
+    # to install with the fix, this simulates/verifies that devices in the field
+    # without the fix will actually be fixed after they refresh
+    if [ "$NESTED_BUILD_FROM_CURRENT" = "false" ]; then
+        if nested_is_core_16_system; then
+            # build the core snap for this run
+            repack_snapd_deb_into_core_snap "$PWD"
+            nested_copy "$PWD/core-from-snapd-deb.snap"
+
+            # install the core snap
+            nested_exec "sudo snap install core-from-snapd-deb.snap --dangerous"
+
+            # now we wait for the reboot for the new core snap
+            nested_wait_for_no_ssh
+            nested_wait_for_ssh
+            
+        else
+            # build the snapd snap for this run
+            repack_snapd_deb_into_snapd_snap "$PWD"
+            nested_copy "$PWD/snapd-from-deb.snap"
+
+            # install the snapd snap
+            nested_exec "sudo snap install snapd-from-deb.snap --dangerous"
+        fi
+    fi
+
+    # Note: there is a race here after we have installed the fix (or we have 
+    # booted a fresh image with the fix). 
+    # Namely, snapd will begin checking on cloud-init status after it has 
+    # ensured that the boot was okay in the device manager, but this will not
+    # happen immediately in zero time, and moreover, snapd will not do anything
+    # substantial or measurable until cloud-init has reached a steady state or
+    # otherwise times out. 
+    # As such, in this test, we first wait for cloud-init to settle down, and 
+    # then wait a bit longer to give snapd a chance to run again and take 
+    # action that we can test for. Since in this test, cloud-init was never 
+    # used, the status command should not take much time at all, since it will 
+    # not have been triggered. 
+
+    echo "Waiting for cloud-init..."
+    nested_exec "cloud-init status --wait"
+
+    # TODO: is there a better thing we can wait for here instead? maybe the log
+    # message from snapd directly via journalctl ?
+    echo "Waiting for snapd to react to cloud-init"
+    sleep 60
+
+    # ensure that snapd disabled cloud-init with the cloud-init.disabled file
+    echo "Ensuring that snapd restricted cloud-init"
+    nested_exec "cloud-init status" | MATCH "status: disabled"
+    nested_exec "test -f /etc/cloud/cloud-init.disabled"
+    nested_exec "! test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
+
+    # save snapd logs before continuing as the logs are not persistent
+    nested_exec "sudo journalctl -e --no-pager -u snapd" > snapd-before-reboot.logs
+
+    # gracefully shutdown so that we don't have file corruption
+    echo "Gracefully shutting down the nested VM to prepare a simulated attack"
+    boot_id="$(nested_get_boot_id)"
+    "$TESTSTOOLS"/nested-state stop-vm
+
+    # replace the empty seed.iso with the new attacker iso
+    mv seed2.iso seed.iso
+
+    echo "Restarting nested VM with attacker cloud-init CD-ROM drive"
+    "$TESTSTOOLS"/nested-state start-vm
+    nested_wait_for_reboot "${boot_id}"
+
+    # cloud-init should not actually run, since it was disabled, but in case the
+    # test fails, for a better error, we will wait for cloud-init to report that
+    # it is "done" or at least steady before ensuring that the attacker-user was
+    # not created.
+    echo "Waiting for cloud-init..."
+    nested_exec "cloud-init status --wait"
+
+    # the attacker-user should not have been created
+    echo "The cloud-init user was not created"
+    nested_exec "cat /var/lib/extrausers/passwd" | NOMATCH attacker-user
+
+    # cloud-init should still be disabled
+    echo "cloud-init is still disabled"
+    nested_exec "cloud-init status" | MATCH "status: disabled"
+    nested_exec "test -f /etc/cloud/cloud-init.disabled"
+    nested_exec "! test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/cloud-init-nocloud-not-vuln/task.yaml snapd-2.48.3+20.04/tests/nested/manual/cloud-init-nocloud-not-vuln/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/cloud-init-nocloud-not-vuln/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/cloud-init-nocloud-not-vuln/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,145 @@
+summary: |
+    Test that cloud-init is no longer vulnerable on Ubuntu Core with the fix for
+    CVE-2020-11933 in place with a system that used NoCloud configuration.
+
+systems: [ubuntu-18.04-64, ubuntu-16.04-64]
+
+environment:
+    # this is for how nested.sh sets up the initial user, we will control
+    # cloud-init for the test through -cdrom with users created through
+    # system-user assertions to ensure that we are testing the right things
+    NESTED_USE_CLOUD_INIT: false
+    # this variant ensures that existing images without the fix are no longer
+    # vulnerable after refreshing to a version of snapd with the fix
+    NESTED_BUILD_FROM_CURRENT/refresh: false
+    # this variant ensures that new images with the fix are not vulnerable
+    NESTED_BUILD_FROM_CURRENT/firstboot: true
+    NESTED_IMAGE_ID: cloud-init-nocloud-$NESTED_BUILD_FROM_CURRENT
+
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    # first boot - legit NoCloud usage
+    nested_build_seed_cdrom "$TESTSLIB/cloud-init-seeds/normal-user" seed.iso cidata user-data meta-data
+
+    # second boot - attacker drive
+    nested_build_seed_cdrom "$TESTSLIB/cloud-init-seeds/attacker-user" seed2.iso cidata user-data meta-data
+
+    "$TESTSTOOLS"/nested-state build-image core 
+
+    # first boot uses seed1 to create the normal-user in addition to the 
+    # system-user assertion
+    "$TESTSTOOLS"/nested-state create-vm core --param-cdrom "-cdrom $(pwd)/seed.iso"
+
+debug: |
+    if [ -f snapd-before-reboot.logs ]; then
+        echo "logs before reboot"
+        cat snapd-before-reboot.logs
+    fi
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    echo "logs from current nested VM boot snapd"
+    nested_exec "sudo journalctl -e --no-pager -u snapd" || true
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    #shellcheck source=tests/lib/snaps.sh
+    . "$TESTSLIB/snaps.sh"
+
+    # the VM here will use both system-user assertions and cloud-init to create
+    # users on the system, the system-user assertion is for the user1 user, and 
+    # the legitimate cloud-init user is the normal-user user
+
+    # wait for cloud-init to finish importing the first seed
+    nested_exec "sudo cloud-init status --wait"
+
+    echo "The initial cloud-init user was created"
+    nested_exec "cat /var/lib/extrausers/passwd" | MATCH normal-user
+
+    # wait for snap seeding to be done
+    nested_exec "sudo snap wait system seed.loaded"
+
+    # if we are not building from current, then we need to prep the snapd snap
+    # to install with the fix, this simulates/verifies that devices in the field
+    # without the fix will actually be fixed after they refresh
+    if [ "$NESTED_BUILD_FROM_CURRENT" = "false" ]; then
+        echo "Refreshing to a version of snapd with the fix"
+        if is_core_16_nested_system; then
+            # build the core snap for this run
+            repack_snapd_deb_into_core_snap "$PWD"
+            nested_copy "$PWD/core-from-snapd-deb.snap"
+
+            # install the core snap
+            nested_exec "sudo snap install core-from-snapd-deb.snap --dangerous"
+
+            # now we wait for the reboot for the new core snap
+            nested_wait_for_no_ssh
+            nested_wait_for_ssh        
+        else
+            # build the snapd snap for this run
+            repack_snapd_deb_into_snapd_snap "$PWD"
+            nested_copy "$PWD/snapd-from-deb.snap"
+
+            # install the snapd snap
+            nested_exec "sudo snap install snapd-from-deb.snap --dangerous"
+        fi
+    fi
+
+    # Note: there is a race here after we have installed the fix (or we have 
+    # booted a fresh image with the fix). 
+    # Namely, snapd will begin checking on cloud-init status after it has 
+    # ensured that the boot was okay in the device manager, but this will not
+    # happen immediately in zero time, and moreover, snapd will not do anything
+    # substantial or measurable until cloud-init has reached a steady state or
+    # otherwise times out. 
+    # As such, in this test, we first wait for cloud-init to settle down, and 
+    # then wait a bit longer to give snapd a chance to run again and take 
+    # action that we can test for.
+
+    echo "Waiting for cloud-init..."
+    nested_exec "cloud-init status --wait"
+
+    # TODO: is there a better thing we can wait for here instead? maybe the log
+    # message from snapd directly via journalctl ?
+    echo "Waiting for snapd to react to cloud-init"
+    sleep 60
+
+    # ensure that snapd restricted cloud-init with the zzzz_snapd.cfg file
+    echo "Ensuring that snapd restricted cloud-init"
+    nested_exec "cloud-init status" | MATCH "status: done"
+    nested_exec "test ! -f /etc/cloud/cloud-init.disabled"
+    nested_exec "test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
+    nested_exec "cat /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg" | MATCH "manual_cache_clean: true"
+
+    # save snapd logs before continuing as the logs are not persistent
+    nested_exec "sudo journalctl -e --no-pager -u snapd" > snapd-before-reboot.logs
+
+    # gracefully shutdown so that we don't have file corruption
+    echo "Gracefully shutting down the nested VM to prepare a simulated attack"
+    boot_id="$(nested_get_boot_id)"
+    "$TESTSTOOLS"/nested-state stop-vm
+
+    # replace the seed.iso with the new attacker iso
+    mv seed2.iso seed.iso
+
+    echo "Restarting nested VM with attacker cloud-init CD-ROM drive"
+    "$TESTSTOOLS"/nested-state start-vm
+    nested_wait_for_reboot "${boot_id}"
+
+    # cloud-init will actually still run because it was not disabled and we
+    # provided a cloud-init drive but importantly, it will not import the drive,
+    # so wait for cloud-init to settle down before continuing
+    echo "Waiting for cloud-init..."
+    nested_exec "cloud-init status --wait"
+
+    # the attacker-user should not have been created
+    echo "The cloud-init attacker user was not created"
+    nested_exec "cat /var/lib/extrausers/passwd" | NOMATCH attacker-user
+
+    echo "cloud-init is still restricted"
+    nested_exec "cloud-init status" | MATCH "status: done"
+    nested_exec "test ! -f /etc/cloud/cloud-init.disabled"
+    nested_exec "test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/core20-early-config/defaults.yaml snapd-2.48.3+20.04/tests/nested/manual/core20-early-config/defaults.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/core20-early-config/defaults.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/core20-early-config/defaults.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,13 @@
+defaults:
+  system:
+    service:
+      rsyslog:
+        disable: true
+      console-conf:
+        disable: true
+    watchdog:
+      runtime-timeout: 13m
+    system:
+      power-key-action: ignore
+      disable-backlight-service: true
+      timezone: Europe/Malta
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/core20-early-config/install snapd-2.48.3+20.04/tests/nested/manual/core20-early-config/install
--- snapd-2.45.1+20.04.2/tests/nested/manual/core20-early-config/install	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/core20-early-config/install	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# rsyslog.service is expected to be a symlink at this point, and apparmor
+# doesn't control readlink, so this should work even without devmode or
+# system-files plug.
+RSYSLOG=$(readlink /etc/systemd/system/rsyslog.service)
+echo "rsyslog symlink: $RSYSLOG" > "$SNAP_COMMON"/debug.txt || true
+
+BACKLIGHT=$(readlink /etc/systemd/system/systemd-backlight@.service)
+echo "backlight symlink: $BACKLIGHT" >> "$SNAP_COMMON"/debug.txt || true
+
+LOCALTIME=$(readlink /etc/writable/localtime)
+echo "localtime symlink: $LOCALTIME"  >> "$SNAP_COMMON"/debug.txt  2>&1 || true
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/core20-early-config/task.yaml snapd-2.48.3+20.04/tests/nested/manual/core20-early-config/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/core20-early-config/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/core20-early-config/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,93 @@
+summary: Test that gadget config defaults are applied early on core20.
+
+systems: [ubuntu-20.04-64]
+
+environment:
+    NESTED_IMAGE_ID: core20-early-config
+    NESTED_ENABLE_TPM: true
+    NESTED_ENABLE_SECURE_BOOT: true
+    NESTED_BUILD_SNAPD_FROM_CURRENT: true
+
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    mkdir extra-snaps
+
+    # Get the snakeoil key and cert
+    KEY_NAME=$(nested_get_snakeoil_key)
+    SNAKEOIL_KEY="$PWD/$KEY_NAME.key"
+    SNAKEOIL_CERT="$PWD/$KEY_NAME.pem"
+
+    # modify and repack gadget snap (add defaults section and install hook)
+    snap download --basename=pc --channel="20/edge" pc
+    unsquashfs -d pc-gadget pc.snap
+
+    # ensure ubuntu-save is there
+    nested_ensure_ubuntu_save pc-gadget
+
+    cat defaults.yaml >> pc-gadget/meta/gadget.yaml
+    mkdir -p pc-gadget/meta/hooks
+    cp install pc-gadget/meta/hooks/
+
+    nested_secboot_sign_gadget pc-gadget "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+    snap pack pc-gadget/ extra-snaps/
+
+    rm -f "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+
+    "$TESTSTOOLS"/nested-state build-image core
+    "$TESTSTOOLS"/nested-state create-vm core
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    check_core20_early_config(){
+        # sanity - check that defaults were applied; note this doesn't guarantee
+        # that defaults were applied early - that is checked further down.
+        echo "Sanity check of the gadget defaults"
+        nested_exec "sudo snap get system service.rsyslog.disable" | MATCH "true"
+        nested_exec "sudo snap get system watchdog.runtime-timeout" | MATCH "13m"
+        nested_exec "sudo snap get system system.power-key-action" | MATCH "ignore"
+        nested_exec "sudo snap get system system.disable-backlight-service" | MATCH "true"
+
+        nested_exec "test -L /etc/systemd/system/rsyslog.service"
+        nested_exec "cat /etc/systemd/logind.conf.d/00-snap-core.conf" | MATCH "HandlePowerKey=ignore"
+        nested_exec "cat /etc/systemd/system.conf.d/10-snapd-watchdog.conf" | MATCH "RuntimeWatchdogSec=780"
+        nested_exec "test -L /etc/systemd/system/systemd-backlight@.service"
+
+        echo "Test that defaults were applied early."
+        # early config is witnessed by install hook of the pc gadget. Note we can
+        # only check rsyslog/backlight symlinks as other core settings cannot be
+        # inspected from install hook of the gadget.
+        nested_exec "cat /var/snap/pc/common/debug.txt" | MATCH "rsyslog symlink: /dev/null"
+        nested_exec "cat /var/snap/pc/common/debug.txt" | MATCH "backlight symlink: /dev/null"
+
+        # timezone is set
+        nested_exec "cat /etc/timezone" | MATCH "Europe/Malta"
+        nested_exec "readlink -f /etc/localtime" | MATCH "Europe/Malta"
+        nested_exec "cat /var/snap/pc/common/debug.txt" | MATCH "localtime symlink: /usr/share/zoneinfo/Europe/Malta"
+
+        # check console-conf disabled
+        nested_exec "cat /var/lib/console-conf/complete" | MATCH "console-conf has been disabled by the snapd system configuration"
+    }
+
+    check_core20_early_config
+
+    # now transition to recover mode and check it again
+    boot_id="$(nested_get_boot_id)"
+    # shellcheck disable=SC2016
+    nested_exec 'sudo snap reboot --recover'
+    nested_wait_for_reboot "${boot_id}"
+
+    # verify in recover mode
+    nested_exec 'sudo cat /proc/cmdline' | MATCH snapd_recovery_mode=recover
+
+    # Wait for the snap command to be available since recover mode needs to seed
+    # itself
+    nested_wait_for_snap_command
+
+    # Wait for snap seeding to be done
+    nested_exec "sudo snap wait system seed.loaded"
+
+    check_core20_early_config
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/core-early-config/defaults.yaml snapd-2.48.3+20.04/tests/nested/manual/core-early-config/defaults.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/core-early-config/defaults.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/core-early-config/defaults.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,9 @@
+defaults:
+  system:
+    service:
+      rsyslog:
+        disable: true
+      console-conf:
+        disable: true
+    system:
+      timezone: Europe/Malta
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/core-early-config/install snapd-2.48.3+20.04/tests/nested/manual/core-early-config/install
--- snapd-2.45.1+20.04.2/tests/nested/manual/core-early-config/install	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/core-early-config/install	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+# rsyslog.service is expected to be a symlink at this point, and apparmor
+# doesn't control readlink, so this should work even without devmode or
+# system-files plug.
+RSYSLOG=$(readlink /etc/systemd/system/rsyslog.service)
+echo "rsyslog symlink: $RSYSLOG" > "$SNAP_COMMON"/debug.txt || true
+
+LOCALTIME=$(readlink /etc/writable/localtime)
+echo "localtime symlink: $LOCALTIME"  >> "$SNAP_COMMON"/debug.txt  2>&1 || true
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/core-early-config/task.yaml snapd-2.48.3+20.04/tests/nested/manual/core-early-config/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/core-early-config/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/core-early-config/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,65 @@
+summary: Test that config defaults are applied early when image is created.
+
+# core18 specific test (and nested vm is derived from host system)
+systems: [ubuntu-18.04-64]
+
+environment:
+    NESTED_IMAGE_ID: core-early-config
+
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    mkdir extra-snaps
+
+    # modify and repack gadget snap (add defaults section and install hook)
+    snap download --channel=18/stable pc
+    GADGET_SNAP=$(ls pc_*.snap)
+    unsquashfs -no-progress "$GADGET_SNAP"
+    rm -f "$GADGET_SNAP"
+    cat defaults.yaml >> squashfs-root/meta/gadget.yaml
+    mkdir -p squashfs-root/meta/hooks
+    cp install squashfs-root/meta/hooks/
+    mksquashfs squashfs-root "$GADGET_SNAP" -comp xz -no-fragments -no-progress
+    rm -rf squashfs-root
+    mv "$GADGET_SNAP" extra-snaps/
+
+    snap download --channel=18/edge pc-kernel
+    KERNEL_SNAP=$(ls pc-kernel_*.snap)
+    mv "$KERNEL_SNAP" extra-snaps/
+
+    "$TESTSTOOLS"/nested-state build-image core 
+
+    # Modify seed to use devmode for pc gadget snap. This is needed for the
+    # install hook to have access to /etc/systemd. Ideally we would use
+    # system-files plug, but it wouldn't get autoconnected due to assertions.
+    IMAGE_NAME="$(nested_get_image_name core)"
+    loops=$(kpartx -avs "$NESTED_IMAGES_DIR/$IMAGE_NAME"  | cut -d' ' -f 3)
+    part=$(echo "$loops" | tail -1)
+    tmp=$(mktemp -d)
+    mount "/dev/mapper/$part" "$tmp"
+    sed -i "$tmp/system-data/var/lib/snapd/seed/seed.yaml" -E -e 's/^(\s+)file: pc_x1.snap/\1file: pc_x1.snap\n\1devmode: true\n/'
+    umount "$tmp"
+    kpartx -d "$NESTED_IMAGES_DIR/$IMAGE_NAME"
+    rmdir "$tmp"
+
+    "$TESTSTOOLS"/nested-state create-vm core
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    nested_exec "sudo snap wait system seed.loaded"
+
+    echo "Test that rsyslog was disabled early."
+    # early config is witnessed by install hook of the pc gadget
+    nested_exec "cat /var/snap/pc/common/debug.txt" | MATCH "rsyslog symlink: /dev/null"
+    nested_exec "test -L /etc/systemd/system/rsyslog.service"
+
+    # timezone is set
+    nested_exec "cat /etc/timezone" | MATCH "Europe/Malta"
+    nested_exec "readlink -f /etc/localtime" | MATCH "Europe/Malta"
+    nested_exec "cat /var/snap/pc/common/debug.txt" | MATCH "localtime symlink: /usr/share/zoneinfo/Europe/Malta"
+
+    # check console-conf disabled
+    nested_exec "cat /var/lib/console-conf/complete" | MATCH "console-conf has been disabled by the snapd system configuration"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-above-testkeys-boot/defaults.yaml snapd-2.48.3+20.04/tests/nested/manual/grade-signed-above-testkeys-boot/defaults.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-above-testkeys-boot/defaults.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/grade-signed-above-testkeys-boot/defaults.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+defaults:
+  system:
+    refresh:
+      hold: "HOLD-TIME"
+    journal:
+      persistent: true
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-above-testkeys-boot/prepare-device snapd-2.48.3+20.04/tests/nested/manual/grade-signed-above-testkeys-boot/prepare-device
--- snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-above-testkeys-boot/prepare-device	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/grade-signed-above-testkeys-boot/prepare-device	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+# 10.0.2.2 is the host from a nested VM
+snapctl set device-service.url=http://10.0.2.2:11029
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-above-testkeys-boot/task.yaml snapd-2.48.3+20.04/tests/nested/manual/grade-signed-above-testkeys-boot/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-above-testkeys-boot/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/grade-signed-above-testkeys-boot/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,136 @@
+summary: Test that snapd with testkeys on UC20 can boot a model with grade signed.
+
+systems: [ubuntu-20.04-64]
+
+environment:
+  # use tpm + secure boot to get full disk encryption, this is explicitly needed
+  # for grade: secured
+  NESTED_ENABLE_TPM: true
+  NESTED_ENABLE_SECURE_BOOT: true
+
+  # use snapd from the spread run so that we have testkeys trusted in the snapd
+  # run
+  NESTED_BUILD_SNAPD_FROM_CURRENT: true
+
+  # don't use cloud-init, that will be a separate test, we only use sys-user
+  # assertions to create the user for this test
+  NESTED_USE_CLOUD_INIT: false
+
+  # sign all the snaps we build for the image with fakestore
+  NESTED_SIGN_SNAPS_FAKESTORE: true
+
+  # use the testrootorg auto-import assertion
+  # TODO: commit the Go code used to create this assertion from the json file
+  NESTED_CUSTOM_AUTO_IMPORT_ASSERTION: $TESTSLIB/assertions/developer1-auto-import.assert
+
+  # two variants, for signed and secured grades
+  MODEL_GRADE/secured: secured
+  MODEL_GRADE/signed: signed
+
+  NESTED_CUSTOM_MODEL: $TESTSLIB/assertions/developer1-20-${MODEL_GRADE}.model
+  NESTED_IMAGE_ID: testkeys-${MODEL_GRADE}
+
+  # for the fake store
+  NESTED_FAKESTORE_BLOB_DIR: $(pwd)/fake-store-blobdir
+  NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL: http://localhost:11028
+
+  # unset this otherwise ubuntu-image complains about overriding the channel for
+  # a model with grade higher than dangerous when building the image
+  NESTED_CORE_CHANNEL: ""
+
+prepare: |
+  if [ "$TRUST_TEST_KEYS" = "false" ]; then
+      echo "This test needs test keys to be trusted"
+      exit
+  fi
+
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  #shellcheck source=tests/lib/store.sh
+  . "$TESTSLIB"/store.sh
+
+  # setup the fakestore, but don't use it for our snapd here on the host VM, so
+  # tear down the staging_store immediately afterwards so that only the SAS is 
+  # running and our snapd is not pointed at it, ubuntu-image is the only thing 
+  # that actually needs to use the fakestore, and we will manually point it at
+  # the fakestore below using NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL
+  setup_fake_store "$NESTED_FAKESTORE_BLOB_DIR"
+  teardown_staging_store
+
+  echo Expose the needed assertions through the fakestore
+  cp "$TESTSLIB"/assertions/developer1.account "$NESTED_FAKESTORE_BLOB_DIR/asserts"
+  cp "$TESTSLIB"/assertions/developer1.account-key "$NESTED_FAKESTORE_BLOB_DIR/asserts"
+
+  # modify and repack gadget snap to add a defaults section and use our own
+  # prepare-device hook to use the fakedevicesvc
+  mkdir -p "$(nested_get_extra_snaps_path)"
+
+  # Get the snakeoil key and cert for signing gadget assets (shim)
+  KEY_NAME=$(nested_get_snakeoil_key)
+  SNAKEOIL_KEY="$PWD/$KEY_NAME.key"
+  SNAKEOIL_CERT="$PWD/$KEY_NAME.pem"
+
+  snap download --basename=pc --channel="20/edge" pc
+  unsquashfs -d pc-gadget pc.snap
+
+  # ensure ubuntu-save is there
+  nested_ensure_ubuntu_save pc-gadget
+
+  # delay all refreshes for a week from now, as otherwise refreshes for our 
+  # snaps (which are asserted by the testrootorg authority-id) may happen, which
+  # will break things because the signing keys won't match, etc. and 
+  # specifically snap-bootstrap in the kernel snap from the store won't trust
+  # the seed keys to unlock the encrypted data partition in the initramfs
+  sed defaults.yaml -e "s/HOLD-TIME/$(date --date="next week" +%Y-%m-%dT%H:%M:%S%:z)/" >> \
+    pc-gadget/meta/gadget.yaml
+
+  # TODO: enable this bit when things are ready to use a testkeys signed model
+  # assertion
+  # copy the prepare-device hook to use our fakedevicesvc
+  # mkdir -p pc-gadget/meta/hooks/
+  # cp prepare-device pc-gadget/meta/hooks/
+
+  nested_secboot_sign_gadget pc-gadget "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+  snap pack pc-gadget/ "$(nested_get_extra_snaps_path)"
+  rm -rf pc-gadget/
+
+  rm -f "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+
+  # TODO: enable when ready
+  # start fake device svc
+  # #shellcheck disable=SC2148
+  #  systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
+
+  "$TESTSTOOLS"/nested-state build-image core
+  "$TESTSTOOLS"/nested-state create-vm core
+
+restore: |
+  if [ "$TRUST_TEST_KEYS" = "false" ]; then
+      echo "This test needs test keys to be trusted"
+      exit
+  fi
+
+  # stop fake device svc
+  # systemctl stop fakedevicesvc
+
+  #shellcheck source=tests/lib/store.sh
+  . "$TESTSLIB"/store.sh
+  teardown_fake_store "$NESTED_FAKESTORE_BLOB_DIR"
+
+execute: |
+  if [ "$TRUST_TEST_KEYS" = "false" ]; then
+      echo "This test needs test keys to be trusted"
+      exit
+  fi
+
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  # we have the right model from snap model
+  nested_exec "sudo snap model --verbose" | MATCH "model:\s+testkeys-snapd-${MODEL_GRADE}-core-20-amd64"
+  nested_exec "sudo snap model --verbose" | MATCH "grade:\s+${MODEL_GRADE}"
+
+  # TODO: check that we got a serial assertion via the fakedevicesvc
+  # for now we just don't get a serial assertion which is fine for the purposes
+  # of this test
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-cloud-init-testkeys/defaults.yaml snapd-2.48.3+20.04/tests/nested/manual/grade-signed-cloud-init-testkeys/defaults.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-cloud-init-testkeys/defaults.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/grade-signed-cloud-init-testkeys/defaults.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+defaults:
+  system:
+    refresh:
+      hold: "@HOLD-TIME@"
+    journal:
+      persistent: true
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-cloud-init-testkeys/prepare-device snapd-2.48.3+20.04/tests/nested/manual/grade-signed-cloud-init-testkeys/prepare-device
--- snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-cloud-init-testkeys/prepare-device	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/grade-signed-cloud-init-testkeys/prepare-device	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+# 10.0.2.2 is the host from a nested VM
+snapctl set device-service.url=http://10.0.2.2:11029
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-cloud-init-testkeys/task.yaml snapd-2.48.3+20.04/tests/nested/manual/grade-signed-cloud-init-testkeys/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/grade-signed-cloud-init-testkeys/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/grade-signed-cloud-init-testkeys/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,173 @@
+summary: Test that snapd with testkeys on UC20 can boot a model with grade signed.
+
+systems: [ubuntu-20.04-64]
+
+environment:
+  # use tpm + secure boot to get full disk encryption, this is explicitly needed
+  # for grade: secured
+  NESTED_ENABLE_TPM: true
+  NESTED_ENABLE_SECURE_BOOT: true
+
+  # use snapd from the spread run so that we have testkeys trusted in the snapd
+  # run
+  NESTED_BUILD_SNAPD_FROM_CURRENT: true
+
+  # don't use cloud-init to create the user, we manually use cloud-init via
+  # NESTED_PARAM_CD in the test setup
+  NESTED_USE_CLOUD_INIT: false
+
+  # sign all the snaps we build for the image with fakestore
+  NESTED_SIGN_SNAPS_FAKESTORE: true
+
+  # use the testrootorg auto-import assertion
+  # TODO: commit the Go code used to create this assertion from the json file
+  NESTED_CUSTOM_AUTO_IMPORT_ASSERTION: $TESTSLIB/assertions/developer1-auto-import.assert
+
+  NESTED_CUSTOM_MODEL: $TESTSLIB/assertions/developer1-20-signed.model
+  NESTED_IMAGE_ID: cloud-init-signed-testkeys
+
+  # for the fake store
+  NESTED_FAKESTORE_BLOB_DIR: $(pwd)/fake-store-blobdir
+  NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL: http://localhost:11028
+
+  # unset this otherwise ubuntu-image complains about overriding the channel for
+  # a model with grade higher than dangerous when building the image
+  NESTED_CORE_CHANNEL: ""
+
+prepare: |
+  if [ "$TRUST_TEST_KEYS" = "false" ]; then
+      echo "This test needs test keys to be trusted"
+      exit
+  fi
+
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  #shellcheck source=tests/lib/store.sh
+  . "$TESTSLIB"/store.sh
+
+  # setup the fakestore, but don't use it for our snapd here on the host VM, so
+  # tear down the staging_store immediately afterwards so that only the SAS is 
+  # running and our snapd is not pointed at it, ubuntu-image is the only thing 
+  # that actually needs to use the fakestore, and we will manually point it at
+  # the fakestore below using NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL
+  setup_fake_store "$NESTED_FAKESTORE_BLOB_DIR"
+  teardown_staging_store
+
+  echo Expose the needed assertions through the fakestore
+  cp "$TESTSLIB"/assertions/developer1.account "$NESTED_FAKESTORE_BLOB_DIR/asserts"
+  cp "$TESTSLIB"/assertions/developer1.account-key "$NESTED_FAKESTORE_BLOB_DIR/asserts"
+
+  # modify and repack gadget snap to add a defaults section and use our own
+  # prepare-device hook to use the fakedevicesvc
+  mkdir "$(nested_get_extra_snaps_path)"
+
+  # Get the snakeoil key and cert for signing gadget assets (shim)
+  KEY_NAME=$(nested_get_snakeoil_key)
+  SNAKEOIL_KEY="$PWD/$KEY_NAME.key"
+  SNAKEOIL_CERT="$PWD/$KEY_NAME.pem"
+
+  snap download --basename=pc --channel="20/edge" pc
+  unsquashfs -d pc-gadget pc.snap
+
+  # ensure ubuntu-save is there
+  nested_ensure_ubuntu_save pc-gadget
+
+  # delay all refreshes for a week from now, as otherwise refreshes for our
+  # snaps (which are asserted by the testrootorg authority-id) may happen, which
+  # will break things because the signing keys won't match, etc. and 
+  # specifically snap-bootstrap in the kernel snap from the store won't trust
+  # the seed keys to unlock the encrypted data partition in the initramfs
+  sed defaults.yaml -e "s/@HOLD-TIME@/$(date --date='next week' +%Y-%m-%dT%H:%M:%S%:z)/" >> \
+    pc-gadget/meta/gadget.yaml
+
+  # TODO: enable this bit when things are ready to use a testkeys signed model
+  # assertion
+  # copy the prepare-device hook to use our fakedevicesvc
+  # mkdir -p pc-gadget/meta/hooks/
+  # cp prepare-device pc-gadget/meta/hooks/
+
+  nested_secboot_sign_gadget pc-gadget "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+  snap pack pc-gadget/ extra-snaps/
+  rm -rf pc-gadget/
+
+  rm -f "$SNAKEOIL_KEY" "$SNAKEOIL_CERT"
+
+  # TODO: enable this when ready, currently serial assertions requests don't 
+  # work with the fakedevicesvc, needs a little bit of work somewhere
+  # start fake device svc
+  # #shellcheck disable=SC2148
+  #  systemd-run --unit fakedevicesvc fakedevicesvc localhost:11029
+
+  # first boot - legit NoCloud usage
+  nested_build_seed_cdrom "$TESTSLIB/cloud-init-seeds/normal-user" seed.iso cidata user-data meta-data
+
+  # second boot - attacker drive
+  nested_build_seed_cdrom "$TESTSLIB/cloud-init-seeds/attacker-user" seed2.iso cidata user-data meta-data
+
+  "$TESTSTOOLS"/nested-state build-image core
+  # first boot will use seed1 to create the normal-user in addition to the 
+  # system-user assertion
+  "$TESTSTOOLS"/nested-state create-vm core --param-cdrom "-cdrom $(pwd)/seed.iso"
+
+restore: |
+  if [ "$TRUST_TEST_KEYS" = "false" ]; then
+      echo "This test needs test keys to be trusted"
+      exit
+  fi
+
+  # stop fake device svc
+  # systemctl stop fakedevicesvc
+
+  #shellcheck source=tests/lib/store.sh
+  . "$TESTSLIB"/store.sh
+  teardown_fake_store "$NESTED_FAKESTORE_BLOB_DIR"
+
+execute: |
+  if [ "$TRUST_TEST_KEYS" = "false" ]; then
+      echo "This test needs test keys to be trusted"
+      exit
+  fi
+
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  echo "The initial cloud-init user was created"
+  nested_exec "cat /var/lib/extrausers/passwd" | MATCH normal-user
+
+  echo "And we can run things as the normal user"
+  nested_exec_as normal-user ubuntu "sudo true"
+
+  # TODO: check that we got a serial assertion via the fakedevicesvc
+  # for now we just don't get a serial assertion which is fine for the purposes
+  # of this test
+
+  # TODO: is there a better thing we can wait for here instead? maybe the log
+  # message from snapd directly via journalctl ?
+  echo "Waiting for snapd to react to cloud-init"
+  sleep 60
+
+  echo "Ensuring that cloud-init got disabled after running"
+  nested_exec "cloud-init status" | MATCH "status: disabled"
+  nested_exec "test -f /etc/cloud/cloud-init.disabled"
+  nested_exec "! test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
+
+  # gracefully shutdown so that we don't have file corruption
+  echo "Gracefully shutting down the nested VM to prepare a simulated attack"
+  boot_id="$(nested_get_boot_id)"
+  nested_shutdown
+
+  # replace the seed.iso with the new attacker iso
+  mv seed2.iso seed.iso
+
+  echo "Restarting nested VM with attacker cloud-init CD-ROM drive"
+  nested_force_start_vm
+  nested_wait_for_reboot "${boot_id}"
+
+  echo "The cloud-init attacker user was not created"
+  nested_exec "cat /var/lib/extrausers/passwd" | NOMATCH attacker-user
+
+  echo "cloud-init is still disabled"
+  nested_exec "cloud-init status" | MATCH "status: disabled"
+  nested_exec "test -f /etc/cloud/cloud-init.disabled"
+  nested_exec "! test -f /etc/cloud/cloud.cfg.d/zzzz_snapd.cfg"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/minimal-smoke/task.yaml snapd-2.48.3+20.04/tests/nested/manual/minimal-smoke/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/minimal-smoke/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/minimal-smoke/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,36 @@
+summary: execute smoke tests in a nested Ubuntu Core VM that meets the minimal requirements
+
+systems: [ubuntu-16.04-64, ubuntu-18.04-64, ubuntu-20.04-64]
+
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    nested_fetch_spread
+    "$TESTSTOOLS"/nested-state build-image core
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    # see https://docs.ubuntu.com/core/en/#advantages-for-iot for minimum
+    # requirements
+    MINIMAL_MEM=256
+
+    if nested_is_core_20_system ; then
+        NESTED_SPREAD_SYSTEM=ubuntu-core-20-64
+        # TODO:UC20: this should written down in the official docs
+        MINIMAL_MEM=384
+    elif nested_is_core_18_system; then
+        NESTED_SPREAD_SYSTEM=ubuntu-core-18-64
+    elif nested_is_core_16_system; then
+        NESTED_SPREAD_SYSTEM=ubuntu-core-16-64
+    else
+        echo "unsupported nested system"
+        exit 1
+    fi
+
+    "$TESTSTOOLS"/nested-state create-vm core --param-mem "-m $MINIMAL_MEM"
+
+    set +x
+    export SPREAD_EXTERNAL_ADDRESS=localhost:8022
+    "$NESTED_WORK_DIR/spread" -v "external:$NESTED_SPREAD_SYSTEM:tests/smoke/..."
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/preseed/task.yaml snapd-2.48.3+20.04/tests/nested/manual/preseed/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/preseed/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/preseed/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,7 +5,7 @@
   command works, and the resulting image boots and finalizes seeding.
   The test assumes cloud image with a core and lxd snaps in its seeds/.
 
-systems: [ubuntu-19.10-*, ubuntu-20.04-*]
+systems: [ubuntu-2*]
 
 environment:
   IMAGE_MOUNTPOINT: /mnt/cloudimg
@@ -13,31 +13,64 @@
 prepare: |
   #shellcheck source=tests/lib/nested.sh
   . "$TESTSLIB/nested.sh"
-  create_nested_classic_vm
+
+  #shellcheck source=tests/lib/snaps.sh
+  . "$TESTSLIB"/snaps.sh
+
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
+
+  # install the snapd deb from spread so we are using the same version to 
+  # validate the seed as well as call preseed, etc. 
+  dpkg -i "$SPREAD_PATH"/../snapd_*.deb
+
+  # create a VM and mount a cloud image
+  "$TESTSTOOLS"/nested-state build-image classic
   mkdir -p "$IMAGE_MOUNTPOINT"
+  IMAGE_NAME=$(nested_get_image_name classic)
+  mount_ubuntu_image "$NESTED_IMAGES_DIR/$IMAGE_NAME" "$IMAGE_MOUNTPOINT"
+
+  # on 20.04 snapd from the deb is newer than snapd from seeds;
+  # this is not a sensible scenario for preseeding but since
+  # we're cheating and preseeding images that were not meant to be
+  # preseeded in their current state, we need to inject newer snapd
+  # into seeds/ to make snap-preseed and the test happy.
+
+  # add snapd from this branch into the seed
+  repack_snapd_deb_into_snapd_snap "$PWD"
+  mv snapd-from-deb.snap snapd.snap
+  inject_snap_into_seed "$IMAGE_MOUNTPOINT" snapd
+
+  # inject a snap that uses system-usernames into the seed to confirm that works
+  # as expected
+  # TODO: replace this snap with a simpler one instead that is smaller, this one
+  # is 37M, but test-snapd-daemon-user does not have a daemon yet
+  snap download --edge --basename=test-postgres-system-usernames test-postgres-system-usernames
+  inject_snap_into_seed "$IMAGE_MOUNTPOINT" test-postgres-system-usernames
+
+  # for images that are already preseeded, we need to undo the preseeding there
+  echo "Running preseed --reset for already preseeded cloud images"
+  SNAPD_DEBUG=1 /usr/lib/snapd/snap-preseed --reset "$IMAGE_MOUNTPOINT"
 
 restore: |
   #shellcheck source=tests/lib/nested.sh
   . "$TESTSLIB/nested.sh"
-  destroy_nested_vm
+  nested_destroy_vm
 
   # any of the restore commands can fail depending on where execute part stopped,
   # account for that with ||true.
+  #shellcheck source=tests/lib/preseed.sh
+  . "$TESTSLIB/preseed.sh"
   umount_ubuntu_image "$IMAGE_MOUNTPOINT" || true
 
 execute: |
   #shellcheck source=tests/lib/nested.sh
   . "$TESTSLIB/nested.sh"
-
   #shellcheck source=tests/lib/preseed.sh
   . "$TESTSLIB/preseed.sh"
 
-  CLOUD_IMAGE=$(get_nested_classic_image_path)
-  mount_ubuntu_image "$CLOUD_IMAGE" "$IMAGE_MOUNTPOINT"
-  setup_preseeding "$IMAGE_MOUNTPOINT"
-
-  echo "Running pre-seeeding"
-  /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT"
+  echo "Running pre-seeding"
+  /usr/lib/snapd/snap-preseed "$IMAGE_MOUNTPOINT" | MATCH "using snapd binary: /tmp/snapd-preseed/usr/lib/snapd/snapd"
 
   # mark-preseeded task is where snap-preseed stopped, therefore it's in Doing.
   snap debug state "$IMAGE_MOUNTPOINT"/var/lib/snapd/state.json --change=1 | MATCH "Doing .+ mark-preseeded +Mark system pre-seeded"
@@ -49,27 +82,69 @@
   . "$TESTSLIB/preseed.sh"
   umount_ubuntu_image "$IMAGE_MOUNTPOINT"
 
+  "$TESTSTOOLS"/nested-state create-vm classic
+
   #shellcheck source=tests/lib/nested.sh
   . "$TESTSLIB/nested.sh"
-  start_nested_classic_vm
-
+  
   echo "Waiting for firstboot seeding to finish"
-  execute_remote "sudo snap wait system seed.loaded"
-  execute_remote "snap changes" | MATCH "Done .+ Initialize system state"
+  nested_exec "sudo snap wait system seed.loaded"
+  nested_exec "snap changes" | MATCH "Done .+ Initialize system state"
 
   echo "Checking that the system-key after first boot is the same as that from preseeding"
-  # note, this doesn't actually test the functionality, but acts as a canary:
-  # the test is run against a vm image with ubuntu release matching that from spread host;
-  # system-key check can fail if the nested vm image differs too much from the spread host system,
-  # e.g. when the list of apparmor features differs due to significant kernel update.
-  execute_remote "cat /var/lib/snapd/system-key" > system-key.real
-  diff -u -w system-key.real system-key.preseeded
-
-  echo "Checking that lxd snap is operational"
-  execute_remote "snap list" | not MATCH "broken"
-  execute_remote "snap services" | MATCH "lxd.activate +enabled +inactive"
-  execute_remote "snap services" | MATCH "lxd.daemon +enabled +inactive +socket-activated"
-  execute_remote "sudo lxd init --auto"
-  execute_remote "snap services" | MATCH "+lxd.daemon +enabled +active +socket-activated"
 
+  # TODO: re-enable the system-key check when we are using the same kernel for 
+  # the host VM as the nested VM, currently we are not, and as such there is a 
+  # diff between the preseed apparmor-features and the nested VM actual 
+  # system-key
+  if [ "$SPREAD_SYSTEM" != "ubuntu-20.04-64" ]; then
+    # note, this doesn't actually test the functionality, but acts as a canary:
+    # the test is run against a vm image with ubuntu release matching that from spread host;
+    # system-key check can fail if the nested vm image differs too much from the spread host system,
+    # e.g. when the list of apparmor features differs due to significant kernel update.
+    nested_exec "cat /var/lib/snapd/system-key" > system-key.real
+    diff -u -w system-key.real system-key.preseeded
+
+    # also check the system-key diff using snap debug seeding
+
+    # we should not have had any system-key difference as per above, so we 
+    # shouldn't output the preseed system-key or the seed-restart-system-key
+    nested_exec "snap debug seeding" | NOMATCH "preseed-system-key:"
+    nested_exec "snap debug seeding" | NOMATCH "seed-restart-system-key:"
+  fi
+
+  nested_exec "snap debug seeding" | MATCH "preseeded:\s+true"
+  nested_exec "snap debug seeding" | MATCH "seeded:\s+true"
+  # FIXME: this just checks that the time is of the form "xxx.xxxs", which could
+  # break if the preseeding takes more than 60s and golang formats the 
+  # time.Duration as "1m2.03s", etc. but for now this should be good enough
+  nested_exec "snap debug seeding" | MATCH "image-preseeding:\s+[0-9]+\.[0-9]+s"
+  nested_exec "snap debug seeding" | MATCH "seed-completion:\s+[0-9]+\.[0-9]+s"
 
+  echo "Checking that lxd snap is operational"
+  nested_exec "snap list" | not MATCH "broken"
+  nested_exec "snap services" | MATCH "lxd.activate +enabled +inactive"
+  nested_exec "snap services" | MATCH "lxd.daemon +enabled +inactive +socket-activated"
+  nested_exec "sudo lxd init --auto"
+  nested_exec "snap services" | MATCH "+lxd.daemon +enabled +active +socket-activated"
+
+  echo "Checking that the test-postgres-system-usernames snap is operational"
+  nested_exec "sudo snap start --enable test-postgres-system-usernames.postgres"
+  # wait for postgres to come online
+  sleep 10
+  nested_exec "snap services" | MATCH "+test-postgres-system-usernames.postgres +enabled +active"
+
+  echo "Checking that mark-seeded task was executed last"
+  # snap debug timings are sorts by read-time, mark-seeded should be last
+  nested_exec "sudo snap debug timings 1" | tail -2 | MATCH "Mark system seeded"
+  # no task should have ready time after mark-seeded
+  # shellcheck disable=SC2046
+  MARK_SEEDED_TIME=$(date -d $(snap change 1 --abs-time | grep "Mark system seeded" | awk '{print $3}') "+%s")
+  for RT in $(snap change 1 --abs-time | grep Done | awk '{print $3}' )
+  do
+    READY_TIME=$(date -d "$RT" "+%s")
+    if [ "$READY_TIME" -gt "$MARK_SEEDED_TIME" ]; then
+      echo "Unexpected ready time greater than mark-seeded ready"
+      snap change 1
+    fi
+  done
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/refresh-revert-fundamentals/task.yaml snapd-2.48.3+20.04/tests/nested/manual/refresh-revert-fundamentals/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/refresh-revert-fundamentals/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/refresh-revert-fundamentals/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,138 @@
+summary: Refresh and revert the fundamental snaps for uc20
+
+description: |
+    This test validates the fundamental snaps can be refreshed
+    and reverted to the new snaps published to edge channel.
+
+systems: [ubuntu-20.04-*]
+
+environment:
+    NESTED_CORE_CHANNEL: beta
+    NESTED_CORE_REFRESH_CHANNEL: edge
+    NESTED_BUILD_SNAPD_FROM_CURRENT: false
+    NESTED_USE_CLOUD_INIT: true
+    # TODO:UC20: temporarily disable secure boot and encryption support. The
+    # location of encryption keys has changed, thus the nested VM will not boot
+    # until the kernel snap is rebuilt with snapd 2.48.
+    NESTED_ENABLE_SECURE_BOOT: false
+    NESTED_ENABLE_TPM: false
+
+    SNAP/kernel: pc-kernel
+    TRACK/kernel: 20
+
+    SNAP/gadget: pc    
+    TRACK/gadget: 20
+
+    SNAP/snapd: snapd
+    TRACK/snapd: latest
+
+    SNAP/base: core20
+    TRACK/base: latest
+
+prepare: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    
+    FROM_REV="$(nested_get_snap_rev_for_channel "$SNAP" $TRACK/$NESTED_CORE_CHANNEL)"
+    TO_REV="$(nested_get_snap_rev_for_channel "$SNAP" $TRACK/$NESTED_CORE_REFRESH_CHANNEL)"
+
+    if [ "$FROM_REV" = "$TO_REV" ]; then
+        echo "Initial and target revisions are the same, skipping..."
+        touch skip.test
+        exit
+    fi
+
+    "$TESTSTOOLS"/nested-state build-image core
+    "$TESTSTOOLS"/nested-state create-vm core
+
+restore: |
+    if [ -f skip.test ]; then
+        rm -f skip.test
+    fi
+
+debug: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+    nested_exec "snap changes" || true
+
+execute: |
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    if [ -f skip.test ]; then
+        exit
+    fi
+
+    FROM_REV="$(nested_get_snap_rev_for_channel "$SNAP" $TRACK/$NESTED_CORE_CHANNEL)"
+    TO_REV="$(nested_get_snap_rev_for_channel "$SNAP" $TRACK/$NESTED_CORE_REFRESH_CHANNEL)"
+
+    nested_exec "snap list $SNAP" | MATCH "^${SNAP}.*${FROM_REV}.*${TRACK}/${NESTED_CORE_CHANNEL}.*"
+    # The snap is refreshed
+    INITIAL_BOOT_ID=$(nested_get_boot_id)
+    REFRESH_ID=$(nested_exec "sudo snap refresh --no-wait --channel $NESTED_CORE_REFRESH_CHANNEL $SNAP")
+
+    case "$SNAP" in
+        snapd|pc)
+            # We manually reboot even after snapd refresh to ensure that if
+            # resealing took place we are still able to boot
+            # The following commands could fails in case the connection is suddenly
+            # stopped because of the reboot in the nested machine
+            nested_exec "snap watch $REFRESH_ID" || true
+            nested_exec "sudo reboot" || true
+            ;;
+        pc-kernel|core20)
+            # don't manually reboot, wait for automatic snapd reboot
+            ;;
+    esac
+    nested_wait_for_reboot "$INITIAL_BOOT_ID"
+    SECOND_BOOT_ID=$(nested_get_boot_id)
+
+    # Check the new version of the snaps is correct after the system reboot
+    nested_exec "snap list $SNAP" | MATCH "^${SNAP}.*${TO_REV}.*${TRACK}/${NESTED_CORE_REFRESH_CHANNEL}.*"
+
+    # We check the change is completed
+    case "$SNAP" in
+        pc-kernel|core20)
+            for _ in $(seq 10); do
+                if nested_exec "snap changes" | MATCH "$REFRESH_ID\s+Done\s+.*"; then
+                    break
+                fi
+                sleep 1
+            done
+            nested_exec "snap changes" | MATCH "$REFRESH_ID\s+Done\s+.*"
+            ;;
+    esac
+
+    # The snap is reverted
+    REVERT_ID=$(nested_exec "sudo snap revert --no-wait $SNAP")
+
+    case "$SNAP" in
+        snapd|pc)
+            # we manually reboot even after snapd refresh to ensure that if
+            # resealing took place we are still able to boot
+            # The following commands could fails in case the connection is suddenly
+            # stopped because of the reboot in the nested machine
+            nested_exec "snap watch $REVERT_ID" || true
+            nested_exec "sudo reboot" || true
+            ;;
+        pc-kernel|core20)
+            # don't manually reboot, wait for automatic snapd reboot
+            ;;
+    esac
+    nested_wait_for_reboot "$SECOND_BOOT_ID"
+
+    # Check the version of the snaps after the revert is correct
+    nested_exec "snap list $SNAP" | MATCH "^${SNAP}.*${FROM_REV}.*${TRACK}/${NESTED_CORE_REFRESH_CHANNEL}.*"
+
+    # We check the change is completed
+    case "$SNAP" in
+        pc-kernel|core20)
+            for _ in $(seq 10); do
+                if nested_exec "snap changes" | MATCH "$REVERT_ID\s+Done\s+.*"; then
+                    break
+                fi
+                sleep 1
+            done
+            nested_exec "snap changes" | MATCH "$REVERT_ID\s+Done\s+.*"
+            ;;
+    esac
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/snapd-refresh-from-old/task.yaml snapd-2.48.3+20.04/tests/nested/manual/snapd-refresh-from-old/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/snapd-refresh-from-old/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/snapd-refresh-from-old/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,71 @@
+summary: Test snapd refresh from a very old snapd snap.
+details: |
+  Test that a refresh from a very old snapd and core18 to a recent one succeeds.
+
+systems: [ubuntu-18.04-*]
+
+environment:
+  # test variants:
+  # latest_only refreshes to snapd from current source tree only,
+  # edge_first refreshes to snapd/core18 from edge, then to current snapd.
+  VARIANT/latest_only: latest_only
+  VARIANT/edge_first: edge_first
+  NESTED_BUILD_SNAPD_FROM_CURRENT: false
+  NESTED_IMAGE_ID: snapd-refresh-from-old
+  SNAPD_SNAP_URL: https://storage.googleapis.com/spread-snapd-tests/snaps/snapd_2.45.2_5760.snap
+  CORE18_SNAP_URL: https://storage.googleapis.com/spread-snapd-tests/snaps/core18_20191126_1279.snap
+
+prepare: |
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  #shellcheck source=tests/lib/snaps.sh
+  . "$TESTSLIB"/snaps.sh
+
+  mkdir extra-snaps
+  wget -P extra-snaps "$SNAPD_SNAP_URL" "$CORE18_SNAP_URL"
+
+  # create core image with old snapd & core18
+  "$TESTSTOOLS"/nested-state build-image core
+  "$TESTSTOOLS"/nested-state create-vm core
+
+  # for refresh in later step of the test
+  repack_snapd_deb_into_snapd_snap "$PWD"
+
+execute: |
+  #shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  nested_exec "sudo snap wait system seed.loaded"
+  nested_exec "snap list" | MATCH "snapd.*5760"
+  nested_exec "snap list" | MATCH "core18.*1279"
+
+  INITIAL_BOOT_ID=$(nested_get_boot_id)
+
+  if [ "$SPREAD_VARIANT" = "edge_first" ]; then
+    # refresh to latest snapd from store, this will drop from ssh.
+    echo "Refreshing snapd and core18 from the store"
+    nested_exec "sudo snap refresh" || true
+
+    nested_wait_for_reboot "$INITIAL_BOOT_ID"
+    if nested_exec "snap list snapd" | MATCH "snapd.*5760"; then
+      echo "unexpected snapd rev 5760"
+      exit 1
+    fi
+
+    # this change is not immediately done and needs a retry
+    for _ in $(seq 1 10); do
+      if nested_exec "snap changes" | MATCH ".* Done .* Refresh snaps.*\"snapd\""; then
+        break
+      fi
+      sleep 1
+    done
+
+    nested_exec "snap changes" | MATCH ".* Done .* Refresh snaps.*\"snapd\""
+    nested_exec "snap changes" | MATCH ".* Done .* Refresh snaps.*\"core18\""
+  fi
+
+  echo "Now refresh snapd with current tree"
+  nested_copy "snapd-from-deb.snap"
+  nested_exec "sudo snap install snapd-from-deb.snap --dangerous" || true
+  nested_exec "snap list snapd" | MATCH "snapd .* x1 "
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/uc20-create-partitions-encrypt/task.yaml snapd-2.48.3+20.04/tests/nested/manual/uc20-create-partitions-encrypt/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/uc20-create-partitions-encrypt/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/uc20-create-partitions-encrypt/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,107 +0,0 @@
-summary: Integration tests for the snap-bootstrap binary
-
-# use the same system and tooling as uc20
-systems: [ubuntu-20.04-64]
-
-debug: |
-    cat /proc/partitions
-
-restore: |
-    if [[ -d ./mnt ]]; then
-        umount ./mnt || true
-    fi
-    umount /dev/mapper/ubuntu-data || true
-    umount /dev/mapper/test-udata || true
-
-    cryptsetup close /dev/mapper/ubuntu-data || true
-    cryptsetup close /dev/mapper/test-udata || true
-
-    if [ -f loop.txt ]; then
-        losetup -d "$(cat loop.txt)"
-    fi
-    apt remove -y cryptsetup
-
-prepare: |
-    echo "Create a fake block device image that looks like an image from u-i"
-    truncate --size=10GB fake.img
-
-    apt install -y cryptsetup
-
-    echo "Setup the image as a block device"
-    losetup -fP fake.img
-    losetup -a |grep fake.img|cut -f1 -d: > loop.txt
-    LOOP="$(cat loop.txt)"
-
-    echo "Create a partition that looks like a uc20 image"
-    cat <<EOF | sfdisk "$LOOP"
-    label: gpt
-
-    start=2048, size=2048, type=21686148-6449-6E6F-744E-656564454649, name="BIOS Boot"
-    start=4096, size=2457600, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, name="ubuntu-seed"
-    EOF
-    udevadm trigger --settle "${LOOP}p2"
-    mkfs.vfat "${LOOP}p2"
-    udevadm trigger --settle "${LOOP}p2"
-    echo "Double check that we got the expected partitions"
-    sfdisk -l "$LOOP" | MATCH 'BIOS boot'
-    sfdisk -l "$LOOP" | MATCH 'EFI System'
-
-    echo "Get the UC20 gadget"
-    snap download --channel=20/edge pc
-    unsquashfs -d gadget-dir pc_*.snap
-
-execute: |
-    LOOP="$(cat loop.txt)"
-    echo "Run the snap-bootstrap tool"
-    /usr/lib/snapd/snap-bootstrap create-partitions --mount \
-        --encrypt --key-file keyfile \
-        --recovery-key-file /run/mnt/ubuntu-data/system-data/recovery-key \
-        ./gadget-dir "$LOOP"
-
-    echo "Check that the key file was created"
-    test "$(stat --printf="%s" ./keyfile)" = 64
-
-    echo "Check that the partitions are created"
-    sfdisk -d "$LOOP" | MATCH "^${LOOP}p1 .*size=\s*2048, type=21686148-6449-6E6F-744E-656564454649,.*BIOS Boot"
-    sfdisk -d "$LOOP" | MATCH "^${LOOP}p2 .*size=\s*2457600, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B,.*ubuntu-seed"
-    sfdisk -d "$LOOP" | MATCH "^${LOOP}p3 .*size=\s*1536000, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4,.*ubuntu-boot"
-    sfdisk -d "$LOOP" | MATCH "^${LOOP}p4 .*size=\s*15533521, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4,.*ubuntu-data"
-
-    not cryptsetup isLuks "${LOOP}p1"
-    not cryptsetup isLuks "${LOOP}p2"
-    not cryptsetup isLuks "${LOOP}p3"
-    cryptsetup isLuks "${LOOP}p4"
-
-    cryptsetup luksDump "${LOOP}p4" | MATCH 'Label:\s*ubuntu-data-enc'
-
-    # we used "lsblk --fs" here but it was unreliable
-    df -T "${LOOP}p3" | MATCH ext4
-    file -s "${LOOP}p3" | MATCH 'volume name "ubuntu-boot"'
-
-    df -T /dev/mapper/ubuntu-data | MATCH ext4
-    POSIXLY_CORRECT=1 file -s /dev/mapper/ubuntu-data | MATCH 'volume name "ubuntu-data"'
-
-    echo "Check that the filesystem content was deployed"
-    ls /run/mnt/ubuntu-boot/EFI/boot/grubx64.efi
-    ls /run/mnt/ubuntu-boot/EFI/boot/bootx64.efi
-    ls /run/mnt/ubuntu-boot/EFI/ubuntu/grub.cfg
-
-    umount /run/mnt/ubuntu-boot
-    umount /run/mnt/ubuntu-data
-    cryptsetup close /dev/mapper/ubuntu-data
-
-    echo "Ensure that we can open the encrypted device using the key"
-    mkdir -p ./mnt
-    cryptsetup open --key-file keyfile "${LOOP}p4" test-udata
-    mount /dev/mapper/test-udata ./mnt
-    echo "Check that the recovery key was stored"
-    test "$(stat --printf="%s" ./mnt/system-data/recovery-key)" = 16
-    cp ./mnt/system-data/recovery-key .
-    umount ./mnt
-    cryptsetup close /dev/mapper/test-udata
-
-    echo "Ensure that we can open the encrypted device using the recovery key"
-    cryptsetup open --key-file recovery-key "${LOOP}p4" test-recovery
-    mount /dev/mapper/test-recovery ./mnt
-    umount ./mnt
-    cryptsetup close /dev/mapper/test-recovery
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/uc20-fde-hooks/task.yaml snapd-2.48.3+20.04/tests/nested/manual/uc20-fde-hooks/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/uc20-fde-hooks/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/uc20-fde-hooks/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+summary: Check that the fde-setup hooks work
+
+# this is a UC20 specific test
+systems: [ubuntu-20.04-64]
+
+environment:
+    NESTED_IMAGE_ID: core20-fde-setup
+    NESTED_ENABLE_TPM: false
+    NESTED_ENABLE_SECURE_BOOT: false
+    NESTED_BUILD_SNAPD_FROM_CURRENT: true
+    NESTED_ENABLE_OVMF: true
+    GO111MODULE: off
+
+prepare: |
+  echo "Build a kernel snap with the fde-setup hook"
+  # shellcheck source=tests/lib/prepare.sh
+  . "$TESTSLIB/prepare.sh"
+  # shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+  mkdir ./extra-snaps
+  # build fde-reveal-key hook into the "extra-initrd" dir so that the
+  # nested_create_core_vm picks this up
+  mkdir -p ./extra-initrd/usr/bin/
+  go build -o ./extra-initrd/usr/bin/fde-reveal-key "$TESTSLIB"/fde-setup-hook/fde-setup.go
+
+  # create fde-setup hook inside the kernel
+  mkdir -p ./extra-kernel-snap/meta/hooks
+  go build -o ./extra-kernel-snap/meta/hooks/fde-setup "$TESTSLIB"/fde-setup-hook/fde-setup.go
+  nested_create_core_vm
+  # start it
+  nested_start_core_vm
+
+execute: |
+  # shellcheck source=tests/lib/nested.sh
+  . "$TESTSLIB/nested.sh"
+
+  # check that we have an encrypted system
+  nested_exec "find /dev/mapper" | MATCH ubuntu-data-[0-9a-f-]+
+  nested_exec "test -e /var/lib/snapd/device/fde/recovery.key"
+  nested_exec "test -e /run/mnt/ubuntu-boot/device/fde/ubuntu-data.sealed-key"
+  nested_exec "test -e /run/mnt/ubuntu-seed/device/fde/ubuntu-data.recovery.sealed-key"
+  nested_exec "test -e /run/mnt/ubuntu-seed/device/fde/ubuntu-save.recovery.sealed-key"
diff -Nru snapd-2.45.1+20.04.2/tests/nested/manual/uc20-storage-safety/task.yaml snapd-2.48.3+20.04/tests/nested/manual/uc20-storage-safety/task.yaml
--- snapd-2.45.1+20.04.2/tests/nested/manual/uc20-storage-safety/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nested/manual/uc20-storage-safety/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,71 @@
+summary: Test that storage-safety prefer-unencrypted works
+
+systems: [ubuntu-20.04-64]
+
+environment:
+    NESTED_ENABLE_TPM: true
+    NESTED_ENABLE_SECURE_BOOT: true
+    NESTED_BUILD_SNAPD_FROM_CURRENT: true
+    NESTED_USE_CLOUD_INIT: true
+
+    MODEL_STORAGE_SAFETY/preferunencrypted: prefer-unencrypted
+    NESTED_CUSTOM_MODEL: $TESTSLIB/assertions/developer1-20-storage-safety-${MODEL_STORAGE_SAFETY}.model
+    NESTED_IMAGE_ID: core20-storage-safety-${MODEL_STORAGE_SAFETY}
+    NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL: http://localhost:11028
+    NESTED_FAKESTORE_BLOB_DIR: $(pwd)/fake-store-blobdir
+
+prepare: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+  
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    #shellcheck source=tests/lib/store.sh
+    . "$TESTSLIB"/store.sh
+
+    # setup the fakestore, but don't use it for our snapd here on the
+    # host VM, so tear down the staging_store immediately afterwards
+    # so that only the SAS is running and our snapd is not pointed at
+    # it, ubuntu-image is the only thing that actually needs to use
+    # the fakestore, and we will manually point it at the fakestore
+    # below using NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL
+    setup_fake_store "$NESTED_FAKESTORE_BLOB_DIR"
+    teardown_staging_store
+
+    echo Expose the needed assertions through the fakestore
+    cp "$TESTSLIB"/assertions/developer1.account "$NESTED_FAKESTORE_BLOB_DIR/asserts"
+    cp "$TESTSLIB"/assertions/developer1.account-key "$NESTED_FAKESTORE_BLOB_DIR/asserts"
+
+    "$TESTSTOOLS"/nested-state build-image core
+    "$TESTSTOOLS"/nested-state create-vm core
+
+restore: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+
+    #shellcheck source=tests/lib/store.sh
+    . "$TESTSLIB"/store.sh
+    teardown_fake_store "$NESTED_FAKESTORE_BLOB_DIR"
+
+execute: |
+    if [ "$TRUST_TEST_KEYS" = "false" ]; then
+        echo "This test needs test keys to be trusted"
+        exit
+    fi
+
+    #shellcheck source=tests/lib/nested.sh
+    . "$TESTSLIB/nested.sh"
+
+    echo "Verify that no fde keys are generated"
+    nested_exec "test ! -d /var/lib/snapd/device/fde"
+
+    # TODO: once we have a install-mode log (PR#9545) we could grep
+    #       "installing system unencrypted because of ..."
+
+    # check that data is mounted from a regular device, not a mapper
+    nested_exec "mount" | MATCH "/dev/[svh]da[45] on /run/mnt/data"
diff -Nru snapd-2.45.1+20.04.2/tests/nightly/classic-ubuntu-core-transition-auth/task.yaml snapd-2.48.3+20.04/tests/nightly/classic-ubuntu-core-transition-auth/task.yaml
--- snapd-2.45.1+20.04.2/tests/nightly/classic-ubuntu-core-transition-auth/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nightly/classic-ubuntu-core-transition-auth/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -20,9 +20,17 @@
     . "$TESTSLIB/changes.sh"
     snap change "$(change_id 'Transition ubuntu-core to core')" || true
 
+restore: |
+    "$TESTSTOOLS"/fs-state restore-file /root/.snap/auth.json
+    "$TESTSTOOLS"/fs-state restore-dir /root/.snap
+
+    "$TESTSTOOLS"/fs-state restore-file /home/test/.snap/auth.json
+    "$TESTSTOOLS"/fs-state restore-dir /home/test/.snap
+
 execute: |
     #shellcheck source=tests/lib/pkgdb.sh
     . "$TESTSLIB/pkgdb.sh"
+
     echo "Ensure core is gone and we have ubuntu-core instead"
     distro_purge_package snapd
     distro_install_build_snapd
@@ -34,9 +42,12 @@
     snap ack ./ubuntu-core_*.assert
     snap install ./ubuntu-core_*.snap
 
-    mkdir -p /root/.snap/
+    "$TESTSTOOLS"/fs-state mock-dir /root/.snap
+    "$TESTSTOOLS"/fs-state mock-file /root/.snap/auth.json
     echo '{}' > /root/.snap/auth.json
-    mkdir -p /home/test/.snap/
+
+    "$TESTSTOOLS"/fs-state mock-dir /home/test/.snap
+    "$TESTSTOOLS"/fs-state mock-file /home/test/.snap/auth.json
     echo '{}' > /home/test/.snap/auth.json
 
     echo "Ensure transition is triggered"
diff -Nru snapd-2.45.1+20.04.2/tests/nightly/install-snaps/task.yaml snapd-2.48.3+20.04/tests/nightly/install-snaps/task.yaml
--- snapd-2.45.1+20.04.2/tests/nightly/install-snaps/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nightly/install-snaps/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -89,7 +89,7 @@
     fi
 
     if [ "$SNAP" = lxd ]; then
-        lxd-tool undo-lxd-mount-changes
+        "$TESTSTOOLS"/lxd-state undo-mount-changes
     fi
 
 execute: |
diff -Nru snapd-2.45.1+20.04.2/tests/nightly/interfaces-openvswitch/task.yaml snapd-2.48.3+20.04/tests/nightly/interfaces-openvswitch/task.yaml
--- snapd-2.45.1+20.04.2/tests/nightly/interfaces-openvswitch/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nightly/interfaces-openvswitch/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,7 +2,7 @@
 
 # Openvswitch getting stuck during installation sporadically on ubuntu-14.04-64
 # Openvswitch service not available on the following systems
-systems: [-ubuntu-core-*, -opensuse-*, -amazon-*, -arch-linux-*, -centos-7-*, -ubuntu-14.04-64]
+systems: [-ubuntu-core-*, -opensuse-*, -amazon-*, -arch-linux-*, -centos-*, -ubuntu-14.04-64]
 
 details: |
     The openvswitch interface allows to task to the openvswitch socket (rw mode).
diff -Nru snapd-2.45.1+20.04.2/tests/nightly/sbuild/task.yaml snapd-2.48.3+20.04/tests/nightly/sbuild/task.yaml
--- snapd-2.45.1+20.04.2/tests/nightly/sbuild/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nightly/sbuild/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,9 +16,9 @@
     echo "Allow test user to run sbuild"
     sbuild-adduser test
 
-    BUILD_PARAM=""
+    BUILD_PARAM="--verbose --debug"
     if [ "$BUILD_MODE" == "any" ]; then
-        BUILD_PARAM="--arch-any"
+        BUILD_PARAM="$BUILD_PARAM --arch-any"
     fi
 
     echo "Build mode: $BUILD_MODE"
diff -Nru snapd-2.45.1+20.04.2/tests/nightly/unity/task.yaml snapd-2.48.3+20.04/tests/nightly/unity/task.yaml
--- snapd-2.45.1+20.04.2/tests/nightly/unity/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/nightly/unity/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,37 +0,0 @@
-summary: Check that a unity snap can start and its window is shown
-
-environment:
-    DISPLAY: ":99.0"
-
-systems: [ubuntu-16.04-64]
-
-prepare: |
-    # the file /etc/init/tty1.conf is present in the default images, upstart
-    # (which is installed as a dependency of the required packages) ships it
-    # and doesn't install cleanly if that file is in place
-    if [ -f /etc/init/tty1.conf ]; then
-        mv /etc/init/tty1.conf /etc/init/tty1.conf.back
-    fi
-
-    apt install -y --no-install-recommends unity
-
-disabled_restore: |
-    systemctl stop unity-app
-    apt autoremove -y --purge unity
-
-    if [ -f /etc/init/tty1.conf.back ]; then
-        mv /etc/init/tty1.conf.back /etc/init/tty1.conf
-    fi
-
-execute: |
-    echo "Given a unity snap is installed"
-    snap install ubuntu-clock-app
-
-    echo "When the app is started"
-    systemd-run --unit unity-app --setenv=DISPLAY="$DISPLAY" --uid "$(id -u test)" "$(command -v xvfb-run)" --server-args="$DISPLAY -screen 0 1200x960x24 -ac +extension RANDR" "$(command -v ubuntu-clock-app.clock)"
-
-    echo "Then the app window is created"
-    expected='.*?\"qmlscene: clockMainView\": \(\"qmlscene\" \"com\.ubuntu\.clock\"\)'
-    while ! xwininfo -tree -root | grep -Pq "$expected"; do
-        sleep 1;
-    done
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1595444/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1595444/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1595444/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1595444/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,9 +10,7 @@
 
 prepare: |
     echo "Having installed the test snap"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     echo "Hanving created a directory not present in the core snap"
     mkdir -p "/foo"
 
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1597839/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1597839/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1597839/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1597839/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,9 +9,7 @@
 
 prepare: |
     echo "Having installed the test snap"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
 execute: |
     echo "We can ensure that the /lib/modules/$(uname -r) directory exists"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1597842/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1597842/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1597842/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1597842/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -10,10 +10,8 @@
 
 prepare: |
     echo "Having installed the test snap"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
     # NOTE: devmode is required because there's no interface for reading /usr/src/.canary
-    install_local_devmode test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools --devmode
     echo "Having prepared a canary file in /usr/src/.canary"
     mv /usr/src /usr/src.orig || true
     mkdir -p /usr/src
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1606277/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1606277/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1606277/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1606277/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,10 +9,8 @@
     even if the log-observe interface is being used.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
     echo "Having installed a test snap"
-    install_local log-observe-consumer
+    "$TESTSTOOLS"/snaps-state install-local log-observe-consumer
     echo "And having connected the log-observe interface"
     snap connect log-observe-consumer:log-observe :log-observe
 
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1607796/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1607796/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1607796/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1607796/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,9 +2,7 @@
 
 prepare: |
     echo "Having installed a test snap in devmode"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local_devmode test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools --devmode
     echo "Having added a canary file in /root"
     echo "test" > /root/canary
 
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1615113/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1615113/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1615113/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1615113/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,10 +2,8 @@
 
 prepare: |
     echo "Having installed a pair of snaps that share content"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-content-slot
-    install_local test-snapd-content-plug
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-slot
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-content-plug
     echo "We can connect them together"
     snap connect test-snapd-content-plug:shared-content-plug test-snapd-content-slot:shared-content-slot
 
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1618683/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1618683/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1618683/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1618683/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -8,9 +8,7 @@
 
 prepare: |
     echo "Having installed a test snap in devmode"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local_devmode test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools --devmode
 
     if [[ "$SPREAD_SYSTEM" == centos-* ]]; then
         # RHEL/Centos 7.4+ set this to 0 by default
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1630479/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1630479/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1630479/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1630479/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -9,9 +9,7 @@
 
 prepare: |
     echo "Having installed a test snap"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local_devmode test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools --devmode
 
 execute: |
     #shellcheck source=tests/lib/dirs.sh
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1644439/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1644439/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1644439/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1644439/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -19,9 +19,7 @@
 
 prepare: |
     echo "Having installed the test snap in devmode"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local_devmode test-snapd-tools
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-tools --devmode
 
 debug: |
     # Kernel version is an important input in understing failures of this test
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1665004/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1665004/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1665004/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1665004/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -7,9 +7,7 @@
     the user.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     if [ -d /var/lib/snapd/hostfs ]; then
         rmdir /var/lib/snapd/hostfs;
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1704860/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1704860/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1704860/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1704860/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -19,9 +19,7 @@
     this is safe to do.
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local_classic test-snapd-classic-confinement
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
     # We don't want to see SNAP_DID_REEXEC being set.
     if snap run --shell test-snapd-classic-confinement ./snap-env-query.sh | grep 'SNAP_DID_REEXEC='; then
         echo "SNAP_DID_REEXEC environment is set - it should *not* be set ever"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1732555/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1732555/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1732555/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1732555/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,9 +5,7 @@
     contained unknown interfaces in either plugs or slots.
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local_devmode test-snapd-unknown-interfaces
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-unknown-interfaces --devmode
 
 execute: |
     echo "Snapd did not die on us"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1797556/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1797556/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1797556/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1797556/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -4,9 +4,7 @@
     user. To avoid hijacking commands and allow sandbox escape, writing to this
     directory is denied.
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     su -l -c 'mkdir -p /home/test/bin/' test
     su -l -c 'mkdir -p /home/test/snap/test-snapd-sh/common/' test
     su -l -c 'touch /home/test/snap/test-snapd-sh/common/evil-2' test
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1802581/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1802581/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1802581/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1802581/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -32,7 +32,7 @@
     # shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB/systemd.sh"
     echo "Create/enable fake gpio"
-    systemd_create_and_start_persistent_unit fake-gpio "$TESTSLIB/fakegpio/fake-gpio.py"  '[Unit]\nBefore=snap.core.interface.gpio-100.service\n[Service]\nType=notify'
+    systemd_create_and_start_unit fake-gpio "$TESTSLIB/fakegpio/fake-gpio.py"  '[Unit]\nBefore=snap.core.interface.gpio-100.service\n[Service]\nType=notify'
 
 restore: |
     # Core image that were created using spread will have a fake "gpio-pin".
@@ -45,12 +45,12 @@
 
     # shellcheck source=tests/lib/systemd.sh
     . "$TESTSLIB/systemd.sh"
-    system_stop_and_remove_persistent_unit fake-gpio
+    systemd_stop_and_remove_unit fake-gpio
     # for good measure, fake-gpio.py does this umount already on exit
     umount /sys/class/gpio || true
 
 debug: |
-    journalctl -u fake-gpio.service
+    "$TESTSTOOLS"/journal-state get-log -u fake-gpio.service
 
 execute: |
     # Core image that were created using spread will have a fake "gpio-pin".
@@ -62,9 +62,7 @@
     fi
 
     echo "Install a snap that uses the gpio consumer"
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local gpio-consumer
+    "$TESTSTOOLS"/snaps-state install-local gpio-consumer
 
     echo "And connect the gpio pin"
     snap connect gpio-consumer:gpio :gpio-pin
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1803535/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1803535/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1803535/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1803535/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,8 +1,6 @@
 summary: regression test for https://bugs.launchpad.net/snapd/+bug/1803535
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-lp-1803535
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-lp-1803535
 execute: |
     # If we can construct the layout and execute /bin/true we are fine.
     test-snapd-lp-1803535.sh -c /bin/true
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1803542/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1803542/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1803542/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1803542/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,14 +5,10 @@
     VARIANT/shared: shared
     VARIANT/private: private
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
-    #shellcheck source=tests/lib/dirs.sh
-    . "$TESTSLIB/dirs.sh"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     # Ensure that every snap namespace is discarded.
     for name in $(snap list | awk '!/Name/ {print $1}'); do
-        "$LIBEXECDIR"/snapd/snap-discard-ns "$name"
+        snapd.tool exec snap-discard-ns "$name"
     done
     if findmnt --noheadings /run/snapd/ns >/dev/null; then
         umount /run/snapd/ns
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1805838/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1805838/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1805838/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1805838/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -6,9 +6,7 @@
 prepare: |
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
-    install_local network-consumer
+    "$TESTSTOOLS"/snaps-state install-local network-consumer
 
     version_info="$(sed -n '2 s/# //p' < /var/lib/snapd/seccomp/bpf/snap.network-consumer.network-consumer.src)"
     test -n "$version_info"
@@ -38,10 +36,17 @@
     mv /var/lib/snapd/system-key.orig /var/lib/snapd/system-key || true
     rm -f bad-snap-seccomp
 
+    # XXX: When this test is sequenced immediately before a test in the main
+    # suite something in this test or in the suite prepare/restore logic is
+    # wrong and we leave the system in a state where "snap run" hangs, waiting
+    # for the system key to match. It might be related to the fact that prepare
+    # restores and restore prepares (really) and we archive and preserve a
+    # broken state somehow.
+
 execute: |
     systemctl stop snapd.socket snapd.service
     systemctl start snapd.socket snapd.service
-    retry-tool -n10 sh -c "journalctl -u snapd | MATCH 'cannot regenerate seccomp profiles'"
-    retry-tool -n10 sh -c "journalctl -u snapd | MATCH 'cannot compile /var/lib/snapd/seccomp/bpf/snap.network-consumer.network-consumer.src: exit status 1'"
+    retry -n10 sh -c "journalctl -u snapd | MATCH 'cannot regenerate seccomp profiles'"
+    retry -n10 sh -c "journalctl -u snapd | MATCH 'cannot compile /var/lib/snapd/seccomp/bpf/snap.network-consumer.network-consumer.src: exit status 1'"
     snap list | MATCH "(core|snapd)"
     test ! -e /var/lib/snapd/system-key
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1813365/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1813365/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1813365/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1813365/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,5 +1,5 @@
 summary: Regression check for https://bugs.launchpad.net/snapd/+bug/1813365
-systems: [ubuntu-*, ubuntu-core-*, debian-*]
+systems: [ubuntu-1*, ubuntu-2*, ubuntu-core-*, debian-*]
 prepare: |
     mount --bind logger "$(command -v adduser)"
     mount --bind logger "$(command -v passwd)"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1813963/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1813963/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1813963/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1813963/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -5,25 +5,23 @@
 backends: [-external]
 
 prepare: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB"/snaps.sh
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB"/dirs.sh
     # Install the versatile test snap.
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
     # Discard the mount namespace in case the snap has any hooks. We rely on
     # the mount namespace to be absent and about to be constructed in the test
     # below.
-    "$LIBEXECDIR"/snapd/snap-discard-ns test-snapd-sh
+    snapd.tool exec snap-discard-ns test-snapd-sh
 
     # Install a simple service snap. This snap has a single service that just
     # runs for an hour and quits. The point is that it is just one service
     # without anything special about it.
     #
     # For the purpose of the test we want the service to be off.
-    install_local test-snapd-simple-service
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-simple-service
     systemctl stop snap.test-snapd-simple-service.test-snapd-simple-service.service
-    "$LIBEXECDIR"/snapd/snap-discard-ns test-snapd-simple-service
+    snapd.tool exec snap-discard-ns test-snapd-simple-service
 
     # Nothing should have been denied yet.
     test "$(dmesg | grep -c DENIED)" -eq 0
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1815722/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1815722/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1815722/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1815722/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,13 +1,8 @@
 summary: regression test for https://bugs.launchpad.net/snapd/+bug/1815722
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-
-    install_local snap-hooks-bad-install || true
+    "$TESTSTOOLS"/snaps-state install-local snap-hooks-bad-install || true
 
     test ! -e /var/lib/snapd/ns/snap-hooks-bad-install.mnt
     test ! -e /var/lib/snapd/ns/snap.snap-hooks-bad-install.fstab
 restore: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/dirs.sh"
-    "$LIBEXECDIR/snapd/snap-discard-ns" snap-hooks-bad-install
+    snapd.tool exec snap-discard-ns snap-hooks-bad-install
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1815869/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1815869/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1815869/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1815869/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -57,7 +57,7 @@
     lxc delete --force xenial || true
 
     snap remove --purge lxd
-    lxd-tool undo-lxd-mount-changes
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
 
 execute: |
     # Run python0 with a hello.py script and redirect the logs to /var/lib/test/hello.log
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1848567/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1848567/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1848567/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1848567/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,9 +21,9 @@
     # Re-compile the apparmor profile for snap-update-ns for the
     # test-snapd-app snap while ensuring that the profile is not loaded
     # into kernel memory and that the compiler is not using any existing
-    # caches. Use memory-tool(1) to record the maximum resident memory usage
+    # caches. Use memory-observe-do to record the maximum resident memory usage
     # and store it in a file.
-    memory-tool -o memory-kb.txt apparmor_parser \
+    "$TESTSTOOLS"/memory-observe-do -o memory-kb.txt apparmor_parser \
       --skip-read-cache --skip-cache --skip-kernel-load -Ono-expr-simplify \
       /var/lib/snapd/apparmor/profiles/snap-update-ns.test-snapd-app
     # Without de-duplicating mount rules the compiler would take about 1.5GB on a
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1862637/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1862637/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1862637/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1862637/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -2,16 +2,57 @@
 prepare: |
     snap pack test-snapd-app
     snap install --dangerous ./test-snapd-app_1_all.snap
-    if [ -d /var/lib/dhcp ]; then
-        touch /var/lib/dhcp/.canary
-    fi
 restore: |
-    if [ -d /var/lib/dhcp ]; then
-        rm -f /var/lib/dhcp/.canary
-    fi
+    rm -f /var/lib/dhcp/.canary
     snap remove test-snapd-app
     rm -f test-snapd-app_1_all.snap
 execute: |
-    if [ -d /var/lib/dhcp ]; then
+    # The snap always sees /var/lib/dhcp. 
+    test-snapd-app.sh -c 'test -d /var/lib/dhcp'
+    if [[ "$SPREAD_SYSTEM" != ubuntu-core-16-* ]]; then
+        if [ -d /var/lib/dhcp ]; then
+            # Variant 1) The host is not a core16 system and has /var/lib/dhcp
+            # Directory is bind mounted and writable when the interface is
+            # connected.
+            touch /var/lib/dhcp/.canary
+            test-snapd-app.sh -c 'test ! -f /var/lib/dhcp/.canary'
+
+            snap connect test-snapd-app:network-control
+            test-snapd-app.sh -c 'test -f /var/lib/dhcp/.canary'
+            test-snapd-app.sh -c 'echo hi > /var/lib/dhcp/.canary'
+            test "$(cat /var/lib/dhcp/.canary)" = hi
+
+            snap disconnect test-snapd-app:network-control
+            test-snapd-app.sh -c 'test ! -f /var/lib/dhcp/.canary'
+            not test-snapd-app.sh -c 'echo bye > /var/lib/dhcp/.canary'
+            test "$(cat /var/lib/dhcp/.canary)" = hi
+        else
+            # Variant 2) The host is not a core16 system but lacks /var/lib/dhcp
+            # Directory is not created on the host and is not bind mounted.
+            # Snaps always see read only, empty directory.
+            test-snapd-app.sh -c 'test ! -f /var/lib/dhcp/.canary'
+
+            snap connect test-snapd-app:network-control
+            not test-snapd-app.sh -c 'echo hi > /var/lib/dhcp/.canary'
+            test-snapd-app.sh -c 'test ! -f /var/lib/dhcp/.canary'
+
+            snap disconnect test-snapd-app:network-control
+            not test-snapd-app.sh -c 'echo bye > /var/lib/dhcp/.canary'
+            test-snapd-app.sh -c 'test ! -f /var/lib/dhcp/.canary'
+        fi
+    else
+        # Variant 3) The host is a core16 system.
+        # Directory is always, effectively, bind mounted.
+        # Writing permission depends on interface connection.
+        touch /var/lib/dhcp/.canary
+        test-snapd-app.sh -c 'test -f /var/lib/dhcp/.canary'
+
+        snap connect test-snapd-app:network-control
         test-snapd-app.sh -c 'test -f /var/lib/dhcp/.canary'
+        test-snapd-app.sh -c 'echo hi > /var/lib/dhcp/.canary'
+        test "$(cat /var/lib/dhcp/.canary)" = hi
+
+        snap disconnect test-snapd-app:network-control
+        not test-snapd-app.sh -c 'echo bye > /var/lib/dhcp/.canary'
+        test "$(cat /var/lib/dhcp/.canary)" = hi
     fi
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1867193/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1867193/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1867193/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1867193/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,4 +21,4 @@
     lxc stop --force bionic
     lxc delete bionic
     snap remove --purge lxd
-    lxd-tool undo-lxd-mount-changes
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1867752/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1867752/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1867752/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1867752/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,6 @@
     lxc stop --force bionic
     lxc delete bionic
     snap remove --purge lxd
-    lxd-tool undo-lxd-mount-changes
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
 debug: |
     lxc exec bionic -- bash -c "SNAPD_DEBUG=1 /usr/lib/snapd/snap-update-ns maas"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1871652/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1871652/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1871652/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1871652/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -14,7 +14,7 @@
 
     # XXX: This fails on: error: cannot communicate with server: Post http://localhost/v2/snaps/core: dial unix /run/snapd.socket: connect: no such file or directory
     # But why?
-    retry-tool -n 30 lxc exec bionic -- snap install core
+    retry -n 30 lxc exec bionic -- snap install core
 
     # Install lxd inside the container and activate it (it is socket activated)
     # by running a lxc command. When lxd service shuts down systemd runs a
@@ -60,4 +60,4 @@
     lxc exec bionic -- chmod -x /usr/local/bin/systemctl
     lxc stop --force bionic
     snap remove --purge lxd
-    lxd-tool undo-lxd-mount-changes
+    "$TESTSTOOLS"/lxd-state undo-mount-changes
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1884849/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1884849/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1884849/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1884849/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,35 @@
+summary: regression test for LP:#1884849
+details: |
+  When a mount point described by the mount profile is unmounted,
+  unmounting it again does not result in an error.
+systems: [ubuntu-16.04-64]
+prepare: |
+  # Having test-snapd-desktop installed, with the desktop plug connected
+  "$TESTSTOOLS"/snaps-state install-local test-snapd-desktop
+  snap install test-snapd-desktop
+  snap connect test-snapd-desktop:desktop
+  # Having constructed the mount namespace as the test user
+  tests.session -u test prepare
+  tests.session -u test exec snap run --shell test-snapd-desktop.sh </dev/null
+  test -e /run/snapd/ns/test-snapd-desktop.mnt
+  # Having altered the desired mount profile so that fontconfig cache is not meant to be mounted
+  sed -i -e 's@^/var/lib/snapd/hostfs/var/cache/fontconfig@#/var/lib/snapd/hostfs/var/cache/fontconfig@' /var/lib/snapd/mount/snap.test-snapd-desktop.fstab
+  # Having manually altered the mount namespace, so that fontconfig cache is not mounted
+  touch /var/cache/fontconfig/.canary
+  nsenter -m/run/snapd/ns/test-snapd-desktop.mnt test -e /var/cache/fontconfig/.canary
+  nsenter -m/run/snapd/ns/test-snapd-desktop.mnt umount /var/cache/fontconfig
+  nsenter -m/run/snapd/ns/test-snapd-desktop.mnt test ! -e /var/cache/fontconfig/.canary
+  # Having confirmed that snap-update-ns manifest assumes it still is.
+  grep -qFx '/var/lib/snapd/hostfs/var/cache/fontconfig /var/cache/fontconfig none bind,ro 0 0' < /run/snapd/ns/snap.test-snapd-desktop.fstab
+execute: |
+  # I can update the mount namespace without an error.
+  SNAPD_DEBUG=1 snapd.tool exec snap-update-ns test-snapd-desktop 2>snap-update-ns.log
+  MATCH 'DEBUG: ignoring EINVAL from unmount, "/var/cache/fontconfig" is not mounted' <snap-update-ns.log
+  # And confirm snap-update-ns fixed the situation
+  not grep -qF '/var/lib/snapd/hostfs/var/cache/fontconfig /var/cache/fontconfig none bind,ro 0 0' < /run/snapd/ns/snap.test-snapd-desktop.fstab
+  nsenter -m/run/snapd/ns/test-snapd-desktop.mnt test ! -e /var/cache/fontconfig/.canary
+restore: |
+  rm -f snap-update-ns.log
+  tests.session -u test restore
+  snap remove --purge test-snapd-desktop
+  rm -f /var/cache/fontconfig/.canary
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1886786/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1886786/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1886786/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1886786/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+summary: regression test for LP:#1886786
+
+prepare: |
+  "$TESTSTOOLS"/snaps-state install-local test-snapd-app-with-test-name
+
+execute: |
+  echo "running the command with .test suffix does not panic"
+  test-snapd-app-with-test-name.test
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1886786/test-snapd-app-with-test-name/meta/snap.yaml snapd-2.48.3+20.04/tests/regression/lp-1886786/test-snapd-app-with-test-name/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1886786/test-snapd-app-with-test-name/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1886786/test-snapd-app-with-test-name/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,10 @@
+name: test-snapd-app-with-test-name
+version: "0.1"
+summary: regression test snap for LP 1886786
+description: regression test snap for LP 1886786
+apps:
+  test:
+    command: test.sh
+base: core18
+confinement: strict
+grade: stable
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1886786/test-snapd-app-with-test-name/test.sh snapd-2.48.3+20.04/tests/regression/lp-1886786/test-snapd-app-with-test-name/test.sh
--- snapd-2.45.1+20.04.2/tests/regression/lp-1886786/test-snapd-app-with-test-name/test.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1886786/test-snapd-app-with-test-name/test.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo test
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1891371/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1891371/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1891371/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1891371/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,19 @@
+summary: mount changes can happen while a bind-mount file is open
+prepare: |
+    tests.cleanup prepare
+    snap pack test-snapd-app
+    tests.cleanup defer rm -f test-snapd-app_1_all.snap
+    snap pack test-snapd-extra-content
+    tests.cleanup defer rm -f test-snapd-extra-content_1_all.snap
+execute: |
+    # This starts a service that opens /opt/foo via bind-file layout.
+    snap install --dangerous ./test-snapd-app_1_all.snap
+    tests.cleanup defer snap remove --purge test-snapd-app
+    # This contains a content snap that does nothing and can be attached to the snap above.
+    snap install --dangerous ./test-snapd-extra-content_1_all.snap
+    tests.cleanup defer snap remove --purge test-snapd-extra-content
+    # This attaches the content snap, forcing bind-file layout to be reconstructed.
+    snap connect test-snapd-app:extra-content test-snapd-extra-content:extra-content
+    tests.cleanup defer snap disconnect test-snapd-app:extra-content test-snapd-extra-content:extra-content
+restore: |
+    tests.cleanup restore
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/bin/keep-foo-open snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/bin/keep-foo-open
--- snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/bin/keep-foo-open	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/bin/keep-foo-open	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+import time
+
+def main() -> None:
+    # Open /opt/foo - which is provided by a layout with bind-file and wait
+    # forever.
+    foo = open("/opt/foo")
+    while True:
+        time.sleep(1)
+
+
+if __name__ == "__main__":
+	main()
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/extra-content/README.txt snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/extra-content/README.txt
--- snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/extra-content/README.txt	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/extra-content/README.txt	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+This directory is a mount point for extra content that is attached sometime
+after the snap service starts.
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/foo snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/foo
--- snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/foo	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/foo	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+This file is bind mounted to /opt/foo and opened from there by the service
+defined in this snap.
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/meta/snap.yaml snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-app/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-app/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,16 @@
+name: test-snapd-app
+version: 1
+
+base: core18
+
+layout:
+  /opt/foo:
+      bind-file: $SNAP/foo
+apps:
+    keep-foo-open:
+        daemon: simple
+        command: bin/keep-foo-open
+plugs:
+    extra-content:
+        interface: content
+        target: $SNAP/extra-content
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-extra-content/meta/snap.yaml snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-extra-content/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1891371/test-snapd-extra-content/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1891371/test-snapd-extra-content/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,9 @@
+name: test-snapd-extra-content
+version: 1
+
+base: none
+
+slots:
+    extra-content:
+        interface: content
+        read: [$SNAP]
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1898038/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,43 @@
+summary: docker-support and multipass-support should mount base /etc/apparmor.d
+
+# no nsenter on ubuntu-14.04
+# core16 uses "legacy" mount layout and does not mount /etc/apparmor{,d} as it's
+# not pivoting to a base snap to begin with.
+systems: [-ubuntu-14.04-*, -ubuntu-core-16-*]
+
+prepare: |
+    tests.cleanup prepare
+    snap pack test-snapd-docker-support-app
+    tests.cleanup defer rm -f test-snapd-docker-support-app_1_all.snap
+    snap install --dangerous ./test-snapd-docker-support-app_1_all.snap
+    tests.cleanup defer snap remove --purge test-snapd-docker-support-app
+    snap pack test-snapd-multipass-support-app
+    tests.cleanup defer rm -f test-snapd-multipass-support-app_1_all.snap
+    snap install --dangerous ./test-snapd-multipass-support-app_1_all.snap
+    tests.cleanup defer snap remove --purge test-snapd-multipass-support-app
+    # XXX: Not a super-realistic test but it lets us see what we are after.
+    # Real snaps in real environment must cope with lack of apparmor anyway.
+    if [ ! -d /etc/apparmor ]; then
+        mkdir /etc/apparmor
+        tests.cleanup defer rmdir /etc/apparmor
+    fi
+    if [ ! -d /etc/apparmor.d ]; then
+        mkdir /etc/apparmor.d
+        tests.cleanup defer rmdir /etc/apparmor.d
+    fi
+    snap connect test-snapd-docker-support-app:docker-support
+    snap connect test-snapd-multipass-support-app:multipass-support
+
+execute: |
+    # now connect it and verify profile can be compiled
+    test-snapd-docker-support-app.test-snapd-docker-support
+    # check that within the snap mount namespace /etc/apparmor is mounted and comes from a snap
+    test "$(nsenter -m/run/snapd/ns/test-snapd-docker-support-app.mnt mount | grep -c '/etc/apparmor\(.d\)\? type squashfs')" -eq 2
+
+    # and do the same for multipass-support
+    test-snapd-multipass-support-app.test-snapd-multipass-support
+    test "$(nsenter -m/run/snapd/ns/test-snapd-multipass-support-app.mnt mount | grep -c '/etc/apparmor\(.d\)\? type squashfs')" -eq 2
+
+restore: |
+    tests.cleanup restore
+
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-docker-support-app/bin/test-snapd-docker-support snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-docker-support-app/bin/test-snapd-docker-support
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-docker-support-app/bin/test-snapd-docker-support	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-docker-support-app/bin/test-snapd-docker-support	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+/sbin/apparmor_parser --skip-kernel-load "$SNAP/test-snapd-docker-support.profile"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-docker-support-app/meta/snap.yaml snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-docker-support-app/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-docker-support-app/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-docker-support-app/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+name: test-snapd-docker-support-app
+version: 1
+
+apps:
+    test-snapd-docker-support:
+        command: bin/test-snapd-docker-support
+        plugs:
+            - docker-support
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-docker-support-app/test-snapd-docker-support.profile snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-docker-support-app/test-snapd-docker-support.profile
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-docker-support-app/test-snapd-docker-support.profile	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-docker-support-app/test-snapd-docker-support.profile	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#include <tunables/global>
+
+profile test-snapd-docker-support-test-profile {
+  #include <abstractions/base>
+
+}
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-multipass-support-app/bin/test-snapd-multipass-support snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-multipass-support-app/bin/test-snapd-multipass-support
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-multipass-support-app/bin/test-snapd-multipass-support	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-multipass-support-app/bin/test-snapd-multipass-support	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+/sbin/apparmor_parser --skip-kernel-load "$SNAP/test-snapd-multipass-support.profile"
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-multipass-support-app/meta/snap.yaml snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-multipass-support-app/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-multipass-support-app/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-multipass-support-app/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,8 @@
+name: test-snapd-multipass-support-app
+version: 1
+
+apps:
+    test-snapd-multipass-support:
+        command: bin/test-snapd-multipass-support
+        plugs:
+            - multipass-support
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-multipass-support-app/test-snapd-multipass-support.profile snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-multipass-support-app/test-snapd-multipass-support.profile
--- snapd-2.45.1+20.04.2/tests/regression/lp-1898038/test-snapd-multipass-support-app/test-snapd-multipass-support.profile	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1898038/test-snapd-multipass-support-app/test-snapd-multipass-support.profile	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,6 @@
+#include <tunables/global>
+
+profile test-snapd-multipass-support-test-profile {
+  #include <abstractions/base>
+
+}
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1899664/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1899664/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1899664/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1899664/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,17 @@
+summary: Test that read-only filesystem on /etc/dbus-1/session.d doesn't prevent snapd refresh.
+systems: [ubuntu-core-18-64]
+
+prepare: |
+  mount -t tmpfs tmptfs -o ro /etc/dbus-1/session.d
+
+execute: |
+  # we are running current snapd build, re-install it to trigger core18
+  # wrappers to be recreated.
+  snap install --dangerous /var/lib/snapd/seed/snaps/snapd_x1.snap 
+  journalctl -u snapd | MATCH "appears to be read-only, could not write snapd dbus config files"
+
+restore: |
+  umount /etc/dbus-1/session.d
+
+  # restore snapd installed originally
+  snap revert snapd
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1906821/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1906821/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1906821/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1906821/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,37 @@
+summary: verify that parallel instances of snaps with complex layout are correct
+
+description: |
+    The layout in https://bugs.launchpad.net/snapd/+bug/1906821 would be broken
+    with parallel instances, as due to a bug in sorting of mount entries, the
+    mapping of /var/snap/aws-iot-greengrass_prime to /var/snap/aws-iot-greengrass
+    was established too late. Layout entries referring to $SNAP_DATA would access
+    content from real /var/snap/aws-iot-greengrass instead of the instance one.
+
+# it's enough to run it on one system
+systems: [ubuntu-20.04-64]
+
+prepare: |
+    echo "Ensure feature flags are enabled"
+    snap set system experimental.parallel-instances=true
+
+execute: |
+    echo "Install snaps"
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-complex-layout
+    "$TESTSTOOLS"/snaps-state install-local-as test-snapd-complex-layout test-snapd-complex-layout_prime
+
+    mkdir -p /var/snap/test-snapd-complex-layout/current/certs
+    mkdir -p /var/snap/test-snapd-complex-layout_prime/current/certs
+    # this file should only be visible in test-snapd-complex-layout snap mount
+    # namespace
+    touch /var/snap/test-snapd-complex-layout/current/certs/non-instance
+    # this file should only be visible in test-snapd-complex-layout_prime mount
+    # namespace
+    touch /var/snap/test-snapd-complex-layout_prime/current/certs/prime-instance
+    #shellcheck disable=SC2016
+    test-snapd-complex-layout.sh -c 'test -e $SNAP/certs/non-instance'
+    #shellcheck disable=SC2016
+    not test-snapd-complex-layout.sh -c 'test -e $SNAP/certs/prime-instance'
+    #shellcheck disable=SC2016
+    test-snapd-complex-layout_prime.sh -c 'test -e $SNAP/certs/prime-instance'
+    #shellcheck disable=SC2016
+    not test-snapd-complex-layout_prime.sh -c 'test -e $SNAP/certs/non-instance'
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1910456/container-mgr-snap/bin/simple.sh snapd-2.48.3+20.04/tests/regression/lp-1910456/container-mgr-snap/bin/simple.sh
--- snapd-2.45.1+20.04.2/tests/regression/lp-1910456/container-mgr-snap/bin/simple.sh	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1910456/container-mgr-snap/bin/simple.sh	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exit 0
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1910456/container-mgr-snap/meta/snap.yaml snapd-2.48.3+20.04/tests/regression/lp-1910456/container-mgr-snap/meta/snap.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1910456/container-mgr-snap/meta/snap.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1910456/container-mgr-snap/meta/snap.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,91 @@
+name: test-snapd-container-mgrs
+summary: A test snap that uses super-privileged container mgr interfaces
+version: 1.0
+
+plugs:
+    greengrass-no-cont:
+        interface: greengrass-support
+        flavor: no-container
+    greengrass-legacy-cont:
+        interface: greengrass-support
+        flavor: legacy-container
+    kubelet:
+        interface: kubernetes-support
+        flavor: kubelet
+    kubeproxy:
+        interface: kubernetes-support
+        flavor: kubeproxy
+    autobind-unix:
+        interface: kubernetes-support
+        flavor: autobind-unix
+
+apps:
+    docker-support:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - docker-support
+
+    greengrass-support:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - greengrass-support
+
+    kubernetes-support:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - kubernetes-support
+
+    lxd-support:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - lxd-support
+
+    greengrass-no-cont:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - greengrass-no-cont
+
+    greengrass-legacy-cont:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - greengrass-legacy-cont
+
+    kubelet:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - kubelet
+
+    kubeproxy:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - kubeproxy
+
+    autobind-unix:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - autobind-unix
+
+    # service without plugs to make sure it doesn't get the Delegate=true
+    bare:
+        command: bin/simple.sh
+        daemon: simple
+
+    # service with multiple plugs to make sure it doesn't have multiple
+    # Delegate=true settings in the service unit
+    multiple-plugs:
+        command: bin/simple.sh
+        daemon: simple
+        plugs:
+            - docker-support
+            - lxd-support
+            - kubernetes-support
+            - greengrass-support
diff -Nru snapd-2.45.1+20.04.2/tests/regression/lp-1910456/task.yaml snapd-2.48.3+20.04/tests/regression/lp-1910456/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/lp-1910456/task.yaml	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/lp-1910456/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,143 @@
+summary: container management snaps should have special systemd unit directives
+details: |
+    Some special interfaces have additional systemd unit directives added to 
+    their systemd units, specifically container management interfaces have the
+    Delegate=true snippet added to prevent CVE-2020-27352.
+
+prepare: |
+    # build and install the strict test snap
+    snap pack container-mgr-snap
+    snap install --dangerous test-snapd-container-mgrs*.snap
+
+    if os.query is-classic; then
+        # then also check the classic snap too
+
+        # create the classic test snap by just adding "confinement: classic" to the
+        # snap.yaml of the strict snap
+
+        cp -r container-mgr-snap classic-container-mgr-snap
+        sed -i -e "s@name: test-snapd-container-mgrs@name: test-snapd-classic-container-mgrs@" \
+            classic-container-mgr-snap/meta/snap.yaml
+        echo "confinement: classic" >> classic-container-mgr-snap/meta/snap.yaml
+
+        # TODO: use os.query is-arch on master; "is-arch" etc. sub-commands are
+        # unavailable on 2.48 branch
+        if [ "$SPREAD_SYSTEM" = "arch-linux-64" ] || [[ "$SPREAD_SYSTEM" == fedora-* ]] || [[ "$SPREAD_SYSTEM" == centos-* ]]; then
+            # need to enable /snap symlink to install classic snaps
+            ln -s /var/lib/snapd/snap /snap
+        fi
+
+        snap pack classic-container-mgr-snap
+        snap install --dangerous --classic test-snapd-classic-container-mgrs*.snap
+    fi
+
+execute: |
+    for confinement in classic strict; do
+        echo "Check that all services exist in the $confinement snap"
+
+        if [ "$confinement" = "classic" ]; then
+            if os.query is-core; then
+                # skip the classic snap version of the test on core systems
+                echo "Skipping classic variant on Ubuntu Core"
+                continue
+            fi
+
+            snapName="test-snapd-classic-container-mgrs"
+        else
+            snapName="test-snapd-container-mgrs"
+        fi
+
+        snap services | MATCH $snapName\.docker-support
+        snap services | MATCH $snapName\.greengrass-support
+        snap services | MATCH $snapName\.kubernetes-support
+        snap services | MATCH $snapName\.lxd-support
+
+        snap services | MATCH $snapName\.greengrass-no-cont
+        snap services | MATCH $snapName\.greengrass-legacy-cont
+
+        snap services | MATCH $snapName\.kubelet
+        snap services | MATCH $snapName\.kubeproxy
+        snap services | MATCH $snapName\.autobind-unix
+
+        snap services | MATCH $snapName\.bare
+
+        snap services | MATCH $snapName\.multiple-plugs
+
+        echo "Check that the container services have Delegate=true in their service unit exactly once"
+
+        for svc in docker-support greengrass-support kubernetes-support lxd-support greengrass-legacy-cont kubelet kubeproxy multiple-plugs; do
+
+            serviceFile="/etc/systemd/system/snap.$snapName.$svc.service"
+
+            cat "$serviceFile" | MATCH "Delegate=true"
+            test "$(cat "$serviceFile" | grep "Delegate=true" | wc -l)" = 1
+
+            # connect and disconnect the interfaces to ensure that 
+            # connection/disconnection does not effect the presence of Delegate=true
+
+            if [ "$svc" = "multiple-plugs" ]; then
+                snap connect "$snapName:docker-support"
+                snap connect "$snapName:greengrass-support"
+                snap connect "$snapName:kubernetes-support"
+                snap connect "$snapName:lxd-support"
+            else
+                snap connect "$snapName:$svc"
+            fi
+
+            cat "$serviceFile" | MATCH "Delegate=true"
+            test "$(cat "$serviceFile" | grep "Delegate=true" | wc -l)" = 1
+
+            if [ "$svc" = "multiple-plugs" ]; then
+                snap disconnect "$snapName:docker-support"
+                snap disconnect "$snapName:greengrass-support"
+                snap disconnect "$snapName:kubernetes-support"
+                snap disconnect "$snapName:lxd-support"
+            else
+                snap disconnect "$snapName:$svc"
+            fi
+
+            cat "$serviceFile" | MATCH "Delegate=true"
+            test "$(cat "$serviceFile" | grep "Delegate=true" | wc -l)" = 1
+        done
+
+        echo "Check that the non-container manager services do not have Delegate=true in their service units"
+
+        for svc in bare "autobind-unix" "greengrass-no-cont"; do 
+            serviceFile="/etc/systemd/system/snap.$snapName.$svc.service"
+            cat "$serviceFile" | NOMATCH "Delegate=true"
+        done
+    done
+
+    # only run this test on ubuntu since the docker snap is not guaranteed to 
+    # work on non-ubuntu systems
+
+    if ! [[ "$SPREAD_SYSTEM" == ubuntu-* ]]; then
+        echo "skipping docker test on non-ubuntu"
+        exit 0
+    fi
+
+    snap install docker
+
+    echo "Test that docker container cgroups on ubuntu are not moved when systemctl daemon-reload is executed"
+
+    # start a docker container - need to wait until dockerd comes alive
+    retry -n10 --wait 1 sh -c 'docker run -d --name test ubuntu:18.04 sleep infinity'
+
+    # make sure that docker top can see the process
+    docker top test | MATCH "sleep infinity"
+
+    # get the pid of that docker container
+    containerPID=$(docker top test | grep "sleep infinity" | awk '{print $2}')
+
+    containerCgroupBefore=$(cat "/proc/$containerPID/cgroup" | grep devices)
+
+    # reload systemd 
+    systemctl daemon-reload
+
+    # check the container cgroup again
+    containerCgroupAfter=$(cat "/proc/$containerPID/cgroup" | grep devices)
+
+    if [ "$containerCgroupBefore" != "$containerCgroupAfter" ]; then
+        echo "test broken, container was moved from cgroup \"$containerCgroupBefore\" to \"$containerCgroupAfter\""
+        exit 1
+    fi
diff -Nru snapd-2.45.1+20.04.2/tests/regression/rhbz-1584461/task.yaml snapd-2.48.3+20.04/tests/regression/rhbz-1584461/task.yaml
--- snapd-2.45.1+20.04.2/tests/regression/rhbz-1584461/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/regression/rhbz-1584461/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 summary: Verify directories from the base snap are not mounted over symlinks in /etc
 
 description: |
-  The host's /etc is made avaialable inside the snap's mount namespace. During
+  The host's /etc is made available inside the snap's mount namespace. During
   setup, snap-confine attempts to preserve some entries from the base snap to
   present a uniform environment for the snaps. When the entries in host
   namespace are symlinks, they are followed when mounting and the mount, with
@@ -19,9 +19,6 @@
     rm -f ./in-snap ./on-host
 
 execute: |
-    # on Fedora, /etc/nsswitch.conf is a symlink to /etc/authselect/nsswitch.conf
-    test -L /etc/nsswitch.conf
-
     # the following mount entries are visible on a broken system:
     # /var/lib/snapd/snaps/core_6818.snap on /etc/authselect/nsswitch.conf type squashfs (ro,nodev,relatime,context=system_u:object_r:snappy_snap_t:s0)
     # /var/lib/snapd/snaps/core_6818.snap on /var/lib/snapd/snap/core/6818/etc/nsswitch.conf type squashfs (ro,nodev,relatime,context=system_u:object_r:snappy_snap_t:s0)
@@ -29,7 +26,7 @@
     # /var/lib/snapd/snaps/core_6818.snap on /etc/authselect/nsswitch.conf type squashfs (ro,nodev,relatime,context=system_u:object_r:snappy_snap_t:s0)
     # /var/lib/snapd/snaps/core_6818.snap on /etc/ssl-backup type squashfs (ro,nodev,relatime,context=system_u:object_r:snappy_snap_t:s0)
 
-    # since we cannot look at /etc/nsswitch.conf, make /etc/ssl a symlink
+    # make /etc/ssl a symlink
     mv /etc/ssl /etc/ssl-backup
     ln -s /etc/ssl-backup /etc/ssl
 
diff -Nru snapd-2.45.1+20.04.2/tests/smoke/install/task.yaml snapd-2.48.3+20.04/tests/smoke/install/task.yaml
--- snapd-2.45.1+20.04.2/tests/smoke/install/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/smoke/install/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -52,3 +52,17 @@
 
     echo "Ensure a change was generated for the install"
     snap changes | MATCH 'Install "test-snapd-sh" snap'
+
+    echo "Ensure different bases work"
+    for base in core18 core20; do
+        # no core20 snap for i386
+        if [ "$base" = "core20" ] && [ "$(uname -m)" = i686 ]; then
+            continue
+        fi
+
+        snap install test-snapd-sh-${base}
+        test-snapd-sh-${base}.sh -c "echo hello $base" | MATCH "hello $base"
+        # shellcheck disable=SC2016
+        test-snapd-sh-${base}.sh -c 'touch $SNAP_COMMON/test'
+        test -f /var/snap/test-snapd-sh-${base}/common/test
+    done
diff -Nru snapd-2.45.1+20.04.2/tests/smoke/remove/task.yaml snapd-2.48.3+20.04/tests/smoke/remove/task.yaml
--- snapd-2.45.1+20.04.2/tests/smoke/remove/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/smoke/remove/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -1,9 +1,7 @@
 summary: Check that install/remove works
 
 execute: |
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sh
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sh
 
     #shellcheck source=tests/lib/dirs.sh
     . "$TESTSLIB/dirs.sh"
@@ -13,7 +11,7 @@
     snap remove test-snapd-sh
     test ! -d "$SNAP_MOUNT_DIR/test-snapd-sh"
 
-    if snap list | grep -E ^test-snapd-sh; then
+    if snap list test-snapd-sh; then
         echo "test-snapd-sh should be removed but it is not"
         snap list
         exit 1
diff -Nru snapd-2.45.1+20.04.2/tests/smoke/sandbox/task.yaml snapd-2.48.3+20.04/tests/smoke/sandbox/task.yaml
--- snapd-2.45.1+20.04.2/tests/smoke/sandbox/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/smoke/sandbox/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -16,9 +16,7 @@
         exit 0
     fi
 
-    #shellcheck source=tests/lib/snaps.sh
-    . "$TESTSLIB/snaps.sh"
-    install_local test-snapd-sandbox
+    "$TESTSTOOLS"/snaps-state install-local test-snapd-sandbox
 
     # home is not auto-connected on core
     if grep -q ID=ubuntu-core /etc/os-release; then
diff -Nru snapd-2.45.1+20.04.2/tests/unit/spread-shellcheck/can-fail snapd-2.48.3+20.04/tests/unit/spread-shellcheck/can-fail
--- snapd-2.45.1+20.04.2/tests/unit/spread-shellcheck/can-fail	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/unit/spread-shellcheck/can-fail	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-
diff -Nru snapd-2.45.1+20.04.2/tests/unit/spread-shellcheck/task.yaml snapd-2.48.3+20.04/tests/unit/spread-shellcheck/task.yaml
--- snapd-2.45.1+20.04.2/tests/unit/spread-shellcheck/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/unit/spread-shellcheck/task.yaml	1970-01-01 00:00:00.000000000 +0000
@@ -1,15 +0,0 @@
-summary: Verify spread task scripts with shellcheck
-
-# need a recent shellcheck version
-systems: [ubuntu-18.04-64]
-
-prepare: |
-    # need to install shellcheck in devmode, the tests are run by 'root', the
-    # source code is under /home/gopath, all file accesses to the source code
-    # will end up getting DENIED even though shellcheck uses home interface
-    snap install --beta --devmode shellcheck
-
-execute: |
-    testdir=$PWD
-    cd "$SPREAD_PATH" || exit 1
-    CAN_FAIL="$testdir/can-fail" ./spread-shellcheck spread.yaml tests
diff -Nru snapd-2.45.1+20.04.2/tests/upgrade/basic/task.yaml snapd-2.48.3+20.04/tests/upgrade/basic/task.yaml
--- snapd-2.45.1+20.04.2/tests/upgrade/basic/task.yaml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/tests/upgrade/basic/task.yaml	2021-02-02 08:21:12.000000000 +0000
@@ -76,7 +76,7 @@
 
         do_classic=no
         if is_classic_confinement_supported ; then
-            install_local_classic test-snapd-classic-confinement
+            "$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
             do_classic=yes
             # Preserve the state across reboots if necessary
             touch do-classic
diff -Nru snapd-2.45.1+20.04.2/testutil/base.go snapd-2.48.3+20.04/testutil/base.go
--- snapd-2.45.1+20.04.2/testutil/base.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/base.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2015 Canonical Ltd
+ * Copyright (C) 2015-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -31,15 +31,19 @@
 
 // SetUpTest prepares the cleanup
 func (s *BaseTest) SetUpTest(c *check.C) {
-	s.cleanupHandlers = nil
+	if len(s.cleanupHandlers) != 0 {
+		panic("BaseTest cleanup handlers were not consumed before a new test start, missing BaseTest.TearDownTest call?")
+	}
 }
 
 // TearDownTest cleans up the channel.ini files in case they were changed by
 // the test.
 // It also runs the cleanup handlers
 func (s *BaseTest) TearDownTest(c *check.C) {
-	// run cleanup handlers and clear the slice
-	for _, f := range s.cleanupHandlers {
+	// run cleanup handlers in reverse order and clear the slice
+	n := len(s.cleanupHandlers)
+	for i := range s.cleanupHandlers {
+		f := s.cleanupHandlers[n-1-i]
 		f()
 	}
 	s.cleanupHandlers = nil
diff -Nru snapd-2.45.1+20.04.2/testutil/containschecker_test.go snapd-2.48.3+20.04/testutil/containschecker_test.go
--- snapd-2.45.1+20.04.2/testutil/containschecker_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/containschecker_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -137,7 +137,7 @@
 }
 
 func (*containsCheckerSuite) TestContainsUncomparableType(c *check.C) {
-	if runtime.Compiler != "go" {
+	if runtime.Compiler != "gc" {
 		c.Skip("this test only works on go (not gccgo)")
 	}
 
diff -Nru snapd-2.45.1+20.04.2/testutil/dbustest2.go snapd-2.48.3+20.04/testutil/dbustest2.go
--- snapd-2.45.1+20.04.2/testutil/dbustest2.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/dbustest2.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,233 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package testutil
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"sync"
-
-	"github.com/godbus/dbus"
-)
-
-// testDBusClientName is the unique name of the connected client.
-const testDBusClientName = ":test"
-
-// DBusHandlerFunc is the type of handler function for interacting with test DBus.
-//
-// The handler is called for each message that arrives to the bus from the test
-// client. The handler can respond by returning zero or more messages.
-// Typically one message is returned (method response or error). Additional
-// messages can be returned to represent signals emitted during message
-// handling.
-//
-// The handler is not called for internal messages related to DBus itself.
-type DBusHandlerFunc func(msg *dbus.Message, n int) ([]*dbus.Message, error)
-
-// testDBusStream provides io.ReadWriteCloser for dbus.NewConn.
-//
-// Internally the stream uses separate input and output buffers.  Input buffer
-// is written to by DBus. Output buffer is written to internally, in response
-// to internal interactions with DBus or in response to message handler
-// function, provided by test code, returning DBus messages to send.
-//
-// Before authentication is completed buffers are used to operate a
-// line-oriented, text protocol. After authentication the buffers exchange DBus
-// messages exclusively.
-//
-// The authentication phase is handled internally and is not exposed to tests.
-//
-// Anything written to the output buffer is passed to DBus for processing.
-// Anything read from input buffer is decoded and either handled internally or
-// delegated to the handler function.
-//
-// DBus implementation we use requires Read to block while data is unavailable
-// so a condition variable is used to provide blocking behavior.
-type testDBusStream struct {
-	handler DBusHandlerFunc
-
-	m        sync.Mutex
-	readable sync.Cond
-
-	outputBuf, inputBuf bytes.Buffer
-	closed              bool
-	authDone            bool
-	n                   int
-}
-
-func (s *testDBusStream) decodeRequest() {
-	// s.m is locked
-	if !s.authDone {
-		// Before authentication is done process the text protocol anticipating
-		// the TEST authentication used by NewDBusTestConn call below.
-		msg := s.inputBuf.String()
-		s.inputBuf.Reset()
-		switch msg {
-		case "\x00":
-			// initial NUL byte, ignore
-		case "AUTH\r\n":
-			s.outputBuf.WriteString("REJECTED TEST\r\n")
-		case "AUTH TEST TEST\r\n":
-			s.outputBuf.WriteString("OK test://\r\n")
-		case "CANCEL\r\n":
-			s.outputBuf.WriteString("REJECTED\r\n")
-		case "BEGIN\r\n":
-			s.authDone = true
-		default:
-			panic(fmt.Errorf("unrecognized authentication message %q", msg))
-		}
-		s.readable.Signal()
-		return
-	}
-
-	// After authentication the buffer must contain marshaled DBus messages.
-	msgIn, err := dbus.DecodeMessage(&s.inputBuf)
-	if err != nil {
-		panic(fmt.Errorf("cannot decode incoming message: %v", err))
-	}
-	switch s.n {
-	case 0:
-		// The very first message we receive is a Hello message sent from
-		// NewDBusTestConn below. This message, along with the NameAcquired
-		// signal we send below, allow DBus to associate the client with the
-		// responses sent by test.
-		s.sendMsg(&dbus.Message{
-			Type: dbus.TypeMethodReply,
-			Headers: map[dbus.HeaderField]dbus.Variant{
-				dbus.FieldDestination: dbus.MakeVariant(testDBusClientName),
-				dbus.FieldSender:      dbus.MakeVariant("org.freedesktop.DBus"),
-				dbus.FieldReplySerial: dbus.MakeVariant(msgIn.Serial()),
-				dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf("")),
-			},
-			Body: []interface{}{":test"},
-		})
-		s.sendMsg(&dbus.Message{
-			Type: dbus.TypeSignal,
-			Headers: map[dbus.HeaderField]dbus.Variant{
-				dbus.FieldPath:        dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/DBus")),
-				dbus.FieldInterface:   dbus.MakeVariant("org.freedesktop.DBus"),
-				dbus.FieldMember:      dbus.MakeVariant("NameAcquired"),
-				dbus.FieldDestination: dbus.MakeVariant(testDBusClientName),
-				dbus.FieldSender:      dbus.MakeVariant("org.freedesktop.DBus"),
-				dbus.FieldSignature:   dbus.MakeVariant(dbus.SignatureOf("")),
-			},
-			Body: []interface{}{testDBusClientName},
-		})
-	default:
-		msgOutList, err := s.handler(msgIn, s.n-1)
-		if err != nil {
-			panic("cannot handle message: " + err.Error())
-		}
-		for _, msgOut := range msgOutList {
-			// Test code does not need to provide the address of the sender.
-			if _, ok := msgOut.Headers[dbus.FieldSender]; !ok {
-				msgOut.Headers[dbus.FieldSender] = dbus.MakeVariant(testDBusClientName)
-			}
-			s.sendMsg(msgOut)
-		}
-	}
-	s.n++
-}
-
-func (s *testDBusStream) sendMsg(msg *dbus.Message) {
-	// TODO: handle big endian if we ever get big endian machines again.
-	if err := msg.EncodeTo(&s.outputBuf, binary.LittleEndian); err != nil {
-		panic(fmt.Errorf("cannot encode outgoing message: %v", err))
-	}
-	// s.m is locked
-	s.readable.Signal()
-}
-
-func (s *testDBusStream) Read(p []byte) (n int, err error) {
-	s.m.Lock()
-	defer s.m.Unlock()
-
-	// When the buffer is empty block until more data arrives. DBus
-	// continuously blocks on reading and premature empty read is treated as an
-	// EOF, terminating the message flow.
-	if s.outputBuf.Len() == 0 {
-		s.readable.Wait()
-	}
-
-	if s.closed {
-		return 0, fmt.Errorf("stream is closed")
-	}
-	return s.outputBuf.Read(p)
-}
-
-func (s *testDBusStream) Write(p []byte) (n int, err error) {
-	s.m.Lock()
-	defer s.m.Unlock()
-
-	if s.closed {
-		return 0, fmt.Errorf("stream is closed")
-	}
-
-	n, err = s.inputBuf.Write(p)
-	s.decodeRequest()
-	return n, err
-}
-
-func (s *testDBusStream) Close() error {
-	s.m.Lock()
-	defer s.m.Unlock()
-	s.closed = true
-	s.readable.Signal()
-	return nil
-}
-
-func newTestDBusStream(handler DBusHandlerFunc) *testDBusStream {
-	s := &testDBusStream{handler: handler}
-	s.readable.L = &s.m
-	return s
-}
-
-// testAuth implements DBus authentication protocol used during testing.
-type testAuth struct{}
-
-func (a *testAuth) FirstData() (name, resp []byte, status dbus.AuthStatus) {
-	return []byte("TEST"), []byte("TEST"), dbus.AuthOk
-}
-
-func (a *testAuth) HandleData(data []byte) (resp []byte, status dbus.AuthStatus) {
-	return []byte(""), dbus.AuthOk
-}
-
-// NewDBusTestConn returns a DBus connection for writing unit tests.
-//
-// The handler function is called for each message sent to the bus. It can
-// return any number of messages to send in response. The counter aids in
-// testing a sequence of messages that is expected.
-func NewDBusTestConn(handler DBusHandlerFunc) (*dbus.Conn, error) {
-	conn, err := dbus.NewConn(newTestDBusStream(handler))
-	if err != nil {
-		return nil, err
-	}
-	if err = conn.Auth([]dbus.Auth{&testAuth{}}); err != nil {
-		_ = conn.Close()
-		return nil, err
-	}
-	if err = conn.Hello(); err != nil {
-		_ = conn.Close()
-		return nil, err
-	}
-	return conn, nil
-}
diff -Nru snapd-2.45.1+20.04.2/testutil/exec.go snapd-2.48.3+20.04/testutil/exec.go
--- snapd-2.45.1+20.04.2/testutil/exec.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/exec.go	2021-02-02 08:21:12.000000000 +0000
@@ -110,6 +110,7 @@
 func mockCommand(c *check.C, basename, script, template string) *MockCmd {
 	var wholeScript bytes.Buffer
 	var binDir, exeFile, logFile string
+	var newpath string
 	if filepath.IsAbs(basename) {
 		binDir = filepath.Dir(basename)
 		err := os.MkdirAll(binDir, 0755)
@@ -122,7 +123,7 @@
 		binDir = c.MkDir()
 		exeFile = path.Join(binDir, basename)
 		logFile = path.Join(binDir, basename+".log")
-		os.Setenv("PATH", binDir+":"+os.Getenv("PATH"))
+		newpath = binDir + ":" + os.Getenv("PATH")
 	}
 	fmt.Fprintf(&wholeScript, template, logFile, script)
 	err := ioutil.WriteFile(exeFile, wholeScript.Bytes(), 0700)
@@ -132,6 +133,10 @@
 
 	maybeShellcheck(c, script, &wholeScript)
 
+	if newpath != "" {
+		os.Setenv("PATH", binDir+":"+os.Getenv("PATH"))
+	}
+
 	return &MockCmd{binDir: binDir, exeFile: exeFile, logFile: logFile}
 }
 
@@ -147,7 +152,7 @@
 	return mockCommand(c, basename, script, strings.Replace(scriptTpl, "###LOCK###", "", 1))
 }
 
-// MockLockCommand is the same as MockCommand(), but the script uses flock to
+// MockLockedCommand is the same as MockCommand(), but the script uses flock to
 // enforce exclusive locking, preventing the call tracking from being corrupted.
 // Thus it is safe to be called in parallel.
 func MockLockedCommand(c *check.C, basename, script string) *MockCmd {
diff -Nru snapd-2.45.1+20.04.2/testutil/export_test.go snapd-2.48.3+20.04/testutil/export_test.go
--- snapd-2.45.1+20.04.2/testutil/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -34,3 +34,11 @@
 		shellcheckPath = old
 	}
 }
+
+func MockRuntimeARCH(new string) (restore func()) {
+	old := runtimeGOARCH
+	runtimeGOARCH = new
+	return func() {
+		runtimeGOARCH = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/testutil/symlinktargetchecker.go snapd-2.48.3+20.04/testutil/symlinktargetchecker.go
--- snapd-2.45.1+20.04.2/testutil/symlinktargetchecker.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/symlinktargetchecker.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,100 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package testutil
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+
+	"gopkg.in/check.v1"
+)
+
+type symlinkTargetChecker struct {
+	*check.CheckerInfo
+	exact bool
+}
+
+// SymlinkTargetEquals verifies that the given file is a symbolic link with the given target.
+var SymlinkTargetEquals check.Checker = &symlinkTargetChecker{
+	CheckerInfo: &check.CheckerInfo{Name: "SymlinkTargetEquals", Params: []string{"filename", "target"}},
+	exact:       true,
+}
+
+// SymlinkTargetContains verifies that the given file is a symbolic link whose target contains the provided text.
+var SymlinkTargetContains check.Checker = &symlinkTargetChecker{
+	CheckerInfo: &check.CheckerInfo{Name: "SymlinkTargetContains", Params: []string{"filename", "target"}},
+}
+
+// SymlinkTargetMatches verifies that the given file is a symbolic link whose target matches the provided regular expression.
+var SymlinkTargetMatches check.Checker = &symlinkTargetChecker{
+	CheckerInfo: &check.CheckerInfo{Name: "SymlinkTargetMatches", Params: []string{"filename", "regex"}},
+}
+
+func (c *symlinkTargetChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	filename, ok := params[0].(string)
+	if !ok {
+		return false, "Filename must be a string"
+	}
+	if names[1] == "regex" {
+		regexpr, ok := params[1].(string)
+		if !ok {
+			return false, "Regex must be a string"
+		}
+		rx, err := regexp.Compile(regexpr)
+		if err != nil {
+			return false, fmt.Sprintf("Cannot compile regexp %q: %v", regexpr, err)
+		}
+		params[1] = rx
+	}
+	return symlinkTargetCheck(filename, params[1], c.exact)
+}
+
+func symlinkTargetCheck(filename string, expectedTarget interface{}, exact bool) (result bool, error string) {
+	target, err := os.Readlink(filename)
+	if err != nil {
+		return false, fmt.Sprintf("Cannot read symbolic link: %v", err)
+	}
+	if exact {
+		switch expectedTarget := expectedTarget.(type) {
+		case string:
+			result = target == expectedTarget
+		default:
+			error = fmt.Sprintf("Cannot compare symbolic link target with something of type %T", expectedTarget)
+		}
+	} else {
+		switch expectedTarget := expectedTarget.(type) {
+		case string:
+			result = strings.Contains(target, expectedTarget)
+		case *regexp.Regexp:
+			result = expectedTarget.MatchString(target)
+		default:
+			error = fmt.Sprintf("Cannot compare symbolic link target with something of type %T", expectedTarget)
+		}
+	}
+	if !result {
+		if error == "" {
+			error = fmt.Sprintf("Failed to match with symbolic link target:\n%v", target)
+		}
+		return result, error
+	}
+	return result, ""
+}
diff -Nru snapd-2.45.1+20.04.2/testutil/symlinktargetchecker_test.go snapd-2.48.3+20.04/testutil/symlinktargetchecker_test.go
--- snapd-2.45.1+20.04.2/testutil/symlinktargetchecker_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/symlinktargetchecker_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,79 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package testutil_test
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+
+	"gopkg.in/check.v1"
+
+	. "github.com/snapcore/snapd/testutil"
+)
+
+type symlinkTargetCheckerSuite struct {
+	d       string
+	symlink string
+	target  string
+}
+
+var _ = check.Suite(&symlinkTargetCheckerSuite{})
+
+func (s *symlinkTargetCheckerSuite) SetUpTest(c *check.C) {
+	s.d = c.MkDir()
+	s.symlink = filepath.Join(s.d, "symlink")
+	s.target = "target"
+	c.Assert(os.Symlink(s.target, s.symlink), check.IsNil)
+}
+
+func (s *symlinkTargetCheckerSuite) TestSymlinkTargetEquals(c *check.C) {
+	testInfo(c, SymlinkTargetEquals, "SymlinkTargetEquals", []string{"filename", "target"})
+	testCheck(c, SymlinkTargetEquals, true, "", s.symlink, s.target)
+
+	testCheck(c, SymlinkTargetEquals, false, "Failed to match with symbolic link target:\ntarget", s.symlink, "not-target")
+	testCheck(c, SymlinkTargetEquals, false, `Cannot read symbolic link: readlink missing: no such file or directory`, "missing", "")
+	testCheck(c, SymlinkTargetEquals, false, "Filename must be a string", 42, "")
+	testCheck(c, SymlinkTargetEquals, false, "Cannot compare symbolic link target with something of type int", s.symlink, 1)
+}
+
+func (s *symlinkTargetCheckerSuite) TestSymlinkTargetContains(c *check.C) {
+	testInfo(c, SymlinkTargetContains, "SymlinkTargetContains", []string{"filename", "target"})
+	testCheck(c, SymlinkTargetContains, true, "", s.symlink, s.target[1:])
+	testCheck(c, SymlinkTargetContains, true, "", s.symlink, regexp.MustCompile(".*"))
+
+	testCheck(c, SymlinkTargetContains, false, "Failed to match with symbolic link target:\ntarget", s.symlink, "not-target")
+	testCheck(c, SymlinkTargetContains, false, "Failed to match with symbolic link target:\ntarget", s.symlink, regexp.MustCompile("^$"))
+	testCheck(c, SymlinkTargetContains, false, `Cannot read symbolic link: readlink missing: no such file or directory`, "missing", "")
+	testCheck(c, SymlinkTargetContains, false, "Filename must be a string", 42, "")
+	testCheck(c, SymlinkTargetContains, false, "Cannot compare symbolic link target with something of type int", s.symlink, 1)
+}
+
+func (s *symlinkTargetCheckerSuite) TestSymlinkTargetMatches(c *check.C) {
+	testInfo(c, SymlinkTargetMatches, "SymlinkTargetMatches", []string{"filename", "regex"})
+	testCheck(c, SymlinkTargetMatches, true, "", s.symlink, ".*")
+	testCheck(c, SymlinkTargetMatches, true, "", s.symlink, "^"+regexp.QuoteMeta(s.target)+"$")
+
+	testCheck(c, SymlinkTargetMatches, false, "Failed to match with symbolic link target:\ntarget", s.symlink, "^$")
+	testCheck(c, SymlinkTargetMatches, false, "Failed to match with symbolic link target:\ntarget", s.symlink, "123"+regexp.QuoteMeta(s.target))
+	testCheck(c, SymlinkTargetMatches, false, `Cannot read symbolic link: readlink missing: no such file or directory`, "missing", "")
+	testCheck(c, SymlinkTargetMatches, false, "Filename must be a string", 42, ".*")
+	testCheck(c, SymlinkTargetMatches, false, "Regex must be a string", s.symlink, 1)
+}
diff -Nru snapd-2.45.1+20.04.2/testutil/timeouts.go snapd-2.48.3+20.04/testutil/timeouts.go
--- snapd-2.45.1+20.04.2/testutil/timeouts.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/timeouts.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,43 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package testutil
+
+import (
+	"runtime"
+	"time"
+)
+
+var runtimeGOARCH = runtime.GOARCH
+
+// HostScaledTimeout returns a timeout for tests that is adjusted
+// for the slowness of certain systems.
+//
+// This should only be used in tests and is a bit of a guess.
+func HostScaledTimeout(t time.Duration) time.Duration {
+	switch runtimeGOARCH {
+	case "riscv64":
+		// virt riscv64 builders are 5x times slower than
+		// armhf when building golang-1.14. These tests
+		// timeout, hence bump timeouts by 6x
+		return t * 6
+	default:
+		return t
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/testutil/timeouts_test.go snapd-2.48.3+20.04/testutil/timeouts_test.go
--- snapd-2.45.1+20.04.2/testutil/timeouts_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/testutil/timeouts_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,45 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package testutil_test
+
+import (
+	"time"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/testutil"
+)
+
+var _ = Suite(&TimeoutTestSuite{})
+
+type TimeoutTestSuite struct{}
+
+func (ts *TimeoutTestSuite) TestHostScaledTimeout(c *C) {
+	restore := testutil.MockRuntimeARCH("some-fast-arch")
+	defer restore()
+	default_timeout := testutil.HostScaledTimeout(2 * time.Second)
+
+	restore = testutil.MockRuntimeARCH("riscv64")
+	defer restore()
+	riscv64_timeout := testutil.HostScaledTimeout(2 * time.Second)
+
+	c.Check(default_timeout, Equals, 2*time.Second)
+	c.Check(riscv64_timeout > default_timeout, Equals, true)
+}
diff -Nru snapd-2.45.1+20.04.2/.travis.yml snapd-2.48.3+20.04/.travis.yml
--- snapd-2.45.1+20.04.2/.travis.yml	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/.travis.yml	1970-01-01 00:00:00.000000000 +0000
@@ -1,38 +0,0 @@
-language: go
-go_import_path: github.com/snapcore/snapd
-git:
-  quiet: true
-matrix:
-  include:
-    - stage: quick
-      go: "1.10.x"
-      name: OSX build and minimal runtime sanity check
-      os: osx
-      addons:
-        homebrew:
-          packages: [squashfs]
-      install:
-        - ./get-deps.sh
-        # extra dependency on darwin:
-        - go get golang.org/x/sys/unix
-      before_script:
-        - ./mkversion.sh
-        - go build -o /tmp/snp ./cmd/snap
-      script:
-        - /tmp/snp download hello
-        - /tmp/snp version
-        # TODO: homebrew appears to be broken, brew install of squashfs fails
-        # and goes unnoticed by travis
-        - if command -v mksquashfs; then /tmp/snp pack tests/lib/snaps/test-snapd-tools/ /tmp ; fi
-    - stage: quick
-      name: CLA check
-      dist: xenial
-      if: type = pull_request
-      language: bash
-      addons:
-        apt:
-          packages:
-            python-launchpadlib
-      script:
-        - git fetch --unshallow
-        - ./tests/lib/cla_check.py
diff -Nru snapd-2.45.1+20.04.2/update-pot snapd-2.48.3+20.04/update-pot
--- snapd-2.45.1+20.04.2/update-pot	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/update-pot	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 #!/bin/sh
 # -*- Mode: sh; indent-tabs-mode: t -*-
 
-set -e
+set -eu
 
 # In LP#1758684 we got reports that the pot file generation
 # is broken. To get to the bottom of this add checks here
@@ -12,8 +12,9 @@
     c1="Alternative command to run"
     c2="Name of the key to use, otherwise use the default key"
     c3="too many arguments for command"
+    c4="%d days ago, at 15:04 MST"
 
-    for canary in "$c1" "$c2" "$c3"; do
+    for canary in "$c1" "$c2" "$c3" "$c4"; do
 	if ! grep -q "$canary" "$OUTPUT"; then
 	    echo "canary '$canary' not found, pot extraction broken"
 	    ls -lh "$OUTPUT"
@@ -25,41 +26,57 @@
 HERE="$(readlink -f "$(dirname "$0")")"
 
 OUTPUT="$HERE/po/snappy.pot"
-if [ -n "$1" ]; then
+if [ -n "${1:-}" ]; then
 	OUTPUT="$1"
 fi
 
 # ensure we have our xgettext-go
 go install github.com/snapcore/snapd/i18n/xgettext-go
 
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
 # exclude vendor and _build subdir
-I18N_FILES="$(mktemp -d)/i18n.files"
-find "$HERE" -type d \( -name "vendor" -o -name "_build" \) -prune -o -name "*.go" -type f -print > "$I18N_FILES"
-# shellcheck disable=SC2064
-trap "rm -rf $(dirname "$I18N_FILES")" EXIT
+find "$HERE" -type d \( -name "vendor" -o -name "_build" -o -name ".git" \) -prune -o -name "*.go" -type f -printf "%P\n" > "$tmpdir/go.files"
 
 "${GOPATH%%:*}/bin/xgettext-go" \
-    -f "$I18N_FILES" \
+    -f "$tmpdir/go.files" \
+    -D "$HERE" \
     -o "$OUTPUT" \
     --add-comments-tag=TRANSLATORS: \
-    --no-location \
     --sort-output \
     --package-name=snappy\
     --msgid-bugs-address=snappy-devel@lists.ubuntu.com \
     --keyword=i18n.G \
-    --keyword-plural=i18n.DG
+    --keyword-plural=i18n.NG
 
 # check canary
 check_canaries
 
 sed -i 's/charset=CHARSET/charset=UTF-8/' "$OUTPUT"
 
+find "$HERE" -path "$HERE/data/desktop/*.desktop.in" -type f -printf "%P\n" > "$tmpdir/desktop.files"
+# we need the || true because Ubuntu 14.04's xgettext does not support
+# extracting from desktop files.
+xgettext \
+    -f "$tmpdir/desktop.files" \
+    -D "$HERE" \
+    -o "$OUTPUT" \
+    --language=Desktop \
+    --sort-output \
+    --package-name=snappy \
+    --msgid-bugs-address=snappy-devel@lists.ubuntu.com \
+    --join-existing || true
+
+find "$HERE" -path "$HERE/data/polkit/*.policy" -type f -printf "%P\n" > "$tmpdir/polkit.files"
 # we need the || true because of
 # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891347
-xgettext "$HERE"/data/polkit/*.policy \
+xgettext \
+    -f "$tmpdir/polkit.files" \
+    -D "$HERE" \
     -o "$OUTPUT" \
     --its="$HERE/po/its/polkit.its" \
-    --no-location \
+    --sort-output \
     --package-name=snappy \
     --msgid-bugs-address=snappy-devel@lists.ubuntu.com \
     --join-existing || true
diff -Nru snapd-2.45.1+20.04.2/usersession/agent/export_test.go snapd-2.48.3+20.04/usersession/agent/export_test.go
--- snapd-2.45.1+20.04.2/usersession/agent/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/agent/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,8 +25,9 @@
 )
 
 var (
-	SessionInfoCmd    = sessionInfoCmd
-	ServiceControlCmd = serviceControlCmd
+	SessionInfoCmd                = sessionInfoCmd
+	ServiceControlCmd             = serviceControlCmd
+	PendingRefreshNotificationCmd = pendingRefreshNotificationCmd
 )
 
 func MockStopTimeouts(stop, kill time.Duration) (restore func()) {
diff -Nru snapd-2.45.1+20.04.2/usersession/agent/rest_api.go snapd-2.48.3+20.04/usersession/agent/rest_api.go
--- snapd-2.45.1+20.04.2/usersession/agent/rest_api.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/agent/rest_api.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,12 +21,20 @@
 
 import (
 	"encoding/json"
+	"fmt"
+	"mime"
 	"net/http"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/mvo5/goconfigparser"
+
+	"github.com/snapcore/snapd/dbusutil"
+	"github.com/snapcore/snapd/desktop/notification"
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/systemd"
 	"github.com/snapcore/snapd/timeout"
 )
@@ -35,6 +43,7 @@
 	rootCmd,
 	sessionInfoCmd,
 	serviceControlCmd,
+	pendingRefreshNotificationCmd,
 }
 
 var (
@@ -52,6 +61,11 @@
 		Path: "/v1/service-control",
 		POST: postServiceControl,
 	}
+
+	pendingRefreshNotificationCmd = &Command{
+		Path: "/v1/notifications/pending-refresh",
+		POST: postPendingRefreshNotification,
+	}
 )
 
 func sessionInfo(c *Command, r *http.Request) Response {
@@ -104,7 +118,7 @@
 		Type:   ResponseTypeError,
 		Status: 500,
 		Result: &errorResult{
-			Message: "some services failed to start",
+			Message: "some user services failed to start",
 			Kind:    errorKindServiceControl,
 			Value: map[string]interface{}{
 				"start-errors": startErrors,
@@ -135,7 +149,7 @@
 		Type:   ResponseTypeError,
 		Status: 500,
 		Result: &errorResult{
-			Message: "some services failed to stop",
+			Message: "some user services failed to stop",
 			Kind:    errorKindServiceControl,
 			Value: map[string]interface{}{
 				"stop-errors": stopErrors,
@@ -167,10 +181,21 @@
 func (dummyReporter) Notify(string) {}
 
 func postServiceControl(c *Command, r *http.Request) Response {
-	if contentType := r.Header.Get("Content-Type"); contentType != "application/json" {
+	contentType := r.Header.Get("Content-Type")
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return BadRequest("cannot parse content type: %v", err)
+	}
+
+	if mediaType != "application/json" {
 		return BadRequest("unknown content type: %s", contentType)
 	}
 
+	charset := strings.ToUpper(params["charset"])
+	if charset != "" && charset != "UTF-8" {
+		return BadRequest("unknown charset in content type: %s", contentType)
+	}
+
 	decoder := json.NewDecoder(r.Body)
 	var inst serviceInstruction
 	if err := decoder.Decode(&inst); err != nil {
@@ -183,6 +208,110 @@
 	// Prevent multiple systemd actions from being carried out simultaneously
 	systemdLock.Lock()
 	defer systemdLock.Unlock()
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.UserMode, dummyReporter{})
+	sysd := systemd.New(systemd.UserMode, dummyReporter{})
 	return impl(&inst, sysd)
 }
+
+func postPendingRefreshNotification(c *Command, r *http.Request) Response {
+	contentType := r.Header.Get("Content-Type")
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return BadRequest("cannot parse content type: %v", err)
+	}
+
+	if mediaType != "application/json" {
+		return BadRequest("unknown content type: %s", contentType)
+	}
+
+	charset := strings.ToUpper(params["charset"])
+	if charset != "" && charset != "UTF-8" {
+		return BadRequest("unknown charset in content type: %s", contentType)
+	}
+
+	decoder := json.NewDecoder(r.Body)
+
+	// pendingSnapRefreshInfo holds information about pending snap refresh provided by snapd.
+	type pendingSnapRefreshInfo struct {
+		InstanceName        string        `json:"instance-name"`
+		TimeRemaining       time.Duration `json:"time-remaining,omitempty"`
+		BusyAppName         string        `json:"busy-app-name,omitempty"`
+		BusyAppDesktopEntry string        `json:"busy-app-desktop-entry,omitempty"`
+	}
+	var refreshInfo pendingSnapRefreshInfo
+	if err := decoder.Decode(&refreshInfo); err != nil {
+		return BadRequest("cannot decode request body into pending snap refresh info: %v", err)
+	}
+
+	// TODO: use c.a.bus once https://github.com/snapcore/snapd/pull/9497 is merged.
+	conn, err := dbusutil.SessionBus()
+	// Note that since the connection is shared, we are not closing it.
+	if err != nil {
+		return SyncResponse(&resp{
+			Type:   ResponseTypeError,
+			Status: 500,
+			Result: &errorResult{
+				Message: fmt.Sprintf("cannot connect to the session bus: %v", err),
+			},
+		})
+	}
+
+	// TODO: support desktop-specific notification APIs if they provide a better
+	// experience. For example, the GNOME notification API.
+	notifySrv := notification.New(conn)
+
+	// TODO: this message needs to be crafted better as it's the only thing guaranteed to be delivered.
+	summary := fmt.Sprintf(i18n.G("Pending update of %q snap"), refreshInfo.InstanceName)
+	var urgencyLevel notification.Urgency
+	var body, icon string
+	var hints []notification.Hint
+
+	plzClose := i18n.G("Close the app to avoid disruptions")
+	if daysLeft := int(refreshInfo.TimeRemaining.Truncate(time.Hour).Hours() / 24); daysLeft > 0 {
+		urgencyLevel = notification.LowUrgency
+		body = fmt.Sprintf("%s (%s)", plzClose, fmt.Sprintf(
+			i18n.NG("%d day left", "%d days left", daysLeft), daysLeft))
+	} else if hoursLeft := int(refreshInfo.TimeRemaining.Truncate(time.Minute).Minutes() / 60); hoursLeft > 0 {
+		urgencyLevel = notification.NormalUrgency
+		body = fmt.Sprintf("%s (%s)", plzClose, fmt.Sprintf(
+			i18n.NG("%d hour left", "%d hours left", hoursLeft), hoursLeft))
+	} else if minutesLeft := int(refreshInfo.TimeRemaining.Truncate(time.Minute).Minutes()); minutesLeft > 0 {
+		urgencyLevel = notification.CriticalUrgency
+		body = fmt.Sprintf("%s (%s)", plzClose, fmt.Sprintf(
+			i18n.NG("%d minute left", "%d minutes left", minutesLeft), minutesLeft))
+	} else {
+		summary = fmt.Sprintf(i18n.G("Snap %q is refreshing now!"), refreshInfo.InstanceName)
+		urgencyLevel = notification.CriticalUrgency
+	}
+	hints = append(hints, notification.WithUrgency(urgencyLevel))
+	// The notification is provided by snapd session agent.
+	hints = append(hints, notification.WithDesktopEntry("io.snapcraft.SessionAgent"))
+	// But if we have a desktop file of the busy application, use that apps's icon.
+	if refreshInfo.BusyAppDesktopEntry != "" {
+		parser := goconfigparser.New()
+		desktopFilePath := filepath.Join(dirs.SnapDesktopFilesDir, refreshInfo.BusyAppDesktopEntry+".desktop")
+		if err := parser.ReadFile(desktopFilePath); err == nil {
+			icon, _ = parser.Get("Desktop Entry", "Icon")
+		}
+	}
+
+	msg := &notification.Message{
+		AppName: refreshInfo.BusyAppName,
+		Summary: summary,
+		Icon:    icon,
+		Body:    body,
+		Hints:   hints,
+	}
+
+	// TODO: silently ignore error returned when the notification server does not exist.
+	// TODO: track returned notification ID and respond to actions, if supported.
+	if _, err := notifySrv.SendNotification(msg); err != nil {
+		return SyncResponse(&resp{
+			Type:   ResponseTypeError,
+			Status: 500,
+			Result: &errorResult{
+				Message: fmt.Sprintf("cannot send notification message: %v", err),
+			},
+		})
+	}
+	return SyncResponse(nil)
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/agent/rest_api_test.go snapd-2.48.3+20.04/usersession/agent/rest_api_test.go
--- snapd-2.45.1+20.04.2/usersession/agent/rest_api_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/agent/rest_api_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,17 +23,24 @@
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"time"
 
 	. "gopkg.in/check.v1"
 
+	"github.com/godbus/dbus"
+	"github.com/snapcore/snapd/dbusutil"
+	"github.com/snapcore/snapd/dbusutil/dbustest"
+	"github.com/snapcore/snapd/desktop/notification"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/systemd"
 	"github.com/snapcore/snapd/testutil"
 	"github.com/snapcore/snapd/usersession/agent"
+	"github.com/snapcore/snapd/usersession/client"
 )
 
 type restSuite struct {
@@ -107,11 +114,33 @@
 }
 
 func (s *restSuite) TestServiceControlDaemonReload(c *C) {
+	s.testServiceControlDaemonReload(c, "application/json")
+}
+
+func (s *restSuite) TestServiceControlDaemonReloadComplexerContentType(c *C) {
+	s.testServiceControlDaemonReload(c, "application/json; charset=utf-8")
+}
+
+func (s *restSuite) TestServiceControlDaemonReloadInvalidCharset(c *C) {
 	_, err := agent.New()
 	c.Assert(err, IsNil)
 
 	req, err := http.NewRequest("POST", "/v1/service-control", bytes.NewBufferString(`{"action":"daemon-reload"}`))
-	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Content-Type", "application/json; charset=iso-8859-1")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.ServiceControlCmd.POST(agent.ServiceControlCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 400)
+	c.Check(rec.Body.String(), testutil.Contains,
+		"unknown charset in content type")
+}
+
+func (s *restSuite) testServiceControlDaemonReload(c *C, contentType string) {
+	_, err := agent.New()
+	c.Assert(err, IsNil)
+
+	req, err := http.NewRequest("POST", "/v1/service-control", bytes.NewBufferString(`{"action":"daemon-reload"}`))
+	req.Header.Set("Content-Type", contentType)
 	c.Assert(err, IsNil)
 	rec := httptest.NewRecorder()
 	agent.ServiceControlCmd.POST(agent.ServiceControlCmd, req).ServeHTTP(rec, req)
@@ -200,7 +229,7 @@
 	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
 	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
 	c.Check(rsp.Result, DeepEquals, map[string]interface{}{
-		"message": "some services failed to start",
+		"message": "some user services failed to start",
 		"kind":    "service-control",
 		"value": map[string]interface{}{
 			"start-errors": map[string]interface{}{
@@ -247,7 +276,7 @@
 	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
 	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
 	c.Check(rsp.Result, DeepEquals, map[string]interface{}{
-		"message": "some services failed to start",
+		"message": "some user services failed to start",
 		"kind":    "service-control",
 		"value": map[string]interface{}{
 			"start-errors": map[string]interface{}{
@@ -343,7 +372,7 @@
 	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
 	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
 	c.Check(rsp.Result, DeepEquals, map[string]interface{}{
-		"message": "some services failed to stop",
+		"message": "some user services failed to stop",
 		"kind":    "service-control",
 		"value": map[string]interface{}{
 			"stop-errors": map[string]interface{}{
@@ -357,3 +386,288 @@
 		{"--user", "stop", "snap.bar.service"},
 	})
 }
+
+func (s *restSuite) TestPostPendingRefreshNotificationMalformedContentType(c *C) {
+	_, err := agent.New()
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh", bytes.NewBufferString(""))
+	req.Header.Set("Content-Type", "text/plain/joke")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 400)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
+	c.Check(rsp.Result, DeepEquals, map[string]interface{}{"message": "cannot parse content type: mime: unexpected content after media subtype"})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationUnsupportedContentType(c *C) {
+	_, err := agent.New()
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh", bytes.NewBufferString(""))
+	req.Header.Set("Content-Type", "text/plain")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 400)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
+	c.Check(rsp.Result, DeepEquals, map[string]interface{}{"message": "unknown content type: text/plain"})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationUnsupportedContentEncoding(c *C) {
+	_, err := agent.New()
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh", bytes.NewBufferString(""))
+	req.Header.Set("Content-Type", "application/json; charset=EBCDIC")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 400)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
+	c.Check(rsp.Result, DeepEquals, map[string]interface{}{"message": "unknown charset in content type: application/json; charset=EBCDIC"})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationMalformedRequestBody(c *C) {
+	_, err := agent.New()
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh",
+		bytes.NewBufferString(`{"instance-name":syntaxerror}`))
+	req.Header.Set("Content-Type", "application/json")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 400)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
+	c.Check(rsp.Result, DeepEquals, map[string]interface{}{"message": "cannot decode request body into pending snap refresh info: invalid character 's' looking for beginning of value"})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationNoSessionBus(c *C) {
+	noDBus := func() (*dbus.Conn, error) {
+		return nil, fmt.Errorf("cannot find bus")
+	}
+	restore := dbusutil.MockConnections(noDBus, noDBus)
+	defer restore()
+
+	_, err := agent.New()
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh",
+		bytes.NewBufferString(`{"instance-name":"pkg"}`))
+	req.Header.Set("Content-Type", "application/json")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 500)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
+	c.Check(rsp.Result, DeepEquals, map[string]interface{}{"message": "cannot connect to the session bus: cannot find bus"})
+}
+
+func (s *restSuite) testPostPendingRefreshNotificationBody(c *C, refreshInfo *client.PendingSnapRefreshInfo, checkMsg func(c *C, msg *dbus.Message)) {
+	conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		if checkMsg != nil {
+			checkMsg(c, msg)
+		}
+		responseSig := dbus.SignatureOf(uint32(0))
+		response := &dbus.Message{
+			Type: dbus.TypeMethodReply,
+			Headers: map[dbus.HeaderField]dbus.Variant{
+				dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+				dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+				// dbus.FieldDestination is provided automatically by DBus test helper.
+				dbus.FieldSignature: dbus.MakeVariant(responseSig),
+			},
+			Body: []interface{}{uint32(7)}, // NotificationID (ignored for now)
+		}
+		return []*dbus.Message{response}, nil
+	})
+	c.Assert(err, IsNil)
+	restore := dbusutil.MockOnlySessionBusAvailable(conn)
+	defer restore()
+
+	_, err = agent.New()
+	c.Assert(err, IsNil)
+
+	reqBody, err := json.Marshal(refreshInfo)
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh", bytes.NewBuffer(reqBody))
+	req.Header.Set("Content-Type", "application/json")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 200)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeSync)
+	c.Check(rsp.Result, IsNil)
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationHappeningNow(c *C) {
+	refreshInfo := &client.PendingSnapRefreshInfo{InstanceName: "pkg"}
+	s.testPostPendingRefreshNotificationBody(c, refreshInfo, func(c *C, msg *dbus.Message) {
+		c.Check(msg.Body[0], Equals, "")
+		c.Check(msg.Body[1], Equals, uint32(0))
+		c.Check(msg.Body[2], Equals, "")
+		c.Check(msg.Body[3], Equals, `Snap "pkg" is refreshing now!`)
+		c.Check(msg.Body[4], Equals, "")
+		c.Check(msg.Body[5], HasLen, 0)
+		c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+			"urgency":       dbus.MakeVariant(byte(notification.CriticalUrgency)),
+			"desktop-entry": dbus.MakeVariant("io.snapcraft.SessionAgent"),
+		})
+		c.Check(msg.Body[7], Equals, int32(0))
+	})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationFewDays(c *C) {
+	refreshInfo := &client.PendingSnapRefreshInfo{
+		InstanceName:  "pkg",
+		TimeRemaining: time.Hour * 72,
+	}
+	s.testPostPendingRefreshNotificationBody(c, refreshInfo, func(c *C, msg *dbus.Message) {
+		c.Check(msg.Body[3], Equals, `Pending update of "pkg" snap`)
+		c.Check(msg.Body[4], Equals, "Close the app to avoid disruptions (3 days left)")
+		c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+			"urgency":       dbus.MakeVariant(byte(notification.LowUrgency)),
+			"desktop-entry": dbus.MakeVariant("io.snapcraft.SessionAgent"),
+		})
+		c.Check(msg.Body[7], Equals, int32(0))
+	})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationFewHours(c *C) {
+	refreshInfo := &client.PendingSnapRefreshInfo{
+		InstanceName:  "pkg",
+		TimeRemaining: time.Hour * 7,
+	}
+	s.testPostPendingRefreshNotificationBody(c, refreshInfo, func(c *C, msg *dbus.Message) {
+		// boring stuff is checked above
+		c.Check(msg.Body[3], Equals, `Pending update of "pkg" snap`)
+		c.Check(msg.Body[4], Equals, "Close the app to avoid disruptions (7 hours left)")
+		c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+			"urgency":       dbus.MakeVariant(byte(notification.NormalUrgency)),
+			"desktop-entry": dbus.MakeVariant("io.snapcraft.SessionAgent"),
+		})
+	})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationFewMinutes(c *C) {
+	refreshInfo := &client.PendingSnapRefreshInfo{
+		InstanceName:  "pkg",
+		TimeRemaining: time.Minute * 15,
+	}
+	s.testPostPendingRefreshNotificationBody(c, refreshInfo, func(c *C, msg *dbus.Message) {
+		// boring stuff is checked above
+		c.Check(msg.Body[3], Equals, `Pending update of "pkg" snap`)
+		c.Check(msg.Body[4], Equals, "Close the app to avoid disruptions (15 minutes left)")
+		c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+			"urgency":       dbus.MakeVariant(byte(notification.CriticalUrgency)),
+			"desktop-entry": dbus.MakeVariant("io.snapcraft.SessionAgent"),
+		})
+	})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationBusyAppDesktopFile(c *C) {
+	refreshInfo := &client.PendingSnapRefreshInfo{
+		InstanceName:        "pkg",
+		BusyAppName:         "app",
+		BusyAppDesktopEntry: "pkg_app",
+	}
+	err := os.MkdirAll(dirs.SnapDesktopFilesDir, 0755)
+	c.Assert(err, IsNil)
+	desktopFilePath := filepath.Join(dirs.SnapDesktopFilesDir, "pkg_app.desktop")
+	err = ioutil.WriteFile(desktopFilePath, []byte(`
+[Desktop Entry]
+Icon=app.png
+	`), 0644)
+	c.Assert(err, IsNil)
+
+	s.testPostPendingRefreshNotificationBody(c, refreshInfo, func(c *C, msg *dbus.Message) {
+		// boring stuff is checked above
+		c.Check(msg.Body[2], Equals, "app.png")
+		c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+			"urgency":       dbus.MakeVariant(byte(notification.CriticalUrgency)),
+			"desktop-entry": dbus.MakeVariant("io.snapcraft.SessionAgent"),
+		})
+	})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationBusyAppMalformedDesktopFile(c *C) {
+	refreshInfo := &client.PendingSnapRefreshInfo{
+		InstanceName:        "pkg",
+		BusyAppName:         "app",
+		BusyAppDesktopEntry: "pkg_app",
+	}
+	err := os.MkdirAll(dirs.SnapDesktopFilesDir, 0755)
+	c.Assert(err, IsNil)
+	desktopFilePath := filepath.Join(dirs.SnapDesktopFilesDir, "pkg_app.desktop")
+	err = ioutil.WriteFile(desktopFilePath, []byte(`garbage!`), 0644)
+	c.Assert(err, IsNil)
+
+	s.testPostPendingRefreshNotificationBody(c, refreshInfo, func(c *C, msg *dbus.Message) {
+		// boring stuff is checked above
+		c.Check(msg.Body[2], Equals, "") // Icon is not provided
+		c.Check(msg.Body[6], DeepEquals, map[string]dbus.Variant{
+			"desktop-entry": dbus.MakeVariant("io.snapcraft.SessionAgent"),
+			"urgency":       dbus.MakeVariant(byte(notification.CriticalUrgency)),
+		})
+	})
+}
+
+func (s *restSuite) TestPostPendingRefreshNotificationNoNotificationServer(c *C) {
+	conn, err := dbustest.Connection(func(msg *dbus.Message, n int) ([]*dbus.Message, error) {
+		response := &dbus.Message{
+			Type: dbus.TypeError,
+			Headers: map[dbus.HeaderField]dbus.Variant{
+				dbus.FieldReplySerial: dbus.MakeVariant(msg.Serial()),
+				dbus.FieldSender:      dbus.MakeVariant(":1"), // This does not matter.
+				// dbus.FieldDestination is provided automatically by DBus test helper.
+				dbus.FieldErrorName: dbus.MakeVariant("org.freedesktop.DBus.Error.NameHasNoOwner"),
+			},
+		}
+		return []*dbus.Message{response}, nil
+	})
+	c.Assert(err, IsNil)
+	restore := dbusutil.MockOnlySessionBusAvailable(conn)
+	defer restore()
+
+	_, err = agent.New()
+	c.Assert(err, IsNil)
+
+	refreshInfo := &client.PendingSnapRefreshInfo{
+		InstanceName: "pkg",
+	}
+	reqBody, err := json.Marshal(refreshInfo)
+	c.Assert(err, IsNil)
+	req, err := http.NewRequest("POST", "/v1/notifications/pending-refresh", bytes.NewBuffer(reqBody))
+	req.Header.Set("Content-Type", "application/json")
+	c.Assert(err, IsNil)
+	rec := httptest.NewRecorder()
+	agent.PendingRefreshNotificationCmd.POST(agent.PendingRefreshNotificationCmd, req).ServeHTTP(rec, req)
+	c.Check(rec.Code, Equals, 500)
+	c.Check(rec.HeaderMap.Get("Content-Type"), Equals, "application/json")
+
+	var rsp resp
+	c.Assert(json.Unmarshal(rec.Body.Bytes(), &rsp), IsNil)
+	c.Check(rsp.Type, Equals, agent.ResponseTypeError)
+	c.Check(rsp.Result, DeepEquals, map[string]interface{}{"message": "cannot send notification message: org.freedesktop.DBus.Error.NameHasNoOwner"})
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/agent/session_agent.go snapd-2.48.3+20.04/usersession/agent/session_agent.go
--- snapd-2.45.1+20.04.2/usersession/agent/session_agent.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/agent/session_agent.go	2021-02-02 08:21:12.000000000 +0000
@@ -150,14 +150,30 @@
 	shutdownTimeout    = 5 * time.Second
 )
 
+type closeOnceListener struct {
+	net.Listener
+
+	idempotClose sync.Once
+	closeErr     error
+}
+
+func (l *closeOnceListener) Close() error {
+	l.idempotClose.Do(func() {
+		l.closeErr = l.Listener.Close()
+	})
+	return l.closeErr
+}
+
 func (s *SessionAgent) Init() error {
 	listenerMap, err := netutil.ActivationListeners()
 	if err != nil {
 		return err
 	}
 	agentSocket := fmt.Sprintf("%s/%d/snapd-session-agent.socket", dirs.XdgRuntimeDirBase, os.Getuid())
-	if s.listener, err = netutil.GetListener(agentSocket, listenerMap); err != nil {
+	if l, err := netutil.GetListener(agentSocket, listenerMap); err != nil {
 		return fmt.Errorf("cannot listen on socket %s: %v", agentSocket, err)
+	} else {
+		s.listener = &closeOnceListener{Listener: l}
 	}
 	s.idle = &idleTracker{
 		active:     make(map[net.Conn]struct{}),
@@ -182,20 +198,40 @@
 }
 
 func (s *SessionAgent) Start() {
-	s.tomb.Go(func() error {
-		err := s.serve.Serve(s.listener)
-		if err == http.ErrServerClosed {
-			return nil
-		}
-		if err != nil && s.tomb.Err() == tomb.ErrStillAlive {
-			return err
-		}
-		return nil
-	})
+	s.tomb.Go(s.runServer)
+	s.tomb.Go(s.shutdownServerOnKill)
 	s.tomb.Go(s.exitOnIdle)
 	systemd.SdNotify("READY=1")
 }
 
+func (s *SessionAgent) runServer() error {
+	err := s.serve.Serve(s.listener)
+	if err == http.ErrServerClosed {
+		err = nil
+	}
+	if s.tomb.Err() == tomb.ErrStillAlive {
+		return err
+	}
+	return nil
+}
+
+func (s *SessionAgent) shutdownServerOnKill() error {
+	<-s.tomb.Dying()
+	// closing the listener (but then it needs wrapping in
+	// closeOnceListener) before actually calling Shutdown, to
+	// workaround https://github.com/golang/go/issues/20239, we
+	// can in some cases (e.g. tests) end up calling Shutdown
+	// before runServer calls Serve and in go <1.11 this can be
+	// racy and the shutdown blocks.
+	// Historically We do something similar in the main daemon
+	// logic as well.
+	s.listener.Close()
+	systemd.SdNotify("STOPPING=1")
+	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancel()
+	return s.serve.Shutdown(ctx)
+}
+
 func (s *SessionAgent) exitOnIdle() error {
 	timer := time.NewTimer(s.IdleTimeout)
 Loop:
@@ -220,10 +256,7 @@
 // Stop performs a graceful shutdown of the session agent and waits up to 5
 // seconds for it to complete.
 func (s *SessionAgent) Stop() error {
-	systemd.SdNotify("STOPPING=1")
-	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
-	defer cancel()
-	s.tomb.Kill(s.serve.Shutdown(ctx))
+	s.tomb.Kill(nil)
 	return s.tomb.Wait()
 }
 
diff -Nru snapd-2.45.1+20.04.2/usersession/client/client.go snapd-2.48.3+20.04/usersession/client/client.go
--- snapd-2.45.1+20.04.2/usersession/client/client.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/client/client.go	2021-02-02 08:21:12.000000000 +0000
@@ -32,6 +32,7 @@
 	"path/filepath"
 	"strconv"
 	"sync"
+	"time"
 
 	"github.com/snapcore/snapd/dirs"
 )
@@ -239,18 +240,12 @@
 		return nil, nil, err
 	}
 	for _, resp := range responses {
-		if resp.err == nil {
-			continue
-		}
 		if agentErr, ok := resp.err.(*Error); ok && agentErr.Kind == "service-control" {
 			if errorValue, ok := agentErr.Value.(map[string]interface{}); ok {
-				failures, err1 := decodeServiceErrors(resp.uid, errorValue, "start-errors")
+				failures, _ := decodeServiceErrors(resp.uid, errorValue, "start-errors")
 				startFailures = append(startFailures, failures...)
-				failures, err2 := decodeServiceErrors(resp.uid, errorValue, "stop-errors")
+				failures, _ = decodeServiceErrors(resp.uid, errorValue, "stop-errors")
 				stopFailures = append(stopFailures, failures...)
-				if err1 == nil && err2 == nil {
-					continue
-				}
 			}
 		}
 		if resp.err != nil && err == nil {
@@ -273,3 +268,22 @@
 	_, stopFailures, err = client.serviceControlCall(ctx, "stop", services)
 	return stopFailures, err
 }
+
+// PendingSnapRefreshInfo holds information about pending snap refresh provided to userd.
+type PendingSnapRefreshInfo struct {
+	InstanceName        string        `json:"instance-name"`
+	TimeRemaining       time.Duration `json:"time-remaining,omitempty"`
+	BusyAppName         string        `json:"busy-app-name,omitempty"`
+	BusyAppDesktopEntry string        `json:"busy-app-desktop-entry,omitempty"`
+}
+
+// PendingRefreshNotification broadcasts information about a refresh.
+func (client *Client) PendingRefreshNotification(ctx context.Context, refreshInfo *PendingSnapRefreshInfo) error {
+	headers := map[string]string{"Content-Type": "application/json"}
+	reqBody, err := json.Marshal(refreshInfo)
+	if err != nil {
+		return err
+	}
+	_, err = client.doMany(ctx, "POST", "/v1/notifications/pending-refresh", nil, headers, reqBody)
+	return err
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/client/client_test.go snapd-2.48.3+20.04/usersession/client/client_test.go
--- snapd-2.45.1+20.04.2/usersession/client/client_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/client/client_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -36,6 +36,10 @@
 	"github.com/snapcore/snapd/usersession/client"
 )
 
+var (
+	timeout = testutil.HostScaledTimeout(80 * time.Millisecond)
+)
+
 func Test(t *testing.T) { TestingT(t) }
 
 type clientSuite struct {
@@ -120,7 +124,7 @@
 }`))
 	})
 
-	ctx, cancel := context.WithTimeout(context.Background(), 80*time.Millisecond)
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
 	si, err := s.cli.SessionInfo(ctx)
 
@@ -252,7 +256,7 @@
 }`))
 	})
 	startFailures, stopFailures, err := s.cli.ServicesStart(context.Background(), []string{"service1.service", "service2.service"})
-	c.Assert(err, IsNil)
+	c.Assert(err, ErrorMatches, "failed to start services")
 	c.Check(startFailures, HasLen, 2)
 	c.Check(stopFailures, HasLen, 0)
 
@@ -299,7 +303,7 @@
 }`))
 	})
 	startFailures, stopFailures, err := s.cli.ServicesStart(context.Background(), []string{"service1.service", "service2.service"})
-	c.Assert(err, IsNil)
+	c.Assert(err, ErrorMatches, "failed to start services")
 	c.Check(startFailures, DeepEquals, []client.ServiceFailure{
 		{
 			Uid:     42,
@@ -343,7 +347,7 @@
 	// Error value is a map, but missing start-errors/stop-errors keys
 	errorValue = "{}"
 	startFailures, stopFailures, err = s.cli.ServicesStart(context.Background(), []string{"service1.service"})
-	c.Check(err, IsNil)
+	c.Check(err, ErrorMatches, "failed to stop services")
 	c.Check(startFailures, HasLen, 0)
 	c.Check(stopFailures, HasLen, 0)
 
@@ -424,7 +428,7 @@
 }`))
 	})
 	failures, err := s.cli.ServicesStop(context.Background(), []string{"service1.service", "service2.service"})
-	c.Assert(err, IsNil)
+	c.Assert(err, ErrorMatches, "failed to stop services")
 	c.Check(failures, HasLen, 2)
 	failure0 := failures[0]
 	failure1 := failures[1]
@@ -442,3 +446,14 @@
 		Error:   "failed to stop",
 	})
 }
+
+func (s *clientSuite) TestPendingRefreshNotification(c *C) {
+	s.handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c.Assert(r.URL.Path, Equals, "/v1/notifications/pending-refresh")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(200)
+		w.Write([]byte(`{"type": "sync"}`))
+	})
+	err := s.cli.PendingRefreshNotification(context.Background(), &client.PendingSnapRefreshInfo{})
+	c.Assert(err, IsNil)
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/userd/launcher.go snapd-2.48.3+20.04/usersession/userd/launcher.go
--- snapd-2.45.1+20.04.2/usersession/userd/launcher.go	2020-07-07 12:09:37.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/userd/launcher.go	2021-02-02 08:21:12.000000000 +0000
@@ -71,37 +71,50 @@
 // This code uses golang's net/url.Parse() which will help ensure the url is
 // ok before passing to xdg-open. xdg-open itself properly quotes the url so
 // shell metacharacters are blocked.
-//
-// apt: the scheme allows specifying a package for xdg-open to pass to an
-//   apt-handling application, like gnome-software, apturl, etc which are all
-//   protected by policykit
-//   - scheme: apt:<name of package>
-//   - https://github.com/snapcore/snapd/pull/7731
-//
-// help: the scheme allows for specifying a help URL. This code ensures that
-//   the url is parseable
-//   - scheme: help://topic
-//   - https://github.com/snapcore/snapd/pull/6493
-//
-// http/https: the scheme allows specifying a web URL. This code ensures that
-//   the url is parseable
-//   - scheme: http(s)://example.com
-//
-// mailto: the scheme allows for specifying an email address
-//   - scheme: mailto:foo@example.com
-//
-// snap: the scheme allows specifying a package for xdg-open to pass to a
-//   snap-handling installer application, like snap-store, etc which are
-//   protected by policykit/snap login
-//   - https://github.com/snapcore/snapd/pull/5181
-//
-// zoommtg: the scheme is a modified web url scheme
-//   - scheme: https://medium.com/zoom-developer-blog/zoom-url-schemes-748b95fd9205
-//     (eg, zoommtg://zoom.us/...)
-//   - https://github.com/snapcore/snapd/pull/8304
-
 var (
-	allowedURLSchemes = []string{"http", "https", "mailto", "snap", "help", "apt", "zoommtg"}
+	allowedURLSchemes = []string{
+		// apt: the scheme allows specifying a package for xdg-open to pass to an
+		//   apt-handling application, like gnome-software, apturl, etc which are all
+		//   protected by policykit
+		//   - scheme: apt:<name of package>
+		//   - https://github.com/snapcore/snapd/pull/7731
+		"apt",
+		// help: the scheme allows for specifying a help URL. This code ensures that
+		//   the url is parseable
+		//   - scheme: help://topic
+		//   - https://github.com/snapcore/snapd/pull/6493
+		"help",
+		// http/https: the scheme allows specifying a web URL. This code ensures that
+		//   the url is parseable
+		//   - scheme: http(s)://example.com
+		"http",
+		"https",
+		// mailto: the scheme allows for specifying an email address
+		//   - scheme: mailto:foo@example.com
+		"mailto",
+		// msteams: the scheme is a thin wrapper around https.
+		//   - scheme: msteams:...
+		//   - https://github.com/snapcore/snapd/pull/8761
+		"msteams",
+		// TODO: document slack URL scheme.
+		"slack",
+		// snap: the scheme allows specifying a package for xdg-open to pass to a
+		//   snap-handling installer application, like snap-store, etc which are
+		//   protected by policykit/snap login
+		//   - https://github.com/snapcore/snapd/pull/5181
+		"snap",
+		// zoommtg: the scheme is a modified web url scheme
+		//   - scheme: https://medium.com/zoom-developer-blog/zoom-url-schemes-748b95fd9205
+		//     (eg, zoommtg://zoom.us/...)
+		//   - https://github.com/snapcore/snapd/pull/8304
+		"zoommtg",
+		// zoomphonecall: another zoom URL scheme, for dialing phone numbers
+		//   - https://github.com/snapcore/snapd/pull/8910
+		"zoomphonecall",
+		// zoomus: alternative name for zoommtg
+		//   - https://github.com/snapcore/snapd/pull/8910
+		"zoomus",
+	}
 )
 
 // Launcher implements the 'io.snapcraft.Launcher' DBus interface.
@@ -109,13 +122,13 @@
 	conn *dbus.Conn
 }
 
-// Name returns the name of the interface this object implements
-func (s *Launcher) Name() string {
+// Interface returns the name of the interface this object implements
+func (s *Launcher) Interface() string {
 	return "io.snapcraft.Launcher"
 }
 
-// BasePath returns the base path of the object
-func (s *Launcher) BasePath() dbus.ObjectPath {
+// ObjectPath returns the path that the object is exported as
+func (s *Launcher) ObjectPath() dbus.ObjectPath {
 	return "/io/snapcraft/Launcher"
 }
 
diff -Nru snapd-2.45.1+20.04.2/usersession/userd/launcher_test.go snapd-2.48.3+20.04/usersession/userd/launcher_test.go
--- snapd-2.45.1+20.04.2/usersession/userd/launcher_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/userd/launcher_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -75,7 +75,7 @@
 }
 
 func (s *launcherSuite) TestOpenURLWithAllowedSchemeHappy(c *C) {
-	for _, schema := range []string{"http", "https", "mailto", "snap", "help", "apt", "zoommtg"} {
+	for _, schema := range []string{"http", "https", "mailto", "snap", "help", "apt", "zoommtg", "zoomus", "zoomphonecall", "slack", "msteams"} {
 		err := s.launcher.OpenURL(schema+"://snapcraft.io", ":some-dbus-sender")
 		c.Assert(err, IsNil)
 		c.Assert(s.mockXdgOpen.Calls(), DeepEquals, [][]string{
diff -Nru snapd-2.45.1+20.04.2/usersession/userd/settings.go snapd-2.48.3+20.04/usersession/userd/settings.go
--- snapd-2.45.1+20.04.2/usersession/userd/settings.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/userd/settings.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2017 Canonical Ltd
+ * Copyright (C) 2017-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -27,6 +27,7 @@
 	"time"
 
 	"github.com/godbus/dbus"
+
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/osutil"
@@ -53,19 +54,35 @@
 		<arg type='s' name='check' direction='in'/>
 		<arg type='s' name='result' direction='out'/>
 	</method>
+	<method name='CheckSub'>
+		<arg type='s' name='setting' direction='in'/>
+		<arg type='s' name='subproperty' direction='in'/>
+		<arg type='s' name='check' direction='in'/>
+		<arg type='s' name='result' direction='out'/>
+	</method>
 	<method name='Get'>
 		<arg type='s' name='setting' direction='in'/>
 		<arg type='s' name='result' direction='out'/>
 	</method>
+	<method name='GetSub'>
+		<arg type='s' name='setting' direction='in'/>
+		<arg type='s' name='subproperty' direction='in'/>
+		<arg type='s' name='result' direction='out'/>
+	</method>
 	<method name='Set'>
 		<arg type='s' name='setting' direction='in'/>
 		<arg type='s' name='value' direction='in'/>
 	</method>
+	<method name='SetSub'>
+		<arg type='s' name='setting' direction='in'/>
+		<arg type='s' name='subproperty' direction='in'/>
+		<arg type='s' name='value' direction='in'/>
+	</method>
 </interface>`
 
-// TODO: allow setting default-url-scheme-handler ?
-var settingsWhitelist = []string{
+var validSettings = []string{
 	"default-web-browser",
+	"default-url-scheme-handler",
 }
 
 func allowedSetting(setting string) bool {
@@ -77,13 +94,27 @@
 	return snap.ValidAppName(base)
 }
 
-func settingWhitelisted(setting string) *dbus.Error {
-	for _, whitelisted := range settingsWhitelist {
-		if setting == whitelisted {
+// settingSpec specifies a setting with an optional subproperty
+type settingSpec struct {
+	setting     string
+	subproperty string
+}
+
+func (s *settingSpec) String() string {
+	if s.subproperty != "" {
+		return fmt.Sprintf("%q subproperty %q", s.setting, s.subproperty)
+	} else {
+		return fmt.Sprintf("%q", s.setting)
+	}
+}
+
+func (s *settingSpec) validate() *dbus.Error {
+	for _, valid := range validSettings {
+		if s.setting == valid {
 			return nil
 		}
 	}
-	return dbus.MakeFailedError(fmt.Errorf("cannot use setting %q: not allowed", setting))
+	return dbus.MakeFailedError(fmt.Errorf("invalid setting %q", s.setting))
 }
 
 // Settings implements the 'io.snapcraft.Settings' DBus interface.
@@ -91,13 +122,13 @@
 	conn *dbus.Conn
 }
 
-// Name returns the name of the interface this object implements
-func (s *Settings) Name() string {
+// Interface returns the name of the interface this object implements
+func (s *Settings) Interface() string {
 	return "io.snapcraft.Settings"
 }
 
-// BasePath returns the base path of the object
-func (s *Settings) BasePath() dbus.ObjectPath {
+// ObjectPath returns the path that the object is exported as
+func (s *Settings) ObjectPath() dbus.ObjectPath {
 	return "/io/snapcraft/Settings"
 }
 
@@ -112,82 +143,48 @@
 // - all desktop files of snaps are prefixed with: ${snap}_
 // - on get/check/set we need to add/strip this prefix
 
-// Check implements the 'Check' method of the 'io.snapcraft.Settings'
-// DBus interface.
-//
-// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.Check string:'default-web-browser' string:'firefox.desktop'
-func (s *Settings) Check(setting, check string, sender dbus.Sender) (string, *dbus.Error) {
+func safeSnapFromSender(s *Settings, sender dbus.Sender) (string, *dbus.Error) {
 	// avoid information leak: see https://github.com/snapcore/snapd/pull/4073#discussion_r146682758
 	snap, err := snapFromSender(s.conn, sender)
 	if err != nil {
 		return "", dbus.MakeFailedError(err)
 	}
-	if err := settingWhitelisted(setting); err != nil {
-		return "", err
-	}
-	if !allowedSetting(check) {
-		return "", dbus.MakeFailedError(fmt.Errorf("cannot check setting %q to value %q: value not allowed", setting, check))
-	}
-
-	// FIXME: this works only for desktop files
-	desktopFile := fmt.Sprintf("%s_%s", snap, check)
+	return snap, nil
+}
 
-	cmd := exec.Command("xdg-settings", "check", setting, desktopFile)
-	output, err := cmd.CombinedOutput()
+func desktopFileFromValueForSetting(s *Settings, command string, setspec *settingSpec, dotDesktopValue string, sender dbus.Sender) (string, *dbus.Error) {
+	snap, err := safeSnapFromSender(s, sender)
 	if err != nil {
-		return "", dbus.MakeFailedError(fmt.Errorf("cannot check setting %s: %s", setting, osutil.OutputErr(output, err)))
+		return "", err
 	}
-
-	return strings.TrimSpace(string(output)), nil
-}
-
-// Get implements the 'Get' method of the 'io.snapcraft.Settings'
-// DBus interface.
-//
-// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.Get string:'default-web-browser'
-func (s *Settings) Get(setting string, sender dbus.Sender) (string, *dbus.Error) {
-	if err := settingWhitelisted(setting); err != nil {
+	if err := setspec.validate(); err != nil {
 		return "", err
 	}
 
-	cmd := exec.Command("xdg-settings", "get", setting)
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		return "", dbus.MakeFailedError(fmt.Errorf("cannot get setting %s: %s", setting, osutil.OutputErr(output, err)))
+	if !allowedSetting(dotDesktopValue) {
+		return "", dbus.MakeFailedError(fmt.Errorf("cannot %s %s setting to invalid value %q", command, setspec, dotDesktopValue))
 	}
 
-	// avoid information leak: see https://github.com/snapcore/snapd/pull/4073#discussion_r146682758
-	snap, err := snapFromSender(s.conn, sender)
+	// FIXME: this works only for desktop files
+	desktopFile := fmt.Sprintf("%s_%s", snap, dotDesktopValue)
+	return desktopFile, nil
+}
+
+func desktopFileFromOutput(s *Settings, output string, sender dbus.Sender) (string, *dbus.Error) {
+	snap, err := safeSnapFromSender(s, sender)
 	if err != nil {
-		return "", dbus.MakeFailedError(err)
+		return "", err
 	}
-	if !strings.HasPrefix(string(output), snap+"_") {
+	if !strings.HasPrefix(output, snap+"_") {
 		return "NOT-THIS-SNAP.desktop", nil
 	}
 
-	desktopFile := strings.SplitN(string(output), "_", 2)[1]
+	desktopFile := strings.SplitN(output, "_", 2)[1]
 	return strings.TrimSpace(desktopFile), nil
 }
 
-// Set implements the 'Set' method of the 'io.snapcraft.Settings'
-// DBus interface.
-//
-// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.Set string:'default-web-browser' string:'chromium-browser.desktop'
-func (s *Settings) Set(setting, new string, sender dbus.Sender) *dbus.Error {
-	if err := settingWhitelisted(setting); err != nil {
-		return err
-	}
-	// see https://github.com/snapcore/snapd/pull/4073#discussion_r146682758
-	snap, err := snapFromSender(s.conn, sender)
-	if err != nil {
-		return dbus.MakeFailedError(err)
-	}
-
-	if !allowedSetting(new) {
-		return dbus.MakeFailedError(fmt.Errorf("cannot set setting %q to value %q: value not allowed", setting, new))
-	}
-	new = fmt.Sprintf("%s_%s", snap, new)
-	df := filepath.Join(dirs.SnapDesktopFilesDir, new)
+func setDialog(s *Settings, setspec *settingSpec, desktopFile string, sender dbus.Sender) *dbus.Error {
+	df := filepath.Join(dirs.SnapDesktopFilesDir, desktopFile)
 	if !osutil.FileExists(df) {
 		return dbus.MakeFailedError(fmt.Errorf("cannot find desktop file %q", df))
 	}
@@ -200,13 +197,19 @@
 	//        the X windows for _NET_WM_PID and use the windowID to
 	//        attach to zenity - not sure how this translate to the
 	//        wayland world though :/
-	dialog, err := ui.New()
+	dialog, uiErr := ui.New()
+	if uiErr != nil {
+		return dbus.MakeFailedError(fmt.Errorf("cannot ask for settings change: %v", uiErr))
+	}
+
+	snap, err := safeSnapFromSender(s, sender)
 	if err != nil {
-		return dbus.MakeFailedError(fmt.Errorf("cannot ask for settings change: %v", err))
+		return err
 	}
+
 	answeredYes := dialog.YesNo(
 		i18n.G("Allow settings change?"),
-		fmt.Sprintf(i18n.G("Allow snap %q to change %q to %q ?"), snap, setting, new),
+		fmt.Sprintf(i18n.G("Allow snap %q to change %s to %q ?"), snap, setspec, desktopFile),
 		&ui.DialogOptions{
 			Timeout: defaultConfirmDialogTimeout,
 			Footer:  i18n.G("This dialog will close automatically after 5 minutes of inactivity."),
@@ -215,11 +218,136 @@
 	if !answeredYes {
 		return dbus.MakeFailedError(fmt.Errorf("cannot change configuration: user declined change"))
 	}
+	return nil
+}
 
-	cmd := exec.Command("xdg-settings", "set", setting, new)
+func checkOutput(cmd *exec.Cmd, command string, setspec *settingSpec) (string, *dbus.Error) {
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return dbus.MakeFailedError(fmt.Errorf("cannot set setting %s: %s", setting, osutil.OutputErr(output, err)))
+		return "", dbus.MakeFailedError(fmt.Errorf("cannot %s %s setting: %s", command, setspec, osutil.OutputErr(output, err)))
+	}
+	return string(output), nil
+}
+
+// Check implements the 'Check' method of the 'io.snapcraft.Settings'
+// DBus interface.
+//
+// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.Check string:'default-web-browser' string:'firefox.desktop'
+func (s *Settings) Check(setting string, check string, sender dbus.Sender) (string, *dbus.Error) {
+	settingMain := &settingSpec{setting: setting}
+	desktopFile, err := desktopFileFromValueForSetting(s, "check", settingMain, check, sender)
+	if err != nil {
+		return "", err
+	}
+
+	cmd := exec.Command("xdg-settings", "check", setting, desktopFile)
+	output, err := checkOutput(cmd, "check", settingMain)
+	if err != nil {
+		return "", err
+	}
+
+	return strings.TrimSpace(output), nil
+}
+
+// CheckSub implements the 'CheckSub' method of the 'io.snapcraft.Settings'
+// DBus interface.
+//
+// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.CheckSub string:'default-url-scheme-handler' string:'irc' string:'ircclient.desktop'
+func (s *Settings) CheckSub(setting string, subproperty string, check string, sender dbus.Sender) (string, *dbus.Error) {
+	settingSub := &settingSpec{setting: setting, subproperty: subproperty}
+	desktopFile, err := desktopFileFromValueForSetting(s, "check", settingSub, check, sender)
+	if err != nil {
+		return "", err
+	}
+
+	cmd := exec.Command("xdg-settings", "check", setting, subproperty, desktopFile)
+	output, err := checkOutput(cmd, "check", settingSub)
+	if err != nil {
+		return "", err
+	}
+
+	return strings.TrimSpace(output), nil
+}
+
+// Get implements the 'Get' method of the 'io.snapcraft.Settings'
+// DBus interface.
+//
+// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.Get string:'default-web-browser'
+func (s *Settings) Get(setting string, sender dbus.Sender) (string, *dbus.Error) {
+	settingMain := &settingSpec{setting: setting}
+	if err := settingMain.validate(); err != nil {
+		return "", err
+	}
+
+	cmd := exec.Command("xdg-settings", "get", setting)
+	output, err := checkOutput(cmd, "get", settingMain)
+	if err != nil {
+		return "", err
+	}
+
+	return desktopFileFromOutput(s, output, sender)
+}
+
+// GetSub implements the 'GetSub' method of the 'io.snapcraft.Settings'
+// DBus interface.
+//
+// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.GetSub string:'default-url-scheme-handler' string:'irc'
+func (s *Settings) GetSub(setting string, subproperty string, sender dbus.Sender) (string, *dbus.Error) {
+	settingSub := &settingSpec{setting: setting, subproperty: subproperty}
+	if err := settingSub.validate(); err != nil {
+		return "", err
+	}
+
+	cmd := exec.Command("xdg-settings", "get", setting, subproperty)
+	output, err := checkOutput(cmd, "get", settingSub)
+	if err != nil {
+		return "", err
+	}
+
+	return desktopFileFromOutput(s, output, sender)
+}
+
+// Set implements the 'Set' method of the 'io.snapcraft.Settings'
+// DBus interface.
+//
+// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.Set string:'default-web-browser' string:'chromium-browser.desktop'
+func (s *Settings) Set(setting string, new string, sender dbus.Sender) *dbus.Error {
+	settingMain := &settingSpec{setting: setting}
+	desktopFile, err := desktopFileFromValueForSetting(s, "set", settingMain, new, sender)
+	if err != nil {
+		return err
+	}
+
+	if err := setDialog(s, settingMain, desktopFile, sender); err != nil {
+		return err
+	}
+
+	cmd := exec.Command("xdg-settings", "set", setting, desktopFile)
+	if _, err := checkOutput(cmd, "set", settingMain); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// SetSub implements the 'SetSub' method of the 'io.snapcraft.Settings'
+// DBus interface.
+//
+// Example usage: dbus-send --session --dest=io.snapcraft.Settings --type=method_call --print-reply /io/snapcraft/Settings io.snapcraft.Settings.SetSub string:'default-url-scheme-handler' string:'irc' string:'ircclient.desktop'
+func (s *Settings) SetSub(setting string, subproperty string, new string, sender dbus.Sender) *dbus.Error {
+	settingSub := &settingSpec{setting: setting, subproperty: subproperty}
+	desktopFile, err := desktopFileFromValueForSetting(s, "set", settingSub, new, sender)
+	if err != nil {
+		return err
+	}
+
+	if err := setDialog(s, settingSub, desktopFile, sender); err != nil {
+		return err
+	}
+
+	cmd := exec.Command("xdg-settings", "set", setting, subproperty, desktopFile)
+	if _, err := checkOutput(cmd, "set", settingSub); err != nil {
+		return err
 	}
 
 	return nil
diff -Nru snapd-2.45.1+20.04.2/usersession/userd/settings_test.go snapd-2.48.3+20.04/usersession/userd/settings_test.go
--- snapd-2.45.1+20.04.2/usersession/userd/settings_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/userd/settings_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -1,7 +1,7 @@
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
- * Copyright (C) 2017 Canonical Ltd
+ * Copyright (C) 2017-2020 Canonical Ltd
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
@@ -50,19 +50,62 @@
 
 	s.settings = &userd.Settings{}
 	s.mockXdgSettings = testutil.MockCommand(c, "xdg-settings", `
-if [ "$1" = "get" ] && [ "$2" = "default-web-browser" ];  then
-  echo "some-snap_foo.desktop"
-elif [ "$1" = "check" ] && [ "$2" = "default-web-browser" ] && [ "$3" = "some-snap_foo.desktop" ];  then
-  echo yes
-elif [ "$1" = "check" ] && [ "$2" = "default-web-browser" ];  then
-  echo no
-elif [ "$1" = "set" ] && [ "$2" = "default-web-browser" ]; then
-  # nothing to do
-  exit 0
-else
-  echo "mock called with unsupported arguments $*"
-  exit 1
-fi
+case "$1" in
+    get)
+        case "$2" in
+            default-web-browser)
+                echo "some-snap_foo.desktop"
+                ;;
+            default-url-scheme-handler)
+                echo "some-snap_ircclient.desktop"
+                ;;
+            *)
+                echo "mock called with unsupported arguments: $*"
+                exit 1
+                ;;
+        esac
+        ;;
+    set)
+        case "$2" in
+            default-web-browser)
+                # nothing to do
+                ;;
+            default-url-scheme-handler)
+                if [ "$3" = "irc2" ]; then
+                    echo "fail"
+                    exit 1
+                fi
+                # nothing to do
+                ;;
+            *)
+                echo "mock called with unsupported arguments: $*"
+                exit 1
+                ;;
+        esac
+        ;;
+    check)
+        case "$2" in
+            default-web-browser)
+                if [ "$3" = "some-snap_foo.desktop" ]; then
+                    echo "yes"
+                else
+                    echo "no"
+                fi
+                ;;
+            default-url-scheme-handler)
+                if [ "$3" = "irc" ] && [ "$4" = "some-snap_ircclient.desktop" ]; then
+                    echo "yes"
+                else
+                    echo "no"
+                fi
+                ;;
+        esac
+        ;;
+    *)
+        echo "mock called with unsupported argument: $1"
+        exit 1
+        ;;
+esac
 `)
 }
 
@@ -86,9 +129,9 @@
 		setting    string
 		errMatcher string
 	}{
-		{"random-setting", `cannot use setting "random-setting": not allowed`},
-		{"invälid", `cannot use setting "invälid": not allowed`},
-		{"", `cannot use setting "": not allowed`},
+		{"random-setting", `invalid setting "random-setting"`},
+		{"invälid", `invalid setting "invälid"`},
+		{"", `invalid setting ""`},
 	} {
 		_, err := s.settings.Get(t.setting, ":some-dbus-sender")
 		c.Assert(err, ErrorMatches, t.errMatcher)
@@ -107,7 +150,7 @@
 
 func (s *settingsSuite) TestCheckInvalidSetting(c *C) {
 	_, err := s.settings.Check("random-setting", "foo.desktop", ":some-dbus-sender")
-	c.Assert(err, ErrorMatches, `cannot use setting "random-setting": not allowed`)
+	c.Assert(err, ErrorMatches, `invalid setting "random-setting"`)
 	c.Assert(s.mockXdgSettings.Calls(), IsNil)
 }
 
@@ -120,6 +163,15 @@
 	})
 }
 
+func (s *settingsSuite) TestCheckIsDefaultUrlScheme(c *C) {
+	isDefault, err := s.settings.CheckSub("default-url-scheme-handler", "irc", "ircclient.desktop", ":some-dbus-sender")
+	c.Assert(err, IsNil)
+	c.Check(isDefault, Equals, "yes")
+	c.Check(s.mockXdgSettings.Calls(), DeepEquals, [][]string{
+		{"xdg-settings", "check", "default-url-scheme-handler", "irc", "some-snap_ircclient.desktop"},
+	})
+}
+
 func (s *settingsSuite) TestCheckNoDefault(c *C) {
 	isDefault, err := s.settings.Check("default-web-browser", "bar.desktop", ":some-dbus-sender")
 	c.Assert(err, IsNil)
@@ -129,9 +181,69 @@
 	})
 }
 
+func (s *settingsSuite) TestCheckNoDefaultUrlScheme(c *C) {
+	isDefault, err := s.settings.CheckSub("default-url-scheme-handler", "irc", "bar.desktop", ":some-dbus-sender")
+	c.Assert(err, IsNil)
+	c.Check(isDefault, Equals, "no")
+	c.Check(s.mockXdgSettings.Calls(), DeepEquals, [][]string{
+		{"xdg-settings", "check", "default-url-scheme-handler", "irc", "some-snap_bar.desktop"},
+	})
+}
+
+func (s *settingsSuite) TestNotThisSnap(c *C) {
+	mockXdgSettings := testutil.MockCommand(c, "xdg-settings", `
+if [ "$1" = "get" ] && [ "$2" = "default-web-browser" ]; then
+    echo "other-snap_foo.desktop"
+    exit 0
+fi
+if [ "$1" = "get" ] && [ "$2" = "default-url-scheme-handler" ] && [ "$3" = "irc" ]; then
+    echo "other-snap_foo-irc.desktop"
+    exit 0
+fi
+
+echo "mock called with unsupported argument: $1"
+exit 1
+`)
+	defer mockXdgSettings.Restore()
+
+	defaultBrowser, err := s.settings.Get("default-web-browser", ":some-dbus-sender")
+	c.Assert(err, IsNil)
+	c.Check(defaultBrowser, Equals, "NOT-THIS-SNAP.desktop")
+	c.Check(mockXdgSettings.Calls(), DeepEquals, [][]string{
+		{"xdg-settings", "get", "default-web-browser"},
+	})
+
+	mockXdgSettings.ForgetCalls()
+
+	defaultSchemeHandler, err := s.settings.GetSub("default-url-scheme-handler", "irc", ":some-dbus-sender")
+	c.Assert(err, IsNil)
+	c.Check(defaultSchemeHandler, Equals, "NOT-THIS-SNAP.desktop")
+	c.Check(mockXdgSettings.Calls(), DeepEquals, [][]string{
+		{"xdg-settings", "get", "default-url-scheme-handler", "irc"},
+	})
+}
+
 func (s *settingsSuite) TestSetInvalidSetting(c *C) {
 	err := s.settings.Set("random-setting", "foo.desktop", ":some-dbus-sender")
-	c.Assert(err, ErrorMatches, `cannot use setting "random-setting": not allowed`)
+	c.Assert(err, ErrorMatches, `invalid setting "random-setting"`)
+	c.Assert(s.mockXdgSettings.Calls(), IsNil)
+}
+
+func (s *settingsSuite) TestSetInvalidValue(c *C) {
+	err := s.settings.Set("default-web-browser", "foo", ":some-dbus-sender")
+	c.Assert(err, ErrorMatches, `cannot set "default-web-browser" setting to invalid value "foo"`)
+	c.Assert(s.mockXdgSettings.Calls(), IsNil)
+}
+
+func (s *settingsSuite) TestSetSubInvalidSetting(c *C) {
+	err := s.settings.SetSub("random-setting", "subprop", "foo.desktop", ":some-dbus-sender")
+	c.Assert(err, ErrorMatches, `invalid setting "random-setting"`)
+	c.Assert(s.mockXdgSettings.Calls(), IsNil)
+}
+
+func (s *settingsSuite) TestSetSubInvalidValue(c *C) {
+	err := s.settings.SetSub("default-url-scheme-handler", "irc", "foo", ":some-dbus-sender")
+	c.Assert(err, ErrorMatches, `cannot set "default-url-scheme-handler" subproperty "irc" setting to invalid value "foo"`)
 	c.Assert(s.mockXdgSettings.Calls(), IsNil)
 }
 
@@ -197,6 +309,20 @@
 	*/
 }
 
+func (s *settingsSuite) testSetUserAcceptsURLScheme(c *C) {
+	df := filepath.Join(dirs.SnapDesktopFilesDir, "some-snap_ircclient.desktop")
+	err := os.MkdirAll(filepath.Dir(df), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(df, nil, 0644)
+	c.Assert(err, IsNil)
+
+	err = s.settings.SetSub("default-url-scheme-handler", "irc", "ircclient.desktop", ":some-dbus-sender")
+	c.Assert(err, IsNil)
+	c.Check(s.mockXdgSettings.Calls(), DeepEquals, [][]string{
+		{"xdg-settings", "set", "default-url-scheme-handler", "irc", "some-snap_ircclient.desktop"},
+	})
+}
+
 func (s *settingsSuite) TestSetUserAcceptsZenity(c *C) {
 	// force kdialog exec missing
 	restoreKDialog := ui.MockHasKDialogExecutable(func() bool { return false })
@@ -209,6 +335,18 @@
 	s.testSetUserAccepts(c)
 }
 
+func (s *settingsSuite) TestSetUserAcceptsZenityUrlScheme(c *C) {
+	// force kdialog exec missing
+	restoreKDialog := ui.MockHasKDialogExecutable(func() bool { return false })
+	restoreCmds := mockUIcommands(c, "true")
+	defer func() {
+		restoreKDialog()
+		restoreCmds()
+	}()
+
+	s.testSetUserAcceptsURLScheme(c)
+}
+
 func (s *settingsSuite) TestSetUserAcceptsKDialog(c *C) {
 	// force zenity exec missing
 	restoreZenity := ui.MockHasZenityExecutable(func() bool { return false })
@@ -220,3 +358,37 @@
 
 	s.testSetUserAccepts(c)
 }
+
+func (s *settingsSuite) TestSetUserAcceptsKDialogUrlScheme(c *C) {
+	// force zenity exec missing
+	restoreZenity := ui.MockHasZenityExecutable(func() bool { return false })
+	restoreCmds := mockUIcommands(c, "true")
+	defer func() {
+		restoreZenity()
+		restoreCmds()
+	}()
+
+	s.testSetUserAcceptsURLScheme(c)
+}
+
+func (s *settingsSuite) TestSetUserAcceptsZenityUrlSchemeXdgSettingsError(c *C) {
+	// force kdialog exec missing
+	restoreKDialog := ui.MockHasKDialogExecutable(func() bool { return false })
+	restoreCmds := mockUIcommands(c, "true")
+	defer func() {
+		restoreKDialog()
+		restoreCmds()
+	}()
+
+	df := filepath.Join(dirs.SnapDesktopFilesDir, "some-snap_ircclient.desktop")
+	err := os.MkdirAll(filepath.Dir(df), 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(df, nil, 0644)
+	c.Assert(err, IsNil)
+
+	err = s.settings.SetSub("default-url-scheme-handler", "irc2", "ircclient.desktop", ":some-dbus-sender")
+	c.Assert(err, ErrorMatches, `cannot set "default-url-scheme-handler" subproperty "irc2" setting: fail`)
+	c.Check(s.mockXdgSettings.Calls(), DeepEquals, [][]string{
+		{"xdg-settings", "set", "default-url-scheme-handler", "irc2", "some-snap_ircclient.desktop"},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/userd/userd.go snapd-2.48.3+20.04/usersession/userd/userd.go
--- snapd-2.45.1+20.04.2/usersession/userd/userd.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/userd/userd.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,8 +30,8 @@
 )
 
 type dbusInterface interface {
-	Name() string
-	BasePath() dbus.ObjectPath
+	Interface() string
+	ObjectPath() dbus.ObjectPath
 	IntrospectionData() string
 }
 
@@ -41,6 +41,14 @@
 	dbusIfaces []dbusInterface
 }
 
+// userdBusNames contains the list of bus names userd will acquire on
+// the session bus.  It is unnecessary (and undesirable) to add more
+// names here when adding new interfaces to the daemon.
+var userdBusNames = []string{
+	"io.snapcraft.Launcher",
+	"io.snapcraft.Settings",
+}
+
 func dbusSessionBus() (*dbus.Conn, error) {
 	// use a private connection to the session bus, this way we can manage
 	// its lifetime without worrying of breaking other code
@@ -77,18 +85,21 @@
 		// at the object level and the actual well-known object name
 		// becoming available on the bus
 		xml := "<node>" + iface.IntrospectionData() + introspect.IntrospectDataString + "</node>"
-		ud.conn.Export(iface, iface.BasePath(), iface.Name())
-		ud.conn.Export(introspect.Introspectable(xml), iface.BasePath(), "org.freedesktop.DBus.Introspectable")
+		ud.conn.Export(iface, iface.ObjectPath(), iface.Interface())
+		ud.conn.Export(introspect.Introspectable(xml), iface.ObjectPath(), "org.freedesktop.DBus.Introspectable")
+
+	}
 
+	for _, name := range userdBusNames {
 		// beyond this point the name is available and all handlers must
 		// have been set up
-		reply, err := ud.conn.RequestName(iface.Name(), dbus.NameFlagDoNotQueue)
+		reply, err := ud.conn.RequestName(name, dbus.NameFlagDoNotQueue)
 		if err != nil {
 			return err
 		}
 
 		if reply != dbus.RequestNameReplyPrimaryOwner {
-			return fmt.Errorf("cannot obtain bus name '%s'", iface.Name())
+			return fmt.Errorf("cannot obtain bus name '%s'", name)
 		}
 	}
 	return nil
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/export_test.go snapd-2.48.3+20.04/usersession/xdgopenproxy/export_test.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/export_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,60 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package xdgopenproxy
+
+import (
+	"time"
+)
+
+type (
+	DesktopLauncher = desktopLauncher
+	PortalLauncher  = portalLauncher
+	UserdLauncher   = userdLauncher
+
+	ResponseError = responseError
+)
+
+const (
+	DesktopPortalBusName      = desktopPortalBusName
+	DesktopPortalObjectPath   = desktopPortalObjectPath
+	DesktopPortalOpenURIIface = desktopPortalOpenURIIface
+	DesktopPortalRequestIface = desktopPortalRequestIface
+
+	UserdLauncherBusName    = userdLauncherBusName
+	UserdLauncherObjectPath = userdLauncherObjectPath
+	UserdLauncherIface      = userdLauncherIface
+)
+
+var (
+	Launch        = launch
+	LaunchWithOne = launchWithOne
+)
+
+func MakeResponseError(msg string) error {
+	return &responseError{msg: msg}
+}
+
+func MockPortalTimeout(t time.Duration) (restore func()) {
+	old := defaultPortalRequestTimeout
+	defaultPortalRequestTimeout = t
+	return func() {
+		defaultPortalRequestTimeout = old
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/portal_launcher.go snapd-2.48.3+20.04/usersession/xdgopenproxy/portal_launcher.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/portal_launcher.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/portal_launcher.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,174 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package xdgopenproxy
+
+import (
+	"fmt"
+	"syscall"
+	"time"
+
+	"github.com/godbus/dbus"
+)
+
+const (
+	desktopPortalBusName      = "org.freedesktop.portal.Desktop"
+	desktopPortalObjectPath   = "/org/freedesktop/portal/desktop"
+	desktopPortalOpenURIIface = "org.freedesktop.portal.OpenURI"
+	desktopPortalRequestIface = "org.freedesktop.portal.Request"
+)
+
+// portalLauncher is a launcher that forwards the requests to xdg-desktop-portal DBus API
+type portalLauncher struct{}
+
+// desktopPortal gets a reference to the xdg-desktop-portal D-Bus service
+func (p *portalLauncher) desktopPortal(bus *dbus.Conn) (dbus.BusObject, error) {
+	// We call StartServiceByName since old versions of
+	// xdg-desktop-portal do not include the AssumedAppArmorLabel
+	// key in their service activation file.
+	var startResult uint32
+	err := bus.BusObject().Call("org.freedesktop.DBus.StartServiceByName", 0, desktopPortalBusName, uint32(0)).Store(&startResult)
+	if dbusErr, ok := err.(dbus.Error); ok {
+		// If it is not possible to activate the service
+		// (i.e. there is no .service file or the systemd unit
+		// has been masked), assume it is already
+		// running. Subsequent method calls will fail if this
+		// assumption is false.
+		if dbusErr.Name == "org.freedesktop.DBus.Error.ServiceUnknown" || dbusErr.Name == "org.freedesktop.systemd1.Masked" {
+			err = nil
+			startResult = 2 // DBUS_START_REPLY_ALREADY_RUNNING
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	switch startResult {
+	case 1: // DBUS_START_REPLY_SUCCESS
+	case 2: // DBUS_START_REPLY_ALREADY_RUNNING
+	default:
+		return nil, fmt.Errorf("unexpected response from StartServiceByName (code %v)", startResult)
+	}
+	return bus.Object(desktopPortalBusName, desktopPortalObjectPath), nil
+}
+
+// portalResponseSuccess is a numeric value indicating a success carrying out
+// the request, returned by the `response` member of
+// org.freedesktop.portal.Request.Response signal
+const portalResponseSuccess = 0
+
+// timeout for asking the user to make a choice, same value as in usersession/userd/launcher.go
+var defaultPortalRequestTimeout = 5 * time.Minute
+
+func (p *portalLauncher) portalCall(bus *dbus.Conn, call func() (dbus.ObjectPath, error)) error {
+	// see https://flatpak.github.io/xdg-desktop-portal/portal-docs.html for
+	// details of the interaction, in short:
+	// 1. caller issues a request to the desktop portal
+	// 2. desktop portal responds with a handle to a dbus object capturing the Request
+	// 3. caller waits for the org.freedesktop.portal.Request.Response
+	// 3a. caller can terminate the request earlier by calling close
+
+	// set up signal handling before we call the portal, so that we do not
+	// miss the signals
+	signals := make(chan *dbus.Signal, 1)
+	bus.Signal(signals)
+	defer func() {
+		bus.RemoveSignal(signals)
+		close(signals)
+	}()
+
+	// TODO: this should use dbus.Conn.AddMatchSignal, but that
+	// does not exist in the external copies of godbus on some
+	// supported platforms.
+	const matchRule = "type='signal',sender='" + desktopPortalBusName + "',interface='" + desktopPortalRequestIface + "',member='Response'"
+	if err := bus.BusObject().Call("org.freedesktop.DBus.AddMatch", 0, matchRule).Store(); err != nil {
+		return err
+	}
+	defer bus.BusObject().Call("org.freedesktop.DBus.RemoveMatch", 0, matchRule)
+
+	requestPath, err := call()
+	if err != nil {
+		return err
+	}
+	request := bus.Object(desktopPortalBusName, requestPath)
+
+	timeout := time.NewTimer(defaultPortalRequestTimeout)
+	defer timeout.Stop()
+	for {
+		select {
+		case <-timeout.C:
+			request.Call(desktopPortalRequestIface+".Close", 0).Store()
+			return &responseError{msg: "timeout waiting for user response"}
+		case signal := <-signals:
+			if signal.Path != requestPath || signal.Name != desktopPortalRequestIface+".Response" {
+				// This isn't the signal we're waiting for
+				continue
+			}
+
+			var response uint32
+			var results map[string]interface{} // don't care
+			if err := dbus.Store(signal.Body, &response, &results); err != nil {
+				return &responseError{msg: fmt.Sprintf("cannot unpack response: %v", err)}
+			}
+			if response == portalResponseSuccess {
+				return nil
+			}
+			return &responseError{msg: fmt.Sprintf("request declined by the user (code %v)", response)}
+		}
+	}
+}
+
+func (p *portalLauncher) OpenFile(bus *dbus.Conn, filename string) error {
+	portal, err := p.desktopPortal(bus)
+	if err != nil {
+		return err
+	}
+
+	fd, err := syscall.Open(filename, syscall.O_RDONLY, 0)
+	if err != nil {
+		return &responseError{msg: err.Error()}
+	}
+	defer syscall.Close(fd)
+
+	return p.portalCall(bus, func() (dbus.ObjectPath, error) {
+		var (
+			parent  string
+			options map[string]dbus.Variant
+			request dbus.ObjectPath
+		)
+		err := portal.Call(desktopPortalOpenURIIface+".OpenFile", 0, parent, dbus.UnixFD(fd), options).Store(&request)
+		return request, err
+	})
+}
+
+func (p *portalLauncher) OpenURI(bus *dbus.Conn, uri string) error {
+	portal, err := p.desktopPortal(bus)
+	if err != nil {
+		return err
+	}
+
+	return p.portalCall(bus, func() (dbus.ObjectPath, error) {
+		var (
+			parent  string
+			options map[string]dbus.Variant
+			request dbus.ObjectPath
+		)
+		err := portal.Call(desktopPortalOpenURIIface+".OpenURI", 0, parent, uri, options).Store(&request)
+		return request, err
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/portal_launcher_test.go snapd-2.48.3+20.04/usersession/xdgopenproxy/portal_launcher_test.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/portal_launcher_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/portal_launcher_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,263 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package xdgopenproxy_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+
+	"github.com/godbus/dbus"
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/usersession/xdgopenproxy"
+)
+
+type portalSuite struct {
+	testutil.DBusTest
+
+	portal  *fakePortal
+	request *fakePortalRequest
+
+	openError    *dbus.Error
+	sendResponse bool
+	openResponse uint32
+	calls        []string
+}
+
+var _ = Suite(&portalSuite{})
+
+const portalRequestPath = "/org/freedesktop/portal/desktop/request/1"
+
+func (s *portalSuite) SetUpSuite(c *C) {
+	s.DBusTest.SetUpSuite(c)
+
+	s.portal = &fakePortal{s}
+	err := s.SessionBus.Export(s.portal, xdgopenproxy.DesktopPortalObjectPath, xdgopenproxy.DesktopPortalOpenURIIface)
+	c.Assert(err, IsNil)
+	s.request = &fakePortalRequest{s}
+	err = s.SessionBus.Export(s.request, portalRequestPath, xdgopenproxy.DesktopPortalRequestIface)
+	c.Assert(err, IsNil)
+
+	_, err = s.SessionBus.RequestName(xdgopenproxy.DesktopPortalBusName, dbus.NameFlagAllowReplacement|dbus.NameFlagReplaceExisting)
+	c.Assert(err, IsNil)
+}
+
+func (s *portalSuite) TearDownSuite(c *C) {
+	if s.SessionBus != nil {
+		_, err := s.SessionBus.ReleaseName(xdgopenproxy.DesktopPortalBusName)
+		c.Check(err, IsNil)
+	}
+
+	s.DBusTest.TearDownSuite(c)
+}
+
+func (s *portalSuite) SetUpTest(c *C) {
+	s.DBusTest.SetUpTest(c)
+
+	s.openError = nil
+	s.openResponse = 0
+	s.sendResponse = true
+	s.calls = nil
+}
+
+func (s *portalSuite) TestOpenFile(c *C) {
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, IsNil)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *portalSuite) TestOpenFileCallError(c *C) {
+	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
+
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, FitsTypeOf, dbus.Error{})
+	c.Check(err, ErrorMatches, "failure")
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *portalSuite) TestOpenFileResponseError(c *C) {
+	s.openResponse = 2
+
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
+	c.Check(err, ErrorMatches, `request declined by the user \(code 2\)`)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *portalSuite) TestOpenFileTimeout(c *C) {
+	s.sendResponse = false
+	restore := xdgopenproxy.MockPortalTimeout(5 * time.Millisecond)
+	defer restore()
+
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	file := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(file, []byte("hello world"), 0644), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, file)
+	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
+	c.Check(err, ErrorMatches, "timeout waiting for user response")
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+		"Request.Close",
+	})
+}
+
+func (s *portalSuite) TestOpenDir(c *C) {
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	dir := c.MkDir()
+	err := launcher.OpenFile(s.SessionBus, dir)
+	c.Check(err, IsNil)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *portalSuite) TestOpenMissingFile(c *C) {
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	path := filepath.Join(c.MkDir(), "no-such-file.txt")
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, ErrorMatches, "no such file or directory")
+	c.Check(s.calls, HasLen, 0)
+}
+
+func (s *portalSuite) TestOpenUnreadableFile(c *C) {
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+	c.Assert(os.Chmod(path, 0), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, ErrorMatches, "permission denied")
+	c.Check(s.calls, HasLen, 0)
+}
+
+func (s *portalSuite) TestOpenURI(c *C) {
+	launcher := &xdgopenproxy.PortalLauncher{}
+
+	err := launcher.OpenURI(s.SessionBus, "http://example.com")
+	c.Check(err, IsNil)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenURI http://example.com",
+	})
+}
+
+func (s *portalSuite) TestOpenURICallError(c *C) {
+	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
+
+	launcher := &xdgopenproxy.PortalLauncher{}
+	err := launcher.OpenURI(s.SessionBus, "http://example.com")
+	c.Check(err, FitsTypeOf, dbus.Error{})
+	c.Check(err, ErrorMatches, "failure")
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenURI http://example.com",
+	})
+}
+
+func (s *portalSuite) TestOpenURIResponseError(c *C) {
+	s.openResponse = 2
+
+	launcher := &xdgopenproxy.PortalLauncher{}
+	err := launcher.OpenURI(s.SessionBus, "http://example.com")
+	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
+	c.Check(err, ErrorMatches, `request declined by the user \(code 2\)`)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenURI http://example.com",
+	})
+}
+
+func (s *portalSuite) TestOpenURITimeout(c *C) {
+	s.sendResponse = false
+	restore := xdgopenproxy.MockPortalTimeout(5 * time.Millisecond)
+	defer restore()
+
+	launcher := &xdgopenproxy.PortalLauncher{}
+	err := launcher.OpenURI(s.SessionBus, "http://example.com")
+	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
+	c.Check(err, ErrorMatches, "timeout waiting for user response")
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenURI http://example.com",
+		"Request.Close",
+	})
+}
+
+type fakePortal struct {
+	*portalSuite
+}
+
+func (p *fakePortal) OpenFile(parent string, clientFD dbus.UnixFD, options map[string]dbus.Variant) (dbus.ObjectPath, *dbus.Error) {
+	p.calls = append(p.calls, "OpenFile")
+
+	fd := int(clientFD)
+	defer syscall.Close(fd)
+
+	if p.sendResponse {
+		var results map[string]dbus.Variant
+		p.SessionBus.Emit(portalRequestPath, xdgopenproxy.DesktopPortalRequestIface+".Response", p.openResponse, results)
+	}
+	return portalRequestPath, p.openError
+}
+
+func (p *fakePortal) OpenURI(parent, uri string, options map[string]dbus.Variant) (dbus.ObjectPath, *dbus.Error) {
+	p.calls = append(p.calls, "OpenURI "+uri)
+	if p.sendResponse {
+		var results map[string]dbus.Variant
+		p.SessionBus.Emit(portalRequestPath, xdgopenproxy.DesktopPortalRequestIface+".Response", p.openResponse, results)
+	}
+	return portalRequestPath, p.openError
+}
+
+type fakePortalRequest struct {
+	*portalSuite
+}
+
+func (r *fakePortalRequest) Close() *dbus.Error {
+	r.calls = append(r.calls, "Request.Close")
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/userd_launcher.go snapd-2.48.3+20.04/usersession/xdgopenproxy/userd_launcher.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/userd_launcher.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/userd_launcher.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,51 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package xdgopenproxy
+
+import (
+	"syscall"
+
+	"github.com/godbus/dbus"
+)
+
+const (
+	userdLauncherBusName    = "io.snapcraft.Launcher"
+	userdLauncherObjectPath = "/io/snapcraft/Launcher"
+	userdLauncherIface      = "io.snapcraft.Launcher"
+)
+
+// userdLauncher is a launcher that forwards the requests to `snap userd` DBus API
+type userdLauncher struct{}
+
+func (s *userdLauncher) OpenFile(bus *dbus.Conn, filename string) error {
+	fd, err := syscall.Open(filename, syscall.O_RDONLY, 0)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+
+	launcher := bus.Object(userdLauncherBusName, userdLauncherObjectPath)
+	return launcher.Call(userdLauncherIface+".OpenFile", 0, "", dbus.UnixFD(fd)).Store()
+}
+
+func (s *userdLauncher) OpenURI(bus *dbus.Conn, path string) error {
+	launcher := bus.Object(userdLauncherBusName, userdLauncherObjectPath)
+	return launcher.Call("io.snapcraft.Launcher.OpenURL", 0, path).Store()
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/userd_launcher_test.go snapd-2.48.3+20.04/usersession/xdgopenproxy/userd_launcher_test.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/userd_launcher_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/userd_launcher_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,173 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2020 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package xdgopenproxy_test
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"syscall"
+
+	"github.com/godbus/dbus"
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/testutil"
+	"github.com/snapcore/snapd/usersession/xdgopenproxy"
+)
+
+type userdSuite struct {
+	testutil.DBusTest
+
+	userd *fakeUserd
+
+	openError *dbus.Error
+	calls     []string
+}
+
+var _ = Suite(&userdSuite{})
+
+func (s *userdSuite) SetUpSuite(c *C) {
+	s.DBusTest.SetUpSuite(c)
+
+	s.userd = &fakeUserd{s}
+	err := s.SessionBus.Export(s.userd, xdgopenproxy.UserdLauncherObjectPath, xdgopenproxy.UserdLauncherIface)
+	c.Assert(err, IsNil)
+
+	_, err = s.SessionBus.RequestName(xdgopenproxy.UserdLauncherBusName, dbus.NameFlagAllowReplacement|dbus.NameFlagReplaceExisting)
+	c.Assert(err, IsNil)
+}
+
+func (s *userdSuite) TearDownSuite(c *C) {
+	if s.SessionBus != nil {
+		_, err := s.SessionBus.ReleaseName(xdgopenproxy.UserdLauncherBusName)
+		c.Check(err, IsNil)
+	}
+
+	s.DBusTest.TearDownSuite(c)
+}
+
+func (s *userdSuite) SetUpTest(c *C) {
+	s.DBusTest.SetUpTest(c)
+
+	s.openError = nil
+	s.calls = nil
+}
+
+func (s *userdSuite) TestOpenFile(c *C) {
+	launcher := &xdgopenproxy.UserdLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, IsNil)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *userdSuite) TestOpenFileError(c *C) {
+	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
+
+	launcher := &xdgopenproxy.UserdLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, FitsTypeOf, dbus.Error{})
+	c.Check(err, ErrorMatches, "failure")
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *userdSuite) TestOpenDir(c *C) {
+	launcher := &xdgopenproxy.UserdLauncher{}
+
+	dir := c.MkDir()
+	err := launcher.OpenFile(s.SessionBus, dir)
+	c.Check(err, IsNil)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenFile",
+	})
+}
+
+func (s *userdSuite) TestOpenMissingFile(c *C) {
+	launcher := &xdgopenproxy.UserdLauncher{}
+
+	path := filepath.Join(c.MkDir(), "no-such-file.txt")
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, ErrorMatches, "no such file or directory")
+	c.Check(s.calls, HasLen, 0)
+}
+
+func (s *userdSuite) TestOpenUnreadableFile(c *C) {
+	launcher := &xdgopenproxy.UserdLauncher{}
+
+	path := filepath.Join(c.MkDir(), "test.txt")
+	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
+	c.Assert(os.Chmod(path, 0), IsNil)
+
+	err := launcher.OpenFile(s.SessionBus, path)
+	c.Check(err, ErrorMatches, "permission denied")
+	c.Check(s.calls, HasLen, 0)
+}
+
+func (s *userdSuite) TestOpenURI(c *C) {
+	launcher := &xdgopenproxy.UserdLauncher{}
+
+	err := launcher.OpenURI(s.SessionBus, "http://example.com")
+	c.Check(err, IsNil)
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenURI http://example.com",
+	})
+}
+
+func (s *userdSuite) TestOpenURIError(c *C) {
+	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
+
+	launcher := &xdgopenproxy.UserdLauncher{}
+	err := launcher.OpenURI(s.SessionBus, "http://example.com")
+	c.Check(err, FitsTypeOf, dbus.Error{})
+	c.Check(err, ErrorMatches, "failure")
+	c.Check(s.calls, DeepEquals, []string{
+		"OpenURI http://example.com",
+	})
+}
+
+type fakeUserd struct {
+	*userdSuite
+}
+
+func (p *fakeUserd) OpenFile(parentWindow string, clientFD dbus.UnixFD) *dbus.Error {
+	p.calls = append(p.calls, "OpenFile")
+
+	fd := int(clientFD)
+	defer syscall.Close(fd)
+
+	return p.openError
+}
+
+func (p *fakeUserd) OpenURL(uri string) *dbus.Error {
+	p.calls = append(p.calls, "OpenURI "+uri)
+	return p.openError
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/xdgopenproxy.go snapd-2.48.3+20.04/usersession/xdgopenproxy/xdgopenproxy.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/xdgopenproxy.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/xdgopenproxy.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,88 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Package xdgopenproxy provides a client for snap userd's xdg-open D-Bus proxy
+package xdgopenproxy
+
+import (
+	"net/url"
+
+	"github.com/godbus/dbus"
+	"golang.org/x/xerrors"
+)
+
+type responseError struct {
+	msg string
+}
+
+func (u *responseError) Error() string { return u.msg }
+
+func (u *responseError) Is(err error) bool {
+	_, ok := err.(*responseError)
+	return ok
+}
+
+type desktopLauncher interface {
+	OpenFile(bus *dbus.Conn, path string) error
+	OpenURI(bus *dbus.Conn, url string) error
+}
+
+var availableLaunchers = []desktopLauncher{
+	&portalLauncher{},
+	&userdLauncher{},
+}
+
+// Run attempts to open given file or URL using one of available launchers
+func Run(urlOrFile string) error {
+	bus, err := dbus.SessionBus()
+	if err != nil {
+		return err
+	}
+	defer bus.Close()
+
+	return launch(bus, availableLaunchers, urlOrFile)
+}
+
+func launchWithOne(bus *dbus.Conn, l desktopLauncher, urlOrFile string) error {
+	if u, err := url.Parse(urlOrFile); err == nil {
+		if u.Scheme == "file" {
+			return l.OpenFile(bus, u.Path)
+		} else if u.Scheme != "" {
+			return l.OpenURI(bus, urlOrFile)
+		}
+	}
+	return l.OpenFile(bus, urlOrFile)
+}
+
+func launch(bus *dbus.Conn, launchers []desktopLauncher, urlOrFile string) error {
+	var err error
+	for _, l := range launchers {
+		err = launchWithOne(bus, l, urlOrFile)
+		if err == nil {
+			break
+		}
+		if xerrors.Is(err, &responseError{}) {
+			// got a response which indicates the action was either
+			// explicitly rejected by the user or abandoned due to
+			// other reasons eg. timeout waiting for user to respond
+			break
+		}
+	}
+	return err
+}
diff -Nru snapd-2.45.1+20.04.2/usersession/xdgopenproxy/xdgopenproxy_test.go snapd-2.48.3+20.04/usersession/xdgopenproxy/xdgopenproxy_test.go
--- snapd-2.45.1+20.04.2/usersession/xdgopenproxy/xdgopenproxy_test.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/usersession/xdgopenproxy/xdgopenproxy_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,104 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package xdgopenproxy_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/godbus/dbus"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/snapcore/snapd/usersession/xdgopenproxy"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type xdgOpenSuite struct{}
+
+var _ = Suite(&xdgOpenSuite{})
+
+func (s *xdgOpenSuite) TestOpenURL(c *C) {
+	launcher := &fakeLauncher{}
+	c.Check(xdgopenproxy.LaunchWithOne(nil, launcher, "http://example.org"), IsNil)
+	c.Check(launcher.calls, DeepEquals, []string{
+		"OpenURI http://example.org",
+	})
+}
+
+func (s *xdgOpenSuite) TestOpenFile(c *C) {
+	launcher := &fakeLauncher{}
+	c.Check(xdgopenproxy.LaunchWithOne(nil, launcher, "/path/test.txt"), IsNil)
+	c.Check(launcher.calls, DeepEquals, []string{
+		"OpenFile /path/test.txt",
+	})
+}
+
+func (s *xdgOpenSuite) TestOpenFileURL(c *C) {
+	launcher := &fakeLauncher{}
+	c.Check(xdgopenproxy.LaunchWithOne(nil, launcher, "file:///path/test.txt"), IsNil)
+	c.Check(launcher.calls, DeepEquals, []string{
+		"OpenFile /path/test.txt",
+	})
+}
+
+func (s *xdgOpenSuite) TestStopOnFirstSuccess(c *C) {
+	l1 := &fakeLauncher{err: fmt.Errorf("failure one")}
+	l2 := &fakeLauncher{err: nil}
+	l3 := &fakeLauncher{err: nil}
+	launchers := []xdgopenproxy.DesktopLauncher{l1, l2, l3}
+
+	err := xdgopenproxy.Launch(nil, launchers, "http://example.org")
+	c.Check(err, IsNil)
+	c.Check(l1.calls, DeepEquals, []string{
+		"OpenURI http://example.org",
+	})
+	c.Check(l2.calls, DeepEquals, []string{
+		"OpenURI http://example.org",
+	})
+	c.Check(l3.calls, HasLen, 0)
+}
+
+func (s *xdgOpenSuite) TestStopOnResponseError(c *C) {
+	l1 := &fakeLauncher{err: fmt.Errorf("failure one")}
+	l2 := &fakeLauncher{err: xdgopenproxy.MakeResponseError("hello")}
+	l3 := &fakeLauncher{err: nil}
+	launchers := []xdgopenproxy.DesktopLauncher{l1, l2, l3}
+
+	err := xdgopenproxy.Launch(nil, launchers, "http://example.org")
+	c.Check(err, Equals, l2.err)
+	c.Check(l3.calls, HasLen, 0)
+}
+
+type fakeLauncher struct {
+	err   error
+	calls []string
+}
+
+func (l *fakeLauncher) OpenFile(bus *dbus.Conn, path string) error {
+	l.calls = append(l.calls, "OpenFile "+path)
+	return l.err
+}
+
+func (l *fakeLauncher) OpenURI(bus *dbus.Conn, uri string) error {
+	l.calls = append(l.calls, "OpenURI "+uri)
+	return l.err
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/auth.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/auth.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/auth.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/auth.go	2021-02-02 08:21:12.000000000 +0000
@@ -11,6 +11,8 @@
 	"fmt"
 	"io"
 
+	"github.com/canonical/go-tpm2/mu"
+
 	"golang.org/x/xerrors"
 )
 
@@ -60,26 +62,23 @@
 	Data []authCommand `tpm2:"raw"`
 }
 
-func (a *commandAuthArea) Marshal(buf io.Writer) (nbytes int, err error) {
+func (a *commandAuthArea) Marshal(w io.Writer) error {
 	tmpBuf := new(bytes.Buffer)
-	if _, err := MarshalToWriter(tmpBuf, commandAuthAreaRawSlice{[]authCommand(*a)}); err != nil {
+	if _, err := mu.MarshalToWriter(tmpBuf, commandAuthAreaRawSlice{[]authCommand(*a)}); err != nil {
 		panic(fmt.Sprintf("cannot marshal raw command auth area to temporary buffer: %v", err))
 	}
 
-	if err := binary.Write(buf, binary.BigEndian, uint32(tmpBuf.Len())); err != nil {
-		return nbytes, xerrors.Errorf("cannot write size of auth area to buffer: %w", err)
+	if err := binary.Write(w, binary.BigEndian, uint32(tmpBuf.Len())); err != nil {
+		return xerrors.Errorf("cannot write size of auth area to buffer: %w", err)
 	}
-	nbytes += binary.Size(uint32(0))
 
-	n, err := tmpBuf.WriteTo(buf)
-	nbytes += int(n)
-	if err != nil {
-		return nbytes, xerrors.Errorf("cannot write marshalled auth area to buffer: %w", err)
+	if _, err := tmpBuf.WriteTo(w); err != nil {
+		return xerrors.Errorf("cannot write marshalled auth area to buffer: %w", err)
 	}
-	return
+	return nil
 }
 
-func (a *commandAuthArea) Unmarshal(buf io.Reader) (int, error) {
+func (a *commandAuthArea) Unmarshal(r mu.Reader) error {
 	panic("no need to unmarshal a command's auth area")
 }
 
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_attestation.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_attestation.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_attestation.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_attestation.go	2021-02-02 08:21:12.000000000 +0000
@@ -19,11 +19,11 @@
 // If signContext is not nil and the object associated with signContext is not a signing key, a *TPMHandleError error with an error
 // code of ErrorKey will be returned for handle index 2.
 //
-// If signContext is not nil and if the scheme of the key associated with signContext is AlgorithmNull, then inScheme must be provided
-// to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be
-// returned for parameter index 2.
+// If signContext is not nil and if the scheme of the key associated with signContext is AsymSchemeNull, then inScheme must be
+// provided to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme
+// will be returned for parameter index 2.
 //
-// If signContext is not nil and the scheme of the key associated with signContext is not AlgorithmNull, then inScheme may be nil. If
+// If signContext is not nil and the scheme of the key associated with signContext is not AsymSchemeNull, then inScheme may be nil. If
 // it is provided, then the specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of
 // ErrorScheme will be returned for parameter index 2.
 //
@@ -59,11 +59,11 @@
 // If signContext is not nil and the object associated with signContext is not a signing key, a *TPMHandleError error with an error
 // code of ErrorKey will be returned for handle index 1.
 //
-// If signContext is not nil and if the scheme of the key associated with signContext is AlgorithmNull, then inScheme must be provided
-// to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be
-// returned for parameter index 3.
+// If signContext is not nil and if the scheme of the key associated with signContext is AsymSchemeNull, then inScheme must be
+// provided to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme
+// will be returned for parameter index 3.
 //
-// If signContext is not nil and the scheme of the key associated with signContext is not AlgorithmNull, then inScheme may be nil. If
+// If signContext is not nil and the scheme of the key associated with signContext is not AsymSchemeNull, then inScheme may be nil. If
 // it is provided, then the specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of
 // ErrorScheme will be returned for parameter index 3.
 //
@@ -103,11 +103,11 @@
 // If signContext is not nil and the object associated with signContext is not a signing key, a *TPMHandleError error with an error
 // code of ErrorKey will be returned for handle index 1.
 //
-// If signContext is not nil and if the scheme of the key associated with signContext is AlgorithmNull, then inScheme must be provided
-// to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be
-// returned for parameter index 2.
+// If signContext is not nil and if the scheme of the key associated with signContext is AsymSchemeNull, then inScheme must be
+// provided to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme
+// will be returned for parameter index 2.
 //
-// If signContext is not nil and the scheme of the key associated with signContext is not AlgorithmNull, then inScheme may be nil. If
+// If signContext is not nil and the scheme of the key associated with signContext is not AsymSchemeNull, then inScheme may be nil. If
 // it is provided, then the specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of
 // ErrorScheme will be returned for parameter index 2.
 //
@@ -144,11 +144,11 @@
 // If signContext is not nil and the object associated with signContext is not a signing key, a *TPMHandleError error with an error
 // code of ErrorKey will be returned for handle index 2.
 //
-// If signContext is not nil and if the scheme of the key associated with signContext is AlgorithmNull, then inScheme must be provided
-// to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be
-// returned for parameter index 2.
+// If signContext is not nil and if the scheme of the key associated with signContext is AsymSchemeNull, then inScheme must be
+// provided to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme
+// will be returned for parameter index 2.
 //
-// If signContext is not nil and the scheme of the key associated with signContext is not AlgorithmNull, then inScheme may be nil. If
+// If signContext is not nil and the scheme of the key associated with signContext is not AsymSchemeNull, then inScheme may be nil. If
 // it is provided, then the specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of
 // ErrorScheme will be returned for parameter index 2.
 //
@@ -186,11 +186,11 @@
 // If signContext is not nil and the object associated with signContext is not a signing key, a *TPMHandleError error with an error
 // code of ErrorKey will be returned for handle index 2.
 //
-// If signContext is not nil and if the scheme of the key associated with signContext is AlgorithmNull, then inScheme must be provided
-// to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be
-// returned for parameter index 2.
+// If signContext is not nil and if the scheme of the key associated with signContext is AsymSchemeNull, then inScheme must be
+// provided to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme
+// will be returned for parameter index 2.
 //
-// If signContext is not nil and the scheme of the key associated with signContext is not AlgorithmNull, then inScheme may be nil. If
+// If signContext is not nil and the scheme of the key associated with signContext is not AsymSchemeNull, then inScheme may be nil. If
 // it is provided, then the specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of
 // ErrorScheme will be returned for parameter index 2.
 //
@@ -227,11 +227,11 @@
 // If signContext is not nil and the object associated with signContext is not a signing key, a *TPMHandleError error with an error
 // code of ErrorKey will be returned for handle index 2.
 //
-// If signContext is not nil and if the scheme of the key associated with signContext is AlgorithmNull, then inScheme must be provided
-// to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be
-// returned for parameter index 2.
+// If signContext is not nil and if the scheme of the key associated with signContext is AsymSchemeNull, then inScheme must be
+// provided to specify a valid signing scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme
+// will be returned for parameter index 2.
 //
-// If signContext is not nil and the scheme of the key associated with signContext is not AlgorithmNull, then inScheme may be nil. If
+// If signContext is not nil and the scheme of the key associated with signContext is not AsymSchemeNull, then inScheme may be nil. If
 // it is provided, then the specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of
 // ErrorScheme will be returned for parameter index 2.
 //
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_cap.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_cap.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_cap.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_cap.go	2021-02-02 08:21:12.000000000 +0000
@@ -5,6 +5,7 @@
 package tpm2
 
 import (
+	"encoding/binary"
 	"fmt"
 )
 
@@ -216,12 +217,77 @@
 	if err != nil {
 		return 0, err
 	}
-	if len(props) == 0 {
-		return 0, nil
+	if len(props) == 0 || props[0].Property != PropertyManufacturer {
+		return 0, &InvalidResponseError{Command: CommandGetCapability, msg: "expected TPM_PT_MANUFACTURER property"}
 	}
 	return TPMManufacturer(props[0].Value), nil
 }
 
+// IsTPM2 determines whether this TPMContext is connected to a TPM2 device. It does this by attempting to execute a TPM2_GetCapability
+// command, and verifying that the response packet has the expected tag.
+//
+// On success, this will return true if TPMContext is connected to a TPM2 device, or false if it is connected to a TPM1.2 device. An
+// error will be returned if communication with the device fails or the response packet is badly formed.
+func (t *TPMContext) IsTPM2() (bool, error) {
+	ctx, err := t.runCommandWithoutProcessingResponse(CommandGetCapability, nil,
+		nil, []interface{}{CapabilityTPMProperties, uint32(PropertyTotalCommands), uint32(1)})
+	if err != nil {
+		return false, err
+	}
+	if ctx.responseTag == TagNoSessions {
+		return true, nil
+	}
+	return false, nil
+}
+
+// GetInputBuffer returns the value of the PropertyInputBuffer property, which indicates the maximum size of arguments of the
+// MaxBuffer type. The size is TPM implementation specific, but required to be at least 1024 bytes.
+func (t *TPMContext) GetInputBuffer(sessions ...SessionContext) int {
+	props, err := t.GetCapabilityTPMProperties(PropertyInputBuffer, 1, sessions...)
+	if err != nil {
+		return 1024
+	}
+	if len(props) == 0 || props[0].Property != PropertyInputBuffer {
+		return 1024
+	}
+	return int(props[0].Value)
+}
+
+// GetMaxDigest returns the value of the PropertyMaxDigest property, which indicates the size of the largest digest algorithm
+// supported by the TPM.
+func (t *TPMContext) GetMaxDigest(sessions ...SessionContext) (int, error) {
+	props, err := t.GetCapabilityTPMProperties(PropertyMaxDigest, 1, sessions...)
+	if err != nil {
+		return 0, err
+	}
+	if len(props) == 0 || props[0].Property != PropertyMaxDigest {
+		return 0, &InvalidResponseError{Command: CommandGetCapability, msg: "expected TPM_PT_MAX_DIGEST property"}
+	}
+	return int(props[0].Value), nil
+}
+
+// GetMaxData returns the maximum size of arguments of the Data type supported by the TPM.
+func (t *TPMContext) GetMaxData(sessions ...SessionContext) (int, error) {
+	n, err := t.GetMaxDigest(sessions...)
+	if err != nil {
+		return 0, err
+	}
+	return n + binary.Size(AlgorithmId(0)), nil
+}
+
+// GetNVBufferMax returns the value of the PropertyNVBufferMax property, which indicates the maximum buffer size supported by
+// the TPM for TPMContext.NVReadRaw and TPMContext.NVWriteRaw.
+func (t *TPMContext) GetNVBufferMax(sessions ...SessionContext) (int, error) {
+	props, err := t.GetCapabilityTPMProperties(PropertyNVBufferMax, 1, sessions...)
+	if err != nil {
+		return 0, err
+	}
+	if len(props) == 0 || props[0].Property != PropertyNVBufferMax {
+		return 0, &InvalidResponseError{Command: CommandGetCapability, msg: "expected TPM_PT_NV_BUFFER_MAX property"}
+	}
+	return int(props[0].Value), nil
+}
+
 // TestParms executes the TPM2_TestParms command to check if the specified combination of algorithm parameters is supported.
 func (t *TPMContext) TestParms(parameters *PublicParams, sessions ...SessionContext) error {
 	return t.RunCommand(CommandTestParms, sessions, Delimiter, parameters)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_context.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_context.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_context.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_context.go	2021-02-02 08:21:12.000000000 +0000
@@ -12,10 +12,12 @@
 	_ "crypto/sha256"
 	"errors"
 	"fmt"
+
+	"github.com/canonical/go-tpm2/mu"
 )
 
 func wrapContextBlob(tpmBlob ContextData, context HandleContext) ContextData {
-	data, err := MarshalToBytes(context.(handleContextPrivate).data(), tpmBlob)
+	data, err := mu.MarshalToBytes(context.(handleContextPrivate).data(), tpmBlob)
 	if err != nil {
 		panic(fmt.Sprintf("cannot marshal resource context and TPM context data: %v", err))
 	}
@@ -23,7 +25,7 @@
 	h := crypto.SHA256.New()
 	h.Write(data)
 
-	data, err = MarshalToBytes(HashAlgorithmSHA256, h.Sum(nil), data)
+	data, err = mu.MarshalToBytes(HashAlgorithmSHA256, h.Sum(nil), data)
 	if err != nil {
 		panic(fmt.Sprintf("cannot marshal data blob and checksum: %v", err))
 	}
@@ -51,7 +53,7 @@
 	switch c := saveContext.(type) {
 	case *sessionContext:
 		if c.scData() == nil {
-			return nil, makeInvalidParamError("saveContext", "unusable session HandleContext")
+			return nil, makeInvalidArgError("saveContext", "unusable session HandleContext")
 		}
 	}
 
@@ -103,13 +105,13 @@
 // SessionContext.
 func (t *TPMContext) ContextLoad(context *Context) (HandleContext, error) {
 	if context == nil {
-		return nil, makeInvalidParamError("context", "nil value")
+		return nil, makeInvalidArgError("context", "nil value")
 	}
 
 	var integrityAlg HashAlgorithmId
 	var integrity []byte
 	var data []byte
-	if _, err := UnmarshalFromBytes(context.Blob, &integrityAlg, &integrity, &data); err != nil {
+	if _, err := mu.UnmarshalFromBytes(context.Blob, &integrityAlg, &integrity, &data); err != nil {
 		return nil, fmt.Errorf("cannot load context: cannot unpack checksum and data blob: %v", err)
 	}
 
@@ -124,7 +126,7 @@
 
 	var hcData *handleContextData
 	var tpmBlob ContextData
-	if _, err := UnmarshalFromBytes(data, &hcData, &tpmBlob); err != nil {
+	if _, err := mu.UnmarshalFromBytes(data, &hcData, &tpmBlob); err != nil {
 		return nil, fmt.Errorf("cannot load context: cannot unmarshal data blob: %v", err)
 	}
 
@@ -183,7 +185,7 @@
 // possible to restore that session with TPMContext.ContextLoad, even if it was previously saved with TPMContext.ContextSave.
 func (t *TPMContext) FlushContext(flushContext HandleContext) error {
 	if err := t.checkHandleContextParam(flushContext); err != nil {
-		return makeInvalidParamError("flushContext", fmt.Sprintf("%v", err))
+		return makeInvalidArgError("flushContext", fmt.Sprintf("%v", err))
 	}
 
 	if err := t.RunCommand(CommandFlushContext, nil,
@@ -225,7 +227,7 @@
 // On successful completion of evicting a persistent object, it returns a nil ResourceContext, and object will be invalidated.
 func (t *TPMContext) EvictControl(auth, object ResourceContext, persistentHandle Handle, authAuthSession SessionContext, sessions ...SessionContext) (ResourceContext, error) {
 	if object == nil {
-		return nil, makeInvalidParamError("object", "nil value")
+		return nil, makeInvalidArgError("object", "nil value")
 	}
 
 	var public *Public
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_hashhmac.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_hashhmac.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_hashhmac.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_hashhmac.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,219 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tpm2
+
+// Section 17 - Hash/HMAC/Event Sequences
+
+// HMACStart executes the TPM2_HMAC_Start command to begin a HMAC sequence. The context argument corresponds to a loaded HMAC
+// key. This command requires authorization with the user auth role for context, with session based authorization provided via
+// contextAuthSession. The command creates a new HMAC sequence object on the TPM. The auth argument defines the authorization value
+// for the newly created sequence object, which is required for subsequent use of it.
+//
+// If context does not correspond to an object with the type ObjectTypeKeyedHash, a *TPMHandleError error with an error code of
+// ErrorType will be returned.
+//
+// If context corresponds to an object with the AttrRestricted attribute set, a *TPMHandleError error with an error code of
+// ErrorAttributes will be returned.
+//
+// If context does not correspond to a signing key, a *TPMHandleError error with an error code of ErrorKey will be returned.
+//
+// The hashAlg argument specifies the HMAC algorithm. If the default scheme of the key associated with context is KeyedHashSchemeNull,
+// then hashAlg must not be HashAlgorithmNull. If the default scheme of the key associated with context is not KeyedHashSchemeNull,
+// then hashAlg must either be HashAlgorithmNull or must match the key's default scheme, else a *TPMParameterError error with an error
+// code of ErrorValue will be returned for parameter index 2.
+//
+// On success, a ResourceContext corresponding to the newly created HMAC sequence object will be returned. It will not be necessary
+// to call ResourceContext.SetAuthValue on it - this function sets the correct authorization value so that it can be used in
+// subsequent commands that require knowledge of the authorization value.
+func (t *TPMContext) HMACStart(context ResourceContext, auth Auth, hashAlg HashAlgorithmId, contextAuthSession SessionContext, sessions ...SessionContext) (ResourceContext, error) {
+	var sequenceHandle Handle
+
+	if err := t.RunCommand(CommandHMACStart, sessions,
+		ResourceContextWithSession{Context: context, Session: contextAuthSession}, Delimiter,
+		auth, hashAlg, Delimiter,
+		&sequenceHandle); err != nil {
+		return nil, err
+	}
+
+	rc := makeObjectContext(sequenceHandle, nil, nil)
+	rc.auth = make([]byte, len(auth))
+	copy(rc.auth, auth)
+	return rc, nil
+}
+
+// HashSequenceStart executes the TPM2_HashSequenceStart command to begin a hash or event sequence. The command creates a new
+// sequence object on the TPM. The auth argument defines the authorization value for the newly created sequence object, which is
+// required for subsequent use of it.
+//
+// If hashAlg is HashAlgorithmNull, this function will return a ResourceContext corresponding to a newly created event sequence
+// object. If hashAlg is not HashAlgorithmNull, this function will return a ResourceContext corresponding to a newly created hash
+// sequence object. It will not be necessary to call ResourceContext.SetAuthValue on it - this function sets the correct authorization
+// value so that it can be used in subsequent commands that require knowledge of the authorization value.
+func (t *TPMContext) HashSequenceStart(auth Auth, hashAlg HashAlgorithmId, sessions ...SessionContext) (ResourceContext, error) {
+	var sequenceHandle Handle
+
+	if err := t.RunCommand(CommandHashSequenceStart, sessions,
+		Delimiter,
+		auth, hashAlg, Delimiter,
+		&sequenceHandle); err != nil {
+		return nil, err
+	}
+
+	rc := makeObjectContext(sequenceHandle, nil, nil)
+	rc.auth = make([]byte, len(auth))
+	copy(rc.auth, auth)
+	return rc, nil
+}
+
+// SequenceUpdate executes the TPM2_SequenceUpdate command to add data to the HMAC, hash or event sequence associated with
+// sequenceContext. This command requires authorization with the user auth role for sequenceContext, with session based authorization
+// provided via sequenceContextAuthSession.
+//
+// If sequenceContext does not correspond to a sequence object, then a *TPMHandleError error with an error code of ErrorMode will be
+// returned.
+//
+// If sequenceContext corresponds to a hash sequence and the hash sequence is intended to produce a digest that will be signed with
+// a restricted signing key, the first block of data added to this sequence must be 4 bytes and not the value of TPMGeneratedValue.
+func (t *TPMContext) SequenceUpdate(sequenceContext ResourceContext, buffer MaxBuffer, sequenceContextAuthSession SessionContext, sessions ...SessionContext) error {
+	return t.RunCommand(CommandSequenceUpdate, sessions,
+		ResourceContextWithSession{Context: sequenceContext, Session: sequenceContextAuthSession}, Delimiter,
+		buffer)
+}
+
+// SequenceComplete executes the TPM2_SequenceComplete command to add the last part of the data the HMAC or hash sequence associated
+// with sequenceContext, and returns the result. This command requires authorization with the user auth role for sequenceContext, with
+// session based authorization provided via sequenceContextAuthSession.
+//
+// If sequenceContext does not correspond to a HMAC or hash sequence object, then a *TPMHandleError error with an error code of
+// ErrorMode will be returned.
+//
+// If sequenceContext corresponds to a hash sequence and the hash sequence is intended to produce a digest that will be signed with
+// a restricted signing key, the first block of data added to this sequence must be 4 bytes and not the value of TPMGeneratedValue.
+// If the returned digest is safe to sign with a restricted signing key, then a ticket that can be passed to TPMContext.Sign will be
+// returned. In this case, the hierarchy argument is used to specify the hierarchy for the ticket.
+//
+// On success, the sequence object associated with sequenceContext will be evicted, and sequenceContext will become invalid.
+func (t *TPMContext) SequenceComplete(sequenceContext ResourceContext, buffer MaxBuffer, hierarchy Handle, sequenceContextAuthSession SessionContext, sessions ...SessionContext) (Digest, *TkHashcheck, error) {
+	var result Digest
+	var validation *TkHashcheck
+
+	if err := t.RunCommand(CommandSequenceComplete, sessions,
+		ResourceContextWithSession{Context: sequenceContext, Session: sequenceContextAuthSession}, Delimiter,
+		buffer, hierarchy, Delimiter,
+		Delimiter,
+		&result, &validation); err != nil {
+		return nil, nil, err
+	}
+
+	if validation.Hierarchy == HandleNull && len(validation.Digest) == 0 {
+		validation = nil
+	}
+
+	sequenceContext.(handleContextPrivate).invalidate()
+	return result, validation, nil
+}
+
+// EventSequenceComplete executes the TPM2_EventSequenceComplete command to add the last part of the data to the event sequence
+// associated with sequenceContext, and return the result. This command requires authorization with the user auth role for
+// sequenceContext, with session based authorization provided via sequenceContextAuthSession.
+//
+// If pcrContext is not nil, the result will be extended to the corresponding PCR in the same manner as TPMContext.PCRExtend.
+// Authorization with the user auth role is required for pcrContext, with session based authorization provided via
+// pcrContextAuthSession.
+//
+// If sequenceContext does not correspond to an event sequence object, then a *TPMHandleError error with an error code of ErrorMode
+// will be returned for handle index 2.
+//
+// If pcrContext is not nil and the corresponding PCR can not be extended from the current locality, a *TPMError error with an
+// error code of ErrorLocality will be returned.
+//
+// On success, the sequence object associated with sequenceContext will be evicted, and sequenceContext will become invalid.
+func (t *TPMContext) EventSequenceComplete(pcrContext, sequenceContext ResourceContext, buffer MaxBuffer, pcrContextAuthSession, sequenceContextAuthSession SessionContext, sessions ...SessionContext) (TaggedHashList, error) {
+	var results TaggedHashList
+
+	if err := t.RunCommand(CommandEventSequenceComplete, sessions,
+		ResourceContextWithSession{Context: pcrContext, Session: pcrContextAuthSession}, ResourceContextWithSession{Context: sequenceContext, Session: sequenceContextAuthSession}, Delimiter,
+		buffer, Delimiter,
+		Delimiter,
+		&results); err != nil {
+		return nil, err
+	}
+
+	sequenceContext.(handleContextPrivate).invalidate()
+	return results, nil
+}
+
+// SequenceExecute executes a hash or HMAC sequence to completion and returns the result by adding the provided data to the sequence
+// with a number of TPM2_SequenceUpdate commands appropriate for the size of buffer, and executing a final TPM2_SequenceComplete
+// command. This command requires authorization with the user auth role for sequenceContext, with session based authorization provided
+// via sequenceContextAuthSession. As this function executes multiple commands, any SessionContext instances provided should have the
+// AttrContinueSession attribute defined.
+//
+// If sequenceContext does not correspond to a hash or HMAC sequence object, then a *TPMHandleError error with an error code of
+// ErrorMode will be returned.
+//
+// If sequenceContext corresponds to a hash sequence and the hash sequence is intended to produce a digest that will be signed with
+// a restricted signing key, the first block of data added to this sequence must be 4 bytes and not the value of TPMGeneratedValue.
+// If the returned digest is safe to sign with a restricted signing key, then a ticket that can be passed to TPMContext.Sign will be
+// returned. In this case, the hierarchy argument is used to specify the hierarchy for the ticket.
+//
+// On success, the sequence object associated with sequenceContext will be evicted, and sequenceContext will become invalid.
+func (t *TPMContext) SequenceExecute(sequenceContext ResourceContext, buffer []byte, hierarchy Handle, sequenceContextAuthSession SessionContext, sessions ...SessionContext) (Digest, *TkHashcheck, error) {
+	if err := t.initPropertiesIfNeeded(); err != nil {
+		return nil, nil, err
+	}
+
+	total := 0
+	for len(buffer)-total > t.maxBufferSize {
+		b := buffer[total:]
+		b = b[:t.maxBufferSize]
+		if err := t.SequenceUpdate(sequenceContext, b, sequenceContextAuthSession, sessions...); err != nil {
+			return nil, nil, err
+		}
+
+		total += len(b)
+	}
+
+	return t.SequenceComplete(sequenceContext, buffer[total:], hierarchy, sequenceContextAuthSession, sessions...)
+}
+
+// EventSequenceExecute executes an event sequence to completion and returns the result by adding the provided data to the sequence
+// with a number of TPM2_SequenceUpdate commands appropriate for the size of buffer, and executing a final TPM2_EventSequenceComplete
+// command. This command requires authorization with the user auth role for sequenceContext, with session based authorization provided
+// via sequenceContextAuthSession.
+//
+// If pcrContext is not nil, the result will be extended to the corresponding PCR in the same manner as TPMContext.PCRExtend.
+// Authorization with the user auth role is required for pcrContext, with session based authorization provided via
+// pcrContextAuthSession.
+//
+// As this function executes multiple commands, any SessionContext instances provided should have the AttrContinueSession attribute
+// defined.
+//
+// If sequenceContext does not correspond to an event sequence object, then a *TPMHandleError error with an error code of ErrorMode
+// will be returned for handle index 1 if the command is CommandSequenceUpdate, or handle index 2 if the command is
+// CommandEventSequenceComplete.
+//
+// If pcrContext is not nil and the corresponding PCR can not be extended from the current locality, a *TPMError error with an
+// error code of ErrorLocality will be returned.
+//
+// On success, the sequence object associated with sequenceContext will be evicted, and sequenceContext will become invalid.
+func (t *TPMContext) EventSequenceExecute(pcrContext, sequenceContext ResourceContext, buffer []byte, pcrContextAuthSession, sequenceContextAuthSession SessionContext, sessions ...SessionContext) (TaggedHashList, error) {
+	if err := t.initPropertiesIfNeeded(); err != nil {
+		return nil, err
+	}
+
+	total := 0
+	for len(buffer)-total > t.maxBufferSize {
+		b := buffer[total:]
+		b = b[:t.maxBufferSize]
+		if err := t.SequenceUpdate(sequenceContext, b, sequenceContextAuthSession, sessions...); err != nil {
+			return nil, err
+		}
+
+		total += len(b)
+	}
+
+	return t.EventSequenceComplete(pcrContext, sequenceContext, buffer[total:], pcrContextAuthSession, sequenceContextAuthSession, sessions...)
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_hierarchy.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_hierarchy.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_hierarchy.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_hierarchy.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,22 +25,22 @@
 // If the Attrs field of inPublic does not have the AttrSensitiveDataOrigin attribute set, then the sensitive data in the created
 // object is initialized with the data provided via the Data field of inSensitive.
 //
-// If the Attrs field of inPublic has the AttrSensitiveDataOrigin attribute set and Type is AlgorithmSymCipher, then the sensitive
+// If the Attrs field of inPublic has the AttrSensitiveDataOrigin attribute set and Type is ObjectTypeSymCipher, then the sensitive
 // data in the created object is initialized with a TPM generated key. The size of this key is determined by the value of the Params
-// field of inPublic. If Type is AlgorithmKeyedHash, then the sensitive data in the created object is initialized with a TPM
+// field of inPublic. If Type is ObjectTypeKeyedHash, then the sensitive data in the created object is initialized with a TPM
 // generated value that is the same size as the name algorithm selected by the NameAlg field of inPublic.
 //
-// If the Type field of inPublic is AlgorithmRSA or AlgorithmECC, then the sensitive data in the created object is initialized with
+// If the Type field of inPublic is ObjectTypeRSA or ObjectTypeECC, then the sensitive data in the created object is initialized with
 // a TPM generated private key. The size of this is determined by the value of the Params field of inPublic.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash and the Attrs field has AttrSensitiveDataOrigin, AttrSign and AttrDecrypt all
+// If the Type field of inPublic is ObjectTypeKeyedHash and the Attrs field has AttrSensitiveDataOrigin, AttrSign and AttrDecrypt all
 // clear, then the created object is a sealed data object.
 //
-// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is not AlgorithmKeyedHash,
-// then the newly created object will be a storage parent.
+// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is not
+// ObjectTypeKeyedHash, then the newly created object will be a storage parent.
 //
-// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is AlgorithmKeyedHash, then
-// the newly created object will be a derivation parent.
+// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is ObjectTypeKeyedHash,
+// then the newly created object will be a derivation parent.
 //
 // The authorization value for the created object is initialized to the value of the UserAuth field of inSensitive.
 //
@@ -50,8 +50,8 @@
 // If the attributes in the Attrs field of inPublic are inconsistent or inappropriate for the usage, a *TPMParameterError error with
 // an error code of ErrorAttributes will be returned for parameter index 2.
 //
-// If the NameAlg field of inPublic is AlgorithmNull, then a *TPMParameterError error with an error code of ErrorHash will be returned
-// for parameter index 2.
+// If the NameAlg field of inPublic is HashAlgorithmNull, then a *TPMParameterError error with an error code of ErrorHash will be
+// returned for parameter index 2.
 //
 // If an authorization policy is defined via the AuthPolicy field of inPublic then the length of the digest must match the name
 // algorithm selected via the NameAlg field, else a *TPMParameterError error with an error code of ErrorSize is returned for parameter
@@ -63,41 +63,41 @@
 // If the digest algorithm specified by the scheme in the Params field of inPublic is inappropriate for the usage, a
 // *TPMParameterError error with an error code of ErrorHash will be returned for parameter index 2.
 //
-// If the Type field of inPublic is not AlgorithmKeyedHash, a *TPMParameterError error with an error code of ErrorSymmetric will be
+// If the Type field of inPublic is not ObjectTypeKeyedHash, a *TPMParameterError error with an error code of ErrorSymmetric will be
 // returned for parameter index 2 if the symmetric algorithm specified in the Params field of inPublic is inappropriate for the
 // usage.
 //
-// If the Type field of inPublic is AlgorithmECC and the KDF scheme specified in the Params field of inPublic is not AlgorithmNull,
-// a *TPMParameterError error with an error code of ErrorKDF will be returned for parameter index 2.
+// If the Type field of inPublic is ObjectTypeECC and the KDF scheme specified in the Params field of inPublic is not
+// KDFAlgorithmNull, a *TPMParameterError error with an error code of ErrorKDF will be returned for parameter index 2.
 //
 // If the length of the UserAuth field of inSensitive is longer than the name algorithm selected by the NameAlg field of inPublic, a
 // *TPMParameterError error with an error code of ErrorSize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmRSA and the Params field specifies an unsupported exponent, a *TPMError with an error
+// If the Type field of inPublic is ObjectTypeRSA and the Params field specifies an unsupported exponent, a *TPMError with an error
 // code of ErrorRange will be returned. If the specified key size is an unsupported value, a *TPMError with an error code of
 // ErrorValue will be returned.
 //
-// If the Type field of inPublic is AlgorithmSymCipher and the key size is an unsupported value, a *TPMError with an error code of
+// If the Type field of inPublic is ObjectTypeSymCipher and the key size is an unsupported value, a *TPMError with an error code of
 // ErrorKeySize will be returned. If the AttrSensitiveDataOrigin attribute is not set and the length of the Data field of inSensitive
 // does not match the key size specified in the Params field of inPublic, a *TPMError with an error code of ErrorKeySize will be
 // returned.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash and the AttrSensitiveDataOrigin attribute is not set, a *TPMError with an error
-// code of ErrorSize will be returned if the length of the Data field of inSensitive is longer than permitted for the digest algorithm
-// selected by the specified scheme.
+// If the Type field of inPublic is ObjectTypeKeyedHash and the AttrSensitiveDataOrigin attribute is not set, a *TPMError with an
+// error code of ErrorSize will be returned if the length of the Data field of inSensitive is longer than permitted for the digest
+// algorithm selected by the specified scheme.
 //
 // On success, a ResourceContext instance will be returned that corresponds to the newly created object on the TPM. It will not be
 // necessary to call ResourceContext.SetAuthValue on it - this function sets the correct authorization value so that it can be used in
-// subsequent commands that require knowledge of the authorization value. If the Type field of inPublic is AlgorithmKeyedHash or
-// AlgorithmSymCipher, then the returned *Public object will have a Unique field that is the digest of the sensitive data and the value
-// of the object's seed in the sensitive area, computed using the object's name algorithm. If the Type field of inPublic is
-// AlgorithmECC or AlgorithmRSA, then the returned *Public object will have a Unique field containing details about the public part of
-// the key, computed from the private part of the key.
+// subsequent commands that require knowledge of the authorization value. If the Type field of inPublic is ObjectTypeKeyedHash or
+// ObjectTypeSymCipher, then the returned *Public object will have a Unique field that is the digest of the sensitive data and the
+// value of the object's seed in the sensitive area, computed using the object's name algorithm. If the Type field of inPublic is
+// ObjectTypeECC or ObjectTypeRSA, then the returned *Public object will have a Unique field containing details about the public part
+// of the key, computed from the private part of the key.
 //
 // The returned *CreationData will contain a digest computed from the values of PCRs selected by the creationPCR parameter at creation
-// time in the PCRDigest field. It will also contain the provided outsideInfo in the OutsideInfo field. The returned *TkCreation ticket
-// can be used to prove the association between the created object and the returned *CreationData via the TPMContext.CertifyCreation
-// method.
+// time in the PCRDigest field. It will also contain the provided outsideInfo in the OutsideInfo field. The returned *TkCreation
+// ticket can be used to prove the association between the created object and the returned *CreationData via the
+// TPMContext.CertifyCreation method.
 func (t *TPMContext) CreatePrimary(primaryObject ResourceContext, inSensitive *SensitiveCreate, inPublic *Public, outsideInfo Data, creationPCR PCRSelectionList, primaryObjectAuthSession SessionContext, sessions ...SessionContext) (ResourceContext, *Public, *CreationData, Digest, *TkCreation, error) {
 	if inSensitive == nil {
 		inSensitive = &SensitiveCreate{}
@@ -140,6 +140,35 @@
 	return rc, outPublic.Ptr, creationData.Ptr, creationHash, &creationTicket, nil
 }
 
+// HierarchyControl executes the TPM2_HierarchyControl command in order to enable or disable the hierarchy associated with the
+// enable argument. If state is true, the hierarchy associated with the enable argument will be enabled. If state is false, the
+// hierarchy associated with the enable argument will be disabled. This command requires authorization with the user auth role
+// for authContext, with session based authorization provided via authContextAuthSession.
+//
+// If enable is HandlePlatform and state is false, then this will disable use of the platform hierarchy. In this case, authContext
+// must correspond to HandlePlatform.
+//
+// If enable is HandlePlatformNV and state is false, then this will disable the use of NV indices with the AttrNVPlatformCreate
+// attribute set, indicating that they were created by the platform owner. In this case, authContext must correspond to
+// HandlePlatform.
+//
+// If enable is HandleOwner and state is false, then this will disable the use of the storage hierarchy and any NV indices with
+// the AttrNVPlatformCreate attribute clear. In this case, authContext must correspond to HandleOwner or HandlePlatform.
+//
+// If enable is HandleEndorsement and state is false, then this will disable the use of the endorsment hierarchy. In this case,
+// authContext must correspond to HandleEndorsement or HandlePlatform.
+//
+// When a hierarchy is disabled, persistent objects associated with it become unavailable, and transient objects associated with it
+// are flushed from the TPM.
+//
+// If state is true, then authContext must correspond to HandlePlatform. Note that the platform hierarchy can't be re-enabled by
+// this command.
+func (t *TPMContext) HierarchyControl(authContext ResourceContext, enable Handle, state bool, authContextAuthSession SessionContext, sessions ...SessionContext) error {
+	return t.RunCommand(CommandHierarchyControl, sessions,
+		ResourceContextWithSession{Context: authContext, Session: authContextAuthSession}, Delimiter,
+		enable, state)
+}
+
 // Clear executes the TPM2_Clear command to remove all context associated with the current owner. The command requires knowledge of
 // the authorization value for either the platform or lockout hierarchy. The hierarchy is specified by passing a ResourceContext
 // corresponding to either HandlePlatform or HandleLockout to authContext. The command requires authorization with the user auth
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_nv.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_nv.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_nv.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_nv.go	2021-02-02 08:21:12.000000000 +0000
@@ -10,20 +10,9 @@
 	"encoding/binary"
 	"errors"
 	"fmt"
-)
 
-func (t *TPMContext) initNVMaxBufferSize() {
-	if t.maxNVBufferSize > 0 {
-		return
-	}
-	props, err := t.GetCapabilityTPMProperties(PropertyNVBufferMax, 1)
-	switch {
-	case err == nil && len(props) > 0:
-		t.maxNVBufferSize = uint16(props[0].Value)
-	default:
-		t.maxNVBufferSize = 512
-	}
-}
+	"github.com/canonical/go-tpm2/mu"
+)
 
 // NVDefineSpace executes the TPM2_NV_DefineSpace command to reserve space to hold the data associated with a NV index described by
 // the publicInfo parameter. The Index field of publicInfo defines the handle at which the index should be reserved. The NameAlg
@@ -93,7 +82,7 @@
 // authorization value so that it can be used in subsequent commands that require knowledge of it.
 func (t *TPMContext) NVDefineSpace(authContext ResourceContext, auth Auth, publicInfo *NVPublic, authContextAuthSession SessionContext, sessions ...SessionContext) (ResourceContext, error) {
 	if publicInfo == nil {
-		return nil, makeInvalidParamError("publicInfo", "nil value")
+		return nil, makeInvalidArgError("publicInfo", "nil value")
 	}
 	name, err := publicInfo.Name()
 	if err != nil {
@@ -192,8 +181,6 @@
 }
 
 // NVWriteRaw executes the TPM2_NV_Write command to write data to the NV index associated with nvIndex, at the specified offset.
-// If the length of the data is greater than the maximum supported by the TPM in a single command, a partial write will be performed
-// and the number of bytes written will be returned.
 //
 // The command requires authorization, defined by the state of the AttrNVPPWrite, AttrNVOwnerWrite, AttrNVAuthWrite and
 // AttrNVPolicyWrite attributes. The handle used for authorization is specified via authContext. If the NV index has the AttrNVPPWrite
@@ -221,21 +208,15 @@
 // code of ErrorNVRange will be returned.
 //
 // On successful completion, the AttrNVWritten flag will be set if this is the first time that the index has been written to.
-func (t *TPMContext) NVWriteRaw(authContext, nvIndex ResourceContext, data MaxNVBuffer, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) (uint16, error) {
-	t.initNVMaxBufferSize()
-
-	if uint16(len(data)) > t.maxNVBufferSize {
-		data = data[0:t.maxNVBufferSize]
-	}
-
+func (t *TPMContext) NVWriteRaw(authContext, nvIndex ResourceContext, data MaxNVBuffer, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) error {
 	if err := t.RunCommand(CommandNVWrite, sessions,
 		ResourceContextWithSession{Context: authContext, Session: authContextAuthSession}, nvIndex, Delimiter,
 		data, offset); err != nil {
-		return 0, err
+		return err
 	}
 
 	nvIndex.(*nvIndexContext).setAttr(AttrNVWritten)
-	return uint16(len(data)), nil
+	return nil
 }
 
 // NVWrite executes the TPM2_NV_Write command to write data to the NV index associated with nvIndex, at the specified offset.
@@ -254,13 +235,8 @@
 // digest that matches the authorization policy for the index.
 //
 // If data is too large to be written in a single command, this function will re-execute the TPM2_NV_Write command until all data is
-// written. As a consequence, any SessionContext instances provided should have the AttrContinueSession attribute defined. An error will
-// be returned if the write will require more than one command execution and there are sessions without the AttrContinueSession
-// attribute defined. If authContextAuth is a SessionContext instance that references a bound session and this is the first write to this
-// index, the first write will break the session binding. In this case, the AuthValue field should be set to the authorization value
-// of the resource associated with authContext to avoid a partial write when the write is split across multiple commands. A policy
-// session can not be used for authContextAuth if the write is to be split across multiple commands - in this case,
-// TPMContext.NVWriteRaw must be used instead.
+// written. In this case, any SessionContext instances provided must have the AttrContinueSession attribute defined and
+// authContextAuthSession must not be a policy session.
 //
 // If the index has the AttrNVWriteLocked attribute set, a *TPMError error with an error code of ErrorNVLocked will be returned.
 //
@@ -275,40 +251,42 @@
 // code of ErrorNVRange will be returned.
 //
 // On successful completion, the AttrNVWritten flag will be set if this is the first time that the index has been written to.
-func (t *TPMContext) NVWrite(authContext, nvIndex ResourceContext, data MaxNVBuffer, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) error {
-	t.initNVMaxBufferSize()
-
-	remaining := uint16(len(data))
-	total := uint16(0)
+func (t *TPMContext) NVWrite(authContext, nvIndex ResourceContext, data []byte, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) error {
+	if err := t.initPropertiesIfNeeded(); err != nil {
+		return err
+	}
 
-	if remaining > t.maxNVBufferSize {
+	if len(data) > t.maxNVBufferSize {
 		if authContextAuthSession != nil {
 			if authContextAuthSession.(*sessionContext).attrs&AttrContinueSession == 0 {
-				return makeInvalidParamError("authContextAuthSession", "the AttrContinueSession attribute is required for a split write")
+				return makeInvalidArgError("authContextAuthSession",
+					fmt.Sprintf("the AttrContinueSession attribute is required for authorization sessions for writes larger than %d bytes", t.maxNVBufferSize))
 			}
 			if authContextAuthSession.(*sessionContext).scData().SessionType == SessionTypePolicy {
-				return makeInvalidParamError("authContextAuthSession", "a policy session can not be used for a split write - use NVWriteRaw instead")
+				return makeInvalidArgError("authContextAuthSession",
+					fmt.Sprintf("a policy authorization session cannot be used for writes larger than %d bytes", t.maxNVBufferSize))
 			}
 		}
-
 		for i, s := range sessions {
 			if s.(*sessionContext).attrs&AttrContinueSession == 0 {
-				return makeInvalidParamError("sessions", fmt.Sprintf("the AttrContineSession attribute is required for session at index %d for "+
-					"a split write", i))
+				return makeInvalidArgError("sessions",
+					fmt.Sprintf("the AttrContineSession attribute is required for session at index %d for writes larger than %d bytes", i, t.maxNVBufferSize))
 			}
 		}
 	}
 
+	total := 0
 	for {
-		n, err := t.NVWriteRaw(authContext, nvIndex, data[total:], offset+total, authContextAuthSession, sessions...)
-		if err != nil {
+		d := data[total:]
+		if len(d) > t.maxNVBufferSize {
+			d = d[:t.maxNVBufferSize]
+		}
+		if err := t.NVWriteRaw(authContext, nvIndex, d, offset+uint16(total), authContextAuthSession, sessions...); err != nil {
 			return err
 		}
 
-		total += n
-		remaining -= n
-
-		if remaining == 0 {
+		total += len(d)
+		if len(data)-total == 0 {
 			break
 		}
 	}
@@ -343,7 +321,7 @@
 	if context.attrs().Type() != NVTypePinPass && context.attrs().Type() != NVTypePinFail {
 		return errors.New("nvIndex does not correspond to a PIN pass or PIN fail index")
 	}
-	data, err := MarshalToBytes(params)
+	data, err := mu.MarshalToBytes(params)
 	if err != nil {
 		panic(fmt.Sprintf("cannot marshal PIN counter parameters: %v", err))
 	}
@@ -492,8 +470,7 @@
 }
 
 // NVReadRaw executes the TPM2_NV_Read command to read the contents of the NV index associated with nvIndex. The amount of data to read,
-// and the offset within the index are defined by the size and offset parameters. If the amount of data requested is greater than the
-// maximum supported by the TPM in a single command, a partial read will be performed.
+// and the offset within the index are defined by the size and offset parameters.
 //
 // The command requires authorization, defined by the state of the AttrNVPPRead, AttrNVOwnerRead, AttrNVAuthRead and AttrNVPolicyRead
 // attributes. The handle used for authorization is specified via authContext. If the NV index has the AttrNVPPRead attribute,
@@ -524,12 +501,6 @@
 //
 // On successful completion, the requested data will be returned.
 func (t *TPMContext) NVReadRaw(authContext, nvIndex ResourceContext, size, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) (MaxNVBuffer, error) {
-	t.initNVMaxBufferSize()
-
-	if size > t.maxNVBufferSize {
-		size = t.maxNVBufferSize
-	}
-
 	var data MaxNVBuffer
 
 	if err := t.RunCommand(CommandNVRead, sessions,
@@ -560,9 +531,8 @@
 // digest that matches the authorization policy for the index.
 //
 // If the requested data can not be read in a single command, this function will re-execute the TPM2_NV_Read command until all data
-// is read. As a consequence, any SessionContext instances provided should have the AttrContinueSession attribute defined. If the requested
-// data cannot be read in a single command, then authContextAuth should not correspond to a policy session. If a policy session is
-// required, use TPMContext.NVReadRaw instead.
+// is read. In this case, any SessionContext instances provided should have the AttrContinueSession attribute defined and
+// authContextAuth should not correspond to a policy session.
 //
 // If the index has the AttrNVReadLocked attribute set, a *TPMError error with an error code of ErrorNVLocked will be returned.
 //
@@ -579,21 +549,28 @@
 // returned.
 //
 // On successful completion, the requested data will be returned.
-func (t *TPMContext) NVRead(authContext, nvIndex ResourceContext, size, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) (MaxNVBuffer, error) {
-	data := make(MaxNVBuffer, size)
-	total := uint16(0)
+func (t *TPMContext) NVRead(authContext, nvIndex ResourceContext, size, offset uint16, authContextAuthSession SessionContext, sessions ...SessionContext) ([]byte, error) {
+	if err := t.initPropertiesIfNeeded(); err != nil {
+		return nil, err
+	}
+
+	data := make([]byte, size)
+	total := 0
 	remaining := size
 
 	for {
-		tmpData, err := t.NVReadRaw(authContext, nvIndex, remaining, offset+total, authContextAuthSession, sessions...)
+		sz := remaining
+		if remaining > uint16(t.maxNVBufferSize) {
+			sz = uint16(t.maxNVBufferSize)
+		}
+		tmpData, err := t.NVReadRaw(authContext, nvIndex, sz, offset+uint16(total), authContextAuthSession, sessions...)
 		if err != nil {
 			return nil, err
 		}
 
 		copy(data[total:], tmpData)
-		n := uint16(len(tmpData))
-		total += n
-		remaining -= n
+		total += int(sz)
+		remaining -= sz
 
 		if remaining == 0 {
 			break
@@ -678,7 +655,7 @@
 		return nil, err
 	}
 	var res NVPinCounterParams
-	if _, err := UnmarshalFromBytes(data, &res); err != nil {
+	if _, err := mu.UnmarshalFromBytes(data, &res); err != nil {
 		return nil, &InvalidResponseError{CommandNVRead, fmt.Sprintf("cannot unmarshal response bytes: %v", err)}
 	}
 	return &res, nil
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_object.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_object.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_object.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_object.go	2021-02-02 08:21:12.000000000 +0000
@@ -25,22 +25,22 @@
 // If the Attrs field of inPublic does not have the AttrSensitiveDataOrigin attribute set, then the sensitive data in the created
 // object is initialized with the data provided via the Data field of inSensitive.
 //
-// If the Attrs field of inPublic has the AttrSensitiveDataOrigin attribute set and Type is AlgorithmSymCipher, then the sensitive
+// If the Attrs field of inPublic has the AttrSensitiveDataOrigin attribute set and Type is ObjectTypeSymCipher, then the sensitive
 // data in the created object is initialized with a TPM generated key. The size of this key is determined by the value of the Params
-// field of inPublic. If Type is AlgorithmKeyedHash, then the sensitive data in the created object is initialized with a TPM
+// field of inPublic. If Type is ObjectTypeKeyedHash, then the sensitive data in the created object is initialized with a TPM
 // generated value that is the same size as the name algorithm selected by the NameAlg field of inPublic.
 //
-// If the Type field of inPublic is AlgorithmRSA or AlgorithmECC, then the sensitive data in the created object is initialized with
+// If the Type field of inPublic is ObjectTypeRSA or ObjectTypeECC, then the sensitive data in the created object is initialized with
 // a TPM generated private key. The size of this is determined by the value of the Params field of inPublic.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash and the Attrs field has AttrSensitiveDataOrigin, AttrSign and AttrDecrypt all
+// If the Type field of inPublic is ObjectTypeKeyedHash and the Attrs field has AttrSensitiveDataOrigin, AttrSign and AttrDecrypt all
 // clear, then the created object is a sealed data object.
 //
-// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is not AlgorithmKeyedHash,
-// then the newly created object will be a storage parent.
+// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is not
+// ObjectTypeKeyedHash, then the newly created object will be a storage parent.
 //
-// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is AlgorithmKeyedHash, then
-// the newly created object will be a derivation parent.
+// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is ObjectTypeKeyedHash,
+// then the newly created object will be a derivation parent.
 //
 // The authorization value for the created object is initialized to the value of the UserAuth field of inSensitive.
 //
@@ -57,8 +57,8 @@
 // If the attributes in the Attrs field of inPublic are inconsistent or inappropriate for the usage, a *TPMParameterError error with
 // an error code of ErrorAttributes will be returned for parameter index 2.
 //
-// If the NameAlg field of inPublic is AlgorithmNull, then a *TPMParameterError error with an error code of ErrorHash will be returned
-// for parameter index 2.
+// If the NameAlg field of inPublic is HashAlgorithmNull, then a *TPMParameterError error with an error code of ErrorHash will be
+// returned for parameter index 2.
 //
 // If an authorization policy is defined via the AuthPolicy field of inPublic then the length of the digest must match the name
 // algorithm selected via the NameAlg field, else a *TPMParameterError error with an error code of ErrorSize is returned for parameter
@@ -70,14 +70,14 @@
 // If the digest algorithm specified by the scheme in the Params field of inPublic is inappropriate for the usage, a
 // *TPMParameterError error with an error code of ErrorHash will be returned for parameter index 2.
 //
-// If the Type field of inPublic is not AlgorithmKeyedHash, a *TPMParameterError error with an error code of ErrorSymmetric will be
+// If the Type field of inPublic is not ObjectTypeKeyedHash, a *TPMParameterError error with an error code of ErrorSymmetric will be
 // returned for parameter index 2 if the symmetric algorithm specified in the Params field of inPublic is inappropriate for the
 // usage.
 //
-// If the Type field of inPublic is AlgorithmECC and the KDF scheme specified in the Params field of inPublic is not AlgorithmNull,
-// a *TPMParameterError error with an error code of ErrorKDF will be returned for parameter index 2.
+// If the Type field of inPublic is ObjectTypeECC and the KDF scheme specified in the Params field of inPublic is not
+// KDFAlgorithmNull, a *TPMParameterError error with an error code of ErrorKDF will be returned for parameter index 2.
 //
-// If the Type field of inPublic is not AlgorithmKeyedHash and the AttrRestricted, AttrFixedParent and AttrDecrypt attributes of
+// If the Type field of inPublic is not ObjectTypeKeyedHash and the AttrRestricted, AttrFixedParent and AttrDecrypt attributes of
 // Attrs are set, a *TPMParameterError error with an error code of ErrorHash will be returned for parameter index 2 if the NameAlg
 // field of inPublic does not select the same name algorithm as the parent object. A *TPMParameterError error with an error code
 // of ErrorSymmetric will be returned for parameter index 2 if the symmetric algorithm specified in the Params field of inPublic
@@ -86,23 +86,23 @@
 // If the length of the UserAuth field of inSensitive is longer than the name algorithm selected by the NameAlg field of inPublic, a
 // *TPMParameterError error with an error code of ErrorSize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmRSA and the Params field specifies an unsupported exponent, a *TPMError with an error
+// If the Type field of inPublic is ObjectTypeRSA and the Params field specifies an unsupported exponent, a *TPMError with an error
 // code of ErrorRange will be returned. If the specified key size is an unsupported value, a *TPMError with an error code of
 // ErrorValue will be returned.
 //
-// If the Type field of inPublic is AlgorithmSymCipher and the key size is an unsupported value, a *TPMError with an error code of
+// If the Type field of inPublic is ObjectTypeSymCipher and the key size is an unsupported value, a *TPMError with an error code of
 // ErrorKeySize will be returned. If the AttrSensitiveDataOrigin attribute is not set and the length of the Data field of inSensitive
 // does not match the key size specified in the Params field of inPublic, a *TPMError with an error code of ErrorKeySize will be
 // returned.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash and the AttrSensitiveDataOrigin attribute is not set, a *TPMError with an error
-// code of ErrorSize will be returned if the length of the Data field of inSensitive is longer than permitted for the digest algorithm
-// selected by the specified scheme.
+// If the Type field of inPublic is ObjectTypeKeyedHash and the AttrSensitiveDataOrigin attribute is not set, a *TPMError with an
+// error code of ErrorSize will be returned if the length of the Data field of inSensitive is longer than permitted for the digest
+// algorithm selected by the specified scheme.
 //
 // On success, the private and public parts of the newly created object will be returned. The newly created object will not exist on
-// the TPM. If the Type field of inPublic is AlgorithmKeyedHash or AlgorithmSymCipher, then the returned *Public object will have a
+// the TPM. If the Type field of inPublic is ObjectTypeKeyedHash or ObjectTypeSymCipher, then the returned *Public object will have a
 // Unique field that is the digest of the sensitive data and the value of the object's seed in the sensitive area, computed using the
-// object's name algorithm. If the Type field of inPublic is AlgorithmECC or AlgorithmRSA, then the returned *Public object will
+// object's name algorithm. If the Type field of inPublic is ObjectTypeECC or ObjectTypeRSA, then the returned *Public object will
 // have a Unique field containing details about the public part of the key, computed from the private part of the key.
 //
 // The returned *CreationData will contain a digest computed from the values of PCRs selected by the creationPCR parameter at creation
@@ -164,25 +164,25 @@
 // code of ErrorType is returned for parameter index 1. If the authorization value in the sensitive area is larger than the name
 // algorithm, a *TPMParameterError error with an error code of ErrorSize is returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmRSA and the size of the modulus in the Unique field is inconsistent with the size
+// If the Type field of inPublic is ObjectTypeRSA and the size of the modulus in the Unique field is inconsistent with the size
 // specified in the Params field, a *TPMParameterError error with an error code of ErrorKey will be returned for parameter index 2.
 // If the value of the exponent in the Params field is invalid, a *TPMParameterError error with an error code of ErrorValue will
 // be returned for parameter index 2. If the size of private key in the sensitive area is not the correct size, a *TPMParameterError
 // error with an error code of ErrorKeySize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmECC and the private key in the sensitive area is invalid, a *TPMParameterError error
+// If the Type field of inPublic is ObjectTypeECC and the private key in the sensitive area is invalid, a *TPMParameterError error
 // with an error code of ErrorKeySize will be returned for parameter index 1. If the public point specified in the Unique field of
 // inPublic does not belong to the private key, a *TPMError with an error code of ErrorBinding will be returned.
 //
-// If the Type field of inPublic is AlgorithmSymCipher and the size of the symmetric key in the sensitive area is inconsistent with
+// If the Type field of inPublic is ObjectTypeSymCipher and the size of the symmetric key in the sensitive area is inconsistent with
 // the symmetric algorithm specified in the Params field of inPublic, a *TPMParameterError error with an error code of ErrorKeySize
 // will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash and the size of the sensitive data is larger than permitted for the digest
+// If the Type field of inPublic is ObjectTypeKeyedHash and the size of the sensitive data is larger than permitted for the digest
 // algorithm selected by the scheme defined in the Params field of inPublic, a *TPMParameterError error with an error code of
 // ErrorKeySize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmSymCipher or AlgorithmKeyedHash and the size of seed value in the sensitive area does
+// If the Type field of inPublic is ObjectTypeSymCipher or ObjectTypeKeyedHash and the size of seed value in the sensitive area does
 // not match the name algorithm, a *TPMError error with an error code of ErrorKeySize will be returned. If the digest in the Unique
 // field of inPublic is inconsistent with the value of the sensitive data and the seed value, a *TPMError with an error code of
 // ErrorBinding will be returned.
@@ -241,40 +241,42 @@
 // sensitive area is larger than the name algorithm, a *TPMParameterError error with an error code of ErrorSize is returned for
 // parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmRSA and the size of the modulus in the Unique field is inconsistent with the size
+// If the Type field of inPublic is ObjectTypeRSA and the size of the modulus in the Unique field is inconsistent with the size
 // specified in the Params field, a *TPMParameterError error with an error code of ErrorKey will be returned for parameter index 2.
 // If the value of the exponent in the Params field is invalid, a *TPMParameterError error with an error code of ErrorValue will
 // be returned for parameter index 2. If inPrivate is provided and the size of private key in the sensitive area is not the correct
 // size, a *TPMParameterError error with an error code of ErrorKeySize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmECC, inPrivate is provided and the private key in the sensitive area is invalid, a
+// If the Type field of inPublic is ObjectTypeECC, inPrivate is provided and the private key in the sensitive area is invalid, a
 // *TPMParameterError error with an error code of ErrorKeySize will be returned for parameter index 1. If the public point specified
 // in the Unique field of inPublic does not belong to the private key, a *TPMError with an error code of ErrorBinding will be
 // returned.
 //
-// If the Type field of inPublic is AlgorithmECC, inPrivate is not provided and the size of the public key in the Unique field of
+// If the Type field of inPublic is ObjectTypeECC, inPrivate is not provided and the size of the public key in the Unique field of
 // inPublic is inconsistent with the value of the Params field of inPublic, a *TPMParameterError error with an error code of ErrorKey
 // is returned for parameter index 2. If the public point is not on the curve specified in the Params field of inPublic, a
 // *TPMParameterError error with an error code of ErrorECCPoint will be returned for parameter index 2.
 //
-// If the Type field of inPublic is AlgorithmSymCipher, inPrivate is provided and the size of the symmetric key in the sensitive area
+// If the Type field of inPublic is ObjectTypeSymCipher, inPrivate is provided and the size of the symmetric key in the sensitive area
 // is inconsistent with the symmetric algorithm specified in the Params field of inPublic, a *TPMParameterError error with an error
 // code of ErrorKeySize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash, inPrivate is provided and the size of the sensitive data is larger than
+// If the Type field of inPublic is ObjectTypeKeyedHash, inPrivate is provided and the size of the sensitive data is larger than
 // permitted for the digest algorithm selected by the scheme defined in the Params field of inPublic, a *TPMParameterError error
 // with an error code of ErrorKeySize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmSymCipher or AlgorithmKeyedHash and inPrivate has not been provided, a *TPMParameterError
-// error with an error code of ErrorKey will be returned for parameter index 2 if the size of the digest in the Unique field of
-// inPublic does not match the selected name algorithm.
+// If the Type field of inPublic is ObjectTypeSymCipher or ObjectTypeKeyedHash and inPrivate has not been provided, a
+// *TPMParameterError error with an error code of ErrorKey will be returned for parameter index 2 if the size of the digest in the
+// Unique field of inPublic does not match the selected name algorithm.
 //
-// If the Type field of inPublic is AlgorithmSymCipher or AlgorithmKeyedHash, inPrivate has been provided and the size of seed value
+// If the Type field of inPublic is ObjectTypeSymCipher or ObjectTypeKeyedHash, inPrivate has been provided and the size of seed value
 // in the sensitive area does not match the name algorithm, a *TPMError error with an error code of ErrorKeySize will be returned.
 // If the digest in the Unique field of inPublic is inconsistent with the value of the sensitive data and the seed value, a
 // *TPMError with an error code of ErrorBinding will be returned.
 //
-// On success, a ResourceContext corresponding to the newly loaded transient object will be returned.
+// On success, a ResourceContext corresponding to the newly loaded transient object will be returned. If inPrivate has been provided,
+// it will not be necessary to call ResourceContext.SetAuthValue on it - this function sets the correct authorization value so that it
+// can be used in subsequent commands that require knowledge of the authorization value.
 func (t *TPMContext) LoadExternal(inPrivate *Sensitive, inPublic *Public, hierarchy Handle, sessions ...SessionContext) (ResourceContext, error) {
 	var objectHandle Handle
 	var name Name
@@ -296,7 +298,12 @@
 	}
 
 	public, _ := inPublic.copy() // inPublic already marshalled successfully, so ignore errors here
-	return makeObjectContext(objectHandle, name, public), nil
+	rc := makeObjectContext(objectHandle, name, public)
+	if inPrivate != nil {
+		rc.auth = make([]byte, len(inPrivate.AuthValue))
+		copy(rc.auth, inPrivate.AuthValue)
+	}
+	return rc, nil
 }
 
 // ReadPublic executes the TPM2_ReadPublic command to read the public area of the object associated with objectContext.
@@ -381,8 +388,8 @@
 // If the size of credential is larger than the name algorithm associated with context, a *TPMParameterError error with an error code
 // of ErrorSize will be returned for parameter index 1.
 //
-// If the algorithm of the object associated with context is AlgorithmECC, a *TPMError with an error code of ErrorKey will be returned
-// if the ECC key is invalid. If the algorithm of the object associated with context is AlgorithmRSA, a *TPMError with an error code
+// If the algorithm of the object associated with context is ObjectTypeECC, a *TPMError with an error code of ErrorKey will be returned
+// if the ECC key is invalid. If the algorithm of the object associated with context is ObjectTypeRSA, a *TPMError with an error code
 // of ErrorScheme will be returned if the padding scheme is invalid or not supported.
 //
 // On success, the encrypted activation credential is returned as IDObjectRaw. The activation credential is encrypted with a key
@@ -411,7 +418,7 @@
 // data. The command requires authorization with the user auth role for itemContext, with session based authorization provided via
 // itemContextAuthSession.
 //
-// If the type of object associated with itemContext is not AlgorithmKeyedHash, a *TPMHandleError error with an error code of
+// If the type of object associated with itemContext is not ObjectTypeKeyedHash, a *TPMHandleError error with an error code of
 // ErrorType will be returned. If the object associated with itemContext has either the AttrDecrypt, AttrSign or AttrRestricted
 // attributes set, a *TPMHandlerError error with an error code of ErrorAttributes will be returned.
 //
@@ -479,30 +486,30 @@
 // AttrSensitiveDataOrigin attribute set, then the sensitive data in the created object is initialized with the data provided via the
 // Data field of inSensitive.
 //
-// If the Attrs field of inPublic has the AttrSensitiveDataOrigin attribute set and Type is AlgorithmSymCipher, then the sensitive
+// If the Attrs field of inPublic has the AttrSensitiveDataOrigin attribute set and Type is ObjectTypeSymCipher, then the sensitive
 // data in the created object is initialized with a TPM generated key. The size of this key is determined by the value of the Params
-// field of inPublic. If Type is AlgorithmKeyedHash, then the sensitive data in the created object is initialized with a TPM
+// field of inPublic. If Type is ObjectTypeKeyedHash, then the sensitive data in the created object is initialized with a TPM
 // generated value that is the same size as the name algorithm selected by the NameAlg field of inPublic.
 //
-// If the Type field of inPublic is AlgorithmRSA then the sensitive data in the created object is initialized with a TPM generated
+// If the Type field of inPublic is ObjectTypeRSA then the sensitive data in the created object is initialized with a TPM generated
 // private key. The size of this is determined by the value of the Params field of inPublic.
 //
-// If the Type field of inPublic is AlgorithmECC and parentContext does not correspond to a derivation parent, then the sensitive data
-// in the created object is initialized with a TPM generated private key. The size of this is determined by the value of the Params
-// field of inPublic.
+// If the Type field of inPublic is ObjectTypeECC and parentContext does not correspond to a derivation parent, then the sensitive
+// data in the created object is initialized with a TPM generated private key. The size of this is determined by the value of the
+// Params field of inPublic.
 //
 // If parentContext corresponds to a derivation parent, the sensitive data in the created object is initialized with a value derived
 // from the parent object's private seed, and the derivation values specified in either the Unique field of inPublic or the Data
 // field of inSensitive.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash, the Attrs field has AttrSensitiveDataOrigin, AttrSign and AttrDecrypt all
+// If the Type field of inPublic is ObjectTypeKeyedHash, the Attrs field has AttrSensitiveDataOrigin, AttrSign and AttrDecrypt all
 // clear, then the created object is a sealed data object.
 //
-// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is not AlgorithmKeyedHash,
-// then the newly created object will be a storage parent.
+// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is not
+// ObjectTypeKeyedHash, then the newly created object will be a storage parent.
 //
-// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is AlgorithmKeyedHash, then
-// the newly created object will be a derivation parent.
+// If the Attrs field of inPublic has the AttrRestricted and AttrDecrypt attributes set, and the Type field is ObjectTypeKeyedHash,
+// then the newly created object will be a derivation parent.
 //
 // The authorization value for the created object is initialized to the value of the UserAuth field of inSensitive.
 //
@@ -515,8 +522,8 @@
 // If the attributes in the Attrs field of inPublic are inconsistent or inappropriate for the usage, a *TPMParameterError error with
 // an error code of ErrorAttributes will be returned for parameter index 2.
 //
-// If the NameAlg field of inPublic is AlgorithmNull, then a *TPMParameterError error with an error code of ErrorHash will be returned
-// for parameter index 2.
+// If the NameAlg field of inPublic is HashAlgorithmNull, then a *TPMParameterError error with an error code of ErrorHash will be
+// returned for parameter index 2.
 //
 // If an authorization policy is defined via the AuthPolicy field of inPublic then the length of the digest must match the name
 // algorithm selected via the NameAlg field, else a *TPMParameterError error with an error code of ErrorSize is returned for parameter
@@ -528,14 +535,14 @@
 // If the digest algorithm specified by the scheme in the Params field of inPublic is inappropriate for the usage, a
 // *TPMParameterError error with an error code of ErrorHash will be returned for parameter index 2.
 //
-// If the Type field of inPublic is not AlgorithmKeyedHash, a *TPMParameterError error with an error code of ErrorSymmetric will be
+// If the Type field of inPublic is not ObjectTypeKeyedHash, a *TPMParameterError error with an error code of ErrorSymmetric will be
 // returned for parameter index 2 if the symmetric algorithm specified in the Params field of inPublic is inappropriate for the
 // usage.
 //
-// If the Type field of inPublic is AlgorithmECC and the KDF scheme specified in the Params field of inPublic is not AlgorithmNull,
-// a *TPMParameterError error with an error code of ErrorKDF will be returned for parameter index 2.
+// If the Type field of inPublic is ObjectTypeECC and the KDF scheme specified in the Params field of inPublic is not
+// KDFAlgorithmNull, a *TPMParameterError error with an error code of ErrorKDF will be returned for parameter index 2.
 //
-// If the Type field of inPublic is not AlgorithmKeyedHash and the AttrRestricted, AttrFixedParent and AttrDecrypt attributes of
+// If the Type field of inPublic is not ObjectTypeKeyedHash and the AttrRestricted, AttrFixedParent and AttrDecrypt attributes of
 // Attrs are set, a *TPMParameterError error with an error code of ErrorHash will be returned for parameter index 2 if the NameAlg
 // field of inPublic does not select the same name algorithm as the parent object. A *TPMParameterError error with an error code
 // of ErrorSymmetric will be returned for parameter index 2 if the symmetric algorithm specified in the Params field of inPublic
@@ -544,25 +551,25 @@
 // If the length of the UserAuth field of inSensitive is longer than the name algorithm selected by the NameAlg field of inPublic, a
 // *TPMParameterError error with an error code of ErrorSize will be returned for parameter index 1.
 //
-// If the Type field of inPublic is AlgorithmRSA and the Params field specifies an unsupported exponent, a *TPMError with an error
+// If the Type field of inPublic is ObjectTypeRSA and the Params field specifies an unsupported exponent, a *TPMError with an error
 // code of ErrorRange will be returned. If the specified key size is an unsupported value, a *TPMError with an error code of
 // ErrorValue will be returned.
 //
-// If the Type field of inPublic is AlgorithmSymCipher and the key size is an unsupported value, a *TPMError with an error code of
+// If the Type field of inPublic is ObjectTypeSymCipher and the key size is an unsupported value, a *TPMError with an error code of
 // ErrorKeySize will be returned. If the AttrSensitiveDataOrigin attribute is not set and the length of the Data field of inSensitive
 // does not match the key size specified in the Params field of inPublic, a *TPMError with an error code of ErrorKeySize will be
 // returned.
 //
-// If the Type field of inPublic is AlgorithmKeyedHash and the AttrSensitiveDataOrigin attribute is not set, a *TPMError with an error
-// code of ErrorSize will be returned if the length of the Data field of inSensitive is longer than permitted for the digest algorithm
-// selected by the specified scheme.
+// If the Type field of inPublic is ObjectTypeKeyedHash and the AttrSensitiveDataOrigin attribute is not set, a *TPMError with an
+// error code of ErrorSize will be returned if the length of the Data field of inSensitive is longer than permitted for the digest
+// algorithm selected by the specified scheme.
 //
 // On success, a ResourceContext instance will be returned that corresponds to the newly created object on the TPM, along with the
 // private and public parts.  It will not be necessary to call ResourceContext.SetAuthValue on the returned ResourceContext - this
 // function sets the correct authorization value so that it can be used in subsequent commands that require knowledge of the
-// authorization value. If the Type field of inPublic is AlgorithmKeyedHash or AlgorithmSymCipher, then the returned *Public object
+// authorization value. If the Type field of inPublic is ObjectTypeKeyedHash or ObjectTypeSymCipher, then the returned *Public object
 // will have a Unique field that is the digest of the sensitive data and the value of the object's seed in the sensitive area,
-// computed using the object's name algorithm. If the Type field of inPublic is AlgorithmECC or AlgorithmRSA, then the returned
+// computed using the object's name algorithm. If the Type field of inPublic is ObjectTypeECC or ObjectTypeRSA, then the returned
 // *Public object will have a Unique field containing details about the public part of the key, computed from the private part of the
 // key.
 func (t *TPMContext) CreateLoaded(parentContext ResourceContext, inSensitive *SensitiveCreate, inPublic PublicTemplate, parentContextAuthSession SessionContext, sessions ...SessionContext) (ResourceContext, Private, *Public, error) {
@@ -571,7 +578,7 @@
 	}
 
 	if inPublic == nil {
-		return nil, nil, nil, makeInvalidParamError("inPublic", "nil value")
+		return nil, nil, nil, makeInvalidArgError("inPublic", "nil value")
 	}
 
 	inTemplate, err := inPublic.ToTemplate()
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_pcr.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_pcr.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_pcr.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_pcr.go	2021-02-02 08:21:12.000000000 +0000
@@ -12,12 +12,41 @@
 	"sort"
 )
 
-// PCRValues contains a collection of PCR values, keyed by AlgorithmId and PCR index.
+// PCRValues contains a collection of PCR values, keyed by HashAlgorithmId and PCR index.
 type PCRValues map[HashAlgorithmId]map[int]Digest
 
-func (v PCRValues) SetValuesFromListAndSelection(digests DigestList, pcrs PCRSelectionList) (int, error) {
+// SelectionList computes a list of PCR selections corresponding to this set of PCR values.
+func (v PCRValues) SelectionList() PCRSelectionList {
+	var out PCRSelectionList
+	for h := range v {
+		s := PCRSelection{Hash: h}
+		for p := range v[h] {
+			s.Select = append(s.Select, p)
+		}
+		out = append(out, s)
+	}
+	return out.Sort()
+}
+
+// ToListAndSelection converts this set of PCR values to a list of PCR selections and list of PCR values, in a form that can be
+// serialized.
+func (v PCRValues) ToListAndSelection() (pcrs PCRSelectionList, digests DigestList) {
+	pcrs = v.SelectionList()
+	for _, p := range pcrs {
+		for _, s := range p.Select {
+			digests = append(digests, v[p.Hash][s])
+		}
+	}
+	return
+}
+
+// SetValuesFromListAndSelection sets PCR values from the supplied list of PCR selections and list of values.
+func (v PCRValues) SetValuesFromListAndSelection(pcrs PCRSelectionList, digests DigestList) (int, error) {
 	i := 0
 	for _, p := range pcrs {
+		if !p.Hash.Supported() {
+			return 0, errors.New("unsupported digest algorithm")
+		}
 		if _, ok := v[p.Hash]; !ok {
 			v[p.Hash] = make(map[int]Digest)
 		}
@@ -28,24 +57,31 @@
 			if len(digests) == 0 {
 				return 0, errors.New("insufficient digests")
 			}
-			v[p.Hash][s] = digests[0]
+			d := digests[0]
 			digests = digests[1:]
+			if len(d) != p.Hash.Size() {
+				return 0, errors.New("incorrect digest size")
+			}
+			v[p.Hash][s] = d
 			i++
 		}
 	}
 	return i, nil
 }
 
-func (v PCRValues) SetValue(pcr int, alg HashAlgorithmId, digest Digest) {
+// SetValue sets the PCR value for the specified PCR and PCR bank.
+func (v PCRValues) SetValue(alg HashAlgorithmId, pcr int, digest Digest) {
 	if _, ok := v[alg]; !ok {
 		v[alg] = make(map[int]Digest)
 	}
 	v[alg][pcr] = digest
 }
 
-func CreatePCRValuesFromListAndSelection(digests DigestList, pcrs PCRSelectionList) (PCRValues, int, error) {
+// CreatePCRValuesFromListAndSelection constructs a new set of PCR values from the supplied list of PCR selections and list of
+// PCR values.
+func CreatePCRValuesFromListAndSelection(pcrs PCRSelectionList, digests DigestList) (PCRValues, int, error) {
 	out := make(PCRValues)
-	n, err := out.SetValuesFromListAndSelection(digests, pcrs)
+	n, err := out.SetValuesFromListAndSelection(pcrs, digests)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -123,23 +159,23 @@
 			pcrUpdateCounter = updateCounter
 		} else if updateCounter != pcrUpdateCounter {
 			return 0, nil, &InvalidResponseError{CommandPCRRead, "PCR update counter changed between commands"}
-		} else if len(values) == 0 && pcrSelectionOut.isEmpty() {
-			return 0, nil, makeInvalidParamError("pcrSelectionIn", "unimplemented PCRs specified")
+		} else if len(values) == 0 && pcrSelectionOut.IsEmpty() {
+			return 0, nil, makeInvalidArgError("pcrSelectionIn", "unimplemented PCRs specified")
 		}
 
-		if n, err := pcrValues.SetValuesFromListAndSelection(values, pcrSelectionOut); err != nil {
+		if n, err := pcrValues.SetValuesFromListAndSelection(pcrSelectionOut, values); err != nil {
 			return 0, nil, &InvalidResponseError{CommandPCRRead, err.Error()}
 		} else if n != len(values) {
 			return 0, nil, &InvalidResponseError{CommandPCRRead, "too many digests"}
 		}
 
 		var err error
-		remaining, err = remaining.subtract(pcrSelectionOut)
+		remaining, err = remaining.Subtract(pcrSelectionOut)
 		if err != nil {
 			return 0, nil, &InvalidResponseError{CommandPCRRead, fmt.Sprintf("cannot determine outstanding PCR selection from selection returned "+
 				"from TPM: %v", err)}
 		}
-		if remaining.isEmpty() {
+		if remaining.IsEmpty() {
 			break
 		}
 	}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_session.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_session.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_session.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_session.go	2021-02-02 08:21:12.000000000 +0000
@@ -7,7 +7,6 @@
 // Section 11 - Session Commands
 
 import (
-	"errors"
 	"fmt"
 
 	"github.com/canonical/go-tpm2/internal"
@@ -49,8 +48,8 @@
 // If symmetric is provided, it defines the symmetric algorithm to use if the session is subsequently used for session based command
 // or response parameter encryption. Session based parameter encryption allows the first command and/or response parameter for a
 // command to be encrypted between the TPM and host CPU for supported parameter types (go types that correspond to TPM2B prefixed
-// types). If symmetric is provided and corresponds to a symmetric block cipher (ie, the Algorithm field is not AlgorithmXOR) then
-// the value of symmetric.Mode.Sym() must be AlgorithmCFB, else a *TPMParameterError error with an error code of ErrorMode is returned
+// types). If symmetric is provided and corresponds to a symmetric block cipher (ie, the Algorithm field is not SymAlgorithmXOR) then
+// the value of symmetric.Mode.Sym() must be SymModeCFB, else a *TPMParameterError error with an error code of ErrorMode is returned
 // for parameter index 4.
 //
 // If a SessionContext instance with the AttrCommandEncrypt attribute set is provided in the variable length sessions parameter, then
@@ -71,7 +70,7 @@
 		symmetric = &SymDef{Algorithm: SymAlgorithmNull}
 	}
 	if !authHash.Supported() {
-		return nil, makeInvalidParamError("authHash", fmt.Sprintf("unsupported digest algorithm %v", authHash))
+		return nil, makeInvalidArgError("authHash", fmt.Sprintf("unsupported digest algorithm %v", authHash))
 	}
 	digestSize := authHash.Size()
 
@@ -81,7 +80,7 @@
 	if tpmKey != nil {
 		object, isObject := tpmKey.(*objectContext)
 		if !isObject {
-			return nil, errors.New("invalid resource context for tpmKey: not an object")
+			return nil, makeInvalidArgError("tpmKey", "resource context is not an object")
 		}
 
 		tpmKeyHandle = tpmKey.Handle()
@@ -136,7 +135,7 @@
 		PolicyHMACType: policyHMACTypeNoAuth,
 		IsBound:        isBound,
 		BoundEntity:    boundEntity,
-		NonceCaller:    Nonce(nonceCaller),
+		NonceCaller:    nonceCaller,
 		NonceTPM:       nonceTPM,
 		Symmetric:      symmetric}
 
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_signature.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_signature.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/cmds_signature.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/cmds_signature.go	2021-02-02 08:21:12.000000000 +0000
@@ -37,11 +37,11 @@
 // If the object associated with keyContext is not a signing key, a *TPMHandleError error with an error code of ErrorKey will be
 // returned.
 //
-// If the scheme of the key associated with keyContext is AlgorithmNull, then inScheme must be provided to specify a valid signing
+// If the scheme of the key associated with keyContext is AsymSchemeNull, then inScheme must be provided to specify a valid signing
 // scheme for the key. If it isn't, a *TPMParameterError error with an error code of ErrorScheme will be returned for parameter index
 // 2.
 //
-// If the scheme of the key associated with keyContext is not AlgorithmNull, then inScheme may be nil. If it is provided, then the
+// If the scheme of the key associated with keyContext is not AsymSchemeNull, then inScheme may be nil. If it is provided, then the
 // specified scheme must match that of the signing key, else a *TPMParameterError error with an error code of ErrorScheme will be
 // returned for parameter index 2.
 //
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/constants.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/constants.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/constants.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/constants.go	2021-02-02 08:21:12.000000000 +0000
@@ -82,6 +82,7 @@
 
 	CommandNVUndefineSpaceSpecial     CommandCode = 0x0000011F // TPM_CC_NV_UndefineSpaceSpecial
 	CommandEvictControl               CommandCode = 0x00000120 // TPM_CC_EvictControl
+	CommandHierarchyControl           CommandCode = 0x00000121 // TPM_CC_HierarchyControl
 	CommandNVUndefineSpace            CommandCode = 0x00000122 // TPM_CC_NV_UndefineSpace
 	CommandClear                      CommandCode = 0x00000126 // TPM_CC_Clear
 	CommandClearControl               CommandCode = 0x00000127 // TPM_CC_ClearControl
@@ -100,6 +101,7 @@
 	CommandNVChangeAuth               CommandCode = 0x0000013B // TPM_CC_NV_ChangeAuth
 	CommandPCREvent                   CommandCode = 0x0000013C // TPM_CC_PCR_Event
 	CommandPCRReset                   CommandCode = 0x0000013D // TPM_CC_PCR_Reset
+	CommandSequenceComplete           CommandCode = 0x0000013E // TPM_CC_SequenceComplete
 	CommandSetCommandCodeAuditStatus  CommandCode = 0x00000140 // TPM_CC_SetCommandCodeAuditStatus
 	CommandIncrementalSelfTest        CommandCode = 0x00000142 // TPM_CC_IncrementalSelfTest
 	CommandSelfTest                   CommandCode = 0x00000143 // TPM_CC_SelfTest
@@ -121,6 +123,8 @@
 	CommandImport                     CommandCode = 0x00000156 // TPM_CC_Import
 	CommandLoad                       CommandCode = 0x00000157 // TPM_CC_Load
 	CommandQuote                      CommandCode = 0x00000158 // TPM_CC_Quote
+	CommandHMACStart                  CommandCode = 0x0000015B // TPM_CC_HMAC_Start
+	CommandSequenceUpdate             CommandCode = 0x0000015C // TPM_CC_SequenceUpdate
 	CommandSign                       CommandCode = 0x0000015D // TPM_CC_Sign
 	CommandUnseal                     CommandCode = 0x0000015E // TPM_CC_Unseal
 	CommandPolicySigned               CommandCode = 0x00000160 // TPM_CC_PolicySigned
@@ -149,6 +153,8 @@
 	CommandPolicyRestart              CommandCode = 0x00000180 // TPM_CC_PolicyRestart
 	CommandReadClock                  CommandCode = 0x00000181 // TPM_CC_ReadClock
 	CommandPCRExtend                  CommandCode = 0x00000182 // TPM_CC_PCR_Extend
+	CommandEventSequenceComplete      CommandCode = 0x00000185 // TPM_CC_EventSequenceComplete
+	CommandHashSequenceStart          CommandCode = 0x00000186 // TPM_CC_HashSequenceStart
 	CommandPolicyDuplicationSelect    CommandCode = 0x00000188 // TPM_CC_PolicyDuplicationSelect
 	CommandPolicyGetDigest            CommandCode = 0x00000189 // TPM_CC_PolicyGetDigest
 	CommandTestParms                  CommandCode = 0x0000018A // TPM_CC_TestParms
@@ -660,6 +666,11 @@
 )
 
 const (
+	// EventMaxSize indicates the maximum size of arguments of the Event type.
+	EventMaxSize = 1024
+)
+
+const (
 	// These constants represent properties that only change when the firmware in the TPM changes.
 	PropertyFamilyIndicator   Property = 0x100 // TPM_PT_FAMILY_INDICATOR
 	PropertyLevel             Property = 0x101 // TPM_PT_LEVEL
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/crypto.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/crypto.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/crypto.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/crypto.go	2021-02-02 08:21:12.000000000 +0000
@@ -15,6 +15,7 @@
 	"math/big"
 
 	"github.com/canonical/go-tpm2/internal"
+	"github.com/canonical/go-tpm2/mu"
 )
 
 func getHashConstructor(alg HashAlgorithmId) func() hash.Hash {
@@ -151,7 +152,7 @@
 
 	mulX, _ := curve.ScalarMult(tpmX, tpmY, ephPriv)
 
-	return ECCParameter(mulX.Bytes()), &ECCPoint{X: ECCParameter(ephX.Bytes()), Y: ECCParameter(ephY.Bytes())}, nil
+	return mulX.Bytes(), &ECCPoint{X: ephX.Bytes(), Y: ephY.Bytes()}, nil
 }
 
 func cryptComputeEncryptedSalt(public *Public) (EncryptedSecret, []byte, error) {
@@ -173,12 +174,12 @@
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to compute secret: %v", err)
 		}
-		encryptedSalt, err := MarshalToBytes(q)
+		encryptedSalt, err := mu.MarshalToBytes(q)
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to marshal ephemeral public key: %v", err)
 		}
 		salt := internal.KDFe(public.NameAlg.GetHash(), []byte(z), []byte("SECRET"), []byte(q.X), []byte(public.Unique.ECC().X), digestSize*8)
-		return EncryptedSecret(encryptedSalt), salt, nil
+		return encryptedSalt, salt, nil
 	}
 
 	return nil, nil, fmt.Errorf("unsupported key type %v", public.Type)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/doc.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/doc.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/doc.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/doc.go	2021-02-02 08:21:12.000000000 +0000
@@ -66,46 +66,6 @@
  }
  // The resource associated with context is now unavailable.
 
-Parameter marshalling and unmarshalling
-
-This package marshals go types to and from the TPM wire format, according to the following rules:
- * UINT8 <-> uint8
- * BYTE <-> byte
- * INT8 <-> int8
- * BOOL <-> bool
- * UINT16 <-> uint16
- * INT16 <-> int16
- * UINT32 <-> uint32
- * INT32 <-> int32
- * UINT64 <-> uint64
- * INT64 <-> int64
- * TPM2B prefixed types (sized buffers with a 2-byte size field) fall in to 2 categories:
-    * Byte buffer <-> []byte, or any type with an identical underlying type.
-    * Sized structure <-> struct referenced via a pointer field in an enclosing struct, where the field has the `tpm2:"sized"` tag. A
-    zero sized struct is represented as a nil pointer.
- * TPMA prefixed types (attributes) <-> whichever go type corresponds to the underlying TPM type (UINT8, UINT16, or UINT32).
- * TPM_ALG_ID (algorithm enum) <-> AlgorithmId
- * TPML prefixed types (lists with a 4-byte length field) <-> slice of whichever go type corresponds to the underlying TPM type.
- * TPMS prefixed types (structures) <-> struct
- * TPMT prefixed types (structures with a tag field used as a union selector) <-> struct
- * TPMU prefixed types (unions) <-> struct with a single field and which implements the Union interface. These must be referenced
- from a field in an enclosing struct, where the field has the `tpm2:"selector:<field_name>"` tag referencing a valid selector
- field name in the enclosing struct.
-
-TPMI prefixed types (interface types) are generally not explicitly supported. These are used by the TPM for type checking during
-unmarshalling. Some TPMI prefixed types that use TPM_ALG_ID as the underlying concrete type are implemented.
-
-Pointer types are automatically dereferenced.
-
-The marshalling code parses the "tpm2" tag on struct fields, the value of which is a comma separated list of options. These options are:
- * selector:<field_name> - used when the field is a struct that implements the Union interface. <field_name> references the name of
- another field in the struct, the value of which is used as the selector for the union type.
- * sized - used when the field is a struct, to indicate that it should be marshalled and unmarshalled as a sized struct. The field
- must be a pointer to a struct, and a nil pointer indicates a zero-sized struct.
- * raw - used when the field is a slice, to indicate that it should be marshalled and unmarshalled without a length (if it
- represents a list) or size (if it represents a sized buffer) field. The slice must be pre-allocated to the correct length by the
- caller during unmarshalling.
-
 Authorization types
 
 Some TPM resources require authorization in order to use them in some commands. There are 3 main types of authorization supported by
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mssim.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mssim.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mssim.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mssim.go	2021-02-02 08:21:12.000000000 +0000
@@ -11,6 +11,8 @@
 	"io"
 	"net"
 
+	"github.com/canonical/go-tpm2/mu"
+
 	"golang.org/x/xerrors"
 )
 
@@ -73,7 +75,7 @@
 }
 
 func (t *TctiMssim) Write(data []byte) (int, error) {
-	buf, err := MarshalToBytes(cmdTPMSendCommand, t.Locality, uint32(len(data)), RawBytes(data))
+	buf, err := mu.MarshalToBytes(cmdTPMSendCommand, t.Locality, uint32(len(data)), mu.RawBytes(data))
 	if err != nil {
 		panic(fmt.Sprintf("cannot marshal command: %v", err))
 	}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mu/doc.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mu/doc.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mu/doc.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mu/doc.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,42 @@
+/*
+Package mu provides helpers to marshalling to and unmarshalling from the TPM wire format.
+
+Go types are marshalled to and from the TPM wire format according to the following rules:
+ * UINT8 <-> uint8
+ * BYTE <-> byte
+ * INT8 <-> int8
+ * BOOL <-> bool
+ * UINT16 <-> uint16
+ * INT16 <-> int16
+ * UINT32 <-> uint32
+ * INT32 <-> int32
+ * UINT64 <-> uint64
+ * INT64 <-> int64
+ * TPM2B prefixed types (sized buffers with a 2-byte size field) fall in to 2 categories:
+    * Byte buffer <-> []byte, or any type with an identical underlying type.
+    * Sized structure <-> struct referenced via a pointer field in an enclosing struct, where the field has the `tpm2:"sized"` tag. A
+    zero sized struct is represented as a nil pointer.
+ * TPMA prefixed types (attributes) <-> whichever go type corresponds to the underlying TPM type (UINT8, UINT16, or UINT32).
+ * TPM_ALG_ID (algorithm enum) <-> tpm2.AlgorithmId
+ * TPML prefixed types (lists with a 4-byte length field) <-> slice of whichever go type corresponds to the underlying TPM type.
+ * TPMS prefixed types (structures) <-> struct
+ * TPMT prefixed types (structures with a tag field used as a union selector) <-> struct
+ * TPMU prefixed types (unions) <-> struct with a single field and which implements the Union interface. These must be referenced
+ from a field in an enclosing struct, where the field has the `tpm2:"selector:<field_name>"` tag referencing a valid selector
+ field name in the enclosing struct.
+
+TPMI prefixed types (interface types) are generally not explicitly supported. These are used by the TPM for type checking during
+unmarshalling. Some TPMI prefixed types that use TPM_ALG_ID as the underlying concrete type are implemented.
+
+Pointer types are automatically dereferenced. Nil pointers are dereference to their zero value during marshalling.
+
+The marshalling code parses the "tpm2" tag on struct fields, the value of which is a comma separated list of options. These options are:
+ * selector:<field_name> - used when the field is a struct that implements the Union interface. <field_name> references the name of
+ another field in the struct, the value of which is used as the selector for the union type.
+ * sized - used when the field is a struct, to indicate that it should be marshalled and unmarshalled as a sized struct. The field
+ must be a pointer to a struct, and a nil pointer indicates a zero-sized struct.
+ * raw - used when the field is a slice, to indicate that it should be marshalled and unmarshalled without a length (if it
+ represents a list) or size (if it represents a sized buffer) field. The slice must be pre-allocated to the correct length by the
+ caller during unmarshalling.
+*/
+package mu
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mu/mu.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mu/mu.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mu/mu.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mu/mu.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,865 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package mu
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"reflect"
+	"strings"
+
+	"golang.org/x/xerrors"
+)
+
+var (
+	customMarshallerType reflect.Type = reflect.TypeOf((*CustomMarshaller)(nil)).Elem()
+	unionType            reflect.Type = reflect.TypeOf((*Union)(nil)).Elem()
+	nilValueType         reflect.Type = reflect.TypeOf(NilUnionValue)
+	rawBytesType         reflect.Type = reflect.TypeOf(RawBytes(nil))
+)
+
+// InvalidSelectorError may be returned as a wrapped error from UnmarshalFromBytes or UnmarshalFromReader when a union type indicates
+// that a selector value is invalid.
+type InvalidSelectorError struct {
+	Selector reflect.Value
+}
+
+func (e *InvalidSelectorError) Error() string {
+	return fmt.Sprintf("invalid selector value: %v", e.Selector)
+}
+
+// CustomMarshaller is implemented by types that require custom marshalling and unmarshalling behaviour because they are non-standard
+// and not directly supported by the marshalling code.
+type CustomMarshaller interface {
+	Marshal(w io.Writer) error
+	Unmarshal(r Reader) error
+}
+
+type empty struct{}
+
+// NilUnionValue is a special value, the type of which should be returned from implementations of Union.Select to indicate
+// that a union contains no data for a particular selector value.
+var NilUnionValue empty
+
+// RawBytes is a special byte slice type which is marshalled and unmarshalled without a size field. The slice must be pre-allocated to
+// the correct length by the caller during unmarshalling.
+type RawBytes []byte
+
+// Union is implemented by types that implement the TPMU prefixed TPM types. Implementations of this should be structures with
+// a single member of the empty interface type.
+type Union interface {
+	// Select is called by the marshalling code with the value of the selector field from the enclosing struct. The implementation
+	// should respond with the type that will be marshalled or unmarshalled for the selector value. If no data should be marshalled
+	// or unmarshalled, it should respond with the type of NilUnionValue.
+	Select(selector reflect.Value) reflect.Type
+}
+
+type muError struct {
+	kind      string
+	val       reflect.Value
+	container reflect.Value
+	err       error
+}
+
+func (e *muError) Error() string {
+	var b bytes.Buffer
+	fmt.Fprintf(&b, "cannot process %s type %s", e.kind, e.val.Type())
+	if e.container.IsValid() {
+		fmt.Fprintf(&b, ", inside container type %s", e.container.Type())
+	}
+	fmt.Fprintf(&b, ": %v", e.err)
+	return b.String()
+}
+
+func (e *muError) Unwrap() error {
+	return e.err
+}
+
+func makeSizedTypeMuError(val reflect.Value, ctx *muContext, err error) error {
+	return &muError{kind: "sized", val: val, container: ctx.container, err: err}
+}
+
+func makeRawTypeMuError(val reflect.Value, ctx *muContext, err error) error {
+	return &muError{kind: "raw", val: val, container: ctx.container, err: err}
+}
+
+func makePrimitiveTypeMuError(val reflect.Value, ctx *muContext, err error) error {
+	return &muError{kind: "primitive", val: val, container: ctx.container, err: err}
+}
+
+func makeListTypeMuError(val reflect.Value, ctx *muContext, err error) error {
+	return &muError{kind: "list", val: val, container: ctx.container, err: err}
+}
+
+func makeStructTypeMuError(val reflect.Value, ctx *muContext, err error) error {
+	return &muError{kind: "struct", val: val, container: ctx.container, err: err}
+}
+
+func makeCustomTypeMuError(val reflect.Value, ctx *muContext, err error) error {
+	return &muError{kind: "custom", val: val, container: ctx.container, err: err}
+}
+
+type structFieldMuError struct {
+	val   reflect.Value
+	field reflect.StructField
+	err   error
+}
+
+func (e *structFieldMuError) Error() string {
+	return fmt.Sprintf("cannot process field %s from struct type %s: %v", e.field.Name, e.val.Type(), e.err)
+}
+
+func (e *structFieldMuError) Unwrap() error {
+	return e.err
+}
+
+func makeStructFieldMuError(s reflect.Value, index int, err error) error {
+	return &structFieldMuError{val: s, field: s.Type().Field(index), err: err}
+}
+
+type listElemMuError struct {
+	val   reflect.Value
+	index int
+	err   error
+}
+
+func (e *listElemMuError) Error() string {
+	return fmt.Sprintf("cannot process element at index %d from list type %s: %v", e.index, e.val.Type(), e.err)
+}
+
+func (e *listElemMuError) Unwrap() error {
+	return e.err
+}
+
+func makeListElemMuError(s reflect.Value, index int, err error) error {
+	return &listElemMuError{val: s, index: index, err: err}
+}
+
+// MarshalError indicates an error during marshalling and may be returned from MarshalToBytes or MarshalToWriter.
+type MarshalError struct {
+	Index int // The index of the argument that caused the error
+	err   error
+}
+
+func (e *MarshalError) Error() string {
+	return fmt.Sprintf("cannot marshal argument at index %d: %v", e.Index, e.err)
+}
+
+func (e *MarshalError) Unwrap() error {
+	return e.err
+}
+
+// UnmarshalError indicates an error during unmarshalling and may be returned from UnmarshalFromBytes or UnmarshalFromReader.
+type UnmarshalError struct {
+	Index int // The index of the argument that caused the error
+	err   error
+}
+
+func (e *UnmarshalError) Error() string {
+	return fmt.Sprintf("cannot unmarshal argument at index %d: %v", e.Index, e.err)
+}
+
+func (e *UnmarshalError) Unwrap() error {
+	return e.err
+}
+
+type muOptions struct {
+	selector string
+	sized    bool
+	raw      bool
+}
+
+func parseStructFieldMuOptions(f reflect.StructField) (out muOptions) {
+	s := f.Tag.Get("tpm2")
+	for _, part := range strings.Split(s, ",") {
+		switch {
+		case strings.HasPrefix(part, "selector:"):
+			out.selector = part[9:]
+		case part == "sized":
+			out.sized = true
+		case part == "raw":
+			out.raw = true
+		}
+	}
+	return
+}
+
+type muContext struct {
+	container reflect.Value
+	options   muOptions
+}
+
+func (c *muContext) enterStructField(s reflect.Value, i int) (f reflect.Value, exit func()) {
+	opts := parseStructFieldMuOptions(s.Type().Field(i))
+	origContainer := c.container
+	origOptions := c.options
+	c.container = s
+	c.options = opts
+
+	return s.Field(i), func() {
+		c.container = origContainer
+		c.options = origOptions
+	}
+}
+
+func (c *muContext) enterListElem(l reflect.Value, i int) (elem reflect.Value, exit func()) {
+	origContainer := c.container
+	origOptions := c.options
+	c.container = l
+	c.options = muOptions{}
+
+	return l.Index(i), func() {
+		c.container = origContainer
+		c.options = origOptions
+	}
+}
+
+func (c *muContext) enterUnionElem(u reflect.Value, unmarshal bool) (elem reflect.Value, exit func(), err error) {
+	if !c.container.IsValid() {
+		panic(fmt.Sprintf("union type %s is not inside a container", u.Type()))
+	}
+	if c.options.selector == "" {
+		panic(fmt.Sprintf("no selector member for union type %s defined in container type %s", u.Type(), c.container.Type()))
+	}
+
+	selectorVal := c.container.FieldByName(c.options.selector)
+	if !selectorVal.IsValid() {
+		panic(fmt.Sprintf("selector name %s for union type %s does not reference a valid field inside container type %s",
+			c.options.selector, u.Type(), c.container.Type()))
+	}
+
+	selectedType := u.Interface().(Union).Select(selectorVal)
+	switch {
+	case selectedType == nil && unmarshal:
+		return reflect.Value{}, nil, &InvalidSelectorError{selectorVal}
+	case selectedType == nil || selectedType == nilValueType:
+		return reflect.Value{}, nil, nil
+	}
+
+	var d reflect.Value
+	f := u.Field(0)
+	switch {
+	case f.IsNil():
+		d = reflect.New(selectedType).Elem()
+	default:
+		d = f.Elem()
+	}
+
+	if d.Type() != selectedType {
+		if !d.Type().ConvertibleTo(selectedType) {
+			return reflect.Value{}, nil, xerrors.Errorf("data has incorrect type %s (expected %s)", d.Type(), selectedType)
+		}
+		d = d.Convert(selectedType)
+	}
+
+	origOptions := c.options
+	c.options.selector = ""
+
+	return d, func() {
+		c.options = origOptions
+
+		if f.IsNil() && unmarshal {
+			f.Set(d)
+		}
+	}, nil
+
+}
+
+func (c *muContext) enterSizedType(v reflect.Value) (exit func()) {
+	switch {
+	case v.Kind() == reflect.Ptr:
+	case v.Kind() == reflect.Slice && v.Type().Elem().Kind() == reflect.Uint8:
+	default:
+		panic(fmt.Sprintf("invalid sized type: %v", v.Type()))
+	}
+
+	origOptions := c.options
+	c.options.sized = false
+	if v.Kind() == reflect.Slice {
+		c.options.raw = true
+	}
+
+	return func() {
+		c.options = origOptions
+	}
+}
+
+// TPMKind indicates the TPM type class associated with a Go type
+type TPMKind int
+
+const (
+	TPMKindUnsupported TPMKind = iota
+	TPMKindPrimitive
+	TPMKindSized
+	TPMKindList
+	TPMKindStruct
+	TPMKindUnion
+	TPMKindCustom
+	TPMKindRawBytes
+	TPMKindRawList
+)
+
+func tpmKind(t reflect.Type) TPMKind {
+	if t.Kind() == reflect.Ptr {
+		t = t.Elem()
+	}
+
+	if reflect.PtrTo(t).Implements(customMarshallerType) {
+		return TPMKindCustom
+	}
+
+	switch t.Kind() {
+	case reflect.Bool, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return TPMKindPrimitive
+	case reflect.Slice:
+		switch {
+		case t == rawBytesType:
+			return TPMKindRawBytes
+		case t.Elem().Kind() == reflect.Uint8:
+			return TPMKindSized
+		}
+		return TPMKindList
+	case reflect.Struct:
+		if t.Implements(unionType) && t.NumField() == 1 && t.Field(0).Type.Kind() == reflect.Interface && t.Field(0).Type.NumMethod() == 0 {
+			return TPMKindUnion
+		}
+		return TPMKindStruct
+	default:
+		return TPMKindUnsupported
+	}
+}
+
+// DetermineTPMKind returns the TPMKind associated with the supplied go value. It will automatically dereference pointer types.
+// Single field structures will be unwrapped and the TPMKind associated with the structure field will be returned.
+func DetermineTPMKind(i interface{}) TPMKind {
+	t := reflect.TypeOf(i)
+	var k TPMKind
+	raw := false
+	for {
+		if t.Kind() == reflect.Ptr {
+			t = t.Elem()
+		}
+		k = tpmKind(t)
+		if k != TPMKindStruct {
+			break
+		}
+		if t.NumField() != 1 {
+			break
+		}
+		f := t.Field(0)
+		opts := parseStructFieldMuOptions(f)
+		switch {
+		case opts.sized:
+			return TPMKindSized
+		case opts.raw:
+			raw = true
+		}
+		t = f.Type
+	}
+	switch {
+	case raw && k == TPMKindSized:
+		return TPMKindRawBytes
+	case raw && k == TPMKindList:
+		return TPMKindRawList
+	default:
+		return k
+	}
+}
+
+type muWriter struct {
+	w      io.Writer
+	nbytes int
+}
+
+func (w *muWriter) Write(p []byte) (n int, err error) {
+	n, err = w.w.Write(p)
+	w.nbytes += n
+	return
+}
+
+func marshalSized(w io.Writer, val reflect.Value, ctx *muContext) error {
+	exit := ctx.enterSizedType(val)
+	defer exit()
+
+	if val.IsNil() {
+		if err := binary.Write(w, binary.BigEndian, uint16(0)); err != nil {
+			return xerrors.Errorf("cannot write size of zero sized value: %w", err)
+		}
+		return nil
+	}
+
+	tmpBuf := new(bytes.Buffer)
+	if err := marshalValue(tmpBuf, val, ctx); err != nil {
+		return err
+	}
+	if tmpBuf.Len() > math.MaxUint16 {
+		return errors.New("sized value size greater than 2^16-1")
+	}
+	if err := binary.Write(w, binary.BigEndian, uint16(tmpBuf.Len())); err != nil {
+		return xerrors.Errorf("cannot write size of sized value: %w", err)
+	}
+	if _, err := tmpBuf.WriteTo(w); err != nil {
+		return xerrors.Errorf("cannot write marshalled sized value: %w", err)
+	}
+	return nil
+}
+
+func marshalRawList(w io.Writer, slice reflect.Value, ctx *muContext) error {
+	for i := 0; i < slice.Len(); i++ {
+		elem, exit := ctx.enterListElem(slice, i)
+		if err := marshalValue(w, elem, ctx); err != nil {
+			exit()
+			return makeListElemMuError(slice, i, err)
+		}
+		exit()
+	}
+	return nil
+}
+
+func marshalRaw(w io.Writer, slice reflect.Value, ctx *muContext) error {
+	switch slice.Type().Elem().Kind() {
+	case reflect.Uint8:
+		_, err := w.Write(slice.Bytes())
+		return err
+	default:
+		return marshalRawList(w, slice, ctx)
+	}
+}
+
+func marshalPtr(w io.Writer, ptr reflect.Value, ctx *muContext) error {
+	p := ptr
+	if ptr.IsNil() {
+		p = reflect.New(ptr.Type().Elem())
+	}
+	return marshalValue(w, p.Elem(), ctx)
+}
+
+func marshalPrimitive(w io.Writer, val reflect.Value, ctx *muContext) error {
+	return binary.Write(w, binary.BigEndian, val.Interface())
+}
+
+func marshalList(w io.Writer, slice reflect.Value, ctx *muContext) error {
+	// int is either 32-bits or 64-bits. We can't compare slice.Len() to math.MaxUint32 when int is 32-bits and it isn't
+	// necessary anyway. For the case where int is 64-bits, truncate to uint32 then zero extend it again to int to make
+	// sure the original number was preserved.
+	if int(uint32(slice.Len())) != slice.Len() {
+		return errors.New("slice length greater than 2^32-1")
+	}
+
+	// Marshal length field
+	if err := binary.Write(w, binary.BigEndian, uint32(slice.Len())); err != nil {
+		return xerrors.Errorf("cannot write length of list: %w", err)
+	}
+
+	return marshalRawList(w, slice, ctx)
+}
+
+func marshalStruct(w io.Writer, s reflect.Value, ctx *muContext) error {
+	for i := 0; i < s.NumField(); i++ {
+		f, exit := ctx.enterStructField(s, i)
+		if err := marshalValue(w, f, ctx); err != nil {
+			exit()
+			return makeStructFieldMuError(s, i, err)
+		}
+		exit()
+	}
+
+	return nil
+}
+
+func marshalUnion(w io.Writer, u reflect.Value, ctx *muContext) error {
+	elem, exit, err := ctx.enterUnionElem(u, false)
+	if err != nil {
+		return err
+	}
+	if !elem.IsValid() {
+		return nil
+	}
+	defer exit()
+	return marshalValue(w, elem, ctx)
+}
+
+func marshalCustom(w io.Writer, val reflect.Value, ctx *muContext) error {
+	if val.Kind() != reflect.Ptr {
+		val = val.Addr()
+	}
+	return val.Interface().(CustomMarshaller).Marshal(w)
+}
+
+func marshalValue(w io.Writer, val reflect.Value, ctx *muContext) error {
+	switch {
+	case ctx.options.sized:
+		if err := marshalSized(w, val, ctx); err != nil {
+			return makeSizedTypeMuError(val, ctx, err)
+		}
+		return nil
+	case ctx.options.raw:
+		if err := marshalRaw(w, val, ctx); err != nil {
+			return makeRawTypeMuError(val, ctx, err)
+		}
+		return nil
+	}
+
+	if val.Kind() == reflect.Ptr {
+		return marshalPtr(w, val, ctx)
+	}
+
+	switch tpmKind(val.Type()) {
+	case TPMKindPrimitive:
+		if err := marshalPrimitive(w, val, ctx); err != nil {
+			return makePrimitiveTypeMuError(val, ctx, err)
+		}
+	case TPMKindSized:
+		if err := marshalSized(w, val, ctx); err != nil {
+			return makeSizedTypeMuError(val, ctx, err)
+		}
+	case TPMKindList:
+		if err := marshalList(w, val, ctx); err != nil {
+			return makeListTypeMuError(val, ctx, err)
+		}
+	case TPMKindStruct:
+		if err := marshalStruct(w, val, ctx); err != nil {
+			return makeStructTypeMuError(val, ctx, err)
+		}
+	case TPMKindUnion:
+		if err := marshalUnion(w, val, ctx); err != nil {
+			return err
+		}
+	case TPMKindCustom:
+		if err := marshalCustom(w, val, ctx); err != nil {
+			return makeCustomTypeMuError(val, ctx, err)
+		}
+	case TPMKindRawBytes:
+		if err := marshalRaw(w, val, ctx); err != nil {
+			return makeRawTypeMuError(val, ctx, err)
+		}
+	default:
+		panic(fmt.Sprintf("cannot marshal unsupported type %s", val.Type()))
+	}
+
+	return nil
+}
+
+// Reader is an interface that groups the io.Reader interface with an additional method to
+// obtain the remaining number of bytes that can be read for implementations that support this.
+type Reader interface {
+	io.Reader
+	Len() int
+}
+
+type muReader struct {
+	r      io.Reader
+	sz     int64
+	nbytes int
+}
+
+func startingSizeOfReader(r io.Reader) (int64, error) {
+	switch rImpl := r.(type) {
+	case *os.File:
+		fi, err := rImpl.Stat()
+		if err != nil {
+			return 0, err
+		}
+		if fi.Mode().IsRegular() {
+			start, err := rImpl.Seek(0, io.SeekCurrent)
+			if err != nil {
+				return 0, err
+			}
+			return fi.Size() - start, nil
+		}
+	case *bytes.Reader:
+		return int64(rImpl.Len()), nil
+	case *bytes.Buffer:
+		return int64(rImpl.Len()), nil
+	case *io.SectionReader:
+		start, _ := rImpl.Seek(0, io.SeekCurrent)
+		return rImpl.Size() - start, nil
+	case *io.LimitedReader:
+		sz, err := startingSizeOfReader(rImpl.R)
+		if err != nil {
+			return 0, err
+		}
+		if rImpl.N < sz {
+			sz = rImpl.N
+		}
+		return sz, nil
+	case *muReader:
+		return int64(rImpl.Len()), nil
+	}
+	return 1<<63 - 1, nil
+}
+
+func makeMuReader(r io.Reader) (*muReader, error) {
+	sz, err := startingSizeOfReader(r)
+	if err != nil {
+		return nil, err
+	}
+	return &muReader{r: r, sz: sz}, nil
+}
+
+func (r *muReader) Read(p []byte) (n int, err error) {
+	n, err = r.r.Read(p)
+	r.nbytes += n
+	return
+}
+
+func (r *muReader) Len() int {
+	return int(r.sz - int64(r.nbytes))
+}
+
+func unmarshalSized(r *muReader, val reflect.Value, ctx *muContext) error {
+	exit := ctx.enterSizedType(val)
+	defer exit()
+
+	var size uint16
+	if err := binary.Read(r, binary.BigEndian, &size); err != nil {
+		return xerrors.Errorf("cannot read size of sized value: %w", err)
+	}
+
+	switch {
+	case size == 0 && !val.IsNil() && val.Kind() == reflect.Ptr:
+		return errors.New("sized value is zero sized, but destination value has been pre-allocated")
+	case size == 0:
+		return nil
+	case int(size) > r.Len():
+		return errors.New("sized value has a size larger than the remaining bytes")
+	case val.Kind() == reflect.Slice:
+		val.Set(reflect.MakeSlice(val.Type(), int(size), int(size)))
+	}
+
+	lr, err := makeMuReader(io.LimitReader(r, int64(size)))
+	if err != nil {
+		return xerrors.Errorf("cannot create new reader for sized payload: %w", err)
+	}
+	return unmarshalValue(lr, val, ctx)
+}
+
+func unmarshalListCommon(r *muReader, slice reflect.Value, n int, ctx *muContext) (reflect.Value, error) {
+	for i := 0; i < n; i++ {
+		slice = reflect.Append(slice, reflect.Zero(slice.Type().Elem()))
+		elem, exit := ctx.enterListElem(slice, i)
+		if err := unmarshalValue(r, elem, ctx); err != nil {
+			exit()
+			return reflect.Value{}, makeListElemMuError(slice, i, err)
+		}
+		exit()
+	}
+	return slice, nil
+}
+
+func unmarshalRawList(r *muReader, slice reflect.Value, ctx *muContext) error {
+	if slice.IsNil() {
+		return errors.New("nil raw slice")
+	}
+	_, err := unmarshalListCommon(r, slice.Slice(0, 0), slice.Len(), ctx)
+	return err
+}
+
+func unmarshalRaw(r *muReader, slice reflect.Value, ctx *muContext) error {
+	switch slice.Type().Elem().Kind() {
+	case reflect.Uint8:
+		_, err := io.ReadFull(r, slice.Bytes())
+		return err
+	default:
+		return unmarshalRawList(r, slice, ctx)
+	}
+}
+
+func unmarshalPtr(r *muReader, ptr reflect.Value, ctx *muContext) error {
+	if ptr.IsNil() {
+		ptr.Set(reflect.New(ptr.Type().Elem()))
+	}
+	return unmarshalValue(r, ptr.Elem(), ctx)
+}
+
+func unmarshalPrimitive(r *muReader, val reflect.Value, ctx *muContext) error {
+	return binary.Read(r, binary.BigEndian, val.Addr().Interface())
+}
+
+func unmarshalList(r *muReader, slice reflect.Value, ctx *muContext) error {
+	// Unmarshal the length
+	var length uint32
+	if err := binary.Read(r, binary.BigEndian, &length); err != nil {
+		return xerrors.Errorf("cannot read length of list: %w", err)
+	}
+
+	s, err := unmarshalListCommon(r, reflect.MakeSlice(slice.Type(), 0, 0), int(length), ctx)
+	if err != nil {
+		return err
+	}
+	slice.Set(s)
+	return nil
+}
+
+func unmarshalStruct(r *muReader, s reflect.Value, ctx *muContext) error {
+	for i := 0; i < s.NumField(); i++ {
+		elem, exit := ctx.enterStructField(s, i)
+		if err := unmarshalValue(r, elem, ctx); err != nil {
+			exit()
+			return makeStructFieldMuError(s, i, err)
+		}
+		exit()
+	}
+	return nil
+}
+
+func unmarshalUnion(r *muReader, u reflect.Value, ctx *muContext) error {
+	elem, exit, err := ctx.enterUnionElem(u, true)
+	if err != nil {
+		return err
+	}
+	if !elem.IsValid() {
+		return nil
+	}
+	defer exit()
+	return unmarshalValue(r, elem, ctx)
+}
+
+func unmarshalCustom(r *muReader, val reflect.Value, ctx *muContext) error {
+	if val.Kind() != reflect.Ptr {
+		val = val.Addr()
+	}
+	return val.Interface().(CustomMarshaller).Unmarshal(r)
+}
+
+func unmarshalValue(r *muReader, val reflect.Value, ctx *muContext) error {
+	switch {
+	case ctx.options.sized:
+		if err := unmarshalSized(r, val, ctx); err != nil {
+			return makeSizedTypeMuError(val, ctx, err)
+		}
+		return nil
+	case ctx.options.raw:
+		if err := unmarshalRaw(r, val, ctx); err != nil {
+			return makeRawTypeMuError(val, ctx, err)
+		}
+		return nil
+	}
+
+	if val.Kind() == reflect.Ptr {
+		return unmarshalPtr(r, val, ctx)
+	}
+
+	switch tpmKind(val.Type()) {
+	case TPMKindPrimitive:
+		if err := unmarshalPrimitive(r, val, ctx); err != nil {
+			return makePrimitiveTypeMuError(val, ctx, err)
+		}
+	case TPMKindSized:
+		if err := unmarshalSized(r, val, ctx); err != nil {
+			return makeSizedTypeMuError(val, ctx, err)
+		}
+	case TPMKindList:
+		if err := unmarshalList(r, val, ctx); err != nil {
+			return makeListTypeMuError(val, ctx, err)
+		}
+	case TPMKindStruct:
+		if err := unmarshalStruct(r, val, ctx); err != nil {
+			return makeStructTypeMuError(val, ctx, err)
+		}
+	case TPMKindUnion:
+		if err := unmarshalUnion(r, val, ctx); err != nil {
+			return err
+		}
+	case TPMKindCustom:
+		if err := unmarshalCustom(r, val, ctx); err != nil {
+			return makeCustomTypeMuError(val, ctx, err)
+		}
+	case TPMKindRawBytes:
+		if err := unmarshalRaw(r, val, ctx); err != nil {
+			return makeRawTypeMuError(val, ctx, err)
+		}
+	default:
+		panic(fmt.Sprintf("cannot marshal unsupported type %s", val.Type()))
+	}
+
+	return nil
+}
+
+// MarshalToWriter marshals vals to w in the TPM wire format, according to the rules specified in the package description. A nil
+// pointer encountered during marshalling causes the zero value for the type to be marshalled, unless the pointer is to a sized
+// structure.
+//
+// The number of bytes written to w are returned. If this function does not complete successfully, it will return an error and
+// the number of bytes written.
+func MarshalToWriter(w io.Writer, vals ...interface{}) (int, error) {
+	var totalBytes int
+	for i, val := range vals {
+		ctx := new(muContext)
+		mw := &muWriter{w: w}
+		err := marshalValue(mw, reflect.ValueOf(val), ctx)
+		totalBytes += mw.nbytes
+		if err != nil {
+			return totalBytes, &MarshalError{Index: i, err: err}
+		}
+	}
+	return totalBytes, nil
+}
+
+// MarshalToBytes marshals vals to the TPM wire format, according to the rules specified in the package description. A nil pointer
+// encountered during marshalling causes the zero value for the type to be marshalled, unless the pointer is to a sized structure.
+//
+// If successful, this function returns the marshalled data. If this function does not complete successfully, it will return an error.
+// In this case, no data will be returned.
+func MarshalToBytes(vals ...interface{}) ([]byte, error) {
+	buf := new(bytes.Buffer)
+	if _, err := MarshalToWriter(buf, vals...); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+// UnmarshalFromReader unmarshals data in the TPM wire format from r to vals, according to the rules specified in the package
+// description. The values supplied to this function must be pointers to the destination values. Nil pointers encountered during
+// unmarshalling will be initialized to point to newly allocated memory, unless the pointer represents a zero-sized structure. New
+// slices will always be created - even if the caller pre-allocates them, unless it is a RawBytes type or a struct field with the
+// `tpm2:"raw"` tag. In this case, the slice must be preallocated to the expected size.
+//
+// The number of bytes read from r are returned. If this function does not complete successfully, it will return an error and
+// the number of bytes read. In this case, partial results may have been unmarshalled to the supplied destination values.
+func UnmarshalFromReader(r io.Reader, vals ...interface{}) (int, error) {
+	var totalBytes int
+	for i, val := range vals {
+		v := reflect.ValueOf(val)
+		if v.Kind() != reflect.Ptr {
+			panic(fmt.Sprintf("cannot unmarshal to non-pointer type %s", v.Type()))
+		}
+
+		if v.IsNil() {
+			panic(fmt.Sprintf("cannot unmarshal to nil pointer of type %s", v.Type()))
+		}
+
+		ctx := new(muContext)
+		mr, err := makeMuReader(r)
+		if err != nil {
+			return totalBytes, err
+		}
+		err = unmarshalValue(mr, v.Elem(), ctx)
+		totalBytes += mr.nbytes
+		if err != nil {
+			return totalBytes, &UnmarshalError{Index: i, err: err}
+		}
+	}
+	return totalBytes, nil
+}
+
+// UnmarshalFromBytes unmarshals data in the TPM wire format from b to vals, according to the rules specified in the package
+// description. The values supplied to this function must be pointers to the destination values. Nil pointers encountered during
+// unmarshalling will be initialized to point to newly allocated memory, unless the pointer represents a zero-sized structure. New
+// slices will always be created - even if the caller pre-allocates them, unless it is a RawBytes type or a struct field with the
+// `tpm2:"raw"` tag. In this case, the slice must be preallocated to the expected size.
+//
+// If successful, this function returns the number of bytes consumed from b. If this function does not complete successfully, it will
+// return an error and the number of bytes consumed. In this case, partial results may have been unmarshalled to the supplied
+// destination values.
+func UnmarshalFromBytes(b []byte, vals ...interface{}) (int, error) {
+	buf := bytes.NewReader(b)
+	return UnmarshalFromReader(buf, vals...)
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mu.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mu.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/mu.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/mu.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,646 +0,0 @@
-// Copyright 2019 Canonical Ltd.
-// Licensed under the LGPLv3 with static-linking exception.
-// See LICENCE file for details.
-
-package tpm2
-
-import (
-	"bytes"
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"io"
-	"math"
-	"reflect"
-	"strings"
-
-	"golang.org/x/xerrors"
-)
-
-var (
-	customMarshallerType reflect.Type = reflect.TypeOf((*CustomMarshaller)(nil)).Elem()
-	rawBytesType         reflect.Type = reflect.TypeOf(RawBytes(nil))
-	unionType            reflect.Type = reflect.TypeOf((*Union)(nil)).Elem()
-)
-
-type InvalidSelectorError struct {
-	Selector reflect.Value
-}
-
-func (e InvalidSelectorError) Error() string {
-	return fmt.Sprintf("invalid selector value: %v", e.Selector)
-}
-
-// CustomMarshaller is implemented by types that require custom marshalling and unmarshalling behaviour because they are non-standard
-// and not directly supported by the marshalling code.
-type CustomMarshaller interface {
-	Marshal(buf io.Writer) (int, error)
-	Unmarshal(buf io.Reader) (int, error)
-}
-
-// RawBytes is a special byte slice type which is marshalled and unmarshalled without a size field. The slice must be pre-allocated to
-// the correct length by the caller during unmarshalling.
-type RawBytes []byte
-
-// Union is implemented by types that implement the TPMU prefixed TPM types.
-//
-// The Select method is called by the marshalling code with the value of the selector field from the enclosing struct, and the
-// implementation should respond with the type that will be marshalled or unmarshalled for the selector value.
-type Union interface {
-	Select(selector reflect.Value) (reflect.Type, error)
-}
-
-func isValidUnionContainer(t reflect.Type) bool {
-	if t.Kind() != reflect.Struct {
-		return false
-	}
-	return true
-}
-
-func isUnion(t reflect.Type) bool {
-	if t.Kind() != reflect.Struct {
-		return false
-	}
-	if !t.Implements(unionType) {
-		return false
-	}
-	if t.NumField() != 1 {
-		return false
-	}
-	if t.Field(0).Type.Kind() != reflect.Interface {
-		return false
-	}
-	return t.Field(0).Type.NumMethod() == 0
-}
-
-func isByteSlice(t reflect.Type) bool {
-	if t.Kind() != reflect.Slice {
-		return false
-	}
-	return t.Elem().Kind() == reflect.Uint8
-}
-
-func hasCustomMarshallerImpl(t reflect.Type) bool {
-	if t.Kind() != reflect.Ptr {
-		t = reflect.PtrTo(t)
-	}
-	return t.Implements(customMarshallerType)
-
-}
-
-type muOptions struct {
-	selector string
-	sized    bool
-	raw      bool
-}
-
-func parseFieldOptions(s string) muOptions {
-	var opts muOptions
-	for _, part := range strings.Split(s, ",") {
-		switch {
-		case strings.HasPrefix(part, "selector:"):
-			opts.selector = part[9:]
-		case part == "sized":
-			opts.sized = true
-		case part == "raw":
-			opts.raw = true
-		}
-	}
-	return opts
-}
-
-type muContext struct {
-	nbytes    int
-	container reflect.Value
-	options   muOptions
-}
-
-func (c *muContext) enterStructField(s reflect.Value, i int) (exit func()) {
-	opts := parseFieldOptions(s.Type().Field(i).Tag.Get("tpm2"))
-	origContainer := c.container
-	origOptions := c.options
-	c.container = s
-	c.options = opts
-	return func() {
-		c.container = origContainer
-		c.options = origOptions
-	}
-}
-
-func (c *muContext) enterContainerElem(e reflect.Value) (exit func()) {
-	origContainer := c.container
-	origOptions := c.options
-	c.container = e
-	c.options = muOptions{}
-	return func() {
-		c.container = origContainer
-		c.options = origOptions
-	}
-}
-
-func (c *muContext) enterSizedStruct() (exit func()) {
-	c.options.sized = false
-	return func() {
-		c.options.sized = true
-	}
-}
-
-func marshalSized(buf io.Writer, s reflect.Value, ctx *muContext) error {
-	switch {
-	case s.Kind() != reflect.Ptr:
-		panic(fmt.Sprintf("sized field of type %s contained within type %s is not a pointer", s.Type(), ctx.container.Type()))
-	case s.Type().Elem().Kind() != reflect.Struct:
-		panic(fmt.Sprintf("sized field of type %s contained within type %s is not a pointer to a struct", s.Type(), ctx.container.Type()))
-	case s.IsNil():
-		if err := binary.Write(buf, binary.BigEndian, uint16(0)); err != nil {
-			return xerrors.Errorf("cannot write size of zero sized struct: %w", err)
-		}
-		ctx.nbytes += binary.Size(uint16(0))
-		return nil
-	}
-
-	exit := ctx.enterSizedStruct()
-	defer exit()
-
-	tmpBuf := new(bytes.Buffer)
-	if err := marshalPtr(tmpBuf, s, ctx); err != nil {
-		return xerrors.Errorf("cannot marshal pointer to struct to temporary buffer: %w", err)
-	}
-	if tmpBuf.Len() > math.MaxUint16 {
-		return errors.New("sized structure length greater than 2^16-1")
-	}
-	if err := binary.Write(buf, binary.BigEndian, uint16(tmpBuf.Len())); err != nil {
-		return xerrors.Errorf("cannot write size of struct: %w", err)
-	}
-	ctx.nbytes += binary.Size(uint16(0))
-	n, err := tmpBuf.WriteTo(buf)
-	ctx.nbytes += int(n)
-	if err != nil {
-		return xerrors.Errorf("cannot write marshalled struct: %w", err)
-	}
-	return nil
-}
-
-func marshalPtr(buf io.Writer, ptr reflect.Value, ctx *muContext) error {
-	var d reflect.Value
-	if ptr.IsNil() {
-		d = reflect.Zero(ptr.Type().Elem())
-	} else {
-		d = ptr.Elem()
-	}
-
-	if err := marshalValue(buf, d, ctx); err != nil {
-		return xerrors.Errorf("cannot marshal element: %w", err)
-	}
-	return nil
-}
-
-func marshalUnion(buf io.Writer, u reflect.Value, ctx *muContext) error {
-	if !ctx.container.IsValid() {
-		panic(fmt.Sprintf("union type %s is not inside a container", u.Type()))
-	}
-
-	if !isValidUnionContainer(ctx.container.Type()) {
-		panic(fmt.Sprintf("union type %s is inside a container of type %s which isn't a valid container type", u.Type(),
-			ctx.container.Type()))
-	}
-
-	if ctx.options.selector == "" {
-		panic(fmt.Sprintf("no selector member for union type %s defined in container type %s", u.Type(), ctx.container.Type()))
-	}
-
-	selectorVal := ctx.container.FieldByName(ctx.options.selector)
-	if !selectorVal.IsValid() {
-		panic(fmt.Sprintf("selector name %s for union type %s does not reference a valid field inside container type %s",
-			ctx.options.selector, u.Type(), ctx.container.Type()))
-	}
-
-	// Ignore errors during marshalling as we can produce some confusing errors for really nested elements.
-	// In the event of an error, selectedType will be nil, we'll marshal nothing and the TPM's unmarshalling
-	// and parameter validation will catch the error when unmarshalling the selector value.
-	selectedType, _ := u.Interface().(Union).Select(selectorVal)
-	if selectedType == nil {
-		return nil
-	}
-
-	var d reflect.Value
-	f := u.Field(0)
-	if f.IsNil() {
-		d = reflect.Zero(selectedType)
-	} else {
-		d = f.Elem()
-	}
-
-	if d.Type() != selectedType {
-		if !d.Type().ConvertibleTo(selectedType) {
-			return xerrors.Errorf("data has incorrect type %s (expected %s)", d.Type(), selectedType)
-		}
-		d = d.Convert(selectedType)
-	}
-
-	exit := ctx.enterContainerElem(u)
-	defer exit()
-	return marshalValue(buf, d, ctx)
-}
-
-func marshalStruct(buf io.Writer, s reflect.Value, ctx *muContext) error {
-	if isUnion(s.Type()) {
-		if err := marshalUnion(buf, s, ctx); err != nil {
-			return xerrors.Errorf("error marshalling union struct: %w", err)
-		}
-		return nil
-	}
-
-	for i := 0; i < s.NumField(); i++ {
-		exit := ctx.enterStructField(s, i)
-		if err := marshalValue(buf, s.Field(i), ctx); err != nil {
-			exit()
-			return xerrors.Errorf("cannot marshal field %s: %w", s.Type().Field(i).Name, err)
-		}
-		exit()
-	}
-
-	return nil
-}
-
-func marshalSlice(buf io.Writer, slice reflect.Value, ctx *muContext) error {
-	if isByteSlice(slice.Type()) {
-		// Shortcut for byte slices
-		if slice.Type() != rawBytesType && !ctx.options.raw {
-			// Sized buffer
-			if slice.Len() > math.MaxUint16 {
-				return errors.New("sized buffer length greater than 2^16-1")
-			}
-
-			if err := binary.Write(buf, binary.BigEndian, uint16(slice.Len())); err != nil {
-				return xerrors.Errorf("cannot write size of sized buffer: %w", err)
-			}
-			ctx.nbytes += binary.Size(uint16(0))
-		}
-		n, err := buf.Write(slice.Bytes())
-		ctx.nbytes += n
-		if err != nil {
-			return xerrors.Errorf("cannot write byte slice contents: %w", err)
-		}
-		return nil
-	}
-
-	// int is either 32-bits or 64-bits. We can't compare slice.Len() to math.MaxUint32 when int is 32-bits and it isn't
-	// necessary anyway. For the case where int is 64-bits, truncate to uint32 then zero extend it again to int to make
-	// sure the original number was preserved.
-	if int(uint32(slice.Len())) != slice.Len() {
-		return errors.New("slice length greater than 2^32-1")
-	}
-
-	if !ctx.options.raw {
-		// Marshal length field
-		if err := binary.Write(buf, binary.BigEndian, uint32(slice.Len())); err != nil {
-			return xerrors.Errorf("cannot write length of list: %w", err)
-		}
-		ctx.nbytes += binary.Size(uint32(0))
-	}
-
-	for i := 0; i < slice.Len(); i++ {
-		exit := ctx.enterContainerElem(slice)
-		if err := marshalValue(buf, slice.Index(i), ctx); err != nil {
-			exit()
-			return xerrors.Errorf("cannot marshal value at index %d: %w", i, err)
-		}
-		exit()
-	}
-	return nil
-}
-
-func marshalValue(buf io.Writer, val reflect.Value, ctx *muContext) error {
-	if hasCustomMarshallerImpl(val.Type()) {
-		origVal := val
-		switch {
-		case val.Kind() != reflect.Ptr:
-			val = val.Addr()
-		case val.IsNil():
-			return xerrors.Errorf("cannot marshal nil pointer type %s with custom marshaller", val.Type())
-		}
-		n, err := val.Interface().(CustomMarshaller).Marshal(buf)
-		ctx.nbytes += n
-		if err != nil {
-			return xerrors.Errorf("cannot marshal type %s with custom marshaller: %w", origVal.Type(), err)
-		}
-		return nil
-	}
-
-	if ctx.options.sized {
-		if err := marshalSized(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot marshal sized type %s: %w", val.Type(), err)
-		}
-		return nil
-	}
-
-	switch val.Kind() {
-	case reflect.Ptr:
-		if err := marshalPtr(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot marshal pointer type %s: %w", val.Type(), err)
-		}
-	case reflect.Struct:
-		if err := marshalStruct(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot marshal struct type %s: %w", val.Type(), err)
-		}
-	case reflect.Slice:
-		if err := marshalSlice(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot marshal slice type %s: %w", val.Type(), err)
-		}
-	case reflect.Array, reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.UnsafePointer:
-		panic(fmt.Sprintf("cannot marshal type %s: unsupported kind %s", val.Type(), val.Kind()))
-	default:
-		if err := binary.Write(buf, binary.BigEndian, val.Interface()); err != nil {
-			return xerrors.Errorf("cannot marshal type %s: write to buffer failed: %w", val.Type(), err)
-		}
-		ctx.nbytes += binary.Size(val.Interface())
-	}
-	return nil
-}
-
-func unmarshalSized(buf io.Reader, s reflect.Value, ctx *muContext) error {
-	switch {
-	case s.Kind() != reflect.Ptr:
-		panic(fmt.Sprintf("sized field of type %s contained within type %s is not a pointer", s.Type(), ctx.container.Type()))
-	case s.Type().Elem().Kind() != reflect.Struct:
-		panic(fmt.Sprintf("sized field of type %s contained within type %s is not a pointer to a struct", s.Type(), ctx.container.Type()))
-	}
-
-	var size uint16
-	if err := binary.Read(buf, binary.BigEndian, &size); err != nil {
-		return xerrors.Errorf("cannot read size of struct: %w", err)
-	}
-	ctx.nbytes += binary.Size(uint16(0))
-	switch {
-	case size == 0 && !s.IsNil():
-		return errors.New("struct is zero sized, but destination struct has been pre-allocated")
-	case size == 0:
-		return nil
-	}
-
-	exit := ctx.enterSizedStruct()
-	defer exit()
-
-	lr := io.LimitReader(buf, int64(size))
-	if err := unmarshalPtr(lr, s, ctx); err != nil {
-		return xerrors.Errorf("cannot unmarshal pointer to struct: %w", err)
-	}
-	return nil
-}
-
-func unmarshalPtr(buf io.Reader, ptr reflect.Value, ctx *muContext) error {
-	if ptr.IsNil() {
-		ptr.Set(reflect.New(ptr.Type().Elem()))
-	}
-
-	if err := unmarshalValue(buf, ptr.Elem(), ctx); err != nil {
-		return xerrors.Errorf("cannot unmarshal element: %w", err)
-	}
-	return nil
-}
-
-func unmarshalUnion(buf io.Reader, u reflect.Value, ctx *muContext) error {
-	if !ctx.container.IsValid() {
-		panic(fmt.Sprintf("union type %s is not inside a container", u.Type()))
-	}
-
-	if !isValidUnionContainer(ctx.container.Type()) {
-		panic(fmt.Sprintf("union type %s is inside a container of type %s which isn't a valid container type", u.Type(),
-			ctx.container.Type()))
-	}
-
-	if ctx.options.selector == "" {
-		panic(fmt.Sprintf("no selector member for union type %s defined in container type %s", u.Type(), ctx.container.Type()))
-	}
-
-	selectorVal := ctx.container.FieldByName(ctx.options.selector)
-	if !selectorVal.IsValid() {
-		panic(fmt.Sprintf("selector name %s for union type %s does not reference a valid field inside container type %s",
-			ctx.options.selector, u.Type(), ctx.container.Type()))
-	}
-
-	selectedType, err := u.Interface().(Union).Select(selectorVal)
-	if err != nil {
-		return xerrors.Errorf("cannot select union data type: %w", err)
-	}
-	if selectedType == nil {
-		return nil
-	}
-
-	var d reflect.Value
-	f := u.Field(0)
-	if f.IsNil() {
-		d = reflect.New(selectedType).Elem()
-	} else {
-		d = f.Elem()
-	}
-
-	exit := ctx.enterContainerElem(u)
-	defer exit()
-
-	if err := unmarshalValue(buf, d, ctx); err != nil {
-		return xerrors.Errorf("cannot unmarshal data value: %w", err)
-	}
-
-	if f.IsNil() {
-		f.Set(d)
-	}
-
-	return nil
-}
-
-func unmarshalStruct(buf io.Reader, s reflect.Value, ctx *muContext) error {
-	if isUnion(s.Type()) {
-		if err := unmarshalUnion(buf, s, ctx); err != nil {
-			return xerrors.Errorf("error unmarshalling union struct: %w", err)
-		}
-		return nil
-	}
-
-	for i := 0; i < s.NumField(); i++ {
-		exit := ctx.enterStructField(s, i)
-		if err := unmarshalValue(buf, s.Field(i), ctx); err != nil {
-			exit()
-			return xerrors.Errorf("cannot unmarshal field %s: %w", s.Type().Field(i).Name, err)
-		}
-		exit()
-	}
-	return nil
-}
-
-func unmarshalSlice(buf io.Reader, slice reflect.Value, ctx *muContext) error {
-	if isByteSlice(slice.Type()) {
-		// Shortcut for byte slice
-		switch {
-		case (slice.Type() == rawBytesType || ctx.options.raw) && slice.IsNil():
-			return errors.New("nil raw byte slice")
-		case slice.Type() == rawBytesType || ctx.options.raw:
-			// No size
-		default:
-			// Sized buffer
-			var size uint16
-			if err := binary.Read(buf, binary.BigEndian, &size); err != nil {
-				return xerrors.Errorf("cannot read size of sized buffer: %w", err)
-			}
-			ctx.nbytes += binary.Size(uint16(0))
-			slice.Set(reflect.MakeSlice(slice.Type(), int(size), int(size)))
-		}
-		n, err := io.ReadFull(buf, slice.Bytes())
-		ctx.nbytes += n
-		if err != nil {
-			return xerrors.Errorf("cannot read byte slice directly from input buffer: %w", err)
-		}
-		return nil
-	}
-
-	// Unmarshal the length
-	switch {
-	case ctx.options.raw && slice.IsNil():
-		return errors.New("nil raw slice")
-	case ctx.options.raw:
-		// No length
-	default:
-		var length uint32
-		if err := binary.Read(buf, binary.BigEndian, &length); err != nil {
-			return xerrors.Errorf("cannot read length of list: %w", err)
-		}
-		ctx.nbytes += binary.Size(uint32(0))
-		slice.Set(reflect.MakeSlice(slice.Type(), int(length), int(length)))
-	}
-
-	for i := 0; i < slice.Len(); i++ {
-		exit := ctx.enterContainerElem(slice)
-		if err := unmarshalValue(buf, slice.Index(i), ctx); err != nil {
-			exit()
-			return xerrors.Errorf("cannot unmarshal value at index %d: %w", i, err)
-		}
-		exit()
-	}
-	return nil
-}
-
-func unmarshalValue(buf io.Reader, val reflect.Value, ctx *muContext) error {
-	if hasCustomMarshallerImpl(val.Type()) {
-		origVal := val
-		switch {
-		case val.Kind() != reflect.Ptr:
-			val = val.Addr()
-		default:
-			if val.IsNil() {
-				val.Set(reflect.New(val.Type().Elem()))
-			}
-		}
-		n, err := val.Interface().(CustomMarshaller).Unmarshal(buf)
-		ctx.nbytes += n
-		if err != nil {
-			return xerrors.Errorf("cannot unmarshal type %s with custom marshaller: %w", origVal.Type(), err)
-		}
-		return nil
-	}
-
-	if ctx.options.sized {
-		if err := unmarshalSized(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot unmarshal sized type %s: %w", val.Type(), err)
-		}
-		return nil
-	}
-
-	switch val.Kind() {
-	case reflect.Ptr:
-		if err := unmarshalPtr(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot unmarshal pointer type %s: %w", val.Type(), err)
-		}
-	case reflect.Struct:
-		if err := unmarshalStruct(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot unmarshal struct type %s: %w", val.Type(), err)
-		}
-	case reflect.Slice:
-		if err := unmarshalSlice(buf, val, ctx); err != nil {
-			return xerrors.Errorf("cannot unmarshal slice type %s: %w", val.Type(), err)
-		}
-	case reflect.Array, reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.UnsafePointer:
-		panic(fmt.Sprintf("cannot unmarshal type %s: unsupported kind %s", val.Type(), val.Kind()))
-	default:
-		if err := binary.Read(buf, binary.BigEndian, val.Addr().Interface()); err != nil {
-			return xerrors.Errorf("cannot unmarshal type %s: read from buffer failed: %w", val.Type(), err)
-		}
-		ctx.nbytes += binary.Size(val.Interface())
-	}
-	return nil
-}
-
-// MarshalToWriter marshals vals to buf in the TPM wire format, according to the rules specified in "Parameter marshalling and
-// unmarshalling". A nil pointer encountered during marshalling causes the zero value for the type to be marshalled, unless the
-// pointer is to a sized structure.
-//
-// The number of bytes written to buf are returned. If this function does not complete successfully, it will return an error and
-// the number of bytes written.
-func MarshalToWriter(buf io.Writer, vals ...interface{}) (int, error) {
-	var totalBytes int
-	for _, val := range vals {
-		ctx := new(muContext)
-		if err := marshalValue(buf, reflect.ValueOf(val), ctx); err != nil {
-			return totalBytes + ctx.nbytes, err
-		}
-		totalBytes += ctx.nbytes
-	}
-	return totalBytes, nil
-}
-
-// MarshalToBytes marshals vals to the TPM wire format, according to the rules specified in "Parameter marshalling and unmarshalling".
-// A nil pointer encountered during marshalling causes the zero value for the type to be marshalled, unless the pointer is to a sized
-// structure.
-//
-// If successful, this function returns the marshalled data. If this function does not complete successfully, it will return an error.
-// In this case, no data will be returned.
-func MarshalToBytes(vals ...interface{}) ([]byte, error) {
-	buf := new(bytes.Buffer)
-	if _, err := MarshalToWriter(buf, vals...); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
-}
-
-// UnmarshalFromReader unmarshals data in the TPM wire format from buf to vals, according to the rules specified in "Parameter
-// marshalling and unmarshalling". The values supplied to this function must be pointers to the destination values. Nil pointer
-// fields encountered during unmarshalling will result in memory being allocated for those values, unless the pointer represents a
-// zero-sized sized struct. New slices will always be created - even if the caller pre-allocates them, unless it is a RawBytes type
-// or a field with the `tpm2:"raw"` tag.
-//
-// The number of bytes read from buf are returned. If this function does not complete successfully, it will return an error and
-// the number of bytes read. In this case, partial results may have been unmarshalled to the supplied destination values.
-func UnmarshalFromReader(buf io.Reader, vals ...interface{}) (int, error) {
-	var totalBytes int
-	for _, val := range vals {
-		v := reflect.ValueOf(val)
-		if v.Kind() != reflect.Ptr {
-			panic(fmt.Sprintf("cannot unmarshal to non-pointer type %s", v.Type()))
-		}
-
-		if v.IsNil() {
-			panic(fmt.Sprintf("cannot unmarshal to nil pointer of type %s", v.Type()))
-		}
-
-		ctx := new(muContext)
-		if err := unmarshalValue(buf, v.Elem(), ctx); err != nil {
-			return totalBytes + ctx.nbytes, err
-		}
-		totalBytes += ctx.nbytes
-	}
-	return totalBytes, nil
-}
-
-// UnmarshalFromBytes unmarshals data in the TPM wire format from b to vals, according to the rules specified in "Parameter
-// marshalling and unmarshalling". The values supplied to this function must be pointers to the destination values. Nil pointer
-// fields encountered during unmarshalling will result in memory being allocated for those values, unless the pointer represents a
-// zero-sized sized struct. New slices will always be created - even if the caller pre-allocates them, unless it is a RawBytes type
-// or a field with the `tpm2:"raw"` tag.
-//
-// If successful, this function returns the number of bytes consumed from b. If this function does not complete successfully, it will
-// return an error and the number of bytes consumed. In this case, partial results may have been unmarshalled to the supplied
-// destination values.
-func UnmarshalFromBytes(b []byte, vals ...interface{}) (int, error) {
-	buf := bytes.NewReader(b)
-	return UnmarshalFromReader(buf, vals...)
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/paramcrypt.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/paramcrypt.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/paramcrypt.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/paramcrypt.go	2021-02-02 08:21:12.000000000 +0000
@@ -8,9 +8,9 @@
 	"crypto/aes"
 	"encoding/binary"
 	"fmt"
-	"reflect"
 
 	"github.com/canonical/go-tpm2/internal"
+	"github.com/canonical/go-tpm2/mu"
 )
 
 func findSessionWithAttr(attr SessionAttributes, sessions []*sessionParam) (*sessionParam, int) {
@@ -39,40 +39,8 @@
 	return s != nil
 }
 
-func isSizedStructParam(v reflect.Value) bool {
-	if v.Kind() != reflect.Struct {
-		return false
-	}
-	if v.Type().NumField() != 1 {
-		return false
-	}
-	f := v.Type().Field(0)
-	if !parseFieldOptions(f.Tag.Get("tpm2")).sized {
-		return false
-	}
-	if f.Type.Kind() == reflect.Struct {
-		return true
-	}
-	if f.Type.Kind() == reflect.Ptr && f.Type.Elem().Kind() == reflect.Struct {
-		return true
-	}
-	if f.Type.Kind() == reflect.Interface && v.Field(0).Elem().Kind() == reflect.Ptr &&
-		v.Field(0).Elem().Elem().Kind() == reflect.Struct {
-		return true
-	}
-	return false
-}
-
-func isSizedBuffer(t reflect.Type) bool {
-	return isByteSlice(t) && t != rawBytesType
-}
-
 func isParamEncryptable(param interface{}) bool {
-	v := reflect.ValueOf(param)
-	if v.Kind() == reflect.Ptr {
-		v = v.Elem()
-	}
-	return isSizedStructParam(v) || isSizedBuffer(v.Type())
+	return mu.DetermineTPMKind(param) == mu.TPMKindSized
 }
 
 func (s *sessionParam) computeSessionValue() []byte {
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/README.md snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/README.md
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/README.md	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/README.md	2021-02-02 08:21:12.000000000 +0000
@@ -22,14 +22,14 @@
  Asymmetric Primitives | None |
  Symmetric Primitives | None |
  Random Number Generator | Full |
- Hash/HMAC/Event Sequences | None |
+ Hash/HMAC/Event Sequences | Full |
  Attestation Commands | Full |
  Ephemeral EC Keys | None |
  Signing and Signature Verification | Full |
  Command Audit | Full |
  Integrity Collection (PCR) | Partial | TPM2_PCR_Extend, TPM2_PCR_Event, TPM2_PCR_Read and TPM2_PCR_Reset are supported
  Enhanced Authorization (EA) Commands | Partial | All commands are supported except for TPM2_PolicyLocality, TPM2_PolicyPhysicalPresence, TPM2_PolicyTemplate and TPM2_PolicyAuthorizeNV
- Hierarchy Commands | Partial | TPM2_CreatePrimary, TPM2_Clear, TPM2_ClearControl and TPM2_HierarchyChangeAuth are supported
+ Hierarchy Commands | Partial | TPM2_CreatePrimary, TPM2_HierarchyControl, TPM2_Clear, TPM2_ClearControl and TPM2_HierarchyChangeAuth are supported
  Dictionary Attack Functions | Full |
  Miscellaneous Management Functions | None |
  Field Upgrade | None |
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/resources.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/resources.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/resources.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/resources.go	2021-02-02 08:21:12.000000000 +0000
@@ -14,6 +14,8 @@
 	"io"
 	"reflect"
 
+	"github.com/canonical/go-tpm2/mu"
+
 	"golang.org/x/xerrors"
 )
 
@@ -130,18 +132,19 @@
 	Data interface{}
 }
 
-func (d handleContextDataU) Select(selector reflect.Value) (reflect.Type, error) {
+func (d handleContextDataU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(handleContextType) {
 	case handleContextTypeDummy, handleContextTypePermanent:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
 	case handleContextTypeObject:
-		return reflect.TypeOf((*Public)(nil)), nil
+		return reflect.TypeOf((*Public)(nil))
 	case handleContextTypeNvIndex:
-		return reflect.TypeOf((*NVPublic)(nil)), nil
+		return reflect.TypeOf((*NVPublic)(nil))
 	case handleContextTypeSession:
-		return reflect.TypeOf((*sessionContextData)(nil)), nil
+		return reflect.TypeOf((*sessionContextData)(nil))
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 type handleContextData struct {
@@ -152,13 +155,13 @@
 }
 
 func (d *handleContextData) serializeToBytes() []byte {
-	data, err := MarshalToBytes(d)
+	data, err := mu.MarshalToBytes(d)
 	if err != nil {
 		panic(fmt.Sprintf("cannot marshal context data: %v", err))
 	}
 	h := crypto.SHA256.New()
 	h.Write(data)
-	data, err = MarshalToBytes(HashAlgorithmSHA256, h.Sum(nil), data)
+	data, err = mu.MarshalToBytes(HashAlgorithmSHA256, h.Sum(nil), data)
 	if err != nil {
 		panic(fmt.Sprintf("cannot pack context blob and checksum: %v", err))
 	}
@@ -166,13 +169,13 @@
 }
 
 func (d *handleContextData) serializeToWriter(w io.Writer) error {
-	data, err := MarshalToBytes(d)
+	data, err := mu.MarshalToBytes(d)
 	if err != nil {
 		panic(fmt.Sprintf("cannot marshal context data: %v", err))
 	}
 	h := crypto.SHA256.New()
 	h.Write(data)
-	_, err = MarshalToWriter(w, HashAlgorithmSHA256, h.Sum(nil), data)
+	_, err = mu.MarshalToWriter(w, HashAlgorithmSHA256, h.Sum(nil), data)
 	return err
 }
 
@@ -710,7 +713,7 @@
 	var integrityAlg HashAlgorithmId
 	var integrity []byte
 	var b []byte
-	if _, err := UnmarshalFromReader(r, &integrityAlg, &integrity, &b); err != nil {
+	if _, err := mu.UnmarshalFromReader(r, &integrityAlg, &integrity, &b); err != nil {
 		return nil, xerrors.Errorf("cannot unpack context blob and checksum: %w", err)
 	}
 
@@ -724,7 +727,7 @@
 	}
 
 	var data *handleContextData
-	n, err := UnmarshalFromBytes(b, &data)
+	n, err := mu.UnmarshalFromBytes(b, &data)
 	if err != nil {
 		return nil, xerrors.Errorf("cannot unmarshal context data: %w", err)
 	}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/run-tests snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/run-tests
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/run-tests	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/run-tests	2021-02-02 08:21:12.000000000 +0000
@@ -37,4 +37,5 @@
 fi
 
 go test -v -race ./internal $@
+go test -v -race ./mu $@
 go test -v -race . -args $MSSIM_ARGS $@
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/strings.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/strings.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/strings.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/strings.go	2021-02-02 08:21:12.000000000 +0000
@@ -91,6 +91,8 @@
 		return "TPM_CC_NV_UndefineSpaceSpecial"
 	case CommandEvictControl:
 		return "TPM_CC_EvictControl"
+	case CommandHierarchyControl:
+		return "TPM_CC_HierarchyControl"
 	case CommandNVUndefineSpace:
 		return "TPM_CC_NV_UndefineSpace"
 	case CommandClear:
@@ -127,6 +129,8 @@
 		return "TPM_CC_PCR_Event"
 	case CommandPCRReset:
 		return "TPM_CC_PCR_Reset"
+	case CommandSequenceComplete:
+		return "TPM_CC_SequenceComplete"
 	case CommandSetCommandCodeAuditStatus:
 		return "TPM_CC_SetCommandCodeAuditStatus"
 	case CommandIncrementalSelfTest:
@@ -169,6 +173,10 @@
 		return "TPM_CC_Load"
 	case CommandQuote:
 		return "TPM_CC_Quote"
+	case CommandHMACStart:
+		return "TPM_CC_HMAC_Start"
+	case CommandSequenceUpdate:
+		return "TPM_CC_SequenceUpdate"
 	case CommandSign:
 		return "TPM_CC_Sign"
 	case CommandUnseal:
@@ -225,6 +233,10 @@
 		return "TPM_CC_ReadClock"
 	case CommandPCRExtend:
 		return "TPM_CC_PCR_Extend"
+	case CommandEventSequenceComplete:
+		return "TPM_CC_EventSequenceComplete"
+	case CommandHashSequenceStart:
+		return "TPM_CC_HashSequenceStart"
 	case CommandPolicyDuplicationSelect:
 		return "TPM_CC_PolicyDuplicationSelect"
 	case CommandPolicyGetDigest:
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/tpm.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/tpm.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/tpm.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/tpm.go	2021-02-02 08:21:12.000000000 +0000
@@ -12,11 +12,13 @@
 	"io"
 	"reflect"
 
+	"github.com/canonical/go-tpm2/mu"
+
 	"golang.org/x/xerrors"
 )
 
-func makeInvalidParamError(name, msg string) error {
-	return fmt.Errorf("invalid %s parameter: %s", name, msg)
+func makeInvalidArgError(name, msg string) error {
+	return fmt.Errorf("invalid %s argument: %s", name, msg)
 }
 
 func wrapMarshallingError(commandCode CommandCode, context string, err error) error {
@@ -24,7 +26,7 @@
 }
 
 func handleUnmarshallingError(context *cmdContext, scope string, err error) error {
-	var s InvalidSelectorError
+	var s *mu.InvalidSelectorError
 	if xerrors.Is(err, io.EOF) || xerrors.Is(err, io.ErrUnexpectedEOF) || xerrors.As(err, &s) {
 		return &InvalidResponseError{context.commandCode, fmt.Sprintf("cannot unmarshal %s: %v", scope, err)}
 	}
@@ -102,11 +104,13 @@
 // authorization for a corresponding TPM resource. These sessions may be used for the purposes of session based parameter encryption
 // or command auditing.
 type TPMContext struct {
-	tcti               io.ReadWriteCloser
-	permanentResources map[Handle]*permanentContext
-	maxSubmissions     uint
-	maxNVBufferSize    uint16
-	exclusiveSession   *sessionContext
+	tcti                  io.ReadWriteCloser
+	permanentResources    map[Handle]*permanentContext
+	maxSubmissions        uint
+	propertiesInitialized bool
+	maxNVBufferSize       int
+	maxBufferSize         int
+	exclusiveSession      *sessionContext
 }
 
 // Close calls Close on the transmission interface.
@@ -130,9 +134,9 @@
 	cHeader := commandHeader{tag, 0, commandCode}
 	cHeader.CommandSize = uint32(binary.Size(cHeader) + len(commandBytes))
 
-	bytes, err := MarshalToBytes(cHeader, RawBytes(commandBytes))
+	bytes, err := mu.MarshalToBytes(cHeader, mu.RawBytes(commandBytes))
 	if err != nil {
-		return 0, 0, nil, wrapMarshallingError(commandCode, "complete command packet", err)
+		panic(fmt.Sprintf("cannot marshal complete command packet bytes: %v", err))
 	}
 
 	if _, err := t.tcti.Write(bytes); err != nil {
@@ -150,7 +154,7 @@
 		return 0, 0, nil, &TctiError{"read", err}
 	}
 
-	if _, err := UnmarshalFromBytes(rHeaderBytes, &rHeader); err != nil {
+	if _, err := mu.UnmarshalFromBytes(rHeaderBytes, &rHeader); err != nil {
 		panic(fmt.Sprintf("cannot unmarshal response header: %v", err))
 	}
 
@@ -178,7 +182,7 @@
 		switch r := resource.(type) {
 		case HandleContext:
 			if err := t.checkHandleContextParam(r); err != nil {
-				return nil, fmt.Errorf("cannot process HandleContext for command %s at index %d: %v", commandCode, i, err)
+				return nil, wrapMarshallingError(commandCode, "command handles", fmt.Errorf("cannot process HandleContext at index %d: %v", i, err))
 			}
 			handles = append(handles, r.Handle())
 			handleNames = append(handleNames, r.Name())
@@ -186,8 +190,8 @@
 			handles = append(handles, HandleNull)
 			handleNames = append(handleNames, makeDummyContext(HandleNull).Name())
 		default:
-			return nil, fmt.Errorf("cannot process command handle parameter for command %s at index %d: invalid type (%s)",
-				commandCode, i, reflect.TypeOf(resource))
+			return nil, wrapMarshallingError(commandCode, "command handles",
+				fmt.Errorf("cannot process command handle parameter at index %d: invalid type (%s)", i, reflect.TypeOf(resource)))
 		}
 	}
 
@@ -197,29 +201,29 @@
 
 	cBytes := new(bytes.Buffer)
 
-	if _, err := MarshalToWriter(cBytes, handles...); err != nil {
-		return nil, wrapMarshallingError(commandCode, "command handles", err)
+	if _, err := mu.MarshalToWriter(cBytes, handles...); err != nil {
+		panic(fmt.Sprintf("cannot marshal command handles: %v", err))
 	}
 
-	cpBytes, err := MarshalToBytes(params...)
-	if err != nil {
+	cpBytes := new(bytes.Buffer)
+	if _, err := mu.MarshalToWriter(cpBytes, params...); err != nil {
 		return nil, wrapMarshallingError(commandCode, "command parameters", err)
 	}
 
 	tag := TagNoSessions
 	if len(sessionParams) > 0 {
 		tag = TagSessions
-		authArea, err := buildCommandAuthArea(t, sessionParams, commandCode, handleNames, cpBytes)
+		authArea, err := buildCommandAuthArea(t, sessionParams, commandCode, handleNames, cpBytes.Bytes())
 		if err != nil {
 			return nil, fmt.Errorf("cannot build command auth area for command %s: %v", commandCode, err)
 		}
-		if _, err := MarshalToWriter(cBytes, &authArea); err != nil {
-			return nil, wrapMarshallingError(commandCode, "command auth area", err)
+		if _, err := mu.MarshalToWriter(cBytes, &authArea); err != nil {
+			panic(fmt.Sprintf("cannot marshal command auth area: %v", err))
 		}
 	}
 
-	if _, err := MarshalToWriter(cBytes, RawBytes(cpBytes)); err != nil {
-		return nil, wrapMarshallingError(commandCode, "raw command parameter bytes", err)
+	if _, err := cpBytes.WriteTo(cBytes); err != nil {
+		panic(fmt.Sprintf("cannot write command parameter bytes to command buffer: %v", err))
 	}
 
 	var responseCode ResponseCode
@@ -266,31 +270,27 @@
 	buf := bytes.NewReader(context.responseBytes)
 
 	if len(handles) > 0 {
-		if _, err := UnmarshalFromReader(buf, handles...); err != nil {
+		if _, err := mu.UnmarshalFromReader(buf, handles...); err != nil {
 			return handleUnmarshallingError(context, "response handles", err)
 		}
 	}
 
-	rpBuf := buf
-	var rpBytes []byte
+	var rpBuf *bytes.Reader
 
-	if context.responseTag == TagSessions {
+	switch context.responseTag {
+	case TagSessions:
 		var parameterSize uint32
-		if _, err := UnmarshalFromReader(buf, &parameterSize); err != nil {
+		if _, err := mu.UnmarshalFromReader(buf, &parameterSize); err != nil {
 			return handleUnmarshallingError(context, "parameterSize field", err)
 		}
-		rpBytes = make([]byte, parameterSize)
-		if n, err := io.ReadFull(buf, rpBytes); err != nil {
-			if err == io.ErrUnexpectedEOF {
-				return &InvalidResponseError{context.commandCode, fmt.Sprintf("insufficient bytes for response parameters (got %d, expected %d)",
-					n, parameterSize)}
-			}
+		rpBytes := make([]byte, parameterSize)
+		if _, err := io.ReadFull(buf, rpBytes); err != nil {
 			return handleUnmarshallingError(context, "response parameters",
 				fmt.Errorf("error reading parameters to temporary buffer: %v", err))
 		}
 
 		authArea := responseAuthAreaRawSlice{make([]authResponse, len(context.sessionParams))}
-		if _, err := UnmarshalFromReader(buf, &authArea); err != nil {
+		if _, err := mu.UnmarshalFromReader(buf, &authArea); err != nil {
 			return handleUnmarshallingError(context, "response auth area", err)
 		}
 		if err := processResponseAuthArea(t, authArea.Data, context.sessionParams, context.commandCode, context.responseCode,
@@ -299,6 +299,10 @@
 		}
 
 		rpBuf = bytes.NewReader(rpBytes)
+	case TagNoSessions:
+		rpBuf = buf
+	default:
+		return &InvalidResponseError{context.commandCode, fmt.Sprintf("unexpected response tag: %v", context.responseTag)}
 	}
 
 	if isSessionAllowed(context.commandCode) {
@@ -322,7 +326,7 @@
 	}
 
 	if len(params) > 0 {
-		if _, err := UnmarshalFromReader(rpBuf, params...); err != nil {
+		if _, err := mu.UnmarshalFromReader(rpBuf, params...); err != nil {
 			return handleUnmarshallingError(context, "response parameters", err)
 		}
 	}
@@ -420,6 +424,41 @@
 	t.maxSubmissions = max
 }
 
+// InitProperties executes a TPM2_GetCapability command to initialize properties used internally by TPMContext. This is normally done
+// automatically by functions that require these properties when they are used for the first time, but this function is provided so
+// that the command can be audited, and so the exclusivity of an audit session can be preserved.
+func (t *TPMContext) InitProperties(sessions ...SessionContext) error {
+	props, err := t.GetCapabilityTPMProperties(PropertyFixed, CapabilityMaxProperties, sessions...)
+	if err != nil {
+		return err
+	}
+
+	for _, prop := range props {
+		switch prop.Property {
+		case PropertyNVBufferMax:
+			t.maxNVBufferSize = int(prop.Value)
+		case PropertyInputBuffer:
+			t.maxBufferSize = int(prop.Value)
+		}
+	}
+
+	if t.maxNVBufferSize == 0 {
+		return &InvalidResponseError{Command: CommandGetCapability, msg: "missing or invalid TPM_PT_NV_BUFFER_MAX property"}
+	}
+	if t.maxBufferSize == 0 {
+		t.maxBufferSize = 1024
+	}
+	t.propertiesInitialized = true
+	return nil
+}
+
+func (t *TPMContext) initPropertiesIfNeeded() error {
+	if t.propertiesInitialized {
+		return nil
+	}
+	return t.InitProperties()
+}
+
 func newTpmContext(tcti io.ReadWriteCloser) *TPMContext {
 	r := new(TPMContext)
 	r.tcti = tcti
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/types.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/types.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/types.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/types.go	2021-02-02 08:21:12.000000000 +0000
@@ -7,6 +7,7 @@
 import (
 	"bytes"
 	"crypto"
+	"crypto/elliptic"
 	_ "crypto/sha1"
 	_ "crypto/sha256"
 	_ "crypto/sha512"
@@ -19,6 +20,8 @@
 	"sort"
 	"unsafe"
 
+	"github.com/canonical/go-tpm2/mu"
+
 	"golang.org/x/xerrors"
 )
 
@@ -35,6 +38,22 @@
 // ECCCurve corresponds to the TPM_ECC_CURVE type.
 type ECCCurve uint16
 
+// GoCurve returns the equivalent elliptic.Curve for this ECC curve.
+func (c ECCCurve) GoCurve() elliptic.Curve {
+	switch c {
+	case ECCCurveNIST_P224:
+		return elliptic.P224()
+	case ECCCurveNIST_P256:
+		return elliptic.P256()
+	case ECCCurveNIST_P384:
+		return elliptic.P384()
+	case ECCCurveNIST_P521:
+		return elliptic.P521()
+	default:
+		return nil
+	}
+}
+
 // CommandCode corresponds to the TPM_CC type.
 type CommandCode uint32
 
@@ -180,51 +199,47 @@
 // array of raw bytes. As no length is encoded, we need a custom marshaller implementation that unmarshals the
 // correct number of bytes depending on the hash algorithm
 
-func (p *TaggedHash) Marshal(buf io.Writer) (nbytes int, err error) {
-	if err := binary.Write(buf, binary.BigEndian, p.HashAlg); err != nil {
-		return nbytes, xerrors.Errorf("cannot marshal digest algorithm: %w", err)
+func (p *TaggedHash) Marshal(w io.Writer) error {
+	if err := binary.Write(w, binary.BigEndian, p.HashAlg); err != nil {
+		return xerrors.Errorf("cannot marshal digest algorithm: %w", err)
 	}
-	nbytes += binary.Size(p.HashAlg)
 	if !p.HashAlg.Supported() {
-		return nbytes, fmt.Errorf("cannot determine digest size for unknown algorithm %v", p.HashAlg)
+		return fmt.Errorf("cannot determine digest size for unknown algorithm %v", p.HashAlg)
 	}
 
 	if p.HashAlg.Size() != len(p.Digest) {
-		return nbytes, fmt.Errorf("invalid digest size %d", len(p.Digest))
+		return fmt.Errorf("invalid digest size %d", len(p.Digest))
 	}
 
-	n, err := buf.Write(p.Digest)
-	nbytes += n
-	if err != nil {
-		return nbytes, xerrors.Errorf("cannot write digest: %w", err)
+	if _, err := w.Write(p.Digest); err != nil {
+		return xerrors.Errorf("cannot write digest: %w", err)
 	}
-	return
+	return nil
 }
 
-func (p *TaggedHash) Unmarshal(buf io.Reader) (nbytes int, err error) {
-	if err := binary.Read(buf, binary.BigEndian, &p.HashAlg); err != nil {
-		return nbytes, xerrors.Errorf("cannot unmarshal digest algorithm: %w", err)
+func (p *TaggedHash) Unmarshal(r mu.Reader) error {
+	if err := binary.Read(r, binary.BigEndian, &p.HashAlg); err != nil {
+		return xerrors.Errorf("cannot unmarshal digest algorithm: %w", err)
 	}
-	nbytes += binary.Size(p.HashAlg)
 	if !p.HashAlg.Supported() {
-		return nbytes, fmt.Errorf("cannot determine digest size for unknown algorithm %v", p.HashAlg)
+		return fmt.Errorf("cannot determine digest size for unknown algorithm %v", p.HashAlg)
 	}
 
 	p.Digest = make(Digest, p.HashAlg.Size())
-	n, err := io.ReadFull(buf, p.Digest)
-	nbytes += n
-	if err != nil {
-		return nbytes, xerrors.Errorf("cannot read digest: %w", err)
+	if _, err := io.ReadFull(r, p.Digest); err != nil {
+		return xerrors.Errorf("cannot read digest: %w", err)
 	}
-	return
+	return nil
 }
 
 // 10.4 Sized Buffers
 
-// Digest corresponds to the TPM2B_DIGEST type.
+// Digest corresponds to the TPM2B_DIGEST type. The largest size of this supported by the TPM can be determined by calling
+// TPMContext.GetMaxDigest.
 type Digest []byte
 
-// Data corresponds to the TPM2B_DATA type.
+// Data corresponds to the TPM2B_DATA type. The largest size of this supported by the TPM can be determined by calling
+// TPMContext.GetMaxData.
 type Data []byte
 
 // Nonce corresponds to the TPM2B_NONCE type.
@@ -236,13 +251,15 @@
 // Operand corresponds to the TPM2B_OPERAND type.
 type Operand Digest
 
-// Event corresponds to the TPM2B_EVENT type.
+// Event corresponds to the TPM2B_EVENT type. The largest size of this is indicated by EventMaxSize.
 type Event []byte
 
-// MaxBuffer corresponds to the TPM2B_MAX_BUFFER type.
+// MaxBuffer corresponds to the TPM2B_MAX_BUFFER type. The largest size of this supported by the TPM can be determined by
+// calling TPMContext.GetInputBuffer.
 type MaxBuffer []byte
 
-// MaxNVBuffer corresponds to the TPM2B_MAX_NV_BUFFER type.
+// MaxNVBuffer corresponds to the TPM2B_MAX_NV_BUFFER type. The largest size of this supported by the TPM can be determined by
+// calling TPMContext.GetNVBufferMax.
 type MaxNVBuffer []byte
 
 // Timeout corresponds to the TPM2B_TIMEOUT type.
@@ -296,7 +313,7 @@
 // contained within this slice.
 type PCRSelect []int
 
-func (d *PCRSelect) Marshal(buf io.Writer) (nbytes int, err error) {
+func (d *PCRSelect) Marshal(w io.Writer) error {
 	bytes := make([]byte, 3)
 
 	for _, i := range *d {
@@ -308,32 +325,29 @@
 		bytes[octet] |= 1 << bit
 	}
 
-	if err := binary.Write(buf, binary.BigEndian, uint8(len(bytes))); err != nil {
-		return nbytes, xerrors.Errorf("cannot write size of PCR selection bit mask: %w", err)
+	if err := binary.Write(w, binary.BigEndian, uint8(len(bytes))); err != nil {
+		return xerrors.Errorf("cannot write size of PCR selection bit mask: %w", err)
 	}
-	nbytes += binary.Size(uint8(0))
 
-	n, err := buf.Write(bytes)
-	nbytes += int(n)
-	if err != nil {
-		return nbytes, xerrors.Errorf("cannot write PCR selection bit mask: %w", err)
+	if _, err := w.Write(bytes); err != nil {
+		return xerrors.Errorf("cannot write PCR selection bit mask: %w", err)
 	}
-	return
+	return nil
 }
 
-func (d *PCRSelect) Unmarshal(buf io.Reader) (nbytes int, err error) {
+func (d *PCRSelect) Unmarshal(r mu.Reader) error {
 	var size uint8
-	if err := binary.Read(buf, binary.BigEndian, &size); err != nil {
-		return nbytes, xerrors.Errorf("cannot read size of PCR selection bit mask: %w", err)
+	if err := binary.Read(r, binary.BigEndian, &size); err != nil {
+		return xerrors.Errorf("cannot read size of PCR selection bit mask: %w", err)
+	}
+	if int(size) > r.Len() {
+		return errors.New("size field is larger than the remaining bytes")
 	}
-	nbytes += binary.Size(uint8(0))
 
 	bytes := make([]byte, size)
 
-	n, err := io.ReadFull(buf, bytes)
-	nbytes += n
-	if err != nil {
-		return nbytes, xerrors.Errorf("cannot read PCR selection bit mask: %w", err)
+	if _, err := io.ReadFull(r, bytes); err != nil {
+		return xerrors.Errorf("cannot read PCR selection bit mask: %w", err)
 	}
 
 	*d = make(PCRSelect, 0)
@@ -347,7 +361,7 @@
 		}
 	}
 
-	return
+	return nil
 }
 
 // PCRSelection corresponds to the TPMS_PCR_SELECTION type.
@@ -438,6 +452,9 @@
 // PCRSelectionList is a slice of PCRSelection values, and corresponds to the TPML_PCR_SELECTION type.
 type PCRSelectionList []PCRSelection
 
+// Equal indicates whether l and r contain the same PCR selections. Equal selections will marshal to the same bytes in the TPM
+// wire format. To be considered equal, each set of selections must be identical length, contain the same PCR banks in the same
+// order, and each PCR bank must contain the same set of PCRs - the order of the PCRs in each bank are not important.
 func (l PCRSelectionList) Equal(r PCRSelectionList) bool {
 	if len(l) != len(r) {
 		return false
@@ -468,33 +485,132 @@
 	return true
 }
 
-func (l PCRSelectionList) subtract(r PCRSelectionList) (PCRSelectionList, error) {
-	if len(l) != len(r) {
-		return nil, errors.New("incorrect number of PCRSelections")
+// Sort will sort the list of PCR selections in order of ascending algorithm ID, and for each PCR selection it will also sort the list
+// of PCRs in ascending order. A new list of selections is returned.
+func (l PCRSelectionList) Sort() (out PCRSelectionList) {
+	for _, p := range l {
+		o := PCRSelection{Hash: p.Hash}
+		o.Select = make([]int, len(p.Select))
+		copy(o.Select, p.Select)
+		sort.Ints(o.Select)
+		out = append(out, o)
 	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Hash < out[j].Hash })
+	return
+}
 
-	var o PCRSelectionList
-	for i, sl := range l {
-		if r[i].Hash != sl.Hash {
-			return nil, errors.New("PCRSelection has unexpected algorithm")
+// Normalize will return a new sorted list of PCR selections with each PCR and each PCR bank only appearing once.
+func (l PCRSelectionList) Normalize() PCRSelectionList {
+	return PCRSelectionList{}.Merge(l).Sort()
+}
+
+// Merge will merge the PCR selections specified by l and r together and return a new set of PCR selections which contains a
+// combination of both. For each PCR found in r that isn't found in l, it will be added to the first occurence of the corresponding
+// PCR bank found in l if that exists, or otherwise a selection for that PCR bank will be appended to the result.
+func (l PCRSelectionList) Merge(r PCRSelectionList) (out PCRSelectionList) {
+	for _, s := range l {
+		o := PCRSelection{Hash: s.Hash}
+		o.Select = make([]int, len(s.Select))
+		copy(o.Select, s.Select)
+		out = append(out, o)
+	}
+
+	for _, s := range r {
+		for _, y := range s.Select {
+			found := false
+			for _, o := range out {
+				if o.Hash != s.Hash {
+					continue
+				}
+				for _, x := range o.Select {
+					if x == y {
+						found = true
+						break
+					}
+				}
+				if found {
+					break
+				}
+			}
+
+			if !found {
+				added := false
+				for i, o := range out {
+					if o.Hash != s.Hash {
+						continue
+					}
+					found = false
+					for _, x := range o.Select {
+						if x == y {
+							found = true
+							break
+						}
+					}
+					if !found {
+						out[i].Select = append(o.Select, y)
+						added = true
+						break
+					}
+				}
+				if !added {
+					out = append(out, PCRSelection{Hash: s.Hash, Select: []int{y}})
+				}
+			}
 		}
-		so := PCRSelection{Hash: sl.Hash}
-	Loop:
-		for _, sli := range sl.Select {
-			for _, sri := range r[i].Select {
-				if sri == sli {
-					continue Loop
+	}
+	return
+}
+
+// Subtract will subtract the PCR selections in r from the PCR selections in l, and return a new set of selections. For each PCR
+// selected in r, the first occurence found in l is removed from the result. If r references a PCR that is not found in l, an error
+// is returned.
+func (l PCRSelectionList) Subtract(r PCRSelectionList) (out PCRSelectionList, err error) {
+	var scratch PCRSelectionList
+	for _, s := range l {
+		o := PCRSelection{Hash: s.Hash}
+		o.Select = make([]int, len(s.Select))
+		copy(o.Select, s.Select)
+		scratch = append(scratch, o)
+	}
+
+	for _, s := range r {
+		for _, y := range s.Select {
+			subtracted := false
+			for i, o := range scratch {
+				if o.Hash != s.Hash {
+					continue
+				}
+				for j, x := range o.Select {
+					if x == y {
+						if j < len(o.Select)-1 {
+							copy(scratch[i].Select[j:], o.Select[j+1:])
+						}
+						scratch[i].Select = o.Select[:len(o.Select)-1]
+						subtracted = true
+						break
+					}
 				}
+				if subtracted {
+					break
+				}
+			}
+			if !subtracted {
+				return nil, fmt.Errorf("cannot subtract PCR%d/%v from selection", y, s.Hash)
 			}
-			so.Select = append(so.Select, sli)
 		}
-		o = append(o, so)
 	}
 
-	return o, nil
+	for _, o := range scratch {
+		if len(o.Select) == 0 {
+			continue
+		}
+		out = append(out, o)
+	}
+	return
 }
 
-func (l PCRSelectionList) isEmpty() bool {
+// IsEmpty returns true if the list of PCR selections selects no PCRs.
+func (l PCRSelectionList) IsEmpty() bool {
 	for _, s := range l {
 		if len(s.Select) > 0 {
 			return false
@@ -586,30 +702,31 @@
 	return c.Data.(TaggedPolicyList)
 }
 
-func (c CapabilitiesU) Select(selector reflect.Value) (reflect.Type, error) {
+func (c CapabilitiesU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(Capability) {
 	case CapabilityAlgs:
-		return reflect.TypeOf(AlgorithmPropertyList(nil)), nil
+		return reflect.TypeOf(AlgorithmPropertyList(nil))
 	case CapabilityHandles:
-		return reflect.TypeOf(HandleList(nil)), nil
+		return reflect.TypeOf(HandleList(nil))
 	case CapabilityCommands:
-		return reflect.TypeOf(CommandAttributesList(nil)), nil
+		return reflect.TypeOf(CommandAttributesList(nil))
 	case CapabilityPPCommands:
-		return reflect.TypeOf(CommandCodeList(nil)), nil
+		return reflect.TypeOf(CommandCodeList(nil))
 	case CapabilityAuditCommands:
-		return reflect.TypeOf(CommandCodeList(nil)), nil
+		return reflect.TypeOf(CommandCodeList(nil))
 	case CapabilityPCRs:
-		return reflect.TypeOf(PCRSelectionList(nil)), nil
+		return reflect.TypeOf(PCRSelectionList(nil))
 	case CapabilityTPMProperties:
-		return reflect.TypeOf(TaggedTPMPropertyList(nil)), nil
+		return reflect.TypeOf(TaggedTPMPropertyList(nil))
 	case CapabilityPCRProperties:
-		return reflect.TypeOf(TaggedPCRPropertyList(nil)), nil
+		return reflect.TypeOf(TaggedPCRPropertyList(nil))
 	case CapabilityECCCurves:
-		return reflect.TypeOf(ECCCurveList(nil)), nil
+		return reflect.TypeOf(ECCCurveList(nil))
 	case CapabilityAuthPolicies:
-		return reflect.TypeOf(TaggedPolicyList(nil)), nil
+		return reflect.TypeOf(TaggedPolicyList(nil))
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // CapabilityData corresponds to the TPMS_CAPABILITY_DATA type, and is returned by TPMContext.GetCapability.
@@ -699,24 +816,25 @@
 	Data interface{}
 }
 
-func (a AttestU) Select(selector reflect.Value) (reflect.Type, error) {
+func (a AttestU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(StructTag) {
 	case TagAttestNV:
-		return reflect.TypeOf((*NVCertifyInfo)(nil)), nil
+		return reflect.TypeOf((*NVCertifyInfo)(nil))
 	case TagAttestCommandAudit:
-		return reflect.TypeOf((*CommandAuditInfo)(nil)), nil
+		return reflect.TypeOf((*CommandAuditInfo)(nil))
 	case TagAttestSessionAudit:
-		return reflect.TypeOf((*SessionAuditInfo)(nil)), nil
+		return reflect.TypeOf((*SessionAuditInfo)(nil))
 	case TagAttestCertify:
-		return reflect.TypeOf((*CertifyInfo)(nil)), nil
+		return reflect.TypeOf((*CertifyInfo)(nil))
 	case TagAttestQuote:
-		return reflect.TypeOf((*QuoteInfo)(nil)), nil
+		return reflect.TypeOf((*QuoteInfo)(nil))
 	case TagAttestTime:
-		return reflect.TypeOf((*TimeAttestInfo)(nil)), nil
+		return reflect.TypeOf((*TimeAttestInfo)(nil))
 	case TagAttestCreation:
-		return reflect.TypeOf((*CreationInfo)(nil)), nil
+		return reflect.TypeOf((*CreationInfo)(nil))
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // Certify returns the underlying value as *CertifyInfo. It panics if the underlying type is not *CertifyInfo.
@@ -773,7 +891,7 @@
 // Decode unmarshals the underlying buffer to the corresponding Attest structure.
 func (a AttestRaw) Decode() (*Attest, error) {
 	var out Attest
-	if _, err := UnmarshalFromBytes(a, &out); err != nil {
+	if _, err := mu.UnmarshalFromBytes(a, &out); err != nil {
 		return nil, err
 	}
 	return &out, nil
@@ -794,20 +912,21 @@
 	Data interface{}
 }
 
-func (b SymKeyBitsU) Select(selector reflect.Value) (reflect.Type, error) {
+func (b SymKeyBitsU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Convert(reflect.TypeOf(AlgorithmId(0))).Interface().(AlgorithmId) {
 	case AlgorithmAES:
 		fallthrough
 	case AlgorithmSM4:
 		fallthrough
 	case AlgorithmCamellia:
-		return reflect.TypeOf(uint16(0)), nil
+		return reflect.TypeOf(uint16(0))
 	case AlgorithmXOR:
-		return reflect.TypeOf(HashAlgorithmId(0)), nil
+		return reflect.TypeOf(HashAlgorithmId(0))
 	case AlgorithmNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // Sym returns the underlying value as uint16. It panics if the underlying type is not uint16.
@@ -831,20 +950,21 @@
 	Data interface{}
 }
 
-func (m SymModeU) Select(selector reflect.Value) (reflect.Type, error) {
+func (m SymModeU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Convert(reflect.TypeOf(AlgorithmId(0))).Interface().(AlgorithmId) {
 	case AlgorithmAES:
 		fallthrough
 	case AlgorithmSM4:
 		fallthrough
 	case AlgorithmCamellia:
-		return reflect.TypeOf(SymModeId(0)), nil
+		return reflect.TypeOf(SymModeId(0))
 	case AlgorithmXOR:
 		fallthrough
 	case AlgorithmNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // Sym returns the underlying value as SymModeId. It panics if the underlying type is not SymModeId.
@@ -930,16 +1050,17 @@
 	Data interface{}
 }
 
-func (d SchemeKeyedHashU) Select(selector reflect.Value) (reflect.Type, error) {
+func (d SchemeKeyedHashU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(KeyedHashSchemeId) {
 	case KeyedHashSchemeHMAC:
-		return reflect.TypeOf((*SchemeHMAC)(nil)), nil
+		return reflect.TypeOf((*SchemeHMAC)(nil))
 	case KeyedHashSchemeXOR:
-		return reflect.TypeOf((*SchemeXOR)(nil)), nil
+		return reflect.TypeOf((*SchemeXOR)(nil))
 	case KeyedHashSchemeNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // HMAC returns the underlying value as *SchemeHMAC. It panics if the underlying type is not *SchemeHMAC.
@@ -983,26 +1104,27 @@
 	Data interface{}
 }
 
-func (s SigSchemeU) Select(selector reflect.Value) (reflect.Type, error) {
+func (s SigSchemeU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(SigSchemeId) {
 	case SigSchemeAlgRSASSA:
-		return reflect.TypeOf((*SigSchemeRSASSA)(nil)), nil
+		return reflect.TypeOf((*SigSchemeRSASSA)(nil))
 	case SigSchemeAlgRSAPSS:
-		return reflect.TypeOf((*SigSchemeRSAPSS)(nil)), nil
+		return reflect.TypeOf((*SigSchemeRSAPSS)(nil))
 	case SigSchemeAlgECDSA:
-		return reflect.TypeOf((*SigSchemeECDSA)(nil)), nil
+		return reflect.TypeOf((*SigSchemeECDSA)(nil))
 	case SigSchemeAlgECDAA:
-		return reflect.TypeOf((*SigSchemeECDAA)(nil)), nil
+		return reflect.TypeOf((*SigSchemeECDAA)(nil))
 	case SigSchemeAlgSM2:
-		return reflect.TypeOf((*SigSchemeSM2)(nil)), nil
+		return reflect.TypeOf((*SigSchemeSM2)(nil))
 	case SigSchemeAlgECSCHNORR:
-		return reflect.TypeOf((*SigSchemeECSCHNORR)(nil)), nil
+		return reflect.TypeOf((*SigSchemeECSCHNORR)(nil))
 	case SigSchemeAlgHMAC:
-		return reflect.TypeOf((*SchemeHMAC)(nil)), nil
+		return reflect.TypeOf((*SchemeHMAC)(nil))
 	case SigSchemeAlgNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // RSASSA returns the underlying value as *SigSchemeRSASSA. It panics if the underlying type is not *SigSchemeRSASSA
@@ -1069,20 +1191,21 @@
 	Data interface{}
 }
 
-func (s KDFSchemeU) Select(selector reflect.Value) (reflect.Type, error) {
+func (s KDFSchemeU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(KDFAlgorithmId) {
 	case KDFAlgorithmMGF1:
-		return reflect.TypeOf((*SchemeMGF1)(nil)), nil
+		return reflect.TypeOf((*SchemeMGF1)(nil))
 	case KDFAlgorithmKDF1_SP800_56A:
-		return reflect.TypeOf((*SchemeKDF1_SP800_56A)(nil)), nil
+		return reflect.TypeOf((*SchemeKDF1_SP800_56A)(nil))
 	case KDFAlgorithmKDF2:
-		return reflect.TypeOf((*SchemeKDF2)(nil)), nil
+		return reflect.TypeOf((*SchemeKDF2)(nil))
 	case KDFAlgorithmKDF1_SP800_108:
-		return reflect.TypeOf((*SchemeKDF1_SP800_108)(nil)), nil
+		return reflect.TypeOf((*SchemeKDF1_SP800_108)(nil))
 	case KDFAlgorithmNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // MGF1 returns the underlying value as *SchemeMGF1. It panics if the underlying type is not *SchemeMGF1.
@@ -1138,32 +1261,33 @@
 	Data interface{}
 }
 
-func (s AsymSchemeU) Select(selector reflect.Value) (reflect.Type, error) {
+func (s AsymSchemeU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Convert(reflect.TypeOf(AsymSchemeId(0))).Interface().(AsymSchemeId) {
 	case AsymSchemeRSASSA:
-		return reflect.TypeOf((*SigSchemeRSASSA)(nil)), nil
+		return reflect.TypeOf((*SigSchemeRSASSA)(nil))
 	case AsymSchemeRSAES:
-		return reflect.TypeOf((*EncSchemeRSAES)(nil)), nil
+		return reflect.TypeOf((*EncSchemeRSAES)(nil))
 	case AsymSchemeRSAPSS:
-		return reflect.TypeOf((*SigSchemeRSAPSS)(nil)), nil
+		return reflect.TypeOf((*SigSchemeRSAPSS)(nil))
 	case AsymSchemeOAEP:
-		return reflect.TypeOf((*EncSchemeOAEP)(nil)), nil
+		return reflect.TypeOf((*EncSchemeOAEP)(nil))
 	case AsymSchemeECDSA:
-		return reflect.TypeOf((*SigSchemeECDSA)(nil)), nil
+		return reflect.TypeOf((*SigSchemeECDSA)(nil))
 	case AsymSchemeECDH:
-		return reflect.TypeOf((*KeySchemeECDH)(nil)), nil
+		return reflect.TypeOf((*KeySchemeECDH)(nil))
 	case AsymSchemeECDAA:
-		return reflect.TypeOf((*SigSchemeECDAA)(nil)), nil
+		return reflect.TypeOf((*SigSchemeECDAA)(nil))
 	case AsymSchemeSM2:
-		return reflect.TypeOf((*SigSchemeSM2)(nil)), nil
+		return reflect.TypeOf((*SigSchemeSM2)(nil))
 	case AsymSchemeECSCHNORR:
-		return reflect.TypeOf((*SigSchemeECSCHNORR)(nil)), nil
+		return reflect.TypeOf((*SigSchemeECSCHNORR)(nil))
 	case AsymSchemeECMQV:
-		return reflect.TypeOf((*KeySchemeECMQV)(nil)), nil
+		return reflect.TypeOf((*KeySchemeECMQV)(nil))
 	case AsymSchemeNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // ECDH returns the underlying value as *KeySchemeECDH. It panics if the underlying type is not *KeySchemeECDH.
@@ -1300,26 +1424,27 @@
 	Data interface{}
 }
 
-func (s SignatureU) Select(selector reflect.Value) (reflect.Type, error) {
+func (s SignatureU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(SigSchemeId) {
 	case SigSchemeAlgRSASSA:
-		return reflect.TypeOf((*SignatureRSASSA)(nil)), nil
+		return reflect.TypeOf((*SignatureRSASSA)(nil))
 	case SigSchemeAlgRSAPSS:
-		return reflect.TypeOf((*SignatureRSAPSS)(nil)), nil
+		return reflect.TypeOf((*SignatureRSAPSS)(nil))
 	case SigSchemeAlgECDSA:
-		return reflect.TypeOf((*SignatureECDSA)(nil)), nil
+		return reflect.TypeOf((*SignatureECDSA)(nil))
 	case SigSchemeAlgECDAA:
-		return reflect.TypeOf((*SignatureECDAA)(nil)), nil
+		return reflect.TypeOf((*SignatureECDAA)(nil))
 	case SigSchemeAlgSM2:
-		return reflect.TypeOf((*SignatureSM2)(nil)), nil
+		return reflect.TypeOf((*SignatureSM2)(nil))
 	case SigSchemeAlgECSCHNORR:
-		return reflect.TypeOf((*SignatureECSCHNORR)(nil)), nil
+		return reflect.TypeOf((*SignatureECSCHNORR)(nil))
 	case SigSchemeAlgHMAC:
-		return reflect.TypeOf((*TaggedHash)(nil)), nil
+		return reflect.TypeOf((*TaggedHash)(nil))
 	case SigSchemeAlgNull:
-		return nil, nil
+		return reflect.TypeOf(mu.NilUnionValue)
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // RSASSA returns the underlying value as *SignatureRSASSA. It panics if the underlying type is not *SignatureRSASSA.
@@ -1391,18 +1516,19 @@
 	Data interface{}
 }
 
-func (p PublicIDU) Select(selector reflect.Value) (reflect.Type, error) {
+func (p PublicIDU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(ObjectTypeId) {
 	case ObjectTypeRSA:
-		return reflect.TypeOf(PublicKeyRSA(nil)), nil
+		return reflect.TypeOf(PublicKeyRSA(nil))
 	case ObjectTypeKeyedHash:
-		return reflect.TypeOf(Digest(nil)), nil
+		return reflect.TypeOf(Digest(nil))
 	case ObjectTypeECC:
-		return reflect.TypeOf((*ECCPoint)(nil)), nil
+		return reflect.TypeOf((*ECCPoint)(nil))
 	case ObjectTypeSymCipher:
-		return reflect.TypeOf(Digest(nil)), nil
+		return reflect.TypeOf(Digest(nil))
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // KeyedHash returns the underlying value as Digest. It panics if the underlying type is not Digest.
@@ -1459,7 +1585,7 @@
 	// For a storage key: AlgorithmNull.
 	Scheme  ECCScheme
 	CurveID ECCCurve  // ECC curve ID
-	KDF     KDFScheme // Unused - always AlgorithmNull
+	KDF     KDFScheme // Unused - always KDFAlgorithmNull
 }
 
 // PublicParamsU is a fake union type that corresponds to the TPMU_PUBLIC_PARMS type. The selector type is ObjectTypeId. Valid types
@@ -1472,18 +1598,19 @@
 	Data interface{}
 }
 
-func (p PublicParamsU) Select(selector reflect.Value) (reflect.Type, error) {
+func (p PublicParamsU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(ObjectTypeId) {
 	case ObjectTypeRSA:
-		return reflect.TypeOf((*RSAParams)(nil)), nil
+		return reflect.TypeOf((*RSAParams)(nil))
 	case ObjectTypeKeyedHash:
-		return reflect.TypeOf((*KeyedHashParams)(nil)), nil
+		return reflect.TypeOf((*KeyedHashParams)(nil))
 	case ObjectTypeECC:
-		return reflect.TypeOf((*ECCParams)(nil)), nil
+		return reflect.TypeOf((*ECCParams)(nil))
 	case ObjectTypeSymCipher:
-		return reflect.TypeOf((*SymCipherParams)(nil)), nil
+		return reflect.TypeOf((*SymCipherParams)(nil))
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // KeyedHashDetail returns the underlying value as *KeyedHashParams. It panics if the underlying type is not *KeyedHashParams.
@@ -1541,10 +1668,10 @@
 		return nil, fmt.Errorf("unsupported name algorithm: %v", p.NameAlg)
 	}
 	hasher := p.NameAlg.NewHash()
-	if _, err := MarshalToWriter(hasher, p); err != nil {
+	if _, err := mu.MarshalToWriter(hasher, p); err != nil {
 		return nil, fmt.Errorf("cannot marshal public object: %v", err)
 	}
-	name, err := MarshalToBytes(p.NameAlg, RawBytes(hasher.Sum(nil)))
+	name, err := mu.MarshalToBytes(p.NameAlg, mu.RawBytes(hasher.Sum(nil)))
 	if err != nil {
 		return nil, fmt.Errorf("cannot marshal algorithm and digest to name: %v", err)
 	}
@@ -1552,12 +1679,12 @@
 }
 
 func (p *Public) copy() (*Public, error) {
-	b, err := MarshalToBytes(p)
+	b, err := mu.MarshalToBytes(p)
 	if err != nil {
 		return nil, err
 	}
 	var out *Public
-	_, err = UnmarshalFromBytes(b, &out)
+	_, err = mu.UnmarshalFromBytes(b, &out)
 	if err != nil {
 		return nil, err
 	}
@@ -1573,7 +1700,7 @@
 }
 
 func (p *Public) ToTemplate() (Template, error) {
-	b, err := MarshalToBytes(p)
+	b, err := mu.MarshalToBytes(p)
 	if err != nil {
 		return nil, fmt.Errorf("cannot marshal object: %v", err)
 	}
@@ -1603,10 +1730,10 @@
 		return nil, fmt.Errorf("unsupported name algorithm: %v", p.NameAlg)
 	}
 	hasher := p.NameAlg.NewHash()
-	if _, err := MarshalToWriter(hasher, p); err != nil {
+	if _, err := mu.MarshalToWriter(hasher, p); err != nil {
 		return nil, fmt.Errorf("cannot marshal public object: %v", err)
 	}
-	name, err := MarshalToBytes(p.NameAlg, RawBytes(hasher.Sum(nil)))
+	name, err := mu.MarshalToBytes(p.NameAlg, mu.RawBytes(hasher.Sum(nil)))
 	if err != nil {
 		return nil, fmt.Errorf("cannot marshal algorithm and digest to name: %v", err)
 	}
@@ -1614,7 +1741,7 @@
 }
 
 func (p *PublicDerived) ToTemplate() (Template, error) {
-	b, err := MarshalToBytes(p)
+	b, err := mu.MarshalToBytes(p)
 	if err != nil {
 		return nil, fmt.Errorf("cannot marshal object: %v", err)
 	}
@@ -1645,18 +1772,19 @@
 	Data interface{}
 }
 
-func (s SensitiveCompositeU) Select(selector reflect.Value) (reflect.Type, error) {
+func (s SensitiveCompositeU) Select(selector reflect.Value) reflect.Type {
 	switch selector.Interface().(ObjectTypeId) {
 	case ObjectTypeRSA:
-		return reflect.TypeOf(PrivateKeyRSA(nil)), nil
+		return reflect.TypeOf(PrivateKeyRSA(nil))
 	case ObjectTypeECC:
-		return reflect.TypeOf(ECCParameter(nil)), nil
+		return reflect.TypeOf(ECCParameter(nil))
 	case ObjectTypeKeyedHash:
-		return reflect.TypeOf(SensitiveData(nil)), nil
+		return reflect.TypeOf(SensitiveData(nil))
 	case ObjectTypeSymCipher:
-		return reflect.TypeOf(SymKey(nil)), nil
+		return reflect.TypeOf(SymKey(nil))
+	default:
+		return nil
 	}
-	return nil, InvalidSelectorError{selector}
 }
 
 // RSA returns the underlying value as PrivateKeyRSA. It panics if the underlying type is not PrivateKeyRSA.
@@ -1750,10 +1878,10 @@
 		return nil, fmt.Errorf("unsupported name algorithm: %v", p.NameAlg)
 	}
 	hasher := p.NameAlg.NewHash()
-	if _, err := MarshalToWriter(hasher, p); err != nil {
+	if _, err := mu.MarshalToWriter(hasher, p); err != nil {
 		return nil, fmt.Errorf("cannot marshal public object: %v", err)
 	}
-	name, err := MarshalToBytes(p.NameAlg, RawBytes(hasher.Sum(nil)))
+	name, err := mu.MarshalToBytes(p.NameAlg, mu.RawBytes(hasher.Sum(nil)))
 	if err != nil {
 		return nil, fmt.Errorf("cannot marshal algorithm and digest to name: %v", err)
 	}
@@ -1769,12 +1897,12 @@
 }
 
 func (p *NVPublic) copy() (*NVPublic, error) {
-	b, err := MarshalToBytes(p)
+	b, err := mu.MarshalToBytes(p)
 	if err != nil {
 		return nil, err
 	}
 	var out *NVPublic
-	_, err = UnmarshalFromBytes(b, &out)
+	_, err = mu.UnmarshalFromBytes(b, &out)
 	if err != nil {
 		return nil, err
 	}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/utils.go snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/utils.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/go-tpm2/utils.go	2020-04-29 19:14:05.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/go-tpm2/utils.go	2021-02-02 08:21:12.000000000 +0000
@@ -10,6 +10,8 @@
 	"fmt"
 	"hash"
 	"sort"
+
+	"github.com/canonical/go-tpm2/mu"
 )
 
 // ComputeCpHash computes a command parameter digest from the specified command code and provided command parameters, using the
@@ -37,7 +39,7 @@
 		case HandleContext:
 			handles = append(handles, p.Name())
 		default:
-			return nil, makeInvalidParamError("params", "parameter in handle area is not a Handle or HandleContext")
+			return nil, makeInvalidArgError("params", "parameter in handle area is not a Handle or HandleContext")
 		}
 	}
 
@@ -45,7 +47,7 @@
 
 	if i < len(params)-1 {
 		var err error
-		cpBytes, err = MarshalToBytes(params[i+1:]...)
+		cpBytes, err = mu.MarshalToBytes(params[i+1:]...)
 		if err != nil {
 			return nil, fmt.Errorf("cannot marshal command parameters: %v", err)
 		}
@@ -55,7 +57,8 @@
 }
 
 // ComputePCRDigest computes a digest using the specified algorithm from the provided set of PCR values and the provided PCR
-// selection. It is most useful for computing an input to TPMContext.PolicyPCR, and validating quotes and creation data.
+// selections. The digest is computed the same way as PCRComputeCurrentDigest as defined in the TPM reference implementation.
+// It is most useful for computing an input to TPMContext.PolicyPCR, and validating quotes and creation data.
 func ComputePCRDigest(alg HashAlgorithmId, pcrs PCRSelectionList, values PCRValues) (Digest, error) {
 	if !alg.Supported() {
 		return nil, fmt.Errorf("unknown digest algorithm %v", alg)
@@ -81,6 +84,20 @@
 	return h.Sum(nil), nil
 }
 
+func ComputePCRDigestSimple(alg HashAlgorithmId, values PCRValues) (PCRSelectionList, Digest, error) {
+	if !alg.Supported() {
+		return nil, nil, fmt.Errorf("unknown digest algorithm %v", alg)
+	}
+
+	pcrs := values.SelectionList()
+	digest, err := ComputePCRDigest(alg, pcrs, values)
+	if err != nil {
+		panic(fmt.Sprintf("ComputePCRDigest failed: %v", err))
+	}
+
+	return pcrs, digest, nil
+}
+
 // TrialAuthPolicy provides a mechanism for computing authorization policy digests without having to execute a trial authorization
 // policy session on the TPM. An advantage of this is that it is possible to compute digests for PolicySecret and PolicyNV assertions
 // without knowledge of the authorization value of the authorizing entities used for those commands.
@@ -168,7 +185,7 @@
 
 func (p *TrialAuthPolicy) PolicyPCR(pcrDigest Digest, pcrs PCRSelectionList) {
 	h, end := p.beginUpdateForCommand(CommandPolicyPCR)
-	if _, err := MarshalToWriter(h, pcrs); err != nil {
+	if _, err := mu.MarshalToWriter(h, pcrs); err != nil {
 		panic(fmt.Sprintf("cannot marshal PCR selection: %v", err))
 	}
 	h.Write(pcrDigest)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/constants.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/constants.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/constants.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/constants.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,71 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+const (
+	EventTypePrebootCert EventType = 0x00000000 // EV_PREBOOT_CERT
+	EventTypePostCode    EventType = 0x00000001 // EV_POST_CODE
+	// EventTypeUnused = 0x00000002
+	EventTypeNoAction             EventType = 0x00000003 // EV_NO_ACTION
+	EventTypeSeparator            EventType = 0x00000004 // EV_SEPARATOR
+	EventTypeAction               EventType = 0x00000005 // EV_ACTION
+	EventTypeEventTag             EventType = 0x00000006 // EV_EVENT_TAG
+	EventTypeSCRTMContents        EventType = 0x00000007 // EV_S_CRTM_CONTENTS
+	EventTypeSCRTMVersion         EventType = 0x00000008 // EV_S_CRTM_VERSION
+	EventTypeCPUMicrocode         EventType = 0x00000009 // EV_CPU_MICROCODE
+	EventTypePlatformConfigFlags  EventType = 0x0000000a // EV_PLATFORM_CONFIG_FLAGS
+	EventTypeTableOfDevices       EventType = 0x0000000b // EV_TABLE_OF_DEVICES
+	EventTypeCompactHash          EventType = 0x0000000c // EV_COMPACT_HASH
+	EventTypeIPL                  EventType = 0x0000000d // EV_IPL
+	EventTypeIPLPartitionData     EventType = 0x0000000e // EV_IPL_PARTITION_DATA
+	EventTypeNonhostCode          EventType = 0x0000000f // EV_NONHOST_CODE
+	EventTypeNonhostConfig        EventType = 0x00000010 // EV_NONHOST_CONFIG
+	EventTypeNonhostInfo          EventType = 0x00000011 // EV_NONHOST_INFO
+	EventTypeOmitBootDeviceEvents EventType = 0x00000012 // EV_OMIT_BOOT_DEVICE_EVENTS
+
+	EventTypeEFIEventBase               EventType = 0x80000000 // EV_EFI_EVENT_BASE
+	EventTypeEFIVariableDriverConfig    EventType = 0x80000001 // EV_EFI_VARIABLE_DRIVER_CONFIG
+	EventTypeEFIVariableBoot            EventType = 0x80000002 // EV_EFI_VARIABLE_BOOT
+	EventTypeEFIBootServicesApplication EventType = 0x80000003 // EV_EFI_BOOT_SERVICES_APPLICATION
+	EventTypeEFIBootServicesDriver      EventType = 0x80000004 // EV_EFI_BOOT_SERVICES_DRIVER
+	EventTypeEFIRuntimeServicesDriver   EventType = 0x80000005 // EV_EFI_RUNTIME_SERVICES_DRIVER
+	EventTypeEFIGPTEvent                EventType = 0x80000006 // EV_EFI_GPT_EVENT
+	EventTypeEFIAction                  EventType = 0x80000007 // EV_EFI_ACTION
+	EventTypeEFIPlatformFirmwareBlob    EventType = 0x80000008 // EV_EFI_PLATFORM_FIRMWARE_BLOB
+	EventTypeEFIHandoffTables           EventType = 0x80000009 // EF_EFI_HANDOFF_TABLES
+	EventTypeEFIHCRTMEvent              EventType = 0x80000010 // EF_EFI_HCRTM_EVENT
+	EventTypeEFIVariableAuthority       EventType = 0x800000e0 // EV_EFI_VARIABLE_AUTHORITY
+)
+
+const (
+	AlgorithmSha1   AlgorithmId = 0x0004 // TPM_ALG_SHA1
+	AlgorithmSha256 AlgorithmId = 0x000b // TPM_ALG_SHA256
+	AlgorithmSha384 AlgorithmId = 0x000c // TPM_ALG_SHA384
+	AlgorithmSha512 AlgorithmId = 0x000d // TPM_ALG_SHA512
+)
+
+const (
+	// SpecUnknown indicates that the specification to which the log conforms is unknown because it doesn't
+	// start with a spec ID event.
+	SpecUnknown Spec = iota
+
+	// SpecPCClient indicates that the log conforms to "TCG PC Client Specific Implementation Specification
+	// for Conventional BIOS".
+	// See https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
+	SpecPCClient
+
+	// SpecEFI_1_2 indicates that the log conforms to "TCG EFI Platform Specification For TPM Family 1.1 or
+	// 1.2".
+	// See https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
+	SpecEFI_1_2
+
+	// SpecEFI_2 indicates that the log conforms to "TCG PC Client Platform Firmware Profile Specification"
+	// See https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+	SpecEFI_2
+)
+
+const (
+	SeparatorEventErrorValue uint32 = 1
+)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/efi.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/efi.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/efi.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/efi.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,806 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"unicode/utf16"
+	"unicode/utf8"
+
+	"golang.org/x/xerrors"
+)
+
+var (
+	surr1 uint16 = 0xd800
+	surr2 uint16 = 0xdc00
+	surr3 uint16 = 0xe000
+)
+
+// UEFI_VARIABLE_DATA specifies the number of *characters* for a UTF-16 sequence rather than the size of
+// the buffer. Extract a UTF-16 sequence of the correct length, given a buffer and the number of characters.
+// The returned buffer can be passed to utf16.Decode.
+func extractUTF16Buffer(r io.ReadSeeker, nchars uint64) ([]uint16, error) {
+	var out []uint16
+
+	for i := nchars; i > 0; i-- {
+		var c uint16
+		if err := binary.Read(r, binary.LittleEndian, &c); err != nil {
+			return nil, err
+		}
+		out = append(out, c)
+		if c >= surr1 && c < surr2 {
+			if err := binary.Read(r, binary.LittleEndian, &c); err != nil {
+				return nil, err
+			}
+			if c < surr2 || c >= surr3 {
+				// Invalid surrogate sequence. utf16.Decode doesn't consume this
+				// byte when inserting the replacement char
+				if _, err := r.Seek(-1, io.SeekCurrent); err != nil {
+					return nil, err
+				}
+				continue
+			}
+			// Valid surrogate sequence
+			out = append(out, c)
+		}
+	}
+
+	return out, nil
+}
+
+// EFIGUID corresponds to the EFI_GUID type
+type EFIGUID [16]uint8
+
+func (guid EFIGUID) String() string {
+	return fmt.Sprintf("{%08x-%04x-%04x-%04x-%012x}",
+		binary.LittleEndian.Uint32(guid[0:4]),
+		binary.LittleEndian.Uint16(guid[4:6]),
+		binary.LittleEndian.Uint16(guid[6:8]),
+		binary.BigEndian.Uint16(guid[8:10]),
+		guid[10:16])
+}
+
+// MakeEFIGUID makes a new EFIGUID from the supplied arguments.
+func MakeEFIGUID(a uint32, b, c, d uint16, e [6]uint8) (out EFIGUID) {
+	binary.LittleEndian.PutUint32(out[0:4], a)
+	binary.LittleEndian.PutUint16(out[4:6], b)
+	binary.LittleEndian.PutUint16(out[6:8], c)
+	binary.BigEndian.PutUint16(out[8:10], d)
+	copy(out[10:], e[:])
+	return
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
+//  (section 7.4 "EV_NO_ACTION Event Types")
+func parseEFI_1_2_SpecIdEvent(r io.Reader, eventData *SpecIdEvent) error {
+	eventData.Spec = SpecEFI_1_2
+
+	// TCG_EfiSpecIdEventStruct.vendorInfoSize
+	var vendorInfoSize uint8
+	if err := binary.Read(r, binary.LittleEndian, &vendorInfoSize); err != nil {
+		return xerrors.Errorf("cannot read vendor info size: %w", err)
+	}
+
+	// TCG_EfiSpecIdEventStruct.vendorInfo
+	eventData.VendorInfo = make([]byte, vendorInfoSize)
+	if _, err := io.ReadFull(r, eventData.VendorInfo); err != nil {
+		return xerrors.Errorf("cannot read vendor info: %w", err)
+	}
+
+	return nil
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+//  (secion 9.4.5.1 "Specification ID Version Event")
+func parseEFI_2_SpecIdEvent(r io.Reader, eventData *SpecIdEvent) error {
+	eventData.Spec = SpecEFI_2
+
+	// TCG_EfiSpecIdEvent.numberOfAlgorithms
+	var numberOfAlgorithms uint32
+	if err := binary.Read(r, binary.LittleEndian, &numberOfAlgorithms); err != nil {
+		return xerrors.Errorf("cannot read number of digest algorithms: %w", err)
+	}
+
+	if numberOfAlgorithms < 1 {
+		return errors.New("numberOfAlgorithms is zero")
+	}
+
+	// TCG_EfiSpecIdEvent.digestSizes
+	eventData.DigestSizes = make([]EFISpecIdEventAlgorithmSize, numberOfAlgorithms)
+	if err := binary.Read(r, binary.LittleEndian, eventData.DigestSizes); err != nil {
+		return xerrors.Errorf("cannot read digest algorithm sizes: %w", err)
+	}
+	for _, d := range eventData.DigestSizes {
+		if d.AlgorithmId.supported() && d.AlgorithmId.Size() != int(d.DigestSize) {
+			return fmt.Errorf("digestSize for algorithmId %v does not match expected size", d.AlgorithmId)
+		}
+	}
+
+	// TCG_EfiSpecIdEvent.vendorInfoSize
+	var vendorInfoSize uint8
+	if err := binary.Read(r, binary.LittleEndian, &vendorInfoSize); err != nil {
+		return xerrors.Errorf("cannot read vendor info size: %w", err)
+	}
+
+	// TCG_EfiSpecIdEvent.vendorInfo
+	eventData.VendorInfo = make([]byte, vendorInfoSize)
+	if _, err := io.ReadFull(r, eventData.VendorInfo); err != nil {
+		return xerrors.Errorf("cannot read vendor info: %w", err)
+	}
+
+	return nil
+}
+
+// startupLocalityEventData is the event data for a StartupLocality EV_NO_ACTION event.
+type startupLocalityEventData struct {
+	data      []byte
+	signature string
+	locality  uint8
+}
+
+func (e *startupLocalityEventData) String() string {
+	return fmt.Sprintf("EfiStartupLocalityEvent{ StartupLocality: %d }", e.locality)
+}
+
+func (e *startupLocalityEventData) Bytes() []byte {
+	return e.data
+}
+
+func (e *startupLocalityEventData) Type() NoActionEventType {
+	return StartupLocality
+}
+
+func (e *startupLocalityEventData) Signature() string {
+	return e.signature
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+//  (section 9.4.5.3 "Startup Locality Event")
+func decodeStartupLocalityEvent(r io.Reader, signature string, data []byte) (*startupLocalityEventData, error) {
+	var locality uint8
+	if err := binary.Read(r, binary.LittleEndian, &locality); err != nil {
+		return nil, err
+	}
+
+	return &startupLocalityEventData{data: data, signature: signature, locality: locality}, nil
+}
+
+type bimReferenceManifestEventData struct {
+	data      []byte
+	signature string
+	vendorId  uint32
+	guid      EFIGUID
+}
+
+func (e *bimReferenceManifestEventData) String() string {
+	return fmt.Sprintf("Sp800_155_PlatformId_Event{ VendorId: %d, ReferenceManifestGuid: %s }", e.vendorId, &e.guid)
+}
+
+func (e *bimReferenceManifestEventData) Bytes() []byte {
+	return e.data
+}
+
+func (e *bimReferenceManifestEventData) Type() NoActionEventType {
+	return BiosIntegrityMeasurement
+}
+
+func (e *bimReferenceManifestEventData) Signature() string {
+	return e.signature
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+//  (section 9.4.5.2 "BIOS Integrity Measurement Reference Manifest Event")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
+//  (section 7.4 "EV_NO_ACTION Event Types")
+func decodeBIMReferenceManifestEvent(r io.Reader, signature string, data []byte) (*bimReferenceManifestEventData, error) {
+	var d struct {
+		VendorId uint32
+		Guid     EFIGUID
+	}
+	if err := binary.Read(r, binary.LittleEndian, &d); err != nil {
+		return nil, err
+	}
+
+	return &bimReferenceManifestEventData{data: data, signature: signature, vendorId: d.VendorId, guid: d.Guid}, nil
+}
+
+// EFIVariableData corresponds to the EFI_VARIABLE_DATA type and is the event data associated with the measurement of an
+// EFI variable.
+type EFIVariableData struct {
+	data          []byte
+	consumedBytes int
+	VariableName EFIGUID
+	UnicodeName  string
+	VariableData []byte
+}
+
+func (e *EFIVariableData) String() string {
+	return fmt.Sprintf("UEFI_VARIABLE_DATA{ VariableName: %s, UnicodeName: \"%s\" }", e.VariableName, e.UnicodeName)
+}
+
+func (e *EFIVariableData) Bytes() []byte {
+	return e.data
+}
+
+// EncodeMeasuredBytes encodes this data in to the form in which it is hashed and measured by firmware or other bootloaders.
+func (e *EFIVariableData) EncodeMeasuredBytes(w io.Writer) error {
+	if _, err := w.Write(e.VariableName[:]); err != nil {
+		return xerrors.Errorf("cannot write variable name: %w", err)
+	}
+	if err := binary.Write(w, binary.LittleEndian, uint64(utf8.RuneCount([]byte(e.UnicodeName)))); err != nil {
+		return xerrors.Errorf("cannot write unicode name length: %w", err)
+	}
+	if err := binary.Write(w, binary.LittleEndian, uint64(len(e.VariableData))); err != nil {
+		return xerrors.Errorf("cannot write variable data length: %w", err)
+	}
+	if err := binary.Write(w, binary.LittleEndian, convertStringToUtf16(e.UnicodeName)); err != nil {
+		return xerrors.Errorf("cannot write unicode name: %w", err)
+	}
+	if _, err := w.Write(e.VariableData); err != nil {
+		return xerrors.Errorf("cannot write variable data: %w", err)
+	}
+	return nil
+}
+
+// TrailingBytes returns any trailing bytes that were not used during decoding. This indicates a bug in the software responsible
+// for the event. See https://github.com/rhboot/shim/commit/7e4d3f1c8c730a5d3f40729cb285b5d8c7b241af and
+// https://github.com/rhboot/shim/commit/8a27a4809a6a2b40fb6a4049071bf96d6ad71b50 for the types of bugs that might cause this. Note
+// that trailing bytes that are measured must be taken in to account when using EncodeMeasuredBytes.
+func (e *EFIVariableData) TrailingBytes() []byte {
+	return e.data[e.consumedBytes:]
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf (section 7.8 "Measuring EFI Variables")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf (section 9.2.6 "Measuring UEFI Variables")
+func decodeEventDataEFIVariable(data []byte, eventType EventType) (*EFIVariableData, error) {
+	r := bytes.NewReader(data)
+
+	d := &EFIVariableData{data: data}
+
+	if _, err := io.ReadFull(r, d.VariableName[:]); err != nil {
+		return nil, xerrors.Errorf("cannot read variable name: %w", err)
+	}
+
+	var unicodeNameLength uint64
+	if err := binary.Read(r, binary.LittleEndian, &unicodeNameLength); err != nil {
+		return nil, xerrors.Errorf("cannot read unicode name length: %w", err)
+	}
+
+	var variableDataLength uint64
+	if err := binary.Read(r, binary.LittleEndian, &variableDataLength); err != nil {
+		return nil, xerrors.Errorf("cannot read variable data length: %w", err)
+	}
+
+	utf16Name, err := extractUTF16Buffer(r, unicodeNameLength)
+	if err != nil {
+		return nil, xerrors.Errorf("cannot extract unicode name buffer: %w", err)
+	}
+	d.UnicodeName = convertUtf16ToString(utf16Name)
+
+	d.VariableData = make([]byte, variableDataLength)
+	if _, err := io.ReadFull(r, d.VariableData); err != nil {
+		return nil, xerrors.Errorf("cannot read variable data: %w", err)
+	}
+
+	d.consumedBytes = int(r.Size()) - r.Len()
+
+	return d, nil
+}
+
+type efiDevicePathNodeType uint8
+
+func (t efiDevicePathNodeType) String() string {
+	switch t {
+	case efiDevicePathNodeHardware:
+		return "HardwarePath"
+	case efiDevicePathNodeACPI:
+		return "AcpiPath"
+	case efiDevicePathNodeMsg:
+		return "Msg"
+	case efiDevicePathNodeMedia:
+		return "MediaPath"
+	case efiDevicePathNodeBBS:
+		return "BbsPath"
+	default:
+		return fmt.Sprintf("Path[%02x]", uint8(t))
+	}
+}
+
+const (
+	efiDevicePathNodeHardware efiDevicePathNodeType = 0x01
+	efiDevicePathNodeACPI                           = 0x02
+	efiDevicePathNodeMsg                            = 0x03
+	efiDevicePathNodeMedia                          = 0x04
+	efiDevicePathNodeBBS                            = 0x05
+	efiDevicePathNodeEoH                            = 0x7f
+)
+
+const (
+	efiHardwareDevicePathNodePCI = 0x01
+
+	efiACPIDevicePathNodeNormal = 0x01
+
+	efiMsgDevicePathNodeLU   = 0x11
+	efiMsgDevicePathNodeSATA = 0x12
+
+	efiMediaDevicePathNodeHardDrive      = 0x01
+	efiMediaDevicePathNodeFilePath       = 0x04
+	efiMediaDevicePathNodeFvFile         = 0x06
+	efiMediaDevicePathNodeFv             = 0x07
+	efiMediaDevicePathNodeRelOffsetRange = 0x08
+)
+
+func firmwareDevicePathNodeToString(subType uint8, data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	var name EFIGUID
+	if _, err := io.ReadFull(r, name[:]); err != nil {
+		return "", xerrors.Errorf("cannot read name: %w", err)
+	}
+
+	var builder bytes.Buffer
+	switch subType {
+	case efiMediaDevicePathNodeFvFile:
+		builder.WriteString("\\FvFile")
+	case efiMediaDevicePathNodeFv:
+		builder.WriteString("\\Fv")
+	default:
+		return "", fmt.Errorf("invalid sub type for firmware device path node: %d", subType)
+	}
+
+	fmt.Fprintf(&builder, "(%s)", name)
+	return builder.String(), nil
+}
+
+func acpiDevicePathNodeToString(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	var hid uint32
+	if err := binary.Read(r, binary.LittleEndian, &hid); err != nil {
+		return "", xerrors.Errorf("cannot read HID: %w", err)
+	}
+
+	var uid uint32
+	if err := binary.Read(r, binary.LittleEndian, &uid); err != nil {
+		return "", xerrors.Errorf("cannot read UID: %w", err)
+	}
+
+	if hid&0xffff == 0x41d0 {
+		switch hid >> 16 {
+		case 0x0a03:
+			return fmt.Sprintf("\\PciRoot(0x%x)", uid), nil
+		case 0x0a08:
+			return fmt.Sprintf("\\PcieRoot(0x%x)", uid), nil
+		case 0x0604:
+			return fmt.Sprintf("\\Floppy(0x%x)", uid), nil
+		default:
+			return fmt.Sprintf("\\Acpi(PNP%04x,0x%x)", hid>>16, uid), nil
+		}
+	} else {
+		return fmt.Sprintf("\\Acpi(0x%08x,0x%x)", hid, uid), nil
+	}
+}
+
+func pciDevicePathNodeToString(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	var function uint8
+	if err := binary.Read(r, binary.LittleEndian, &function); err != nil {
+		return "", xerrors.Errorf("cannot read function: %w", err)
+	}
+
+	var device uint8
+	if err := binary.Read(r, binary.LittleEndian, &device); err != nil {
+		return "", xerrors.Errorf("cannot read device: %w", err)
+	}
+
+	return fmt.Sprintf("\\Pci(0x%x,0x%x)", device, function), nil
+}
+
+func luDevicePathNodeToString(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	var lun uint8
+	if err := binary.Read(r, binary.LittleEndian, &lun); err != nil {
+		return "", xerrors.Errorf("cannot read LUN: %w", err)
+	}
+
+	return fmt.Sprintf("\\Unit(0x%x)", lun), nil
+}
+
+func hardDriveDevicePathNodeToString(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	var partNumber uint32
+	if err := binary.Read(r, binary.LittleEndian, &partNumber); err != nil {
+		return "", xerrors.Errorf("cannot read partition number: %w", err)
+	}
+
+	var partStart uint64
+	if err := binary.Read(r, binary.LittleEndian, &partStart); err != nil {
+		return "", xerrors.Errorf("cannot read partition start: %w", err)
+	}
+
+	var partSize uint64
+	if err := binary.Read(r, binary.LittleEndian, &partSize); err != nil {
+		return "", xerrors.Errorf("cannot read partition size: %w", err)
+	}
+
+	var sig EFIGUID
+	if _, err := io.ReadFull(r, sig[:]); err != nil {
+		return "", xerrors.Errorf("cannot read signature: %w", err)
+	}
+
+	var partFormat uint8
+	if err := binary.Read(r, binary.LittleEndian, &partFormat); err != nil {
+		return "", xerrors.Errorf("cannot read partition format: %w", err)
+	}
+
+	var sigType uint8
+	if err := binary.Read(r, binary.LittleEndian, &sigType); err != nil {
+		return "", xerrors.Errorf("cannot read signature type: %w", err)
+	}
+
+	var builder bytes.Buffer
+
+	switch sigType {
+	case 0x01:
+		fmt.Fprintf(&builder, "\\HD(%d,MBR,0x%08x,", partNumber, binary.LittleEndian.Uint32(sig[:]))
+	case 0x02:
+		fmt.Fprintf(&builder, "\\HD(%d,GPT,%s,", partNumber, sig)
+	default:
+		fmt.Fprintf(&builder, "\\HD(%d,%d,0,", partNumber, sigType)
+	}
+
+	fmt.Fprintf(&builder, "0x%016x, 0x%016x)", partStart, partSize)
+	return builder.String(), nil
+}
+
+func sataDevicePathNodeToString(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	var hbaPortNumber uint16
+	if err := binary.Read(r, binary.LittleEndian, &hbaPortNumber); err != nil {
+		return "", xerrors.Errorf("cannot read HBA port number: %w", err)
+	}
+
+	var portMultiplierPortNumber uint16
+	if err := binary.Read(r, binary.LittleEndian, &portMultiplierPortNumber); err != nil {
+		return "", xerrors.Errorf("cannot read port multiplier port number: %w", err)
+	}
+
+	var lun uint16
+	if err := binary.Read(r, binary.LittleEndian, &lun); err != nil {
+		return "", xerrors.Errorf("cannot read LUN: %w", err)
+	}
+
+	return fmt.Sprintf("\\Sata(0x%x,0x%x,0x%x)", hbaPortNumber, portMultiplierPortNumber, lun), nil
+}
+
+func filePathDevicePathNodeToString(data []byte) string {
+	u16 := make([]uint16, len(data)/2)
+	r := bytes.NewReader(data)
+	binary.Read(r, binary.LittleEndian, &u16)
+
+	var buf bytes.Buffer
+	for _, r := range utf16.Decode(u16) {
+		buf.WriteRune(r)
+	}
+	return buf.String()
+}
+
+func relOffsetRangePathNodeToString(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+
+	if _, err := r.Seek(4, io.SeekCurrent); err != nil {
+		return "", err
+	}
+
+	var start uint64
+	if err := binary.Read(r, binary.LittleEndian, &start); err != nil {
+		return "", xerrors.Errorf("cannot read start: %w", err)
+	}
+
+	var end uint64
+	if err := binary.Read(r, binary.LittleEndian, &end); err != nil {
+		return "", xerrors.Errorf("cannot read end: %w", err)
+	}
+
+	return fmt.Sprintf("\\Offset(0x%x,0x%x)", start, end), nil
+}
+
+func decodeDevicePathNode(r io.Reader) (string, error) {
+	var t efiDevicePathNodeType
+	if err := binary.Read(r, binary.LittleEndian, &t); err != nil {
+		return "", xerrors.Errorf("cannot read type: %w", err)
+	}
+
+	if t == efiDevicePathNodeEoH {
+		return "", nil
+	}
+
+	var subType uint8
+	if err := binary.Read(r, binary.LittleEndian, &subType); err != nil {
+		return "", xerrors.Errorf("cannot read sub-type: %w", err)
+	}
+
+	var length uint16
+	if err := binary.Read(r, binary.LittleEndian, &length); err != nil {
+		return "", xerrors.Errorf("cannot read length: %w", err)
+	}
+
+	if length < 4 {
+		return "", errors.New("unexpected length")
+	}
+
+	data := make([]byte, length-4)
+	if _, err := io.ReadFull(r, data); err != nil {
+		return "", xerrors.Errorf("cannot read data: %w", err)
+	}
+
+	switch t {
+	case efiDevicePathNodeMedia:
+		switch subType {
+		case efiMediaDevicePathNodeFvFile, efiMediaDevicePathNodeFv:
+			s, err := firmwareDevicePathNodeToString(subType, data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode Fv or FvFile node: %w", err)
+			}
+			return s, nil
+		case efiMediaDevicePathNodeHardDrive:
+			s, err := hardDriveDevicePathNodeToString(data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode HD node: %w", err)
+			}
+			return s, nil
+		case efiMediaDevicePathNodeFilePath:
+			return filePathDevicePathNodeToString(data), nil
+		case efiMediaDevicePathNodeRelOffsetRange:
+			s, err := relOffsetRangePathNodeToString(data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode Offset node: %w", err)
+			}
+			return s, nil
+		}
+	case efiDevicePathNodeACPI:
+		switch subType {
+		case efiACPIDevicePathNodeNormal:
+			s, err := acpiDevicePathNodeToString(data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode Acpi node: %w", err)
+			}
+			return s, nil
+		}
+	case efiDevicePathNodeHardware:
+		switch subType {
+		case efiHardwareDevicePathNodePCI:
+			s, err := pciDevicePathNodeToString(data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode Pci node: %w", err)
+			}
+			return s, nil
+		}
+	case efiDevicePathNodeMsg:
+		switch subType {
+		case efiMsgDevicePathNodeLU:
+			s, err := luDevicePathNodeToString(data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode Unit node: %w", err)
+			}
+			return s, nil
+		case efiMsgDevicePathNodeSATA:
+			s, err := sataDevicePathNodeToString(data)
+			if err != nil {
+				return "", xerrors.Errorf("cannot decode Sata node: %w", err)
+			}
+			return s, nil
+		}
+
+	}
+
+	var builder bytes.Buffer
+	fmt.Fprintf(&builder, "\\%s(%d", t, subType)
+	if len(data) > 0 {
+		fmt.Fprintf(&builder, ", 0x")
+		for _, b := range data {
+			fmt.Fprintf(&builder, "%02x", b)
+		}
+	}
+	fmt.Fprintf(&builder, ")")
+	return builder.String(), nil
+}
+
+func decodeDevicePath(data []byte) (string, error) {
+	r := bytes.NewReader(data)
+	var builder bytes.Buffer
+
+	for i := 0; ; i++ {
+		node, err := decodeDevicePathNode(r)
+		if err != nil {
+			return "", xerrors.Errorf("cannot decode node %d: %w", i, err)
+		}
+		if node == "" {
+			return builder.String(), nil
+		}
+		fmt.Fprintf(&builder, "%s", node)
+	}
+}
+
+type efiImageLoadEventData struct {
+	data             []byte
+	locationInMemory uint64
+	lengthInMemory   uint64
+	linkTimeAddress  uint64
+	path             string
+}
+
+func (e *efiImageLoadEventData) String() string {
+	return fmt.Sprintf("UEFI_IMAGE_LOAD_EVENT{ ImageLocationInMemory: 0x%016x, ImageLengthInMemory: %d, "+
+		"ImageLinkTimeAddress: 0x%016x, DevicePath: %s }", e.locationInMemory, e.lengthInMemory,
+		e.linkTimeAddress, e.path)
+}
+
+func (e *efiImageLoadEventData) Bytes() []byte {
+	return e.data
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf (section 4 "Measuring PE/COFF Image Files")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf (section 9.2.3 "UEFI_IMAGE_LOAD_EVENT Structure")
+func decodeEventDataEFIImageLoad(data []byte) (*efiImageLoadEventData, error) {
+	r := bytes.NewReader(data)
+
+	var locationInMemory uint64
+	if err := binary.Read(r, binary.LittleEndian, &locationInMemory); err != nil {
+		return nil, xerrors.Errorf("cannot read location in memory: %w", err)
+	}
+
+	var lengthInMemory uint64
+	if err := binary.Read(r, binary.LittleEndian, &lengthInMemory); err != nil {
+		return nil, xerrors.Errorf("cannot read length in memory: %w", err)
+	}
+
+	var linkTimeAddress uint64
+	if err := binary.Read(r, binary.LittleEndian, &linkTimeAddress); err != nil {
+		return nil, xerrors.Errorf("cannot read link time address: %w", err)
+	}
+
+	var devicePathLength uint64
+	if err := binary.Read(r, binary.LittleEndian, &devicePathLength); err != nil {
+		return nil, xerrors.Errorf("cannot read device path length: %w", err)
+	}
+
+	devicePathBuf := make([]byte, devicePathLength)
+
+	if _, err := io.ReadFull(r, devicePathBuf); err != nil {
+		return nil, xerrors.Errorf("cannot read device path: %w", err)
+	}
+
+	path, err := decodeDevicePath(devicePathBuf)
+	if err != nil {
+		return nil, xerrors.Errorf("cannot decode device path: %w", err)
+	}
+
+	return &efiImageLoadEventData{data: data,
+		locationInMemory: locationInMemory,
+		lengthInMemory:   lengthInMemory,
+		linkTimeAddress:  linkTimeAddress,
+		path:             path}, nil
+}
+
+type efiGPTPartitionEntry struct {
+	typeGUID   EFIGUID
+	uniqueGUID EFIGUID
+	name       string
+}
+
+func (p *efiGPTPartitionEntry) String() string {
+	return fmt.Sprintf("PartitionTypeGUID: %s, UniquePartitionGUID: %s, Name: \"%s\"", p.typeGUID, p.uniqueGUID, p.name)
+}
+
+type efiGPTEventData struct {
+	data       []byte
+	diskGUID   EFIGUID
+	partitions []*efiGPTPartitionEntry
+}
+
+func (e *efiGPTEventData) String() string {
+	var builder bytes.Buffer
+	fmt.Fprintf(&builder, "UEFI_GPT_DATA{ DiskGUID: %s, Partitions: [", e.diskGUID)
+	for i, part := range e.partitions {
+		if i > 0 {
+			fmt.Fprintf(&builder, ", ")
+		}
+		fmt.Fprintf(&builder, "{ %s }", part)
+	}
+	fmt.Fprintf(&builder, "] }")
+	return builder.String()
+}
+
+func (e *efiGPTEventData) Bytes() []byte {
+	return e.data
+}
+
+func decodeEventDataEFIGPT(data []byte) (*efiGPTEventData, error) {
+	r := bytes.NewReader(data)
+
+	// Skip UEFI_GPT_DATA.UEFIPartitionHeader.{Header, MyLBA, AlternateLBA, FirstUsableLBA, LastUsableLBA}
+	if _, err := r.Seek(56, io.SeekCurrent); err != nil {
+		return nil, err
+	}
+
+	d := &efiGPTEventData{data: data}
+
+	// UEFI_GPT_DATA.UEFIPartitionHeader.DiskGUID
+	if _, err := io.ReadFull(r, d.diskGUID[:]); err != nil {
+		return nil, xerrors.Errorf("cannot read disk GUID: %w", err)
+	}
+
+	// Skip UEFI_GPT_DATA.UEFIPartitionHeader.{PartitionEntryLBA, NumberOfPartitionEntries}
+	if _, err := r.Seek(12, io.SeekCurrent); err != nil {
+		return nil, err
+	}
+
+	// UEFI_GPT_DATA.UEFIPartitionHeader.SizeOfPartitionEntry
+	var partEntrySize uint32
+	if err := binary.Read(r, binary.LittleEndian, &partEntrySize); err != nil {
+		return nil, xerrors.Errorf("cannot read SizeOfPartitionEntry: %w", err)
+	}
+
+	// Skip UEFI_GPT_DATA.UEFIPartitionHeader.PartitionEntryArrayCRC32
+	if _, err := r.Seek(4, io.SeekCurrent); err != nil {
+		return nil, err
+	}
+
+	// UEFI_GPT_DATA.NumberOfPartitions
+	var numberOfParts uint64
+	if err := binary.Read(r, binary.LittleEndian, &numberOfParts); err != nil {
+		return nil, xerrors.Errorf("cannot read number of partitions: %w", err)
+	}
+
+	for i := uint64(0); i < numberOfParts; i++ {
+		entryData := make([]byte, partEntrySize)
+		if _, err := io.ReadFull(r, entryData); err != nil {
+			return nil, xerrors.Errorf("cannot read partition entry data: %w", err)
+		}
+
+		er := bytes.NewReader(entryData)
+		e := &efiGPTPartitionEntry{}
+
+		if _, err := io.ReadFull(er, e.typeGUID[:]); err != nil {
+			return nil, xerrors.Errorf("cannot read partition type GUID: %w", err)
+		}
+
+		if _, err := io.ReadFull(er, e.uniqueGUID[:]); err != nil {
+			return nil, xerrors.Errorf("cannot read partition unique GUID: %w", err)
+		}
+
+		// Skip UEFI_GPT_DATA.Partitions[i].{StartingLBA, EndingLBA, Attributes}
+		if _, err := er.Seek(24, io.SeekCurrent); err != nil {
+			return nil, err
+		}
+
+		nameUtf16 := make([]uint16, er.Len()/2)
+		if err := binary.Read(er, binary.LittleEndian, &nameUtf16); err != nil {
+			return nil, xerrors.Errorf("cannot read partition name: %w", err)
+		}
+
+		var name bytes.Buffer
+		for _, r := range utf16.Decode(nameUtf16) {
+			if r == rune(0) {
+				break
+			}
+			name.WriteRune(r)
+		}
+		e.name = name.String()
+
+		d.partitions = append(d.partitions, e)
+	}
+
+	return d, nil
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/eventdata.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/eventdata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/eventdata.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/eventdata.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,82 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"fmt"
+)
+
+// EventData represents all event data types that appear in a log. Some implementations of this are exported so that event data
+// contents can be inspected programatically.
+//
+// If an error is encountered when decoding the data associated with an event, the event data will implement the error interface
+// which can be used for obtaining information about the decoding error.
+type EventData interface {
+	fmt.Stringer
+
+	// Bytes returns the raw event data bytes as they appear in the event log from which this event data was decoded.
+	Bytes() []byte
+}
+
+// invalidEventData corresponds to an event data blob that failed to decode correctly.
+type invalidEventData struct {
+	data []byte
+	err  error
+}
+
+func (e *invalidEventData) String() string {
+	return fmt.Sprintf("Invalid event data: %v", e.err)
+}
+
+func (e *invalidEventData) Bytes() []byte {
+	return e.data
+}
+
+func (e *invalidEventData) Error() string {
+	return e.err.Error()
+}
+
+func (e *invalidEventData) Unwrap() error {
+	return e.err
+}
+
+// opaqueEventData is event data whose format is unknown or implementation defined.
+type opaqueEventData struct {
+	data []byte
+}
+
+func (e *opaqueEventData) String() string {
+	return ""
+}
+
+func (e *opaqueEventData) Bytes() []byte {
+	return e.data
+}
+
+func decodeEventData(pcrIndex PCRIndex, eventType EventType, digests DigestMap, data []byte, options *LogOptions) EventData {
+	if options.EnableGrub && (pcrIndex == 8 || pcrIndex == 9) {
+		if out := decodeEventDataGRUB(pcrIndex, eventType, data); out != nil {
+			return out
+		}
+	}
+
+	if options.EnableSystemdEFIStub && pcrIndex == options.SystemdEFIStubPCR {
+		if out := decodeEventDataSystemdEFIStub(eventType, data); out != nil {
+			return out
+		}
+
+	}
+
+	out, err := decodeEventDataTCG(eventType, digests, data)
+	if err != nil {
+		return &invalidEventData{data: data, err: err}
+	}
+
+	if out != nil {
+		return out
+	}
+
+	return &opaqueEventData{data: data}
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/grubeventdata.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/grubeventdata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/grubeventdata.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/grubeventdata.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,83 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"fmt"
+	"io"
+	"strings"
+)
+
+var (
+	kernelCmdlinePrefix = "kernel_cmdline: "
+	grubCmdPrefix       = "grub_cmd: "
+)
+
+// GrubStringEventType indicates the type of data measured by GRUB in to a log by GRUB.
+type GrubStringEventType int
+
+const (
+	// GrubCmd indicates that the data measured by GRUB is associated with a GRUB command.
+	GrubCmd GrubStringEventType = iota
+
+	// KernelCmdline indicates that the data measured by GRUB is associated with a kernel commandline.
+	KernelCmdline
+)
+
+func grubEventTypeString(t GrubStringEventType) string {
+	switch t {
+	case GrubCmd:
+		return "grub_cmd"
+	case KernelCmdline:
+		return "kernel_cmdline"
+	}
+	panic("invalid value")
+}
+
+// GrubStringEventData represents the data associated with an event measured by GRUB.
+type GrubStringEventData struct {
+	data []byte
+	Type GrubStringEventType
+	Str  string
+}
+
+func (e *GrubStringEventData) String() string {
+	return fmt.Sprintf("%s{ %s }", grubEventTypeString(e.Type), e.Str)
+}
+
+func (e *GrubStringEventData) Bytes() []byte {
+	return e.data
+}
+
+// EncodeMeasuredBytes encodes this data to the form that would be hashed and measured by GRUB.
+func (e *GrubStringEventData) EncodeMeasuredBytes(buf io.Writer) error {
+	if _, err := io.WriteString(buf, e.Str); err != nil {
+		return err
+	}
+	return nil
+}
+
+func decodeEventDataGRUB(pcrIndex PCRIndex, eventType EventType, data []byte) EventData {
+	if eventType != EventTypeIPL {
+		return nil
+	}
+
+	switch pcrIndex {
+	case 8:
+		str := string(data)
+		switch {
+		case strings.HasPrefix(str, kernelCmdlinePrefix):
+			return &GrubStringEventData{data, KernelCmdline, strings.TrimSuffix(strings.TrimPrefix(str, kernelCmdlinePrefix), "\x00")}
+		case strings.HasPrefix(str, grubCmdPrefix):
+			return &GrubStringEventData{data, GrubCmd, strings.TrimSuffix(strings.TrimPrefix(str, grubCmdPrefix), "\x00")}
+		default:
+			return nil
+		}
+	case 9:
+		return &asciiStringEventData{data: data}
+	default:
+		panic("unhandled PCR index")
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/LICENSE snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/LICENSE
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/LICENSE	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/LICENSE	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,191 @@
+All files in this repository are licensed as follows. If you contribute
+to this repository, it is assumed that you license your contribution
+under the same license unless you state otherwise.
+
+All files Copyright (C) 2019 Canonical Ltd. unless otherwise specified in the file.
+
+This software is licensed under the LGPLv3, included below.
+
+As a special exception to the GNU Lesser General Public License version 3
+("LGPL3"), the copyright holders of this Library give you permission to
+convey to a third party a Combined Work that links statically or dynamically
+to this Library without providing any Minimal Corresponding Source or
+Minimal Application Code as set out in 4d or providing the installation
+information set out in section 4e, provided that you comply with the other
+provisions of LGPL3 and provided that you meet, for the Application the
+terms and conditions of the license(s) which apply to the Application.
+
+Except as stated in this special exception, the provisions of LGPL3 will
+continue to comply in full to this Library. If you modify this Library, you
+may apply this exception to your version of this Library, but you are not
+obliged to do so. If you do not wish to do so, delete this exception
+statement from your version. This exception does not (and cannot) modify any
+license terms which apply to the Application, with which you must still
+comply.
+
+
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/log.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/log.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/log.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/log.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,263 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+
+	"golang.org/x/xerrors"
+)
+
+// LogOptions allows the behaviour of Log to be controlled.
+type LogOptions struct {
+	EnableGrub           bool     // Enable support for interpreting events recorded by GRUB
+	EnableSystemdEFIStub bool     // Enable support for interpreting events recorded by systemd's EFI linux loader stub
+	SystemdEFIStubPCR    PCRIndex // Specify the PCR that systemd's EFI linux loader stub measures to
+}
+
+type parser interface {
+	readNextEvent() (*Event, error)
+}
+
+func isPCRIndexInRange(index PCRIndex) bool {
+	const maxPCRIndex PCRIndex = 31
+	return index <= maxPCRIndex
+}
+
+type eventHeader_1_2 struct {
+	PCRIndex  PCRIndex
+	EventType EventType
+}
+
+type parser_1_2 struct {
+	r       io.Reader
+	options *LogOptions
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
+//  (section 11.1.1 "TCG_PCClientPCREventStruct Structure")
+func (p *parser_1_2) readNextEvent() (*Event, error) {
+	var header eventHeader_1_2
+	if err := binary.Read(p.r, binary.LittleEndian, &header); err != nil {
+		if err == io.EOF {
+			return nil, err
+		}
+		return nil, xerrors.Errorf("cannot read event header: %w", err)
+	}
+
+	if !isPCRIndexInRange(header.PCRIndex) {
+		return nil, fmt.Errorf("log entry has an out-of-range PCR index (%d)", header.PCRIndex)
+	}
+
+	digest := make(Digest, AlgorithmSha1.Size())
+	if _, err := p.r.Read(digest); err != nil {
+		return nil, xerrors.Errorf("cannot read SHA-1 digest: %w", err)
+	}
+	digests := make(DigestMap)
+	digests[AlgorithmSha1] = digest
+
+	var eventSize uint32
+	if err := binary.Read(p.r, binary.LittleEndian, &eventSize); err != nil {
+		return nil, xerrors.Errorf("cannot read event size: %w", err)
+	}
+
+	event := make([]byte, eventSize)
+	if _, err := io.ReadFull(p.r, event); err != nil {
+		return nil, xerrors.Errorf("cannot read event data: %w", err)
+	}
+
+	return &Event{
+		PCRIndex:  header.PCRIndex,
+		EventType: header.EventType,
+		Digests:   digests,
+		Data:      decodeEventData(header.PCRIndex, header.EventType, digests, event, p.options),
+	}, nil
+}
+
+type eventHeader_2 struct {
+	PCRIndex  PCRIndex
+	EventType EventType
+	Count     uint32
+}
+
+type parser_2 struct {
+	r        io.Reader
+	options  *LogOptions
+	algSizes []EFISpecIdEventAlgorithmSize
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+//  (section 9.2.2 "TCG_PCR_EVENT2 Structure")
+func (p *parser_2) readNextEvent() (*Event, error) {
+	var header eventHeader_2
+	if err := binary.Read(p.r, binary.LittleEndian, &header); err != nil {
+		if err == io.EOF {
+			return nil, err
+		}
+		return nil, xerrors.Errorf("cannot read event header: %w", err)
+	}
+
+	if !isPCRIndexInRange(header.PCRIndex) {
+		return nil, fmt.Errorf("log entry has an out-of-range PCR index (%d)", header.PCRIndex)
+	}
+
+	digests := make(DigestMap)
+
+	for i := uint32(0); i < header.Count; i++ {
+		var algorithmId AlgorithmId
+		if err := binary.Read(p.r, binary.LittleEndian, &algorithmId); err != nil {
+			return nil, xerrors.Errorf("cannot read algorithm ID: %w", err)
+		}
+
+		var digestSize uint16
+		var j int
+		for j = 0; j < len(p.algSizes); j++ {
+			if p.algSizes[j].AlgorithmId == algorithmId {
+				digestSize = p.algSizes[j].DigestSize
+				break
+			}
+		}
+
+		if j == len(p.algSizes) {
+			return nil, fmt.Errorf("event contains a digest for an unrecognized algorithm (%v)", algorithmId)
+		}
+
+		digest := make(Digest, digestSize)
+		if _, err := io.ReadFull(p.r, digest); err != nil {
+			return nil, xerrors.Errorf("cannot read digest for algorithm %v: %w", algorithmId, err)
+		}
+
+		if _, exists := digests[algorithmId]; exists {
+			return nil, fmt.Errorf("event contains more than one digest value for algorithm %v", algorithmId)
+		}
+		digests[algorithmId] = digest
+	}
+
+	for _, s := range p.algSizes {
+		if _, exists := digests[s.AlgorithmId]; !exists {
+			return nil, fmt.Errorf("event is missing a digest value for algorithm %v", s.AlgorithmId)
+		}
+	}
+
+	for alg, _ := range digests {
+		if alg.supported() {
+			continue
+		}
+		delete(digests, alg)
+	}
+
+	var eventSize uint32
+	if err := binary.Read(p.r, binary.LittleEndian, &eventSize); err != nil {
+		return nil, xerrors.Errorf("cannot read event size: %w", err)
+	}
+
+	event := make([]byte, eventSize)
+	if _, err := io.ReadFull(p.r, event); err != nil {
+		return nil, xerrors.Errorf("cannot read event data: %w", err)
+	}
+
+	return &Event{
+		PCRIndex:  header.PCRIndex,
+		EventType: header.EventType,
+		Digests:   digests,
+		Data:      decodeEventData(header.PCRIndex, header.EventType, digests, event, p.options),
+	}, nil
+}
+
+func fixupSpecIdEvent(event *Event, algorithms AlgorithmIdList) {
+	if event.Data.(*SpecIdEvent).Spec != SpecEFI_2 {
+		return
+	}
+
+	for _, alg := range algorithms {
+		if alg == AlgorithmSha1 {
+			continue
+		}
+
+		if _, ok := event.Digests[alg]; ok {
+			continue
+		}
+
+		event.Digests[alg] = make(Digest, alg.Size())
+	}
+}
+
+func isSpecIdEvent(event *Event) (out bool) {
+	_, out = event.Data.(*SpecIdEvent)
+	return
+}
+
+// Log corresponds to a parsed event log.
+type Log struct {
+	Spec       Spec            // The specification to which this log conforms
+	Algorithms AlgorithmIdList // The digest algorithms that appear in the log
+	Events     []*Event        // The list of events in the log
+}
+
+// ParseLog parses an event log read from r, using the supplied options. If an error occurs during parsing, this may return an
+// incomplete list of events with the error.
+func ParseLog(r io.Reader, options *LogOptions) (*Log, error) {
+	var parser parser = &parser_1_2{r: r, options: options}
+	event, err := parser.readNextEvent()
+	if err != nil {
+		return nil, err
+	}
+
+	var spec Spec = SpecUnknown
+	var digestSizes []EFISpecIdEventAlgorithmSize
+
+	switch d := event.Data.(type) {
+	case *SpecIdEvent:
+		spec = d.Spec
+		digestSizes = d.DigestSizes
+	}
+
+	var algorithms AlgorithmIdList
+
+	if spec == SpecEFI_2 {
+		for _, s := range digestSizes {
+			if s.AlgorithmId.supported() {
+				algorithms = append(algorithms, s.AlgorithmId)
+			}
+		}
+		parser = &parser_2{r: r,
+			options:  options,
+			algSizes: digestSizes}
+	} else {
+		algorithms = AlgorithmIdList{AlgorithmSha1}
+	}
+
+	indexTracker := make(map[PCRIndex]uint)
+	populateEventIndex := func(event *Event) {
+		var index uint
+		if i, ok := indexTracker[event.PCRIndex]; ok {
+			index = i
+		}
+		event.Index = index
+		indexTracker[event.PCRIndex] = index + 1
+	}
+
+	populateEventIndex(event)
+	if isSpecIdEvent(event) {
+		fixupSpecIdEvent(event, algorithms)
+	}
+
+	log := &Log{Spec: spec, Algorithms: algorithms, Events: []*Event{event}}
+
+	for {
+		event, err := parser.readNextEvent()
+		switch {
+		case err == io.EOF:
+			return log, nil
+		case err != nil:
+			return log, err
+		default:
+			populateEventIndex(event)
+			log.Events = append(log.Events, event)
+		}
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/README.md snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/README.md
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/README.md	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/README.md	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,11 @@
+# TCG Log Parser
+
+This repository contains a go library for parsing TCG event logs. Also included is a simple command line tool that prints details of log entries to the console.
+
+## Relevant specifications
+
+* [TCG PC Client Platform Firmware Profile Specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf)
+* [TCG EFI Platform Specification For TPM Family 1.1 or 1.2](https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf)
+* [TCG PC Client Specific Implementation Specification for Conventional BIOS](https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf)
+* [Unified Extensible Firmware Interface (UEFI) Specification](https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf)
+* [Platform Initialization (PI) Specification](https://uefi.org/sites/default/files/resources/PI_Spec_1_6.pdf)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/sdefistub.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/sdefistub.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/sdefistub.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/sdefistub.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,51 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+)
+
+// SystemdEFIStubEventData represents the data associated with a kernel commandline measured by the systemd EFI stub linux loader.
+type SystemdEFIStubEventData struct {
+	data []byte
+	Str  string
+}
+
+func (e *SystemdEFIStubEventData) String() string {
+	return fmt.Sprintf("%s", e.Str)
+}
+
+func (e *SystemdEFIStubEventData) Bytes() []byte {
+	return e.data
+}
+
+// EncodeMeasured bytes encodes this data to the form that would be hashed and measured by the systemd EFI stub linux loader for the
+// specified kernel commandline. Note that it assumes that the calling bootloader includes a UTF-16 NULL terminator at the end of
+// LoadOptions, and sets LoadOptionsSize to StrLen(LoadOptions)+1
+func (e *SystemdEFIStubEventData) EncodeMeasuredBytes(w io.Writer) error {
+	// Both GRUB's chainloader and systemd's EFI bootloader include a UTF-16 NULL terminator at the end of LoadOptions and
+	// set LoadOptionsSize to StrLen(LoadOptions)+1. The EFI stub loader measures LoadOptionsSize number of bytes, meaning that
+	// the 2 NULL bytes are measured. Include those here.
+	return binary.Write(w, binary.LittleEndian, append(convertStringToUtf16(e.Str), 0))
+}
+
+func decodeEventDataSystemdEFIStub(eventType EventType, data []byte) EventData {
+	if eventType != EventTypeIPL {
+		return nil
+	}
+
+	// data is a UTF-16 string in little-endian form terminated with a single zero byte.
+	// Omit the zero byte added by the EFI stub and then convert to native byte order.
+	reader := bytes.NewReader(data[:len(data)-1])
+
+	utf16Str := make([]uint16, len(data)/2)
+	binary.Read(reader, binary.LittleEndian, &utf16Str)
+
+	return &SystemdEFIStubEventData{data: data, Str: convertUtf16ToString(utf16Str)}
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/tcgeventdata.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/tcgeventdata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/tcgeventdata.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/tcgeventdata.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,324 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"math"
+	"strings"
+	"unsafe"
+
+	"golang.org/x/xerrors"
+)
+
+type invalidSpecIdEventError struct {
+	err error
+}
+
+func (e invalidSpecIdEventError) Error() string {
+	return e.err.Error()
+}
+
+func (e invalidSpecIdEventError) Unwrap() error {
+	return e.err
+}
+
+// EFISpecIdEventAlgorithmSize represents a digest algorithm and its length and corresponds to the
+// TCG_EfiSpecIdEventAlgorithmSize type.
+type EFISpecIdEventAlgorithmSize struct {
+	AlgorithmId AlgorithmId
+	DigestSize  uint16
+}
+
+// NoActionEventType corresponds to the type of a EV_NO_ACTION event.
+type NoActionEventType int
+
+const (
+	UnknownNoActionEvent     NoActionEventType = iota // Unknown EV_NO_ACTION event type
+	SpecId                                            // "Spec ID Event00", "Spec ID Event02" or "Spec ID Event03" event type
+	StartupLocality                                   // "StartupLocality" event type
+	BiosIntegrityMeasurement                          // "SP800-155 Event" event type
+)
+
+// NoActionEventData provides a mechanism to determine the type of a EV_NO_ACTION event from the decoded EventData.
+type NoActionEventData interface {
+	Type() NoActionEventType
+	Spec() string
+}
+
+// SpecIdEvent corresponds to the TCG_PCClientSpecIdEventStruct, TCG_EfiSpecIdEventStruct, and TCG_EfiSpecIdEvent types and is the
+// event data for a Specification ID Version EV_NO_ACTION event.
+type SpecIdEvent struct {
+	data      []byte
+	signature string
+	Spec             Spec
+	PlatformClass    uint32
+	SpecVersionMinor uint8
+	SpecVersionMajor uint8
+	SpecErrata       uint8
+	UintnSize        uint8
+	DigestSizes      []EFISpecIdEventAlgorithmSize // The digest algorithms contained within this log
+	VendorInfo       []byte
+}
+
+func (e *SpecIdEvent) String() string {
+	var builder bytes.Buffer
+	switch e.Spec {
+	case SpecPCClient:
+		builder.WriteString("PCClientSpecIdEvent")
+	case SpecEFI_1_2, SpecEFI_2:
+		builder.WriteString("EfiSpecIDEvent")
+	}
+
+	fmt.Fprintf(&builder, "{ spec=%d, platformClass=%d, specVersionMinor=%d, specVersionMajor=%d, "+
+		"specErrata=%d", e.Spec, e.PlatformClass, e.SpecVersionMinor, e.SpecVersionMajor, e.SpecErrata)
+	if e.Spec == SpecEFI_2 {
+		builder.WriteString(", digestSizes=[")
+		for i, algSize := range e.DigestSizes {
+			if i > 0 {
+				builder.WriteString(", ")
+			}
+			fmt.Fprintf(&builder, "{ algorithmId=0x%04x, digestSize=%d }",
+				uint16(algSize.AlgorithmId), algSize.DigestSize)
+		}
+		builder.WriteString("]")
+	}
+	builder.WriteString(" }")
+	return builder.String()
+}
+
+func (e *SpecIdEvent) Bytes() []byte {
+	return e.data
+}
+
+func (e *SpecIdEvent) Type() NoActionEventType {
+	return SpecId
+}
+
+func (e *SpecIdEvent) Signature() string {
+	return e.signature
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
+//  (section 11.3.4.1 "Specification Event")
+func parsePCClientSpecIdEvent(r io.Reader, eventData *SpecIdEvent) error {
+	eventData.Spec = SpecPCClient
+
+	// TCG_PCClientSpecIdEventStruct.vendorInfoSize
+	var vendorInfoSize uint8
+	if err := binary.Read(r, binary.LittleEndian, &vendorInfoSize); err != nil {
+		return xerrors.Errorf("cannot read vendor info size: %w", err)
+	}
+
+	// TCG_PCClientSpecIdEventStruct.vendorInfo
+	eventData.VendorInfo = make([]byte, vendorInfoSize)
+	if _, err := io.ReadFull(r, eventData.VendorInfo); err != nil {
+		return xerrors.Errorf("cannot read vendor info: %w", err)
+	}
+
+	return nil
+}
+
+type specIdEventCommon struct {
+	PlatformClass    uint32
+	SpecVersionMinor uint8
+	SpecVersionMajor uint8
+	SpecErrata       uint8
+	UintnSize        uint8
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
+//  (section 11.3.4.1 "Specification Event")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
+//  (section 7.4 "EV_NO_ACTION Event Types")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+//  (secion 9.4.5.1 "Specification ID Version Event")
+func decodeSpecIdEvent(r io.Reader, signature string, data []byte, helper func(io.Reader, *SpecIdEvent) error) (*SpecIdEvent, error) {
+	var common struct {
+		PlatformClass    uint32
+		SpecVersionMinor uint8
+		SpecVersionMajor uint8
+		SpecErrata       uint8
+		UintnSize        uint8
+	}
+	if err := binary.Read(r, binary.LittleEndian, &common); err != nil {
+		return nil, invalidSpecIdEventError{xerrors.Errorf("cannot read common fields: %w", err)}
+	}
+
+	eventData := &SpecIdEvent{
+		data:      data,
+		signature: signature,
+		PlatformClass:    common.PlatformClass,
+		SpecVersionMinor: common.SpecVersionMinor,
+		SpecVersionMajor: common.SpecVersionMajor,
+		SpecErrata:       common.SpecErrata,
+		UintnSize:        common.UintnSize}
+
+	if err := helper(r, eventData); err != nil {
+		return nil, invalidSpecIdEventError{err}
+	}
+
+	return eventData, nil
+}
+
+var (
+	validNormalSeparatorValues = [...]uint32{0, math.MaxUint32}
+)
+
+// asciiStringEventData corresponds to event data that is an ASCII string. The event data may be informational (it provides a hint
+// as to what was measured as opposed to representing what was measured).
+type asciiStringEventData struct {
+	data []byte
+}
+
+func (e *asciiStringEventData) String() string {
+	return *(*string)(unsafe.Pointer(&e.data))
+}
+
+func (e *asciiStringEventData) Bytes() []byte {
+	return e.data
+}
+
+// unknownNoActionEventData is the event data for a EV_NO_ACTION event with an unrecognized type.
+type unknownNoActionEventData struct {
+	data      []byte
+	signature string
+}
+
+func (e *unknownNoActionEventData) String() string {
+	return ""
+}
+
+func (e *unknownNoActionEventData) Bytes() []byte {
+	return e.data
+}
+
+func (e *unknownNoActionEventData) Type() NoActionEventType {
+	return UnknownNoActionEvent
+}
+
+func (e *unknownNoActionEventData) Signature() string {
+	return e.signature
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
+//  (section 11.3.4 "EV_NO_ACTION Event Types")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
+//  (section 9.4.5 "EV_NO_ACTION Event Types")
+func decodeEventDataNoAction(data []byte) (EventData, error) {
+	r := bytes.NewReader(data)
+
+	// Signature field
+	var sig [16]byte
+	if _, err := io.ReadFull(r, sig[:]); err != nil {
+		return nil, xerrors.Errorf("cannot read signature: %w", err)
+	}
+	signature := strings.TrimRight(string(sig[:]), "\x00")
+
+	switch signature {
+	case "Spec ID Event00":
+		out, err := decodeSpecIdEvent(r, signature, data, parsePCClientSpecIdEvent)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot decode Spec ID Event00 data: %w", err)
+		}
+		return out, nil
+	case "Spec ID Event02":
+		out, err := decodeSpecIdEvent(r, signature, data, parseEFI_1_2_SpecIdEvent)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot decode Spec ID Event02 data: %w", err)
+		}
+		return out, nil
+	case "Spec ID Event03":
+		out, err := decodeSpecIdEvent(r, signature, data, parseEFI_2_SpecIdEvent)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot decode Spec ID Event03 data: %w", err)
+		}
+		return out, nil
+	case "SP800-155 Event":
+		out, err := decodeBIMReferenceManifestEvent(r, signature, data)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot decode SP800-155 Event data: %w", err)
+		}
+		return out, nil
+	case "StartupLocality":
+		out, err := decodeStartupLocalityEvent(r, signature, data)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot decode StartupLocality data: %w", err)
+		}
+		return out, nil
+	default:
+		return &unknownNoActionEventData{data: data, signature: signature}, nil
+	}
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf (section 11.3.3 "EV_ACTION event types")
+// https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf (section 9.4.3 "EV_ACTION Event Types")
+func decodeEventDataAction(data []byte) *asciiStringEventData {
+	return &asciiStringEventData{data: data}
+}
+
+// SeparatorEventData is the event data associated with a EV_SEPARATOR event.
+type SeparatorEventData struct {
+	data    []byte
+	IsError bool // The event indicates an error condition
+}
+
+func (e *SeparatorEventData) String() string {
+	if !e.IsError {
+		return ""
+	}
+	return "*ERROR*"
+}
+
+func (e *SeparatorEventData) Bytes() []byte {
+	return e.data
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
+//  (section 3.3.2.2 2 Error Conditions" , section 8.2.3 "Measuring Boot Events")
+// https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf:
+//  (section 2.3.2 "Error Conditions", section 2.3.4 "PCR Usage", section 7.2
+//   "Procedure for Pre-OS to OS-Present Transition")
+func decodeEventDataSeparator(digests DigestMap, data []byte) *SeparatorEventData {
+	errorValue := make([]byte, 4)
+	binary.LittleEndian.PutUint32(errorValue, SeparatorEventErrorValue)
+
+	var isError bool
+	for alg, digest := range digests {
+		isError = bytes.Equal(digest, alg.hash(errorValue))
+		break
+	}
+
+	return &SeparatorEventData{data: data, IsError: isError}
+}
+
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf (section 11.3.1 "Event Types")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf (section 7.2 "Event Types")
+// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf (section 9.4.1 "Event Types")
+func decodeEventDataTCG(eventType EventType, digests DigestMap, data []byte) (out EventData, err error) {
+	switch eventType {
+	case EventTypeNoAction:
+		out, err = decodeEventDataNoAction(data)
+	case EventTypeSeparator:
+		return decodeEventDataSeparator(digests, data), nil
+	case EventTypeAction, EventTypeEFIAction:
+		return decodeEventDataAction(data), nil
+	case EventTypeEFIVariableDriverConfig, EventTypeEFIVariableBoot, EventTypeEFIVariableAuthority:
+		out, err = decodeEventDataEFIVariable(data, eventType)
+	case EventTypeEFIBootServicesApplication, EventTypeEFIBootServicesDriver, EventTypeEFIRuntimeServicesDriver:
+		out, err = decodeEventDataEFIImageLoad(data)
+	case EventTypeEFIGPTEvent:
+		out, err = decodeEventDataEFIGPT(data)
+	default:
+	}
+
+	if err != nil {
+		err = xerrors.Errorf("cannot decode %v event data: %w", eventType, err)
+	}
+	return
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/types.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/types.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/types.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/types.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,181 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"crypto"
+	_ "crypto/sha1"
+	_ "crypto/sha256"
+	_ "crypto/sha512"
+	"fmt"
+)
+
+// Spec corresponds to the TCG specification that an event log conforms to.
+type Spec uint
+
+// PCRIndex corresponds to the index of a PCR on the TPM.
+type PCRIndex uint32
+
+// EventType corresponds to the type of an event in an event log.
+type EventType uint32
+
+// AlgorithmId corresponds to the algorithm of digests that appear in the log. The values are in sync with those
+// in the TPM Library Specification for the TPM_ALG_ID type.
+// See https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf (Table 9)
+type AlgorithmId uint16
+
+func (a AlgorithmId) GetHash() crypto.Hash {
+	switch a {
+	case AlgorithmSha1:
+		return crypto.SHA1
+	case AlgorithmSha256:
+		return crypto.SHA256
+	case AlgorithmSha384:
+		return crypto.SHA384
+	case AlgorithmSha512:
+		return crypto.SHA512
+	default:
+		return 0
+	}
+}
+
+func (a AlgorithmId) supported() bool {
+	return a.GetHash() != crypto.Hash(0)
+}
+
+func (a AlgorithmId) Size() int {
+	return a.GetHash().Size()
+}
+
+func (a AlgorithmId) hash(data []byte) []byte {
+	h := a.GetHash().New()
+	h.Write(data)
+	return h.Sum(nil)
+}
+
+// Digest is the result of hashing some data.
+type Digest []byte
+
+// DigestMap is a map of algorithms to digests.
+type DigestMap map[AlgorithmId]Digest
+
+func (e EventType) String() string {
+	switch e {
+	case EventTypePrebootCert:
+		return "EV_PREBOOT_CERT"
+	case EventTypePostCode:
+		return "EV_POST_CODE"
+	case EventTypeNoAction:
+		return "EV_NO_ACTION"
+	case EventTypeSeparator:
+		return "EV_SEPARATOR"
+	case EventTypeAction:
+		return "EV_ACTION"
+	case EventTypeEventTag:
+		return "EV_EVENT_TAG"
+	case EventTypeSCRTMContents:
+		return "EV_S_CRTM_CONTENTS"
+	case EventTypeSCRTMVersion:
+		return "EV_S_CRTM_VERSION"
+	case EventTypeCPUMicrocode:
+		return "EV_CPU_MICROCODE"
+	case EventTypePlatformConfigFlags:
+		return "EV_PLATFORM_CONFIG_FLAGS"
+	case EventTypeTableOfDevices:
+		return "EV_TABLE_OF_DEVICES"
+	case EventTypeCompactHash:
+		return "EV_COMPACT_HASH"
+	case EventTypeIPL:
+		return "EV_IPL"
+	case EventTypeIPLPartitionData:
+		return "EV_IPL_PARTITION_DATA"
+	case EventTypeNonhostCode:
+		return "EV_NONHOST_CODE"
+	case EventTypeNonhostConfig:
+		return "EV_NONHOST_CONFIG"
+	case EventTypeNonhostInfo:
+		return "EV_NONHOST_INFO"
+	case EventTypeOmitBootDeviceEvents:
+		return "EV_OMIT_BOOT_DEVICE_EVENTS"
+	case EventTypeEFIVariableDriverConfig:
+		return "EV_EFI_VARIABLE_DRIVER_CONFIG"
+	case EventTypeEFIVariableBoot:
+		return "EV_EFI_VARIABLE_BOOT"
+	case EventTypeEFIBootServicesApplication:
+		return "EV_EFI_BOOT_SERVICES_APPLICATION"
+	case EventTypeEFIBootServicesDriver:
+		return "EV_EFI_BOOT_SERVICES_DRIVER"
+	case EventTypeEFIRuntimeServicesDriver:
+		return "EV_EFI_RUNTIME_SERVICES_DRIVER"
+	case EventTypeEFIGPTEvent:
+		return "EF_EFI_GPT_EVENT"
+	case EventTypeEFIAction:
+		return "EV_EFI_ACTION"
+	case EventTypeEFIPlatformFirmwareBlob:
+		return "EV_EFI_PLATFORM_FIRMWARE_BLOB"
+	case EventTypeEFIHandoffTables:
+		return "EV_EFI_HANDOFF_TABLES"
+	case EventTypeEFIHCRTMEvent:
+		return "EV_EFI_HCRTM_EVENT"
+	case EventTypeEFIVariableAuthority:
+		return "EV_EFI_VARIABLE_AUTHORITY"
+	default:
+		return fmt.Sprintf("%08x", uint32(e))
+	}
+}
+
+func (e EventType) Format(s fmt.State, f rune) {
+	switch f {
+	case 's', 'v':
+		fmt.Fprintf(s, "%s", e.String())
+	default:
+		fmt.Fprintf(s, makeDefaultFormatter(s, f), uint32(e))
+	}
+}
+
+func (a AlgorithmId) String() string {
+	switch a {
+	case AlgorithmSha1:
+		return "SHA-1"
+	case AlgorithmSha256:
+		return "SHA-256"
+	case AlgorithmSha384:
+		return "SHA-384"
+	case AlgorithmSha512:
+		return "SHA-512"
+	default:
+		return fmt.Sprintf("%04x", uint16(a))
+	}
+}
+
+func (a AlgorithmId) Format(s fmt.State, f rune) {
+	switch f {
+	case 's', 'v':
+		fmt.Fprintf(s, "%s", a.String())
+	default:
+		fmt.Fprintf(s, makeDefaultFormatter(s, f), uint16(a))
+	}
+}
+
+// AlgorithmListId is a slice of AlgorithmId values,
+type AlgorithmIdList []AlgorithmId
+
+func (l AlgorithmIdList) Contains(a AlgorithmId) bool {
+	for _, alg := range l {
+		if alg == a {
+			return true
+		}
+	}
+	return false
+}
+
+// Event corresponds to a single event in an event log.
+type Event struct {
+	Index     uint      // Sequential index of event in the log
+	PCRIndex  PCRIndex  // PCR index to which this event was measured
+	EventType EventType // The type of this event
+	Digests   DigestMap // The digests corresponding to this event for the supported algorithms
+	Data      EventData // The data recorded with this event
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/utils.go snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/utils.go
--- snapd-2.45.1+20.04.2/vendor/github.com/canonical/tcglog-parser/utils.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/canonical/tcglog-parser/utils.go	2020-11-05 20:12:59.000000000 +0000
@@ -0,0 +1,50 @@
+// Copyright 2019 Canonical Ltd.
+// Licensed under the LGPLv3 with static-linking exception.
+// See LICENCE file for details.
+
+package tcglog
+
+import (
+	"bytes"
+	"fmt"
+	"unicode/utf16"
+	"unicode/utf8"
+)
+
+func makeDefaultFormatter(s fmt.State, f rune) string {
+	var builder bytes.Buffer
+	builder.WriteString("%%")
+	for _, flag := range [...]int{'+', '-', '#', ' ', '0'} {
+		if s.Flag(flag) {
+			fmt.Fprintf(&builder, "%c", flag)
+		}
+	}
+	if width, ok := s.Width(); ok {
+		fmt.Fprintf(&builder, "%d", width)
+	}
+	if prec, ok := s.Precision(); ok {
+		fmt.Fprintf(&builder, ".%d", prec)
+	}
+	fmt.Fprintf(&builder, "%c", f)
+	return builder.String()
+}
+
+func convertStringToUtf16(str string) []uint16 {
+	var unicodePoints []rune
+	for len(str) > 0 {
+		r, s := utf8.DecodeRuneInString(str)
+		unicodePoints = append(unicodePoints, r)
+		str = str[s:]
+	}
+	return utf16.Encode(unicodePoints)
+}
+
+func convertUtf16ToString(u []uint16) string {
+	var utf8Str []byte
+	for _, r := range utf16.Decode(u) {
+		utf8Char := make([]byte, utf8.RuneLen(r))
+		utf8.EncodeRune(utf8Char, r)
+		utf8Str = append(utf8Str, utf8Char...)
+	}
+	return string(utf8Str)
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/constants.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/constants.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/constants.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/constants.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,67 +0,0 @@
-package tcglog
-
-const (
-	EventTypePrebootCert EventType = 0x00000000 // EV_PREBOOT_CERT
-	EventTypePostCode    EventType = 0x00000001 // EV_POST_CODE
-	// EventTypeUnused = 0x00000002
-	EventTypeNoAction             EventType = 0x00000003 // EV_NO_ACTION
-	EventTypeSeparator            EventType = 0x00000004 // EV_SEPARATOR
-	EventTypeAction               EventType = 0x00000005 // EV_ACTION
-	EventTypeEventTag             EventType = 0x00000006 // EV_EVENT_TAG
-	EventTypeSCRTMContents        EventType = 0x00000007 // EV_S_CRTM_CONTENTS
-	EventTypeSCRTMVersion         EventType = 0x00000008 // EV_S_CRTM_VERSION
-	EventTypeCPUMicrocode         EventType = 0x00000009 // EV_CPU_MICROCODE
-	EventTypePlatformConfigFlags  EventType = 0x0000000a // EV_PLATFORM_CONFIG_FLAGS
-	EventTypeTableOfDevices       EventType = 0x0000000b // EV_TABLE_OF_DEVICES
-	EventTypeCompactHash          EventType = 0x0000000c // EV_COMPACT_HASH
-	EventTypeIPL                  EventType = 0x0000000d // EV_IPL
-	EventTypeIPLPartitionData     EventType = 0x0000000e // EV_IPL_PARTITION_DATA
-	EventTypeNonhostCode          EventType = 0x0000000f // EV_NONHOST_CODE
-	EventTypeNonhostConfig        EventType = 0x00000010 // EV_NONHOST_CONFIG
-	EventTypeNonhostInfo          EventType = 0x00000011 // EV_NONHOST_INFO
-	EventTypeOmitBootDeviceEvents EventType = 0x00000012 // EV_OMIT_BOOT_DEVICE_EVENTS
-
-	EventTypeEFIEventBase               EventType = 0x80000000 // EV_EFI_EVENT_BASE
-	EventTypeEFIVariableDriverConfig    EventType = 0x80000001 // EV_EFI_VARIABLE_DRIVER_CONFIG
-	EventTypeEFIVariableBoot            EventType = 0x80000002 // EV_EFI_VARIABLE_BOOT
-	EventTypeEFIBootServicesApplication EventType = 0x80000003 // EV_EFI_BOOT_SERVICES_APPLICATION
-	EventTypeEFIBootServicesDriver      EventType = 0x80000004 // EV_EFI_BOOT_SERVICES_DRIVER
-	EventTypeEFIRuntimeServicesDriver   EventType = 0x80000005 // EV_EFI_RUNTIME_SERVICES_DRIVER
-	EventTypeEFIGPTEvent                EventType = 0x80000006 // EV_EFI_GPT_EVENT
-	EventTypeEFIAction                  EventType = 0x80000007 // EV_EFI_ACTION
-	EventTypeEFIPlatformFirmwareBlob    EventType = 0x80000008 // EV_EFI_PLATFORM_FIRMWARE_BLOB
-	EventTypeEFIHandoffTables           EventType = 0x80000009 // EF_EFI_HANDOFF_TABLES
-	EventTypeEFIHCRTMEvent              EventType = 0x80000010 // EF_EFI_HCRTM_EVENT
-	EventTypeEFIVariableAuthority       EventType = 0x800000e0 // EV_EFI_VARIABLE_AUTHORITY
-)
-
-const (
-	AlgorithmSha1   AlgorithmId = 0x0004 // TPM_ALG_SHA1
-	AlgorithmSha256 AlgorithmId = 0x000b // TPM_ALG_SHA256
-	AlgorithmSha384 AlgorithmId = 0x000c // TPM_ALG_SHA384
-	AlgorithmSha512 AlgorithmId = 0x000d // TPM_ALG_SHA512
-)
-
-const (
-	// SpecUnknown indicates that the specification to which the log conforms is unknown because it doesn't
-	// start with a spec ID event.
-	SpecUnknown Spec = iota
-
-	// SpecPCClient indicates that the log conforms to "TCG PC Client Specific Implementation Specification
-	// for Conventional BIOS".
-	// See https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
-	SpecPCClient
-
-	// SpecEFI_1_2 indicates that the log conforms to "TCG EFI Platform Specification For TPM Family 1.1 or
-	// 1.2".
-	// See https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
-	SpecEFI_1_2
-
-	// SpecEFI_2 indicates that the log conforms to "TCG PC Client Platform Firmware Profile Specification"
-	// See https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-	SpecEFI_2
-)
-
-const (
-	separatorEventErrorValue uint32 = 1
-)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/efi.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/efi.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/efi.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/efi.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,782 +0,0 @@
-package tcglog
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"io"
-	"unicode/utf16"
-	"unicode/utf8"
-)
-
-var (
-	surr1 uint16 = 0xd800
-	surr2 uint16 = 0xdc00
-	surr3 uint16 = 0xe000
-)
-
-// UEFI_VARIABLE_DATA specifies the number of *characters* for a UTF-16 sequence rather than the size of
-// the buffer. Extract a UTF-16 sequence of the correct length, given a buffer and the number of characters.
-// The returned buffer can be passed to utf16.Decode.
-func extractUTF16Buffer(stream io.ReadSeeker, nchars uint64) ([]uint16, error) {
-	var out []uint16
-
-	for i := nchars; i > 0; i-- {
-		var c uint16
-		if err := binary.Read(stream, binary.LittleEndian, &c); err != nil {
-			return nil, err
-		}
-		out = append(out, c)
-		if c >= surr1 && c < surr2 {
-			if err := binary.Read(stream, binary.LittleEndian, &c); err != nil {
-				return nil, err
-			}
-			if c < surr2 || c >= surr3 {
-				// Invalid surrogate sequence. utf16.Decode doesn't consume this
-				// byte when inserting the replacement char
-				if _, err := stream.Seek(-1, io.SeekCurrent); err != nil {
-					return nil, err
-				}
-				continue
-			}
-			// Valid surrogate sequence
-			out = append(out, c)
-		}
-	}
-
-	return out, nil
-}
-
-// EFIGUID corresponds to the EFI_GUID type
-type EFIGUID struct {
-	Data1 uint32
-	Data2 uint16
-	Data3 uint16
-	Data4 [8]uint8
-}
-
-func (g *EFIGUID) String() string {
-	return fmt.Sprintf("{%08x-%04x-%04x-%04x-%012x}", g.Data1, g.Data2, g.Data3, binary.BigEndian.Uint16(g.Data4[0:2]), g.Data4[2:])
-}
-
-func NewEFIGUID(a uint32, b, c, d uint16, e [6]uint8) *EFIGUID {
-	guid := &EFIGUID{Data1: a, Data2: b, Data3: c}
-	binary.BigEndian.PutUint16(guid.Data4[0:2], d)
-	copy(guid.Data4[2:], e[:])
-	return guid
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
-//  (section 7.4 "EV_NO_ACTION Event Types")
-func parseEFI_1_2_SpecIdEvent(stream io.Reader, eventData *SpecIdEventData) error {
-	eventData.Spec = SpecEFI_1_2
-
-	// TCG_EfiSpecIdEventStruct.vendorInfoSize
-	var vendorInfoSize uint8
-	if err := binary.Read(stream, binary.LittleEndian, &vendorInfoSize); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	// TCG_EfiSpecIdEventStruct.vendorInfo
-	eventData.VendorInfo = make([]byte, vendorInfoSize)
-	if _, err := io.ReadFull(stream, eventData.VendorInfo); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	return nil
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-//  (secion 9.4.5.1 "Specification ID Version Event")
-func parseEFI_2_SpecIdEvent(stream io.Reader, eventData *SpecIdEventData) error {
-	eventData.Spec = SpecEFI_2
-
-	// TCG_EfiSpecIdEvent.numberOfAlgorithms
-	var numberOfAlgorithms uint32
-	if err := binary.Read(stream, binary.LittleEndian, &numberOfAlgorithms); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	if numberOfAlgorithms < 1 {
-		return invalidSpecIdEventError{"numberOfAlgorithms is zero"}
-	}
-
-	// TCG_EfiSpecIdEvent.digestSizes
-	eventData.DigestSizes = make([]EFISpecIdEventAlgorithmSize, numberOfAlgorithms)
-	if err := binary.Read(stream, binary.LittleEndian, eventData.DigestSizes); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-	for _, d := range eventData.DigestSizes {
-		if d.AlgorithmId.supported() && d.AlgorithmId.size() != int(d.DigestSize) {
-			return invalidSpecIdEventError{
-				fmt.Sprintf("digestSize for algorithmId 0x%04x doesn't match expected size "+
-					"(got: %d, expected: %d)", d.AlgorithmId, d.DigestSize, d.AlgorithmId.size())}
-		}
-	}
-
-	// TCG_EfiSpecIdEvent.vendorInfoSize
-	var vendorInfoSize uint8
-	if err := binary.Read(stream, binary.LittleEndian, &vendorInfoSize); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	// TCG_EfiSpecIdEvent.vendorInfo
-	eventData.VendorInfo = make([]byte, vendorInfoSize)
-	if _, err := io.ReadFull(stream, eventData.VendorInfo); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	return nil
-}
-
-type startupLocalityEventData struct {
-	data     []byte
-	Locality uint8
-}
-
-func (e *startupLocalityEventData) String() string {
-	return fmt.Sprintf("EfiStartupLocalityEvent{ StartupLocality: %d }", e.Locality)
-}
-
-func (e *startupLocalityEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *startupLocalityEventData) Type() NoActionEventType {
-	return StartupLocality
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-//  (section 9.4.5.3 "Startup Locality Event")
-func decodeStartupLocalityEvent(stream io.Reader, data []byte) (*startupLocalityEventData, error) {
-	var locality uint8
-	if err := binary.Read(stream, binary.LittleEndian, &locality); err != nil {
-		return nil, err
-	}
-
-	return &startupLocalityEventData{data: data, Locality: locality}, nil
-}
-
-type bimReferenceManifestEventData struct {
-	data     []byte
-	VendorId uint32
-	Guid     EFIGUID
-}
-
-func (e *bimReferenceManifestEventData) String() string {
-	return fmt.Sprintf("Sp800_155_PlatformId_Event{ VendorId: %d, ReferenceManifestGuid: %s }",
-		e.VendorId, &e.Guid)
-}
-
-func (e *bimReferenceManifestEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *bimReferenceManifestEventData) Type() NoActionEventType {
-	return BiosIntegrityMeasurement
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-//  (section 9.4.5.2 "BIOS Integrity Measurement Reference Manifest Event")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
-//  (section 7.4 "EV_NO_ACTION Event Types")
-func decodeBIMReferenceManifestEvent(stream io.Reader, data []byte) (*bimReferenceManifestEventData, error) {
-	var d struct{
-		VendorId uint32
-		Guid EFIGUID
-	}
-	if err := binary.Read(stream, binary.LittleEndian, &d); err != nil {
-		return nil, err
-	}
-
-	return &bimReferenceManifestEventData{data: data, VendorId: d.VendorId, Guid: d.Guid}, nil
-}
-
-// EFIVariableEventData corresponds to the EFI_VARIABLE_DATA type.
-type EFIVariableEventData struct {
-	data         []byte
-	VariableName EFIGUID
-	UnicodeName  string
-	VariableData []byte
-}
-
-func (e *EFIVariableEventData) String() string {
-	return fmt.Sprintf("UEFI_VARIABLE_DATA{ VariableName: %s, UnicodeName: \"%s\" }",
-		e.VariableName.String(), e.UnicodeName)
-}
-
-func (e *EFIVariableEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *EFIVariableEventData) EncodeMeasuredBytes(buf io.Writer) error {
-	if err := binary.Write(buf, binary.LittleEndian, e.VariableName); err != nil {
-		return err
-	}
-	if err := binary.Write(buf, binary.LittleEndian, uint64(utf8.RuneCount([]byte(e.UnicodeName)))); err != nil {
-		return err
-	}
-	if err := binary.Write(buf, binary.LittleEndian, uint64(len(e.VariableData))); err != nil {
-		return err
-	}
-	if err := binary.Write(buf, binary.LittleEndian, convertStringToUtf16(e.UnicodeName)); err != nil {
-		return err
-	}
-	if _, err := buf.Write(e.VariableData); err != nil {
-		return err
-	}
-	return nil
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf (section 7.8 "Measuring EFI Variables")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf (section 9.2.6 "Measuring UEFI Variables")
-func decodeEventDataEFIVariableImpl(data []byte, eventType EventType) (*EFIVariableEventData, int, error) {
-	stream := bytes.NewReader(data)
-
-	var guid EFIGUID
-	if err := binary.Read(stream, binary.LittleEndian, &guid); err != nil {
-		return nil, 0, err
-	}
-
-	var unicodeNameLength uint64
-	if err := binary.Read(stream, binary.LittleEndian, &unicodeNameLength); err != nil {
-		return nil, 0, err
-	}
-
-	var variableDataLength uint64
-	if err := binary.Read(stream, binary.LittleEndian, &variableDataLength); err != nil {
-		return nil, 0, err
-	}
-
-	utf16Name, err := extractUTF16Buffer(stream, unicodeNameLength)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	variableData := make([]byte, variableDataLength)
-	if _, err := io.ReadFull(stream, variableData); err != nil {
-		return nil, 0, err
-	}
-
-	return &EFIVariableEventData{data: data,
-		VariableName: guid,
-		UnicodeName:  convertUtf16ToString(utf16Name),
-		VariableData: variableData}, stream.Len(), nil
-}
-
-func decodeEventDataEFIVariable(data []byte, eventType EventType) (out EventData, trailingBytes int, err error) {
-	d, trailingBytes, err := decodeEventDataEFIVariableImpl(data, eventType)
-	if d != nil {
-		out = d
-	}
-	return
-}
-
-type efiDevicePathNodeType uint8
-
-func (t efiDevicePathNodeType) String() string {
-	switch t {
-	case efiDevicePathNodeHardware:
-		return "HardwarePath"
-	case efiDevicePathNodeACPI:
-		return "AcpiPath"
-	case efiDevicePathNodeMsg:
-		return "Msg"
-	case efiDevicePathNodeMedia:
-		return "MediaPath"
-	case efiDevicePathNodeBBS:
-		return "BbsPath"
-	default:
-		return fmt.Sprintf("Path[%02x]", uint8(t))
-	}
-}
-
-const (
-	efiDevicePathNodeHardware efiDevicePathNodeType = 0x01
-	efiDevicePathNodeACPI                           = 0x02
-	efiDevicePathNodeMsg                            = 0x03
-	efiDevicePathNodeMedia                          = 0x04
-	efiDevicePathNodeBBS                            = 0x05
-	efiDevicePathNodeEoH                            = 0x7f
-)
-
-const (
-	efiHardwareDevicePathNodePCI = 0x01
-
-	efiACPIDevicePathNodeNormal = 0x01
-
-	efiMsgDevicePathNodeLU   = 0x11
-	efiMsgDevicePathNodeSATA = 0x12
-
-	efiMediaDevicePathNodeHardDrive      = 0x01
-	efiMediaDevicePathNodeFilePath       = 0x04
-	efiMediaDevicePathNodeFvFile         = 0x06
-	efiMediaDevicePathNodeFv             = 0x07
-	efiMediaDevicePathNodeRelOffsetRange = 0x08
-)
-
-func firmwareDevicePathNodeToString(subType uint8, data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	var name EFIGUID
-	if err := binary.Read(stream, binary.LittleEndian, &name); err != nil {
-		return "", err
-	}
-
-	var builder bytes.Buffer
-	switch subType {
-	case efiMediaDevicePathNodeFvFile:
-		builder.WriteString("\\FvFile")
-	case efiMediaDevicePathNodeFv:
-		builder.WriteString("\\Fv")
-	default:
-		return "", fmt.Errorf("invalid sub type for firmware device path node: %d", subType)
-	}
-
-	fmt.Fprintf(&builder, "(%s)", &name)
-	return builder.String(), nil
-}
-
-func acpiDevicePathNodeToString(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	var hid uint32
-	if err := binary.Read(stream, binary.LittleEndian, &hid); err != nil {
-		return "", err
-	}
-
-	var uid uint32
-	if err := binary.Read(stream, binary.LittleEndian, &uid); err != nil {
-		return "", err
-	}
-
-	if hid&0xffff == 0x41d0 {
-		switch hid >> 16 {
-		case 0x0a03:
-			return fmt.Sprintf("\\PciRoot(0x%x)", uid), nil
-		case 0x0a08:
-			return fmt.Sprintf("\\PcieRoot(0x%x)", uid), nil
-		case 0x0604:
-			return fmt.Sprintf("\\Floppy(0x%x)", uid), nil
-		default:
-			return fmt.Sprintf("\\Acpi(PNP%04x,0x%x)", hid>>16, uid), nil
-		}
-	} else {
-		return fmt.Sprintf("\\Acpi(0x%08x,0x%x)", hid, uid), nil
-	}
-}
-
-func pciDevicePathNodeToString(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	var function uint8
-	if err := binary.Read(stream, binary.LittleEndian, &function); err != nil {
-		return "", err
-	}
-
-	var device uint8
-	if err := binary.Read(stream, binary.LittleEndian, &device); err != nil {
-		return "", err
-	}
-
-	return fmt.Sprintf("\\Pci(0x%x,0x%x)", device, function), nil
-}
-
-func luDevicePathNodeToString(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	var lun uint8
-	if err := binary.Read(stream, binary.LittleEndian, &lun); err != nil {
-		return "", err
-	}
-
-	return fmt.Sprintf("\\Unit(0x%x)", lun), nil
-}
-
-func hardDriveDevicePathNodeToString(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	var partNumber uint32
-	if err := binary.Read(stream, binary.LittleEndian, &partNumber); err != nil {
-		return "", err
-	}
-
-	var partStart uint64
-	if err := binary.Read(stream, binary.LittleEndian, &partStart); err != nil {
-		return "", err
-	}
-
-	var partSize uint64
-	if err := binary.Read(stream, binary.LittleEndian, &partSize); err != nil {
-		return "", err
-	}
-
-	var sig [16]byte
-	if _, err := io.ReadFull(stream, sig[:]); err != nil {
-		return "", err
-	}
-
-	var partFormat uint8
-	if err := binary.Read(stream, binary.LittleEndian, &partFormat); err != nil {
-		return "", err
-	}
-
-	var sigType uint8
-	if err := binary.Read(stream, binary.LittleEndian, &sigType); err != nil {
-		return "", err
-	}
-
-	var builder bytes.Buffer
-
-	switch sigType {
-	case 0x01:
-		fmt.Fprintf(&builder, "\\HD(%d,MBR,0x%08x,", partNumber, binary.LittleEndian.Uint32(sig[:]))
-	case 0x02:
-		r := bytes.NewReader(sig[:])
-		var guid EFIGUID
-		if err := binary.Read(r, binary.LittleEndian, &guid); err != nil {
-			return "", err
-		}
-		fmt.Fprintf(&builder, "\\HD(%d,GPT,%s,", partNumber, &guid)
-	default:
-		fmt.Fprintf(&builder, "\\HD(%d,%d,0,", partNumber, sigType)
-	}
-
-	fmt.Fprintf(&builder, "0x%016x, 0x%016x)", partStart, partSize)
-	return builder.String(), nil
-}
-
-func sataDevicePathNodeToString(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	var hbaPortNumber uint16
-	if err := binary.Read(stream, binary.LittleEndian, &hbaPortNumber); err != nil {
-		return "", err
-	}
-
-	var portMultiplierPortNumber uint16
-	if err := binary.Read(stream, binary.LittleEndian, &portMultiplierPortNumber); err != nil {
-		return "", err
-	}
-
-	var lun uint16
-	if err := binary.Read(stream, binary.LittleEndian, &lun); err != nil {
-		return "", err
-	}
-
-	return fmt.Sprintf("\\Sata(0x%x,0x%x,0x%x)", hbaPortNumber, portMultiplierPortNumber, lun), nil
-}
-
-func filePathDevicePathNodeToString(data []byte) string {
-	u16 := make([]uint16, len(data)/2)
-	stream := bytes.NewReader(data)
-	binary.Read(stream, binary.LittleEndian, &u16)
-
-	var buf bytes.Buffer
-	for _, r := range utf16.Decode(u16) {
-		buf.WriteRune(r)
-	}
-	return buf.String()
-}
-
-func relOffsetRangePathNodeToString(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-
-	if _, err := stream.Seek(4, io.SeekCurrent); err != nil {
-		return "", err
-	}
-
-	var start uint64
-	if err := binary.Read(stream, binary.LittleEndian, &start); err != nil {
-		return "", err
-	}
-
-	var end uint64
-	if err := binary.Read(stream, binary.LittleEndian, &end); err != nil {
-		return "", err
-	}
-
-	return fmt.Sprintf("\\Offset(0x%x,0x%x)", start, end), nil
-}
-
-func decodeDevicePathNode(stream io.Reader) (string, error) {
-	var t efiDevicePathNodeType
-	if err := binary.Read(stream, binary.LittleEndian, &t); err != nil {
-		return "", err
-	}
-
-	if t == efiDevicePathNodeEoH {
-		return "", nil
-	}
-
-	var subType uint8
-	if err := binary.Read(stream, binary.LittleEndian, &subType); err != nil {
-		return "", err
-	}
-
-	var length uint16
-	if err := binary.Read(stream, binary.LittleEndian, &length); err != nil {
-		return "", err
-	}
-
-	if length < 4 {
-		return "", fmt.Errorf("unexpected device path node length (got %d, expected >= 4)", length)
-	}
-
-	data := make([]byte, length-4)
-	if _, err := io.ReadFull(stream, data); err != nil {
-		return "", err
-	}
-
-	switch t {
-	case efiDevicePathNodeMedia:
-		switch subType {
-		case efiMediaDevicePathNodeFvFile:
-			fallthrough
-		case efiMediaDevicePathNodeFv:
-			return firmwareDevicePathNodeToString(subType, data)
-		case efiMediaDevicePathNodeHardDrive:
-			return hardDriveDevicePathNodeToString(data)
-		case efiMediaDevicePathNodeFilePath:
-			return filePathDevicePathNodeToString(data), nil
-		case efiMediaDevicePathNodeRelOffsetRange:
-			return relOffsetRangePathNodeToString(data)
-		}
-	case efiDevicePathNodeACPI:
-		switch subType {
-		case efiACPIDevicePathNodeNormal:
-			return acpiDevicePathNodeToString(data)
-		}
-	case efiDevicePathNodeHardware:
-		switch subType {
-		case efiHardwareDevicePathNodePCI:
-			return pciDevicePathNodeToString(data)
-		}
-	case efiDevicePathNodeMsg:
-		switch subType {
-		case efiMsgDevicePathNodeLU:
-			return luDevicePathNodeToString(data)
-		case efiMsgDevicePathNodeSATA:
-			return sataDevicePathNodeToString(data)
-		}
-
-	}
-
-	var builder bytes.Buffer
-	fmt.Fprintf(&builder, "\\%s(%d", t, subType)
-	if len(data) > 0 {
-		fmt.Fprintf(&builder, ", 0x")
-		for _, b := range data {
-			fmt.Fprintf(&builder, "%02x", b)
-		}
-	}
-	fmt.Fprintf(&builder, ")")
-	return builder.String(), nil
-}
-
-func decodeDevicePath(data []byte) (string, error) {
-	stream := bytes.NewReader(data)
-	var builder bytes.Buffer
-
-	for {
-		node, err := decodeDevicePathNode(stream)
-		if err != nil {
-			return "", err
-		}
-		if node == "" {
-			return builder.String(), nil
-		}
-		fmt.Fprintf(&builder, "%s", node)
-	}
-}
-
-type efiImageLoadEventData struct {
-	data             []byte
-	locationInMemory uint64
-	lengthInMemory   uint64
-	linkTimeAddress  uint64
-	path             string
-}
-
-func (e *efiImageLoadEventData) String() string {
-	return fmt.Sprintf("UEFI_IMAGE_LOAD_EVENT{ ImageLocationInMemory: 0x%016x, ImageLengthInMemory: %d, "+
-		"ImageLinkTimeAddress: 0x%016x, DevicePath: %s }", e.locationInMemory, e.lengthInMemory,
-		e.linkTimeAddress, e.path)
-}
-
-func (e *efiImageLoadEventData) Bytes() []byte {
-	return e.data
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf (section 4 "Measuring PE/COFF Image Files")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf (section 9.2.3 "UEFI_IMAGE_LOAD_EVENT Structure")
-func decodeEventDataEFIImageLoadImpl(data []byte) (*efiImageLoadEventData, error) {
-	stream := bytes.NewReader(data)
-
-	var locationInMemory uint64
-	if err := binary.Read(stream, binary.LittleEndian, &locationInMemory); err != nil {
-		return nil, err
-	}
-
-	var lengthInMemory uint64
-	if err := binary.Read(stream, binary.LittleEndian, &lengthInMemory); err != nil {
-		return nil, err
-	}
-
-	var linkTimeAddress uint64
-	if err := binary.Read(stream, binary.LittleEndian, &linkTimeAddress); err != nil {
-		return nil, err
-	}
-
-	var devicePathLength uint64
-	if err := binary.Read(stream, binary.LittleEndian, &devicePathLength); err != nil {
-		return nil, err
-	}
-
-	devicePathBuf := make([]byte, devicePathLength)
-
-	if _, err := io.ReadFull(stream, devicePathBuf); err != nil {
-		return nil, err
-	}
-
-	path, err := decodeDevicePath(devicePathBuf)
-	if err != nil {
-		return nil, err
-	}
-
-	return &efiImageLoadEventData{data: data,
-		locationInMemory: locationInMemory,
-		lengthInMemory:   lengthInMemory,
-		linkTimeAddress:  linkTimeAddress,
-		path:             path}, nil
-}
-
-func decodeEventDataEFIImageLoad(data []byte) (out EventData, trailingBytes int, err error) {
-	d, err := decodeEventDataEFIImageLoadImpl(data)
-	if d != nil {
-		out = d
-	}
-	return
-}
-
-type efiGPTPartitionEntry struct {
-	typeGUID   EFIGUID
-	uniqueGUID EFIGUID
-	name       string
-}
-
-func (p *efiGPTPartitionEntry) String() string {
-	return fmt.Sprintf("PartitionTypeGUID: %s, UniquePartitionGUID: %s, Name: \"%s\"",
-		&p.typeGUID, &p.uniqueGUID, p.name)
-}
-
-type efiGPTEventData struct {
-	data       []byte
-	diskGUID   EFIGUID
-	partitions []efiGPTPartitionEntry
-}
-
-func (e *efiGPTEventData) String() string {
-	var builder bytes.Buffer
-	fmt.Fprintf(&builder, "UEFI_GPT_DATA{ DiskGUID: %s, Partitions: [", &e.diskGUID)
-	for i, part := range e.partitions {
-		if i > 0 {
-			fmt.Fprintf(&builder, ", ")
-		}
-		fmt.Fprintf(&builder, "{ %s }", &part)
-	}
-	fmt.Fprintf(&builder, "] }")
-	return builder.String()
-}
-
-func (e *efiGPTEventData) Bytes() []byte {
-	return e.data
-}
-
-func decodeEventDataEFIGPTImpl(data []byte) (*efiGPTEventData, int, error) {
-	stream := bytes.NewReader(data)
-
-	// Skip UEFI_GPT_DATA.UEFIPartitionHeader.{Header, MyLBA, AlternateLBA, FirstUsableLBA, LastUsableLBA}
-	if _, err := stream.Seek(56, io.SeekCurrent); err != nil {
-		return nil, 0, err
-	}
-
-	// UEFI_GPT_DATA.UEFIPartitionHeader.DiskGUID
-	var diskGUID EFIGUID
-	if err := binary.Read(stream, binary.LittleEndian, &diskGUID); err != nil {
-		return nil, 0, err
-	}
-
-	// Skip UEFI_GPT_DATA.UEFIPartitionHeader.{PartitionEntryLBA, NumberOfPartitionEntries}
-	if _, err := stream.Seek(12, io.SeekCurrent); err != nil {
-		return nil, 0, err
-	}
-
-	// UEFI_GPT_DATA.UEFIPartitionHeader.SizeOfPartitionEntry
-	var partEntrySize uint32
-	if err := binary.Read(stream, binary.LittleEndian, &partEntrySize); err != nil {
-		return nil, 0, err
-	}
-
-	// Skip UEFI_GPT_DATA.UEFIPartitionHeader.PartitionEntryArrayCRC32
-	if _, err := stream.Seek(4, io.SeekCurrent); err != nil {
-		return nil, 0, err
-	}
-
-	// UEFI_GPT_DATA.NumberOfPartitions
-	var numberOfParts uint64
-	if err := binary.Read(stream, binary.LittleEndian, &numberOfParts); err != nil {
-		return nil, 0, err
-	}
-
-	eventData := &efiGPTEventData{diskGUID: diskGUID, partitions: make([]efiGPTPartitionEntry, numberOfParts)}
-
-	for i := uint64(0); i < numberOfParts; i++ {
-		entryData := make([]byte, partEntrySize)
-		if _, err := io.ReadFull(stream, entryData); err != nil {
-			return nil, 0, err
-		}
-
-		entryStream := bytes.NewReader(entryData)
-
-		var typeGUID EFIGUID
-		if err := binary.Read(entryStream, binary.LittleEndian, &typeGUID); err != nil {
-			return nil, 0, err
-		}
-
-		var uniqueGUID EFIGUID
-		if err := binary.Read(entryStream, binary.LittleEndian, &uniqueGUID); err != nil {
-			return nil, 0, err
-		}
-
-		// Skip UEFI_GPT_DATA.Partitions[i].{StartingLBA, EndingLBA, Attributes}
-		if _, err := entryStream.Seek(24, io.SeekCurrent); err != nil {
-			return nil, 0, err
-		}
-
-		nameUtf16 := make([]uint16, entryStream.Len()/2)
-		if err := binary.Read(entryStream, binary.LittleEndian, &nameUtf16); err != nil {
-			return nil, 0, err
-		}
-
-		var name bytes.Buffer
-		for _, r := range utf16.Decode(nameUtf16) {
-			if r == rune(0) {
-				break
-			}
-			name.WriteRune(r)
-		}
-
-		eventData.partitions[i] = efiGPTPartitionEntry{typeGUID: typeGUID, uniqueGUID: uniqueGUID, name: name.String()}
-	}
-
-	return eventData, stream.Len(), nil
-}
-
-func decodeEventDataEFIGPT(data []byte) (out EventData, trailingBytes int, err error) {
-	d, trailingBytes, err := decodeEventDataEFIGPTImpl(data)
-	if d != nil {
-		out = d
-	}
-	return
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/eventdata.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/eventdata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/eventdata.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/eventdata.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,82 +0,0 @@
-package tcglog
-
-import (
-	"fmt"
-	"io"
-)
-
-// EventData is an interface that represents all event data types that appear in a log. Most implementations of
-// this are private to this module.
-type EventData interface {
-	String() string // Textual representation of the event data
-	Bytes() []byte  // The raw event data bytes
-}
-
-// BrokenEventData corresponds to an event data buffer that could not be parsed correctly, for the reason
-// described by Error.
-type BrokenEventData struct {
-	data  []byte
-	Error error
-}
-
-func (e *BrokenEventData) String() string {
-	if e.Error == io.ErrUnexpectedEOF {
-		return "Invalid event data: event data smaller than expected"
-	}
-	return fmt.Sprintf("Invalid event data: %v", e.Error)
-}
-
-func (e *BrokenEventData) Bytes() []byte {
-	return e.data
-}
-
-type opaqueEventData struct {
-	data []byte
-}
-
-func (e *opaqueEventData) String() string {
-	return ""
-}
-
-func (e *opaqueEventData) Bytes() []byte {
-	return e.data
-}
-
-func decodeEventDataImpl(pcrIndex PCRIndex, eventType EventType, data []byte, options *LogOptions,
-	hasDigestOfSeparatorError bool) (EventData, int, error) {
-	switch {
-	case options.EnableGrub && (pcrIndex == 8 || pcrIndex == 9):
-		if d, n := decodeEventDataGRUB(pcrIndex, eventType, data); d != nil {
-			return d, n, nil
-		}
-		fallthrough
-	case options.EnableSystemdEFIStub && pcrIndex == options.SystemdEFIStubPCR && eventType == EventTypeIPL:
-		if d, n, e := decodeEventDataSystemdEFIStub(data); d != nil {
-			return d, n, nil
-		} else if e != nil {
-			return nil, 0, e
-		}
-		fallthrough
-	default:
-		return decodeEventDataTCG(eventType, data, hasDigestOfSeparatorError)
-	}
-}
-
-func decodeEventData(pcrIndex PCRIndex, eventType EventType, data []byte, options *LogOptions,
-	hasDigestOfSeparatorError bool) (EventData, int) {
-	event, trailingBytes, err :=
-		decodeEventDataImpl(pcrIndex, eventType, data, options, hasDigestOfSeparatorError)
-
-	if err != nil {
-		if err == io.EOF {
-			err = io.ErrUnexpectedEOF
-		}
-		return &BrokenEventData{data: data, Error: err}, 0
-	}
-
-	if event != nil {
-		return event, trailingBytes
-	}
-
-	return &opaqueEventData{data: data}, 0
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/grubeventdata.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/grubeventdata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/grubeventdata.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/grubeventdata.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,73 +0,0 @@
-package tcglog
-
-import (
-	"fmt"
-	"io"
-	"strings"
-)
-
-var (
-	kernelCmdlinePrefix = "kernel_cmdline: "
-	grubCmdPrefix       = "grub_cmd: "
-)
-
-type GrubStringEventType int
-
-const (
-	GrubCmd GrubStringEventType = iota
-	KernelCmdline
-)
-
-func grubEventTypeString(t GrubStringEventType) string {
-	switch t {
-	case GrubCmd:
-		return "grub_cmd"
-	case KernelCmdline:
-		return "kernel_cmdline"
-	}
-	panic("invalid value")
-}
-
-type GrubStringEventData struct {
-	data []byte
-	Type GrubStringEventType
-	Str  string
-}
-
-func (e *GrubStringEventData) String() string {
-	return fmt.Sprintf("%s{ %s }", grubEventTypeString(e.Type), e.Str)
-}
-
-func (e *GrubStringEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *GrubStringEventData) EncodeMeasuredBytes(buf io.Writer) error {
-	if _, err := io.WriteString(buf, e.Str); err != nil {
-		return err
-	}
-	return nil
-}
-
-func decodeEventDataGRUB(pcrIndex PCRIndex, eventType EventType, data []byte) (EventData, int) {
-	if eventType != EventTypeIPL {
-		return nil, 0
-	}
-
-	switch pcrIndex {
-	case 8:
-		str := string(data)
-		switch {
-		case strings.HasPrefix(str, kernelCmdlinePrefix):
-			return &GrubStringEventData{data, KernelCmdline, strings.TrimSuffix(strings.TrimPrefix(str, kernelCmdlinePrefix), "\x00")}, 0
-		case strings.HasPrefix(str, grubCmdPrefix):
-			return &GrubStringEventData{data, GrubCmd, strings.TrimSuffix(strings.TrimPrefix(str, grubCmdPrefix), "\x00")}, 0
-		default:
-			return nil, 0
-		}
-	case 9:
-		return &asciiStringEventData{data: data}, 0
-	default:
-		panic("unhandled PCR index")
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/log.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/log.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/log.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/log.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,322 +0,0 @@
-package tcglog
-
-import (
-	"bytes"
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"io"
-)
-
-// LogOptions allows the behaviour of Log to be controlled.
-type LogOptions struct {
-	EnableGrub           bool     // Enable support for interpreting events recorded by GRUB
-	EnableSystemdEFIStub bool     // Enable support for interpreting events recorded by systemd's EFI linux loader stub
-	SystemdEFIStubPCR    PCRIndex // Specify the PCR that systemd's EFI linux loader stub measures to
-}
-
-var zeroDigests = map[AlgorithmId][]byte{
-	AlgorithmSha1:   make([]byte, AlgorithmSha1.size()),
-	AlgorithmSha256: make([]byte, AlgorithmSha256.size()),
-	AlgorithmSha384: make([]byte, AlgorithmSha384.size()),
-	AlgorithmSha512: make([]byte, AlgorithmSha512.size())}
-
-type stream interface {
-	readNextEvent() (*Event, int, error)
-}
-
-func isPCRIndexInRange(index PCRIndex) bool {
-	const maxPCRIndex PCRIndex = 31
-	return index <= maxPCRIndex
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
-//  (section 3.3.2.2 2 Error Conditions" , section 8.2.3 "Measuring Boot Events")
-// https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf:
-//  (section 2.3.2 "Error Conditions", section 2.3.4 "PCR Usage", section 7.2
-//   "Procedure for Pre-OS to OS-Present Transition")
-func isDigestOfSeparatorErrorValue(digest Digest, alg AlgorithmId) bool {
-	errorValue := make([]byte, 4)
-	binary.LittleEndian.PutUint32(errorValue, separatorEventErrorValue)
-
-	return bytes.Compare(digest, alg.hash(errorValue)) == 0
-}
-
-func wrapLogReadError(origErr error, partial bool) error {
-	if origErr == io.EOF {
-		if !partial {
-			return origErr
-		}
-		origErr = io.ErrUnexpectedEOF
-	}
-
-	return fmt.Errorf("error when reading from log stream (%v)", origErr)
-}
-
-func wrapPCRIndexOutOfRangeError(pcrIndex PCRIndex) error {
-	return fmt.Errorf("log entry has an out-of-range PCR index (%d)", pcrIndex)
-}
-
-type eventHeader_1_2 struct {
-	PCRIndex  PCRIndex
-	EventType EventType
-}
-
-type stream_1_2 struct {
-	r       io.ReadSeeker
-	options LogOptions
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
-//  (section 11.1.1 "TCG_PCClientPCREventStruct Structure")
-func (s *stream_1_2) readNextEvent() (*Event, int, error) {
-	var header eventHeader_1_2
-	if err := binary.Read(s.r, binary.LittleEndian, &header); err != nil {
-		return nil, 0, wrapLogReadError(err, false)
-	}
-
-	if !isPCRIndexInRange(header.PCRIndex) {
-		return nil, 0, wrapPCRIndexOutOfRangeError(header.PCRIndex)
-	}
-
-	digest := make(Digest, AlgorithmSha1.size())
-	if _, err := s.r.Read(digest); err != nil {
-		return nil, 0, wrapLogReadError(err, true)
-	}
-	digests := make(DigestMap)
-	digests[AlgorithmSha1] = digest
-
-	var eventSize uint32
-	if err := binary.Read(s.r, binary.LittleEndian, &eventSize); err != nil {
-		return nil, 0, wrapLogReadError(err, true)
-	}
-
-	event := make([]byte, eventSize)
-	if _, err := io.ReadFull(s.r, event); err != nil {
-		return nil, 0, wrapLogReadError(err, true)
-	}
-
-	data, trailing := decodeEventData(header.PCRIndex, header.EventType, event, &s.options,
-		isDigestOfSeparatorErrorValue(digest, AlgorithmSha1))
-
-	return &Event{
-		PCRIndex:  header.PCRIndex,
-		EventType: header.EventType,
-		Digests:   digests,
-		Data:      data,
-	}, trailing, nil
-}
-
-type eventHeader_2 struct {
-	PCRIndex  PCRIndex
-	EventType EventType
-	Count     uint32
-}
-
-type stream_2 struct {
-	r              io.ReadSeeker
-	options        LogOptions
-	algSizes       []EFISpecIdEventAlgorithmSize
-	readFirstEvent bool
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-//  (section 9.2.2 "TCG_PCR_EVENT2 Structure")
-func (s *stream_2) readNextEvent() (*Event, int, error) {
-	if !s.readFirstEvent {
-		s.readFirstEvent = true
-		stream := stream_1_2{r: s.r}
-		return stream.readNextEvent()
-	}
-
-	var header eventHeader_2
-	if err := binary.Read(s.r, binary.LittleEndian, &header); err != nil {
-		return nil, 0, wrapLogReadError(err, false)
-	}
-
-	if !isPCRIndexInRange(header.PCRIndex) {
-		return nil, 0, wrapPCRIndexOutOfRangeError(header.PCRIndex)
-	}
-
-	digests := make(DigestMap)
-
-	for i := uint32(0); i < header.Count; i++ {
-		var algorithmId AlgorithmId
-		if err := binary.Read(s.r, binary.LittleEndian, &algorithmId); err != nil {
-			return nil, 0, wrapLogReadError(err, true)
-		}
-
-		var digestSize uint16
-		var j int
-		for j = 0; j < len(s.algSizes); j++ {
-			if s.algSizes[j].AlgorithmId == algorithmId {
-				digestSize = s.algSizes[j].DigestSize
-				break
-			}
-		}
-
-		if j == len(s.algSizes) {
-			return nil, 0, fmt.Errorf("crypto-agile log entry contains a digest for an unrecognized "+
-				"algorithm (%s)", algorithmId)
-		}
-
-		digest := make(Digest, digestSize)
-		if _, err := io.ReadFull(s.r, digest); err != nil {
-			return nil, 0, wrapLogReadError(err, true)
-		}
-
-		if _, exists := digests[algorithmId]; exists {
-			return nil, 0, fmt.Errorf("crypto-agile log entry contains more than one digest value "+
-				"for algorithm %s", algorithmId)
-		}
-		digests[algorithmId] = digest
-	}
-
-	for _, algSize := range s.algSizes {
-		if _, exists := digests[algSize.AlgorithmId]; !exists {
-			return nil, 0,
-				fmt.Errorf("crypto-agile log entry is missing a digest value for algorithm %s "+
-					"that was present in the Spec ID Event", algSize.AlgorithmId)
-		}
-	}
-
-	for alg, _ := range digests {
-		if alg.supported() {
-			continue
-		}
-		delete(digests, alg)
-	}
-
-	var eventSize uint32
-	if err := binary.Read(s.r, binary.LittleEndian, &eventSize); err != nil {
-		return nil, 0, wrapLogReadError(err, true)
-	}
-
-	event := make([]byte, eventSize)
-	if _, err := io.ReadFull(s.r, event); err != nil {
-		return nil, 0, wrapLogReadError(err, true)
-	}
-
-	data, trailing := decodeEventData(header.PCRIndex, header.EventType, event, &s.options,
-		isDigestOfSeparatorErrorValue(digests[s.algSizes[0].AlgorithmId], s.algSizes[0].AlgorithmId))
-
-	return &Event{
-		PCRIndex:  header.PCRIndex,
-		EventType: header.EventType,
-		Digests:   digests,
-		Data:      data,
-	}, trailing, nil
-}
-
-func fixupSpecIdEvent(event *Event, algorithms AlgorithmIdList) {
-	if event.Data.(*SpecIdEventData).Spec != SpecEFI_2 {
-		return
-	}
-
-	for _, alg := range algorithms {
-		if alg == AlgorithmSha1 {
-			continue
-		}
-
-		if _, ok := event.Digests[alg]; ok {
-			continue
-		}
-
-		event.Digests[alg] = zeroDigests[alg]
-	}
-}
-
-func isSpecIdEvent(event *Event) (out bool) {
-	_, out = event.Data.(*SpecIdEventData)
-	return
-}
-
-// Log corresponds to an event log parser instance, and allows the consumer to iterate over log entries.
-type Log struct {
-	Spec         Spec            // The specification to which this log conforms
-	Algorithms   AlgorithmIdList // The digest algorithms that appear in the log
-	stream       stream
-	failed       bool
-	indexTracker map[PCRIndex]uint
-}
-
-func (l *Log) nextEventInternal() (*Event, int, error) {
-	if l.failed {
-		return nil, 0,
-			errors.New("cannot read next event: log status inconsistent due to a previous error")
-	}
-
-	event, trailing, err := l.stream.readNextEvent()
-	if err != nil {
-		if err != io.EOF {
-			l.failed = true
-		}
-		return nil, 0, err
-	}
-
-	if i, exists := l.indexTracker[event.PCRIndex]; exists {
-		event.Index = i
-		l.indexTracker[event.PCRIndex] = i + 1
-	} else {
-		event.Index = 0
-		l.indexTracker[event.PCRIndex] = 1
-	}
-
-	if isSpecIdEvent(event) {
-		fixupSpecIdEvent(event, l.Algorithms)
-	}
-
-	return event, trailing, nil
-}
-
-// NextEvent returns an Event structure that corresponds to the next event in the log. Upon successful completion,
-// the Log instance will advance to the next event. If there are no more events in the log, it will return io.EOF.
-func (l *Log) NextEvent() (event *Event, err error) {
-	event, _, err = l.nextEventInternal()
-	return
-}
-
-// NewLog creates a new Log instance that reads an event log from r
-func NewLog(r io.ReaderAt, options LogOptions) (*Log, error) {
-	var stream stream = &stream_1_2{r: io.NewSectionReader(r, 0, (1<<63)-1), options: options}
-	event, _, err := stream.readNextEvent()
-	if err != nil {
-		return nil, wrapLogReadError(err, true)
-	}
-
-	var spec Spec = SpecUnknown
-	var digestSizes []EFISpecIdEventAlgorithmSize
-	var algorithms AlgorithmIdList
-
-	switch d := event.Data.(type) {
-	case *SpecIdEventData:
-		spec = d.Spec
-		digestSizes = d.DigestSizes
-	case *BrokenEventData:
-		if _, isSpecErr := d.Error.(invalidSpecIdEventError); isSpecErr {
-			return nil, d.Error
-		}
-	}
-
-	if spec == SpecEFI_2 {
-		algorithms = make(AlgorithmIdList, 0, len(digestSizes))
-		for _, specAlgSize := range digestSizes {
-			if specAlgSize.AlgorithmId.supported() {
-				algorithms = append(algorithms, specAlgSize.AlgorithmId)
-			}
-		}
-		stream = &stream_2{r: io.NewSectionReader(r, 0, (1<<63)-1),
-			options:        options,
-			algSizes:       digestSizes,
-			readFirstEvent: false}
-	} else {
-		algorithms = AlgorithmIdList{AlgorithmSha1}
-		stream.(*stream_1_2).r.Seek(0, io.SeekStart)
-	}
-
-	return &Log{Spec: spec,
-		Algorithms:   algorithms,
-		stream:       stream,
-		failed:       false,
-		indexTracker: map[PCRIndex]uint{}}, nil
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/README.md snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/README.md
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/README.md	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/README.md	1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-# TCG Log Parser
-
-This repository contains a go library for parsing TCG event logs. Also included is a simple command line tool that prints details of log entries to the console.
-
-## Relevant specifications
-
-The library parses data in a format that is defined by the following specifications:
-* [TCG PC Client Platform Firmware Profile Specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf)
-* [TCG EFI Platform Specification For TPM Family 1.1 or 1.2](https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf)
-* [TCG PC Client Specific Implementation Specification for Conventional BIOS](https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf)
-* [Unified Extensible Firmware Interface (UEFI) Specification](https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf)
-* [Platform Initialization (PI) Specification](https://uefi.org/sites/default/files/resources/PI_Spec_1_6.pdf)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/sdefistub.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/sdefistub.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/sdefistub.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/sdefistub.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,36 +0,0 @@
-package tcglog
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"io"
-)
-
-type SystemdEFIStubEventData struct {
-	data []byte
-	Str  string
-}
-
-func (e *SystemdEFIStubEventData) String() string {
-	return fmt.Sprintf("%s", e.Str)
-}
-
-func (e *SystemdEFIStubEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *SystemdEFIStubEventData) EncodeMeasuredBytes(buf io.Writer) error {
-	return binary.Write(buf, binary.LittleEndian, append(convertStringToUtf16(e.Str), 0))
-}
-
-func decodeEventDataSystemdEFIStub(data []byte) (EventData, int, error) {
-	// data is a UTF-16 string in little-endian form terminated with a single zero byte.
-	// Omit the zero byte added by the EFI stub and then convert to native byte order.
-	reader := bytes.NewReader(data[:len(data)-1])
-
-	utf16Str := make([]uint16, len(data)/2)
-	binary.Read(reader, binary.LittleEndian, &utf16Str)
-
-	return &SystemdEFIStubEventData{data: data, Str: convertUtf16ToString(utf16Str)}, 0, nil
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/tcgeventdata.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/tcgeventdata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/tcgeventdata.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/tcgeventdata.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,287 +0,0 @@
-package tcglog
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"io"
-	"math"
-	"unsafe"
-)
-
-type invalidSpecIdEventError struct {
-	s string
-}
-
-func (e invalidSpecIdEventError) Error() string {
-	return fmt.Sprintf("invalid SpecIdEvent (%s)", e.s)
-}
-
-// EFISpecIdEventAlgorithmSize represents a digest algorithm and its length.
-type EFISpecIdEventAlgorithmSize struct {
-	AlgorithmId AlgorithmId
-	DigestSize  uint16
-}
-
-type NoActionEventType int
-
-const (
-	UnknownNoActionEvent NoActionEventType = iota
-	SpecId
-	StartupLocality
-	BiosIntegrityMeasurement
-)
-
-type NoActionEventData interface {
-	Type() NoActionEventType
-}
-
-// SpecIdEventData corresponds to the event data for a Specification ID Version event
-// (TCG_PCClientSpecIdEventStruct, TCG_EfiSpecIdEventStruct, TCG_EfiSpecIdEvent)
-type SpecIdEventData struct {
-	data             []byte
-	Spec             Spec
-	PlatformClass    uint32
-	SpecVersionMinor uint8
-	SpecVersionMajor uint8
-	SpecErrata       uint8
-	UintnSize        uint8
-	DigestSizes      []EFISpecIdEventAlgorithmSize // The digest algorithms contained within this log
-	VendorInfo       []byte
-}
-
-func (e *SpecIdEventData) String() string {
-	var builder bytes.Buffer
-	switch e.Spec {
-	case SpecPCClient:
-		builder.WriteString("PCClientSpecIdEvent")
-	case SpecEFI_1_2, SpecEFI_2:
-		builder.WriteString("EfiSpecIDEvent")
-	}
-
-	fmt.Fprintf(&builder, "{ spec=%d, platformClass=%d, specVersionMinor=%d, specVersionMajor=%d, "+
-		"specErrata=%d", e.Spec, e.PlatformClass, e.SpecVersionMinor, e.SpecVersionMajor, e.SpecErrata)
-	if e.Spec == SpecEFI_2 {
-		builder.WriteString(", digestSizes=[")
-		for i, algSize := range e.DigestSizes {
-			if i > 0 {
-				builder.WriteString(", ")
-			}
-			fmt.Fprintf(&builder, "{ algorithmId=0x%04x, digestSize=%d }",
-				uint16(algSize.AlgorithmId), algSize.DigestSize)
-		}
-		builder.WriteString("]")
-	}
-	builder.WriteString(" }")
-	return builder.String()
-}
-
-func (e *SpecIdEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *SpecIdEventData) Type() NoActionEventType {
-	return SpecId
-}
-
-func wrapSpecIdEventReadError(origErr error) error {
-	if origErr == io.EOF {
-		return invalidSpecIdEventError{"not enough data"}
-	}
-
-	return invalidSpecIdEventError{origErr.Error()}
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
-//  (section 11.3.4.1 "Specification Event")
-func parsePCClientSpecIdEvent(stream io.Reader, eventData *SpecIdEventData) error {
-	eventData.Spec = SpecPCClient
-
-	// TCG_PCClientSpecIdEventStruct.vendorInfoSize
-	var vendorInfoSize uint8
-	if err := binary.Read(stream, binary.LittleEndian, &vendorInfoSize); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	// TCG_PCClientSpecIdEventStruct.vendorInfo
-	eventData.VendorInfo = make([]byte, vendorInfoSize)
-	if _, err := io.ReadFull(stream, eventData.VendorInfo); err != nil {
-		return wrapSpecIdEventReadError(err)
-	}
-
-	return nil
-}
-
-type specIdEventCommon struct {
-	PlatformClass uint32
-	SpecVersionMinor uint8
-	SpecVersionMajor uint8
-	SpecErrata uint8
-	UintnSize uint8
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
-//  (section 11.3.4.1 "Specification Event")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf
-//  (section 7.4 "EV_NO_ACTION Event Types")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-//  (secion 9.4.5.1 "Specification ID Version Event")
-func decodeSpecIdEvent(stream io.Reader, data []byte, helper func(io.Reader, *SpecIdEventData) error) (*SpecIdEventData, error) {
-	var common struct{
-		PlatformClass uint32
-		SpecVersionMinor uint8
-		SpecVersionMajor uint8
-		SpecErrata uint8
-		UintnSize uint8
-	}
-	if err := binary.Read(stream, binary.LittleEndian, &common); err != nil {
-		return nil, wrapSpecIdEventReadError(err)
-	}
-
-	eventData := &SpecIdEventData{
-		data:             data,
-		PlatformClass:    common.PlatformClass,
-		SpecVersionMinor: common.SpecVersionMinor,
-		SpecVersionMajor: common.SpecVersionMajor,
-		SpecErrata:       common.SpecErrata,
-		UintnSize:	  common.UintnSize}
-
-	if err := helper(stream, eventData); err != nil {
-		return nil, err
-	}
-
-	return eventData, nil
-}
-
-var (
-	validNormalSeparatorValues = [...]uint32{0, math.MaxUint32}
-)
-
-type asciiStringEventData struct {
-	data []byte
-}
-
-func (e *asciiStringEventData) String() string {
-	return *(*string)(unsafe.Pointer(&e.data))
-}
-
-func (e *asciiStringEventData) Bytes() []byte {
-	return e.data
-}
-
-type unknownNoActionEventData struct {
-	data []byte
-}
-
-func (e *unknownNoActionEventData) String() string {
-	return ""
-}
-
-func (e *unknownNoActionEventData) Bytes() []byte {
-	return e.data
-}
-
-func (e *unknownNoActionEventData) Type() NoActionEventType {
-	return UnknownNoActionEvent
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf
-//  (section 11.3.4 "EV_NO_ACTION Event Types")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf
-//  (section 9.4.5 "EV_NO_ACTION Event Types")
-func decodeEventDataNoAction(data []byte) (out EventData, trailingBytes int, err error) {
-	stream := bytes.NewReader(data)
-
-	// Signature field
-	signature := make([]byte, 16)
-	if _, err := io.ReadFull(stream, signature); err != nil {
-		return nil, 0, err
-	}
-
-	switch *(*string)(unsafe.Pointer(&signature)) {
-	case "Spec ID Event00\x00":
-		d, e := decodeSpecIdEvent(stream, data, parsePCClientSpecIdEvent)
-		if d != nil {
-			out = d
-		}
-		err = e
-	case "Spec ID Event02\x00":
-		d, e := decodeSpecIdEvent(stream, data, parseEFI_1_2_SpecIdEvent)
-		if d != nil {
-			out = d
-		}
-		err = e
-	case "Spec ID Event03\x00":
-		d, e := decodeSpecIdEvent(stream, data, parseEFI_2_SpecIdEvent)
-		if d != nil {
-			out = d
-		}
-		err = e
-	case "SP800-155 Event\x00":
-		d, e := decodeBIMReferenceManifestEvent(stream, data)
-		if d != nil {
-			out = d
-		}
-		err = e
-	case "StartupLocality\x00":
-		d, e := decodeStartupLocalityEvent(stream, data)
-		if d != nil {
-			out = d
-		}
-		err = e
-	default:
-		return &unknownNoActionEventData{data}, 0, nil
-	}
-
-	return
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf (section 11.3.3 "EV_ACTION event types")
-// https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf (section 9.4.3 "EV_ACTION Event Types")
-func decodeEventDataAction(data []byte) (*asciiStringEventData, int, error) {
-	return &asciiStringEventData{data: data}, 0, nil
-}
-
-type separatorEventData struct {
-	data    []byte
-	isError bool
-}
-
-func (e *separatorEventData) String() string {
-	if !e.isError {
-		return ""
-	}
-	return "*ERROR*"
-}
-
-func (e *separatorEventData) Bytes() []byte {
-	return e.data
-}
-
-func decodeEventDataSeparator(data []byte, isError bool) (*separatorEventData, int, error) {
-	return &separatorEventData{data: data, isError: isError}, 0, nil
-}
-
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf (section 11.3.1 "Event Types")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf (section 7.2 "Event Types")
-// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf (section 9.4.1 "Event Types")
-func decodeEventDataTCG(eventType EventType, data []byte,
-	hasDigestOfSeparatorError bool) (out EventData, trailingBytes int, err error) {
-	switch eventType {
-	case EventTypeNoAction:
-		return decodeEventDataNoAction(data)
-	case EventTypeSeparator:
-		return decodeEventDataSeparator(data, hasDigestOfSeparatorError)
-	case EventTypeAction, EventTypeEFIAction:
-		return decodeEventDataAction(data)
-	case EventTypeEFIVariableDriverConfig, EventTypeEFIVariableBoot, EventTypeEFIVariableAuthority:
-		return decodeEventDataEFIVariable(data, eventType)
-	case EventTypeEFIBootServicesApplication, EventTypeEFIBootServicesDriver,
-		EventTypeEFIRuntimeServicesDriver:
-		return decodeEventDataEFIImageLoad(data)
-	case EventTypeEFIGPTEvent:
-		return decodeEventDataEFIGPT(data)
-	default:
-	}
-	return nil, 0, nil
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/types.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/types.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/types.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/types.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,182 +0,0 @@
-package tcglog
-
-import (
-	"crypto"
-	_ "crypto/sha1"
-	_ "crypto/sha256"
-	_ "crypto/sha512"
-	"fmt"
-	"hash"
-)
-
-// Spec corresponds to the TCG specification that an event log conforms to.
-type Spec uint
-
-// PCRIndex corresponds to the index of a PCR on the TPM.
-type PCRIndex uint32
-
-// EventType corresponds to the type of an event in an event log.
-type EventType uint32
-
-// AlgorithmId corresponds to the algorithm of digests that appear in the log. The values are in sync with those
-// in the TPM Library Specification for the TPM_ALG_ID type.
-// See https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf (Table 9)
-type AlgorithmId uint16
-
-func (a AlgorithmId) getHash() crypto.Hash {
-	switch a {
-	case AlgorithmSha1:
-		return crypto.SHA1
-	case AlgorithmSha256:
-		return crypto.SHA256
-	case AlgorithmSha384:
-		return crypto.SHA384
-	case AlgorithmSha512:
-		return crypto.SHA512
-	default:
-		return 0
-	}
-}
-
-func (a AlgorithmId) supported() bool {
-	return a.getHash() != crypto.Hash(0)
-}
-
-func (a AlgorithmId) size() int {
-	return a.getHash().Size()
-}
-
-func (a AlgorithmId) newHash() hash.Hash {
-	return a.getHash().New()
-}
-
-func (a AlgorithmId) hash(data []byte) []byte {
-	h := a.newHash()
-	h.Write(data)
-	return h.Sum(nil)
-}
-
-// Digest is the result of hashing some data.
-type Digest []byte
-
-// DigestMap is a map of algorithms to digests.
-type DigestMap map[AlgorithmId]Digest
-
-func (e EventType) String() string {
-	switch e {
-	case EventTypePrebootCert:
-		return "EV_PREBOOT_CERT"
-	case EventTypePostCode:
-		return "EV_POST_CODE"
-	case EventTypeNoAction:
-		return "EV_NO_ACTION"
-	case EventTypeSeparator:
-		return "EV_SEPARATOR"
-	case EventTypeAction:
-		return "EV_ACTION"
-	case EventTypeEventTag:
-		return "EV_EVENT_TAG"
-	case EventTypeSCRTMContents:
-		return "EV_S_CRTM_CONTENTS"
-	case EventTypeSCRTMVersion:
-		return "EV_S_CRTM_VERSION"
-	case EventTypeCPUMicrocode:
-		return "EV_CPU_MICROCODE"
-	case EventTypePlatformConfigFlags:
-		return "EV_PLATFORM_CONFIG_FLAGS"
-	case EventTypeTableOfDevices:
-		return "EV_TABLE_OF_DEVICES"
-	case EventTypeCompactHash:
-		return "EV_COMPACT_HASH"
-	case EventTypeIPL:
-		return "EV_IPL"
-	case EventTypeIPLPartitionData:
-		return "EV_IPL_PARTITION_DATA"
-	case EventTypeNonhostCode:
-		return "EV_NONHOST_CODE"
-	case EventTypeNonhostConfig:
-		return "EV_NONHOST_CONFIG"
-	case EventTypeNonhostInfo:
-		return "EV_NONHOST_INFO"
-	case EventTypeOmitBootDeviceEvents:
-		return "EV_OMIT_BOOT_DEVICE_EVENTS"
-	case EventTypeEFIVariableDriverConfig:
-		return "EV_EFI_VARIABLE_DRIVER_CONFIG"
-	case EventTypeEFIVariableBoot:
-		return "EV_EFI_VARIABLE_BOOT"
-	case EventTypeEFIBootServicesApplication:
-		return "EV_EFI_BOOT_SERVICES_APPLICATION"
-	case EventTypeEFIBootServicesDriver:
-		return "EV_EFI_BOOT_SERVICES_DRIVER"
-	case EventTypeEFIRuntimeServicesDriver:
-		return "EV_EFI_RUNTIME_SERVICES_DRIVER"
-	case EventTypeEFIGPTEvent:
-		return "EF_EFI_GPT_EVENT"
-	case EventTypeEFIAction:
-		return "EV_EFI_ACTION"
-	case EventTypeEFIPlatformFirmwareBlob:
-		return "EV_EFI_PLATFORM_FIRMWARE_BLOB"
-	case EventTypeEFIHandoffTables:
-		return "EV_EFI_HANDOFF_TABLES"
-	case EventTypeEFIHCRTMEvent:
-		return "EV_EFI_HCRTM_EVENT"
-	case EventTypeEFIVariableAuthority:
-		return "EV_EFI_VARIABLE_AUTHORITY"
-	default:
-		return fmt.Sprintf("%08x", uint32(e))
-	}
-}
-
-func (e EventType) Format(s fmt.State, f rune) {
-	switch f {
-	case 's':
-		fmt.Fprintf(s, "%s", e.String())
-	default:
-		fmt.Fprintf(s, makeDefaultFormatter(s, f), uint32(e))
-	}
-}
-
-func (a AlgorithmId) String() string {
-	switch a {
-	case AlgorithmSha1:
-		return "SHA-1"
-	case AlgorithmSha256:
-		return "SHA-256"
-	case AlgorithmSha384:
-		return "SHA-384"
-	case AlgorithmSha512:
-		return "SHA-512"
-	default:
-		return fmt.Sprintf("%04x", uint16(a))
-	}
-}
-
-func (a AlgorithmId) Format(s fmt.State, f rune) {
-	switch f {
-	case 's':
-		fmt.Fprintf(s, "%s", a.String())
-	default:
-		fmt.Fprintf(s, makeDefaultFormatter(s, f), uint16(a))
-	}
-}
-
-// AlgorithmListId is a slice of AlgorithmId values,
-type AlgorithmIdList []AlgorithmId
-
-func (l AlgorithmIdList) Contains(a AlgorithmId) bool {
-	for _, alg := range l {
-		if alg == a {
-			return true
-		}
-	}
-	return false
-}
-
-// Event corresponds to a single event in an event log.
-type Event struct {
-	Index     uint      // Sequential index of event in the log
-	PCRIndex  PCRIndex  // PCR index to which this event was measured
-	EventType EventType // The type of this event
-	Digests   DigestMap // The digests corresponding to this event for the supported algorithms
-	Data      EventData // The data recorded with this event
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/utils.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/utils.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/utils.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/utils.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,84 +0,0 @@
-package tcglog
-
-import (
-	"bytes"
-	"fmt"
-	"strconv"
-	"unicode/utf16"
-	"unicode/utf8"
-)
-
-func makeDefaultFormatter(s fmt.State, f rune) string {
-	var builder bytes.Buffer
-	builder.WriteString("%%")
-	for _, flag := range [...]int{'+', '-', '#', ' ', '0'} {
-		if s.Flag(flag) {
-			fmt.Fprintf(&builder, "%c", flag)
-		}
-	}
-	if width, ok := s.Width(); ok {
-		fmt.Fprintf(&builder, "%d", width)
-	}
-	if prec, ok := s.Precision(); ok {
-		fmt.Fprintf(&builder, ".%d", prec)
-	}
-	fmt.Fprintf(&builder, "%c", f)
-	return builder.String()
-}
-
-type PCRArgList []PCRIndex
-
-func (l *PCRArgList) String() string {
-	var builder bytes.Buffer
-	for i, pcr := range *l {
-		if i > 0 {
-			builder.WriteString(", ")
-		}
-		fmt.Fprintf(&builder, "%d", pcr)
-	}
-	return builder.String()
-}
-
-func (l *PCRArgList) Set(value string) error {
-	v, err := strconv.ParseUint(value, 10, 32)
-	if err != nil {
-		return err
-	}
-	*l = append(*l, PCRIndex(v))
-	return nil
-}
-
-func ParseAlgorithm(alg string) (AlgorithmId, error) {
-	switch alg {
-	case "sha1":
-		return AlgorithmSha1, nil
-	case "sha256":
-		return AlgorithmSha256, nil
-	case "sha384":
-		return AlgorithmSha384, nil
-	case "sha512":
-		return AlgorithmSha512, nil
-	default:
-		return 0, fmt.Errorf("Unrecognized algorithm \"%s\"", alg)
-	}
-}
-
-func convertStringToUtf16(str string) []uint16 {
-	var unicodePoints []rune
-	for len(str) > 0 {
-		r, s := utf8.DecodeRuneInString(str)
-		unicodePoints = append(unicodePoints, r)
-		str = str[s:]
-	}
-	return utf16.Encode(unicodePoints)
-}
-
-func convertUtf16ToString(u []uint16) string {
-	var utf8Str []byte
-	for _, r := range utf16.Decode(u) {
-		utf8Char := make([]byte, utf8.RuneLen(r))
-		utf8.EncodeRune(utf8Char, r)
-		utf8Str = append(utf8Str, utf8Char...)
-	}
-	return string(utf8Str)
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/validate.go snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/validate.go
--- snapd-2.45.1+20.04.2/vendor/github.com/chrisccoulson/tcglog-parser/validate.go	2020-04-06 18:31:34.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/chrisccoulson/tcglog-parser/validate.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,228 +0,0 @@
-package tcglog
-
-import (
-	"bytes"
-	"encoding/binary"
-	"io"
-	"os"
-)
-
-type EFIBootVariableBehaviour int
-
-const (
-	EFIBootVariableBehaviourUnknown EFIBootVariableBehaviour = iota
-	EFIBootVariableBehaviourFull
-	EFIBootVariableBehaviourVarDataOnly
-)
-
-type IncorrectDigestValue struct {
-	Algorithm AlgorithmId
-	Expected  Digest
-}
-
-type ValidatedEvent struct {
-	Event                      *Event
-	MeasuredBytes              []byte
-	MeasuredTrailingBytesCount int
-	IncorrectDigestValues      []IncorrectDigestValue
-}
-
-type LogValidateResult struct {
-	EfiBootVariableBehaviour EFIBootVariableBehaviour
-	ValidatedEvents          []*ValidatedEvent
-	Spec                     Spec
-	Algorithms               AlgorithmIdList
-	ExpectedPCRValues        map[PCRIndex]DigestMap
-}
-
-func doesEventTypeExtendPCR(t EventType) bool {
-	if t == EventTypeNoAction {
-		return false
-	}
-	return true
-}
-
-func performHashExtendOperation(alg AlgorithmId, initial Digest, event Digest) Digest {
-	hash := alg.newHash()
-	hash.Write(initial)
-	hash.Write(event)
-	return hash.Sum(nil)
-}
-
-func determineMeasuredBytes(event *Event, efiBootVariableQuirk bool) ([]byte, bool) {
-	switch d := event.Data.(type) {
-	case *opaqueEventData:
-		switch event.EventType {
-		case EventTypeEventTag, EventTypeSCRTMVersion, EventTypePlatformConfigFlags,
-			EventTypeTableOfDevices, EventTypeNonhostInfo, EventTypeOmitBootDeviceEvents:
-			return event.Data.Bytes(), false
-		}
-	case *separatorEventData:
-		if !d.isError {
-			return event.Data.Bytes(), false
-		} else {
-			out := make([]byte, 4)
-			binary.LittleEndian.PutUint32(out, separatorEventErrorValue)
-			return out, false
-		}
-	case *asciiStringEventData:
-		switch event.EventType {
-		case EventTypeAction, EventTypeEFIAction:
-			return event.Data.Bytes(), false
-		}
-	case *EFIVariableEventData:
-		if event.EventType == EventTypeEFIVariableBoot && efiBootVariableQuirk {
-			return d.VariableData, false
-		} else {
-			return event.Data.Bytes(), true
-		}
-	case *efiGPTEventData:
-		return event.Data.Bytes(), true
-	case *GrubStringEventData:
-		return []byte(d.Str), false
-	case *SystemdEFIStubEventData:
-		// The event data is a UTF-16 string terminated with a single zero byte, but the measured
-		// data is a UTF-16 string with a UTF-16 null terminator. Add an extra zero byte here
-		c := make([]byte, len(d.data)+1)
-		copy(c, d.data)
-		return c, false
-	}
-
-	return nil, false
-}
-
-func isExpectedDigestValue(digest Digest, alg AlgorithmId, measuredBytes []byte) (bool, []byte) {
-	expected := alg.hash(measuredBytes)
-	return bytes.Equal(digest, expected), expected
-}
-
-type logValidator struct {
-	log                      *Log
-	expectedPCRValues        map[PCRIndex]DigestMap
-	efiBootVariableBehaviour EFIBootVariableBehaviour
-	validatedEvents          []*ValidatedEvent
-}
-
-func (v *logValidator) checkEventDigests(e *ValidatedEvent, trailingBytes int) {
-	for alg, digest := range e.Event.Digests {
-		if len(e.MeasuredBytes) > 0 {
-			// We've already determined the bytes measured for this event for a previous digest
-			if ok, expected := isExpectedDigestValue(digest, alg, e.MeasuredBytes); !ok {
-				e.IncorrectDigestValues = append(e.IncorrectDigestValues,
-					IncorrectDigestValue{Algorithm: alg, Expected: expected})
-			}
-			continue
-		}
-
-		efiBootVariableBehaviourTry := v.efiBootVariableBehaviour
-
-	Loop:
-		for {
-			// Determine what we expect to be measured
-			provisionalMeasuredBytes, checkTrailingBytes := determineMeasuredBytes(e.Event, efiBootVariableBehaviourTry == EFIBootVariableBehaviourVarDataOnly)
-			if provisionalMeasuredBytes == nil {
-				return
-			}
-
-			var provisionalMeasuredTrailingBytes int
-			if checkTrailingBytes {
-				provisionalMeasuredTrailingBytes = trailingBytes
-			}
-
-			for {
-				// Determine whether the digest is consistent with the current provisional measured bytes
-				ok, _ := isExpectedDigestValue(digest, alg, provisionalMeasuredBytes)
-				switch {
-				case ok:
-					// All good
-					e.MeasuredBytes = provisionalMeasuredBytes
-					e.MeasuredTrailingBytesCount = provisionalMeasuredTrailingBytes
-					if e.Event.EventType == EventTypeEFIVariableBoot && v.efiBootVariableBehaviour == EFIBootVariableBehaviourUnknown {
-						// This is the first EV_EFI_VARIABLE_BOOT event, so record the measurement behaviour.
-						v.efiBootVariableBehaviour = efiBootVariableBehaviourTry
-						if efiBootVariableBehaviourTry == EFIBootVariableBehaviourUnknown {
-							v.efiBootVariableBehaviour = EFIBootVariableBehaviourFull
-						}
-					}
-					break Loop
-				case provisionalMeasuredTrailingBytes > 0:
-					// Invalid digest, the event data decoder determined there were trailing bytes, and we were expecting the measured
-					// bytes to match the event data. Test if any of the trailing bytes only appear in the event data by truncating
-					// the provisional measured bytes one byte at a time and re-testing.
-					provisionalMeasuredBytes = provisionalMeasuredBytes[0 : len(provisionalMeasuredBytes)-1]
-					provisionalMeasuredTrailingBytes -= 1
-				default:
-					// Invalid digest
-					if e.Event.EventType == EventTypeEFIVariableBoot && efiBootVariableBehaviourTry == EFIBootVariableBehaviourUnknown {
-						// This is the first EV_EFI_VARIABLE_BOOT event, and this test was done assuming that the measured bytes
-						// would include the entire EFI_VARIABLE_DATA structure. Repeat the test with only the variable data.
-						efiBootVariableBehaviourTry = EFIBootVariableBehaviourVarDataOnly
-						continue Loop
-					}
-					// Record the expected digest on the event
-					expectedMeasuredBytes, _ := determineMeasuredBytes(e.Event, false)
-					e.IncorrectDigestValues = append(
-						e.IncorrectDigestValues,
-						IncorrectDigestValue{Algorithm: alg, Expected: alg.hash(expectedMeasuredBytes)})
-					break Loop
-				}
-			}
-		}
-	}
-}
-
-func (v *logValidator) processEvent(event *Event, trailingBytes int) {
-	if _, exists := v.expectedPCRValues[event.PCRIndex]; !exists {
-		v.expectedPCRValues[event.PCRIndex] = DigestMap{}
-		for _, alg := range v.log.Algorithms {
-			v.expectedPCRValues[event.PCRIndex][alg] = make(Digest, alg.size())
-		}
-	}
-
-	ve := &ValidatedEvent{Event: event}
-	v.validatedEvents = append(v.validatedEvents, ve)
-
-	if !doesEventTypeExtendPCR(event.EventType) {
-		return
-	}
-
-	for alg, digest := range event.Digests {
-		v.expectedPCRValues[event.PCRIndex][alg] =
-			performHashExtendOperation(alg, v.expectedPCRValues[event.PCRIndex][alg], digest)
-	}
-
-	v.checkEventDigests(ve, trailingBytes)
-}
-
-func (v *logValidator) run() (*LogValidateResult, error) {
-	for {
-		event, trailingBytes, err := v.log.nextEventInternal()
-		if err != nil {
-			if err == io.EOF {
-				return &LogValidateResult{
-					EfiBootVariableBehaviour: v.efiBootVariableBehaviour,
-					ValidatedEvents:          v.validatedEvents,
-					Spec:                     v.log.Spec,
-					Algorithms:               v.log.Algorithms,
-					ExpectedPCRValues:        v.expectedPCRValues}, nil
-			}
-			return nil, err
-		}
-		v.processEvent(event, trailingBytes)
-	}
-}
-
-func ReplayAndValidateLog(logPath string, options LogOptions) (*LogValidateResult, error) {
-	file, err := os.Open(logPath)
-	if err != nil {
-		return nil, err
-	}
-
-	log, err := NewLog(file, options)
-	if err != nil {
-		return nil, err
-	}
-
-	v := &logValidator{log: log, expectedPCRValues: make(map[PCRIndex]DigestMap)}
-	return v.run()
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/diff.go snapd-2.48.3+20.04/vendor/github.com/kr/pretty/diff.go
--- snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/diff.go	2019-08-27 16:08:29.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/kr/pretty/diff.go	2020-08-13 11:17:05.000000000 +0000
@@ -41,7 +41,12 @@
 // It calls Printf once for each difference, with no trailing newline.
 // The standard library log.Logger is a Printfer.
 func Pdiff(p Printfer, a, b interface{}) {
-	diffPrinter{w: p}.diff(reflect.ValueOf(a), reflect.ValueOf(b))
+	d := diffPrinter{
+		w:        p,
+		aVisited: make(map[visit]visit),
+		bVisited: make(map[visit]visit),
+	}
+	d.diff(reflect.ValueOf(a), reflect.ValueOf(b))
 }
 
 type Logfer interface {
@@ -66,6 +71,9 @@
 type diffPrinter struct {
 	w Printfer
 	l string // label
+
+	aVisited map[visit]visit
+	bVisited map[visit]visit
 }
 
 func (w diffPrinter) printf(f string, a ...interface{}) {
@@ -96,6 +104,28 @@
 		return
 	}
 
+	if av.CanAddr() && bv.CanAddr() {
+		avis := visit{av.UnsafeAddr(), at}
+		bvis := visit{bv.UnsafeAddr(), bt}
+		var cycle bool
+
+		// Have we seen this value before?
+		if vis, ok := w.aVisited[avis]; ok {
+			cycle = true
+			if vis != bvis {
+				w.printf("%# v (previously visited) != %# v", formatter{v: av, quote: true}, formatter{v: bv, quote: true})
+			}
+		} else if _, ok := w.bVisited[bvis]; ok {
+			cycle = true
+			w.printf("%# v != %# v (previously visited)", formatter{v: av, quote: true}, formatter{v: bv, quote: true})
+		}
+		w.aVisited[avis] = bvis
+		w.bVisited[bvis] = avis
+		if cycle {
+			return
+		}
+	}
+
 	switch kind := at.Kind(); kind {
 	case reflect.Bool:
 		if a, b := av.Bool(), bv.Bool(); a != b {
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/formatter.go snapd-2.48.3+20.04/vendor/github.com/kr/pretty/formatter.go
--- snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/formatter.go	2019-08-27 16:08:29.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/kr/pretty/formatter.go	2020-08-13 11:17:05.000000000 +0000
@@ -37,7 +37,7 @@
 	s := "%"
 	for i := 0; i < 128; i++ {
 		if f.Flag(i) {
-			s += string(i)
+			s += string(rune(i))
 		}
 	}
 	if w, ok := f.Width(); ok {
@@ -125,7 +125,6 @@
 			}
 			keys := v.MapKeys()
 			for i := 0; i < v.Len(); i++ {
-				showTypeInStruct := true
 				k := keys[i]
 				mv := v.MapIndex(k)
 				pp.printValue(k, false, true)
@@ -133,7 +132,7 @@
 				if expand {
 					writeByte(pp, '\t')
 				}
-				showTypeInStruct = t.Elem().Kind() == reflect.Interface
+				showTypeInStruct := t.Elem().Kind() == reflect.Interface
 				pp.printValue(mv, showTypeInStruct, true)
 				if expand {
 					io.WriteString(pp, ",\n")
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/go.mod snapd-2.48.3+20.04/vendor/github.com/kr/pretty/go.mod
--- snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/go.mod	2019-08-27 16:08:29.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/kr/pretty/go.mod	2020-08-13 11:17:05.000000000 +0000
@@ -1,3 +1,5 @@
-module "github.com/kr/pretty"
+module github.com/kr/pretty
 
-require "github.com/kr/text" v0.1.0
+go 1.12
+
+require github.com/kr/text v0.1.0
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/go.sum snapd-2.48.3+20.04/vendor/github.com/kr/pretty/go.sum
--- snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/go.sum	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/kr/pretty/go.sum	2020-08-13 11:17:05.000000000 +0000
@@ -0,0 +1,3 @@
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/License snapd-2.48.3+20.04/vendor/github.com/kr/pretty/License
--- snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/License	2019-08-27 16:08:29.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/kr/pretty/License	2020-08-13 11:17:05.000000000 +0000
@@ -1,5 +1,3 @@
-The MIT License (MIT)
-
 Copyright 2012 Keith Rarick
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/pretty.go snapd-2.48.3+20.04/vendor/github.com/kr/pretty/pretty.go
--- snapd-2.45.1+20.04.2/vendor/github.com/kr/pretty/pretty.go	2019-08-27 16:08:29.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/kr/pretty/pretty.go	2020-08-13 11:17:05.000000000 +0000
@@ -75,7 +75,7 @@
 
 // Println pretty-prints its operands and writes to standard output.
 //
-// Calling Print(x, y) is equivalent to
+// Calling Println(x, y) is equivalent to
 // fmt.Println(Formatter(x), Formatter(y)), but each operand is
 // formatted with "%# v".
 func Println(a ...interface{}) (n int, errno error) {
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/mvo5/goconfigparser/configparser.go snapd-2.48.3+20.04/vendor/github.com/mvo5/goconfigparser/configparser.go
--- snapd-2.45.1+20.04.2/vendor/github.com/mvo5/goconfigparser/configparser.go	2019-08-27 16:08:32.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/mvo5/goconfigparser/configparser.go	2020-08-10 18:34:35.000000000 +0000
@@ -14,8 +14,9 @@
 )
 
 // see python3 configparser.py
-var sectionRE = regexp.MustCompile(`\[(?P<header>[^]]+)\]`)
+var sectionRE = regexp.MustCompile(`^\[(?P<header>[^]]+)\]`)
 var optionRE = regexp.MustCompile(`^(?P<option>.*?)\s*(?P<vi>[=|:])\s*(?P<value>.*)$`)
+var commentRE = regexp.MustCompile(`^\s*[#;].*$`)
 
 var booleanStates = map[string]bool{
 	"1": true, "yes": true, "true": true, "on": true,
@@ -104,7 +105,7 @@
 
 	curSect := ""
 	// we allow files with no [section] header in this mode, by
-	// default its a error to be alinged with what python configparser
+	// default its a error to be aligned with what python configparser
 	// is doing
 	if c.AllowNoSectionHeader {
 		c.sections[""] = Section{
@@ -112,7 +113,9 @@
 	}
 	for scanner.Scan() {
 		line := scanner.Text()
-		if sectionRE.MatchString(line) {
+		if commentRE.MatchString(line) {
+			// Do nothing
+		} else if sectionRE.MatchString(line) {
 			matches := sectionRE.FindStringSubmatch(line)
 			curSect = matches[1]
 			c.sections[curSect] = Section{
@@ -121,6 +124,7 @@
 			matches := optionRE.FindStringSubmatch(line)
 			key := matches[1]
 			value := matches[3]
+			value = strings.Replace(value, "%%", "%", -1)
 			if _, ok := c.sections[curSect]; !ok {
 				return newNoSectionError(curSect)
 			}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/mvo5/goconfigparser/README.md snapd-2.48.3+20.04/vendor/github.com/mvo5/goconfigparser/README.md
--- snapd-2.45.1+20.04.2/vendor/github.com/mvo5/goconfigparser/README.md	2019-08-27 16:08:32.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/mvo5/goconfigparser/README.md	2020-08-10 18:34:35.000000000 +0000
@@ -1,3 +1,5 @@
+[![Build Status][travis-image]][travis-url]
+[![GoDoc][godoc-image]][godoc-url]
 Config File Parser (INI style)
 ==============================
 
@@ -7,6 +9,36 @@
 configuration files from go and also ease the porting of existing
 python code.
 
+Example usage:
+```golang
+package main
+
+import (
+	"fmt"
+
+	"github.com/mvo5/goconfigparser"
+)
+
+var cfgExample = `[service]
+base: something
+`
+
+var cfgExample2 = `[service]
+base=something
+`
+
+func main() {
+	cfg := goconfigparser.New()
+	cfg.ReadString(cfgExample)
+	val, err := cfg.Get("service", "base")
+	if err != nil {
+		panic(err)
+	}
+	fmt.Printf("Got value %q\n", val)
+}
+```
+
+
 It implements most of RawConfigParser (i.e. no interpolation) at this
 point.
 
@@ -15,4 +47,10 @@
  * no interpolation
  * no defaults
  * no write support
- * not all API is provided
\ No newline at end of file
+ * not all API is provided
+
+[travis-image]: https://travis-ci.org/mvo5/goconfigparser.svg?branch=master
+[travis-url]: https://travis-ci.org/mvo5/goconfigparser
+
+[godoc-image]: https://godoc.org/github.com/mvo5/goconfigparser?status.svg
+[godoc-url]: https://godoc.org/github.com/mvo5/goconfigparser
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/bolt/bolt_riscv64.go snapd-2.48.3+20.04/vendor/github.com/snapcore/bolt/bolt_riscv64.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/bolt/bolt_riscv64.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/bolt/bolt_riscv64.go	2020-07-14 08:06:24.000000000 +0000
@@ -0,0 +1,12 @@
+// +build riscv64
+
+package bolt
+
+// maxMapSize represents the largest mmap size supported by Bolt.
+const maxMapSize = 0xFFFFFFFFFFFF // 256TB
+
+// maxAllocSize is the size used when creating array pointers.
+const maxAllocSize = 0x7FFFFFFF
+
+// Are unaligned load/stores broken on this arch?
+var brokenUnaligned = false
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/constants.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/constants.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/constants.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/constants.go	2020-11-05 20:13:01.000000000 +0000
@@ -24,62 +24,9 @@
 )
 
 const (
-	// Default RSA2048 SRK handle, see section 7.8 of "TCG TPM v2.0 Provisioning Guidance" Version 1.0, Revision 1.0, 15 March 2017
-	srkHandle tpm2.Handle = 0x81000001
-
-	// Default RSA2048 EK handle, see section 7.8 of "TCG TPM v2.0 Provisioning Guidance" Version 1.0, Revision 1.0, 15 March 2017
-	ekHandle tpm2.Handle = 0x81010001
-
-	lockNVHandle     tpm2.Handle = 0x01801100 // Global NV handle for locking access to sealed key objects
-	lockNVDataHandle tpm2.Handle = 0x01801101 // NV index containing policy data for lockNVHandle
+	lockNVHandle tpm2.Handle = 0x01801100 // Legacy global NV handle for locking access to sealed key objects
 
 	// SHA-256 is mandatory to exist on every PC-Client TPM
 	// XXX: Maybe dynamically select algorithms based on what's available on the device?
 	defaultSessionHashAlgorithm tpm2.HashAlgorithmId = tpm2.HashAlgorithmSHA256
 )
-
-func makeDefaultEKTemplate() *tpm2.Public {
-	return &tpm2.Public{
-		Type:    tpm2.ObjectTypeRSA,
-		NameAlg: tpm2.HashAlgorithmSHA256,
-		Attrs: tpm2.AttrFixedTPM | tpm2.AttrFixedParent | tpm2.AttrSensitiveDataOrigin | tpm2.AttrAdminWithPolicy | tpm2.AttrRestricted |
-			tpm2.AttrDecrypt,
-		AuthPolicy: []byte{0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc, 0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7,
-			0x6e, 0x06, 0x52, 0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa},
-		Params: tpm2.PublicParamsU{
-			Data: &tpm2.RSAParams{
-				Symmetric: tpm2.SymDefObject{
-					Algorithm: tpm2.SymObjectAlgorithmAES,
-					KeyBits:   tpm2.SymKeyBitsU{Data: uint16(128)},
-					Mode:      tpm2.SymModeU{Data: tpm2.SymModeCFB}},
-				Scheme:   tpm2.RSAScheme{Scheme: tpm2.RSASchemeNull},
-				KeyBits:  2048,
-				Exponent: 0}},
-		Unique: tpm2.PublicIDU{Data: make(tpm2.PublicKeyRSA, 256)}}
-}
-
-func makeDefaultSRKTemplate() *tpm2.Public {
-	return &tpm2.Public{
-		Type:    tpm2.ObjectTypeRSA,
-		NameAlg: tpm2.HashAlgorithmSHA256,
-		Attrs: tpm2.AttrFixedTPM | tpm2.AttrFixedParent | tpm2.AttrSensitiveDataOrigin | tpm2.AttrUserWithAuth | tpm2.AttrNoDA |
-			tpm2.AttrRestricted | tpm2.AttrDecrypt,
-		Params: tpm2.PublicParamsU{
-			Data: &tpm2.RSAParams{
-				Symmetric: tpm2.SymDefObject{
-					Algorithm: tpm2.SymObjectAlgorithmAES,
-					KeyBits:   tpm2.SymKeyBitsU{Data: uint16(128)},
-					Mode:      tpm2.SymModeU{Data: tpm2.SymModeCFB}},
-				Scheme:   tpm2.RSAScheme{Scheme: tpm2.RSASchemeNull},
-				KeyBits:  2048,
-				Exponent: 0}},
-		Unique: tpm2.PublicIDU{Data: make(tpm2.PublicKeyRSA, 256)}}
-}
-
-var (
-	// Default RSA2048 EK template, see section B.3.3 of "TCG EK Credential Profile For TPM Family 2.0; Level 0", Version 2.1, Revision 13, 10 December 2018
-	ekTemplate = makeDefaultEKTemplate()
-
-	// srkTemplate is the default RSA2048 SRK template, see section 7.5.1 of "TCG TPM v2.0 Provisioning Guidance", version 1.0, revision 1.0, 15 March 2017.
-	srkTemplate = makeDefaultSRKTemplate()
-)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/crypt.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/crypt.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/crypt.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/crypt.go	2021-02-02 08:21:12.000000000 +0000
@@ -30,9 +30,12 @@
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/snapcore/snapd/osutil"
+
 	"golang.org/x/sys/unix"
 	"golang.org/x/xerrors"
 )
@@ -42,8 +45,61 @@
 var (
 	runDir                = "/run"
 	systemdCryptsetupPath = "/lib/systemd/systemd-cryptsetup"
+
+	defaultKeyringPrefix = "secboot"
 )
 
+func keyringPrefixOrDefault(prefix string) string {
+	if prefix == "" {
+		return defaultKeyringPrefix
+	}
+	return prefix
+}
+
+// RecoveryKey corresponds to a 16-byte recovery key in its binary form.
+type RecoveryKey [16]byte
+
+func (k RecoveryKey) String() string {
+	var u16 [8]uint16
+	for i := 0; i < 8; i++ {
+		u16[i] = binary.LittleEndian.Uint16(k[i*2:])
+	}
+	return fmt.Sprintf("%05d-%05d-%05d-%05d-%05d-%05d-%05d-%05d", u16[0], u16[1], u16[2], u16[3], u16[4], u16[5], u16[6], u16[7])
+}
+
+// ParseRecoveryKey interprets the supplied string and returns the corresponding RecoveryKey. The recovery key is a
+// 16-byte number, and the formatted version of this is represented as 8 5-digit zero-extended base-10 numbers (each
+// with a range of 00000-65535) which may be separated by an optional '-', eg:
+//
+// "61665-00531-54469-09783-47273-19035-40077-28287"
+//
+// The formatted version of the recovery key is designed to be able to be inputted on a numeric keypad.
+func ParseRecoveryKey(s string) (out RecoveryKey, err error) {
+	for i := 0; i < 8; i++ {
+		if len(s) < 5 {
+			return RecoveryKey{}, errors.New("incorrectly formatted: insufficient characters")
+		}
+		x, err := strconv.ParseUint(s[0:5], 10, 16)
+		if err != nil {
+			return RecoveryKey{}, xerrors.Errorf("incorrectly formatted: %w", err)
+		}
+		binary.LittleEndian.PutUint16(out[i*2:], uint16(x))
+
+		// Move to the next 5 digits
+		s = s[5:]
+		// Permit each set of 5 digits to be separated by an optional '-', but don't allow the formatted key to end or begin with one.
+		if len(s) > 1 && s[0] == '-' {
+			s = s[1:]
+		}
+	}
+
+	if len(s) > 0 {
+		return RecoveryKey{}, errors.New("incorrectly formatted: too many characters")
+	}
+
+	return
+}
+
 type execError struct {
 	path string
 	err  error
@@ -69,27 +125,44 @@
 	return xerrors.As(err, &e) && e.path == path
 }
 
-func activate(volumeName, sourceDevicePath string, key []byte, options []string) error {
-	keyFilePath, err := func() (string, error) {
-		f, err := ioutil.TempFile(runDir, filepath.Base(os.Args[0])+".")
-		if err != nil {
-			return "", xerrors.Errorf("cannot create temporary file: %w", err)
-		}
-		defer f.Close()
-		if err := f.Chmod(0600); err != nil {
-			return "", err
-		}
-		if _, err := f.Write(key); err != nil {
-			return "", xerrors.Errorf("cannot write key to file: %w", err)
+func mkFifo() (string, func(), error) {
+	// /run is not world writable but we create a unique directory here because this
+	// code can be invoked by a public API and we shouldn't fail if more than one
+	// process reaches here at the same time.
+	dir, err := ioutil.TempDir(runDir, filepath.Base(os.Args[0])+".")
+	if err != nil {
+		return "", nil, xerrors.Errorf("cannot create temporary directory: %w", err)
+	}
+
+	cleanup := func() {
+		os.RemoveAll(dir)
+	}
+
+	succeeded := false
+	defer func() {
+		if succeeded {
+			return
 		}
-		return f.Name(), nil
+		cleanup()
 	}()
+
+	fifo := filepath.Join(dir, "fifo")
+	if err := unix.Mkfifo(fifo, 0600); err != nil {
+		return "", nil, xerrors.Errorf("cannot create FIFO: %w", err)
+	}
+
+	succeeded = true
+	return fifo, cleanup, nil
+}
+
+func activate(volumeName, sourceDevicePath string, key []byte, options []string) error {
+	fifoPath, cleanupFifo, err := mkFifo()
 	if err != nil {
-		return xerrors.Errorf("cannot temporarily save key for systemd-cryptsetup: %w", err)
+		return xerrors.Errorf("cannot create FIFO for passing key to systemd-cryptsetup: %w", err)
 	}
-	defer os.Remove(keyFilePath)
+	defer cleanupFifo()
 
-	cmd := exec.Command(systemdCryptsetupPath, "attach", volumeName, sourceDevicePath, keyFilePath, strings.Join(options, ","))
+	cmd := exec.Command(systemdCryptsetupPath, "attach", volumeName, sourceDevicePath, fifoPath, strings.Join(options, ","))
 	cmd.Env = os.Environ()
 	cmd.Env = append(cmd.Env, "SYSTEMD_LOG_TARGET=console")
 	stdout, err := cmd.StdoutPipe()
@@ -120,6 +193,23 @@
 		}
 		done <- true
 	}()
+
+	f, err := os.OpenFile(fifoPath, os.O_WRONLY, 0)
+	if err != nil {
+		// If we fail to open the write end, the read end will be blocked in open()
+		cmd.Process.Kill()
+		return xerrors.Errorf("cannot open FIFO for passing key to systemd-cryptsetup: %w", err)
+	}
+
+	if _, err := f.Write(key); err != nil {
+		f.Close()
+		// The read end is open and blocked inside read(). Closing our write end will result in the
+		// read end returning 0 bytes (EOF) and exitting cleanly.
+		cmd.Wait()
+		return xerrors.Errorf("cannot pass key to systemd-cryptsetup: %w", err)
+	}
+
+	f.Close()
 	for i := 0; i < 2; i++ {
 		<-done
 	}
@@ -159,62 +249,35 @@
 	return askPassword(sourceDevicePath, "Please enter the "+description+" for disk "+sourceDevicePath+":")
 }
 
-func decodeRecoveryKey(passphrase string) ([]byte, error) {
-	// The recovery key should be provided as 8 groups of 5 base-10 digits, with each 5 digits being converted to a 2-byte number to
-	// make a 16-byte key.
-	var key bytes.Buffer
-	for len(passphrase) > 0 {
-		if len(passphrase) < 5 {
-			return nil, errors.New("incorrectly formatted (insufficient characters)")
-		}
-		x, err := strconv.ParseUint(passphrase[0:5], 10, 16)
-		if err != nil {
-			return nil, errors.New("incorrectly formatted (invalid base-10 number)")
-		}
-		binary.Write(&key, binary.LittleEndian, uint16(x))
-
-		// Move to the next 5 digits
-		passphrase = passphrase[5:]
-		// Permit each set of 5 digits to be separated by '-', but don't allow the recovery key to end or begin with one.
-		if len(passphrase) > 1 && passphrase[0] == '-' {
-			passphrase = passphrase[1:]
-		}
-	}
-	return key.Bytes(), nil
-}
-
-// RecoveryKeyUsageReason indicates the reason that a volume had to be activated with the fallback recovery key instead of the TPM
-// sealed key.
-type RecoveryKeyUsageReason uint8
+// KeyErrorCode indicates the reason that a TPM protected key could not be used to activate a volume.
+type KeyErrorCode uint8
 
 const (
-	// RecoveryKeyUsageReasonUnexpectedError indicates that a volume had to be activated with the fallback recovery key because an
-	// unexpected error was encountered during activation with the TPM sealed key.
-	RecoveryKeyUsageReasonUnexpectedError RecoveryKeyUsageReason = iota + 1
-
-	// RecoveryKeyUsageReasonRequested indicates that a volume was activated with the fallback recovery key via the
-	// ActivateVolumeWithRecoveryKey API.
-	RecoveryKeyUsageReasonRequested
-
-	// RecoveryKeyUsageReasonTPMLockout indicates that a volume had to be activated with the fallback recovery key because the TPM is in
-	// dictionary attack lockout mode.
-	RecoveryKeyUsageReasonTPMLockout
-
-	// RecoveryKeyUsageReasonTPMProvisioningError indicates that a volume had to be activated with the fallback recovery key because the
-	// TPM is not correctly provisioned.
-	RecoveryKeyUsageReasonTPMProvisioningError
-
-	// RecoveryKeyUsageReasonInvalidKeyFile indicates that a volume had to be activated with the fallback recovery key because the TPM
-	// sealed key file is invalid. Note that attempts to resolve this by creating a new file with SealKeyToTPM may indicate that the TPM
-	// is also not correctly provisioned.
-	RecoveryKeyUsageReasonInvalidKeyFile
+	// KeyUnexpectedError indicates that a key could not be used because an unexpected error was encountered
+	// with it.
+	KeyUnexpectedError KeyErrorCode = iota + 1
+
+	// This is here for compatibility with old secboot versions running in early boot.
+	legacyRecoveryKeyRequested
+
+	// KeyErrorTPMLockout indicates that a key could not be used because the TPM is in dictionary attack
+	// lockout mode.
+	KeyErrorTPMLockout
+
+	// KeyErrorTPMProvisioning indicates that a key could not be used because the TPM is not correctly provisioned.
+	KeyErrorTPMProvisioning
+
+	// KeyErrorInvalidFile indicates that a key could not be used because the TPM sealed key is invalid. Note
+	// that attempts to resolve this by creating a new file with SealKeyToTPM may indicate that the TPM is also
+	// not correctly provisioned.
+	KeyErrorInvalidFile
 
-	// RecoveryKeyUsageReasonPINFail indicates that a volume had to be activated with the fallback recovery key because the correct PIN
+	// KeyErrorPassphraseFail indicates that a key could not be used because the correct user passphrase/PIN
 	// was not provided.
-	RecoveryKeyUsageReasonPINFail
+	KeyErrorPassphraseFail
 )
 
-func activateWithRecoveryKey(volumeName, sourceDevicePath string, keyReader io.Reader, tries int, reason RecoveryKeyUsageReason, activateOptions []string) error {
+func activateWithRecoveryKey(volumeName, sourceDevicePath string, keyReader io.Reader, tries int, reasons []KeyErrorCode, activateOptions []string, keyringPrefix string) error {
 	if tries == 0 {
 		return errors.New("no recovery key tries permitted")
 	}
@@ -232,13 +295,13 @@
 			return xerrors.Errorf("cannot obtain recovery key: %w", err)
 		}
 
-		key, err := decodeRecoveryKey(passphrase)
+		key, err := ParseRecoveryKey(passphrase)
 		if err != nil {
 			lastErr = xerrors.Errorf("cannot decode recovery key: %w", err)
 			continue
 		}
 
-		if err := activate(volumeName, sourceDevicePath, key, activateOptions); err != nil {
+		if err := activate(volumeName, sourceDevicePath, key[:], activateOptions); err != nil {
 			err = xerrors.Errorf("cannot activate volume: %w", err)
 			var e *exec.ExitError
 			if !xerrors.As(err, &e) {
@@ -248,108 +311,178 @@
 			continue
 		}
 
-		if _, err := unix.AddKey("user", fmt.Sprintf("%s:%s:reason=%d", filepath.Base(os.Args[0]), volumeName, reason), key, userKeyring); err != nil {
-			lastErr = xerrors.Errorf("cannot add recovery key to user keyring: %w", err)
+		// Add a key to the calling user's user keyring with default 0x3f010000 permissions (these defaults are hardcoded in the kernel).
+		// This permission flags define the following permissions:
+		// Possessor Set Attribute / Possessor Link / Possessor Search / Possessor Write / Possessor Read / Possessor View / User View.
+		// Possessor permissions only apply to a process with a searchable link to the key from one of its own keyrings - just having the
+		// same UID is not sufficient. Read permission is required to read the contents of the key (view permission only permits viewing
+		// of the description and other public metadata that isn't the key payload).
+		//
+		// Note that by default, systemd starts services with a private session keyring which does not contain a link to the user keyring.
+		// Therefore these services cannot access the contents of keys in the root user's user keyring if those keys only permit
+		// possessor-read.
+		//
+		// Ignore errors - we've activated the volume and so we shouldn't return an error at this point unless we close the volume again.
+		var desc bytes.Buffer
+		fmt.Fprintf(&desc, "%s:%s?type=recovery", keyringPrefixOrDefault(keyringPrefix), sourceDevicePath)
+		if len(reasons) == 0 {
+			fmt.Fprintf(&desc, "&requested")
+		} else {
+			fmt.Fprintf(&desc, "&errors=")
+			for i, e := range reasons {
+				if i > 0 {
+					fmt.Fprintf(&desc, ",")
+				}
+				fmt.Fprintf(&desc, "%d", e)
+			}
 		}
+		unix.AddKey("user", desc.String(), key[:], userKeyring)
 		break
 	}
 
 	return lastErr
 }
 
-func unsealKeyFromTPM(tpm *TPMConnection, k *SealedKeyObject, pin string) ([]byte, error) {
-	key, err := k.UnsealFromTPM(tpm, pin)
+func unsealKeyFromTPM(tpm *TPMConnection, k *SealedKeyObject, pin string) ([]byte, []byte, error) {
+	sealedKey, authPrivateKey, err := k.UnsealFromTPM(tpm, pin)
 	if err == ErrTPMProvisioning {
 		// ErrTPMProvisioning in this context might indicate that there isn't a valid persistent SRK. Have a go at creating one now and then
 		// retrying the unseal operation - if the previous SRK was evicted, the TPM owner hasn't changed and the storage hierarchy still
 		// has a null authorization value, then this will allow us to unseal the key without requiring any type of manual recovery. If the
 		// storage hierarchy has a non-null authorization value, ProvionTPM will fail. If the TPM owner has changed, ProvisionTPM might
 		// succeed, but UnsealFromTPM will fail with InvalidKeyFileError when retried.
-		if pErr := ProvisionTPM(tpm, ProvisionModeWithoutLockout, nil); pErr == nil {
-			key, err = k.UnsealFromTPM(tpm, pin)
+		if pErr := tpm.EnsureProvisioned(ProvisionModeWithoutLockout, nil); pErr == nil || pErr == ErrTPMProvisioningRequiresLockout {
+			sealedKey, authPrivateKey, err = k.UnsealFromTPM(tpm, pin)
 		}
 	}
-	return key, err
+	return sealedKey, authPrivateKey, err
+}
+
+func unsealKeyFromTPMAndActivate(tpm *TPMConnection, volumeName, sourceDevicePath, keyringPrefix string, activateOptions []string, k *SealedKeyObject, pin string) error {
+	sealedKey, authPrivateKey, err := unsealKeyFromTPM(tpm, k, pin)
+	if err != nil {
+		return xerrors.Errorf("cannot unseal key: %w", err)
+	}
+
+	if err := activate(volumeName, sourceDevicePath, sealedKey, activateOptions); err != nil {
+		return xerrors.Errorf("cannot activate volume: %w", err)
+	}
+
+	// Add a key to the calling user's user keyring with default 0x3f010000 permissions (these defaults are hardcoded in the kernel).
+	// This permission flags define the following permissions:
+	// Possessor Set Attribute / Possessor Link / Possessor Search / Possessor Write / Possessor Read / Possessor View / User View.
+	// Possessor permissions only apply to a process with a searchable link to the key from one of its own keyrings - just having the
+	// same UID is not sufficient. Read permission is required to read the contents of the key (view permission only permits viewing
+	// of the description and other public metadata that isn't the key payload).
+	//
+	// Note that by default, systemd starts services with a private session keyring which does not contain a link to the user keyring.
+	// Therefore these services cannot access the contents of keys in the root user's user keyring if those keys only permit
+	// possessor-read.
+	//
+	// Ignore errors - we've activated the volume and so we shouldn't return an error at this point unless we close the volume again.
+	unix.AddKey("user", fmt.Sprintf("%s:%s?type=tpm", keyringPrefixOrDefault(keyringPrefix), sourceDevicePath), authPrivateKey, userKeyring)
+	return nil
 }
 
 var requiresPinErr = errors.New("no PIN tries permitted when a PIN is required")
 
-type lockAccessError struct {
-	err error
+type activateWithTPMKeyError struct {
+	path string
+	err  error
 }
 
-func (e lockAccessError) Error() string {
-	return e.err.Error()
+func (e *activateWithTPMKeyError) Error() string {
+	return fmt.Sprintf("%s: %v", e.path, e.err)
 }
 
-func (e lockAccessError) Unwrap() error {
+func (e *activateWithTPMKeyError) Unwrap() error {
 	return e.err
 }
 
-func isLockAccessError(err error) bool {
-	var e lockAccessError
-	return xerrors.As(err, &e)
-}
-
-func activateWithTPMKey(tpm *TPMConnection, volumeName, sourceDevicePath, keyPath string, pinReader io.Reader, pinTries int, lock bool, activateOptions []string) error {
-	var lockErr error
-	key, err := func() ([]byte, error) {
-		defer func() {
-			if !lock {
-				return
-			}
-			lockErr = LockAccessToSealedKeys(tpm)
-		}()
+type activateTPMKeyContext struct {
+	path string
+	k    *SealedKeyObject
+	err  error
+}
 
-		k, err := ReadSealedKeyObject(keyPath)
+func (c *activateTPMKeyContext) Err() *activateWithTPMKeyError {
+	if c.err == nil {
+		return nil
+	}
+	return &activateWithTPMKeyError{path: c.path, err: c.err}
+}
+
+func activateWithTPMKeys(tpm *TPMConnection, volumeName, sourceDevicePath string, keyPaths []string, passphraseReader io.Reader, passphraseTries int, activateOptions []string, keyringPrefix string) (succeeded bool, errs []*activateWithTPMKeyError) {
+	var contexts []*activateTPMKeyContext
+	// Read key files
+	for _, path := range keyPaths {
+		k, err := ReadSealedKeyObject(path)
 		if err != nil {
-			return nil, xerrors.Errorf("cannot read sealed key object: %w", err)
+			err = xerrors.Errorf("cannot read sealed key object: %w", err)
 		}
+		contexts = append(contexts, &activateTPMKeyContext{path: path, k: k, err: err})
+	}
 
-		switch {
-		case pinTries == 0 && k.AuthMode2F() == AuthModePIN:
-			return nil, requiresPinErr
-		case pinTries == 0:
-			pinTries = 1
+	// Try key files that don't require a passphrase first.
+	for _, c := range contexts {
+		if c.err != nil {
+			continue
+		}
+		if c.k.AuthMode2F() != AuthModeNone {
+			continue
 		}
 
-		var key []byte
-
-		for ; pinTries > 0; pinTries-- {
-			var pin string
-			if k.AuthMode2F() == AuthModePIN {
-				r := pinReader
-				pinReader = nil
-				pin, err = getPassword(sourceDevicePath, "PIN", r)
-				if err != nil {
-					return nil, xerrors.Errorf("cannot obtain PIN: %w", err)
-				}
-			}
+		if err := unsealKeyFromTPMAndActivate(tpm, volumeName, sourceDevicePath, keyringPrefix, activateOptions, c.k, ""); err != nil {
+			c.err = err
+			continue
+		}
+
+		return true, nil
+	}
+
+	// Try key files that do require a passhprase last.
+	for _, c := range contexts {
+		if c.err != nil {
+			continue
+		}
+		if c.k.AuthMode2F() != AuthModePIN {
+			continue
+		}
+		if passphraseTries == 0 {
+			c.err = requiresPinErr
+			continue
+		}
 
-			key, err = unsealKeyFromTPM(tpm, k, pin)
-			if err != nil && (err != ErrPINFail || k.AuthMode2F() != AuthModePIN) {
+		var pin string
+		for i := 0; i < passphraseTries; i++ {
+			r := passphraseReader
+			passphraseReader = nil
+			var err error
+			pin, err = getPassword(sourceDevicePath, "PIN", r)
+			if err != nil {
+				c.err = xerrors.Errorf("cannot obtain PIN: %w", err)
 				break
 			}
 		}
 
-		if err != nil {
-			return nil, xerrors.Errorf("cannot unseal key: %w", err)
+		if c.err != nil {
+			continue
 		}
-		return key, nil
-	}()
 
-	switch {
-	case lockErr != nil:
-		return lockAccessError{err}
-	case err != nil:
-		return err
+		if err := unsealKeyFromTPMAndActivate(tpm, volumeName, sourceDevicePath, keyringPrefix, activateOptions, c.k, pin); err != nil {
+			c.err = err
+			continue
+		}
+
+		return true, nil
 	}
 
-	if err := activate(volumeName, sourceDevicePath, key, activateOptions); err != nil {
-		return xerrors.Errorf("cannot activate volume: %w", err)
+	// Activation has failed if we reach this point.
+	for _, c := range contexts {
+		errs = append(errs, c.Err())
 	}
+	return false, errs
 
-	return nil
 }
 
 func makeActivateOptions(in []string) ([]string, error) {
@@ -363,63 +496,83 @@
 	return append(out, "tries=1"), nil
 }
 
-// ActivateWithTPMSealedKeyOptions provides options to ActivateVolumeWtthTPMSealedKey.
-type ActivateWithTPMSealedKeyOptions struct {
-	// PINTries specifies the maximum number of times that unsealing with a PIN should be attempted before failing with an error and
-	// falling back to activating with the recovery key if RecoveryKeyTries is greater than zero. Setting this to zero disables unsealing
-	// with a PIN - in this case, an error will be returned if the sealed key object indicates that a PIN has been set. Attempts to
-	// unseal with a PIN will stop if the TPM enters dictionary attack lockout mode before this limit is reached.
-	PINTries int
-
-	// RecoveryKeyTries specifies the maximum number of times that activation with the fallback recovery key should be attempted
-	// if activation with the TPM sealed key fails, before failing with an error. Setting this to zero will disable attempts to activate
-	// with the fallback recovery key.
+// ActivateVolumeOptions provides options to the ActivateVolumeWith*
+// family of functions.
+type ActivateVolumeOptions struct {
+	// PassphraseTries specifies the maximum number of times
+	// that unsealing with a user passphrase should be attempted
+	// before failing with an error and falling back to activating
+	// with the recovery key (see RecoveryKeyTries).
+	// Setting this to zero disables unsealing with a user
+	// passphrase - in this case, an error will be returned if the
+	// sealed key object indicates that a user passphrase has been
+	// set.
+	// With a TPM, attempts to unseal will stop if the TPM enters
+	// dictionary attack lockout mode before this limit is
+	// reached.
+	// It is ignored by ActivateWithRecoveryKey.
+	PassphraseTries int
+
+	// RecoveryKeyTries specifies the maximum number of times that
+	// activation with the fallback recovery key should be
+	// attempted.
+	// It is used directly by ActivateWithRecoveryKey and
+	// indirectly with other methods upon failure, for example
+	// failed TPM unsealing.  Setting this to zero will disable
+	// attempts to activate with the fallback recovery key.
 	RecoveryKeyTries int
 
-	// ActivateOptions provides a mechanism to pass additional options to systemd-cryptsetup.
+	// ActivateOptions provides a mechanism to pass additional
+	// options to systemd-cryptsetup.
 	ActivateOptions []string
 
-	// LockSealedKeyAccess controls whether LockAccessToSealedKeys should be called after unsealing the TPM sealed key. It is called if
-	// this is set to true, and not called if this is set to false.
-	LockSealedKeyAccess bool
+	// KeyringPrefix is the prefix used for the description of any
+	// kernel keys created during activation.
+	KeyringPrefix string
 }
 
-// ActivateVolumeWithTPMSealedKey attempts to activate the LUKS encrypted volume at sourceDevicePath and create a mapping with the
-// name volumeName, using the TPM sealed key object at the specified keyPath. This makes use of systemd-cryptsetup.
+// ActivateVolumeWithMultipleTPMSealedKeys attempts to activate the LUKS encrypted volume at sourceDevicePath and create a
+// mapping with the name volumeName, using the TPM sealed key objects at the specified keyPaths. This makes use of
+// systemd-cryptsetup. This function will try the sealed key objects that don't require a passphrase first, and then
+// try sealed key objects that do require a passphrase. Sealed key objects are otherwise tried in the order in which
+// they are provided.
 //
-// If the TPM sealed key object has a PIN defined, then this function will use systemd-ask-password to request it. If pinReader is not
-// nil, then an attempt to read the PIN from this will be made instead by reading all characters until the first newline. The PINTries
-// field of options defines how many attempts should be made to obtain the correct PIN before failing.
+// If this function tries a TPM sealed key object that has a user passphrase/PIN defined, then this function will use
+// systemd-ask-password to request it. If passphraseReader is not nil, then an attempt to read the user passphrase/PIN from this
+// will be made instead by reading all characters until the first newline. The PassphraseTries field of options defines how many
+// attempts should be made to obtain the correct passphrase for each TPM sealed key before failing.
 //
 // The ActivateOptions field of options can be used to specify additional options to pass to systemd-cryptsetup.
 //
-// If the LockSealedKeyAccess field of options is true, then this function will call LockAccessToSealedKeys after unsealing the key
-// and before activating the LUKS volume.
-//
-// If activation with the TPM sealed key object fails, this function will attempt to activate it with the fallback recovery key
+// If activation with the TPM sealed key objects fails, this function will attempt to activate it with the fallback recovery key
 // instead. The fallback recovery key will be requested using systemd-ask-password. The RecoveryKeyTries field of options specifies
 // how many attempts should be made to activate the volume with the recovery key before failing. If this is set to 0, then no attempts
 // will be made to activate the encrypted volume with the fallback recovery key. If activation with the recovery key is successful,
-// the recovery key will be added to the root user keyring in the kernel with a description of the format
-// "<argv[0]>:<volumeName>:reason=<reason>" where reason is an integer that describes the recovery reason - see the
-// RecoveryKeyUsageReason type.
+// calling GetActivationDataFromKernel will return a *RecoveryActivationData containing the recovery key and the error codes
+// associated with the supplied TPM sealed keys.
 //
-// If either the PINTries or RecoveryKeyTries fields of options are less than zero, an error will be returned. If the ActivateOptions
+// If either the PassphraseTries or RecoveryKeyTries fields of options are less than zero, an error will be returned. If the ActivateOptions
 // field of options contains the "tries=" option, then an error will be returned. This option cannot be used with this function.
 //
-// If the LockSealedKeyAccess field of options is true and the call to LockAccessToSealedKeys fails, a LockAccessToSealedKeysError
-// error will be returned. In this case, activation with either the TPM sealed key or the fallback recovery key will not be attempted.
+// If activation with the TPM sealed keys fails, a *ActivateWithMultipleTPMSealedKeysError error will be returned, even if the
+// subsequent fallback recovery activation is successful. In this case, the RecoveryKeyUsageErr field of the returned error will
+// be nil, and the TPMErrs field will contain the original errors for each of the TPM sealed keys. If activation with the fallback
+// recovery key also fails, the RecoveryKeyUsageErr field of the returned error will also contain details of the error encountered
+// during recovery key activation.
 //
-// If activation with the TPM sealed key fails, a *ActivateWithTPMSealedKeyError error will be returned, even if the subsequent
-// fallback recovery activation is successful. In this case, the RecoveryKeyUsageErr field of the returned error will be nil, and the
-// TPMErr field will contain the original error. If activation with the fallback recovery key also fails, the RecoveryKeyUsageErr
-// field of the returned error will also contain details of the error encountered during recovery key activation.
+// If the volume is successfully activated with a TPM sealed key and the TPM sealed key has a version of greater than 1, calling
+// GetActivationDataFromKernel will return a TPMPolicyAuthKey containing the private part of the key used for authorizing PCR policy
+// updates with UpdateKeyPCRProtectionPolicy.
 //
-// If the volume is successfully activated, either with the TPM sealed key or the fallback recovery key, this function returns true.
+// If the volume is successfully activated, either with a TPM sealed key or the fallback recovery key, this function returns true.
 // If it is not successfully activated, then this function returns false.
-func ActivateVolumeWithTPMSealedKey(tpm *TPMConnection, volumeName, sourceDevicePath, keyPath string, pinReader io.Reader, options *ActivateWithTPMSealedKeyOptions) (bool, error) {
-	if options.PINTries < 0 {
-		return false, errors.New("invalid PINTries")
+func ActivateVolumeWithMultipleTPMSealedKeys(tpm *TPMConnection, volumeName, sourceDevicePath string, keyPaths []string, passphraseReader io.Reader, options *ActivateVolumeOptions) (bool, error) {
+	if len(keyPaths) == 0 {
+		return false, errors.New("no key files provided")
+	}
+
+	if options.PassphraseTries < 0 {
+		return false, errors.New("invalid PassphraseTries")
 	}
 	if options.RecoveryKeyTries < 0 {
 		return false, errors.New("invalid RecoveryKeyTries")
@@ -430,60 +583,101 @@
 		return false, err
 	}
 
-	if err := activateWithTPMKey(tpm, volumeName, sourceDevicePath, keyPath, pinReader, options.PINTries, options.LockSealedKeyAccess, activateOptions); err != nil {
-		reason := RecoveryKeyUsageReasonUnexpectedError
-		switch {
-		case isLockAccessError(err):
-			return false, LockAccessToSealedKeysError(err.Error())
-		case xerrors.Is(err, ErrTPMLockout):
-			reason = RecoveryKeyUsageReasonTPMLockout
-		case xerrors.Is(err, ErrTPMProvisioning):
-			reason = RecoveryKeyUsageReasonTPMProvisioningError
-		case isInvalidKeyFileError(err):
-			reason = RecoveryKeyUsageReasonInvalidKeyFile
-		case xerrors.Is(err, requiresPinErr):
-			reason = RecoveryKeyUsageReasonPINFail
-		case xerrors.Is(err, ErrPINFail):
-			reason = RecoveryKeyUsageReasonPINFail
-		case isExecError(err, systemdCryptsetupPath):
-			// systemd-cryptsetup only provides 2 exit codes - success or fail - so we don't know the reason it failed yet. If activation
-			// with the recovery key is successful, then it's safe to assume that it failed because the key unsealed from the TPM is incorrect.
-			reason = RecoveryKeyUsageReasonInvalidKeyFile
+	if success, errs := activateWithTPMKeys(tpm, volumeName, sourceDevicePath, keyPaths, passphraseReader, options.PassphraseTries, activateOptions, options.KeyringPrefix); !success {
+		var tpmErrCodes []KeyErrorCode
+		var tpmErrs []error
+
+		for _, e := range errs {
+			code := KeyUnexpectedError
+			switch {
+			case xerrors.Is(e, ErrTPMLockout):
+				code = KeyErrorTPMLockout
+			case xerrors.Is(e, ErrTPMProvisioning):
+				code = KeyErrorTPMProvisioning
+			case isInvalidKeyFileError(e):
+				code = KeyErrorInvalidFile
+			case xerrors.Is(e, requiresPinErr):
+				code = KeyErrorPassphraseFail
+			case xerrors.Is(e, ErrPINFail):
+				code = KeyErrorPassphraseFail
+			case isExecError(e, systemdCryptsetupPath):
+				// systemd-cryptsetup only provides 2 exit codes - success or fail - so we don't know the reason it failed yet.
+				// If activation with the recovery key is successful, then it's safe to assume that it failed because the key
+				// unsealed from the TPM is incorrect.
+				code = KeyErrorInvalidFile
+			}
+			tpmErrCodes = append(tpmErrCodes, code)
+			tpmErrs = append(tpmErrs, e)
+
 		}
-		rErr := activateWithRecoveryKey(volumeName, sourceDevicePath, nil, options.RecoveryKeyTries, reason, activateOptions)
-		return rErr == nil, &ActivateWithTPMSealedKeyError{err, rErr}
+		rErr := activateWithRecoveryKey(volumeName, sourceDevicePath, nil, options.RecoveryKeyTries, tpmErrCodes, activateOptions, options.KeyringPrefix)
+		return rErr == nil, &ActivateWithMultipleTPMSealedKeysError{tpmErrs, rErr}
 	}
 
 	return true, nil
 }
 
-// ActivateWithRecoveryKeyOptions provides options to ActivateVolumeWithRecoveryKey.
-type ActivateWithRecoveryKeyOptions struct {
-	// Tries specifies the maximum number of times that activation with the fallback recovery key should be attempted before failing
-	// with an error.
-	Tries int
-
-	// ActivateOptions provides a mechanism to pass additional options to systemd-cryptsetup.
-	ActivateOptions []string
+// ActivateVolumeWithTPMSealedKey attempts to activate the LUKS encrypted volume at sourceDevicePath and create a mapping with the
+// name volumeName, using the TPM sealed key object at the specified keyPath. This makes use of systemd-cryptsetup.
+//
+// If the TPM sealed key object has a user passphrase/PIN defined, then this function will use systemd-ask-password to request
+// it. If passphraseReader is not nil, then an attempt to read the user passphrase/PIN from this will be made instead by reading
+// all characters until the first newline. The PassphraseTries field of options defines how many attempts should be made to
+// obtain the correct passphrase before failing.
+//
+// The ActivateOptions field of options can be used to specify additional options to pass to systemd-cryptsetup.
+//
+// If activation with the TPM sealed key object fails, this function will attempt to activate it with the fallback recovery key
+// instead. The fallback recovery key will be requested using systemd-ask-password. The RecoveryKeyTries field of options specifies
+// how many attempts should be made to activate the volume with the recovery key before failing. If this is set to 0, then no attempts
+// will be made to activate the encrypted volume with the fallback recovery key. If activation with the recovery key is successful,
+// calling GetActivationDataFromKernel will return a *RecoveryActivationData containing the recovery key and the error code
+// associated with the TPM sealed key.
+//
+// If either the PassphraseTries or RecoveryKeyTries fields of options are less than zero, an error will be returned. If the
+// ActivateOptions field of options contains the "tries=" option, then an error will be returned. This option cannot be used with
+// this function.
+//
+// If activation with the TPM sealed key fails, a *ActivateWithTPMSealedKeyError error will be returned, even if the subsequent
+// fallback recovery activation is successful. In this case, the RecoveryKeyUsageErr field of the returned error will be nil, and the
+// TPMErr field will contain the original error. If activation with the fallback recovery key also fails, the RecoveryKeyUsageErr
+// field of the returned error will also contain details of the error encountered during recovery key activation.
+//
+// If the volume is successfully activated with the TPM sealed key and the TPM sealed key has a version of greater than 1, calling
+// GetActivationDataFromKernel will return a TPMPolicyAuthKey containing the private part of the key used for authorizing PCR policy
+// updates with UpdateKeyPCRProtectionPolicy.
+//
+// If the volume is successfully activated, either with the TPM sealed key or the fallback recovery key, this function returns true.
+// If it is not successfully activated, then this function returns false.
+func ActivateVolumeWithTPMSealedKey(tpm *TPMConnection, volumeName, sourceDevicePath, keyPath string, passphraseReader io.Reader, options *ActivateVolumeOptions) (bool, error) {
+	succeeded, err := ActivateVolumeWithMultipleTPMSealedKeys(tpm, volumeName, sourceDevicePath, []string{keyPath}, passphraseReader, options)
+	if e1, ok := err.(*ActivateWithMultipleTPMSealedKeysError); ok {
+		if e2, ok := e1.TPMErrs[0].(*activateWithTPMKeyError); ok {
+			err = &ActivateWithTPMSealedKeyError{e2.err, e1.RecoveryKeyUsageErr}
+		} else {
+			err = &ActivateWithTPMSealedKeyError{e1.TPMErrs[0], e1.RecoveryKeyUsageErr}
+		}
+	}
+	return succeeded, err
 }
 
 // ActivateVolumeWithRecoveryKey attempts to activate the LUKS encrypted volume at sourceDevicePath and create a mapping with the
 // name volumeName, using the fallback recovery key. This makes use of systemd-cryptsetup.
 //
 // This function will use systemd-ask-password to request the recovery key. If keyReader is not nil, then an attempt to read the key
-// from this will be made instead by reading all characters until the first newline. The Tries field of options defines how many
+// from this will be made instead by reading all characters until the first newline. The RecoveryKeyTries field of options defines how many
 // attempts should be made to activate the volume with the recovery key before failing.
 //
 // The ActivateOptions field of options can be used to specify additional options to pass to systemd-cryptsetup.
 //
-// If activation with the recovery key is successful, the recovery key will be added to the root user keyring in the kernel with a
-// description of the format "<argv[0]>:<volumeName>:reason=2".
+// If activation with the recovery key is successful, calling GetActivationDataFromKernel will return a *RecoveryActivationData
+// containing the recovery key and the Requested flag set to true.
 //
-// If the Tries field of options is less than zero, an error will be returned. If the ActivateOptions field of options contains the
+// If the RecoveryKeyTries field of options is less than zero, an error will be returned. If the ActivateOptions field of options contains the
 // "tries=" option, then an error will be returned. This option cannot be used with this function.
-func ActivateVolumeWithRecoveryKey(volumeName, sourceDevicePath string, keyReader io.Reader, options *ActivateWithRecoveryKeyOptions) error {
-	if options.Tries < 0 {
-		return errors.New("invalid Tries")
+func ActivateVolumeWithRecoveryKey(volumeName, sourceDevicePath string, keyReader io.Reader, options *ActivateVolumeOptions) error {
+	if options.RecoveryKeyTries < 0 {
+		return errors.New("invalid RecoveryKeyTries")
 	}
 
 	activateOptions, err := makeActivateOptions(options.ActivateOptions)
@@ -491,5 +685,387 @@
 		return err
 	}
 
-	return activateWithRecoveryKey(volumeName, sourceDevicePath, keyReader, options.Tries, RecoveryKeyUsageReasonRequested, activateOptions)
+	return activateWithRecoveryKey(volumeName, sourceDevicePath, keyReader, options.RecoveryKeyTries, nil, activateOptions, options.KeyringPrefix)
+}
+
+// ActivateVolumeWithKey attempts to activate the LUKS encrypted volume at
+// sourceDevicePath and create a mapping with the name volumeName, using the
+// provided key. This makes use of systemd-cryptsetup.
+//
+// The ActivateOptions field of options can be used to specify additional
+// options to pass to systemd-cryptsetup. All other fields are ignored.
+//
+// If the ActivateOptions field of options contains the "tries=" option, then an
+// error will be returned. This option cannot be used with this function.
+func ActivateVolumeWithKey(volumeName, sourceDevicePath string, key []byte, options *ActivateVolumeOptions) error {
+	// do not be more strict about checking options to allow reusing it
+	// across different calls
+	activateOptions, err := makeActivateOptions(options.ActivateOptions)
+	if err != nil {
+		return err
+	}
+
+	return activate(volumeName, sourceDevicePath, key, activateOptions)
+}
+
+// ActivationData corresponds to some data added to the user keyring by one of the ActivateVolume functions.
+type ActivationData interface{}
+
+// RecoveryActivationData is added to the user keyring when a recovery key is used to activate a volume.
+type RecoveryActivationData struct {
+	Key       RecoveryKey
+	Requested bool // The recovery key was used via the ActivateVolumeWithRecoveryKey API
+
+	// ErrorCodes indicates the errors encountered with each key file passed to ActivateVolumeWithTPMSealedKey
+	// or ActivateVolumeWithMultipleTPMSealedKeys in the case that Requested is false.
+	ErrorCodes []KeyErrorCode
+}
+
+// GetActivationDataFromKernel retrieves data that was added to the current user's user keyring by ActivateVolumeWithTPMSealedKey or
+// ActivateVolumeWithRecoveryKey for the specified source block device, using the prefix that was passed to either of those functions.
+// The block device path must match the path passed to one of the ActivateVolume functions. The type of data returned is dependent on
+// how the volume was activated - see the documentation for each function, If no data is found for the specified device, a
+// ErrNoActivationData error is returned.
+//
+// If remove is true, this function will unlink the key from the user's user keyring.
+func GetActivationDataFromKernel(prefix, sourceDevicePath string, remove bool) (ActivationData, error) {
+	var userKeys []int
+
+	sz, err := unix.KeyctlBuffer(unix.KEYCTL_READ, userKeyring, nil, 0)
+	if err != nil {
+		return nil, xerrors.Errorf("cannot determine size of user keyring payload: %w", err)
+	}
+
+	for {
+		payload := make([]byte, sz)
+		n, err := unix.KeyctlBuffer(unix.KEYCTL_READ, userKeyring, payload, 0)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot read user keyring payload: %w", err)
+		}
+
+		if n <= sz {
+			payload = payload[:n]
+
+			for len(payload) > 0 {
+				userKeys = append(userKeys, int(binary.LittleEndian.Uint32(payload)))
+				payload = payload[4:]
+			}
+			break
+		}
+
+		sz = n
+	}
+
+	re := regexp.MustCompile(fmt.Sprintf(`^user;[[:digit:]]+;[[:digit:]]+;[[:xdigit:]]+;%s:([^\?]+)\??(.*)`, keyringPrefixOrDefault(prefix)))
+	for _, id := range userKeys {
+		desc, err := unix.KeyctlString(unix.KEYCTL_DESCRIBE, id)
+		if err != nil {
+			continue
+		}
+		m := re.FindStringSubmatch(desc)
+		if len(m) == 0 {
+			continue
+		}
+		if m[1] != sourceDevicePath {
+			continue
+		}
+
+		sz, err := unix.KeyctlBuffer(unix.KEYCTL_READ, id, nil, 0)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot determine size of key payload: %w", err)
+		}
+		payload := make([]byte, sz)
+		_, err = unix.KeyctlBuffer(unix.KEYCTL_READ, id, payload, 0)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot read key payload: %w", err)
+		}
+
+		if remove {
+			// XXX: What should we do if unlinking fails?
+			unix.KeyctlInt(unix.KEYCTL_UNLINK, id, userKeyring, 0, 0)
+		}
+
+		params := make(map[string]string)
+		if len(m) > 2 {
+			for _, p := range strings.Split(m[2], "&") {
+				s := strings.SplitN(p, "=", 2)
+				k := s[0]
+				var v string
+				if len(s) > 1 {
+					v = s[1]
+				}
+				params[k] = v
+			}
+		}
+
+		t, ok := params["type"]
+		if !ok {
+			return nil, errors.New("invalid description (no type)")
+		}
+		switch t {
+		case "tpm":
+			return TPMPolicyAuthKey(payload), nil
+		case "recovery":
+			if len(payload) != binary.Size(RecoveryKey{}) {
+				return nil, errors.New("invalid payload size")
+			}
+
+			var key RecoveryKey
+			copy(key[:], payload)
+
+			_, ok := params["requested"]
+			if ok {
+				return &RecoveryActivationData{Key: key, Requested: true}, nil
+			}
+
+			e, ok := params["errors"]
+			if ok {
+				var errCodes []KeyErrorCode
+				for _, s := range strings.Split(e, ",") {
+					c, err := strconv.Atoi(s)
+					if err != nil {
+						return nil, xerrors.Errorf("invalid recovery error code: %w", err)
+					}
+					errCodes = append(errCodes, KeyErrorCode(c))
+				}
+				return &RecoveryActivationData{Key: key, ErrorCodes: errCodes}, nil
+			}
+
+			// This is here for compatibility with old secboot versions running in early boot.
+			reason, ok := params["reason"]
+			if ok {
+				n, err := strconv.Atoi(reason)
+				if err != nil {
+					return nil, xerrors.Errorf("invalid recovery reason: %w", err)
+				}
+				if n == int(legacyRecoveryKeyRequested) {
+					return &RecoveryActivationData{Key: key, Requested: true}, nil
+				}
+				return &RecoveryActivationData{Key: key, ErrorCodes: []KeyErrorCode{KeyErrorCode(n)}}, nil
+			}
+
+			return nil, errors.New("invalid recovery key parameters")
+		default:
+			return nil, errors.New("invalid description (unhandled type)")
+		}
+	}
+
+	return nil, ErrNoActivationData
+}
+
+func setLUKS2KeyslotPreferred(devicePath string, slot int) error {
+	cmd := exec.Command("cryptsetup", "config", "--priority", "prefer", "--key-slot", strconv.Itoa(slot), devicePath)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+
+	return nil
+}
+
+// InitializeLUKS2ContainerOptions carries options for initializing LUKS2
+// containers.
+type InitializeLUKS2ContainerOptions struct {
+	// MetadataKiBSize sets the size of the LUKS2 metadata (JSON) area,
+	// expressed in multiples of 1024 bytes. The value includes 4096 bytes
+	// for the binary metadata. According to LUKS2 specification and
+	// cryptsetup(8), only these values are valid: 16, 32, 64, 128, 256,
+	// 512, 1024, 2048 and 4096 KiB.
+	MetadataKiBSize int
+	// KeyslotsAreaSize sets the size of the LUKS2 binary keyslot area,
+	// expressed in multiples of 1024 bytes. The value must be aligned to
+	// 4096 bytes, with the maximum size of 128MB.
+	KeyslotsAreaKiBSize int
+}
+
+func validateInitializeLUKS2Options(options *InitializeLUKS2ContainerOptions) error {
+	if options == nil {
+		return nil
+	}
+
+	if options.MetadataKiBSize != 0 {
+		// metadata size is one of the allowed values (in kB)
+		allowedSizesKB := []int{16, 32, 64, 128, 256, 512, 1024, 2048, 4096}
+		found := false
+		for _, sz := range allowedSizesKB {
+			if options.MetadataKiBSize == sz {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return fmt.Errorf("cannot set metadata size to %v KiB",
+				options.MetadataKiBSize)
+		}
+	}
+	if options.KeyslotsAreaKiBSize != 0 {
+		// minimum size 4096 (4KiB), a multiple of 4096, max size 128MiB
+		sizeValid := options.KeyslotsAreaKiBSize >= 4 &&
+			options.KeyslotsAreaKiBSize <= 128*1024 &&
+			options.KeyslotsAreaKiBSize%4 == 0
+		if !sizeValid {
+			return fmt.Errorf("cannot set keyslots area size to %v KiB",
+				options.KeyslotsAreaKiBSize)
+		}
+	}
+	return nil
+}
+
+// InitializeLUKS2Container will initialize the partition at the specified devicePath as a new LUKS2 container. This can only
+// be called on a partition that isn't mapped. The label for the new LUKS2 container is provided via the label argument.
+//
+// The initial key used for unlocking the container is provided via the key argument, and must be a cryptographically secure
+// random number of at least 32-bytes. The key should be encrypted by using SealKeyToTPM.
+//
+// The container will be configured to encrypt data with AES-256 and XTS block cipher mode.
+//
+// On failure, this will return an error containing the output of the cryptsetup command.
+//
+// WARNING: This function is destructive. Calling this on an existing LUKS container will make the data contained inside of it
+// irretrievable.
+func InitializeLUKS2Container(devicePath, label string, key []byte, options *InitializeLUKS2ContainerOptions) error {
+	if len(key) < 32 {
+		return fmt.Errorf("expected a key length of at least 256-bits (got %d)", len(key)*8)
+	}
+	if err := validateInitializeLUKS2Options(options); err != nil {
+		return err
+	}
+
+	args := []string{
+		// batch processing, no password verification for formatting an existing LUKS container
+		"-q",
+		// formatting a new volume
+		"luksFormat",
+		// use LUKS2
+		"--type", "luks2",
+		// read the key from stdin
+		"--key-file", "-",
+		// use AES-256 with XTS block cipher mode (XTS requires 2 keys)
+		"--cipher", "aes-xts-plain64", "--key-size", "512",
+		// use argon2i as the KDF with reduced cost. This is done because the supplied input key has an
+		// entropy of at least 32 bytes, and increased cost doesn't provide a security benefit because
+		// this key and these settings are already more secure than the recovery key. Increased cost
+		// here only slows down unlocking.
+		"--pbkdf", "argon2i", "--iter-time", "100",
+		// set LUKS2 label
+		"--label", label,
+	}
+	if options != nil {
+		if options.MetadataKiBSize != 0 {
+			args = append(args,
+				"--luks2-metadata-size", fmt.Sprintf("%dk", options.MetadataKiBSize))
+		}
+		if options.KeyslotsAreaKiBSize != 0 {
+			args = append(args,
+				"--luks2-keyslots-size", fmt.Sprintf("%dk", options.KeyslotsAreaKiBSize))
+		}
+	}
+	args = append(args,
+		// device to format
+		devicePath)
+	cmd := exec.Command("cryptsetup", args...)
+	cmd.Stdin = bytes.NewReader(key)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+
+	return setLUKS2KeyslotPreferred(devicePath, 0)
+}
+
+func addKeyToLUKS2Container(devicePath string, existingKey, key []byte, extraOptionArgs []string) error {
+	fifoPath, cleanupFifo, err := mkFifo()
+	if err != nil {
+		return xerrors.Errorf("cannot create FIFO for passing existing key to cryptsetup: %w", err)
+	}
+	defer cleanupFifo()
+
+	args := []string{
+		// add a new key
+		"luksAddKey",
+		// read existing key from named pipe
+		"--key-file", fifoPath}
+	args = append(args, extraOptionArgs...)
+	args = append(args,
+		// container to add key to
+		devicePath,
+		// read new key from stdin
+		"-")
+	cmd := exec.Command("cryptsetup", args...)
+	cmd.Stdin = bytes.NewReader(key)
+
+	var b bytes.Buffer
+	cmd.Stdout = &b
+	cmd.Stderr = &b
+
+	if err := cmd.Start(); err != nil {
+		return xerrors.Errorf("cannot start cryptsetup: %w", err)
+	}
+
+	f, err := os.OpenFile(fifoPath, os.O_WRONLY, 0)
+	if err != nil {
+		// If we fail to open the write end, the read end will be blocked in open()
+		cmd.Process.Kill()
+		return xerrors.Errorf("cannot open FIFO for passing existing key to cryptsetup: %w", err)
+	}
+
+	if _, err := f.Write(existingKey); err != nil {
+		f.Close()
+		// The read end is open and blocked inside read(). Closing our write end will result in the
+		// read end returning 0 bytes (EOF) and exitting cleanly.
+		cmd.Wait()
+		return xerrors.Errorf("cannot pass existing key to cryptsetup: %w", err)
+	}
+
+	f.Close()
+	if err := cmd.Wait(); err != nil {
+		return osutil.OutputErr(b.Bytes(), err)
+	}
+	return nil
+}
+
+// AddRecoveryKeyToLUKS2Container adds a fallback recovery key to an existing LUKS2 container created with InitializeLUKS2Container.
+// The recovery key is intended to be used as a fallback mechanism that operates independently of the TPM in order to unlock the
+// container in the event that the key encrypted with SealKeyToTPM cannot be used to unlock it. The devicePath argument specifies
+// the device node for the partition that contains the LUKS2 container. The existing key for the container is provided via the
+// key argument.
+//
+// The recovery key is provided via the recoveryKey argument and must be a cryptographically secure 16-byte number.
+func AddRecoveryKeyToLUKS2Container(devicePath string, key []byte, recoveryKey RecoveryKey) error {
+	return addKeyToLUKS2Container(devicePath, key, recoveryKey[:], []string{
+		// use argon2i as the KDF with an increased cost
+		"--pbkdf", "argon2i", "--iter-time", "5000"})
+}
+
+// ChangeLUKS2KeyUsingRecoveryKey changes the key normally used for unlocking the LUKS2 container at devicePath. This function
+// is intended to be used after the container is unlocked with the recovery key, in the scenario that the TPM sealed key is
+// invalid and needs to be recreated.
+//
+// In order to perform this action, the recovery key needs to be supplied via the recoveryKey argument. The new key is provided via
+// the key argument. The new key should be stored encrypted with SealKeyToTPM.
+//
+// Note that this operation is not atomic. It will delete the existing key from the container before configuring the keyslot with
+// the new key. This is not a problem, because this function is intended to be called in the scenario that the default key cannot
+// be used to activate the LUKS2 container.
+func ChangeLUKS2KeyUsingRecoveryKey(devicePath string, recoveryKey RecoveryKey, key []byte) error {
+	if len(key) < 32 {
+		return fmt.Errorf("expected a key length of at least 256-bits (got %d)", len(key)*8)
+	}
+
+	cmd := exec.Command("cryptsetup", "luksKillSlot", "--key-file", "-", devicePath, "0")
+	cmd.Stdin = bytes.NewReader(recoveryKey[:])
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return osutil.OutputErr(output, err)
+	}
+
+	if err := addKeyToLUKS2Container(devicePath, recoveryKey[:], key, []string{
+		// use argon2i as the KDF with reduced cost. This is done because the supplied input key has an
+		// entropy of at least 32 bytes, and increased cost doesn't provide a security benefit because
+		// this key and these settings are already more secure than the recovery key. Increased cost
+		// here only slows down unlocking.
+		"--pbkdf", "argon2i", "--iter-time", "100",
+		// always have the main key in slot 0 for now
+		"--key-slot", "0"}); err != nil {
+		return err
+	}
+
+	return setLUKS2KeyslotPreferred(devicePath, 0)
 }
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/efibootmanager_policy.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/efibootmanager_policy.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/efibootmanager_policy.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/efibootmanager_policy.go	2020-11-05 20:13:01.000000000 +0000
@@ -0,0 +1,339 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash"
+	"io"
+	"os"
+	"sort"
+
+	"github.com/canonical/go-tpm2"
+	"github.com/canonical/tcglog-parser"
+	"github.com/snapcore/secboot/internal/efi"
+	"github.com/snapcore/secboot/internal/pe1.14"
+
+	"golang.org/x/xerrors"
+)
+
+// computePeImageDigest computes a hash of a PE image in accordance with the "Windows Authenticode Portable Executable Signature
+// Format" specification. This function interprets the byte stream of the raw headers in some places, the layout of which are
+// defined in the "PE Format" specification (https://docs.microsoft.com/en-us/windows/win32/debug/pe-format)
+func computePeImageDigest(alg tpm2.HashAlgorithmId, image EFIImage) (tpm2.Digest, error) {
+	r, err := image.Open()
+	if err != nil {
+		return nil, xerrors.Errorf("cannot open image: %w", err)
+	}
+	defer r.Close()
+
+	var dosheader [96]byte
+	if _, err := r.ReadAt(dosheader[0:], 0); err != nil {
+		return nil, err
+	}
+
+	var coffHeaderOffset int64
+	if dosheader[0] == 'M' && dosheader[1] == 'Z' {
+		signoff := int64(binary.LittleEndian.Uint32(dosheader[0x3c:]))
+		var sign [4]byte
+		r.ReadAt(sign[:], signoff)
+		if !(sign[0] == 'P' && sign[1] == 'E' && sign[2] == 0 && sign[3] == 0) {
+			return nil, fmt.Errorf("invalid PE COFF file signature: %v", sign)
+		}
+		coffHeaderOffset = signoff + 4
+	}
+
+	p, err := pe.NewFile(r)
+	if err != nil {
+		return nil, xerrors.Errorf("cannot decode PE binary: %w", err)
+	}
+
+	var isPe32Plus bool
+	var sizeOfHeaders int64
+	var dd []pe.DataDirectory
+	switch oh := p.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		sizeOfHeaders = int64(oh.SizeOfHeaders)
+		dd = oh.DataDirectory[0:oh.NumberOfRvaAndSizes]
+	case *pe.OptionalHeader64:
+		isPe32Plus = true
+		sizeOfHeaders = int64(oh.SizeOfHeaders)
+		dd = oh.DataDirectory[0:oh.NumberOfRvaAndSizes]
+	default:
+		return nil, errors.New("PE binary doesn't contain an optional header")
+	}
+
+	// 1) Load the image header in to memory.
+	hr := io.NewSectionReader(r, 0, sizeOfHeaders)
+
+	// 2) Initialize a hash algorithm context.
+	h := alg.NewHash()
+
+	// 3) Hash the image header from its base to immediately before the start of the checksum address in the optional header.
+	// This includes the DOS header, 4-byte PE signature, COFF header, and the first 64 bytes of the optional header.
+	b := make([]byte, int(coffHeaderOffset)+binary.Size(p.FileHeader)+64)
+	if _, err := hr.Read(b); err != nil {
+		return nil, xerrors.Errorf("cannot read from image to start to checksum: %w", err)
+	}
+	h.Write(b)
+
+	// 4) Skip over the checksum, which is a 4-byte field.
+	hr.Seek(4, io.SeekCurrent)
+
+	var certTable *pe.DataDirectory
+
+	if len(dd) > certTableIndex {
+		// 5) Hash everything from the end of the checksum field to immediately before the start of the Certificate Table entry in the
+		// optional header data directory.
+		// This is 60 bytes for PE32 format binaries, or 76 bytes for PE32+ format binaries.
+		sz := 60
+		if isPe32Plus {
+			sz = 76
+		}
+		b = make([]byte, sz)
+		if _, err := hr.Read(b); err != nil {
+			return nil, xerrors.Errorf("cannot read from checksum to certificate table data directory entry: %w", err)
+		}
+		h.Write(b)
+
+		// 6) Get the Attribute Certificate Table address and size from the Certificate Table entry.
+		certTable = &dd[certTableIndex]
+	}
+
+	// 7) Exclude the Certificate Table entry from the calculation and hash	everything from the end of the Certificate Table entry
+	// to the end of image header, including the Section Table. The Certificate Table entry is 8 bytes long.
+	if certTable != nil {
+		hr.Seek(8, io.SeekCurrent)
+	}
+
+	chunkedHashAll := func(r io.Reader, h hash.Hash) error {
+		b := make([]byte, 4096)
+		for {
+			n, err := r.Read(b)
+			h.Write(b[:n])
+
+			if err == io.EOF {
+				return nil
+			}
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if err := chunkedHashAll(hr, h); err != nil {
+		return nil, xerrors.Errorf("cannot hash remainder of headers and section table: %w", err)
+	}
+
+	// 8) Create a counter called sumOfBytesHashed, which is not part of the signature. Set this counter to the SizeOfHeaders field.
+	sumOfBytesHashed := sizeOfHeaders
+
+	// 9) Build a temporary table of pointers to all of the section headers in the image. Do not include any section headers in the
+	// table whose Size field is zero.
+	var sections []*pe.SectionHeader
+	for _, section := range p.Sections {
+		if section.Size == 0 {
+			continue
+		}
+		sections = append(sections, &section.SectionHeader)
+	}
+
+	// 10) Using the Offset field in the referenced SectionHeader structure as a key, arrange the table's elements in ascending order.
+	// In other words, sort the section headers in ascending order according to the disk-file offset of the sections.
+	sort.Slice(sections, func(i, j int) bool { return sections[i].Offset < sections[j].Offset })
+
+	for _, section := range sections {
+		// 11) Walk through the sorted table, load the corresponding section into memory, and hash the entire section. Use the
+		// Size field in the SectionHeader structure to determine the amount of data to hash.
+		sr := io.NewSectionReader(r, int64(section.Offset), int64(section.Size))
+		if err := chunkedHashAll(sr, h); err != nil {
+			return nil, xerrors.Errorf("cannot hash section %s: %w", section.Name, err)
+		}
+
+		// 12) Add the section’s Size value to sumOfBytesHashed.
+		sumOfBytesHashed += int64(section.Size)
+
+		// 13) Repeat steps 11 and 12 for all of the sections in the sorted table.
+	}
+
+	// 14) Create a value called fileSize, which is not part of the signature. Set this value to the image’s file size. If fileSize is
+	// greater than sumOfBytesHashed, the file contains extra data that must be added to the hash. This data begins at the
+	// sumOfBytesHashed file offset, and its length is:
+	// fileSize – (certTable.Size + sumOfBytesHashed)
+	fileSize := r.Size()
+
+	if fileSize > sumOfBytesHashed {
+		var certSize int64
+		if certTable != nil {
+			certSize = int64(certTable.Size)
+		}
+
+		if fileSize < (sumOfBytesHashed + certSize) {
+			return nil, errors.New("image too short")
+		}
+
+		sr := io.NewSectionReader(r, sumOfBytesHashed, fileSize-sumOfBytesHashed-certSize)
+		if err := chunkedHashAll(sr, h); err != nil {
+			return nil, xerrors.Errorf("cannot hash extra data: %w", err)
+		}
+	}
+
+	return h.Sum(nil), nil
+}
+
+type bootManagerCodePolicyGenBranch struct {
+	profile  *PCRProtectionProfile
+	branches []*PCRProtectionProfile
+}
+
+func (n *bootManagerCodePolicyGenBranch) branch() *bootManagerCodePolicyGenBranch {
+	b := &bootManagerCodePolicyGenBranch{profile: NewPCRProtectionProfile()}
+	n.branches = append(n.branches, b.profile)
+	return b
+}
+
+// bmLoadEventAndBranch binds together a EFIImageLoadEvent and the branch that the event needs to be applied to.
+type bmLoadEventAndBranch struct {
+	event  *EFIImageLoadEvent
+	branch *bootManagerCodePolicyGenBranch
+}
+
+// EFIBootManagerProfileParams provide the arguments to AddEFIBootManagerProfile.
+type EFIBootManagerProfileParams struct {
+	// PCRAlgorithm is the algorithm for which to compute PCR digests for. TPMs compliant with the "TCG PC Client Platform TPM Profile
+	// (PTP) Specification" Level 00, Revision 01.03 v22, May 22 2017 are required to support tpm2.HashAlgorithmSHA1 and
+	// tpm2.HashAlgorithmSHA256. Support for other digest algorithms is optional.
+	PCRAlgorithm tpm2.HashAlgorithmId
+
+	// LoadSequences is a list of EFI image load sequences for which to compute PCR digests for.
+	LoadSequences []*EFIImageLoadEvent
+}
+
+// AddEFIBootManagerProfile adds the UEFI boot manager code and boot attempts profile to the provided PCR protection profile, in order
+// to generate a PCR policy that restricts access to a sealed key to a specific set of binaries started from the UEFI boot manager and
+// which are measured to PCR 4. Events that are measured to this PCR are detailed in section 2.3.4.5 of the "TCG PC Client Platform
+// Firmware Profile Specification".
+//
+// If the firmware supports executing system preparation applications before the transition to "OS present", events corresponding to
+// the launch of these applications will be measured to PCR 4. If the event log indicates that any system preparation applications
+// were executed during the current boot, this function will automatically include these binaries in the generated PCR profile. Note
+// that it is not possible to pre-compute PCR values for system preparation applications using this function, and so it is not
+// possible to update these in a way that is atomic (if any of them are changed, a new PCR profile can only be generated after
+// performing a reboot).
+//
+// The sequences of binaries for which to generate a PCR profile for is supplied via the LoadSequences field of params. Note that
+// this function does not use the Source field of EFIImageLoadEvent. Each bootloader stage in each load sequence must perform a
+// measurement of any subsequent stage to PCR 4 in the same format as the events measured by the UEFI boot manager.
+//
+// Section 2.3.4.5 of the "TCG PC Client Platform Firmware Profile Specification" specifies that EFI applications that load additional
+// pre-OS environment code must measure this to PCR 4 using the EV_COMPACT_HASH event type. This function does not support EFI
+// applications that load additional pre-OS environment code that isn't otherwise authenticated via the secure boot mechanism,
+// and will generate PCR profiles that aren't correct for applications that do this.
+//
+// If the EV_OMIT_BOOT_DEVICE_EVENTS is not recorded to PCR 4, the platform firmware will perform meaurements of all boot attempts,
+// even if they fail. The generated PCR policy will not be satisfied if the platform firmware performs boot attempts that fail,
+// even if the successful boot attempt is of a sequence of binaries included in this PCR profile.
+func AddEFIBootManagerProfile(profile *PCRProtectionProfile, params *EFIBootManagerProfileParams) error {
+	// Load event log
+	eventLog, err := os.Open(efi.EventLogPath)
+	if err != nil {
+		return xerrors.Errorf("cannot open TCG event log: %w", err)
+	}
+	log, err := tcglog.ParseLog(eventLog, &tcglog.LogOptions{})
+	if err != nil {
+		return xerrors.Errorf("cannot parse TCG event log: %w", err)
+	}
+
+	if !log.Algorithms.Contains(tcglog.AlgorithmId(params.PCRAlgorithm)) {
+		return errors.New("cannot compute secure boot policy digests: the TCG event log does not have the requested algorithm")
+	}
+
+	profile.AddPCRValue(params.PCRAlgorithm, bootManagerCodePCR, make(tpm2.Digest, params.PCRAlgorithm.Size()))
+
+	// Replay the event log until we see the transition from "pre-OS" to "OS-present". The event log may contain measurements
+	// for system preparation applications, and spec-compliant firmware should measure a EV_EFI_ACTION “Calling EFI Application
+	// from Boot Option” event before the EV_SEPARATOR event, but not all firmware does this.
+	for _, event := range log.Events {
+		if event.PCRIndex != bootManagerCodePCR {
+			continue
+		}
+
+		profile.ExtendPCR(params.PCRAlgorithm, bootManagerCodePCR, tpm2.Digest(event.Digests[tcglog.AlgorithmId(params.PCRAlgorithm)]))
+		if event.EventType == tcglog.EventTypeSeparator {
+			break
+		}
+	}
+
+	root := bootManagerCodePolicyGenBranch{profile: profile}
+	allBranches := []*bootManagerCodePolicyGenBranch{&root}
+
+	var loadEvents []*bmLoadEventAndBranch
+	var nextLoadEvents []*bmLoadEventAndBranch
+
+	if len(params.LoadSequences) == 1 {
+		loadEvents = append(loadEvents, &bmLoadEventAndBranch{event: params.LoadSequences[0], branch: &root})
+	} else {
+		for _, e := range params.LoadSequences {
+			branch := root.branch()
+			allBranches = append(allBranches, branch)
+			loadEvents = append(loadEvents, &bmLoadEventAndBranch{event: e, branch: branch})
+		}
+	}
+
+	for len(loadEvents) > 0 {
+		e := loadEvents[0]
+		loadEvents = loadEvents[1:]
+
+		digest, err := computePeImageDigest(params.PCRAlgorithm, e.event.Image)
+		if err != nil {
+			return err
+		}
+		e.branch.profile.ExtendPCR(params.PCRAlgorithm, bootManagerCodePCR, digest)
+
+		if len(e.event.Next) == 1 {
+			nextLoadEvents = append(nextLoadEvents, &bmLoadEventAndBranch{event: e.event.Next[0], branch: e.branch})
+		} else {
+			for _, n := range e.event.Next {
+				branch := e.branch.branch()
+				nextLoadEvents = append(nextLoadEvents, &bmLoadEventAndBranch{event: n, branch: branch})
+				allBranches = append(allBranches, branch)
+			}
+		}
+
+		if len(loadEvents) == 0 {
+			loadEvents = nextLoadEvents
+			nextLoadEvents = nil
+		}
+	}
+
+	// Iterate over all of the branch points starting from the root and creates a tree of
+	// sub-profiles with AddProfileOR. The ordering doesn't matter here, because each subprofile
+	// is already complete
+	for _, b := range allBranches {
+		if len(b.branches) == 0 {
+			continue
+		}
+		b.profile.AddProfileOR(b.branches...)
+	}
+
+	return nil
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/efi.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/efi.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/efi.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/efi.go	2021-02-02 08:21:12.000000000 +0000
@@ -0,0 +1,117 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot
+
+import (
+	"fmt"
+	"github.com/snapcore/snapd/snap"
+	"io"
+	"os"
+)
+
+const (
+	bootManagerCodePCR = 4 // Boot Manager Code and Boot Attempts PCR
+
+	certTableIndex = 4 // Index of the Certificate Table entry in the Data Directory of a PE image optional header
+)
+
+// EFIImage corresponds to a binary that is loaded, verified and executed before ExitBootServices.
+type EFIImage interface {
+	fmt.Stringer
+	Open() (interface {
+		io.ReaderAt
+		io.Closer
+		Size() int64
+	}, error) // Open a handle to the image for reading
+}
+
+// SnapFileEFIImage corresponds to a binary contained within a snap file that is loaded, verified and executed before ExitBootServices.
+type SnapFileEFIImage struct {
+	Container snap.Container
+	Path      string // The path of the snap image (used by the implementation of fmt.Stringer)
+	FileName  string // The filename within the snap squashfs
+}
+
+func (f SnapFileEFIImage) String() string {
+	return "snap:" + f.Path + ":" + f.FileName
+}
+
+func (f SnapFileEFIImage) Open() (interface {
+	io.ReaderAt
+	io.Closer
+	Size() int64
+}, error) {
+	return f.Container.RandomAccessFile(f.FileName)
+}
+
+type fileEFIImageHandle struct {
+	*os.File
+	size int64
+}
+
+func (h *fileEFIImageHandle) Size() int64 {
+	return h.size
+}
+
+// FileEFIImage corresponds to a file on disk that is loaded, verified and executed before ExitBootServices.
+type FileEFIImage string
+
+func (p FileEFIImage) String() string {
+	return string(p)
+}
+
+func (p FileEFIImage) Open() (interface {
+	io.ReaderAt
+	io.Closer
+	Size() int64
+}, error) {
+	f, err := os.Open(string(p))
+	if err != nil {
+		return nil, err
+	}
+	fi, err := f.Stat()
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+	return &fileEFIImageHandle{File: f, size: fi.Size()}, nil
+}
+
+// EFIImageLoadEventSource corresponds to the source of a EFIImageLoadEvent.
+type EFIImageLoadEventSource int
+
+const (
+	// Firmware indicates that the source of a EFIImageLoadEvent was platform firmware, via the EFI_BOOT_SERVICES.LoadImage()
+	// and EFI_BOOT_SERVICES.StartImage() functions, with the subsequently executed image being verified against the signatures
+	// in the EFI authorized signature database.
+	Firmware EFIImageLoadEventSource = iota
+
+	// Shim indicates that the source of a EFIImageLoadEvent was shim, without relying on EFI boot services for loading, verifying
+	// and executing the subsequently executed image. The image is verified by shim against the signatures in the EFI authorized
+	// signature database, the MOK database or shim's built-in vendor certificate before being executed directly.
+	Shim
+)
+
+// EFIImageLoadEvent corresponds to the execution of a verified EFIImage.
+type EFIImageLoadEvent struct {
+	Source EFIImageLoadEventSource // The source of the event
+	Image  EFIImage                // The image
+	Next   []*EFIImageLoadEvent    // A list of possible subsequent EFIImageLoadEvents
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/errors.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/errors.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/errors.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/errors.go	2020-11-05 20:13:01.000000000 +0000
@@ -20,6 +20,7 @@
 package secboot
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 
@@ -29,10 +30,15 @@
 )
 
 var (
-	// ErrTPMClearRequiresPPI is returned from ProvisionTPM and indicates that clearing the TPM must be performed via
+	// ErrTPMClearRequiresPPI is returned from TPMConnection.EnsureProvisioned and indicates that clearing the TPM must be performed via
 	// the Physical Presence Interface.
 	ErrTPMClearRequiresPPI = errors.New("clearing the TPM requires the use of the Physical Presence Interface")
 
+	// ErrTPMProvisioningRequiresLockout is returned from TPMConnection.EnsureProvisioned when fully provisioning the TPM requires
+	// the use of the lockout hierarchy. In this case, the provisioning steps that can be performed without the use of the lockout
+	// hierarchy are completed.
+	ErrTPMProvisioningRequiresLockout = errors.New("provisioning the TPM requires the use of the lockout hierarchy")
+
 	// ErrTPMProvisioning indicates that the TPM is not provisioned correctly for the requested operation. Please note that other errors
 	// that can be returned may also be caused by incomplete provisioning, as it is not always possible to detect incomplete or
 	// incorrect provisioning in all contexts.
@@ -46,9 +52,12 @@
 	// ErrPINFail is returned from SealedKeyObject.UnsealFromTPM if the provided PIN is incorrect.
 	ErrPINFail = errors.New("the provided PIN is incorrect")
 
-	// ErrSealedKeyAccessLocked is returned from SealedKeyObject.UnsealFromTPM if the sealed key object cannot be unsealed until the
-	// next TPM reset or restart.
-	ErrSealedKeyAccessLocked = errors.New("cannot access the sealed key object until the next TPM reset or restart")
+	// ErrNoTPM2Device is returned from ConnectToDefaultTPM or SecureConnectToDefaultTPM if no TPM2 device is avaiable.
+	ErrNoTPM2Device = errors.New("no TPM2 device is available")
+
+	// ErrNoActivationData is returned from GetActivationDataFromKernel if no activation data was found in the user keyring for
+	// the specified block device.
+	ErrNoActivationData = errors.New("no activation data found for the specified device")
 )
 
 // TPMResourceExistsError is returned from any function that creates a persistent TPM resource if a resource already exists
@@ -122,14 +131,6 @@
 	return xerrors.As(err, &e)
 }
 
-// LockAccessToSealedKeysError is returned from ActivateVolumeWithTPMSealedKey if an error occurred whilst trying to lock access
-// to sealed keys created by this package.
-type LockAccessToSealedKeysError string
-
-func (e LockAccessToSealedKeysError) Error() string {
-	return "cannot lock access to sealed keys: " + string(e)
-}
-
 // ActivateWithTPMSealedKeyError is returned from ActivateVolumeWithTPMSealedKey if activation with the TPM protected key failed.
 type ActivateWithTPMSealedKeyError struct {
 	// TPMErr details the error that occurred during activation with the TPM sealed key.
@@ -146,3 +147,28 @@
 	}
 	return fmt.Sprintf("cannot activate with TPM sealed key (%v) but activation with recovery key was successful", e.TPMErr)
 }
+
+// ActivateWithMultipleTPMSealedKeysError is returned from ActivateVolumeWithMultipleTPMSealedKeys if activation with the
+// TPM protected keys failed.
+type ActivateWithMultipleTPMSealedKeysError struct {
+	// TPMErrs details the errors that occurred during activation with the TPM sealed keys.
+	TPMErrs []error
+
+	// RecoveryKeyUsageErr details the error that occurred during activation with the fallback recovery key, if activation
+	// with the recovery key was also unsuccessful.
+	RecoveryKeyUsageErr error
+}
+
+func (e *ActivateWithMultipleTPMSealedKeysError) Error() string {
+	var s bytes.Buffer
+	fmt.Fprintf(&s, "cannot activate with TPM sealed keys:")
+	for _, err := range e.TPMErrs {
+		fmt.Fprintf(&s, "\n- %v", err)
+	}
+	if e.RecoveryKeyUsageErr != nil {
+		fmt.Fprintf(&s, "\nand activation with recovery key failed: %v", e.RecoveryKeyUsageErr)
+	} else {
+		fmt.Fprintf(&s, "\nbut activation with recovery key was successful")
+	}
+	return s.String()
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/efi/efi.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/efi/efi.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/efi/efi.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/efi/efi.go	2020-10-01 09:24:52.000000000 +0000
@@ -0,0 +1,25 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package efi
+
+var (
+	EventLogPath = "/sys/kernel/security/tpm0/binary_bios_measurements" // Path of the TCG event log for the default TPM, in binary form
+	EFIVarsPath  = "/sys/firmware/efi/efivars"                          // Default mount point for efivarfs
+)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/file.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/file.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/file.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/file.go	2020-07-15 14:52:34.000000000 +0000
@@ -0,0 +1,601 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package pe implements access to PE (Microsoft Windows Portable Executable) files.
+package pe
+
+import (
+	"bytes"
+	"compress/zlib"
+	"debug/dwarf"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+// Avoid use of post-Go 1.4 io features, to make safe for toolchain bootstrap.
+const seekStart = 0
+
+// A File represents an open PE file.
+type File struct {
+	FileHeader
+	OptionalHeader interface{} // of type *OptionalHeader32 or *OptionalHeader64
+	Sections       []*Section
+	Symbols        []*Symbol    // COFF symbols with auxiliary symbol records removed
+	COFFSymbols    []COFFSymbol // all COFF symbols (including auxiliary symbol records)
+	StringTable    StringTable
+
+	closer io.Closer
+}
+
+// Open opens the named file using os.Open and prepares it for use as a PE binary.
+func Open(name string) (*File, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	ff, err := NewFile(f)
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+	ff.closer = f
+	return ff, nil
+}
+
+// Close closes the File.
+// If the File was created using NewFile directly instead of Open,
+// Close has no effect.
+func (f *File) Close() error {
+	var err error
+	if f.closer != nil {
+		err = f.closer.Close()
+		f.closer = nil
+	}
+	return err
+}
+
+// TODO(brainman): add Load function, as a replacement for NewFile, that does not call removeAuxSymbols (for performance)
+
+// NewFile creates a new File for accessing a PE binary in an underlying reader.
+func NewFile(r io.ReaderAt) (*File, error) {
+	f := new(File)
+	sr := io.NewSectionReader(r, 0, 1<<63-1)
+
+	var dosheader [96]byte
+	if _, err := r.ReadAt(dosheader[0:], 0); err != nil {
+		return nil, err
+	}
+	var base int64
+	if dosheader[0] == 'M' && dosheader[1] == 'Z' {
+		signoff := int64(binary.LittleEndian.Uint32(dosheader[0x3c:]))
+		var sign [4]byte
+		r.ReadAt(sign[:], signoff)
+		if !(sign[0] == 'P' && sign[1] == 'E' && sign[2] == 0 && sign[3] == 0) {
+			return nil, fmt.Errorf("Invalid PE COFF file signature of %v.", sign)
+		}
+		base = signoff + 4
+	} else {
+		base = int64(0)
+	}
+	sr.Seek(base, seekStart)
+	if err := binary.Read(sr, binary.LittleEndian, &f.FileHeader); err != nil {
+		return nil, err
+	}
+	switch f.FileHeader.Machine {
+	case IMAGE_FILE_MACHINE_UNKNOWN, IMAGE_FILE_MACHINE_ARMNT, IMAGE_FILE_MACHINE_AMD64, IMAGE_FILE_MACHINE_I386:
+	default:
+		return nil, fmt.Errorf("Unrecognised COFF file header machine value of 0x%x.", f.FileHeader.Machine)
+	}
+
+	var err error
+
+	// Read string table.
+	f.StringTable, err = readStringTable(&f.FileHeader, sr)
+	if err != nil {
+		return nil, err
+	}
+
+	// Read symbol table.
+	f.COFFSymbols, err = readCOFFSymbols(&f.FileHeader, sr)
+	if err != nil {
+		return nil, err
+	}
+	f.Symbols, err = removeAuxSymbols(f.COFFSymbols, f.StringTable)
+	if err != nil {
+		return nil, err
+	}
+
+	// Seek past file header.
+	_, err = sr.Seek(base+int64(binary.Size(f.FileHeader)), seekStart)
+	if err != nil {
+		return nil, fmt.Errorf("failure to seek past the file header: %v", err)
+	}
+
+	// Read optional header.
+	f.OptionalHeader, err = readOptionalHeader(sr, f.FileHeader.SizeOfOptionalHeader)
+	if err != nil {
+		return nil, err
+	}
+
+	// Process sections.
+	f.Sections = make([]*Section, f.FileHeader.NumberOfSections)
+	for i := 0; i < int(f.FileHeader.NumberOfSections); i++ {
+		sh := new(SectionHeader32)
+		if err := binary.Read(sr, binary.LittleEndian, sh); err != nil {
+			return nil, err
+		}
+		name, err := sh.fullName(f.StringTable)
+		if err != nil {
+			return nil, err
+		}
+		s := new(Section)
+		s.SectionHeader = SectionHeader{
+			Name:                 name,
+			VirtualSize:          sh.VirtualSize,
+			VirtualAddress:       sh.VirtualAddress,
+			Size:                 sh.SizeOfRawData,
+			Offset:               sh.PointerToRawData,
+			PointerToRelocations: sh.PointerToRelocations,
+			PointerToLineNumbers: sh.PointerToLineNumbers,
+			NumberOfRelocations:  sh.NumberOfRelocations,
+			NumberOfLineNumbers:  sh.NumberOfLineNumbers,
+			Characteristics:      sh.Characteristics,
+		}
+		r2 := r
+		if sh.PointerToRawData == 0 { // .bss must have all 0s
+			r2 = zeroReaderAt{}
+		}
+		s.sr = io.NewSectionReader(r2, int64(s.SectionHeader.Offset), int64(s.SectionHeader.Size))
+		s.ReaderAt = s.sr
+		f.Sections[i] = s
+	}
+	for i := range f.Sections {
+		var err error
+		f.Sections[i].Relocs, err = readRelocs(&f.Sections[i].SectionHeader, sr)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return f, nil
+}
+
+// zeroReaderAt is ReaderAt that reads 0s.
+type zeroReaderAt struct{}
+
+// ReadAt writes len(p) 0s into p.
+func (w zeroReaderAt) ReadAt(p []byte, off int64) (n int, err error) {
+	for i := range p {
+		p[i] = 0
+	}
+	return len(p), nil
+}
+
+// getString extracts a string from symbol string table.
+func getString(section []byte, start int) (string, bool) {
+	if start < 0 || start >= len(section) {
+		return "", false
+	}
+
+	for end := start; end < len(section); end++ {
+		if section[end] == 0 {
+			return string(section[start:end]), true
+		}
+	}
+	return "", false
+}
+
+// Section returns the first section with the given name, or nil if no such
+// section exists.
+func (f *File) Section(name string) *Section {
+	for _, s := range f.Sections {
+		if s.Name == name {
+			return s
+		}
+	}
+	return nil
+}
+
+func (f *File) DWARF() (*dwarf.Data, error) {
+	dwarfSuffix := func(s *Section) string {
+		switch {
+		case strings.HasPrefix(s.Name, ".debug_"):
+			return s.Name[7:]
+		case strings.HasPrefix(s.Name, ".zdebug_"):
+			return s.Name[8:]
+		default:
+			return ""
+		}
+
+	}
+
+	// sectionData gets the data for s and checks its size.
+	sectionData := func(s *Section) ([]byte, error) {
+		b, err := s.Data()
+		if err != nil && uint32(len(b)) < s.Size {
+			return nil, err
+		}
+
+		if 0 < s.VirtualSize && s.VirtualSize < s.Size {
+			b = b[:s.VirtualSize]
+		}
+
+		if len(b) >= 12 && string(b[:4]) == "ZLIB" {
+			dlen := binary.BigEndian.Uint64(b[4:12])
+			dbuf := make([]byte, dlen)
+			r, err := zlib.NewReader(bytes.NewBuffer(b[12:]))
+			if err != nil {
+				return nil, err
+			}
+			if _, err := io.ReadFull(r, dbuf); err != nil {
+				return nil, err
+			}
+			if err := r.Close(); err != nil {
+				return nil, err
+			}
+			b = dbuf
+		}
+		return b, nil
+	}
+
+	// There are many other DWARF sections, but these
+	// are the ones the debug/dwarf package uses.
+	// Don't bother loading others.
+	var dat = map[string][]byte{"abbrev": nil, "info": nil, "str": nil, "line": nil, "ranges": nil}
+	for _, s := range f.Sections {
+		suffix := dwarfSuffix(s)
+		if suffix == "" {
+			continue
+		}
+		if _, ok := dat[suffix]; !ok {
+			continue
+		}
+
+		b, err := sectionData(s)
+		if err != nil {
+			return nil, err
+		}
+		dat[suffix] = b
+	}
+
+	d, err := dwarf.New(dat["abbrev"], nil, nil, dat["info"], dat["line"], nil, dat["ranges"], dat["str"])
+	if err != nil {
+		return nil, err
+	}
+
+	// Look for DWARF4 .debug_types sections.
+	for i, s := range f.Sections {
+		suffix := dwarfSuffix(s)
+		if suffix != "types" {
+			continue
+		}
+
+		b, err := sectionData(s)
+		if err != nil {
+			return nil, err
+		}
+
+		err = d.AddTypes(fmt.Sprintf("types-%d", i), b)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return d, nil
+}
+
+// TODO(brainman): document ImportDirectory once we decide what to do with it.
+
+type ImportDirectory struct {
+	OriginalFirstThunk uint32
+	TimeDateStamp      uint32
+	ForwarderChain     uint32
+	Name               uint32
+	FirstThunk         uint32
+
+	dll string
+}
+
+// ImportedSymbols returns the names of all symbols
+// referred to by the binary f that are expected to be
+// satisfied by other libraries at dynamic load time.
+// It does not return weak symbols.
+func (f *File) ImportedSymbols() ([]string, error) {
+	if f.OptionalHeader == nil {
+		return nil, nil
+	}
+
+	pe64 := f.Machine == IMAGE_FILE_MACHINE_AMD64
+
+	// grab the number of data directory entries
+	var dd_length uint32
+	if pe64 {
+		dd_length = f.OptionalHeader.(*OptionalHeader64).NumberOfRvaAndSizes
+	} else {
+		dd_length = f.OptionalHeader.(*OptionalHeader32).NumberOfRvaAndSizes
+	}
+
+	// check that the length of data directory entries is large
+	// enough to include the imports directory.
+	if dd_length < IMAGE_DIRECTORY_ENTRY_IMPORT+1 {
+		return nil, nil
+	}
+
+	// grab the import data directory entry
+	var idd DataDirectory
+	if pe64 {
+		idd = f.OptionalHeader.(*OptionalHeader64).DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]
+	} else {
+		idd = f.OptionalHeader.(*OptionalHeader32).DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]
+	}
+
+	// figure out which section contains the import directory table
+	var ds *Section
+	ds = nil
+	for _, s := range f.Sections {
+		if s.VirtualAddress <= idd.VirtualAddress && idd.VirtualAddress < s.VirtualAddress+s.VirtualSize {
+			ds = s
+			break
+		}
+	}
+
+	// didn't find a section, so no import libraries were found
+	if ds == nil {
+		return nil, nil
+	}
+
+	d, err := ds.Data()
+	if err != nil {
+		return nil, err
+	}
+
+	// seek to the virtual address specified in the import data directory
+	d = d[idd.VirtualAddress-ds.VirtualAddress:]
+
+	// start decoding the import directory
+	var ida []ImportDirectory
+	for len(d) >= 20 {
+		var dt ImportDirectory
+		dt.OriginalFirstThunk = binary.LittleEndian.Uint32(d[0:4])
+		dt.TimeDateStamp = binary.LittleEndian.Uint32(d[4:8])
+		dt.ForwarderChain = binary.LittleEndian.Uint32(d[8:12])
+		dt.Name = binary.LittleEndian.Uint32(d[12:16])
+		dt.FirstThunk = binary.LittleEndian.Uint32(d[16:20])
+		d = d[20:]
+		if dt.OriginalFirstThunk == 0 {
+			break
+		}
+		ida = append(ida, dt)
+	}
+	// TODO(brainman): this needs to be rewritten
+	//  ds.Data() returns contents of section containing import table. Why store in variable called "names"?
+	//  Why we are retrieving it second time? We already have it in "d", and it is not modified anywhere.
+	//  getString does not extracts a string from symbol string table (as getString doco says).
+	//  Why ds.Data() called again and again in the loop?
+	//  Needs test before rewrite.
+	names, _ := ds.Data()
+	var all []string
+	for _, dt := range ida {
+		dt.dll, _ = getString(names, int(dt.Name-ds.VirtualAddress))
+		d, _ = ds.Data()
+		// seek to OriginalFirstThunk
+		d = d[dt.OriginalFirstThunk-ds.VirtualAddress:]
+		for len(d) > 0 {
+			if pe64 { // 64bit
+				va := binary.LittleEndian.Uint64(d[0:8])
+				d = d[8:]
+				if va == 0 {
+					break
+				}
+				if va&0x8000000000000000 > 0 { // is Ordinal
+					// TODO add dynimport ordinal support.
+				} else {
+					fn, _ := getString(names, int(uint32(va)-ds.VirtualAddress+2))
+					all = append(all, fn+":"+dt.dll)
+				}
+			} else { // 32bit
+				va := binary.LittleEndian.Uint32(d[0:4])
+				d = d[4:]
+				if va == 0 {
+					break
+				}
+				if va&0x80000000 > 0 { // is Ordinal
+					// TODO add dynimport ordinal support.
+					//ord := va&0x0000FFFF
+				} else {
+					fn, _ := getString(names, int(va-ds.VirtualAddress+2))
+					all = append(all, fn+":"+dt.dll)
+				}
+			}
+		}
+	}
+
+	return all, nil
+}
+
+// ImportedLibraries returns the names of all libraries
+// referred to by the binary f that are expected to be
+// linked with the binary at dynamic link time.
+func (f *File) ImportedLibraries() ([]string, error) {
+	// TODO
+	// cgo -dynimport don't use this for windows PE, so just return.
+	return nil, nil
+}
+
+// FormatError is unused.
+// The type is retained for compatibility.
+type FormatError struct {
+}
+
+func (e *FormatError) Error() string {
+	return "unknown error"
+}
+
+// readOptionalHeader accepts a io.ReadSeeker pointing to optional header in the PE file
+// and its size as seen in the file header.
+// It parses the given size of bytes and returns optional header. It infers whether the
+// bytes being parsed refer to 32 bit or 64 bit version of optional header.
+func readOptionalHeader(r io.ReadSeeker, sz uint16) (interface{}, error) {
+	// If optional header size is 0, return empty optional header.
+	if sz == 0 {
+		return nil, nil
+	}
+
+	var (
+		// First couple of bytes in option header state its type.
+		// We need to read them first to determine the type and
+		// validity of optional header.
+		ohMagic   uint16
+		ohMagicSz = binary.Size(ohMagic)
+	)
+
+	// If optional header size is greater than 0 but less than its magic size, return error.
+	if sz < uint16(ohMagicSz) {
+		return nil, fmt.Errorf("optional header size is less than optional header magic size")
+	}
+
+	// read reads from io.ReadSeeke, r, into data.
+	var err error
+	read := func(data interface{}) bool {
+		err = binary.Read(r, binary.LittleEndian, data)
+		return err == nil
+	}
+
+	if !read(&ohMagic) {
+		return nil, fmt.Errorf("failure to read optional header magic: %v", err)
+
+	}
+
+	switch ohMagic {
+	case 0x10b: // PE32
+		var (
+			oh32 OptionalHeader32
+			// There can be 0 or more data directories. So the minimum size of optional
+			// header is calculated by subtracting oh32.DataDirectory size from oh32 size.
+			oh32MinSz = binary.Size(oh32) - binary.Size(oh32.DataDirectory)
+		)
+
+		if sz < uint16(oh32MinSz) {
+			return nil, fmt.Errorf("optional header size(%d) is less minimum size (%d) of PE32 optional header", sz, oh32MinSz)
+		}
+
+		// Init oh32 fields
+		oh32.Magic = ohMagic
+		if !read(&oh32.MajorLinkerVersion) ||
+			!read(&oh32.MinorLinkerVersion) ||
+			!read(&oh32.SizeOfCode) ||
+			!read(&oh32.SizeOfInitializedData) ||
+			!read(&oh32.SizeOfUninitializedData) ||
+			!read(&oh32.AddressOfEntryPoint) ||
+			!read(&oh32.BaseOfCode) ||
+			!read(&oh32.BaseOfData) ||
+			!read(&oh32.ImageBase) ||
+			!read(&oh32.SectionAlignment) ||
+			!read(&oh32.FileAlignment) ||
+			!read(&oh32.MajorOperatingSystemVersion) ||
+			!read(&oh32.MinorOperatingSystemVersion) ||
+			!read(&oh32.MajorImageVersion) ||
+			!read(&oh32.MinorImageVersion) ||
+			!read(&oh32.MajorSubsystemVersion) ||
+			!read(&oh32.MinorSubsystemVersion) ||
+			!read(&oh32.Win32VersionValue) ||
+			!read(&oh32.SizeOfImage) ||
+			!read(&oh32.SizeOfHeaders) ||
+			!read(&oh32.CheckSum) ||
+			!read(&oh32.Subsystem) ||
+			!read(&oh32.DllCharacteristics) ||
+			!read(&oh32.SizeOfStackReserve) ||
+			!read(&oh32.SizeOfStackCommit) ||
+			!read(&oh32.SizeOfHeapReserve) ||
+			!read(&oh32.SizeOfHeapCommit) ||
+			!read(&oh32.LoaderFlags) ||
+			!read(&oh32.NumberOfRvaAndSizes) {
+			return nil, fmt.Errorf("failure to read PE32 optional header: %v", err)
+		}
+
+		dd, err := readDataDirectories(r, sz-uint16(oh32MinSz), oh32.NumberOfRvaAndSizes)
+		if err != nil {
+			return nil, err
+		}
+
+		copy(oh32.DataDirectory[:], dd)
+
+		return &oh32, nil
+	case 0x20b: // PE32+
+		var (
+			oh64 OptionalHeader64
+			// There can be 0 or more data directories. So the minimum size of optional
+			// header is calculated by subtracting oh64.DataDirectory size from oh64 size.
+			oh64MinSz = binary.Size(oh64) - binary.Size(oh64.DataDirectory)
+		)
+
+		if sz < uint16(oh64MinSz) {
+			return nil, fmt.Errorf("optional header size(%d) is less minimum size (%d) for PE32+ optional header", sz, oh64MinSz)
+		}
+
+		// Init oh64 fields
+		oh64.Magic = ohMagic
+		if !read(&oh64.MajorLinkerVersion) ||
+			!read(&oh64.MinorLinkerVersion) ||
+			!read(&oh64.SizeOfCode) ||
+			!read(&oh64.SizeOfInitializedData) ||
+			!read(&oh64.SizeOfUninitializedData) ||
+			!read(&oh64.AddressOfEntryPoint) ||
+			!read(&oh64.BaseOfCode) ||
+			!read(&oh64.ImageBase) ||
+			!read(&oh64.SectionAlignment) ||
+			!read(&oh64.FileAlignment) ||
+			!read(&oh64.MajorOperatingSystemVersion) ||
+			!read(&oh64.MinorOperatingSystemVersion) ||
+			!read(&oh64.MajorImageVersion) ||
+			!read(&oh64.MinorImageVersion) ||
+			!read(&oh64.MajorSubsystemVersion) ||
+			!read(&oh64.MinorSubsystemVersion) ||
+			!read(&oh64.Win32VersionValue) ||
+			!read(&oh64.SizeOfImage) ||
+			!read(&oh64.SizeOfHeaders) ||
+			!read(&oh64.CheckSum) ||
+			!read(&oh64.Subsystem) ||
+			!read(&oh64.DllCharacteristics) ||
+			!read(&oh64.SizeOfStackReserve) ||
+			!read(&oh64.SizeOfStackCommit) ||
+			!read(&oh64.SizeOfHeapReserve) ||
+			!read(&oh64.SizeOfHeapCommit) ||
+			!read(&oh64.LoaderFlags) ||
+			!read(&oh64.NumberOfRvaAndSizes) {
+			return nil, fmt.Errorf("failure to read PE32+ optional header: %v", err)
+		}
+
+		dd, err := readDataDirectories(r, sz-uint16(oh64MinSz), oh64.NumberOfRvaAndSizes)
+		if err != nil {
+			return nil, err
+		}
+
+		copy(oh64.DataDirectory[:], dd)
+
+		return &oh64, nil
+	default:
+		return nil, fmt.Errorf("optional header has unexpected Magic of 0x%x", ohMagic)
+	}
+}
+
+// readDataDirectories accepts a io.ReadSeeker pointing to data directories in the PE file,
+// its size and number of data directories as seen in optional header.
+// It parses the given size of bytes and returns given number of data directories.
+func readDataDirectories(r io.ReadSeeker, sz uint16, n uint32) ([]DataDirectory, error) {
+	ddSz := binary.Size(DataDirectory{})
+	if uint32(sz) != n*uint32(ddSz) {
+		return nil, fmt.Errorf("size of data directories(%d) is inconsistent with number of data directories(%d)", sz, n)
+	}
+
+	dd := make([]DataDirectory, n)
+	if err := binary.Read(r, binary.LittleEndian, dd); err != nil {
+		return nil, fmt.Errorf("failure to read data directories: %v", err)
+	}
+
+	return dd, nil
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/pe.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/pe.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/pe.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/pe.go	2020-07-15 14:52:34.000000000 +0000
@@ -0,0 +1,131 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package pe
+
+type FileHeader struct {
+	Machine              uint16
+	NumberOfSections     uint16
+	TimeDateStamp        uint32
+	PointerToSymbolTable uint32
+	NumberOfSymbols      uint32
+	SizeOfOptionalHeader uint16
+	Characteristics      uint16
+}
+
+type DataDirectory struct {
+	VirtualAddress uint32
+	Size           uint32
+}
+
+type OptionalHeader32 struct {
+	Magic                       uint16
+	MajorLinkerVersion          uint8
+	MinorLinkerVersion          uint8
+	SizeOfCode                  uint32
+	SizeOfInitializedData       uint32
+	SizeOfUninitializedData     uint32
+	AddressOfEntryPoint         uint32
+	BaseOfCode                  uint32
+	BaseOfData                  uint32
+	ImageBase                   uint32
+	SectionAlignment            uint32
+	FileAlignment               uint32
+	MajorOperatingSystemVersion uint16
+	MinorOperatingSystemVersion uint16
+	MajorImageVersion           uint16
+	MinorImageVersion           uint16
+	MajorSubsystemVersion       uint16
+	MinorSubsystemVersion       uint16
+	Win32VersionValue           uint32
+	SizeOfImage                 uint32
+	SizeOfHeaders               uint32
+	CheckSum                    uint32
+	Subsystem                   uint16
+	DllCharacteristics          uint16
+	SizeOfStackReserve          uint32
+	SizeOfStackCommit           uint32
+	SizeOfHeapReserve           uint32
+	SizeOfHeapCommit            uint32
+	LoaderFlags                 uint32
+	NumberOfRvaAndSizes         uint32
+	DataDirectory               [16]DataDirectory
+}
+
+type OptionalHeader64 struct {
+	Magic                       uint16
+	MajorLinkerVersion          uint8
+	MinorLinkerVersion          uint8
+	SizeOfCode                  uint32
+	SizeOfInitializedData       uint32
+	SizeOfUninitializedData     uint32
+	AddressOfEntryPoint         uint32
+	BaseOfCode                  uint32
+	ImageBase                   uint64
+	SectionAlignment            uint32
+	FileAlignment               uint32
+	MajorOperatingSystemVersion uint16
+	MinorOperatingSystemVersion uint16
+	MajorImageVersion           uint16
+	MinorImageVersion           uint16
+	MajorSubsystemVersion       uint16
+	MinorSubsystemVersion       uint16
+	Win32VersionValue           uint32
+	SizeOfImage                 uint32
+	SizeOfHeaders               uint32
+	CheckSum                    uint32
+	Subsystem                   uint16
+	DllCharacteristics          uint16
+	SizeOfStackReserve          uint64
+	SizeOfStackCommit           uint64
+	SizeOfHeapReserve           uint64
+	SizeOfHeapCommit            uint64
+	LoaderFlags                 uint32
+	NumberOfRvaAndSizes         uint32
+	DataDirectory               [16]DataDirectory
+}
+
+const (
+	IMAGE_FILE_MACHINE_UNKNOWN   = 0x0
+	IMAGE_FILE_MACHINE_AM33      = 0x1d3
+	IMAGE_FILE_MACHINE_AMD64     = 0x8664
+	IMAGE_FILE_MACHINE_ARM       = 0x1c0
+	IMAGE_FILE_MACHINE_ARMNT     = 0x1c4
+	IMAGE_FILE_MACHINE_ARM64     = 0xaa64
+	IMAGE_FILE_MACHINE_EBC       = 0xebc
+	IMAGE_FILE_MACHINE_I386      = 0x14c
+	IMAGE_FILE_MACHINE_IA64      = 0x200
+	IMAGE_FILE_MACHINE_M32R      = 0x9041
+	IMAGE_FILE_MACHINE_MIPS16    = 0x266
+	IMAGE_FILE_MACHINE_MIPSFPU   = 0x366
+	IMAGE_FILE_MACHINE_MIPSFPU16 = 0x466
+	IMAGE_FILE_MACHINE_POWERPC   = 0x1f0
+	IMAGE_FILE_MACHINE_POWERPCFP = 0x1f1
+	IMAGE_FILE_MACHINE_R4000     = 0x166
+	IMAGE_FILE_MACHINE_SH3       = 0x1a2
+	IMAGE_FILE_MACHINE_SH3DSP    = 0x1a3
+	IMAGE_FILE_MACHINE_SH4       = 0x1a6
+	IMAGE_FILE_MACHINE_SH5       = 0x1a8
+	IMAGE_FILE_MACHINE_THUMB     = 0x1c2
+	IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x169
+)
+
+// IMAGE_DIRECTORY_ENTRY constants
+const (
+	IMAGE_DIRECTORY_ENTRY_EXPORT         = 0
+	IMAGE_DIRECTORY_ENTRY_IMPORT         = 1
+	IMAGE_DIRECTORY_ENTRY_RESOURCE       = 2
+	IMAGE_DIRECTORY_ENTRY_EXCEPTION      = 3
+	IMAGE_DIRECTORY_ENTRY_SECURITY       = 4
+	IMAGE_DIRECTORY_ENTRY_BASERELOC      = 5
+	IMAGE_DIRECTORY_ENTRY_DEBUG          = 6
+	IMAGE_DIRECTORY_ENTRY_ARCHITECTURE   = 7
+	IMAGE_DIRECTORY_ENTRY_GLOBALPTR      = 8
+	IMAGE_DIRECTORY_ENTRY_TLS            = 9
+	IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    = 10
+	IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   = 11
+	IMAGE_DIRECTORY_ENTRY_IAT            = 12
+	IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   = 13
+	IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14
+)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/README snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/README
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/README	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/README	2020-07-15 14:52:34.000000000 +0000
@@ -0,0 +1,7 @@
+This is a copy of debug/pe from go 1.14.2 (96745b980cfde139e8611772e2bc0c59a8e6cdf7)
+It exists here because debug/pe in go versions before 1.14 did not handle variable
+length optional headers (where the data directory is less than 16 entries) and
+therefore doesn't correctly decode kernel EFI images. Copying the code here avoids
+a hard dependency on go 1.14.
+
+See https://github.com/golang/go/commit/3b92f36d15c868e856be71c0fadfc7ff97039b96
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/section.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/section.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/section.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/section.go	2020-07-15 14:52:34.000000000 +0000
@@ -0,0 +1,111 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package pe
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"strconv"
+)
+
+// SectionHeader32 represents real PE COFF section header.
+type SectionHeader32 struct {
+	Name                 [8]uint8
+	VirtualSize          uint32
+	VirtualAddress       uint32
+	SizeOfRawData        uint32
+	PointerToRawData     uint32
+	PointerToRelocations uint32
+	PointerToLineNumbers uint32
+	NumberOfRelocations  uint16
+	NumberOfLineNumbers  uint16
+	Characteristics      uint32
+}
+
+// fullName finds real name of section sh. Normally name is stored
+// in sh.Name, but if it is longer then 8 characters, it is stored
+// in COFF string table st instead.
+func (sh *SectionHeader32) fullName(st StringTable) (string, error) {
+	if sh.Name[0] != '/' {
+		return cstring(sh.Name[:]), nil
+	}
+	i, err := strconv.Atoi(cstring(sh.Name[1:]))
+	if err != nil {
+		return "", err
+	}
+	return st.String(uint32(i))
+}
+
+// TODO(brainman): copy all IMAGE_REL_* consts from ldpe.go here
+
+// Reloc represents a PE COFF relocation.
+// Each section contains its own relocation list.
+type Reloc struct {
+	VirtualAddress   uint32
+	SymbolTableIndex uint32
+	Type             uint16
+}
+
+func readRelocs(sh *SectionHeader, r io.ReadSeeker) ([]Reloc, error) {
+	if sh.NumberOfRelocations <= 0 {
+		return nil, nil
+	}
+	_, err := r.Seek(int64(sh.PointerToRelocations), seekStart)
+	if err != nil {
+		return nil, fmt.Errorf("fail to seek to %q section relocations: %v", sh.Name, err)
+	}
+	relocs := make([]Reloc, sh.NumberOfRelocations)
+	err = binary.Read(r, binary.LittleEndian, relocs)
+	if err != nil {
+		return nil, fmt.Errorf("fail to read section relocations: %v", err)
+	}
+	return relocs, nil
+}
+
+// SectionHeader is similar to SectionHeader32 with Name
+// field replaced by Go string.
+type SectionHeader struct {
+	Name                 string
+	VirtualSize          uint32
+	VirtualAddress       uint32
+	Size                 uint32
+	Offset               uint32
+	PointerToRelocations uint32
+	PointerToLineNumbers uint32
+	NumberOfRelocations  uint16
+	NumberOfLineNumbers  uint16
+	Characteristics      uint32
+}
+
+// Section provides access to PE COFF section.
+type Section struct {
+	SectionHeader
+	Relocs []Reloc
+
+	// Embed ReaderAt for ReadAt method.
+	// Do not embed SectionReader directly
+	// to avoid having Read and Seek.
+	// If a client wants Read and Seek it must use
+	// Open() to avoid fighting over the seek offset
+	// with other clients.
+	io.ReaderAt
+	sr *io.SectionReader
+}
+
+// Data reads and returns the contents of the PE section s.
+func (s *Section) Data() ([]byte, error) {
+	dat := make([]byte, s.sr.Size())
+	n, err := s.sr.ReadAt(dat, 0)
+	if n == len(dat) {
+		err = nil
+	}
+	return dat[0:n], err
+}
+
+// Open returns a new ReadSeeker reading the PE section s.
+func (s *Section) Open() io.ReadSeeker {
+	return io.NewSectionReader(s.sr, 0, 1<<63-1)
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/string.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/string.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/string.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/string.go	2020-07-15 14:52:34.000000000 +0000
@@ -0,0 +1,68 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package pe
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+)
+
+// cstring converts ASCII byte sequence b to string.
+// It stops once it finds 0 or reaches end of b.
+func cstring(b []byte) string {
+	i := bytes.IndexByte(b, 0)
+	if i == -1 {
+		i = len(b)
+	}
+	return string(b[:i])
+}
+
+// StringTable is a COFF string table.
+type StringTable []byte
+
+func readStringTable(fh *FileHeader, r io.ReadSeeker) (StringTable, error) {
+	// COFF string table is located right after COFF symbol table.
+	if fh.PointerToSymbolTable <= 0 {
+		return nil, nil
+	}
+	offset := fh.PointerToSymbolTable + COFFSymbolSize*fh.NumberOfSymbols
+	_, err := r.Seek(int64(offset), seekStart)
+	if err != nil {
+		return nil, fmt.Errorf("fail to seek to string table: %v", err)
+	}
+	var l uint32
+	err = binary.Read(r, binary.LittleEndian, &l)
+	if err != nil {
+		return nil, fmt.Errorf("fail to read string table length: %v", err)
+	}
+	// string table length includes itself
+	if l <= 4 {
+		return nil, nil
+	}
+	l -= 4
+	buf := make([]byte, l)
+	_, err = io.ReadFull(r, buf)
+	if err != nil {
+		return nil, fmt.Errorf("fail to read string table: %v", err)
+	}
+	return StringTable(buf), nil
+}
+
+// TODO(brainman): decide if start parameter should be int instead of uint32
+
+// String extracts string from COFF string table st at offset start.
+func (st StringTable) String(start uint32) (string, error) {
+	// start includes 4 bytes of string table length
+	if start < 4 {
+		return "", fmt.Errorf("offset %d is before the start of string table", start)
+	}
+	start -= 4
+	if int(start) > len(st) {
+		return "", fmt.Errorf("offset %d is beyond the end of string table", start)
+	}
+	return cstring(st[start:]), nil
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/symbol.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/symbol.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/pe1.14/symbol.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/pe1.14/symbol.go	2020-07-15 14:52:34.000000000 +0000
@@ -0,0 +1,98 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package pe
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+)
+
+const COFFSymbolSize = 18
+
+// COFFSymbol represents single COFF symbol table record.
+type COFFSymbol struct {
+	Name               [8]uint8
+	Value              uint32
+	SectionNumber      int16
+	Type               uint16
+	StorageClass       uint8
+	NumberOfAuxSymbols uint8
+}
+
+func readCOFFSymbols(fh *FileHeader, r io.ReadSeeker) ([]COFFSymbol, error) {
+	if fh.PointerToSymbolTable == 0 {
+		return nil, nil
+	}
+	if fh.NumberOfSymbols <= 0 {
+		return nil, nil
+	}
+	_, err := r.Seek(int64(fh.PointerToSymbolTable), seekStart)
+	if err != nil {
+		return nil, fmt.Errorf("fail to seek to symbol table: %v", err)
+	}
+	syms := make([]COFFSymbol, fh.NumberOfSymbols)
+	err = binary.Read(r, binary.LittleEndian, syms)
+	if err != nil {
+		return nil, fmt.Errorf("fail to read symbol table: %v", err)
+	}
+	return syms, nil
+}
+
+// isSymNameOffset checks symbol name if it is encoded as offset into string table.
+func isSymNameOffset(name [8]byte) (bool, uint32) {
+	if name[0] == 0 && name[1] == 0 && name[2] == 0 && name[3] == 0 {
+		return true, binary.LittleEndian.Uint32(name[4:])
+	}
+	return false, 0
+}
+
+// FullName finds real name of symbol sym. Normally name is stored
+// in sym.Name, but if it is longer then 8 characters, it is stored
+// in COFF string table st instead.
+func (sym *COFFSymbol) FullName(st StringTable) (string, error) {
+	if ok, offset := isSymNameOffset(sym.Name); ok {
+		return st.String(offset)
+	}
+	return cstring(sym.Name[:]), nil
+}
+
+func removeAuxSymbols(allsyms []COFFSymbol, st StringTable) ([]*Symbol, error) {
+	if len(allsyms) == 0 {
+		return nil, nil
+	}
+	syms := make([]*Symbol, 0)
+	aux := uint8(0)
+	for _, sym := range allsyms {
+		if aux > 0 {
+			aux--
+			continue
+		}
+		name, err := sym.FullName(st)
+		if err != nil {
+			return nil, err
+		}
+		aux = sym.NumberOfAuxSymbols
+		s := &Symbol{
+			Name:          name,
+			Value:         sym.Value,
+			SectionNumber: sym.SectionNumber,
+			Type:          sym.Type,
+			StorageClass:  sym.StorageClass,
+		}
+		syms = append(syms, s)
+	}
+	return syms, nil
+}
+
+// Symbol is similar to COFFSymbol with Name field replaced
+// by Go string. Symbol also does not have NumberOfAuxSymbols.
+type Symbol struct {
+	Name          string
+	Value         uint32
+	SectionNumber int16
+	Type          uint16
+	StorageClass  uint8
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/tcg/tcg.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/tcg/tcg.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/tcg/tcg.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/tcg/tcg.go	2020-09-10 04:56:37.000000000 +0000
@@ -0,0 +1,93 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package tcg
+
+import (
+	"encoding/asn1"
+
+	"github.com/canonical/go-tpm2"
+)
+
+const (
+	// Handle for RSA2048 EK certificate, see section 7.8 of "TCG TPM v2.0 Provisioning Guidance" Version 1.0, Revision 1.0, 15 March 2017.
+	EKCertHandle tpm2.Handle = 0x01c00002
+
+	// Default RSA2048 SRK handle, see section 7.8 of "TCG TPM v2.0 Provisioning Guidance" Version 1.0, Revision 1.0, 15 March 2017
+	SRKHandle tpm2.Handle = 0x81000001
+
+	// Default RSA2048 EK handle, see section 7.8 of "TCG TPM v2.0 Provisioning Guidance" Version 1.0, Revision 1.0, 15 March 2017
+	EKHandle tpm2.Handle = 0x81010001
+
+	SANDirectoryNameTag = 4 // Subject Alternative Name directoryName, see section 4.2.16 or RFC5280
+)
+
+func MakeDefaultSRKTemplate() *tpm2.Public {
+	return &tpm2.Public{
+		Type:    tpm2.ObjectTypeRSA,
+		NameAlg: tpm2.HashAlgorithmSHA256,
+		Attrs: tpm2.AttrFixedTPM | tpm2.AttrFixedParent | tpm2.AttrSensitiveDataOrigin | tpm2.AttrUserWithAuth | tpm2.AttrNoDA |
+			tpm2.AttrRestricted | tpm2.AttrDecrypt,
+		Params: tpm2.PublicParamsU{
+			Data: &tpm2.RSAParams{
+				Symmetric: tpm2.SymDefObject{
+					Algorithm: tpm2.SymObjectAlgorithmAES,
+					KeyBits:   tpm2.SymKeyBitsU{Data: uint16(128)},
+					Mode:      tpm2.SymModeU{Data: tpm2.SymModeCFB}},
+				Scheme:   tpm2.RSAScheme{Scheme: tpm2.RSASchemeNull},
+				KeyBits:  2048,
+				Exponent: 0}},
+		Unique: tpm2.PublicIDU{Data: make(tpm2.PublicKeyRSA, 256)}}
+}
+
+func MakeDefaultEKTemplate() *tpm2.Public {
+	return &tpm2.Public{
+		Type:    tpm2.ObjectTypeRSA,
+		NameAlg: tpm2.HashAlgorithmSHA256,
+		Attrs: tpm2.AttrFixedTPM | tpm2.AttrFixedParent | tpm2.AttrSensitiveDataOrigin | tpm2.AttrAdminWithPolicy | tpm2.AttrRestricted |
+			tpm2.AttrDecrypt,
+		AuthPolicy: []byte{0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc, 0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7,
+			0x6e, 0x06, 0x52, 0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa},
+		Params: tpm2.PublicParamsU{
+			Data: &tpm2.RSAParams{
+				Symmetric: tpm2.SymDefObject{
+					Algorithm: tpm2.SymObjectAlgorithmAES,
+					KeyBits:   tpm2.SymKeyBitsU{Data: uint16(128)},
+					Mode:      tpm2.SymModeU{Data: tpm2.SymModeCFB}},
+				Scheme:   tpm2.RSAScheme{Scheme: tpm2.RSASchemeNull},
+				KeyBits:  2048,
+				Exponent: 0}},
+		Unique: tpm2.PublicIDU{Data: make(tpm2.PublicKeyRSA, 256)}}
+}
+
+var (
+	// srkTemplate is the default RSA2048 SRK template, see section 7.5.1 of "TCG TPM v2.0 Provisioning Guidance", version 1.0, revision 1.0, 15 March 2017.
+	SRKTemplate = MakeDefaultSRKTemplate()
+
+	// Default RSA2048 EK template, see section B.3.3 of "TCG EK Credential Profile For TPM Family 2.0; Level 0", Version 2.1, Revision 13, 10 December 2018
+	EKTemplate = MakeDefaultEKTemplate()
+
+	OIDExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} // id-ce-subjectAltName, see section 4.2.16 of RFC5280
+
+	// TCG specific OIDs, see section 4 of "TCG EK Credential Profile For TPM Family 2.0; Level 0", Version 2.1, Revision 13, 10 December 2018.
+	OIDTcgAttributeTpmManufacturer = asn1.ObjectIdentifier{2, 23, 133, 2, 1} // tcg-at-tpmManufacturer
+	OIDTcgAttributeTpmModel        = asn1.ObjectIdentifier{2, 23, 133, 2, 2} // tcg-at-tpmModel
+	OIDTcgAttributeTpmVersion      = asn1.ObjectIdentifier{2, 23, 133, 2, 3} // tcg-at-tpmVersion
+	OIDTcgKpEkCertificate          = asn1.ObjectIdentifier{2, 23, 133, 8, 1} // tcg-kp-EKCertificate
+)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/tcti/tcti.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/tcti/tcti.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/tcti/tcti.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/tcti/tcti.go	2020-09-10 04:56:37.000000000 +0000
@@ -0,0 +1,36 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2019 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package tcti
+
+import (
+	"io"
+
+	"github.com/canonical/go-tpm2"
+)
+
+const (
+	// FIXME: This is fine during initial install and early boot, but we should strive to use the resource manager at other times.
+	tpmPath = "/dev/tpm0"
+)
+
+// OpenDefaultTcti connects to the default TPM character device. This can be overridden for tests to connect to a simulator device.
+var OpenDefault = func() (io.ReadWriteCloser, error) {
+	return tpm2.OpenTPMDevice(tpmPath)
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/truststore/truststore.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/truststore/truststore.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/internal/truststore/truststore.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/internal/truststore/truststore.go	2020-09-10 04:56:37.000000000 +0000
@@ -0,0 +1,12 @@
+package truststore
+
+var (
+	RootCAHashes = [][]byte{
+		[]byte{0x27, 0x82, 0xe5, 0x1a, 0x95, 0xe8, 0x6d, 0x95, 0x57, 0xfe, 0x42, 0x04, 0x31, 0x6c, 0xf8, 0x05, 0xbd, 0x6f, 0x58, 0x98, 0xf8, 0x1f, 0x97, 0x32, 0xe9, 0x44, 0xd7, 0x42, 0xbc, 0xdc, 0x5f, 0x54},
+		[]byte{0xe3, 0x8c, 0x28, 0x0f, 0x7c, 0x0e, 0x0b, 0x49, 0xf3, 0x1e, 0xfc, 0x75, 0x31, 0x03, 0x2b, 0xb6, 0xa8, 0x6c, 0x3f, 0xba, 0x4e, 0xb8, 0x9b, 0xeb, 0x1d, 0x51, 0x0e, 0xaa, 0x45, 0x10, 0xae, 0x4a},
+		[]byte{0x4a, 0xeb, 0xe7, 0x7a, 0x51, 0xed, 0x29, 0x95, 0x9a, 0x7f, 0x9f, 0x5e, 0x07, 0xa2, 0x4a, 0x55, 0x8d, 0xee, 0x81, 0x67, 0xf3, 0x98, 0x5d, 0x72, 0x49, 0x95, 0xa5, 0x41, 0xc2, 0x58, 0xdf, 0xda},
+		[]byte{0xcd, 0x81, 0x85, 0xff, 0x89, 0x95, 0xed, 0x09, 0x81, 0x19, 0x70, 0x09, 0x0a, 0x8c, 0x36, 0xfa, 0xfa, 0xb3, 0x4e, 0xf8, 0x7f, 0x47, 0xfa, 0x51, 0xfd, 0xb9, 0xec, 0xf9, 0x5c, 0x9c, 0x2e, 0x04},
+		[]byte{0x89, 0x9e, 0x35, 0x47, 0x4c, 0x98, 0x07, 0xeb, 0x4c, 0x7f, 0x2f, 0x7a, 0x12, 0xda, 0x00, 0x28, 0xfb, 0x25, 0x0c, 0xd0, 0x21, 0x54, 0xd0, 0x00, 0x9f, 0xca, 0x7d, 0x9c, 0x66, 0x57, 0x4f, 0x3b},
+		[]byte{0xf8, 0xe3, 0x7a, 0x86, 0xb6, 0x89, 0xa2, 0x0a, 0x6c, 0xc0, 0xc4, 0x0c, 0xc3, 0xf8, 0x1f, 0xb1, 0x30, 0xfa, 0x9f, 0x44, 0xce, 0x7f, 0xfa, 0x60, 0xd6, 0x25, 0x90, 0xaa, 0xf8, 0x72, 0x73, 0xa9},
+	}
+)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/keydata.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/keydata.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/keydata.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/keydata.go	2020-11-05 20:13:01.000000000 +0000
@@ -22,23 +22,29 @@
 import (
 	"bytes"
 	"crypto"
+	"crypto/ecdsa"
 	"crypto/rsa"
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"hash"
 	"io"
 	"math/big"
 	"os"
 
 	"github.com/canonical/go-tpm2"
+	"github.com/canonical/go-tpm2/mu"
+	"github.com/snapcore/secboot/internal/tcg"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/sys"
 
 	"golang.org/x/xerrors"
+
+	"maze.io/x/crypto/afis"
 )
 
 const (
-	currentVersion            uint32 = 0
+	currentMetadataVersion    uint32 = 1
 	keyDataHeader             uint32 = 0x55534b24
 	keyPolicyUpdateDataHeader uint32 = 0x55534b50
 )
@@ -51,106 +57,304 @@
 	AuthModePIN
 )
 
-// keyPolicyUpdateData corresponds to the private part of a sealed key object that is required in order to create new dynamic
-// authorization policies.
-type keyPolicyUpdateData struct {
-	Data struct {
-		AuthKey []byte
-	}
-	CreationData   *tpm2.CreationData
-	CreationTicket *tpm2.TkCreation
+// TPMPolicyAuthKey corresponds to the private part of the key used for signing updates to the authorization policy for a sealed key.
+type TPMPolicyAuthKey []byte
+
+type sealedData struct {
+	Key            []byte
+	AuthPrivateKey TPMPolicyAuthKey
 }
 
-// keyData corresponds to the part of a sealed key object that contains the TPM sealed object and associated metadata required
-// for executing authorization policy assertions.
-type keyData struct {
-	KeyPrivate        tpm2.Private
-	KeyPublic         *tpm2.Public
-	AuthModeHint      AuthMode
-	StaticPolicyData  *staticPolicyData
-	DynamicPolicyData *dynamicPolicyData
+type afSplitDataRawHdr struct {
+	Stripes uint32
+	HashAlg tpm2.HashAlgorithmId
+	Size    uint32
 }
 
-// readKeyPolicyUpdateData deserializes keyPolicyUpdateData from the provided io.Reader.
-func readKeyPolicyUpdateData(buf io.Reader) (*keyPolicyUpdateData, error) {
-	var header uint32
-	var version uint32
-	if _, err := tpm2.UnmarshalFromReader(buf, &header, &version); err != nil {
-		return nil, xerrors.Errorf("cannot unmarshal header and version number: %w", err)
+// afSlitDataRaw is the on-disk version of afSplitData.
+type afSplitDataRaw struct {
+	Hdr  afSplitDataRawHdr
+	Data mu.RawBytes
+}
+
+func (d *afSplitDataRaw) Marshal(w io.Writer) error {
+	_, err := mu.MarshalToWriter(w, d.Hdr, d.Data)
+	return err
+}
+
+func (d *afSplitDataRaw) Unmarshal(r mu.Reader) error {
+	var h afSplitDataRawHdr
+	if _, err := mu.UnmarshalFromReader(r, &h); err != nil {
+		return xerrors.Errorf("cannot unmarshal header: %w", err)
 	}
 
-	if header != keyPolicyUpdateDataHeader {
-		return nil, fmt.Errorf("unexpected header (%d)", header)
+	data := make([]byte, h.Size)
+	if _, err := io.ReadFull(r, data); err != nil {
+		return xerrors.Errorf("cannot read data: %w", err)
 	}
-	if version != currentVersion {
-		return nil, fmt.Errorf("unexpected version number (%d)", version)
+
+	d.Hdr = h
+	d.Data = data
+	return nil
+}
+
+func (d *afSplitDataRaw) data() *afSplitData {
+	return &afSplitData{
+		stripes: d.Hdr.Stripes,
+		hashAlg: d.Hdr.HashAlg,
+		data:    d.Data}
+}
+
+// makeAfSplitDataRaw converts afSplitData to its on disk form.
+func makeAfSplitDataRaw(d *afSplitData) *afSplitDataRaw {
+	return &afSplitDataRaw{
+		Hdr: afSplitDataRawHdr{
+			Stripes: d.stripes,
+			HashAlg: d.hashAlg,
+			Size:    uint32(len(d.data))},
+		Data: d.data}
+}
+
+// afSplitData is a container for data that has been passed through an Anti-Forensic Information Splitter, to support
+// secure destruction of on-disk key material by increasing the size of the data stored and requiring every bit to survive
+// in order to recover the original data.
+type afSplitData struct {
+	stripes uint32
+	hashAlg tpm2.HashAlgorithmId
+	data    []byte
+}
+
+// merge recovers the original data from this container.
+func (d *afSplitData) merge() ([]byte, error) {
+	if d.stripes < 1 {
+		return nil, errors.New("invalid number of stripes")
+	}
+	if !d.hashAlg.Supported() {
+		return nil, errors.New("unsupported digest algorithm")
 	}
+	return afis.MergeHash(d.data, int(d.stripes), func() hash.Hash { return d.hashAlg.NewHash() })
+}
 
-	var d keyPolicyUpdateData
-	if _, err := tpm2.UnmarshalFromReader(buf, &d); err != nil {
-		return nil, xerrors.Errorf("cannot unmarshal key data: %w", err)
+// makeAfSplitData passes the supplied data through an Anti-Forensic Information Splitter to increase the size of the data to at
+// least the size specified by the minSz argument.
+func makeAfSplitData(data []byte, minSz int, hashAlg tpm2.HashAlgorithmId) (*afSplitData, error) {
+	stripes := uint32((minSz / len(data)) + 1)
+
+	split, err := afis.SplitHash(data, int(stripes), func() hash.Hash { return hashAlg.NewHash() })
+	if err != nil {
+		return nil, err
 	}
 
-	return &d, nil
+	return &afSplitData{stripes: stripes, hashAlg: hashAlg, data: split}, nil
 }
 
-// write serializes keyPolicyUpdateData to the provided io.Writer.
-func (d *keyPolicyUpdateData) write(buf io.Writer) error {
-	if _, err := tpm2.MarshalToWriter(buf, keyPolicyUpdateDataHeader, currentVersion, d); err != nil {
-		return err
-	}
-	return nil
+func (d *afSplitData) Marshal(w io.Writer) (nbytes int, err error) {
+	panic("cannot be marshalled")
 }
 
-type keyFileError struct {
-	err error
+func (d *afSplitData) Unmarshal(r io.Reader) (nbytes int, err error) {
+	panic("cannot be unmarshalled")
 }
 
-func (e keyFileError) Error() string {
-	return e.err.Error()
+// keyPolicyUpdateDataRaw_v0 is version 0 of the on-disk format of keyPolicyUpdateData.
+type keyPolicyUpdateDataRaw_v0 struct {
+	AuthKey        []byte
+	CreationData   *tpm2.CreationData
+	CreationTicket *tpm2.TkCreation
 }
 
-func (e keyFileError) Unwrap() error {
-	return e.err
+// keyPolicyUpdateData corresponds to the private part of a sealed key object that is required in order to create new dynamic
+// authorization policies.
+type keyPolicyUpdateData struct {
+	version        uint32
+	authKey        crypto.PrivateKey
+	creationInfo   tpm2.Data
+	creationData   *tpm2.CreationData
+	creationTicket *tpm2.TkCreation
 }
 
-func isKeyFileError(err error) bool {
-	var e keyFileError
-	return xerrors.As(err, &e)
+func (d *keyPolicyUpdateData) Marshal(w io.Writer) error {
+	panic("not implemented")
 }
 
-// readKeyData deserializes keyData from the provided io.Reader.
-func readKeyData(buf io.Reader) (*keyData, error) {
-	var header uint32
+func (d *keyPolicyUpdateData) Unmarshal(r mu.Reader) error {
 	var version uint32
-	if _, err := tpm2.UnmarshalFromReader(buf, &header, &version); err != nil {
-		return nil, keyFileError{xerrors.Errorf("cannot unmarshal header and version number: %w", err)}
+	if _, err := mu.UnmarshalFromReader(r, &version); err != nil {
+		return xerrors.Errorf("cannot unmarshal version number: %w", err)
 	}
 
-	if header != keyDataHeader {
-		return nil, keyFileError{fmt.Errorf("unexpected header (%d)", header)}
+	switch version {
+	case 0:
+		var raw keyPolicyUpdateDataRaw_v0
+		if _, err := mu.UnmarshalFromReader(r, &raw); err != nil {
+			return xerrors.Errorf("cannot unmarshal data: %w", err)
+		}
+
+		authKey, err := x509.ParsePKCS1PrivateKey(raw.AuthKey)
+		if err != nil {
+			return xerrors.Errorf("cannot parse dynamic authorization policy signing key: %w", err)
+		}
+
+		h := crypto.SHA256.New()
+		if _, err := mu.MarshalToWriter(h, raw.AuthKey); err != nil {
+			panic(fmt.Sprintf("cannot marshal dynamic authorization policy signing key: %v", err))
+		}
+
+		*d = keyPolicyUpdateData{
+			version:        version,
+			authKey:        authKey,
+			creationInfo:   h.Sum(nil),
+			creationData:   raw.CreationData,
+			creationTicket: raw.CreationTicket}
+	default:
+		return fmt.Errorf("unexpected version number (%d)", version)
 	}
-	if version != currentVersion {
-		return nil, keyFileError{fmt.Errorf("unexpected version number (%d)", version)}
+	return nil
+}
+
+// decodeKeyPolicyUpdateData deserializes keyPolicyUpdateData from the provided io.Reader.
+func decodeKeyPolicyUpdateData(r io.Reader) (*keyPolicyUpdateData, error) {
+	var header uint32
+	if _, err := mu.UnmarshalFromReader(r, &header); err != nil {
+		return nil, xerrors.Errorf("cannot unmarshal header: %w", err)
+	}
+	if header != keyPolicyUpdateDataHeader {
+		return nil, fmt.Errorf("unexpected header (%d)", header)
 	}
 
-	var d keyData
-	if _, err := tpm2.UnmarshalFromReader(buf, &d); err != nil {
-		return nil, keyFileError{xerrors.Errorf("cannot unmarshal key data: %w", err)}
+	var d keyPolicyUpdateData
+	if _, err := mu.UnmarshalFromReader(r, &d); err != nil {
+		return nil, xerrors.Errorf("cannot unmarshal data: %w", err)
 	}
 
 	return &d, nil
 }
 
+// keyDataRaw_v0 is version 0 of the on-disk format of keyDataRaw.
+type keyDataRaw_v0 struct {
+	KeyPrivate        tpm2.Private
+	KeyPublic         *tpm2.Public
+	AuthModeHint      AuthMode
+	StaticPolicyData  *staticPolicyDataRaw_v0
+	DynamicPolicyData *dynamicPolicyDataRaw_v0
+}
+
+// keyDataRaw_v1 is version 1 of the on-disk format of keyDataRaw.
+type keyDataRaw_v1 struct {
+	KeyPrivate        tpm2.Private
+	KeyPublic         *tpm2.Public
+	AuthModeHint      AuthMode
+	StaticPolicyData  *staticPolicyDataRaw_v1
+	DynamicPolicyData *dynamicPolicyDataRaw_v0
+}
+
+// keyData corresponds to the part of a sealed key object that contains the TPM sealed object and associated metadata required
+// for executing authorization policy assertions.
+type keyData struct {
+	version           uint32
+	keyPrivate        tpm2.Private
+	keyPublic         *tpm2.Public
+	authModeHint      AuthMode
+	staticPolicyData  *staticPolicyData
+	dynamicPolicyData *dynamicPolicyData
+}
+
+func (d *keyData) Marshal(w io.Writer) error {
+	if _, err := mu.MarshalToWriter(w, d.version); err != nil {
+		return xerrors.Errorf("cannot marshal version number: %w", err)
+	}
+
+	switch d.version {
+	case 0:
+		raw := keyDataRaw_v0{
+			KeyPrivate:        d.keyPrivate,
+			KeyPublic:         d.keyPublic,
+			AuthModeHint:      d.authModeHint,
+			StaticPolicyData:  makeStaticPolicyDataRaw_v0(d.staticPolicyData),
+			DynamicPolicyData: makeDynamicPolicyDataRaw_v0(d.dynamicPolicyData)}
+		if _, err := mu.MarshalToWriter(w, raw); err != nil {
+			return xerrors.Errorf("cannot marshal raw data: %w", err)
+		}
+	case 1:
+		var tmpW bytes.Buffer
+		raw := keyDataRaw_v1{
+			KeyPrivate:        d.keyPrivate,
+			KeyPublic:         d.keyPublic,
+			AuthModeHint:      d.authModeHint,
+			StaticPolicyData:  makeStaticPolicyDataRaw_v1(d.staticPolicyData),
+			DynamicPolicyData: makeDynamicPolicyDataRaw_v0(d.dynamicPolicyData)}
+		if _, err := mu.MarshalToWriter(&tmpW, raw); err != nil {
+			return xerrors.Errorf("cannot marshal raw data: %w", err)
+		}
+		splitData, err := makeAfSplitData(tmpW.Bytes(), 128*1024, tpm2.HashAlgorithmSHA256)
+		if err != nil {
+			return xerrors.Errorf("cannot split data: %w", err)
+		}
+		if _, err := mu.MarshalToWriter(w, makeAfSplitDataRaw(splitData)); err != nil {
+			return xerrors.Errorf("cannot marshal split data: %w", err)
+		}
+	default:
+		return fmt.Errorf("unexpected version number (%d)", d.version)
+	}
+	return nil
+}
+
+func (d *keyData) Unmarshal(r mu.Reader) error {
+	var version uint32
+	if _, err := mu.UnmarshalFromReader(r, &version); err != nil {
+		return xerrors.Errorf("cannot unmarshal version number: %w", err)
+	}
+
+	switch version {
+	case 0:
+		var raw keyDataRaw_v0
+		if _, err := mu.UnmarshalFromReader(r, &raw); err != nil {
+			return xerrors.Errorf("cannot unmarshal data: %w", err)
+		}
+		*d = keyData{
+			version:           version,
+			keyPrivate:        raw.KeyPrivate,
+			keyPublic:         raw.KeyPublic,
+			authModeHint:      raw.AuthModeHint,
+			staticPolicyData:  raw.StaticPolicyData.data(),
+			dynamicPolicyData: raw.DynamicPolicyData.data()}
+	case 1:
+		var splitData afSplitDataRaw
+		if _, err := mu.UnmarshalFromReader(r, &splitData); err != nil {
+			return xerrors.Errorf("cannot unmarshal split data: %w", err)
+		}
+
+		merged, err := splitData.data().merge()
+		if err != nil {
+			return xerrors.Errorf("cannot merge data: %w", err)
+		}
+
+		var raw keyDataRaw_v1
+		if _, err := mu.UnmarshalFromBytes(merged, &raw); err != nil {
+			return xerrors.Errorf("cannot unmarshal data: %w", err)
+		}
+		*d = keyData{
+			version:           version,
+			keyPrivate:        raw.KeyPrivate,
+			keyPublic:         raw.KeyPublic,
+			authModeHint:      raw.AuthModeHint,
+			staticPolicyData:  raw.StaticPolicyData.data(),
+			dynamicPolicyData: raw.DynamicPolicyData.data()}
+	default:
+		return fmt.Errorf("unexpected version number (%d)", version)
+	}
+	return nil
+}
+
 // load loads the TPM sealed object associated with this keyData in to the storage hierarchy of the TPM, and returns the newly
 // created tpm2.ResourceContext.
 func (d *keyData) load(tpm *tpm2.TPMContext, session tpm2.SessionContext) (tpm2.ResourceContext, error) {
-	srkContext, err := tpm.CreateResourceContextFromTPM(srkHandle)
+	srkContext, err := tpm.CreateResourceContextFromTPM(tcg.SRKHandle)
 	if err != nil {
 		return nil, xerrors.Errorf("cannot create context for SRK: %w", err)
 	}
 
-	keyContext, err := tpm.Load(srkContext, d.KeyPrivate, d.KeyPublic, session)
+	keyContext, err := tpm.Load(srkContext, d.keyPrivate, d.keyPublic, session)
 	if err != nil {
 		invalidObject := false
 		switch {
@@ -168,210 +372,291 @@
 	return keyContext, nil
 }
 
-// write serializes keyData in to the provided io.Writer.
-func (d *keyData) write(buf io.Writer) error {
-	if _, err := tpm2.MarshalToWriter(buf, keyDataHeader, currentVersion, d); err != nil {
-		return err
-	}
-	return nil
-}
-
-// writeToFileAtomic serializes keyData and writes it atomically to the file at the specified path.
-func (d *keyData) writeToFileAtomic(dest string) error {
-	f, err := osutil.NewAtomicFile(dest, 0600, 0, sys.UserID(osutil.NoChown), sys.GroupID(osutil.NoChown))
-	if err != nil {
-		return xerrors.Errorf("cannot create new atomic file: %w", err)
-	}
-	defer f.Cancel()
-
-	if _, err := tpm2.MarshalToWriter(f, keyDataHeader, currentVersion, d); err != nil {
-		return xerrors.Errorf("cannot marshal key data to temporary file: %w", err)
-	}
-
-	if err := f.Commit(); err != nil {
-		return xerrors.Errorf("cannot atomically replace file: %w", err)
-	}
-
-	return nil
-}
-
-// validateKeyData performs some correctness checking on the provided keyData and keyPolicyUpdateData. On success, it returns the validated
-// public area for the PIN NV index.
-func validateKeyData(tpm *tpm2.TPMContext, data *keyData, policyUpdateData *keyPolicyUpdateData, session tpm2.SessionContext) (*tpm2.NVPublic, error) {
-	srkContext, err := tpm.CreateResourceContextFromTPM(srkHandle)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot create context for SRK: %w", err)
+// validate performs some correctness checking on the provided keyData and authKey. On success, it returns the validated public area
+// for the PCR policy counter.
+func (d *keyData) validate(tpm *tpm2.TPMContext, authKey crypto.PrivateKey, session tpm2.SessionContext) (*tpm2.NVPublic, error) {
+	if d.version > currentMetadataVersion {
+		return nil, keyFileError{errors.New("invalid metadata version")}
 	}
 
 	sealedKeyTemplate := makeSealedKeyTemplate()
 
+	keyPublic := d.keyPublic
+
 	// Perform some initial checks on the sealed data object's public area
-	if data.KeyPublic.Type != sealedKeyTemplate.Type {
+	if keyPublic.Type != sealedKeyTemplate.Type {
 		return nil, keyFileError{errors.New("sealed key object has the wrong type")}
 	}
-	if data.KeyPublic.Attrs != sealedKeyTemplate.Attrs {
+	if keyPublic.Attrs != sealedKeyTemplate.Attrs {
 		return nil, keyFileError{errors.New("sealed key object has the wrong attributes")}
 	}
 
 	// Load the sealed data object in to the TPM for integrity checking
-	keyContext, err := tpm.Load(srkContext, data.KeyPrivate, data.KeyPublic, session)
+	keyContext, err := d.load(tpm, session)
 	if err != nil {
-		invalidObject := false
-		switch {
-		case tpm2.IsTPMParameterError(err, tpm2.AnyErrorCode, tpm2.CommandLoad, tpm2.AnyParameterIndex):
-			invalidObject = true
-		case tpm2.IsTPMError(err, tpm2.ErrorSensitive, tpm2.CommandLoad):
-			invalidObject = true
-		}
-		if invalidObject {
-			return nil, keyFileError{errors.New("cannot load sealed key object in to TPM: bad sealed key object or TPM owner changed")}
-		}
-		return nil, xerrors.Errorf("cannot load sealed key object in to TPM: %w", err)
+		return nil, err
 	}
 	// It's loaded ok, so we know that the private and public parts are consistent.
-	defer tpm.FlushContext(keyContext)
+	tpm.FlushContext(keyContext)
 
-	lockIndex, err := tpm.CreateResourceContextFromTPM(lockNVHandle)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot create context for lock NV index: %v", err)
-	}
-	lockIndexPub, err := readAndValidateLockNVIndexPublic(tpm, lockIndex, session)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot determine if NV index at %v is global lock index: %w", lockNVHandle, err)
-	}
-	if lockIndexPub == nil {
-		return nil, xerrors.Errorf("NV index at %v is not a valid global lock index", lockNVHandle)
+	var legacyLockIndexName tpm2.Name
+	if d.version == 0 {
+		index, err := tpm.CreateResourceContextFromTPM(lockNVHandle, session.IncludeAttrs(tpm2.AttrAudit))
+		if err != nil {
+			if tpm2.IsResourceUnavailableError(err, lockNVHandle) {
+				return nil, keyFileError{errors.New("lock NV index is unavailable")}
+			}
+			return nil, xerrors.Errorf("cannot create context for lock NV index: %w", err)
+		}
+		indexPub, _, err := tpm.NVReadPublic(index, session.IncludeAttrs(tpm2.AttrAudit))
+		if err != nil {
+			return nil, xerrors.Errorf("cannot read public area of lock NV index: %w", err)
+		}
+		indexPub.Attrs &^= tpm2.AttrNVReadLocked
+		legacyLockIndexName, err = indexPub.Name()
+		if err != nil {
+			return nil, xerrors.Errorf("cannot compute name of lock NV index: %w", err)
+		}
 	}
 
-	// Obtain a ResourceContext for the PIN NV index. Go-tpm2 calls TPM2_NV_ReadPublic twice here. The second time is with a session, and
-	// there is also verification that the returned public area is for the specified handle so that we know that the returned
-	// ResourceContext corresponds to an actual entity on the TPM at PinIndexHandle.
-	if data.StaticPolicyData.PinIndexHandle.Type() != tpm2.HandleTypeNVIndex {
-		return nil, keyFileError{errors.New("PIN NV index handle is invalid")}
+	// Obtain a ResourceContext for the PCR policy counter. Go-tpm2 calls TPM2_NV_ReadPublic twice here. The second time is with a
+	// session, and there is also verification that the returned public area is for the specified handle so that we know that the
+	// returned ResourceContext corresponds to an actual entity on the TPM at the specified handle. This index is used for PCR policy
+	// revocation, and also for PIN integration with v0 metadata only.
+	pcrPolicyCounterHandle := d.staticPolicyData.pcrPolicyCounterHandle
+	if (pcrPolicyCounterHandle != tpm2.HandleNull || d.version == 0) && pcrPolicyCounterHandle.Type() != tpm2.HandleTypeNVIndex {
+		return nil, keyFileError{errors.New("PCR policy counter handle is invalid")}
 	}
-	pinIndex, err := tpm.CreateResourceContextFromTPM(data.StaticPolicyData.PinIndexHandle, session.IncludeAttrs(tpm2.AttrAudit))
-	if err != nil {
-		if tpm2.IsResourceUnavailableError(err, data.StaticPolicyData.PinIndexHandle) {
-			return nil, keyFileError{errors.New("PIN NV index is unavailable")}
+
+	var pcrPolicyCounter tpm2.ResourceContext
+	if pcrPolicyCounterHandle != tpm2.HandleNull {
+		pcrPolicyCounter, err = tpm.CreateResourceContextFromTPM(pcrPolicyCounterHandle, session.IncludeAttrs(tpm2.AttrAudit))
+		if err != nil {
+			if tpm2.IsResourceUnavailableError(err, pcrPolicyCounterHandle) {
+				return nil, keyFileError{errors.New("PCR policy counter is unavailable")}
+			}
+			return nil, xerrors.Errorf("cannot create context for PCR policy counter: %w", err)
 		}
-		return nil, xerrors.Errorf("cannot create context for PIN NV index: %w", err)
 	}
 
-	authKeyName, err := data.StaticPolicyData.AuthPublicKey.Name()
+	var pcrPolicyRef tpm2.Nonce
+	if d.version > 0 {
+		pcrPolicyRef = computePcrPolicyRefFromCounterContext(pcrPolicyCounter)
+	}
+
+	// Validate the type and scheme of the dynamic authorization policy signing key.
+	authPublicKey := d.staticPolicyData.authPublicKey
+	authKeyName, err := authPublicKey.Name()
 	if err != nil {
 		return nil, keyFileError{xerrors.Errorf("cannot compute name of dynamic authorization policy key: %w", err)}
 	}
-	if data.StaticPolicyData.AuthPublicKey.Type != tpm2.ObjectTypeRSA {
+	var expectedAuthKeyType tpm2.ObjectTypeId
+	var expectedAuthKeyScheme tpm2.AsymSchemeId
+	switch d.version {
+	case 0:
+		expectedAuthKeyType = tpm2.ObjectTypeRSA
+		expectedAuthKeyScheme = tpm2.AsymSchemeRSAPSS
+	default:
+		expectedAuthKeyType = tpm2.ObjectTypeECC
+		expectedAuthKeyScheme = tpm2.AsymSchemeECDSA
+	}
+	if authPublicKey.Type != expectedAuthKeyType {
 		return nil, keyFileError{errors.New("public area of dynamic authorization policy signing key has the wrong type")}
 	}
+	authKeyScheme := authPublicKey.Params.AsymDetail().Scheme
+	if authKeyScheme.Scheme != tpm2.AsymSchemeNull {
+		if authKeyScheme.Scheme != expectedAuthKeyScheme {
+			return nil, keyFileError{errors.New("dynamic authorization policy signing key has unexpected scheme")}
+		}
+		if authKeyScheme.Details.Any().HashAlg != authPublicKey.NameAlg {
+			return nil, keyFileError{errors.New("dynamic authorization policy signing key algorithm must match name algorithm")}
+		}
+	}
 
 	// Make sure that the static authorization policy data is consistent with the sealed key object's policy.
-	trial, err := tpm2.ComputeAuthPolicy(data.KeyPublic.NameAlg)
+	trial, err := tpm2.ComputeAuthPolicy(keyPublic.NameAlg)
 	if err != nil {
 		return nil, keyFileError{xerrors.Errorf("cannot determine if static authorization policy matches sealed key object: %w", err)}
 	}
-	trial.PolicyAuthorize(nil, authKeyName)
-	trial.PolicySecret(pinIndex.Name(), nil)
-	trial.PolicyNV(lockIndex.Name(), nil, 0, tpm2.OpEq)
-
-	if !bytes.Equal(trial.GetDigest(), data.KeyPublic.AuthPolicy) {
-		return nil, keyFileError{errors.New("the sealed key object's authorization policy is inconsistent with the associatedc metadata or persistent TPM resources")}
-	}
 
-	pinIndexPublic, _, err := tpm.NVReadPublic(pinIndex, session.IncludeAttrs(tpm2.AttrAudit))
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read public area of PIN NV index: %w", err)
+	trial.PolicyAuthorize(pcrPolicyRef, authKeyName)
+	if d.version == 0 {
+		trial.PolicySecret(pcrPolicyCounter.Name(), nil)
+		trial.PolicyNV(legacyLockIndexName, nil, 0, tpm2.OpEq)
+	} else {
+		// v1 metadata and later
+		trial.PolicyAuthValue()
+	}
+
+	if !bytes.Equal(trial.GetDigest(), keyPublic.AuthPolicy) {
+		return nil, keyFileError{errors.New("the sealed key object's authorization policy is inconsistent with the associated metadata or persistent TPM resources")}
+	}
+
+	// Read the public area of the PCR policy counter
+	var pcrPolicyCounterPub *tpm2.NVPublic
+	if pcrPolicyCounter != nil {
+		pcrPolicyCounterPub, _, err = tpm.NVReadPublic(pcrPolicyCounter, session.IncludeAttrs(tpm2.AttrAudit))
+		if err != nil {
+			return nil, xerrors.Errorf("cannot read public area of PCR policy counter: %w", err)
+		}
 	}
 
-	expectedPinIndexAuthPolicies, err := computePinNVIndexPostInitAuthPolicies(pinIndexPublic.NameAlg, authKeyName)
-	if err != nil {
-		return nil, keyFileError{xerrors.Errorf("cannot determine if PIN NV index has a valid authorization policy: %w", err)}
-	}
-	if len(data.StaticPolicyData.PinIndexAuthPolicies)-1 != len(expectedPinIndexAuthPolicies) {
-		return nil, keyFileError{errors.New("unexpected number of OR policy digests for PIN NV index")}
-	}
-	for i, expected := range expectedPinIndexAuthPolicies {
-		if !bytes.Equal(expected, data.StaticPolicyData.PinIndexAuthPolicies[i+1]) {
-			return nil, keyFileError{errors.New("unexpected OR policy digest for PIN NV index")}
+	// For v0 metadata, validate that the OR policy digests for the PCR policy counter match the public area of the index.
+	if d.version == 0 {
+		pcrPolicyCounterAuthPolicies := d.staticPolicyData.v0PinIndexAuthPolicies
+		expectedPcrPolicyCounterAuthPolicies, err := computeV0PinNVIndexPostInitAuthPolicies(pcrPolicyCounterPub.NameAlg, authKeyName)
+		if err != nil {
+			return nil, keyFileError{xerrors.Errorf("cannot determine if PCR policy counter has a valid authorization policy: %w", err)}
+		}
+		if len(pcrPolicyCounterAuthPolicies)-1 != len(expectedPcrPolicyCounterAuthPolicies) {
+			return nil, keyFileError{errors.New("unexpected number of OR policy digests for PCR policy counter")}
+		}
+		for i, expected := range expectedPcrPolicyCounterAuthPolicies {
+			if !bytes.Equal(expected, pcrPolicyCounterAuthPolicies[i+1]) {
+				return nil, keyFileError{errors.New("unexpected OR policy digest for PCR policy counter")}
+			}
 		}
-	}
 
-	trial, _ = tpm2.ComputeAuthPolicy(pinIndexPublic.NameAlg)
-	trial.PolicyOR(data.StaticPolicyData.PinIndexAuthPolicies)
-	if !bytes.Equal(pinIndexPublic.AuthPolicy, trial.GetDigest()) {
-		return nil, keyFileError{errors.New("PIN NV index has unexpected authorization policy")}
+		trial, _ = tpm2.ComputeAuthPolicy(pcrPolicyCounterPub.NameAlg)
+		trial.PolicyOR(pcrPolicyCounterAuthPolicies)
+		if !bytes.Equal(pcrPolicyCounterPub.AuthPolicy, trial.GetDigest()) {
+			return nil, keyFileError{errors.New("PCR policy counter has unexpected authorization policy")}
+		}
 	}
 
 	// At this point, we know that the sealed object is an object with an authorization policy created by this package and with
 	// matching static metadata and persistent TPM resources.
 
-	if policyUpdateData == nil {
-		// If we weren't passed a private data structure, we're done.
-		return pinIndexPublic, nil
+	switch k := authKey.(type) {
+	case *rsa.PrivateKey:
+		goAuthPublicKey := rsa.PublicKey{
+			N: new(big.Int).SetBytes(authPublicKey.Unique.RSA()),
+			E: int(authPublicKey.Params.RSADetail().Exponent)}
+		if k.E != goAuthPublicKey.E || k.N.Cmp(goAuthPublicKey.N) != 0 {
+			return nil, keyFileError{errors.New("dynamic authorization policy signing private key doesn't match public key")}
+		}
+	case *ecdsa.PrivateKey:
+		if d.version == 0 {
+			return nil, keyFileError{errors.New("unexpected dynamic authorization policy signing private key type")}
+		}
+		expectedX, expectedY := k.Curve.ScalarBaseMult(k.D.Bytes())
+		if expectedX.Cmp(k.X) != 0 || expectedY.Cmp(k.Y) != 0 {
+			return nil, keyFileError{errors.New("dynamic authorization policy signing private key doesn't match public key")}
+		}
+	case nil:
+	default:
+		return nil, keyFileError{errors.New("unexpected dynamic authorization policy signing private key type")}
 	}
 
-	// Verify that the private data structure is bound to the key data structure.
-	h := data.KeyPublic.NameAlg.NewHash()
-	if _, err := tpm2.MarshalToWriter(h, policyUpdateData.CreationData); err != nil {
-		panic(fmt.Sprintf("cannot marshal creation data: %v", err))
+	return pcrPolicyCounterPub, nil
+}
+
+// write serializes keyData in to the provided io.Writer.
+func (d *keyData) write(w io.Writer) error {
+	if _, err := mu.MarshalToWriter(w, keyDataHeader, d); err != nil {
+		return err
 	}
+	return nil
+}
 
-	if _, _, err := tpm.CertifyCreation(nil, keyContext, nil, h.Sum(nil), nil, policyUpdateData.CreationTicket, nil,
-		session.IncludeAttrs(tpm2.AttrAudit)); err != nil {
-		if tpm2.IsTPMParameterError(err, tpm2.ErrorTicket, tpm2.CommandCertifyCreation, 4) {
-			return nil, keyFileError{errors.New("key data file and dynamic authorization policy update data file mismatch: invalid creation ticket")}
-		}
-		return nil, xerrors.Errorf("cannot validate creation data for sealed data object: %w", err)
+// writeToFileAtomic serializes keyData and writes it atomically to the file at the specified path.
+func (d *keyData) writeToFileAtomic(dest string) error {
+	f, err := osutil.NewAtomicFile(dest, 0600, 0, sys.UserID(osutil.NoChown), sys.GroupID(osutil.NoChown))
+	if err != nil {
+		return xerrors.Errorf("cannot create new atomic file: %w", err)
 	}
+	defer f.Cancel()
 
-	h = crypto.SHA256.New()
-	if _, err := tpm2.MarshalToWriter(h, &policyUpdateData.Data); err != nil {
-		panic(fmt.Sprintf("cannot marshal dynamic authorization policy update data: %v", err))
+	if err := d.write(f); err != nil {
+		return xerrors.Errorf("cannot write to temporary file: %w", err)
 	}
 
-	if !bytes.Equal(h.Sum(nil), policyUpdateData.CreationData.OutsideInfo) {
-		return nil, keyFileError{errors.New("key data file and dynamic authorization policy update data file mismatch: digest doesn't match creation data")}
+	if err := f.Commit(); err != nil {
+		return xerrors.Errorf("cannot atomically replace file: %w", err)
 	}
 
-	authKey, err := x509.ParsePKCS1PrivateKey(policyUpdateData.Data.AuthKey)
-	if err != nil {
-		return nil, keyFileError{xerrors.Errorf("cannot parse dynamic authorization policy signing key: %w", err)}
+	return nil
+}
+
+// decodeKeyData deserializes keyData from the provided io.Reader.
+func decodeKeyData(r io.Reader) (*keyData, error) {
+	var header uint32
+	if _, err := mu.UnmarshalFromReader(r, &header); err != nil {
+		return nil, xerrors.Errorf("cannot unmarshal header: %w", err)
+	}
+	if header != keyDataHeader {
+		return nil, fmt.Errorf("unexpected header (%d)", header)
 	}
 
-	authPublicKey := rsa.PublicKey{
-		N: new(big.Int).SetBytes(data.StaticPolicyData.AuthPublicKey.Unique.RSA()),
-		E: int(data.StaticPolicyData.AuthPublicKey.Params.RSADetail().Exponent)}
-	if authKey.PublicKey.E != authPublicKey.E || authKey.PublicKey.N.Cmp(authPublicKey.N) != 0 {
-		return nil, keyFileError{errors.New("dynamic authorization policy signing private key doesn't match public key")}
+	var d keyData
+	if _, err := mu.UnmarshalFromReader(r, &d); err != nil {
+		return nil, xerrors.Errorf("cannot unmarshal data: %w", err)
 	}
 
-	return pinIndexPublic, nil
+	return &d, nil
+}
+
+type keyFileError struct {
+	err error
+}
+
+func (e keyFileError) Error() string {
+	return e.err.Error()
+}
+
+func (e keyFileError) Unwrap() error {
+	return e.err
+}
+
+func isKeyFileError(err error) bool {
+	var e keyFileError
+	return xerrors.As(err, &e)
 }
 
-// readAndValidateKeyData will deserialize keyData and keyPolicyUpdateData from the provided io.Readers and then perform some correctness
-// checking. On success, it returns the keyData, keyPolicyUpdateData and the validated public area of the PIN NV index.
-func readAndValidateKeyData(tpm *tpm2.TPMContext, keyFile, keyPolicyUpdateFile io.Reader, session tpm2.SessionContext) (*keyData, *keyPolicyUpdateData, *tpm2.NVPublic, error) {
+// decodeAndValidateKeyData will deserialize keyData from the provided io.Reader and then perform some correctness checking. On
+// success, it returns the keyData, dynamic authorization policy signing key (if authData is provided) and the validated public area
+// of the PCR policy counter index.
+func decodeAndValidateKeyData(tpm *tpm2.TPMContext, keyFile io.Reader, authData interface{}, session tpm2.SessionContext) (*keyData, crypto.PrivateKey, *tpm2.NVPublic, error) {
 	// Read the key data
-	data, err := readKeyData(keyFile)
+	data, err := decodeKeyData(keyFile)
 	if err != nil {
-		return nil, nil, nil, xerrors.Errorf("cannot read key data: %w", err)
+		return nil, nil, nil, keyFileError{xerrors.Errorf("cannot read key data: %w", err)}
 	}
 
-	var policyUpdateData *keyPolicyUpdateData
-	if keyPolicyUpdateFile != nil {
-		var err error
-		policyUpdateData, err = readKeyPolicyUpdateData(keyPolicyUpdateFile)
+	var authKey crypto.PrivateKey
+
+	switch a := authData.(type) {
+	case io.Reader:
+		// If we were called with an io.Reader, then we're expecting to load a legacy version-0 keydata and associated
+		// private key file.
+		policyUpdateData, err := decodeKeyPolicyUpdateData(a)
 		if err != nil {
-			return nil, nil, nil, xerrors.Errorf("cannot read dynamic policy authorization data: %w", err)
+			return nil, nil, nil, keyFileError{xerrors.Errorf("cannot read dynamic policy update data: %w", err)}
+		}
+		if policyUpdateData.version != data.version {
+			return nil, nil, nil, keyFileError{errors.New("mismatched metadata versions")}
 		}
+		authKey = policyUpdateData.authKey
+	case TPMPolicyAuthKey:
+		if len(a) > 0 {
+			// If we were called with a byte slice, then we're expecting to load the current keydata version and the byte
+			// slice is the private part of the elliptic auth key.
+			authKey, err = createECDSAPrivateKeyFromTPM(data.staticPolicyData.authPublicKey, tpm2.ECCParameter(a))
+			if err != nil {
+				return nil, nil, nil, keyFileError{xerrors.Errorf("cannot create auth key: %w", err)}
+			}
+		}
+	case nil:
+	default:
+		panic("invalid type")
 	}
 
-	pinNVPublic, err := validateKeyData(tpm, data, policyUpdateData, session)
+	pcrPolicyCounterPub, err := data.validate(tpm, authKey, session)
 	if err != nil {
 		return nil, nil, nil, xerrors.Errorf("cannot validate key data: %w", err)
 	}
 
-	return data, policyUpdateData, pinNVPublic, nil
+	return data, authKey, pcrPolicyCounterPub, nil
 }
 
 // SealedKeyObject corresponds to a sealed key data file and exists to provide access to some read only operations on the underlying
@@ -380,14 +665,20 @@
 	data *keyData
 }
 
+// Version returns the version number that this sealed key object was created with.
+func (k *SealedKeyObject) Version() uint32 {
+	return k.data.version
+}
+
 // AuthMode2F indicates the 2nd-factor authentication type for this sealed key object.
 func (k *SealedKeyObject) AuthMode2F() AuthMode {
-	return k.data.AuthModeHint
+	return k.data.authModeHint
 }
 
-// PINIndexHandle indicates the handle of the NV index used for PIN support for this sealed key object.
-func (k *SealedKeyObject) PINIndexHandle() tpm2.Handle {
-	return k.data.StaticPolicyData.PinIndexHandle
+// PCRPolicyCounterHandle indicates the handle of the NV counter used for PCR policy revocation for this sealed key object (and for
+// PIN integration for version 0 key files).
+func (k *SealedKeyObject) PCRPolicyCounterHandle() tpm2.Handle {
+	return k.data.staticPolicyData.pcrPolicyCounterHandle
 }
 
 // ReadSealedKeyObject loads a sealed key data file created by SealKeyToTPM from the specified path. If the file cannot be opened,
@@ -401,7 +692,7 @@
 	}
 	defer f.Close()
 
-	data, err := readKeyData(f)
+	data, err := decodeKeyData(f)
 	if err != nil {
 		return nil, InvalidKeyFileError{err.Error()}
 	}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/pcr_profile.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/pcr_profile.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/pcr_profile.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/pcr_profile.go	2020-07-15 14:52:34.000000000 +0000
@@ -20,6 +20,8 @@
 package secboot
 
 import (
+	"bytes"
+	"errors"
 	"fmt"
 
 	"github.com/canonical/go-tpm2"
@@ -33,7 +35,7 @@
 // setValue sets the specified PCR to the supplied value for all branches.
 func (l pcrValuesList) setValue(alg tpm2.HashAlgorithmId, pcr int, value tpm2.Digest) {
 	for _, v := range l {
-		v.SetValue(pcr, alg, value)
+		v.SetValue(alg, pcr, value)
 	}
 }
 
@@ -73,60 +75,26 @@
 	value tpm2.Digest
 }
 
-func (i *pcrProtectionProfileAddPCRValueInstr) apply(_ *tpm2.TPMContext, values pcrValuesList) (pcrValuesList, error) {
-	values.setValue(i.alg, i.pcr, i.value)
-	return values, nil
-}
-
 type pcrProtectionProfileAddPCRValueFromTPMInstr struct {
 	alg tpm2.HashAlgorithmId
 	pcr int
 }
 
-func (i *pcrProtectionProfileAddPCRValueFromTPMInstr) apply(tpm *tpm2.TPMContext, values pcrValuesList) (pcrValuesList, error) {
-	if tpm == nil {
-		return nil, fmt.Errorf("cannot read current value of PCR %d from bank %v: no TPM context", i.pcr, i.alg)
-	}
-	_, v, err := tpm.PCRRead(tpm2.PCRSelectionList{{Hash: i.alg, Select: []int{i.pcr}}})
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read current value of PCR %d from bank %v: %w", i.pcr, i.alg, err)
-	}
-	values.setValue(i.alg, i.pcr, v[i.alg][i.pcr])
-	return values, nil
-}
-
 type pcrProtectionProfileExtendPCRInstr struct {
 	alg   tpm2.HashAlgorithmId
 	pcr   int
 	value tpm2.Digest
 }
 
-func (i *pcrProtectionProfileExtendPCRInstr) apply(_ *tpm2.TPMContext, values pcrValuesList) (pcrValuesList, error) {
-	values.extendValue(i.alg, i.pcr, i.value)
-	return values, nil
-}
-
 type pcrProtectionProfileAddProfileORInstr struct {
 	profiles []*PCRProtectionProfile
 }
 
-func (i *pcrProtectionProfileAddProfileORInstr) apply(tpm *tpm2.TPMContext, values pcrValuesList) (pcrValuesList, error) {
-	var out []tpm2.PCRValues
-	for _, p := range i.profiles {
-		v, err := p.computePCRValues(tpm, values.copy())
-		if err != nil {
-			// TODO: More context
-			return nil, err
-		}
-		out = append(out, v...)
-	}
-	return out, nil
-}
+// pcrProtectionProfileEndProfileInstr is a pseudo instruction to mark the end of a branch.
+type pcrProtectionProfileEndProfileInstr struct{}
 
 // pcrProtectionProfileInstr is a building block of PCRProtectionProfile.
-type pcrProtectionProfileInstr interface {
-	apply(*tpm2.TPMContext, pcrValuesList) (pcrValuesList, error)
-}
+type pcrProtectionProfileInstr interface{}
 
 // PCRProtectionProfile defines the PCR profile used to protect a key sealed with SealKeyToTPM. It contains a sequence of instructions
 // for computing combinations of PCR values that a key will be protected against. The profile is built using the methods of this type.
@@ -177,19 +145,245 @@
 	return p
 }
 
+// pcrProtectionProfileIterator provides a mechanism to perform a depth first traversal of instructions in a PCRProtectionProfile.
+type pcrProtectionProfileIterator struct {
+	instrs [][]pcrProtectionProfileInstr
+}
+
+// descendInToProfiles adds instructions from the supplied profiles to the front of the iterator, so that subsequent calls to
+// next will return instructions from each of these profiles in turn.
+func (iter *pcrProtectionProfileIterator) descendInToProfiles(profiles ...*PCRProtectionProfile) {
+	instrs := make([][]pcrProtectionProfileInstr, 0, len(profiles)+len(iter.instrs))
+	for _, p := range profiles {
+		instrs = append(instrs, p.instrs)
+	}
+	instrs = append(instrs, iter.instrs...)
+	iter.instrs = instrs
+}
+
+// next returns the next instruction from this iterator. When encountering a branch, a *pcrProtectionProfileAddProfileORInstr will
+// be returned, which indicates the number of alternate branches. Subsequent calls to next will return instructions from each of
+// these sub-branches in turn, with each branch terminating with *pcrProtectionProfileEndProfileInstr. Once all sub-branches have
+// been processed, subsequent calls to next will resume returning instructions from the parent branch.
+func (iter *pcrProtectionProfileIterator) next() pcrProtectionProfileInstr {
+	if len(iter.instrs) == 0 {
+		panic("no more instructions")
+	}
+
+	for {
+		if len(iter.instrs[0]) == 0 {
+			iter.instrs = iter.instrs[1:]
+			return &pcrProtectionProfileEndProfileInstr{}
+		}
+
+		instr := iter.instrs[0][0]
+		iter.instrs[0] = iter.instrs[0][1:]
+
+		switch i := instr.(type) {
+		case *pcrProtectionProfileAddProfileORInstr:
+			if len(i.profiles) == 0 {
+				// If this is an empty branch point, don't return this instruction because there
+				// won't be a corresponding *EndProfileInstr
+				continue
+			}
+			iter.descendInToProfiles(i.profiles...)
+			return instr
+		default:
+			return instr
+		}
+	}
+}
+
+// traverseInstructions returns an iterator that performs a depth first traversal through the instructions in this profile.
+func (p *PCRProtectionProfile) traverseInstructions() *pcrProtectionProfileIterator {
+	i := &pcrProtectionProfileIterator{}
+	i.descendInToProfiles(p)
+	return i
+}
+
+type pcrProtectionProfileStringifyBranchContext struct {
+	index int
+	total int
+}
+
+func (p *PCRProtectionProfile) String() string {
+	var b bytes.Buffer
+
+	contexts := []*pcrProtectionProfileStringifyBranchContext{{index: 0, total: 1}}
+	branchStart := false
+
+	iter := p.traverseInstructions()
+	for len(contexts) > 0 {
+		fmt.Fprintf(&b, "\n")
+		depth := len(contexts) - 1
+		if branchStart {
+			branchStart = false
+			fmt.Fprintf(&b, "%*sBranch %d {\n", depth*3, "", contexts[0].index)
+		}
+
+		switch i := iter.next().(type) {
+		case *pcrProtectionProfileAddPCRValueInstr:
+			fmt.Fprintf(&b, "%*s AddPCRValue(%v, %d, %x)", depth*3, "", i.alg, i.pcr, i.value)
+		case *pcrProtectionProfileAddPCRValueFromTPMInstr:
+			fmt.Fprintf(&b, "%*s AddPCRValueFromTPM(%v, %d)", depth*3, "", i.alg, i.pcr)
+		case *pcrProtectionProfileExtendPCRInstr:
+			fmt.Fprintf(&b, "%*s ExtendPCR(%v, %d, %x)", depth*3, "", i.alg, i.pcr, i.value)
+		case *pcrProtectionProfileAddProfileORInstr:
+			contexts = append([]*pcrProtectionProfileStringifyBranchContext{{index: 0, total: len(i.profiles)}}, contexts...)
+			fmt.Fprintf(&b, "%*s AddProfileOR(", depth*3, "")
+			branchStart = true
+		case *pcrProtectionProfileEndProfileInstr:
+			contexts[0].index++
+			if len(contexts) > 1 {
+				// This is the end of a sub-branch rather than the root profile.
+				fmt.Fprintf(&b, "%*s}", depth*3, "")
+			}
+			switch {
+			case contexts[0].index < contexts[0].total:
+				// There are sibling branches to print.
+				branchStart = true
+			case len(contexts) > 1:
+				// This is the end of a sub-branch rather than the root profile and there are no more sibling branches. Printing
+				// will continue with the parent branch.
+				fmt.Fprintf(&b, "\n%*s )", (depth-1)*3, "")
+				fallthrough
+			default:
+				// Return to the parent branch's context.
+				contexts = contexts[1:]
+			}
+		}
+	}
+
+	return b.String()
+}
+
+// pcrProtectionProfileComputeContext records state used when computing PCR values for a PCRProtectionProfile
+type pcrProtectionProfileComputeContext struct {
+	parent *pcrProtectionProfileComputeContext
+	values pcrValuesList
+}
+
+// handleBranches is called when encountering a branch in a profile, and returns a slice of new *pcrProtectionProfileComputeContext
+// instances (one for each sub-branch). At the end of each sub-branch, finishBranch must be called on the associated
+// *pcrProtectionProfileComputeContext.
+func (c *pcrProtectionProfileComputeContext) handleBranches(n int) (out []*pcrProtectionProfileComputeContext) {
+	out = make([]*pcrProtectionProfileComputeContext, 0, n)
+	for i := 0; i < n; i++ {
+		out = append(out, &pcrProtectionProfileComputeContext{parent: c, values: c.values.copy()})
+	}
+	c.values = nil
+	return
+}
+
+// finishBranch is called when encountering the end of a branch. This propagates the computed PCR values to the
+// *pcrProtectionProfileComputeContext associated with the parent branch. Calling this will panic on a
+// *pcrProtectionProfileComputeContext associated with the root branch.
+func (c *pcrProtectionProfileComputeContext) finishBranch() {
+	c.parent.values = append(c.parent.values, c.values...)
+}
+
+// isRoot returns true if this *pcrProtectionProfileComputeContext is associated with a root branch.
+func (c *pcrProtectionProfileComputeContext) isRoot() bool {
+	return c.parent == nil
+}
+
+// pcrProtectionProfileComputeContextStack is a stack of *pcrProtectionProfileComputeContext, with the top of the stack associated
+// with the profile branch from which instructions are currently being processed.
+type pcrProtectionProfileComputeContextStack []*pcrProtectionProfileComputeContext
+
+// handleBranches is called when encountering a branch in a profile, and returns a new pcrProtectionProfileComputeContextStack with
+// the top of the stack associated with the first sub-branch, from which subsequent instructions will be processed from. At the
+// end of each sub-branch, finishBranch must be called.
+func (s pcrProtectionProfileComputeContextStack) handleBranches(n int) pcrProtectionProfileComputeContextStack {
+	newContexts := s.top().handleBranches(n)
+	return pcrProtectionProfileComputeContextStack(append(newContexts, s...))
+}
+
+// finishBranch is called when encountering the end of a branch. This propagates the computed PCR values from the
+// *pcrProtectionProfileComputeContext at the top of the stack to the *pcrProtectionProfileComputeContext associated with the parent
+// branch, and then pops the context from the top of the stack. The new top of the stack corresponds to either a sibling branch or
+// the parent branch, from which subsequent instructions will be processed from.
+func (s pcrProtectionProfileComputeContextStack) finishBranch() pcrProtectionProfileComputeContextStack {
+	s.top().finishBranch()
+	return s[1:]
+}
+
+// top returns the *pcrProtectionProfileComputeContext at the top of the stack, which is associated with the branch that instructions
+// are currently being processed from.
+func (s pcrProtectionProfileComputeContextStack) top() *pcrProtectionProfileComputeContext {
+	return s[0]
+}
+
 // computePCRValues computes a list of different PCR value combinations from this PCRProtectionProfile.
-func (p *PCRProtectionProfile) computePCRValues(tpm *tpm2.TPMContext, values pcrValuesList) (pcrValuesList, error) {
-	if len(values) == 0 {
-		values = append(values, make(tpm2.PCRValues))
+func (p *PCRProtectionProfile) computePCRValues(tpm *tpm2.TPMContext) (pcrValuesList, error) {
+	contexts := pcrProtectionProfileComputeContextStack{{values: pcrValuesList{make(tpm2.PCRValues)}}}
+
+	iter := p.traverseInstructions()
+	for {
+		switch i := iter.next().(type) {
+		case *pcrProtectionProfileAddPCRValueInstr:
+			contexts.top().values.setValue(i.alg, i.pcr, i.value)
+		case *pcrProtectionProfileAddPCRValueFromTPMInstr:
+			if tpm == nil {
+				return nil, fmt.Errorf("cannot read current value of PCR %d from bank %v: no TPM context", i.pcr, i.alg)
+			}
+			_, v, err := tpm.PCRRead(tpm2.PCRSelectionList{{Hash: i.alg, Select: []int{i.pcr}}})
+			if err != nil {
+				return nil, xerrors.Errorf("cannot read current value of PCR %d from bank %v: %w", i.pcr, i.alg, err)
+			}
+			contexts.top().values.setValue(i.alg, i.pcr, v[i.alg][i.pcr])
+		case *pcrProtectionProfileExtendPCRInstr:
+			contexts.top().values.extendValue(i.alg, i.pcr, i.value)
+		case *pcrProtectionProfileAddProfileORInstr:
+			// As this is a depth-first traversal, processing of this branch is parked when a AddProfileOR instruction is encountered.
+			// Subsequent instructions will be from each of the sub-branches in turn.
+			contexts = contexts.handleBranches(len(i.profiles))
+		case *pcrProtectionProfileEndProfileInstr:
+			if contexts.top().isRoot() {
+				// This is the end of the profile
+				return contexts.top().values, nil
+			}
+			contexts = contexts.finishBranch()
+		}
+	}
+}
+
+// computePCRDigests computes a PCR selection and list of PCR digests from this PCRProtectionProfile. The returned list of PCR digests
+// is de-duplicated.
+func (p *PCRProtectionProfile) computePCRDigests(tpm *tpm2.TPMContext, alg tpm2.HashAlgorithmId) (tpm2.PCRSelectionList, tpm2.DigestList, error) {
+	// Compute the sets of PCR values for all branches
+	values, err := p.computePCRValues(tpm)
+	if err != nil {
+		return nil, nil, err
 	}
 
-	for _, instr := range p.instrs {
-		var err error
-		values, err = instr.apply(tpm, values)
-		if err != nil {
-			return nil, err
+	// Compute the PCR selection for this profile from the first branch.
+	pcrs := values[0].SelectionList()
+
+	// Compute the PCR digests for all branches, making sure that they all contain values for the same sets of PCRs.
+	var pcrDigests tpm2.DigestList
+	for _, v := range values {
+		p, digest, _ := tpm2.ComputePCRDigestSimple(alg, v)
+		if !p.Equal(pcrs) {
+			return nil, nil, errors.New("not all branches contain values for the same sets of PCRs")
+		}
+		pcrDigests = append(pcrDigests, digest)
+	}
+
+	var uniquePcrDigests tpm2.DigestList
+	for _, d := range pcrDigests {
+		found := false
+		for _, f := range uniquePcrDigests {
+			if bytes.Equal(d, f) {
+				found = true
+				break
+			}
+		}
+		if found {
+			continue
 		}
+		uniquePcrDigests = append(uniquePcrDigests, d)
 	}
 
-	return values, nil
+	return pcrs, uniquePcrDigests, nil
 }
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/pe.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/pe.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/pe.go	2020-04-06 18:31:36.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/pe.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,197 +0,0 @@
-package secboot
-
-import (
-	"debug/pe"
-	"encoding/binary"
-	"fmt"
-	"io"
-)
-
-// readDataDirectories accepts a io.ReadSeeker pointing to data directories in the PE file,
-// its size and number of data directories as seen in optional header.
-// It parses the given size of bytes and returns given number of data directories.
-func readDataDirectories(r io.ReadSeeker, sz uint16, n uint32) ([]pe.DataDirectory, error) {
-	ddSz := binary.Size(pe.DataDirectory{})
-	if uint32(sz) != n*uint32(ddSz) {
-		return nil, fmt.Errorf("size of data directories(%d) is inconsistent with number of data "+
-			"directories(%d)", sz, n)
-	}
-
-	dd := make([]pe.DataDirectory, n)
-	if err := binary.Read(r, binary.LittleEndian, dd); err != nil {
-		return nil, fmt.Errorf("failure to read data directories: %v", err)
-	}
-
-	return dd, nil
-}
-
-// readOptionalHeader accepts a io.ReadSeeker pointing to optional header in the PE file
-// and its size as seen in the file header.
-// It parses the given size of bytes and returns optional header. It infers whether the
-// bytes being parsed refer to 32 bit or 64 bit version of optional header.
-func readOptionalHeader(r io.ReadSeeker, sz uint16) (interface{}, error) {
-	// If optional header size is 0, return empty optional header.
-	if sz == 0 {
-		return nil, nil
-	}
-
-	var (
-		// First couple of bytes in option header state its type.
-		// We need to read them first to determine the type and
-		// validity of optional header.
-		ohMagic   uint16
-		ohMagicSz = binary.Size(ohMagic)
-	)
-
-	// If optional header size is greater than 0 but less than its magic size, return error.
-	if sz < uint16(ohMagicSz) {
-		return nil, fmt.Errorf("optional header size is less than optional header magic size")
-	}
-
-	// read reads from io.ReadSeeker, r, into data.
-	var err error
-	read := func(data interface{}) bool {
-		err = binary.Read(r, binary.LittleEndian, data)
-		return err == nil
-	}
-
-	if !read(&ohMagic) {
-		return nil, fmt.Errorf("failure to read optional header magic: %v", err)
-	}
-
-	switch ohMagic {
-	case 0x10b: // PE32
-		var (
-			oh32 pe.OptionalHeader32
-			// There can be 0 or more data directories. So the minimum size of optional
-			// header is calculated by substracting oh32.DataDirectory size from oh32 size.
-			oh32MinSz = binary.Size(oh32) - binary.Size(oh32.DataDirectory)
-		)
-
-		if sz < uint16(oh32MinSz) {
-			return nil, fmt.Errorf("optional header size(%d) is less minimum size (%d) of PE32 "+
-				"optional header", sz, oh32MinSz)
-		}
-
-		// Init oh32 fields
-		oh32.Magic = ohMagic
-		if !read(&oh32.MajorLinkerVersion) ||
-			!read(&oh32.MinorLinkerVersion) ||
-			!read(&oh32.SizeOfCode) ||
-			!read(&oh32.SizeOfInitializedData) ||
-			!read(&oh32.SizeOfUninitializedData) ||
-			!read(&oh32.AddressOfEntryPoint) ||
-			!read(&oh32.BaseOfCode) ||
-			!read(&oh32.BaseOfData) ||
-			!read(&oh32.ImageBase) ||
-			!read(&oh32.SectionAlignment) ||
-			!read(&oh32.FileAlignment) ||
-			!read(&oh32.MajorOperatingSystemVersion) ||
-			!read(&oh32.MinorOperatingSystemVersion) ||
-			!read(&oh32.MajorImageVersion) ||
-			!read(&oh32.MinorImageVersion) ||
-			!read(&oh32.MajorSubsystemVersion) ||
-			!read(&oh32.MinorSubsystemVersion) ||
-			!read(&oh32.Win32VersionValue) ||
-			!read(&oh32.SizeOfImage) ||
-			!read(&oh32.SizeOfHeaders) ||
-			!read(&oh32.CheckSum) ||
-			!read(&oh32.Subsystem) ||
-			!read(&oh32.DllCharacteristics) ||
-			!read(&oh32.SizeOfStackReserve) ||
-			!read(&oh32.SizeOfStackCommit) ||
-			!read(&oh32.SizeOfHeapReserve) ||
-			!read(&oh32.SizeOfHeapCommit) ||
-			!read(&oh32.LoaderFlags) ||
-			!read(&oh32.NumberOfRvaAndSizes) {
-			return nil, fmt.Errorf("failure to read PE32 optional header: %v", err)
-		}
-
-		dd, err := readDataDirectories(r, sz-uint16(oh32MinSz), oh32.NumberOfRvaAndSizes)
-		if err != nil {
-			return nil, err
-		}
-
-		copy(oh32.DataDirectory[:], dd)
-
-		return &oh32, nil
-	case 0x20b: // PE32+
-		var (
-			oh64 pe.OptionalHeader64
-			// There can be 0 or more data directories. So the minimum size of optional
-			// header is calculated by substracting oh64.DataDirectory size from oh64 size.
-			oh64MinSz = binary.Size(oh64) - binary.Size(oh64.DataDirectory)
-		)
-
-		if sz < uint16(oh64MinSz) {
-			return nil, fmt.Errorf("optional header size(%d) is less minimum size (%d) for PE32+ "+
-				"optional header", sz, oh64MinSz)
-		}
-
-		// Init oh64 fields
-		oh64.Magic = ohMagic
-		if !read(&oh64.MajorLinkerVersion) ||
-			!read(&oh64.MinorLinkerVersion) ||
-			!read(&oh64.SizeOfCode) ||
-			!read(&oh64.SizeOfInitializedData) ||
-			!read(&oh64.SizeOfUninitializedData) ||
-			!read(&oh64.AddressOfEntryPoint) ||
-			!read(&oh64.BaseOfCode) ||
-			!read(&oh64.ImageBase) ||
-			!read(&oh64.SectionAlignment) ||
-			!read(&oh64.FileAlignment) ||
-			!read(&oh64.MajorOperatingSystemVersion) ||
-			!read(&oh64.MinorOperatingSystemVersion) ||
-			!read(&oh64.MajorImageVersion) ||
-			!read(&oh64.MinorImageVersion) ||
-			!read(&oh64.MajorSubsystemVersion) ||
-			!read(&oh64.MinorSubsystemVersion) ||
-			!read(&oh64.Win32VersionValue) ||
-			!read(&oh64.SizeOfImage) ||
-			!read(&oh64.SizeOfHeaders) ||
-			!read(&oh64.CheckSum) ||
-			!read(&oh64.Subsystem) ||
-			!read(&oh64.DllCharacteristics) ||
-			!read(&oh64.SizeOfStackReserve) ||
-			!read(&oh64.SizeOfStackCommit) ||
-			!read(&oh64.SizeOfHeapReserve) ||
-			!read(&oh64.SizeOfHeapCommit) ||
-			!read(&oh64.LoaderFlags) ||
-			!read(&oh64.NumberOfRvaAndSizes) {
-			return nil, fmt.Errorf("failure to read PE32+ optional header: %v", err)
-		}
-
-		dd, err := readDataDirectories(r, sz-uint16(oh64MinSz), oh64.NumberOfRvaAndSizes)
-		if err != nil {
-			return nil, err
-		}
-
-		copy(oh64.DataDirectory[:], dd)
-
-		return &oh64, nil
-	default:
-		return nil, fmt.Errorf("optional header has unexpected Magic of 0x%x", ohMagic)
-	}
-}
-
-func readVariableLengthOptionalHeader(r io.ReaderAt, sz uint16) (interface{}, error) {
-	var dosheader [96]byte
-	if _, err := r.ReadAt(dosheader[0:], 0); err != nil {
-		return nil, err
-	}
-	var base int64
-	if dosheader[0] == 'M' && dosheader[1] == 'Z' {
-		signoff := int64(binary.LittleEndian.Uint32(dosheader[0x3c:]))
-		var sign [4]byte
-		r.ReadAt(sign[:], signoff)
-		if !(sign[0] == 'P' && sign[1] == 'E' && sign[2] == 0 && sign[3] == 0) {
-			return nil, fmt.Errorf("invalid PE COFF file signature of %v.", sign)
-		}
-		base = signoff + 4
-	} else {
-		base = 0
-	}
-
-	sr := io.NewSectionReader(r, base+int64(binary.Size(pe.FileHeader{})), int64(sz))
-	return readOptionalHeader(sr, sz)
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/pin.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/pin.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/pin.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/pin.go	2020-11-05 20:13:01.000000000 +0000
@@ -20,24 +20,22 @@
 package secboot
 
 import (
-	"crypto/rand"
-	"crypto/rsa"
-	"encoding/binary"
 	"os"
 
 	"github.com/canonical/go-tpm2"
+	"github.com/snapcore/secboot/internal/tcg"
 
 	"golang.org/x/xerrors"
 )
 
-// computePinNVIndexPostInitAuthPolicies computes the authorization policy digests associated with the post-initialization
-// actions on a NV index created with createPinNVIndex. These are:
+// computeV0PinNVIndexPostInitAuthPolicies computes the authorization policy digests associated with the post-initialization
+// actions on a NV index created with the removed createPinNVIndex for version 0 key files. These are:
 // - A policy for updating the index to revoke old dynamic authorization policies, requiring an assertion signed by the key
 //   associated with updateKeyName.
 // - A policy for updating the authorization value (PIN / passphrase), requiring knowledge of the current authorization value.
 // - A policy for reading the counter value without knowing the authorization value, as the value isn't secret.
 // - A policy for using the counter value in a TPM2_PolicyNV assertion without knowing the authorization value.
-func computePinNVIndexPostInitAuthPolicies(alg tpm2.HashAlgorithmId, updateKeyName tpm2.Name) (tpm2.DigestList, error) {
+func computeV0PinNVIndexPostInitAuthPolicies(alg tpm2.HashAlgorithmId, updateKeyName tpm2.Name) (tpm2.DigestList, error) {
 	var out tpm2.DigestList
 	// Compute a policy for incrementing the index to revoke dynamic authorization policies, requiring an assertion signed by the
 	// key associated with updateKeyName.
@@ -78,152 +76,13 @@
 	return out, nil
 }
 
-// createPinNVIndex creates a NV index that is associated with a sealed key object and is used for implementing PIN support. It is
-// also used as a counter to support revoking of dynamic authorization policies.
+// performPinChangeV0 changes the authorization value of the dynamic authorization policy counter associated with the public
+// argument, for PIN integration in version 0 key files. This requires the authorization policy digests initially returned from
+// (the now removed) createPinNVIndex function in order to execute the policy session required to change the authorization value.
+// The current authorization value must be provided via the oldAuth argument.
 //
-// To prevent someone with knowledge of the owner authorization (which is empty unless someone has taken ownership of the TPM) from
-// resetting the PIN by just undefining and redifining a new NV index with the same properties, we need a way to prevent someone
-// from being able to create an index with the same name. To do this, we require the NV index to have been written to and only allow
-// the initial write with a signed authorization policy. Once initialized, the signing key that authorized the initial write is
-// discarded. This works because the name of the signing key is included in the authorization policy digest for the NV index, and the
-// authorization policy digest and attributes are included in the name of the NV index. Without the private part of the signing key,
-// it is impossible to create a new NV index with the same name, and so, if this NV index is undefined then it becomes impossible to
-// satisfy the authorization policy for the sealed key object to which it is associated.
-//
-// The NV index will be created with an authorization policy that permits TPM2_NV_Read and TPM2_PolicyNV without knowing the PIN,
-// and an authorization policy that permits TPM2_NV_Increment with a signed authorization policy, signed by the key associated with
-// updateKeyName.
-func createPinNVIndex(tpm *tpm2.TPMContext, handle tpm2.Handle, updateKeyName tpm2.Name, hmacSession tpm2.SessionContext) (*tpm2.NVPublic, tpm2.DigestList, error) {
-	initKey, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot create signing key for initializing NV index: %w", err)
-	}
-
-	initKeyPublic := createPublicAreaForRSASigningKey(&initKey.PublicKey)
-	initKeyName, err := initKeyPublic.Name()
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot compute name of signing key for initializing NV index: %w", err)
-	}
-
-	nameAlg := tpm2.HashAlgorithmSHA256
-
-	// The NV index requires 5 policies:
-	// - A policy for initializing the index, requiring an assertion signed with an ephemeral key so that the index cannot be recreated.
-	// - A policy for updating the index to revoke old dynamic authorization policies, requiring a signed assertion.
-	// - A policy for updating the authorization value (PIN / passphrase), requiring knowledge of the current authorization value.
-	// - A policy for reading the counter value without knowing the authorization value, as the value isn't secret.
-	// - A policy for using the counter value in a TPM2_PolicyNV assertion without knowing the authorization value.
-	var authPolicies tpm2.DigestList
-
-	// Compute a policy for initialization which requires an assertion signed with an ephemeral key (initKey)
-	trial, _ := tpm2.ComputeAuthPolicy(nameAlg)
-	trial.PolicyCommandCode(tpm2.CommandNVIncrement)
-	trial.PolicyNvWritten(false)
-	trial.PolicySigned(initKeyName, nil)
-	authPolicies = append(authPolicies, trial.GetDigest())
-
-	// Compute the remaining 4 post-initalization policies.
-	postInitAuthPolicies, err := computePinNVIndexPostInitAuthPolicies(nameAlg, updateKeyName)
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot compute authorization policies: %w", err)
-	}
-	authPolicies = append(authPolicies, postInitAuthPolicies...)
-
-	trial, _ = tpm2.ComputeAuthPolicy(nameAlg)
-	trial.PolicyOR(authPolicies)
-
-	// Define the NV index
-	public := &tpm2.NVPublic{
-		Index:      handle,
-		NameAlg:    nameAlg,
-		Attrs:      tpm2.NVTypeCounter.WithAttrs(tpm2.AttrNVPolicyWrite | tpm2.AttrNVAuthRead | tpm2.AttrNVPolicyRead),
-		AuthPolicy: trial.GetDigest(),
-		Size:       8}
-
-	index, err := tpm.NVDefineSpace(tpm.OwnerHandleContext(), nil, public, hmacSession)
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot define NV space: %w", err)
-	}
-
-	// NVDefineSpace was integrity protected, so we know that we have an index with the expected public area at the handle we specified
-	// at this point.
-
-	succeeded := false
-	defer func() {
-		if succeeded {
-			return
-		}
-		tpm.NVUndefineSpace(tpm.OwnerHandleContext(), index, hmacSession)
-	}()
-
-	// Begin a session to initialize the index.
-	policySession, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, nameAlg)
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot begin policy session to initialize NV index: %w", err)
-	}
-	defer tpm.FlushContext(policySession)
-
-	// Compute a digest for signing with our key
-	signDigest := tpm2.HashAlgorithmSHA256
-	h := signDigest.NewHash()
-	h.Write(policySession.NonceTPM())
-	binary.Write(h, binary.BigEndian, int32(0))
-
-	// Sign the digest
-	sig, err := rsa.SignPSS(rand.Reader, initKey, signDigest.GetHash(), h.Sum(nil), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot provide signature for initializing NV index: %w", err)
-	}
-
-	// Load the public part of the key in to the TPM. There's no integrity protection for this command as if it's altered in
-	// transit then either the signature verification fails or the policy digest will not match the one associated with the NV
-	// index.
-	initKeyContext, err := tpm.LoadExternal(nil, initKeyPublic, tpm2.HandleEndorsement)
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot load public part of key used to initialize NV index to the TPM: %w", err)
-	}
-	defer tpm.FlushContext(initKeyContext)
-
-	signature := tpm2.Signature{
-		SigAlg: tpm2.SigSchemeAlgRSAPSS,
-		Signature: tpm2.SignatureU{
-			Data: &tpm2.SignatureRSAPSS{
-				Hash: signDigest,
-				Sig:  tpm2.PublicKeyRSA(sig)}}}
-
-	// Execute the policy assertions
-	if err := tpm.PolicyCommandCode(policySession, tpm2.CommandNVIncrement); err != nil {
-		return nil, nil, xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
-	}
-	if err := tpm.PolicyNvWritten(policySession, false); err != nil {
-		return nil, nil, xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
-	}
-	if _, _, err := tpm.PolicySigned(initKeyContext, policySession, true, nil, nil, 0, &signature); err != nil {
-		return nil, nil, xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
-	}
-	if err := tpm.PolicyOR(policySession, authPolicies); err != nil {
-		return nil, nil, xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
-	}
-
-	// Initialize the index
-	if err := tpm.NVIncrement(index, index, policySession, hmacSession.IncludeAttrs(tpm2.AttrAudit)); err != nil {
-		return nil, nil, xerrors.Errorf("cannot initialize NV index: %w", err)
-	}
-
-	// The index has a different name now that it has been written, so update the public area we return so that it can be used
-	// to construct an authorization policy.
-	public.Attrs |= tpm2.AttrNVWritten
-
-	succeeded = true
-	return public, authPolicies, nil
-}
-
-// performPinChange changes the authorization value of the PIN NV index associated with the public argument. This requires the
-// authorization policy digests initially returned from createPinNVIndex in order to execute the policy session required to change
-// the authorization value. The current authorization value must be provided via the oldAuth argument.
-//
-// On success, the authorization value of the PIN NV index will be changed to newAuth.
-func performPinChange(tpm *tpm2.TPMContext, public *tpm2.NVPublic, authPolicies tpm2.DigestList, oldAuth, newAuth string, hmacSession tpm2.SessionContext) error {
+// On success, the authorization value of the counter will be changed to newAuth.
+func performPinChangeV0(tpm *tpm2.TPMContext, public *tpm2.NVPublic, authPolicies tpm2.DigestList, oldAuth, newAuth string, hmacSession tpm2.SessionContext) error {
 	index, err := tpm2.CreateNVIndexResourceContextFromPublic(public)
 	if err != nil {
 		return xerrors.Errorf("cannot create resource context for NV index: %w", err)
@@ -253,6 +112,33 @@
 	return nil
 }
 
+// performPinChange changes the authorization value of the sealed key object associated with keyPrivate and keyPublic, for PIN
+// integration in current key files. The sealed key file must be created without the AttrAdminWithPolicy attribute. The current
+// authorization value must be provided via the oldAuth argument.
+//
+// On success, a new private area will be returned for the sealed key object, containing the new PIN.
+func performPinChange(tpm *tpm2.TPMContext, keyPrivate tpm2.Private, keyPublic *tpm2.Public, oldPIN, newPIN string, session tpm2.SessionContext) (tpm2.Private, error) {
+	srk, err := tpm.CreateResourceContextFromTPM(tcg.SRKHandle)
+	if err != nil {
+		return nil, xerrors.Errorf("cannot create context for SRK: %w", err)
+	}
+
+	key, err := tpm.Load(srk, keyPrivate, keyPublic, session)
+	if err != nil {
+		return nil, xerrors.Errorf("cannot load sealed key object in to TPM: %w", err)
+	}
+	defer tpm.FlushContext(key)
+
+	key.SetAuthValue([]byte(oldPIN))
+
+	newKeyPrivate, err := tpm.ObjectChangeAuth(key, srk, []byte(newPIN), session.IncludeAttrs(tpm2.AttrCommandEncrypt))
+	if err != nil {
+		return nil, xerrors.Errorf("cannot change sealed key object authorization value: %w", err)
+	}
+
+	return newKeyPrivate, nil
+}
+
 // ChangePIN changes the PIN for the key data file at the specified path. The existing PIN must be supplied via the oldPIN argument.
 // Setting newPIN to an empty string will clear the PIN and set a hint on the key data file that no PIN is set.
 //
@@ -282,32 +168,42 @@
 	defer keyFile.Close()
 
 	// Read and validate the key data file
-	data, _, pinIndexPublic, err := readAndValidateKeyData(tpm.TPMContext, keyFile, nil, tpm.HmacSession())
+	data, _, pcrPolicyCounterPub, err := decodeAndValidateKeyData(tpm.TPMContext, keyFile, nil, tpm.HmacSession())
 	if err != nil {
-		var kfErr keyFileError
-		if xerrors.As(err, &kfErr) {
+		if isKeyFileError(err) {
 			return InvalidKeyFileError{err.Error()}
 		}
 		return xerrors.Errorf("cannot read and validate key data file: %w", err)
 	}
 
 	// Change the PIN
-	if err := performPinChange(tpm.TPMContext, pinIndexPublic, data.StaticPolicyData.PinIndexAuthPolicies, oldPIN, newPIN, tpm.HmacSession()); err != nil {
-		if isAuthFailError(err, tpm2.CommandNVChangeAuth, 1) {
-			return ErrPINFail
+	if data.version == 0 {
+		if err := performPinChangeV0(tpm.TPMContext, pcrPolicyCounterPub, data.staticPolicyData.v0PinIndexAuthPolicies, oldPIN, newPIN, tpm.HmacSession()); err != nil {
+			if isAuthFailError(err, tpm2.CommandNVChangeAuth, 1) {
+				return ErrPINFail
+			}
+			return err
+		}
+	} else {
+		newKeyPrivate, err := performPinChange(tpm.TPMContext, data.keyPrivate, data.keyPublic, oldPIN, newPIN, tpm.HmacSession())
+		if err != nil {
+			if isAuthFailError(err, tpm2.CommandObjectChangeAuth, 1) {
+				return ErrPINFail
+			}
+			return err
 		}
-		return err
+		data.keyPrivate = newKeyPrivate
 	}
 
 	// Update the metadata and write a new key data file
-	origAuthModeHint := data.AuthModeHint
+	origAuthModeHint := data.authModeHint
 	if newPIN == "" {
-		data.AuthModeHint = AuthModeNone
+		data.authModeHint = AuthModeNone
 	} else {
-		data.AuthModeHint = AuthModePIN
+		data.authModeHint = AuthModePIN
 	}
 
-	if origAuthModeHint == data.AuthModeHint {
+	if origAuthModeHint == data.authModeHint && data.version == 0 {
 		return nil
 	}
 
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/policy.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/policy.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/policy.go	2020-05-26 11:11:21.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/policy.go	2020-11-05 20:13:01.000000000 +0000
@@ -20,42 +20,34 @@
 package secboot
 
 import (
-	"bytes"
+	"crypto"
+	"crypto/ecdsa"
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/binary"
 	"errors"
-	"fmt"
-	"sort"
 
 	"github.com/canonical/go-tpm2"
 
 	"golang.org/x/xerrors"
 )
 
-const (
-	lockNVIndexVersion   uint8 = 0    // Policy data version for lockNVHandle, to support backwards compatible changes
-	lockNVIndexGraceTime       = 5000 // Time window in milliseconds in which lockNVHandle can be initialized after creation
-)
-
 var (
-	// lockNVIndexAttrs are the attributes for the global lock NV index.
-	lockNVIndexAttrs = tpm2.NVTypeOrdinary.WithAttrs(tpm2.AttrNVPolicyWrite | tpm2.AttrNVAuthRead | tpm2.AttrNVNoDA | tpm2.AttrNVReadStClear)
+	// lockNVIndex1Attrs are the attributes for the first global lock NV index.
+	lockNVIndex1Attrs = tpm2.NVTypeOrdinary.WithAttrs(tpm2.AttrNVPolicyWrite | tpm2.AttrNVAuthRead | tpm2.AttrNVNoDA | tpm2.AttrNVReadStClear)
 )
 
 // dynamicPolicyComputeParams provides the parameters to computeDynamicPolicy.
 type dynamicPolicyComputeParams struct {
-	key *rsa.PrivateKey // Key used to authorize the generated dynamic authorization policy
+	key crypto.PrivateKey // Key used to authorize the generated dynamic authorization policy
 
 	// signAlg is the digest algorithm for the signature used to authorize the generated dynamic authorization policy. It must
 	// match the name algorithm of the public part of key that will be loaded in to the TPM for verification.
-	signAlg              tpm2.HashAlgorithmId
-	pcrValues            []tpm2.PCRValues // Approved PCR digests
-	policyCountIndexName tpm2.Name        // Name of the NV index used for revoking authorization policies
-
-	// policyCount is the maximum permitted value of the NV index associated with policyCountIndexName, beyond which, this authorization
-	// policy will not be satisfied.
-	policyCount uint64
+	signAlg           tpm2.HashAlgorithmId
+	pcrs              tpm2.PCRSelectionList // PCR selection
+	pcrDigests        tpm2.DigestList       // Approved PCR digests
+	policyCounterName tpm2.Name             // Name of the NV index used for revoking authorization policies
+	policyCount       uint64                // Count for this policy, used for revocation
 }
 
 // policyOrDataNode represents a collection of up to 8 digests used in a single TPM2_PolicyOR invocation, and forms part of a tree
@@ -67,7 +59,17 @@
 
 type policyOrDataTree []policyOrDataNode
 
+// dynamicPolicyData is an output of computeDynamicPolicy and provides metadata for executing a policy session.
 type dynamicPolicyData struct {
+	pcrSelection              tpm2.PCRSelectionList
+	pcrOrData                 policyOrDataTree
+	policyCount               uint64
+	authorizedPolicy          tpm2.Digest
+	authorizedPolicySignature *tpm2.Signature
+}
+
+// dynamicPolicyDataRaw_v0 is version 0 of the on-disk format of dynamicPolicyData.
+type dynamicPolicyDataRaw_v0 struct {
 	PCRSelection              tpm2.PCRSelectionList
 	PCROrData                 policyOrDataTree
 	PolicyCount               uint64
@@ -75,28 +77,116 @@
 	AuthorizedPolicySignature *tpm2.Signature
 }
 
+func (d *dynamicPolicyDataRaw_v0) data() *dynamicPolicyData {
+	return &dynamicPolicyData{
+		pcrSelection:              d.PCRSelection,
+		pcrOrData:                 d.PCROrData,
+		policyCount:               d.PolicyCount,
+		authorizedPolicy:          d.AuthorizedPolicy,
+		authorizedPolicySignature: d.AuthorizedPolicySignature}
+}
+
+// makeDynamicPolicyDataRaw_v0 converts dynamicPolicyData to version 0 of the on-disk format.
+func makeDynamicPolicyDataRaw_v0(data *dynamicPolicyData) *dynamicPolicyDataRaw_v0 {
+	return &dynamicPolicyDataRaw_v0{
+		PCRSelection:              data.pcrSelection,
+		PCROrData:                 data.pcrOrData,
+		PolicyCount:               data.policyCount,
+		AuthorizedPolicy:          data.authorizedPolicy,
+		AuthorizedPolicySignature: data.authorizedPolicySignature}
+}
+
 // staticPolicyComputeParams provides the parameters to computeStaticPolicy.
 type staticPolicyComputeParams struct {
-	key                  *tpm2.Public    // Public part of key used to authorize a dynamic authorization policy
-	pinIndexPub          *tpm2.NVPublic  // Public area of the NV index used for the PIN
-	pinIndexAuthPolicies tpm2.DigestList // Metadata for executing policy sessions to interact with the PIN NV index
-	lockIndexName        tpm2.Name       // Name of the global NV index for locking access to sealed key objects
+	key                 *tpm2.Public   // Public part of key used to authorize a dynamic authorization policy
+	pcrPolicyCounterPub *tpm2.NVPublic // Public area of the NV counter used for revoking PCR policies
 }
 
 // staticPolicyData is an output of computeStaticPolicy and provides metadata for executing a policy session.
 type staticPolicyData struct {
+	authPublicKey          *tpm2.Public
+	pcrPolicyCounterHandle tpm2.Handle
+	v0PinIndexAuthPolicies tpm2.DigestList
+}
+
+// staticPolicyDataRaw_v0 is version 0 of the on-disk format of staticPolicyData.
+type staticPolicyDataRaw_v0 struct {
 	AuthPublicKey        *tpm2.Public
 	PinIndexHandle       tpm2.Handle
 	PinIndexAuthPolicies tpm2.DigestList
 }
 
-// incrementDynamicPolicyCounter will increment the NV counter index associated with nvPublic. This is designed to operate on a
-// NV index created by createPinNVIndex. The authorization policy digests returned from createPinNVIndex must be supplied via the
-// nvAuthPolicies argument.
+func (d *staticPolicyDataRaw_v0) data() *staticPolicyData {
+	return &staticPolicyData{
+		authPublicKey:          d.AuthPublicKey,
+		pcrPolicyCounterHandle: d.PinIndexHandle,
+		v0PinIndexAuthPolicies: d.PinIndexAuthPolicies}
+}
+
+// makeStaticPolicyDataRaw_v0 converts staticPolicyData to version 0 of the on-disk format.
+func makeStaticPolicyDataRaw_v0(data *staticPolicyData) *staticPolicyDataRaw_v0 {
+	return &staticPolicyDataRaw_v0{
+		AuthPublicKey:        data.authPublicKey,
+		PinIndexHandle:       data.pcrPolicyCounterHandle,
+		PinIndexAuthPolicies: data.v0PinIndexAuthPolicies}
+}
+
+// staticPolicyDataRaw_v1 is version 1 of the on-disk format of staticPolicyData.
+type staticPolicyDataRaw_v1 struct {
+	AuthPublicKey          *tpm2.Public
+	PCRPolicyCounterHandle tpm2.Handle
+	PCRPolicyRef           tpm2.Nonce
+}
+
+func (d *staticPolicyDataRaw_v1) data() *staticPolicyData {
+	return &staticPolicyData{
+		authPublicKey:          d.AuthPublicKey,
+		pcrPolicyCounterHandle: d.PCRPolicyCounterHandle}
+}
+
+// makeStaticPolicyDataRaw_v1 converts staticPolicyData to version 1 of the on-disk format.
+func makeStaticPolicyDataRaw_v1(data *staticPolicyData) *staticPolicyDataRaw_v1 {
+	return &staticPolicyDataRaw_v1{
+		AuthPublicKey:          data.authPublicKey,
+		PCRPolicyCounterHandle: data.pcrPolicyCounterHandle}
+}
+
+// computePcrPolicyCounterAuthPolicies computes the authorization policy digests passed to TPM2_PolicyOR for a PCR
+// policy counter that can be updated with the key associated with updateKeyName.
+func computePcrPolicyCounterAuthPolicies(alg tpm2.HashAlgorithmId, updateKeyName tpm2.Name) (tpm2.DigestList, error) {
+	// The NV index requires 2 policies:
+	// - A policy to initialize the index with no authorization
+	// - A policy for updating the index to revoke old PCR policies using a signed assertion. This isn't done for security
+	//   reasons, but just to make it harder to accidentally increment the counter for anyone interacting with the TPM.
+	// This is simpler than the policy required for the v0 PIN NV index because it doesn't require additional authorization
+	// policy branches to allow its authorization value to be changed, or to be able to read the counter value or use it in
+	// a policy assertion without knowing the authorization value (reading the value of this counter does require the
+	// authorization value, but it is always empty and this policy doesn't allow it to be changed).
+	var authPolicies tpm2.DigestList
+
+	trial, err := tpm2.ComputeAuthPolicy(alg)
+	if err != nil {
+		return nil, err
+	}
+	trial.PolicyNvWritten(false)
+	authPolicies = append(authPolicies, trial.GetDigest())
+
+	trial, _ = tpm2.ComputeAuthPolicy(alg)
+	trial.PolicySigned(updateKeyName, nil)
+	authPolicies = append(authPolicies, trial.GetDigest())
+
+	return authPolicies, nil
+}
+
+// incrementPcrPolicyCounter will increment the NV counter index associated with nvPublic. This is designed to operate on a
+// NV index created by createPcrPolicyCounter (for current key files) or on a NV index created by (the now deleted)
+// createPinNVINdex for version 0 key files.
 //
-// This requires a signed authorization. The keyPublic argument must correspond to the updateKeyName argument originally passed to
-// createPinNVIndex. The private part of that key must be supplied via the key argument.
-func incrementDynamicPolicyCounter(tpm *tpm2.TPMContext, nvPublic *tpm2.NVPublic, nvAuthPolicies tpm2.DigestList, key *rsa.PrivateKey, keyPublic *tpm2.Public, hmacSession tpm2.SessionContext) error {
+// This requires a signed authorization. For current key files, the keyPublic argument must correspond to the updateKeyName argument
+// originally passed to createPcrPolicyCounter. For version 0 key files, this must correspond to the key originally passed to
+// createPinNVIndex. The private part of that key must be supplied via the key argument. For version 0 key files, the authorization
+// policy digests returned from createPinNVIndex must be supplied via the nvAuthPolicies argument.
+func incrementPcrPolicyCounter(tpm *tpm2.TPMContext, version uint32, nvPublic *tpm2.NVPublic, nvAuthPolicies tpm2.DigestList, key crypto.PrivateKey, keyPublic *tpm2.Public, hmacSession tpm2.SessionContext) error {
 	index, err := tpm2.CreateNVIndexResourceContextFromPublic(nvPublic)
 	if err != nil {
 		return xerrors.Errorf("cannot create context for NV index: %w", err)
@@ -110,15 +200,46 @@
 	defer tpm.FlushContext(policySession)
 
 	// Compute a digest for signing with the update key
-	signDigest := tpm2.HashAlgorithmSHA256
+	signDigest := tpm2.HashAlgorithmNull
+	keyScheme := keyPublic.Params.AsymDetail().Scheme
+	if keyScheme.Scheme != tpm2.AsymSchemeNull {
+		signDigest = keyScheme.Details.Any().HashAlg
+	}
+	if signDigest == tpm2.HashAlgorithmNull {
+		signDigest = tpm2.HashAlgorithmSHA256
+	}
 	h := signDigest.NewHash()
 	h.Write(policySession.NonceTPM())
 	binary.Write(h, binary.BigEndian, int32(0)) // expiration
 
 	// Sign the digest
-	sig, err := rsa.SignPSS(rand.Reader, key, signDigest.GetHash(), h.Sum(nil), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
-	if err != nil {
-		return xerrors.Errorf("cannot sign authorization: %w", err)
+	var signature tpm2.Signature
+	switch k := key.(type) {
+	case *rsa.PrivateKey:
+		sig, err := rsa.SignPSS(rand.Reader, k, signDigest.GetHash(), h.Sum(nil), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
+		if err != nil {
+			return xerrors.Errorf("cannot sign authorization: %w", err)
+		}
+		signature = tpm2.Signature{
+			SigAlg: tpm2.SigSchemeAlgRSAPSS,
+			Signature: tpm2.SignatureU{
+				Data: &tpm2.SignatureRSAPSS{
+					Hash: signDigest,
+					Sig:  tpm2.PublicKeyRSA(sig)}}}
+	case *ecdsa.PrivateKey:
+		sigR, sigS, err := ecdsa.Sign(rand.Reader, k, h.Sum(nil))
+		if err != nil {
+			return xerrors.Errorf("cannot sign authorization: %w", err)
+		}
+		signature = tpm2.Signature{
+			SigAlg: tpm2.SigSchemeAlgECDSA,
+			Signature: tpm2.SignatureU{
+				Data: &tpm2.SignatureECDSA{
+					Hash:       signDigest,
+					SignatureR: sigR.Bytes(),
+					SignatureS: sigS.Bytes()}}}
+	default:
+		panic("invalid private key type")
 	}
 
 	// Load the public part of the key in to the TPM. There's no integrity protection for this command as if it's altered in
@@ -130,20 +251,23 @@
 	}
 	defer tpm.FlushContext(keyLoaded)
 
-	signature := tpm2.Signature{
-		SigAlg: tpm2.SigSchemeAlgRSAPSS,
-		Signature: tpm2.SignatureU{
-			Data: &tpm2.SignatureRSAPSS{
-				Hash: signDigest,
-				Sig:  tpm2.PublicKeyRSA(sig)}}}
-
 	// Execute the policy assertions
-	if err := tpm.PolicyCommandCode(policySession, tpm2.CommandNVIncrement); err != nil {
-		return xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
-	}
-	if err := tpm.PolicyNvWritten(policySession, true); err != nil {
-		return xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
+	if version == 0 {
+		// See the comment for computeV0PinNVIndexPostInitAuthPolicies for a description of the authorization policy
+		// for the v0 NV index.
+		if err := tpm.PolicyCommandCode(policySession, tpm2.CommandNVIncrement); err != nil {
+			return xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
+		}
+		if err := tpm.PolicyNvWritten(policySession, true); err != nil {
+			return xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
+		}
+	} else {
+		nvAuthPolicies, err = computePcrPolicyCounterAuthPolicies(nvPublic.NameAlg, keyLoaded.Name())
+		if err != nil {
+			return xerrors.Errorf("cannot compute auth policies for counter: %w", err)
+		}
 	}
+
 	if _, _, err := tpm.PolicySigned(keyLoaded, policySession, true, nil, nil, 0, &signature); err != nil {
 		return xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
 	}
@@ -159,29 +283,41 @@
 	return nil
 }
 
-// readDynamicPolicyCounter will read the value of the counter NV index associated with nvPublic. This is designed to operate on a
-// NV index created by createPinNVIndex. The authorization policy digests returned from createPinNVIndex must be supplied via the
-// nvAuthPolicies argument.
-func readDynamicPolicyCounter(tpm *tpm2.TPMContext, nvPublic *tpm2.NVPublic, nvAuthPolicies tpm2.DigestList, hmacSession tpm2.SessionContext) (uint64, error) {
+// readPcrPolicyCounter will read the value of the counter NV index associated with nvPublic. This is designed to operate on a
+// NV index created by createPcrPolicyCounter (for current key files) or on a NV index created by (the now deleted)
+// createPinNVINdex for version 0 key files. For version 0 key files, the authorization policy digests returned from createPinNVIndex
+// must be supplied via the nvAuthPolicies argument.
+func readPcrPolicyCounter(tpm *tpm2.TPMContext, version uint32, nvPublic *tpm2.NVPublic, nvAuthPolicies tpm2.DigestList, hmacSession tpm2.SessionContext) (uint64, error) {
 	index, err := tpm2.CreateNVIndexResourceContextFromPublic(nvPublic)
 	if err != nil {
 		return 0, xerrors.Errorf("cannot create context for NV index: %w", err)
 	}
 
-	policySession, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, nvPublic.NameAlg)
-	if err != nil {
-		return 0, xerrors.Errorf("cannot begin policy session: %w", err)
-	}
-	defer tpm.FlushContext(policySession)
+	var authSession tpm2.SessionContext
+	var extraSession tpm2.SessionContext
+	if version == 0 {
+		authSession, err = tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, nvPublic.NameAlg)
+		if err != nil {
+			return 0, xerrors.Errorf("cannot begin policy session: %w", err)
+		}
+		defer tpm.FlushContext(authSession)
 
-	if err := tpm.PolicyCommandCode(policySession, tpm2.CommandNVRead); err != nil {
-		return 0, xerrors.Errorf("cannot execute assertion to read counter: %w", err)
-	}
-	if err := tpm.PolicyOR(policySession, nvAuthPolicies); err != nil {
-		return 0, xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
+		// See the comment for computeV0PinNVIndexPostInitAuthPolicies for a description of the authorization policy
+		// for the v0 NV index. Because the v0 NV index was also used for the PIN, it needed an authorization policy
+		// to permit reading the counter value without knowing the authorization value of the index.
+		if err := tpm.PolicyCommandCode(authSession, tpm2.CommandNVRead); err != nil {
+			return 0, xerrors.Errorf("cannot execute assertion to read counter: %w", err)
+		}
+		if err := tpm.PolicyOR(authSession, nvAuthPolicies); err != nil {
+			return 0, xerrors.Errorf("cannot execute assertion to increment counter: %w", err)
+		}
+
+		extraSession = hmacSession.IncludeAttrs(tpm2.AttrAudit)
+	} else {
+		authSession = hmacSession
 	}
 
-	c, err := tpm.NVReadCounter(index, index, policySession, hmacSession.IncludeAttrs(tpm2.AttrAudit))
+	c, err := tpm.NVReadCounter(index, index, authSession, extraSession)
 	if err != nil {
 		return 0, xerrors.Errorf("cannot read counter: %w", err)
 	}
@@ -189,272 +325,69 @@
 	return c, nil
 }
 
-// ensureLockNVIndex creates a NV index at lockNVHandle if one doesn't exist already. This is used for locking access to any sealed
-// key objects we create until the next TPM restart or reset. The same handle is used for all keys, regardless of individual key
-// policy.
-//
-// Locking works by enabling the read lock bit for the NV index. As this changes the name of the index until the next TPM reset or
-// restart, it makes any authorization policy that depends on it un-satisfiable. We do this rather than extending an extra value to a
-// PCR, as it decouples the PCR policy from the locking feature and allows for the option of having more flexible, owner-customizable
-// and maybe device-specific PCR policies in the future.
-//
-// To prevent someone with knowledge of the owner authorization (which is empty unless someone has taken ownership of the TPM) from
-// clearing the read lock bit by just undefining and redifining a new NV index with the same properties, we need a way to prevent
-// someone from being able to create an identical index. One option for this would be to use a NV counter, which has the property
-// that they can only increment and are initialized with a value larger than the largest count value seen on the TPM. Whilst it
-// would be possible to recreate a counter with the same name, it wouldn't be possible to recreate one with the same value. Keys
-// sealed by this package can then execute an assertion that the counter is equal to a certain value. One problem with this is that
-// the current value needs to be known at key sealing time (as it forms part of the authorization policy), and the read lock bit will
-// prevent the count value from being read from the TPM. Also, the number of counters available is extremely limited, and we already
-// use one per sealed key.
+// createPcrPolicyCounter creates and initializes a NV counter that is associated with a sealed key object and is used for
+// implementing dynamic authorization policy revocation.
 //
-// Another approach is to use an ordinary NV index that can't be recreated with the same name. To do this, we require the NV index
-// to have been written to and only allow writes with a signed authorization policy. Once initialized, the signing key is discarded.
-// This works because the name of the signing key is included in the authorization policy digest for the NV index, and the
-// authorization policy digest and attributes are included in the name of the NV index. Without the private part of the signing key,
-// it is impossible to create a new NV index with the same name, and so, if this NV index is undefined then it becomes impossible to
-// satisfy the authorization policy for any sealed key objects we've created already.
-//
-// The issue here though is that the globally defined NV index is created at provisioning time, and it may be possible to seal a new
-// key to the TPM at any point in the future without provisioning a new global NV index here. In the time between provisioning and
-// sealing a key to the TPM, an adversary may have created a new NV index with a policy that only allows writes with a signed
-// authorization, initialized it, but then retained the private part of the key. This allows them to undefine and redefine a new NV
-// index with the same name in the future in order to remove the read lock bit. To mitigate this, we include another assertion in
-// the authorization policy that only allows writes during a small time window (sufficient to initialize the index after it is
-// created), and disallows writes once the TPM's clock has advanced past that window. As the parameters of this assertion are
-// included in the authorization policy digest, it becomes impossible even for someone with the private part of the key to create
-// and initialize a NV index with the same name once the TPM's clock has advanced past that point, without performing a clear of the
-// TPM. Clearing the TPM changes the SPS anyway, and makes it impossible to recover any keys previously sealed.
-//
-// The signing key name and the time window during which the index can be initialized are recorded in another NV index so that it is
-// possible to use those to determine whether the lock NV index has an authorization policy that can never be satisfied, in order to
-// verify that the index can not be recreated and is therefore safe to use.
-func ensureLockNVIndex(tpm *tpm2.TPMContext, session tpm2.SessionContext) error {
-	if existing, err := tpm.CreateResourceContextFromTPM(lockNVHandle); err == nil {
-		if _, err := readAndValidateLockNVIndexPublic(tpm, existing, session); err == nil {
-			return nil
-		}
-	}
-
-	// Create signing key.
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return xerrors.Errorf("cannot create signing key for initializing NV index: %w", err)
-	}
-
-	keyPublic := createPublicAreaForRSASigningKey(&key.PublicKey)
-	keyName, err := keyPublic.Name()
-	if err != nil {
-		return xerrors.Errorf("cannot compute name of signing key for initializing NV index: %w", err)
-	}
-
-	// Read the TPM clock (no session here because some Infineon devices don't allow them, despite being permitted in the spec
-	// and reference implementation)
-	time, err := tpm.ReadClock()
-	if err != nil {
-		return xerrors.Errorf("cannot read current time: %w", err)
-	}
-	// Give us a small window in which to initialize the index, beyond which the index cannot be written to without a change in TPM owner.
-	time.ClockInfo.Clock += lockNVIndexGraceTime
-	clockBytes := make(tpm2.Operand, binary.Size(time.ClockInfo.Clock))
-	binary.BigEndian.PutUint64(clockBytes, time.ClockInfo.Clock)
-
+// The NV index will be created with attributes that allow anyone to read the index, and an authorization policy that permits
+// TPM2_NV_Increment with a signed authorization policy.
+func createPcrPolicyCounter(tpm *tpm2.TPMContext, handle tpm2.Handle, updateKeyName tpm2.Name, hmacSession tpm2.SessionContext) (*tpm2.NVPublic, error) {
 	nameAlg := tpm2.HashAlgorithmSHA256
 
-	// Compute the authorization policy.
+	authPolicies, _ := computePcrPolicyCounterAuthPolicies(nameAlg, updateKeyName)
+
 	trial, _ := tpm2.ComputeAuthPolicy(nameAlg)
-	trial.PolicyCommandCode(tpm2.CommandNVWrite)
-	trial.PolicyCounterTimer(clockBytes, 8, tpm2.OpUnsignedLT)
-	trial.PolicySigned(keyName, nil)
+	trial.PolicyOR(authPolicies)
 
-	// Create the index.
+	// Define the NV index
 	public := &tpm2.NVPublic{
-		Index:      lockNVHandle,
+		Index:      handle,
 		NameAlg:    nameAlg,
-		Attrs:      lockNVIndexAttrs,
+		Attrs:      tpm2.NVTypeCounter.WithAttrs(tpm2.AttrNVPolicyWrite | tpm2.AttrNVAuthRead | tpm2.AttrNVNoDA),
 		AuthPolicy: trial.GetDigest(),
-		Size:       0}
-	index, err := tpm.NVDefineSpace(tpm.OwnerHandleContext(), nil, public, session)
+		Size:       8}
+
+	index, err := tpm.NVDefineSpace(tpm.OwnerHandleContext(), nil, public, hmacSession)
 	if err != nil {
-		var e *tpm2.TPMError
-		if tpm2.AsTPMError(err, tpm2.ErrorNVDefined, tpm2.CommandNVDefineSpace, &e) {
-			return &tpmErrorWithHandle{err: e, handle: public.Index}
-		}
-		return xerrors.Errorf("cannot create NV index: %w", err)
+		return nil, xerrors.Errorf("cannot define NV space: %w", err)
 	}
 
+	// NVDefineSpace was integrity protected, so we know that we have an index with the expected public area at the handle we specified
+	// at this point.
+
 	succeeded := false
 	defer func() {
 		if succeeded {
 			return
 		}
-		tpm.NVUndefineSpace(tpm.OwnerHandleContext(), index, session)
+		tpm.NVUndefineSpace(tpm.OwnerHandleContext(), index, hmacSession)
 	}()
 
 	// Begin a session to initialize the index.
 	policySession, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, nameAlg)
 	if err != nil {
-		return xerrors.Errorf("cannot begin policy session to initialize NV index: %w", err)
+		return nil, xerrors.Errorf("cannot begin policy session to initialize NV index: %w", err)
 	}
 	defer tpm.FlushContext(policySession)
 
-	// Compute a digest for signing with our key
-	signDigest := tpm2.HashAlgorithmSHA256
-	h := signDigest.NewHash()
-	h.Write(policySession.NonceTPM())
-	binary.Write(h, binary.BigEndian, int32(0))
-
-	// Sign the digest
-	sig, err := rsa.SignPSS(rand.Reader, key, signDigest.GetHash(), h.Sum(nil), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
-	if err != nil {
-		return xerrors.Errorf("cannot provide signature for initializing NV index: %w", err)
-	}
-
-	// Load the public part of the key in to the TPM. There's no integrity protection for this command as if it's altered in
-	// transit then either the signature verification fails or the policy digest will not match the one associated with the NV
-	// index.
-	keyLoaded, err := tpm.LoadExternal(nil, keyPublic, tpm2.HandleEndorsement)
-	if err != nil {
-		return xerrors.Errorf("cannot load public part of key used to initialize NV index to the TPM: %w", err)
-	}
-	defer tpm.FlushContext(keyLoaded)
-
-	signature := tpm2.Signature{
-		SigAlg: tpm2.SigSchemeAlgRSAPSS,
-		Signature: tpm2.SignatureU{
-			Data: &tpm2.SignatureRSAPSS{
-				Hash: signDigest,
-				Sig:  tpm2.PublicKeyRSA(sig)}}}
-
 	// Execute the policy assertions
-	if err := tpm.PolicyCommandCode(policySession, tpm2.CommandNVWrite); err != nil {
-		return xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
-	}
-	if err := tpm.PolicyCounterTimer(policySession, clockBytes, 8, tpm2.OpUnsignedLT); err != nil {
-		return xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
+	if err := tpm.PolicyNvWritten(policySession, false); err != nil {
+		return nil, xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
 	}
-	if _, _, err := tpm.PolicySigned(keyLoaded, policySession, true, nil, nil, 0, &signature); err != nil {
-		return xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
+	if err := tpm.PolicyOR(policySession, authPolicies); err != nil {
+		return nil, xerrors.Errorf("cannot execute assertion to initialize NV index: %w", err)
 	}
 
 	// Initialize the index
-	if err := tpm.NVWrite(index, index, nil, 0, policySession, session.IncludeAttrs(tpm2.AttrAudit)); err != nil {
-		return xerrors.Errorf("cannot initialize NV index: %w", err)
-	}
-
-	// Marshal key name and cut-off time for writing to the NV index so that they can be used for verification in the future.
-	data, err := tpm2.MarshalToBytes(lockNVIndexVersion, keyName, time.ClockInfo.Clock)
-	if err != nil {
-		panic(fmt.Sprintf("cannot marshal contents for policy data NV index: %v", err))
+	if err := tpm.NVIncrement(index, index, policySession, hmacSession.IncludeAttrs(tpm2.AttrAudit)); err != nil {
+		return nil, xerrors.Errorf("cannot initialize NV index: %w", err)
 	}
 
-	// Create the data index.
-	dataPublic := tpm2.NVPublic{
-		Index:   lockNVDataHandle,
-		NameAlg: tpm2.HashAlgorithmSHA256,
-		Attrs:   tpm2.NVTypeOrdinary.WithAttrs(tpm2.AttrNVAuthWrite | tpm2.AttrNVWriteDefine | tpm2.AttrNVAuthRead | tpm2.AttrNVNoDA),
-		Size:    uint16(len(data))}
-	dataIndex, err := tpm.NVDefineSpace(tpm.OwnerHandleContext(), nil, &dataPublic, session)
-	if err != nil {
-		var e *tpm2.TPMError
-		if tpm2.AsTPMError(err, tpm2.ErrorNVDefined, tpm2.CommandNVDefineSpace, &e) {
-			return &tpmErrorWithHandle{err: e, handle: dataPublic.Index}
-		}
-		return xerrors.Errorf("cannot create policy data NV index: %w", err)
-	}
-
-	defer func() {
-		if succeeded {
-			return
-		}
-		tpm.NVUndefineSpace(tpm.OwnerHandleContext(), dataIndex, session)
-	}()
-
-	// Initialize the index
-	if err := tpm.NVWrite(dataIndex, dataIndex, data, 0, session); err != nil {
-		return xerrors.Errorf("cannot initialize policy data NV index: %w", err)
-	}
-	if err := tpm.NVWriteLock(dataIndex, dataIndex, session); err != nil {
-		return xerrors.Errorf("cannot write lock policy data NV index: %w", err)
-	}
+	// The index has a different name now that it has been written, so update the public area we return so that it can be used
+	// to construct an authorization policy.
+	public.Attrs |= tpm2.AttrNVWritten
 
 	succeeded = true
-	return nil
-}
-
-// readAndValidateLockNVIndexPublic validates that the NV index at the global lock handle is safe to protect a new key against, and
-// then returns the public area if it is. The name of the public area can then be used in an authorization policy.
-func readAndValidateLockNVIndexPublic(tpm *tpm2.TPMContext, index tpm2.ResourceContext, session tpm2.SessionContext) (*tpm2.NVPublic, error) {
-	// Obtain the data recorded alongside the lock NV index for validating that it has a valid authorization policy.
-	dataIndex, err := tpm.CreateResourceContextFromTPM(lockNVDataHandle)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot obtain context for policy data NV index: %w", err)
-	}
-	dataPub, _, err := tpm.NVReadPublic(dataIndex)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read public area of policy data NV index: %w", err)
-	}
-	data, err := tpm.NVRead(dataIndex, dataIndex, dataPub.Size, 0, nil)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read policy data: %w", err)
-	}
-
-	// Unmarshal the data
-	var version uint8
-	var keyName tpm2.Name
-	var clock uint64
-	if _, err := tpm2.UnmarshalFromBytes(data, &version, &keyName, &clock); err != nil {
-		return nil, xerrors.Errorf("cannot unmarshal policy data: %w", err)
-	}
-
-	// Allow for future changes to the public attributes or auth policy configuration.
-	if version != lockNVIndexVersion {
-		return nil, errors.New("unrecognized version for policy data")
-	}
-
-	// Read the TPM clock (no session here because some Infineon devices don't allow them, despite being permitted in the spec
-	// and reference implementation)
-	time, err := tpm.ReadClock()
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read current time: %w", err)
-	}
-
-	// Make sure the window beyond which this index can be written has passed or about to pass.
-	if time.ClockInfo.Clock+lockNVIndexGraceTime < clock {
-		return nil, errors.New("unexpected clock value in policy data")
-	}
-
-	// Read the public area of the lock NV index.
-	pub, _, err := tpm.NVReadPublic(index, session.IncludeAttrs(tpm2.AttrAudit))
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read public area of NV index: %w", err)
-	}
-
-	pub.Attrs &^= tpm2.AttrNVReadLocked
-	// Validate its attributes
-	if pub.Attrs != lockNVIndexAttrs|tpm2.AttrNVWritten {
-		return nil, errors.New("unexpected NV index attributes")
-	}
-
-	clockBytes := make([]byte, binary.Size(clock))
-	binary.BigEndian.PutUint64(clockBytes, clock)
-
-	// Compute the expected authorization policy from the contents of the data index, and make sure this matches the public area.
-	// This verifies that the lock NV index has a valid authorization policy.
-	trial, err := tpm2.ComputeAuthPolicy(pub.NameAlg)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot compute expected policy for NV index: %w", err)
-	}
-	trial.PolicyCommandCode(tpm2.CommandNVWrite)
-	trial.PolicyCounterTimer(clockBytes, 8, tpm2.OpUnsignedLT)
-	trial.PolicySigned(keyName, nil)
-
-	if !bytes.Equal(trial.GetDigest(), pub.AuthPolicy) {
-		return nil, errors.New("incorrect policy for NV index")
-	}
-
-	// This is a valid global lock NV index that cannot be recreated!
-	return pub, nil
+	return public, nil
 }
 
 // ensureSufficientORDigests turns a single digest in to a pair of identical digests. This is because TPM2_PolicyOR assertions
@@ -467,28 +400,65 @@
 	return digests
 }
 
-// computeStaticPolicy computes the part of an authorization policy that is bound to a sealed key object and never changes.
+// computePcrPolicyRefFromCounterName computes the reference used for authorization of signed PCR policies from the supplied
+// PCR policy counter name. If name is empty, then the name of the null handle is assumed. The policy ref serves 2 purposes:
+// 1) It limits the scope of the signed policy to just PCR policies (the dynamic authorization policy key may be able to sign
+//    different types of policy in the future, for example, to permit recovery with a signed assertion.
+// 2) It binds the name of the PCR policy counter to the static authorization policy.
+func computePcrPolicyRefFromCounterName(name tpm2.Name) tpm2.Nonce {
+	if len(name) == 0 {
+		name = make(tpm2.Name, binary.Size(tpm2.Handle(0)))
+		binary.BigEndian.PutUint32(name, uint32(tpm2.HandleNull))
+	}
+
+	h := tpm2.HashAlgorithmSHA256.NewHash()
+	h.Write([]byte("AUTH-PCR-POLICY"))
+	h.Write(name)
+
+	return h.Sum(nil)
+}
+
+// computePcrPolicyRefFromCounterContext computes the reference used for authorization of signed PCR policies from the supplied
+// ResourceContext.
+func computePcrPolicyRefFromCounterContext(context tpm2.ResourceContext) tpm2.Nonce {
+	var name tpm2.Name
+	if context != nil {
+		name = context.Name()
+	}
+
+	return computePcrPolicyRefFromCounterName(name)
+}
+
+// computeStaticPolicy computes the part of an authorization policy that is bound to a sealed key object and never changes. The
+// static policy asserts that the following are true:
+// - The signed PCR policy created by computeDynamicPolicy is valid and has been satisfied (by way of a PolicyAuthorize assertion,
+//   which allows the PCR policy to be updated without creating a new sealed key object).
+// - Knowledge of the the authorization value for the entity on which the policy session is used has been demonstrated by the
+//   caller (in SealedKeyObject.UnsealFromTPM where the policy session is used for authorizing unsealing the sealed key object,
+//   this means that the PIN / passhphrase has been provided).
 func computeStaticPolicy(alg tpm2.HashAlgorithmId, input *staticPolicyComputeParams) (*staticPolicyData, tpm2.Digest, error) {
-	trial, _ := tpm2.ComputeAuthPolicy(alg)
-
 	keyName, err := input.key.Name()
 	if err != nil {
 		return nil, nil, xerrors.Errorf("cannot compute name of signing key for dynamic policy authorization: %w", err)
 	}
 
-	pinIndexName, err := input.pinIndexPub.Name()
-	if err != nil {
-		return nil, nil, xerrors.Errorf("cannot compute name of PIN NV index: %w", err)
+	pcrPolicyCounterHandle := tpm2.HandleNull
+	var pcrPolicyCounterName tpm2.Name
+	if input.pcrPolicyCounterPub != nil {
+		pcrPolicyCounterHandle = input.pcrPolicyCounterPub.Index
+		pcrPolicyCounterName, err = input.pcrPolicyCounterPub.Name()
+		if err != nil {
+			return nil, nil, xerrors.Errorf("cannot compute name of PCR policy counter: %w", err)
+		}
 	}
 
-	trial.PolicyAuthorize(nil, keyName)
-	trial.PolicySecret(pinIndexName, nil)
-	trial.PolicyNV(input.lockIndexName, nil, 0, tpm2.OpEq)
+	trial, _ := tpm2.ComputeAuthPolicy(alg)
+	trial.PolicyAuthorize(computePcrPolicyRefFromCounterName(pcrPolicyCounterName), keyName)
+	trial.PolicyAuthValue()
 
 	return &staticPolicyData{
-		AuthPublicKey:        input.key,
-		PinIndexHandle:       input.pinIndexPub.Index,
-		PinIndexAuthPolicies: input.pinIndexAuthPolicies}, trial.GetDigest(), nil
+		authPublicKey:          input.key,
+		pcrPolicyCounterHandle: pcrPolicyCounterHandle}, trial.GetDigest(), nil
 }
 
 // computePolicyORData computes data required to perform a sequence of TPM2_PolicyOR assertions in order to support compound
@@ -550,79 +520,82 @@
 	return data
 }
 
-// computePCRSelectionListFromValues builds a tpm2.PCRSelectionList from the provided map of PCR values.
-func computePCRSelectionListFromValues(v tpm2.PCRValues) (out tpm2.PCRSelectionList) {
-	for alg := range v {
-		s := tpm2.PCRSelection{Hash: alg}
-		for pcr := range v[alg] {
-			s.Select = append(s.Select, pcr)
-		}
-		out = append(out, s)
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Hash < out[j].Hash })
-	return
-}
-
-// computeDynamicPolicy computes the part of an authorization policy associated with a sealed key object that can change and be
-// updated.
-func computeDynamicPolicy(alg tpm2.HashAlgorithmId, input *dynamicPolicyComputeParams) (*dynamicPolicyData, error) {
-	if len(input.pcrValues) == 0 {
-		return nil, errors.New("no PCR values specified")
+// computeDynamicPolicy computes the PCR policy associated with a sealed key object, and can be updated without having to create a
+// new sealed key object as it takes advantage of the PolicyAuthorize assertion. The PCR policy asserts that the following are true:
+// - The selected PCRs contain expected values - ie, one of the sets of permitted values specified by the caller to this function,
+//   indicating that the device is in an expected state. This is done by a single PolicyPCR assertion and then one or more PolicyOR
+//   assertions (depending on how many sets of permitted PCR values there are).
+// - The PCR policy hasn't been revoked. This is done using a PolicyNV assertion to assert that the value of an optional NV counter
+//   is not greater than the expected value.
+// The computed PCR policy digest is signed with the supplied asymmetric key, and the signature of this is validated before executing
+// the corresponding PolicyAuthorize assertion as part of the static policy.
+func computeDynamicPolicy(version uint32, alg tpm2.HashAlgorithmId, input *dynamicPolicyComputeParams) (*dynamicPolicyData, error) {
+	if len(input.pcrDigests) == 0 {
+		return nil, errors.New("no PCR digests specified")
 	}
 
-	// Build a PCRSelectionList from input.pcrValues
-	pcrs := computePCRSelectionListFromValues(input.pcrValues[0])
-
 	// Compute the policy digest that would result from a TPM2_PolicyPCR assertion for each condition
 	var pcrOrDigests tpm2.DigestList
-	for _, v := range input.pcrValues {
-		// We only support a single PCR selection, so ensure that all conditions explicitly define values for the same set of PCRs
-		p := computePCRSelectionListFromValues(v)
-		if !p.Equal(pcrs) {
-			return nil, errors.New("not all combinations of PCR values contain a complete set of values")
-		}
-
-		// Compute PCR digest from the map of PCR values and the computed selection
-		digest, _ := tpm2.ComputePCRDigest(alg, pcrs, v)
-
-		// Execute trial TPM2_PolicyPCR with the computed PCR digest and selection, and save the result
+	for _, d := range input.pcrDigests {
 		trial, _ := tpm2.ComputeAuthPolicy(alg)
-		trial.PolicyPCR(digest, pcrs)
+		trial.PolicyPCR(d, input.pcrs)
 		pcrOrDigests = append(pcrOrDigests, trial.GetDigest())
 	}
 
 	trial, _ := tpm2.ComputeAuthPolicy(alg)
 	pcrOrData := computePolicyORData(alg, trial, pcrOrDigests)
 
-	operandB := make([]byte, 8)
-	binary.BigEndian.PutUint64(operandB, input.policyCount)
-	trial.PolicyNV(input.policyCountIndexName, operandB, 0, tpm2.OpUnsignedLE)
+	if len(input.policyCounterName) > 0 {
+		operandB := make([]byte, 8)
+		binary.BigEndian.PutUint64(operandB, input.policyCount)
+		trial.PolicyNV(input.policyCounterName, operandB, 0, tpm2.OpUnsignedLE)
+	}
 
 	authorizedPolicy := trial.GetDigest()
 
 	// Create a digest to sign
 	h := input.signAlg.NewHash()
 	h.Write(authorizedPolicy)
+	if version > 0 {
+		h.Write(computePcrPolicyRefFromCounterName(input.policyCounterName))
+	}
 
 	// Sign the digest
-	sig, err := rsa.SignPSS(rand.Reader, input.key, input.signAlg.GetHash(), h.Sum(nil), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
-	if err != nil {
-		return nil, xerrors.Errorf("cannot provide signature for initializing NV index: %w", err)
+	var signature tpm2.Signature
+	if version == 0 {
+		sig, err := rsa.SignPSS(rand.Reader, input.key.(*rsa.PrivateKey), input.signAlg.GetHash(), h.Sum(nil),
+			&rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
+		if err != nil {
+			return nil, xerrors.Errorf("cannot provide signature for initializing NV index: %w", err)
+		}
+
+		signature = tpm2.Signature{
+			SigAlg: tpm2.SigSchemeAlgRSAPSS,
+			Signature: tpm2.SignatureU{
+				Data: &tpm2.SignatureRSAPSS{
+					Hash: input.signAlg,
+					Sig:  tpm2.PublicKeyRSA(sig)}}}
+	} else {
+		sigR, sigS, err := ecdsa.Sign(rand.Reader, input.key.(*ecdsa.PrivateKey), h.Sum(nil))
+		if err != nil {
+			return nil, xerrors.Errorf("cannot provide signature for initializing NV index: %w", err)
+		}
+
+		signature = tpm2.Signature{
+			SigAlg: tpm2.SigSchemeAlgECDSA,
+			Signature: tpm2.SignatureU{
+				Data: &tpm2.SignatureECDSA{
+					Hash:       input.signAlg,
+					SignatureR: sigR.Bytes(),
+					SignatureS: sigS.Bytes()}}}
 	}
 
-	signature := tpm2.Signature{
-		SigAlg: tpm2.SigSchemeAlgRSAPSS,
-		Signature: tpm2.SignatureU{
-			Data: &tpm2.SignatureRSAPSS{
-				Hash: input.signAlg,
-				Sig:  tpm2.PublicKeyRSA(sig)}}}
-
 	return &dynamicPolicyData{
-		PCRSelection:              pcrs,
-		PCROrData:                 pcrOrData,
-		PolicyCount:               input.policyCount,
-		AuthorizedPolicy:          authorizedPolicy,
-		AuthorizedPolicySignature: &signature}, nil
+		pcrSelection:              input.pcrs,
+		pcrOrData:                 pcrOrData,
+		policyCount:               input.policyCount,
+		authorizedPolicy:          authorizedPolicy,
+		authorizedPolicySignature: &signature}, nil
 }
 
 type staticPolicyDataError struct {
@@ -707,13 +680,13 @@
 
 // executePolicySession executes an authorization policy session using the supplied metadata. On success, the supplied policy
 // session can be used for authorization.
-func executePolicySession(tpm *tpm2.TPMContext, policySession tpm2.SessionContext, staticInput *staticPolicyData,
+func executePolicySession(tpm *tpm2.TPMContext, policySession tpm2.SessionContext, version uint32, staticInput *staticPolicyData,
 	dynamicInput *dynamicPolicyData, pin string, hmacSession tpm2.SessionContext) error {
-	if err := tpm.PolicyPCR(policySession, nil, dynamicInput.PCRSelection); err != nil {
+	if err := tpm.PolicyPCR(policySession, nil, dynamicInput.pcrSelection); err != nil {
 		return xerrors.Errorf("cannot execute PCR assertion: %w", err)
 	}
 
-	if err := executePolicyORAssertions(tpm, policySession, dynamicInput.PCROrData); err != nil {
+	if err := executePolicyORAssertions(tpm, policySession, dynamicInput.pcrOrData); err != nil {
 		switch {
 		case tpm2.IsTPMError(err, tpm2.AnyErrorCode, tpm2.CommandPolicyGetDigest):
 			return xerrors.Errorf("cannot execute OR assertions: %w", err)
@@ -724,142 +697,171 @@
 		return dynamicPolicyDataError{xerrors.Errorf("cannot complete OR assertions: %w", err)}
 	}
 
-	if staticInput.PinIndexHandle.Type() != tpm2.HandleTypeNVIndex {
-		return staticPolicyDataError{errors.New("invalid handle type for PIN NV index")}
-	}
-	pinIndex, err := tpm.CreateResourceContextFromTPM(staticInput.PinIndexHandle)
-	switch {
-	case tpm2.IsResourceUnavailableError(err, staticInput.PinIndexHandle):
-		// If there is no NV index at the expected handle then the key file is invalid and must be recreated.
-		return staticPolicyDataError{errors.New("no PIN NV index found")}
-	case err != nil:
-		return xerrors.Errorf("cannot obtain context for PIN NV index: %w", err)
-	}
-	pinIndexPub, _, err := tpm.NVReadPublic(pinIndex)
-	if err != nil {
-		return xerrors.Errorf("cannot read public area for PIN NV index: %w", err)
-	}
-	if !pinIndexPub.NameAlg.Supported() {
-		//If the NV index has an unsupported name algorithm, then this key file is invalid and must be recreated.
-		return staticPolicyDataError{errors.New("PIN NV index has an unsupported name algorithm")}
+	pcrPolicyCounterHandle := staticInput.pcrPolicyCounterHandle
+	if (pcrPolicyCounterHandle != tpm2.HandleNull || version == 0) && pcrPolicyCounterHandle.Type() != tpm2.HandleTypeNVIndex {
+		return staticPolicyDataError{errors.New("invalid handle for PCR policy counter")}
 	}
 
-	revocationCheckSession, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, pinIndexPub.NameAlg)
-	if err != nil {
-		return xerrors.Errorf("cannot create session for dynamic authorization policy revocation check: %w", err)
-	}
-	defer tpm.FlushContext(revocationCheckSession)
+	var policyCounter tpm2.ResourceContext
+	if pcrPolicyCounterHandle != tpm2.HandleNull {
+		var err error
+		policyCounter, err = tpm.CreateResourceContextFromTPM(pcrPolicyCounterHandle)
+		switch {
+		case tpm2.IsResourceUnavailableError(err, pcrPolicyCounterHandle):
+			// If there is no NV index at the expected handle then the key file is invalid and must be recreated.
+			return staticPolicyDataError{errors.New("no PCR policy counter found")}
+		case err != nil:
+			return xerrors.Errorf("cannot obtain context for PCR policy counter: %w", err)
+		}
 
-	if err := tpm.PolicyCommandCode(revocationCheckSession, tpm2.CommandPolicyNV); err != nil {
-		return xerrors.Errorf("cannot execute assertion for dynamic authorization policy revocation check: %w", err)
-	}
-	if err := tpm.PolicyOR(revocationCheckSession, staticInput.PinIndexAuthPolicies); err != nil {
-		if tpm2.IsTPMParameterError(err, tpm2.ErrorValue, tpm2.CommandPolicyOR, 1) {
-			// staticInput.PinIndexAuthPolicies is invalid.
-			return staticPolicyDataError{errors.New("authorization policy metadata for PIN NV index is invalid")}
+		var revocationCheckSession tpm2.SessionContext
+		if version == 0 {
+			policyCounterPub, _, err := tpm.NVReadPublic(policyCounter)
+			if err != nil {
+				return xerrors.Errorf("cannot read public area for PCR policy counter: %w", err)
+			}
+			if !policyCounterPub.NameAlg.Supported() {
+				//If the NV index has an unsupported name algorithm, then this key file is invalid and must be recreated.
+				return staticPolicyDataError{errors.New("PCR policy counter has an unsupported name algorithm")}
+			}
+
+			revocationCheckSession, err = tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, policyCounterPub.NameAlg)
+			if err != nil {
+				return xerrors.Errorf("cannot create session for PCR policy revocation check: %w", err)
+			}
+			defer tpm.FlushContext(revocationCheckSession)
+
+			// See the comment for computeV0PinNVIndexPostInitAuthPolicies for a description of the authorization policy
+			// for the v0 NV index. Because the v0 NV index was also used for the PIN, it needed an authorization policy to
+			// permit using the counter value in an assertion without knowing the authorization value of the index.
+			if err := tpm.PolicyCommandCode(revocationCheckSession, tpm2.CommandPolicyNV); err != nil {
+				return xerrors.Errorf("cannot execute assertion for PCR policy revocation check: %w", err)
+			}
+			if err := tpm.PolicyOR(revocationCheckSession, staticInput.v0PinIndexAuthPolicies); err != nil {
+				if tpm2.IsTPMParameterError(err, tpm2.ErrorValue, tpm2.CommandPolicyOR, 1) {
+					// staticInput.v0PinIndexAuthPolicies is invalid.
+					return staticPolicyDataError{errors.New("authorization policy metadata for PCR policy counter is invalid")}
+				}
+				return xerrors.Errorf("cannot execute assertion for PCR policy revocation check: %w", err)
+			}
 		}
-		return xerrors.Errorf("cannot execute assertion for dynamic authorization policy revocation check: %w", err)
-	}
 
-	operandB := make([]byte, 8)
-	binary.BigEndian.PutUint64(operandB, dynamicInput.PolicyCount)
-	if err := tpm.PolicyNV(pinIndex, pinIndex, policySession, operandB, 0, tpm2.OpUnsignedLE, revocationCheckSession); err != nil {
-		switch {
-		case tpm2.IsTPMError(err, tpm2.ErrorPolicy, tpm2.CommandPolicyNV):
-			// The dynamic authorization policy has been revoked.
-			return dynamicPolicyDataError{errors.New("the dynamic authorization policy has been revoked")}
-		case tpm2.IsTPMSessionError(err, tpm2.ErrorPolicyFail, tpm2.CommandPolicyNV, 1):
-			// Either staticInput.PinIndexAuthPolicies is invalid or the NV index isn't what's expected, so the key file is invalid.
-			return staticPolicyDataError{errors.New("invalid PIN NV index or associated authorization policy metadata")}
+		operandB := make([]byte, 8)
+		binary.BigEndian.PutUint64(operandB, dynamicInput.policyCount)
+		if err := tpm.PolicyNV(policyCounter, policyCounter, policySession, operandB, 0, tpm2.OpUnsignedLE, revocationCheckSession); err != nil {
+			switch {
+			case tpm2.IsTPMError(err, tpm2.ErrorPolicy, tpm2.CommandPolicyNV):
+				// The PCR policy has been revoked.
+				return dynamicPolicyDataError{errors.New("the PCR policy has been revoked")}
+			case tpm2.IsTPMSessionError(err, tpm2.ErrorPolicyFail, tpm2.CommandPolicyNV, 1):
+				// Either staticInput.v0PinIndexAuthPolicies is invalid or the NV index isn't what's expected, so the key file is invalid.
+				return staticPolicyDataError{errors.New("invalid PCR policy counter or associated authorization policy metadata")}
+			}
+			return xerrors.Errorf("PCR policy revocation check failed: %w", err)
 		}
-		return xerrors.Errorf("dynamic authorization policy revocation check failed: %w", err)
 	}
 
-	if !staticInput.AuthPublicKey.NameAlg.Supported() {
-		return staticPolicyDataError{errors.New("public area of dynamic authorization policy signature verification key has an unsupported name algorithm")}
+	authPublicKey := staticInput.authPublicKey
+	if !authPublicKey.NameAlg.Supported() {
+		return staticPolicyDataError{errors.New("public area of dynamic authorization policy signing key has an unsupported name algorithm")}
 	}
-	authorizeKey, err := tpm.LoadExternal(nil, staticInput.AuthPublicKey, tpm2.HandleOwner)
+	authorizeKey, err := tpm.LoadExternal(nil, authPublicKey, tpm2.HandleOwner)
 	if err != nil {
 		if tpm2.IsTPMParameterError(err, tpm2.AnyErrorCode, tpm2.CommandLoadExternal, 2) {
 			// staticInput.AuthPublicKey is invalid
-			return staticPolicyDataError{errors.New("public area of dynamic authorization policy signature verification key is invalid")}
+			return staticPolicyDataError{errors.New("public area of dynamic authorization policy signing key is invalid")}
 		}
-		return xerrors.Errorf("cannot load public area for dynamic authorization policy signature verification key: %w", err)
+		return xerrors.Errorf("cannot load public area for dynamic authorization policy signing key: %w", err)
 	}
 	defer tpm.FlushContext(authorizeKey)
 
-	h := staticInput.AuthPublicKey.NameAlg.NewHash()
-	h.Write(dynamicInput.AuthorizedPolicy)
+	var pcrPolicyRef tpm2.Nonce
+	if version > 0 {
+		// The authorized PCR policy signature contains a reference for > v0 metadata, which limits the scope of it for authorizing
+		// PCR policy. In future, the key that authorizes this policy may be used to authorize other policy digests for the purposes of,
+		// eg, recovery with a signed assertion.
+		pcrPolicyRef = computePcrPolicyRefFromCounterContext(policyCounter)
+	}
+
+	h := authPublicKey.NameAlg.NewHash()
+	h.Write(dynamicInput.authorizedPolicy)
+	h.Write(pcrPolicyRef)
 
-	authorizeTicket, err := tpm.VerifySignature(authorizeKey, h.Sum(nil), dynamicInput.AuthorizedPolicySignature)
+	authorizeTicket, err := tpm.VerifySignature(authorizeKey, h.Sum(nil), dynamicInput.authorizedPolicySignature)
 	if err != nil {
 		if tpm2.IsTPMParameterError(err, tpm2.AnyErrorCode, tpm2.CommandVerifySignature, 2) {
-			// dynamicInput.AuthorizedPolicySignature is invalid.
-			return dynamicPolicyDataError{errors.New("cannot verify dynamic authorization policy signature")}
+			// dynamicInput.AuthorizedPolicySignature or the computed policy ref is invalid.
+			// XXX: It's not possible to determine whether this is broken dynamic or static metadata -
+			//  we should just do away with the distinction here tbh
+			return dynamicPolicyDataError{errors.New("cannot verify PCR policy signature")}
 		}
-		return xerrors.Errorf("cannot verify dynamic authorization policy signature: %w", err)
+		return xerrors.Errorf("cannot verify PCR policy signature: %w", err)
 	}
 
-	if err := tpm.PolicyAuthorize(policySession, dynamicInput.AuthorizedPolicy, nil, authorizeKey.Name(), authorizeTicket); err != nil {
+	if err := tpm.PolicyAuthorize(policySession, dynamicInput.authorizedPolicy, pcrPolicyRef, authorizeKey.Name(), authorizeTicket); err != nil {
 		if tpm2.IsTPMParameterError(err, tpm2.ErrorValue, tpm2.CommandPolicyAuthorize, 1) {
 			// dynamicInput.AuthorizedPolicy is invalid.
-			return dynamicPolicyDataError{errors.New("the dynamic authorization policy is invalid")}
+			return dynamicPolicyDataError{errors.New("the PCR policy is invalid")}
 		}
-		return xerrors.Errorf("dynamic authorization policy check failed: %w", err)
+		return xerrors.Errorf("PCR policy check failed: %w", err)
 	}
 
-	pinIndex.SetAuthValue([]byte(pin))
-	if _, _, err := tpm.PolicySecret(pinIndex, policySession, nil, nil, 0, hmacSession); err != nil {
-		return xerrors.Errorf("cannot execute PolicySecret assertion: %w", err)
+	if version == 0 {
+		// For metadata version 0, PIN support is implemented by asserting knowlege of the authorization value
+		// for the PCR policy counter.
+		policyCounter.SetAuthValue([]byte(pin))
+		if _, _, err := tpm.PolicySecret(policyCounter, policySession, nil, nil, 0, hmacSession); err != nil {
+			return xerrors.Errorf("cannot execute PolicySecret assertion: %w", err)
+		}
+	} else {
+		// For metadata versions > 0, PIN support is implemented by requiring knowlege of the authorization value for
+		// the sealed key object when this policy session is used to unseal it.
+		if err := tpm.PolicyAuthValue(policySession); err != nil {
+			return xerrors.Errorf("cannot execute PolicyAuthValue assertion: %w", err)
+		}
 	}
 
-	lockIndex, err := tpm.CreateResourceContextFromTPM(lockNVHandle)
-	if err != nil {
-		return xerrors.Errorf("cannot obtain context for lock NV index: %w", err)
-	}
-	if err := tpm.PolicyNV(lockIndex, lockIndex, policySession, nil, 0, tpm2.OpEq, hmacSession); err != nil {
-		return xerrors.Errorf("policy lock check failed: %w", err)
+	if version == 0 {
+		// Execute required TPM2_PolicyNV assertion that was used for legacy locking with v0 files -
+		// this is only here because the existing policy for v0 files requires it. It is not expected that
+		// this will fail unless the NV index has been removed or altered, at which point the key is
+		// non-recoverable anyway.
+		index, err := tpm.CreateResourceContextFromTPM(lockNVHandle)
+		if err != nil {
+			return xerrors.Errorf("cannot obtain context for lock NV index: %w", err)
+		}
+		if err := tpm.PolicyNV(index, index, policySession, nil, 0, tpm2.OpEq, nil); err != nil {
+			return xerrors.Errorf("policy lock check failed: %w", err)
+		}
 	}
 
 	return nil
 }
 
-// LockAccessToSealedKeys locks access to keys sealed by this package until the next TPM restart (equivalent to eg, system resume
-// from suspend-to-disk) or TPM reset (equivalent to booting after a system restart). This works for all keys sealed by this package
-// regardless of their PCR protection profile.
+// BlockPCRProtectionPolicies inserts a fence in to the specific PCRs for all active PCR banks, in order to
+// make PCR policies that depend on the specified PCRs and are satisfiable by the current PCR values invalid
+// until the next TPM restart (equivalent to eg, system resume from suspend-to-disk) or TPM reset
+// (equivalent to booting after a system reset).
 //
-// On success, subsequent calls to SealedKeyObject.UnsealFromTPM will fail with a ErrSealedKeyAccessLocked error until the next TPM
-// restart or TPM reset.
-func LockAccessToSealedKeys(tpm *TPMConnection) error {
+// This acts as a barrier between the environment in which a sealed key should be permitted to be unsealed
+// (eg, the initramfs), and the environment in which a sealed key should not be permitted to be unsealed
+// (eg, the OS runtime).
+func BlockPCRProtectionPolicies(tpm *TPMConnection, pcrs []int) error {
 	session := tpm.HmacSession()
 
-	handles, err := tpm.GetCapabilityHandles(lockNVHandle, 1, session.IncludeAttrs(tpm2.AttrAudit))
-	if err != nil {
-		return xerrors.Errorf("cannot obtain handles from TPM: %w", err)
-	}
-	if len(handles) == 0 || handles[0] != lockNVHandle {
-		// Not provisioned, so no keys created by this package can be unsealed by this TPM
-		return nil
-	}
-	lock, err := tpm.CreateResourceContextFromTPM(lockNVHandle)
-	if err != nil {
-		return xerrors.Errorf("cannot obtain context for lock NV index: %w", err)
-	}
-	lockPublic, _, err := tpm.NVReadPublic(lock, session.IncludeAttrs(tpm2.AttrAudit))
-	if err != nil {
-		return xerrors.Errorf("cannot read public area of lock NV index: %w", err)
-	}
-	if lockPublic.Attrs != lockNVIndexAttrs|tpm2.AttrNVWritten {
-		// Definitely not an index created by us, so no keys created by this package can be unsealed by this TPM.
-		return nil
-	}
-	if err := tpm.NVReadLock(lock, lock, session); err != nil {
-		if isAuthFailError(err, tpm2.CommandNVReadLock, 1) {
-			// The index has an authorization value, so it wasn't created by this package and no keys created by this package can be unsealed
-			// by this TPM.
-			return nil
+	// The fence is a hash of uint32(0), which is the same as EV_SEPARATOR (which can be uint32(0) or uint32(-1))
+	fence := make([]byte, 4)
+
+	// Insert PCR fence
+	for _, pcr := range pcrs {
+		seq, err := tpm.HashSequenceStart(nil, tpm2.HashAlgorithmNull)
+		if err != nil {
+			return xerrors.Errorf("cannot being hash sequence: %w", err)
+		}
+		if _, err := tpm.EventSequenceExecute(tpm.PCRHandleContext(pcr), seq, fence, session, nil); err != nil {
+			return xerrors.Errorf("cannot execute hash sequence: %w", err)
 		}
-		return xerrors.Errorf("cannot lock NV index for reading: %w", err)
 	}
+
 	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/provisioning.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/provisioning.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/provisioning.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/provisioning.go	2020-11-05 20:13:01.000000000 +0000
@@ -20,11 +20,12 @@
 package secboot
 
 import (
-	"bytes"
+	"errors"
 	"fmt"
 	"os"
 
 	"github.com/canonical/go-tpm2"
+	"github.com/snapcore/secboot/internal/tcg"
 
 	"golang.org/x/xerrors"
 )
@@ -42,47 +43,22 @@
 	lockoutRecovery uint32 = 86400
 )
 
-// ProvisionStatusAttributes correspond to the state of the TPM with regards to provisioning for full disk encryption.
-type ProvisionStatusAttributes int
-
-const (
-	// AttrValidSRK indicates that the TPM contains a valid primary storage key with the expected properties at the
-	// expected location. Note that this does not mean that the object was created with the same template that ProvisionTPM
-	// uses, and is no guarantee that a call to ProvisionTPM wouldn't result in a different key being created.
-	AttrValidSRK ProvisionStatusAttributes = 1 << iota
-
-	// AttrValidEK indicates that the TPM contains a valid endorsement key at the expected location. On a TPMConnection created
-	// with SecureConnectToDefaultTPM, it means that the TPM contains the key associated with the verified endorsement certificate.
-	// On a TPMConnection created with ConnectToDefaultTPM, it means that the TPM contains a valid primary key with the expected
-	// properties at the expected location, but does not mean that the object was created with the the same template that
-	// ProvisionTPM uses, and is no guarantee that a call to ProvisionTPM wouldn't result in a different key being created.
-	AttrValidEK
-
-	AttrDAParamsOK         // The dictionary attack lockout parameters are configured correctly.
-	AttrOwnerClearDisabled // The ability to clear the TPM with owner authorization is disabled.
-
-	// AttrLockoutAuthSet indicates that the lockout hierarchy has an authorization value defined. This
-	// doesn't necessarily mean that the authorization value is the same one that was originally provided
-	// to ProvisionTPM - it could have been changed outside of our control.
-	AttrLockoutAuthSet
-
-	AttrValidLockNVIndex // The TPM has a valid NV index used for locking access to keys sealed with SealKeyToTPM
-)
-
-// ProvisionMode is used to control the behaviour of ProvisionTPM.
+// ProvisionMode is used to control the behaviour of TPMConnection.EnsureProvisioned.
 type ProvisionMode int
 
 const (
-	// ProvisionModeClear specifies that the TPM should be fully provisioned after clearing it.
-	ProvisionModeClear ProvisionMode = iota
-
-	// ProvisionModeWithoutLockout specifies that the TPM should be refreshed without performing operations that require knowledge of
-	// the lockout hierarchy authorization value. Operations that won't be performed in this mode are disabling owner clear, configuring
-	// the dictionary attack parameters and setting the authorization value for the lockout hierarchy.
-	ProvisionModeWithoutLockout
+	// ProvisionModeWithoutLockout specifies that the TPM should be refreshed without performing operations that require the use of the
+	// lockout hierarchy. Operations that won't be performed in this mode are disabling owner clear, configuring the dictionary attack
+	// parameters, and setting the authorization value for the lockout hierarchy.
+	ProvisionModeWithoutLockout ProvisionMode = iota
 
-	// ProvisionModeFull specifies that the TPM should be fully provisioned without clearing it.
+	// ProvisionModeFull specifies that the TPM should be fully provisioned without clearing it. This requires use of the lockout
+	// hierarchy.
 	ProvisionModeFull
+
+	// ProvisionModeClear specifies that the TPM should be fully provisioned after clearing it. This requires use of the lockout
+	// hierarchy.
+	ProvisionModeClear
 )
 
 func provisionPrimaryKey(tpm *tpm2.TPMContext, hierarchy tpm2.ResourceContext, template *tpm2.Public, handle tpm2.Handle, session tpm2.SessionContext) (tpm2.ResourceContext, error) {
@@ -114,62 +90,63 @@
 	return obj, nil
 }
 
-// ProvisionTPM prepares the TPM associated with the tpm parameter for full disk encryption. The mode parameter specifies the
-// behaviour of this function.
+// EnsureProvisioned prepares the TPM for full disk encryption. The mode parameter specifies the behaviour of this function.
 //
 // If mode is ProvisionModeClear, this function will attempt to clear the TPM before provisioning it. If owner clear has been
 // disabled (which will be the case if the TPM has previously been provisioned with this function), then ErrTPMClearRequiresPPI
 // will be returned. In this case, the TPM must be cleared via the physical presence interface by calling RequestTPMClearUsingPPI
-// and performing a system restart.
+// and performing a system restart. Note that clearing the TPM makes all previously sealed keys permanently unrecoverable. This
+// mode should normally be used when resetting a device to factory settings (ie, performing a new installation).
 //
-// If mode is ProvisionModeClear or ProvisionModeFull then the authorization value for the lockout hierarchy will be set to
-// newLockoutAuth, owner clear will be disabled, and the parameters of the TPM's dictionary attack logic will be configured. These
-// operations require knowledge of the lockout hierarchy authorization value, which must be provided by calling
+// If mode is ProvisionModeClear or ProvisionModeFull, then the authorization value for the lockout hierarchy will be set to
+// newLockoutAuth, owner clear will be disabled, and the parameters of the TPM's dictionary attack logic will be configured to
+// appropriate values.
+//
+// If mode is ProvisionModeClear or ProvisionModeFull, this function performs operations that require the use of the lockout
+// hierarchy (detailed above), and knowledge of the lockout hierarchy's authorization value. This must be provided by calling
 // TPMConnection.LockoutHandleContext().SetAuthValue() prior to this call. If the wrong lockout hierarchy authorization value is
 // provided, then a AuthFailError error will be returned. If this happens, the TPM will have entered dictionary attack lockout mode
 // for the lockout hierarchy. Further calls will result in a ErrTPMLockout error being returned. The only way to recover from this is
 // to either wait for the pre-programmed recovery time to expire, or to clear the TPM via the physical presence interface by calling
-// RequestTPMClearUsingPPI. If the lockout hierarchy authorization value is not known or the caller wants to skip the operations that
-// require use of the lockout hierarchy, then mode can be set to ProvisionModeWithoutLockout.
+// RequestTPMClearUsingPPI. If the lockout hierarchy authorization value is not known then mode should be set to
+// ProvisionModeWithoutLockout, with the caveat that this mode cannot fully provision the TPM.
 //
-// If mode is ProvisionModeFull or ProvisionModeWithoutLockout, this function performs operations that require knowledge of the
-// storage and endorsement hierarchies (creation of primary keys and NV indices, detailed below). Whilst these will be empty after
-// clearing the TPM, if they have been set since clearing the TPM then they will need to be provided by calling
-// TPMConnection.EndorsementHandleContext().SetAuthValue() and TPMConnection.OwnerHandleContext().SetAuthValue() prior to calling
-// this function. If the wrong value is provided for either authorization, then a AuthFailError error will be returned. If the correct
-// authorization values are not known, then the only way to recover from this is to clear the TPM either by calling this function with
-// mode set to ProvisionModeClear, or by using the physical presence interface.
+// If mode is ProvisionModeFull or ProvisionModeWithoutLockout, this function will not affect the ability to recover sealed keys that
+// can currently be recovered.
 //
 // In all modes, this function will create and persist both a storage root key and an endorsement key. Both of these will be created
 // using the RSA templates defined in and persisted at the handles specified in the "TCG EK Credential Profile for TPM Family 2.0"
 // and "TCG TPM v2.0 Provisioning Guidance" specifications. If there are any objects already stored at the locations required for
-// either primary key, then this function will evict them automatically from the TPM.
+// either primary key, then this function will evict them automatically from the TPM. These operations both require the use of the
+// storage and endorsement hierarchies. If mode is ProvisionModeFull or ProvisionModeWithoutLockout, then knowledge of the
+// authorization values for these hierarchies is required. Whilst these will be empty after clearing the TPM, if they have been set
+// since clearing the TPM then they will need to be provided by calling TPMConnection.EndorsementHandleContext().SetAuthValue() and
+// TPMConnection.OwnerHandleContext().SetAuthValue() prior to calling this function. If the wrong value is provided for either
+// authorization, then a AuthFailError error will be returned. If the correct authorization values are not known, then the only way
+// to recover from this is to clear the TPM either by calling this function with mode set to ProvisionModeClear (and providing the
+// correct authorization value for the lockout hierarchy), or by using the physical presence interface.
 //
-// In all modes, this function will also create a pair of NV indices used for locking access to sealed key objects, if necessary.
-// These indices will be created at handles 0x01801100 and 0x01801101. If there are already NV indices defined at either of the
-// required handles but they don't meet the requirements of this function, a TPMResourceExistsError error will be returned. In this
-// case, the caller will either need to manually undefine these using TPMConnection.NVUndefineSpace, or clear the TPM.
-func ProvisionTPM(tpm *TPMConnection, mode ProvisionMode, newLockoutAuth []byte) error {
-	status, err := ProvisionStatus(tpm)
-	if err != nil {
-		return xerrors.Errorf("cannot determine the current TPM status: %w", err)
-	}
+// If mode is ProvisionModeWithoutLockout but the TPM indicates that use of the lockout hierarchy is required to fully provision the
+// TPM (eg, to disable owner clear, set the lockout hierarchy authorization value or configure the DA lockout parameters), then a
+// ErrTPMProvisioningRequiresLockout error will be returned. In this scenario, the function will complete all operations that can be
+// completed without using the lockout hierarchy, but the function should be called again either with mode set to ProvisionModeFull
+// (if the authorization value for the lockout hierarchy is known), or ProvisionModeClear.
+func (t *TPMConnection) EnsureProvisioned(mode ProvisionMode, newLockoutAuth []byte) error {
+	session := t.HmacSession()
 
-	// Create an initial session for HMAC authorizations
-	session, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypeHMAC, nil, defaultSessionHashAlgorithm, nil)
+	props, err := t.GetCapabilityTPMProperties(tpm2.PropertyPermanent, 1, session.IncludeAttrs(tpm2.AttrAudit))
 	if err != nil {
-		return xerrors.Errorf("cannot start session: %w", err)
+		return xerrors.Errorf("cannot fetch permanent properties: %w", err)
+	}
+	if props[0].Property != tpm2.PropertyPermanent {
+		return errors.New("TPM returned value for the wrong property")
 	}
-	defer tpm.FlushContext(session)
-
-	session.SetAttrs(tpm2.AttrContinueSession)
-
 	if mode == ProvisionModeClear {
-		if status&AttrOwnerClearDisabled > 0 {
+		if tpm2.PermanentAttributes(props[0].Value)&tpm2.AttrDisableClear > 0 {
 			return ErrTPMClearRequiresPPI
 		}
 
-		if err := tpm.Clear(tpm.LockoutHandleContext(), session); err != nil {
+		if err := t.Clear(t.LockoutHandleContext(), session); err != nil {
 			switch {
 			case isAuthFailError(err, tpm2.CommandClear, 1):
 				return AuthFailError{tpm2.HandleLockout}
@@ -178,12 +155,10 @@
 			}
 			return xerrors.Errorf("cannot clear the TPM: %w", err)
 		}
-
-		status = 0
 	}
 
 	// Provision an endorsement key
-	if _, err := provisionPrimaryKey(tpm.TPMContext, tpm.EndorsementHandleContext(), ekTemplate, ekHandle, session); err != nil {
+	if _, err := provisionPrimaryKey(t.TPMContext, t.EndorsementHandleContext(), tcg.EKTemplate, tcg.EKHandle, session); err != nil {
 		switch {
 		case isAuthFailError(err, tpm2.CommandEvictControl, 1):
 			return AuthFailError{tpm2.HandleOwner}
@@ -194,20 +169,19 @@
 		}
 	}
 
-	// Close the existing session and create a new session that's salted with a value protected with the newly provisioned EK.
+	// Reinitialize the connection, which creates a new session that's salted with a value protected with the newly provisioned EK.
 	// This will have a symmetric algorithm for parameter encryption during HierarchyChangeAuth.
-	tpm.FlushContext(session)
-	if err := tpm.init(); err != nil {
+	if err := t.init(); err != nil {
 		var verifyErr verificationError
 		if xerrors.As(err, &verifyErr) {
 			return TPMVerificationError{fmt.Sprintf("cannot reinitialize TPM connection after provisioning endorsement key: %v", err)}
 		}
 		return xerrors.Errorf("cannot reinitialize TPM connection after provisioning endorsement key: %w", err)
 	}
-	session = tpm.HmacSession()
+	session = t.HmacSession()
 
 	// Provision a storage root key
-	srk, err := provisionPrimaryKey(tpm.TPMContext, tpm.OwnerHandleContext(), srkTemplate, srkHandle, session)
+	srk, err := provisionPrimaryKey(t.TPMContext, t.OwnerHandleContext(), tcg.SRKTemplate, tcg.SRKHandle, session)
 	if err != nil {
 		switch {
 		case isAuthFailError(err, tpm2.AnyCommandCode, 1):
@@ -216,25 +190,39 @@
 			return xerrors.Errorf("cannot provision storage root key: %w", err)
 		}
 	}
-	tpm.provisionedSrk = srk
+	t.provisionedSrk = srk
 
-	// Provision a lock NV index
-	if err := ensureLockNVIndex(tpm.TPMContext, session); err != nil {
-		var e *tpmErrorWithHandle
-		if tpm2.IsTPMError(err, tpm2.ErrorNVDefined, tpm2.AnyCommandCode) && xerrors.As(err, &e) {
-			return TPMResourceExistsError{e.handle}
+	if mode == ProvisionModeWithoutLockout {
+		props, err := t.GetCapabilityTPMProperties(tpm2.PropertyPermanent, 1, session.IncludeAttrs(tpm2.AttrAudit))
+		if err != nil {
+			return xerrors.Errorf("cannot fetch permanent properties to determine if lockout hierarchy is required: %w", err)
+		}
+		if props[0].Property != tpm2.PropertyPermanent {
+			return errors.New("TPM returned value for the wrong property")
+		}
+		required := tpm2.AttrLockoutAuthSet | tpm2.AttrDisableClear
+		if tpm2.PermanentAttributes(props[0].Value)&required != required {
+			return ErrTPMProvisioningRequiresLockout
+		}
+
+		props, err = t.GetCapabilityTPMProperties(tpm2.PropertyMaxAuthFail, 3, session.IncludeAttrs(tpm2.AttrAudit))
+		if err != nil {
+			return xerrors.Errorf("cannot fetch DA parameters to determine if lockout hierarchy is required: %w", err)
+		}
+		if props[0].Property != tpm2.PropertyMaxAuthFail || props[1].Property != tpm2.PropertyLockoutInterval || props[2].Property != tpm2.PropertyLockoutRecovery {
+			return errors.New("TPM returned values for the wrong properties")
+		}
+		if props[0].Value > maxTries || props[1].Value < recoveryTime || props[2].Value < lockoutRecovery {
+			return ErrTPMProvisioningRequiresLockout
 		}
-		return xerrors.Errorf("cannot create lock NV index: %w", err)
-	}
 
-	if mode == ProvisionModeWithoutLockout {
 		return nil
 	}
 
 	// Perform actions that require the lockout hierarchy authorization.
 
 	// Set the DA parameters.
-	if err := tpm.DictionaryAttackParameters(tpm.LockoutHandleContext(), maxTries, recoveryTime, lockoutRecovery, session); err != nil {
+	if err := t.DictionaryAttackParameters(t.LockoutHandleContext(), maxTries, recoveryTime, lockoutRecovery, session); err != nil {
 		switch {
 		case isAuthFailError(err, tpm2.CommandDictionaryAttackParameters, 1):
 			return AuthFailError{tpm2.HandleLockout}
@@ -245,14 +233,13 @@
 	}
 
 	// Disable owner clear
-	if err := tpm.ClearControl(tpm.LockoutHandleContext(), true, session); err != nil {
+	if err := t.ClearControl(t.LockoutHandleContext(), true, session); err != nil {
 		// Lockout auth failure or lockout mode would have been caught by DictionaryAttackParameters
 		return xerrors.Errorf("cannot disable owner clear: %w", err)
 	}
 
 	// Set the lockout hierarchy authorization.
-	if err := tpm.HierarchyChangeAuth(tpm.LockoutHandleContext(), tpm2.Auth(newLockoutAuth),
-		session.IncludeAttrs(tpm2.AttrCommandEncrypt)); err != nil {
+	if err := t.HierarchyChangeAuth(t.LockoutHandleContext(), newLockoutAuth, session.IncludeAttrs(tpm2.AttrCommandEncrypt)); err != nil {
 		return xerrors.Errorf("cannot set the lockout hierarchy authorization value: %w", err)
 	}
 
@@ -275,81 +262,3 @@
 
 	return nil
 }
-
-// ProvisionStatus returns the provisioning status for the specified TPM.
-func ProvisionStatus(tpm *TPMConnection) (ProvisionStatusAttributes, error) {
-	var out ProvisionStatusAttributes
-
-	session := tpm.HmacSession().IncludeAttrs(tpm2.AttrAudit)
-
-	ek, err := tpm.CreateResourceContextFromTPM(ekHandle, session)
-	switch {
-	case err != nil && !tpm2.IsResourceUnavailableError(err, ekHandle):
-		// Unexpected error
-		return 0, err
-	case tpm2.IsResourceUnavailableError(err, ekHandle):
-		// Nothing to do
-	default:
-		if ekInit, err := tpm.EndorsementKey(); err == nil && bytes.Equal(ekInit.Name(), ek.Name()) {
-			out |= AttrValidEK
-		}
-	}
-
-	srk, err := tpm.CreateResourceContextFromTPM(srkHandle, session)
-	switch {
-	case err != nil && !tpm2.IsResourceUnavailableError(err, srkHandle):
-		// Unexpected error
-		return 0, err
-	case tpm2.IsResourceUnavailableError(err, srkHandle):
-		// Nothing to do
-	case tpm.provisionedSrk != nil:
-		// ProvisionTPM has been called with this TPMConnection. Make sure it's the same object
-		if bytes.Equal(tpm.provisionedSrk.Name(), srk.Name()) {
-			out |= AttrValidSRK
-		}
-	default:
-		// ProvisionTPM hasn't been called with this TPMConnection, but there is an object at srkHandle. Make sure it looks like a storage
-		// primary key.
-		ok, err := isObjectPrimaryKeyWithTemplate(tpm.TPMContext, tpm.OwnerHandleContext(), srk, srkTemplate, tpm.HmacSession())
-		switch {
-		case err != nil:
-			return 0, xerrors.Errorf("cannot determine if object at %v is a primary key in the storage hierarchy: %w", srkHandle, err)
-		case ok:
-			out |= AttrValidSRK
-		}
-	}
-
-	props, err := tpm.GetCapabilityTPMProperties(tpm2.PropertyMaxAuthFail, 3)
-	if err != nil {
-		return 0, xerrors.Errorf("cannot fetch DA parameters: %w", err)
-	}
-	if props[0].Value <= maxTries && props[1].Value >= recoveryTime && props[2].Value >= lockoutRecovery {
-		out |= AttrDAParamsOK
-	}
-
-	props, err = tpm.GetCapabilityTPMProperties(tpm2.PropertyPermanent, 1)
-	if err != nil {
-		return 0, xerrors.Errorf("cannot fetch permanent properties: %w", err)
-	}
-	if tpm2.PermanentAttributes(props[0].Value)&tpm2.AttrDisableClear > 0 {
-		out |= AttrOwnerClearDisabled
-	}
-	if tpm2.PermanentAttributes(props[0].Value)&tpm2.AttrLockoutAuthSet > 0 {
-		out |= AttrLockoutAuthSet
-	}
-
-	lockIndex, err := tpm.CreateResourceContextFromTPM(lockNVHandle, session)
-	switch {
-	case err != nil && !tpm2.IsResourceUnavailableError(err, lockNVHandle):
-		// Unexpected error
-		return 0, err
-	case tpm2.IsResourceUnavailableError(err, lockNVHandle):
-		// Nothing to do
-	default:
-		if _, err := readAndValidateLockNVIndexPublic(tpm.TPMContext, lockIndex, session); err == nil {
-			out |= AttrValidLockNVIndex
-		}
-	}
-
-	return out, nil
-}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/rootcerts.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/rootcerts.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/rootcerts.go	2020-04-06 18:31:36.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/rootcerts.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-package secboot
-
-var (
-	rootCAHashes = [][]byte{
-		[]byte{0x27, 0x82, 0xe5, 0x1a, 0x95, 0xe8, 0x6d, 0x95, 0x57, 0xfe, 0x42, 0x04, 0x31, 0x6c, 0xf8, 0x05, 0xbd, 0x6f, 0x58, 0x98, 0xf8, 0x1f, 0x97, 0x32, 0xe9, 0x44, 0xd7, 0x42, 0xbc, 0xdc, 0x5f, 0x54},
-		[]byte{0xe3, 0x8c, 0x28, 0x0f, 0x7c, 0x0e, 0x0b, 0x49, 0xf3, 0x1e, 0xfc, 0x75, 0x31, 0x03, 0x2b, 0xb6, 0xa8, 0x6c, 0x3f, 0xba, 0x4e, 0xb8, 0x9b, 0xeb, 0x1d, 0x51, 0x0e, 0xaa, 0x45, 0x10, 0xae, 0x4a},
-		[]byte{0x4a, 0xeb, 0xe7, 0x7a, 0x51, 0xed, 0x29, 0x95, 0x9a, 0x7f, 0x9f, 0x5e, 0x07, 0xa2, 0x4a, 0x55, 0x8d, 0xee, 0x81, 0x67, 0xf3, 0x98, 0x5d, 0x72, 0x49, 0x95, 0xa5, 0x41, 0xc2, 0x58, 0xdf, 0xda},
-		[]byte{0xcd, 0x81, 0x85, 0xff, 0x89, 0x95, 0xed, 0x09, 0x81, 0x19, 0x70, 0x09, 0x0a, 0x8c, 0x36, 0xfa, 0xfa, 0xb3, 0x4e, 0xf8, 0x7f, 0x47, 0xfa, 0x51, 0xfd, 0xb9, 0xec, 0xf9, 0x5c, 0x9c, 0x2e, 0x04},
-		[]byte{0x89, 0x9e, 0x35, 0x47, 0x4c, 0x98, 0x07, 0xeb, 0x4c, 0x7f, 0x2f, 0x7a, 0x12, 0xda, 0x00, 0x28, 0xfb, 0x25, 0x0c, 0xd0, 0x21, 0x54, 0xd0, 0x00, 0x9f, 0xca, 0x7d, 0x9c, 0x66, 0x57, 0x4f, 0x3b},
-		[]byte{0xf8, 0xe3, 0x7a, 0x86, 0xb6, 0x89, 0xa2, 0x0a, 0x6c, 0xc0, 0xc4, 0x0c, 0xc3, 0xf8, 0x1f, 0xb1, 0x30, 0xfa, 0x9f, 0x44, 0xce, 0x7f, 0xfa, 0x60, 0xd6, 0x25, 0x90, 0xaa, 0xf8, 0x72, 0x73, 0xa9},
-	}
-)
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/run-tests snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/run-tests
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/run-tests	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/run-tests	2020-10-01 09:24:52.000000000 +0000
@@ -1,7 +1,6 @@
 #!/bin/sh -e
 
 WITH_MSSIM=0
-TPM_SIMULATOR=
 MSSIM_ARGS=
 
 while [ $# -gt 0 ]; do
@@ -21,20 +20,8 @@
 done
 
 if [ $WITH_MSSIM -eq 1 ]; then
-        for s in tpm2-simulator tpm2-simulator-chrisccoulson.tpm2-simulator; do
-                if TPM_SIMULATOR=$(which ${s}); then
-                        break
-                fi
-        done
-
-        if [ -z $TPM_SIMULATOR ]; then
-                echo "Cannot find a TPM simulator"
-                exit 1
-        fi
-
-        $TPM_SIMULATOR -m >/dev/null &
         MSSIM_ARGS=-use-mssim
 fi
 
 
-go test -v -race ./... -args -check.v $MSSIM_ARGS $@
+go test -v -race -p 1 ./... -args -check.v $MSSIM_ARGS $@
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/sdefistub_policy.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/sdefistub_policy.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/sdefistub_policy.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/sdefistub_policy.go	2020-11-05 20:13:01.000000000 +0000
@@ -24,7 +24,7 @@
 	"errors"
 
 	"github.com/canonical/go-tpm2"
-	"github.com/chrisccoulson/tcglog-parser"
+	"github.com/canonical/tcglog-parser"
 
 	"golang.org/x/xerrors"
 )
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/seal.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/seal.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/seal.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/seal.go	2020-11-05 20:13:01.000000000 +0000
@@ -20,15 +20,18 @@
 package secboot
 
 import (
+	"bytes"
 	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
 	"errors"
 	"fmt"
 	"os"
 
 	"github.com/canonical/go-tpm2"
+	"github.com/canonical/go-tpm2/mu"
+	"github.com/snapcore/secboot/internal/tcg"
 
 	"golang.org/x/xerrors"
 )
@@ -41,36 +44,70 @@
 		Params:  tpm2.PublicParamsU{Data: &tpm2.KeyedHashParams{Scheme: tpm2.KeyedHashScheme{Scheme: tpm2.KeyedHashSchemeNull}}}}
 }
 
-func computeSealedKeyDynamicAuthPolicy(tpm *tpm2.TPMContext, alg, signAlg tpm2.HashAlgorithmId, authKey *rsa.PrivateKey,
-	countIndexPub *tpm2.NVPublic, countIndexAuthPolicies tpm2.DigestList, pcrProfile *PCRProtectionProfile,
+func computeSealedKeyDynamicAuthPolicy(tpm *tpm2.TPMContext, version uint32, alg, signAlg tpm2.HashAlgorithmId, authKey crypto.PrivateKey,
+	counterPub *tpm2.NVPublic, counterAuthPolicies tpm2.DigestList, pcrProfile *PCRProtectionProfile,
 	session tpm2.SessionContext) (*dynamicPolicyData, error) {
-	// Obtain the count for the new dynamic authorization policy
-	nextPolicyCount, err := readDynamicPolicyCounter(tpm, countIndexPub, countIndexAuthPolicies, session)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot read dynamic policy counter: %w", err)
+	// Obtain the count for the new policy
+	var nextPolicyCount uint64
+	var counterName tpm2.Name
+	if counterPub != nil {
+		var err error
+		nextPolicyCount, err = readPcrPolicyCounter(tpm, version, counterPub, counterAuthPolicies, session)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot read policy counter: %w", err)
+		}
+		nextPolicyCount += 1
+
+		counterName, err = counterPub.Name()
+		if err != nil {
+			return nil, xerrors.Errorf("cannot compute name of policy counter: %w", err)
+		}
 	}
-	nextPolicyCount += 1
 
-	countIndexName, _ := countIndexPub.Name()
+	supportedPcrs, err := tpm.GetCapabilityPCRs(session.IncludeAttrs(tpm2.AttrAudit))
 	if err != nil {
-		return nil, xerrors.Errorf("cannot compute name of dynamic policy counter: %w", err)
+		return nil, xerrors.Errorf("cannot determine supported PCRs: %w", err)
 	}
 
 	// Compute PCR digests
-	pcrValues, err := pcrProfile.computePCRValues(tpm, nil)
+	pcrs, pcrDigests, err := pcrProfile.computePCRDigests(tpm, alg)
 	if err != nil {
-		return nil, xerrors.Errorf("cannot compute PCR values from protection profile: %w", err)
+		return nil, xerrors.Errorf("cannot compute PCR digests from protection profile: %w", err)
+	}
+
+	for _, p := range pcrs {
+		for _, s := range p.Select {
+			found := false
+			for _, p2 := range supportedPcrs {
+				if p2.Hash != p.Hash {
+					continue
+				}
+				for _, s2 := range p2.Select {
+					if s2 == s {
+						found = true
+						break
+					}
+				}
+				if found {
+					break
+				}
+			}
+			if !found {
+				return nil, errors.New("PCR protection profile contains digests for unsupported PCRs")
+			}
+		}
 	}
 
 	// Use the PCR digests and NV index names to generate a single signed dynamic authorization policy digest
 	policyParams := dynamicPolicyComputeParams{
-		key:                  authKey,
-		signAlg:              signAlg,
-		pcrValues:            pcrValues,
-		policyCountIndexName: countIndexName,
-		policyCount:          nextPolicyCount}
+		key:               authKey,
+		signAlg:           signAlg,
+		pcrs:              pcrs,
+		pcrDigests:        pcrDigests,
+		policyCounterName: counterName,
+		policyCount:       nextPolicyCount}
 
-	policyData, err := computeDynamicPolicy(alg, &policyParams)
+	policyData, err := computeDynamicPolicy(version, alg, &policyParams)
 	if err != nil {
 		return nil, xerrors.Errorf("cannot compute dynamic authorization policy: %w", err)
 	}
@@ -83,47 +120,72 @@
 	// PCRProfile defines the profile used to generate a PCR protection policy for the newly created sealed key file.
 	PCRProfile *PCRProtectionProfile
 
-	// PINHandle is the handle at which to create a NV index for PIN support. The handle must be a valid NV index handle (MSO == 0x01)
-	// and the choice of handle should take in to consideration the reserved indices from the "Registry of reserved TPM 2.0 handles and
-	// localities" specification. It is recommended that the handle is in the block reserved for owner objects (0x01800000 - 0x01bfffff).
-	PINHandle tpm2.Handle
+	// PCRPolicyCounterHandle is the handle at which to create a NV index for dynamic authorization poliy revocation support. The handle
+	// must either be tpm2.HandleNull (in which case, no NV index will be created and the sealed key will not benefit from dynamic
+	// authorization policy revocation support), or it must be a valid NV index handle (MSO == 0x01). The choice of handle should take
+	// in to consideration the reserved indices from the "Registry of reserved TPM 2.0 handles and localities" specification. It is
+	// recommended that the handle is in the block reserved for owner objects (0x01800000 - 0x01bfffff).
+	PCRPolicyCounterHandle tpm2.Handle
+
+	// AuthKey can be set to chose an auhorisation key whose
+	// private part will be used for authorizing PCR policy
+	// updates with UpdateKeyPCRProtectionPolicy
+	// If set a key from elliptic.P256 must be used,
+	// if not set one is generated.
+	AuthKey *ecdsa.PrivateKey
 }
 
-// SealKeyToTPM seals the supplied disk encryption key to the storage hierarchy of the TPM. The sealed key object and associated
-// metadata that is required during early boot in order to unseal the key again and unlock the associated encrypted volume is written
-// to a file at the path specified by keyPath. Additional data that is required in order to update the authorization policy for the
-// sealed key is written to a file at the path specified by policyUpdatePath. This file must live inside the encrypted volume
-// protected by the sealed key.
-//
-// The supplied key must be 64-bytes long. An error will be returned if it isn't.
+// SealKeyRequest corresponds to a key that should be sealed by SealKeyToTPMMultiple
+// to a file at the specified path.
+type SealKeyRequest struct {
+	Key  []byte
+	Path string
+}
+
+// SealKeyToTPMMultiple seals the supplied disk encryption keys to the storage hierarchy of the TPM. The keys are specified by
+// the keys argument, which is a slice of associated key and corresponding file path. The sealed key objects and associated
+// metadata that is required during early boot in order to unseal the keys again and unlock the associated encrypted volumes
+// are written to files at the specifed paths.
 //
 // This function requires knowledge of the authorization value for the storage hierarchy, which must be provided by calling
 // TPMConnection.OwnerHandleContext().SetAuthValue() prior to calling this function. If the provided authorization value is incorrect,
 // a AuthFailError error will be returned.
 //
-// If the TPM is not correctly provisioned, a ErrTPMProvisioning error will be returned. In this case, ProvisionTPM must be called
-// before proceeding.
+// This function expects there to be no files at the specified paths. If the keys argument references a file that already exists, a
+// wrapped *os.PathError error will be returned with an underlying error of syscall.EEXIST. A wrapped *os.PathError error will be
+// returned if any file cannot be created and opened for writing.
 //
-// This function expects there to be no files at the specified paths. If either path references a file that already exists, a wrapped
-// *os.PathError error will be returned with an underlying error of syscall.EEXIST. A wrapped *os.PathError error will be returned if
-// either file cannot be created and opened for writing.
+// This function will create a NV index at the handle specified by the PCRPolicyCounterHandle field of the params argument if it is
+// not tpm2.HandleNull. If the handle is already in use, a TPMResourceExistsError error will be returned. In this case, the caller
+// will need to either choose a different handle or undefine the existing one. If it is not tpm2.HandleNull, then it must be a valid
+// NV index handle (MSO == 0x01), and the choice of handle should take in to consideration the reserved indices from the "Registry of
+// reserved TPM 2.0 handles and localities" specification. It is recommended that the handle is in the block reserved for owner
+// objects (0x01800000 - 0x01bfffff).
 //
-// This function will create a NV index at the handle specified by the PINHandle field of the params argument. If the handle is already
-// in use, a TPMResourceExistsError error will be returned. In this case, the caller will need to either choose a different handle or
-// undefine the existing one. The handle must be a valid NV index handle (MSO == 0x01), and the choice of handle should take in to
-// consideration the reserved indices from the "Registry of reserved TPM 2.0 handles and localities" specification. It is recommended
-// that the handle is in the block reserved for owner objects (0x01800000 - 0x01bfffff).
+// All keys will be created with the same authorization policy, and will be protected with a PCR policy computed from the
+// PCRProtectionProfile supplied via the PCRProfile field of the params argument.
 //
-// The key will be protected with a PCR policy computed from the PCRProtectionProfile supplied via the PCRProfile field of the params
-// argument.
-func SealKeyToTPM(tpm *TPMConnection, key []byte, keyPath, policyUpdatePath string, params *KeyCreationParams) error {
-	// Check that the key is the correct length.
-	if len(key) != 64 {
-		return fmt.Errorf("expected a key length of 512 bits (got %d)", len(key)*8)
-	}
+// If any part of this function fails, no sealed keys will be created.
+//
+// On success, this function returns the private part of the key used for authorizing PCR policy updates with
+// UpdateKeyPCRProtectionPolicyMultiple. This key doesn't need to be stored anywhere, and certainly mustn't be stored outside of the
+// encrypted volume protected with this sealed key file. The key is stored encrypted inside this sealed key file and returned from
+// future calls to SealedKeyObject.UnsealFromTPM.
+//
+// The authorization key can also be chosen and provided by setting
+// AuthKey in the params argument.
+func SealKeyToTPMMultiple(tpm *TPMConnection, keys []*SealKeyRequest, params *KeyCreationParams) (authKey TPMPolicyAuthKey, err error) {
 	// params is mandatory.
 	if params == nil {
-		return errors.New("no KeyCreationParams provided")
+		return nil, errors.New("no KeyCreationParams provided")
+	}
+	if len(keys) == 0 {
+		return nil, errors.New("no keys provided")
+	}
+
+	// Perform some sanity checks on params.
+	if params.AuthKey != nil && params.AuthKey.Curve != elliptic.P256() {
+		return nil, errors.New("provided AuthKey must be from elliptic.P256, no other curve is supported")
 	}
 
 	// Use the HMAC session created when the connection was opened rather than creating a new one.
@@ -136,201 +198,202 @@
 	srk := tpm.provisionedSrk
 	if srk == nil {
 		var err error
-		srk, err = provisionPrimaryKey(tpm.TPMContext, tpm.OwnerHandleContext(), srkTemplate, srkHandle, session)
+		srk, err = provisionPrimaryKey(tpm.TPMContext, tpm.OwnerHandleContext(), tcg.SRKTemplate, tcg.SRKHandle, session)
 		switch {
 		case isAuthFailError(err, tpm2.AnyCommandCode, 1):
-			return AuthFailError{tpm2.HandleOwner}
+			return nil, AuthFailError{tpm2.HandleOwner}
 		case err != nil:
-			return xerrors.Errorf("cannot provision storage root key: %w", err)
+			return nil, xerrors.Errorf("cannot provision storage root key: %w", err)
 		}
 	}
 
-	// Validate that the lock NV index is valid and obtain its name
-	lockIndex, err := tpm.CreateResourceContextFromTPM(lockNVHandle)
-	switch {
-	case tpm2.IsResourceUnavailableError(err, lockNVHandle):
-		return ErrTPMProvisioning
-	case err != nil:
-		return xerrors.Errorf("cannot create context for lock NV index: %w", err)
-	}
-
-	lockIndexPub, err := readAndValidateLockNVIndexPublic(tpm.TPMContext, lockIndex, session)
-	if err != nil {
-		return ErrTPMProvisioning
-	}
-	lockIndexName, err := lockIndexPub.Name()
-	if err != nil {
-		return xerrors.Errorf("cannot compute name of global lock NV index: %w", err)
-	}
-
 	succeeded := false
 
-	// Create destination files
-	keyFile, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	// Compute metadata.
+
+	var goAuthKey *ecdsa.PrivateKey
+	// Use the provided authorization key,
+	// otherwise create an asymmetric key for signing
+	// authorization policy updates, and authorizing dynamic
+	// authorization policy revocations.
+	if params.AuthKey != nil {
+		goAuthKey = params.AuthKey
+	} else {
+		goAuthKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot generate key for signing dynamic authorization policies: %w", err)
+		}
+	}
+	authPublicKey := createTPMPublicAreaForECDSAKey(&goAuthKey.PublicKey)
+	authKeyName, err := authPublicKey.Name()
 	if err != nil {
-		return xerrors.Errorf("cannot create key data file: %w", err)
+		return nil, xerrors.Errorf("cannot compute name of signing key for dynamic policy authorization: %w", err)
 	}
-	defer func() {
-		keyFile.Close()
-		if succeeded {
-			return
-		}
-		os.Remove(keyPath)
-	}()
+	authKey = goAuthKey.D.Bytes()
 
-	var policyUpdateFile *os.File
-	if policyUpdatePath != "" {
-		var err error
-		policyUpdateFile, err = os.OpenFile(policyUpdatePath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
-		if err != nil {
-			return xerrors.Errorf("cannot create private data file: %w", err)
+	// Create PCR policy counter, if requested.
+	var pcrPolicyCounterPub *tpm2.NVPublic
+	if params.PCRPolicyCounterHandle != tpm2.HandleNull {
+		pcrPolicyCounterPub, err = createPcrPolicyCounter(tpm.TPMContext, params.PCRPolicyCounterHandle, authKeyName, session)
+		switch {
+		case tpm2.IsTPMError(err, tpm2.ErrorNVDefined, tpm2.CommandNVDefineSpace):
+			return nil, TPMResourceExistsError{params.PCRPolicyCounterHandle}
+		case isAuthFailError(err, tpm2.CommandNVDefineSpace, 1):
+			return nil, AuthFailError{tpm2.HandleOwner}
+		case err != nil:
+			return nil, xerrors.Errorf("cannot create new dynamic authorization policy counter: %w", err)
 		}
 		defer func() {
-			policyUpdateFile.Close()
 			if succeeded {
 				return
 			}
-			os.Remove(policyUpdatePath)
+			index, err := tpm2.CreateNVIndexResourceContextFromPublic(pcrPolicyCounterPub)
+			if err != nil {
+				return
+			}
+			tpm.NVUndefineSpace(tpm.OwnerHandleContext(), index, session)
 		}()
 	}
 
-	// Create an asymmetric key for signing authorization policy updates, and authorizing dynamic authorization policy revocations.
-	authKey, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return xerrors.Errorf("cannot generate RSA key pair for signing dynamic authorization policies: %w", err)
-	}
-	authPublicKey := createPublicAreaForRSASigningKey(&authKey.PublicKey)
-	authKeyName, err := authPublicKey.Name()
-	if err != nil {
-		return xerrors.Errorf("cannot compute name of signing key for dynamic policy authorization: %w", err)
-	}
-
-	// Create pin NV index
-	pinIndexPub, pinIndexAuthPolicies, err := createPinNVIndex(tpm.TPMContext, params.PINHandle, authKeyName, session)
-	switch {
-	case tpm2.IsTPMError(err, tpm2.ErrorNVDefined, tpm2.CommandNVDefineSpace):
-		return TPMResourceExistsError{params.PINHandle}
-	case isAuthFailError(err, tpm2.CommandNVDefineSpace, 1):
-		return AuthFailError{tpm2.HandleOwner}
-	case err != nil:
-		return xerrors.Errorf("cannot create new pin NV index: %w", err)
-	}
-	defer func() {
-		if succeeded {
-			return
-		}
-		index, err := tpm2.CreateNVIndexResourceContextFromPublic(pinIndexPub)
-		if err != nil {
-			return
-		}
-		tpm.NVUndefineSpace(tpm.OwnerHandleContext(), index, session)
-	}()
-
 	template := makeSealedKeyTemplate()
 
 	// Compute the static policy - this never changes for the lifetime of this key file
 	staticPolicyData, authPolicy, err := computeStaticPolicy(template.NameAlg, &staticPolicyComputeParams{
-		key:                  authPublicKey,
-		pinIndexPub:          pinIndexPub,
-		pinIndexAuthPolicies: pinIndexAuthPolicies,
-		lockIndexName:        lockIndexName})
+		key:                 authPublicKey,
+		pcrPolicyCounterPub: pcrPolicyCounterPub})
 	if err != nil {
-		return xerrors.Errorf("cannot compute static authorization policy: %w", err)
+		return nil, xerrors.Errorf("cannot compute static authorization policy: %w", err)
 	}
 
 	// Define the template for the sealed key object, using the computed policy digest
 	template.AuthPolicy = authPolicy
-	sensitive := tpm2.SensitiveCreate{Data: key}
-
-	// Have the digest of the private data recorded in the creation data for the sealed data object.
-	var policyUpdateData keyPolicyUpdateData
-	policyUpdateData.Data.AuthKey = x509.MarshalPKCS1PrivateKey(authKey)
-
-	h := crypto.SHA256.New()
-	if _, err := tpm2.MarshalToWriter(h, &policyUpdateData.Data); err != nil {
-		panic(fmt.Sprintf("cannot marshal dynamic authorization policy update data: %v", err))
-	}
-
-	// Now create the sealed key object. The command is integrity protected so if the object at the handle we expect the SRK to reside
-	// at has a different name (ie, if we're connected via a resource manager and somebody swapped the object with another one), this
-	// command will fail. We take advantage of parameter encryption here too.
-	priv, pub, creationData, _, creationTicket, err :=
-		tpm.Create(srk, &sensitive, template, h.Sum(nil), nil, session.IncludeAttrs(tpm2.AttrCommandEncrypt))
-	if err != nil {
-		return xerrors.Errorf("cannot create sealed data object for key: %w", err)
-	}
-
-	policyUpdateData.CreationData = creationData
-	policyUpdateData.CreationTicket = creationTicket
 
 	// Create a dynamic authorization policy
 	pcrProfile := params.PCRProfile
 	if pcrProfile == nil {
 		pcrProfile = &PCRProtectionProfile{}
 	}
-	dynamicPolicyData, err := computeSealedKeyDynamicAuthPolicy(tpm.TPMContext, template.NameAlg, staticPolicyData.AuthPublicKey.NameAlg,
-		authKey, pinIndexPub, pinIndexAuthPolicies, pcrProfile, session)
+	dynamicPolicyData, err := computeSealedKeyDynamicAuthPolicy(tpm.TPMContext, currentMetadataVersion, template.NameAlg,
+		authPublicKey.NameAlg, goAuthKey, pcrPolicyCounterPub, nil, pcrProfile, session)
 	if err != nil {
-		return err
+		return nil, xerrors.Errorf("cannot compute dynamic authorization policy: %w", err)
 	}
 
-	// Marshal the entire object (sealed key object and auxiliary data) to disk
-	data := keyData{
-		KeyPrivate:        priv,
-		KeyPublic:         pub,
-		AuthModeHint:      AuthModeNone,
-		StaticPolicyData:  staticPolicyData,
-		DynamicPolicyData: dynamicPolicyData}
+	// Clean up files on failure.
+	defer func() {
+		if succeeded {
+			return
+		}
+		for _, key := range keys {
+			os.Remove(key.Path)
+		}
+	}()
 
-	if err := data.write(keyFile); err != nil {
-		return xerrors.Errorf("cannot write key data file: %w", err)
-	}
+	// Seal each key.
+	for _, key := range keys {
+		// Create the destination file
+		f, err := os.OpenFile(key.Path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+		if err != nil {
+			return nil, xerrors.Errorf("cannot create key data file %s: %w", key.Path, err)
+		}
+		// We'll close this at the end of this loop, but make sure it is closed if the function
+		// returns early
+		defer f.Close()
+
+		// Create the sensitive data
+		sealedData, err := mu.MarshalToBytes(sealedData{Key: key.Key, AuthPrivateKey: authKey})
+		if err != nil {
+			panic(fmt.Sprintf("cannot marshal sensitive data: %v", err))
+		}
+		sensitive := tpm2.SensitiveCreate{Data: sealedData}
+
+		// Now create the sealed key object. The command is integrity protected so if the object at the handle we expect the SRK to reside
+		// at has a different name (ie, if we're connected via a resource manager and somebody swapped the object with another one), this
+		// command will fail. We take advantage of parameter encryption here too.
+		priv, pub, _, _, _, err := tpm.Create(srk, &sensitive, template, nil, nil, session.IncludeAttrs(tpm2.AttrCommandEncrypt))
+		if err != nil {
+			return nil, xerrors.Errorf("cannot create sealed data object for key: %w", err)
+		}
+
+		// Marshal the entire object (sealed key object and auxiliary data) to disk
+		data := keyData{
+			version:           currentMetadataVersion,
+			keyPrivate:        priv,
+			keyPublic:         pub,
+			authModeHint:      AuthModeNone,
+			staticPolicyData:  staticPolicyData,
+			dynamicPolicyData: dynamicPolicyData}
 
-	if policyUpdateFile != nil {
-		// Marshal the private data to disk
-		if err := policyUpdateData.write(policyUpdateFile); err != nil {
-			return xerrors.Errorf("cannot write dynamic authorization policy update data file: %w", err)
+		if err := data.write(f); err != nil {
+			return nil, xerrors.Errorf("cannot write key data file: %w", err)
 		}
+
+		f.Close()
 	}
 
-	if err := incrementDynamicPolicyCounter(tpm.TPMContext, pinIndexPub, pinIndexAuthPolicies, authKey,
-		data.StaticPolicyData.AuthPublicKey, session); err != nil {
-		return xerrors.Errorf("cannot increment dynamic policy counter: %w", err)
+	// Increment the PCR policy counter for the first time.
+	if pcrPolicyCounterPub != nil {
+		if err := incrementPcrPolicyCounter(tpm.TPMContext, currentMetadataVersion, pcrPolicyCounterPub, nil, goAuthKey, authPublicKey,
+			session); err != nil {
+			return nil, xerrors.Errorf("cannot increment PCR policy counter: %w", err)
+		}
 	}
 
 	succeeded = true
-	return nil
+	return authKey, nil
 }
 
-// UpdateKeyPCRProtectionPolicy updates the PCR protection policy for the sealed key at the path specified by the keyPath argument
-// to the profile defined by the pcrProfile argument. In order to do this, the caller must also specify the path to the policy update
-// data file that was saved by SealKeyToTPM.
+// SealKeyToTPM seals the supplied disk encryption key to the storage hierarchy of the TPM. The sealed key object and associated
+// metadata that is required during early boot in order to unseal the key again and unlock the associated encrypted volume is written
+// to a file at the path specified by keyPath.
 //
-// If either file cannot be opened, a wrapped *os.PathError error will be returned.
+// This function requires knowledge of the authorization value for the storage hierarchy, which must be provided by calling
+// TPMConnection.OwnerHandleContext().SetAuthValue() prior to calling this function. If the provided authorization value is incorrect,
+// a AuthFailError error will be returned.
 //
-// If either file cannot be deserialized correctly or validation of the files fails, a InvalidKeyFileError error will be returned.
+// If the TPM is not correctly provisioned, a ErrTPMProvisioning error will be returned. In this case, ProvisionTPM must be called
+// before proceeding.
 //
-// On success, the sealed key data file is updated atomically with an updated authorization policy that includes a PCR policy
-// computed from the supplied PCRProtectionProfile.
-func UpdateKeyPCRProtectionPolicy(tpm *TPMConnection, keyPath, policyUpdatePath string, pcrProfile *PCRProtectionProfile) error {
-	// Use the HMAC session created when the connection was opened rather than creating a new one.
-	session := tpm.HmacSession()
+// This function expects there to be no file at the specified path. If keyPath references a file that already exists, a wrapped
+// *os.PathError error will be returned with an underlying error of syscall.EEXIST. A wrapped *os.PathError error will be returned if
+// the file cannot be created and opened for writing.
+//
+// This function will create a NV index at the handle specified by the PCRPolicyCounterHandle field of the params argument if it is not
+// tpm2.HandleNull. If the handle is already in use, a TPMResourceExistsError error will be returned. In this case, the caller will
+// need to either choose a different handle or undefine the existing one. If it is not tpm2.HandleNull, then it must be a valid NV
+// index handle (MSO == 0x01), and the choice of handle should take in to consideration the reserved indices from the "Registry of
+// reserved TPM 2.0 handles and localities" specification. It is recommended that the handle is in the block reserved for owner
+// objects (0x01800000 - 0x01bfffff).
+//
+// The key will be protected with a PCR policy computed from the PCRProtectionProfile supplied via the PCRProfile field of the params
+// argument.
+//
+// On success, this function returns the private part of the key used for authorizing PCR policy updates with
+// UpdateKeyPCRProtectionPolicy. This key doesn't need to be stored anywhere, and certainly mustn't be stored outside of the encrypted
+// volume protected with this sealed key file. The key is stored encrypted inside this sealed key file and returned from future calls
+// to SealedKeyObject.UnsealFromTPM.
+//
+// The authorization key can also be chosen and provided by setting
+// AuthKey in the params argument.
+func SealKeyToTPM(tpm *TPMConnection, key []byte, keyPath string, params *KeyCreationParams) (authKey TPMPolicyAuthKey, err error) {
+	return SealKeyToTPMMultiple(tpm, []*SealKeyRequest{{Key: key, Path: keyPath}}, params)
+}
 
-	// Open the key data file
-	keyFile, err := os.Open(keyPath)
-	if err != nil {
-		return xerrors.Errorf("cannot open key data file: %w", err)
+func updateKeyPCRProtectionPolicyCommon(tpm *tpm2.TPMContext, keyPaths []string, authData interface{}, pcrProfile *PCRProtectionProfile, session tpm2.SessionContext) error {
+	if len(keyPaths) == 0 {
+		return errors.New("no key files supplied")
 	}
-	defer keyFile.Close()
 
-	// Open the policy update data file
-	policyUpdateFile, err := os.Open(policyUpdatePath)
+	var datas []*keyData
+	// Open the primary data file
+	keyFile, err := os.Open(keyPaths[0])
 	if err != nil {
-		return xerrors.Errorf("cannot open private data file: %w", err)
+		return xerrors.Errorf("cannot open key data file: %w", err)
 	}
-	defer policyUpdateFile.Close()
+	defer keyFile.Close()
 
-	data, policyUpdateData, pinIndexPublic, err := readAndValidateKeyData(tpm.TPMContext, keyFile, policyUpdateFile, session)
+	// Validate the primary file
+	primaryData, authKey, pcrPolicyCounterPub, err := decodeAndValidateKeyData(tpm, keyFile, authData, session)
 	if err != nil {
 		if isKeyFileError(err) {
 			return InvalidKeyFileError{err.Error()}
@@ -338,33 +401,117 @@
 		// FIXME: Turn the missing lock NV index in to ErrProvisioning
 		return xerrors.Errorf("cannot read and validate key data file: %w", err)
 	}
+	datas = append(datas, primaryData)
 
-	authKey, err := x509.ParsePKCS1PrivateKey(policyUpdateData.Data.AuthKey)
-	if err != nil {
-		return xerrors.Errorf("cannot parse authorization key: %w", err)
+	// Open and validate secondary files and make sure they are related
+	for _, p := range keyPaths[1:] {
+		keyFile, err := os.Open(p)
+		if err != nil {
+			return xerrors.Errorf("cannot open related key data file: %w", err)
+		}
+		defer keyFile.Close()
+
+		data, _, _, err := decodeAndValidateKeyData(tpm, keyFile, nil, session)
+		if err != nil {
+			if isKeyFileError(err) {
+				return InvalidKeyFileError{err.Error() + " (" + p + ")"}
+			}
+			// FIXME: Turn the missing lock NV index in to ErrProvisioning
+			return xerrors.Errorf("cannot read and validate related key data file: %w", err)
+		}
+		// The metadata is valid and consistent with the object's static authorization policy.
+		// Verify that it also has the same static authorization policy as the first key object passed
+		// to this function. This policy digest includes a cryptographic record of the PCR policy counter
+		// and dynamic authorization policy signing key, so this is the only check required to determine
+		// if 2 keys are related.
+		if !bytes.Equal(data.keyPublic.AuthPolicy, primaryData.keyPublic.AuthPolicy) {
+			return InvalidKeyFileError{"key data file " + p + " is not a related key file"}
+		}
+		datas = append(datas, data)
 	}
 
+	authPublicKey := primaryData.staticPolicyData.authPublicKey
+	v0PinIndexAuthPolicies := primaryData.staticPolicyData.v0PinIndexAuthPolicies
+
 	// Compute a new dynamic authorization policy
 	if pcrProfile == nil {
 		pcrProfile = &PCRProtectionProfile{}
 	}
-	policyData, err := computeSealedKeyDynamicAuthPolicy(tpm.TPMContext, data.KeyPublic.NameAlg, data.StaticPolicyData.AuthPublicKey.NameAlg,
-		authKey, pinIndexPublic, data.StaticPolicyData.PinIndexAuthPolicies, pcrProfile, session)
+	policyData, err := computeSealedKeyDynamicAuthPolicy(tpm, primaryData.version, primaryData.keyPublic.NameAlg, authPublicKey.NameAlg, authKey,
+		pcrPolicyCounterPub, v0PinIndexAuthPolicies, pcrProfile, session)
 	if err != nil {
-		return err
+		return xerrors.Errorf("cannot compute dynamic authorization policy: %w", err)
 	}
 
-	// Atomically update the key data file
-	data.DynamicPolicyData = policyData
+	// Atomically update the key data files
+	for i, data := range datas {
+		data.dynamicPolicyData = policyData
 
-	if err := data.writeToFileAtomic(keyPath); err != nil {
-		return xerrors.Errorf("cannot write key data file: %v", err)
+		if err := data.writeToFileAtomic(keyPaths[i]); err != nil {
+			return xerrors.Errorf("cannot write key data file: %v", err)
+		}
+	}
+
+	if pcrPolicyCounterPub == nil {
+		return nil
 	}
 
-	if err := incrementDynamicPolicyCounter(tpm.TPMContext, pinIndexPublic, data.StaticPolicyData.PinIndexAuthPolicies, authKey,
-		data.StaticPolicyData.AuthPublicKey, session); err != nil {
-		return xerrors.Errorf("cannot revoke old dynamic authorization policies: %w", err)
+	if err := incrementPcrPolicyCounter(tpm, primaryData.version, pcrPolicyCounterPub, v0PinIndexAuthPolicies, authKey, authPublicKey, session); err != nil {
+		return xerrors.Errorf("cannot revoke old PCR policies: %w", err)
 	}
 
 	return nil
 }
+
+// UpdateKeyPCRProtectionPolicyV0 updates the PCR protection policy for the sealed key at the path specified by the keyPath argument
+// to the profile defined by the pcrProfile argument. This function only works with version 0 sealed key files. In order to do this,
+// the caller must also specify the path to the policy update data file that was originally saved by SealKeyToTPM.
+//
+// If either file cannot be opened, a wrapped *os.PathError error will be returned.
+//
+// If either file cannot be deserialized correctly or validation of the files fails, a InvalidKeyFileError error will be returned.
+//
+// On success, the sealed key data file is updated atomically with an updated authorization policy that includes a PCR policy
+// computed from the supplied PCRProtectionProfile.
+func UpdateKeyPCRProtectionPolicyV0(tpm *TPMConnection, keyPath, policyUpdatePath string, pcrProfile *PCRProtectionProfile) error {
+	policyUpdateFile, err := os.Open(policyUpdatePath)
+	if err != nil {
+		return xerrors.Errorf("cannot open private data file: %w", err)
+	}
+	defer policyUpdateFile.Close()
+
+	return updateKeyPCRProtectionPolicyCommon(tpm.TPMContext, []string{keyPath}, policyUpdateFile, pcrProfile, tpm.HmacSession())
+}
+
+// UpdateKeyPCRProtectionPolicy updates the PCR protection policy for the sealed key at the path specified by the keyPath argument
+// to the profile defined by the pcrProfile argument. In order to do this, the caller must also specify the private part of the
+// authorization key that was either returned by SealKeyToTPM or SealedKeyObject.UnsealFromTPM.
+//
+// If the file cannot be opened, a wrapped *os.PathError error will be returned.
+//
+// If the file cannot be deserialized correctly or validation of the file fails, a InvalidKeyFileError error will be returned.
+//
+// On success, the sealed key data file is updated atomically with an updated authorization policy that includes a PCR policy
+// computed from the supplied PCRProtectionProfile. If the sealed key data file was created with a PCR policy counter, the
+// previous PCR policy will be revoked.
+func UpdateKeyPCRProtectionPolicy(tpm *TPMConnection, keyPath string, authKey TPMPolicyAuthKey, pcrProfile *PCRProtectionProfile) error {
+	return updateKeyPCRProtectionPolicyCommon(tpm.TPMContext, []string{keyPath}, authKey, pcrProfile, tpm.HmacSession())
+}
+
+// UpdateKeyPCRProtectionPolicyMultiple updates the PCR protection policy for the sealed keys at the paths specified
+// by the keyPaths argument to the profile defined by the pcrProfile argument. The keys must all be related (ie, they
+// were created using SealKeyToTPMMultiple). If any key in the supplied set is not related, an error will be returned.
+//
+// If any file cannot be opened, a wrapped *os.PathError error will be returned.
+//
+// If any file cannot be deserialized correctly or validation of a file fails, a InvalidKeyFileError error will
+// be returned.
+//
+// On success, each sealed key data file is updated atomically with an updated authorization policy that includes a PCR
+// policy computed from the supplied PCRProtectionProfile. If the sealed key data files were created with a PCR policy
+// counter, the previous PCR policy will be revoked only when all of the sealed key data files have been updated
+// successfully. If any file is not updated successfully, the previous PCR policy will not be revoked and the associated
+// error will be returned.
+func UpdateKeyPCRProtectionPolicyMultiple(tpm *TPMConnection, keyPaths []string, authKey TPMPolicyAuthKey, pcrProfile *PCRProtectionProfile) error {
+	return updateKeyPCRProtectionPolicyCommon(tpm.TPMContext, keyPaths, authKey, pcrProfile, tpm.HmacSession())
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/secureboot_policy.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/secureboot_policy.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/secureboot_policy.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/secureboot_policy.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,7 +23,7 @@
 	"bufio"
 	"bytes"
 	"crypto/x509"
-	"debug/pe"
+	"encoding/asn1"
 	"encoding/binary"
 	"errors"
 	"fmt"
@@ -35,9 +35,10 @@
 	"strings"
 
 	"github.com/canonical/go-tpm2"
-	"github.com/chrisccoulson/tcglog-parser"
+	"github.com/canonical/tcglog-parser"
+	"github.com/snapcore/secboot/internal/efi"
+	"github.com/snapcore/secboot/internal/pe1.14"
 	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/snap"
 
 	"golang.org/x/xerrors"
 
@@ -59,9 +60,7 @@
 	dbxFilename     = "dbx-d719b2cb-3d3a-4596-a3bc-dad00e67656f"       // Filename in efivarfs for accessing the EFI forbidden signature database
 	mokListFilename = "MokListRT-605dab50-e046-4300-abb6-3dd810dd8b23" // Filename in efivarfs for accessing a runtime copy of the shim MOK database
 
-	uefiDriverPCR      = 2 // UEFI Drivers and UEFI Applications PCR
-	bootManagerCodePCR = 4 // Boot Manager Code and Boot Attempts PCR
-	secureBootPCR      = 7 // Secure Boot Policy Measurements PCR
+	secureBootPCR = 7 // Secure Boot Policy Measurements PCR
 
 	returningFromEfiApplicationEvent = "Returning from EFI Application from Boot Option" // EV_EFI_ACTION index 2: "Attempt to execute code from Boot Option was unsuccessful"
 
@@ -72,84 +71,18 @@
 )
 
 var (
-	shimGuid                     = tcglog.NewEFIGUID(0x605dab50, 0xe046, 0x4300, 0xabb6, [...]uint8{0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23}) // SHIM_LOCK_GUID
-	efiGlobalVariableGuid        = tcglog.NewEFIGUID(0x8be4df61, 0x93ca, 0x11d2, 0xaa0d, [...]uint8{0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c}) // EFI_GLOBAL_VARIABLE
-	efiImageSecurityDatabaseGuid = tcglog.NewEFIGUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3bc, [...]uint8{0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f}) // EFI_IMAGE_SECURITY_DATABASE_GUID
+	shimGuid                     = tcglog.MakeEFIGUID(0x605dab50, 0xe046, 0x4300, 0xabb6, [...]uint8{0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23}) // SHIM_LOCK_GUID
+	efiGlobalVariableGuid        = tcglog.MakeEFIGUID(0x8be4df61, 0x93ca, 0x11d2, 0xaa0d, [...]uint8{0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c}) // EFI_GLOBAL_VARIABLE
+	efiImageSecurityDatabaseGuid = tcglog.MakeEFIGUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3bc, [...]uint8{0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f}) // EFI_IMAGE_SECURITY_DATABASE_GUID
 
-	efiCertX509Guid      = tcglog.NewEFIGUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87b5, [...]uint8{0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72}) // EFI_CERT_X509_GUID
-	efiCertTypePkcs7Guid = tcglog.NewEFIGUID(0x4aafd29d, 0x68df, 0x49ee, 0x8aa9, [...]uint8{0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7}) // EFI_CERT_TYPE_PKCS7_GUID
+	efiCertX509Guid      = tcglog.MakeEFIGUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87b5, [...]uint8{0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72}) // EFI_CERT_X509_GUID
+	efiCertTypePkcs7Guid = tcglog.MakeEFIGUID(0x4aafd29d, 0x68df, 0x49ee, 0x8aa9, [...]uint8{0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7}) // EFI_CERT_TYPE_PKCS7_GUID
 
-	eventLogPath = "/sys/kernel/security/tpm0/binary_bios_measurements" // Path of the TCG event log for the default TPM, in binary form
-	efivarsPath  = "/sys/firmware/efi/efivars"                          // Default mount point for efivarfs
-)
-
-// EFIImage corresponds to a binary that is loaded, verified and executed before ExitBootServices.
-type EFIImage interface {
-	fmt.Stringer
-	Open() (interface {
-		io.ReaderAt
-		io.Closer
-	}, error) // Open a handle to the image for reading
-}
-
-// SnapFileEFIImage corresponds to a binary contained within a snap file that is loaded, verified and executed before ExitBootServices.
-type SnapFileEFIImage struct {
-	Container snap.Container
-	Path      string // The path of the snap image (used by the implementation of fmt.Stringer)
-	FileName  string // The filename within the snap squashfs
-}
-
-func (f SnapFileEFIImage) String() string {
-	return "snap:" + f.Path + ":" + f.FileName
-}
-
-func (f SnapFileEFIImage) Open() (interface {
-	io.ReaderAt
-	io.Closer
-}, error) {
-	return f.Container.RandomAccessFile(f.FileName)
-}
-
-// FileEFIImage corresponds to a file on disk that is loaded, verified and executed before ExitBootServices.
-type FileEFIImage string
+	oidSha256 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 1}
 
-func (p FileEFIImage) String() string {
-	return string(p)
-}
-
-func (p FileEFIImage) Open() (interface {
-	io.ReaderAt
-	io.Closer
-}, error) {
-	f, err := os.Open(string(p))
-	if err != nil {
-		return nil, err
-	}
-	return f, nil
-}
-
-// EFIImageLoadEventSource corresponds to the source of a EFIImageLoadEvent.
-type EFIImageLoadEventSource int
-
-const (
-	// Firmware indicates that the source of a EFIImageLoadEvent was platform firmware, via the EFI_BOOT_SERVICES.LoadImage()
-	// and EFI_BOOT_SERVICES.StartImage() functions, with the subsequently executed image being verified against the signatures
-	// in the EFI authorized signature database.
-	Firmware EFIImageLoadEventSource = iota
-
-	// Shim indicates that the source of a EFIImageLoadEvent was shim, without relying on EFI boot services for loading, verifying
-	// and executing the subsequently executed image. The image is verified by shim against the signatures in the EFI authorized
-	// signature database, the MOK database or shim's built-in vendor certificate before being executed directly.
-	Shim
+	efivarsPath = "/sys/firmware/efi/efivars" // Default mount point for efivarfs
 )
 
-// EFIImageLoadEvent corresponds to the execution of a verified EFIImage.
-type EFIImageLoadEvent struct {
-	Source EFIImageLoadEventSource // The source of the event
-	Image  EFIImage                // The image
-	Next   []*EFIImageLoadEvent    // A list of possible subsequent EFIImageLoadEvents
-}
-
 type winCertificate interface {
 	wCertificateType() uint16
 }
@@ -174,17 +107,17 @@
 
 // decodeWinCertificate decodes the WIN_CERTIFICATE implementation from r. Currently supported types are WIN_CERT_TYPE_PKCS_SIGNED_DATA
 // and WIN_CERT_TYPE_EFI_GUID.
-func decodeWinCertificate(r io.Reader) (winCertificate, error) {
+func decodeWinCertificate(r io.Reader) (cert winCertificate, length int, err error) {
 	var hdr struct {
 		Length          uint32
 		Revision        uint16
 		CertificateType uint16
 	}
 	if err := binary.Read(r, binary.LittleEndian, &hdr); err != nil {
-		return nil, xerrors.Errorf("cannot read WIN_CERTIFICATE header fields: %w", err)
+		return nil, 0, xerrors.Errorf("cannot read WIN_CERTIFICATE header fields: %w", err)
 	}
 	if hdr.Revision != 0x200 {
-		return nil, fmt.Errorf("invalid wRevision value (0x%04x)", hdr.Revision)
+		return nil, 0, fmt.Errorf("invalid wRevision value (0x%04x)", hdr.Revision)
 	}
 
 	switch hdr.CertificateType {
@@ -192,21 +125,21 @@
 		out := &winCertificateAuthenticode{}
 		out.Data = make([]byte, int(hdr.Length)-binary.Size(hdr))
 		if _, err := io.ReadFull(r, out.Data); err != nil {
-			return nil, xerrors.Errorf("cannot read WIN_CERTIFICATE.bCertificate: %w", err)
+			return nil, 0, xerrors.Errorf("cannot read WIN_CERTIFICATE.bCertificate: %w", err)
 		}
-		return out, nil
+		return out, int(hdr.Length), nil
 	case winCertTypeEfiGuid:
 		out := &winCertificateUefiGuid{}
-		if err := binary.Read(r, binary.LittleEndian, &out.CertType); err != nil {
-			return nil, xerrors.Errorf("cannot read WIN_CERTIFICATE_UEFI_GUID.CertType: %w", err)
+		if _, err := io.ReadFull(r, out.CertType[:]); err != nil {
+			return nil, 0, xerrors.Errorf("cannot read WIN_CERTIFICATE_UEFI_GUID.CertType: %w", err)
 		}
 		out.Data = make([]byte, int(hdr.Length)-binary.Size(hdr)-binary.Size(out.CertType))
 		if _, err := io.ReadFull(r, out.Data); err != nil {
-			return nil, xerrors.Errorf("cannot read WIN_CERTIFICATE_UEFI_GUID.CertData: %w", err)
+			return nil, 0, xerrors.Errorf("cannot read WIN_CERTIFICATE_UEFI_GUID.CertData: %w", err)
 		}
-		return out, nil
+		return out, int(hdr.Length), nil
 	default:
-		return nil, fmt.Errorf("cannot decode unrecognized type (0x%04x)", hdr.CertificateType)
+		return nil, 0, fmt.Errorf("cannot decode unrecognized type (0x%04x)", hdr.CertificateType)
 	}
 }
 
@@ -262,23 +195,23 @@
 
 // nextSignatureList returns the SignatureType, SignatureHeader and EFI_SIGNATURE_DATA entries associated with the next
 // EFI_SIGNATURE_LIST.
-func (d *secureBootDbIterator) nextSignatureList() (*tcglog.EFIGUID, []byte, [][]byte, error) {
+func (d *secureBootDbIterator) nextSignatureList() (tcglog.EFIGUID, []byte, [][]byte, error) {
 	start, _ := d.r.Seek(0, io.SeekCurrent)
 
 	// Decode EFI_SIGNATURE_LIST.SignatureType
 	var signatureType tcglog.EFIGUID
-	if err := binary.Read(d.r, binary.LittleEndian, &signatureType); err != nil {
+	if _, err := io.ReadFull(d.r, signatureType[:]); err != nil {
 		if err == io.EOF {
-			return nil, nil, nil, err
+			return tcglog.EFIGUID{}, nil, nil, err
 		}
-		return nil, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureType: %w", err)
+		return tcglog.EFIGUID{}, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureType: %w", err)
 	}
 
 	// Decode EFI_SIGNATURE_LIST.SignatureListSize, which indicates the size of the entire EFI_SIGNATURE_LIST,
 	// including all of the EFI_SIGNATURE_DATA entries.
 	var signatureListSize uint32
 	if err := binary.Read(d.r, binary.LittleEndian, &signatureListSize); err != nil {
-		return nil, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureListSize: %w", err)
+		return tcglog.EFIGUID{}, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureListSize: %w", err)
 	}
 
 	// Decode EFI_SIGNATURE_LIST.SignatureHeaderSize, which indicates the size of the optional header data between
@@ -286,28 +219,28 @@
 	// Always zero for the signature types we care about.
 	var signatureHeaderSize uint32
 	if err := binary.Read(d.r, binary.LittleEndian, &signatureHeaderSize); err != nil {
-		return nil, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureHeaderSize: %w", err)
+		return tcglog.EFIGUID{}, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureHeaderSize: %w", err)
 	}
 
 	// Decode EFI_SIGNATURE_LIST.SignatureSize, which indicates the size of each EFI_SIGNATURE_DATA entry.
 	var signatureSize uint32
 	if err := binary.Read(d.r, binary.LittleEndian, &signatureSize); err != nil {
-		return nil, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureSize: %w", err)
+		return tcglog.EFIGUID{}, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureSize: %w", err)
 	}
-	if signatureSize == 0 {
-		return nil, nil, nil, errors.New("EFI_SIGNATURE_LIST.SignatureSize is zero")
+	if signatureSize < 16 {
+		return tcglog.EFIGUID{}, nil, nil, errors.New("EFI_SIGNATURE_LIST.SignatureSize is invalid")
 	}
 
 	signatureHeader := make([]byte, signatureHeaderSize)
 	if _, err := io.ReadFull(d.r, signatureHeader); err != nil {
-		return nil, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureHeader: %w", err)
+		return tcglog.EFIGUID{}, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_LIST.SignatureHeader: %w", err)
 	}
 
 	// Calculate the number of EFI_SIGNATURE_DATA entries
 	endOfHeader, _ := d.r.Seek(0, io.SeekCurrent)
 	signatureDataSize := int64(signatureListSize) - endOfHeader + start
 	if signatureDataSize%int64(signatureSize) != 0 {
-		return nil, nil, nil, errors.New("EFI_SIGNATURE_LIST has inconsistent SignatureListSIze, SignatureHeaderSize and SignatureSize fields")
+		return tcglog.EFIGUID{}, nil, nil, errors.New("EFI_SIGNATURE_LIST has inconsistent SignatureListSize, SignatureHeaderSize and SignatureSize fields")
 	}
 	numOfSignatures := signatureDataSize / int64(signatureSize)
 
@@ -317,12 +250,12 @@
 	for i := int64(0); i < numOfSignatures; i++ {
 		signature := make([]byte, signatureSize)
 		if _, err := io.ReadFull(d.r, signature); err != nil {
-			return nil, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_DATA entry at index %d: %w", i, err)
+			return tcglog.EFIGUID{}, nil, nil, xerrors.Errorf("cannot read EFI_SIGNATURE_DATA entry at index %d: %w", i, err)
 		}
 		signatures = append(signatures, signature)
 	}
 
-	return &signatureType, signatureHeader, signatures, nil
+	return signatureType, signatureHeader, signatures, nil
 }
 
 // efiSignatureData corresponds to a EFI_SIGNATURE_DATA entry from a secure boot database, with the inclusion of the SignatureType
@@ -334,7 +267,7 @@
 }
 
 func (e *efiSignatureData) encode(buf io.Writer) error {
-	if err := binary.Write(buf, binary.LittleEndian, e.owner); err != nil {
+	if _, err := buf.Write(e.owner[:]); err != nil {
 		return fmt.Errorf("cannot write signature owner: %v", err)
 	}
 	if _, err := buf.Write(e.data); err != nil {
@@ -363,7 +296,7 @@
 
 			// Decode EFI_SIGNATURE_DATA.SignatureOwner
 			var signatureOwner tcglog.EFIGUID
-			if err := binary.Read(sr, binary.LittleEndian, &signatureOwner); err != nil {
+			if _, err := io.ReadFull(sr, signatureOwner[:]); err != nil {
 				return nil, xerrors.Errorf("cannot decode EFI_SIGNATURE_DATA.SignatureOwner for signature at index %d in list index %d: %w", j, i, err)
 			}
 
@@ -372,21 +305,31 @@
 				return nil, xerrors.Errorf("cannot obtain EFI_SIGNATURE_DATA.SignatureData for signature at index %d in list index %d: %w", j, i, err)
 			}
 
-			out = append(out, &efiSignatureData{signatureType: *sigType, owner: signatureOwner, data: data})
+			out = append(out, &efiSignatureData{signatureType: sigType, owner: signatureOwner, data: data})
 		}
 	}
 
 	return out, nil
 }
 
+type sigDbUpdateQuirkMode int
+
+const (
+	sigDbUpdateQuirkModeNone = iota
+
+	// sigDbUpdateQuirkModeDedupIgnoresOwner enables a mode to compute signature database updates where the firmware
+	// doesn't consider 2 EFI_SIGNATURE_DATA entries where only the SignatureOwner fields differ to be unique.
+	sigDbUpdateQuirkModeDedupIgnoresOwner
+)
+
 // computeDbUpdate appends the EFI signature database update supplied via update to the signature database supplied via orig, filtering
 // out EFI_SIGNATURE_DATA entries that are already in orig and then returning the result.
-func computeDbUpdate(orig io.ReaderAt, update io.ReadSeeker) ([]byte, error) {
+func computeDbUpdate(orig io.ReaderAt, update io.ReadSeeker, quirkMode sigDbUpdateQuirkMode) ([]byte, error) {
 	// Skip over EFI_VARIABLE_AUTHENTICATION_2.TimeStamp
 	update.Seek(16, io.SeekCurrent)
 
 	var cert *winCertificateUefiGuid
-	if c, err := decodeWinCertificate(update); err != nil {
+	if c, _, err := decodeWinCertificate(update); err != nil {
 		return nil, xerrors.Errorf("cannot decode EFI_VARIABLE_AUTHENTICATION_2.AuthInfo field from update: %w", err)
 	} else if c.wCertificateType() != winCertTypeEfiGuid {
 		return nil, fmt.Errorf("update has invalid EFI_VARIABLE_AUTHENTICATION_2.AuthInfo.Hdr.wCertificateType (0x%04x)", c.wCertificateType())
@@ -394,8 +337,8 @@
 		cert = c.(*winCertificateUefiGuid)
 	}
 
-	if cert.CertType != *efiCertTypePkcs7Guid {
-		return nil, fmt.Errorf("update has invalid value for EFI_VARIABLE_AUTHENTICATION_2.AuthInfo.CertType (%s)", &cert.CertType)
+	if cert.CertType != efiCertTypePkcs7Guid {
+		return nil, fmt.Errorf("update has invalid value for EFI_VARIABLE_AUTHENTICATION_2.AuthInfo.CertType (%s)", cert.CertType)
 	}
 
 	filteredUpdate := new(bytes.Buffer)
@@ -425,13 +368,22 @@
 					}
 					return nil, xerrors.Errorf("cannot obtain signature list from target at index %d: %w", j, err)
 				}
-				if *sigType != *updateSigType {
+				if sigType != updateSigType {
 					// EFI_SIGNATURE_LIST.SignatureType doesn't match
 					continue
 				}
 				for _, sig := range sigs {
-					if bytes.Equal(sig, updateSig) {
-						isNewSig = false
+					switch quirkMode {
+					case sigDbUpdateQuirkModeNone:
+						if bytes.Equal(sig, updateSig) {
+							isNewSig = false
+						}
+					case sigDbUpdateQuirkModeDedupIgnoresOwner:
+						if bytes.Equal(sig[16:], updateSig[16:]) {
+							isNewSig = false
+						}
+					}
+					if !isNewSig {
 						break
 					}
 				}
@@ -525,7 +477,7 @@
 		return nil, xerrors.Errorf("lookup failed %s: %w", sbKeySyncExe, err)
 	}
 
-	args := []string{"--dry-run", "--verbose", "--no-default-keystores", "--efivars-path", efivarsPath}
+	args := []string{"--dry-run", "--verbose", "--no-default-keystores", "--efivars-path", efi.EFIVarsPath}
 	for _, ks := range keystores {
 		args = append(args, "--keystore", ks)
 	}
@@ -562,64 +514,8 @@
 	return updates, nil
 }
 
-// secureBootVerificationEvent corresponds to a EV_EFI_VARIABLE_AUTHORITY event and associated image load event
-// (EV_EFI_BOOT_SERVICES_DRIVER, EV_EFI_RUNTIME_SERVICES_DRIVER or EV_EFI_BOOT_SERVICES_APPLICATION).
-type secureBootVerificationEvent struct {
-	event          *tcglog.Event
-	imageLoadEvent *tcglog.Event
-}
-
-// identifyInitialOSLaunchVerificationEvent finds the secure boot verification event associated with the verification of the initial
-// OS EFI image.
-func identifyInitialOSLaunchVerificationEvent(events []*tcglog.Event) (*secureBootVerificationEvent, error) {
-	var lastEvent *tcglog.Event
-	var lastEventImageLoadEvent *tcglog.Event
-	seenInitialOSLaunchVerificationEvent := false
-
-Loop:
-	for _, e := range events {
-		switch e.PCRIndex {
-		case uefiDriverPCR:
-			if e.EventType != tcglog.EventTypeEFIBootServicesDriver && e.EventType != tcglog.EventTypeEFIRuntimeServicesDriver {
-				continue
-			}
-			if lastEvent == nil {
-				// Drivers can be launched without verification in some circumstances (eg, if loaded from a firmware volume)
-				continue
-			}
-			if lastEventImageLoadEvent != nil {
-				continue
-			}
-			lastEventImageLoadEvent = e
-		case bootManagerCodePCR:
-			if e.EventType != tcglog.EventTypeEFIBootServicesApplication {
-				continue
-			}
-			if lastEvent == nil {
-				return nil, errors.New("boot manager image load event occurred without a preceding verification event")
-			}
-			seenInitialOSLaunchVerificationEvent = true
-			if lastEventImageLoadEvent == nil {
-				lastEventImageLoadEvent = e
-			}
-			break Loop
-		case secureBootPCR:
-			if e.EventType != tcglog.EventTypeEFIVariableAuthority {
-				continue
-			}
-			lastEvent = e
-			lastEventImageLoadEvent = nil
-		}
-	}
-
-	if !seenInitialOSLaunchVerificationEvent {
-		return nil, errors.New("boot manager image load event not found")
-	}
-	return &secureBootVerificationEvent{event: lastEvent, imageLoadEvent: lastEventImageLoadEvent}, nil
-}
-
 // isSecureBootConfigMeasurementEvent determines if event corresponds to the measurement of a secure boot configuration.
-func isSecureBootConfigMeasurementEvent(event *tcglog.Event, guid *tcglog.EFIGUID, name string) bool {
+func isSecureBootConfigMeasurementEvent(event *tcglog.Event, guid tcglog.EFIGUID, name string) bool {
 	if event.PCRIndex != secureBootPCR {
 		return false
 	}
@@ -627,12 +523,12 @@
 		return false
 	}
 
-	efiVarData, isEfiVar := event.Data.(*tcglog.EFIVariableEventData)
+	efiVarData, isEfiVar := event.Data.(*tcglog.EFIVariableData)
 	if !isEfiVar {
 		return false
 	}
 
-	return efiVarData.VariableName == *guid && efiVarData.UnicodeName == name
+	return efiVarData.VariableName == guid && efiVarData.UnicodeName == name
 }
 
 // isKEKMeasurementEvent determines if event corresponds to the measurement of KEK.
@@ -693,271 +589,105 @@
 	shimDb *secureBootDb
 }
 
-// secureBootPolicyGenPath corresponds to a single path of secure boot policy events.
-type secureBootPolicyGenPath struct {
-	pcrValue                   tpm2.Digest     // The current computed PCR value associated with this event path
-	dbUpdateLevel              int             // The number of EFI signature database events applied on this event path
-	dbSet                      secureBootDbSet // The signature database set associated with this event path
-	firmwareVerificationEvents tpm2.DigestList // The verification events recorded by firmware on this event path
-	shimVerificationEvents     tpm2.DigestList // The verification events recorded by shim on this event path
-
-	unbootable bool // Whether this event path is one that cannot be booted, and so it's digest shall be omitted
+type secureBootAuthority struct {
+	signature *efiSignatureData
+	source    *secureBootDb
 }
 
-// extendMeasurement extends the supplied digest to the current value of pcrValue for this event path.
-func (p *secureBootPolicyGenPath) extendMeasurement(alg tpm2.HashAlgorithmId, digest tpm2.Digest) {
-	if len(digest) != alg.Size() {
-		panic("invalid digest length")
-	}
-
-	h := alg.NewHash()
-	h.Write(p.pcrValue)
-	h.Write(digest)
-	p.pcrValue = h.Sum(nil)
+type authenticodeSignerAndIntermediates struct {
+	signer        *x509.Certificate
+	intermediates *x509.CertPool
 }
 
-// extendVerificationMeasurement extends the supplied digest to the current value of pcrValue for this event path, and records the
-// extended digest in order to avoid measuring the same verification event more than once.
-func (p *secureBootPolicyGenPath) extendVerificationMeasurement(alg tpm2.HashAlgorithmId, digest tpm2.Digest, source EFIImageLoadEventSource) {
-	var digests *tpm2.DigestList
-	switch source {
-	case Firmware:
-		digests = &p.firmwareVerificationEvents
-	case Shim:
-		digests = &p.shimVerificationEvents
-	}
-	*digests = append(*digests, digest)
-	p.extendMeasurement(alg, digest)
+// secureBootPolicyGen is the main structure involved with computing secure boot policy PCR digests. It is essentially just
+// a container for EFISecureBootPolicyProfileParams - per-branch context is maintained in secureBootPolicyGenBranch instead.
+type secureBootPolicyGen struct {
+	pcrAlgorithm  tpm2.HashAlgorithmId
+	loadSequences []*EFIImageLoadEvent
+
+	events       []*tcglog.Event
+	sigDbUpdates []*secureBootDbUpdate
 }
 
-// duplicate makes a copy of this event path. Note that whilst the firmwareVerificationEvents and shimVerificationEvents slices
-// are copied and can be mutated in the copy, the individual digests are not copied and should be considered read only. The pointers
-// to secureBootDb structs are copied and can be changed in the copy, but the actual secureBootDb instances should also be considered
-// read only.
-func (p *secureBootPolicyGenPath) duplicate() *secureBootPolicyGenPath {
-	n := &secureBootPolicyGenPath{}
+// secureBootPolicyGenBranch represents a branch of a PCRProtectionProfile. It contains its own PCRProtectionProfile in to which
+// instructions can be recorded, as well as some other context associated with this branch.
+type secureBootPolicyGenBranch struct {
+	gen *secureBootPolicyGen
 
-	n.pcrValue = make(tpm2.Digest, len(p.pcrValue))
-	copy(n.pcrValue, p.pcrValue)
+	profile     *PCRProtectionProfile        // The PCR profile containing the instructions for this branch
+	subBranches []*secureBootPolicyGenBranch // Sub-branches, if this has been branched
 
-	n.dbUpdateLevel = p.dbUpdateLevel
-	n.dbSet = p.dbSet
+	dbUpdateLevel              int             // The number of EFI signature database updates applied in this branch
+	dbSet                      secureBootDbSet // The signature database set associated with this branch
+	firmwareVerificationEvents tpm2.DigestList // The verification events recorded by firmware in this branch
+	shimVerificationEvents     tpm2.DigestList // The verification events recorded by shim in this branch
+}
 
-	n.firmwareVerificationEvents = make(tpm2.DigestList, len(p.firmwareVerificationEvents))
-	copy(n.firmwareVerificationEvents, p.firmwareVerificationEvents)
-	n.shimVerificationEvents = make(tpm2.DigestList, len(p.shimVerificationEvents))
-	copy(n.shimVerificationEvents, p.shimVerificationEvents)
+// branch creates a branch point in the current branch if one doesn't exist already (although inserting this branch point with
+// PCRProtectionProfile.AddProfileOR is deferred until later), and creates a new sub-branch at the current branch point. Once
+// this has been called, no more instructions can be inserted in to the current branch.
+func (b *secureBootPolicyGenBranch) branch() *secureBootPolicyGenBranch {
+	c := &secureBootPolicyGenBranch{gen: b.gen, profile: NewPCRProtectionProfile()}
+	b.subBranches = append(b.subBranches, c)
 
-	return n
-}
+	// Preserve the context associated with this branch
+	c.dbUpdateLevel = b.dbUpdateLevel
+	c.dbSet = b.dbSet
+	c.firmwareVerificationEvents = make(tpm2.DigestList, len(b.firmwareVerificationEvents))
+	copy(c.firmwareVerificationEvents, b.firmwareVerificationEvents)
+	c.shimVerificationEvents = make(tpm2.DigestList, len(b.shimVerificationEvents))
+	copy(c.shimVerificationEvents, b.shimVerificationEvents)
 
-type loadEventAndPaths struct {
-	event *EFIImageLoadEvent
-	paths []*secureBootPolicyGenPath
+	return c
 }
 
-// secureBootPolicyGen is the main structure involved with computing secure boot policy PCR digests.
-type secureBootPolicyGen struct {
-	*EFISecureBootPolicyProfileParams
+// extendMeasurement extends the supplied digest to this branch.
+func (b *secureBootPolicyGenBranch) extendMeasurement(digest tpm2.Digest) {
+	if len(b.subBranches) > 0 {
+		panic("This branch has already been branched")
+	}
+	b.profile.ExtendPCR(b.gen.pcrAlgorithm, secureBootPCR, digest)
 }
 
-// extendMeasurement extends the supplied digest to the current value of pcrValue for the specified event path.
-func (g *secureBootPolicyGen) extendMeasurement(path *secureBootPolicyGenPath, digest tpm2.Digest) {
-	path.extendMeasurement(g.PCRAlgorithm, digest)
+// extendVerificationMeasurement extends the supplied digest and records that the digest has been measured by the specified source in
+// to this branch.
+func (b *secureBootPolicyGenBranch) extendVerificationMeasurement(digest tpm2.Digest, source EFIImageLoadEventSource) {
+	var digests *tpm2.DigestList
+	switch source {
+	case Firmware:
+		digests = &b.firmwareVerificationEvents
+	case Shim:
+		digests = &b.shimVerificationEvents
+	}
+	*digests = append(*digests, digest)
+	b.extendMeasurement(digest)
 }
 
-// extendFirmwareVerificationMeasurement extends the supplied digest to the current value of pcrValue for the specified event path,
-// and records the extended digest in order to avoid measuring the same verification event more than once.
-func (g *secureBootPolicyGen) extendFirmwareVerificationMeasurement(path *secureBootPolicyGenPath, digest tpm2.Digest) {
-	path.extendVerificationMeasurement(g.PCRAlgorithm, digest, Firmware)
+// extendFirmwareVerificationMeasurement extends the supplied digest and records that the digest has been measured by the firmware
+// in to this branch.
+func (b *secureBootPolicyGenBranch) extendFirmwareVerificationMeasurement(digest tpm2.Digest) {
+	b.extendVerificationMeasurement(digest, Firmware)
 }
 
-// computeAndExtendVariableMeasurement computes a EFI variable measurement from the supplied arguments and extends that to the
-// current value of pcrValue for the specified event path.
-func (g *secureBootPolicyGen) computeAndExtendVariableMeasurement(path *secureBootPolicyGenPath, varName *tcglog.EFIGUID, unicodeName string, varData []byte) error {
-	data := tcglog.EFIVariableEventData{
-		VariableName: *varName,
+// omputeAndExtendVariableMeasurement computes a EFI variable measurement from the supplied arguments and extends that to
+// this branch.
+func (b *secureBootPolicyGenBranch) computeAndExtendVariableMeasurement(varName tcglog.EFIGUID, unicodeName string, varData []byte) error {
+	data := tcglog.EFIVariableData{
+		VariableName: varName,
 		UnicodeName:  unicodeName,
 		VariableData: varData}
-	h := g.PCRAlgorithm.NewHash()
+	h := b.gen.pcrAlgorithm.NewHash()
 	if err := data.EncodeMeasuredBytes(h); err != nil {
 		return xerrors.Errorf("cannot encode EFI_VARIABLE_DATA: %w", err)
 	}
-	g.extendMeasurement(path, h.Sum(nil))
-	return nil
-}
-
-// computeAndExtendVerificationMeasurement computes a verification measurement for the EFI image obtained from r and extends that to
-// the current value of pcrValue for the specified event paths. If the computed verification measurement has already been measured
-// from the specified source on an event path, then it will not be measured again.
-//
-// In order to compute the measurement for each event path, the source of the certificate that will be used to verify the image
-// needs to be determined. If the image is not signed with an authority that chains to a valid signature database for a specific path,
-// then that path will be marked as unbootable and its computed PCR digest shall be omitted from the final results.
-func (g *secureBootPolicyGen) computeAndExtendVerificationMeasurement(paths []*secureBootPolicyGenPath, r io.ReaderAt, source EFIImageLoadEventSource) error {
-	pefile, err := pe.NewFile(r)
-	if err != nil {
-		return xerrors.Errorf("cannot decode PE binary: %w", err)
-	}
-
-	if pefile.OptionalHeader == nil {
-		// Work around debug/pe not handling variable length optional headers - see
-		// https://github.com/golang/go/commit/3b92f36d15c868e856be71c0fadfc7ff97039b96. We copy the required functionality from that commit
-		// in to this package for now in order to avoid a hard dependency on newer go versions.
-		h, err := readVariableLengthOptionalHeader(r, pefile.FileHeader.SizeOfOptionalHeader)
-		if err != nil {
-			return xerrors.Errorf("cannot decode PE binary optional header: %w", err)
-		}
-		pefile.OptionalHeader = h
-	}
-
-	// Obtain security directory entry from optional header
-	var dd *pe.DataDirectory
-	switch oh := pefile.OptionalHeader.(type) {
-	case *pe.OptionalHeader32:
-		if oh.NumberOfRvaAndSizes < 5 {
-			return errors.New("cannot obtain security directory entry from PE binary: invalid number of data directories")
-		}
-		dd = &oh.DataDirectory[4]
-	case *pe.OptionalHeader64:
-		if oh.NumberOfRvaAndSizes < 5 {
-			return errors.New("cannot obtain security directory entry from PE binary: invalid number of data directories")
-		}
-		dd = &oh.DataDirectory[4]
-	default:
-		return errors.New("cannot obtain security directory entry from PE binary: no optional header")
-	}
-
-	// Create a reader for the security directory entry, which points to a WIN_CERTIFICATE struct
-	secReader := io.NewSectionReader(r, int64(dd.VirtualAddress), int64(dd.Size))
-
-	var cert *winCertificateAuthenticode
-	if c, err := decodeWinCertificate(secReader); err != nil {
-		return xerrors.Errorf("cannot decode WIN_CERTIFICATE from security directory entry of PE binary: %w", err)
-	} else if c.wCertificateType() != winCertTypePKCSSignedData {
-		return fmt.Errorf("unexpected value for WIN_CERTIFICATE.wCertificateType (0x%04x): not an Authenticode signature", c.wCertificateType())
-	} else {
-		cert = c.(*winCertificateAuthenticode)
-	}
-
-	// Decode the signature
-	p7, err := pkcs7.Parse(cert.Data)
-	if err != nil {
-		return xerrors.Errorf("cannot decode signature: %w", err)
-	}
-
-	// Grab the certificate for the signing key
-	signer := p7.GetOnlySigner()
-	if signer == nil {
-		return errors.New("cannot obtain signer certificate from signature")
-	}
-
-	for _, p := range paths {
-		if p.unbootable {
-			continue
-		}
-
-		dbs := []*secureBootDb{p.dbSet.uefiDb}
-		if source == Shim {
-			if p.dbSet.shimDb == nil {
-				return errors.New("shim specified as event source without a shim executable appearing in preceding events")
-			}
-			dbs = append(dbs, p.dbSet.mokDb, p.dbSet.shimDb)
-		}
-
-		var root *efiSignatureData
-		var rootDb *secureBootDb
-	Outer:
-		for _, db := range dbs {
-			if db == nil {
-				continue
-			}
-
-			for _, s := range db.signatures {
-				// Ignore signatures that aren't X509 certificates
-				if s.signatureType != *efiCertX509Guid {
-					continue
-				}
-
-				if bytes.Equal(s.data, signer.Raw) {
-					// The signing certificate is actually the root in the DB
-					root = s
-					rootDb = db
-					break Outer
-				}
-
-				c, err := x509.ParseCertificate(s.data)
-				if err != nil {
-					continue
-				}
-
-				if err := signer.CheckSignatureFrom(c); err == nil {
-					// The signing certificate was issued by this root
-					root = s
-					rootDb = db
-					break Outer
-				}
-			}
-		}
-
-		if root == nil {
-			p.unbootable = true
-			continue
-		}
-
-		// Serialize authority certificate for measurement
-		var varData *bytes.Buffer
-		switch source {
-		case Firmware:
-			// Firmware measures the entire EFI_SIGNATURE_DATA, including the SignatureOwner
-			varData = new(bytes.Buffer)
-			if err := root.encode(varData); err != nil {
-				return xerrors.Errorf("cannot encode EFI_SIGNATURE_DATA for authority: %w", err)
-			}
-		case Shim:
-			// Shim measures the certificate data, rather than the entire EFI_SIGNATURE_DATA
-			varData = bytes.NewBuffer(root.data)
-		}
-
-		// Create event data, compute digest and perform extension for verification of this executable
-		eventData := tcglog.EFIVariableEventData{
-			VariableName: rootDb.variableName,
-			UnicodeName:  rootDb.unicodeName,
-			VariableData: varData.Bytes()}
-		h := g.PCRAlgorithm.NewHash()
-		if err := eventData.EncodeMeasuredBytes(h); err != nil {
-			return xerrors.Errorf("cannot encode EFI_VARIABLE_DATA: %w", err)
-		}
-		digest := h.Sum(nil)
-
-		// Don't measure events that have already been measured
-		var digests *tpm2.DigestList
-		switch source {
-		case Firmware:
-			digests = &p.firmwareVerificationEvents
-		case Shim:
-			digests = &p.shimVerificationEvents
-		}
-		measured := false
-		for _, d := range *digests {
-			if bytes.Equal(d, digest) {
-				measured = true
-				break
-			}
-		}
-		if measured {
-			continue
-		}
-		p.extendVerificationMeasurement(g.PCRAlgorithm, digest, source)
-	}
-
+	b.extendMeasurement(h.Sum(nil))
 	return nil
 }
 
 // processSignatureDbMeasurementEvent computes a EFI signature database measurement for the specified database and with the supplied
-// updates, and then extends that to the current value of pcrValue for the specified event path.
-func (g *secureBootPolicyGen) processSignatureDbMeasurementEvent(path *secureBootPolicyGenPath, guid *tcglog.EFIGUID, name, filename string, sigDbUpdates []*secureBootDbUpdate) ([]byte, error) {
-	db, err := ioutil.ReadFile(filepath.Join(efivarsPath, filename))
+// updates, and then extends that in to this branch.
+func (b *secureBootPolicyGenBranch) processSignatureDbMeasurementEvent(guid tcglog.EFIGUID, name, filename string, updates []*secureBootDbUpdate, updateQuirkMode sigDbUpdateQuirkMode) ([]byte, error) {
+	db, err := ioutil.ReadFile(filepath.Join(efi.EFIVarsPath, filename))
 	if err != nil && !os.IsNotExist(err) {
 		return nil, xerrors.Errorf("cannot read current variable: %w", err)
 	}
@@ -965,44 +695,45 @@
 		if len(db) < 4 {
 			return nil, errors.New("current variable data is too short")
 		}
+		// Skip over the 4-byte attribute field
 		db = db[4:]
 	}
 
-	for _, u := range sigDbUpdates {
+	for _, u := range updates {
 		if u.db != name {
 			continue
 		}
 		if f, err := os.Open(u.path); err != nil {
 			return nil, xerrors.Errorf("cannot open signature DB update: %w", err)
-		} else if d, err := computeDbUpdate(bytes.NewReader(db), f); err != nil {
+		} else if d, err := computeDbUpdate(bytes.NewReader(db), f, updateQuirkMode); err != nil {
 			return nil, xerrors.Errorf("cannot compute signature DB update for %s: %w", u.path, err)
 		} else {
 			db = d
 		}
 	}
 
-	if err := g.computeAndExtendVariableMeasurement(path, guid, name, db); err != nil {
+	if err := b.computeAndExtendVariableMeasurement(guid, name, db); err != nil {
 		return nil, xerrors.Errorf("cannot compute and extend measurement: %w", err)
 	}
 
 	return db, nil
 }
 
-// processKEKMeasurementEvent computes a measurement of KEK with the supplied udates applied and then extends that to the current
-// value of pcrValue for the specified event path.
-func (g *secureBootPolicyGen) processKEKMeasurementEvent(path *secureBootPolicyGenPath, sigDbUpdates []*secureBootDbUpdate) error {
-	if _, err := g.processSignatureDbMeasurementEvent(path, efiGlobalVariableGuid, kekName, kekFilename, sigDbUpdates); err != nil {
+// processKEKMeasurementEvent computes a measurement of KEK with the supplied udates applied and then extends that in to
+// this branch.
+func (b *secureBootPolicyGenBranch) processKEKMeasurementEvent(updates []*secureBootDbUpdate, updateQuirkMode sigDbUpdateQuirkMode) error {
+	if _, err := b.processSignatureDbMeasurementEvent(efiGlobalVariableGuid, kekName, kekFilename, updates, updateQuirkMode); err != nil {
 		return err
 	}
 	return nil
 }
 
-// processDbMeasurementEvent computes a measurement of the EFI authorized signature database with the supplied udates applied and then
-// extends that to the current value of pcrValue for the specified event path. The specified event path is then updated to contain
-// a list of signatures associated with the resulting authorized signature database contents, which is used later on when computing
-// verification events in secureBootPolicyGen.computeAndExtendVerificationMeasurement.
-func (g *secureBootPolicyGen) processDbMeasurementEvent(path *secureBootPolicyGenPath, sigDbUpdates []*secureBootDbUpdate) error {
-	db, err := g.processSignatureDbMeasurementEvent(path, efiImageSecurityDatabaseGuid, dbName, dbFilename, sigDbUpdates)
+// processDbMeasurementEvent computes a measurement of the EFI authorized signature database with the supplied updates applied and
+// then extends that in to this branch. The branch context is then updated to contain a list of signatures associated with the
+// resulting authorized signature database contents, which is used later on when computing verification events in
+// secureBootPolicyGen.computeAndExtendVerificationMeasurement.
+func (b *secureBootPolicyGenBranch) processDbMeasurementEvent(updates []*secureBootDbUpdate, updateQuirkMode sigDbUpdateQuirkMode) error {
+	db, err := b.processSignatureDbMeasurementEvent(efiImageSecurityDatabaseGuid, dbName, dbFilename, updates, updateQuirkMode)
 	if err != nil {
 		return err
 	}
@@ -1012,89 +743,338 @@
 		return xerrors.Errorf("cannot decode DB contents: %w", err)
 	}
 
-	path.dbSet.uefiDb = &secureBootDb{variableName: *efiImageSecurityDatabaseGuid, unicodeName: dbName, signatures: sigs}
+	b.dbSet.uefiDb = &secureBootDb{variableName: efiImageSecurityDatabaseGuid, unicodeName: dbName, signatures: sigs}
 
 	return nil
 }
 
-// processDbxMeasurementEvent computes a measurement of the EFI forbidden signature database with the supplied udates applied and then
-// extends that to the current value of pcrValue for the specified event path.
-func (g *secureBootPolicyGen) processDbxMeasurementEvent(path *secureBootPolicyGenPath, sigDbUpdates []*secureBootDbUpdate) error {
-	if _, err := g.processSignatureDbMeasurementEvent(path, efiImageSecurityDatabaseGuid, dbxName, dbxFilename, sigDbUpdates); err != nil {
+// processDbxMeasurementEvent computes a measurement of the EFI forbidden signature database with the supplied updates applied and
+// then extends that in to this branch.
+func (b *secureBootPolicyGenBranch) processDbxMeasurementEvent(updates []*secureBootDbUpdate, updateQuirkMode sigDbUpdateQuirkMode) error {
+	if _, err := b.processSignatureDbMeasurementEvent(efiImageSecurityDatabaseGuid, dbxName, dbxFilename, updates, updateQuirkMode); err != nil {
 		return err
 	}
 	return nil
 }
 
 // processPreOSEvents iterates over the pre-OS secure boot policy events contained within the supplied list of events and extends
-// these to the current value of pcrValue for the specified event path. For events corresponding to the measurement of EFI signature
-// databases, measurements are computed based on the current contents of each database with the supplied updates applied.
+// these in to this branch. For events corresponding to the measurement of EFI signature databases, measurements are computed based
+// on the current contents of each database with the supplied updates applied.
 //
-// Processing of the list of events stops when the verification event associated with the loading of the initial OS EFI executable
-// is encountered.
-func (g *secureBootPolicyGen) processPreOSEvents(path *secureBootPolicyGenPath, events []*tcglog.Event, initialOSVerificationEvent *secureBootVerificationEvent, sigDbUpdates []*secureBootDbUpdate) error {
-	for len(events) > 0 && events[0] != initialOSVerificationEvent.event {
+// Processing of the list of events stops after transitioning from pre-OS to OS-present. This transition is indicated when an
+// EV_SEPARATOR event has been measured to any of PCRs 0-6 AND PCR 7. This handles 2 different firmware behaviours:
+// - Some firmware implementations signal the transition by measuring EV_SEPARATOR events to PCRs 0-7 at the same time.
+// - Other firmware implementations measure a EV_SEPARATOR event to PCR 7 immediately after measuring the secure boot
+//   configuration, which is before the transition to OS-present. In this case, processing of pre-OS events in PCR 7
+//   must continue until an EV_SEPARATOR event is encountered in PCRs 0-6. On firmware implmentations that support
+//   secure boot verification of EFI drivers, these verification events will be recorded to PCR 7 after the
+//   EV_SEPARATOR event in PCR 7 but before the EV_SEPARATOR events in PCRs 0-6.
+func (b *secureBootPolicyGenBranch) processPreOSEvents(events []*tcglog.Event, sigDbUpdates []*secureBootDbUpdate, sigDbUpdateQuirkMode sigDbUpdateQuirkMode) error {
+	osPresent := false
+	seenSecureBootPCRSeparator := false
+
+	for len(events) > 0 {
 		e := events[0]
 		events = events[1:]
 		switch {
+		case e.PCRIndex < secureBootPCR && e.EventType == tcglog.EventTypeSeparator:
+			osPresent = true
 		case isKEKMeasurementEvent(e):
-			if err := g.processKEKMeasurementEvent(path, sigDbUpdates); err != nil {
+			if err := b.processKEKMeasurementEvent(sigDbUpdates, sigDbUpdateQuirkMode); err != nil {
 				return xerrors.Errorf("cannot process KEK measurement event: %w", err)
 			}
 		case isDbMeasurementEvent(e):
-			if err := g.processDbMeasurementEvent(path, sigDbUpdates); err != nil {
+			if err := b.processDbMeasurementEvent(sigDbUpdates, sigDbUpdateQuirkMode); err != nil {
 				return xerrors.Errorf("cannot process db measurement event: %w", err)
 			}
 		case isDbxMeasurementEvent(e):
-			if err := g.processDbxMeasurementEvent(path, sigDbUpdates); err != nil {
+			if err := b.processDbxMeasurementEvent(sigDbUpdates, sigDbUpdateQuirkMode); err != nil {
 				return xerrors.Errorf("cannot process dbx measurement event: %w", err)
 			}
 		case isVerificationEvent(e):
-			g.extendFirmwareVerificationMeasurement(path, tpm2.Digest(e.Digests[tcglog.AlgorithmId(g.PCRAlgorithm)]))
+			b.extendFirmwareVerificationMeasurement(tpm2.Digest(e.Digests[tcglog.AlgorithmId(b.gen.pcrAlgorithm)]))
 		case e.PCRIndex == secureBootPCR:
-			g.extendMeasurement(path, tpm2.Digest(e.Digests[tcglog.AlgorithmId(g.PCRAlgorithm)]))
+			b.extendMeasurement(tpm2.Digest(e.Digests[tcglog.AlgorithmId(b.gen.pcrAlgorithm)]))
+			if e.EventType == tcglog.EventTypeSeparator {
+				seenSecureBootPCRSeparator = true
+			}
+		}
+
+		if osPresent && seenSecureBootPCRSeparator {
+			break
 		}
 	}
 
-	if len(events) == 0 {
+	return nil
+}
+
+// processShimExecutableLaunch updates the context in this branch with the supplied shim vendor certificate so that it can be used
+// later on when computing verification events in secureBootPolicyGenBranch.computeAndExtendVerificationMeasurement.
+func (b *secureBootPolicyGenBranch) processShimExecutableLaunch(vendorCert []byte) {
+	b.dbSet.shimDb = &secureBootDb{variableName: shimGuid, unicodeName: shimName}
+	if vendorCert != nil {
+		b.dbSet.shimDb.signatures = append(b.dbSet.shimDb.signatures, &efiSignatureData{signatureType: efiCertX509Guid, data: vendorCert})
+	}
+	b.shimVerificationEvents = nil
+}
+
+// hasVerificationEventBeenMeasuredBy determines whether the verification event with the associated digest has been measured by the
+// supplied source already in this branch.
+func (b *secureBootPolicyGenBranch) hasVerificationEventBeenMeasuredBy(digest tpm2.Digest, source EFIImageLoadEventSource) bool {
+	var digests *tpm2.DigestList
+	switch source {
+	case Firmware:
+		digests = &b.firmwareVerificationEvents
+	case Shim:
+		digests = &b.shimVerificationEvents
+	}
+	for _, d := range *digests {
+		if bytes.Equal(d, digest) {
+			return true
+		}
+	}
+	return false
+}
+
+// computeAndExtendVerificationMeasurement computes a measurement for the the authentication of an EFI image using the supplied
+// signatures and extends that in to this branch. If the computed measurement has already been measured by the specified source, then
+// it will not be measured again.
+//
+// In order to compute the measurement, the CA certificate that will be used to authenticate the image using the supplied signatures,
+// and the source of that certificate, needs to be determined. If the image is not signed with an authority that is trusted by a CA
+// certificate that exists in this branch, then this branch will be marked as unbootable and it will be omitted from the final PCR
+// profile.
+func (b *secureBootPolicyGenBranch) computeAndExtendVerificationMeasurement(sigs []*authenticodeSignerAndIntermediates, source EFIImageLoadEventSource) error {
+	if b.profile == nil {
+		// This branch is going to be excluded because it is unbootable.
 		return nil
 	}
 
-	if initialOSVerificationEvent.imageLoadEvent.PCRIndex == bootManagerCodePCR {
+	dbs := []*secureBootDb{b.dbSet.uefiDb}
+	if source == Shim {
+		if b.dbSet.shimDb == nil {
+			return errors.New("shim specified as event source without a shim executable appearing in preceding events")
+		}
+		dbs = append(dbs, b.dbSet.mokDb, b.dbSet.shimDb)
+	}
+
+	var authority *secureBootAuthority
+
+	// To determine what CA certificate will be used to authenticate this image, iterate over the signatures in the order in which they
+	// appear in the binary in this outer loop. Iterating over the CA certificates occurs in an inner loop. This behaviour isn't defined
+	// in the UEFI specification but it matches EDK2 and the firmware on the Intel NUC. If an implementation iterates over the CA
+	// certificates in an outer loop and the signatures in an inner loop, then this may produce the wrong result.
+Outer:
+	for _, sig := range sigs {
+		for _, db := range dbs {
+			if db == nil {
+				continue
+			}
+
+			for _, caSig := range db.signatures {
+				// Ignore signatures that aren't X509 certificates
+				if caSig.signatureType != efiCertX509Guid {
+					continue
+				}
+
+				ca, err := x509.ParseCertificate(caSig.data)
+				if err != nil {
+					continue
+				}
+
+				// XXX: This doesn't work if there isn't a direct relationship between the
+				// signing certificate and the CA (ie, there are intermediates). Ideally we
+				// would use x509.Certificate.Verify here, but there is no way to turn off
+				// time checking and UEFI doesn't consider expired certificates invalid.
+				if bytes.Equal(ca.Raw, sig.signer.Raw) {
+					// The signer certificate is the CA
+					authority = &secureBootAuthority{signature: caSig, source: db}
+					break Outer
+				}
+				if err := sig.signer.CheckSignatureFrom(ca); err == nil {
+					// The signer certificate is directly trusted by the CA
+					authority = &secureBootAuthority{signature: caSig, source: db}
+					break Outer
+				}
+			}
+		}
+	}
+
+	if authority == nil {
+		// Mark this branch as unbootable by clearing its PCR profile
+		b.profile = nil
 		return nil
 	}
 
-	// The verification event associated with the initial OS load event was recorded as part of a UEFI driver load, so we need to keep it.
-	g.extendFirmwareVerificationMeasurement(path, tpm2.Digest(initialOSVerificationEvent.event.Digests[tcglog.AlgorithmId(g.PCRAlgorithm)]))
+	// Serialize authority certificate for measurement
+	var varData *bytes.Buffer
+	switch source {
+	case Firmware:
+		// Firmware measures the entire EFI_SIGNATURE_DATA, including the SignatureOwner
+		varData = new(bytes.Buffer)
+		if err := authority.signature.encode(varData); err != nil {
+			return xerrors.Errorf("cannot encode EFI_SIGNATURE_DATA for authority: %w", err)
+		}
+	case Shim:
+		// Shim measures the certificate data, rather than the entire EFI_SIGNATURE_DATA
+		varData = bytes.NewBuffer(authority.signature.data)
+	}
 
+	// Create event data, compute digest and perform extension for verification of this executable
+	eventData := tcglog.EFIVariableData{
+		VariableName: authority.source.variableName,
+		UnicodeName:  authority.source.unicodeName,
+		VariableData: varData.Bytes()}
+	h := b.gen.pcrAlgorithm.NewHash()
+	if err := eventData.EncodeMeasuredBytes(h); err != nil {
+		return xerrors.Errorf("cannot encode EFI_VARIABLE_DATA: %w", err)
+	}
+	digest := h.Sum(nil)
+
+	// Don't measure events that have already been measured
+	if b.hasVerificationEventBeenMeasuredBy(digest, source) {
+		return nil
+	}
+	b.extendVerificationMeasurement(digest, source)
 	return nil
 }
 
-// processShimExecutable extracts the vendor certificate from the shim executable read from r, and then updates the specified event
-// paths to contain a reference to the vendor certificate so that it can be used later on when computing verification events in
-// secureBootPolicyGen.computeAndExtendVerificationMeasurement.
-func (g *secureBootPolicyGen) processShimExecutable(paths []*secureBootPolicyGenPath, r io.ReaderAt) error {
+// sbLoadEventAndBranches binds together a EFIImageLoadEvent and the branches that the event needs to be applied to.
+type sbLoadEventAndBranches struct {
+	event    *EFIImageLoadEvent
+	branches []*secureBootPolicyGenBranch
+}
+
+func (e *sbLoadEventAndBranches) branch(event *EFIImageLoadEvent) *sbLoadEventAndBranches {
+	var branches []*secureBootPolicyGenBranch
+	for _, b := range e.branches {
+		if b.profile == nil {
+			continue
+		}
+		branches = append(branches, b.branch())
+	}
+	return &sbLoadEventAndBranches{event, branches}
+}
+
+// computeAndExtendVerificationMeasurement computes a measurement for the the authentication of the EFI image obtained from r and
+// extends that to the supplied branches. If the computed measurement has already been measured by the specified source in a branch,
+// then it will not be measured again.
+//
+// In order to compute the measurement for each branch, the CA certificate that will be used to authenticate the image and the
+// source of that certificate needs to be determined. If the image is not signed with an authority that is trusted by a CA
+// certificate for a particular branch, then that branch will be marked as unbootable and it will be omitted from the final PCR
+// profile.
+func (g *secureBootPolicyGen) computeAndExtendVerificationMeasurement(branches []*secureBootPolicyGenBranch, r io.ReaderAt, source EFIImageLoadEventSource) error {
+	pefile, err := pe.NewFile(r)
+	if err != nil {
+		return xerrors.Errorf("cannot decode PE binary: %w", err)
+	}
+
+	// Obtain security directory entry from optional header
+	var dd []pe.DataDirectory
+	switch oh := pefile.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		dd = oh.DataDirectory[0:oh.NumberOfRvaAndSizes]
+	case *pe.OptionalHeader64:
+		dd = oh.DataDirectory[0:oh.NumberOfRvaAndSizes]
+	default:
+		return errors.New("cannot obtain security directory entry from PE binary: no optional header")
+	}
+
+	if len(dd) <= certTableIndex {
+		return errors.New("cannot obtain security directory entry from PE binary: invalid number of data directories")
+	}
+
+	// Create a reader for the security directory entry, which points to a WIN_CERTIFICATE struct
+	certReader := io.NewSectionReader(r, int64(dd[certTableIndex].VirtualAddress), int64(dd[certTableIndex].Size))
+
+	// Binaries can have multiple signers - this is achieved using multiple single-signed Authenticode signatures - see section 32.5.3.3
+	// ("Secure Boot and Driver Signing - UEFI Image Validation - Signature Database Update - Authorization Process") of the UEFI
+	// Specification, version 2.8.
+	var sigs []*authenticodeSignerAndIntermediates
+	read := 0
+	for {
+		// Signatures in this section are 8-byte aligned - see the PE spec:
+		// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#the-attribute-certificate-table-image-only
+		alignSize := (8 - (read & 7)) % 8
+		read += alignSize
+		certReader.Seek(int64(alignSize), io.SeekCurrent)
+
+		if int64(read) >= certReader.Size() {
+			break
+		}
+
+		c, n, err := decodeWinCertificate(certReader)
+		switch {
+		case err != nil:
+			return xerrors.Errorf("cannot decode WIN_CERTIFICATE from security directory entry of PE binary: %w", err)
+		case c.wCertificateType() != winCertTypePKCSSignedData:
+			return fmt.Errorf("unexpected value for WIN_CERTIFICATE.wCertificateType (0x%04x): not an Authenticode signature", c.wCertificateType())
+		}
+
+		read += n
+
+		// Decode the signature
+		p7, err := pkcs7.Parse(c.(*winCertificateAuthenticode).Data)
+		if err != nil {
+			return xerrors.Errorf("cannot decode signature: %w", err)
+		}
+
+		// Grab the certificate of the signer
+		signer := p7.GetOnlySigner()
+		if signer == nil {
+			return errors.New("cannot obtain signer certificate from signature")
+		}
+
+		// Reject any signature with a digest algorithm other than SHA256, as that's the only algorithm used for binaries we're
+		// expected to support, and therefore required by the UEFI implementation.
+		if !p7.Signers[0].DigestAlgorithm.Algorithm.Equal(oidSha256) {
+			return errors.New("signature has unexpected digest algorithm")
+		}
+
+		// Grab all of the certificates in the signature and populate an intermediates pool
+		intermediates := x509.NewCertPool()
+		for _, c := range p7.Certificates {
+			intermediates.AddCert(c)
+		}
+
+		sigs = append(sigs, &authenticodeSignerAndIntermediates{signer: p7.GetOnlySigner(), intermediates: intermediates})
+	}
+
+	if len(sigs) == 0 {
+		return errors.New("no Authenticode signatures")
+	}
+
+	for _, b := range branches {
+		if err := b.computeAndExtendVerificationMeasurement(sigs, source); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// processShimExecutableLaunch extracts the vendor certificate from the shim executable read from r, and then updates the specified
+// branches to contain a reference to the vendor certificate so that it can be used later on when computing verification events in
+// secureBootPolicyGen.computeAndExtendVerificationMeasurement for images that are authenticated by shim.
+func (g *secureBootPolicyGen) processShimExecutableLaunch(branches []*secureBootPolicyGenBranch, r io.ReaderAt) error {
 	// Extract this shim's vendor cert
 	vendorCert, err := readShimVendorCert(r)
 	if err != nil {
 		return xerrors.Errorf("cannot extract vendor certificate: %w", err)
 	}
 
-	for _, p := range paths {
-		p.dbSet.shimDb = &secureBootDb{variableName: *shimGuid, unicodeName: shimName}
-		if vendorCert != nil {
-			p.dbSet.shimDb.signatures = append(p.dbSet.shimDb.signatures, &efiSignatureData{signatureType: *efiCertX509Guid, data: vendorCert})
-		}
-		p.shimVerificationEvents = nil
+	for _, b := range branches {
+		b.processShimExecutableLaunch(vendorCert)
 	}
 
 	return nil
 }
 
-// processOSLoadEvent computes a measurement associated with the supplied image load event and extends this to the current value of
-// pcrValue for each of the specified event paths. If the image load corresponds to shim, then some additional processing is performed
-// to extract the included vendor certificate (see secureBootPolicyGen.processShimExecutable).
-func (g *secureBootPolicyGen) processOSLoadEvent(paths []*secureBootPolicyGenPath, event *EFIImageLoadEvent) error {
+// processOSLoadEvent computes a measurement associated with the supplied image load event and extends this to the specified branches.
+// If the image load corresponds to shim, then some additional processing is performed to extract the included vendor certificate
+// (see secureBootPolicyGen.processShimExecutableLaunch).
+func (g *secureBootPolicyGen) processOSLoadEvent(branches []*secureBootPolicyGenBranch, event *EFIImageLoadEvent) error {
 	r, err := event.Image.Open()
 	if err != nil {
 		return xerrors.Errorf("cannot open image: %w", err)
@@ -1106,7 +1086,7 @@
 		return xerrors.Errorf("cannot determine image type: %w", err)
 	}
 
-	if err := g.computeAndExtendVerificationMeasurement(paths, r, event.Source); err != nil {
+	if err := g.computeAndExtendVerificationMeasurement(branches, r, event.Source); err != nil {
 		return xerrors.Errorf("cannot compute load verification event: %w", err)
 	}
 
@@ -1114,118 +1094,172 @@
 		return nil
 	}
 
-	if err := g.processShimExecutable(paths, r); err != nil {
+	if err := g.processShimExecutableLaunch(branches, r); err != nil {
 		return xerrors.Errorf("cannot process shim executable: %w", err)
 	}
 
 	return nil
 }
 
-// run takes a TCG event log and computes a set of secure boot policy PCR digests from the supplied configuration (see
-// EFISecureBootPolicyProfileParams)
-func (g *secureBootPolicyGen) run(events []*tcglog.Event) (tpm2.DigestList, error) {
-	sigDbUpdates, err := buildSignatureDbUpdateList(g.SignatureDbUpdateKeystores)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot build list of UEFI signature DB updates: %w", err)
-	}
-
-	initialOSVerificationEvent, err := identifyInitialOSLaunchVerificationEvent(events)
-	if err != nil {
-		return nil, xerrors.Errorf("cannot identify initial OS launch verification event: %w", err)
-	}
-
-	var allPaths []*secureBootPolicyGenPath
-
-	for i := 0; i <= len(sigDbUpdates); i++ {
-		path := &secureBootPolicyGenPath{pcrValue: make(tpm2.Digest, g.PCRAlgorithm.Size()), dbUpdateLevel: i}
-		if err := g.processPreOSEvents(path, events, initialOSVerificationEvent, sigDbUpdates[0:i]); err != nil {
-			return nil, xerrors.Errorf("cannot process pre-OS events from event log: %w", err)
-		}
-		allPaths = append(allPaths, path)
+// run takes a TCG event log and builds a PCR profile from the supplied configuration (see EFISecureBootPolicyProfileParams)
+func (g *secureBootPolicyGen) run(profile *PCRProtectionProfile, sigDbUpdateQuirkMode sigDbUpdateQuirkMode) error {
+	// Process the pre-OS events for the current signature DB and then with each pending update applied
+	// in turn.
+	var roots []*secureBootPolicyGenBranch
+	for i := 0; i <= len(g.sigDbUpdates); i++ {
+		branch := &secureBootPolicyGenBranch{gen: g, profile: NewPCRProtectionProfile(), dbUpdateLevel: i}
+		if err := branch.processPreOSEvents(g.events, g.sigDbUpdates[0:i], sigDbUpdateQuirkMode); err != nil {
+			return xerrors.Errorf("cannot process pre-OS events from event log: %w", err)
+		}
+		roots = append(roots, branch)
 	}
 
-	numPreOSPaths := len(allPaths)
+	allBranches := make([]*secureBootPolicyGenBranch, len(roots))
+	copy(allBranches, roots)
 
-	duplicatePaths := func(paths []*secureBootPolicyGenPath) (out []*secureBootPolicyGenPath) {
-		for _, p := range paths {
-			p2 := p.duplicate()
-			allPaths = append(allPaths, p2)
-			out = append(out, p2)
-		}
-		return
-	}
+	var loadEvents []*sbLoadEventAndBranches
+	var nextLoadEvents []*sbLoadEventAndBranches
 
-	var loadEvents []*loadEventAndPaths
-	var nextLoadEvents []*loadEventAndPaths
-
-	for i, e := range g.LoadSequences {
-		var paths []*secureBootPolicyGenPath
-		if i == 0 {
-			paths = allPaths
-		} else {
-			paths = duplicatePaths(allPaths[0:numPreOSPaths])
+	if len(g.loadSequences) == 1 {
+		loadEvents = append(loadEvents, &sbLoadEventAndBranches{event: g.loadSequences[0], branches: roots})
+	} else {
+		for _, e := range g.loadSequences {
+			var branches []*secureBootPolicyGenBranch
+			for _, b := range roots {
+				branches = append(branches, b.branch())
+			}
+			allBranches = append(allBranches, branches...)
+			loadEvents = append(loadEvents, &sbLoadEventAndBranches{event: e, branches: branches})
 		}
-		loadEvents = append(loadEvents, &loadEventAndPaths{event: e, paths: paths})
 	}
 
 	for len(loadEvents) > 0 {
 		e := loadEvents[0]
 		loadEvents = loadEvents[1:]
-		if err := g.processOSLoadEvent(e.paths, e.event); err != nil {
-			return nil, xerrors.Errorf("cannot process OS load event for %s: %w", e.event.Image, err)
+
+		if err := g.processOSLoadEvent(e.branches, e.event); err != nil {
+			return xerrors.Errorf("cannot process OS load event for %s: %w", e.event.Image, err)
 		}
-		for i, n := range e.event.Next {
-			var paths []*secureBootPolicyGenPath
-			if i == 0 {
-				paths = e.paths
-			} else {
-				paths = duplicatePaths(e.paths)
+
+		if len(e.event.Next) == 1 {
+			nextLoadEvents = append(nextLoadEvents, &sbLoadEventAndBranches{event: e.event.Next[0], branches: e.branches})
+		} else {
+			for _, n := range e.event.Next {
+				ne := e.branch(n)
+				allBranches = append(allBranches, ne.branches...)
+				nextLoadEvents = append(nextLoadEvents, ne)
 			}
-			nextLoadEvents = append(nextLoadEvents, &loadEventAndPaths{event: n, paths: paths})
 		}
+
 		if len(loadEvents) == 0 {
 			loadEvents = nextLoadEvents
 			nextLoadEvents = nil
 		}
 	}
 
-	var results tpm2.DigestList
-	validPathsForCurrentDb := false
+	for i := len(allBranches) - 1; i >= 0; i-- {
+		b := allBranches[i]
 
-	for _, p := range allPaths {
-		if p.unbootable {
+		if len(b.subBranches) == 0 {
+			// This is a leaf branch
 			continue
 		}
-		if p.dbUpdateLevel == 0 {
-			validPathsForCurrentDb = true
-		}
-		duplicate := false
-		for _, d := range results {
-			if bytes.Equal(d, p.pcrValue) {
-				duplicate = true
-				break
+
+		var subProfiles []*PCRProtectionProfile
+		for _, sb := range b.subBranches {
+			if sb.profile == nil {
+				// This sub-branch has been marked unbootable
+				continue
 			}
+			subProfiles = append(subProfiles, sb.profile)
 		}
-		if duplicate {
+
+		if len(subProfiles) == 0 {
+			// All sub branches are unbootable, so ensure our parent branch omits us too.
+			b.profile = nil
 			continue
 		}
-		results = append(results, p.pcrValue)
+
+		b.profile.AddProfileOR(subProfiles...)
+	}
+
+	validPathsForCurrentDb := false
+	var subProfiles []*PCRProtectionProfile
+	for _, b := range roots {
+		if b.profile == nil {
+			// This branch has no bootable paths
+			continue
+		}
+		if b.dbUpdateLevel == 0 {
+			validPathsForCurrentDb = true
+		}
+		subProfiles = append(subProfiles, b.profile)
 	}
 
 	if !validPathsForCurrentDb {
-		return nil, errors.New("no bootable paths with current EFI signature database")
+		return errors.New("no bootable paths with current EFI signature database")
 	}
 
-	return results, nil
+	profile.AddProfileOR(subProfiles...)
+
+	return nil
 }
 
 // AddEFISecureBootPolicyProfile adds the UEFI secure boot policy profile to the provided PCR protection profile, in order to generate
-// a PCR policy that restricts access to a key to a set of UEFI secure boot policies measured to PCR 7. The secure boot policy
+// a PCR policy that restricts access to a sealed key to a set of UEFI secure boot policies measured to PCR 7. The secure boot policy
 // information that is measured to PCR 7 is defined in section 2.3.4.8 of the "TCG PC Client Platform Firmware Profile Specification".
 //
-// The secure boot policy measurements include events that correspond to the verification of loaded EFI images, and those events
-// record the certificate of the authorities used to verify images. The params argument allows the generated PCR policy to be
-// restricted to a specific set of chains of trust by specifying EFI image load sequences via the LoadSequences field.
+// This function can only be called if the current boot was performed with secure boot enabled. An error will be returned if the
+// current boot was performed with secure boot disabled. It can only generate a PCR profile that will work when secure boot is
+// enabled.
+//
+// The secure boot policy measurements include events that correspond to the authentication of loaded EFI images, and those events
+// record the certificate of the authorities used to authenticate these images. The params argument allows the generated PCR policy
+// to be restricted to a specific set of chains of trust by specifying EFI image load sequences via the LoadSequences field. This
+// function will compute the measurements associated with the authentication of these load sequences. Each of the EFIImage instances
+// reachable from the LoadSequences field of params must correspond to an EFI image with one or more Authenticode signatures. These
+// signatures are used to determine the CA certificate that will be used to authenticate them in order to compute authentication
+// meausurement events. The digest algorithm of the Authenticode signatures must be SHA256. If there are no signatures, or the
+// binary's certificate table contains non-Authenticode entries, or contains any Authenticode signatures with a digest algorithm other
+// than SHA256, then an error will be returned. Note that this function assumes that any signatures are correct and does not ensure
+// that they are so - it only determines if there is a chain of trust beween the signing certificate and a CA certificate in order to
+// determine which certificate will be used for authentication, and what the source of that certificate is (for UEFI images that are
+// loaded by shim).
+//
+// If none of the sequences in the LoadSequences field of params can be authenticated by the current authorized signature database
+// contents, then an error will be returned.
+//
+// This function does not support computing measurements for images that are authenticated by an image digest rather than an
+// Authenticode signature. If an image has a signature where the signer has a chain of trust to a CA certificate in the authorized
+// signature database (or shim's vendor certificate) but that image is authenticated because an image digest is present in the
+// authorized signature database instead, then this function will generate a PCR profile that is incorrect.
+//
+// If an image has a signature that can be authenticated by multiple CA certificates in the authorized signature database, this
+// function assumes that the firmware will try the CA certificates in the order in which they appear in the database and authenticate
+// the image with the first valid certificate. If the firmware does not do this, then this function may generate a PCR profile that is
+// incorrect for binaries that have a signature that can be authenticated by more than one CA certificate. Note that the structure of
+// the signature database means that it can only really be iterated in one direction anyway.
+//
+// For images with multiple Authenticode signatures, this function assumes that the device's firmware will iterate over the signatures
+// in the order in which they appear in the binary's certificate table in an outer loop during image authentication (ie, for each
+// signature, attempt to authenticate the binary using one of the CA certificates). If a device's firmware iterates over the
+// authorized signature database in an outer loop instead (ie, for each CA certificate, attempt to authenticate the binary using one
+// of its signatures), then this function may generate a PCR profile that is incorrect for binaries that have multiple signatures
+// where both signers have a chain of trust to a different CA certificate but the signatures appear in a different order to which
+// their CA certificates are enrolled.
+//
+// This function does not consider the contents of the forbidden signature database. This is most relevant for images with multiple
+// signatures. If an image has more than one signature where the signing certificates have chains of trust to different CA
+// certificates, but the first signature is not used to authenticate the image because one of the certificates in its chain is
+// blacklisted, then this function will generate a PCR profile that is incorrect.
+//
+// In determining whether a signing certificate has a chain of trust to a CA certificate, this function expects there to be a direct
+// relationship between the CA certificate and signing certificate. It does not currently detect that there is a chain of trust if
+// intermediate certificates form part of the chain. This is most relevant for images with multiple signatures. If an image has more
+// than one signature where the signing certificate have chains of trust to different CA certificate, but the first signature's chain
+// involves intermediate certificates, then this function will generate a PCR profile that is incorrect.
+//
+// This function does not support computing measurements for images that are authenticated by shim using a machine owner key (MOK).
 //
 // The secure boot policy measurements include the secure boot configuration, which includes the contents of the UEFI signature
 // databases. In order to support atomic updates of these databases with the sbkeysync tool, it is possible to generate a PCR policy
@@ -1233,88 +1267,90 @@
 // the SignatureDbUpdateKeystores field of the params argument. This function assumes that sbkeysync is executed with the
 // "--no-default-keystores" option. When there are pending updates in the specified directories, this function will generate a PCR
 // policy that is compatible with the current database contents and the database contents computed for each individual update.
+// Note that sbkeysync ignores errors when applying updates - if any of the pending updates don't apply for some reason, the generated
+// PCR profile will be invalid.
 //
 // For the most common case where there are no signature database updates pending in the specified keystore directories and each image
 // load event sequence corresponds to loads of images that are all verified with the same chain of trust, this is a complicated way of
 // adding a single PCR digest to the provided PCRProtectionProfile.
 func AddEFISecureBootPolicyProfile(profile *PCRProtectionProfile, params *EFISecureBootPolicyProfileParams) error {
 	// Load event log
-	eventLog, err := os.Open(eventLogPath)
+	eventLog, err := os.Open(efi.EventLogPath)
 	if err != nil {
 		return xerrors.Errorf("cannot open TCG event log: %w", err)
 	}
-	log, err := tcglog.NewLog(eventLog, tcglog.LogOptions{})
+	log, err := tcglog.ParseLog(eventLog, &tcglog.LogOptions{})
 	if err != nil {
-		return xerrors.Errorf("cannot parse TCG event log header: %w", err)
+		return xerrors.Errorf("cannot parse TCG event log: %w", err)
 	}
 
 	if !log.Algorithms.Contains(tcglog.AlgorithmId(params.PCRAlgorithm)) {
-		return errors.New("cannot compute secure boot policy digests: the TCG event log does not have the requested algorithm")
+		return errors.New("cannot compute secure boot policy profile: the TCG event log does not have the requested algorithm")
 	}
 
-	// Parse events and make sure that the current boot is sane.
-	var events []*tcglog.Event
-	for {
-		event, err := log.NextEvent()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return xerrors.Errorf("cannot parse TCG event log: %w", err)
-		}
-
+	// Make sure that the current boot is sane.
+	for _, event := range log.Events {
 		switch event.PCRIndex {
 		case bootManagerCodePCR:
 			if event.EventType == tcglog.EventTypeEFIAction && event.Data.String() == returningFromEfiApplicationEvent {
 				// Firmware should record this event if an EFI application returns to the boot manager. Bail out if this happened because the policy might not make sense.
-				return errors.New("cannot compute secure boot policy digests: the current boot was preceeded by a boot attempt to an EFI " +
+				return errors.New("cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI " +
 					"application that returned to the boot manager, without a reboot in between")
 			}
 		case secureBootPCR:
 			switch event.EventType {
 			case tcglog.EventTypeEFIVariableDriverConfig:
-				efiVarData, isEfiVar := event.Data.(*tcglog.EFIVariableEventData)
-				if !isEfiVar {
-					return fmt.Errorf("%s secure boot policy event has invalid event data", event.EventType)
+				if err, isErr := event.Data.(error); isErr {
+					return fmt.Errorf("%s secure boot policy event has invalid event data: %v", event.EventType, err)
 				}
-				if efiVarData.VariableName == *efiGlobalVariableGuid && efiVarData.UnicodeName == sbStateName {
+				efiVarData := event.Data.(*tcglog.EFIVariableData)
+				if efiVarData.VariableName == efiGlobalVariableGuid && efiVarData.UnicodeName == sbStateName {
 					switch {
 					case event.Index > 0:
 						// The spec says that secure boot policy must be measured again if the system supports changing it before ExitBootServices
 						// without a reboot. But the policy we create won't make sense, so bail out
-						return errors.New("cannot compute secure boot policy digests: secure boot configuration was modified after the initial " +
+						return errors.New("cannot compute secure boot policy profile: secure boot configuration was modified after the initial " +
 							"configuration was measured, without performing a reboot")
 					case efiVarData.VariableData[0] == 0x00:
-						return errors.New("cannot compute secure boot policy digests: the current boot was performed with secure boot disabled in firmware")
+						return errors.New("cannot compute secure boot policy profile: the current boot was performed with secure boot disabled in firmware")
 					}
 				}
 			case tcglog.EventTypeEFIVariableAuthority:
-				efiVarData, isEfiVar := event.Data.(*tcglog.EFIVariableEventData)
-				if !isEfiVar {
-					return fmt.Errorf("%s secure boot policy event has invalid event data", event.EventType)
+				if err, isErr := event.Data.(error); isErr {
+					return fmt.Errorf("%s secure boot policy event has invalid event data: %v", event.EventType, err)
 				}
-				if efiVarData.VariableName == *shimGuid && efiVarData.UnicodeName == mokSbStateName {
+				efiVarData := event.Data.(*tcglog.EFIVariableData)
+				if efiVarData.VariableName == shimGuid && efiVarData.UnicodeName == mokSbStateName {
 					// MokSBState is set to 0x01 if secure boot enforcement is disabled in shim. The variable is deleted when secure boot enforcement
 					// is enabled, so don't bother looking at the value here. It doesn't make a lot of sense to create a policy if secure boot
 					// enforcement is disabled in shim
-					return errors.New("cannot compute secure boot policy digests: the current boot was performed with validation disabled in Shim")
+					return errors.New("cannot compute secure boot policy profile: the current boot was performed with validation disabled in Shim")
 				}
 			}
 		}
-		events = append(events, event)
 	}
 
-	gen := &secureBootPolicyGen{params}
-	digests, err := gen.run(events)
+	// Initialize the secure boot PCR to 0
+	profile.AddPCRValue(params.PCRAlgorithm, secureBootPCR, make(tpm2.Digest, params.PCRAlgorithm.Size()))
+
+	// Compute a list of pending EFI signature DB updates.
+	sigDbUpdates, err := buildSignatureDbUpdateList(params.SignatureDbUpdateKeystores)
 	if err != nil {
-		return xerrors.Errorf("cannot compute secure boot policy digests: %w", err)
+		return xerrors.Errorf("cannot build list of UEFI signature DB updates: %w", err)
 	}
 
-	var subProfiles []*PCRProtectionProfile
-	for _, d := range digests {
-		subProfiles = append(subProfiles, NewPCRProtectionProfile().AddPCRValue(params.PCRAlgorithm, secureBootPCR, d))
+	gen := &secureBootPolicyGen{params.PCRAlgorithm, params.LoadSequences, log.Events, sigDbUpdates}
+
+	profile1 := NewPCRProtectionProfile()
+	if err := gen.run(profile1, sigDbUpdateQuirkModeNone); err != nil {
+		return xerrors.Errorf("cannot compute secure boot policy profile: %w", err)
 	}
 
-	profile.AddProfileOR(subProfiles...)
+	profile2 := NewPCRProtectionProfile()
+	if err := gen.run(profile2, sigDbUpdateQuirkModeDedupIgnoresOwner); err != nil {
+		return xerrors.Errorf("cannot compute secure boot policy profile: %w", err)
+	}
+
+	profile.AddProfileOR(profile1, profile2)
 	return nil
 }
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/snapmodel_policy.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/snapmodel_policy.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/snapmodel_policy.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/snapmodel_policy.go	2020-10-01 09:24:52.000000000 +0000
@@ -38,7 +38,16 @@
 	return h.Sum(nil)
 }
 
-func computeSnapModelDigest(alg tpm2.HashAlgorithmId, model *asserts.Model) (tpm2.Digest, error) {
+// SnapModel exposes the details of a snap device model that are to be measured.
+type SnapModel interface {
+	Series() string
+	BrandID() string
+	Model() string
+	Grade() asserts.ModelGrade
+	SignKeyID() string
+}
+
+func computeSnapModelDigest(alg tpm2.HashAlgorithmId, model SnapModel) (tpm2.Digest, error) {
 	signKeyId, err := base64.RawURLEncoding.DecodeString(model.SignKeyID())
 	if err != nil {
 		return nil, xerrors.Errorf("cannot decode signing key ID: %w", err)
@@ -74,7 +83,7 @@
 	PCRIndex int
 
 	// Models is the set of models to add to the PCR profile.
-	Models []*asserts.Model
+	Models []SnapModel
 }
 
 // AddSnapModelProfile adds the snap model profile to the PCR protection profile, as measured by snap-bootstrap, in order to generate
@@ -166,7 +175,7 @@
 
 // MeasureSnapModelToTPM measures a digest of the supplied model assertion to the specified PCR for all supported PCR banks.
 // See the documentation for AddSnapModelProfile for details of how the digest of the model is computed.
-func MeasureSnapModelToTPM(tpm *TPMConnection, pcrIndex int, model *asserts.Model) error {
+func MeasureSnapModelToTPM(tpm *TPMConnection, pcrIndex int, model SnapModel) error {
 	return measureSnapPropertyToTPM(tpm, pcrIndex, func(alg tpm2.HashAlgorithmId) (tpm2.Digest, error) {
 		return computeSnapModelDigest(alg, model)
 	})
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/tpm.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/tpm.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/tpm.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/tpm.go	2020-10-01 09:24:52.000000000 +0000
@@ -37,6 +37,10 @@
 	"time"
 
 	"github.com/canonical/go-tpm2"
+	"github.com/canonical/go-tpm2/mu"
+	"github.com/snapcore/secboot/internal/tcg"
+	"github.com/snapcore/secboot/internal/tcti"
+	"github.com/snapcore/secboot/internal/truststore"
 	"github.com/snapcore/snapd/httputil"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/sys"
@@ -44,26 +48,6 @@
 	"golang.org/x/xerrors"
 )
 
-const (
-	// FIXME: This is fine during initial install and early boot, but we should strive to use the resource manager at other times.
-	tpmPath string = "/dev/tpm0"
-
-	// Handle for RSA2048 EK certificate, see section 7.8 of "TCG TPM v2.0 Provisioning Guidance" Version 1.0, Revision 1.0, 15 March 2017.
-	ekCertHandle tpm2.Handle = 0x01c00002
-
-	sanDirectoryNameTag = 4 // Subject Alternative Name directoryName, see section 4.2.16 or RFC5280
-)
-
-var (
-	oidExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} // id-ce-subjectAltName, see section 4.2.16 of RFC5280
-
-	// TCG specific OIDs, see section 4 of "TCG EK Credential Profile For TPM Family 2.0; Level 0", Version 2.1, Revision 13, 10 December 2018.
-	oidTcgAttributeTpmManufacturer = asn1.ObjectIdentifier{2, 23, 133, 2, 1} // tcg-at-tpmManufacturer
-	oidTcgAttributeTpmModel        = asn1.ObjectIdentifier{2, 23, 133, 2, 2} // tcg-at-tpmModel
-	oidTcgAttributeTpmVersion      = asn1.ObjectIdentifier{2, 23, 133, 2, 3} // tcg-at-tpmVersion
-	oidTcgKpEkCertificate          = asn1.ObjectIdentifier{2, 23, 133, 8, 1} // tcg-kp-EKCertificate
-)
-
 // TPMDeviceAttributes contains details about the TPM extracted from a manufacturer issued endorsement key certificate.
 type TPMDeviceAttributes struct {
 	Manufacturer    tpm2.TPMManufacturer
@@ -81,6 +65,18 @@
 	hmacSession              tpm2.SessionContext
 }
 
+// IsEnabled indicates whether the TPM is enabled or whether it has been disabled by the platform firmware. A TPM device can be
+// disabled by the platform firmware by disabling the storage and endorsement hierarchies, but still remain visible to the operating
+// system.
+func (t *TPMConnection) IsEnabled() bool {
+	props, err := t.GetCapabilityTPMProperties(tpm2.PropertyStartupClear, 1, t.HmacSession().IncludeAttrs(tpm2.AttrAudit))
+	if err != nil || len(props) == 0 {
+		return false
+	}
+	const enabledMask = tpm2.AttrShEnable | tpm2.AttrEhEnable
+	return tpm2.StartupClearAttributes(props[0].Value)&enabledMask == enabledMask
+}
+
 // VerifiedEKCertChain returns the verified certificate chain for the endorsement key certificate obtained from this TPM. It was
 // verified using one of the built-in TPM manufacturer root CA certificates.
 func (t *TPMConnection) VerifiedEKCertChain() []*x509.Certificate {
@@ -130,7 +126,7 @@
 	}
 	defer tpm.FlushContext(session)
 
-	ek, _, _, _, _, err := tpm.CreatePrimary(tpm.EndorsementHandleContext(), nil, ekTemplate, nil, nil, session)
+	ek, _, _, _, _, err := tpm.CreatePrimary(tpm.EndorsementHandleContext(), nil, tcg.EKTemplate, nil, nil, session)
 	return ek, err
 }
 
@@ -153,8 +149,8 @@
 
 	// Insert the RSA public key in to the EK template to compute the name of the EK object we expected to read back from the TPM.
 	var ekPublic *tpm2.Public
-	b, _ := tpm2.MarshalToBytes(ekTemplate)
-	tpm2.UnmarshalFromBytes(b, &ekPublic)
+	b, _ := mu.MarshalToBytes(tcg.EKTemplate)
+	mu.UnmarshalFromBytes(b, &ekPublic)
 
 	// The default exponent of 2^^16-1 is indicated by the value of 0 in the public area.
 	if pubKey.E != 65537 {
@@ -204,8 +200,10 @@
 	t.ek = nil
 	t.provisionedSrk = nil
 
+	secureMode := len(t.verifiedEkCertChain) > 0
+
 	// Acquire an unverified ResourceContext for the EK. If there is no object at the persistent EK index, then attempt to create
-	// a transient EK with the supplied authorization.
+	// a transient EK with the supplied authorization if this is a secure connection.
 	//
 	// Under the hood, go-tpm2 initializes the ResourceContext with TPM2_ReadPublic (or TPM2_CreatePrimary if we create a new one),
 	// and it cross-checks that the returned name and public area match. The returned name is available via ek.Name and the
@@ -213,11 +211,11 @@
 	//
 	// Without verification against the EK certificate, ek isn't yet safe to use for secret sharing with the TPM.
 	ek, err := func() (tpm2.ResourceContext, error) {
-		ek, err := t.CreateResourceContextFromTPM(ekHandle)
-		if err == nil {
+		ek, err := t.CreateResourceContextFromTPM(tcg.EKHandle)
+		if err == nil || !secureMode {
 			return ek, nil
 		}
-		if !tpm2.IsResourceUnavailableError(err, ekHandle) {
+		if !tpm2.IsResourceUnavailableError(err, tcg.EKHandle) {
 			return nil, err
 		}
 		if ek, err := createTransientEk(t.TPMContext); err == nil {
@@ -225,30 +223,32 @@
 		}
 		return nil, err
 	}()
-	if err != nil && len(t.verifiedEkCertChain) > 0 {
+	if err != nil {
 		// A lack of EK should be fatal in this context
 		return xerrors.Errorf("cannot obtain context for EK: %w", err)
 	}
 
-	ekIsPersistent := false
-	if ek != nil {
-		if ek.Handle().Type() == tpm2.HandleTypeTransient {
-			defer t.FlushContext(ek)
-		} else {
-			ekIsPersistent = true
-		}
+	ekIsPersistent := func() bool {
+		return ek != nil && ek.Handle() == tcg.EKHandle
 	}
 
-	if len(t.verifiedEkCertChain) > 0 {
+	defer func() {
+		if ek == nil || ekIsPersistent() {
+			return
+		}
+		t.FlushContext(ek)
+	}()
+
+	if secureMode {
 		// Verify that ek is associated with the verified EK certificate. If the first attempt fails and ek references a persistent
 		// object, then try to create a transient EK with the provided authorization and make another attempt at verification, in case
 		// the persistent object isn't a valid EK.
 		rc, err := func() (tpm2.ResourceContext, error) {
 			err := verifyEk(t.verifiedEkCertChain[0], ek)
 			if err == nil {
-				return ek, nil
+				return nil, nil
 			}
-			if ek.Handle().Type() == tpm2.HandleTypeTransient {
+			if ek.Handle() != tcg.EKHandle {
 				// If this was already a transient EK, fail now
 				return nil, err
 			}
@@ -265,25 +265,17 @@
 		if err != nil {
 			return verificationError{xerrors.Errorf("cannot verify public area of endorsement key read from the TPM: %w", err)}
 		}
-		if ekIsPersistent && rc.Handle().Type() == tpm2.HandleTypeTransient {
+		if rc != nil {
 			// The persistent EK was bad, and we created and verified a transient EK instead
-			defer t.FlushContext(rc)
-			ekIsPersistent = false
+			ek = rc
 		}
-		ek = rc
-	} else if ekIsPersistent {
+	} else if ek != nil {
 		// If we don't have a verified EK certificate and ek is a persistent object, just do a sanity check that the public area returned
-		// from the TPM has the expected properties. If it doesn't, then attempt to create a transient EK with the provided authorization
-		// value.
-		if ok, err := isObjectPrimaryKeyWithTemplate(t.TPMContext, t.EndorsementHandleContext(), ek, ekTemplate, nil); err != nil {
+		// from the TPM has the expected properties. If it doesn't, then don't use it, as TPM2_StartAuthSession might fail.
+		if ok, err := isObjectPrimaryKeyWithTemplate(t.TPMContext, t.EndorsementHandleContext(), ek, tcg.EKTemplate, nil); err != nil {
 			return xerrors.Errorf("cannot determine if object is a primary key in the endorsement hierarchy: %w", err)
 		} else if !ok {
-			transientEk, err := createTransientEk(t.TPMContext)
-			if err == nil {
-				defer t.FlushContext(transientEk)
-			}
-			ekIsPersistent = false
-			ek = transientEk
+			ek = nil
 		}
 	}
 
@@ -307,7 +299,7 @@
 		t.FlushContext(session)
 	}()
 
-	if len(t.verifiedEkCertChain) > 0 {
+	if secureMode {
 		_, err = t.GetRandom(20, session.WithAttrs(tpm2.AttrContinueSession|tpm2.AttrAudit))
 		if err != nil {
 			if isAuthFailError(err, tpm2.CommandGetRandom, 1) {
@@ -319,7 +311,7 @@
 
 	succeeded = true
 
-	if ekIsPersistent {
+	if ekIsPersistent() {
 		t.ek = ek
 	}
 	t.hmacSession = session
@@ -329,7 +321,7 @@
 // readEkCertFromTPM reads the manufacturer injected certificate for the default RSA2048 EK from the standard index, and
 // returns it as a DER encoded byte slice.
 func readEkCertFromTPM(tpm *tpm2.TPMContext) ([]byte, error) {
-	ekCertIndex, err := tpm.CreateResourceContextFromTPM(ekCertHandle)
+	ekCertIndex, err := tpm.CreateResourceContextFromTPM(tcg.EKCertHandle)
 	if err != nil {
 		return nil, xerrors.Errorf("cannot create context: %w", err)
 	}
@@ -347,19 +339,27 @@
 	return cert, nil
 }
 
-// openDefaultTcti connects to the default TPM character device. This can be overridden for tests to connect to a simulator device.
-var openDefaultTcti = func() (io.ReadWriteCloser, error) {
-	return tpm2.OpenTPMDevice(tpmPath)
-}
-
 // connectToDefaultTPM opens a connection to the default TPM device.
 func connectToDefaultTPM() (*tpm2.TPMContext, error) {
-	tcti, err := openDefaultTcti()
+	tcti, err := tcti.OpenDefault()
 	if err != nil {
+		if isPathError(err) {
+			return nil, ErrNoTPM2Device
+		}
 		return nil, xerrors.Errorf("cannot open TPM device: %w", err)
 	}
 
 	tpm, _ := tpm2.NewTPMContext(tcti)
+	isTpm2, err := tpm.IsTPM2()
+	if err != nil {
+		tpm.Close()
+		return nil, xerrors.Errorf("cannot determine if TPM is a TPM2 device: %w", err)
+	}
+	if !isTpm2 {
+		tpm.Close()
+		return nil, ErrNoTPM2Device
+	}
+
 	return tpm, nil
 }
 
@@ -374,7 +374,7 @@
 
 func isExtKeyUsageEkCertificate(usage []asn1.ObjectIdentifier) bool {
 	for _, u := range usage {
-		if u.Equal(oidTcgKpEkCertificate) {
+		if u.Equal(tcg.OIDTcgKpEkCertificate) {
 			return true
 		}
 	}
@@ -418,7 +418,7 @@
 	for _, rdns := range dirName {
 		for _, atv := range rdns {
 			switch {
-			case atv.Type.Equal(oidTcgAttributeTpmManufacturer):
+			case atv.Type.Equal(tcg.OIDTcgAttributeTpmManufacturer):
 				if hasManufacturer {
 					return nil, nil, asn1.StructuralError{Msg: "duplicate TPM manufacturer"}
 				}
@@ -438,7 +438,7 @@
 					return nil, nil, asn1.StructuralError{Msg: "invalid TPM manufacturer: too short"}
 				}
 				attrs.Manufacturer = tpm2.TPMManufacturer(binary.BigEndian.Uint32(hex))
-			case atv.Type.Equal(oidTcgAttributeTpmModel):
+			case atv.Type.Equal(tcg.OIDTcgAttributeTpmModel):
 				if hasModel {
 					return nil, nil, asn1.StructuralError{Msg: "duplicate TPM model"}
 				}
@@ -448,7 +448,7 @@
 					return nil, nil, asn1.StructuralError{Msg: "invalid TPM attribute value"}
 				}
 				attrs.Model = s
-			case atv.Type.Equal(oidTcgAttributeTpmVersion):
+			case atv.Type.Equal(tcg.OIDTcgAttributeTpmVersion):
 				if hasVersion {
 					return nil, nil, asn1.StructuralError{Msg: "duplicate TPM firmware version"}
 				}
@@ -504,7 +504,7 @@
 			return nil, nil, asn1.StructuralError{Msg: "invalid SAN entry"}
 		}
 
-		if v.Tag == sanDirectoryNameTag {
+		if v.Tag == tcg.SANDirectoryNameTag {
 			var dirName pkix.RDNSequence
 			if rest, err := asn1.Unmarshal(v.Bytes, &dirName); err != nil {
 				return nil, nil, err
@@ -527,7 +527,7 @@
 	hash := h.Sum(nil)
 
 Outer:
-	for _, rootHash := range rootCAHashes {
+	for _, rootHash := range truststore.RootCAHashes {
 		for i, b := range rootHash {
 			if b != hash[i] {
 				continue Outer
@@ -581,7 +581,7 @@
 
 	var attrs *TPMDeviceAttributes
 	for _, e := range cert.Extensions {
-		if e.Id.Equal(oidExtensionSubjectAltName) {
+		if e.Id.Equal(tcg.OIDExtensionSubjectAltName) {
 			// SubjectAltName MUST be critical if subject is empty
 			if len(cert.Subject.Names) == 0 && !e.Critical {
 				return nil, nil, errors.New("certificate with empty subject contains non-critical SAN extension")
@@ -610,7 +610,7 @@
 	// If SAN contains only fields unhandled by crypto/x509 and it is marked as critical, then it ends up here. Remove it because
 	// we've handled it ourselves and x509.Certificate.Verify fails if we leave it here.
 	for i, e := range cert.UnhandledCriticalExtensions {
-		if e.Equal(oidExtensionSubjectAltName) {
+		if e.Equal(tcg.OIDExtensionSubjectAltName) {
 			copy(cert.UnhandledCriticalExtensions[i:], cert.UnhandledCriticalExtensions[i+1:])
 			cert.UnhandledCriticalExtensions = cert.UnhandledCriticalExtensions[:len(cert.UnhandledCriticalExtensions)-1]
 			break
@@ -746,7 +746,7 @@
 	}
 	defer f.Cancel()
 
-	if _, err := tpm2.MarshalToWriter(f, data); err != nil {
+	if _, err := mu.MarshalToWriter(f, data); err != nil {
 		return xerrors.Errorf("cannot marshal cert chain: %w", err)
 	}
 
@@ -817,7 +817,7 @@
 		data.Parents = append(data.Parents, c.Raw)
 	}
 
-	if _, err := tpm2.MarshalToWriter(w, &data); err != nil {
+	if _, err := mu.MarshalToWriter(w, &data); err != nil {
 		return xerrors.Errorf("cannot marshal cert chain: %w", err)
 	}
 
@@ -828,6 +828,8 @@
 // function is useful for connecting to a device that isn't correctly provisioned and for which the endorsement hierarchy
 // authorization value is unknown (so that it can be cleared), or for connecting to a device in order to execute
 // FetchAndSaveEKCertificateChain. It should not be used in any other scenario.
+//
+// If no TPM2 device is available, then a ErrNoTPM2Device error will be returned.
 func ConnectToDefaultTPM() (*TPMConnection, error) {
 	tpm, err := connectToDefaultTPM()
 	if err != nil {
@@ -875,12 +877,15 @@
 // executed yet), this function will attempt to create a transient endorsement key. This requires knowledge of the endorsement
 // hierarchy authorization value, provided via the endorsementAuth argument, The endorsement hierarchy authorization value will be
 // empty on a newly cleared device. If there is no valid persistent endorsement key and creation of a transient endorsement key fails,
-// ErrTPMProvisioning will be returned.
+// ErrTPMProvisioning will be returned. Note that creation of a transient endorsement key may take a long time on some TPMs (in excess
+// of 10 seconds).
 //
 // If the TPM cannot prove it is the device for which the endorsement key certificate was issued, a TPMVerificationError error will be
 // returned. This can happen if there is an object at the persistent endorsement key index but it is not the object for which the
 // endorsement key certificate was issued, and creation of a transient endorsement key fails because the correct endorsement hierarchy
 // authorization value hasn't been provided via the endorsementAuth argument.
+//
+// If no TPM2 device is available, then a ErrNoTPM2Device error will be returned.
 func SecureConnectToDefaultTPM(ekCertDataReader io.Reader, endorsementAuth []byte) (*TPMConnection, error) {
 	if ekCertDataReader == nil {
 		return nil, errors.New("no EK certificate data was provided")
@@ -904,7 +909,7 @@
 
 	var certData *ekCertData
 	// Unmarshal supplied EK cert data
-	if _, err := tpm2.UnmarshalFromReader(ekCertDataReader, &certData); err != nil {
+	if _, err := mu.UnmarshalFromReader(ekCertDataReader, &certData); err != nil {
 		return nil, EKCertVerificationError{fmt.Sprintf("cannot unmarshal supplied EK certificate data: %v", err)}
 	}
 	if len(certData.Cert) == 0 {
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/unseal.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/unseal.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/unseal.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/unseal.go	2020-11-05 20:13:01.000000000 +0000
@@ -21,6 +21,8 @@
 
 import (
 	"github.com/canonical/go-tpm2"
+	"github.com/canonical/go-tpm2/mu"
+	"github.com/snapcore/secboot/internal/tcg"
 
 	"golang.org/x/xerrors"
 )
@@ -60,93 +62,104 @@
 // If the provided PIN is incorrect, then a ErrPINFail error will be returned and the TPM's dictionary attack counter will be
 // incremented.
 //
-// If access to sealed key objects created by this package is disallowed until the next TPM reset or TPM restart, then a
-// ErrSealedKeyAccessLocked error will be returned.
-//
 // If the authorization policy check fails during unsealing, then a InvalidKeyFileError error will be returned. Note that this
 // condition can also occur as the result of an incorrectly provisioned TPM, which will be detected during a subsequent call to
 // SealKeyToTPM.
 //
-// On success, the unsealed cleartext key is returned.
-func (k *SealedKeyObject) UnsealFromTPM(tpm *TPMConnection, pin string) ([]byte, error) {
+// On success, the unsealed cleartext key is returned as the first return value, and the private part of the key used for
+// authorizing PCR policy updates with UpdateKeyPCRProtectionPolicy is returned as the second return value.
+func (k *SealedKeyObject) UnsealFromTPM(tpm *TPMConnection, pin string) (key []byte, authKey TPMPolicyAuthKey, err error) {
 	// Check if the TPM is in lockout mode
 	props, err := tpm.GetCapabilityTPMProperties(tpm2.PropertyPermanent, 1)
 	if err != nil {
-		return nil, xerrors.Errorf("cannot fetch properties from TPM: %w", err)
+		return nil, nil, xerrors.Errorf("cannot fetch properties from TPM: %w", err)
 	}
 
 	if tpm2.PermanentAttributes(props[0].Value)&tpm2.AttrInLockout > 0 {
-		return nil, ErrTPMLockout
+		return nil, nil, ErrTPMLockout
 	}
 
 	// Use the HMAC session created when the connection was opened for parameter encryption rather than creating a new one.
 	hmacSession := tpm.HmacSession()
 
 	// Load the key data
-	key, err := k.data.load(tpm.TPMContext, hmacSession)
+	keyObject, err := k.data.load(tpm.TPMContext, hmacSession)
 	switch {
 	case isKeyFileError(err):
-		// A keyFileError can be as a result of an improperly provisioned TPM - detect if the object at srkHandle is a valid primary key
+		// A keyFileError can be as a result of an improperly provisioned TPM - detect if the object at tcg.SRKHandle is a valid primary key
 		// with the correct attributes. If it's not, then it's definitely a provisioning error. If it is, then it could still be a
 		// provisioning error because we don't know if the object was created with the same template that ProvisionTPM uses. In that case,
 		// we'll just assume an invalid key file
-		srk, err2 := tpm.CreateResourceContextFromTPM(srkHandle)
+		srk, err2 := tpm.CreateResourceContextFromTPM(tcg.SRKHandle)
 		switch {
-		case tpm2.IsResourceUnavailableError(err2, srkHandle):
-			return nil, ErrTPMProvisioning
+		case tpm2.IsResourceUnavailableError(err2, tcg.SRKHandle):
+			return nil, nil, ErrTPMProvisioning
 		case err2 != nil:
-			return nil, xerrors.Errorf("cannot create context for SRK: %w", err2)
+			return nil, nil, xerrors.Errorf("cannot create context for SRK: %w", err2)
 		}
-		ok, err2 := isObjectPrimaryKeyWithTemplate(tpm.TPMContext, tpm.OwnerHandleContext(), srk, srkTemplate, tpm.HmacSession())
+		ok, err2 := isObjectPrimaryKeyWithTemplate(tpm.TPMContext, tpm.OwnerHandleContext(), srk, tcg.SRKTemplate, tpm.HmacSession())
 		switch {
 		case err2 != nil:
-			return nil, xerrors.Errorf("cannot determine if object at 0x%08x is a primary key in the storage hierarchy: %w", srkHandle, err2)
+			return nil, nil, xerrors.Errorf("cannot determine if object at 0x%08x is a primary key in the storage hierarchy: %w", tcg.SRKHandle, err2)
 		case !ok:
-			return nil, ErrTPMProvisioning
+			return nil, nil, ErrTPMProvisioning
 		}
 		// This is probably a broken key file, but it could still be a provisioning error because we don't know if the SRK object was
 		// created with the same template that ProvisionTPM uses.
-		return nil, InvalidKeyFileError{err.Error()}
-	case tpm2.IsResourceUnavailableError(err, srkHandle):
-		return nil, ErrTPMProvisioning
+		return nil, nil, InvalidKeyFileError{err.Error()}
+	case tpm2.IsResourceUnavailableError(err, tcg.SRKHandle):
+		return nil, nil, ErrTPMProvisioning
 	case err != nil:
-		return nil, err
+		return nil, nil, err
 	}
-	defer tpm.FlushContext(key)
+	defer tpm.FlushContext(keyObject)
 
 	// Begin and execute policy session
-	policySession, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, k.data.KeyPublic.NameAlg)
+	policySession, err := tpm.StartAuthSession(nil, nil, tpm2.SessionTypePolicy, nil, k.data.keyPublic.NameAlg)
 	if err != nil {
-		return nil, xerrors.Errorf("cannot start policy session: %w", err)
+		return nil, nil, xerrors.Errorf("cannot start policy session: %w", err)
 	}
 	defer tpm.FlushContext(policySession)
 
-	if err := executePolicySession(tpm.TPMContext, policySession, k.data.StaticPolicyData, k.data.DynamicPolicyData, pin, hmacSession); err != nil {
+	if err := executePolicySession(tpm.TPMContext, policySession, k.data.version, k.data.staticPolicyData, k.data.dynamicPolicyData, pin, hmacSession); err != nil {
 		err = xerrors.Errorf("cannot complete authorization policy assertions: %w", err)
 		switch {
 		case isDynamicPolicyDataError(err):
 			// TODO: Add a separate error for this
-			return nil, InvalidKeyFileError{err.Error()}
+			return nil, nil, InvalidKeyFileError{err.Error()}
 		case isStaticPolicyDataError(err):
-			return nil, InvalidKeyFileError{err.Error()}
+			return nil, nil, InvalidKeyFileError{err.Error()}
 		case isAuthFailError(err, tpm2.CommandPolicySecret, 1):
-			return nil, ErrPINFail
+			return nil, nil, ErrPINFail
 		case tpm2.IsResourceUnavailableError(err, lockNVHandle):
-			return nil, ErrTPMProvisioning
-		case tpm2.IsTPMError(err, tpm2.ErrorNVLocked, tpm2.CommandPolicyNV):
-			return nil, ErrSealedKeyAccessLocked
+			return nil, nil, InvalidKeyFileError{"required legacy lock NV index is not present"}
 		}
-		return nil, err
+		return nil, nil, err
 	}
 
+	// For metadata version > 0, the PIN is the auth value for the sealed key object, and the authorization
+	// policy asserts that this value is known when the policy session is used.
+	keyObject.SetAuthValue([]byte(pin))
+
 	// Unseal
-	keyData, err := tpm.Unseal(key, policySession, hmacSession.IncludeAttrs(tpm2.AttrResponseEncrypt))
+	keyData, err := tpm.Unseal(keyObject, policySession, hmacSession.IncludeAttrs(tpm2.AttrResponseEncrypt))
 	switch {
 	case tpm2.IsTPMSessionError(err, tpm2.ErrorPolicyFail, tpm2.CommandUnseal, 1):
-		return nil, InvalidKeyFileError{"the authorization policy check failed during unsealing"}
+		return nil, nil, InvalidKeyFileError{"the authorization policy check failed during unsealing"}
+	case isAuthFailError(err, tpm2.CommandUnseal, 1):
+		return nil, nil, ErrPINFail
 	case err != nil:
-		return nil, xerrors.Errorf("cannot unseal key: %w", err)
+		return nil, nil, xerrors.Errorf("cannot unseal key: %w", err)
+	}
+
+	if k.data.version == 0 {
+		return keyData, nil, nil
+	}
+
+	var sealedData sealedData
+	if _, err := mu.UnmarshalFromBytes(keyData, &sealedData); err != nil {
+		return nil, nil, InvalidKeyFileError{err.Error()}
 	}
 
-	return keyData, nil
+	return sealedData.Key, sealedData.AuthPrivateKey, nil
 }
diff -Nru snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/utils.go snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/utils.go
--- snapd-2.45.1+20.04.2/vendor/github.com/snapcore/secboot/utils.go	2020-04-29 19:14:06.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/github.com/snapcore/secboot/utils.go	2020-11-05 20:13:01.000000000 +0000
@@ -21,14 +21,24 @@
 
 import (
 	"bytes"
-	"crypto/rsa"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"errors"
 	"fmt"
+	"math/big"
+	"os"
 
 	"github.com/canonical/go-tpm2"
+	"github.com/canonical/go-tpm2/mu"
 
 	"golang.org/x/xerrors"
 )
 
+func isPathError(err error) bool {
+	var e *os.PathError
+	return xerrors.As(err, &e)
+}
+
 // isAuthFailError indicates whether the specified error is a TPM authorization check failure, with or without DA implications.
 func isAuthFailError(err error, command tpm2.CommandCode, index int) bool {
 	return tpm2.IsTPMSessionError(err, tpm2.ErrorAuthFail, command, index) ||
@@ -78,16 +88,16 @@
 
 	pub.Unique = template.Unique
 
-	pubBytes, _ := tpm2.MarshalToBytes(pub)
-	templateBytes, _ := tpm2.MarshalToBytes(template)
+	pubBytes, _ := mu.MarshalToBytes(pub)
+	templateBytes, _ := mu.MarshalToBytes(template)
 	if !bytes.Equal(pubBytes, templateBytes) {
 		// For RSA keys, the default exponent (2^^16 - 1) is normally indicated by the value 0, but handle a TPM that actually
 		// returns 65537 by trying again.
 		if template.Type == tpm2.ObjectTypeRSA && template.Params.RSADetail().Exponent == 0 {
 			var templateCopy *tpm2.Public
-			tpm2.UnmarshalFromBytes(templateBytes, &templateCopy)
+			mu.UnmarshalFromBytes(templateBytes, &templateCopy)
 			templateCopy.Params.RSADetail().Exponent = 65537
-			templateBytes, _ = tpm2.MarshalToBytes(templateCopy)
+			templateBytes, _ = mu.MarshalToBytes(templateCopy)
 			if !bytes.Equal(pubBytes, templateBytes) {
 				return false, nil
 			}
@@ -104,7 +114,7 @@
 	h.Write(hierarchy.Name())
 	h.Write(object.Name())
 
-	expectedQualifiedName, _ := tpm2.MarshalToBytes(pub.NameAlg, tpm2.RawBytes(h.Sum(nil)))
+	expectedQualifiedName, _ := mu.MarshalToBytes(pub.NameAlg, mu.RawBytes(h.Sum(nil)))
 	if !bytes.Equal(expectedQualifiedName, qualifiedName) {
 		return false, nil
 	}
@@ -112,20 +122,76 @@
 	return true, nil
 }
 
-// createPublicAreaForRSASigningKey creates a *tpm2.Public from a go *rsa.PublicKey, which is suitable for loading
+func bigIntToBytesZeroExtended(x *big.Int, bytes int) (out []byte) {
+	b := x.Bytes()
+	if len(b) > bytes {
+		return b
+	}
+	out = make([]byte, bytes)
+	copy(out[bytes-len(b):], b)
+	return
+}
+
+// createPublicAreaForECDSAKey creates a *tpm2.Public from a go *ecdsa.PublicKey, which is suitable for loading
 // in to a TPM with TPMContext.LoadExternal.
-func createPublicAreaForRSASigningKey(key *rsa.PublicKey) *tpm2.Public {
+func createTPMPublicAreaForECDSAKey(key *ecdsa.PublicKey) *tpm2.Public {
+	var curve tpm2.ECCCurve
+	switch key.Curve {
+	case elliptic.P224():
+		curve = tpm2.ECCCurveNIST_P224
+	case elliptic.P256():
+		curve = tpm2.ECCCurveNIST_P256
+	case elliptic.P384():
+		curve = tpm2.ECCCurveNIST_P384
+	case elliptic.P521():
+		curve = tpm2.ECCCurveNIST_P521
+	default:
+		panic("unsupported curve")
+	}
+
 	return &tpm2.Public{
-		Type:    tpm2.ObjectTypeRSA,
+		Type:    tpm2.ObjectTypeECC,
 		NameAlg: tpm2.HashAlgorithmSHA256,
 		Attrs:   tpm2.AttrSensitiveDataOrigin | tpm2.AttrUserWithAuth | tpm2.AttrSign,
 		Params: tpm2.PublicParamsU{
-			Data: &tpm2.RSAParams{
+			Data: &tpm2.ECCParams{
 				Symmetric: tpm2.SymDefObject{Algorithm: tpm2.SymObjectAlgorithmNull},
-				Scheme:    tpm2.RSAScheme{Scheme: tpm2.RSASchemeNull},
-				KeyBits:   uint16(key.N.BitLen()),
-				Exponent:  uint32(key.E)}},
-		Unique: tpm2.PublicIDU{Data: tpm2.PublicKeyRSA(key.N.Bytes())}}
+				Scheme: tpm2.ECCScheme{
+					Scheme:  tpm2.ECCSchemeECDSA,
+					Details: tpm2.AsymSchemeU{Data: &tpm2.SigSchemeECDSA{HashAlg: tpm2.HashAlgorithmSHA256}}},
+				CurveID: curve,
+				KDF:     tpm2.KDFScheme{Scheme: tpm2.KDFAlgorithmNull}}},
+		Unique: tpm2.PublicIDU{
+			Data: &tpm2.ECCPoint{
+				X: bigIntToBytesZeroExtended(key.X, key.Params().BitSize/8),
+				Y: bigIntToBytesZeroExtended(key.Y, key.Params().BitSize/8)}}}
+}
+
+func createECDSAPrivateKeyFromTPM(public *tpm2.Public, private tpm2.ECCParameter) (*ecdsa.PrivateKey, error) {
+	if public.Type != tpm2.ObjectTypeECC {
+		return nil, errors.New("unsupported type")
+	}
+
+	var curve elliptic.Curve
+	switch public.Params.ECCDetail().CurveID {
+	case tpm2.ECCCurveNIST_P224:
+		curve = elliptic.P224()
+	case tpm2.ECCCurveNIST_P256:
+		curve = elliptic.P256()
+	case tpm2.ECCCurveNIST_P384:
+		curve = elliptic.P384()
+	case tpm2.ECCCurveNIST_P521:
+		curve = elliptic.P521()
+	default:
+		return nil, errors.New("unsupported curve")
+	}
+
+	return &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: curve,
+			X:     new(big.Int).SetBytes(public.Unique.ECC().X),
+			Y:     new(big.Int).SetBytes(public.Unique.ECC().Y)},
+		D: new(big.Int).SetBytes(private)}, nil
 }
 
 // digestListContains indicates whether the specified digest is present in the list of digests.
diff -Nru snapd-2.45.1+20.04.2/vendor/maze.io/x/crypto/afis/afis.go snapd-2.48.3+20.04/vendor/maze.io/x/crypto/afis/afis.go
--- snapd-2.45.1+20.04.2/vendor/maze.io/x/crypto/afis/afis.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/maze.io/x/crypto/afis/afis.go	2020-11-05 20:13:02.000000000 +0000
@@ -0,0 +1,119 @@
+package afis // import "maze.io/x/crypto/afis"
+
+import (
+	"crypto/rand"
+	"crypto/sha1"
+	"encoding/binary"
+	"errors"
+	"hash"
+	"io"
+	"math"
+)
+
+// Errors.
+var (
+	ErrMinStripe = errors.New("afis: at least one stripe is required")
+	ErrDataLen   = errors.New("afis: data length is not multiple of stripes")
+)
+
+// DefaultHash is our default hashing function.
+var DefaultHash = sha1.New
+
+// Split data using the default SHA-1 hash.
+func Split(data []byte, stripes int) ([]byte, error) {
+	return SplitHash(data, stripes, DefaultHash)
+}
+
+// SplitHash splits data using the selected hash function.
+func SplitHash(data []byte, stripes int, hashFunc func() hash.Hash) ([]byte, error) {
+	if stripes < 1 {
+		return nil, ErrMinStripe
+	}
+	var (
+		blockSize = len(data)
+		block     = make([]byte, blockSize)
+		random    = make([]byte, blockSize)
+		splitted  []byte
+	)
+	for i := 0; i < stripes-1; i++ {
+		if _, err := io.ReadFull(rand.Reader, random); err != nil {
+			return nil, err
+		}
+		splitted = append(splitted, random...)
+
+		xor(block, random, block)
+		block = diffuse(block, blockSize, hashFunc)
+	}
+
+	size := len(splitted)
+	splitted = append(splitted, make([]byte, blockSize)...)
+	xor(splitted[size:], block, data)
+
+	return splitted, nil
+}
+
+// Merge data splitted previously with Split using the default SHA-1 hash.
+func Merge(data []byte, stripes int) ([]byte, error) {
+	return MergeHash(data, stripes, DefaultHash)
+}
+
+// MergeHash merges data splitted previously with the selected hash function.
+func MergeHash(data []byte, stripes int, hashFunc func() hash.Hash) ([]byte, error) {
+	if len(data)%stripes != 0 {
+		return nil, ErrDataLen
+	}
+
+	var (
+		blockSize = len(data) / stripes
+		block     = make([]byte, blockSize)
+	)
+	for i := 0; i < stripes-1; i++ {
+		offset := i * blockSize
+		xor(block, data[offset:offset+blockSize], block)
+		block = diffuse(block, blockSize, hashFunc)
+	}
+
+	xor(block, data[(stripes-1)*blockSize:], block)
+	return block, nil
+}
+
+func xor(dst, src1, src2 []byte) {
+	for i := range dst {
+		dst[i] = src1[i] ^ src2[i]
+	}
+}
+
+func diffuse(block []byte, size int, hashFunc func() hash.Hash) []byte {
+	var (
+		hash       = hashFunc()
+		digestSize = hash.Size()
+		blocks     = int(math.Floor(float64(len(block)) / float64(digestSize)))
+		padding    = len(block) % digestSize
+		diffused   []byte
+	)
+
+	// Hash full blocks
+	for i := 0; i < blocks; i++ {
+		offset := i * digestSize
+		hash.Reset()
+		hash.Write(packInt(i))
+		hash.Write(block[offset : offset+digestSize])
+		diffused = append(diffused, hash.Sum(nil)...)
+	}
+
+	// Hash remainder
+	if padding > 0 {
+		hash.Reset()
+		hash.Write(packInt(blocks))
+		hash.Write(block[blocks*digestSize:])
+		diffused = append(diffused, hash.Sum(nil)[:padding]...)
+	}
+
+	return diffused
+}
+
+func packInt(i int) []byte {
+	var packed [4]byte
+	binary.BigEndian.PutUint32(packed[:], uint32(i))
+	return packed[:]
+}
diff -Nru snapd-2.45.1+20.04.2/vendor/maze.io/x/crypto/afis/doc.go snapd-2.48.3+20.04/vendor/maze.io/x/crypto/afis/doc.go
--- snapd-2.45.1+20.04.2/vendor/maze.io/x/crypto/afis/doc.go	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/maze.io/x/crypto/afis/doc.go	2020-11-05 20:13:02.000000000 +0000
@@ -0,0 +1,26 @@
+/*
+Package afis implements Anti-Forensic Information Splitting
+
+The splitter supports secure data destruction crucial for secure on-disk key
+management. The key idea is to bloat information and therefor improving the
+chance of destroying a single bit of it. The information is bloated in such a
+way, that a single missing bit causes the original information become
+unrecoverable. The theory behind AFsplitter is presented in TKS1.
+
+The interface is simple. It consists of two functions:
+
+	Split(data, stripes)
+	Merge(data, stripes)
+
+Split operates on data and returns information splitted data. Merge does
+just the opposite: uses the information stored in data to recover the original
+splitted data.
+
+
+References
+
+AFsplitter reference implementation at http://clemens.endorphin.org/AFsplitter
+
+TKS1 paper at http://clemens.endorphin.org/TKS1-draft.pdf
+*/
+package afis
diff -Nru snapd-2.45.1+20.04.2/vendor/maze.io/x/crypto/LICENSE snapd-2.48.3+20.04/vendor/maze.io/x/crypto/LICENSE
--- snapd-2.45.1+20.04.2/vendor/maze.io/x/crypto/LICENSE	1970-01-01 00:00:00.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/maze.io/x/crypto/LICENSE	2020-11-05 20:13:02.000000000 +0000
@@ -0,0 +1,5 @@
+MIT License
+Copyright (c) <year> <copyright holders>
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff -Nru snapd-2.45.1+20.04.2/vendor/vendor.json snapd-2.48.3+20.04/vendor/vendor.json
--- snapd-2.45.1+20.04.2/vendor/vendor.json	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/vendor/vendor.json	2021-02-02 08:21:12.000000000 +0000
@@ -7,10 +7,10 @@
 			"revision": ""
 		},
 		{
-			"checksumSHA1": "FM+dp3Hv1n+R9b/gqhtjSq6W4T8=",
+			"checksumSHA1": "inZOuvF07VvZnsj1HvApM8Uf7qY=",
 			"path": "github.com/canonical/go-tpm2",
-			"revision": "16307201a54dc51583440f9416cfa836bcf0b3fc",
-			"revisionTime": "2020-04-16T00:17:14Z"
+			"revision": "fb781d04d0dea72f916cc68b637b7be6bcb3ccd4",
+			"revisionTime": "2020-08-24T18:49:43Z"
 		},
 		{
 			"checksumSHA1": "bT/rC7K8St3lNRXf/XJGpB4wNJU=",
@@ -19,10 +19,16 @@
 			"revisionTime": "2020-04-16T00:17:14Z"
 		},
 		{
-			"checksumSHA1": "eDjzake0GpHm9kfTH7FMUWX8zVA=",
-			"path": "github.com/chrisccoulson/tcglog-parser",
-			"revision": "7b0f085a85398d368e10382a21a44ec2226c35b3",
-			"revisionTime": "2020-02-28T14:36:39Z"
+			"checksumSHA1": "fGle5W3B2jSAsLeOQnRbGG7uyV8=",
+			"path": "github.com/canonical/go-tpm2/mu",
+			"revision": "8f372d7de1b07c887e388874555d48f9161feaed",
+			"revisionTime": "2020-08-24T11:54:14Z"
+		},
+		{
+			"checksumSHA1": "QGwWyf2f/5+FacNj2iKpjp8N5hg=",
+			"path": "github.com/canonical/tcglog-parser",
+			"revision": "12a3a7bcf5a14486e838fea211e8d4aa280e9671",
+			"revisionTime": "2020-09-08T16:50:21Z"
 		},
 		{
 			"checksumSHA1": "zg16zjZTQ9R89+UOLmEZxHgxDtM=",
@@ -67,10 +73,10 @@
 			"revisionTime": "2017-10-26T09:04:26Z"
 		},
 		{
-			"checksumSHA1": "3ohk4dFYrERZ6WTdKkIwnTA0HSI=",
+			"checksumSHA1": "uSYSOqWHns5IziQOPrgKq+ianZ8=",
 			"path": "github.com/kr/pretty",
-			"revision": "73f6ac0b30a98e433b289500d779f50c1a6f0712",
-			"revisionTime": "2018-05-06T08:33:45Z"
+			"revision": "814ac30b4b181fedaa28ed1b6763ee87f0096826",
+			"revisionTime": "2020-08-10T07:44:40Z"
 		},
 		{
 			"checksumSHA1": "SbguDK5lY8uhaHNrmJmNbiWIGM0=",
@@ -79,10 +85,10 @@
 			"revisionTime": "2018-05-06T08:24:08Z"
 		},
 		{
-			"checksumSHA1": "bzUdFxQ29mPK0lwgFVcF0GFN74Q=",
+			"checksumSHA1": "IttM8us+Q4MCsRvzLCUstr4ry9w=",
 			"path": "github.com/mvo5/goconfigparser",
-			"revision": "26426272dda20cc76aa1fa44286dc743d2972fe8",
-			"revisionTime": "2015-02-12T09:37:50Z"
+			"revision": "72e476556adb39b13f78b99ba01ca387503a075d",
+			"revisionTime": "2020-08-03T08:53:09Z"
 		},
 		{
 			"checksumSHA1": "uSjL89zodhV0X/LvyZ67FlKYKvg=",
@@ -91,11 +97,11 @@
 			"revisionTime": "2018-03-08T15:25:21Z"
 		},
 		{
-			"checksumSHA1": "XEtWdIrRbRSFBR9q+SOATOuy7vM=",
+			"checksumSHA1": "fFe39jZ9Y2DPUuNvx2Bzs6N/yYs=",
 			"comment": "fork of boltdb/bolt to fix build failure on ppc. upstream: https://github.com/boltdb/bolt/pull/740 and https://github.com/coreos/bbolt/pull/73",
 			"path": "github.com/snapcore/bolt",
-			"revision": "9eca199504ee1299394669820724322b5bfc070a",
-			"revisionTime": "2018-01-18T17:01:45Z"
+			"revision": "e23dabaa2861760fc674e679fad48343c06c0afc",
+			"revisionTime": "2020-06-03T12:59:28Z"
 		},
 		{
 			"checksumSHA1": "CSPV27Mm4+WBlyGFT/lKz1la/VI=",
@@ -110,10 +116,40 @@
 			"revisionTime": "2017-09-28T14:21:59Z"
 		},
 		{
-			"checksumSHA1": "DLybl1kT3Xoui39mHI4jO4+1GuM=",
+			"checksumSHA1": "QOWBbcZJqGF5v2rtNSjsGGLrUUE=",
 			"path": "github.com/snapcore/secboot",
-			"revision": "9530c0bc45a0828327097bd5d966da15bc9e8697",
-			"revisionTime": "2020-05-12T08:22:20Z"
+			"revision": "027522efe9c7dc36adde13ea8ab030d3dfa34267",
+			"revisionTime": "2020-11-19T14:48:04Z"
+		},
+		{
+			"checksumSHA1": "c7jHLQSWFWbymTcFWZMQH0C5Wik=",
+			"path": "github.com/snapcore/secboot/internal/efi",
+			"revision": "bd7a6eabe9371024327d0133a5e1915df27c9eed",
+			"revisionTime": "2020-10-27T12:12:33Z"
+		},
+		{
+			"checksumSHA1": "loFEiH6evGaDnDSlQgk3ugemkcU=",
+			"path": "github.com/snapcore/secboot/internal/pe1.14",
+			"revision": "bd7a6eabe9371024327d0133a5e1915df27c9eed",
+			"revisionTime": "2020-10-27T12:12:33Z"
+		},
+		{
+			"checksumSHA1": "kDay47kq9OgDplpkrYw0/a8Z+YY=",
+			"path": "github.com/snapcore/secboot/internal/tcg",
+			"revision": "bd7a6eabe9371024327d0133a5e1915df27c9eed",
+			"revisionTime": "2020-10-27T12:12:33Z"
+		},
+		{
+			"checksumSHA1": "PRS8ACUu14shrvAgb747Izc25ns=",
+			"path": "github.com/snapcore/secboot/internal/tcti",
+			"revision": "bd7a6eabe9371024327d0133a5e1915df27c9eed",
+			"revisionTime": "2020-10-27T12:12:33Z"
+		},
+		{
+			"checksumSHA1": "TnfofdyojXYWOwdWCKMY5RCeI7s=",
+			"path": "github.com/snapcore/secboot/internal/truststore",
+			"revision": "bd7a6eabe9371024327d0133a5e1915df27c9eed",
+			"revisionTime": "2020-10-27T12:12:33Z"
 		},
 		{
 			"checksumSHA1": "3AmEm18mKj8XxBuru/ix4OOpRkE=",
@@ -265,6 +301,13 @@
 			"path": "gopkg.in/yaml.v2",
 			"revision": "86f5ed62f8a0ee96bd888d2efdfd6d4fb100a4eb",
 			"revisionTime": "2018-03-26T05:07:29Z"
+		},
+		{
+			"checksumSHA1": "tZ9GNzrjTZEPDhoJEkouGPKRmZk=",
+			"origin": "github.com/pedronis/maze.io-x-crypto/afis",
+			"path": "maze.io/x/crypto/afis",
+			"revision": "9b94c9afe06676a7da39a608a48ed4e31f5d125f",
+			"revisionTime": "2019-01-31T09:06:03Z"
 		}
 	],
 	"rootPath": "github.com/snapcore/build-area/snapd-tmp"
diff -Nru snapd-2.45.1+20.04.2/wrappers/core18.go snapd-2.48.3+20.04/wrappers/core18.go
--- snapd-2.45.1+20.04.2/wrappers/core18.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/core18.go	2021-02-02 08:21:12.000000000 +0000
@@ -26,6 +26,7 @@
 	"os"
 	"path/filepath"
 	"regexp"
+	"syscall"
 	"time"
 
 	"github.com/snapcore/snapd/dirs"
@@ -128,7 +129,7 @@
 // AddSnapdSnapServices sets up the services based on a given snapd snap in the
 // system.
 func AddSnapdSnapServices(s *snap.Info, inter interacter) error {
-	if snapType := s.GetType(); snapType != snap.TypeSnapd {
+	if snapType := s.Type(); snapType != snap.TypeSnapd {
 		return fmt.Errorf("internal error: adding explicit snapd services for snap %q type %q is unexpected", s.InstanceName(), snapType)
 	}
 
@@ -137,7 +138,7 @@
 		return nil
 	}
 
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+	sysd := systemd.New(systemd.SystemMode, inter)
 
 	if err := writeSnapdToolingMountUnit(sysd, s.MountDir()); err != nil {
 		return err
@@ -284,6 +285,11 @@
 		return err
 	}
 
+	// Handle D-Bus configuration
+	if err := writeSnapdDbusConfigOnCore(s); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -378,7 +384,7 @@
 		return err
 	}
 
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.GlobalUserMode, inter)
+	sysd := systemd.New(systemd.GlobalUserMode, inter)
 
 	serviceUnits, err := filepath.Glob(filepath.Join(s.MountDir(), "usr/lib/systemd/user/*.service"))
 	if err != nil {
@@ -446,7 +452,7 @@
 // deployed in the filesystem as part of snapd snap installation. This should
 // only be executed as part of a controlled undo path.
 func undoSnapdUserServicesOnCore(s *snap.Info, inter interacter) error {
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.GlobalUserMode, inter)
+	sysd := systemd.NewUnderRoot(dirs.GlobalRootDir, systemd.GlobalUserMode, inter)
 
 	// list user service and socket units present in the snapd snap
 	serviceUnits, err := filepath.Glob(filepath.Join(s.MountDir(), "usr/lib/systemd/user/*.service"))
@@ -485,12 +491,91 @@
 	return nil
 }
 
+func DeriveSnapdDBusConfig(s *snap.Info) (sessionContent, systemContent map[string]osutil.FileState, err error) {
+	sessionConfigs, err := filepath.Glob(filepath.Join(s.MountDir(), "usr/share/dbus-1/session.d/snapd.*.conf"))
+	if err != nil {
+		return nil, nil, err
+	}
+	sessionContent = make(map[string]osutil.FileState, len(sessionConfigs)+1)
+	for _, config := range sessionConfigs {
+		sessionContent[filepath.Base(config)] = &osutil.FileReference{
+			Path: config,
+		}
+	}
+
+	systemConfigs, err := filepath.Glob(filepath.Join(s.MountDir(), "usr/share/dbus-1/system.d/snapd.*.conf"))
+	if err != nil {
+		return nil, nil, err
+	}
+	systemContent = make(map[string]osutil.FileState, len(systemConfigs)+1)
+	for _, config := range systemConfigs {
+		systemContent[filepath.Base(config)] = &osutil.FileReference{
+			Path: config,
+		}
+	}
+
+	return sessionContent, systemContent, nil
+}
+
+func isReadOnlyFsError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if e, ok := err.(*os.PathError); ok {
+		err = e.Err
+	}
+	if e, ok := err.(syscall.Errno); ok {
+		return e == syscall.EROFS
+	}
+	return false
+}
+
+var ensureDirState = osutil.EnsureDirState
+
+func writeSnapdDbusConfigOnCore(s *snap.Info) error {
+	sessionContent, systemContent, err := DeriveSnapdDBusConfig(s)
+	if err != nil {
+		return err
+	}
+
+	_, _, err = ensureDirState(dirs.SnapDBusSessionPolicyDir, "snapd.*.conf", sessionContent)
+	if err != nil {
+		if isReadOnlyFsError(err) {
+			// If /etc/dbus-1/session.d is read-only (which may be the case on very old core18), then
+			// err is os.PathError with syscall.Errno underneath. Hitting this prevents snapd refresh,
+			// so log the error but carry on. This fixes LP: 1899664.
+			// XXX: ideally we should regenerate session files elsewhere if we fail here (otherwise
+			// this will only happen on future snapd refresh), but realistically this
+			// is not relevant on core18 devices.
+			logger.Noticef("%s appears to be read-only, could not write snapd dbus config files", dirs.SnapDBusSessionPolicyDir)
+		} else {
+			return err
+		}
+	}
+
+	_, _, err = osutil.EnsureDirState(dirs.SnapDBusSystemPolicyDir, "snapd.*.conf", systemContent)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func undoSnapdDbusConfigOnCore(s *snap.Info) error {
+	_, _, err := osutil.EnsureDirState(dirs.SnapDBusSystemPolicyDir, "snapd.*.conf", nil)
+	if err != nil {
+		return err
+	}
+	_, _, err = osutil.EnsureDirState(dirs.SnapDBusSessionPolicyDir, "snapd.*.conf", nil)
+	return err
+}
+
 // RemoveSnapdSnapServicesOnCore removes the snapd services generated by a prior
 // call to AddSnapdSnapServices. The core snap is used as the reference for
 // restoring the system state, making this undo helper suitable for use when
 // reverting the first installation of the snapd snap on a core device.
 func RemoveSnapdSnapServicesOnCore(s *snap.Info, inter interacter) error {
-	if snapType := s.GetType(); snapType != snap.TypeSnapd {
+	if snapType := s.Type(); snapType != snap.TypeSnapd {
 		return fmt.Errorf("internal error: removing explicit snapd services for snap %q type %q is unexpected", s.InstanceName(), snapType)
 	}
 
@@ -499,8 +584,11 @@
 		return nil
 	}
 
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+	sysd := systemd.NewUnderRoot(dirs.GlobalRootDir, systemd.SystemMode, inter)
 
+	if err := undoSnapdDbusConfigOnCore(s); err != nil {
+		return err
+	}
 	if err := undoSnapdServicesOnCore(s, sysd); err != nil {
 		return err
 	}
diff -Nru snapd-2.45.1+20.04.2/wrappers/core18_test.go snapd-2.48.3+20.04/wrappers/core18_test.go
--- snapd-2.45.1+20.04.2/wrappers/core18_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/core18_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -23,10 +23,12 @@
 	"fmt"
 	"os"
 	"path/filepath"
+	"syscall"
 
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/release"
@@ -42,6 +44,10 @@
 	c.Assert(err, IsNil)
 	err = os.MkdirAll(dirs.SnapUserServicesDir, 0755)
 	c.Assert(err, IsNil)
+	err = os.MkdirAll(dirs.SnapDBusSystemPolicyDir, 0755)
+	c.Assert(err, IsNil)
+	err = os.MkdirAll(dirs.SnapDBusSessionPolicyDir, 0755)
+	c.Assert(err, IsNil)
 
 	info := snaptest.MockSnapWithFiles(c, snapdYaml, &snap.SideInfo{Revision: snap.R(1)}, [][]string{
 		// system services
@@ -53,6 +59,11 @@
 		// user services
 		{"usr/lib/systemd/user/snapd.session-agent.service", "[Unit]\n[Service]\nExecStart=/usr/bin/snap session-agent"},
 		{"usr/lib/systemd/user/snapd.session-agent.socket", "[Unit]\n[Socket]\nListenStream=%t/snap-session.socket"},
+		// D-Bus configuration
+		{"usr/share/dbus-1/session.d/snapd.session-services.conf", "<busconfig/>"},
+		{"usr/share/dbus-1/system.d/snapd.system-services.conf", "<busconfig/>"},
+		// Extra non-snapd D-Bus config that shouldn't be copied
+		{"usr/share/dbus-1/system.d/io.netplan.Netplan.conf", "<busconfig/>"},
 	})
 
 	return info
@@ -91,9 +102,9 @@
 			s := fmt.Sprintf("Type=oneshot\nId=%s\nActiveState=inactive\nUnitFileState=enabled\n", cmd[2])
 			return []byte(s), nil
 		}
-		if len(cmd) == 4 && cmd[2] == "is-enabled" {
+		if len(cmd) == 2 && cmd[0] == "is-enabled" {
 			// pretend snapd.socket is disabled
-			if cmd[3] == "snapd.socket" {
+			if cmd[1] == "snapd.socket" {
 				return []byte("disabled"), &mockSystemctlError{msg: "disabled", exitCode: 1}
 			}
 			return []byte("enabled"), nil
@@ -148,41 +159,50 @@
 		// check that snapd.session-agent.socket is created
 		filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.socket"),
 		"[Unit]\n[Socket]\nListenStream=%t/snap-session.socket",
+	}, {
+		filepath.Join(dirs.SnapDBusSystemPolicyDir, "snapd.system-services.conf"),
+		"<busconfig/>",
+	}, {
+		filepath.Join(dirs.SnapDBusSessionPolicyDir, "snapd.session-services.conf"),
+		"<busconfig/>",
 	}} {
 		c.Check(entry[0], testutil.FileEquals, entry[1])
 	}
 
+	// Non-snapd D-Bus config is not copied
+	c.Check(filepath.Join(dirs.SnapDBusSystemPolicyDir, "io.netplan.Netplan.conf"), testutil.FileAbsent)
+
 	// check the systemctl calls
 	c.Check(s.sysdLog, DeepEquals, [][]string{
 		{"daemon-reload"},
-		{"--root", dirs.GlobalRootDir, "enable", "usr-lib-snapd.mount"},
+		{"enable", "usr-lib-snapd.mount"},
 		{"stop", "usr-lib-snapd.mount"},
 		{"show", "--property=ActiveState", "usr-lib-snapd.mount"},
 		{"start", "usr-lib-snapd.mount"},
 		{"daemon-reload"},
-		{"--root", dirs.GlobalRootDir, "is-enabled", "snapd.autoimport.service"},
-		{"--root", dirs.GlobalRootDir, "is-enabled", "snapd.service"},
-		{"--root", dirs.GlobalRootDir, "is-enabled", "snapd.snap-repair.timer"},
+		{"is-enabled", "snapd.autoimport.service"},
+		{"is-enabled", "snapd.service"},
+		{"is-enabled", "snapd.snap-repair.timer"},
 		// test pretends snapd.socket is disabled and needs enabling
-		{"--root", dirs.GlobalRootDir, "is-enabled", "snapd.socket"},
-		{"--root", dirs.GlobalRootDir, "enable", "snapd.socket"},
-		{"--root", dirs.GlobalRootDir, "is-enabled", "snapd.system-shutdown.service"},
-		{"--root", dirs.GlobalRootDir, "is-active", "snapd.autoimport.service"},
+		{"is-enabled", "snapd.socket"},
+		{"enable", "snapd.socket"},
+		{"is-enabled", "snapd.system-shutdown.service"},
+		{"is-active", "snapd.autoimport.service"},
 		{"stop", "snapd.autoimport.service"},
 		{"show", "--property=ActiveState", "snapd.autoimport.service"},
 		{"start", "snapd.autoimport.service"},
-		{"--root", dirs.GlobalRootDir, "is-active", "snapd.snap-repair.timer"},
+		{"is-active", "snapd.snap-repair.timer"},
 		{"stop", "snapd.snap-repair.timer"},
 		{"show", "--property=ActiveState", "snapd.snap-repair.timer"},
 		{"start", "snapd.snap-repair.timer"},
-		{"--root", dirs.GlobalRootDir, "is-active", "snapd.socket"},
+		{"is-active", "snapd.socket"},
 		{"start", "snapd.service"},
 		{"start", "--no-block", "snapd.seeded.service"},
 		{"start", "--no-block", "snapd.autoimport.service"},
-		{"--user", "--global", "--root", dirs.GlobalRootDir, "disable", "snapd.session-agent.service"},
-		{"--user", "--global", "--root", dirs.GlobalRootDir, "enable", "snapd.session-agent.service"},
-		{"--user", "--global", "--root", dirs.GlobalRootDir, "disable", "snapd.session-agent.socket"},
-		{"--user", "--global", "--root", dirs.GlobalRootDir, "enable", "snapd.session-agent.socket"},
+		{"--user", "--global", "disable", "snapd.session-agent.service"},
+		{"--user", "--global", "enable", "snapd.session-agent.service"},
+		{"--user", "--global", "disable", "snapd.session-agent.socket"},
+		{"--user", "--global", "enable", "snapd.session-agent.socket"},
 	})
 }
 
@@ -202,11 +222,46 @@
 	c.Check(osutil.FileExists(filepath.Join(dirs.SnapServicesDir, "usr-lib-snapd.mount")), Equals, false)
 	c.Check(osutil.FileExists(filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.service")), Equals, false)
 	c.Check(osutil.FileExists(filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.socket")), Equals, false)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapDBusSystemPolicyDir, "snapd.system-services.conf")), Equals, false)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapDBusSessionPolicyDir, "snapd.session-services.conf")), Equals, false)
 
 	// check that no systemctl calls happened
 	c.Check(s.sysdLog, IsNil)
 }
 
+func (s *servicesTestSuite) TestAddSessionServicesWithReadOnlyFilesystem(c *C) {
+	restore := release.MockOnClassic(false)
+	defer restore()
+
+	restoreEnsureDirState := wrappers.MockEnsureDirState(func(dir string, glob string, content map[string]osutil.FileState) (changed, removed []string, err error) {
+		return nil, nil, &os.PathError{Err: syscall.EROFS}
+	})
+	defer restoreEnsureDirState()
+
+	info := makeMockSnapdSnap(c)
+
+	logBuf, restore := logger.MockLogger()
+	defer restore()
+
+	// add the snapd service
+	err := wrappers.AddSnapdSnapServices(info, progress.Null)
+
+	// didn't fail despite of read-only SnapDBusSessionPolicyDir
+	c.Assert(err, IsNil)
+
+	// check that snapd services were *not* created
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapServicesDir, "snapd.service")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapServicesDir, "snapd.autoimport.service")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapServicesDir, "snapd.system-shutdown.service")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapServicesDir, "usr-lib-snapd.mount")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.service")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.socket")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapDBusSystemPolicyDir, "snapd.system-services.conf")), Equals, true)
+	c.Check(osutil.FileExists(filepath.Join(dirs.SnapDBusSessionPolicyDir, "snapd.session-services.conf")), Equals, false)
+
+	c.Assert(logBuf.String(), testutil.Contains, "/etc/dbus-1/session.d appears to be read-only, could not write snapd dbus config files")
+}
+
 func (s *servicesTestSuite) TestAddSnapdServicesWithNonSnapd(c *C) {
 	restore := release.MockOnClassic(false)
 	defer restore()
@@ -257,6 +312,8 @@
 		{filepath.Join(dirs.SnapServicesDir, "snapd.system-shutdown.service"), "from-snapd"},
 		{filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.service"), "from-snapd"},
 		{filepath.Join(dirs.SnapUserServicesDir, "snapd.session-agent.socket"), "from-snapd"},
+		{filepath.Join(dirs.SnapDBusSystemPolicyDir, "snapd.system-services.conf"), "from-snapd"},
+		{filepath.Join(dirs.SnapDBusSessionPolicyDir, "snapd.session-services.conf"), "from-snapd"},
 		// extra unit not present in core snap
 		{filepath.Join(dirs.SnapServicesDir, "snapd.not-in-core.service"), "from-snapd"},
 	}
@@ -330,3 +387,20 @@
 	err := wrappers.RemoveSnapdSnapServicesOnCore(info, progress.Null)
 	c.Assert(err, ErrorMatches, `internal error: removing explicit snapd services for snap "foo" type "app" is unexpected`)
 }
+
+func (s *servicesTestSuite) TestDeriveSnapdDBusConfig(c *C) {
+	info := makeMockSnapdSnap(c)
+
+	sessionContent, systemContent, err := wrappers.DeriveSnapdDBusConfig(info)
+	c.Assert(err, IsNil)
+	c.Check(sessionContent, DeepEquals, map[string]osutil.FileState{
+		"snapd.session-services.conf": &osutil.FileReference{
+			Path: filepath.Join(info.MountDir(), "usr/share/dbus-1/session.d/snapd.session-services.conf"),
+		},
+	})
+	c.Check(systemContent, DeepEquals, map[string]osutil.FileState{
+		"snapd.system-services.conf": &osutil.FileReference{
+			Path: filepath.Join(info.MountDir(), "usr/share/dbus-1/system.d/snapd.system-services.conf"),
+		},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/wrappers/desktop.go snapd-2.48.3+20.04/wrappers/desktop.go
--- snapd-2.45.1+20.04.2/wrappers/desktop.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/desktop.go	2021-02-02 08:21:12.000000000 +0000
@@ -235,21 +235,6 @@
 	return nil
 }
 
-// desktopPrefix returns the prefix string for the desktop files that
-// belongs to the given snapInstance. We need to do something custom
-// here because a) we need to be compatible with the world before we had
-// parallel installs b) we can't just use the usual "_" parallel installs
-// separator because that is already used as the separator between snap
-// and desktop filename.
-func desktopPrefix(s *snap.Info) string {
-	if s.SnapName() == s.InstanceName() {
-		return s.SnapName()
-	}
-	// we cannot use the usual "_" separator because that is also used
-	// to separate "$snap_$desktopfile"
-	return fmt.Sprintf("%s+%s", s.SnapName(), s.InstanceKey)
-}
-
 // AddSnapDesktopFiles puts in place the desktop files for the applications from the snap.
 func AddSnapDesktopFiles(s *snap.Info) (err error) {
 	var created []string
@@ -284,7 +269,7 @@
 		// but we can't just use the app name because a desktop file
 		// may call the same app with multiple parameters, e.g.
 		// --create-new, --open-existing etc
-		installedDesktopFileName := filepath.Join(dirs.SnapDesktopFilesDir, fmt.Sprintf("%s_%s", desktopPrefix(s), filepath.Base(df)))
+		installedDesktopFileName := filepath.Join(dirs.SnapDesktopFilesDir, fmt.Sprintf("%s_%s", s.DesktopPrefix(), filepath.Base(df)))
 		content = sanitizeDesktopFile(s, installedDesktopFileName, content)
 		if err := osutil.AtomicWriteFile(installedDesktopFileName, content, 0755, 0); err != nil {
 			return err
@@ -304,7 +289,7 @@
 func RemoveSnapDesktopFiles(s *snap.Info) error {
 	removedDesktopFiles := make([]string, 0, len(s.Apps))
 
-	desktopFiles, err := filepath.Glob(filepath.Join(dirs.SnapDesktopFilesDir, fmt.Sprintf("%s_*.desktop", desktopPrefix(s))))
+	desktopFiles, err := filepath.Glob(filepath.Join(dirs.SnapDesktopFilesDir, fmt.Sprintf("%s_*.desktop", s.DesktopPrefix())))
 	if err != nil {
 		return nil
 	}
diff -Nru snapd-2.45.1+20.04.2/wrappers/desktop_test.go snapd-2.48.3+20.04/wrappers/desktop_test.go
--- snapd-2.45.1+20.04.2/wrappers/desktop_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/desktop_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -24,6 +24,7 @@
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 
 	. "gopkg.in/check.v1"
 
@@ -158,7 +159,7 @@
 	err := os.MkdirAll(dirs.SnapDesktopFilesDir, 0755)
 	c.Assert(err, IsNil)
 
-	mockDesktopInstanceFilePath := filepath.Join(dirs.SnapDesktopFilesDir, "foo_instance_foobar.desktop")
+	mockDesktopInstanceFilePath := filepath.Join(dirs.SnapDesktopFilesDir, "foo+instance_foobar.desktop")
 	err = ioutil.WriteFile(mockDesktopInstanceFilePath, mockDesktopFile, 0644)
 	c.Assert(err, IsNil)
 
@@ -181,7 +182,7 @@
 	c.Check(err, NotNil)
 	c.Check(osutil.FileExists(mockDesktopFilePath), Equals, false)
 	c.Check(s.mockUpdateDesktopDatabase.Calls(), HasLen, 0)
-	// foo_instance file was not removed by cleanup
+	// foo+instance file was not removed by cleanup
 	c.Check(osutil.FileExists(mockDesktopInstanceFilePath), Equals, true)
 }
 
@@ -405,7 +406,7 @@
 	c.Assert(string(e), Equals, fmt.Sprintf(`[Desktop Entry]
 X-SnapInstanceName=snap_bar
 Name=foo
-Exec=env BAMF_DESKTOP_FILE_HINT=snap_bar_app.desktop %s/bin/snap_bar.app
+Exec=env BAMF_DESKTOP_FILE_HINT=snap+bar_app.desktop %s/bin/snap_bar.app
 `, dirs.SnapMountDir))
 }
 
@@ -429,7 +430,7 @@
 	c.Assert(string(e), Equals, fmt.Sprintf(`[Desktop Entry]
 X-SnapInstanceName=snap_bar
 Name=foo
-Exec=env BAMF_DESKTOP_FILE_HINT=snap_bar_app.desktop %s/bin/snap_bar.app %%U
+Exec=env BAMF_DESKTOP_FILE_HINT=snap+bar_app.desktop %s/bin/snap_bar.app %%U
 `, dirs.SnapMountDir))
 }
 
@@ -540,7 +541,7 @@
 X-SnapInstanceName=snap_bar
 Name=foo
 Icon=snap.snap_bar.icon
-Exec=env BAMF_DESKTOP_FILE_HINT=snap_bar_app.desktop %s/bin/snap_bar.app
+Exec=env BAMF_DESKTOP_FILE_HINT=snap+bar_app.desktop %s/bin/snap_bar.app
 `, dirs.SnapMountDir))
 }
 
@@ -578,6 +579,13 @@
 		c.Assert(err, IsNil)
 		c.Assert(osutil.FileExists(expectedDesktopFilePath), Equals, true)
 
+		// Ensure that the old-style parallel install desktop file was
+		// not created.
+		if t.instance != "" {
+			unexpectedOldStyleDesktopFilePath := strings.Replace(expectedDesktopFilePath, "+", "_", 1)
+			c.Assert(osutil.FileExists(unexpectedOldStyleDesktopFilePath), Equals, false)
+		}
+
 		// remove it again
 		err = wrappers.RemoveSnapDesktopFiles(info)
 		c.Assert(err, IsNil)
diff -Nru snapd-2.45.1+20.04.2/wrappers/export_test.go snapd-2.48.3+20.04/wrappers/export_test.go
--- snapd-2.45.1+20.04.2/wrappers/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/export_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,6 +21,8 @@
 
 import (
 	"time"
+
+	"github.com/snapcore/snapd/osutil"
 )
 
 // some internal helper exposed for testing
@@ -50,3 +52,11 @@
 		killWait = oldKillWait
 	}
 }
+
+func MockEnsureDirState(f func(dir string, glob string, content map[string]osutil.FileState) (changed, removed []string, err error)) (restore func()) {
+	oldEnsureDirState := ensureDirState
+	ensureDirState = f
+	return func() {
+		ensureDirState = oldEnsureDirState
+	}
+}
diff -Nru snapd-2.45.1+20.04.2/wrappers/services_gen_test.go snapd-2.48.3+20.04/wrappers/services_gen_test.go
--- snapd-2.45.1+20.04.2/wrappers/services_gen_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/services_gen_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -68,6 +68,27 @@
 WantedBy=multi-user.target
 `
 
+const expectedUserServiceFmt = `[Unit]
+# Auto-generated, DO NOT EDIT
+Description=Service for snap application snap.app
+X-Snappy=yes
+
+[Service]
+EnvironmentFile=-/etc/environment
+ExecStart=/usr/bin/snap run snap.app
+SyslogIdentifier=snap.app
+Restart=%s
+WorkingDirectory=/var/snap/snap/44
+ExecStop=/usr/bin/snap run --command=stop snap.app
+ExecReload=/usr/bin/snap run --command=reload snap.app
+ExecStopPost=/usr/bin/snap run --command=post-stop snap.app
+TimeoutStopSec=10
+Type=%s
+
+[Install]
+WantedBy=default.target
+`
+
 var (
 	mountUnitPrefix = strings.Replace(dirs.SnapMountDir[1:], "/", "-", -1)
 )
@@ -76,6 +97,7 @@
 	expectedAppService     = fmt.Sprintf(expectedServiceFmt, mountUnitPrefix, mountUnitPrefix, "on-failure", "simple")
 	expectedDbusService    = fmt.Sprintf(expectedServiceFmt, mountUnitPrefix, mountUnitPrefix, "on-failure", "dbus\nBusName=foo.bar.baz")
 	expectedOneshotService = fmt.Sprintf(expectedServiceFmt, mountUnitPrefix, mountUnitPrefix, "no", "oneshot\nRemainAfterExit=yes")
+	expectedUserAppService = fmt.Sprintf(expectedUserServiceFmt, "on-failure", "simple")
 )
 
 var (
@@ -129,7 +151,7 @@
 	info.Revision = snap.R(44)
 	app := info.Apps["app"]
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app, nil)
 	c.Assert(err, IsNil)
 	c.Check(string(generatedWrapper), Equals, expectedAppService)
 }
@@ -149,7 +171,7 @@
 	info.Revision = snap.R(44)
 	app := info.Apps["app"]
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app, nil)
 	c.Assert(err, IsNil)
 	c.Check(string(generatedWrapper), testutil.Contains, "\nTimeoutStartSec=600\n")
 }
@@ -170,7 +192,7 @@
 		info.Revision = snap.R(44)
 		app := info.Apps["app"]
 
-		generatedWrapper, err := wrappers.GenerateSnapServiceFile(app)
+		generatedWrapper, err := wrappers.GenerateSnapServiceFile(app, nil)
 		c.Assert(err, IsNil)
 		wrapperText := string(generatedWrapper)
 		if cond == snap.RestartNever {
@@ -197,9 +219,10 @@
 		PostStopCommand: "bin/foo post-stop",
 		StopTimeout:     timeout.DefaultTimeout,
 		Daemon:          "forking",
+		DaemonScope:     snap.SystemDaemon,
 	}
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, nil)
 	c.Assert(err, IsNil)
 	c.Assert(string(generatedWrapper), Equals, expectedTypeForkingWrapper)
 }
@@ -218,9 +241,10 @@
 		PostStopCommand: "bin/foo post-stop",
 		StopTimeout:     timeout.DefaultTimeout,
 		Daemon:          "simple",
+		DaemonScope:     snap.SystemDaemon,
 	}
 
-	_, err := wrappers.GenerateSnapServiceFile(service)
+	_, err := wrappers.GenerateSnapServiceFile(service, nil)
 	c.Assert(err, NotNil)
 }
 
@@ -245,7 +269,7 @@
 	info.Revision = snap.R(44)
 	app := info.Apps["app"]
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app, nil)
 	c.Assert(err, IsNil)
 
 	c.Assert(string(generatedWrapper), Equals, expectedDbusService)
@@ -268,12 +292,36 @@
 
 	app := info.Apps["app"]
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app, nil)
 	c.Assert(err, IsNil)
 
 	c.Assert(string(generatedWrapper), Equals, expectedOneshotService)
 }
 
+func (s *servicesWrapperGenSuite) TestGenerateSnapUserServiceFile(c *C) {
+	yamlText := `
+name: snap
+version: 1.0
+apps:
+    app:
+        command: bin/start
+        stop-command: bin/stop
+        reload-command: bin/reload
+        post-stop-command: bin/stop --post
+        stop-timeout: 10s
+        daemon: simple
+        daemon-scope: user
+`
+	info, err := snap.InfoFromSnapYaml([]byte(yamlText))
+	c.Assert(err, IsNil)
+	info.Revision = snap.R(44)
+	app := info.Apps["app"]
+
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(app, nil)
+	c.Assert(err, IsNil)
+	c.Check(string(generatedWrapper), Equals, expectedUserAppService)
+}
+
 func (s *servicesWrapperGenSuite) TestGenerateSnapServiceWithSockets(c *C) {
 	const sock1ExpectedFmt = `[Unit]
 # Auto-generated, DO NOT EDIT
@@ -313,11 +361,12 @@
 		SideInfo:      snap.SideInfo{Revision: snap.R(44)},
 	}
 	service := &snap.AppInfo{
-		Snap:    si,
-		Name:    "app",
-		Command: "bin/foo start",
-		Daemon:  "simple",
-		Plugs:   map[string]*snap.PlugInfo{"network-bind": {}},
+		Snap:        si,
+		Name:        "app",
+		Command:     "bin/foo start",
+		Daemon:      "simple",
+		DaemonScope: snap.SystemDaemon,
+		Plugs:       map[string]*snap.PlugInfo{"network-bind": {Interface: "network-bind"}},
 		Sockets: map[string]*snap.SocketInfo{
 			"sock1": {
 				Name:         "sock1",
@@ -338,7 +387,7 @@
 	sock1Expected := fmt.Sprintf(sock1ExpectedFmt, mountUnitPrefix, mountUnitPrefix, si.DataDir())
 	sock2Expected := fmt.Sprintf(sock2ExpectedFmt, mountUnitPrefix, mountUnitPrefix, si.DataDir())
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, nil)
 	c.Assert(err, IsNil)
 	c.Assert(strings.Contains(string(generatedWrapper), "[Install]"), Equals, false)
 	c.Assert(strings.Contains(string(generatedWrapper), "WantedBy=multi-user.target"), Equals, false)
@@ -383,30 +432,35 @@
 			SideInfo:      snap.SideInfo{Revision: snap.R(44)},
 			Apps: map[string]*snap.AppInfo{
 				"foo": {
-					Name:   "foo",
-					Snap:   &snap.Info{SuggestedName: "snap"},
-					Daemon: "forking",
+					Name:        "foo",
+					Snap:        &snap.Info{SuggestedName: "snap"},
+					Daemon:      "forking",
+					DaemonScope: snap.SystemDaemon,
 				},
 				"bar": {
-					Name:   "bar",
-					Snap:   &snap.Info{SuggestedName: "snap"},
-					Daemon: "forking",
+					Name:        "bar",
+					Snap:        &snap.Info{SuggestedName: "snap"},
+					Daemon:      "forking",
+					DaemonScope: snap.SystemDaemon,
 				},
 				"zed": {
-					Name:   "zed",
-					Snap:   &snap.Info{SuggestedName: "snap"},
-					Daemon: "forking",
+					Name:        "zed",
+					Snap:        &snap.Info{SuggestedName: "snap"},
+					Daemon:      "forking",
+					DaemonScope: snap.SystemDaemon,
 				},
 				"baz": {
-					Name:   "baz",
-					Snap:   &snap.Info{SuggestedName: "snap"},
-					Daemon: "forking",
+					Name:        "baz",
+					Snap:        &snap.Info{SuggestedName: "snap"},
+					Daemon:      "forking",
+					DaemonScope: snap.SystemDaemon,
 				},
 			},
 		},
 		Name:        "app",
 		Command:     "bin/foo start",
 		Daemon:      "simple",
+		DaemonScope: snap.SystemDaemon,
 		StopTimeout: timeout.DefaultTimeout,
 	}
 
@@ -430,7 +484,7 @@
 		c.Logf("tc: %v", tc)
 		service.After = tc.after
 		service.Before = tc.before
-		generatedWrapper, err := wrappers.GenerateSnapServiceFile(service)
+		generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, nil)
 		c.Assert(err, IsNil)
 
 		expectedService := fmt.Sprintf(expectedServiceFmt, mountUnitPrefix, mountUnitPrefix,
@@ -466,6 +520,7 @@
 		Name:        "app",
 		Command:     "bin/foo start",
 		Daemon:      "simple",
+		DaemonScope: snap.SystemDaemon,
 		StopTimeout: timeout.DefaultTimeout,
 		Timer: &snap.TimerInfo{
 			Timer: "10:00-12:00/2",
@@ -490,6 +545,7 @@
 		Name:        "app",
 		Command:     "bin/foo start",
 		Daemon:      "simple",
+		DaemonScope: snap.SystemDaemon,
 		StopTimeout: timeout.DefaultTimeout,
 		Timer: &snap.TimerInfo{
 			Timer: "bad-timer",
@@ -534,13 +590,14 @@
 		Name:        "app",
 		Command:     "bin/foo start",
 		Daemon:      "simple",
+		DaemonScope: snap.SystemDaemon,
 		StopTimeout: timeout.DefaultTimeout,
 		Timer: &snap.TimerInfo{
 			Timer: "10:00-12:00,,mon,23:00~01:00/2",
 		},
 	}
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service)
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, nil)
 	c.Assert(err, IsNil)
 
 	c.Logf("service: \n%v\n", string(generatedWrapper))
@@ -695,13 +752,14 @@
 				Version:       "0.3.4",
 				SideInfo:      snap.SideInfo{Revision: snap.R(44)},
 			},
-			Name:     "app",
-			Command:  "bin/foo start",
-			Daemon:   "simple",
-			StopMode: snap.StopModeType(rm),
+			Name:        "app",
+			Command:     "bin/foo start",
+			Daemon:      "simple",
+			DaemonScope: snap.SystemDaemon,
+			StopMode:    snap.StopModeType(rm),
 		}
 
-		generatedWrapper, err := wrappers.GenerateSnapServiceFile(service)
+		generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, nil)
 		c.Assert(err, IsNil)
 
 		c.Check(string(generatedWrapper), Equals, fmt.Sprintf(`[Unit]
@@ -739,10 +797,52 @@
 		Name:         "app",
 		Command:      "bin/foo start",
 		Daemon:       "simple",
+		DaemonScope:  snap.SystemDaemon,
+		RestartDelay: timeout.Timeout(20 * time.Second),
+	}
+
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, nil)
+	c.Assert(err, IsNil)
+
+	c.Check(string(generatedWrapper), Equals, fmt.Sprintf(`[Unit]
+# Auto-generated, DO NOT EDIT
+Description=Service for snap application snap.app
+Requires=%s-snap-44.mount
+Wants=network.target
+After=%s-snap-44.mount network.target snapd.apparmor.service
+X-Snappy=yes
+
+[Service]
+EnvironmentFile=-/etc/environment
+ExecStart=/usr/bin/snap run snap.app
+SyslogIdentifier=snap.app
+Restart=on-failure
+RestartSec=20
+WorkingDirectory=/var/snap/snap/44
+TimeoutStopSec=30
+Type=simple
+
+[Install]
+WantedBy=multi-user.target
+`, mountUnitPrefix, mountUnitPrefix))
+}
+
+func (s *servicesWrapperGenSuite) TestVitalityScore(c *C) {
+	service := &snap.AppInfo{
+		Snap: &snap.Info{
+			SuggestedName: "snap",
+			Version:       "0.3.4",
+			SideInfo:      snap.SideInfo{Revision: snap.R(44)},
+		},
+		Name:         "app",
+		Command:      "bin/foo start",
+		Daemon:       "simple",
+		DaemonScope:  snap.SystemDaemon,
 		RestartDelay: timeout.Timeout(20 * time.Second),
 	}
 
-	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service)
+	opts := &wrappers.AddSnapServicesOptions{VitalityRank: 1}
+	generatedWrapper, err := wrappers.GenerateSnapServiceFile(service, opts)
 	c.Assert(err, IsNil)
 
 	c.Check(string(generatedWrapper), Equals, fmt.Sprintf(`[Unit]
@@ -762,6 +862,7 @@
 WorkingDirectory=/var/snap/snap/44
 TimeoutStopSec=30
 Type=simple
+OOMScoreAdjust=-899
 
 [Install]
 WantedBy=multi-user.target
diff -Nru snapd-2.45.1+20.04.2/wrappers/services.go snapd-2.48.3+20.04/wrappers/services.go
--- snapd-2.45.1+20.04.2/wrappers/services.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/services.go	2021-02-02 08:21:12.000000000 +0000
@@ -21,18 +21,21 @@
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"text/template"
 	"time"
 
-	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/osutil/sys"
+	"github.com/snapcore/snapd/progress"
 	"github.com/snapcore/snapd/randutil"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/strutil"
@@ -40,6 +43,7 @@
 	"github.com/snapcore/snapd/timeout"
 	"github.com/snapcore/snapd/timeutil"
 	"github.com/snapcore/snapd/timings"
+	"github.com/snapcore/snapd/usersession/client"
 )
 
 type interacter interface {
@@ -57,63 +61,169 @@
 	return time.Duration(tout)
 }
 
-func generateSnapServiceFile(app *snap.AppInfo) ([]byte, error) {
+func generateSnapServiceFile(app *snap.AppInfo, opts *AddSnapServicesOptions) ([]byte, error) {
 	if err := snap.ValidateApp(app); err != nil {
 		return nil, err
 	}
 
-	return genServiceFile(app), nil
+	return genServiceFile(app, opts)
+}
+
+func stopUserServices(cli *client.Client, inter interacter, services ...string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout.DefaultTimeout))
+	defer cancel()
+	failures, err := cli.ServicesStop(ctx, services)
+	for _, f := range failures {
+		inter.Notify(fmt.Sprintf("Could not stop service %q for uid %d: %s", f.Service, f.Uid, f.Error))
+	}
+	return err
+}
+
+func startUserServices(cli *client.Client, inter interacter, services ...string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout.DefaultTimeout))
+	defer cancel()
+	startFailures, stopFailures, err := cli.ServicesStart(ctx, services)
+	for _, f := range startFailures {
+		inter.Notify(fmt.Sprintf("Could not start service %q for uid %d: %s", f.Service, f.Uid, f.Error))
+	}
+	for _, f := range stopFailures {
+		inter.Notify(fmt.Sprintf("While trying to stop previously started service %q for uid %d: %s", f.Service, f.Uid, f.Error))
+	}
+	return err
 }
 
 func stopService(sysd systemd.Systemd, app *snap.AppInfo, inter interacter) error {
 	serviceName := app.ServiceName()
 	tout := serviceStopTimeout(app)
 
-	stopErrors := []error{}
+	var extraServices []string
 	for _, socket := range app.Sockets {
-		if err := sysd.Stop(filepath.Base(socket.File()), tout); err != nil {
-			stopErrors = append(stopErrors, err)
+		extraServices = append(extraServices, filepath.Base(socket.File()))
+	}
+	if app.Timer != nil {
+		extraServices = append(extraServices, filepath.Base(app.Timer.File()))
+	}
+
+	switch app.DaemonScope {
+	case snap.SystemDaemon:
+		stopErrors := []error{}
+		for _, service := range extraServices {
+			if err := sysd.Stop(service, tout); err != nil {
+				stopErrors = append(stopErrors, err)
+			}
+		}
+
+		if err := sysd.Stop(serviceName, tout); err != nil {
+			if !systemd.IsTimeout(err) {
+				return err
+			}
+			inter.Notify(fmt.Sprintf("%s refused to stop, killing.", serviceName))
+			// ignore errors for kill; nothing we'd do differently at this point
+			sysd.Kill(serviceName, "TERM", "")
+			time.Sleep(killWait)
+			sysd.Kill(serviceName, "KILL", "")
 		}
+
+		if len(stopErrors) > 0 {
+			return stopErrors[0]
+		}
+
+	case snap.UserDaemon:
+		extraServices = append(extraServices, serviceName)
+		cli := client.New()
+		return stopUserServices(cli, inter, extraServices...)
 	}
 
-	if app.Timer != nil {
-		if err := sysd.Stop(filepath.Base(app.Timer.File()), tout); err != nil {
-			stopErrors = append(stopErrors, err)
+	return nil
+}
+
+// enableServices enables services specified by apps. On success the returned
+// disable function can be used to undo all the actions. On error all the
+// services get disabled automatically (disable is nil).
+func enableServices(apps []*snap.AppInfo, inter interacter) (disable func(), err error) {
+	var enabled []string
+	var userEnabled []string
+
+	systemSysd := systemd.New(systemd.SystemMode, inter)
+	userSysd := systemd.New(systemd.GlobalUserMode, inter)
+
+	disableEnabledServices := func() {
+		for _, srvName := range enabled {
+			if e := systemSysd.Disable(srvName); e != nil {
+				inter.Notify(fmt.Sprintf("While trying to disable previously enabled service %q: %v", srvName, e))
+			}
+		}
+		for _, s := range userEnabled {
+			if e := userSysd.Disable(s); e != nil {
+				inter.Notify(fmt.Sprintf("while trying to disable %s due to previous failure: %v", s, e))
+			}
 		}
 	}
 
-	if err := sysd.Stop(serviceName, tout); err != nil {
-		if !systemd.IsTimeout(err) {
-			return err
+	defer func() {
+		if err != nil {
+			disableEnabledServices()
 		}
-		inter.Notify(fmt.Sprintf("%s refused to stop, killing.", serviceName))
-		// ignore errors for kill; nothing we'd do differently at this point
-		sysd.Kill(serviceName, "TERM", "")
-		time.Sleep(killWait)
-		sysd.Kill(serviceName, "KILL", "")
+	}()
 
-	}
+	for _, app := range apps {
+		var sysd systemd.Systemd
+		switch app.DaemonScope {
+		case snap.SystemDaemon:
+			sysd = systemSysd
+		case snap.UserDaemon:
+			sysd = userSysd
+		}
 
-	if len(stopErrors) > 0 {
-		return stopErrors[0]
+		svcName := app.ServiceName()
+
+		switch app.DaemonScope {
+		case snap.SystemDaemon:
+			if err = sysd.Enable(svcName); err != nil {
+				return nil, err
+
+			}
+			enabled = append(enabled, svcName)
+		case snap.UserDaemon:
+			if err = userSysd.Enable(svcName); err != nil {
+				return nil, err
+			}
+			userEnabled = append(userEnabled, svcName)
+		}
 	}
 
-	return nil
+	return disableEnabledServices, nil
+}
+
+// StartServicesFlags carries extra flags for StartServices.
+type StartServicesFlags struct {
+	Enable bool
 }
 
 // StartServices starts service units for the applications from the snap which
 // are services. Service units will be started in the order provided by the
 // caller.
-func StartServices(apps []*snap.AppInfo, inter interacter, tm timings.Measurer) (err error) {
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+func StartServices(apps []*snap.AppInfo, disabledSvcs []string, flags *StartServicesFlags, inter interacter, tm timings.Measurer) (err error) {
+	systemSysd := systemd.New(systemd.SystemMode, inter)
+	userSysd := systemd.New(systemd.GlobalUserMode, inter)
+	cli := client.New()
 
-	services := make([]string, 0, len(apps))
+	systemServices := make([]string, 0, len(apps))
+	userServices := make([]string, 0, len(apps))
 	for _, app := range apps {
 		// they're *supposed* to be all services, but checking doesn't hurt
 		if !app.IsService() {
 			continue
 		}
 
+		var sysd systemd.Systemd
+		switch app.DaemonScope {
+		case snap.SystemDaemon:
+			sysd = systemSysd
+		case snap.UserDaemon:
+			sysd = userSysd
+		}
+
 		defer func(app *snap.AppInfo) {
 			if err == nil {
 				return
@@ -144,9 +254,13 @@
 			if err != nil {
 				return err
 			}
-
 			if isEnabled {
-				services = append(services, app.ServiceName())
+				switch app.DaemonScope {
+				case snap.SystemDaemon:
+					systemServices = append(systemServices, app.ServiceName())
+				case snap.UserDaemon:
+					userServices = append(userServices, app.ServiceName())
+				}
 			}
 		}
 
@@ -157,9 +271,16 @@
 				return err
 			}
 
-			timings.Run(tm, "start-socket-service", fmt.Sprintf("start socket service %q", socketService), func(nested timings.Measurer) {
-				err = sysd.Start(socketService)
-			})
+			switch app.DaemonScope {
+			case snap.SystemDaemon:
+				timings.Run(tm, "start-system-socket-service", fmt.Sprintf("start system socket service %q", socketService), func(nested timings.Measurer) {
+					err = sysd.Start(socketService)
+				})
+			case snap.UserDaemon:
+				timings.Run(tm, "start-user-socket-service", fmt.Sprintf("start user socket service %q", socketService), func(nested timings.Measurer) {
+					err = startUserServices(cli, inter, socketService)
+				})
+			}
 			if err != nil {
 				return err
 			}
@@ -172,16 +293,23 @@
 				return err
 			}
 
-			timings.Run(tm, "start-timer-service", fmt.Sprintf("start timer service %q", timerService), func(nested timings.Measurer) {
-				err = sysd.Start(timerService)
-			})
+			switch app.DaemonScope {
+			case snap.SystemDaemon:
+				timings.Run(tm, "start-system-timer-service", fmt.Sprintf("start system timer service %q", timerService), func(nested timings.Measurer) {
+					err = sysd.Start(timerService)
+				})
+			case snap.UserDaemon:
+				timings.Run(tm, "start-user-timer-service", fmt.Sprintf("start user timer service %q", timerService), func(nested timings.Measurer) {
+					err = startUserServices(cli, inter, timerService)
+				})
+			}
 			if err != nil {
 				return err
 			}
 		}
 	}
 
-	for _, srv := range services {
+	for _, srv := range systemServices {
 		// starting all services at once does not create a single
 		// transaction, but instead spawns multiple jobs, make sure the
 		// services started in the original order by bring them up one
@@ -189,24 +317,40 @@
 		// https://github.com/systemd/systemd/issues/8102
 		// https://lists.freedesktop.org/archives/systemd-devel/2018-January/040152.html
 		timings.Run(tm, "start-service", fmt.Sprintf("start service %q", srv), func(nested timings.Measurer) {
-			err = sysd.Start(srv)
+			err = systemSysd.Start(srv)
 		})
 		if err != nil {
 			// cleanup was set up by iterating over apps
 			return err
 		}
 	}
+	if len(userServices) != 0 {
+		timings.Run(tm, "start-user-services", "start user services", func(nested timings.Measurer) {
+			err = startUserServices(cli, inter, userServices...)
+		})
+		if err != nil {
+			return err
+		}
+	}
 
 	return nil
 }
 
+func userDaemonReload() error {
+	cli := client.New()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout.DefaultTimeout))
+	defer cancel()
+	return cli.ServicesDaemonReload(ctx)
+}
+
 type AddSnapServicesOptions struct {
-	Preseeding bool
+	Preseeding   bool
+	VitalityRank int
 }
 
 // AddSnapServices adds service units for the applications from the snap which are services.
 func AddSnapServices(s *snap.Info, disabledSvcs []string, opts *AddSnapServicesOptions, inter interacter) (err error) {
-	if s.GetType() == snap.TypeSnapd {
+	if s.Type() == snap.TypeSnapd {
 		return fmt.Errorf("internal error: adding explicit services for snapd snap is unexpected")
 	}
 
@@ -228,36 +372,45 @@
 	// TODO: remove once services get enabled on start and not when created.
 	preseeding := opts.Preseeding
 
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+	// note, sysd is not used when preseeding
+	sysd := systemd.New(systemd.SystemMode, inter)
 	var written []string
-	var enabled []string
+	var writtenSystem, writtenUser bool
+	var disableEnabledServices func()
+
 	defer func() {
 		if err == nil {
 			return
 		}
-		for _, s := range enabled {
-			if e := sysd.Disable(s); e != nil {
-				inter.Notify(fmt.Sprintf("while trying to disable %s due to previous failure: %v", s, e))
-			}
+		if disableEnabledServices != nil {
+			disableEnabledServices()
 		}
 		for _, s := range written {
 			if e := os.Remove(s); e != nil {
 				inter.Notify(fmt.Sprintf("while trying to remove %s due to previous failure: %v", s, e))
 			}
 		}
-		if len(written) > 0 && !preseeding {
+		if writtenSystem && !preseeding {
 			if e := sysd.DaemonReload(); e != nil {
 				inter.Notify(fmt.Sprintf("while trying to perform systemd daemon-reload due to previous failure: %v", e))
 			}
 		}
+		if writtenUser && !preseeding {
+			if e := userDaemonReload(); e != nil {
+				inter.Notify(fmt.Sprintf("while trying to perform user systemd daemon-reload due to previous failure: %v", e))
+			}
+		}
 	}()
 
+	var toEnable []*snap.AppInfo
+
+	// create services first; this doesn't trigger systemd
 	for _, app := range s.Apps {
 		if !app.IsService() {
 			continue
 		}
 		// Generate service file
-		content, err := generateSnapServiceFile(app)
+		content, err := generateSnapServiceFile(app, opts)
 		if err != nil {
 			return err
 		}
@@ -267,6 +420,12 @@
 			return err
 		}
 		written = append(written, svcFilePath)
+		switch app.DaemonScope {
+		case snap.SystemDaemon:
+			writtenSystem = true
+		case snap.UserDaemon:
+			writtenUser = true
+		}
 
 		// Generate systemd .socket files if needed
 		socketFiles, err := generateSnapSocketFiles(app)
@@ -299,25 +458,32 @@
 			// boot
 			continue
 		}
-
-		svcName := app.ServiceName()
-
-		if strutil.ListContains(disabledSvcs, app.Name) {
-			// service is disabled, nothing to do
+		// XXX: this may become quadratic, optimize.
+		// When preseeding services get enabled in doMarkPresseeded instead at
+		// the moment.
+		if strutil.ListContains(disabledSvcs, app.Name) || preseeding {
 			continue
 		}
 
-		if !preseeding {
-			if err := sysd.Enable(svcName); err != nil {
+		toEnable = append(toEnable, app)
+	}
+
+	// this is no-op when preseeding because of empty toEnable list
+	disableEnabledServices, err = enableServices(toEnable, inter)
+	if err != nil {
+		return err
+	}
+
+	if !preseeding {
+		if writtenSystem {
+			if err := sysd.DaemonReload(); err != nil {
 				return err
 			}
 		}
-		enabled = append(enabled, svcName)
-	}
-
-	if len(written) > 0 && !preseeding {
-		if err := sysd.DaemonReload(); err != nil {
-			return err
+		if writtenUser {
+			if err := userDaemonReload(); err != nil {
+				return err
+			}
 		}
 	}
 
@@ -328,7 +494,7 @@
 // the first boot of a pre-seeded image with service files already in place but not enabled.
 // XXX: it should go away once services are fixed and enabled on start.
 func EnableSnapServices(s *snap.Info, inter interacter) (err error) {
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+	sysd := systemd.New(systemd.SystemMode, inter)
 	for _, app := range s.Apps {
 		if app.IsService() {
 			svcName := app.ServiceName()
@@ -340,11 +506,24 @@
 	return nil
 }
 
-// StopServices stops service units for the applications from the snap which are services.
-func StopServices(apps []*snap.AppInfo, reason snap.ServiceStopReason, inter interacter, tm timings.Measurer) error {
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+// StopServicesFlags carries extra flags for StopServices.
+type StopServicesFlags struct {
+	Disable bool
+}
+
+// StopServices stops and optionally disables service units for the applications
+// from the snap which are services.
+func StopServices(apps []*snap.AppInfo, flags *StopServicesFlags, reason snap.ServiceStopReason, inter interacter, tm timings.Measurer) error {
+	sysd := systemd.New(systemd.SystemMode, inter)
+	if flags == nil {
+		flags = &StopServicesFlags{}
+	}
 
-	logger.Debugf("StopServices called for %q, reason: %v", apps, reason)
+	if reason != snap.StopReasonOther {
+		logger.Debugf("StopServices called for %q, reason: %v", apps, reason)
+	} else {
+		logger.Debugf("StopServices called for %q", apps)
+	}
 	for _, app := range apps {
 		// Handle the case where service file doesn't exist and don't try to stop it as it will fail.
 		// This can happen with snap try when snap.yaml is modified on the fly and a daemon line is added.
@@ -365,6 +544,9 @@
 		var err error
 		timings.Run(tm, "stop-service", fmt.Sprintf("stop service %q", app.ServiceName()), func(nested timings.Measurer) {
 			err = stopService(sysd, app, inter)
+			if err == nil && flags.Disable {
+				err = sysd.Disable(app.ServiceName())
+			}
 		})
 		if err != nil {
 			return err
@@ -372,7 +554,7 @@
 
 		// ensure the service is really stopped on remove regardless
 		// of stop-mode
-		if reason == snap.StopReasonRemove && !app.StopMode.KillAll() {
+		if reason == snap.StopReasonRemove && !app.StopMode.KillAll() && app.DaemonScope == snap.SystemDaemon {
 			// FIXME: make this smarter and avoid the killWait
 			//        delay if not needed (i.e. if all processes
 			//        have died)
@@ -381,14 +563,13 @@
 			sysd.Kill(app.ServiceName(), "KILL", "")
 		}
 	}
-
 	return nil
 }
 
 // ServicesEnableState returns a map of service names from the given snap,
 // together with their enable/disable status.
 func ServicesEnableState(s *snap.Info, inter interacter) (map[string]bool, error) {
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
+	sysd := systemd.New(systemd.SystemMode, inter)
 
 	// loop over all services in the snap, querying systemd for the current
 	// systemd state of the snaps
@@ -397,6 +578,10 @@
 		if !app.IsService() {
 			continue
 		}
+		// FIXME: handle user daemons
+		if app.DaemonScope != snap.SystemDaemon {
+			continue
+		}
 		state, err := sysd.IsEnabled(app.ServiceName())
 		if err != nil {
 			return nil, err
@@ -410,18 +595,27 @@
 // from the snap which are services. The optional flag indicates whether
 // services are removed as part of undoing of first install of a given snap.
 func RemoveSnapServices(s *snap.Info, inter interacter) error {
-	if s.GetType() == snap.TypeSnapd {
+	if s.Type() == snap.TypeSnapd {
 		return fmt.Errorf("internal error: removing explicit services for snapd snap is unexpected")
 	}
-	sysd := systemd.New(dirs.GlobalRootDir, systemd.SystemMode, inter)
-	nservices := 0
+	systemSysd := systemd.New(systemd.SystemMode, inter)
+	userSysd := systemd.New(systemd.GlobalUserMode, inter)
+	var removedSystem, removedUser bool
 
 	for _, app := range s.Apps {
 		if !app.IsService() || !osutil.FileExists(app.ServiceFile()) {
 			continue
 		}
-		nservices++
 
+		var sysd systemd.Systemd
+		switch app.DaemonScope {
+		case snap.SystemDaemon:
+			sysd = systemSysd
+			removedSystem = true
+		case snap.UserDaemon:
+			sysd = userSysd
+			removedUser = true
+		}
 		serviceName := filepath.Base(app.ServiceFile())
 
 		for _, socket := range app.Sockets {
@@ -460,8 +654,13 @@
 	}
 
 	// only reload if we actually had services
-	if nservices > 0 {
-		if err := sysd.DaemonReload(); err != nil {
+	if removedSystem {
+		if err := systemSysd.DaemonReload(); err != nil {
+			return err
+		}
+	}
+	if removedUser {
+		if err := userDaemonReload(); err != nil {
 			return err
 		}
 	}
@@ -480,13 +679,55 @@
 	return names
 }
 
-func genServiceFile(appInfo *snap.AppInfo) []byte {
+func genServiceFile(appInfo *snap.AppInfo, opts *AddSnapServicesOptions) ([]byte, error) {
+	if opts == nil {
+		opts = &AddSnapServicesOptions{}
+	}
+
+	// assemble all of the service directive snippets for all interfaces that
+	// this service needs to include in the generated systemd file
+
+	// use an ordered set to ensure we don't duplicate any keys from interfaces
+	// that specify the same snippet
+
+	// TODO: maybe we should error if multiple interfaces specify different
+	// values for the same directive, otherwise one of them will overwrite the
+	// other? What happens right now is that the snippet from the plug that
+	// comes last will win in the case of directives that can have only one
+	// value, but for some directives, systemd combines their values into a
+	// list.
+	ifaceServiceSnippets := &strutil.OrderedSet{}
+
+	for _, plug := range appInfo.Plugs {
+		iface, err := interfaces.ByName(plug.Interface)
+		if err != nil {
+			return nil, fmt.Errorf("error processing plugs while generating service unit for %v: %v", appInfo.SecurityTag(), err)
+		}
+		snips, err := interfaces.PermanentPlugServiceSnippets(iface, plug)
+		if err != nil {
+			return nil, fmt.Errorf("error processing plugs while generating service unit for %v: %v", appInfo.SecurityTag(), err)
+		}
+		for _, snip := range snips {
+			ifaceServiceSnippets.Put(snip)
+		}
+	}
+
+	// join the service snippets into one string to be included in the
+	// template
+	ifaceSpecifiedServiceSnippet := strings.Join(ifaceServiceSnippets.Items(), "\n")
+
 	serviceTemplate := `[Unit]
 # Auto-generated, DO NOT EDIT
 Description=Service for snap application {{.App.Snap.InstanceName}}.{{.App.Name}}
+{{- if .MountUnit }}
 Requires={{.MountUnit}}
+{{- end }}
+{{- if .PrerequisiteTarget}}
 Wants={{.PrerequisiteTarget}}
-After={{.MountUnit}} {{.PrerequisiteTarget}}{{if .After}} {{ stringsJoin .After " " }}{{end}}
+{{- end}}
+{{- if .After}}
+After={{ stringsJoin .After " " }}
+{{- end}}
 {{- if .Before}}
 Before={{ stringsJoin .Before " "}}
 {{- end}}
@@ -500,7 +741,7 @@
 {{- if .App.RestartDelay}}
 RestartSec={{.App.RestartDelay.Seconds}}
 {{- end}}
-WorkingDirectory={{.App.Snap.DataDir}}
+WorkingDirectory={{.WorkingDir}}
 {{- if .App.StopCommand}}
 ExecStop={{.App.LauncherStopCommand}}
 {{- end}}
@@ -532,6 +773,12 @@
 {{- if .KillSignal}}
 KillSignal={{.KillSignal}}
 {{- end}}
+{{- if .OOMAdjustScore }}
+OOMScoreAdjust={{.OOMAdjustScore}}
+{{- end}}
+{{- if .InterfaceServiceSnippets}}
+{{.InterfaceServiceSnippets}}
+{{- end}}
 {{- if not .App.Sockets}}
 
 [Install]
@@ -550,6 +797,14 @@
 		restartCond = snap.RestartOnFailure.String()
 	}
 
+	// use score -900+vitalityRank, where vitalityRank starts at 1
+	// and considering snapd itself has OOMScoreAdjust=-900
+	const baseOOMAdjustScore = -900
+	var oomAdjustScore int
+	if opts.VitalityRank > 0 {
+		oomAdjustScore = baseOOMAdjustScore + opts.VitalityRank
+	}
+
 	var remain string
 	if appInfo.Daemon == "oneshot" {
 		// any restart condition other than "no" is invalid for oneshot daemons
@@ -568,54 +823,82 @@
 	wrapperData := struct {
 		App *snap.AppInfo
 
-		Restart            string
-		StopTimeout        time.Duration
-		StartTimeout       time.Duration
-		ServicesTarget     string
-		PrerequisiteTarget string
-		MountUnit          string
-		Remain             string
-		KillMode           string
-		KillSignal         string
-		Before             []string
-		After              []string
+		Restart                  string
+		WorkingDir               string
+		StopTimeout              time.Duration
+		StartTimeout             time.Duration
+		ServicesTarget           string
+		PrerequisiteTarget       string
+		MountUnit                string
+		Remain                   string
+		KillMode                 string
+		KillSignal               string
+		OOMAdjustScore           int
+		Before                   []string
+		After                    []string
+		InterfaceServiceSnippets string
 
 		Home    string
 		EnvVars string
 	}{
 		App: appInfo,
 
-		Restart:            restartCond,
-		StopTimeout:        serviceStopTimeout(appInfo),
-		StartTimeout:       time.Duration(appInfo.StartTimeout),
-		ServicesTarget:     systemd.ServicesTarget,
-		PrerequisiteTarget: systemd.PrerequisiteTarget,
-		MountUnit:          filepath.Base(systemd.MountUnitPath(appInfo.Snap.MountDir())),
-		Remain:             remain,
-		KillMode:           killMode,
-		KillSignal:         appInfo.StopMode.KillSignal(),
+		InterfaceServiceSnippets: ifaceSpecifiedServiceSnippet,
+
+		Restart:        restartCond,
+		StopTimeout:    serviceStopTimeout(appInfo),
+		StartTimeout:   time.Duration(appInfo.StartTimeout),
+		Remain:         remain,
+		KillMode:       killMode,
+		KillSignal:     appInfo.StopMode.KillSignal(),
+		OOMAdjustScore: oomAdjustScore,
 
 		Before: genServiceNames(appInfo.Snap, appInfo.Before),
-		After:  append(genServiceNames(appInfo.Snap, appInfo.After), "snapd.apparmor.service"),
+		After:  genServiceNames(appInfo.Snap, appInfo.After),
 
 		// systemd runs as PID 1 so %h will not work.
 		Home: "/root",
 	}
+	switch appInfo.DaemonScope {
+	case snap.SystemDaemon:
+		wrapperData.ServicesTarget = systemd.ServicesTarget
+		wrapperData.PrerequisiteTarget = systemd.PrerequisiteTarget
+		wrapperData.MountUnit = filepath.Base(systemd.MountUnitPath(appInfo.Snap.MountDir()))
+		wrapperData.WorkingDir = appInfo.Snap.DataDir()
+		wrapperData.After = append(wrapperData.After, "snapd.apparmor.service")
+	case snap.UserDaemon:
+		wrapperData.ServicesTarget = systemd.UserServicesTarget
+		// FIXME: ideally use UserDataDir("%h"), but then the
+		// unit fails if the directory doesn't exist.
+		wrapperData.WorkingDir = appInfo.Snap.DataDir()
+	default:
+		panic("unknown snap.DaemonScope")
+	}
+
+	// Add extra "After" targets
+	if wrapperData.PrerequisiteTarget != "" {
+		wrapperData.After = append([]string{wrapperData.PrerequisiteTarget}, wrapperData.After...)
+	}
+	if wrapperData.MountUnit != "" {
+		wrapperData.After = append([]string{wrapperData.MountUnit}, wrapperData.After...)
+	}
 
 	if err := t.Execute(&templateOut, wrapperData); err != nil {
 		// this can never happen, except we forget a variable
 		logger.Panicf("Unable to execute template: %v", err)
 	}
 
-	return templateOut.Bytes()
+	return templateOut.Bytes(), nil
 }
 
 func genServiceSocketFile(appInfo *snap.AppInfo, socketName string) []byte {
 	socketTemplate := `[Unit]
 # Auto-generated, DO NOT EDIT
 Description=Socket {{.SocketName}} for snap application {{.App.Snap.InstanceName}}.{{.App.Name}}
+{{- if .MountUnit}}
 Requires={{.MountUnit}}
 After={{.MountUnit}}
+{{- end}}
 X-Snappy=yes
 
 [Socket]
@@ -646,11 +929,18 @@
 		App:             appInfo,
 		ServiceFileName: filepath.Base(appInfo.ServiceFile()),
 		SocketsTarget:   systemd.SocketsTarget,
-		MountUnit:       filepath.Base(systemd.MountUnitPath(appInfo.Snap.MountDir())),
 		SocketName:      socketName,
 		SocketInfo:      socket,
 		ListenStream:    listenStream,
 	}
+	switch appInfo.DaemonScope {
+	case snap.SystemDaemon:
+		wrapperData.MountUnit = filepath.Base(systemd.MountUnitPath(appInfo.Snap.MountDir()))
+	case snap.UserDaemon:
+		// nothing
+	default:
+		panic("unknown snap.DaemonScope")
+	}
 
 	if err := t.Execute(&templateOut, wrapperData); err != nil {
 		// this can never happen, except we forget a variable
@@ -673,22 +963,36 @@
 }
 
 func renderListenStream(socket *snap.SocketInfo) string {
-	snap := socket.App.Snap
-	listenStream := strings.Replace(socket.ListenStream, "$SNAP_DATA", snap.DataDir(), -1)
-	// TODO: when we support User/Group in the generated systemd unit,
-	// adjust this accordingly
-	serviceUserUid := sys.UserID(0)
-	runtimeDir := snap.UserXdgRuntimeDir(serviceUserUid)
-	listenStream = strings.Replace(listenStream, "$XDG_RUNTIME_DIR", runtimeDir, -1)
-	return strings.Replace(listenStream, "$SNAP_COMMON", snap.CommonDataDir(), -1)
+	s := socket.App.Snap
+	listenStream := socket.ListenStream
+	switch socket.App.DaemonScope {
+	case snap.SystemDaemon:
+		listenStream = strings.Replace(listenStream, "$SNAP_DATA", s.DataDir(), -1)
+		// TODO: when we support User/Group in the generated
+		// systemd unit, adjust this accordingly
+		serviceUserUid := sys.UserID(0)
+		runtimeDir := s.UserXdgRuntimeDir(serviceUserUid)
+		listenStream = strings.Replace(listenStream, "$XDG_RUNTIME_DIR", runtimeDir, -1)
+		listenStream = strings.Replace(listenStream, "$SNAP_COMMON", s.CommonDataDir(), -1)
+	case snap.UserDaemon:
+		listenStream = strings.Replace(listenStream, "$SNAP_USER_DATA", s.UserDataDir("%h"), -1)
+		listenStream = strings.Replace(listenStream, "$SNAP_USER_COMMON", s.UserCommonDataDir("%h"), -1)
+		// FIXME: find some way to share code with snap.UserXdgRuntimeDir()
+		listenStream = strings.Replace(listenStream, "$XDG_RUNTIME_DIR", fmt.Sprintf("%%t/snap.%s", s.InstanceName()), -1)
+	default:
+		panic("unknown snap.DaemonScope")
+	}
+	return listenStream
 }
 
 func generateSnapTimerFile(app *snap.AppInfo) ([]byte, error) {
 	timerTemplate := `[Unit]
 # Auto-generated, DO NOT EDIT
 Description=Timer {{.TimerName}} for snap application {{.App.Snap.InstanceName}}.{{.App.Name}}
+{{- if .MountUnit}}
 Requires={{.MountUnit}}
 After={{.MountUnit}}
+{{- end}}
 X-Snappy=yes
 
 [Timer]
@@ -720,9 +1024,16 @@
 		ServiceFileName: filepath.Base(app.ServiceFile()),
 		TimersTarget:    systemd.TimersTarget,
 		TimerName:       app.Name,
-		MountUnit:       filepath.Base(systemd.MountUnitPath(app.Snap.MountDir())),
 		Schedules:       schedules,
 	}
+	switch app.DaemonScope {
+	case snap.SystemDaemon:
+		wrapperData.MountUnit = filepath.Base(systemd.MountUnitPath(app.Snap.MountDir()))
+	case snap.UserDaemon:
+		// nothing
+	default:
+		panic("unknown snap.DaemonScope")
+	}
 
 	if err := t.Execute(&templateOut, wrapperData); err != nil {
 		// this can never happen, except we forget a variable
@@ -730,7 +1041,6 @@
 	}
 
 	return templateOut.Bytes(), nil
-
 }
 
 func makeAbbrevWeekdays(start time.Weekday, end time.Weekday) []string {
@@ -948,3 +1258,58 @@
 	}
 	return calendarEvents
 }
+
+type RestartServicesFlags struct {
+	Reload bool
+}
+
+// Restart or reload services; if reload flag is set then "systemctl reload-or-restart" is attempted.
+func RestartServices(svcs []*snap.AppInfo, flags *RestartServicesFlags, inter interacter, tm timings.Measurer) error {
+	sysd := systemd.New(systemd.SystemMode, inter)
+
+	for _, srv := range svcs {
+		// they're *supposed* to be all services, but checking doesn't hurt
+		if !srv.IsService() {
+			continue
+		}
+
+		var err error
+		timings.Run(tm, "restart-service", fmt.Sprintf("restart service %q", srv), func(nested timings.Measurer) {
+			if flags != nil && flags.Reload {
+				err = sysd.ReloadOrRestart(srv.ServiceName())
+			} else {
+				// note: stop followed by start, not just 'restart'
+				err = sysd.Restart(srv.ServiceName(), 5*time.Second)
+			}
+		})
+		if err != nil {
+			// there is nothing we can do about failed service
+			return err
+		}
+	}
+	return nil
+}
+
+// QueryDisabledServices returns a list of all currently disabled snap services
+// in the snap.
+func QueryDisabledServices(info *snap.Info, pb progress.Meter) ([]string, error) {
+	// save the list of services that are in the disabled state before unlinking
+	// and thus removing the snap services
+	snapSvcStates, err := ServicesEnableState(info, pb)
+	if err != nil {
+		return nil, err
+	}
+
+	disabledSnapSvcs := []string{}
+	// add all disabled services to the list
+	for svc, isEnabled := range snapSvcStates {
+		if !isEnabled {
+			disabledSnapSvcs = append(disabledSnapSvcs, svc)
+		}
+	}
+
+	// sort for easier testing
+	sort.Strings(disabledSnapSvcs)
+
+	return disabledSnapSvcs, nil
+}
diff -Nru snapd-2.45.1+20.04.2/wrappers/services_test.go snapd-2.48.3+20.04/wrappers/services_test.go
--- snapd-2.45.1+20.04.2/wrappers/services_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/wrappers/services_test.go	2021-02-02 08:21:12.000000000 +0000
@@ -22,6 +22,7 @@
 import (
 	"fmt"
 	"io/ioutil"
+	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -31,6 +32,9 @@
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/dirs"
+	// imported to ensure actual interfaces are defined,
+	// in production this is guaranteed by ifacestate
+	_ "github.com/snapcore/snapd/interfaces/builtin"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/progress"
@@ -40,6 +44,7 @@
 	"github.com/snapcore/snapd/systemd"
 	"github.com/snapcore/snapd/testutil"
 	"github.com/snapcore/snapd/timings"
+	"github.com/snapcore/snapd/usersession/agent"
 	"github.com/snapcore/snapd/wrappers"
 )
 
@@ -51,6 +56,8 @@
 	systemctlRestorer, delaysRestorer func()
 
 	perfTimings timings.Measurer
+
+	agent *agent.SessionAgent
 }
 
 var _ = Suite(&servicesTestSuite{})
@@ -67,12 +74,22 @@
 	s.delaysRestorer = systemd.MockStopDelays(time.Millisecond, 25*time.Second)
 	s.perfTimings = timings.New(nil)
 
+	xdgRuntimeDir := fmt.Sprintf("%s/%d", dirs.XdgRuntimeDirBase, os.Getuid())
+	err := os.MkdirAll(xdgRuntimeDir, 0700)
+	c.Assert(err, IsNil)
+	s.agent, err = agent.New()
+	c.Assert(err, IsNil)
+	s.agent.Start()
 }
 
 func (s *servicesTestSuite) TearDownTest(c *C) {
-	dirs.SetRootDir("")
+	if s.agent != nil {
+		err := s.agent.Stop()
+		c.Check(err, IsNil)
+	}
 	s.systemctlRestorer()
 	s.delaysRestorer()
+	dirs.SetRootDir("")
 }
 
 func (s *servicesTestSuite) TestAddSnapServicesAndRemove(c *C) {
@@ -82,22 +99,42 @@
 	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
 	c.Assert(err, IsNil)
 	c.Check(s.sysdLog, DeepEquals, [][]string{
-		{"--root", dirs.GlobalRootDir, "enable", filepath.Base(svcFile)},
+		{"enable", filepath.Base(svcFile)},
 		{"daemon-reload"},
 	})
 
 	content, err := ioutil.ReadFile(svcFile)
 	c.Assert(err, IsNil)
 
-	verbs := []string{"Start", "Stop", "StopPost"}
-	cmds := []string{"", " --command=stop", " --command=post-stop"}
-	for i := range verbs {
-		expected := fmt.Sprintf("Exec%s=/usr/bin/snap run%s hello-snap.svc1", verbs[i], cmds[i])
-		c.Check(string(content), Matches, "(?ms).*^"+regexp.QuoteMeta(expected)) // check.v1 adds ^ and $ around the regexp provided
-	}
+	dir := filepath.Join(dirs.GlobalRootDir, "snap", "hello-snap", "12.mount")
+	c.Assert(string(content), Equals, fmt.Sprintf(`[Unit]
+# Auto-generated, DO NOT EDIT
+Description=Service for snap application hello-snap.svc1
+Requires=%[1]s
+Wants=network.target
+After=%[1]s network.target snapd.apparmor.service
+X-Snappy=yes
+
+[Service]
+EnvironmentFile=-/etc/environment
+ExecStart=/usr/bin/snap run hello-snap.svc1
+SyslogIdentifier=hello-snap.svc1
+Restart=on-failure
+WorkingDirectory=%[2]s/var/snap/hello-snap/12
+ExecStop=/usr/bin/snap run --command=stop hello-snap.svc1
+ExecStopPost=/usr/bin/snap run --command=post-stop hello-snap.svc1
+TimeoutStopSec=30
+Type=forking
+
+[Install]
+WantedBy=multi-user.target
+`,
+		systemd.EscapeUnitNamePath(dir),
+		dirs.GlobalRootDir,
+	))
 
 	s.sysdLog = nil
-	err = wrappers.StopServices(info.Services(), "", progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, "", progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 	c.Assert(s.sysdLog, HasLen, 2)
 	c.Check(s.sysdLog, DeepEquals, [][]string{
@@ -110,10 +147,200 @@
 	c.Assert(err, IsNil)
 	c.Check(osutil.FileExists(svcFile), Equals, false)
 	c.Assert(s.sysdLog, HasLen, 2)
-	c.Check(s.sysdLog[0], DeepEquals, []string{"--root", dirs.GlobalRootDir, "disable", filepath.Base(svcFile)})
+	c.Check(s.sysdLog[0], DeepEquals, []string{"disable", filepath.Base(svcFile)})
 	c.Check(s.sysdLog[1], DeepEquals, []string{"daemon-reload"})
 }
 
+func (s *servicesTestSuite) TestAddSnapServicesWithInterfaceSnippets(c *C) {
+	tt := []struct {
+		comment     string
+		plugSnippet string
+	}{
+		// just single bare interfaces with no attributes
+		{
+			"docker-support",
+			`
+  plugs:
+   - docker-support`,
+		},
+		{
+			"k8s-support",
+			`
+  plugs:
+   - kubernetes-support`,
+		},
+		{
+			"lxd-support",
+			`
+  plugs:
+   - lxd-support
+`,
+		},
+		{
+			"greengrass-support",
+			`
+  plugs:
+   - greengrass-support
+`,
+		},
+
+		// multiple interfaces that require Delegate=true, but only one is
+		// generated
+
+		{
+			"multiple interfaces that require Delegate=true",
+			`
+  plugs:
+   - docker-support
+   - kubernetes-support`,
+		},
+
+		// interfaces with flavor attributes
+
+		{
+			"k8s-support with kubelet",
+			`
+  plugs:
+   - kubelet
+plugs:
+ kubelet:
+  interface: kubernetes-support
+  flavor: kubelet
+`,
+		},
+		{
+			"k8s-support with kubeproxy",
+			`
+  plugs:
+   - kubeproxy
+plugs:
+ kubeproxy:
+  interface: kubernetes-support
+  flavor: kubeproxy
+`,
+		},
+		{
+			"greengrass-support with legacy-container flavor",
+			`
+  plugs:
+   - greengrass
+plugs:
+ greengrass:
+  interface: greengrass-support
+  flavor: legacy-container
+`,
+		},
+	}
+
+	for _, t := range tt {
+		comment := Commentf(t.comment)
+		info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  daemon: simple
+`+t.plugSnippet,
+			&snap.SideInfo{Revision: snap.R(12)})
+		svcFile := filepath.Join(s.tempdir, "/etc/systemd/system/snap.hello-snap.svc1.service")
+
+		err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+		c.Assert(err, IsNil, comment)
+		c.Check(s.sysdLog, DeepEquals, [][]string{
+			{"enable", "snap.hello-snap.svc1.service"},
+			{"daemon-reload"},
+		}, comment)
+
+		content, err := ioutil.ReadFile(svcFile)
+		c.Assert(err, IsNil, comment)
+
+		dir := filepath.Join(dirs.GlobalRootDir, "snap", "hello-snap", "12.mount")
+		c.Assert(string(content), Equals, fmt.Sprintf(`[Unit]
+# Auto-generated, DO NOT EDIT
+Description=Service for snap application hello-snap.svc1
+Requires=%[1]s
+Wants=network.target
+After=%[1]s network.target snapd.apparmor.service
+X-Snappy=yes
+
+[Service]
+EnvironmentFile=-/etc/environment
+ExecStart=/usr/bin/snap run hello-snap.svc1
+SyslogIdentifier=hello-snap.svc1
+Restart=on-failure
+WorkingDirectory=%[2]s/var/snap/hello-snap/12
+TimeoutStopSec=30
+Type=simple
+Delegate=true
+
+[Install]
+WantedBy=multi-user.target
+`,
+			systemd.EscapeUnitNamePath(dir),
+			dirs.GlobalRootDir,
+		), comment)
+
+		s.sysdLog = nil
+		err = wrappers.StopServices(info.Services(), nil, "", progress.Null, s.perfTimings)
+		c.Assert(err, IsNil, comment)
+		c.Assert(s.sysdLog, HasLen, 2, comment)
+		c.Check(s.sysdLog, DeepEquals, [][]string{
+			{"stop", filepath.Base(svcFile)},
+			{"show", "--property=ActiveState", "snap.hello-snap.svc1.service"},
+		}, comment)
+
+		s.sysdLog = nil
+		err = wrappers.RemoveSnapServices(info, progress.Null)
+		c.Assert(err, IsNil, comment)
+		c.Check(osutil.FileExists(svcFile), Equals, false, comment)
+		c.Assert(s.sysdLog, HasLen, 2, comment)
+		c.Check(s.sysdLog, DeepEquals, [][]string{
+			{"disable", filepath.Base(svcFile)},
+			{"daemon-reload"},
+		}, comment)
+
+		s.sysdLog = nil
+	}
+}
+
+func (s *servicesTestSuite) TestAddSnapServicesAndRemoveUserDaemons(c *C) {
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  daemon: simple
+  daemon-scope: user
+`, &snap.SideInfo{Revision: snap.R(12)})
+	svcFile := filepath.Join(s.tempdir, "/etc/systemd/user/snap.hello-snap.svc1.service")
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, IsNil)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"--user", "--global", "enable", filepath.Base(svcFile)},
+		{"--user", "daemon-reload"},
+	})
+
+	content, err := ioutil.ReadFile(svcFile)
+	c.Assert(err, IsNil)
+
+	expected := "ExecStart=/usr/bin/snap run hello-snap.svc1"
+	c.Check(string(content), Matches, "(?ms).*^"+regexp.QuoteMeta(expected)) // check.v1 adds ^ and $ around the regexp provided
+
+	s.sysdLog = nil
+	err = wrappers.StopServices(info.Services(), nil, "", progress.Null, s.perfTimings)
+	c.Assert(err, IsNil)
+	c.Assert(s.sysdLog, HasLen, 2)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"--user", "stop", filepath.Base(svcFile)},
+		{"--user", "show", "--property=ActiveState", "snap.hello-snap.svc1.service"},
+	})
+
+	s.sysdLog = nil
+	err = wrappers.RemoveSnapServices(info, progress.Null)
+	c.Assert(err, IsNil)
+	c.Check(osutil.FileExists(svcFile), Equals, false)
+	c.Assert(s.sysdLog, HasLen, 2)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"--user", "--global", "disable", filepath.Base(svcFile)},
+		{"--user", "daemon-reload"},
+	})
+}
+
 var snapdYaml = `name: snapd
 version: 1.0
 type: snapd
@@ -135,7 +362,7 @@
 	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
 	c.Assert(err, IsNil)
 
-	err = wrappers.StopServices(info.Services(), "", &progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, "", &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 
 	err = wrappers.RemoveSnapServices(info, &progress.Null)
@@ -179,7 +406,7 @@
 
 	svcFName := "snap.wat.wat.service"
 
-	err = wrappers.StopServices(info.Services(), "", progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, "", progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 
 	c.Check(sysdLog, DeepEquals, [][]string{
@@ -190,11 +417,54 @@
 	})
 }
 
+func (s *servicesTestSuite) TestRemoveSnapPackageUserDaemonStopFailure(c *C) {
+	var sysdLog [][]string
+	r := systemd.MockSystemctl(func(cmd ...string) ([]byte, error) {
+		// filter out the "systemctl --user show" that
+		// StopServices generates
+		if cmd[0] == "--user" && cmd[1] != "show" {
+			sysdLog = append(sysdLog, cmd)
+		}
+		if cmd[0] == "--user" && cmd[1] == "stop" {
+			return nil, fmt.Errorf("user unit stop failed")
+		}
+		return []byte("ActiveState=active\n"), nil
+	})
+	defer r()
+
+	info := snaptest.MockSnap(c, `name: wat
+version: 42
+apps:
+ wat:
+   command: wat
+   stop-timeout: 20ms
+   daemon: forking
+   daemon-scope: user
+`, &snap.SideInfo{Revision: snap.R(11)})
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, IsNil)
+
+	sysdLog = nil
+
+	svcFName := "snap.wat.wat.service"
+
+	err = wrappers.StopServices(info.Services(), nil, "", progress.Null, s.perfTimings)
+	c.Check(err, ErrorMatches, "some user services failed to stop")
+	c.Check(sysdLog, DeepEquals, [][]string{
+		{"--user", "stop", svcFName},
+	})
+}
+
 func (s *servicesTestSuite) TestServicesEnableState(c *C) {
 	info := snaptest.MockSnap(c, packageHello+`
  svc2:
   command: bin/hello
   daemon: forking
+ svc3:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
 `, &snap.SideInfo{Revision: snap.R(12)})
 	svc1File := "snap.hello-snap.svc1.service"
 	svc2File := "snap.hello-snap.svc2.service"
@@ -244,12 +514,12 @@
 	// is non-deterministic, so manually check each call
 	c.Assert(r.Calls(), HasLen, 2)
 	for _, call := range r.Calls() {
-		c.Assert(call, HasLen, 5)
-		c.Assert(call[:4], DeepEquals, []string{"systemctl", "--root", s.tempdir, "is-enabled"})
-		switch call[4] {
+		c.Assert(call, HasLen, 3)
+		c.Assert(call[:2], DeepEquals, []string{"systemctl", "is-enabled"})
+		switch call[2] {
 		case svc1File, svc2File:
 		default:
-			c.Errorf("unknown service for systemctl call: %s", call[4])
+			c.Errorf("unknown service for systemctl call: %s", call[2])
 		}
 	}
 }
@@ -291,7 +561,7 @@
 	c.Assert(err, ErrorMatches, ".*is-enabled snap.hello-snap.svc1.service\\] failed with exit status 1: whoops\n.*")
 
 	c.Assert(r.Calls(), DeepEquals, [][]string{
-		{"systemctl", "--root", s.tempdir, "is-enabled", svc1File},
+		{"systemctl", "is-enabled", svc1File},
 	})
 }
 
@@ -343,7 +613,7 @@
 
 	// only svc2 should be enabled
 	c.Assert(r.Calls(), DeepEquals, [][]string{
-		{"systemctl", "--root", s.tempdir, "enable", "snap.hello-snap.svc2.service"},
+		{"systemctl", "enable", "snap.hello-snap.svc2.service"},
 		{"systemctl", "daemon-reload"},
 	})
 }
@@ -397,7 +667,7 @@
 	// actually enabling them, so we just see a daemon-reload call and not any
 	// enable calls
 	c.Assert(r.Calls(), DeepEquals, [][]string{
-		{"systemctl", "--root", s.tempdir, "enable", "snap.hello-snap.svc1.service"},
+		{"systemctl", "enable", "snap.hello-snap.svc1.service"},
 		{"systemctl", "daemon-reload"},
 	})
 }
@@ -451,7 +721,7 @@
 	// actually enabling them, so we just see a daemon-reload call and not any
 	// enable calls
 	c.Assert(r.Calls(), DeepEquals, [][]string{
-		{"systemctl", "--root", s.tempdir, "enable", "snap.hello-snap.svc1.service"},
+		{"systemctl", "enable", "snap.hello-snap.svc1.service"},
 		{"systemctl", "daemon-reload"},
 	})
 }
@@ -477,10 +747,12 @@
 }
 
 func (s *servicesTestSuite) TestStopServicesWithSockets(c *C) {
-	var sysdLog []string
+	var sysServices, userServices []string
 	r := systemd.MockSystemctl(func(cmd ...string) ([]byte, error) {
 		if cmd[0] == "stop" {
-			sysdLog = append(sysdLog, cmd[1])
+			sysServices = append(sysServices, cmd[1])
+		} else if cmd[0] == "--user" && cmd[1] == "stop" {
+			userServices = append(userServices, cmd[2])
 		}
 		return []byte("ActiveState=inactive\n"), nil
 	})
@@ -496,34 +768,65 @@
       socket-mode: 0666
     sock2:
       listen-stream: $SNAP_DATA/sock2.socket
+ svc2:
+  daemon: simple
+  daemon-scope: user
+  plugs: [network-bind]
+  sockets:
+    sock1:
+      listen-stream: $SNAP_USER_COMMON/sock1.socket
+      socket-mode: 0666
+    sock2:
+      listen-stream: $SNAP_USER_DATA/sock2.socket
 `, &snap.SideInfo{Revision: snap.R(12)})
 
 	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
 	c.Assert(err, IsNil)
 
-	sysdLog = nil
+	sysServices = nil
+	userServices = nil
 
-	err = wrappers.StopServices(info.Services(), "", &progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, "", &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 
-	sort.Strings(sysdLog)
-	c.Check(sysdLog, DeepEquals, []string{
+	sort.Strings(sysServices)
+	c.Check(sysServices, DeepEquals, []string{
 		"snap.hello-snap.svc1.service", "snap.hello-snap.svc1.sock1.socket", "snap.hello-snap.svc1.sock2.socket"})
+	sort.Strings(userServices)
+	c.Check(userServices, DeepEquals, []string{
+		"snap.hello-snap.svc2.service", "snap.hello-snap.svc2.sock1.socket", "snap.hello-snap.svc2.sock2.socket"})
 }
 
 func (s *servicesTestSuite) TestStartServices(c *C) {
 	info := snaptest.MockSnap(c, packageHello, &snap.SideInfo{Revision: snap.R(12)})
 	svcFile := filepath.Join(s.tempdir, "/etc/systemd/system/snap.hello-snap.svc1.service")
 
-	err := wrappers.StartServices(info.Services(), nil, s.perfTimings)
+	err := wrappers.StartServices(info.Services(), nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 
 	c.Assert(s.sysdLog, DeepEquals, [][]string{
-		{"--root", s.tempdir, "is-enabled", filepath.Base(svcFile)},
+		{"is-enabled", filepath.Base(svcFile)},
 		{"start", filepath.Base(svcFile)},
 	})
 }
 
+func (s *servicesTestSuite) TestStartServicesUserDaemons(c *C) {
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  daemon: simple
+  daemon-scope: user
+`, &snap.SideInfo{Revision: snap.R(12)})
+	svcFile := filepath.Join(s.tempdir, "/etc/systemd/user/snap.hello-snap.svc1.service")
+
+	err := wrappers.StartServices(info.Services(), nil, nil, &progress.Null, s.perfTimings)
+	c.Assert(err, IsNil)
+
+	c.Assert(s.sysdLog, DeepEquals, [][]string{
+		{"--user", "--global", "is-enabled", filepath.Base(svcFile)},
+		{"--user", "start", filepath.Base(svcFile)},
+	})
+}
+
 func (s *servicesTestSuite) TestEnableServices(c *C) {
 	info := snaptest.MockSnap(c, packageHello, &snap.SideInfo{Revision: snap.R(12)})
 	svcFile := filepath.Join(s.tempdir, "/etc/systemd/system/snap.hello-snap.svc1.service")
@@ -532,7 +835,7 @@
 	c.Assert(err, IsNil)
 
 	c.Assert(s.sysdLog, DeepEquals, [][]string{
-		{"--root", s.tempdir, "enable", filepath.Base(svcFile)},
+		{"enable", filepath.Base(svcFile)},
 	})
 }
 
@@ -563,11 +866,11 @@
 	`)
 	defer r.Restore()
 
-	err := wrappers.StartServices(info.Services(), nil, s.perfTimings)
+	err := wrappers.StartServices(info.Services(), nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 
 	c.Assert(r.Calls(), DeepEquals, [][]string{
-		{"systemctl", "--root", s.tempdir, "is-enabled", filepath.Base(svcFile)},
+		{"systemctl", "is-enabled", filepath.Base(svcFile)},
 	})
 }
 
@@ -594,8 +897,6 @@
 	if len(s.sysdLog) > 0 {
 		// the second service failed validation
 		c.Check(s.sysdLog, DeepEquals, [][]string{
-			{"--root", dirs.GlobalRootDir, "enable", "snap.hello-snap.svc1.service"},
-			{"--root", dirs.GlobalRootDir, "disable", "snap.hello-snap.svc1.service"},
 			{"daemon-reload"},
 		})
 	}
@@ -653,9 +954,9 @@
 	svcFiles, _ = filepath.Glob(filepath.Join(dirs.SnapServicesDir, "snap.hello-snap.*.service"))
 	c.Check(svcFiles, HasLen, 0)
 	c.Check(sysdLog, DeepEquals, [][]string{
-		{"--root", dirs.GlobalRootDir, "enable", svc1Name},
-		{"--root", dirs.GlobalRootDir, "enable", svc2Name}, // this one fails
-		{"--root", dirs.GlobalRootDir, "disable", svc1Name},
+		{"enable", svc1Name},
+		{"enable", svc2Name}, // this one fails
+		{"disable", svc1Name},
 		{"daemon-reload"},
 	})
 }
@@ -701,15 +1002,140 @@
 	svcFiles, _ = filepath.Glob(filepath.Join(dirs.SnapServicesDir, "snap.hello-snap.*.service"))
 	c.Check(svcFiles, HasLen, 0)
 	c.Check(sysdLog, DeepEquals, [][]string{
-		{"--root", dirs.GlobalRootDir, "enable", svc1Name},
-		{"--root", dirs.GlobalRootDir, "enable", svc2Name},
+		{"enable", svc1Name},
+		{"enable", svc2Name},
 		{"daemon-reload"}, // this one fails
-		{"--root", dirs.GlobalRootDir, "disable", svc1Name},
-		{"--root", dirs.GlobalRootDir, "disable", svc2Name},
+		{"disable", svc1Name},
+		{"disable", svc2Name},
 		{"daemon-reload"}, // so does this one :-)
 	})
 }
 
+func (s *servicesTestSuite) TestAddSnapMultiUserServicesFailEnableCleanup(c *C) {
+	var sysdLog [][]string
+	svc1Name := "snap.hello-snap.svc1.service"
+	svc2Name := "snap.hello-snap.svc2.service"
+	numEnables := 0
+
+	// sanity check: there are no service files
+	svcFiles, _ := filepath.Glob(filepath.Join(dirs.SnapUserServicesDir, "snap.hello-snap.*.service"))
+	c.Check(svcFiles, HasLen, 0)
+
+	r := systemd.MockSystemctl(func(cmd ...string) ([]byte, error) {
+		sysdLog = append(sysdLog, cmd)
+		if len(cmd) >= 1 && cmd[0] == "--user" {
+			cmd = cmd[1:]
+		}
+		if len(cmd) >= 1 && cmd[0] == "--global" {
+			cmd = cmd[1:]
+		}
+		sdcmd := cmd[0]
+		if len(cmd) >= 2 {
+			sdcmd = cmd[len(cmd)-2]
+		}
+		switch sdcmd {
+		case "enable":
+			numEnables++
+			switch numEnables {
+			case 1:
+				if cmd[len(cmd)-1] == svc2Name {
+					// the services are being iterated in the "wrong" order
+					svc1Name, svc2Name = svc2Name, svc1Name
+				}
+				return nil, nil
+			case 2:
+				return nil, fmt.Errorf("failed")
+			default:
+				panic("expected no more than 2 enables")
+			}
+		case "disable", "daemon-reload":
+			return nil, nil
+		default:
+			panic("unexpected systemctl command " + sdcmd)
+		}
+	})
+	defer r()
+
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+ svc2:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+`, &snap.SideInfo{Revision: snap.R(12)})
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, ErrorMatches, "failed")
+
+	// the services are cleaned up
+	svcFiles, _ = filepath.Glob(filepath.Join(dirs.SnapUserServicesDir, "snap.hello-snap.*.service"))
+	c.Check(svcFiles, HasLen, 0)
+	c.Check(sysdLog, DeepEquals, [][]string{
+		{"--user", "--global", "enable", svc1Name},
+		{"--user", "--global", "enable", svc2Name}, // this one fails
+		{"--user", "--global", "disable", svc1Name},
+		{"--user", "daemon-reload"},
+	})
+}
+
+func (s *servicesTestSuite) TestAddSnapMultiUserServicesStartFailOnSystemdReloadCleanup(c *C) {
+	// this test might be overdoing it (it's mostly covering the same ground as the previous one), but ... :-)
+	var sysdLog [][]string
+	svc1Name := "snap.hello-snap.svc1.service"
+	svc2Name := "snap.hello-snap.svc2.service"
+
+	// sanity check: there are no service files
+	svcFiles, _ := filepath.Glob(filepath.Join(dirs.SnapUserServicesDir, "snap.hello-snap.*.service"))
+	c.Check(svcFiles, HasLen, 0)
+
+	first := true
+	r := systemd.MockSystemctl(func(cmd ...string) ([]byte, error) {
+		sysdLog = append(sysdLog, cmd)
+		if len(cmd) < 3 {
+			return nil, fmt.Errorf("failed")
+		}
+		if first {
+			first = false
+			if cmd[len(cmd)-1] == svc2Name {
+				// the services are being iterated in the "wrong" order
+				svc1Name, svc2Name = svc2Name, svc1Name
+			}
+		}
+		return nil, nil
+
+	})
+	defer r()
+
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+ svc2:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+`, &snap.SideInfo{Revision: snap.R(12)})
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, ErrorMatches, "cannot reload daemon: failed")
+
+	// the services are cleaned up
+	svcFiles, _ = filepath.Glob(filepath.Join(dirs.SnapUserServicesDir, "snap.hello-snap.*.service"))
+	c.Check(svcFiles, HasLen, 0)
+	c.Check(sysdLog, DeepEquals, [][]string{
+		{"--user", "--global", "enable", svc1Name},
+		{"--user", "--global", "enable", svc2Name},
+		{"--user", "daemon-reload"}, // this one fails
+		{"--user", "--global", "disable", svc1Name},
+		{"--user", "--global", "disable", svc2Name},
+		{"--user", "daemon-reload"}, // so does this one :-)
+	})
+}
+
 func (s *servicesTestSuite) TestAddSnapSocketFiles(c *C) {
 	info := snaptest.MockSnap(c, packageHello+`
  svc1:
@@ -762,6 +1188,55 @@
 	c.Check(sock3File, testutil.FileContains, expected)
 }
 
+func (s *servicesTestSuite) TestAddSnapUserSocketFiles(c *C) {
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  daemon: simple
+  daemon-scope: user
+  plugs: [network-bind]
+  sockets:
+    sock1:
+      listen-stream: $SNAP_USER_COMMON/sock1.socket
+      socket-mode: 0666
+    sock2:
+      listen-stream: $SNAP_USER_DATA/sock2.socket
+    sock3:
+      listen-stream: $XDG_RUNTIME_DIR/sock3.socket
+`, &snap.SideInfo{Revision: snap.R(12)})
+
+	sock1File := filepath.Join(s.tempdir, "/etc/systemd/user/snap.hello-snap.svc1.sock1.socket")
+	sock2File := filepath.Join(s.tempdir, "/etc/systemd/user/snap.hello-snap.svc1.sock2.socket")
+	sock3File := filepath.Join(s.tempdir, "/etc/systemd/user/snap.hello-snap.svc1.sock3.socket")
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, IsNil)
+
+	expected := `[Socket]
+Service=snap.hello-snap.svc1.service
+FileDescriptorName=sock1
+ListenStream=%h/snap/hello-snap/common/sock1.socket
+SocketMode=0666
+
+`
+	c.Check(sock1File, testutil.FileContains, expected)
+
+	expected = `[Socket]
+Service=snap.hello-snap.svc1.service
+FileDescriptorName=sock2
+ListenStream=%h/snap/hello-snap/12/sock2.socket
+
+`
+	c.Check(sock2File, testutil.FileContains, expected)
+
+	expected = `[Socket]
+Service=snap.hello-snap.svc1.service
+FileDescriptorName=sock3
+ListenStream=%t/snap.hello-snap/sock3.socket
+
+`
+	c.Check(sock3File, testutil.FileContains, expected)
+}
+
 func (s *servicesTestSuite) TestStartSnapMultiServicesFailStartCleanup(c *C) {
 	var sysdLog [][]string
 	svc1Name := "snap.hello-snap.svc1.service"
@@ -790,12 +1265,12 @@
 	if svcs[0].Name == "svc2" {
 		svcs[0], svcs[1] = svcs[1], svcs[0]
 	}
-	err := wrappers.StartServices(svcs, nil, s.perfTimings)
+	err := wrappers.StartServices(svcs, nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, ErrorMatches, "failed")
 	c.Assert(sysdLog, HasLen, 8, Commentf("len: %v calls: %v", len(sysdLog), sysdLog))
 	c.Check(sysdLog, DeepEquals, [][]string{
-		{"--root", s.tempdir, "is-enabled", svc1Name},
-		{"--root", s.tempdir, "is-enabled", svc2Name},
+		{"is-enabled", svc1Name},
+		{"is-enabled", svc2Name},
 		{"start", svc1Name},
 		{"start", svc2Name}, // one of the services fails
 		{"stop", svc2Name},
@@ -844,31 +1319,83 @@
 	// ensure desired order
 	apps := []*snap.AppInfo{info.Apps["svc1"], info.Apps["svc2"], info.Apps["svc3"]}
 
-	err := wrappers.StartServices(apps, nil, s.perfTimings)
+	err := wrappers.StartServices(apps, nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, ErrorMatches, "failed")
 	c.Logf("sysdlog: %v", sysdLog)
 	c.Assert(sysdLog, HasLen, 17, Commentf("len: %v calls: %v", len(sysdLog), sysdLog))
 	c.Check(sysdLog, DeepEquals, [][]string{
-		{"--root", s.tempdir, "is-enabled", svc1Name},
-		{"--root", s.tempdir, "enable", svc2SocketName},
+		{"is-enabled", svc1Name},
+		{"enable", svc2SocketName},
 		{"start", svc2SocketName},
-		{"--root", s.tempdir, "enable", svc3SocketName},
+		{"enable", svc3SocketName},
 		{"start", svc3SocketName}, // start failed, what follows is the cleanup
 		{"stop", svc3SocketName},
 		{"show", "--property=ActiveState", svc3SocketName},
 		{"stop", svc3Name},
 		{"show", "--property=ActiveState", svc3Name},
-		{"--root", s.tempdir, "disable", svc3SocketName},
+		{"disable", svc3SocketName},
 		{"stop", svc2SocketName},
 		{"show", "--property=ActiveState", svc2SocketName},
 		{"stop", svc2Name},
 		{"show", "--property=ActiveState", svc2Name},
-		{"--root", s.tempdir, "disable", svc2SocketName},
+		{"disable", svc2SocketName},
 		{"stop", svc1Name},
 		{"show", "--property=ActiveState", svc1Name},
 	}, Commentf("calls: %v", sysdLog))
 }
 
+func (s *servicesTestSuite) TestStartSnapMultiUserServicesFailStartCleanup(c *C) {
+	var sysdLog [][]string
+	svc1Name := "snap.hello-snap.svc1.service"
+	svc2Name := "snap.hello-snap.svc2.service"
+
+	r := systemd.MockSystemctl(func(cmd ...string) ([]byte, error) {
+		sysdLog = append(sysdLog, cmd)
+		if len(cmd) >= 3 && cmd[0] == "--user" && cmd[1] == "start" {
+			name := cmd[len(cmd)-1]
+			if name == svc2Name {
+				return nil, fmt.Errorf("failed")
+			}
+		}
+		return []byte("ActiveState=inactive\n"), nil
+	})
+	defer r()
+
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+ svc2:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+`, &snap.SideInfo{Revision: snap.R(12)})
+
+	svcs := info.Services()
+	c.Assert(svcs, HasLen, 2)
+	if svcs[0].Name == "svc2" {
+		svcs[0], svcs[1] = svcs[1], svcs[0]
+	}
+	err := wrappers.StartServices(svcs, nil, nil, &progress.Null, s.perfTimings)
+	c.Assert(err, ErrorMatches, "some user services failed to start")
+	c.Assert(sysdLog, HasLen, 10, Commentf("len: %v calls: %v", len(sysdLog), sysdLog))
+	c.Check(sysdLog, DeepEquals, [][]string{
+		{"--user", "--global", "is-enabled", svc1Name},
+		{"--user", "--global", "is-enabled", svc2Name},
+		{"--user", "start", svc1Name},
+		{"--user", "start", svc2Name}, // one of the services fails
+		// session agent attempts to stop the non-failed services
+		{"--user", "stop", svc1Name},
+		{"--user", "show", "--property=ActiveState", svc1Name},
+		// StartServices ensures everything is stopped
+		{"--user", "stop", svc2Name},
+		{"--user", "show", "--property=ActiveState", svc2Name},
+		{"--user", "stop", svc1Name},
+		{"--user", "show", "--property=ActiveState", svc1Name},
+	}, Commentf("calls: %v", sysdLog))
+}
+
 func (s *servicesTestSuite) TestStartSnapServicesKeepsOrder(c *C) {
 	var sysdLog [][]string
 	svc1Name := "snap.services-snap.svc1.service"
@@ -900,13 +1427,13 @@
 	sorted, err := snap.SortServices(svcs)
 	c.Assert(err, IsNil)
 
-	err = wrappers.StartServices(sorted, nil, s.perfTimings)
+	err = wrappers.StartServices(sorted, nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 	c.Assert(sysdLog, HasLen, 6, Commentf("len: %v calls: %v", len(sysdLog), sysdLog))
 	c.Check(sysdLog, DeepEquals, [][]string{
-		{"--root", s.tempdir, "is-enabled", svc1Name},
-		{"--root", s.tempdir, "is-enabled", svc3Name},
-		{"--root", s.tempdir, "is-enabled", svc2Name},
+		{"is-enabled", svc1Name},
+		{"is-enabled", svc3Name},
+		{"is-enabled", svc2Name},
 		{"start", svc1Name},
 		{"start", svc3Name},
 		{"start", svc2Name},
@@ -916,13 +1443,13 @@
 	sorted[1], sorted[0] = sorted[0], sorted[1]
 
 	// we should observe the calls done in the same order as services
-	err = wrappers.StartServices(sorted, nil, s.perfTimings)
+	err = wrappers.StartServices(sorted, nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 	c.Assert(sysdLog, HasLen, 12, Commentf("len: %v calls: %v", len(sysdLog), sysdLog))
 	c.Check(sysdLog[6:], DeepEquals, [][]string{
-		{"--root", s.tempdir, "is-enabled", svc3Name},
-		{"--root", s.tempdir, "is-enabled", svc1Name},
-		{"--root", s.tempdir, "is-enabled", svc2Name},
+		{"is-enabled", svc3Name},
+		{"is-enabled", svc1Name},
+		{"is-enabled", svc2Name},
 		{"start", svc3Name},
 		{"start", svc1Name},
 		{"start", svc2Name},
@@ -1046,17 +1573,17 @@
 	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
 	c.Assert(err, IsNil)
 	c.Check(s.sysdLog, DeepEquals, [][]string{
-		{"--root", dirs.GlobalRootDir, "enable", filepath.Base(survivorFile)},
+		{"enable", filepath.Base(survivorFile)},
 		{"daemon-reload"},
 	})
 
 	s.sysdLog = nil
-	err = wrappers.StopServices(info.Services(), snap.StopReasonRefresh, progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, snap.StopReasonRefresh, progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 	c.Assert(s.sysdLog, HasLen, 0)
 
 	s.sysdLog = nil
-	err = wrappers.StopServices(info.Services(), snap.StopReasonRemove, progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, snap.StopReasonRemove, progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 	c.Check(s.sysdLog, DeepEquals, [][]string{
 		{"stop", filepath.Base(survivorFile)},
@@ -1098,12 +1625,12 @@
 		err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
 		c.Assert(err, IsNil)
 		c.Check(s.sysdLog, DeepEquals, [][]string{
-			{"--root", dirs.GlobalRootDir, "enable", filepath.Base(survivorFile)},
+			{"enable", filepath.Base(survivorFile)},
 			{"daemon-reload"},
 		})
 
 		s.sysdLog = nil
-		err = wrappers.StopServices(info.Services(), snap.StopReasonRefresh, progress.Null, s.perfTimings)
+		err = wrappers.StopServices(info.Services(), nil, snap.StopReasonRefresh, progress.Null, s.perfTimings)
 		c.Assert(err, IsNil)
 		c.Check(s.sysdLog, DeepEquals, [][]string{
 			{"stop", filepath.Base(survivorFile)},
@@ -1111,7 +1638,7 @@
 		}, Commentf("failure in %s", t.mode))
 
 		s.sysdLog = nil
-		err = wrappers.StopServices(info.Services(), snap.StopReasonRemove, progress.Null, s.perfTimings)
+		err = wrappers.StopServices(info.Services(), nil, snap.StopReasonRemove, progress.Null, s.perfTimings)
 		c.Assert(err, IsNil)
 		switch t.expectedWho {
 		case "all":
@@ -1133,27 +1660,72 @@
 
 }
 
+func (s *servicesTestSuite) TestStartSnapSocketEnableStart(c *C) {
+	svc1Name := "snap.hello-snap.svc1.service"
+	// svc2Name := "snap.hello-snap.svc2.service"
+	svc2Sock := "snap.hello-snap.svc2.sock.socket"
+	svc3Sock := "snap.hello-snap.svc3.sock.socket"
+
+	info := snaptest.MockSnap(c, packageHello+`
+ svc2:
+  command: bin/hello
+  daemon: simple
+  sockets:
+    sock:
+      listen-stream: $SNAP_COMMON/sock1.socket
+ svc3:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+  sockets:
+    sock:
+      listen-stream: $SNAP_USER_COMMON/sock1.socket
+`, &snap.SideInfo{Revision: snap.R(12)})
+
+	// fix the apps order to make the test stable
+	apps := []*snap.AppInfo{info.Apps["svc1"], info.Apps["svc2"], info.Apps["svc3"]}
+	err := wrappers.StartServices(apps, nil, nil, &progress.Null, s.perfTimings)
+	c.Assert(err, IsNil)
+	c.Assert(s.sysdLog, HasLen, 6, Commentf("len: %v calls: %v", len(s.sysdLog), s.sysdLog))
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"is-enabled", svc1Name},
+		{"enable", svc2Sock},
+		{"start", svc2Sock},
+		{"--user", "--global", "enable", svc3Sock},
+		{"--user", "start", svc3Sock},
+		{"start", svc1Name},
+	}, Commentf("calls: %v", s.sysdLog))
+}
+
 func (s *servicesTestSuite) TestStartSnapTimerEnableStart(c *C) {
 	svc1Name := "snap.hello-snap.svc1.service"
 	// svc2Name := "snap.hello-snap.svc2.service"
 	svc2Timer := "snap.hello-snap.svc2.timer"
+	svc3Timer := "snap.hello-snap.svc3.timer"
 
 	info := snaptest.MockSnap(c, packageHello+`
  svc2:
   command: bin/hello
   daemon: simple
   timer: 10:00-12:00
+ svc3:
+  command: bin/hello
+  daemon: simple
+  daemon-scope: user
+  timer: 10:00-12:00
 `, &snap.SideInfo{Revision: snap.R(12)})
 
 	// fix the apps order to make the test stable
-	apps := []*snap.AppInfo{info.Apps["svc1"], info.Apps["svc2"]}
-	err := wrappers.StartServices(apps, nil, s.perfTimings)
+	apps := []*snap.AppInfo{info.Apps["svc1"], info.Apps["svc2"], info.Apps["svc3"]}
+	err := wrappers.StartServices(apps, nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
-	c.Assert(s.sysdLog, HasLen, 4, Commentf("len: %v calls: %v", len(s.sysdLog), s.sysdLog))
+	c.Assert(s.sysdLog, HasLen, 6, Commentf("len: %v calls: %v", len(s.sysdLog), s.sysdLog))
 	c.Check(s.sysdLog, DeepEquals, [][]string{
-		{"--root", dirs.GlobalRootDir, "is-enabled", svc1Name},
-		{"--root", dirs.GlobalRootDir, "enable", svc2Timer},
+		{"is-enabled", svc1Name},
+		{"enable", svc2Timer},
 		{"start", svc2Timer},
+		{"--user", "--global", "enable", svc3Timer},
+		{"--user", "start", svc3Timer},
 		{"start", svc1Name},
 	}, Commentf("calls: %v", s.sysdLog))
 }
@@ -1182,18 +1754,18 @@
 
 	// fix the apps order to make the test stable
 	apps := []*snap.AppInfo{info.Apps["svc1"], info.Apps["svc2"]}
-	err := wrappers.StartServices(apps, nil, s.perfTimings)
+	err := wrappers.StartServices(apps, nil, nil, &progress.Null, s.perfTimings)
 	c.Assert(err, ErrorMatches, "failed")
 	c.Assert(sysdLog, HasLen, 10, Commentf("len: %v calls: %v", len(sysdLog), sysdLog))
 	c.Check(sysdLog, DeepEquals, [][]string{
-		{"--root", dirs.GlobalRootDir, "is-enabled", svc1Name},
-		{"--root", dirs.GlobalRootDir, "enable", svc2Timer},
+		{"is-enabled", svc1Name},
+		{"enable", svc2Timer},
 		{"start", svc2Timer}, // this call fails
 		{"stop", svc2Timer},
 		{"show", "--property=ActiveState", svc2Timer},
 		{"stop", svc2Name},
 		{"show", "--property=ActiveState", svc2Name},
-		{"--root", dirs.GlobalRootDir, "disable", svc2Timer},
+		{"disable", svc2Timer},
 		{"stop", svc1Name},
 		{"show", "--property=ActiveState", svc1Name},
 	}, Commentf("calls: %v", sysdLog))
@@ -1216,7 +1788,7 @@
 	c.Check(osutil.FileExists(app.Timer.File()), Equals, true)
 	c.Check(osutil.FileExists(app.ServiceFile()), Equals, true)
 
-	err = wrappers.StopServices(info.Services(), "", &progress.Null, s.perfTimings)
+	err = wrappers.StopServices(info.Services(), nil, "", &progress.Null, s.perfTimings)
 	c.Assert(err, IsNil)
 
 	err = wrappers.RemoveSnapServices(info, &progress.Null)
@@ -1342,7 +1914,7 @@
 	c.Assert(s.sysdLog, HasLen, 2, Commentf("len: %v calls: %v", len(s.sysdLog), s.sysdLog))
 	c.Check(s.sysdLog, DeepEquals, [][]string{
 		// only svc3 gets started during boot
-		{"--root", dirs.GlobalRootDir, "enable", svc3Name},
+		{"enable", svc3Name},
 		{"daemon-reload"},
 	}, Commentf("calls: %v", s.sysdLog))
 }
@@ -1378,3 +1950,64 @@
 	err = wrappers.RemoveSnapServices(info, progress.Null)
 	c.Check(err, ErrorMatches, "internal error: removing explicit services for snapd snap is unexpected")
 }
+
+func (s *servicesTestSuite) TestReloadOrRestart(c *C) {
+	const surviveYaml = `name: test-snap
+version: 1.0
+apps:
+  foo:
+    command: bin/foo
+    daemon: simple
+`
+	info := snaptest.MockSnap(c, surviveYaml, &snap.SideInfo{Revision: snap.R(1)})
+	srvFile := "snap.test-snap.foo.service"
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, IsNil)
+
+	s.sysdLog = nil
+	flags := &wrappers.RestartServicesFlags{Reload: true}
+	c.Assert(wrappers.RestartServices(info.Services(), flags, progress.Null, s.perfTimings), IsNil)
+	c.Assert(err, IsNil)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"reload-or-restart", srvFile},
+	})
+
+	s.sysdLog = nil
+	flags.Reload = false
+	c.Assert(wrappers.RestartServices(info.Services(), flags, progress.Null, s.perfTimings), IsNil)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"stop", srvFile},
+		{"show", "--property=ActiveState", srvFile},
+		{"start", srvFile},
+	})
+
+	s.sysdLog = nil
+	c.Assert(wrappers.RestartServices(info.Services(), nil, progress.Null, s.perfTimings), IsNil)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"stop", srvFile},
+		{"show", "--property=ActiveState", srvFile},
+		{"start", srvFile},
+	})
+}
+
+func (s *servicesTestSuite) TestStopAndDisableServices(c *C) {
+	info := snaptest.MockSnap(c, packageHello+`
+ svc1:
+  daemon: simple
+`, &snap.SideInfo{Revision: snap.R(12)})
+	svcFile := "snap.hello-snap.svc1.service"
+
+	err := wrappers.AddSnapServices(info, nil, nil, progress.Null)
+	c.Assert(err, IsNil)
+
+	s.sysdLog = nil
+	flags := &wrappers.StopServicesFlags{Disable: true}
+	err = wrappers.StopServices(info.Services(), flags, "", progress.Null, s.perfTimings)
+	c.Assert(err, IsNil)
+	c.Check(s.sysdLog, DeepEquals, [][]string{
+		{"stop", svcFile},
+		{"show", "--property=ActiveState", svcFile},
+		{"disable", svcFile},
+	})
+}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/export_test.go snapd-2.48.3+20.04/xdgopenproxy/export_test.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/export_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/export_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,60 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package xdgopenproxy
-
-import (
-	"time"
-)
-
-type (
-	DesktopLauncher = desktopLauncher
-	PortalLauncher  = portalLauncher
-	UserdLauncher   = userdLauncher
-
-	ResponseError = responseError
-)
-
-const (
-	DesktopPortalBusName      = desktopPortalBusName
-	DesktopPortalObjectPath   = desktopPortalObjectPath
-	DesktopPortalOpenURIIface = desktopPortalOpenURIIface
-	DesktopPortalRequestIface = desktopPortalRequestIface
-
-	UserdLauncherBusName    = userdLauncherBusName
-	UserdLauncherObjectPath = userdLauncherObjectPath
-	UserdLauncherIface      = userdLauncherIface
-)
-
-var (
-	Launch        = launch
-	LaunchWithOne = launchWithOne
-)
-
-func MakeResponseError(msg string) error {
-	return &responseError{msg: msg}
-}
-
-func MockPortalTimeout(t time.Duration) (restore func()) {
-	old := defaultPortalRequestTimeout
-	defaultPortalRequestTimeout = t
-	return func() {
-		defaultPortalRequestTimeout = old
-	}
-}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/portal_launcher.go snapd-2.48.3+20.04/xdgopenproxy/portal_launcher.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/portal_launcher.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/portal_launcher.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,174 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package xdgopenproxy
-
-import (
-	"fmt"
-	"syscall"
-	"time"
-
-	"github.com/godbus/dbus"
-)
-
-const (
-	desktopPortalBusName      = "org.freedesktop.portal.Desktop"
-	desktopPortalObjectPath   = "/org/freedesktop/portal/desktop"
-	desktopPortalOpenURIIface = "org.freedesktop.portal.OpenURI"
-	desktopPortalRequestIface = "org.freedesktop.portal.Request"
-)
-
-// portalLauncher is a launcher that forwards the requests to xdg-desktop-portal DBus API
-type portalLauncher struct{}
-
-// desktopPortal gets a reference to the xdg-desktop-portal D-Bus service
-func (p *portalLauncher) desktopPortal(bus *dbus.Conn) (dbus.BusObject, error) {
-	// We call StartServiceByName since old versions of
-	// xdg-desktop-portal do not include the AssumedAppArmorLabel
-	// key in their service activation file.
-	var startResult uint32
-	err := bus.BusObject().Call("org.freedesktop.DBus.StartServiceByName", 0, desktopPortalBusName, uint32(0)).Store(&startResult)
-	if dbusErr, ok := err.(dbus.Error); ok {
-		// If it is not possible to activate the service
-		// (i.e. there is no .service file or the systemd unit
-		// has been masked), assume it is already
-		// running. Subsequent method calls will fail if this
-		// assumption is false.
-		if dbusErr.Name == "org.freedesktop.DBus.Error.ServiceUnknown" || dbusErr.Name == "org.freedesktop.systemd1.Masked" {
-			err = nil
-			startResult = 2 // DBUS_START_REPLY_ALREADY_RUNNING
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-	switch startResult {
-	case 1: // DBUS_START_REPLY_SUCCESS
-	case 2: // DBUS_START_REPLY_ALREADY_RUNNING
-	default:
-		return nil, fmt.Errorf("unexpected response from StartServiceByName (code %v)", startResult)
-	}
-	return bus.Object(desktopPortalBusName, desktopPortalObjectPath), nil
-}
-
-// portalResponseSuccess is a numeric value indicating a success carrying out
-// the request, returned by the `response` member of
-// org.freedesktop.portal.Request.Response signal
-const portalResponseSuccess = 0
-
-// timeout for asking the user to make a choice, same value as in usersession/userd/launcher.go
-var defaultPortalRequestTimeout = 5 * time.Minute
-
-func (p *portalLauncher) portalCall(bus *dbus.Conn, call func() (dbus.ObjectPath, error)) error {
-	// see https://flatpak.github.io/xdg-desktop-portal/portal-docs.html for
-	// details of the interaction, in short:
-	// 1. caller issues a request to the desktop portal
-	// 2. desktop portal responds with a handle to a dbus object capturing the Request
-	// 3. caller waits for the org.freedesktop.portal.Request.Response
-	// 3a. caller can terminate the request earlier by calling close
-
-	// set up signal handling before we call the portal, so that we do not
-	// miss the signals
-	signals := make(chan *dbus.Signal, 1)
-	bus.Signal(signals)
-	defer func() {
-		bus.RemoveSignal(signals)
-		close(signals)
-	}()
-
-	// TODO: this should use dbus.Conn.AddMatchSignal, but that
-	// does not exist in the external copies of godbus on some
-	// supported platforms.
-	const matchRule = "type='signal',sender='" + desktopPortalBusName + "',interface='" + desktopPortalRequestIface + "',member='Response'"
-	if err := bus.BusObject().Call("org.freedesktop.DBus.AddMatch", 0, matchRule).Store(); err != nil {
-		return err
-	}
-	defer bus.BusObject().Call("org.freedesktop.DBus.RemoveMatch", 0, matchRule)
-
-	requestPath, err := call()
-	if err != nil {
-		return err
-	}
-	request := bus.Object(desktopPortalBusName, requestPath)
-
-	timeout := time.NewTimer(defaultPortalRequestTimeout)
-	defer timeout.Stop()
-	for {
-		select {
-		case <-timeout.C:
-			request.Call(desktopPortalRequestIface+".Close", 0).Store()
-			return &responseError{msg: "timeout waiting for user response"}
-		case signal := <-signals:
-			if signal.Path != requestPath || signal.Name != desktopPortalRequestIface+".Response" {
-				// This isn't the signal we're waiting for
-				continue
-			}
-
-			var response uint32
-			var results map[string]interface{} // don't care
-			if err := dbus.Store(signal.Body, &response, &results); err != nil {
-				return &responseError{msg: fmt.Sprintf("cannot unpack response: %v", err)}
-			}
-			if response == portalResponseSuccess {
-				return nil
-			}
-			return &responseError{msg: fmt.Sprintf("request declined by the user (code %v)", response)}
-		}
-	}
-}
-
-func (p *portalLauncher) OpenFile(bus *dbus.Conn, filename string) error {
-	portal, err := p.desktopPortal(bus)
-	if err != nil {
-		return err
-	}
-
-	fd, err := syscall.Open(filename, syscall.O_RDONLY, 0)
-	if err != nil {
-		return &responseError{msg: err.Error()}
-	}
-	defer syscall.Close(fd)
-
-	return p.portalCall(bus, func() (dbus.ObjectPath, error) {
-		var (
-			parent  string
-			options map[string]dbus.Variant
-			request dbus.ObjectPath
-		)
-		err := portal.Call(desktopPortalOpenURIIface+".OpenFile", 0, parent, dbus.UnixFD(fd), options).Store(&request)
-		return request, err
-	})
-}
-
-func (p *portalLauncher) OpenURI(bus *dbus.Conn, uri string) error {
-	portal, err := p.desktopPortal(bus)
-	if err != nil {
-		return err
-	}
-
-	return p.portalCall(bus, func() (dbus.ObjectPath, error) {
-		var (
-			parent  string
-			options map[string]dbus.Variant
-			request dbus.ObjectPath
-		)
-		err := portal.Call(desktopPortalOpenURIIface+".OpenURI", 0, parent, uri, options).Store(&request)
-		return request, err
-	})
-}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/portal_launcher_test.go snapd-2.48.3+20.04/xdgopenproxy/portal_launcher_test.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/portal_launcher_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/portal_launcher_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,263 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package xdgopenproxy_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"syscall"
-	"time"
-
-	"github.com/godbus/dbus"
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/testutil"
-	"github.com/snapcore/snapd/xdgopenproxy"
-)
-
-type portalSuite struct {
-	testutil.DBusTest
-
-	portal  *fakePortal
-	request *fakePortalRequest
-
-	openError    *dbus.Error
-	sendResponse bool
-	openResponse uint32
-	calls        []string
-}
-
-var _ = Suite(&portalSuite{})
-
-const portalRequestPath = "/org/freedesktop/portal/desktop/request/1"
-
-func (s *portalSuite) SetUpSuite(c *C) {
-	s.DBusTest.SetUpSuite(c)
-
-	s.portal = &fakePortal{s}
-	err := s.SessionBus.Export(s.portal, xdgopenproxy.DesktopPortalObjectPath, xdgopenproxy.DesktopPortalOpenURIIface)
-	c.Assert(err, IsNil)
-	s.request = &fakePortalRequest{s}
-	err = s.SessionBus.Export(s.request, portalRequestPath, xdgopenproxy.DesktopPortalRequestIface)
-	c.Assert(err, IsNil)
-
-	_, err = s.SessionBus.RequestName(xdgopenproxy.DesktopPortalBusName, dbus.NameFlagAllowReplacement|dbus.NameFlagReplaceExisting)
-	c.Assert(err, IsNil)
-}
-
-func (s *portalSuite) TearDownSuite(c *C) {
-	if s.SessionBus != nil {
-		_, err := s.SessionBus.ReleaseName(xdgopenproxy.DesktopPortalBusName)
-		c.Check(err, IsNil)
-	}
-
-	s.DBusTest.TearDownSuite(c)
-}
-
-func (s *portalSuite) SetUpTest(c *C) {
-	s.DBusTest.SetUpTest(c)
-
-	s.openError = nil
-	s.openResponse = 0
-	s.sendResponse = true
-	s.calls = nil
-}
-
-func (s *portalSuite) TestOpenFile(c *C) {
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, IsNil)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *portalSuite) TestOpenFileCallError(c *C) {
-	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
-
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, FitsTypeOf, dbus.Error{})
-	c.Check(err, ErrorMatches, "failure")
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *portalSuite) TestOpenFileResponseError(c *C) {
-	s.openResponse = 2
-
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
-	c.Check(err, ErrorMatches, `request declined by the user \(code 2\)`)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *portalSuite) TestOpenFileTimeout(c *C) {
-	s.sendResponse = false
-	restore := xdgopenproxy.MockPortalTimeout(5 * time.Millisecond)
-	defer restore()
-
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	file := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(file, []byte("hello world"), 0644), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, file)
-	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
-	c.Check(err, ErrorMatches, "timeout waiting for user response")
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-		"Request.Close",
-	})
-}
-
-func (s *portalSuite) TestOpenDir(c *C) {
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	dir := c.MkDir()
-	err := launcher.OpenFile(s.SessionBus, dir)
-	c.Check(err, IsNil)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *portalSuite) TestOpenMissingFile(c *C) {
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	path := filepath.Join(c.MkDir(), "no-such-file.txt")
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, ErrorMatches, "no such file or directory")
-	c.Check(s.calls, HasLen, 0)
-}
-
-func (s *portalSuite) TestOpenUnreadableFile(c *C) {
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-	c.Assert(os.Chmod(path, 0), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, ErrorMatches, "permission denied")
-	c.Check(s.calls, HasLen, 0)
-}
-
-func (s *portalSuite) TestOpenURI(c *C) {
-	launcher := &xdgopenproxy.PortalLauncher{}
-
-	err := launcher.OpenURI(s.SessionBus, "http://example.com")
-	c.Check(err, IsNil)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenURI http://example.com",
-	})
-}
-
-func (s *portalSuite) TestOpenURICallError(c *C) {
-	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
-
-	launcher := &xdgopenproxy.PortalLauncher{}
-	err := launcher.OpenURI(s.SessionBus, "http://example.com")
-	c.Check(err, FitsTypeOf, dbus.Error{})
-	c.Check(err, ErrorMatches, "failure")
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenURI http://example.com",
-	})
-}
-
-func (s *portalSuite) TestOpenURIResponseError(c *C) {
-	s.openResponse = 2
-
-	launcher := &xdgopenproxy.PortalLauncher{}
-	err := launcher.OpenURI(s.SessionBus, "http://example.com")
-	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
-	c.Check(err, ErrorMatches, `request declined by the user \(code 2\)`)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenURI http://example.com",
-	})
-}
-
-func (s *portalSuite) TestOpenURITimeout(c *C) {
-	s.sendResponse = false
-	restore := xdgopenproxy.MockPortalTimeout(5 * time.Millisecond)
-	defer restore()
-
-	launcher := &xdgopenproxy.PortalLauncher{}
-	err := launcher.OpenURI(s.SessionBus, "http://example.com")
-	c.Check(err, FitsTypeOf, (*xdgopenproxy.ResponseError)(nil))
-	c.Check(err, ErrorMatches, "timeout waiting for user response")
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenURI http://example.com",
-		"Request.Close",
-	})
-}
-
-type fakePortal struct {
-	*portalSuite
-}
-
-func (p *fakePortal) OpenFile(parent string, clientFD dbus.UnixFD, options map[string]dbus.Variant) (dbus.ObjectPath, *dbus.Error) {
-	p.calls = append(p.calls, "OpenFile")
-
-	fd := int(clientFD)
-	defer syscall.Close(fd)
-
-	if p.sendResponse {
-		var results map[string]dbus.Variant
-		p.SessionBus.Emit(portalRequestPath, xdgopenproxy.DesktopPortalRequestIface+".Response", p.openResponse, results)
-	}
-	return portalRequestPath, p.openError
-}
-
-func (p *fakePortal) OpenURI(parent, uri string, options map[string]dbus.Variant) (dbus.ObjectPath, *dbus.Error) {
-	p.calls = append(p.calls, "OpenURI "+uri)
-	if p.sendResponse {
-		var results map[string]dbus.Variant
-		p.SessionBus.Emit(portalRequestPath, xdgopenproxy.DesktopPortalRequestIface+".Response", p.openResponse, results)
-	}
-	return portalRequestPath, p.openError
-}
-
-type fakePortalRequest struct {
-	*portalSuite
-}
-
-func (r *fakePortalRequest) Close() *dbus.Error {
-	r.calls = append(r.calls, "Request.Close")
-	return nil
-}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/userd_launcher.go snapd-2.48.3+20.04/xdgopenproxy/userd_launcher.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/userd_launcher.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/userd_launcher.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,51 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package xdgopenproxy
-
-import (
-	"syscall"
-
-	"github.com/godbus/dbus"
-)
-
-const (
-	userdLauncherBusName    = "io.snapcraft.Launcher"
-	userdLauncherObjectPath = "/io/snapcraft/Launcher"
-	userdLauncherIface      = "io.snapcraft.Launcher"
-)
-
-// userdLauncher is a launcher that forwards the requests to `snap userd` DBus API
-type userdLauncher struct{}
-
-func (s *userdLauncher) OpenFile(bus *dbus.Conn, filename string) error {
-	fd, err := syscall.Open(filename, syscall.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer syscall.Close(fd)
-
-	launcher := bus.Object(userdLauncherBusName, userdLauncherObjectPath)
-	return launcher.Call(userdLauncherIface+".OpenFile", 0, "", dbus.UnixFD(fd)).Store()
-}
-
-func (s *userdLauncher) OpenURI(bus *dbus.Conn, path string) error {
-	launcher := bus.Object(userdLauncherBusName, userdLauncherObjectPath)
-	return launcher.Call("io.snapcraft.Launcher.OpenURL", 0, path).Store()
-}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/userd_launcher_test.go snapd-2.48.3+20.04/xdgopenproxy/userd_launcher_test.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/userd_launcher_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/userd_launcher_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,173 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2020 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package xdgopenproxy_test
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"syscall"
-
-	"github.com/godbus/dbus"
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/testutil"
-	"github.com/snapcore/snapd/xdgopenproxy"
-)
-
-type userdSuite struct {
-	testutil.DBusTest
-
-	userd *fakeUserd
-
-	openError *dbus.Error
-	calls     []string
-}
-
-var _ = Suite(&userdSuite{})
-
-func (s *userdSuite) SetUpSuite(c *C) {
-	s.DBusTest.SetUpSuite(c)
-
-	s.userd = &fakeUserd{s}
-	err := s.SessionBus.Export(s.userd, xdgopenproxy.UserdLauncherObjectPath, xdgopenproxy.UserdLauncherIface)
-	c.Assert(err, IsNil)
-
-	_, err = s.SessionBus.RequestName(xdgopenproxy.UserdLauncherBusName, dbus.NameFlagAllowReplacement|dbus.NameFlagReplaceExisting)
-	c.Assert(err, IsNil)
-}
-
-func (s *userdSuite) TearDownSuite(c *C) {
-	if s.SessionBus != nil {
-		_, err := s.SessionBus.ReleaseName(xdgopenproxy.UserdLauncherBusName)
-		c.Check(err, IsNil)
-	}
-
-	s.DBusTest.TearDownSuite(c)
-}
-
-func (s *userdSuite) SetUpTest(c *C) {
-	s.DBusTest.SetUpTest(c)
-
-	s.openError = nil
-	s.calls = nil
-}
-
-func (s *userdSuite) TestOpenFile(c *C) {
-	launcher := &xdgopenproxy.UserdLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, IsNil)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *userdSuite) TestOpenFileError(c *C) {
-	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
-
-	launcher := &xdgopenproxy.UserdLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, FitsTypeOf, dbus.Error{})
-	c.Check(err, ErrorMatches, "failure")
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *userdSuite) TestOpenDir(c *C) {
-	launcher := &xdgopenproxy.UserdLauncher{}
-
-	dir := c.MkDir()
-	err := launcher.OpenFile(s.SessionBus, dir)
-	c.Check(err, IsNil)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenFile",
-	})
-}
-
-func (s *userdSuite) TestOpenMissingFile(c *C) {
-	launcher := &xdgopenproxy.UserdLauncher{}
-
-	path := filepath.Join(c.MkDir(), "no-such-file.txt")
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, ErrorMatches, "no such file or directory")
-	c.Check(s.calls, HasLen, 0)
-}
-
-func (s *userdSuite) TestOpenUnreadableFile(c *C) {
-	launcher := &xdgopenproxy.UserdLauncher{}
-
-	path := filepath.Join(c.MkDir(), "test.txt")
-	c.Assert(ioutil.WriteFile(path, []byte("hello world"), 0644), IsNil)
-	c.Assert(os.Chmod(path, 0), IsNil)
-
-	err := launcher.OpenFile(s.SessionBus, path)
-	c.Check(err, ErrorMatches, "permission denied")
-	c.Check(s.calls, HasLen, 0)
-}
-
-func (s *userdSuite) TestOpenURI(c *C) {
-	launcher := &xdgopenproxy.UserdLauncher{}
-
-	err := launcher.OpenURI(s.SessionBus, "http://example.com")
-	c.Check(err, IsNil)
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenURI http://example.com",
-	})
-}
-
-func (s *userdSuite) TestOpenURIError(c *C) {
-	s.openError = dbus.MakeFailedError(fmt.Errorf("failure"))
-
-	launcher := &xdgopenproxy.UserdLauncher{}
-	err := launcher.OpenURI(s.SessionBus, "http://example.com")
-	c.Check(err, FitsTypeOf, dbus.Error{})
-	c.Check(err, ErrorMatches, "failure")
-	c.Check(s.calls, DeepEquals, []string{
-		"OpenURI http://example.com",
-	})
-}
-
-type fakeUserd struct {
-	*userdSuite
-}
-
-func (p *fakeUserd) OpenFile(parentWindow string, clientFD dbus.UnixFD) *dbus.Error {
-	p.calls = append(p.calls, "OpenFile")
-
-	fd := int(clientFD)
-	defer syscall.Close(fd)
-
-	return p.openError
-}
-
-func (p *fakeUserd) OpenURL(uri string) *dbus.Error {
-	p.calls = append(p.calls, "OpenURI "+uri)
-	return p.openError
-}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/xdgopenproxy.go snapd-2.48.3+20.04/xdgopenproxy/xdgopenproxy.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/xdgopenproxy.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/xdgopenproxy.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,88 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-// Package xdgopenproxy provides a client for snap userd's xdg-open D-Bus proxy
-package xdgopenproxy
-
-import (
-	"net/url"
-
-	"github.com/godbus/dbus"
-	"golang.org/x/xerrors"
-)
-
-type responseError struct {
-	msg string
-}
-
-func (u *responseError) Error() string { return u.msg }
-
-func (u *responseError) Is(err error) bool {
-	_, ok := err.(*responseError)
-	return ok
-}
-
-type desktopLauncher interface {
-	OpenFile(bus *dbus.Conn, path string) error
-	OpenURI(bus *dbus.Conn, url string) error
-}
-
-var availableLaunchers = []desktopLauncher{
-	&portalLauncher{},
-	&userdLauncher{},
-}
-
-// Run attempts to open given file or URL using one of available launchers
-func Run(urlOrFile string) error {
-	bus, err := dbus.SessionBus()
-	if err != nil {
-		return err
-	}
-	defer bus.Close()
-
-	return launch(bus, availableLaunchers, urlOrFile)
-}
-
-func launchWithOne(bus *dbus.Conn, l desktopLauncher, urlOrFile string) error {
-	if u, err := url.Parse(urlOrFile); err == nil {
-		if u.Scheme == "file" {
-			return l.OpenFile(bus, u.Path)
-		} else if u.Scheme != "" {
-			return l.OpenURI(bus, urlOrFile)
-		}
-	}
-	return l.OpenFile(bus, urlOrFile)
-}
-
-func launch(bus *dbus.Conn, launchers []desktopLauncher, urlOrFile string) error {
-	var err error
-	for _, l := range launchers {
-		err = launchWithOne(bus, l, urlOrFile)
-		if err == nil {
-			break
-		}
-		if xerrors.Is(err, &responseError{}) {
-			// got a response which indicates the action was either
-			// explicitly rejected by the user or abandoned due to
-			// other reasons eg. timeout waiting for user to respond
-			break
-		}
-	}
-	return err
-}
diff -Nru snapd-2.45.1+20.04.2/xdgopenproxy/xdgopenproxy_test.go snapd-2.48.3+20.04/xdgopenproxy/xdgopenproxy_test.go
--- snapd-2.45.1+20.04.2/xdgopenproxy/xdgopenproxy_test.go	2020-06-05 13:13:49.000000000 +0000
+++ snapd-2.48.3+20.04/xdgopenproxy/xdgopenproxy_test.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,104 +0,0 @@
-// -*- Mode: Go; indent-tabs-mode: t -*-
-
-/*
- * Copyright (C) 2018 Canonical Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-package xdgopenproxy_test
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/godbus/dbus"
-
-	. "gopkg.in/check.v1"
-
-	"github.com/snapcore/snapd/xdgopenproxy"
-)
-
-func Test(t *testing.T) { TestingT(t) }
-
-type xdgOpenSuite struct{}
-
-var _ = Suite(&xdgOpenSuite{})
-
-func (s *xdgOpenSuite) TestOpenURL(c *C) {
-	launcher := &fakeLauncher{}
-	c.Check(xdgopenproxy.LaunchWithOne(nil, launcher, "http://example.org"), IsNil)
-	c.Check(launcher.calls, DeepEquals, []string{
-		"OpenURI http://example.org",
-	})
-}
-
-func (s *xdgOpenSuite) TestOpenFile(c *C) {
-	launcher := &fakeLauncher{}
-	c.Check(xdgopenproxy.LaunchWithOne(nil, launcher, "/path/test.txt"), IsNil)
-	c.Check(launcher.calls, DeepEquals, []string{
-		"OpenFile /path/test.txt",
-	})
-}
-
-func (s *xdgOpenSuite) TestOpenFileURL(c *C) {
-	launcher := &fakeLauncher{}
-	c.Check(xdgopenproxy.LaunchWithOne(nil, launcher, "file:///path/test.txt"), IsNil)
-	c.Check(launcher.calls, DeepEquals, []string{
-		"OpenFile /path/test.txt",
-	})
-}
-
-func (s *xdgOpenSuite) TestStopOnFirstSuccess(c *C) {
-	l1 := &fakeLauncher{err: fmt.Errorf("failure one")}
-	l2 := &fakeLauncher{err: nil}
-	l3 := &fakeLauncher{err: nil}
-	launchers := []xdgopenproxy.DesktopLauncher{l1, l2, l3}
-
-	err := xdgopenproxy.Launch(nil, launchers, "http://example.org")
-	c.Check(err, IsNil)
-	c.Check(l1.calls, DeepEquals, []string{
-		"OpenURI http://example.org",
-	})
-	c.Check(l2.calls, DeepEquals, []string{
-		"OpenURI http://example.org",
-	})
-	c.Check(l3.calls, HasLen, 0)
-}
-
-func (s *xdgOpenSuite) TestStopOnResponseError(c *C) {
-	l1 := &fakeLauncher{err: fmt.Errorf("failure one")}
-	l2 := &fakeLauncher{err: xdgopenproxy.MakeResponseError("hello")}
-	l3 := &fakeLauncher{err: nil}
-	launchers := []xdgopenproxy.DesktopLauncher{l1, l2, l3}
-
-	err := xdgopenproxy.Launch(nil, launchers, "http://example.org")
-	c.Check(err, Equals, l2.err)
-	c.Check(l3.calls, HasLen, 0)
-}
-
-type fakeLauncher struct {
-	err   error
-	calls []string
-}
-
-func (l *fakeLauncher) OpenFile(bus *dbus.Conn, path string) error {
-	l.calls = append(l.calls, "OpenFile "+path)
-	return l.err
-}
-
-func (l *fakeLauncher) OpenURI(bus *dbus.Conn, uri string) error {
-	l.calls = append(l.calls, "OpenURI "+uri)
-	return l.err
-}